@taodigital/database 0.0.0-stage → 1.2.0

package/prisma/migrations/0004_extended_models/migration.sql

@@ -0,0 +1,215 @@
+-- Migration: 0004_extended_models
+-- Creates all tables added to schema.prisma after the initial migration:
+-- CrawlJob, ElementFingerprint, UserSession, VisualBaseline, VisualDiff,
+-- HumanReviewItem, TestRun, TestResult
+-- Also adds the @@unique([testCaseId, language]) constraint on TestScript.
+
+-- CreateTable
+CREATE TABLE "CrawlJob" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'QUEUED',
+    "config" JSONB NOT NULL,
+    "result" JSONB,
+    "error" TEXT,
+    "progress" INTEGER NOT NULL DEFAULT 0,
+    "queuedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "startedAt" TIMESTAMP(3),
+    "finishedAt" TIMESTAMP(3),
+
+    CONSTRAINT "CrawlJob_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "ElementFingerprint" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "elementId" TEXT NOT NULL,
+    "selectors" JSONB NOT NULL,
+    "lastHealedAt" TIMESTAMP(3),
+    "healCount" INTEGER NOT NULL DEFAULT 0,
+
+    CONSTRAINT "ElementFingerprint_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "UserSession" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "source" TEXT NOT NULL,
+    "startUrl" TEXT NOT NULL,
+    "events" JSONB NOT NULL,
+    "duration" INTEGER,
+    "status" TEXT NOT NULL DEFAULT 'PENDING',
+    "convertedSuiteId" TEXT,
+    "recordedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "UserSession_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "VisualBaseline" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "screenId" TEXT NOT NULL,
+    "viewport" TEXT NOT NULL DEFAULT 'DESKTOP',
+    "storagePath" TEXT NOT NULL,
+    "approvedBy" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "VisualBaseline_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "VisualDiff" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "baselineId" TEXT NOT NULL,
+    "newScreenshotPath" TEXT NOT NULL,
+    "diffScore" DOUBLE PRECISION NOT NULL,
+    "changeType" TEXT NOT NULL,
+    "changes" JSONB,
+    "recommendation" TEXT,
+    "bugReportDraft" JSONB,
+    "status" TEXT NOT NULL DEFAULT 'PENDING',
+    "reviewedBy" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "VisualDiff_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "HumanReviewItem" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "testCaseId" TEXT NOT NULL,
+    "reason" TEXT NOT NULL,
+    "confidence" DOUBLE PRECISION NOT NULL,
+    "context" JSONB,
+    "status" TEXT NOT NULL DEFAULT 'PENDING',
+    "assignedTo" TEXT,
+    "resolution" TEXT,
+    "reviewedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "HumanReviewItem_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "TestRun" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "suiteId" TEXT,
+    "trigger" TEXT NOT NULL DEFAULT 'MANUAL',
+    "status" TEXT NOT NULL DEFAULT 'RUNNING',
+    "config" JSONB,
+    "summary" JSONB,
+    "startedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "finishedAt" TIMESTAMP(3),
+
+    CONSTRAINT "TestRun_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "TestResult" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "runId" TEXT NOT NULL,
+    "testCaseId" TEXT NOT NULL,
+    "status" TEXT NOT NULL,
+    "duration" INTEGER,
+    "error" TEXT,
+    "screenshotPath" TEXT,
+    "logs" JSONB,
+    "healedAt" TIMESTAMP(3),
+
+    CONSTRAINT "TestResult_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "CrawlJob_tenantId_projectId_idx" ON "CrawlJob"("tenantId", "projectId");
+
+-- CreateIndex
+CREATE INDEX "CrawlJob_status_idx" ON "CrawlJob"("status");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ElementFingerprint_elementId_key" ON "ElementFingerprint"("elementId");
+
+-- CreateIndex
+CREATE INDEX "ElementFingerprint_tenantId_projectId_idx" ON "ElementFingerprint"("tenantId", "projectId");
+
+-- CreateIndex
+CREATE INDEX "UserSession_tenantId_projectId_idx" ON "UserSession"("tenantId", "projectId");
+
+-- CreateIndex
+CREATE INDEX "UserSession_status_idx" ON "UserSession"("status");
+
+-- CreateIndex
+CREATE INDEX "VisualBaseline_tenantId_projectId_idx" ON "VisualBaseline"("tenantId", "projectId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "VisualBaseline_screenId_viewport_key" ON "VisualBaseline"("screenId", "viewport");
+
+-- CreateIndex
+CREATE INDEX "VisualDiff_tenantId_baselineId_idx" ON "VisualDiff"("tenantId", "baselineId");
+
+-- CreateIndex
+CREATE INDEX "VisualDiff_status_idx" ON "VisualDiff"("status");
+
+-- CreateIndex
+CREATE INDEX "HumanReviewItem_tenantId_projectId_idx" ON "HumanReviewItem"("tenantId", "projectId");
+
+-- CreateIndex
+CREATE INDEX "HumanReviewItem_status_idx" ON "HumanReviewItem"("status");
+
+-- CreateIndex
+CREATE INDEX "TestRun_tenantId_projectId_idx" ON "TestRun"("tenantId", "projectId");
+
+-- CreateIndex
+CREATE INDEX "TestRun_status_idx" ON "TestRun"("status");
+
+-- CreateIndex
+CREATE INDEX "TestResult_tenantId_runId_idx" ON "TestResult"("tenantId", "runId");
+
+-- CreateIndex
+CREATE INDEX "TestResult_testCaseId_idx" ON "TestResult"("testCaseId");
+
+-- CreateIndex (safe — no existing data to conflict)
+CREATE UNIQUE INDEX IF NOT EXISTS "TestScript_testCaseId_language_key" ON "TestScript"("testCaseId", "language");
+
+-- AddForeignKey
+ALTER TABLE "CrawlJob" ADD CONSTRAINT "CrawlJob_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ElementFingerprint" ADD CONSTRAINT "ElementFingerprint_elementId_fkey" FOREIGN KEY ("elementId") REFERENCES "Element"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "UserSession" ADD CONSTRAINT "UserSession_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "VisualBaseline" ADD CONSTRAINT "VisualBaseline_screenId_fkey" FOREIGN KEY ("screenId") REFERENCES "Screen"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "VisualDiff" ADD CONSTRAINT "VisualDiff_baselineId_fkey" FOREIGN KEY ("baselineId") REFERENCES "VisualBaseline"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "HumanReviewItem" ADD CONSTRAINT "HumanReviewItem_testCaseId_fkey" FOREIGN KEY ("testCaseId") REFERENCES "TestCase"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TestRun" ADD CONSTRAINT "TestRun_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TestResult" ADD CONSTRAINT "TestResult_runId_fkey" FOREIGN KEY ("runId") REFERENCES "TestRun"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TestResult" ADD CONSTRAINT "TestResult_testCaseId_fkey" FOREIGN KEY ("testCaseId") REFERENCES "TestCase"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- RLS: new tables inherit tenant isolation from the existing app role policies.
+-- Existing policy on all tables: SELECT/INSERT/UPDATE/DELETE WHERE tenantId = current_setting('app.current_tenant_id').
+-- No additional policy needed — the withTenant() wrapper in application code sets this.

