@taodigital/database 0.0.0-stage → 1.2.1

package/prisma/migrations/20260702160000_add_requirement_model/migration.sql

@@ -0,0 +1,62 @@
+-- Migration: add_requirement_model
+-- Additive only — no existing tables modified.
+-- Every TestCase.traceTo references a reqId from this table.
+
+CREATE TABLE IF NOT EXISTS "Requirement" (
+    "id"                 TEXT NOT NULL,
+    "tenantId"           TEXT NOT NULL,
+    "projectId"          TEXT NOT NULL,
+    "reqId"              TEXT NOT NULL,
+    "title"              TEXT NOT NULL,
+    "actor"              TEXT,
+    "type"               TEXT NOT NULL DEFAULT 'functional',
+    "priority"           TEXT NOT NULL DEFAULT 'HIGH',
+    "acceptanceCriteria" JSONB NOT NULL DEFAULT '[]',
+    "businessRules"      JSONB NOT NULL DEFAULT '[]',
+    "relatedScreenHints" JSONB NOT NULL DEFAULT '[]',
+    "derived"            BOOLEAN NOT NULL DEFAULT false,
+    "status"             TEXT NOT NULL DEFAULT 'pending',
+    "source"             TEXT NOT NULL DEFAULT 'AI_GENERATED',
+    "createdAt"          TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt"          TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "Requirement_pkey" PRIMARY KEY ("id")
+);
+
+-- Unique constraint: one reqId per project per tenant
+CREATE UNIQUE INDEX IF NOT EXISTS "Requirement_tenantId_projectId_reqId_key"
+    ON "Requirement"("tenantId", "projectId", "reqId");
+
+-- General project lookup
+CREATE INDEX IF NOT EXISTS "Requirement_tenantId_projectId_idx"
+    ON "Requirement"("tenantId", "projectId");
+
+-- Priority-based filtering
+CREATE INDEX IF NOT EXISTS "Requirement_tenantId_projectId_priority_idx"
+    ON "Requirement"("tenantId", "projectId", "priority");
+
+-- Status-based filtering (covered/untested/unbuilt)
+CREATE INDEX IF NOT EXISTS "Requirement_tenantId_projectId_status_idx"
+    ON "Requirement"("tenantId", "projectId", "status");
+
+-- FK to Project with cascade delete
+ALTER TABLE "Requirement"
+    ADD CONSTRAINT "Requirement_projectId_fkey"
+    FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Enable RLS (consistent with all other tenant tables)
+ALTER TABLE "Requirement" ENABLE ROW LEVEL SECURITY;
+
+-- Updated-at trigger (reuse existing function if present)
+CREATE OR REPLACE FUNCTION update_updated_at_column()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW."updatedAt" = CURRENT_TIMESTAMP;
+    RETURN NEW;
+END;
+$$ language 'plpgsql';
+
+DROP TRIGGER IF EXISTS "Requirement_updatedAt" ON "Requirement";
+CREATE TRIGGER "Requirement_updatedAt"
+    BEFORE UPDATE ON "Requirement"
+    FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();

