@superblocksteam/shared 0.9618.2 → 0.9619.1

package/src/database-lifecycle/appDatabaseMigrations.ts

@@ -0,0 +1,78 @@
+/**
+ * The migrations timeline for one App Database environment.
+ *
+ * Which files ran on an environment is an estimate: the control plane records
+ * the files it sent to the worker on each successful migration run, not the
+ * worker's own ledger. A file counts as applied once a run that included it
+ * finished.
+ */
+
+export type AppDatabaseMigrationEnvironmentKind = 'deployed' | 'edit';
+
+export type AppDatabaseMigrationEnvironmentState = 'failed' | 'migrating' | 'not_created' | 'ready';
+
+export type AppDatabaseMigrationEnvironmentPosition = {
+  displayName: string;
+  kind: AppDatabaseMigrationEnvironmentKind;
+  /** Files in the working tree that have not run on this environment. */
+  pendingCount: number;
+  profile: string;
+  /** Version of the last file in the unbroken run of applied files, 0 when none ran. */
+  schemaVersion: number;
+  state: AppDatabaseMigrationEnvironmentState;
+};
+
+export type AppDatabaseMigrationEnvironment = AppDatabaseMigrationEnvironmentPosition & {
+  /** The worker's message from the failed run, when `state` is `failed`. */
+  error: string | null;
+  /** The version being applied (`migrating`) or that failed (`failed`). */
+  targetVersion: number | null;
+};
+
+export type AppDatabaseMigrationStatus = 'applied' | 'failed' | 'pending' | 'running';
+
+export type AppDatabaseMigrationChange = {
+  /** Why this line removes data, when publishing it asks for confirmation. */
+  destructive: string | null;
+  kind: 'add' | 'drop';
+  text: string;
+};
+
+/** The saved version that first contained the migration file. */
+export type AppDatabaseMigrationCommit = {
+  author: string;
+  commitId: string;
+  createdAt: string;
+  externalCommitId: string | null;
+  message: string | null;
+};
+
+export type AppDatabaseMigration = {
+  /** Only filled for files that have not run on the selected environment. */
+  changes: AppDatabaseMigrationChange[];
+  commit: AppDatabaseMigrationCommit | null;
+  filename: string;
+  sql: string;
+  status: AppDatabaseMigrationStatus;
+  /** The filename without its version prefix and extension, as words. */
+  summary: string;
+  version: number;
+  /** The version prefix exactly as written in the filename. */
+  versionLabel: string;
+};
+
+export type AppDatabaseMigrations = {
+  /** Selected environment, or null when no `profile` was asked for. */
+  environment: AppDatabaseMigrationEnvironment | null;
+  environments: AppDatabaseMigrationEnvironmentPosition[];
+  /** Version of the newest file, 0 when there are none. */
+  headVersion: number;
+  /** Oldest first. Empty when the caller asked only for each environment's position. */
+  migrations: AppDatabaseMigration[];
+  /**
+   * Newest saved version on the branch whose tree contains every migration
+   * file. Publishing an older version would roll the rest of the app back.
+   * Null when that newest version does not contain the files yet.
+   */
+  publishCommit: AppDatabaseMigrationCommit | null;
+};