package/prisma/migrations/0005_enhanced_test_artifacts/migration.sql

@@ -0,0 +1,24 @@
+-- Migration 0005: Enhanced test artifacts
+-- Adds market-standard fields to TestCase for Gherkin, priority, preconditions,
+-- expectedResult, source, screenId (grounded element link), ref (human ID), tags, references.
+
+ALTER TABLE "TestCase"
+  ADD COLUMN IF NOT EXISTS "priority"       TEXT NOT NULL DEFAULT 'HIGH',
+  ADD COLUMN IF NOT EXISTS "preconditions"  TEXT,
+  ADD COLUMN IF NOT EXISTS "expectedResult" TEXT,
+  ADD COLUMN IF NOT EXISTS "gherkin"        TEXT,
+  ADD COLUMN IF NOT EXISTS "source"         TEXT NOT NULL DEFAULT 'AI_GENERATED',
+  ADD COLUMN IF NOT EXISTS "screenId"       TEXT,
+  ADD COLUMN IF NOT EXISTS "ref"            TEXT,
+  ADD COLUMN IF NOT EXISTS "tags"           JSONB NOT NULL DEFAULT '[]',
+  ADD COLUMN IF NOT EXISTS "caseRefs"       JSONB NOT NULL DEFAULT '[]';
+
+-- Optional FK: screenId -> Screen (nullable — some cases span multiple screens)
+ALTER TABLE "TestCase"
+  ADD CONSTRAINT "TestCase_screenId_fkey"
+  FOREIGN KEY ("screenId") REFERENCES "Screen"("id")
+  ON DELETE SET NULL ON UPDATE CASCADE;
+
+CREATE INDEX IF NOT EXISTS "TestCase_screenId_idx" ON "TestCase"("screenId");
+CREATE INDEX IF NOT EXISTS "TestCase_priority_idx" ON "TestCase"("priority");
+CREATE INDEX IF NOT EXISTS "TestCase_source_idx" ON "TestCase"("source");

