@tangen/db 0.0.0-stage → 0.1.54

package/drizzle/0041_knowledge.sql

@@ -0,0 +1,79 @@
+-- Knowledge (RAG) tables, owned by @tangen/db (freeze review C4).
+--
+-- Until this migration, @tangen/knowledge created these four tables itself at
+-- runtime with CREATE TABLE IF NOT EXISTS: no ledger, no doctor, a second DDL
+-- authority. The canonical text now lives in packages/db/src/knowledge-schema.ts
+-- and this file carries it verbatim (the test proves it). Every statement is
+-- idempotent, so an installation whose tables the runtime already created is
+-- adopted as it stands: nothing is dropped, recreated or rewritten.
+--
+-- pgvector is an operator prerequisite (decision B): Tangen never runs
+-- CREATE EXTENSION vector. knowledge_meta, knowledge_qa and knowledge_queries
+-- need nothing and are created here unconditionally. knowledge_chunks needs the
+-- vector type, so it is created only when that type exists; when pgvector is
+-- enabled later, the canonical migration entrypoint (runMigrations, which the
+-- API runs at boot) applies the same statements. The embedding column is typed
+-- to the configured model dimensions by pinKnowledgeVectorSpace, the one
+-- configuration-driven DDL step, also owned by @tangen/db.
+
+CREATE TABLE IF NOT EXISTS "knowledge_meta" (
+  "workspace_id" text NOT NULL,
+  "env_id" text NOT NULL,
+  "provider" text NOT NULL,
+  "model" text NOT NULL,
+  "dimensions" integer NOT NULL,
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY ("workspace_id", "env_id")
+);
+CREATE TABLE IF NOT EXISTS "knowledge_qa" (
+  "id" text PRIMARY KEY,
+  "workspace_id" text NOT NULL,
+  "env_id" text NOT NULL,
+  "question" text NOT NULL,
+  "answer" text NOT NULL,
+  "audience" text NOT NULL DEFAULT 'public',
+  "enabled" boolean NOT NULL DEFAULT true,
+  "updated_by" text,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS "knowledge_qa_scope_idx" ON "knowledge_qa" ("workspace_id", "env_id");
+CREATE TABLE IF NOT EXISTS "knowledge_queries" (
+  "id" bigserial PRIMARY KEY,
+  "workspace_id" text NOT NULL,
+  "env_id" text NOT NULL,
+  "query" text NOT NULL,
+  "source" text NOT NULL,
+  "audience" text NOT NULL DEFAULT 'public',
+  "locale" text NOT NULL DEFAULT '',
+  "top_score" real,
+  "hit_count" integer NOT NULL DEFAULT 0,
+  "answered" boolean NOT NULL DEFAULT false,
+  "created_at" timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS "knowledge_queries_scope_idx" ON "knowledge_queries" ("workspace_id", "env_id", "created_at");
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_type WHERE typname = 'vector') THEN
+    EXECUTE $ddl$CREATE TABLE IF NOT EXISTS "knowledge_chunks" (
+  "id" bigserial PRIMARY KEY,
+  "workspace_id" text NOT NULL,
+  "env_id" text NOT NULL,
+  "source_kind" text NOT NULL,
+  "source_id" text NOT NULL,
+  "source_group" text NOT NULL DEFAULT '',
+  "field" text NOT NULL DEFAULT '',
+  "locale" text NOT NULL DEFAULT '',
+  "audience" text NOT NULL DEFAULT 'public',
+  "chunk_index" integer NOT NULL DEFAULT 0,
+  "content" text NOT NULL,
+  "content_hash" text NOT NULL,
+  "metadata" jsonb,
+  "embedding" vector NOT NULL,
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+)$ddl$;
+    EXECUTE $ddl$ALTER TABLE "knowledge_chunks" ADD COLUMN IF NOT EXISTS "audience" text NOT NULL DEFAULT 'public'$ddl$;
+    EXECUTE $ddl$CREATE INDEX IF NOT EXISTS "knowledge_chunks_scope_idx" ON "knowledge_chunks" ("workspace_id", "env_id", "source_kind", "source_id")$ddl$;
+  END IF;
+END $$;

