@superblocksteam/shared 0.9604.2 → 0.9605.0

package/src/database-lifecycle/destructiveMigrations.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, test } from 'vitest';
+
+import { analyzeDestructiveMigrations } from './destructiveMigrations.js';
+
+describe('analyzeDestructiveMigrations', () => {
+  test('returns empty when SQL has no destructive statements', () => {
+    expect(
+      analyzeDestructiveMigrations([
+        {
+          fileName: '0001_init.sql',
+          sql: 'CREATE TABLE users (id uuid PRIMARY KEY);\nALTER TABLE users ADD COLUMN email text;'
+        }
+      ])
+    ).toEqual([]);
+  });
+
+  test('flags DROP TABLE', () => {
+    const findings = analyzeDestructiveMigrations([{ fileName: '0002_drop_users.sql', sql: 'DROP TABLE users;' }]);
+    expect(findings).toEqual([
+      {
+        fileName: '0002_drop_users.sql',
+        kind: 'drop_table',
+        excerpt: expect.stringMatching(/DROP TABLE users/i)
+      }
+    ]);
+  });
+
+  test('flags DROP DATABASE, DROP SCHEMA, TRUNCATE, and DROP COLUMN', () => {
+    const findings = analyzeDestructiveMigrations([
+      {
+        fileName: '0003_multi.sql',
+        sql: `
+DROP DATABASE IF EXISTS old_db;
+DROP SCHEMA public CASCADE;
+TRUNCATE TABLE events;
+ALTER TABLE users DROP COLUMN email;
+`
+      }
+    ]);
+    expect(findings.map((f) => f.kind).sort()).toEqual(['drop_column', 'drop_database', 'drop_schema', 'truncate']);
+  });
+
+  test('flags ALTER TABLE … DROP col without the COLUMN keyword', () => {
+    // Postgres treats COLUMN as optional: ALTER TABLE t DROP c;
+    const findings = analyzeDestructiveMigrations([{ fileName: '0003b_drop_col_short.sql', sql: 'ALTER TABLE users DROP email;' }]);
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.kind).toBe('drop_column');
+  });
+
+  test('flags standalone DROP COLUMN without ALTER prefix', () => {
+    const findings = analyzeDestructiveMigrations([{ fileName: '0004_drop_col.sql', sql: 'DROP COLUMN orphaned;' }]);
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.kind).toBe('drop_column');
+  });
+
+  test('ignores DROP INDEX, DROP VIEW, DROP CONSTRAINT, and non-column ALTER', () => {
+    expect(
+      analyzeDestructiveMigrations([
+        {
+          fileName: '0005_safe.sql',
+          sql: `
+DROP INDEX users_email_idx;
+DROP VIEW user_summary;
+ALTER TABLE users DROP CONSTRAINT users_email_key;
+ALTER TABLE users DROP INDEX users_email_idx;
+ALTER TABLE users ADD COLUMN name text;
+`
+        }
+      ])
+    ).toEqual([]);
+  });
+
+  test('ignores ALTER COLUMN DROP NOT NULL / DROP DEFAULT / DROP EXPRESSION (not column drops)', () => {
+    expect(
+      analyzeDestructiveMigrations([
+        {
+          fileName: '0005b_safe_alter.sql',
+          sql: `
+ALTER TABLE users ALTER COLUMN email DROP NOT NULL;
+ALTER TABLE users ALTER COLUMN status DROP DEFAULT;
+ALTER TABLE users ALTER COLUMN full_name DROP EXPRESSION;
+`
+        }
+      ])
+    ).toEqual([]);
+  });
+
+  test('does not flag DELETE FROM (data DML is out of the schema-destroying set)', () => {
+    expect(analyzeDestructiveMigrations([{ fileName: '0005c_delete.sql', sql: 'DELETE FROM users WHERE id = 1;' }])).toEqual([]);
+  });
+
+  test('strips line and block comments before matching', () => {
+    expect(
+      analyzeDestructiveMigrations([
+        {
+          fileName: '0006_commented.sql',
+          sql: `
+-- DROP TABLE users;
+/* DROP DATABASE doomed; */
+CREATE TABLE users (id int);
+`
+        }
+      ])
+    ).toEqual([]);
+  });
+
+  test('is case-insensitive and finds multiple statements across files', () => {
+    const findings = analyzeDestructiveMigrations([
+      { fileName: 'a.sql', sql: 'drop table IF EXISTS foo;' },
+      { fileName: 'b.sql', sql: 'Truncate events;' }
+    ]);
+    expect(findings).toHaveLength(2);
+    expect(findings[0]).toMatchObject({ fileName: 'a.sql', kind: 'drop_table' });
+    expect(findings[1]).toMatchObject({ fileName: 'b.sql', kind: 'truncate' });
+  });
+});