package/prisma/migrations/20260702180000_add_invitation_model/migration.sql

@@ -0,0 +1,53 @@
+-- Migration: add_invitation_model
+-- Pending workspace invitations for users who have not registered yet.
+-- Additive only — no existing tables modified except a NOT VALID role check on Membership.
+
+CREATE TABLE IF NOT EXISTS "Invitation" (
+    "id"         TEXT NOT NULL,
+    "tenantId"   TEXT NOT NULL,
+    "email"      TEXT NOT NULL,
+    "role"       TEXT NOT NULL,
+    "tokenHash"  TEXT NOT NULL,
+    "invitedBy"  TEXT,
+    "status"     TEXT NOT NULL DEFAULT 'PENDING',
+    "expiresAt"  TIMESTAMP(3) NOT NULL,
+    "createdAt"  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "acceptedAt" TIMESTAMP(3),
+
+    CONSTRAINT "Invitation_pkey" PRIMARY KEY ("id"),
+    CONSTRAINT "Invitation_role_check" CHECK ("role" IN ('OWNER','ADMIN','QA_LEAD','TESTER','DEVELOPER','VIEWER')),
+    CONSTRAINT "Invitation_status_check" CHECK ("status" IN ('PENDING','ACCEPTED','REVOKED','EXPIRED'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "Invitation_tokenHash_key" ON "Invitation"("tokenHash");
+CREATE UNIQUE INDEX IF NOT EXISTS "Invitation_tenantId_email_key" ON "Invitation"("tenantId", "email");
+CREATE INDEX IF NOT EXISTS "Invitation_tenantId_status_idx" ON "Invitation"("tenantId", "status");
+
+ALTER TABLE "Invitation"
+    ADD CONSTRAINT "Invitation_tenantId_fkey"
+    FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- RLS (consistent with all other tenant tables)
+ALTER TABLE "Invitation" ENABLE ROW LEVEL SECURITY;
+
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies WHERE tablename = 'Invitation' AND policyname = 'tenant_isolation'
+  ) THEN
+    EXECUTE format(
+      'CREATE POLICY tenant_isolation ON "Invitation" USING ("tenantId" = current_setting(''app.current_tenant'', true))'
+    );
+  END IF;
+END $$;
+
+-- Role integrity on Membership — NOT VALID so legacy rows are untouched,
+-- but every new write must use a known role.
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'Membership_role_check'
+  ) THEN
+    ALTER TABLE "Membership"
+      ADD CONSTRAINT "Membership_role_check"
+      CHECK ("role" IN ('OWNER','ADMIN','QA_LEAD','TESTER','DEVELOPER','VIEWER')) NOT VALID;
+  END IF;
+END $$;

package/prisma/migrations/20260702190000_suite_hierarchy_artifact_trace/migration.sql

@@ -0,0 +1,28 @@
+-- Migration: suite_hierarchy_artifact_trace
+-- Additive only.
+-- 1. TestSuite.parentId — child suites created per Section column on import.
+-- 2. TestCase.artifactId — traceability from imported test cases back to the source artifact.
+
+ALTER TABLE "TestSuite" ADD COLUMN IF NOT EXISTS "parentId" TEXT;
+
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'TestSuite_parentId_fkey') THEN
+    ALTER TABLE "TestSuite"
+      ADD CONSTRAINT "TestSuite_parentId_fkey"
+      FOREIGN KEY ("parentId") REFERENCES "TestSuite"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS "TestSuite_parentId_idx" ON "TestSuite"("parentId");
+
+ALTER TABLE "TestCase" ADD COLUMN IF NOT EXISTS "artifactId" TEXT;
+
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'TestCase_artifactId_fkey') THEN
+    ALTER TABLE "TestCase"
+      ADD CONSTRAINT "TestCase_artifactId_fkey"
+      FOREIGN KEY ("artifactId") REFERENCES "ProjectArtifact"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS "TestCase_artifactId_idx" ON "TestCase"("artifactId");

package/prisma/migrations/20260702200000_project_member_access/migration.sql

@@ -0,0 +1,31 @@
+-- Migration: project_member_access
+-- Optional per-project access list. No rows = project open to all tenant members.
+
+CREATE TABLE IF NOT EXISTS "ProjectMember" (
+    "id"        TEXT NOT NULL,
+    "tenantId"  TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "userId"    TEXT NOT NULL,
+
+    CONSTRAINT "ProjectMember_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "ProjectMember_projectId_userId_key" ON "ProjectMember"("projectId", "userId");
+CREATE INDEX IF NOT EXISTS "ProjectMember_tenantId_userId_idx" ON "ProjectMember"("tenantId", "userId");
+
+ALTER TABLE "ProjectMember"
+    ADD CONSTRAINT "ProjectMember_projectId_fkey"
+    FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- RLS (consistent with all other tenant tables)
+ALTER TABLE "ProjectMember" ENABLE ROW LEVEL SECURITY;
+
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies WHERE tablename = 'ProjectMember' AND policyname = 'tenant_isolation'
+  ) THEN
+    EXECUTE format(
+      'CREATE POLICY tenant_isolation ON "ProjectMember" USING ("tenantId" = current_setting(''app.current_tenant'', true))'
+    );
+  END IF;
+END $$;