package/src/database-lifecycle/appDatabaseSharing.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  appDatabaseAccessFields,
+  getAppDatabaseAccessLevel,
+  INTEGRATION_READ_ONLY_ROLE_NAME,
+  isAppDatabase,
+  isAppDatabaseReadOnlyForApplication,
+  isIntegrationReadOnlyRole
+} from './appDatabaseSharing.js';
+import { DATABASE_LIFECYCLE_MANAGED_BY } from './index.js';
+
+const appDatabase = { applicationId: 'owner-app', managedBy: DATABASE_LIFECYCLE_MANAGED_BY };
+
+describe('isIntegrationReadOnlyRole', () => {
+  it('matches only the built-in role, not an org role with the same name', () => {
+    expect(isIntegrationReadOnlyRole({ name: INTEGRATION_READ_ONLY_ROLE_NAME, organizationId: null })).toBe(true);
+    expect(isIntegrationReadOnlyRole({ name: INTEGRATION_READ_ONLY_ROLE_NAME, organizationId: 'org-1' })).toBe(false);
+    expect(isIntegrationReadOnlyRole({ name: 'Developer', organizationId: null })).toBe(false);
+  });
+});
+
+describe('isAppDatabase', () => {
+  it('is true only for a lifecycle-managed integration with an owning app', () => {
+    expect(isAppDatabase(appDatabase)).toBe(true);
+    expect(isAppDatabase({ applicationId: 'owner-app', managedBy: null })).toBe(false);
+    expect(isAppDatabase({ applicationId: null, managedBy: DATABASE_LIFECYCLE_MANAGED_BY })).toBe(false);
+    expect(isAppDatabase(undefined)).toBe(false);
+  });
+});
+
+describe('isAppDatabaseReadOnlyForApplication', () => {
+  it('is read-only for an app that does not own the database', () => {
+    expect(isAppDatabaseReadOnlyForApplication(appDatabase, 'consumer-app')).toBe(true);
+  });
+
+  it('gives the owning app full access', () => {
+    expect(isAppDatabaseReadOnlyForApplication(appDatabase, 'owner-app')).toBe(false);
+  });
+
+  it('is not read-only without an app context', () => {
+    expect(isAppDatabaseReadOnlyForApplication(appDatabase, undefined)).toBe(false);
+  });
+
+  it('is not read-only for org integrations', () => {
+    expect(isAppDatabaseReadOnlyForApplication({ applicationId: 'owner-app', managedBy: null }, 'consumer-app')).toBe(false);
+  });
+});
+
+describe('getAppDatabaseAccessLevel', () => {
+  it('reports read_only for an app database another app owns', () => {
+    expect(getAppDatabaseAccessLevel(appDatabase, 'consumer-app')).toBe('read_only');
+  });
+
+  it('reports nothing when the app has full access', () => {
+    expect(getAppDatabaseAccessLevel(appDatabase, 'owner-app')).toBeUndefined();
+    expect(getAppDatabaseAccessLevel({ applicationId: null, managedBy: null }, 'consumer-app')).toBeUndefined();
+  });
+
+  it('names the owner alongside read_only, and nothing for a database the app can write to', () => {
+    const shared = { ...appDatabase, ownerApplicationName: 'Orders' };
+    expect(appDatabaseAccessFields(shared, 'consumer-app')).toEqual({ accessLevel: 'read_only', ownerApplicationName: 'Orders' });
+    expect(appDatabaseAccessFields(appDatabase, 'consumer-app')).toEqual({ accessLevel: 'read_only' });
+    expect(appDatabaseAccessFields(appDatabase, 'owner-app')).toEqual({});
+  });
+
+  it('reports read_only when the server named another owning app, even without an app context', () => {
+    const shared = { ...appDatabase, ownerApplicationName: 'Orders' };
+    expect(getAppDatabaseAccessLevel(shared, undefined)).toBe('read_only');
+    expect(getAppDatabaseAccessLevel(appDatabase, undefined)).toBeUndefined();
+  });
+});