package/src/database-lifecycle/destructiveMigrations.ts

@@ -0,0 +1,105 @@
+export const DESTRUCTIVE_MIGRATION_ACK_REQUIRED = 'DESTRUCTIVE_MIGRATION_ACK_REQUIRED' as const;
+/**
+ * Deploy rejection message for unacknowledged destructive migrations. The
+ * client only receives the message text (the classified error code does not
+ * survive HTTP error serialization), so the UI matches on this to know a
+ * blocked publish can be retried with an acknowledgment.
+ */
+export const DESTRUCTIVE_MIGRATION_ACK_REQUIRED_MESSAGE =
+  'Destructive schema changes require acknowledgment before migrations can run' as const;
+/** Publish plan: migration files could not be scanned for destructive SQL. */
+export const DESTRUCTIVE_MIGRATION_SCAN_UNAVAILABLE = 'DESTRUCTIVE_MIGRATION_SCAN_UNAVAILABLE' as const;
+
+export type DestructiveMigrationKind = 'drop_table' | 'drop_database' | 'drop_schema' | 'truncate' | 'drop_column';
+
+export type DestructiveMigrationFinding = {
+  fileName: string;
+  kind: DestructiveMigrationKind;
+  excerpt: string;
+};
+
+export type DestructiveMigrationFile = {
+  fileName: string;
+  sql: string;
+};
+
+const MAX_EXCERPT_LENGTH = 160;
+
+/**
+ * Schema-destroying statements that require explicit user acknowledgment.
+ *
+ * Intentionally out of scope (do not expand without a product decision):
+ * - `DELETE FROM` / other DML data loss
+ * - `DROP MATERIALIZED VIEW` / `DROP SEQUENCE` / `DROP TYPE` / `DROP VIEW`
+ * - Dynamic SQL inside dollar-quoted function bodies
+ * - Comment/string-literal edge cases in `stripSqlComments` (markers inside
+ *   string literals can hide a following statement on the same line)
+ */
+/** Patterns are checked in order; first match wins per statement. */
+const DESTRUCTIVE_PATTERNS: Array<{ kind: DestructiveMigrationKind; re: RegExp }> = [
+  { kind: 'drop_table', re: /^\s*DROP\s+TABLE\b/i },
+  { kind: 'drop_database', re: /^\s*DROP\s+DATABASE\b/i },
+  { kind: 'drop_schema', re: /^\s*DROP\s+SCHEMA\b/i },
+  { kind: 'truncate', re: /^\s*TRUNCATE\b/i },
+  // ALTER … DROP [COLUMN] col — COLUMN is optional in Postgres. Exclude
+  // DROP CONSTRAINT / INDEX / TRIGGER / RULE / POLICY / STATISTICS / IDENTITY
+  // and ALTER COLUMN … DROP NOT NULL / DEFAULT / EXPRESSION (not column drops).
+  {
+    kind: 'drop_column',
+    re: /^\s*ALTER\s+TABLE\b[\s\S]*?\bDROP\s+(?:COLUMN\s+)?(?!CONSTRAINT\b|INDEX\b|TRIGGER\b|RULE\b|POLICY\b|STATISTICS\b|IDENTITY\b|NOT\b|DEFAULT\b|EXPRESSION\b)["\w]/i
+  },
+  { kind: 'drop_column', re: /^\s*DROP\s+COLUMN\b/i }
+];
+
+function stripSqlComments(sql: string): string {
+  // Block comments first, then line comments. Good enough for migration files;
+  // does not try to handle comment markers inside string literals.
+  return sql.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/--[^\n]*/g, ' ');
+}
+
+function splitStatements(sql: string): string[] {
+  return sql
+    .split(';')
+    .map((part) => part.trim())
+    .filter((part) => part.length > 0);
+}
+
+function excerptFor(statement: string): string {
+  const collapsed = statement.replace(/\s+/g, ' ').trim();
+  if (collapsed.length <= MAX_EXCERPT_LENGTH) {
+    return collapsed;
+  }
+  return `${collapsed.slice(0, MAX_EXCERPT_LENGTH - 1)}…`;
+}
+
+function classifyStatement(statement: string): DestructiveMigrationKind | undefined {
+  for (const { kind, re } of DESTRUCTIVE_PATTERNS) {
+    if (re.test(statement)) {
+      return kind;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Scans migration SQL for schema-destroying statements that require an
+ * explicit user acknowledgment before apply/deploy.
+ */
+export function analyzeDestructiveMigrations(files: DestructiveMigrationFile[]): DestructiveMigrationFinding[] {
+  const findings: DestructiveMigrationFinding[] = [];
+  for (const file of files) {
+    const statements = splitStatements(stripSqlComments(file.sql));
+    for (const statement of statements) {
+      const kind = classifyStatement(statement);
+      if (kind === undefined) {
+        continue;
+      }
+      findings.push({
+        fileName: file.fileName,
+        kind,
+        excerpt: excerptFor(statement)
+      });
+    }
+  }
+  return findings;
+}