package/prisma/migrations/0006_tenant_settings/migration.sql

@@ -0,0 +1,28 @@
+-- 0006: workspace-level tenant settings (LLM provider, etc.)
+CREATE TABLE IF NOT EXISTS "TenantSetting" (
+  "id"        TEXT        NOT NULL,
+  "tenantId"  TEXT        NOT NULL,
+  -- "LLM" | "NOTIFICATIONS" | "BRANDING"
+  "category"  TEXT        NOT NULL,
+  -- Encrypted JSON blob (sensitive fields use _enc suffix, same as Connector)
+  "config"    JSONB       NOT NULL DEFAULT '{}',
+  "updatedAt" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  CONSTRAINT "TenantSetting_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "TenantSetting_tenantId_category_key"
+  ON "TenantSetting"("tenantId", "category");
+CREATE INDEX IF NOT EXISTS "TenantSetting_tenantId_idx"
+  ON "TenantSetting"("tenantId");
+
+-- RLS: same isolation pattern as all other tables
+ALTER TABLE "TenantSetting" ENABLE ROW LEVEL SECURITY;
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies WHERE tablename = 'TenantSetting' AND policyname = 'tenant_isolation'
+  ) THEN
+    EXECUTE format(
+      'CREATE POLICY tenant_isolation ON "TenantSetting" USING ("tenantId" = current_setting(''app.current_tenant'', true))'
+    );
+  END IF;
+END $$;

package/prisma/migrations/0007_project_slug/migration.sql

@@ -0,0 +1,11 @@
+-- Add slug to Project for human-readable URLs
+ALTER TABLE "Project"
+  ADD COLUMN IF NOT EXISTS "slug" TEXT NOT NULL DEFAULT '';
+
+-- Backfill: generate slug from existing name (lowercase, hyphens, strip special chars)
+UPDATE "Project"
+SET "slug" = LOWER(REGEXP_REPLACE(REGEXP_REPLACE(name, '[^a-zA-Z0-9\s-]', '', 'g'), '\s+', '-', 'g'))
+WHERE "slug" = '';
+
+-- Unique per tenant (duplicate names get suffix at the application layer)
+CREATE UNIQUE INDEX IF NOT EXISTS "Project_tenantId_slug_key" ON "Project"("tenantId", "slug");

package/prisma/migrations/0008_project_crawl_config/migration.sql

@@ -0,0 +1,3 @@
+-- Store encrypted crawl credentials per project
+ALTER TABLE "Project"
+  ADD COLUMN IF NOT EXISTS "crawlConfig" JSONB;

package/prisma/migrations/0009_tenant_slug/migration.sql

@@ -0,0 +1,11 @@
+-- Add slug to Tenant for workspace URL identity
+ALTER TABLE "Tenant"
+  ADD COLUMN IF NOT EXISTS "slug" TEXT NOT NULL DEFAULT '';
+
+-- Backfill from name
+UPDATE "Tenant"
+SET "slug" = LOWER(REGEXP_REPLACE(REGEXP_REPLACE(name, '[^a-zA-Z0-9\s-]', '', 'g'), '\s+', '-', 'g'))
+WHERE "slug" = '';
+
+-- Make slugs unique (add suffix if needed via application layer)
+CREATE UNIQUE INDEX IF NOT EXISTS "Tenant_slug_key" ON "Tenant"("slug");

package/prisma/migrations/0010_user_password/migration.sql

@@ -0,0 +1,3 @@
+-- Add password hash to User for email+password authentication
+ALTER TABLE "User"
+  ADD COLUMN IF NOT EXISTS "passwordHash" TEXT;

