@stacksjs/ts-cloud 0.9.2 → 0.9.4

package/dist/bin/chunk-etrb03mt.js

@@ -0,0 +1,1507 @@
+import{kh as TE}from"./chunk-rxcvf10f.js";var X=["project:read","config:read","config:write","deployments:read","deployments:create","deployments:cancel","deployments:rollback","runtime:read","runtime:restart","runtime:logs","runtime:terminal","data:read","data:write","data:admin","backups:read","backups:create","backups:restore","secrets:read","secrets:write","fleet:read","fleet:manage","users:read","users:manage","users:transfer-ownership","audit:read","billing:read","billing:manage","security:read","security:manage","security:waive","sources:read","sources:manage","applications:read","applications:manage","automation:read","automation:manage","tags:manage"],Y=["project:read","config:read","deployments:read","runtime:read","runtime:logs","data:read","backups:read","security:read","sources:read","applications:read","billing:read"],_E={owner:new Set(X),admin:new Set(X.filter((E)=>E!=="users:transfer-ownership")),deployer:new Set([...Y,"deployments:create","deployments:cancel","deployments:rollback","sources:manage","applications:manage"]),operator:new Set([...Y,"runtime:restart","backups:create","security:manage","sources:manage","applications:manage"]),viewer:new Set(Y),auditor:new Set(["project:read","config:read","deployments:read","runtime:read","data:read","backups:read","audit:read","security:read","sources:read","applications:read"])};function u(E){return _E[E]}function x(E,T){if(E.type==="organization")return E.id===void 0||E.id===T.organizationId;if(!E.id)return!1;if(E.type==="project")return E.id===T.projectId;if(E.type==="environment")return E.id===T.environmentId;return E.id===T.resourceId}function V(E){let{membership:T,capability:N,target:e}=E;if(!T||T.status!=="active"||T.organizationId!==e.organizationId)return{allowed:!1,reason:"inactive-membership"};let L=E.grants.filter((s)=>s.organizationId===e.organizationId&&s.membershipId===T.id&&s.capability===N&&x(s.scope,e)),t=L.find((s)=>s.effect==="deny");if(t)return{allowed:!1,reason:"explicit-deny",inheritedFrom:{kind:"grant",id:t.id,scope:t.scope}};let _=L.find((s)=>s.effect==="allow");if(_)return{allowed:!0,reason:"explicit-allow",inheritedFrom:{kind:"grant",id:_.id,scope:_.scope}};if(!x(T.scope,e))return{allowed:!1,reason:"scope-mismatch"};if(u(T.roleTemplate).has(N))return{allowed:!0,reason:"role-template",inheritedFrom:{kind:"membership",id:T.id,scope:T.scope}};return{allowed:!1,reason:"missing-capability"}}function sE(E){return X.filter((T)=>V({...E,capability:T}).allowed)}import{createHash as g,randomBytes as dE}from"node:crypto";import{chmodSync as B,existsSync as w,mkdirSync as rE,statSync as nE}from"node:fs";import{dirname as EE}from"node:path";import{Database as oE}from"bun:sqlite";var C=40,G=[{version:1,name:"core_control_plane",sql:`
+      CREATE TABLE projects (
+        id TEXT PRIMARY KEY,
+        slug TEXT NOT NULL UNIQUE,
+        name TEXT NOT NULL,
+        description TEXT,
+        organization_id TEXT,
+        desired_config_hash TEXT,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE environments (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        slug TEXT NOT NULL,
+        name TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        region TEXT,
+        desired_state TEXT NOT NULL DEFAULT '{}',
+        discovered_state TEXT NOT NULL DEFAULT '{}',
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(project_id, slug)
+      ) STRICT;
+
+      CREATE TABLE resources (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        kind TEXT NOT NULL,
+        slug TEXT NOT NULL,
+        name TEXT NOT NULL,
+        provider TEXT,
+        provider_id TEXT,
+        desired_state TEXT NOT NULL DEFAULT '{}',
+        discovered_state TEXT NOT NULL DEFAULT '{}',
+        metadata TEXT NOT NULL DEFAULT '{}',
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(project_id, environment_id, kind, slug)
+      ) STRICT;
+
+      CREATE TABLE actors (
+        id TEXT PRIMARY KEY,
+        kind TEXT NOT NULL CHECK (kind IN ('user', 'service_account', 'system')),
+        external_id TEXT,
+        display_name TEXT NOT NULL,
+        metadata TEXT NOT NULL DEFAULT '{}',
+        disabled_at TEXT,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(kind, external_id)
+      ) STRICT;
+
+      CREATE TABLE operations (
+        id TEXT PRIMARY KEY,
+        project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+        environment_id TEXT REFERENCES environments(id) ON DELETE SET NULL,
+        resource_id TEXT REFERENCES resources(id) ON DELETE SET NULL,
+        actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        kind TEXT NOT NULL,
+        state TEXT NOT NULL CHECK (state IN ('queued', 'running', 'succeeded', 'failed', 'cancelled', 'timed_out')),
+        correlation_id TEXT NOT NULL,
+        idempotency_key TEXT UNIQUE,
+        input TEXT NOT NULL DEFAULT '{}',
+        output TEXT NOT NULL DEFAULT '{}',
+        error TEXT,
+        attempt INTEGER NOT NULL DEFAULT 0 CHECK (attempt >= 0),
+        priority INTEGER NOT NULL DEFAULT 0,
+        lease_owner TEXT,
+        lease_expires_at TEXT,
+        cancel_requested_at TEXT,
+        started_at TEXT,
+        finished_at TEXT,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE events (
+        sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+        id TEXT NOT NULL UNIQUE,
+        project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+        operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL,
+        resource_id TEXT REFERENCES resources(id) ON DELETE SET NULL,
+        actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        correlation_id TEXT NOT NULL,
+        type TEXT NOT NULL,
+        level TEXT NOT NULL CHECK (level IN ('debug', 'info', 'warning', 'error')),
+        payload TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE settings (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE schema_migrations (
+        version INTEGER PRIMARY KEY,
+        name TEXT NOT NULL,
+        applied_at TEXT NOT NULL
+      ) STRICT;
+    `},{version:2,name:"operations_and_event_indexes",sql:`
+      CREATE INDEX operations_queue_idx ON operations(state, priority DESC, created_at ASC);
+      CREATE INDEX operations_project_idx ON operations(project_id, created_at DESC);
+      CREATE INDEX operations_lease_idx ON operations(state, lease_expires_at);
+      CREATE INDEX operations_correlation_idx ON operations(correlation_id);
+      CREATE INDEX events_project_idx ON events(project_id, sequence DESC);
+      CREATE INDEX events_operation_idx ON events(operation_id, sequence ASC);
+      CREATE INDEX events_resource_idx ON events(resource_id, sequence DESC);
+      CREATE INDEX events_correlation_idx ON events(correlation_id, sequence ASC);
+      CREATE INDEX resources_environment_idx ON resources(environment_id, kind, slug);
+    `},{version:3,name:"resource_discovery_preferences",sql:`
+      CREATE TABLE tags (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        normalized_name TEXT NOT NULL,
+        color TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(project_id, normalized_name)
+      ) STRICT;
+
+      CREATE TABLE resource_tags (
+        resource_id TEXT NOT NULL REFERENCES resources(id) ON DELETE CASCADE,
+        tag_id TEXT NOT NULL REFERENCES tags(id) ON DELETE CASCADE,
+        created_at TEXT NOT NULL,
+        PRIMARY KEY(resource_id, tag_id)
+      ) STRICT;
+
+      CREATE TABLE saved_filters (
+        id TEXT PRIMARY KEY,
+        actor_key TEXT NOT NULL,
+        name TEXT NOT NULL,
+        route_id TEXT NOT NULL,
+        query TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(actor_key, name)
+      ) STRICT;
+
+      CREATE TABLE navigation_items (
+        actor_key TEXT NOT NULL,
+        entity_type TEXT NOT NULL,
+        entity_id TEXT NOT NULL,
+        favorite INTEGER NOT NULL DEFAULT 0 CHECK (favorite IN (0, 1)),
+        last_visited_at TEXT NOT NULL,
+        visit_count INTEGER NOT NULL DEFAULT 1 CHECK (visit_count > 0),
+        PRIMARY KEY(actor_key, entity_type, entity_id)
+      ) STRICT;
+
+      CREATE INDEX tags_project_idx ON tags(project_id, normalized_name);
+      CREATE INDEX resource_tags_tag_idx ON resource_tags(tag_id, resource_id);
+      CREATE INDEX saved_filters_actor_idx ON saved_filters(actor_key, updated_at DESC);
+      CREATE INDEX navigation_actor_idx ON navigation_items(actor_key, favorite DESC, last_visited_at DESC);
+    `},{version:4,name:"organizations_and_scoped_authorization",sql:`
+      CREATE TABLE organizations (
+        id TEXT PRIMARY KEY,
+        slug TEXT NOT NULL UNIQUE,
+        name TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+
+      ALTER TABLE events ADD COLUMN organization_id TEXT REFERENCES organizations(id) ON DELETE SET NULL;
+
+      CREATE TABLE organization_memberships (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        actor_id TEXT NOT NULL REFERENCES actors(id) ON DELETE CASCADE,
+        role_template TEXT NOT NULL CHECK (role_template IN ('owner', 'admin', 'deployer', 'operator', 'viewer', 'auditor')),
+        scope_type TEXT NOT NULL CHECK (scope_type IN ('organization', 'project', 'environment', 'resource')),
+        scope_id TEXT,
+        status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'revoked')),
+        session_version INTEGER NOT NULL DEFAULT 1 CHECK (session_version > 0),
+        last_active_at TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(organization_id, actor_id),
+        CHECK ((scope_type = 'organization' AND scope_id IS NULL) OR (scope_type != 'organization' AND scope_id IS NOT NULL))
+      ) STRICT;
+
+      CREATE TABLE organization_invitations (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        email TEXT NOT NULL,
+        role_template TEXT NOT NULL CHECK (role_template IN ('owner', 'admin', 'deployer', 'operator', 'viewer', 'auditor')),
+        scope_type TEXT NOT NULL CHECK (scope_type IN ('organization', 'project', 'environment', 'resource')),
+        scope_id TEXT,
+        token_hash TEXT NOT NULL UNIQUE,
+        invited_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        accepted_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        expires_at TEXT NOT NULL,
+        accepted_at TEXT,
+        revoked_at TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        CHECK ((scope_type = 'organization' AND scope_id IS NULL) OR (scope_type != 'organization' AND scope_id IS NOT NULL))
+      ) STRICT;
+
+      CREATE TABLE authorization_grants (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        membership_id TEXT NOT NULL REFERENCES organization_memberships(id) ON DELETE CASCADE,
+        effect TEXT NOT NULL CHECK (effect IN ('allow', 'deny')),
+        capability TEXT NOT NULL,
+        scope_type TEXT NOT NULL CHECK (scope_type IN ('organization', 'project', 'environment', 'resource')),
+        scope_id TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(membership_id, effect, capability, scope_type, scope_id),
+        CHECK ((scope_type = 'organization' AND scope_id IS NULL) OR (scope_type != 'organization' AND scope_id IS NOT NULL))
+      ) STRICT;
+
+      CREATE INDEX memberships_org_idx ON organization_memberships(organization_id, status, role_template);
+      CREATE INDEX memberships_actor_idx ON organization_memberships(actor_id, status);
+      CREATE INDEX invitations_org_idx ON organization_invitations(organization_id, accepted_at, revoked_at, expires_at);
+      CREATE INDEX grants_membership_idx ON authorization_grants(membership_id, capability, effect);
+      CREATE UNIQUE INDEX grants_unique_idx ON authorization_grants(membership_id, effect, capability, scope_type, COALESCE(scope_id, ''));
+      CREATE INDEX projects_organization_idx ON projects(organization_id, slug);
+      CREATE INDEX events_organization_idx ON events(organization_id, sequence DESC);
+    `},{version:5,name:"authorization_provenance",sql:`
+      ALTER TABLE organization_memberships ADD COLUMN source TEXT NOT NULL DEFAULT 'manual' CHECK (source IN ('manual', 'legacy', 'invitation'));
+      ALTER TABLE authorization_grants ADD COLUMN source TEXT NOT NULL DEFAULT 'manual' CHECK (source IN ('manual', 'legacy', 'invitation'));
+      CREATE INDEX grants_source_idx ON authorization_grants(membership_id, source);
+    `},{version:6,name:"durable_authentication",sql:`
+      CREATE TABLE auth_identities (
+        id TEXT PRIMARY KEY,
+        actor_id TEXT NOT NULL UNIQUE REFERENCES actors(id) ON DELETE CASCADE,
+        username TEXT NOT NULL COLLATE NOCASE UNIQUE,
+        email TEXT COLLATE NOCASE UNIQUE,
+        email_verified_at TEXT,
+        password_hash TEXT NOT NULL,
+        credential_version INTEGER NOT NULL DEFAULT 1 CHECK (credential_version > 0),
+        requires_password_upgrade INTEGER NOT NULL DEFAULT 0 CHECK (requires_password_upgrade IN (0, 1)),
+        disabled_at TEXT,
+        last_login_at TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE auth_action_tokens (
+        id TEXT PRIMARY KEY,
+        identity_id TEXT NOT NULL REFERENCES auth_identities(id) ON DELETE CASCADE,
+        type TEXT NOT NULL CHECK (type IN ('activation', 'password_reset', 'email_verification')),
+        token_hash TEXT NOT NULL UNIQUE,
+        metadata TEXT NOT NULL DEFAULT '{}',
+        expires_at TEXT NOT NULL,
+        consumed_at TEXT,
+        created_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE auth_sessions (
+        id TEXT PRIMARY KEY,
+        identity_id TEXT NOT NULL REFERENCES auth_identities(id) ON DELETE CASCADE,
+        token_hash TEXT NOT NULL UNIQUE,
+        credential_version INTEGER NOT NULL CHECK (credential_version > 0),
+        auth_method TEXT NOT NULL CHECK (auth_method IN ('local', 'oidc')),
+        user_agent TEXT,
+        network_hint TEXT,
+        created_at TEXT NOT NULL,
+        last_used_at TEXT NOT NULL,
+        idle_expires_at TEXT NOT NULL,
+        absolute_expires_at TEXT NOT NULL,
+        recent_auth_at TEXT NOT NULL,
+        mfa_at TEXT,
+        revoked_at TEXT
+      ) STRICT;
+
+      CREATE INDEX auth_identities_email_idx ON auth_identities(email);
+      CREATE INDEX auth_action_tokens_identity_idx ON auth_action_tokens(identity_id, type, created_at DESC);
+      CREATE INDEX auth_action_tokens_expiry_idx ON auth_action_tokens(expires_at, consumed_at);
+      CREATE INDEX auth_sessions_identity_idx ON auth_sessions(identity_id, revoked_at, last_used_at DESC);
+      CREATE INDEX auth_sessions_expiry_idx ON auth_sessions(idle_expires_at, absolute_expires_at, revoked_at);
+    `},{version:7,name:"multi_factor_authentication",sql:`
+      CREATE TABLE auth_mfa_factors (
+        id TEXT PRIMARY KEY,
+        identity_id TEXT NOT NULL UNIQUE REFERENCES auth_identities(id) ON DELETE CASCADE,
+        type TEXT NOT NULL DEFAULT 'totp' CHECK (type = 'totp'),
+        label TEXT NOT NULL,
+        secret_ciphertext TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        verified_at TEXT,
+        disabled_at TEXT,
+        last_used_step INTEGER
+      ) STRICT;
+
+      CREATE TABLE auth_recovery_codes (
+        id TEXT PRIMARY KEY,
+        identity_id TEXT NOT NULL REFERENCES auth_identities(id) ON DELETE CASCADE,
+        code_hash TEXT NOT NULL UNIQUE,
+        created_at TEXT NOT NULL,
+        consumed_at TEXT
+      ) STRICT;
+
+      CREATE TABLE auth_mfa_challenges (
+        id TEXT PRIMARY KEY,
+        identity_id TEXT NOT NULL REFERENCES auth_identities(id) ON DELETE CASCADE,
+        purpose TEXT NOT NULL CHECK (purpose IN ('login', 'step_up')),
+        token_hash TEXT NOT NULL UNIQUE,
+        attempts INTEGER NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+        expires_at TEXT NOT NULL,
+        consumed_at TEXT,
+        created_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE INDEX auth_recovery_codes_identity_idx ON auth_recovery_codes(identity_id, consumed_at);
+      CREATE INDEX auth_mfa_challenges_identity_idx ON auth_mfa_challenges(identity_id, purpose, expires_at);
+      CREATE INDEX auth_mfa_challenges_expiry_idx ON auth_mfa_challenges(expires_at, consumed_at);
+    `},{version:8,name:"openid_connect_authentication",sql:`
+      CREATE TABLE auth_oidc_providers (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        slug TEXT NOT NULL COLLATE NOCASE UNIQUE,
+        name TEXT NOT NULL,
+        issuer TEXT NOT NULL UNIQUE,
+        client_id TEXT NOT NULL,
+        client_secret_ciphertext TEXT,
+        scopes TEXT NOT NULL DEFAULT '["openid","email","profile"]',
+        allowed_domains TEXT NOT NULL,
+        default_role TEXT NOT NULL DEFAULT 'viewer' CHECK (default_role IN ('admin', 'deployer', 'operator', 'viewer', 'auditor')),
+        enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+        enforce_sso INTEGER NOT NULL DEFAULT 0 CHECK (enforce_sso IN (0, 1)),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE auth_oidc_subjects (
+        id TEXT PRIMARY KEY,
+        provider_id TEXT NOT NULL REFERENCES auth_oidc_providers(id) ON DELETE CASCADE,
+        identity_id TEXT NOT NULL REFERENCES auth_identities(id) ON DELETE CASCADE,
+        subject TEXT NOT NULL,
+        email TEXT NOT NULL COLLATE NOCASE,
+        linked_at TEXT NOT NULL,
+        last_login_at TEXT NOT NULL,
+        UNIQUE(provider_id, subject),
+        UNIQUE(provider_id, identity_id)
+      ) STRICT;
+
+      CREATE TABLE auth_oidc_transactions (
+        id TEXT PRIMARY KEY,
+        provider_id TEXT NOT NULL REFERENCES auth_oidc_providers(id) ON DELETE CASCADE,
+        state_hash TEXT NOT NULL UNIQUE,
+        nonce_ciphertext TEXT NOT NULL,
+        verifier_ciphertext TEXT NOT NULL,
+        redirect_uri TEXT NOT NULL,
+        return_path TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        consumed_at TEXT,