package/src/database-lifecycle/index.ts

@@ -70,19 +70,22 @@ export type LifecycleNonTerminalState = (typeof LIFECYCLE_NON_TERMINAL_STATES)[n
 export type LifecycleState = (typeof LIFECYCLE_STATES)[number];
 export type LifecycleMigrationState = (typeof LIFECYCLE_MIGRATION_STATES)[number];
 
-export type LifecycleErrorCode =
-  | 'unsupported_provider_capability'
-  | 'backend_locked'
-  | 'policy_blocked'
-  | 'credential_resolution_failed'
-  | 'terraform_failed'
-  | 'migration_failed'
-  | 'callback_failed'
+export const LIFECYCLE_ERROR_CODES = [
+  'unsupported_provider_capability',
+  'backend_locked',
+  'policy_blocked',
+  'credential_resolution_failed',
+  'terraform_failed',
+  'migration_failed',
+  'callback_failed',
   // Server-side classification for a terminal callback that arrived for a
   // request whose desiredSpecHash no longer matches the binding (binding has
   // moved to a newer spec). The callback's metadata/state is discarded and
   // the request is cancelled rather than applied to the current binding.
-  | 'stale_dispatch';
+  'stale_dispatch'
+] as const;
+
+export type LifecycleErrorCode = (typeof LIFECYCLE_ERROR_CODES)[number];
 
 export type PhysicalMasterCredentialRef = {
   resolver: 'aws_secrets_manager';
@@ -170,6 +173,7 @@ export type PhysicalDatabaseInstance = {
   organizationId: string;
   region: string;
   engine: DatabaseEngine; // postgres-only in V1
+  provisionResourceKey: string;
   endpoint: string;
   masterCredentialRef: PhysicalMasterCredentialRef;
   capacityMax: number;
@@ -195,11 +199,25 @@ export type LifecycleMigration = {
   sql: string;
 };
 
+export {
+  analyzeDestructiveMigrations,
+  DESTRUCTIVE_MIGRATION_ACK_REQUIRED,
+  DESTRUCTIVE_MIGRATION_ACK_REQUIRED_MESSAGE,
+  DESTRUCTIVE_MIGRATION_SCAN_UNAVAILABLE
+} from './destructiveMigrations.js';
+export type { DestructiveMigrationFile, DestructiveMigrationFinding, DestructiveMigrationKind } from './destructiveMigrations.js';
+
 export type LifecycleDispatchContinuation = {
   currentState?: string;
   physicalInstanceId?: string;
   physicalTerraformResourceKey?: string;
   reservationId?: string;
+  // An operator's assertion that the worker holding this binding's Terraform
+  // state lock is gone, which is the only thing that lets the next worker
+  // break that lock. Set by the admin retry endpoint and cleared by anything
+  // that reopens the request on a timer, which cannot tell a dead worker from
+  // a slow one.
+  stateLockRecoveryAuthorized?: boolean;
 };
 
 // Wizard-facing view of a physical pool provisioning run. Narrower than

package/src/socket/protocol.ts

@@ -240,7 +240,13 @@ export interface ServerMethods {
             targetTemplateName?: string;
             migrationGeneration?: number;
           },
-          { hash: string; degradedMode?: DegradedMode; commitId?: string; checkpointSkipped?: CheckpointSkipReason }
+          {
+            hash: string;
+            degradedMode?: DegradedMode;
+            commitId?: string;
+            commitMessage?: string;
+            checkpointSkipped?: CheckpointSkipReason;
+          }
         >;
       };
       directoryContents: {

package/src/socket/socket.test.ts

@@ -1,12 +1,58 @@
 import { trace } from '@opentelemetry/api';
 import { describe, expect, it, vi } from 'vitest';
 