package/drizzle/0042_schema_pushes_checksum.sql

@@ -0,0 +1,7 @@
+-- Push history integrity (closure plan, Phase 1 Unit 4).
+--
+-- Every push records a checksum of the effective plan and the statements it
+-- ran; the next push re-fingerprints the environment's rows from what they
+-- store and refuses when one disagrees. Rows from before this column exist
+-- with NULL: legacy, accepted as they are, reported, never rewritten.
+ALTER TABLE "schema_pushes" ADD COLUMN IF NOT EXISTS "checksum" text;

package/drizzle/0043_guard_adoption.sql

@@ -0,0 +1,12 @@
+-- Adoption of what only the boot guard ever defined (closure plan, Phase 1 Unit 5).
+--
+-- Until this migration, `object_types.localized` and the `entity_tags` table
+-- with its two indexes existed in ensure-system-schema.ts alone: created at
+-- boot and before every push by a hand-maintained guard, never by a
+-- migration. The guard is now derived from the migrations and defines
+-- nothing itself, so these move here, verbatim and idempotent: a database the
+-- guard already provisioned is adopted as it stands.
+ALTER TABLE "object_types" ADD COLUMN IF NOT EXISTS "localized" boolean NOT NULL DEFAULT false;
+CREATE TABLE IF NOT EXISTS "entity_tags" ("workspace_id" text NOT NULL, "env_id" text NOT NULL, "entity_type" text NOT NULL, "entity_id" text NOT NULL, "tag" text NOT NULL, "source" text NOT NULL DEFAULT 'user', "created_at" timestamp with time zone DEFAULT now() NOT NULL, "created_by" text, CONSTRAINT "entity_tags_pk" PRIMARY KEY("workspace_id","env_id","entity_type","entity_id","tag"));
+CREATE INDEX IF NOT EXISTS "entity_tags_filter_idx" ON "entity_tags" ("workspace_id","env_id","entity_type","tag");
+CREATE INDEX IF NOT EXISTS "entity_tags_entity_idx" ON "entity_tags" ("workspace_id","env_id","entity_type","entity_id");

package/drizzle/0044_retention_indexes.sql

@@ -0,0 +1,7 @@
+-- Retention (closure plan Phase 2, Unit 3): the daily purge deletes by
+-- workspace (or target environment) and age, so every table it covers needs
+-- an index on that pair. audit_log, workspace_activity and search_query_log
+-- already had one; these three did not.
+CREATE INDEX IF NOT EXISTS "webhook_deliveries_retention_idx" ON "webhook_deliveries" ("workspace_id", "created_at");
+CREATE INDEX IF NOT EXISTS "job_runs_retention_idx" ON "job_runs" ("workspace_id", "started_at");
+CREATE INDEX IF NOT EXISTS "promotion_log_retention_idx" ON "promotion_log" ("to_env_id", "promoted_at");

