@triagepilot/db 1.1.0

package/dist/routing-recovery.js

@@ -0,0 +1,175 @@
+import { sql } from "kysely";
+import { lockProviderConnectionProjection } from "./provider-connections.js";
+export function createWorkspaceRoutingRecoveryRepository(db, workspaceId) {
+    return {
+        findTarget: (request) => findRoutingRecoveryTarget(db, workspaceId, request),
+        findActiveRepository: (input) => findActiveRecoveryRepository(db, workspaceId, input),
+        findActiveExternalConnectionId: (input) => findActiveExternalConnectionId(db, workspaceId, input),
+        enqueue: (input) => enqueueRoutingRecovery(db, workspaceId, input),
+    };
+}
+export async function findRoutingRecoveryTarget(db, workspaceId, request) {
+    if ("decisionId" in request) {
+        const target = await db
+            .selectFrom("routing_decisions")
+            .innerJoin("repositories", (join) => join
+            .onRef("repositories.id", "=", "routing_decisions.repository_id")
+            .onRef("repositories.workspace_id", "=", "routing_decisions.workspace_id"))
+            .innerJoin("provider_connections", (join) => join
+            .onRef("provider_connections.id", "=", "repositories.provider_connection_id")
+            .onRef("provider_connections.workspace_id", "=", "repositories.workspace_id")
+            .onRef("provider_connections.provider", "=", "repositories.provider"))
+            .select([
+            "repositories.provider",
+            "repositories.provider_connection_id",
+            "repositories.external_repository_id",
+            "repositories.owner",
+            "repositories.name",
+            "routing_decisions.change_request_id",
+            "routing_decisions.pull_number",
+        ])
+            .where("routing_decisions.workspace_id", "=", workspaceId)
+            .where("routing_decisions.id", "=", request.decisionId)
+            .where("provider_connections.status", "=", "active")
+            .executeTakeFirst();
+        return target === undefined ? null : toRoutingRecoveryTarget(target);
+    }
+    const reference = request.changeRequest;
+    const target = await db
+        .selectFrom("repositories")
+        .innerJoin("provider_connections", (join) => join
+        .onRef("provider_connections.id", "=", "repositories.provider_connection_id")
+        .onRef("provider_connections.workspace_id", "=", "repositories.workspace_id")
+        .onRef("provider_connections.provider", "=", "repositories.provider"))
+        .select([
+        "repositories.provider",
+        "repositories.provider_connection_id",
+        "repositories.external_repository_id",
+        "repositories.owner",
+        "repositories.name",
+    ])
+        .where("repositories.workspace_id", "=", workspaceId)
+        .where("repositories.provider", "=", reference.repository.provider)
+        .where("repositories.external_repository_id", "=", reference.repository.externalId)
+        .where("repositories.owner", "=", reference.repository.owner)
+        .where("repositories.name", "=", reference.repository.name)
+        .where("provider_connections.status", "=", "active")
+        .executeTakeFirst();
+    if (target === undefined)
+        return null;
+    return toRoutingRecoveryTarget({
+        ...target,
+        change_request_id: reference.externalId,
+        pull_number: reference.number,
+    });
+}
+export async function findActiveRecoveryRepository(db, workspaceId, input) {
+    const matches = await db
+        .selectFrom("repositories")
+        .innerJoin("provider_connections", (join) => join
+        .onRef("provider_connections.id", "=", "repositories.provider_connection_id")
+        .onRef("provider_connections.workspace_id", "=", "repositories.workspace_id")
+        .onRef("provider_connections.provider", "=", "repositories.provider"))
+        .select([
+        "repositories.provider",
+        "repositories.external_repository_id",
+        "repositories.owner",
+        "repositories.name",
+    ])
+        .where("repositories.workspace_id", "=", workspaceId)
+        .where("repositories.provider", "=", input.provider)
+        .where(sql `lower(repositories.owner) = lower(${input.owner})`)
+        .where(sql `lower(repositories.name) = lower(${input.name})`)
+        .where("provider_connections.status", "=", "active")