package/prisma/migrations/0011_oauth_connections/migration.sql

@@ -0,0 +1,78 @@
+-- Migration: 0011_oauth_connections
+-- Add OAuthConnection model for GitHub App, Jira 3LO, Figma OAuth.
+-- Replaces manual token entry (secretRef pattern in Connector).
+-- All token fields are AES-256-GCM encrypted at application layer (_enc suffix).
+
+CREATE TABLE "OAuthConnection" (
+  "id"                    TEXT NOT NULL,
+  "tenantId"              TEXT NOT NULL,
+  "projectId"             TEXT NOT NULL,
+  "provider"              TEXT NOT NULL,
+
+  -- Encrypted token fields (AES-256-GCM, base64-encoded ciphertext)
+  "accessToken_enc"       TEXT,
+  "refreshToken_enc"      TEXT,
+  "tokenExpiresAt"        TIMESTAMP(3),
+  "refreshTokenExpiresAt" TIMESTAMP(3),
+
+  -- Connection lifecycle
+  "status"                TEXT NOT NULL DEFAULT 'CONNECTED',
+  "connectedAs"           TEXT,
+
+  -- Provider-specific identifiers
+  "installationId"        TEXT,
+  "cloudId"               TEXT,
+  "scopes"                TEXT,
+
+  -- Jira Data Center fallback (PAT + base URL)
+  "pat_enc"               TEXT,
+  "dcBaseUrl"             TEXT,
+
+  "createdAt"             TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updatedAt"             TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  CONSTRAINT "OAuthConnection_pkey" PRIMARY KEY ("id")
+);
+
+-- Enforce one active connection per provider per project
+ALTER TABLE "OAuthConnection"
+  ADD CONSTRAINT "OAuthConnection_projectId_provider_key"
+  UNIQUE ("projectId", "provider");
+
+-- Foreign key: project must exist
+ALTER TABLE "OAuthConnection"
+  ADD CONSTRAINT "OAuthConnection_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id")
+  ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- Indexes for common query patterns
+CREATE INDEX "OAuthConnection_tenantId_projectId_idx"
+  ON "OAuthConnection"("tenantId", "projectId");
+
+CREATE INDEX "OAuthConnection_tenantId_provider_idx"
+  ON "OAuthConnection"("tenantId", "provider");
+
+CREATE INDEX "OAuthConnection_status_idx"
+  ON "OAuthConnection"("status");
+
+-- Row-Level Security: tenants may only see their own OAuth connections.
+-- Mirrors the RLS policies applied to all other tenant-scoped tables.
+ALTER TABLE "OAuthConnection" ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "tenant_isolation_oauth_connections"
+  ON "OAuthConnection"
+  USING ("tenantId" = current_setting('app.tenant_id', true));
+
+-- Auto-update updatedAt on every row change
+CREATE OR REPLACE FUNCTION update_oauth_connection_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW."updatedAt" = CURRENT_TIMESTAMP;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER "OAuthConnection_updatedAt"
+  BEFORE UPDATE ON "OAuthConnection"
+  FOR EACH ROW
+  EXECUTE FUNCTION update_oauth_connection_updated_at();