+        created_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE INDEX auth_oidc_providers_org_idx ON auth_oidc_providers(organization_id, enabled, name);
+      CREATE INDEX auth_oidc_subjects_identity_idx ON auth_oidc_subjects(identity_id, provider_id);
+      CREATE INDEX auth_oidc_transactions_expiry_idx ON auth_oidc_transactions(expires_at, consumed_at);
+    `},{version:9,name:"service_accounts_and_api_tokens",sql:`
+      CREATE TABLE service_accounts (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        actor_id TEXT NOT NULL UNIQUE REFERENCES actors(id) ON DELETE CASCADE,
+        slug TEXT NOT NULL COLLATE NOCASE,
+        name TEXT NOT NULL,
+        description TEXT,
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        disabled_at TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(organization_id, slug)
+      ) STRICT;
+
+      CREATE TABLE api_tokens (
+        id TEXT PRIMARY KEY,
+        service_account_id TEXT NOT NULL REFERENCES service_accounts(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        token_hash TEXT NOT NULL UNIQUE,
+        token_prefix TEXT NOT NULL UNIQUE,
+        capabilities TEXT NOT NULL,
+        scope_type TEXT NOT NULL CHECK (scope_type IN ('organization', 'project', 'environment', 'resource')),
+        scope_id TEXT,
+        expires_at TEXT NOT NULL,
+        last_used_at TEXT,
+        last_network_hint TEXT,
+        revoked_at TEXT,
+        rotated_from_token_id TEXT REFERENCES api_tokens(id) ON DELETE SET NULL,
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        CHECK ((scope_type = 'organization' AND scope_id IS NULL) OR (scope_type != 'organization' AND scope_id IS NOT NULL))
+      ) STRICT;
+
+      CREATE TABLE api_idempotency_records (
+        id TEXT PRIMARY KEY,
+        token_id TEXT NOT NULL REFERENCES api_tokens(id) ON DELETE CASCADE,
+        idempotency_key TEXT NOT NULL,
+        request_hash TEXT NOT NULL,
+        operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL,
+        response_status INTEGER NOT NULL,
+        response_body TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        UNIQUE(token_id, idempotency_key)
+      ) STRICT;
+
+      CREATE INDEX service_accounts_org_idx ON service_accounts(organization_id, disabled_at, name);
+      CREATE INDEX api_tokens_account_idx ON api_tokens(service_account_id, revoked_at, expires_at);
+      CREATE INDEX api_tokens_expiry_idx ON api_tokens(expires_at, revoked_at);
+      CREATE INDEX api_idempotency_expiry_idx ON api_idempotency_records(expires_at);
+    `},{version:10,name:"security_posture_and_deploy_policy",sql:`
+      CREATE TABLE security_scan_runs (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE,
+        release_id TEXT,
+        scanner_id TEXT NOT NULL,
+        scanner_version TEXT NOT NULL,
+        status TEXT NOT NULL CHECK (status IN ('passed', 'failed', 'skipped', 'unavailable', 'unsupported', 'stale')),
+        error TEXT,
+        metadata TEXT NOT NULL DEFAULT '{}',
+        findings_count INTEGER NOT NULL DEFAULT 0 CHECK (findings_count >= 0),
+        started_at TEXT NOT NULL,
+        completed_at TEXT NOT NULL,
+        duration_ms INTEGER NOT NULL CHECK (duration_ms >= 0)
+      ) STRICT;
+
+      CREATE TABLE security_findings (
+        id TEXT PRIMARY KEY,
+        fingerprint TEXT NOT NULL UNIQUE,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE,
+        release_id TEXT,
+        scan_run_id TEXT NOT NULL REFERENCES security_scan_runs(id) ON DELETE CASCADE,
+        scanner_id TEXT NOT NULL,
+        scanner_version TEXT NOT NULL,
+        rule_id TEXT NOT NULL,
+        severity TEXT NOT NULL CHECK (severity IN ('info', 'low', 'medium', 'high', 'critical')),
+        title TEXT NOT NULL,
+        description TEXT NOT NULL,
+        evidence TEXT NOT NULL DEFAULT '{}',
+        remediation TEXT,
+        subject TEXT NOT NULL,
+        status TEXT NOT NULL CHECK (status IN ('open', 'acknowledged', 'resolved', 'waived')),
+        owner_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        recurrence_count INTEGER NOT NULL DEFAULT 0 CHECK (recurrence_count >= 0),
+        first_seen_at TEXT NOT NULL,
+        last_seen_at TEXT NOT NULL,
+        resolved_at TEXT,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE security_policies (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        rules TEXT NOT NULL,
+        scanner_fail_mode TEXT NOT NULL CHECK (scanner_fail_mode IN ('open', 'closed')),
+        enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(organization_id, environment_id, name)
+      ) STRICT;
+
+      CREATE TABLE security_waivers (
+        id TEXT PRIMARY KEY,
+        finding_id TEXT NOT NULL REFERENCES security_findings(id) ON DELETE CASCADE,
+        policy_id TEXT REFERENCES security_policies(id) ON DELETE SET NULL,
+        reason TEXT NOT NULL,
+        reference_url TEXT,
+        created_by_actor_id TEXT NOT NULL REFERENCES actors(id) ON DELETE RESTRICT,
+        expires_at TEXT NOT NULL,
+        revoked_at TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE security_finding_comments (
+        id TEXT PRIMARY KEY,
+        finding_id TEXT NOT NULL REFERENCES security_findings(id) ON DELETE CASCADE,
+        actor_id TEXT NOT NULL REFERENCES actors(id) ON DELETE RESTRICT,
+        body TEXT NOT NULL,
+        reference_url TEXT,
+        created_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE release_security_artifacts (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        release_id TEXT NOT NULL,
+        kind TEXT NOT NULL CHECK (kind IN ('sbom', 'vulnerability_summary', 'signature', 'provenance')),
+        format TEXT NOT NULL,
+        digest TEXT NOT NULL,
+        summary TEXT NOT NULL DEFAULT '{}',
+        content TEXT,
+        sensitive INTEGER NOT NULL DEFAULT 1 CHECK (sensitive IN (0, 1)),
+        created_at TEXT NOT NULL,
+        UNIQUE(release_id, kind, digest)
+      ) STRICT;
+
+      CREATE TABLE security_deploy_decisions (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
+        operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL,
+        policy_id TEXT NOT NULL REFERENCES security_policies(id) ON DELETE RESTRICT,
+        policy_version INTEGER NOT NULL CHECK (policy_version > 0),
+        outcome TEXT NOT NULL CHECK (outcome IN ('allow', 'warn', 'block')),
+        scanner_versions TEXT NOT NULL,
+        finding_ids TEXT NOT NULL,
+        waiver_ids TEXT NOT NULL,
+        explanation TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE INDEX security_scan_scope_idx ON security_scan_runs(organization_id, project_id, environment_id, completed_at DESC);
+      CREATE INDEX security_scan_scanner_idx ON security_scan_runs(scanner_id, completed_at DESC);
+      CREATE INDEX security_findings_scope_idx ON security_findings(organization_id, project_id, environment_id, status, severity);
+      CREATE INDEX security_findings_scanner_idx ON security_findings(scanner_id, rule_id, last_seen_at DESC);
+      CREATE INDEX security_waivers_finding_idx ON security_waivers(finding_id, expires_at, revoked_at);
+      CREATE INDEX security_comments_finding_idx ON security_finding_comments(finding_id, created_at);
+      CREATE INDEX release_security_artifacts_release_idx ON release_security_artifacts(release_id, kind);
+      CREATE INDEX security_decisions_environment_idx ON security_deploy_decisions(environment_id, created_at DESC);
+    `},{version:11,name:"required_security_scanners",sql:`
+      ALTER TABLE security_policies ADD COLUMN required_scanners TEXT NOT NULL DEFAULT '[]';
+    `},{version:12,name:"git_source_connections",sql:`
+      CREATE TABLE source_connections (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        provider TEXT NOT NULL CHECK (provider IN ('github', 'gitlab', 'bitbucket', 'gitea', 'generic_https', 'generic_ssh')),
+        name TEXT NOT NULL,
+        host TEXT NOT NULL,
+        owner TEXT,
+        auth_kind TEXT NOT NULL CHECK (auth_kind IN ('app', 'oauth_token', 'access_token', 'deploy_key', 'none')),
+        credential_ciphertext TEXT,
+        credential_fingerprint TEXT,
+        granted_scopes TEXT NOT NULL DEFAULT '[]',
+        capabilities TEXT NOT NULL DEFAULT '{}',
+        status TEXT NOT NULL CHECK (status IN ('pending', 'healthy', 'degraded', 'expired', 'disconnected')),
+        health_message TEXT,
+        last_tested_at TEXT,
+        last_synced_at TEXT,
+        credential_expires_at TEXT,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(organization_id, name)
+      ) STRICT;
+
+      CREATE TABLE source_repositories (
+        id TEXT PRIMARY KEY,
+        connection_id TEXT NOT NULL REFERENCES source_connections(id) ON DELETE CASCADE,
+        provider_repository_id TEXT NOT NULL,
+        full_name TEXT NOT NULL,
+        clone_url TEXT NOT NULL,
+        default_branch TEXT NOT NULL,
+        visibility TEXT NOT NULL CHECK (visibility IN ('public', 'private', 'internal', 'unknown')),
+        archived INTEGER NOT NULL DEFAULT 0 CHECK (archived IN (0, 1)),
+        metadata TEXT NOT NULL DEFAULT '{}',
+        synced_at TEXT NOT NULL,
+        UNIQUE(connection_id, provider_repository_id),
+        UNIQUE(connection_id, full_name)
+      ) STRICT;
+
+      CREATE TABLE source_deploy_keys (
+        id TEXT PRIMARY KEY,
+        connection_id TEXT NOT NULL REFERENCES source_connections(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        public_key TEXT NOT NULL,
+        public_key_fingerprint TEXT NOT NULL,
+        private_key_ciphertext TEXT NOT NULL,
+        host TEXT NOT NULL,
+        host_key TEXT NOT NULL,
+        host_key_fingerprint TEXT NOT NULL,
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(connection_id, name),
+        UNIQUE(connection_id, public_key_fingerprint)
+      ) STRICT;
+
+      CREATE TABLE source_bindings (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE,
+        connection_id TEXT NOT NULL REFERENCES source_connections(id) ON DELETE RESTRICT,
+        repository_id TEXT REFERENCES source_repositories(id) ON DELETE SET NULL,
+        repository_full_name TEXT NOT NULL,
+        default_branch TEXT NOT NULL,
+        branch_rule TEXT,
+        tag_rule TEXT,
+        monorepo_root TEXT NOT NULL DEFAULT '.',
+        include_paths TEXT NOT NULL DEFAULT '[]',
+        exclude_paths TEXT NOT NULL DEFAULT '[]',
+        submodules INTEGER NOT NULL DEFAULT 0 CHECK (submodules IN (0, 1)),
+        clone_depth INTEGER CHECK (clone_depth IS NULL OR clone_depth > 0),
+        deploy_key_id TEXT REFERENCES source_deploy_keys(id) ON DELETE SET NULL,
+        auto_deploy INTEGER NOT NULL DEFAULT 1 CHECK (auto_deploy IN (0, 1)),
+        pull_request_previews INTEGER NOT NULL DEFAULT 1 CHECK (pull_request_previews IN (0, 1)),
+        status TEXT NOT NULL CHECK (status IN ('active', 'disabled')),
+        disabled_reason TEXT,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(project_id, environment_id, resource_id)
+      ) STRICT;
+
+      CREATE TABLE source_webhooks (
+        id TEXT PRIMARY KEY,
+        connection_id TEXT NOT NULL REFERENCES source_connections(id) ON DELETE CASCADE,
+        repository_id TEXT REFERENCES source_repositories(id) ON DELETE SET NULL,
+        repository_full_name TEXT NOT NULL,
+        provider_webhook_id TEXT,
+        endpoint_token_hash TEXT NOT NULL UNIQUE,
+        secret_ciphertext TEXT NOT NULL,
+        events TEXT NOT NULL,
+        status TEXT NOT NULL CHECK (status IN ('pending', 'healthy', 'degraded', 'disabled')),
+        health_message TEXT,
+        last_delivery_at TEXT,
+        last_reconciled_at TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(connection_id, repository_full_name)
+      ) STRICT;
+
+      CREATE TABLE source_webhook_deliveries (
+        id TEXT PRIMARY KEY,
+        connection_id TEXT NOT NULL REFERENCES source_connections(id) ON DELETE CASCADE,
+        webhook_id TEXT NOT NULL REFERENCES source_webhooks(id) ON DELETE CASCADE,
+        provider_delivery_id TEXT NOT NULL,
+        event TEXT NOT NULL,
+        action TEXT,
+        commit_sha TEXT,
+        signature_status TEXT NOT NULL CHECK (signature_status IN ('verified', 'invalid', 'missing')),
+        status TEXT NOT NULL CHECK (status IN ('accepted', 'ignored', 'rejected', 'duplicate', 'enqueued', 'failed')),
+        payload_summary TEXT NOT NULL DEFAULT '{}',
+        operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL,
+        error TEXT,
+        received_at TEXT NOT NULL,
+        processed_at TEXT,
+        UNIQUE(connection_id, provider_delivery_id)
+      ) STRICT;
+
+      CREATE INDEX source_connections_org_idx ON source_connections(organization_id, status, provider, name);
+      CREATE INDEX source_repositories_connection_idx ON source_repositories(connection_id, full_name);
+      CREATE INDEX source_bindings_connection_idx ON source_bindings(connection_id, status);
+      CREATE INDEX source_bindings_repository_idx ON source_bindings(connection_id, repository_full_name, status);
+      CREATE INDEX source_webhooks_connection_idx ON source_webhooks(connection_id, status);
+      CREATE INDEX source_deliveries_webhook_idx ON source_webhook_deliveries(webhook_id, received_at DESC);
+    `},{version:13,name:"encrypted_source_webhook_endpoint_tokens",sql:`
+      ALTER TABLE source_webhooks ADD COLUMN endpoint_token_ciphertext TEXT;
+    `},{version:14,name:"application_onboarding_drafts",sql:`
+      CREATE TABLE application_drafts (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        schema_version INTEGER NOT NULL,
+        name TEXT NOT NULL,
+        step TEXT NOT NULL,
+        input TEXT NOT NULL,
+        supplied_secret_names TEXT NOT NULL DEFAULT '[]',
+        status TEXT NOT NULL DEFAULT 'draft',
+        version INTEGER NOT NULL DEFAULT 1,
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+      CREATE INDEX application_drafts_project_idx ON application_drafts(project_id, updated_at DESC);
+    `},{version:15,name:"encrypted_container_registry_connections",sql:`
+      CREATE TABLE registry_connections (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        provider TEXT NOT NULL,
+        name TEXT NOT NULL,
+        host TEXT NOT NULL,
+        credential_ciphertext TEXT,
+        credential_fingerprint TEXT,
+        credential_expires_at TEXT,
+        status TEXT NOT NULL DEFAULT 'pending',
+        health_message TEXT,
+        last_tested_at TEXT,
+        version INTEGER NOT NULL DEFAULT 1,
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(organization_id, name)
+      );
+      CREATE INDEX registry_connections_org_idx ON registry_connections(organization_id, status, name);
+    `},{version:16,name:"inspected_application_artifacts",sql:`
+      CREATE TABLE application_artifacts (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        filename TEXT NOT NULL,
+        storage_path TEXT NOT NULL,
+        sha256 TEXT NOT NULL,
+        size INTEGER NOT NULL,
+        format TEXT NOT NULL,
+        entry_count INTEGER NOT NULL,
+        expanded_bytes INTEGER NOT NULL,
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        created_at TEXT NOT NULL,
+        UNIQUE(project_id, sha256)
+      );
+      CREATE INDEX application_artifacts_project_idx ON application_artifacts(project_id, created_at DESC);
+    `},{version:17,name:"durable_operation_queue",sql:`
+      CREATE TABLE operation_jobs (
+        operation_id TEXT PRIMARY KEY REFERENCES operations(id) ON DELETE CASCADE,
+        lock_key TEXT,
+        provider_key TEXT,
+        build_slot INTEGER NOT NULL DEFAULT 0 CHECK (build_slot IN (0, 1)),
+        max_attempts INTEGER NOT NULL DEFAULT 1 CHECK (max_attempts > 0),
+        available_at TEXT NOT NULL,
+        timeout_seconds INTEGER NOT NULL DEFAULT 1800 CHECK (timeout_seconds > 0),
+        heartbeat_at TEXT,
+        current_step TEXT,
+        blocked_reason TEXT,
+        retry_classes TEXT NOT NULL DEFAULT '[]',
+        resume_policy TEXT NOT NULL DEFAULT 'fail' CHECK (resume_policy IN ('fail', 'requeue')),
+        cancellation_mode TEXT NOT NULL DEFAULT 'cooperative' CHECK (cancellation_mode IN ('cooperative', 'provider_non_cancellable')),
+        retention_until TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE operation_logs (
+        sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+        id TEXT NOT NULL UNIQUE,
+        operation_id TEXT NOT NULL REFERENCES operations(id) ON DELETE CASCADE,
+        stream TEXT NOT NULL CHECK (stream IN ('stdout', 'stderr', 'system', 'step')),
+        step TEXT,
+        message TEXT NOT NULL,
+        redacted INTEGER NOT NULL DEFAULT 0 CHECK (redacted IN (0, 1)),
+        truncated INTEGER NOT NULL DEFAULT 0 CHECK (truncated IN (0, 1)),
+        created_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE TABLE operation_locks (
+        lock_key TEXT PRIMARY KEY,
+        operation_id TEXT NOT NULL UNIQUE REFERENCES operations(id) ON DELETE CASCADE,
+        lease_owner TEXT NOT NULL,
+        lease_expires_at TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+
+      CREATE INDEX operation_jobs_available_idx ON operation_jobs(available_at, operation_id);
+      CREATE INDEX operation_jobs_provider_idx ON operation_jobs(provider_key, build_slot, operation_id);
+      CREATE INDEX operation_jobs_retention_idx ON operation_jobs(retention_until);
+      CREATE INDEX operation_logs_operation_idx ON operation_logs(operation_id, sequence);
+      CREATE INDEX operation_locks_expiry_idx ON operation_locks(lease_expires_at);
+    `},{version:18,name:"preview_environments",sql:`
+      CREATE TABLE preview_definitions (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        resource_id TEXT NOT NULL REFERENCES resources(id) ON DELETE CASCADE,
+        base_environment_id TEXT NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
+        enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+        branch_rule TEXT,