-import { INTENTIONAL_CLOSE_CODE, ISocket } from './socket.js';
+import { INTENTIONAL_CLOSE_CODE, ISocket, REQUEST_ABORTED_SOCKET_ERROR } from './socket.js';
 import { ISocketWithClientAuth } from './socketWithClientAuth.js';
 
 const PING_TIMEOUT_CLOSE_REASON = 'Ping timeout';
 
 describe('ISocket', () => {
+  it('clears abort cleanup when a no-response timeout rejects the request', async () => {
+    vi.useFakeTimers();
+    try {
+      const controller = new AbortController();
+      const addEventListener = vi.spyOn(controller.signal, 'addEventListener');
+      const removeEventListener = vi.spyOn(controller.signal, 'removeEventListener');
+      const ws = {
+        addEventListener: vi.fn(),
+        close: vi.fn(),
+        send: vi.fn()
+      };
+      const socket = new ISocket(ws as never, {}, [], {
+        onClose: vi.fn(),
+        getAbortSignal: () => controller.signal,
+        timeouts: { noResponseTimeoutInSeconds: 1 }
+      });
+      const pendingRequest = socket.request('editor.ping', {});
+      expect(addEventListener).toHaveBeenCalledWith('abort', expect.any(Function), { once: true });
+
+      const assertion = expect(pendingRequest).rejects.toMatchObject({ code: 7 });
+      await vi.advanceTimersByTimeAsync(1000);
+      await assertion;
+      expect(removeEventListener).toHaveBeenCalled();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('rejects a pending request when getAbortSignal returns an aborted signal', async () => {
+    const ws = {
+      addEventListener: vi.fn(),
+      close: vi.fn(),
+      send: vi.fn()
+    };
+    const controller = new AbortController();
+    const socket = new ISocket(ws as never, {}, [], {
+      onClose: vi.fn(),
+      getAbortSignal: () => controller.signal
+    });
+    const pendingRequest = socket.request('editor.ping', {});
+
+    controller.abort();
+
+    await expect(pendingRequest).rejects.toMatchObject(REQUEST_ABORTED_SOCKET_ERROR);
+  });
+
   it('preserves the transport-close marker when rejecting pending requests with a reason', async () => {
     const ws = {
       addEventListener: vi.fn(),
@@ -24,6 +70,47 @@ describe('ISocket', () => {
     });
     expect(ws.close).toHaveBeenCalledWith(INTENTIONAL_CLOSE_CODE, PING_TIMEOUT_CLOSE_REASON);
   });
+
+  it('rejects a request whose signal is already aborted before it is sent', async () => {
+    const ws = {
+      addEventListener: vi.fn(),
+      close: vi.fn(),
+      send: vi.fn()
+    };
+    const controller = new AbortController();
+    const socket = new ISocket(ws as never, {}, [], { onClose: vi.fn(), getAbortSignal: () => controller.signal });
+    controller.abort();
+
+    await expect(socket.request('editor.ping', {})).rejects.toMatchObject(REQUEST_ABORTED_SOCKET_ERROR);
+    expect(ws.send).not.toHaveBeenCalled();
+  });
+
+  it('ignores a late response after an aborted request', async () => {
+    let messageHandler: ((event: { data: string }) => void) | undefined;
+    const ws = {
+      addEventListener: vi.fn((event: string, handler: (event: { data: string }) => void) => {
+        if (event === 'message') {
+          messageHandler = handler;
+        }
+      }),
+      close: vi.fn(),
+      send: vi.fn()
+    };
+    const controller = new AbortController();
+    const socket = new ISocket(ws as never, {}, [], { onClose: vi.fn(), getAbortSignal: () => controller.signal });
+    const pendingRequest = socket.request('editor.ping', {});
+
+    controller.abort();
+    await expect(pendingRequest).rejects.toMatchObject(REQUEST_ABORTED_SOCKET_ERROR);
+
+    expect(() => {
+      messageHandler?.({
+        data: JSON.stringify({
+          response: { id: 1, payload: 'too-late', error: null }
+        })
+      });
+    }).not.toThrow();
+  });
 });
 
 describe('ISocketWithClientAuth', () => {

package/src/socket/socket.ts

@@ -10,6 +10,13 @@ import {
   type GenericMiddleware
 } from './types.js';
 