package/prisma/migrations/20260703000000_add_system_config/migration.sql

@@ -0,0 +1,11 @@
+-- CreateTable
+CREATE TABLE "SystemConfig" (
+    "key" TEXT NOT NULL,
+    "value" TEXT NOT NULL,
+    "category" TEXT NOT NULL,
+    "sensitive" BOOLEAN NOT NULL DEFAULT false,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "updatedByAdminId" TEXT,
+
+    CONSTRAINT "SystemConfig_pkey" PRIMARY KEY ("key")
+);

package/prisma/migrations/20260703000000_custom_roles/migration.sql

@@ -0,0 +1,29 @@
+-- CreateTable: CustomRole — per-tenant custom roles with explicit permission arrays
+CREATE TABLE "CustomRole" (
+    "id"          TEXT NOT NULL,
+    "tenantId"    TEXT NOT NULL,
+    "name"        TEXT NOT NULL,
+    "description" TEXT,
+    "permissions" JSONB NOT NULL DEFAULT '[]',
+    "createdAt"   TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt"   TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "CustomRole_pkey" PRIMARY KEY ("id")
+);
+
+-- UniqueIndex: one name per tenant
+CREATE UNIQUE INDEX "CustomRole_tenantId_name_key" ON "CustomRole"("tenantId", "name");
+
+-- FK to Tenant
+ALTER TABLE "CustomRole"
+    ADD CONSTRAINT "CustomRole_tenantId_fkey"
+    FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id")
+    ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- RLS: users only see their own tenant's custom roles
+ALTER TABLE "CustomRole" ENABLE ROW LEVEL SECURITY;
+CREATE POLICY tenant_isolation ON "CustomRole"
+    USING (
+        "tenantId" = current_setting('app.current_tenant', true)
+        OR current_setting('app.current_tenant', true) = ''
+    );

package/prisma/migrations/20260703100000_platform_admin/migration.sql

@@ -0,0 +1,11 @@
+-- Platform Admin: separate from tenant users, no RLS, cross-tenant authority
+CREATE TABLE "AdminUser" (
+    "id"           TEXT NOT NULL,
+    "email"        TEXT NOT NULL,
+    "passwordHash" TEXT NOT NULL,
+    "name"         TEXT,
+    "createdAt"    TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt"    TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "AdminUser_pkey" PRIMARY KEY ("id")
+);
+CREATE UNIQUE INDEX "AdminUser_email_key" ON "AdminUser"("email");