package/prisma/migrations/0012_agent_webhooks/migration.sql

@@ -0,0 +1,46 @@
+-- Migration: 0012_agent_webhooks
+-- Local agent pairing tokens (hashed) and outbound webhooks.
+-- Token plain-text is only ever shown once on creation; we store SHA-256 hash.
+-- Webhook HMAC secret is AES-256-GCM encrypted at application layer (_enc suffix).
+
+CREATE TABLE "AgentToken" (
+  "id"          TEXT NOT NULL,
+  "tenantId"    TEXT NOT NULL,
+  "projectId"   TEXT NOT NULL,
+  "name"        TEXT NOT NULL,
+  "tokenHash"   TEXT NOT NULL,
+  "lastSeenAt"  TIMESTAMP(3),
+  "revokedAt"   TIMESTAMP(3),
+  "createdAt"   TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  CONSTRAINT "AgentToken_pkey" PRIMARY KEY ("id"),
+  CONSTRAINT "AgentToken_tokenHash_key" UNIQUE ("tokenHash"),
+  CONSTRAINT "AgentToken_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+
+CREATE TABLE "Webhook" (
+  "id"         TEXT NOT NULL,
+  "tenantId"   TEXT NOT NULL,
+  "projectId"  TEXT NOT NULL,
+  "url"        TEXT NOT NULL,
+  "secret_enc" TEXT NOT NULL,
+  "events"     JSONB NOT NULL DEFAULT '[]',
+  "active"     BOOLEAN NOT NULL DEFAULT true,
+  "createdAt"  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updatedAt"  TIMESTAMP(3) NOT NULL,
+
+  CONSTRAINT "Webhook_pkey" PRIMARY KEY ("id"),
+  CONSTRAINT "Webhook_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+
+CREATE INDEX "AgentToken_tenantId_projectId_idx" ON "AgentToken"("tenantId", "projectId");
+CREATE INDEX "Webhook_tenantId_projectId_idx" ON "Webhook"("tenantId", "projectId");
+
+-- RLS: extend tenant isolation to new tables
+ALTER TABLE "AgentToken" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "Webhook"    ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "tenant_isolation" ON "AgentToken"
+  USING ("tenantId" = current_setting('app.current_tenant', true));
+CREATE POLICY "tenant_isolation" ON "Webhook"
+  USING ("tenantId" = current_setting('app.current_tenant', true));

package/prisma/migrations/0013_project_artifacts/migration.sql

@@ -0,0 +1,27 @@
+-- Migration: 0013_project_artifacts
+-- User-uploaded knowledge artifacts (docs, spreadsheets, old test cases).
+-- Files are converted to markdown at upload time and stored as content.
+-- Used by searchKnowledge() for keyword-scored RAG context assembly.
+
+CREATE TABLE "ProjectArtifact" (
+  "id"           TEXT NOT NULL,
+  "tenantId"     TEXT NOT NULL,
+  "projectId"    TEXT NOT NULL,
+  "name"         TEXT NOT NULL,
+  "originalName" TEXT NOT NULL,
+  "mimeType"     TEXT NOT NULL,
+  "size"         INTEGER NOT NULL,
+  "content"      TEXT NOT NULL,
+  "kind"         TEXT NOT NULL DEFAULT 'DOCUMENT',
+  "uploadedBy"   TEXT NOT NULL,
+  "uploadedAt"   TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  CONSTRAINT "ProjectArtifact_pkey" PRIMARY KEY ("id"),
+  CONSTRAINT "ProjectArtifact_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+
+CREATE INDEX "ProjectArtifact_tenantId_projectId_idx" ON "ProjectArtifact"("tenantId", "projectId");
+
+ALTER TABLE "ProjectArtifact" ENABLE ROW LEVEL SECURITY;
+CREATE POLICY "tenant_isolation" ON "ProjectArtifact"
+  USING ("tenantId" = current_setting('app.current_tenant', true));

package/prisma/migrations/0014_knowledge_chunks/migration.sql

@@ -0,0 +1,37 @@
+-- KnowledgeChunk: Postgres full-text search index for skill files and artifacts.
+-- One row per heading-delimited section. The tsv column is maintained automatically
+-- by Postgres via GENERATED ALWAYS AS; Prisma does not touch it.
+
+CREATE TABLE "KnowledgeChunk" (
+  "id"         TEXT NOT NULL DEFAULT gen_random_uuid()::TEXT,
+  "tenantId"   TEXT NOT NULL,
+  "projectId"  TEXT,
+  "sourceType" TEXT NOT NULL,
+  "sourceId"   TEXT NOT NULL,
+  "heading"    TEXT NOT NULL,
+  "content"    TEXT NOT NULL,
+  "tsv"        TSVECTOR GENERATED ALWAYS AS (
+                 to_tsvector('english', "heading" || ' ' || "content")
+               ) STORED,
+  "updatedAt"  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  CONSTRAINT "KnowledgeChunk_pkey" PRIMARY KEY ("id")
+);
+
+-- Composite index for tenant-scoped queries
+CREATE INDEX "KnowledgeChunk_tenantId_projectId_idx" ON "KnowledgeChunk"("tenantId", "projectId");
+
+-- Index for fast delete-by-source when re-indexing after skill file update
+CREATE INDEX "KnowledgeChunk_sourceId_idx" ON "KnowledgeChunk"("sourceId");
+
+-- GIN index on tsvector — the key index that makes ts_rank fast
+CREATE INDEX "KnowledgeChunk_tsv_idx" ON "KnowledgeChunk" USING GIN("tsv");
+
+-- Row-Level Security (same pattern as all other tables)
+ALTER TABLE "KnowledgeChunk" ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "tenant_isolation" ON "KnowledgeChunk"
+  USING (
+    "tenantId" = current_setting('app.current_tenant', true)
+    OR "tenantId" = 'GLOBAL'
+  );

