@tickernelz/paperclip-pro-db 2026.925.0

package/dist/migrations/0121_pipeline_automation_retry_effects.sql

@@ -0,0 +1,43 @@
+ALTER TABLE "pipeline_cases" ADD COLUMN IF NOT EXISTS "automation_attempt_id" uuid;--> statement-breakpoint
+ALTER TABLE "pipeline_cases" ADD COLUMN IF NOT EXISTS "retired_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "pipeline_cases" ADD COLUMN IF NOT EXISTS "retired_by_attempt_id" uuid;--> statement-breakpoint
+ALTER TABLE "pipeline_cases" ADD COLUMN IF NOT EXISTS "retired_reason" text;--> statement-breakpoint
+ALTER TABLE "pipeline_cases" ADD COLUMN IF NOT EXISTS "hidden_from_board_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "pipeline_case_issue_links" ADD COLUMN IF NOT EXISTS "automation_attempt_id" uuid;--> statement-breakpoint
+ALTER TABLE "pipeline_case_issue_links" ADD COLUMN IF NOT EXISTS "retired_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "pipeline_case_issue_links" ADD COLUMN IF NOT EXISTS "retired_by_attempt_id" uuid;--> statement-breakpoint
+ALTER TABLE "pipeline_case_issue_links" ADD COLUMN IF NOT EXISTS "retired_reason" text;--> statement-breakpoint
+ALTER TABLE "pipeline_automation_executions" ADD COLUMN IF NOT EXISTS "retry_of_execution_id" uuid;--> statement-breakpoint
+ALTER TABLE "pipeline_automation_executions" ADD COLUMN IF NOT EXISTS "generation" integer DEFAULT 1 NOT NULL;--> statement-breakpoint
+DROP INDEX IF EXISTS "pipeline_cases_parent_request_key_uq";--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "pipeline_cases_parent_request_key_uq" ON "pipeline_cases" USING btree ("parent_case_id","request_key") WHERE "pipeline_cases"."request_key" is not null and "pipeline_cases"."retired_at" is null;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "pipeline_cases_automation_attempt_idx" ON "pipeline_cases" USING btree ("automation_attempt_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "pipeline_cases_retired_idx" ON "pipeline_cases" USING btree ("company_id","retired_at");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "pipeline_case_issue_links_automation_attempt_idx" ON "pipeline_case_issue_links" USING btree ("automation_attempt_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "pipeline_automation_executions_retry_of_execution_idx" ON "pipeline_automation_executions" USING btree ("retry_of_execution_id");--> statement-breakpoint
+ALTER TABLE "pipeline_case_events" DROP CONSTRAINT IF EXISTS "pipeline_case_events_type_check";--> statement-breakpoint
+ALTER TABLE "pipeline_case_events" ADD CONSTRAINT "pipeline_case_events_type_check" CHECK ("pipeline_case_events"."type" in (
+        'ingested',
+        'updated',
+        'claimed',
+        'lease_released',
+        'lease_expired',
+        'transitioned',
+        'transition_forced',
+        'transition_suggested',
+        'suggestion_resolved',
+        'review_decided',
+        'conversation_opened',
+        'issue_linked',
+        'issue_unlinked',
+        'automation_executed',
+        'automation_failed',
+        'automation_retry_requested',
+        'automation_effects_retired',
+        'automation_retry_dispatched',
+        'blockers_set',
+        'blockers_resolved',
+        'children_terminal',
+        'upstream_drift',
+        'drift_acknowledged'
+      ));