package/src/database-lifecycle/appDatabaseSharing.ts

@@ -0,0 +1,58 @@
+import { DATABASE_LIFECYCLE_MANAGED_BY } from './index.js';
+
+// The built-in integrations role that gives an app read-only access to an app
+// database another app owns. Only 3.0 apps can hold it.
+export const INTEGRATION_READ_ONLY_ROLE_NAME = 'Read only';
+
+export function isIntegrationReadOnlyRole(role: { name: string; organizationId?: string | null }): boolean {
+  return role.name === INTEGRATION_READ_ONLY_ROLE_NAME && !role.organizationId;
+}
+
+type AppDatabaseOwnershipFields = {
+  applicationId?: string | null;
+  managedBy?: string | null;
+};
+
+export function isAppDatabase(integration: AppDatabaseOwnershipFields | undefined): boolean {
+  return integration?.managedBy === DATABASE_LIFECYCLE_MANAGED_BY && Boolean(integration.applicationId);
+}
+
+// True when the integration is an app database owned by a different app. That
+// app can read the data but not change it; the owning app keeps full access.
+export function isAppDatabaseReadOnlyForApplication(
+  integration: AppDatabaseOwnershipFields | undefined,
+  applicationId: string | null | undefined
+): boolean {
+  return isAppDatabase(integration) && Boolean(applicationId) && integration?.applicationId !== applicationId;
+}
+
+// Same wire value the orchestrator receives in executionAccess.level.
+export const INTEGRATION_ACCESS_LEVEL_READ_ONLY = 'read_only';
+export type IntegrationAccessLevel = typeof INTEGRATION_ACCESS_LEVEL_READ_ONLY;
+
+// The server names the owning app only in a payload built for a different
+// app, so a named owner marks the database read-only even when the caller does
+// not know which app it is building.
+export function getAppDatabaseAccessLevel(
+  integration: (AppDatabaseOwnershipFields & { ownerApplicationName?: string }) | undefined,
+  applicationId: string | null | undefined
+): IntegrationAccessLevel | undefined {
+  const namedOwner = isAppDatabase(integration) && Boolean(integration?.ownerApplicationName);
+  return namedOwner || isAppDatabaseReadOnlyForApplication(integration, applicationId) ? INTEGRATION_ACCESS_LEVEL_READ_ONLY : undefined;
+}
+
+// Fields to copy onto an integration summary so Clark knows it may only read
+// this database, and whose it is. Empty for anything the app can write to.
+export function appDatabaseAccessFields(
+  integration: (AppDatabaseOwnershipFields & { ownerApplicationName?: string }) | undefined,
+  applicationId: string | null | undefined
+): { accessLevel?: IntegrationAccessLevel; ownerApplicationName?: string } {
+  const accessLevel = getAppDatabaseAccessLevel(integration, applicationId);
+  if (!accessLevel) {
+    return {};
+  }
+  return {
+    accessLevel,
+    ...(integration?.ownerApplicationName ? { ownerApplicationName: integration.ownerApplicationName } : {})
+  };
+}

package/src/database-lifecycle/dataImport.test.ts

@@ -166,5 +166,10 @@ describe('data import contracts', () => {
       currentPrefixSizeBytes: 1,
       postgresMajorVersion: 16
     });
+    expect(parseDataImportMetadata('pg_dump_custom', { ...base, omittedObjectKinds: ['VIEW', 'FUNCTION'] })).toEqual({
+      kind: 'pg_dump_custom',
+      omittedObjectKinds: ['FUNCTION', 'VIEW']
+    });
+    expect(parseDataImportMetadata('pg_dump_custom', { ...base, omittedObjectKinds: ['select secret'] })).toBeUndefined();
   });
 });

package/src/database-lifecycle/dataImport.ts

@@ -69,6 +69,7 @@ export type PgDumpDataImportMetadata = {
   capturedSha256?: string;
   capturedSizeBytes?: number;
   currentPrefixSizeBytes?: number;
+  omittedObjectKinds?: string[];
   postgresMajorVersion?: number;
   prefixChecksumSha256?: string;
   prefixObjectKey?: string;
@@ -303,6 +304,25 @@ function isNonEmptyString(value: unknown): value is string {
   return typeof value === 'string' && value.trim().length > 0;
 }
 