package/prisma/migrations/20260626022056_platform_job_migration/migration.sql

@@ -0,0 +1,44 @@
+/*
+  Warnings:
+
+  - You are about to drop the `CrawlJob` table. If the table is not empty, all the data it contains will be lost.
+
+*/
+-- DropForeignKey
+ALTER TABLE "CrawlJob" DROP CONSTRAINT "CrawlJob_projectId_fkey";
+
+-- AlterTable
+ALTER TABLE "OAuthConnection" ALTER COLUMN "updatedAt" DROP DEFAULT;
+
+-- AlterTable
+ALTER TABLE "TenantSetting" ALTER COLUMN "updatedAt" SET DATA TYPE TIMESTAMP(3);
+
+-- DropTable
+DROP TABLE "CrawlJob";
+
+-- CreateTable
+CREATE TABLE "PlatformJob" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "type" TEXT NOT NULL DEFAULT 'CRAWL',
+    "status" TEXT NOT NULL DEFAULT 'QUEUED',
+    "config" JSONB NOT NULL,
+    "result" JSONB,
+    "error" TEXT,
+    "progress" INTEGER NOT NULL DEFAULT 0,
+    "queuedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "startedAt" TIMESTAMP(3),
+    "finishedAt" TIMESTAMP(3),
+
+    CONSTRAINT "PlatformJob_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "PlatformJob_tenantId_projectId_idx" ON "PlatformJob"("tenantId", "projectId");
+
+-- CreateIndex
+CREATE INDEX "PlatformJob_status_idx" ON "PlatformJob"("status");
+
+-- AddForeignKey
+ALTER TABLE "PlatformJob" ADD CONSTRAINT "PlatformJob_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/prisma/migrations/20260626053339_kag_schema_update/migration.sql

@@ -0,0 +1,27 @@
+/*
+  Warnings:
+
+  - You are about to drop the column `tsv` on the `KnowledgeChunk` table. All the data in the column will be lost.
+  - Added the required column `isInteractive` to the `Element` table without a default value. This is not possible if the table is not empty.
+
+*/
+-- DropIndex
+DROP INDEX "KnowledgeChunk_tsv_idx";
+
+-- AlterTable (add nullable first so existing rows with nulls from failed prior attempt are handled)
+ALTER TABLE "Element"
+  ADD COLUMN IF NOT EXISTS "isInteractive" BOOLEAN,
+  ADD COLUMN IF NOT EXISTS "text" TEXT,
+  ADD COLUMN IF NOT EXISTS "transitionsToScreenId" TEXT;
+-- Backfill nulls before setting NOT NULL constraint
+UPDATE "Element" SET "isInteractive" = false WHERE "isInteractive" IS NULL;
+ALTER TABLE "Element" ALTER COLUMN "isInteractive" SET NOT NULL;
+
+-- AlterTable
+ALTER TABLE "KnowledgeChunk" DROP COLUMN "tsv",
+ADD COLUMN     "imagePath" TEXT,
+ALTER COLUMN "id" DROP DEFAULT,
+ALTER COLUMN "updatedAt" DROP DEFAULT;
+
+-- AddForeignKey
+ALTER TABLE "Element" ADD CONSTRAINT "Element_transitionsToScreenId_fkey" FOREIGN KEY ("transitionsToScreenId") REFERENCES "Screen"("id") ON DELETE SET NULL ON UPDATE CASCADE;

package/prisma/migrations/20260626053340_restore_bm25_index/migration.sql

@@ -0,0 +1,13 @@
+-- Restore the tsvector column + GIN index that was accidentally dropped by the
+-- KAG schema migration (20260626053339). The tsv column is a GENERATED ALWAYS AS
+-- STORED column managed by Postgres; Prisma declared it Unsupported so it will
+-- never try to drop it again.
+
+-- Restore GENERATED tsvector column
+ALTER TABLE "KnowledgeChunk"
+  ADD COLUMN "tsv" TSVECTOR GENERATED ALWAYS AS (
+    to_tsvector('english', "heading" || ' ' || "content")
+  ) STORED;
+
+-- Restore GIN index for fast ts_rank scoring
+CREATE INDEX "KnowledgeChunk_tsv_idx" ON "KnowledgeChunk" USING GIN("tsv");

