@tickernelz/paperclip-pro-db 2026.925.0

package/dist/migrations/0232_fixed_hannibal_king.sql

@@ -0,0 +1,202 @@
+CREATE TABLE IF NOT EXISTS "connection_grant_members" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"grant_id" uuid NOT NULL,
+	"subject_type" text NOT NULL,
+	"subject_id" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "connection_grant_members_subject_type_check" CHECK ("connection_grant_members"."subject_type" in ('user'))
+);
+--> statement-breakpoint
+ALTER TABLE "connection_grant_members" DROP CONSTRAINT IF EXISTS "connection_grant_members_company_grant_fk";--> statement-breakpoint
+ALTER TABLE "connection_grant_members" DROP CONSTRAINT IF EXISTS "connection_grant_members_grant_id_connection_grants_id_fk";--> statement-breakpoint
+ALTER TABLE "connection_grant_members" DROP CONSTRAINT IF EXISTS "connection_grant_members_company_id_companies_id_fk";--> statement-breakpoint
+ALTER TABLE "connection_grants" DROP CONSTRAINT IF EXISTS "connection_grants_kind_check";--> statement-breakpoint
+ALTER TABLE "connection_grants" DROP CONSTRAINT IF EXISTS "connection_grants_subject_check";--> statement-breakpoint
+ALTER TABLE "connection_grants" DROP CONSTRAINT IF EXISTS "connection_grants_default_check";--> statement-breakpoint
+ALTER TABLE "tool_connections" DROP CONSTRAINT IF EXISTS "tool_connections_credential_policy_check";--> statement-breakpoint
+DROP INDEX IF EXISTS "connection_grants_default_uq";--> statement-breakpoint
+UPDATE "connection_grants" SET "kind" = 'organization' WHERE "kind" = 'workspace';--> statement-breakpoint
+INSERT INTO "connection_grants" (
+	"company_id", "connection_id", "kind", "credential_secret_refs", "status", "is_default",
+	"created_by_agent_id", "created_by_user_id", "created_at", "updated_at"
+)
+SELECT
+	c."company_id", c."id", 'organization', c."credential_secret_refs", 'active', true,
+	c."created_by_agent_id", c."created_by_user_id", c."created_at", c."updated_at"
+FROM "tool_connections" c
+WHERE NOT EXISTS (
+	SELECT 1 FROM "connection_grants" g
+	WHERE g."connection_id" = c."id" AND g."is_default" = true
+);--> statement-breakpoint
+ALTER TABLE "tool_connections" ADD COLUMN IF NOT EXISTS "credential_policy" text DEFAULT 'shared' NOT NULL;--> statement-breakpoint
+ALTER TABLE "connection_grant_members" ADD CONSTRAINT "connection_grant_members_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+DO $$
+BEGIN
+	IF NOT EXISTS (
+		SELECT 1
+		FROM pg_constraint
+		WHERE conname = 'connection_grants_company_id_uq'
+			AND conrelid = 'connection_grants'::regclass
+	) THEN
+		ALTER TABLE "connection_grants" ADD CONSTRAINT "connection_grants_company_id_uq" UNIQUE("company_id","id");
+	END IF;
+END $$;--> statement-breakpoint
+ALTER TABLE "connection_grant_members" ADD CONSTRAINT "connection_grant_members_company_grant_fk" FOREIGN KEY ("company_id","grant_id") REFERENCES "public"."connection_grants"("company_id","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "connection_grant_members_company_subject_idx" ON "connection_grant_members" USING btree ("company_id","subject_type","subject_id");--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "connection_grant_members_grant_subject_uq" ON "connection_grant_members" USING btree ("grant_id","subject_type","subject_id");--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "connection_grants_default_uq" ON "connection_grants" USING btree ("connection_id") WHERE "connection_grants"."is_default" = true and "connection_grants"."kind" = 'organization';--> statement-breakpoint
+ALTER TABLE "connection_grants" ADD CONSTRAINT "connection_grants_kind_check" CHECK ("connection_grants"."kind" in ('organization', 'user'));--> statement-breakpoint
+ALTER TABLE "connection_grants" ADD CONSTRAINT "connection_grants_subject_check" CHECK (("connection_grants"."kind" = 'user' and "connection_grants"."subject_user_id" is not null) or ("connection_grants"."kind" = 'organization' and "connection_grants"."subject_user_id" is null));--> statement-breakpoint
+ALTER TABLE "connection_grants" ADD CONSTRAINT "connection_grants_default_check" CHECK ("connection_grants"."is_default" = false or "connection_grants"."kind" = 'organization');--> statement-breakpoint
+ALTER TABLE "tool_connections" ADD CONSTRAINT "tool_connections_credential_policy_check" CHECK ("tool_connections"."credential_policy" in ('shared', 'per_user', 'per_user_with_fallback'));
+--> statement-breakpoint
+ALTER TABLE "issue_thread_interactions" ADD COLUMN IF NOT EXISTS "addressee_user_id" text;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "issue_thread_interactions_addressee_user_idx" ON "issue_thread_interactions" USING btree ("addressee_user_id");
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "connection_grant_delegations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"grant_id" uuid NOT NULL,
+	"agent_id" uuid NOT NULL,
+	"created_by_user_id" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "connection_grant_delegations" DROP CONSTRAINT IF EXISTS "connection_grant_delegations_company_id_companies_id_fk";
+--> statement-breakpoint
+ALTER TABLE "connection_grant_delegations" ADD CONSTRAINT "connection_grant_delegations_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "connection_grant_delegations" DROP CONSTRAINT IF EXISTS "connection_grant_delegations_agent_id_agents_id_fk";
+--> statement-breakpoint
+ALTER TABLE "connection_grant_delegations" ADD CONSTRAINT "connection_grant_delegations_agent_id_agents_id_fk" FOREIGN KEY ("agent_id") REFERENCES "public"."agents"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "connection_grant_delegations" DROP CONSTRAINT IF EXISTS "connection_grant_delegations_company_grant_fk";