+        domain_pattern TEXT NOT NULL,
+        ttl_hours INTEGER NOT NULL DEFAULT 24 CHECK (ttl_hours BETWEEN 1 AND 720),
+        keep_count INTEGER NOT NULL DEFAULT 10 CHECK (keep_count BETWEEN 1 AND 100),
+        public_access INTEGER NOT NULL DEFAULT 0 CHECK (public_access IN (0, 1)),
+        authentication_required INTEGER NOT NULL DEFAULT 1 CHECK (authentication_required IN (0, 1)),
+        allow_forks INTEGER NOT NULL DEFAULT 0 CHECK (allow_forks IN (0, 1)),
+        inherited_secrets TEXT NOT NULL DEFAULT '[]',
+        resource_overrides TEXT NOT NULL DEFAULT '{}',
+        database_strategy TEXT NOT NULL DEFAULT 'disabled' CHECK (database_strategy IN ('disabled', 'isolated', 'snapshot', 'shared_read_only')),
+        max_monthly_cost REAL NOT NULL DEFAULT 25 CHECK (max_monthly_cost >= 0),
+        max_cpu REAL NOT NULL DEFAULT 1 CHECK (max_cpu > 0),
+        max_memory_mb INTEGER NOT NULL DEFAULT 1024 CHECK (max_memory_mb > 0),
+        cleanup_on_close INTEGER NOT NULL DEFAULT 1 CHECK (cleanup_on_close IN (0, 1)),
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(project_id, resource_id)
+      ) STRICT;
+
+      CREATE TABLE preview_instances (
+        id TEXT PRIMARY KEY,
+        definition_id TEXT NOT NULL REFERENCES preview_definitions(id) ON DELETE CASCADE,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        resource_id TEXT NOT NULL REFERENCES resources(id) ON DELETE CASCADE,
+        base_environment_id TEXT NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
+        identity_key TEXT NOT NULL,
+        source_provider TEXT,
+        repository TEXT,
+        branch TEXT NOT NULL,
+        pull_request_number INTEGER,
+        fork INTEGER NOT NULL DEFAULT 0 CHECK (fork IN (0, 1)),
+        commit_sha TEXT NOT NULL,
+        name TEXT NOT NULL,
+        stack_name TEXT NOT NULL,
+        url TEXT,
+        status TEXT NOT NULL CHECK (status IN ('queued', 'deploying', 'active', 'updating', 'destroying', 'destroyed', 'failed', 'cleanup_failed')),
+        expires_at TEXT NOT NULL,
+        latest_operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL,
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        cost_estimate REAL,
+        desired_state TEXT NOT NULL DEFAULT '{}',
+        observed_state TEXT NOT NULL DEFAULT '{}',
+        teardown_error TEXT,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        destroyed_at TEXT,
+        UNIQUE(definition_id, identity_key),
+        UNIQUE(project_id, name),
+        UNIQUE(project_id, stack_name)
+      ) STRICT;
+
+      CREATE TABLE preview_resources (
+        id TEXT PRIMARY KEY,
+        preview_id TEXT NOT NULL REFERENCES preview_instances(id) ON DELETE CASCADE,
+        provider TEXT NOT NULL,
+        provider_resource_id TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        tags TEXT NOT NULL,
+        observed_state TEXT NOT NULL DEFAULT '{}',
+        discovered_at TEXT NOT NULL,
+        deleted_at TEXT,
+        UNIQUE(preview_id, provider, provider_resource_id)
+      ) STRICT;
+
+      CREATE INDEX preview_definitions_project_idx ON preview_definitions(project_id, enabled, resource_id);
+      CREATE INDEX preview_instances_project_idx ON preview_instances(project_id, status, expires_at);
+      CREATE INDEX preview_instances_pr_idx ON preview_instances(repository, pull_request_number, status);
+      CREATE INDEX preview_instances_expiry_idx ON preview_instances(expires_at, status);
+      CREATE INDEX preview_resources_preview_idx ON preview_resources(preview_id, deleted_at);
+      CREATE INDEX preview_resources_provider_idx ON preview_resources(provider, provider_resource_id);
+    `},{version:19,name:"compose_applications",sql:`
+      CREATE TABLE compose_applications (
+        id TEXT PRIMARY KEY,
+        resource_id TEXT NOT NULL UNIQUE REFERENCES resources(id) ON DELETE CASCADE,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        slug TEXT NOT NULL,
+        status TEXT NOT NULL CHECK (status IN ('draft', 'ready', 'deploying', 'running', 'stopped', 'degraded', 'failed', 'deleting', 'deleted')),
+        source_kind TEXT NOT NULL CHECK (source_kind IN ('compose', 'template')),
+        source_hash TEXT NOT NULL,
+        redacted_source TEXT NOT NULL,
+        manifest TEXT NOT NULL,
+        diagnostics TEXT NOT NULL DEFAULT '[]',
+        template_id TEXT,
+        template_version TEXT,
+        latest_operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL,
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        deleted_at TEXT,
+        UNIQUE(project_id, environment_id, slug)
+      ) STRICT;
+
+      CREATE TABLE compose_service_states (
+        application_id TEXT NOT NULL REFERENCES compose_applications(id) ON DELETE CASCADE,
+        service_name TEXT NOT NULL,
+        status TEXT NOT NULL CHECK (status IN ('pending', 'starting', 'running', 'stopped', 'unhealthy', 'failed', 'unknown')),
+        replicas INTEGER NOT NULL DEFAULT 0 CHECK (replicas >= 0),
+        healthy_replicas INTEGER NOT NULL DEFAULT 0 CHECK (healthy_replicas >= 0),
+        latest_operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL,
+        observed_state TEXT NOT NULL DEFAULT '{}',
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY(application_id, service_name)
+      ) STRICT;
+
+      CREATE INDEX compose_applications_scope_idx ON compose_applications(project_id, environment_id, status, updated_at);
+      CREATE INDEX compose_service_states_status_idx ON compose_service_states(application_id, status, service_name);
+    `},{version:20,name:"unified_releases",sql:`
+      CREATE TABLE release_artifacts (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, digest TEXT NOT NULL, kind TEXT NOT NULL CHECK (kind IN ('static','compute','serverless_zip','serverless_image','container','compose')), uri TEXT NOT NULL, size INTEGER NOT NULL CHECK (size >= 0), media_type TEXT NOT NULL, provenance TEXT NOT NULL DEFAULT '{}', attestation TEXT NOT NULL DEFAULT '{}', verified_at TEXT NOT NULL, created_at TEXT NOT NULL, UNIQUE(organization_id, digest));
+      CREATE TABLE releases (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT NOT NULL REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT NOT NULL REFERENCES resources(id) ON DELETE CASCADE, artifact_id TEXT NOT NULL REFERENCES release_artifacts(id) ON DELETE RESTRICT, kind TEXT NOT NULL CHECK (kind IN ('static','compute','serverless_zip','serverless_image','container','compose')), source_sha TEXT, config_hash TEXT NOT NULL, manifest TEXT NOT NULL, provenance TEXT NOT NULL DEFAULT '{}', strategy TEXT NOT NULL CHECK (strategy IN ('atomic','rolling','blue_green','canary')), status TEXT NOT NULL CHECK (status IN ('built','awaiting_approval','activating','active','failed','rolled_back','superseded')), health_gate TEXT, hooks TEXT NOT NULL DEFAULT '{}', drain_seconds INTEGER NOT NULL DEFAULT 30, grace_seconds INTEGER NOT NULL DEFAULT 30, automatic_rollback INTEGER NOT NULL DEFAULT 1 CHECK (automatic_rollback IN (0,1)), rollback_attempts INTEGER NOT NULL DEFAULT 0, previous_release_id TEXT REFERENCES releases(id) ON DELETE SET NULL, promoted_from_release_id TEXT REFERENCES releases(id) ON DELETE SET NULL, actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL, trigger TEXT NOT NULL, pinned INTEGER NOT NULL DEFAULT 0 CHECK (pinned IN (0,1)), pin_reason TEXT, activated_at TEXT, failed_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
+      CREATE TABLE release_transitions (sequence INTEGER PRIMARY KEY AUTOINCREMENT, id TEXT NOT NULL UNIQUE, release_id TEXT NOT NULL REFERENCES releases(id) ON DELETE CASCADE, from_status TEXT, to_status TEXT NOT NULL, traffic_percent REAL, health TEXT NOT NULL DEFAULT '{}', message TEXT NOT NULL, operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL, created_at TEXT NOT NULL);
+      CREATE TABLE release_approvals (id TEXT PRIMARY KEY, release_id TEXT NOT NULL REFERENCES releases(id) ON DELETE CASCADE, environment_id TEXT NOT NULL REFERENCES environments(id) ON DELETE CASCADE, decision TEXT NOT NULL CHECK (decision IN ('approved','rejected')), actor_id TEXT NOT NULL REFERENCES actors(id) ON DELETE RESTRICT, comment TEXT, created_at TEXT NOT NULL);
+      CREATE INDEX releases_scope_idx ON releases(project_id, environment_id, resource_id, created_at DESC);
+      CREATE INDEX releases_active_idx ON releases(resource_id, status, activated_at DESC);
+      CREATE INDEX releases_artifact_idx ON releases(artifact_id, status);
+      CREATE INDEX release_transitions_release_idx ON release_transitions(release_id, sequence);
+    `},{version:21,name:"normalized_telemetry",sql:`
+      CREATE TABLE telemetry_records (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE,
+        kind TEXT NOT NULL CHECK (kind IN ('metric','log','trace','request','event')),
+        source TEXT NOT NULL,
+        name TEXT NOT NULL,
+        timestamp TEXT NOT NULL,
+        observed_at TEXT NOT NULL,
+        value REAL,
+        unit TEXT,
+        level TEXT,
+        message TEXT,
+        duration_ms REAL,
+        status_code INTEGER,
+        method TEXT,
+        host TEXT,
+        path_template TEXT,
+        bytes_in INTEGER,
+        bytes_out INTEGER,
+        region TEXT,
+        cache_result TEXT,
+        upstream TEXT,
+        trace_id TEXT,
+        request_id TEXT,
+        deployment_id TEXT,
+        release_id TEXT,
+        workload_id TEXT,
+        sampled INTEGER NOT NULL DEFAULT 1 CHECK (sampled IN (0,1)),
+        attributes TEXT NOT NULL DEFAULT '{}',
+        ingested_bytes INTEGER NOT NULL DEFAULT 0 CHECK (ingested_bytes >= 0)
+      ) STRICT;
+      CREATE INDEX telemetry_scope_time_idx ON telemetry_records(project_id, environment_id, timestamp DESC, id DESC);
+      CREATE INDEX telemetry_resource_time_idx ON telemetry_records(resource_id, timestamp DESC, id DESC);
+      CREATE INDEX telemetry_kind_name_time_idx ON telemetry_records(kind, name, timestamp DESC);
+      CREATE INDEX telemetry_trace_idx ON telemetry_records(trace_id, timestamp ASC);
+      CREATE INDEX telemetry_request_idx ON telemetry_records(request_id, timestamp ASC);
+      CREATE INDEX telemetry_release_idx ON telemetry_records(release_id, timestamp DESC);
+
+      CREATE TABLE telemetry_saved_queries (
+        id TEXT PRIMARY KEY,
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        actor_id TEXT REFERENCES actors(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        query TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(project_id, actor_id, name)
+      ) STRICT;
+      CREATE INDEX telemetry_saved_queries_actor_idx ON telemetry_saved_queries(project_id, actor_id, updated_at DESC);
+    `},{version:22,name:"health_alerting_notifications",sql:`
+      CREATE TABLE health_checks (
+        id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE,
+        name TEXT NOT NULL, kind TEXT NOT NULL CHECK (kind IN ('http','tcp','command')), target TEXT NOT NULL, config TEXT NOT NULL DEFAULT '{}', interval_seconds INTEGER NOT NULL CHECK (interval_seconds BETWEEN 10 AND 86400), timeout_seconds INTEGER NOT NULL CHECK (timeout_seconds BETWEEN 1 AND 300),
+        failure_threshold INTEGER NOT NULL CHECK (failure_threshold BETWEEN 1 AND 100), recovery_threshold INTEGER NOT NULL CHECK (recovery_threshold BETWEEN 1 AND 100), regions TEXT NOT NULL DEFAULT '[]', enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0,1)), version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX health_checks_scope_idx ON health_checks(project_id, environment_id, resource_id, enabled, updated_at DESC);
+      CREATE TABLE health_results (
+        id TEXT PRIMARY KEY, check_id TEXT NOT NULL REFERENCES health_checks(id) ON DELETE CASCADE, status TEXT NOT NULL CHECK (status IN ('healthy','unhealthy','no_data')), agent TEXT NOT NULL, region TEXT, status_code INTEGER, message TEXT, timings TEXT NOT NULL DEFAULT '{}', checked_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX health_results_check_idx ON health_results(check_id, checked_at DESC);
+
+      CREATE TABLE alert_rules (
+        id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE, health_check_id TEXT REFERENCES health_checks(id) ON DELETE CASCADE,
+        name TEXT NOT NULL, signal TEXT NOT NULL, operator TEXT NOT NULL CHECK (operator IN ('gt','gte','lt','lte','eq','unhealthy')), threshold REAL, recovery_threshold REAL, window_ms INTEGER NOT NULL, consecutive INTEGER NOT NULL CHECK (consecutive BETWEEN 1 AND 100), recovery_consecutive INTEGER NOT NULL CHECK (recovery_consecutive BETWEEN 1 AND 100), no_data_policy TEXT NOT NULL CHECK (no_data_policy IN ('ignore','pending','firing')),
+        severity TEXT NOT NULL CHECK (severity IN ('info','warning','critical')), group_by TEXT NOT NULL DEFAULT '[]', labels TEXT NOT NULL DEFAULT '{}', enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0,1)), version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX alert_rules_scope_idx ON alert_rules(project_id, environment_id, resource_id, enabled, updated_at DESC);
+      CREATE TABLE alerts (
+        id TEXT PRIMARY KEY, rule_id TEXT NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE,
+        dedup_key TEXT NOT NULL UNIQUE, group_key TEXT NOT NULL, state TEXT NOT NULL CHECK (state IN ('pending','firing','resolved','silenced')), severity TEXT NOT NULL, title TEXT NOT NULL, evidence TEXT NOT NULL DEFAULT '{}', failure_count INTEGER NOT NULL DEFAULT 0, recovery_count INTEGER NOT NULL DEFAULT 0, occurrence_count INTEGER NOT NULL DEFAULT 1,
+        owner_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL, acknowledged_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL, acknowledged_at TEXT, first_seen_at TEXT NOT NULL, last_seen_at TEXT NOT NULL, firing_at TEXT, resolved_at TEXT, silenced_until TEXT, updated_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX alerts_scope_state_idx ON alerts(project_id, environment_id, resource_id, state, severity, updated_at DESC);
+      CREATE TABLE alert_events (
+        sequence INTEGER PRIMARY KEY AUTOINCREMENT, id TEXT NOT NULL UNIQUE, alert_id TEXT NOT NULL REFERENCES alerts(id) ON DELETE CASCADE, type TEXT NOT NULL, actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL, payload TEXT NOT NULL DEFAULT '{}', created_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX alert_events_alert_idx ON alert_events(alert_id, sequence);
+      CREATE TABLE alert_silences (
+        id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE, matcher TEXT NOT NULL DEFAULT '{}', reason TEXT NOT NULL, starts_at TEXT NOT NULL, ends_at TEXT NOT NULL, timezone TEXT NOT NULL, created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL, created_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX alert_silences_scope_idx ON alert_silences(project_id, starts_at, ends_at);
+
+      CREATE TABLE notification_channels (
+        id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, name TEXT NOT NULL, kind TEXT NOT NULL CHECK (kind IN ('slack','discord','teams','telegram','email','webhook')), config TEXT NOT NULL DEFAULT '{}', credential_ciphertext TEXT, credential_fingerprint TEXT, status TEXT NOT NULL CHECK (status IN ('active','paused','failing','disabled')), version INTEGER NOT NULL DEFAULT 1, last_tested_at TEXT, last_error TEXT, created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(organization_id, name)
+      ) STRICT;
+      CREATE TABLE notification_routes (
+        id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, name TEXT NOT NULL, priority INTEGER NOT NULL DEFAULT 0, matcher TEXT NOT NULL DEFAULT '{}', channel_ids TEXT NOT NULL DEFAULT '[]', quiet_hours TEXT, group_wait_seconds INTEGER NOT NULL DEFAULT 30, reminder_seconds INTEGER, escalation TEXT NOT NULL DEFAULT '[]', enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0,1)), version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX notification_routes_org_idx ON notification_routes(organization_id, enabled, priority DESC);
+      CREATE TABLE notification_deliveries (
+        id TEXT PRIMARY KEY, alert_id TEXT REFERENCES alerts(id) ON DELETE CASCADE, channel_id TEXT NOT NULL REFERENCES notification_channels(id) ON DELETE CASCADE, route_id TEXT REFERENCES notification_routes(id) ON DELETE SET NULL, event_type TEXT NOT NULL, idempotency_key TEXT NOT NULL UNIQUE, state TEXT NOT NULL CHECK (state IN ('pending','delivered','retrying','failed','dead')), attempt INTEGER NOT NULL DEFAULT 0, max_attempts INTEGER NOT NULL DEFAULT 3, next_attempt_at TEXT, response_status INTEGER, error TEXT, payload TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, delivered_at TEXT
+      ) STRICT;
+      CREATE INDEX notification_deliveries_state_idx ON notification_deliveries(state, next_attempt_at, updated_at);
+    `},{version:23,name:"notification_templates_and_rate_limits",sql:`
+      ALTER TABLE notification_routes ADD COLUMN template TEXT;
+      ALTER TABLE notification_routes ADD COLUMN rate_limit_per_minute INTEGER NOT NULL DEFAULT 60 CHECK (rate_limit_per_minute BETWEEN 1 AND 10000);
+      CREATE INDEX notification_deliveries_route_created_idx ON notification_deliveries(route_id, created_at DESC);
+    `},{version:24,name:"scheduled_jobs_and_workers",sql:`
+      CREATE TABLE scheduled_jobs (
+        id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE,
+        name TEXT NOT NULL, provider TEXT NOT NULL CHECK (provider IN ('server','eventbridge','lambda','platform')), expression TEXT NOT NULL, normalized_expression TEXT NOT NULL, timezone TEXT NOT NULL, starts_at TEXT, ends_at TEXT, flexible_minutes INTEGER NOT NULL DEFAULT 0,
+        target TEXT NOT NULL, payload_refs TEXT NOT NULL DEFAULT '{}', missed_run_policy TEXT NOT NULL CHECK (missed_run_policy IN ('skip','catch_up')), overlap_policy TEXT NOT NULL CHECK (overlap_policy IN ('allow','forbid','replace')), retry_policy TEXT NOT NULL, timeout_seconds INTEGER NOT NULL,