+const omittedObjectKindPattern = /^[A-Z][A-Z0-9]*(?: [A-Z][A-Z0-9]*){0,4}$/;
+
+export function omittedObjectKinds(value: unknown): { kinds?: string[]; ok: boolean } {
+  if (value === undefined) {
+    return { ok: true };
+  }
+  if (!Array.isArray(value) || value.length < 1 || value.length > 32) {
+    return { ok: false };
+  }
+  const seen = new Set<string>();
+  for (const kind of value) {
+    if (typeof kind !== 'string' || !omittedObjectKindPattern.test(kind)) {
+      return { ok: false };
+    }
+    seen.add(kind);
+  }
+  return { ok: true, kinds: [...seen].sort() };
+}
+
 // One unquoted lowercase schema.table. Each part is at most 63 bytes, which
 // is PostgreSQL's identifier limit. A longer spelling would truncate to the
 // same relation as another accepted key.
@@ -332,9 +352,17 @@ function parsePgDumpMetadata(value: Record<string, unknown>): PgDumpDataImportMe
     }
     metadata.tableNames = value.tableNames;
   }
+  const omitted = omittedObjectKinds(value.omittedObjectKinds);
+  if (!omitted.ok) {
+    return undefined;
+  }
+  if (omitted.kinds) {
+    metadata.omittedObjectKinds = omitted.kinds;
+  }
   const allowed = new Set([
     'kind',
     'currentPrefixSizeBytes',
+    'omittedObjectKinds',
     'postgresMajorVersion',
     'prefixChecksumSha256',
     'prefixObjectKey',

package/src/database-lifecycle/destructiveMigrations.test.ts

@@ -1,6 +1,11 @@
 import { describe, expect, test } from 'vitest';
 
-import { analyzeDestructiveMigrations, analyzeDestructiveMigrationsRequiringAck, stripSqlComments } from './destructiveMigrations.js';
+import {
+  analyzeDestructiveMigrations,
+  analyzeDestructiveMigrationsRequiringAck,
+  describeMigrationChanges,
+  stripSqlComments
+} from './destructiveMigrations.js';
 
 describe('analyzeDestructiveMigrations', () => {
   test('returns empty when SQL has no destructive statements', () => {
@@ -222,6 +227,89 @@ describe('analyzeDestructiveMigrationsRequiringAck', () => {
   });
 });
 
