@tangen/db 0.0.0-stage → 0.1.54

package/drizzle/0011_jobs_v2.sql

@@ -0,0 +1,67 @@
+-- Jobs v2: durable Postgres queue, run history, scheduler state,
+-- admin-managed cron entries, and the Postgres cache fallback.
+
+CREATE TABLE IF NOT EXISTS job_queue (
+  id bigserial PRIMARY KEY,
+  task_id text NOT NULL,
+  workspace_id text NOT NULL,
+  env_id text NOT NULL,
+  payload jsonb,
+  status text NOT NULL DEFAULT 'queued',
+  attempts integer NOT NULL DEFAULT 0,
+  max_attempts integer NOT NULL DEFAULT 3,
+  run_at timestamptz NOT NULL DEFAULT now(),
+  locked_at timestamptz,
+  locked_by text,
+  last_error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  finished_at timestamptz
+);
+CREATE INDEX IF NOT EXISTS job_queue_due_idx ON job_queue (status, run_at);
+
+CREATE TABLE IF NOT EXISTS job_runs (
+  id bigserial PRIMARY KEY,
+  kind text NOT NULL,                -- task | scheduled | cron
+  name text NOT NULL,                -- task id / job id / cron entry name
+  workspace_id text NOT NULL,
+  env_id text NOT NULL,
+  status text NOT NULL,              -- running | ok | error
+  started_at timestamptz NOT NULL DEFAULT now(),
+  finished_at timestamptz,
+  duration_ms integer,
+  error text,
+  meta jsonb
+);
+CREATE INDEX IF NOT EXISTS job_runs_scope_idx ON job_runs (workspace_id, env_id, started_at DESC);
+
+CREATE TABLE IF NOT EXISTS scheduler_state (
+  workspace_id text NOT NULL,
+  env_id text NOT NULL,
+  job_id text NOT NULL,
+  last_run timestamptz NOT NULL,
+  PRIMARY KEY (workspace_id, env_id, job_id)
+);
+
+CREATE TABLE IF NOT EXISTS cron_jobs (
+  id text PRIMARY KEY,
+  workspace_id text NOT NULL,
+  env_id text NOT NULL,
+  name text NOT NULL,
+  schedule text NOT NULL,
+  action jsonb NOT NULL,             -- {type:'url',...} | {type:'task',...}
+  enabled boolean NOT NULL DEFAULT true,
+  created_by text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS cron_jobs_scope_idx ON cron_jobs (workspace_id, env_id, enabled);
+
+CREATE TABLE IF NOT EXISTS cache_entries (
+  key text PRIMARY KEY,
+  value text NOT NULL,
+  tags text[] NOT NULL DEFAULT '{}',
+  stored_at timestamptz NOT NULL DEFAULT now(),
+  expires_at timestamptz NOT NULL
+);
+CREATE INDEX IF NOT EXISTS cache_entries_tags_idx ON cache_entries USING gin (tags);
+CREATE INDEX IF NOT EXISTS cache_entries_expiry_idx ON cache_entries (expires_at);

package/drizzle/0012_search_platform.sql

@@ -0,0 +1,36 @@
+-- Search platform: query-log analytics (retention-bounded, no PII), marketing-
+-- managed synonyms, and query curation/recommendations. All additive.
+
+CREATE TABLE IF NOT EXISTS search_query_log (
+  id text PRIMARY KEY,
+  workspace_id text NOT NULL,
+  env_id text NOT NULL,
+  audience text NOT NULL,            -- internal (Admin) | public (Site)
+  term text NOT NULL,                -- the query; no PII beyond what was typed
+  result_count integer NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS search_query_log_ws_env_idx ON search_query_log (workspace_id, env_id, created_at);
+
+CREATE TABLE IF NOT EXISTS search_synonyms (
+  id text PRIMARY KEY,
+  workspace_id text NOT NULL,
+  env_id text NOT NULL,
+  terms jsonb NOT NULL DEFAULT '[]',  -- interchangeable terms (string[])
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS search_synonyms_ws_env_idx ON search_synonyms (workspace_id, env_id);
+
+CREATE TABLE IF NOT EXISTS search_recommendations (
+  id text PRIMARY KEY,
+  workspace_id text NOT NULL,
+  env_id text NOT NULL,
+  query text NOT NULL,               -- query this rule applies to (case-insensitive)
+  pins jsonb NOT NULL DEFAULT '[]',   -- result ids/urls to pin, in order
+  hides jsonb NOT NULL DEFAULT '[]',  -- result ids/urls to remove
+  audience text,                      -- internal | public | null (both)
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS search_recommendations_ws_env_idx ON search_recommendations (workspace_id, env_id);