+--> statement-breakpoint
+ALTER TABLE "connection_grant_delegations" ADD CONSTRAINT "connection_grant_delegations_company_grant_fk" FOREIGN KEY ("company_id","grant_id") REFERENCES "public"."connection_grants"("company_id","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "connection_grant_delegations_company_agent_idx" ON "connection_grant_delegations" USING btree ("company_id","agent_id");--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "connection_grant_delegations_grant_agent_uq" ON "connection_grant_delegations" USING btree ("grant_id","agent_id");
+--> statement-breakpoint
+-- A legacy company-scoped credential can only become user-scoped when exactly
+-- one personal owner references it and no organization grant, connection, or
+-- company binding also references it. Ambiguous rows fail closed in-place:
+-- remove only personal-grant references and require those users to
+-- reauthorize. Organization grants, shared/fallback connections, company
+-- bindings, and routine triggers keep the original company-scoped secret so
+-- their existing consumers continue to resolve it. Connection rows also keep
+-- direct references: policy-aware resolution ignores them for strict per-user
+-- access, while stripping them would break an independent shared consumer.
+DROP TABLE IF EXISTS "phase4_ambiguous_personal_secrets";
+--> statement-breakpoint
+CREATE TEMP TABLE "phase4_ambiguous_personal_secrets" ON COMMIT DROP AS
+WITH personal_secret_owners AS (
+	SELECT
+		s."id" AS "secret_id",
+		s."company_id",
+		count(DISTINCT g."subject_user_id") AS "owner_count"
+	FROM "company_secrets" s
+	JOIN "connection_grants" g
+		ON g."company_id" = s."company_id"
+		AND g."kind" = 'user'
+	CROSS JOIN LATERAL jsonb_array_elements(g."credential_secret_refs") personal_ref
+	WHERE s."scope" = 'company'
+		AND s."id"::text = personal_ref ->> 'secretId'
+	GROUP BY s."id", s."company_id"
+)
+	SELECT owners."secret_id", owners."company_id"
+	FROM personal_secret_owners owners
+	WHERE owners."owner_count" <> 1
+		OR EXISTS (
+			SELECT 1
+			FROM "connection_grants" organization_grant
+			CROSS JOIN LATERAL jsonb_array_elements(organization_grant."credential_secret_refs") organization_ref
+			WHERE organization_grant."company_id" = owners."company_id"
+				AND organization_grant."kind" <> 'user'
+				AND organization_ref ->> 'secretId' = owners."secret_id"::text
+		)
+			OR EXISTS (
+				SELECT 1
+				FROM "tool_connections" connection
+			CROSS JOIN LATERAL jsonb_array_elements(connection."credential_secret_refs") connection_ref
+			WHERE connection."company_id" = owners."company_id"
+					AND connection_ref ->> 'secretId' = owners."secret_id"::text
+			)
+			OR EXISTS (
+				SELECT 1
+				FROM "company_secret_bindings" binding
+				WHERE binding."company_id" = owners."company_id"
+					AND binding."secret_id" = owners."secret_id"
+			)
+			OR EXISTS (
+				SELECT 1
+				FROM "routine_triggers" routine_trigger
+				WHERE routine_trigger."company_id" = owners."company_id"
+					AND routine_trigger."secret_id" = owners."secret_id"
+			);
+--> statement-breakpoint
+WITH ambiguous_secrets AS (
+	SELECT "secret_id", "company_id" FROM "phase4_ambiguous_personal_secrets"
+)
+UPDATE "connection_grants" grant_row
+SET
+	"credential_secret_refs" = COALESCE((
+		SELECT jsonb_agg(ref)
+		FROM jsonb_array_elements(grant_row."credential_secret_refs") ref
+		WHERE NOT EXISTS (
+			SELECT 1
+			FROM ambiguous_secrets ambiguous
+			WHERE ambiguous."company_id" = grant_row."company_id"
+				AND ref ->> 'secretId' = ambiguous."secret_id"::text
+		)
+	), '[]'::jsonb),
+	"status" = 'needs_reauthorization',
+	"is_default" = false,
+	"updated_at" = now()
+WHERE grant_row."kind" = 'user'
+	AND EXISTS (
+	SELECT 1
+	FROM jsonb_array_elements(grant_row."credential_secret_refs") ref
+	JOIN ambiguous_secrets ambiguous
+		ON ambiguous."company_id" = grant_row."company_id"
+		AND ref ->> 'secretId' = ambiguous."secret_id"::text
+);
+--> statement-breakpoint
+DROP TABLE IF EXISTS "phase4_ambiguous_personal_secrets";
+--> statement-breakpoint
+INSERT INTO "user_secret_definitions" (
+	"company_id", "key", "name", "description", "provider", "managed_mode",
+	"provider_config_id", "provider_metadata", "created_by_agent_id", "created_by_user_id"
+)
+SELECT DISTINCT
+	s."company_id",
+	'tool_oauth.' || s."id"::text,
+	s."name",
+	'Personal connection credential migrated to user scope.',
+	s."provider",
+	s."managed_mode",
+	s."provider_config_id",
+	s."provider_metadata",
+	s."created_by_agent_id",
+	s."created_by_user_id"
+FROM "company_secrets" s
+JOIN "connection_grants" g ON g."company_id" = s."company_id" AND g."kind" = 'user'
+CROSS JOIN LATERAL jsonb_array_elements(g."credential_secret_refs") ref
+WHERE s."id"::text = ref ->> 'secretId'
+	AND s."scope" = 'company'
+ON CONFLICT DO NOTHING;
+--> statement-breakpoint
+UPDATE "company_secrets" s
+SET
+	"scope" = 'user',
+	"owner_user_id" = owner_map."owner_user_id",
+	"user_secret_definition_id" = d."id",
+	"updated_at" = now()
+FROM (
+	SELECT s2."id" AS "secret_id", min(g."subject_user_id") AS "owner_user_id"
+	FROM "company_secrets" s2
+	JOIN "connection_grants" g ON g."company_id" = s2."company_id" AND g."kind" = 'user'
+	CROSS JOIN LATERAL jsonb_array_elements(g."credential_secret_refs") ref
+	WHERE s2."id"::text = ref ->> 'secretId' AND s2."scope" = 'company'
+	GROUP BY s2."id"
+	HAVING count(DISTINCT g."subject_user_id") = 1
+) owner_map
+JOIN "user_secret_definitions" d ON d."key" = 'tool_oauth.' || owner_map."secret_id"::text AND d."deleted_at" IS NULL
+WHERE s."id" = owner_map."secret_id" AND d."company_id" = s."company_id";