package/prisma/migrations/20260703110000_add_extension_models/migration.sql

@@ -0,0 +1,106 @@
+-- Migration: add_extension_models
+-- Adds ExtensionCapture, ExtensionInteraction, and ExtensionError models.
+-- Also updates the Element model to support extension-captured elements.
+
+-- ── Element model updates ───────────────────────────────────────────────────
+-- Make previously required fields nullable (to support extension captures
+-- which don't have a crawled Screen, meaning, role, or isInteractive value).
+ALTER TABLE "Element"
+  ALTER COLUMN "screenId"      DROP NOT NULL,
+  ALTER COLUMN "meaning"       DROP NOT NULL,
+  ALTER COLUMN "role"          DROP NOT NULL,
+  ALTER COLUMN "isInteractive" DROP NOT NULL;
+
+-- Add extension-specific fields
+ALTER TABLE "Element"
+  ADD COLUMN IF NOT EXISTS "selector"      TEXT,
+  ADD COLUMN IF NOT EXISTS "pageUrl"       TEXT,
+  ADD COLUMN IF NOT EXISTS "screenshotUrl" TEXT,
+  ADD COLUMN IF NOT EXISTS "source"        TEXT NOT NULL DEFAULT 'crawl',
+  ADD COLUMN IF NOT EXISTS "metadata"      JSONB;
+
+-- Unique index for upsert from the extension
+CREATE UNIQUE INDEX IF NOT EXISTS "Element_ext_upsert_key"
+  ON "Element" ("tenantId", "projectId", "selector", "pageUrl");
+
+-- ── ExtensionCapture ────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "ExtensionCapture" (
+  "id"         TEXT NOT NULL PRIMARY KEY,
+  "tenantId"   TEXT NOT NULL,
+  "projectId"  TEXT NOT NULL,
+  "kind"       TEXT NOT NULL,
+  "s3Url"      TEXT,
+  "entryCount" INTEGER NOT NULL DEFAULT 0,
+  "capturedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "createdAt"  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "metadata"   JSONB,
+  CONSTRAINT "ExtensionCapture_projectId_fkey"
+    FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS "ExtensionCapture_tenantId_projectId_idx"
+  ON "ExtensionCapture" ("tenantId", "projectId");
+
+CREATE INDEX IF NOT EXISTS "ExtensionCapture_tenantId_projectId_kind_idx"
+  ON "ExtensionCapture" ("tenantId", "projectId", "kind");
+
+CREATE INDEX IF NOT EXISTS "ExtensionCapture_tenantId_projectId_capturedAt_idx"
+  ON "ExtensionCapture" ("tenantId", "projectId", "capturedAt");
+
+-- ── ExtensionInteraction ────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "ExtensionInteraction" (
+  "id"        TEXT NOT NULL PRIMARY KEY,
+  "tenantId"  TEXT NOT NULL,
+  "captureId" TEXT NOT NULL,
+  "type"      TEXT NOT NULL,
+  "selector"  TEXT,
+  "xpath"     TEXT,
+  "tagName"   TEXT,
+  "value"     TEXT,
+  "url"       TEXT,
+  "timestamp" BIGINT,
+  "metadata"  JSONB,
+  CONSTRAINT "ExtensionInteraction_captureId_fkey"
+    FOREIGN KEY ("captureId") REFERENCES "ExtensionCapture"("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS "ExtensionInteraction_tenantId_captureId_idx"
+  ON "ExtensionInteraction" ("tenantId", "captureId");
+
+CREATE INDEX IF NOT EXISTS "ExtensionInteraction_captureId_idx"
+  ON "ExtensionInteraction" ("captureId");
+
+-- ── ExtensionError ──────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "ExtensionError" (
+  "id"           TEXT NOT NULL PRIMARY KEY,
+  "tenantId"     TEXT NOT NULL,
+  "projectId"    TEXT NOT NULL,
+  "pageUrl"      TEXT,
+  "kind"         TEXT NOT NULL,
+  "level"        TEXT NOT NULL DEFAULT 'error',
+  "text"         TEXT NOT NULL,
+  "url"          TEXT,
+  "lineNumber"   INTEGER,
+  "columnNumber" INTEGER,
+  "stackTrace"   JSONB,
+  "source"       TEXT,
+  "capturedAt"   TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "createdAt"    TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "ExtensionError_projectId_fkey"
+    FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS "ExtensionError_tenantId_projectId_idx"
+  ON "ExtensionError" ("tenantId", "projectId");
+
+CREATE INDEX IF NOT EXISTS "ExtensionError_tenantId_projectId_pageUrl_idx"
+  ON "ExtensionError" ("tenantId", "projectId", "pageUrl");
+
+CREATE INDEX IF NOT EXISTS "ExtensionError_tenantId_projectId_kind_idx"
+  ON "ExtensionError" ("tenantId", "projectId", "kind");
+
+CREATE INDEX IF NOT EXISTS "ExtensionError_tenantId_projectId_level_idx"
+  ON "ExtensionError" ("tenantId", "projectId", "level");
+
+CREATE INDEX IF NOT EXISTS "ExtensionError_tenantId_projectId_capturedAt_idx"
+  ON "ExtensionError" ("tenantId", "projectId", "capturedAt");

package/prisma/migrations/20260703120000_project_restricted_column/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE "Project" ADD COLUMN IF NOT EXISTS "restricted" BOOLEAN NOT NULL DEFAULT false;

package/prisma/migrations/20260703200000_system_config_category_index/migration.sql