package/drizzle/0013_search_synonym_label.sql

@@ -0,0 +1,2 @@
+-- Search synonyms: a human title/label per group so marketing knows its purpose.
+ALTER TABLE search_synonyms ADD COLUMN IF NOT EXISTS label text;

package/drizzle/0014_object_types_disabled.sql

@@ -0,0 +1,2 @@
+-- TL-1: type-level soft delete — content APIs 404 for disabled types
+ALTER TABLE "object_types" ADD COLUMN IF NOT EXISTS "disabled" boolean NOT NULL DEFAULT false;

package/drizzle/0015_playground_collections.sql

@@ -0,0 +1,25 @@
+-- PG-3: API Playground collections (saved requests, private/shared) and
+-- per-member variable sets for {{name}} interpolation.
+CREATE TABLE IF NOT EXISTS "playground_collections" (
+  "id" text PRIMARY KEY,
+  "workspace_id" text NOT NULL,
+  "env_id" text NOT NULL,
+  "name" text NOT NULL,
+  "requests" jsonb NOT NULL DEFAULT '[]',
+  "visibility" text NOT NULL DEFAULT 'private',
+  "created_by" text NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS "playground_collections_scope_idx"
+  ON "playground_collections" ("workspace_id", "env_id");
+
+CREATE TABLE IF NOT EXISTS "playground_variables" (
+  "id" text PRIMARY KEY,
+  "workspace_id" text NOT NULL,
+  "env_id" text NOT NULL,
+  "member_id" text NOT NULL,
+  "vars" jsonb NOT NULL DEFAULT '{}',
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "playground_variables_owner" UNIQUE ("workspace_id", "env_id", "member_id")
+);

package/drizzle/0016_catchup_activity_promotion.sql

@@ -0,0 +1,36 @@
+-- Catch-up migration: the monorepo evolves system tables via `drizzle-kit push`,
+-- so these two never got a generated migration — consumer installs (which
+-- migrate via @tangen/db/migrate) were missing them. Hand-rolled from the live
+-- schema (drizzle-kit generate is currently incompatible with orm 0.45).
+CREATE TABLE IF NOT EXISTS "workspace_activity" (
+    "id" text PRIMARY KEY NOT NULL,
+    "workspace_id" text NOT NULL,
+    "env_id" text,
+    "category" text NOT NULL,
+    "action" text NOT NULL,
+    "actor_id" text,
+    "actor_name" text,
+    "actor_type" text,
+    "source" text DEFAULT 'admin' NOT NULL,
+    "type_name" text,
+    "object_id" text,
+    "object_title" text,
+    "target_label" text,
+    "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "promotion_log" (
+    "id" text PRIMARY KEY NOT NULL,
+    "object_id" text NOT NULL,
+    "from_env_id" text NOT NULL,
+    "to_env_id" text NOT NULL,
+    "release_id" text,
+    "promoted_by" text,
+    "promoted_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "workspace_activity_workspace_created" ON "workspace_activity" ("workspace_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "workspace_activity_env_created" ON "workspace_activity" ("env_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "promotion_log_object_env_idx" ON "promotion_log" ("object_id","to_env_id");