package/dist/migrations/0233_living_dreaming_celestial.sql

@@ -0,0 +1,13 @@
+ALTER TABLE "connection_grants" ADD COLUMN IF NOT EXISTS "external_credential" jsonb;--> statement-breakpoint
+ALTER TABLE "tool_connections" ADD COLUMN IF NOT EXISTS "credential_source" text DEFAULT 'paperclip_vault' NOT NULL;--> statement-breakpoint
+ALTER TABLE "tool_connections" ADD COLUMN IF NOT EXISTS "external_credential" jsonb;--> statement-breakpoint
+ALTER TABLE "connection_grants" DROP CONSTRAINT IF EXISTS "connection_grants_credential_source_one_of_check";--> statement-breakpoint
+ALTER TABLE "connection_grants" ADD CONSTRAINT "connection_grants_credential_source_one_of_check" CHECK ("connection_grants"."external_credential" is null or jsonb_array_length("connection_grants"."credential_secret_refs") = 0);--> statement-breakpoint
+ALTER TABLE "tool_connections" DROP CONSTRAINT IF EXISTS "tool_connections_credential_source_check";--> statement-breakpoint
+ALTER TABLE "tool_connections" ADD CONSTRAINT "tool_connections_credential_source_check" CHECK ("tool_connections"."credential_source" in ('paperclip_vault', 'vercel_connect'));--> statement-breakpoint
+ALTER TABLE "tool_connections" DROP CONSTRAINT IF EXISTS "tool_connections_credential_source_one_of_check";--> statement-breakpoint
+ALTER TABLE "tool_connections" ADD CONSTRAINT "tool_connections_credential_source_one_of_check" CHECK ((
+      ("tool_connections"."credential_source" = 'paperclip_vault' and "tool_connections"."external_credential" is null)
+      or
+      ("tool_connections"."credential_source" = 'vercel_connect' and "tool_connections"."external_credential" is not null and jsonb_array_length("tool_connections"."credential_refs") = 0 and jsonb_array_length("tool_connections"."credential_secret_refs") = 0)
+    ));