+export const REQUEST_ABORTED_SOCKET_ERROR = {
+  code: 9,
+  message: '[internal] Request aborted',
+  /** Distinguishes a locally synthesized abort from a server SocketError with code 9. */
+  aborted: true as const
+} as const;
+
 interface SocketRequest<Payload = unknown> {
   method: string;
   payload: Payload;
@@ -60,7 +67,12 @@ export class ISocket<ImplementedMethods, CallableMethods, RequestContext extends
   private readonly globalMiddlewares: GenericMiddleware<CallableMethods, RequestContext>[];
   private readonly responseHandler = new Map<
     number,
-    { resolve: (data: unknown) => void; reject: (error: SocketError) => void; timeout?: NodeJS.Timeout }
+    {
+      resolve: (data: unknown) => void;
+      reject: (error: SocketError) => void;
+      timeout?: NodeJS.Timeout;
+      abortCleanup?: () => void;
+    }
   >();
   private peerAuthorization?: string;
   protected nxtRequestId: number;
@@ -69,6 +81,7 @@ export class ISocket<ImplementedMethods, CallableMethods, RequestContext extends
   protected logger: { error: (message?: string) => void; info: (message?: string) => void; warn: (message?: string) => void };
   private timeouts?: SocketTimeouts;
   private isClosed = false;
+  private readonly getAbortSignal?: () => AbortSignal | undefined;
 
   constructor(
     ws: WebSocket,
@@ -87,9 +100,12 @@ export class ISocket<ImplementedMethods, CallableMethods, RequestContext extends
       onClose: (event: WebSocket.CloseEvent) => void;
       timeouts?: SocketTimeouts;
       logger?: { error: (message?: string) => void; info: (message?: string) => void; warn: (message?: string) => void };
+      /** Read at request time so server-side callers can supply a per-call signal without Node ALS in this package. */
+      getAbortSignal?: () => AbortSignal | undefined;
     }
   ) {
     this.ws = ws;
+    this.getAbortSignal = options.getAbortSignal;
     this.requestHandlers = requestHandlers;
     this.globalMiddlewares = globalMiddlewares;
     this.nxtRequestId = 0;
@@ -122,6 +138,7 @@ export class ISocket<ImplementedMethods, CallableMethods, RequestContext extends
         // which shouldn't be possible
         this.responseHandler.forEach((handler, key) => {
           clearTimeout(handler.timeout);
+          handler.abortCleanup?.();
           this.logger.error(`Rejecting pending requestId ${key} due to connection close`);
           handler.reject({ code: 8, message: '[internal] Connection closed' });
         });
@@ -207,11 +224,12 @@ export class ISocket<ImplementedMethods, CallableMethods, RequestContext extends
       }
       if (message.response.error) {
         responseHandler.reject(message.response.error);
+        this.clearPendingRequestState(message.response.id);
+        return;
       }
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       responseHandler.resolve(message.response.payload as any);
-      clearTimeout(responseHandler.timeout);
-      this.responseHandler.delete(message.response.id);
+      this.clearPendingRequestState(message.response.id);
     } else {
       return this.respondError(-1, {
         code: 3,
@@ -242,6 +260,10 @@ export class ISocket<ImplementedMethods, CallableMethods, RequestContext extends
         resolve: (result) => resolve(result as Result),
         reject: (error: SocketError) => reject(error)
       });
+      this.attachAbortListener(requestId, this.getAbortSignal?.());
+      if (!this.responseHandler.has(requestId)) {
+        return;
+      }
       let toSend: SocketMessage = { request: { method, payload: params, id: requestId, setAuthorization: authorization } };
       toSend = this.decorateToSend(toSend);
       this.ws.send(JSON.stringify(toSend));
@@ -265,6 +287,10 @@ export class ISocket<ImplementedMethods, CallableMethods, RequestContext extends
         resolve: (result) => resolve(result as Result),
         reject: (error: SocketError) => reject(error)
       });
+      this.attachAbortListener(requestId, this.getAbortSignal?.());
+      if (!this.responseHandler.has(requestId)) {
+        return;
+      }
       let toSend: SocketMessage = {
         request: {
           method,
@@ -281,6 +307,53 @@ export class ISocket<ImplementedMethods, CallableMethods, RequestContext extends
     });
   }
 