package/drizzle/0017_fields_disabled.sql

@@ -0,0 +1,3 @@
+-- #42 D5: field-level soft-disable — hidden from every runtime surface (admin,
+-- REST, TangenQL, GraphQL); column + data preserved, fully reversible.
+ALTER TABLE "fields" ADD COLUMN IF NOT EXISTS "disabled" boolean NOT NULL DEFAULT false;

package/drizzle/0018_object_types_plural.sql

@@ -0,0 +1 @@
+ALTER TABLE "object_types" ADD COLUMN IF NOT EXISTS "plural" text;

package/drizzle/0019_member_profile.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "members" ADD COLUMN IF NOT EXISTS "designation" text;
+ALTER TABLE "members" ADD COLUMN IF NOT EXISTS "avatar" text;

package/drizzle/0020_paused_jobs.sql

@@ -0,0 +1,7 @@
+CREATE TABLE IF NOT EXISTS "paused_jobs" (
+	"workspace_id" text NOT NULL,
+	"job_id" text NOT NULL,
+	"paused_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"paused_by" text,
+	CONSTRAINT "paused_jobs_workspace_id_job_id_pk" PRIMARY KEY("workspace_id","job_id")
+);

package/drizzle/0021_form_submission_notes.sql

@@ -0,0 +1,2 @@
+-- #50: internal admin notes per form submission (lead management)
+ALTER TABLE "form_submissions" ADD COLUMN IF NOT EXISTS "notes" text;

package/drizzle/0022_paused_jobs_env_reason.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "paused_jobs" ADD COLUMN IF NOT EXISTS "env_id" text NOT NULL DEFAULT '*';
+ALTER TABLE "paused_jobs" ADD COLUMN IF NOT EXISTS "reason" text;
+ALTER TABLE "paused_jobs" DROP CONSTRAINT IF EXISTS "paused_jobs_workspace_id_job_id_pk";
+ALTER TABLE "paused_jobs" ADD CONSTRAINT "paused_jobs_workspace_id_job_id_env_id_pk" PRIMARY KEY("workspace_id","job_id","env_id");

package/drizzle/0023_scale_indexes.sql

@@ -0,0 +1,3 @@
+CREATE INDEX IF NOT EXISTS "auth_users_workspace_env_created_idx" ON "auth_users" ("workspace_id","env_id","created_at" DESC);
+CREATE INDEX IF NOT EXISTS "form_submissions_form_created_idx" ON "form_submissions" ("form_id","created_at" DESC);
+CREATE INDEX IF NOT EXISTS "extension_data_scope_prefix_idx" ON "extension_data" ("extension_id","workspace_id","env_id","object_id" text_pattern_ops);

package/drizzle/0024_migration_runs.sql

@@ -0,0 +1,24 @@
+CREATE TABLE IF NOT EXISTS "migration_runs" (
+  "id" text PRIMARY KEY NOT NULL,
+  "workspace_id" text NOT NULL,
+  "kind" text NOT NULL,
+  "source_env_id" text,
+  "target_env_id" text,
+  "status" text NOT NULL DEFAULT 'pending',
+  "scope" jsonb NOT NULL DEFAULT '{}',
+  "counts" jsonb NOT NULL DEFAULT '{}',
+  "total_items" integer NOT NULL DEFAULT 0,
+  "processed_items" integer NOT NULL DEFAULT 0,
+  "results_parts" integer NOT NULL DEFAULT 0,
+  "error" text,
+  "cancel_requested" boolean NOT NULL DEFAULT false,
+  "created_by" text,
+  "created_at" timestamp with time zone NOT NULL DEFAULT now(),
+  "started_at" timestamp with time zone,
+  "finished_at" timestamp with time zone,
+  "heartbeat_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "migration_runs_workspace_idx" ON "migration_runs" ("workspace_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "migration_runs_status_idx" ON "migration_runs" ("status");