+        .limit(2)
+        .execute();
+    if (matches.length !== 1)
+        return null;
+    const repository = matches[0];
+    return {
+        provider: repository.provider,
+        externalId: repository.external_repository_id,
+        owner: repository.owner,
+        name: repository.name,
+    };
+}
+export async function findActiveExternalConnectionId(db, workspaceId, input) {
+    const connection = await db.selectFrom("provider_connections")
+        .select("external_connection_id")
+        .where("workspace_id", "=", workspaceId)
+        .where("provider", "=", input.provider)
+        .where("id", "=", input.providerConnectionId)
+        .where("status", "=", "active")
+        .executeTakeFirst();
+    return connection?.external_connection_id ?? null;
+}
+export async function enqueueRoutingRecovery(db, workspaceId, input) {
+    if (!matchesEnqueueScope(workspaceId, input))
+        return null;
+    return await db.transaction().execute(async (trx) => {
+        await lockProviderConnectionProjection(trx, workspaceId);
+        const repository = await trx
+            .selectFrom("repositories")
+            .innerJoin("provider_connections", (join) => join
+            .onRef("provider_connections.id", "=", "repositories.provider_connection_id")
+            .onRef("provider_connections.workspace_id", "=", "repositories.workspace_id")
+            .onRef("provider_connections.provider", "=", "repositories.provider"))
+            .select("repositories.id")
+            .where("repositories.workspace_id", "=", workspaceId)
+            .where("repositories.provider", "=", input.provider)
+            .where("repositories.provider_connection_id", "=", input.providerConnectionId)
+            .where("repositories.external_repository_id", "=", input.payload.changeRequest.repository.externalId)
+            .where("repositories.owner", "=", input.payload.changeRequest.repository.owner)
+            .where("repositories.name", "=", input.payload.changeRequest.repository.name)
+            .where("provider_connections.status", "=", "active")
+            .executeTakeFirst();
+        if (repository === undefined)
+            return null;
+        const inserted = await trx.insertInto("jobs").values({
+            workspace_id: workspaceId,
+            provider: input.provider,
+            provider_connection_id: input.providerConnectionId,
+            kind: "process_pull_request",
+            payload: input.payload,
+            idempotency_key: input.idempotencyKey,
+        }).onConflict((conflict) => conflict
+            .columns(["workspace_id", "idempotency_key"])
+            .doNothing())
+            .returning("id")
+            .executeTakeFirst();
+        if (inserted !== undefined)
+            return { inserted: true, jobId: inserted.id };
+        const existing = await trx.selectFrom("jobs")
+            .select("id")
+            .where("workspace_id", "=", workspaceId)
+            .where("provider", "=", input.provider)
+            .where("provider_connection_id", "=", input.providerConnectionId)
+            .where("kind", "=", "process_pull_request")
+            .where("idempotency_key", "=", input.idempotencyKey)
+            .executeTakeFirst();
+        return existing === undefined ? null : { inserted: false, jobId: existing.id };
+    });
+}
+function matchesEnqueueScope(workspaceId, input) {
+    return input.payload.workspaceId === workspaceId
+        && input.payload.providerConnectionId === input.providerConnectionId
+        && input.payload.changeRequest.repository.provider === input.provider
+        && input.payload.routingKey === input.idempotencyKey;
+}
+function toRoutingRecoveryTarget(input) {
+    if (input.change_request_id === null || input.change_request_id.trim().length === 0
+        || input.pull_number === null || !Number.isSafeInteger(input.pull_number) || input.pull_number < 1) {
+        return null;
+    }
+    return {
+        providerConnectionId: input.provider_connection_id,
+        repository: {
+            provider: input.provider,
+            externalId: input.external_repository_id,
+            owner: input.owner,
+            name: input.name,
+        },
+        changeRequestId: input.change_request_id,
+        changeRequestNumber: input.pull_number,
+    };
+}