+describe('describeMigrationChanges', () => {
+  test('lists each table, column, and index a file adds', () => {
+    expect(
+      describeMigrationChanges([
+        {
+          fileName: '0001_init.sql',
+          sql: [
+            'CREATE TABLE IF NOT EXISTS orders (id uuid PRIMARY KEY);',
+            'ALTER TABLE orders ADD COLUMN status text;',
+            "ALTER TABLE orders ADD CONSTRAINT orders_status_check CHECK (status <> '');",
+            'CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS orders_status_idx ON public.orders (status);',
+            "INSERT INTO orders (id) VALUES ('00000000-0000-0000-0000-000000000000');"
+          ].join('\n')
+        }
+      ])
+    ).toEqual([
+      {
+        fileName: '0001_init.sql',
+        changes: [
+          { destructiveKind: null, kind: 'add', text: 'Create table orders' },
+          { destructiveKind: null, kind: 'add', text: 'Add column orders.status' },
+          { destructiveKind: null, kind: 'add', text: 'Add index on public.orders (status)' }
+        ]
+      }
+    ]);
+  });
+
+  test('names the dropped column when the same statement first drops a default', () => {
+    expect(
+      describeMigrationChanges([
+        {
+          fileName: '0004_drop_column.sql',
+          sql: 'ALTER TABLE users ALTER COLUMN a DROP DEFAULT, DROP COLUMN b;'
+        }
+      ])
+    ).toEqual([
+      {
+        fileName: '0004_drop_column.sql',
+        changes: [{ destructiveKind: 'drop_column', kind: 'drop', text: 'Drop column users.b' }]
+      }
+    ]);
+  });
+
+  test('marks a drop destructive only when the batch did not create the object first', () => {
+    expect(
+      describeMigrationChanges([
+        { fileName: '0002_scratch.sql', sql: 'CREATE TABLE scratch (id int); DROP TABLE scratch;' },
+        { fileName: '0003_cleanup.sql', sql: 'ALTER TABLE orders DROP COLUMN legacy_code; TRUNCATE audit_log;' }
+      ])
+    ).toEqual([
+      {
+        fileName: '0002_scratch.sql',
+        changes: [
+          { destructiveKind: null, kind: 'add', text: 'Create table scratch' },
+          { destructiveKind: null, kind: 'drop', text: 'Drop table scratch' }
+        ]
+      },
+      {
+        fileName: '0003_cleanup.sql',
+        changes: [
+          { destructiveKind: 'drop_column', kind: 'drop', text: 'Drop column orders.legacy_code' },
+          { destructiveKind: 'truncate', kind: 'drop', text: 'Truncate audit_log' }
+        ]
+      }
+    ]);
+  });
+
+  test('flags the same drops the publish asks the user to confirm', () => {
+    const files = [
+      { fileName: '0004_a.sql', sql: 'DROP TABLE orders, scratch; DROP SCHEMA reporting CASCADE;' },
+      { fileName: '0005_b.sql', sql: '-- DROP TABLE commented_out;\nDROP DATABASE other;' }
+    ];
+    const destructive = describeMigrationChanges(files).flatMap((file) =>
+      file.changes.filter((change) => change.destructiveKind !== null).map((change) => `${file.fileName}:${change.destructiveKind}`)
+    );
+    expect(destructive).toEqual(analyzeDestructiveMigrationsRequiringAck(files).map((finding) => `${finding.fileName}:${finding.kind}`));
+    expect(describeMigrationChanges(files)[0]?.changes.map((change) => change.text)).toEqual([
+      'Drop table orders, scratch',
+      'Drop schema reporting'
+    ]);
+  });
+});
+
 describe('stripSqlComments', () => {
   test('removes a well-formed block comment', () => {
     // Whitespace-normalized: the comment marker is replaced with a single