package/drizzle/0045_extension_install_per_env.sql

@@ -0,0 +1,40 @@
+-- Extension installation per environment (closure plan Phase 4, Unit 1).
+--
+-- Until now one row meant "installed in this workspace, every environment".
+-- The v1 contract installs, enables, upgrades and uninstalls per environment,
+-- so the row gains env_id, state, enabled, version, upgraded_at and
+-- uninstalled_at, and the old rows are ADOPTED: each workspace-wide row
+-- becomes one row per environment the workspace has (from `environments`),
+-- installed and enabled, options and installed_at/by carried over, version
+-- left NULL until the first boot records the manifest's. A workspace with no
+-- environment rows keeps one row under env_development, the platform's
+-- default environment id, so nothing that was installed disappears.
+-- Idempotent: only rows without an env_id are adopted; the second run finds none.
+ALTER TABLE "workspace_installed_apps" ADD COLUMN IF NOT EXISTS "env_id" text;
+ALTER TABLE "workspace_installed_apps" ADD COLUMN IF NOT EXISTS "state" text NOT NULL DEFAULT 'installed';
+ALTER TABLE "workspace_installed_apps" ADD COLUMN IF NOT EXISTS "enabled" boolean NOT NULL DEFAULT true;
+ALTER TABLE "workspace_installed_apps" ADD COLUMN IF NOT EXISTS "version" text;
+ALTER TABLE "workspace_installed_apps" ADD COLUMN IF NOT EXISTS "upgraded_at" timestamp with time zone;
+ALTER TABLE "workspace_installed_apps" ADD COLUMN IF NOT EXISTS "uninstalled_at" timestamp with time zone;
+
+-- The old uniqueness (workspace, app) would refuse the second environment.
+DROP INDEX IF EXISTS "workspace_installed_apps_ws_app_unique";
+
+-- Adoption of the workspace-wide rows.
+INSERT INTO "workspace_installed_apps" ("id", "workspace_id", "env_id", "app_id", "options", "state", "enabled", "version", "installed_at", "installed_by")
+SELECT r."id" || '_' || replace(e."id", 'env_', ''), r."workspace_id", e."id", r."app_id", r."options", 'installed', true, r."version", r."installed_at", r."installed_by"
+FROM "workspace_installed_apps" r
+JOIN "environments" e ON e."workspace_id" = r."workspace_id"
+WHERE r."env_id" IS NULL
+ON CONFLICT DO NOTHING;
+
+INSERT INTO "workspace_installed_apps" ("id", "workspace_id", "env_id", "app_id", "options", "state", "enabled", "version", "installed_at", "installed_by")
+SELECT r."id" || '_development', r."workspace_id", 'env_development', r."app_id", r."options", 'installed', true, r."version", r."installed_at", r."installed_by"
+FROM "workspace_installed_apps" r
+WHERE r."env_id" IS NULL
+  AND NOT EXISTS (SELECT 1 FROM "environments" e WHERE e."workspace_id" = r."workspace_id")
+ON CONFLICT DO NOTHING;
+
+DELETE FROM "workspace_installed_apps" WHERE "env_id" IS NULL;
+
+CREATE UNIQUE INDEX IF NOT EXISTS "workspace_installed_apps_ws_env_app_unique" ON "workspace_installed_apps" ("workspace_id", "env_id", "app_id");

package/drizzle/0046_extension_migrations.sql

@@ -0,0 +1,18 @@
+-- The extension migration ledger (closure plan Phase 4, Unit 5): one row per
+-- migration an extension applied in one workspace x environment, with the
+-- checksum of the SQL that ran. Extension schema evolution is explicit,
+-- deterministic and ledgered; nothing creates or alters an extension's
+-- tables at import, REGISTER, ENABLE or START.
+CREATE TABLE IF NOT EXISTS "extension_migrations" (
+	"id" text PRIMARY KEY NOT NULL,
+	"workspace_id" text NOT NULL,
+	"env_id" text NOT NULL,
+	"extension_id" text NOT NULL,
+	"migration_id" text NOT NULL,
+	"extension_version" text,
+	"checksum" text NOT NULL,
+	"status" text DEFAULT 'applied' NOT NULL,
+	"error" text,
+	"applied_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS "extension_migrations_scope_unique" ON "extension_migrations" ("workspace_id","env_id","extension_id","migration_id");