package/dist/migrations/0122_pipeline_case_documents.sql

@@ -0,0 +1,28 @@
+CREATE TABLE IF NOT EXISTS "pipeline_case_documents" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"case_id" uuid NOT NULL,
+	"document_id" uuid NOT NULL,
+	"key" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "pipeline_case_documents" ADD CONSTRAINT "pipeline_case_documents_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "pipeline_case_documents" ADD CONSTRAINT "pipeline_case_documents_case_id_pipeline_cases_id_fk" FOREIGN KEY ("case_id") REFERENCES "public"."pipeline_cases"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "pipeline_case_documents" ADD CONSTRAINT "pipeline_case_documents_document_id_documents_id_fk" FOREIGN KEY ("document_id") REFERENCES "public"."documents"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+ WHEN duplicate_object THEN null;
+END $$;--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "pipeline_case_documents_company_case_key_uq" ON "pipeline_case_documents" USING btree ("company_id","case_id","key");--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "pipeline_case_documents_document_uq" ON "pipeline_case_documents" USING btree ("document_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "pipeline_case_documents_company_case_updated_idx" ON "pipeline_case_documents" USING btree ("company_id","case_id","updated_at");

package/dist/migrations/0123_document_annotation_source_trust.sql

@@ -0,0 +1 @@
+ALTER TABLE "document_annotation_comments" ADD COLUMN IF NOT EXISTS "source_trust" jsonb;

package/dist/migrations/0124_agent_api_key_scope_config.sql

@@ -0,0 +1 @@
+ALTER TABLE "agent_api_keys" ADD COLUMN IF NOT EXISTS "scope_config" jsonb;