package/drizzle/0025_porter_transfer.sql

@@ -0,0 +1,30 @@
+CREATE TABLE IF NOT EXISTS "porter_transfer_codes" (
+  "id" text PRIMARY KEY NOT NULL,
+  "workspace_id" text NOT NULL,
+  "env_id" text NOT NULL,
+  "code_hash" text NOT NULL,
+  "expires_at" timestamp with time zone NOT NULL,
+  "redeemed_at" timestamp with time zone,
+  "revoked_at" timestamp with time zone,
+  "created_at" timestamp with time zone NOT NULL DEFAULT now(),
+  "created_by" text
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "porter_codes_hash_idx" ON "porter_transfer_codes" ("code_hash");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "porter_codes_workspace_idx" ON "porter_transfer_codes" ("workspace_id","env_id");
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "porter_transfer_tokens" (
+  "id" text PRIMARY KEY NOT NULL,
+  "workspace_id" text NOT NULL,
+  "env_id" text NOT NULL,
+  "token_hash" text NOT NULL,
+  "code_id" text NOT NULL,
+  "run_id" text,
+  "expires_at" timestamp with time zone NOT NULL,
+  "revoked_at" timestamp with time zone,
+  "created_at" timestamp with time zone NOT NULL DEFAULT now(),
+  "sender_info" jsonb NOT NULL DEFAULT '{}'
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "porter_tokens_hash_idx" ON "porter_transfer_tokens" ("token_hash");

package/drizzle/0026_cron_timezone.sql

@@ -0,0 +1 @@
+ALTER TABLE "cron_jobs" ADD COLUMN IF NOT EXISTS "timezone" text;

package/drizzle/0027_rate_limit_counters.sql

@@ -0,0 +1,6 @@
+CREATE TABLE IF NOT EXISTS "rate_limit_counters" (
+  "key" text PRIMARY KEY NOT NULL,
+  "count" integer NOT NULL DEFAULT 0,
+  "reset_at" timestamp with time zone NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "rate_limit_counters_reset_idx" ON "rate_limit_counters" ("reset_at");

package/drizzle/0028_realtime_events.sql

@@ -0,0 +1,10 @@
+CREATE TABLE IF NOT EXISTS "realtime_events" (
+  "seq" bigserial PRIMARY KEY,
+  "channel" text NOT NULL,
+  "id" text NOT NULL,
+  "t" bigint NOT NULL,
+  "type" text NOT NULL,
+  "data" jsonb NOT NULL DEFAULT '{}'::jsonb
+);
+CREATE INDEX IF NOT EXISTS "realtime_events_channel_seq_idx" ON "realtime_events" ("channel", "seq");
+CREATE UNIQUE INDEX IF NOT EXISTS "realtime_events_channel_id_idx" ON "realtime_events" ("channel", "id");

package/drizzle/0030_delivery_artifacts.sql

@@ -0,0 +1,10 @@
+CREATE TABLE IF NOT EXISTS "delivery_artifacts" (
+  "workspace_id" text NOT NULL,
+  "env_id" text NOT NULL,
+  "path" text NOT NULL,
+  "body" text NOT NULL,
+  "content_type" text NOT NULL DEFAULT 'application/octet-stream',
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "delivery_artifacts_pk" PRIMARY KEY("workspace_id","env_id","path")
+);

package/drizzle/0031_realtime_presence.sql

@@ -0,0 +1,8 @@
+CREATE TABLE IF NOT EXISTS "realtime_presence" (
+  "channel" text NOT NULL,
+  "session_id" text NOT NULL,
+  "data" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  "expires_at" bigint NOT NULL,
+  PRIMARY KEY ("channel", "session_id")
+);
+CREATE INDEX IF NOT EXISTS "realtime_presence_expires_idx" ON "realtime_presence" ("expires_at");

package/drizzle/0032_schema_pushes.sql

@@ -0,0 +1,15 @@
+CREATE TABLE IF NOT EXISTS "schema_pushes" (
+  "id" text PRIMARY KEY NOT NULL,
+  "env_id" text NOT NULL,
+  "workspace_id" text NOT NULL,
+  "started_at" timestamp with time zone NOT NULL DEFAULT now(),
+  "finished_at" timestamp with time zone,
+  "status" text NOT NULL DEFAULT 'running',
+  "git_sha" text,
+  "cli_version" text,
+  "plan_json" jsonb NOT NULL DEFAULT '{}',
+  "statements_json" jsonb NOT NULL DEFAULT '[]',
+  "error" text
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "schema_pushes_env_idx" ON "schema_pushes" ("env_id","started_at");