+        enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0,1)), origin TEXT NOT NULL CHECK (origin IN ('managed','config','external')), source_key TEXT, owner_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL, observed_state TEXT NOT NULL DEFAULT '{}', reconciliation_status TEXT NOT NULL CHECK (reconciliation_status IN ('pending','in_sync','drifted','unsupported','unavailable')),
+        next_run_at TEXT, last_scheduled_for TEXT, version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(project_id, environment_id, source_key)
+      ) STRICT;
+      CREATE INDEX scheduled_jobs_due_idx ON scheduled_jobs(enabled, next_run_at, project_id, environment_id);
+      CREATE TABLE job_executions (
+        id TEXT PRIMARY KEY, job_id TEXT NOT NULL REFERENCES scheduled_jobs(id) ON DELETE CASCADE, operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL, trigger TEXT NOT NULL CHECK (trigger IN ('scheduled','manual','catch_up','external','retry')), scheduled_for TEXT NOT NULL, idempotency_key TEXT NOT NULL UNIQUE,
+        status TEXT NOT NULL CHECK (status IN ('queued','running','succeeded','failed','skipped','dead')), attempt INTEGER NOT NULL DEFAULT 0, started_at TEXT, finished_at TEXT, output TEXT NOT NULL DEFAULT '{}', error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX job_executions_job_idx ON job_executions(job_id, scheduled_for DESC, created_at DESC);
+      CREATE TABLE worker_definitions (
+        id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE,
+        name TEXT NOT NULL, provider TEXT NOT NULL CHECK (provider IN ('systemd','ecs','lambda')), queue TEXT NOT NULL, processes INTEGER NOT NULL, timeout_seconds INTEGER NOT NULL, restart_policy TEXT NOT NULL CHECK (restart_policy IN ('always','on_failure','never')), target TEXT NOT NULL, enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0,1)), origin TEXT NOT NULL CHECK (origin IN ('managed','config','external')), source_key TEXT,
+        owner_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL, observed_state TEXT NOT NULL DEFAULT '{}', reconciliation_status TEXT NOT NULL CHECK (reconciliation_status IN ('pending','in_sync','drifted','unsupported','unavailable')), version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(project_id, environment_id, source_key)
+      ) STRICT;
+      CREATE INDEX worker_definitions_scope_idx ON worker_definitions(project_id, environment_id, resource_id, enabled);
+    `},{version:25,name:"data_service_lifecycle",sql:`
+      CREATE TABLE data_services (
+        id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE SET NULL,
+        name TEXT NOT NULL, engine TEXT NOT NULL CHECK (engine IN ('postgres','mysql','mariadb','redis','mongodb','libsql')), provider TEXT NOT NULL CHECK (provider IN ('aws_rds','aws_aurora','aws_elasticache','server','container','external')), placement TEXT NOT NULL, engine_version TEXT, plan TEXT NOT NULL, storage_gb INTEGER, high_availability INTEGER NOT NULL DEFAULT 0 CHECK (high_availability IN (0,1)), public_exposure INTEGER NOT NULL DEFAULT 0 CHECK (public_exposure IN (0,1)), allowed_cidrs TEXT NOT NULL DEFAULT '[]',
+        desired_state TEXT NOT NULL DEFAULT '{}', observed_state TEXT NOT NULL DEFAULT '{}', capabilities TEXT NOT NULL DEFAULT '{}', credential_ref TEXT, status TEXT NOT NULL CHECK (status IN ('draft','planning','provisioning','available','modifying','degraded','failed','deleting','retained','adopted')), origin TEXT NOT NULL CHECK (origin IN ('managed','config','adopted')), management_enabled INTEGER NOT NULL DEFAULT 1 CHECK (management_enabled IN (0,1)), owner_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(project_id, environment_id, name)
+      ) STRICT;
+      CREATE INDEX data_services_scope_idx ON data_services(project_id, environment_id, status, engine);
+      CREATE TABLE data_service_credentials (
+        id TEXT PRIMARY KEY, service_id TEXT NOT NULL REFERENCES data_services(id) ON DELETE CASCADE, username TEXT NOT NULL, secret_ref TEXT NOT NULL, version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, rotated_at TEXT, UNIQUE(service_id, username)
+      ) STRICT;
+      CREATE TABLE data_service_dependencies (
+        service_id TEXT NOT NULL REFERENCES data_services(id) ON DELETE CASCADE, resource_id TEXT NOT NULL REFERENCES resources(id) ON DELETE CASCADE, secret_ref TEXT NOT NULL, requires_redeploy INTEGER NOT NULL DEFAULT 1 CHECK (requires_redeploy IN (0,1)), created_at TEXT NOT NULL, PRIMARY KEY(service_id, resource_id)
+      ) STRICT;
+    `},{version:26,name:"encrypted_data_service_secrets",sql:`
+      CREATE TABLE data_service_secrets (
+        reference TEXT PRIMARY KEY,
+        ciphertext TEXT NOT NULL,
+        fingerprint TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+    `},{version:27,name:"backup_recovery_control_plane",sql:`
+      CREATE TABLE backup_destinations (
+        id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        name TEXT NOT NULL, provider TEXT NOT NULL CHECK (provider IN ('aws_s3','s3_compatible','aws_backup')), endpoint TEXT, endpoint_policy TEXT NOT NULL CHECK (endpoint_policy IN ('public_https','allow_private')), bucket TEXT, prefix TEXT NOT NULL DEFAULT '', region TEXT, force_path_style INTEGER NOT NULL DEFAULT 0 CHECK (force_path_style IN (0,1)), credential_ref TEXT,
+        encryption TEXT NOT NULL CHECK (encryption IN ('provider','client_side','both')), encryption_key_ref TEXT, immutability TEXT NOT NULL DEFAULT '{}', status TEXT NOT NULL CHECK (status IN ('untested','healthy','failing','disabled')), last_tested_at TEXT, last_success_at TEXT, last_failure_at TEXT, last_error TEXT,
+        version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(project_id,name)
+      ) STRICT;
+      CREATE INDEX backup_destinations_health_idx ON backup_destinations(project_id,status,last_tested_at);
+      CREATE TABLE backup_policies (
+        id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE, data_service_id TEXT REFERENCES data_services(id) ON DELETE CASCADE, destination_id TEXT NOT NULL REFERENCES backup_destinations(id) ON DELETE RESTRICT,
+        name TEXT NOT NULL, resource_kind TEXT NOT NULL CHECK (resource_kind IN ('managed_database','logical_database','volume','files','control_plane','infrastructure')), schedule TEXT NOT NULL, timezone TEXT NOT NULL, retention TEXT NOT NULL, compression TEXT NOT NULL CHECK (compression IN ('none','gzip','zstd')), encryption TEXT NOT NULL CHECK (encryption IN ('destination','client_side','both')), include_patterns TEXT NOT NULL DEFAULT '[]', exclude_patterns TEXT NOT NULL DEFAULT '[]', expected_rpo_minutes INTEGER NOT NULL CHECK (expected_rpo_minutes BETWEEN 1 AND 525600), expected_rto_minutes INTEGER NOT NULL CHECK (expected_rto_minutes BETWEEN 1 AND 525600), health_check_id TEXT REFERENCES health_checks(id) ON DELETE SET NULL, enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0,1)), next_run_at TEXT, last_run_at TEXT, version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(project_id,environment_id,name)
+      ) STRICT;
+      CREATE INDEX backup_policies_due_idx ON backup_policies(enabled,next_run_at,project_id,environment_id);
+      CREATE TABLE backup_jobs (
+        id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, policy_id TEXT REFERENCES backup_policies(id) ON DELETE SET NULL, recovery_point_id TEXT, operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL,
+        kind TEXT NOT NULL CHECK (kind IN ('backup','restore','verify','drill','cleanup')), status TEXT NOT NULL CHECK (status IN ('queued','running','succeeded','failed','cancelled','cleanup_required')), idempotency_key TEXT NOT NULL UNIQUE, target TEXT NOT NULL DEFAULT '{}', restore_mode TEXT CHECK (restore_mode IN ('isolated','in_place')), cancellability TEXT NOT NULL CHECK (cancellability IN ('safe','checkpoint_only','provider_uncancellable')), safety_backup_id TEXT, health_result TEXT, progress TEXT NOT NULL DEFAULT '{}', error TEXT, started_at TEXT, finished_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX backup_jobs_scope_idx ON backup_jobs(project_id,status,kind,created_at DESC);
+      CREATE TABLE recovery_points (
+        id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, policy_id TEXT REFERENCES backup_policies(id) ON DELETE SET NULL, destination_id TEXT NOT NULL REFERENCES backup_destinations(id) ON DELETE RESTRICT, resource_id TEXT REFERENCES resources(id) ON DELETE SET NULL, data_service_id TEXT REFERENCES data_services(id) ON DELETE SET NULL, backup_job_id TEXT REFERENCES backup_jobs(id) ON DELETE SET NULL,
+        kind TEXT NOT NULL, point_in_time TEXT NOT NULL, uri TEXT NOT NULL, size_bytes INTEGER NOT NULL DEFAULT 0 CHECK (size_bytes >= 0), checksum TEXT NOT NULL, manifest TEXT NOT NULL DEFAULT '{}', tool_version TEXT, engine_version TEXT, expires_at TEXT, locked_until TEXT, held INTEGER NOT NULL DEFAULT 0 CHECK (held IN (0,1)), pinned INTEGER NOT NULL DEFAULT 0 CHECK (pinned IN (0,1)), status TEXT NOT NULL CHECK (status IN ('pending','available','failed','deleting','deleted')), verification_state TEXT NOT NULL CHECK (verification_state IN ('unverified','verifying','verified','corrupt','failed')), verified_at TEXT, duration_ms INTEGER, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX recovery_points_inventory_idx ON recovery_points(project_id,policy_id,point_in_time DESC);
+      CREATE INDEX recovery_points_retention_idx ON recovery_points(status,expires_at,held,pinned);
+      CREATE TRIGGER backup_jobs_recovery_point_fk_insert BEFORE INSERT ON backup_jobs WHEN NEW.recovery_point_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM recovery_points WHERE id=NEW.recovery_point_id) BEGIN SELECT RAISE(ABORT,'backup recovery point not found'); END;
+      CREATE TRIGGER backup_jobs_recovery_point_fk_update BEFORE UPDATE OF recovery_point_id ON backup_jobs WHEN NEW.recovery_point_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM recovery_points WHERE id=NEW.recovery_point_id) BEGIN SELECT RAISE(ABORT,'backup recovery point not found'); END;
+    `},{version:28,name:"scoped_configuration",sql:`
+      CREATE TABLE configuration_entries (
+        id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        scope_type TEXT NOT NULL CHECK (scope_type IN ('project','environment','service','preview')), scope_id TEXT NOT NULL, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE, preview_id TEXT,
+        key TEXT NOT NULL, kind TEXT NOT NULL CHECK (kind IN ('variable','secret')), value TEXT, value_fingerprint TEXT NOT NULL, secret_ref TEXT, backend TEXT NOT NULL CHECK (backend IN ('plaintext','local_encrypted','aws_secrets_manager','aws_ssm','external')), backend_version TEXT,
+        origin TEXT NOT NULL CHECK (origin IN ('managed','config','migrated')), required INTEGER NOT NULL DEFAULT 0 CHECK (required IN (0,1)), metadata TEXT NOT NULL DEFAULT '{}', last_used_at TEXT, rotated_at TEXT,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0), created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+        UNIQUE(project_id,scope_type,scope_id,key),
+        CHECK ((kind='variable' AND value IS NOT NULL AND secret_ref IS NULL AND backend='plaintext') OR (kind='secret' AND value IS NULL AND secret_ref IS NOT NULL AND backend<>'plaintext'))
+      ) STRICT;
+      CREATE INDEX configuration_entries_scope_idx ON configuration_entries(project_id,environment_id,resource_id,preview_id,kind,key);
+      CREATE TABLE configuration_dependencies (
+        entry_id TEXT NOT NULL REFERENCES configuration_entries(id) ON DELETE CASCADE, resource_id TEXT NOT NULL REFERENCES resources(id) ON DELETE CASCADE, injection_target TEXT NOT NULL CHECK (injection_target IN ('environment','native_reference','file')), required INTEGER NOT NULL DEFAULT 1 CHECK (required IN (0,1)), requires_redeploy INTEGER NOT NULL DEFAULT 1 CHECK (requires_redeploy IN (0,1)), last_deployed_version INTEGER, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, PRIMARY KEY(entry_id,resource_id)
+      ) STRICT;
+      CREATE INDEX configuration_dependencies_resource_idx ON configuration_dependencies(resource_id,requires_redeploy);
+      CREATE TABLE configuration_mutations (
+        id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, idempotency_key TEXT NOT NULL UNIQUE, request_hash TEXT NOT NULL, result TEXT NOT NULL DEFAULT '{}', actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL, created_at TEXT NOT NULL
+      ) STRICT;
+    `},{version:29,name:"encrypted_configuration_values",sql:`
+      CREATE TABLE configuration_secret_values (
+        reference TEXT PRIMARY KEY,
+        ciphertext TEXT NOT NULL,
+        fingerprint TEXT NOT NULL,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+    `},{version:30,name:"function_configuration_scope",sql:`
+      ALTER TABLE configuration_entries RENAME TO configuration_entries_old;
+      ALTER TABLE configuration_dependencies RENAME TO configuration_dependencies_old;
+      DROP INDEX configuration_entries_scope_idx;
+      DROP INDEX configuration_dependencies_resource_idx;
+      CREATE TABLE configuration_entries (
+        id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        scope_type TEXT NOT NULL CHECK (scope_type IN ('project','environment','service','function','preview')), scope_id TEXT NOT NULL, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE CASCADE, preview_id TEXT,
+        key TEXT NOT NULL, kind TEXT NOT NULL CHECK (kind IN ('variable','secret')), value TEXT, value_fingerprint TEXT NOT NULL, secret_ref TEXT, backend TEXT NOT NULL CHECK (backend IN ('plaintext','local_encrypted','aws_secrets_manager','aws_ssm','external')), backend_version TEXT,
+        origin TEXT NOT NULL CHECK (origin IN ('managed','config','migrated')), required INTEGER NOT NULL DEFAULT 0 CHECK (required IN (0,1)), metadata TEXT NOT NULL DEFAULT '{}', last_used_at TEXT, rotated_at TEXT,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0), created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+        UNIQUE(project_id,scope_type,scope_id,key),
+        CHECK ((kind='variable' AND value IS NOT NULL AND secret_ref IS NULL AND backend='plaintext') OR (kind='secret' AND value IS NULL AND secret_ref IS NOT NULL AND backend<>'plaintext'))
+      ) STRICT;
+      INSERT INTO configuration_entries SELECT * FROM configuration_entries_old;
+      CREATE INDEX configuration_entries_scope_idx ON configuration_entries(project_id,environment_id,resource_id,preview_id,kind,key);
+      CREATE TABLE configuration_dependencies (
+        entry_id TEXT NOT NULL REFERENCES configuration_entries(id) ON DELETE CASCADE, resource_id TEXT NOT NULL REFERENCES resources(id) ON DELETE CASCADE, injection_target TEXT NOT NULL CHECK (injection_target IN ('environment','native_reference','file')), required INTEGER NOT NULL DEFAULT 1 CHECK (required IN (0,1)), requires_redeploy INTEGER NOT NULL DEFAULT 1 CHECK (requires_redeploy IN (0,1)), last_deployed_version INTEGER, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, PRIMARY KEY(entry_id,resource_id)
+      ) STRICT;
+      INSERT INTO configuration_dependencies SELECT * FROM configuration_dependencies_old;
+      CREATE INDEX configuration_dependencies_resource_idx ON configuration_dependencies(resource_id,requires_redeploy);
+      DROP TABLE configuration_dependencies_old;
+      DROP TABLE configuration_entries_old;
+    `},{version:31,name:"persistent_volume_lifecycle",sql:`
+      CREATE TABLE persistent_volumes (
+        id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        resource_id TEXT REFERENCES resources(id) ON DELETE SET NULL, name TEXT NOT NULL, provider TEXT NOT NULL, provider_id TEXT, type TEXT NOT NULL CHECK (type IN ('server_path','docker','ebs','efs','provider')),
+        status TEXT NOT NULL CHECK (status IN ('pending','available','attaching','attached','detaching','resizing','snapshotting','orphaned','deleting','deleted','error')), capacity_bytes INTEGER CHECK (capacity_bytes IS NULL OR capacity_bytes >= 0), used_bytes INTEGER CHECK (used_bytes IS NULL OR used_bytes >= 0), filesystem TEXT, encrypted INTEGER NOT NULL DEFAULT 0 CHECK (encrypted IN (0,1)),
+        capabilities TEXT NOT NULL DEFAULT '{}', desired_state TEXT NOT NULL DEFAULT '{}', observed_state TEXT NOT NULL DEFAULT '{}', backup_policy_id TEXT REFERENCES backup_policies(id) ON DELETE SET NULL, last_backup_at TEXT, orphaned_at TEXT, adopted_at TEXT,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0), created_at TEXT NOT NULL, updated_at TEXT NOT NULL, deleted_at TEXT, UNIQUE(project_id,environment_id,name)
+      ) STRICT;
+      CREATE INDEX persistent_volumes_inventory_idx ON persistent_volumes(project_id,environment_id,status,type,updated_at DESC);
+      CREATE UNIQUE INDEX persistent_volumes_provider_idx ON persistent_volumes(provider,provider_id) WHERE provider_id IS NOT NULL AND deleted_at IS NULL;
+      CREATE TABLE volume_attachments (
+        id TEXT PRIMARY KEY, volume_id TEXT NOT NULL REFERENCES persistent_volumes(id) ON DELETE RESTRICT, resource_id TEXT NOT NULL REFERENCES resources(id) ON DELETE CASCADE,
+        target_path TEXT NOT NULL, read_only INTEGER NOT NULL DEFAULT 0 CHECK (read_only IN (0,1)), uid INTEGER CHECK (uid IS NULL OR uid >= 0), gid INTEGER CHECK (gid IS NULL OR gid >= 0), mode TEXT, propagation TEXT NOT NULL DEFAULT 'private' CHECK (propagation IN ('private','rprivate','shared','rshared','slave','rslave')), driver_options TEXT NOT NULL DEFAULT '{}',
+        desired_state TEXT NOT NULL CHECK (desired_state IN ('attached','detached')), observed_state TEXT NOT NULL CHECK (observed_state IN ('pending','attached','detached','error')), operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL, last_error TEXT,
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0), created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(volume_id,resource_id,target_path)
+      ) STRICT;
+      CREATE INDEX volume_attachments_resource_idx ON volume_attachments(resource_id,desired_state,observed_state);