package/dist/migrations/0234_provider_trace_records.sql

@@ -0,0 +1,31 @@
+CREATE TABLE IF NOT EXISTS "provider_trace_records" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"run_id" uuid NOT NULL,
+	"status" text DEFAULT 'capturing' NOT NULL,
+	"provider" text NOT NULL,
+	"trace_ref" text NOT NULL,
+	"frame_count" integer DEFAULT 0 NOT NULL,
+	"byte_count" bigint DEFAULT 0 NOT NULL,
+	"digest" text,
+	"reason" text,
+	"requested_by" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"deleted_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+DO $$ BEGIN
+	ALTER TABLE "provider_trace_records" ADD CONSTRAINT "provider_trace_records_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE no action ON UPDATE no action;
+EXCEPTION
+	WHEN duplicate_object THEN NULL;
+END $$;--> statement-breakpoint
+DO $$ BEGIN
+	ALTER TABLE "provider_trace_records" ADD CONSTRAINT "provider_trace_records_run_id_heartbeat_runs_id_fk" FOREIGN KEY ("run_id") REFERENCES "public"."heartbeat_runs"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION
+	WHEN duplicate_object THEN NULL;
+END $$;--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "provider_trace_records_run_unique" ON "provider_trace_records" USING btree ("run_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "provider_trace_records_expiry_idx" ON "provider_trace_records" USING btree ("status","expires_at");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "provider_trace_records_company_created_idx" ON "provider_trace_records" USING btree ("company_id","created_at");

package/dist/migrations/0235_heartbeat_run_event_sequence_uniqueness.sql

@@ -0,0 +1,28 @@
+WITH ranked AS (
+	SELECT
+		"id",
+		"run_id",
+		"seq",
+		row_number() OVER (PARTITION BY "run_id", "seq" ORDER BY "id") AS duplicate_ordinal,
+		max("seq") OVER (PARTITION BY "run_id") AS max_seq
+	FROM "heartbeat_run_events"
+), duplicates AS (
+	SELECT
+		"id",
+		max_seq + row_number() OVER (PARTITION BY "run_id" ORDER BY "seq", "id") AS repaired_seq
+	FROM ranked
+	WHERE duplicate_ordinal > 1
+)
+UPDATE "heartbeat_run_events" AS event
+SET "seq" = duplicates.repaired_seq
+FROM duplicates
+WHERE event."id" = duplicates."id";--> statement-breakpoint
+UPDATE "heartbeat_runs" AS run
+SET "next_event_seq" = COALESCE((
+	SELECT max(event."seq") + 1
+	FROM "heartbeat_run_events" AS event
+	WHERE event."run_id" = run."id"
+), 1);--> statement-breakpoint
+-- paperclip:migration-safety-ignore large-create-index-not-concurrently: Drizzle migrations run transactionally, so CONCURRENTLY is unavailable. The duplicate repair and uniqueness invariant must commit atomically before native event writers rely on the sequence key.
+CREATE UNIQUE INDEX IF NOT EXISTS "heartbeat_run_events_run_seq_uq" ON "heartbeat_run_events" USING btree ("run_id","seq");--> statement-breakpoint
+DROP INDEX IF EXISTS "heartbeat_run_events_run_seq_idx";