package/src/database-lifecycle/destructiveMigrations.ts

@@ -248,26 +248,124 @@ export function analyzeDestructiveMigrations(files: DestructiveMigrationFile[]):
  * container in the same batch does not prove it is free of customer data.
  */
 export function analyzeDestructiveMigrationsRequiringAck(files: DestructiveMigrationFile[]): DestructiveMigrationFinding[] {
+  const findings: DestructiveMigrationFinding[] = [];
+  walkBatch(files, ({ fileName, kind, requiresAck, statement }) => {
+    if (kind !== undefined && requiresAck) {
+      findings.push({ fileName, kind, excerpt: excerptFor(statement) });
+    }
+  });
+  return findings;
+}
+
+type BatchStatement = {
+  fileName: string;
+  kind: DestructiveMigrationKind | undefined;
+  /** A destructive statement that removes something that existed before the batch. */
+  requiresAck: boolean;
+  statement: string;
+};
+
+function walkBatch(files: DestructiveMigrationFile[], visit: (statement: BatchStatement) => void): void {
   const createdTables = new Set<string>();
   const createdColumns = new Set<string>();
-  const findings: DestructiveMigrationFinding[] = [];
   for (const file of files) {
-    const statements = splitStatements(stripSqlComments(file.sql));
-    for (const statement of statements) {
+    for (const statement of splitStatements(stripSqlComments(file.sql))) {
       recordCreates(statement, createdTables, createdColumns);
       const kind = classifyStatement(statement);
-      if (kind === undefined) {
-        continue;
-      }
-      if (isCoveredByEarlierCreate(kind, statement, createdTables, createdColumns)) {
-        continue;
-      }
-      findings.push({
-        fileName: file.fileName,
-        kind,
-        excerpt: excerptFor(statement)
-      });
+      const requiresAck = kind !== undefined && !isCoveredByEarlierCreate(kind, statement, createdTables, createdColumns);
+      visit({ fileName: file.fileName, kind, requiresAck, statement });
     }
   }
-  return findings;
+}
+
+export type MigrationChange = {
+  /** Set when publishing this line asks the user to confirm a deletion. */
+  destructiveKind: DestructiveMigrationKind | null;
+  kind: 'add' | 'drop';
+  text: string;
+};
+
+export type MigrationFileChanges = {
+  changes: MigrationChange[];
+  fileName: string;
+};
+
+const CREATE_TABLE = new RegExp(String.raw`^\s*CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(${SQL_IDENT})`, 'i');
+const ADD_COLUMN = new RegExp(
+  String.raw`^\s*ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(${SQL_IDENT})\s+ADD\s+(?:COLUMN\s+)?(?:IF\s+NOT\s+EXISTS\s+)?(?!CONSTRAINT\b|PRIMARY\b|FOREIGN\b|UNIQUE\b|CHECK\b|EXCLUDE\b)(${SQL_IDENT})`,
+  'i'
+);
+const CREATE_INDEX = new RegExp(
+  String.raw`^\s*CREATE\s+(?:UNIQUE\s+)?INDEX\s+(?:CONCURRENTLY\s+)?(?:IF\s+NOT\s+EXISTS\s+)?(?:${SQL_IDENT}\s+)?ON\s+(?:ONLY\s+)?(${SQL_IDENT})\s*(?:USING\s+\w+\s*)?\(([^)]*)\)`,
+  'i'
+);
+const DROP_COLUMN = new RegExp(
+  String.raw`^\s*ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(${SQL_IDENT})\s+[\s\S]*?\bDROP\s+(?:COLUMN\s+)?(?:IF\s+EXISTS\s+)?(?!CONSTRAINT\b|INDEX\b|TRIGGER\b|RULE\b|POLICY\b|STATISTICS\b|IDENTITY\b|NOT\b|DEFAULT\b|EXPRESSION\b)(${SQL_IDENT})`,
+  'i'
+);
+const DROP_CONTAINER = new RegExp(String.raw`^\s*DROP\s+(?:DATABASE|SCHEMA)\s+(?:IF\s+EXISTS\s+)?(${SQL_IDENT})`, 'i');
+
+function describeAddition(statement: string): string | undefined {
+  const table = matchFirstIdent(statement, CREATE_TABLE);
+  if (table !== undefined) {
+    return `Create table ${table}`;
+  }
+  const column = ADD_COLUMN.exec(statement);
+  if (column?.[1] !== undefined && column[2] !== undefined) {
+    return `Add column ${normalizeSqlIdent(column[1])}.${normalizeSqlIdent(column[2])}`;
+  }
+  const index = CREATE_INDEX.exec(statement);
+  if (index?.[1] !== undefined && index[2] !== undefined) {
+    return `Add index on ${normalizeSqlIdent(index[1])} (${index[2].replace(/\s+/g, ' ').trim()})`;
+  }
+  return undefined;
+}
+
+function describeDrop(kind: DestructiveMigrationKind, statement: string): string {
+  switch (kind) {
+    case 'drop_table': {
+      const tables = matchTableListTargets(statement, /^\s*DROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?/i);
+      return tables ? `Drop table ${tables.join(', ')}` : excerptFor(statement);
+    }
+    case 'truncate': {
+      const tables = matchTableListTargets(statement, /^\s*TRUNCATE\s+(?:TABLE\s+)?/i);
+      return tables ? `Truncate ${tables.join(', ')}` : excerptFor(statement);
+    }
+    case 'drop_column': {
+      const match = DROP_COLUMN.exec(statement);
+      return match?.[1] !== undefined && match[2] !== undefined
+        ? `Drop column ${normalizeSqlIdent(match[1])}.${normalizeSqlIdent(match[2])}`
+        : excerptFor(statement);
+    }
+    case 'drop_database':
+    case 'drop_schema': {
+      const name = matchFirstIdent(statement, DROP_CONTAINER);
+      const noun = kind === 'drop_database' ? 'database' : 'schema';
+      return name ? `Drop ${noun} ${name}` : excerptFor(statement);
+    }
+  }
+}
+
+/**
+ * One line per schema change in each file, for showing a batch of migrations
+ * that has not run yet. Judged exactly like the publish confirmation: a drop
+ * is destructive unless the same batch created the object first.
+ */
+export function describeMigrationChanges(files: DestructiveMigrationFile[]): MigrationFileChanges[] {
+  const byFile = new Map<string, MigrationChange[]>(files.map((file) => [file.fileName, []]));
+  walkBatch(files, ({ fileName, kind, requiresAck, statement }) => {
+    const changes = byFile.get(fileName);
+    if (!changes) {
+      return;
+    }
+    if (kind !== undefined) {
+      changes.push({ destructiveKind: requiresAck ? kind : null, kind: 'drop', text: describeDrop(kind, statement) });
+      return;
+    }
+    const addition = describeAddition(statement);
+    if (addition !== undefined) {
+      changes.push({ destructiveKind: null, kind: 'add', text: addition });
+    }
+  });
+  return [...byFile].map(([fileName, changes]) => ({ changes, fileName }));
 }