package/dist/workspaces.d.ts

@@ -0,0 +1,50 @@
+import type { Kysely } from "kysely";
+import type { WorkspaceId } from "@triagepilot/contracts";
+import type { Database } from "./kysely.js";
+import { type DecisionInput, type HumanReviewPolicyDecision, type PersistedDecision } from "./decisions.js";
+import { type HumanReviewPolicyDeliveryInput, type RoutingDeliveryInput } from "./deliveries.js";
+import { type WorkspaceJobQueue } from "./jobs.js";
+import { type OperationsOverview, type ReadOperationsOverviewInput, type RepositoryConfigurationTarget } from "./operations.js";
+import { type ConfiguredProviderConnectionInput, type ProviderConnectionMetadata, type ProviderConnectionRepositoryUpdateInput } from "./provider-connections.js";
+export declare const LOCAL_WORKSPACE_EXTERNAL_KEY = "self-hosted";
+export declare function ensureLocalWorkspace(db: Kysely<Database>): Promise<WorkspaceId>;
+export interface WorkspaceRepositories {
+    workspaceId: WorkspaceId;
+    jobs: WorkspaceJobQueue;
+    persistDecision(input: DecisionInput): Promise<PersistedDecision>;
+    recordPolicyCheck(input: {
+        decisionId: string;
+        checkRunId: string;
+        state: "in_progress" | "success" | "failure";
+    }): Promise<void>;
+    findLatestHumanReviewPolicyDecision(input: {
+        repositoryId: string;
+        pullNumber: number;
+    }): Promise<HumanReviewPolicyDecision | null>;
+    updatePolicyCheckState(input: {
+        decisionId: string;
+        state: "in_progress" | "success" | "failure";
+    }): Promise<void>;
+    markActionSucceeded(decisionId: string, at: Date): Promise<void>;
+    markActionFailed(decisionId: string, error: string, at: Date): Promise<void>;
+    readOperations(input: ReadOperationsOverviewInput): Promise<OperationsOverview>;
+    findRepositoryConfigurationTarget(repositoryId: string): Promise<RepositoryConfigurationTarget | null>;
+    recoverStaleJobs(now: Date, staleAfterMs?: number): Promise<void>;
+    applyFixedRetention(now: Date): Promise<void>;
+    acceptRoutingDelivery(input: RoutingDeliveryInput): Promise<{
+        inserted: boolean;
+        jobId: string | null;
+    }>;
+    acceptHumanReviewPolicyDelivery(input: HumanReviewPolicyDeliveryInput): Promise<{
+        inserted: boolean;
+        jobId: string | null;
+    }>;
+    activateConfiguredProviderConnection(input: ProviderConnectionMetadata): Promise<void>;
+    upsertConfiguredProviderConnection(input: ConfiguredProviderConnectionInput): Promise<void>;
+    replaceProviderConnectionRepositories(input: ConfiguredProviderConnectionInput): Promise<void>;
+    updateProviderConnectionRepositories(input: ProviderConnectionRepositoryUpdateInput): Promise<void>;
+    suspendConfiguredProviderConnection(input: ProviderConnectionMetadata): Promise<void>;
+    revokeConfiguredProviderConnection(input: Pick<ProviderConnectionMetadata, "provider" | "externalConnectionId">): Promise<void>;
+    cleanupRevokedProviderConnections(now: Date): Promise<number>;
+}
+export declare function createWorkspaceRepositories(db: Kysely<Database>, workspaceId: WorkspaceId): WorkspaceRepositories;