package/dist/migrations/0236_remove_cheap_model_profiles.sql

@@ -0,0 +1,108 @@
+CREATE INDEX IF NOT EXISTS "agents_remove_model_profiles_idx"
+	ON "agents" USING btree ("id")
+	WHERE "runtime_config" ? 'modelProfiles';--> statement-breakpoint
+
+DO $$
+DECLARE
+	updated_count integer;
+BEGIN
+	LOOP
+		WITH batch AS MATERIALIZED (
+			SELECT "id"
+			FROM "agents"
+			WHERE "runtime_config" ? 'modelProfiles'
+			ORDER BY "id"
+			LIMIT 1000
+		)
+		UPDATE "agents" AS agent
+		SET "runtime_config" = agent."runtime_config" - 'modelProfiles',
+			"updated_at" = now()
+		FROM batch
+		WHERE agent."id" = batch."id";
+
+		GET DIAGNOSTICS updated_count = ROW_COUNT;
+		EXIT WHEN updated_count = 0;
+	END LOOP;
+END $$;--> statement-breakpoint
+
+DROP INDEX IF EXISTS "agents_remove_model_profiles_idx";--> statement-breakpoint
+
+-- paperclip:migration-safety-ignore large-create-index-not-concurrently: This temporary partial index covers only revision snapshots with the retired JSON key and is dropped after the bounded cleanup.
+CREATE INDEX IF NOT EXISTS "agent_config_revisions_remove_model_profiles_idx"
+	ON "agent_config_revisions" USING btree ("id")
+	WHERE ("before_config" #> '{runtimeConfig}') ? 'modelProfiles'
+		OR ("after_config" #> '{runtimeConfig}') ? 'modelProfiles';--> statement-breakpoint
+
+DO $$
+DECLARE
+	updated_count integer;
+BEGIN
+	LOOP
+		WITH batch AS MATERIALIZED (
+			SELECT "id"
+			FROM "agent_config_revisions"
+			WHERE ("before_config" #> '{runtimeConfig}') ? 'modelProfiles'
+				OR ("after_config" #> '{runtimeConfig}') ? 'modelProfiles'
+			ORDER BY "id"
+			LIMIT 1000
+		)
+		UPDATE "agent_config_revisions" AS revision
+		SET "before_config" = CASE
+				WHEN (revision."before_config" #> '{runtimeConfig}') ? 'modelProfiles'
+				THEN jsonb_set(
+					revision."before_config",
+					'{runtimeConfig}',
+					(revision."before_config" #> '{runtimeConfig}') - 'modelProfiles'
+				)
+				ELSE revision."before_config"
+			END,
+			"after_config" = CASE
+				WHEN (revision."after_config" #> '{runtimeConfig}') ? 'modelProfiles'
+				THEN jsonb_set(
+					revision."after_config",
+					'{runtimeConfig}',
+					(revision."after_config" #> '{runtimeConfig}') - 'modelProfiles'
+				)
+				ELSE revision."after_config"
+			END
+		FROM batch
+		WHERE revision."id" = batch."id";
+
+		GET DIAGNOSTICS updated_count = ROW_COUNT;
+		EXIT WHEN updated_count = 0;
+	END LOOP;
+END $$;--> statement-breakpoint
+
+DROP INDEX IF EXISTS "agent_config_revisions_remove_model_profiles_idx";--> statement-breakpoint
+
+-- paperclip:migration-safety-ignore large-create-index-not-concurrently: This temporary partial index covers only rows with the retired JSON key and is dropped after the bounded cleanup.
+CREATE INDEX IF NOT EXISTS "issues_remove_model_profile_idx"
+	ON "issues" USING btree ("id")
+	WHERE "assignee_adapter_overrides" ? 'modelProfile';--> statement-breakpoint
+
+DO $$
+DECLARE
+	updated_count integer;
+BEGIN
+	LOOP
+		WITH batch AS MATERIALIZED (
+			SELECT "id"
+			FROM "issues"
+			WHERE "assignee_adapter_overrides" ? 'modelProfile'
+			ORDER BY "id"
+			LIMIT 1000
+		)
+		UPDATE "issues" AS issue
+		SET "assignee_adapter_overrides" = NULLIF(
+			issue."assignee_adapter_overrides" - 'modelProfile',
+			'{}'::jsonb
+		)
+		FROM batch
+		WHERE issue."id" = batch."id";
+
+		GET DIAGNOSTICS updated_count = ROW_COUNT;
+		EXIT WHEN updated_count = 0;
+	END LOOP;
+END $$;--> statement-breakpoint
+
+DROP INDEX IF EXISTS "issues_remove_model_profile_idx";