+      CREATE TABLE volume_snapshots (
+        id TEXT PRIMARY KEY, volume_id TEXT NOT NULL REFERENCES persistent_volumes(id) ON DELETE CASCADE, recovery_point_id TEXT REFERENCES recovery_points(id) ON DELETE SET NULL, provider_id TEXT,
+        name TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('pending','available','restoring','deleting','deleted','error')), size_bytes INTEGER CHECK (size_bytes IS NULL OR size_bytes >= 0), encrypted INTEGER NOT NULL DEFAULT 0 CHECK (encrypted IN (0,1)), checksum TEXT, metadata TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL, updated_at TEXT NOT NULL, deleted_at TEXT
+      ) STRICT;
+      CREATE INDEX volume_snapshots_inventory_idx ON volume_snapshots(volume_id,status,created_at DESC);
+    `},{version:32,name:"provider_neutral_fleet",sql:`
+    CREATE TABLE fleet_servers (
+      id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, resource_id TEXT NOT NULL REFERENCES resources(id) ON DELETE CASCADE,
+      name TEXT NOT NULL, provider TEXT NOT NULL CHECK(provider IN ('aws','hetzner','ssh')), provider_id TEXT, region TEXT, zone TEXT, endpoint TEXT NOT NULL, ssh_user TEXT NOT NULL, ssh_port INTEGER NOT NULL CHECK(ssh_port BETWEEN 1 AND 65535), credential_ref TEXT NOT NULL,
+      host_key_algorithm TEXT, host_key_fingerprint TEXT, pending_host_key TEXT, roles TEXT NOT NULL, labels TEXT NOT NULL DEFAULT '{}', taints TEXT NOT NULL DEFAULT '[]', capacity TEXT NOT NULL DEFAULT '{}', usage TEXT NOT NULL DEFAULT '{}', capabilities TEXT NOT NULL DEFAULT '{}',
+      status TEXT NOT NULL CHECK(status IN ('pending','validating','ready','degraded','unreachable','draining','drained','archived')), trust_state TEXT NOT NULL CHECK(trust_state IN ('unverified','pinned','rotation_pending','blocked')), validation TEXT NOT NULL DEFAULT '{}', bootstrap_version TEXT, heartbeat_at TEXT, last_seen_at TEXT, archived_at TEXT,
+      version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(project_id,name)
+    ) STRICT;
+    CREATE UNIQUE INDEX fleet_servers_provider_identity ON fleet_servers(organization_id,provider,provider_id) WHERE provider_id IS NOT NULL AND archived_at IS NULL;
+    CREATE INDEX fleet_servers_status ON fleet_servers(project_id,status,heartbeat_at);
+    CREATE TABLE fleet_bootstrap_plans (id TEXT PRIMARY KEY, server_id TEXT NOT NULL REFERENCES fleet_servers(id) ON DELETE CASCADE, plan_version TEXT NOT NULL, facts_hash TEXT NOT NULL, steps TEXT NOT NULL, status TEXT NOT NULL CHECK(status IN ('preview','queued','running','succeeded','failed')), operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
+  `},{version:33,name:"capacity_pools_and_placement",sql:`
+    CREATE TABLE capacity_pools (
+      id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      name TEXT NOT NULL, purpose TEXT NOT NULL CHECK(purpose IN ('application','build','worker','monitoring','backup')), backend TEXT NOT NULL CHECK(backend IN ('server','ecs','asg')),
+      region TEXT, architecture TEXT, labels TEXT NOT NULL DEFAULT '{}', required_server_labels TEXT NOT NULL DEFAULT '{}', tolerated_taints TEXT NOT NULL DEFAULT '[]',
+      capacity TEXT NOT NULL, reserved TEXT NOT NULL DEFAULT '{}', max_workloads INTEGER NOT NULL CHECK(max_workloads > 0), cost_weight REAL NOT NULL DEFAULT 1 CHECK(cost_weight >= 0), spread_key TEXT,
+      concurrency INTEGER NOT NULL DEFAULT 1 CHECK(concurrency > 0), ephemeral_workspaces INTEGER NOT NULL DEFAULT 1 CHECK(ephemeral_workspaces IN (0,1)), allow_production_secrets INTEGER NOT NULL DEFAULT 0 CHECK(allow_production_secrets IN (0,1)),
+      status TEXT NOT NULL CHECK(status IN ('active','draining','disabled')), version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(project_id,name)
+    ) STRICT;
+    CREATE INDEX capacity_pools_scope ON capacity_pools(project_id,purpose,status,region,architecture);
+    CREATE TABLE capacity_pool_members (
+      pool_id TEXT NOT NULL REFERENCES capacity_pools(id) ON DELETE CASCADE, server_id TEXT NOT NULL REFERENCES fleet_servers(id) ON DELETE CASCADE,
+      capacity_override TEXT NOT NULL DEFAULT '{}', status TEXT NOT NULL CHECK(status IN ('active','draining','offline')), created_at TEXT NOT NULL, updated_at TEXT NOT NULL, PRIMARY KEY(pool_id,server_id)
+    ) STRICT;
+    CREATE TABLE workload_placements (
+      id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE, resource_id TEXT NOT NULL REFERENCES resources(id) ON DELETE CASCADE,
+      release_id TEXT REFERENCES releases(id) ON DELETE SET NULL, pool_id TEXT NOT NULL REFERENCES capacity_pools(id) ON DELETE RESTRICT, server_id TEXT REFERENCES fleet_servers(id) ON DELETE SET NULL,
+      purpose TEXT NOT NULL, requirements TEXT NOT NULL, decision TEXT NOT NULL, stateful INTEGER NOT NULL DEFAULT 0 CHECK(stateful IN (0,1)), auto_reschedule INTEGER NOT NULL DEFAULT 0 CHECK(auto_reschedule IN (0,1)),
+      status TEXT NOT NULL CHECK(status IN ('reserved','active','moving','blocked','released','failed')), version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    ) STRICT;
+    CREATE INDEX workload_placements_target ON workload_placements(project_id,resource_id,status,pool_id);
+    CREATE TABLE capacity_leases (
+      id TEXT PRIMARY KEY, placement_id TEXT NOT NULL REFERENCES workload_placements(id) ON DELETE CASCADE, pool_id TEXT NOT NULL REFERENCES capacity_pools(id) ON DELETE CASCADE, server_id TEXT REFERENCES fleet_servers(id) ON DELETE SET NULL,
+      resources TEXT NOT NULL, state TEXT NOT NULL CHECK(state IN ('active','released','expired')), expires_at TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    ) STRICT;
+    CREATE UNIQUE INDEX capacity_leases_active ON capacity_leases(placement_id) WHERE state='active';
+    CREATE INDEX capacity_leases_pool ON capacity_leases(pool_id,state,expires_at);
+    CREATE TABLE remote_builds (
+      id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, resource_id TEXT REFERENCES resources(id) ON DELETE SET NULL, pool_id TEXT NOT NULL REFERENCES capacity_pools(id) ON DELETE RESTRICT,
+      placement_id TEXT REFERENCES workload_placements(id) ON DELETE SET NULL, operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL, source_sha TEXT NOT NULL, build_spec TEXT NOT NULL, credential_policy TEXT NOT NULL,
+      workspace TEXT, cache_key TEXT, artifact_uri TEXT, artifact_digest TEXT, status TEXT NOT NULL CHECK(status IN ('queued','running','uploading','succeeded','failed','cancelled','cleanup_required')),
+      cleanup_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    ) STRICT;
+    CREATE INDEX remote_builds_pool ON remote_builds(pool_id,status,created_at);
+  `},{version:34,name:"multi_region_orchestration",sql:`
+    CREATE TABLE regional_topologies (
+      id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+      name TEXT NOT NULL, hostname TEXT NOT NULL, home_region TEXT NOT NULL, regions TEXT NOT NULL, traffic_policy TEXT NOT NULL CHECK(traffic_policy IN ('active_passive','weighted','latency')),
+      data_policy TEXT NOT NULL, status TEXT NOT NULL CHECK(status IN ('draft','provisioning','ready','degraded','failing_over','failed_over','failing_back','destroying','destroyed','failed')),
+      active_region TEXT NOT NULL, revision TEXT, version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(project_id,environment_id,name), UNIQUE(project_id,hostname)
+    ) STRICT;
+    CREATE TABLE regional_targets (
+      id TEXT PRIMARY KEY, topology_id TEXT NOT NULL REFERENCES regional_topologies(id) ON DELETE CASCADE, region TEXT NOT NULL, role TEXT NOT NULL CHECK(role IN ('primary','secondary')), provider TEXT NOT NULL,
+      stack_id TEXT, stack_revision TEXT, status TEXT NOT NULL CHECK(status IN ('pending','provisioning','ready','degraded','failed','deleting','deleted')), health TEXT NOT NULL DEFAULT '{}', last_healthy_at TEXT,
+      version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(topology_id,region)
+    ) STRICT;
+    CREATE TABLE regional_replication_channels (
+      id TEXT PRIMARY KEY, topology_id TEXT NOT NULL REFERENCES regional_topologies(id) ON DELETE CASCADE, kind TEXT NOT NULL CHECK(kind IN ('s3','dynamodb','secrets')), source_region TEXT NOT NULL, target_region TEXT NOT NULL,
+      config TEXT NOT NULL, status TEXT NOT NULL CHECK(status IN ('pending','configuring','in_sync','lagging','failed','disabled')), checkpoint TEXT, lag_seconds INTEGER, last_verified_at TEXT, version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+      UNIQUE(topology_id,kind,source_region,target_region)
+    ) STRICT;
+    CREATE TABLE regional_traffic_routes (
+      id TEXT PRIMARY KEY, topology_id TEXT NOT NULL REFERENCES regional_topologies(id) ON DELETE CASCADE, hostname TEXT NOT NULL, dns_provider TEXT NOT NULL, cdn_enabled INTEGER NOT NULL DEFAULT 0 CHECK(cdn_enabled IN (0,1)), waf_enabled INTEGER NOT NULL DEFAULT 0 CHECK(waf_enabled IN (0,1)),
+      weights TEXT NOT NULL, desired_weights TEXT NOT NULL, status TEXT NOT NULL CHECK(status IN ('pending','applying','in_sync','failed','drained')), provider_state TEXT NOT NULL DEFAULT '{}', version INTEGER NOT NULL DEFAULT 1, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(topology_id,hostname)
+    ) STRICT;
+    CREATE TABLE regional_executions (
+      id TEXT PRIMARY KEY, topology_id TEXT NOT NULL REFERENCES regional_topologies(id) ON DELETE CASCADE, operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL, kind TEXT NOT NULL CHECK(kind IN ('rollout','failover','failback','destroy','reconcile')),
+      requested_region TEXT, revision TEXT, plan TEXT NOT NULL, current_step TEXT, completed_steps TEXT NOT NULL DEFAULT '[]', status TEXT NOT NULL CHECK(status IN ('queued','running','succeeded','failed','cancelled')), error TEXT,
+      created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    ) STRICT;
+    CREATE INDEX regional_executions_active ON regional_executions(topology_id,status,created_at DESC);
+  `},{version:35,name:"platform_maintenance_and_dr",sql:`
+    CREATE TABLE platform_trusted_keys (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, name TEXT NOT NULL, algorithm TEXT NOT NULL CHECK(algorithm='ed25519'), public_key_pem TEXT NOT NULL, fingerprint TEXT NOT NULL UNIQUE, revoked_at TEXT, created_at TEXT NOT NULL, UNIQUE(organization_id,name)) STRICT;
+    CREATE TABLE platform_update_manifests (
+      id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE, version TEXT NOT NULL, channel TEXT NOT NULL CHECK(channel IN ('stable','preview','nightly')), published_at TEXT NOT NULL, key_id TEXT NOT NULL REFERENCES platform_trusted_keys(id) ON DELETE RESTRICT,
+      digest TEXT NOT NULL UNIQUE, document TEXT NOT NULL, signature TEXT NOT NULL, verification_status TEXT NOT NULL CHECK(verification_status IN ('verified','invalid','revoked')), compatibility TEXT NOT NULL, created_at TEXT NOT NULL, UNIQUE(organization_id,version,channel)
+    ) STRICT;
+    CREATE TABLE maintenance_windows (
+      id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, name TEXT NOT NULL, schedule TEXT NOT NULL, timezone TEXT NOT NULL, duration_minutes INTEGER NOT NULL CHECK(duration_minutes BETWEEN 5 AND 1440), allowed_operations TEXT NOT NULL, require_approval INTEGER NOT NULL DEFAULT 1 CHECK(require_approval IN (0,1)), enabled INTEGER NOT NULL DEFAULT 1 CHECK(enabled IN (0,1)), created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(project_id,name)
+    ) STRICT;
+    CREATE TABLE platform_upgrade_campaigns (
+      id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, manifest_id TEXT NOT NULL REFERENCES platform_update_manifests(id) ON DELETE RESTRICT, window_id TEXT REFERENCES maintenance_windows(id) ON DELETE SET NULL, from_version TEXT NOT NULL, strategy TEXT NOT NULL CHECK(strategy IN ('canary','rolling')), batch_size INTEGER NOT NULL CHECK(batch_size > 0), health_gate TEXT NOT NULL,
+      status TEXT NOT NULL CHECK(status IN ('planned','queued','running','paused','rolling_back','succeeded','failed','rolled_back','cancelled')), current_stage TEXT, backup_id TEXT, approved_by TEXT REFERENCES actors(id) ON DELETE SET NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    ) STRICT;
+    CREATE TABLE platform_upgrade_targets (
+      id TEXT PRIMARY KEY, campaign_id TEXT NOT NULL REFERENCES platform_upgrade_campaigns(id) ON DELETE CASCADE, server_id TEXT REFERENCES fleet_servers(id) ON DELETE SET NULL, target TEXT NOT NULL, cohort INTEGER NOT NULL, previous_version TEXT NOT NULL,
+      status TEXT NOT NULL CHECK(status IN ('pending','downloading','installing','healthy','failed','rolling_back','rolled_back','skipped')), evidence TEXT NOT NULL DEFAULT '{}', error TEXT, started_at TEXT, finished_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(campaign_id,target)
+    ) STRICT;
+    CREATE TABLE cleanup_plans (
+      id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, kind TEXT NOT NULL CHECK(kind IN ('releases','artifacts','operations','logs','previews','snapshots','orphaned_resources')), criteria TEXT NOT NULL, candidates TEXT NOT NULL, candidate_digest TEXT NOT NULL, estimated_bytes INTEGER NOT NULL DEFAULT 0, status TEXT NOT NULL CHECK(status IN ('preview','approved','running','succeeded','partial','failed','expired')), confirmation TEXT, expires_at TEXT NOT NULL, result TEXT NOT NULL DEFAULT '{}', created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    ) STRICT;
+    CREATE TABLE disaster_recovery_drills (
+      id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, backup_policy_id TEXT REFERENCES backup_policies(id) ON DELETE SET NULL, recovery_point_id TEXT REFERENCES recovery_points(id) ON DELETE SET NULL, topology_id TEXT REFERENCES regional_topologies(id) ON DELETE SET NULL,
+      scenario TEXT NOT NULL CHECK(scenario IN ('control_plane','database','volume','regional')), isolated_target TEXT NOT NULL, expected_rpo_minutes INTEGER NOT NULL, expected_rto_minutes INTEGER NOT NULL, status TEXT NOT NULL CHECK(status IN ('planned','queued','restoring','verifying','cleaning','passed','failed','cleanup_required','cancelled')),
+      operation_id TEXT REFERENCES operations(id) ON DELETE SET NULL, evidence TEXT NOT NULL DEFAULT '{}', measured_rpo_minutes REAL, measured_rto_minutes REAL, cleanup_verified INTEGER NOT NULL DEFAULT 0 CHECK(cleanup_verified IN (0,1)), error TEXT, started_at TEXT, finished_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    ) STRICT;
+    CREATE INDEX platform_campaign_status ON platform_upgrade_campaigns(project_id,status,created_at DESC);
+    CREATE INDEX cleanup_plan_status ON cleanup_plans(project_id,status,expires_at);
+    CREATE INDEX dr_drill_status ON disaster_recovery_drills(project_id,status,created_at DESC);
+  `},{version:36,name:"telemetry_source_rollups",sql:`
+      CREATE TABLE telemetry_source_rollups (
+        project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT NOT NULL DEFAULT '',
+        resource_id TEXT NOT NULL DEFAULT '',
+        source TEXT NOT NULL,
+        first_observed_at TEXT NOT NULL,
+        latest_observed_at TEXT NOT NULL,
+        ingested_bytes INTEGER NOT NULL DEFAULT 0 CHECK (ingested_bytes >= 0),
+        record_count INTEGER NOT NULL DEFAULT 0 CHECK (record_count >= 0),
+        PRIMARY KEY(project_id, environment_id, resource_id, source)
+      ) STRICT;
+
+      INSERT INTO telemetry_source_rollups (
+        project_id, environment_id, resource_id, source,
+        first_observed_at, latest_observed_at, ingested_bytes, record_count
+      )
+      SELECT
+        project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source,
+        MIN(observed_at), MAX(observed_at), SUM(ingested_bytes), COUNT(*)
+      FROM telemetry_records
+      GROUP BY project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source;
+
+      CREATE TRIGGER telemetry_source_rollups_insert
+      AFTER INSERT ON telemetry_records
+      BEGIN
+        INSERT INTO telemetry_source_rollups (
+          project_id, environment_id, resource_id, source,
+          first_observed_at, latest_observed_at, ingested_bytes, record_count
+        )
+        VALUES (
+          NEW.project_id, COALESCE(NEW.environment_id, ''), COALESCE(NEW.resource_id, ''), NEW.source,
+          NEW.observed_at, NEW.observed_at, NEW.ingested_bytes, 1
+        )
+        ON CONFLICT(project_id, environment_id, resource_id, source) DO UPDATE SET
+          first_observed_at = MIN(first_observed_at, excluded.first_observed_at),
+          latest_observed_at = MAX(latest_observed_at, excluded.latest_observed_at),
+          ingested_bytes = ingested_bytes + excluded.ingested_bytes,
+          record_count = record_count + 1;
+      END;
+    `},{version:37,name:"spend_management",sql:`
+      CREATE TABLE spend_budgets (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        period TEXT NOT NULL CHECK (period IN ('daily', 'weekly', 'monthly')),
+        timezone TEXT NOT NULL DEFAULT 'UTC',
+        currency TEXT NOT NULL DEFAULT 'USD',
+        soft_limit_cents INTEGER CHECK (soft_limit_cents IS NULL OR soft_limit_cents >= 0),
+        hard_limit_cents INTEGER CHECK (hard_limit_cents IS NULL OR hard_limit_cents >= 0),
+        thresholds TEXT NOT NULL DEFAULT '[]',
+        meters TEXT NOT NULL DEFAULT '[]',
+        grace_seconds INTEGER NOT NULL DEFAULT 0 CHECK (grace_seconds >= 0),
+        hysteresis_percent REAL NOT NULL DEFAULT 5 CHECK (hysteresis_percent >= 0),
+        dry_run INTEGER NOT NULL DEFAULT 0 CHECK (dry_run IN (0, 1)),
+        enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(organization_id, name),
+        CHECK (soft_limit_cents IS NOT NULL OR hard_limit_cents IS NOT NULL)
+      ) STRICT;
+      CREATE INDEX spend_budgets_scope ON spend_budgets(organization_id, project_id, environment_id, enabled);
+
+      -- Hourly rollups. The empty string stands in for "unscoped" so the
+      -- primary key stays usable: SQLite treats every NULL as distinct, which
+      -- would let the same bucket be inserted without limit.