package/drizzle/0033_studio_design_capability.sql

@@ -0,0 +1,37 @@
+-- Studio decision 3 (2026-08-25): `studio:design` splits class, tag, token,
+-- theme and stylesheet work off `studio:edit`.
+--
+-- Every custom role that could style a page BEFORE this release did so through
+-- one of three grants: `studio:edit` directly, or `studio:manage` /
+-- `studio:creative`, both of which implied `studio:edit`. Shipping the split
+-- without this statement would take styling away from all of them silently, at
+-- the moment of deploy, with no admin action and no notice.
+--
+-- So the grandfather is written down as data, not hidden in the capability
+-- resolver: each of those roles gets `studio:design` (and `studio:edit`, when
+-- it was only ever implied) added to its stored capability list, where an
+-- owner can SEE it in the roles editor and remove it from the marketer roles
+-- that should not have kept it. A silent implication would have been
+-- invisible forever.
+--
+-- Owners and admins are unaffected: they never carry a capability list.
+-- Code-defined roles (defineRole() in a site's config) are not stored here and
+-- must add `studio:design` in code - see docs/rbac.md.
+UPDATE "roles"
+SET "permissions" = jsonb_set(
+      "permissions",
+      '{capabilities}',
+      COALESCE("permissions"->'capabilities', '[]'::jsonb)
+        || (CASE WHEN "permissions"->'capabilities' @> '"studio:design"'::jsonb
+                 THEN '[]'::jsonb ELSE '["studio:design"]'::jsonb END)
+        || (CASE WHEN "permissions"->'capabilities' @> '"studio:edit"'::jsonb
+                 THEN '[]'::jsonb ELSE '["studio:edit"]'::jsonb END),
+      true
+    ),
+    "updated_at" = now()
+WHERE jsonb_typeof("permissions"->'capabilities') = 'array'
+  AND ("permissions"->'capabilities' @> '"studio:edit"'::jsonb
+    OR "permissions"->'capabilities' @> '"studio:manage"'::jsonb
+    OR "permissions"->'capabilities' @> '"studio:creative"'::jsonb)
+  AND NOT ("permissions"->'capabilities' @> '"studio:design"'::jsonb
+       AND "permissions"->'capabilities' @> '"studio:edit"'::jsonb);

package/drizzle/0034_object_types_provided_by.sql

@@ -0,0 +1,12 @@
+-- Extension-provisioned content types (2026-08-26): a registry row remembers
+-- WHO declared it.
+--
+-- Nullable, and NULL means what it always meant: the site's own code declares
+-- this type, so `tangen push` may offer to drop it (with --confirm) when the
+-- code stops declaring it. A non-null value names the extension that provides
+-- the type, and buys the row one guarantee - a diff never turns it into a
+-- DROP_TYPE. An extension that is removed, disabled, or simply stops declaring
+-- the type leaves an ORPHAN: the table and its rows stay, push says so, doctor
+-- says so. A site takes ownership by declaring the same name in its own
+-- schema, which clears this column, and only then can drop it the ordinary way.
+ALTER TABLE "object_types" ADD COLUMN IF NOT EXISTS "provided_by" text;

package/drizzle/0035_custom_table_owners.sql

@@ -0,0 +1,24 @@
+-- Extension-declared custom tables (2026-08-28): a registry row remembers WHO
+-- declared each custom table.
+--
+-- Keyed by table name alone, and that key is the honest description of the
+-- architecture: a physical table is instance-global. Installing an extension in
+-- a second workspace does not create a second table, it finds the one already
+-- there. The rows inside stay workspace- and environment-scoped, as they were.
+--
+-- `owner_kind` is 'site' when the site's own config declares the table, or
+-- 'extension' with the extension id and the manifest version it was claimed at.
+-- A table with NO row here is unclaimed rather than unowned: every custom table
+-- that predates this registry is unclaimed, and an extension declaring one of
+-- those names is refused rather than handed somebody else's data. Ownership is
+-- never transferred by declaring a name.
+CREATE TABLE IF NOT EXISTS "custom_table_owners" (
+  "table_name" text PRIMARY KEY,
+  "owner_kind" text NOT NULL,
+  "owner_id" text,
+  "owner_version" text,
+  "workspace_id" text,
+  "env_id" text,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);