package/dist/migrations/0237_clammy_colonel_america.sql

@@ -0,0 +1,52 @@
+CREATE TABLE "managed_agent_profiles" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"profile_key" text NOT NULL,
+	"display_name" text NOT NULL,
+	"service" text DEFAULT 'anthropic_managed_agents' NOT NULL,
+	"anthropic_agent_id" text NOT NULL,
+	"agent_version" text NOT NULL,
+	"environment_id" text NOT NULL,
+	"beta_version" text DEFAULT 'managed-agents-2026-04-01' NOT NULL,
+	"default_model" text DEFAULT 'claude-sonnet-5' NOT NULL,
+	"default_max_list_cost_cents" integer DEFAULT 100 NOT NULL,
+	"api_key_secret_id" uuid NOT NULL,
+	"enabled" boolean DEFAULT false NOT NULL,
+	"retention_acknowledged" boolean DEFAULT false NOT NULL,
+	"qualification" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"qualified_at" timestamp with time zone,
+	"qualified_revision" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "managed_agent_profiles_service_check" CHECK ("managed_agent_profiles"."service" = 'anthropic_managed_agents'),
+	CONSTRAINT "managed_agent_profiles_beta_check" CHECK ("managed_agent_profiles"."beta_version" = 'managed-agents-2026-04-01'),
+	CONSTRAINT "managed_agent_profiles_positive_budget_check" CHECK ("managed_agent_profiles"."default_max_list_cost_cents" > 0),
+	CONSTRAINT "managed_agent_profiles_qualified_revision_check" CHECK (("managed_agent_profiles"."qualified_at" IS NULL AND "managed_agent_profiles"."qualified_revision" IS NULL) OR ("managed_agent_profiles"."qualified_at" IS NOT NULL AND "managed_agent_profiles"."qualification" <> '{}'::jsonb AND "managed_agent_profiles"."qualified_revision" ~ '^sha256:[0-9a-f]{64}$'))
+);
+--> statement-breakpoint
+CREATE TABLE "remote_agent_profiles" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"profile_key" text NOT NULL,
+	"display_name" text NOT NULL,
+	"service" text NOT NULL,
+	"configuration" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"enabled" boolean DEFAULT false NOT NULL,
+	"retention_acknowledged" boolean DEFAULT false NOT NULL,
+	"qualification" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"qualified_at" timestamp with time zone,
+	"qualified_revision" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "remote_agent_profiles_service_check" CHECK ("remote_agent_profiles"."service" = 'aws_bedrock_agentcore_harness'),
+	CONSTRAINT "remote_agent_profiles_qualified_revision_check" CHECK (("remote_agent_profiles"."qualified_at" IS NULL AND "remote_agent_profiles"."qualified_revision" IS NULL) OR ("remote_agent_profiles"."qualified_at" IS NOT NULL AND "remote_agent_profiles"."qualification" <> '{}'::jsonb AND "remote_agent_profiles"."qualified_revision" ~ '^sha256:[0-9a-f]{64}$'))
+);
+--> statement-breakpoint
+ALTER TABLE "managed_agent_profiles" ADD CONSTRAINT "managed_agent_profiles_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "managed_agent_profiles" ADD CONSTRAINT "managed_agent_profiles_api_key_secret_id_company_secrets_id_fk" FOREIGN KEY ("api_key_secret_id") REFERENCES "public"."company_secrets"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "remote_agent_profiles" ADD CONSTRAINT "remote_agent_profiles_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "managed_agent_profiles_company_idx" ON "managed_agent_profiles" USING btree ("company_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "managed_agent_profiles_company_key_uq" ON "managed_agent_profiles" USING btree ("company_id","profile_key");--> statement-breakpoint
+CREATE UNIQUE INDEX "managed_agent_profiles_company_resource_uq" ON "managed_agent_profiles" USING btree ("company_id","anthropic_agent_id","agent_version","environment_id");--> statement-breakpoint
+CREATE INDEX "remote_agent_profiles_company_idx" ON "remote_agent_profiles" USING btree ("company_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "remote_agent_profiles_company_key_uq" ON "remote_agent_profiles" USING btree ("company_id","profile_key");

package/dist/migrations/0238_graceful_infant_terrible.sql

@@ -0,0 +1,7 @@
+ALTER TABLE "native_run_finalizations" ADD COLUMN IF NOT EXISTS "controller_boot_id" text;--> statement-breakpoint
+ALTER TABLE "native_run_finalizations" ADD COLUMN IF NOT EXISTS "controller_pid" integer;--> statement-breakpoint
+ALTER TABLE "native_run_finalizations" ADD COLUMN IF NOT EXISTS "controller_process_started_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "native_run_finalizations" ADD COLUMN IF NOT EXISTS "controller_generation" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "native_run_finalizations" ADD COLUMN IF NOT EXISTS "recovery_state" text;--> statement-breakpoint
+ALTER TABLE "native_run_finalizations" ADD COLUMN IF NOT EXISTS "recovery_request_id" text;--> statement-breakpoint
+ALTER TABLE "native_run_finalizations" ADD COLUMN IF NOT EXISTS "recovery_history" jsonb DEFAULT '[]'::jsonb NOT NULL;