@@ -0,0 +1 @@
+CREATE INDEX "SystemConfig_category_idx" ON "SystemConfig"("category");

package/prisma/migrations/20260703210000_workspace_layer/migration.sql

@@ -0,0 +1,24 @@
+-- Drop old workspace foreign keys and columns
+ALTER TABLE "Tenant" DROP COLUMN IF EXISTS "workspaceId";
+ALTER TABLE "User" DROP COLUMN IF EXISTS "workspaceId";
+DROP TABLE IF EXISTS "Workspace" CASCADE;
+
+-- Create new Workspace table (team/group within a Tenant)
+CREATE TABLE "Workspace" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "Workspace_pkey" PRIMARY KEY ("id")
+);
+CREATE UNIQUE INDEX "Workspace_tenantId_slug_key" ON "Workspace"("tenantId", "slug");
+CREATE INDEX "Workspace_tenantId_idx" ON "Workspace"("tenantId");
+ALTER TABLE "Workspace" ADD CONSTRAINT "Workspace_tenantId_fkey"
+    FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Add workspaceId to Project (nullable — projects may not be in a workspace yet)
+ALTER TABLE "Project" ADD COLUMN "workspaceId" TEXT;
+ALTER TABLE "Project" ADD CONSTRAINT "Project_workspaceId_fkey"
+    FOREIGN KEY ("workspaceId") REFERENCES "Workspace"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+CREATE INDEX "Project_workspaceId_idx" ON "Project"("workspaceId");

package/prisma/migrations/20260703230000_workspace_agent_tokens/migration.sql

@@ -0,0 +1,2 @@
+-- Make AgentToken.projectId optional so workspace-scoped tokens (not tied to a project) can exist.
+ALTER TABLE "AgentToken" ALTER COLUMN "projectId" DROP NOT NULL;

package/prisma/migrations/20260704000000_requirement_rls_policy/migration.sql

@@ -0,0 +1,35 @@
+-- ============================================================================
+--  Add RLS policies to Requirement and AppField tables
+--
+--  Both tables were created with ENABLE ROW LEVEL SECURITY but without any
+--  policy. PostgreSQL defaults to deny-all when RLS is enabled with no
+--  policies, causing error 42501 on any write from qip_app.
+--
+--  This migration adds the standard tenant_isolation policy consistent with
+--  all other tenant-scoped tables in this project.
+-- ============================================================================
+
+DO $$
+DECLARE
+  t text;
+  tables text[] := ARRAY['Requirement', 'AppField'];
+BEGIN
+  FOREACH t IN ARRAY tables LOOP
+    -- Force RLS even for table owner (consistent with other tables)
+    EXECUTE format('ALTER TABLE "%s" FORCE ROW LEVEL SECURITY;', t);
+
+    -- Add tenant isolation policy
+    BEGIN
+      EXECUTE format($f$
+        CREATE POLICY tenant_isolation ON "%s"
+          USING ("tenantId" = current_setting('app.current_tenant', true))
+          WITH CHECK ("tenantId" = current_setting('app.current_tenant', true));
+      $f$, t);
+    EXCEPTION WHEN duplicate_object THEN
+      NULL; -- already exists, skip
+    END;
+
+    -- Ensure qip_app has table-level privileges
+    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON "%s" TO qip_app;', t);
+  END LOOP;
+END $$;

package/prisma/migrations/20260704100000_fix_oauth_auditlog_cascade/migration.sql