+  private attachAbortListener(requestId: number, abortSignal?: AbortSignal): void {
+    if (!abortSignal) {
+      return;
+    }
+
+    const onAbort = () => {
+      this.logger.warn(`Rejecting pending requestId ${requestId} due to abort`);
+      this.rejectPendingRequest(requestId, REQUEST_ABORTED_SOCKET_ERROR);
+    };
+
+    if (abortSignal.aborted) {
+      onAbort();
+      return;
+    }
+
+    const handler = this.responseHandler.get(requestId);
+    if (!handler) {
+      return;
+    }
+
+    abortSignal.addEventListener('abort', onAbort, { once: true });
+    handler.abortCleanup = () => {
+      abortSignal.removeEventListener('abort', onAbort);
+    };
+  }
+
+  private clearPendingRequestState(requestId: number): void {
+    const responseHandler = this.responseHandler.get(requestId);
+    if (!responseHandler) {
+      return;
+    }
+    clearTimeout(responseHandler.timeout);
+    responseHandler.abortCleanup?.();
+    this.responseHandler.delete(requestId);
+  }
+
+  private rejectPendingRequest(requestId: number, error: SocketError): void {
+    const responseHandler = this.responseHandler.get(requestId);
+    if (!responseHandler) {
+      return;
+    }
+    clearTimeout(responseHandler.timeout);
+    responseHandler.abortCleanup?.();
+    this.responseHandler.delete(requestId);
+    responseHandler.reject(error);
+  }
+
   protected decorateToSend(message: SocketMessage): SocketMessage {
     return message;
   }
@@ -333,20 +406,18 @@ export class ISocket<ImplementedMethods, CallableMethods, RequestContext extends
     if (!responseHandler) {
       return;
     }
-    const noResponseTimeout = responseHandler.timeout;
-    const reject = responseHandler.reject;
     if (responseHandler.timeout) {
-      clearTimeout(noResponseTimeout);
+      clearTimeout(responseHandler.timeout);
     }
     // Set a new timeout for the next message
-    responseHandler.timeout = setTimeout(this.handleNoResponseTimeout(reject), this.timeouts?.noResponseTimeoutInSeconds * 1000);
+    responseHandler.timeout = setTimeout(this.handleNoResponseTimeout(requestId), this.timeouts?.noResponseTimeoutInSeconds * 1000);
   }
 
-  private handleNoResponseTimeout(reject: (error: SocketError) => void) {
+  private handleNoResponseTimeout(requestId: number) {
     return () => {
       const message = `Request timed out after ${this.timeouts?.noResponseTimeoutInSeconds} seconds`;
       this.logger.error(message);
-      reject({ code: 7, message });
+      this.rejectPendingRequest(requestId, { code: 7, message });
     };
   }
 
@@ -359,6 +430,7 @@ export class ISocket<ImplementedMethods, CallableMethods, RequestContext extends
   public closeAndRejectPendingRequests(reason?: string): void {
     this.responseHandler.forEach((handler, key) => {
       clearTimeout(handler.timeout);
+      handler.abortCleanup?.();
       this.logger.error(`Rejecting pending requestId ${key} due to intentional connection close`);
       handler.reject({ code: 8, message: reason ? `${CONNECTION_CLOSED_MESSAGE}: ${reason}` : CONNECTION_CLOSED_MESSAGE });
     });

package/src/socket/socketWithClientAuth.ts

@@ -27,6 +27,7 @@ export class ISocketWithClientAuth<ImplementedMethods, CallableMethods, RequestC
       onClose: (event: WebSocket.CloseEvent) => void;
       timeouts?: SocketTimeouts;
       logger?: { error: (message?: string) => void; info: (message?: string) => void; warn: (message?: string) => void };
+      getAbortSignal?: () => AbortSignal | undefined;
     }
   ) {
     super(ws, requestHandlers, globalMiddlewares, tracer, options);

package/src/socket/tracedSocket.ts

@@ -114,6 +114,7 @@ export class TracedSocket<ImplementedMethods, CallableMethods, RequestContext ex
       onClose: (event: WebSocket.CloseEvent) => void;
       timeouts?: SocketTimeouts;
       logger?: { error: (message?: string) => void; info: (message?: string) => void; warn: (message?: string) => void };
+      getAbortSignal?: () => AbortSignal | undefined;
     }
   ) {
     super(ws, requestHandlers, globalMiddlewares, options);