package/drizzle/0036_revision_version_unique.sql

@@ -0,0 +1,42 @@
+-- Revision version numbers must be unique per object (2026-08-28).
+--
+-- `createRevision` allocated with `SELECT COALESCE(MAX(version),0)` followed by
+-- a separate INSERT, with no transaction, no lock and no constraint. Two
+-- concurrent writers to one object both read the same maximum and both inserted
+-- the same version. Allocation is now a single INSERT ... SELECT that computes
+-- the maximum inline and retries on conflict, and THIS index is what makes the
+-- invariant real: without it the retry has nothing to catch.
+--
+-- The scope is (workspace_id, object_id) and deliberately NOT env_id, because
+-- that is the scope the previous MAX() used. Widening it would change numbering
+-- semantics; matching it changes nothing except that duplicates become
+-- impossible.
+--
+-- A database that already contains duplicates cannot take this index. Rather
+-- than fail with a bare "could not create unique index", stop first and say
+-- exactly what is wrong and how to look at it: this is corrupt revision
+-- history, and repairing it by renumbering rewrites a record the product
+-- promises to keep, so it is an operator decision rather than a migration's.
+DO $$
+DECLARE dup_count integer; sample text;
+BEGIN
+  SELECT count(*), min(workspace_id || ' / ' || object_id || ' / v' || version)
+    INTO dup_count, sample
+  FROM (
+    SELECT workspace_id, object_id, version
+    FROM "_revisions"
+    GROUP BY workspace_id, object_id, version
+    HAVING count(*) > 1
+  ) d;
+
+  IF dup_count > 0 THEN
+    RAISE EXCEPTION
+      'Cannot add the revision uniqueness index: % object/version pair(s) already have duplicate revisions (for example %). '
+      'This is pre-existing corrupt revision history from the unsafe allocator. Inspect with: '
+      'SELECT workspace_id, object_id, version, count(*) FROM "_revisions" GROUP BY 1,2,3 HAVING count(*) > 1; '
+      'Decide how to renumber or remove the duplicates, then re-run the migration.',
+      dup_count, sample;
+  END IF;
+END $$;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "_revisions_object_version_uniq" ON "_revisions" ("workspace_id","object_id","version");

package/drizzle/0037_job_queue_dedupe.sql

@@ -0,0 +1,20 @@
+-- One pending job per logical target.
+--
+-- The search indexer enqueues a job per content mutation, and those jobs carry
+-- no snapshot: each one re-reads the object and reconciles the index to
+-- whatever it finds. So while a job is still QUEUED, a second job for the same
+-- object is pure duplicate work - a hundred autosaves produced a hundred jobs
+-- that all indexed the same final state.
+--
+-- The index is deliberately PARTIAL on status='queued'. A claimed (running)
+-- row leaves the index, so a mutation arriving mid-job can always enqueue the
+-- follow-up reconciliation it needs; without that, a change made while a job
+-- was running would be silently dropped. A failed row leaves it too, so one
+-- poisoned job cannot block current state from ever being reconciled.
+--
+-- dedupe_key is NULL for every other task, and NULL is not deduplicated.
+ALTER TABLE "job_queue" ADD COLUMN IF NOT EXISTS "dedupe_key" TEXT;
+
+CREATE UNIQUE INDEX IF NOT EXISTS "job_queue_dedupe_uniq"
+  ON "job_queue" ("dedupe_key")
+  WHERE "status" = 'queued' AND "dedupe_key" IS NOT NULL;