package/dist/migrations/0125_environment_custom_image_templates.sql

@@ -0,0 +1,147 @@
+CREATE TABLE "environment_custom_image_templates" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "company_id" uuid NOT NULL,
+  "environment_id" uuid NOT NULL,
+  "provider" text NOT NULL,
+  "template_kind" text DEFAULT 'unknown' NOT NULL,
+  "template_ref" text NOT NULL,
+  "source_template_ref" text,
+  "source_environment_config_fingerprint" text,
+  "status" text DEFAULT 'active' NOT NULL,
+  "created_by_user_id" text,
+  "created_by_agent_id" uuid,
+  "captured_at" timestamp with time zone,
+  "last_used_at" timestamp with time zone,
+  "superseded_by_template_id" uuid,
+  "metadata" jsonb,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "environment_custom_image_setup_sessions" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "company_id" uuid NOT NULL,
+  "environment_id" uuid NOT NULL,
+  "template_id" uuid,
+  "promoted_template_id" uuid,
+  "provider" text NOT NULL,
+  "provider_lease_id" text,
+  "environment_lease_id" uuid,
+  "status" text DEFAULT 'starting' NOT NULL,
+  "started_by_user_id" text,
+  "started_by_agent_id" uuid,
+  "base_template_ref" text,
+  "expires_at" timestamp with time zone,
+  "finished_at" timestamp with time zone,
+  "failure_reason" text,
+  "connection_summary" jsonb,
+  "connection_secret_ref" text,
+  "metadata" jsonb,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_templates"
+  ADD CONSTRAINT "environment_custom_image_templates_company_id_companies_id_fk"
+  FOREIGN KEY ("company_id")
+  REFERENCES "public"."companies"("id")
+  ON DELETE cascade
+  ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_templates"
+  ADD CONSTRAINT "environment_custom_image_templates_environment_id_environments_id_fk"
+  FOREIGN KEY ("environment_id")
+  REFERENCES "public"."environments"("id")
+  ON DELETE cascade
+  ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_templates"
+  ADD CONSTRAINT "environment_custom_image_templates_created_by_agent_id_agents_id_fk"
+  FOREIGN KEY ("created_by_agent_id")
+  REFERENCES "public"."agents"("id")
+  ON DELETE set null
+  ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_templates"
+  ADD CONSTRAINT "environment_custom_image_templates_superseded_by_template_id_fk"
+  FOREIGN KEY ("superseded_by_template_id")
+  REFERENCES "public"."environment_custom_image_templates"("id")
+  ON DELETE set null
+  ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_setup_sessions"
+  ADD CONSTRAINT "environment_custom_image_setup_sessions_company_id_companies_id_fk"
+  FOREIGN KEY ("company_id")
+  REFERENCES "public"."companies"("id")
+  ON DELETE cascade
+  ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_setup_sessions"
+  ADD CONSTRAINT "environment_custom_image_setup_sessions_environment_id_environments_id_fk"
+  FOREIGN KEY ("environment_id")
+  REFERENCES "public"."environments"("id")
+  ON DELETE cascade
+  ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_setup_sessions"
+  ADD CONSTRAINT "environment_custom_image_setup_sessions_template_id_fk"
+  FOREIGN KEY ("template_id")
+  REFERENCES "public"."environment_custom_image_templates"("id")
+  ON DELETE set null
+  ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_setup_sessions"
+  ADD CONSTRAINT "environment_custom_image_setup_sessions_promoted_template_id_fk"
+  FOREIGN KEY ("promoted_template_id")
+  REFERENCES "public"."environment_custom_image_templates"("id")
+  ON DELETE set null
+  ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_setup_sessions"
+  ADD CONSTRAINT "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk"
+  FOREIGN KEY ("environment_lease_id")
+  REFERENCES "public"."environment_leases"("id")
+  ON DELETE set null
+  ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_setup_sessions"
+  ADD CONSTRAINT "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk"
+  FOREIGN KEY ("started_by_agent_id")
+  REFERENCES "public"."agents"("id")
+  ON DELETE set null
+  ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_templates_company_environment_status_idx"
+  ON "environment_custom_image_templates" USING btree ("company_id", "environment_id", "status");
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_templates_company_provider_status_idx"
+  ON "environment_custom_image_templates" USING btree ("company_id", "provider", "status");
+--> statement-breakpoint
+CREATE UNIQUE INDEX "environment_custom_image_templates_company_environment_active_uq"
+  ON "environment_custom_image_templates" USING btree ("company_id", "environment_id")
+  WHERE "status" = 'active';
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_templates_superseded_by_idx"
+  ON "environment_custom_image_templates" USING btree ("superseded_by_template_id");
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_templates_company_last_used_idx"
+  ON "environment_custom_image_templates" USING btree ("company_id", "last_used_at");
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_setup_sessions_company_environment_status_idx"
+  ON "environment_custom_image_setup_sessions" USING btree ("company_id", "environment_id", "status");
+--> statement-breakpoint
+CREATE UNIQUE INDEX "environment_custom_image_setup_sessions_company_environment_active_uq"
+  ON "environment_custom_image_setup_sessions" USING btree ("company_id", "environment_id")
+  WHERE "status" IN ('starting', 'waiting_for_user', 'capturing');
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_setup_sessions_company_template_idx"
+  ON "environment_custom_image_setup_sessions" USING btree ("company_id", "template_id");
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_setup_sessions_company_promoted_template_idx"
+  ON "environment_custom_image_setup_sessions" USING btree ("company_id", "promoted_template_id");
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_setup_sessions_company_expires_idx"
+  ON "environment_custom_image_setup_sessions" USING btree ("company_id", "expires_at");
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_setup_sessions_provider_lease_idx"
+  ON "environment_custom_image_setup_sessions" USING btree ("provider", "provider_lease_id");