package/drizzle/0047_environment_role.sql

@@ -0,0 +1,25 @@
+-- The semantic environment role (closure plan Phase 5A, Unit 2).
+--
+-- Exactly three roles exist in v1 - development, staging, production - and
+-- every production protection keys on the role, never on a slug or a label.
+-- The column is nullable at the database level so a legacy row waits for
+-- adoption (migration 0048 / doctor) instead of being guessed; a row that
+-- has a role keeps it: the trigger refuses every later change. One
+-- environment per role per workspace.
+ALTER TABLE "environments" ADD COLUMN IF NOT EXISTS "role" text;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'environments_role_check') THEN
+    ALTER TABLE "environments" ADD CONSTRAINT "environments_role_check" CHECK ("role" IS NULL OR "role" IN ('development', 'staging', 'production'));
+  END IF;
+END $$;
+CREATE UNIQUE INDEX IF NOT EXISTS "environments_workspace_role_unique" ON "environments" ("workspace_id", "role") WHERE "role" IS NOT NULL;
+CREATE OR REPLACE FUNCTION environments_role_set_once() RETURNS trigger AS $$
+BEGIN
+  IF OLD.role IS NOT NULL AND NEW.role IS DISTINCT FROM OLD.role THEN
+    RAISE EXCEPTION 'environments.role is immutable: % is % and cannot become %', OLD.id, OLD.role, COALESCE(NEW.role, 'null')
+      USING ERRCODE = 'check_violation';
+  END IF;
+  RETURN NEW;
+END $$ LANGUAGE plpgsql;
+DROP TRIGGER IF EXISTS environments_role_set_once ON "environments";
+CREATE TRIGGER environments_role_set_once BEFORE UPDATE ON "environments" FOR EACH ROW EXECUTE FUNCTION environments_role_set_once();

package/drizzle/0048_environment_role_adoption.sql

@@ -0,0 +1,30 @@
+-- Adoption of legacy environments into the three roles (closure plan Phase 5A, Unit 3).
+--
+-- The rule is environmentRoleForSlug in @tangen/types: development | dev,
+-- staging | stage, production | prod, case-insensitively. A role is assigned
+-- only when exactly ONE null-role environment of the workspace names it and
+-- the workspace does not already hold it. Two candidates for one role
+-- (prod and production side by side), a slug the rule does not know (uat,
+-- live, prod-eu) or a role already held leave the row null: doctor reports
+-- it and `tangen environment adopt-role` is the operator's decision. Never
+-- a guess; never two productions. Idempotent: only null roles are touched.
+WITH candidates AS (
+  SELECT e."id", e."workspace_id",
+    CASE
+      WHEN lower(e."slug") IN ('development', 'dev') THEN 'development'
+      WHEN lower(e."slug") IN ('staging', 'stage') THEN 'staging'
+      WHEN lower(e."slug") IN ('production', 'prod') THEN 'production'
+    END AS "role"
+  FROM "environments" e
+  WHERE e."role" IS NULL
+), counted AS (
+  SELECT c."id", c."workspace_id", c."role",
+    count(*) OVER (PARTITION BY c."workspace_id", c."role") AS "n",
+    EXISTS (SELECT 1 FROM "environments" x WHERE x."workspace_id" = c."workspace_id" AND x."role" = c."role") AS "taken"
+  FROM candidates c
+  WHERE c."role" IS NOT NULL
+)
+UPDATE "environments" e
+SET "role" = counted."role"
+FROM counted
+WHERE e."id" = counted."id" AND counted."n" = 1 AND NOT counted."taken";