@@ -0,0 +1,9 @@
+-- OAuthConnection: ON DELETE CASCADE so deleting a project removes its OAuth connections
+ALTER TABLE "OAuthConnection" DROP CONSTRAINT IF EXISTS "OAuthConnection_projectId_fkey";
+ALTER TABLE "OAuthConnection" ADD CONSTRAINT "OAuthConnection_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AuditLog: ON DELETE SET NULL so deleting a project nullifies audit log project references
+ALTER TABLE "AuditLog" DROP CONSTRAINT IF EXISTS "AuditLog_projectId_fkey";
+ALTER TABLE "AuditLog" ADD CONSTRAINT "AuditLog_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE SET NULL ON UPDATE CASCADE;

package/prisma/migrations/20260704110000_skillfile_approval_status/migration.sql

@@ -0,0 +1,2 @@
+-- Add approvalStatus to SkillFile (was being set via `as any` hack, causing 500 on approve)
+ALTER TABLE "SkillFile" ADD COLUMN IF NOT EXISTS "approvalStatus" TEXT NOT NULL DEFAULT 'PENDING';

package/prisma/migrations/20260704120000_scenario_suspect_workspace/migration.sql

@@ -0,0 +1,35 @@
+-- Add settings to Workspace
+ALTER TABLE "Workspace" ADD COLUMN IF NOT EXISTS "settings" JSONB;
+
+-- Create Scenario table
+CREATE TABLE IF NOT EXISTS "Scenario" (
+    "id"            TEXT NOT NULL,
+    "tenantId"      TEXT NOT NULL,
+    "projectId"     TEXT NOT NULL,
+    "requirementId" TEXT NOT NULL,
+    "title"         TEXT NOT NULL,
+    "description"   TEXT,
+    "gherkin"       TEXT NOT NULL DEFAULT '',
+    "status"        TEXT NOT NULL DEFAULT 'draft',
+    "version"       INTEGER NOT NULL DEFAULT 1,
+    "source"        TEXT NOT NULL DEFAULT 'AI_GENERATED',
+    "createdAt"     TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt"     TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "Scenario_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX IF NOT EXISTS "Scenario_tenantId_projectId_idx" ON "Scenario"("tenantId", "projectId");
+CREATE INDEX IF NOT EXISTS "Scenario_requirementId_idx" ON "Scenario"("requirementId");
+
+ALTER TABLE "Scenario" ADD CONSTRAINT "Scenario_requirementId_fkey"
+  FOREIGN KEY ("requirementId") REFERENCES "Requirement"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Add scenario + suspect fields to TestCase
+ALTER TABLE "TestCase" ADD COLUMN IF NOT EXISTS "scenarioId"    TEXT;
+ALTER TABLE "TestCase" ADD COLUMN IF NOT EXISTS "suspect"       BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "TestCase" ADD COLUMN IF NOT EXISTS "suspectReason" TEXT;
+
+CREATE INDEX IF NOT EXISTS "TestCase_scenarioId_idx" ON "TestCase"("scenarioId");
+
+ALTER TABLE "TestCase" ADD CONSTRAINT "TestCase_scenarioId_fkey"
+  FOREIGN KEY ("scenarioId") REFERENCES "Scenario"("id") ON DELETE SET NULL ON UPDATE CASCADE;

package/prisma/migrations/20260704130000_testcase_traceto_suspect_indexes/migration.sql

@@ -0,0 +1,5 @@
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "TestCase_traceTo_idx" ON "TestCase"("traceTo");
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "TestCase_tenantId_projectId_suspect_idx" ON "TestCase"("tenantId", "projectId", "suspect");

package/prisma/migrations/20260704140000_workspace_rls/migration.sql

@@ -0,0 +1,19 @@
+-- ============================================================================
+--  RLS FOR Workspace TABLE
+--
+--  Workspace was missing from the initial tenant isolation migration.
+--  Enforces the same pattern: rows only visible when tenantId matches
+--  the app.current_tenant session variable set by withTenant().
+-- ============================================================================
+
+ALTER TABLE "Workspace" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "Workspace" FORCE ROW LEVEL SECURITY;
+
+DO $$
+BEGIN
+  CREATE POLICY tenant_isolation ON "Workspace"
+    USING ("tenantId" = current_setting('app.current_tenant', true))
+    WITH CHECK ("tenantId" = current_setting('app.current_tenant', true));
+EXCEPTION WHEN duplicate_object THEN
+  NULL;
+END $$;