+      CREATE TABLE spend_usage (
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT NOT NULL DEFAULT '',
+        environment_id TEXT NOT NULL DEFAULT '',
+        resource_id TEXT NOT NULL DEFAULT '',
+        provider TEXT NOT NULL DEFAULT '',
+        region TEXT NOT NULL DEFAULT '',
+        meter TEXT NOT NULL,
+        bucket_start TEXT NOT NULL,
+        quantity REAL NOT NULL DEFAULT 0 CHECK (quantity >= 0),
+        cost_cents REAL NOT NULL DEFAULT 0 CHECK (cost_cents >= 0),
+        sample_count INTEGER NOT NULL DEFAULT 0 CHECK (sample_count >= 0),
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY(organization_id, project_id, environment_id, resource_id, provider, region, meter, bucket_start)
+      ) STRICT;
+      CREATE INDEX spend_usage_window ON spend_usage(organization_id, bucket_start);
+      CREATE INDEX spend_usage_project_window ON spend_usage(project_id, bucket_start);
+
+      -- Applied deltas, so replaying telemetry cannot double-bill.
+      CREATE TABLE spend_usage_receipts (
+        key TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        bucket_start TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX spend_usage_receipts_age ON spend_usage_receipts(created_at);
+
+      CREATE TABLE spend_enforcements (
+        id TEXT PRIMARY KEY,
+        budget_id TEXT NOT NULL REFERENCES spend_budgets(id) ON DELETE CASCADE,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        action TEXT NOT NULL,
+        state TEXT NOT NULL CHECK (state IN ('pending', 'active', 'releasing', 'released', 'failed')),
+        reason TEXT NOT NULL,
+        restore TEXT NOT NULL DEFAULT '{}',
+        triggered_at_percent REAL NOT NULL DEFAULT 0,
+        simulated INTEGER NOT NULL DEFAULT 0 CHECK (simulated IN (0, 1)),
+        applied_at TEXT,
+        released_at TEXT,
+        error TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      ) STRICT;
+      -- At most one live enforcement per budget+action; released rows are history.
+      CREATE UNIQUE INDEX spend_enforcements_live
+        ON spend_enforcements(budget_id, action)
+        WHERE state IN ('pending', 'active', 'releasing');
+      CREATE INDEX spend_enforcements_scope ON spend_enforcements(organization_id, state, created_at DESC);
+
+      CREATE TABLE spend_decisions (
+        id TEXT PRIMARY KEY,
+        budget_id TEXT NOT NULL REFERENCES spend_budgets(id) ON DELETE CASCADE,
+        level TEXT NOT NULL CHECK (level IN ('ok', 'warning', 'soft_capped', 'hard_capped')),
+        window_start TEXT NOT NULL,
+        window_end TEXT NOT NULL,
+        used_percent REAL NOT NULL,
+        projected_percent REAL NOT NULL,
+        actual_cents REAL NOT NULL,
+        projected_cents REAL NOT NULL,
+        actions TEXT NOT NULL DEFAULT '[]',
+        simulated INTEGER NOT NULL DEFAULT 0 CHECK (simulated IN (0, 1)),
+        reason TEXT NOT NULL,
+        evaluated_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX spend_decisions_budget ON spend_decisions(budget_id, evaluated_at DESC);
+
+      CREATE TABLE spend_anomalies (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        -- The nullable scope columns cannot carry the uniqueness themselves:
+        -- SQLite treats every NULL as distinct, so an org-wide anomaly would
+        -- re-insert on every evaluation. This collapses the scope to a string.
+        scope_key TEXT NOT NULL,
+        signal TEXT NOT NULL,
+        direction TEXT NOT NULL CHECK (direction IN ('spike', 'drop')),
+        observed REAL NOT NULL,
+        expected REAL NOT NULL,
+        score REAL NOT NULL,
+        delta_percent REAL NOT NULL,
+        severity TEXT NOT NULL CHECK (severity IN ('info', 'warning', 'critical')),
+        bucket_start TEXT NOT NULL,
+        evidence TEXT NOT NULL DEFAULT '{}',
+        acknowledged_at TEXT,
+        created_at TEXT NOT NULL,
+        UNIQUE(scope_key, signal, bucket_start)
+      ) STRICT;
+      CREATE INDEX spend_anomalies_recent ON spend_anomalies(organization_id, created_at DESC);
+    `},{version:38,name:"anomaly_configuration",sql:`
+      CREATE TABLE anomaly_configs (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+        environment_id TEXT REFERENCES environments(id) ON DELETE CASCADE,
+        -- Nullable scope columns cannot carry uniqueness in SQLite, so the
+        -- scope is collapsed into a string the way spend_anomalies does.
+        scope_key TEXT NOT NULL,
+        signal TEXT NOT NULL,
+        enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+        -- 'low' widens the threshold, 'high' narrows it. Stored rather than a
+        -- raw z-score so the UI can offer a choice people can reason about.
+        sensitivity TEXT NOT NULL DEFAULT 'medium' CHECK (sensitivity IN ('low', 'medium', 'high')),
+        season_length INTEGER NOT NULL DEFAULT 24 CHECK (season_length > 0),
+        min_absolute_delta REAL NOT NULL DEFAULT 0 CHECK (min_absolute_delta >= 0),
+        detect_drops INTEGER NOT NULL DEFAULT 0 CHECK (detect_drops IN (0, 1)),
+        severity TEXT NOT NULL DEFAULT 'warning' CHECK (severity IN ('info', 'warning', 'critical')),
+        version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0),
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(scope_key, signal)
+      ) STRICT;
+      CREATE INDEX anomaly_configs_scope ON anomaly_configs(organization_id, enabled);
+
+      CREATE TABLE anomaly_silences (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+        scope_key TEXT NOT NULL,
+        -- A silence matches on any combination; an empty matcher would silence
+        -- everything, which the store refuses rather than storing.
+        signal TEXT,
+        route_pattern TEXT,
+        status_code INTEGER,
+        reason TEXT NOT NULL,
+        actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        expires_at TEXT,
+        created_at TEXT NOT NULL
+      ) STRICT;
+      CREATE INDEX anomaly_silences_scope ON anomaly_silences(organization_id, expires_at);
+    `},{version:39,name:"sms_notification_channel",sql:`
+      -- SQLite cannot alter a CHECK constraint, so widening the channel kinds
+      -- means rebuilding the table. Rows are copied first and the old table is
+      -- dropped last, so an interrupted migration leaves the original intact.
+      CREATE TABLE notification_channels_new (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        kind TEXT NOT NULL CHECK (kind IN ('slack','discord','teams','telegram','email','webhook','sms')),
+        config TEXT NOT NULL DEFAULT '{}',
+        credential_ciphertext TEXT,
+        credential_fingerprint TEXT,
+        status TEXT NOT NULL CHECK (status IN ('active','paused','failing','disabled')),
+        version INTEGER NOT NULL DEFAULT 1,
+        last_tested_at TEXT,
+        last_error TEXT,
+        created_by_actor_id TEXT REFERENCES actors(id) ON DELETE SET NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(organization_id, name)
+      ) STRICT;
+
+      INSERT INTO notification_channels_new SELECT
+        id, organization_id, name, kind, config, credential_ciphertext, credential_fingerprint,
+        status, version, last_tested_at, last_error, created_by_actor_id, created_at, updated_at
+      FROM notification_channels;
+
+      DROP TABLE notification_channels;
+      ALTER TABLE notification_channels_new RENAME TO notification_channels;
+    `},{version:40,name:"telemetry_kind_scope_index",sql:`
+      -- Anomaly detection filters request records by (project, kind, time).
+      -- The existing scope index leads with project_id and environment_id but
+      -- never mentions kind, so every request series scanned each project's
+      -- logs, metrics, and traces too and discarded them in memory. On a
+      -- project emitting mostly logs that is several times the necessary work,
+      -- once a minute, forever.
+      CREATE INDEX telemetry_kind_scope_time_idx
+        ON telemetry_records(project_id, kind, timestamp);
+    `}];class U extends Error{constructor(E,T,N){super(`${E} ${T} changed since version ${N}`);this.name="OptimisticConcurrencyError"}}class j extends Error{constructor(E,T){super(`Operation cannot transition from ${E} to ${T}`);this.name="InvalidOperationTransitionError"}}class v extends Error{constructor(E,T){super(`Control-plane schema version ${E} is newer than supported version ${T}`);this.name="UnsupportedSchemaVersionError"}}var eE=65536,q=16384,cE=["succeeded","failed","cancelled","timed_out"],CE={queued:["running","cancelled","timed_out"],running:["queued","succeeded","failed","cancelled","timed_out"],succeeded:[],failed:["queued"],cancelled:["queued"],timed_out:["queued"]},UE=/(?:^|_)(?:authorization|cookie|credential|password|passwd|secret|token|api_?key|private_?key|access_?key)(?:$|_)/i,NE=/(?:authorization|password|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;]+/gi;function c(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function d(E){return typeof E==="string"?E:void 0}function P(E,T){if(T&&UE.test(T))return"[REDACTED]";if(E===null||typeof E==="boolean"||typeof E==="number")return E;if(typeof E==="string")return E.replace(NE,"[REDACTED]");if(Array.isArray(E))return E.map((N)=>P(N));if(E&&typeof E==="object"){let N={};for(let[e,L]of Object.entries(E))N[e]=P(L,e);return N}return String(E??"")}function LE(E,T=eE){let N=P(E),e=JSON.stringify(N);if(Buffer.byteLength(e)<=T)return N;return{truncated:!0,originalBytes:Buffer.byteLength(e),preview:e.slice(0,Math.max(0,T-128))}}function r(E){return JSON.stringify(LE(E))}function z(E){if(!E)return;let T=E.replace(NE,"[REDACTED]");return Buffer.byteLength(T)<=q?T:`${T.slice(0,q-24)}
+[output truncated]`}function F(E){return{id:String(E.id),slug:String(E.slug),name:String(E.name),description:d(E.description),organizationId:d(E.organization_id),desiredConfigHash:d(E.desired_config_hash),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function y(E){return{id:String(E.id),projectId:String(E.project_id),slug:String(E.slug),name:String(E.name),kind:String(E.kind),region:d(E.region),desiredState:c(E.desired_state),discoveredState:c(E.discovered_state),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function m(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:d(E.environment_id),kind:String(E.kind),slug:String(E.slug),name:String(E.name),provider:d(E.provider),providerId:d(E.provider_id),desiredState:c(E.desired_state),discoveredState:c(E.discovered_state),metadata:c(E.metadata),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function f(E){return{id:String(E.id),kind:String(E.kind),externalId:d(E.external_id),displayName:String(E.display_name),metadata:c(E.metadata),disabledAt:d(E.disabled_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function O(E){return{id:String(E.id),projectId:d(E.project_id),environmentId:d(E.environment_id),resourceId:d(E.resource_id),actorId:d(E.actor_id),kind:String(E.kind),state:String(E.state),correlationId:String(E.correlation_id),idempotencyKey:d(E.idempotency_key),input:c(E.input),output:c(E.output),error:d(E.error),attempt:Number(E.attempt),priority:Number(E.priority),leaseOwner:d(E.lease_owner),leaseExpiresAt:d(E.lease_expires_at),cancelRequestedAt:d(E.cancel_requested_at),startedAt:d(E.started_at),finishedAt:d(E.finished_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function M(E){return{id:String(E.id),sequence:Number(E.sequence),organizationId:d(E.organization_id),projectId:d(E.project_id),operationId:d(E.operation_id),resourceId:d(E.resource_id),actorId:d(E.actor_id),correlationId:String(E.correlation_id),type:String(E.type),level:String(E.level),payload:c(E.payload),createdAt:String(E.created_at)}}function l(E){return{id:String(E.id),projectId:String(E.project_id),name:String(E.name),normalizedName:String(E.normalized_name),color:String(E.color),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function h(E){return{id:String(E.id),actorKey:String(E.actor_key),name:String(E.name),routeId:String(E.route_id),query:c(E.query),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function K(E){return{actorKey:String(E.actor_key),entityType:String(E.entity_type),entityId:String(E.entity_id),favorite:Number(E.favorite)===1,lastVisitedAt:String(E.last_visited_at),visitCount:Number(E.visit_count)}}function b(E){return{id:String(E.id),slug:String(E.slug),name:String(E.name),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Q(E){let T=String(E.scope_type);return{type:T,...T==="organization"?{}:{id:String(E.scope_id)}}}function k(E){return{id:String(E.id),organizationId:String(E.organization_id),actorId:String(E.actor_id),roleTemplate:String(E.role_template),scope:Q(E),source:String(E.source??"manual"),status:String(E.status),sessionVersion:Number(E.session_version),lastActiveAt:d(E.last_active_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function A(E,T){let N=d(E.accepted_at),e=d(E.revoked_at),L=String(E.expires_at),t=e?"revoked":N?"accepted":L<=T?"expired":"pending";return{id:String(E.id),organizationId:String(E.organization_id),email:String(E.email),roleTemplate:String(E.role_template),scope:Q(E),invitedByActorId:d(E.invited_by_actor_id),acceptedByActorId:d(E.accepted_by_actor_id),expiresAt:L,acceptedAt:N,revokedAt:e,state:t,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function H(E){return{id:String(E.id),organizationId:String(E.organization_id),membershipId:String(E.membership_id),effect:String(E.effect),capability:String(E.capability),scope:Q(E),source:String(E.source??"manual"),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function D(E){return{type:E.type,id:E.id??null}}function OE(E){return Array.from({length:E},()=>"?").join(", ")}function a(E,T,N){return E.run(T,N)}class iE{path;database;nowFn;idFn;constructor(E={}){this.path=E.path??TE(E.cwd??process.cwd(),"control-plane.sqlite"),this.nowFn=E.now??(()=>new Date),this.idFn=E.id??(()=>crypto.randomUUID());let T=this.path===":memory:";if(!T){rE(EE(this.path),{recursive:!0,mode:448});try{B(EE(this.path),448)}catch{}}if(this.database=new oE(this.path,{create:!0,strict:!0}),this.database.run("PRAGMA foreign_keys = ON"),this.database.run(`PRAGMA busy_timeout = ${Math.max(100,E.busyTimeoutMs??5000)}`),!T)this.database.run("PRAGMA journal_mode = WAL"),this.database.run("PRAGMA synchronous = NORMAL");if(this.migrate(),!T)this.secureDatabaseFiles()}now(){return this.nowFn().toISOString()}secureDatabaseFiles(){for(let E of[this.path,`${this.path}-wal`,`${this.path}-shm`]){if(!w(E))continue;try{B(E,384)}catch{}}}backupTo(E){this.database.run("VACUUM INTO ?",[E]);try{B(E,384)}catch{}}migrate(){let E=this.database.query("PRAGMA user_version").get(),T=Number(E?.user_version??0);if(T>C)throw new v(T,C);if(T===C)return;let N;if(T>0&&this.path!==":memory:")N=`${this.path}.v${T}.${Date.now()}.bak`,this.backupTo(N);try{if(this.database.transaction(()=>{for(let L of G){if(L.version<=T)continue;this.database.run(L.sql),a(this.database,"INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)",[L.version,L.name,this.now()]),this.database.run(`PRAGMA user_version = ${L.version}`)}}).exclusive(),N)this.setSetting("storage.last_backup",{path:N,createdAt:this.now(),reason:"pre-migration"})}catch(e){let L=N?` Restore from ${N}.`:"";throw Error(`Control-plane migration from schema ${T} failed.${L} ${e instanceof Error?e.message:String(e)}`)}}close(){if(this.path!==":memory:")this.secureDatabaseFiles();this.database.close()}transaction(E){return this.database.transaction(E).immediate()}createProject(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,"INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",[T,E.slug,E.name,E.description??null,E.organizationId??null,E.desiredConfigHash??null,N,N]),this.getProject(T)}getProject(E){let T=this.database.query("SELECT * FROM projects WHERE id = ?").get(E);return T?F(T):void 0}getProjectBySlug(E){let T=this.database.query("SELECT * FROM projects WHERE slug = ?").get(E);return T?F(T):void 0}listProjects(){return this.database.query("SELECT * FROM projects ORDER BY name COLLATE NOCASE, id").all().map(F)}updateProject(E,T,N){let e=this.getProject(E);if(!e||e.version!==T)throw new U("Project",E,T);if(a(this.database,`UPDATE projects SET name = ?, description = ?, organization_id = ?, desired_config_hash = ?, version = version + 1, updated_at = ?