package/dist/migrations/0127_environment_custom_images_instance_scoped.sql

@@ -0,0 +1,106 @@
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM "environment_custom_image_templates"
+    WHERE "status" = 'active'
+    GROUP BY "environment_id"
+    HAVING count(*) > 1
+  ) THEN
+    RAISE EXCEPTION 'Cannot migrate environment custom image templates to environment scope while multiple active templates exist for the same environment. Revoke or supersede the extra active templates before retrying.';
+  END IF;
+END $$;
+--> statement-breakpoint
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM "environment_custom_image_setup_sessions"
+    WHERE "status" IN ('starting', 'waiting_for_user', 'capturing')
+    GROUP BY "environment_id"
+    HAVING count(*) > 1
+  ) THEN
+    RAISE EXCEPTION 'Cannot migrate environment custom image setup sessions to environment scope while multiple active sessions exist for the same environment. Finish or cancel the extra sessions before retrying.';
+  END IF;
+END $$;
+--> statement-breakpoint
+UPDATE "environment_custom_image_templates"
+SET
+  "metadata" = jsonb_set(
+    COALESCE("metadata", '{}'::jsonb),
+    '{setupRpcCompanyId}',
+    to_jsonb("company_id"::text),
+    true
+  ),
+  "updated_at" = now()
+WHERE "company_id" IS NOT NULL
+  AND COALESCE("metadata" ->> 'setupRpcCompanyId', '') = '';
+--> statement-breakpoint
+UPDATE "environment_custom_image_setup_sessions"
+SET
+  "metadata" = jsonb_set(
+    COALESCE("metadata", '{}'::jsonb),
+    '{setupRpcCompanyId}',
+    to_jsonb("company_id"::text),
+    true
+  ),
+  "updated_at" = now()
+WHERE "company_id" IS NOT NULL
+  AND COALESCE("metadata" ->> 'setupRpcCompanyId', '') = '';
+--> statement-breakpoint
+DROP INDEX IF EXISTS "environment_custom_image_templates_company_environment_status_idx";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "environment_custom_image_templates_company_provider_status_idx";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "environment_custom_image_templates_company_environment_active_uq";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "environment_custom_image_templates_company_last_used_idx";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "environment_custom_image_setup_sessions_company_environment_status_idx";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "environment_custom_image_setup_sessions_company_environment_active_uq";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "environment_custom_image_setup_sessions_company_template_idx";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "environment_custom_image_setup_sessions_company_promoted_template_idx";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "environment_custom_image_setup_sessions_company_expires_idx";
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_templates"
+  DROP CONSTRAINT IF EXISTS "environment_custom_image_templates_company_id_companies_id_fk";
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_setup_sessions"
+  DROP CONSTRAINT IF EXISTS "environment_custom_image_setup_sessions_company_id_companies_id_fk";
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_templates" DROP COLUMN IF EXISTS "company_id";
+--> statement-breakpoint
+ALTER TABLE "environment_custom_image_setup_sessions" DROP COLUMN IF EXISTS "company_id";
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_templates_environment_status_idx"
+  ON "environment_custom_image_templates" USING btree ("environment_id", "status");
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_templates_environment_provider_status_idx"
+  ON "environment_custom_image_templates" USING btree ("environment_id", "provider", "status");
+--> statement-breakpoint
+CREATE UNIQUE INDEX "environment_custom_image_templates_environment_active_uq"
+  ON "environment_custom_image_templates" USING btree ("environment_id")
+  WHERE "status" = 'active';
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_templates_last_used_idx"
+  ON "environment_custom_image_templates" USING btree ("last_used_at");
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_setup_sessions_environment_status_idx"
+  ON "environment_custom_image_setup_sessions" USING btree ("environment_id", "status");
+--> statement-breakpoint
+CREATE UNIQUE INDEX "environment_custom_image_setup_sessions_environment_active_uq"
+  ON "environment_custom_image_setup_sessions" USING btree ("environment_id")
+  WHERE "status" IN ('starting', 'waiting_for_user', 'capturing');
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_setup_sessions_template_idx"
+  ON "environment_custom_image_setup_sessions" USING btree ("template_id");
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_setup_sessions_promoted_template_idx"
+  ON "environment_custom_image_setup_sessions" USING btree ("promoted_template_id");
+--> statement-breakpoint
+CREATE INDEX "environment_custom_image_setup_sessions_expires_idx"
+  ON "environment_custom_image_setup_sessions" USING btree ("expires_at");