package/dist/workspaces.js

@@ -0,0 +1,43 @@
+import { findLatestHumanReviewPolicyDecision, markActionFailed, markActionSucceeded, persistDecision, recordPolicyCheck, updatePolicyCheckState, } from "./decisions.js";
+import { acceptHumanReviewPolicyDelivery, acceptRoutingDelivery, } from "./deliveries.js";
+import { createWorkspaceJobQueue, recoverStaleJobs } from "./jobs.js";
+import { findRepositoryConfigurationTarget, readOperationsOverview, } from "./operations.js";
+import { activateConfiguredProviderConnection, cleanupRevokedProviderConnections, replaceProviderConnectionRepositories, revokeConfiguredProviderConnection, suspendConfiguredProviderConnection, updateProviderConnectionRepositories, upsertConfiguredProviderConnection, } from "./provider-connections.js";
+import { applyFixedRetention } from "./retention.js";
+export const LOCAL_WORKSPACE_EXTERNAL_KEY = "self-hosted";
+export async function ensureLocalWorkspace(db) {
+    const workspace = await db
+        .insertInto("workspaces")
+        .values({ external_key: LOCAL_WORKSPACE_EXTERNAL_KEY })
+        .onConflict((conflict) => conflict.column("external_key").doUpdateSet({
+        external_key: LOCAL_WORKSPACE_EXTERNAL_KEY,
+    }))
+        .returning("id")
+        .executeTakeFirstOrThrow();
+    return workspace.id;
+}
+export function createWorkspaceRepositories(db, workspaceId) {
+    return {
+        workspaceId,
+        jobs: createWorkspaceJobQueue(db, workspaceId),
+        persistDecision: (input) => persistDecision(db, workspaceId, input),
+        recordPolicyCheck: (input) => recordPolicyCheck(db, workspaceId, input),
+        findLatestHumanReviewPolicyDecision: (input) => findLatestHumanReviewPolicyDecision(db, workspaceId, input),
+        updatePolicyCheckState: (input) => updatePolicyCheckState(db, workspaceId, input),
+        markActionSucceeded: (decisionId, at) => markActionSucceeded(db, workspaceId, decisionId, at),
+        markActionFailed: (decisionId, error, at) => markActionFailed(db, workspaceId, decisionId, error, at),
+        readOperations: (input) => readOperationsOverview(db, workspaceId, input),
+        findRepositoryConfigurationTarget: (repositoryId) => findRepositoryConfigurationTarget(db, workspaceId, repositoryId),
+        recoverStaleJobs: (now, staleAfterMs) => recoverStaleJobs(db, workspaceId, now, staleAfterMs),
+        applyFixedRetention: (now) => applyFixedRetention(db, workspaceId, now),
+        acceptRoutingDelivery: (input) => acceptRoutingDelivery(db, workspaceId, input),
+        acceptHumanReviewPolicyDelivery: (input) => acceptHumanReviewPolicyDelivery(db, workspaceId, input),
+        activateConfiguredProviderConnection: (input) => activateConfiguredProviderConnection(db, workspaceId, input),
+        upsertConfiguredProviderConnection: (input) => upsertConfiguredProviderConnection(db, workspaceId, input),
+        replaceProviderConnectionRepositories: (input) => replaceProviderConnectionRepositories(db, workspaceId, input),
+        updateProviderConnectionRepositories: (input) => updateProviderConnectionRepositories(db, workspaceId, input),
+        suspendConfiguredProviderConnection: (input) => suspendConfiguredProviderConnection(db, workspaceId, input),
+        revokeConfiguredProviderConnection: (input) => revokeConfiguredProviderConnection(db, workspaceId, input),
+        cleanupRevokedProviderConnections: (now) => cleanupRevokedProviderConnections(db, workspaceId, now),
+    };
+}