package/src/database-lifecycle/index.ts

@@ -640,13 +640,16 @@ export {
   analyzeDestructiveMigrationsRequiringAck,
   DESTRUCTIVE_MIGRATION_ACK_REQUIRED,
   DESTRUCTIVE_MIGRATION_ACK_REQUIRED_MESSAGE,
-  DESTRUCTIVE_MIGRATION_SCAN_UNAVAILABLE
+  DESTRUCTIVE_MIGRATION_SCAN_UNAVAILABLE,
+  describeMigrationChanges
 } from './destructiveMigrations.js';
 export type {
   DestructiveMigrationFile,
   DestructiveMigrationFinding,
   DestructiveMigrationGate,
-  DestructiveMigrationKind
+  DestructiveMigrationKind,
+  MigrationChange,
+  MigrationFileChanges
 } from './destructiveMigrations.js';
 
 export type LifecycleDispatchContinuation = {

package/src/errors/integration.ts

@@ -1,5 +1,5 @@
 // Integration errors are external errors to Superblocks and thrown from API execution
-import { isEmpty } from 'lodash';
+import { isEmpty } from 'lodash-es';
 
 import { Code as CommonErrorCode } from '@superblocksteam/types';
 

package/src/index.ts

@@ -1,5 +1,6 @@
 export * from './errors/index.js';
 export * from './types/index.js';
+export * from './types/customAgents.js';
 export * from './utils/index.js';
 export * from './relay/index.js';
 export * from './plugins/index.js';
@@ -29,6 +30,8 @@ export * from './org-features/index.js';
 export * from './database-lifecycle/index.js';
 export * from './database-lifecycle/appDatabaseCompatibility.js';
 export * from './database-lifecycle/importCompatibility.js';
+export type * from './database-lifecycle/appDatabaseMigrations.js';
+export * from './database-lifecycle/appDatabaseSharing.js';
 export * from './database-lifecycle/appDatabaseStatus.js';
 export * from './database-lifecycle/edit-lifecycle-capability.js';
 export * from './environment-compatibility/appEnvironmentCompatibility.js';

package/src/jwt/verifier.test.ts

@@ -2,10 +2,10 @@ import { generateKeyPairSync } from 'node:crypto';
 import { createServer, type Socket } from 'node:net';
 
 import { SignJWT, importPKCS8 } from 'jose';
-import { type JWTPayload } from 'jose';
+import type { JWTPayload } from 'jose';
 import { vi, describe, it, expect, beforeAll } from 'vitest';
 