package/src/types/audit/ocsf.ts

@@ -148,6 +148,14 @@ export const AUDIT_EVENT_TYPE_CATALOG: AuditEventTypeEntry[] = [
     resource_type: 'API',
     operations: ['api.bulk_delete', 'api.create', 'api.delete', 'api.deploy', 'api.metadata.update', 'api.settings.update']
   },
+  {
+    class_uid: OCSFClassUid.ENTITY_MANAGEMENT,
+    class_name: 'ENTITY_MANAGEMENT',
+    category_uid: OCSFCategoryUid.APPLICATION_ACTIVITY,
+    category_name: 'APPLICATION_ACTIVITY',
+    resource_type: 'AppDatabase',
+    operations: ['database.migrate', 'database.provision']
+  },
   {
     class_uid: OCSFClassUid.APPLICATION_LIFECYCLE,
     class_name: 'APPLICATION_LIFECYCLE',
@@ -277,7 +285,12 @@ export const AUDIT_EVENT_TYPE_CATALOG: AuditEventTypeEntry[] = [
     category_uid: OCSFCategoryUid.APPLICATION_ACTIVITY,
     category_name: 'APPLICATION_ACTIVITY',
     resource_type: 'ReviewPolicy',
-    operations: ['reviewpolicy.allowlist.applications.added', 'reviewpolicy.allowlist.applications.removed']
+    operations: [
+      'reviewpolicy.allowlist.applications.added',
+      'reviewpolicy.allowlist.applications.removed',
+      'reviewpolicy.create',
+      'reviewpolicy.delete'
+    ]
   },
   {
     class_uid: OCSFClassUid.ENTITY_MANAGEMENT,

package/src/types/billing/pricingModel.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest';
 
-import { isCreditsPricing, isSeatsPricing, PricingModelEnum, resolvePricingModel } from './pricingModel.js';
+import { BillingPlan } from './billing.js';
+import { isCreditsPricing, isSeatlessOrg, isSeatsPricing, PricingModelEnum, resolvePricingModel } from './pricingModel.js';
 
 describe('PricingModelEnum', () => {
   it('uses stable string values for the billing.pricing_model column', () => {
@@ -39,6 +40,35 @@ describe('isSeatsPricing', () => {
   });
 });
 
+describe('isSeatlessOrg', () => {
+  // `pricing_model` is stamped once at TRIAL signup and grandfathered forever
+  // (organization.ts: "Only TRIAL signups reach here"). A PLG org that later
+  // signs an enterprise contract therefore keeps `credits` — while its contract
+  // is seat-bearing. Gating seat surfaces on the raw stamp stranded exactly
+  // those orgs with no way to assign builder licenses.
+  it('is true for a PLG org on credits pricing', () => {
+    expect(isSeatlessOrg(PricingModelEnum.CREDITS, BillingPlan.TEAMS)).toBe(true);
+    expect(isSeatlessOrg(PricingModelEnum.CREDITS, BillingPlan.TRIAL)).toBe(true);
+  });
+
+  it('is false for every enterprise-like plan, whatever the stamp says', () => {
+    for (const plan of [BillingPlan.ENTERPRISE, BillingPlan.POC, BillingPlan.STARTER, BillingPlan.PRO]) {
+      expect(isSeatlessOrg(PricingModelEnum.CREDITS, plan)).toBe(false);
+    }
+  });
+
+  it('is false for seat-pricing and for an absent stamp', () => {
+    expect(isSeatlessOrg(PricingModelEnum.SEATS, BillingPlan.TEAMS)).toBe(false);
+    expect(isSeatlessOrg(undefined, BillingPlan.TEAMS)).toBe(false);
+    expect(isSeatlessOrg(null, BillingPlan.TEAMS)).toBe(false);
+  });
+
+  it('is false when the plan is unknown (fail closed to showing seats)', () => {
+    expect(isSeatlessOrg(PricingModelEnum.CREDITS, undefined)).toBe(false);
+    expect(isSeatlessOrg(PricingModelEnum.CREDITS, null)).toBe(false);
+  });
+});
+
 describe('resolvePricingModel', () => {
   it('passes through recognized model values from the LD flag', () => {
     expect(resolvePricingModel('credits')).toBe(PricingModelEnum.CREDITS);