package/prisma/migrations/20260704150000_project_cascade_deletes/migration.sql

@@ -0,0 +1,125 @@
+-- Add ON DELETE CASCADE to Project relations that were missing it.
+-- Without these, deleting a Project fails with FK constraint violation.
+
+-- Clean up orphaned rows (projectId references non-existent Project) before adding FK constraints.
+DELETE FROM "TestData"          WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "TestScript"        WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "PlatformJob"       WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "SkillFile"         WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "ProjectArtifact"   WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "Flow"              WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "ScreenGroup"       WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "ElementFingerprint" WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "UserSession"       WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "VisualBaseline"    WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "HumanReviewItem"   WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "TestRun"           WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "Webhook"           WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "AgentToken"        WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "ProbeObservation"  WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "ScreenDiff"        WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "ChangeLog"         WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+DELETE FROM "Connector"         WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+-- Tables with nullable projectId → SET NULL orphaned refs instead of DELETE
+UPDATE "LLMCallLog"     SET "projectId" = NULL WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+UPDATE "KnowledgeChunk" SET "projectId" = NULL WHERE "projectId" IS NOT NULL AND "projectId" NOT IN (SELECT "id" FROM "Project");
+
+-- ScreenGroup
+ALTER TABLE "ScreenGroup" DROP CONSTRAINT IF EXISTS "ScreenGroup_projectId_fkey";
+ALTER TABLE "ScreenGroup" ADD CONSTRAINT "ScreenGroup_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Flow
+ALTER TABLE "Flow" DROP CONSTRAINT IF EXISTS "Flow_projectId_fkey";
+ALTER TABLE "Flow" ADD CONSTRAINT "Flow_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- SkillFile
+ALTER TABLE "SkillFile" DROP CONSTRAINT IF EXISTS "SkillFile_projectId_fkey";
+ALTER TABLE "SkillFile" ADD CONSTRAINT "SkillFile_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- ProjectArtifact
+ALTER TABLE "ProjectArtifact" DROP CONSTRAINT IF EXISTS "ProjectArtifact_projectId_fkey";
+ALTER TABLE "ProjectArtifact" ADD CONSTRAINT "ProjectArtifact_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- TestData
+ALTER TABLE "TestData" DROP CONSTRAINT IF EXISTS "TestData_projectId_fkey";
+ALTER TABLE "TestData" ADD CONSTRAINT "TestData_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- TestScript
+ALTER TABLE "TestScript" DROP CONSTRAINT IF EXISTS "TestScript_projectId_fkey";
+ALTER TABLE "TestScript" ADD CONSTRAINT "TestScript_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- PlatformJob
+ALTER TABLE "PlatformJob" DROP CONSTRAINT IF EXISTS "PlatformJob_projectId_fkey";
+ALTER TABLE "PlatformJob" ADD CONSTRAINT "PlatformJob_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- ElementFingerprint
+ALTER TABLE "ElementFingerprint" DROP CONSTRAINT IF EXISTS "ElementFingerprint_projectId_fkey";
+ALTER TABLE "ElementFingerprint" ADD CONSTRAINT "ElementFingerprint_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- UserSession
+ALTER TABLE "UserSession" DROP CONSTRAINT IF EXISTS "UserSession_projectId_fkey";
+ALTER TABLE "UserSession" ADD CONSTRAINT "UserSession_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- VisualBaseline
+ALTER TABLE "VisualBaseline" DROP CONSTRAINT IF EXISTS "VisualBaseline_projectId_fkey";
+ALTER TABLE "VisualBaseline" ADD CONSTRAINT "VisualBaseline_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- HumanReviewItem
+ALTER TABLE "HumanReviewItem" DROP CONSTRAINT IF EXISTS "HumanReviewItem_projectId_fkey";
+ALTER TABLE "HumanReviewItem" ADD CONSTRAINT "HumanReviewItem_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- TestRun
+ALTER TABLE "TestRun" DROP CONSTRAINT IF EXISTS "TestRun_projectId_fkey";
+ALTER TABLE "TestRun" ADD CONSTRAINT "TestRun_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Webhook
+ALTER TABLE "Webhook" DROP CONSTRAINT IF EXISTS "Webhook_projectId_fkey";
+ALTER TABLE "Webhook" ADD CONSTRAINT "Webhook_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AgentToken
+ALTER TABLE "AgentToken" DROP CONSTRAINT IF EXISTS "AgentToken_projectId_fkey";
+ALTER TABLE "AgentToken" ADD CONSTRAINT "AgentToken_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- ProbeObservation
+ALTER TABLE "ProbeObservation" DROP CONSTRAINT IF EXISTS "ProbeObservation_projectId_fkey";
+ALTER TABLE "ProbeObservation" ADD CONSTRAINT "ProbeObservation_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- ScreenDiff (has screenId FK, but also projectId)
+ALTER TABLE "ScreenDiff" DROP CONSTRAINT IF EXISTS "ScreenDiff_projectId_fkey";
+ALTER TABLE "ScreenDiff" ADD CONSTRAINT "ScreenDiff_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- ChangeLog
+ALTER TABLE "ChangeLog" DROP CONSTRAINT IF EXISTS "ChangeLog_projectId_fkey";
+ALTER TABLE "ChangeLog" ADD CONSTRAINT "ChangeLog_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- KnowledgeChunk (nullable projectId → SetNull)
+ALTER TABLE "KnowledgeChunk" DROP CONSTRAINT IF EXISTS "KnowledgeChunk_projectId_fkey";
+ALTER TABLE "KnowledgeChunk" ADD CONSTRAINT "KnowledgeChunk_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- LLMCallLog (nullable projectId → SetNull)
+ALTER TABLE "LLMCallLog" DROP CONSTRAINT IF EXISTS "LLMCallLog_projectId_fkey";
+ALTER TABLE "LLMCallLog" ADD CONSTRAINT "LLMCallLog_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- Connector
+ALTER TABLE "Connector" DROP CONSTRAINT IF EXISTS "Connector_projectId_fkey";
+ALTER TABLE "Connector" ADD CONSTRAINT "Connector_projectId_fkey"
+  FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260705100000_platform_job_worker_id/migration.sql