package/drizzle/0038_search_documents.sql

@@ -0,0 +1,87 @@
+-- btree_gin lets a GIN index carry ordinary scalar columns alongside the
+-- tsvector, which is what keeps the scope filters INSIDE the index. It is a
+-- standard contrib extension and is TRUSTED from PostgreSQL 13, so the database
+-- owner can install it without superuser. If this fails, the deployment is on a
+-- managed service that withholds contrib, and search must be told so plainly
+-- rather than silently building an index that filters after the fact.
+DO $$
+BEGIN
+  CREATE EXTENSION IF NOT EXISTS btree_gin;
+EXCEPTION WHEN OTHERS THEN
+  RAISE EXCEPTION 'Tangen search needs the btree_gin extension (standard PostgreSQL contrib, trusted since 13). Install it as the database owner: CREATE EXTENSION btree_gin;  Underlying error: %', SQLERRM;
+END $$;
+
+-- The search index, in the database that was already mandatory.
+--
+-- One row per (workspace, environment, source, type, object, LOCALE). The
+-- locale is part of the identity because the text-search configuration is per
+-- row: a French document has to be stemmed and queried as French, and one row
+-- carrying every translation could only ever be stemmed once.
+--
+-- `search_vector` is GENERATED, and its configuration comes from the row's own
+-- `cfg` column - PostgreSQL accepts `to_tsvector(cfg, ...)` as immutable. So the
+-- language is data, the vector maintains itself, and no application code or
+-- trigger ever computes it.
+--
+-- No pg_trgm here on purpose. Measured at a million documents, the trigram index
+-- cost 36% of write throughput and 175% more WAL than the FTS index it
+-- accompanied - more than full-text search itself. Typo tolerance is an opt-in
+-- capability, not a default, and lives in its own migration.
+CREATE TABLE IF NOT EXISTS "search_documents" (
+  "workspace_id"  text        NOT NULL,
+  "env_id"        text        NOT NULL,
+  "source"        text        NOT NULL,          -- 'content' | 'media' | 'ext:<id>:<src>'
+  "type_slug"     text        NOT NULL,
+  "object_id"     text        NOT NULL,
+  "locale"        text        NOT NULL DEFAULT '',
+  "cfg"           regconfig   NOT NULL DEFAULT 'simple',
+  "title"         text        NOT NULL DEFAULT '',
+  "slug"          text,
+  "body"          text        NOT NULL DEFAULT '',
+  -- Bounded snippet source. ts_headline is linear in the text it is given:
+  -- 101 ms to snippet twenty 100 KB documents, against 1 ms for 1 KB ones.
+  "excerpt"       text        NOT NULL DEFAULT '',
+  "status"        text        NOT NULL DEFAULT 'draft',
+  "is_published"  boolean     NOT NULL DEFAULT false,
+  "metadata"      jsonb       NOT NULL DEFAULT '{}'::jsonb,
+  "updated_at"    timestamptz NOT NULL DEFAULT now(),
+  "search_vector" tsvector GENERATED ALWAYS AS (
+       setweight(to_tsvector("cfg", coalesce("title",   '')), 'A')
+    || setweight(to_tsvector("cfg", coalesce("slug",    '')), 'B')
+    || setweight(to_tsvector("cfg", coalesce("excerpt", '')), 'B')
+    || setweight(to_tsvector("cfg", coalesce("body",    '')), 'C')
+  ) STORED,
+  CONSTRAINT "search_documents_pkey"
+    PRIMARY KEY ("workspace_id", "env_id", "source", "type_slug", "object_id", "locale")
+);
+
+-- Every constraint a search actually applies lives INSIDE the index.
+--
+-- The prototype put only the vector in the GIN index and filtered
+-- `is_published` afterwards: PostgreSQL fetched 50,000 matching heap rows and
+-- then discarded every one of them, for 2.3 seconds. A filter outside the index
+-- is not a filter, it is a post-processing step that pays full price.
+CREATE INDEX IF NOT EXISTS "search_documents_fts"
+  ON "search_documents"
+  USING gin ("workspace_id", "env_id", "locale", "is_published", "source", "type_slug", "search_vector");
+
+-- Autocomplete. An anchored B-tree, NOT trigram: measured across five prefixes
+-- at a million documents, trigram ranged from 0.04 ms to 11.6 ms with a 137 ms
+-- tail, while this is 0.015-0.104 ms p50 and under 1.2 ms at p95 for every
+-- prefix tried. `text_pattern_ops` is what makes LIKE 'x%' an index range scan.
+CREATE INDEX IF NOT EXISTS "search_documents_title_prefix"
+  ON "search_documents" ("workspace_id", "env_id", lower("title") text_pattern_ops);
+CREATE INDEX IF NOT EXISTS "search_documents_slug_prefix"
+  ON "search_documents" ("workspace_id", "env_id", lower("slug") text_pattern_ops);
+
+-- Exact identifier lookup: the CMS case, and the fastest path in the design.
+CREATE INDEX IF NOT EXISTS "search_documents_slug"
+  ON "search_documents" ("workspace_id", "env_id", "slug");
+-- Facet and filter dimensions that are not text.
+CREATE INDEX IF NOT EXISTS "search_documents_scope"
+  ON "search_documents" ("workspace_id", "env_id", "is_published", "type_slug");
+CREATE INDEX IF NOT EXISTS "search_documents_metadata"
+  ON "search_documents" USING gin ("metadata" jsonb_path_ops);
+-- Backfill progress scans by object identity.
+CREATE INDEX IF NOT EXISTS "search_documents_object"
+  ON "search_documents" ("workspace_id", "env_id", "source", "object_id");