package/dist/migrations/0239_sturdy_santa_claus.sql

@@ -0,0 +1,38 @@
+CREATE TABLE IF NOT EXISTS "connection_event_deliveries" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"provider" text NOT NULL,
+	"provider_delivery_id" text NOT NULL,
+	"event" text NOT NULL,
+	"action" text,
+	"installation_id" text,
+	"repository_id" text,
+	"normalized_payload" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"status" text DEFAULT 'received' NOT NULL,
+	"attempts" integer DEFAULT 1 NOT NULL,
+	"last_error" text,
+	"provider_created_at" timestamp with time zone,
+	"processed_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "connection_grants" DROP CONSTRAINT IF EXISTS "connection_grants_kind_check";--> statement-breakpoint
+ALTER TABLE "connection_grants" DROP CONSTRAINT IF EXISTS "connection_grants_subject_check";--> statement-breakpoint
+ALTER TABLE "tool_connections" DROP CONSTRAINT IF EXISTS "tool_connections_credential_policy_check";--> statement-breakpoint
+ALTER TABLE "connection_grants" ADD COLUMN IF NOT EXISTS "subject_agent_id" uuid;--> statement-breakpoint
+ALTER TABLE "tool_oauth_states" ADD COLUMN IF NOT EXISTS "subject_agent_id" uuid;--> statement-breakpoint
+ALTER TABLE "connection_event_deliveries" DROP CONSTRAINT IF EXISTS "connection_event_deliveries_company_id_companies_id_fk";--> statement-breakpoint
+ALTER TABLE "connection_event_deliveries" ADD CONSTRAINT "connection_event_deliveries_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "connection_event_deliveries_company_provider_id_uq" ON "connection_event_deliveries" USING btree ("company_id","provider","provider_delivery_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "connection_event_deliveries_company_status_idx" ON "connection_event_deliveries" USING btree ("company_id","status","created_at");--> statement-breakpoint
+ALTER TABLE "connection_grants" DROP CONSTRAINT IF EXISTS "connection_grants_subject_agent_id_agents_id_fk";--> statement-breakpoint
+ALTER TABLE "connection_grants" ADD CONSTRAINT "connection_grants_subject_agent_id_agents_id_fk" FOREIGN KEY ("subject_agent_id") REFERENCES "public"."agents"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "tool_oauth_states" DROP CONSTRAINT IF EXISTS "tool_oauth_states_subject_agent_id_agents_id_fk";--> statement-breakpoint
+ALTER TABLE "tool_oauth_states" ADD CONSTRAINT "tool_oauth_states_subject_agent_id_agents_id_fk" FOREIGN KEY ("subject_agent_id") REFERENCES "public"."agents"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "connection_grants_subject_agent_idx" ON "connection_grants" USING btree ("company_id","subject_agent_id");--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "connection_grants_agent_uq" ON "connection_grants" USING btree ("connection_id","subject_agent_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "tool_oauth_states_subject_agent_idx" ON "tool_oauth_states" USING btree ("company_id","subject_agent_id");--> statement-breakpoint
+ALTER TABLE "connection_grants" ADD CONSTRAINT "connection_grants_kind_check" CHECK ("connection_grants"."kind" in ('organization', 'user', 'agent'));--> statement-breakpoint
+ALTER TABLE "connection_grants" ADD CONSTRAINT "connection_grants_subject_check" CHECK (("connection_grants"."kind" = 'user' and "connection_grants"."subject_user_id" is not null and "connection_grants"."subject_agent_id" is null) or ("connection_grants"."kind" = 'agent' and "connection_grants"."subject_agent_id" is not null and "connection_grants"."subject_user_id" is null) or ("connection_grants"."kind" = 'organization' and "connection_grants"."subject_user_id" is null and "connection_grants"."subject_agent_id" is null));--> statement-breakpoint
+ALTER TABLE "tool_connections" ADD CONSTRAINT "tool_connections_credential_policy_check" CHECK ("tool_connections"."credential_policy" in ('shared', 'per_user', 'per_user_with_fallback', 'per_agent'));

package/dist/migrations/0240_pink_fantastic_four.sql

@@ -0,0 +1,25 @@
+CREATE TABLE IF NOT EXISTS "run_identity_contexts" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"run_id" uuid NOT NULL,
+	"revision" integer NOT NULL,
+	"responsible_user_id" text,
+	"message_id" uuid,
+	"parent_context_id" uuid,
+	"cause" text NOT NULL,
+	"correlation_id" text NOT NULL,
+	"status" text DEFAULT 'accepted' NOT NULL,
+	"accepted_at" timestamp with time zone,
+	"github" jsonb,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "heartbeat_runs" ADD COLUMN IF NOT EXISTS "active_identity_context_id" uuid;--> statement-breakpoint
+DO $$ BEGIN
+ IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'run_identity_contexts_company_id_companies_id_fk' AND conrelid = 'public.run_identity_contexts'::regclass) THEN
+  ALTER TABLE "run_identity_contexts" ADD CONSTRAINT "run_identity_contexts_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;
+ END IF;
+END $$;--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "run_identity_contexts_run_revision_idx" ON "run_identity_contexts" USING btree ("run_id","revision");--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "run_identity_contexts_run_correlation_idx" ON "run_identity_contexts" USING btree ("run_id","correlation_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "run_identity_contexts_company_run_idx" ON "run_identity_contexts" USING btree ("company_id","run_id");

package/dist/migrations/0241_conscious_adam_destine.sql

@@ -0,0 +1 @@
+ALTER TABLE "issues" ADD COLUMN IF NOT EXISTS "origin_identity_context_id" uuid;

package/dist/migrations/0242_wide_lightspeed.sql

@@ -0,0 +1 @@
+ALTER TABLE "issue_thread_interactions" ADD COLUMN IF NOT EXISTS "source_identity_context_id" uuid;

package/dist/migrations/0243_sleepy_metal_master.sql

@@ -0,0 +1 @@
+ALTER TABLE "issues" ADD COLUMN IF NOT EXISTS "continuation_identity_context_id" uuid;

package/dist/migrations/0244_organic_meltdown.sql

@@ -0,0 +1 @@
+ALTER TABLE "run_identity_contexts" DROP CONSTRAINT IF EXISTS "run_identity_contexts_run_id_heartbeat_runs_id_fk";