package/dist/migrations/0128_user_specific_secrets.sql

@@ -0,0 +1,178 @@
+CREATE TABLE IF NOT EXISTS "user_secret_definitions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"key" text NOT NULL,
+	"name" text NOT NULL,
+	"description" text,
+	"status" text DEFAULT 'active' NOT NULL,
+	"provider" text DEFAULT 'local_encrypted' NOT NULL,
+	"managed_mode" text DEFAULT 'paperclip_managed' NOT NULL,
+	"provider_config_id" uuid,
+	"provider_metadata" jsonb,
+	"usage_guidance" text,
+	"created_by_agent_id" uuid,
+	"created_by_user_id" text,
+	"updated_by_agent_id" uuid,
+	"updated_by_user_id" text,
+	"deleted_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "user_secret_declarations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"user_secret_definition_id" uuid NOT NULL,
+	"target_type" text NOT NULL,
+	"target_id" text NOT NULL,
+	"config_path" text NOT NULL,
+	"env_key" text NOT NULL,
+	"version_selector" text DEFAULT 'latest' NOT NULL,
+	"required" boolean DEFAULT true NOT NULL,
+	"allow_missing_override" boolean DEFAULT false NOT NULL,
+	"label" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "company_secrets" ADD COLUMN IF NOT EXISTS "scope" text DEFAULT 'company' NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "company_secrets" ADD COLUMN IF NOT EXISTS "owner_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "company_secrets" ADD COLUMN IF NOT EXISTS "user_secret_definition_id" uuid;
+--> statement-breakpoint
+UPDATE "company_secrets"
+SET "scope" = 'company'
+WHERE "scope" IS NULL;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ALTER COLUMN "secret_id" DROP NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "user_secret_definition_id" uuid;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "secret_scope" text DEFAULT 'company' NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "credential_owner_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "credential_subject_type" text;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "credential_subject_id" text;
+--> statement-breakpoint
+ALTER TABLE "issues" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "heartbeat_runs" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "routines" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "routine_revisions" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "routine_runs" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_definitions_company_id_companies_id_fk') THEN
+		ALTER TABLE "user_secret_definitions" ADD CONSTRAINT "user_secret_definitions_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk') THEN
+		ALTER TABLE "user_secret_definitions" ADD CONSTRAINT "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk" FOREIGN KEY ("provider_config_id") REFERENCES "public"."company_secret_provider_configs"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_definitions_created_by_agent_id_agents_id_fk') THEN
+		ALTER TABLE "user_secret_definitions" ADD CONSTRAINT "user_secret_definitions_created_by_agent_id_agents_id_fk" FOREIGN KEY ("created_by_agent_id") REFERENCES "public"."agents"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_definitions_updated_by_agent_id_agents_id_fk') THEN
+		ALTER TABLE "user_secret_definitions" ADD CONSTRAINT "user_secret_definitions_updated_by_agent_id_agents_id_fk" FOREIGN KEY ("updated_by_agent_id") REFERENCES "public"."agents"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_declarations_company_id_companies_id_fk') THEN
+		ALTER TABLE "user_secret_declarations" ADD CONSTRAINT "user_secret_declarations_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk') THEN
+		ALTER TABLE "user_secret_declarations" ADD CONSTRAINT "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk" FOREIGN KEY ("user_secret_definition_id") REFERENCES "public"."user_secret_definitions"("id") ON DELETE cascade ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'company_secrets_user_secret_definition_id_user_secret_definitions_id_fk') THEN
+		ALTER TABLE "company_secrets" ADD CONSTRAINT "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk" FOREIGN KEY ("user_secret_definition_id") REFERENCES "public"."user_secret_definitions"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk') THEN
+		ALTER TABLE "secret_access_events" ADD CONSTRAINT "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk" FOREIGN KEY ("user_secret_definition_id") REFERENCES "public"."user_secret_definitions"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'company_secrets_scope_shape_check') THEN