+      WHERE id = ? AND version = ?`,[N.name??e.name,N.description===null?null:N.description??e.description??null,N.organizationId===null?null:N.organizationId??e.organizationId??null,N.desiredConfigHash===null?null:N.desiredConfigHash??e.desiredConfigHash??null,this.now(),E,T]).changes!==1)throw new U("Project",E,T);return this.getProject(E)}createEnvironment(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.projectId,E.slug,E.name,E.kind,E.region??null,r(E.desiredState??{}),r(E.discoveredState??{}),N,N]),y(this.database.query("SELECT * FROM environments WHERE id = ?").get(T))}listEnvironments(E){return this.database.query("SELECT * FROM environments WHERE project_id = ? ORDER BY name COLLATE NOCASE, id").all(E).map(y)}getEnvironmentBySlug(E,T){let N=this.database.query("SELECT * FROM environments WHERE project_id = ? AND slug = ?").get(E,T);return N?y(N):void 0}createResource(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.projectId,E.environmentId??null,E.kind,E.slug,E.name,E.provider??null,E.providerId??null,r(E.desiredState??{}),r(E.discoveredState??{}),r(E.metadata??{}),N,N]),m(this.database.query("SELECT * FROM resources WHERE id = ?").get(T))}listResources(E,T){return(T?this.database.query("SELECT * FROM resources WHERE project_id = ? AND environment_id = ? ORDER BY kind, name COLLATE NOCASE").all(E,T):this.database.query("SELECT * FROM resources WHERE project_id = ? ORDER BY kind, name COLLATE NOCASE").all(E)).map(m)}getResource(E){let T=this.database.query("SELECT * FROM resources WHERE id = ?").get(E);return T?m(T):void 0}updateResource(E,T,N){let e=this.getResource(E);if(!e||e.version!==T)throw new U("Resource",E,T);if(a(this.database,`UPDATE resources SET name = ?, provider = ?, provider_id = ?, desired_state = ?, discovered_state = ?, metadata = ?,
+      version = version + 1, updated_at = ? WHERE id = ? AND version = ?`,[N.name??e.name,N.provider===null?null:N.provider??e.provider??null,N.providerId===null?null:N.providerId??e.providerId??null,r(N.desiredState??e.desiredState),r(N.discoveredState??e.discoveredState),r(N.metadata??e.metadata),this.now(),E,T]).changes!==1)throw new U("Resource",E,T);return this.getResource(E)}createActor(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,"INSERT INTO actors (id, kind, external_id, display_name, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[T,E.kind,E.externalId??null,E.displayName,r(E.metadata??{}),N,N]),f(this.database.query("SELECT * FROM actors WHERE id = ?").get(T))}getActorByExternalId(E,T){let N=this.database.query("SELECT * FROM actors WHERE kind = ? AND external_id = ?").get(E,T);return N?f(N):void 0}getActor(E){let T=this.database.query("SELECT * FROM actors WHERE id = ?").get(E);return T?f(T):void 0}createOrganization(E){let T=E.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/.test(T))throw Error("Organization slugs must contain 3-64 lowercase letters, numbers, or dashes");let N=E.name.trim();if(!N||N.length>100)throw Error("Organization names must contain 1-100 characters");let e=E.id??this.idFn(),L=this.now();return a(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[e,T,N,L,L]),this.getOrganization(e)}getOrganization(E){let T=this.database.query("SELECT * FROM organizations WHERE id = ?").get(E);return T?b(T):void 0}getOrganizationBySlug(E){let T=this.database.query("SELECT * FROM organizations WHERE slug = ?").get(E.trim().toLowerCase());return T?b(T):void 0}listOrganizations(E){return(E?this.database.query(`SELECT organizations.* FROM organizations JOIN organization_memberships ON organization_memberships.organization_id = organizations.id
+          WHERE organization_memberships.actor_id = ? AND organization_memberships.status = 'active' ORDER BY organizations.name COLLATE NOCASE`).all(E):this.database.query("SELECT * FROM organizations ORDER BY name COLLATE NOCASE").all()).map(b)}normalizeAuthorizationScope(E,T={type:"organization"}){if(T.type==="organization"){if(T.id&&T.id!==E)throw Error("Organization scope does not match the requested organization");return{type:"organization"}}if(!T.id)throw Error(`${T.type} scopes require an ID`);if(!this.resolveAuthorizationTarget(E,T))throw Error("Authorization scope was not found in this organization");return{type:T.type,id:T.id}}resolveAuthorizationTarget(E,T){if(!this.getOrganization(E))return;if(T.type==="organization")return{organizationId:E};if(!T.id)return;if(T.type==="project"){let e=this.database.query("SELECT id FROM projects WHERE id = ? AND organization_id = ?").get(T.id,E);return e?{organizationId:E,projectId:String(e.id)}:void 0}if(T.type==="environment"){let e=this.database.query("SELECT environments.id, environments.project_id FROM environments JOIN projects ON projects.id = environments.project_id WHERE environments.id = ? AND projects.organization_id = ?").get(T.id,E);return e?{organizationId:E,projectId:String(e.project_id),environmentId:String(e.id)}:void 0}let N=this.database.query(`SELECT resources.id, resources.project_id, resources.environment_id FROM resources
+      JOIN projects ON projects.id = resources.project_id WHERE resources.id = ? AND projects.organization_id = ?`).get(T.id,E);return N?{organizationId:E,projectId:String(N.project_id),environmentId:d(N.environment_id),resourceId:String(N.id)}:void 0}createMembership(E){if(!this.getActor(E.actorId))throw Error("Membership actor was not found");let T=this.normalizeAuthorizationScope(E.organizationId,E.scope);if(E.roleTemplate==="owner"&&T.type!=="organization")throw Error("Owners must be scoped to the organization");let N=E.id??this.idFn(),e=this.now();a(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, source, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[N,E.organizationId,E.actorId,E.roleTemplate,T.type,T.id??null,E.source??"manual",e,e]);let L=this.getMembership(N);return this.appendEvent({organizationId:E.organizationId,actorId:E.performedByActorId,type:"organization.membership.created",payload:{membershipId:N,actorId:E.actorId,roleTemplate:E.roleTemplate,scope:D(T)}}),L}getMembership(E){let T=this.database.query("SELECT * FROM organization_memberships WHERE id = ?").get(E);return T?k(T):void 0}getMembershipForActor(E,T){let N=this.database.query("SELECT * FROM organization_memberships WHERE organization_id = ? AND actor_id = ?").get(E,T);return N?k(N):void 0}listMemberships(E,T={}){let N=T.includeRevoked?"":"AND status = 'active'";return this.database.query(`SELECT * FROM organization_memberships WHERE organization_id = ? ${N} ORDER BY created_at, id`).all(E).map(k)}updateMembership(E){let T=this.getMembership(E.id);if(!T)throw Error("Membership was not found");let N=this.normalizeAuthorizationScope(T.organizationId,E.scope??T.scope);if(E.roleTemplate==="owner"&&N.type!=="organization")throw Error("Owners must be scoped to the organization");if(T.roleTemplate==="owner"&&T.status==="active"&&(E.roleTemplate!=="owner"||N.type!=="organization"))this.assertAnotherOwner(T);return a(this.database,"UPDATE organization_memberships SET role_template = ?, scope_type = ?, scope_id = ?, session_version = session_version + 1, updated_at = ? WHERE id = ?",[E.roleTemplate,N.type,N.id??null,this.now(),T.id]),this.appendEvent({organizationId:T.organizationId,actorId:E.actorId,type:"organization.membership.updated",payload:{membershipId:T.id,from:{roleTemplate:T.roleTemplate,scope:D(T.scope)},to:{roleTemplate:E.roleTemplate,scope:D(N)}}}),this.getMembership(T.id)}revokeMembership(E,T){let N=this.getMembership(E);if(!N)throw Error("Membership was not found");if(N.status==="revoked")return N;if(N.roleTemplate==="owner")this.assertAnotherOwner(N);return a(this.database,"UPDATE organization_memberships SET status = 'revoked', session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),E]),this.appendEvent({organizationId:N.organizationId,actorId:T,type:"organization.membership.revoked",payload:{membershipId:E}}),this.getMembership(E)}touchMembership(E){let T=this.now();a(this.database,"UPDATE organization_memberships SET last_active_at = ?, updated_at = ? WHERE id = ? AND status = ?",[T,T,E,"active"]);let N=this.getMembership(E);if(!N)throw Error("Membership was not found");return N}assertAnotherOwner(E){if(Number(this.database.query("SELECT COUNT(*) AS count FROM organization_memberships WHERE organization_id = ? AND status = ? AND role_template = 'owner'").get(E.organizationId,"active")?.count??0)<=1)throw Error("Cannot remove or demote the last organization owner")}createInvitation(E){let T=E.email.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(T)||T.length>254)throw Error("A valid invitation email is required");let N=this.normalizeAuthorizationScope(E.organizationId,E.scope);if(E.roleTemplate==="owner"&&N.type!=="organization")throw Error("Owners must be scoped to the organization");let e=dE(32).toString("base64url"),L=g("sha256").update(e).digest("hex"),t=E.id??this.idFn(),_=this.now(),s=new Date(this.nowFn().getTime()+Math.min(2592000000,Math.max(60000,E.expiresInMs??604800000))).toISOString();return a(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, expires_at, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E.organizationId,T,E.roleTemplate,N.type,N.id??null,L,E.invitedByActorId??null,s,_,_]),this.appendEvent({organizationId:E.organizationId,actorId:E.invitedByActorId,type:"organization.invitation.created",payload:{invitationId:t,email:T,roleTemplate:E.roleTemplate,scope:D(N),expiresAt:s}}),{invitation:this.getInvitation(t),token:e}}getInvitation(E){let T=this.database.query("SELECT * FROM organization_invitations WHERE id = ?").get(E);return T?A(T,this.now()):void 0}listInvitations(E){return this.database.query("SELECT * FROM organization_invitations WHERE organization_id = ? ORDER BY created_at DESC").all(E).map((T)=>A(T,this.now()))}inspectInvitationToken(E){let T=g("sha256").update(E).digest("hex"),N=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(T);return N?A(N,this.now()):void 0}acceptInvitation(E,T){let N=g("sha256").update(E).digest("hex");return this.transaction(()=>{let e=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(N);if(!e)throw Error("Invitation is invalid");let L=A(e,this.now());if(L.state!=="pending")throw Error(`Invitation is ${L.state}`);if(!this.getActor(T))throw Error("Invitation actor was not found");if(a(this.database,"UPDATE organization_invitations SET accepted_by_actor_id = ?, accepted_at = ?, updated_at = ? WHERE id = ? AND accepted_at IS NULL AND revoked_at IS NULL AND expires_at > ?",[T,this.now(),this.now(),L.id,this.now()]).changes!==1)throw Error("Invitation is no longer available");let _=this.getMembershipForActor(L.organizationId,T),s=_??this.createMembership({organizationId:L.organizationId,actorId:T,roleTemplate:L.roleTemplate,scope:L.scope,source:"invitation"});if(_&&L.roleTemplate==="owner"&&_.roleTemplate!=="owner")s=this.updateMembership({id:_.id,roleTemplate:"owner",scope:{type:"organization"},actorId:T});else if(_)for(let n of u(L.roleTemplate))this.upsertGrant({organizationId:L.organizationId,membershipId:_.id,effect:"allow",capability:n,scope:L.scope,source:"invitation"});return this.appendEvent({organizationId:L.organizationId,actorId:T,type:"organization.invitation.accepted",payload:{invitationId:L.id,membershipId:s.id}}),{invitation:this.getInvitation(L.id),membership:this.getMembership(s.id)}})}revokeInvitation(E,T){let N=this.getInvitation(E);if(!N)throw Error("Invitation was not found");if(N.acceptedAt)throw Error("Accepted invitations cannot be revoked");if(!N.revokedAt)a(this.database,"UPDATE organization_invitations SET revoked_at = ?, updated_at = ? WHERE id = ?",[this.now(),this.now(),E]);return this.appendEvent({organizationId:N.organizationId,actorId:T,type:"organization.invitation.revoked",payload:{invitationId:E}}),this.getInvitation(E)}reissueInvitation(E,T){let N=this.getInvitation(E);if(!N)throw Error("Invitation was not found");if(N.state==="accepted")throw Error("Accepted invitations cannot be reissued");return this.revokeInvitation(E,T),this.createInvitation({organizationId:N.organizationId,email:N.email,roleTemplate:N.roleTemplate,scope:N.scope,invitedByActorId:T})}upsertGrant(E){if(!X.includes(E.capability))throw Error("Unknown authorization capability");let T=this.getMembership(E.membershipId);if(!T||T.organizationId!==E.organizationId)throw Error("Grant membership was not found in this organization");let N=this.normalizeAuthorizationScope(E.organizationId,E.scope),e=this.now(),L=this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? AND effect = ? AND capability = ? AND scope_type = ? AND scope_id IS ?").get(E.membershipId,E.effect,E.capability,N.type,N.id??null);if(L)return H(L);let t=E.id??this.idFn();return a(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E.organizationId,E.membershipId,E.effect,E.capability,N.type,N.id??null,E.source??"manual",e,e]),a(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[e,E.membershipId]),this.appendEvent({organizationId:E.organizationId,actorId:E.actorId,type:"organization.grant.created",payload:{grantId:t,membershipId:E.membershipId,effect:E.effect,capability:E.capability,scope:D(N)}}),this.getGrant(t)}getGrant(E){let T=this.database.query("SELECT * FROM authorization_grants WHERE id = ?").get(E);return T?H(T):void 0}listGrants(E){return this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? ORDER BY effect DESC, capability, scope_type, scope_id").all(E).map(H)}removeGrant(E,T){let N=this.getGrant(E);if(!N)return!1;let e=a(this.database,"DELETE FROM authorization_grants WHERE id = ?",[E]).changes===1;if(e)a(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),N.membershipId]),this.appendEvent({organizationId:N.organizationId,actorId:T,type:"organization.grant.removed",payload:{grantId:E,membershipId:N.membershipId}});return e}createOperation(E){if(E.idempotencyKey){let L=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(E.idempotencyKey);if(L)return O(L)}let T=E.id??this.idFn(),N=E.correlationId??this.idFn(),e=this.now();try{return this.transaction(()=>{return a(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key, input, output, priority, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, '{}', ?, ?, ?)`,[T,E.projectId??null,E.environmentId??null,E.resourceId??null,E.actorId??null,E.kind,N,E.idempotencyKey??null,r(E.input??{}),E.priority??0,e,e]),this.appendEvent({projectId:E.projectId,operationId:T,resourceId:E.resourceId,actorId:E.actorId,correlationId:N,type:"operation.queued",payload:{kind:E.kind}}),this.getOperation(T)})}catch(L){if(E.idempotencyKey){let t=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(E.idempotencyKey);if(t)return O(t)}throw L}}getOperation(E){let T=this.database.query("SELECT * FROM operations WHERE id = ?").get(E);return T?O(T):void 0}listOperations(E={}){let T=[],N=[];if(E.projectId)T.push("project_id = ?"),N.push(E.projectId);if(E.state)T.push("state = ?"),N.push(E.state);if(E.kind)T.push("kind = ?"),N.push(E.kind);if(E.before)T.push("created_at < ?"),N.push(E.before);let e=Math.min(500,Math.max(1,E.limit??100));N.push(e);let L=T.length?`WHERE ${T.join(" AND ")}`:"";return this.database.query(`SELECT * FROM operations ${L} ORDER BY created_at DESC, id DESC LIMIT ?`).all(...N).map(O)}claimNextOperation(E,T=60000,N){let e=this.now(),L=new Date(this.nowFn().getTime()+T).toISOString();return this.transaction(()=>{let t=N?.length?`AND kind IN (${OE(N.length)})`:"",_=N?[...N]:[],s=this.database.query(`SELECT * FROM operations WHERE state = 'queued' ${t} ORDER BY priority DESC, created_at ASC, id ASC LIMIT 1`).get(..._);if(!s)return;let n=O(s);if(a(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
+        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[E,L,e,e,n.id,n.version]).changes!==1)return;return this.appendEvent({projectId:n.projectId,operationId:n.id,resourceId:n.resourceId,actorId:n.actorId,correlationId:n.correlationId,type:"operation.running",payload:{attempt:n.attempt+1,workerId:E}}),this.getOperation(n.id)})}claimOperation(E,T,N=60000){let e=this.now(),L=new Date(this.nowFn().getTime()+N).toISOString();return this.transaction(()=>{let t=this.getOperation(E);if(!t||t.state!=="queued")return;if(a(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
+        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[T,L,e,e,t.id,t.version]).changes!==1)return;return this.appendEvent({projectId:t.projectId,operationId:t.id,resourceId:t.resourceId,actorId:t.actorId,correlationId:t.correlationId,type:"operation.running",payload:{attempt:t.attempt+1,workerId:T}}),this.getOperation(t.id)})}transitionOperation(E,T){return this.transaction(()=>{let N=this.getOperation(E);if(!N)throw Error(`Operation ${E} was not found`);let e=T.expectedVersion??N.version;if(N.version!==e)throw new U("Operation",E,e);if(!CE[N.state].includes(T.to))throw new j(N.state,T.to);let L=this.now(),t=cE.includes(T.to),_=T.to==="queued";if(a(this.database,`UPDATE operations SET state = ?, output = ?, error = ?, lease_owner = ?, lease_expires_at = ?,
+        finished_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND version = ?`,[T.to,r(T.output??N.output),z(T.error)??null,_||t?null:T.leaseOwner??N.leaseOwner??null,_||t?null:T.leaseExpiresAt??N.leaseExpiresAt??null,t?L:null,L,E,e]).changes!==1)throw new U("Operation",E,e);return this.appendEvent({projectId:N.projectId,operationId:E,resourceId:N.resourceId,actorId:N.actorId,correlationId:N.correlationId,type:`operation.${T.to}`,level:T.to==="failed"?"error":"info",payload:{from:N.state,to:T.to,error:z(T.error)??null}}),this.getOperation(E)})}requestCancellation(E){let T=this.now();a(this.database,"UPDATE operations SET cancel_requested_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND state IN ('queued', 'running')",[T,T,E]);let N=this.getOperation(E);if(!N)throw Error(`Operation ${E} was not found`);return N}reconcileOrphanedOperations(E={}){let T=(E.now??this.nowFn()).toISOString(),N=E.policy??"fail",e=this.database.query("SELECT * FROM operations WHERE state = 'running' AND (lease_expires_at IS NULL OR lease_expires_at <= ?)").all(T).map(O),L=0,t=0;for(let _ of e)if(N==="requeue")this.transitionOperation(_.id,{to:"queued",expectedVersion:_.version,error:"Worker lease expired; operation requeued after restart."}),L++;else this.transitionOperation(_.id,{to:"failed",expectedVersion:_.version,error:"Worker lease expired or dashboard restarted before completion."}),t++;return{requeued:L,failed:t}}appendEvent(E){let T=E.id??this.idFn(),N=E.correlationId??this.idFn(),e=E.organizationId??(E.projectId?d(this.database.query("SELECT organization_id FROM projects WHERE id = ?").get(E.projectId)?.organization_id):void 0);return a(this.database,`INSERT INTO events (id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,e??null,E.projectId??null,E.operationId??null,E.resourceId??null,E.actorId??null,N,E.type,E.level??"info",r(E.payload??{}),this.now()]),M(this.database.query("SELECT * FROM events WHERE id = ?").get(T))}listEvents(E={}){let T=[],N=[];if(E.organizationId)T.push("organization_id = ?"),N.push(E.organizationId);if(E.projectId)T.push("project_id = ?"),N.push(E.projectId);if(E.operationId)T.push("operation_id = ?"),N.push(E.operationId);if(E.resourceId)T.push("resource_id = ?"),N.push(E.resourceId);if(E.correlationId)T.push("correlation_id = ?"),N.push(E.correlationId);if(E.afterSequence!==void 0)T.push("sequence > ?"),N.push(E.afterSequence);let e=Math.min(1000,Math.max(1,E.limit??200));N.push(e);let L=T.length?`WHERE ${T.join(" AND ")}`:"";return this.database.query(`SELECT * FROM events ${L} ORDER BY sequence ASC LIMIT ?`).all(...N).map(M)}setSetting(E,T){a(this.database,`INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)
+      ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`,[E,r(T),this.now()])}getSetting(E){let T=this.database.query("SELECT value FROM settings WHERE key = ?").get(E);return T?c(T.value):void 0}upsertTag(E,T,N="#5a8be0"){let e=T.trim().toLowerCase().replace(/\s+/g,"-");if(!/^[a-z0-9][a-z0-9-]{0,31}$/.test(e))throw Error("Tag names must contain 1-32 letters, numbers, or dashes");if(!/^#[0-9a-f]{6}$/i.test(N))throw Error("Tag colors must be six-digit hex colors");let L=this.now(),t=this.database.query("SELECT * FROM tags WHERE project_id = ? AND normalized_name = ?").get(E,e);if(t)return a(this.database,"UPDATE tags SET name = ?, color = ?, updated_at = ? WHERE id = ?",[T.trim(),N.toLowerCase(),L,String(t.id)]),l(this.database.query("SELECT * FROM tags WHERE id = ?").get(String(t.id)));let _=this.idFn();return a(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[_,E,T.trim(),e,N.toLowerCase(),L,L]),l(this.database.query("SELECT * FROM tags WHERE id = ?").get(_))}listTags(E){return this.database.query("SELECT * FROM tags WHERE project_id = ? ORDER BY normalized_name").all(E).map(l)}assignTag(E,T){if(!this.database.query("SELECT tags.id FROM tags JOIN resources ON resources.project_id = tags.project_id WHERE tags.id = ? AND resources.id = ?").get(T,E))throw Error("The tag and resource must belong to the same project");a(this.database,"INSERT OR IGNORE INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[E,T,this.now()])}removeTag(E,T){a(this.database,"DELETE FROM resource_tags WHERE resource_id = ? AND tag_id = ?",[E,T])}listResourceTags(E){return this.database.query(`SELECT resource_tags.resource_id, tags.* FROM resource_tags JOIN tags ON tags.id = resource_tags.tag_id
+      WHERE tags.project_id = ? ORDER BY tags.normalized_name`).all(E).map((N)=>({resourceId:String(N.resource_id),tag:l(N)}))}saveFilter(E,T,N,e){let L=T.trim();if(!L||L.length>64)throw Error("Saved filter names must contain 1-64 characters");if(!N||N.length>160||/^[a-z][a-z0-9+.-]*:|^\/\//i.test(N))throw Error("Saved filter routes must be local route IDs or paths");let t=r(e);if(t.length>8192)throw Error("Saved filter queries must be smaller than 8 KB");let _=this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? AND name = ?").get(E,L),s=this.now();if(_)return a(this.database,"UPDATE saved_filters SET route_id = ?, query = ?, updated_at = ? WHERE id = ?",[N,t,s,String(_.id)]),h(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(String(_.id)));let n=this.idFn();return a(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[n,E,L,N,t,s,s]),h(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(n))}listSavedFilters(E){return this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? ORDER BY updated_at DESC, name").all(E).map(h)}deleteSavedFilter(E,T){return a(this.database,"DELETE FROM saved_filters WHERE actor_key = ? AND id = ?",[E,T]).changes===1}recordNavigation(E,T,N){let e=this.now();return a(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, last_visited_at) VALUES (?, ?, ?, ?)