package/dist/migrations/0245_misty_nightshade.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "run_identity_contexts" DROP CONSTRAINT IF EXISTS "run_identity_contexts_company_id_companies_id_fk";
+--> statement-breakpoint
+ALTER TABLE "run_identity_contexts" ADD CONSTRAINT "run_identity_contexts_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;

package/dist/migrations/0246_nostalgic_medusa.sql

@@ -0,0 +1,19 @@
+CREATE TABLE IF NOT EXISTS "connection_intent_deliveries" (
+	"interaction_id" uuid PRIMARY KEY NOT NULL,
+	"company_id" uuid NOT NULL,
+	"next_attempt_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"delivered_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'connection_intent_deliveries_interaction_id_issue_thread_interactions_id_fk'::name AND conrelid = 'public.connection_intent_deliveries'::regclass) THEN
+    ALTER TABLE "connection_intent_deliveries" ADD CONSTRAINT "connection_intent_deliveries_interaction_id_issue_thread_interactions_id_fk" FOREIGN KEY ("interaction_id") REFERENCES "public"."issue_thread_interactions"("id") ON DELETE cascade ON UPDATE no action;
+  END IF;
+END $$;--> statement-breakpoint
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'connection_intent_deliveries_company_id_companies_id_fk'::name AND conrelid = 'public.connection_intent_deliveries'::regclass) THEN
+    ALTER TABLE "connection_intent_deliveries" ADD CONSTRAINT "connection_intent_deliveries_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;
+  END IF;
+END $$;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "connection_intent_deliveries_pending_idx" ON "connection_intent_deliveries" USING btree ("delivered_at","next_attempt_at");

package/dist/migrations/0247_even_moon_knight.sql

@@ -0,0 +1,2 @@
+-- paperclip:migration-safety-ignore large-create-index-not-concurrently: The migration runner wraps each migration in a transaction, so CONCURRENTLY is unavailable. This narrow partial index enforces crash-safe connection outcome delivery. Deploying on large instances requires a maintenance window for the initial table scan.
+CREATE UNIQUE INDEX IF NOT EXISTS "agent_wakeup_requests_connection_intent_delivery_idempotency_uq" ON "agent_wakeup_requests" USING btree ("company_id","idempotency_key") WHERE "agent_wakeup_requests"."idempotency_key" LIKE 'connection-intent:%' AND "agent_wakeup_requests"."status" NOT IN ('skipped', 'failed', 'cancelled');

package/dist/migrations/0248_small_manta.sql

@@ -0,0 +1,36 @@
+-- Preview checkouts used earlier migration numbers; retain their goal state.
+CREATE TABLE IF NOT EXISTS "agent_session_goal_actions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"session_id" uuid NOT NULL,
+	"request_id" text NOT NULL,
+	"action" text NOT NULL,
+	"payload_json" jsonb NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"result_json" jsonb,
+	"error" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"delivered_at" timestamp with time zone,
+	"completed_at" timestamp with time zone,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "agent_task_sessions" ADD COLUMN IF NOT EXISTS "goal_capability_json" jsonb;--> statement-breakpoint
+ALTER TABLE "agent_task_sessions" ADD COLUMN IF NOT EXISTS "goal_json" jsonb;--> statement-breakpoint
+ALTER TABLE "agent_task_sessions" ADD COLUMN IF NOT EXISTS "goal_status" text;--> statement-breakpoint
+ALTER TABLE "agent_task_sessions" ADD COLUMN IF NOT EXISTS "goal_desired_state" text;--> statement-breakpoint
+ALTER TABLE "agent_task_sessions" ADD COLUMN IF NOT EXISTS "goal_source_id" text;--> statement-breakpoint
+ALTER TABLE "agent_task_sessions" ADD COLUMN IF NOT EXISTS "goal_source_cursor" bigint;--> statement-breakpoint
+ALTER TABLE "agent_task_sessions" ADD COLUMN IF NOT EXISTS "goal_revision" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "agent_task_sessions" ADD COLUMN IF NOT EXISTS "goal_observed_at" timestamp with time zone;--> statement-breakpoint
+DO $$ BEGIN
+  ALTER TABLE "agent_session_goal_actions" ADD CONSTRAINT "agent_session_goal_actions_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE no action ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL;
+END $$;--> statement-breakpoint
+DO $$ BEGIN
+  ALTER TABLE "agent_session_goal_actions" ADD CONSTRAINT "agent_session_goal_actions_session_id_agent_task_sessions_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."agent_task_sessions"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL;
+END $$;--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "agent_session_goal_actions_session_request_uniq" ON "agent_session_goal_actions" USING btree ("session_id","request_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "agent_session_goal_actions_company_status_created_idx" ON "agent_session_goal_actions" USING btree ("company_id","status","created_at");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "agent_session_goal_actions_session_created_idx" ON "agent_session_goal_actions" USING btree ("session_id","created_at");