@@ -0,0 +1,12 @@
+-- Adds workerId + heartbeatAt to PlatformJob: identifies which worker process
+-- (host:pid) claimed a job, and lets the stale-job recovery sweep compare a
+-- liveness heartbeat (bumped on every progress update) instead of startedAt,
+-- so a slow-but-alive job isn't requeued and double-processed by another
+-- worker just for taking a long time.
+ALTER TABLE "PlatformJob" ADD COLUMN IF NOT EXISTS "workerId" TEXT;
+ALTER TABLE "PlatformJob" ADD COLUMN IF NOT EXISTS "heartbeatAt" TIMESTAMP(3);
+
+-- Speeds up the atomic claim query's `ORDER BY "queuedAt" WHERE status = 'QUEUED'`
+-- scan and the stale-job sweep's `WHERE status = 'RUNNING' AND "heartbeatAt" < ...`.
+CREATE INDEX IF NOT EXISTS "PlatformJob_status_queuedAt_idx" ON "PlatformJob"("status", "queuedAt");
+CREATE INDEX IF NOT EXISTS "PlatformJob_status_heartbeatAt_idx" ON "PlatformJob"("status", "heartbeatAt");

package/prisma/migrations/20260705110000_screen_discovery_method/migration.sql

@@ -0,0 +1,7 @@
+-- Adds discoveryMethod to Screen: how the screen was first found during a crawl
+-- (ENTRY_POINT | LINK_FOLLOW | SEED_URL | SKYVERN_AI). Set once at creation, never
+-- changed on re-crawl. Powers orphan-page detection — see repository.ts's
+-- getOrphanScreens().
+ALTER TABLE "Screen" ADD COLUMN IF NOT EXISTS "discoveryMethod" TEXT NOT NULL DEFAULT 'LINK_FOLLOW';
+
+CREATE INDEX IF NOT EXISTS "Screen_tenantId_projectId_discoveryMethod_idx" ON "Screen"("tenantId", "projectId", "discoveryMethod");