package/drizzle/0049_release_lifecycle.sql

@@ -0,0 +1,55 @@
+-- Releases v1 (closure plan Phase 5B, Unit 2): the explicit state machine
+-- DRAFT -> IN_REVIEW -> APPROVED -> APPLYING -> APPLIED | FAILED, the columns
+-- approval, scheduling, application and failure record on, item identity
+-- (one item per object per release) with a per-item outcome, and the
+-- promotion history. A legacy `pending` release becomes a `draft`. Data is
+-- never dropped: duplicate item selections of one object are collapsed to
+-- the first (they were one application anyway).
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "submitted_at" timestamp with time zone;
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "submitted_by" text;
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "approved_at" timestamp with time zone;
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "approved_by" text;
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "approved_checksum" text;
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "scheduled_at" timestamp with time zone;
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "scheduled_by" text;
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "applying_started_at" timestamp with time zone;
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "failed_at" timestamp with time zone;
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "failure" jsonb;
+ALTER TABLE "releases" ADD COLUMN IF NOT EXISTS "attempts" integer DEFAULT 0 NOT NULL;
+UPDATE "releases" SET "status" = 'draft' WHERE "status" = 'pending';
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'releases_status_check') THEN
+    ALTER TABLE "releases" ADD CONSTRAINT "releases_status_check" CHECK ("status" IN ('draft', 'in_review', 'approved', 'applying', 'applied', 'failed'));
+  END IF;
+END $$;
+ALTER TABLE "release_items" ADD COLUMN IF NOT EXISTS "frozen_payload" jsonb;
+ALTER TABLE "release_items" ADD COLUMN IF NOT EXISTS "target_fingerprint" text;
+ALTER TABLE "release_items" ADD COLUMN IF NOT EXISTS "position" integer;
+ALTER TABLE "release_items" ADD COLUMN IF NOT EXISTS "apply_outcome" text;
+ALTER TABLE "release_items" ADD COLUMN IF NOT EXISTS "applied_at" timestamp with time zone;
+ALTER TABLE "release_items" ADD COLUMN IF NOT EXISTS "apply_error" text;
+DELETE FROM "release_items" a USING "release_items" b
+  WHERE a."release_id" = b."release_id" AND a."type_name" = b."type_name" AND a."object_id" = b."object_id" AND a."id" > b."id";
+CREATE UNIQUE INDEX IF NOT EXISTS "release_items_identity_unique" ON "release_items" ("release_id", "type_name", "object_id");
+CREATE TABLE IF NOT EXISTS "release_history" (
+	"id" text PRIMARY KEY NOT NULL,
+	"release_id" text NOT NULL,
+	"workspace_id" text NOT NULL,
+	"attempt" integer DEFAULT 0 NOT NULL,
+	"action" text NOT NULL,
+	"from_status" text,
+	"to_status" text NOT NULL,
+	"actor" text,
+	"source_env_id" text NOT NULL,
+	"target_env_id" text NOT NULL,
+	"source_role" text,
+	"target_role" text,
+	"checksum" text,
+	"counts" jsonb,
+	"error_id" text,
+	"error_summary" text,
+	"reason" text,
+	"started_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"finished_at" timestamp with time zone
+);
+CREATE INDEX IF NOT EXISTS "release_history_release_idx" ON "release_history" ("release_id", "started_at");

package/drizzle/0050_member_env_membership.sql

@@ -0,0 +1,21 @@
+-- Environment membership (tasks/plan-environment-architecture.md D3, Stage 1
+-- T1.9). A workspace member reaches an environment only through an ACTIVE row
+-- here; a member is no longer implied into every environment of its database.
+-- Backfilled with today's behaviour made explicit: every member active in
+-- every environment of its workspace. Member and environment creation write
+-- the rows from now on; the Stage 3 reconciler converges them to desired state.
+CREATE TABLE IF NOT EXISTS "member_env_membership" (
+  "member_id" text NOT NULL REFERENCES "members"("id") ON DELETE CASCADE,
+  "env_id" text NOT NULL REFERENCES "environments"("id") ON DELETE CASCADE,
+  "workspace_id" text NOT NULL,
+  "status" text NOT NULL DEFAULT 'active',
+  "created_at" timestamp with time zone NOT NULL DEFAULT now(),
+  "updated_at" timestamp with time zone NOT NULL DEFAULT now(),
+  PRIMARY KEY ("member_id", "env_id")
+);
+CREATE INDEX IF NOT EXISTS "member_env_membership_ws_env_idx" ON "member_env_membership" ("workspace_id", "env_id");
+INSERT INTO "member_env_membership" ("member_id", "env_id", "workspace_id", "status")
+SELECT m."id", e."id", m."workspace_id", 'active'
+FROM "members" m
+JOIN "environments" e ON e."workspace_id" = m."workspace_id"
+ON CONFLICT DO NOTHING;