-import { JwtVerifier, JwtVerifierOptions, JwtKey } from './verifier.js';
+import { JwtVerifier, type JwtVerifierOptions, type JwtKey } from './verifier.js';
 type SigningMaterial = {
   privateKeyPem: string;
   jwk: JwtKey;

package/src/jwt/verifier.ts

@@ -1,6 +1,6 @@
 import { createLocalJWKSet, createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from 'jose';
 import type { JWTPayload, JWTVerifyOptions, RemoteJWKSetOptions } from 'jose';
-import { isEmpty } from 'lodash';
+import { isEmpty } from 'lodash-es';
 
 import { UnauthorizedError } from '../errors/index.js';
 

package/src/pageMigrations/migrations/v4to5.test.ts

@@ -3,7 +3,7 @@
 // So we are using `!` to assert that `widget.children` is never undefined.
 // Note that `!` does not change the runtime behavior of the code so the code will work the same way as before.
 
-import { cloneDeep } from 'lodash';
+import { cloneDeep } from 'lodash-es';
 import { describe, it, expect } from 'vitest';
 
 import type { PageDSL4and5 } from '../../types/index.js';

package/src/pageMigrations/migrations/v5to6.test.ts

@@ -5,7 +5,7 @@
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
-import { cloneDeep } from 'lodash';
+import { cloneDeep } from 'lodash-es';
 import { describe, it, expect } from 'vitest';
 
 import type { PageDSL4and5, WidgetProps4and5 } from '../../types/index.js';

package/src/pageMigrations/migrations/v5to6.ts

@@ -1,4 +1,4 @@
-import { get, isArray, isEmpty, isString, set, uniq } from 'lodash';
+import { get, isArray, isEmpty, isString, set, uniq } from 'lodash-es';
 
 import type { PageDSL4and5, PageDSL6 } from '../../types/index.js';
 

package/src/pageMigrations/migrations/v6to7/adjustModalCanvases.test.ts

@@ -5,7 +5,7 @@
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
-import { cloneDeep } from 'lodash';
+import { cloneDeep } from 'lodash-es';
 import { describe, test, expect } from 'vitest';
 
 import with2ModalsAppV6DSL from '../../../utils/pageFixtures/v6/with_2_modals.js';

package/src/pageMigrations/migrations/v6to7/adjustModalCanvases.ts

@@ -3,7 +3,7 @@
 // So we are using `!` to assert that `widget.children` is never undefined.
 // Note that `!` does not change the runtime behavior of the code so the code will work the same way as before.
 
-import { cloneDeep } from 'lodash';
+import { cloneDeep } from 'lodash-es';
 
 import type { PageDSL6, WidgetProps6 } from '../../../types/index.js';
 

package/src/pageMigrations/migrations/v6to7/migrateToDimensions.test.ts

@@ -1,4 +1,4 @@
-import { cloneDeep } from 'lodash';
+import { cloneDeep } from 'lodash-es';
 import { describe, test, expect } from 'vitest';
 
 import type { WidgetProps6, WidgetProps7 } from '../../../types/index.js';

package/src/pageMigrations/migrations/v6to7/migrateToDimensions.ts

@@ -1,4 +1,4 @@
-import { cloneDeep } from 'lodash';
+import { cloneDeep } from 'lodash-es';
 
 import { Dimension, type PageDSL6, type PageDSL7, type WidgetProps6, type WidgetProps7 } from '../../../types/index.js';
 

package/src/pageMigrations/migrations/v6to7/v6to7.test.ts

@@ -1,4 +1,4 @@
-import { cloneDeep } from 'lodash';
+import { cloneDeep } from 'lodash-es';
 import { describe, it, expect } from 'vitest';
 
 import type { PageDSL6 } from '../../../index.js';

package/src/pageMigrations/migrations/v7to8.test.ts

@@ -1,4 +1,4 @@
-import { cloneDeep, get, omit } from 'lodash';
+import { cloneDeep, get, omit } from 'lodash-es';
 import { describe, it, expect } from 'vitest';
 
 import type { PageDSL7, WidgetProps7 } from '../../types/index.js';