+      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET last_visited_at = excluded.last_visited_at, visit_count = visit_count + 1`,[E,T,N,e]),K(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(E,T,N))}setFavorite(E,T,N,e){let L=this.now();return a(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at) VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET favorite = excluded.favorite`,[E,T,N,e?1:0,L]),K(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(E,T,N))}listNavigation(E,T={}){let N=T.favoritesOnly?"AND favorite = 1":"",e=Math.min(100,Math.max(1,T.limit??20));return this.database.query(`SELECT * FROM navigation_items WHERE actor_key = ? ${N} ORDER BY favorite DESC, last_visited_at DESC LIMIT ?`).all(E,e).map(K)}compact(E={}){let T=new Date(this.nowFn().getTime()-(E.eventRetentionDays??90)*86400000).toISOString(),N=new Date(this.nowFn().getTime()-(E.operationRetentionDays??365)*86400000).toISOString(),e=this.transaction(()=>{let L=a(this.database,"DELETE FROM events WHERE created_at < ?",[T]).changes,t=a(this.database,"DELETE FROM operations WHERE created_at < ? AND state IN ('succeeded', 'failed', 'cancelled', 'timed_out')",[N]).changes;return{events:L,operations:t}});if(E.vacuum!==!1)this.database.run("VACUUM");return{deletedEvents:e.events,deletedOperations:e.operations,vacuumed:E.vacuum!==!1}}createBackup(E="manual"){if(this.path===":memory:")throw Error("Cannot create a filesystem backup for an in-memory control plane");let T=`${this.path}.${Date.now()}.bak`;return this.backupTo(T),this.setSetting("storage.last_backup",{path:T,createdAt:this.now(),reason:E}),T}integrityCheck(){let E=this.database.query("PRAGMA integrity_check").all();return E.length===1&&Object.values(E[0])[0]==="ok"?"ok":"corrupt"}health(){let E=Object.fromEntries(["queued","running","succeeded","failed","cancelled","timed_out"].map((L)=>[L,0]));for(let L of this.database.query("SELECT state, COUNT(*) AS count FROM operations GROUP BY state").all())E[String(L.state)]=Number(L.count);let T=this.database.query("PRAGMA journal_mode").get(),N=this.getSetting("storage.last_backup"),e=N&&!Array.isArray(N)&&typeof N==="object"&&typeof N.createdAt==="string"?N.createdAt:void 0;return{path:this.path,schemaVersion:Number(this.database.query("PRAGMA user_version").get()?.user_version??0),supportedSchemaVersion:C,integrity:this.integrityCheck(),journalMode:String(T?.journal_mode??"unknown"),databaseBytes:this.path!==":memory:"&&w(this.path)?nE(this.path).size:this.database.serialize().byteLength,lastBackupAt:e,operations:E,pendingRetryableOperations:E.queued+E.failed+E.timed_out}}exportSnapshot(){let E={};for(let T of this.database.query("SELECT key, value FROM settings ORDER BY key").all())E[String(T.key)]=c(T.value);return{format:"ts-cloud-control-plane",schemaVersion:C,exportedAt:this.now(),organizations:this.database.query("SELECT * FROM organizations ORDER BY id").all().map(b),memberships:this.database.query("SELECT * FROM organization_memberships ORDER BY id").all().map(k),invitations:this.database.query("SELECT * FROM organization_invitations ORDER BY id").all().map((T)=>({...A(T,this.now()),tokenHash:String(T.token_hash)})),grants:this.database.query("SELECT * FROM authorization_grants ORDER BY id").all().map(H),projects:this.database.query("SELECT * FROM projects ORDER BY id").all().map(F),environments:this.database.query("SELECT * FROM environments ORDER BY id").all().map(y),resources:this.database.query("SELECT * FROM resources ORDER BY id").all().map(m),actors:this.database.query("SELECT * FROM actors ORDER BY id").all().map(f),operations:this.database.query("SELECT * FROM operations ORDER BY id").all().map(O),events:this.database.query("SELECT * FROM events ORDER BY sequence").all().map(M),settings:E,tags:this.database.query("SELECT * FROM tags ORDER BY id").all().map(l),resourceTags:this.database.query("SELECT * FROM resource_tags ORDER BY resource_id, tag_id").all().map((T)=>({resourceId:String(T.resource_id),tagId:String(T.tag_id),createdAt:String(T.created_at)})),savedFilters:this.database.query("SELECT * FROM saved_filters ORDER BY id").all().map(h),navigationItems:this.database.query("SELECT * FROM navigation_items ORDER BY actor_key, entity_type, entity_id").all().map(K)}}importSnapshot(E,T={}){if(E.format!=="ts-cloud-control-plane")throw Error("Unsupported control-plane snapshot format");if(E.schemaVersion>C)throw new v(E.schemaVersion,C);this.transaction(()=>{if((Number(this.database.query("SELECT COUNT(*) AS count FROM projects").get()?.count??0)>0||Number(this.database.query("SELECT COUNT(*) AS count FROM operations").get()?.count??0)>0)&&!T.replace)throw Error("Control plane is not empty; pass replace: true to import this snapshot");if(T.replace)this.database.run("DELETE FROM authorization_grants"),this.database.run("DELETE FROM organization_invitations"),this.database.run("DELETE FROM organization_memberships"),this.database.run("DELETE FROM resource_tags"),this.database.run("DELETE FROM tags"),this.database.run("DELETE FROM saved_filters"),this.database.run("DELETE FROM navigation_items"),this.database.run("DELETE FROM events"),this.database.run("DELETE FROM operations"),this.database.run("DELETE FROM resources"),this.database.run("DELETE FROM environments"),this.database.run("DELETE FROM projects"),this.database.run("DELETE FROM actors"),this.database.run("DELETE FROM organizations"),this.database.run("DELETE FROM settings");for(let e of E.organizations??[])a(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[e.id,e.slug,e.name,e.createdAt,e.updatedAt]);for(let e of E.projects)a(this.database,`INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.slug,e.name,e.description??null,e.organizationId??null,e.desiredConfigHash??null,e.version,e.createdAt,e.updatedAt]);for(let e of E.environments)a(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.projectId,e.slug,e.name,e.kind,e.region??null,r(e.desiredState),r(e.discoveredState),e.version,e.createdAt,e.updatedAt]);for(let e of E.resources)a(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.projectId,e.environmentId??null,e.kind,e.slug,e.name,e.provider??null,e.providerId??null,r(e.desiredState),r(e.discoveredState),r(e.metadata),e.version,e.createdAt,e.updatedAt]);for(let e of E.actors)a(this.database,`INSERT INTO actors (id, kind, external_id, display_name, metadata, disabled_at, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.kind,e.externalId??null,e.displayName,r(e.metadata),e.disabledAt??null,e.version,e.createdAt,e.updatedAt]);for(let e of E.memberships??[])a(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, status, session_version, last_active_at, source, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.organizationId,e.actorId,e.roleTemplate,e.scope.type,e.scope.id??null,e.status,e.sessionVersion,e.lastActiveAt??null,e.source??"manual",e.createdAt,e.updatedAt]);for(let e of E.invitations??[]){let L=e.tokenHash??g("sha256").update(`revoked:${e.id}:${this.idFn()}`).digest("hex");a(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, accepted_by_actor_id, expires_at, accepted_at, revoked_at, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.organizationId,e.email,e.roleTemplate,e.scope.type,e.scope.id??null,L,e.invitedByActorId??null,e.acceptedByActorId??null,e.expiresAt,e.acceptedAt??null,e.tokenHash?e.revokedAt??null:e.revokedAt??this.now(),e.createdAt,e.updatedAt])}for(let e of E.grants??[])a(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.organizationId,e.membershipId,e.effect,e.capability,e.scope.type,e.scope.id??null,e.source??"manual",e.createdAt,e.updatedAt]);for(let e of E.operations)a(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key,
+          input, output, error, attempt, priority, lease_owner, lease_expires_at, cancel_requested_at, started_at, finished_at, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.projectId??null,e.environmentId??null,e.resourceId??null,e.actorId??null,e.kind,e.state,e.correlationId,e.idempotencyKey??null,r(e.input),r(e.output),z(e.error)??null,e.attempt,e.priority,e.leaseOwner??null,e.leaseExpiresAt??null,e.cancelRequestedAt??null,e.startedAt??null,e.finishedAt??null,e.version,e.createdAt,e.updatedAt]);for(let e of E.events)a(this.database,`INSERT INTO events (sequence, id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.sequence,e.id,e.organizationId??null,e.projectId??null,e.operationId??null,e.resourceId??null,e.actorId??null,e.correlationId,e.type,e.level,r(e.payload),e.createdAt]);for(let[e,L]of Object.entries(E.settings))a(this.database,"INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)",[e,r(L),this.now()]);for(let e of E.tags??[])a(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[e.id,e.projectId,e.name,e.normalizedName,e.color,e.createdAt,e.updatedAt]);for(let e of E.resourceTags??[])a(this.database,"INSERT INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[e.resourceId,e.tagId,e.createdAt]);for(let e of E.savedFilters??[])a(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[e.id,e.actorKey,e.name,e.routeId,r(e.query),e.createdAt,e.updatedAt]);for(let e of E.navigationItems??[])a(this.database,"INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at, visit_count) VALUES (?, ?, ?, ?, ?, ?)",[e.actorKey,e.entityType,e.entityId,e.favorite?1:0,e.lastVisitedAt,e.visitCount])})}}var XE=new Set(["domain","domains","hostname","hostnames","url","repository","repo","image","label","labels"]),RE=new Set(["sha","commit","commitsha","release","releaseid"]);function tE(E,T){if(!E||typeof E!=="object"||Array.isArray(E))return[];let N=[];for(let[e,L]of Object.entries(E)){if(!T.has(e.toLowerCase()))continue;if(typeof L==="string")N.push(L);else if(Array.isArray(L))N.push(...L.filter((t)=>typeof t==="string"))}return N}function W(E){return E.toLowerCase().trim().replace(/[^a-z0-9._:/@-]+/g," ")}function $(E,T,N){let e=W(E),L=W(T),t=W(N);if(!e)return 0;if(L===e)return 1000;if(L.startsWith(e))return 800-Math.min(100,L.length-e.length);if(L.includes(e))return 650-Math.min(100,L.indexOf(e));let _=e.split(/\s+/).filter(Boolean);if(_.every((n)=>t.includes(n)))return 400+_.length*10;let s=0;for(let n of e){if(s=t.indexOf(n,s),s<0)return 0;s++}return Math.max(1,180-Math.floor(t.length/20))}function lE(E,T){let N=E.kind.toLowerCase();if(N==="server"||N==="compute")return{type:"server",href:`/server/metrics?env=${encodeURIComponent(T)}`};if(N.includes("database")||["mysql","postgres","postgresql","sqlite","redis"].includes(N))return{type:"database",href:`/server/database?env=${encodeURIComponent(T)}&database=${encodeURIComponent(E.slug)}`};return{type:"service",href:`/server/sites?env=${encodeURIComponent(T)}&service=${encodeURIComponent(E.slug)}`}}function AE(E,T){let N=E.getProject(T.projectId);if(!N)return[];let e=E.listEnvironments(N.id),L=new Map(e.map((i)=>[i.id,i])),t=E.listResourceTags(N.id),_=new Map;for(let i of t){let o=_.get(i.resourceId)??[];o.push({id:i.tag.id,name:i.tag.name,color:i.tag.color}),_.set(i.resourceId,o)}let s=[],n=T.allowedResourceSlugs!==void 0;if(!n){s.push({type:"project",id:N.id,title:N.name,subtitle:N.slug,href:`/?project=${encodeURIComponent(N.slug)}`,tags:[],score:0});for(let i of e)s.push({type:"environment",id:i.id,title:i.name,subtitle:`${N.name} · ${i.kind}`,href:`/?env=${encodeURIComponent(i.slug)}`,environment:i.slug,tags:[],score:0})}let Z=E.listResources(N.id).filter((i)=>!T.allowedResourceSlugs||T.allowedResourceSlugs.has(i.slug));for(let i of Z){let o=i.environmentId?L.get(i.environmentId):void 0,R=_.get(i.id)??[],S=tE(i.desiredState,XE),I=[i.name,i.slug,i.kind,i.provider,i.providerId,o?.slug,...S,...R.map((aE)=>aE.name)].filter(Boolean).join(" "),p=lE(i,o?.slug??e[0]?.slug??"");s.push({type:p.type,id:i.id,title:i.name,subtitle:[i.kind,...S.slice(0,2)].join(" · "),href:p.href,environment:o?.slug,provider:i.provider,tags:R,score:$(T.query,i.name,I)})}if(!n)for(let i of E.listOperations({projectId:N.id,limit:500})){let o=i.environmentId?L.get(i.environmentId):void 0,R=tE(i.input,RE),S=i.kind.includes("deploy"),I=R[0]??i.kind,p=[i.kind,i.id,i.correlationId,i.state,...R].join(" ");s.push({type:S?"deployment":"operation",id:i.id,title:I,subtitle:`${i.kind} · ${i.state}`,href:`/server/activity?env=${encodeURIComponent(o?.slug??e[0]?.slug??"")}&operation=${encodeURIComponent(i.id)}`,environment:o?.slug,status:i.state,tags:[],score:$(T.query,I,p)})}for(let i of s)if(i.score===0)i.score=$(T.query,i.title,`${i.title} ${i.subtitle} ${i.environment??""} ${i.provider??""}`);let J={service:0,server:1,database:2,deployment:3,environment:4,project:5,operation:6};return s.filter((i)=>i.score>0).sort((i,o)=>o.score-i.score||J[i.type]-J[o.type]||i.title.localeCompare(o.title)||i.id.localeCompare(o.id)).slice(0,Math.min(50,Math.max(1,T.limit??20)))}export{X as jg,u as kg,V as lg,sE as mg,LE as ng,iE as og,AE as pg};