+		ALTER TABLE "company_secrets" ADD CONSTRAINT "company_secrets_scope_shape_check" CHECK (
+			("scope" = 'company' AND "owner_user_id" IS NULL AND "user_secret_definition_id" IS NULL)
+			OR
+			("scope" = 'user' AND "owner_user_id" IS NOT NULL AND "user_secret_definition_id" IS NOT NULL)
+		);
+	END IF;
+END $$;
+--> statement-breakpoint
+DROP INDEX IF EXISTS "company_secrets_company_name_uq";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "company_secrets_company_key_uq";
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_definitions_company_status_idx" ON "user_secret_definitions" USING btree ("company_id","status");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_definitions_company_provider_idx" ON "user_secret_definitions" USING btree ("company_id","provider");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_definitions_provider_config_idx" ON "user_secret_definitions" USING btree ("provider_config_id");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "user_secret_definitions_company_key_uq" ON "user_secret_definitions" USING btree ("company_id","key") WHERE "user_secret_definitions"."deleted_at" IS NULL;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_declarations_company_idx" ON "user_secret_declarations" USING btree ("company_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_declarations_definition_idx" ON "user_secret_declarations" USING btree ("user_secret_definition_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_declarations_target_idx" ON "user_secret_declarations" USING btree ("company_id","target_type","target_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_declarations_company_required_idx" ON "user_secret_declarations" USING btree ("company_id","required");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "user_secret_declarations_target_path_uq" ON "user_secret_declarations" USING btree ("company_id","target_type","target_id","config_path");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_declarations_required_override_idx" ON "user_secret_declarations" USING btree ("company_id","allow_missing_override") WHERE "user_secret_declarations"."allow_missing_override" = true;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "company_secrets_company_scope_idx" ON "company_secrets" USING btree ("company_id","scope");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "company_secrets_company_owner_idx" ON "company_secrets" USING btree ("company_id","owner_user_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "company_secrets_user_definition_owner_idx" ON "company_secrets" USING btree ("company_id","user_secret_definition_id","owner_user_id");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "company_secrets_company_name_uq" ON "company_secrets" USING btree ("company_id","name") WHERE "company_secrets"."scope" = 'company' AND "company_secrets"."deleted_at" IS NULL;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "company_secrets_company_key_uq" ON "company_secrets" USING btree ("company_id","key") WHERE "company_secrets"."scope" = 'company' AND "company_secrets"."deleted_at" IS NULL;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "company_secrets_user_definition_owner_uq" ON "company_secrets" USING btree ("company_id","user_secret_definition_id","owner_user_id") WHERE "company_secrets"."scope" = 'user' AND "company_secrets"."deleted_at" IS NULL;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "secret_access_events_user_definition_created_idx" ON "secret_access_events" USING btree ("user_secret_definition_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "secret_access_events_company_credential_owner_idx" ON "secret_access_events" USING btree ("company_id","credential_owner_user_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "issues_company_responsible_user_idx" ON "issues" USING btree ("company_id","responsible_user_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "heartbeat_runs_company_responsible_user_idx" ON "heartbeat_runs" USING btree ("company_id","responsible_user_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "routines_company_responsible_user_idx" ON "routines" USING btree ("company_id","responsible_user_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "routine_revisions_company_responsible_user_idx" ON "routine_revisions" USING btree ("company_id","responsible_user_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "routine_runs_company_responsible_user_idx" ON "routine_runs" USING btree ("company_id","responsible_user_id","created_at");