package/prisma/migrations/20260626063704_token_optimisation/migration.sql

@@ -0,0 +1,86 @@
+
+
+-- AlterTable
+ALTER TABLE "PlatformJob" ADD COLUMN     "llmCallCount" INTEGER NOT NULL DEFAULT 0,
+ADD COLUMN     "totalCacheReadTokens" INTEGER,
+ADD COLUMN     "totalCompletionTokens" INTEGER,
+ADD COLUMN     "totalEstimatedCostUsd" DOUBLE PRECISION,
+ADD COLUMN     "totalPromptTokens" INTEGER;
+
+-- AlterTable
+ALTER TABLE "SkillFile" ADD COLUMN     "lastGenAt" TIMESTAMP(3),
+ADD COLUMN     "lastGenCompletionTokens" INTEGER,
+ADD COLUMN     "lastGenCostUsd" DOUBLE PRECISION,
+ADD COLUMN     "lastGenModel" TEXT,
+ADD COLUMN     "lastGenPromptTokens" INTEGER;
+
+-- AlterTable
+ALTER TABLE "TestCase" ADD COLUMN     "genCompletionTokens" INTEGER,
+ADD COLUMN     "genCostUsd" DOUBLE PRECISION,
+ADD COLUMN     "genModel" TEXT,
+ADD COLUMN     "genPromptTokens" INTEGER;
+
+-- AlterTable
+ALTER TABLE "TestSuite" ADD COLUMN     "genAt" TIMESTAMP(3),
+ADD COLUMN     "genModel" TEXT,
+ADD COLUMN     "genScreenCount" INTEGER,
+ADD COLUMN     "genTotalCostUsd" DOUBLE PRECISION,
+ADD COLUMN     "genTotalTokens" INTEGER;
+
+-- CreateTable
+CREATE TABLE "LLMCallLog" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "projectId" TEXT,
+    "jobId" TEXT,
+    "agentType" TEXT NOT NULL,
+    "label" TEXT NOT NULL,
+    "entityId" TEXT,
+    "entityType" TEXT,
+    "provider" TEXT NOT NULL,
+    "model" TEXT NOT NULL,
+    "promptTokens" INTEGER NOT NULL,
+    "completionTokens" INTEGER NOT NULL,
+    "cacheReadTokens" INTEGER NOT NULL DEFAULT 0,
+    "cacheWriteTokens" INTEGER NOT NULL DEFAULT 0,
+    "totalTokens" INTEGER NOT NULL,
+    "estimatedCostUsd" DOUBLE PRECISION NOT NULL DEFAULT 0,
+    "outputTokens" INTEGER,
+    "latencyMs" INTEGER,
+    "calledAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "LLMCallLog_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "TokenBudget" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "monthlyTokenCap" INTEGER,
+    "monthlyUsdCap" DOUBLE PRECISION,
+    "alertAtPercent" INTEGER NOT NULL DEFAULT 80,
+    "currentMonthTokens" INTEGER NOT NULL DEFAULT 0,
+    "currentMonthUsd" DOUBLE PRECISION NOT NULL DEFAULT 0,
+    "lastResetAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "TokenBudget_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "LLMCallLog_tenantId_projectId_idx" ON "LLMCallLog"("tenantId", "projectId");
+
+-- CreateIndex
+CREATE INDEX "LLMCallLog_tenantId_jobId_idx" ON "LLMCallLog"("tenantId", "jobId");
+
+-- CreateIndex
+CREATE INDEX "LLMCallLog_tenantId_agentType_idx" ON "LLMCallLog"("tenantId", "agentType");
+
+-- CreateIndex
+CREATE INDEX "LLMCallLog_entityId_idx" ON "LLMCallLog"("entityId");
+
+-- CreateIndex
+CREATE INDEX "LLMCallLog_calledAt_idx" ON "LLMCallLog"("calledAt");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "TokenBudget_tenantId_key" ON "TokenBudget"("tenantId");