package/drizzle/0039_job_prune_indexes.sql

@@ -0,0 +1,25 @@
+-- Housekeeping must not scale with retained history.
+--
+-- Every five minutes the queue worker prunes finished jobs older than the
+-- retention window. Neither prune had an index on the column it filters by, so
+-- each one was a full sequential scan of the retained table - 15k rows of
+-- job_queue and 46k rows of job_runs, every pass, to delete nothing at all on
+-- a quiet server. That was the whole of an idle server's periodic read volume
+-- once the claim query was fixed, and it grew with site activity: the busier a
+-- site had been, the more an idle server paid to confirm there was nothing to
+-- do. Same class of defect as the claim's ORDER BY id, one layer down.
+--
+-- With the column indexed, a prune with nothing old enough to delete positions
+-- at the cutoff and stops: two buffers regardless of how much history is kept.
+--
+-- job_queue: finished_at is NULL until a job finishes, and the prune filters on
+-- status IN ('done','failed') as well. A partial index matching that predicate
+-- measured identically to a plain one (same size, same two buffers), so the
+-- plain index is used: it does not depend on the planner proving the partial
+-- predicate, and it stays useful if the prune's status list ever changes.
+--
+-- job_runs: job_runs_scope_idx is (workspace_id, env_id, started_at DESC), and
+-- a bare started_at range cannot use it with started_at in third position.
+CREATE INDEX IF NOT EXISTS "job_queue_finished_idx" ON "job_queue" ("finished_at");
+
+CREATE INDEX IF NOT EXISTS "job_runs_started_idx" ON "job_runs" ("started_at");

package/drizzle/0040_extension_data_object_idx.sql

@@ -0,0 +1,10 @@
+-- Extension data by object.
+--
+-- Every admin list asks extension_data which of the page's objects carry
+-- unpublished extension data (the draft-changes indicator). Both existing
+-- indexes lead with extension_id, so that lookup - by workspace, environment
+-- and object - had no index at all and scanned the whole table: measured at
+-- 37 ms over 120k rows, on every admin list, growing with every extension row
+-- a site accumulates. This index makes it a handful of probes, and lets the
+-- indicator ride the page query itself instead of costing a round trip.
+CREATE INDEX IF NOT EXISTS "extension_data_object_idx" ON "extension_data" ("workspace_id", "env_id", "object_id");