package/dist/migrations/0129_agent_api_key_responsible_user.sql

@@ -0,0 +1,41 @@
+ALTER TABLE "agent_api_keys" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+UPDATE "agent_api_keys" AS key
+SET "responsible_user_id" = created_by."responsible_user_id"
+FROM (
+  SELECT DISTINCT ON (key_id)
+    key_id,
+    responsible_user_id
+  FROM (
+    SELECT
+      log.details ->> 'keyId' AS key_id,
+      log.actor_id AS responsible_user_id,
+      log.created_at
+    FROM "activity_log" AS log
+    WHERE log.action = 'agent.key_created'
+      AND log.actor_type = 'user'
+      AND log.details ->> 'keyId' IS NOT NULL
+      AND log.actor_id IS NOT NULL
+      AND log.actor_id <> ''
+
+    UNION ALL
+
+    SELECT
+      log.entity_id AS key_id,
+      request.approved_by_user_id AS responsible_user_id,
+      log.created_at
+    FROM "activity_log" AS log
+    INNER JOIN "join_requests" AS request
+      ON request.id::text = log.details ->> 'joinRequestId'
+    WHERE log.action = 'agent_api_key.claimed'
+      AND log.entity_type = 'agent_api_key'
+      AND log.entity_id IS NOT NULL
+      AND request.approved_by_user_id IS NOT NULL
+      AND request.approved_by_user_id <> ''
+  ) AS candidates
+  WHERE responsible_user_id IS NOT NULL
+    AND responsible_user_id <> ''
+  ORDER BY key_id, created_at ASC
+) AS created_by
+WHERE key.id::text = created_by.key_id
+  AND key.responsible_user_id IS NULL;

package/dist/migrations/0131_repair_run_responsible_user_context_refs.sql

@@ -0,0 +1,67 @@
+WITH extracted_run_refs AS (
+  SELECT
+    h."id" AS "run_id",
+    h."company_id",
+    NULLIF(h."context_snapshot" ->> 'issueId', '') AS "issue_ref",
+    1 AS "ref_priority"
+  FROM "heartbeat_runs" AS h
+  WHERE h."responsible_user_id" IS NULL
+    AND NULLIF(h."context_snapshot" ->> 'issueId', '') IS NOT NULL
+
+  UNION ALL
+
+  SELECT
+    h."id" AS "run_id",
+    h."company_id",
+    NULLIF(h."context_snapshot" ->> 'taskId', '') AS "issue_ref",
+    2 AS "ref_priority"
+  FROM "heartbeat_runs" AS h
+  WHERE h."responsible_user_id" IS NULL
+    AND NULLIF(h."context_snapshot" ->> 'taskId', '') IS NOT NULL
+),
+uuid_run_refs AS (
+  SELECT
+    "run_id",
+    "company_id",
+    "issue_ref"::uuid AS "issue_id",
+    "ref_priority"
+  FROM extracted_run_refs
+  WHERE "issue_ref" ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+),
+resolved_run_users AS (
+  SELECT DISTINCT ON ("run_id")
+    "run_id",
+    "responsible_user_id"
+  FROM (
+    SELECT
+      refs."run_id",
+      i."responsible_user_id",
+      refs."ref_priority",
+      1 AS "match_priority"
+    FROM uuid_run_refs AS refs
+    JOIN "issues" AS i
+      ON i."id" = refs."issue_id"
+     AND i."company_id" = refs."company_id"
+    WHERE i."responsible_user_id" IS NOT NULL
+
+    UNION ALL
+
+    SELECT
+      refs."run_id",
+      i."responsible_user_id",
+      refs."ref_priority",
+      2 AS "match_priority"
+    FROM extracted_run_refs AS refs
+    JOIN "issues" AS i
+      ON i."identifier" = refs."issue_ref"
+     AND i."company_id" = refs."company_id"
+    WHERE i."responsible_user_id" IS NOT NULL
+  ) AS candidates
+  ORDER BY "run_id", "ref_priority" ASC, "match_priority" ASC
+)
+UPDATE "heartbeat_runs" AS h
+SET "responsible_user_id" = resolved_run_users."responsible_user_id",
+    "updated_at" = now()
+FROM resolved_run_users
+WHERE h."id" = resolved_run_users."run_id"
+  AND h."responsible_user_id" IS NULL;