package/migrations/0001_initial.sql

@@ -0,0 +1,79 @@
+create extension if not exists pgcrypto;
+
+create table installations (
+  id uuid primary key default gen_random_uuid(),
+  github_installation_id bigint unique not null,
+  account_login text not null,
+  account_type text not null,
+  status text not null,
+  permissions jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create unique index one_active_installation_idx on installations (status) where status = 'active';
+
+create table repositories (
+  id uuid primary key default gen_random_uuid(),
+  installation_id uuid not null references installations(id) on delete cascade,
+  github_repository_id bigint unique not null,
+  owner text not null,
+  name text not null,
+  default_branch text,
+  config_state text not null default 'unknown',
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  last_config_mode text not null default 'shadow' check (last_config_mode in ('shadow', 'enforce'))
+);
+
+create table webhook_receipts (
+  delivery_id text primary key,
+  event_name text not null,
+  installation_id bigint,
+  payload_summary jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now()
+);
+
+create table jobs (
+  id uuid primary key default gen_random_uuid(),
+  kind text not null,
+  status text not null default 'queued' check (status in ('queued', 'running', 'succeeded', 'failed')),
+  payload jsonb not null,
+  idempotency_key text not null unique,
+  attempt_count integer not null default 0,
+  max_attempts integer not null default 5,
+  run_at timestamptz not null default now(),
+  locked_at timestamptz,
+  locked_by text,
+  last_error text,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create index jobs_claim_idx on jobs (status, run_at) where status = 'queued';
+
+create table routing_decisions (
+  id uuid primary key default gen_random_uuid(),
+  repository_id uuid references repositories(id) on delete set null,
+  delivery_id text not null,
+  action text not null,
+  risk_score integer not null,
+  selected_reviewer text,
+  no_human_reason text,
+  details jsonb not null,
+  created_at timestamptz not null default now(),
+  mode text not null default 'shadow' check (mode in ('shadow', 'enforce')),
+  action_status text not null default 'not_applied'
+    check (action_status in ('not_applied', 'pending', 'succeeded', 'failed')),
+  action_error text,
+  action_applied_at timestamptz,
+  action_failed_at timestamptz
+);
+
+create unique index routing_decisions_delivery_idx on routing_decisions (delivery_id);
+
+create table worker_heartbeat (
+  id boolean primary key default true check (id),
+  worker_id text not null,
+  heartbeat_at timestamptz not null
+);

package/migrations/0002_selected_reviewers.sql

@@ -0,0 +1,10 @@
+alter table routing_decisions
+  add column selected_reviewers jsonb not null default '[]'::jsonb,
+  add constraint routing_decisions_selected_reviewers_array
+    check (jsonb_typeof(selected_reviewers) = 'array'),
+  add constraint routing_decisions_selected_reviewers_limit
+    check (jsonb_array_length(selected_reviewers) <= 2);
+
+update routing_decisions
+set selected_reviewers = jsonb_build_array(selected_reviewer)
+where selected_reviewer is not null;

package/migrations/0003_human_review_policy.sql

@@ -0,0 +1,10 @@
+alter table routing_decisions
+  add column pull_number integer,
+  add column head_sha text,
+  add column policy_check_run_id bigint,
+  add column policy_check_state text not null default 'not_started',
+  add constraint routing_decisions_policy_check_state
+    check (policy_check_state in ('not_started', 'in_progress', 'success', 'failure'));
+
+create index routing_decisions_human_review_policy_lookup
+  on routing_decisions (repository_id, pull_number, created_at desc);

package/migrations/0004_semantic_routing_deduplication.sql

@@ -0,0 +1,15 @@
+alter table webhook_receipts
+  add column event_action text,
+  add column hook_id text;
+
+alter table routing_decisions
+  add column routing_key text;
+
+update routing_decisions
+  set routing_key = 'legacy:' || delivery_id
+  where routing_key is null;
+
+alter table routing_decisions
+  alter column routing_key set not null;
+
+create unique index routing_decisions_routing_key_idx on routing_decisions (routing_key);

package/migrations/0005_reviewer_availability.sql

@@ -0,0 +1,58 @@
+create extension if not exists btree_gist;
+
+create table organization_settings (
+  id boolean primary key default true check (id),
+  timezone text not null default 'UTC',
+  updated_at timestamptz not null default now()
+);
+
+insert into organization_settings (id, timezone) values (true, 'UTC');
+
+create table reviewer_absences (
+  id uuid primary key default gen_random_uuid(),
+  reviewer_handle text not null,
+  start_at timestamptz not null,
+  end_at timestamptz not null,
+  status text not null default 'scheduled'
+    check (status in ('scheduled', 'cancelled')),
+  revision integer not null default 1 check (revision > 0),
+  cancelled_at timestamptz,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint reviewer_absences_normalized_handle
+    check (reviewer_handle = lower(reviewer_handle) and reviewer_handle ~ '^@[a-z0-9_.-]+$'),
+  constraint reviewer_absences_valid_interval check (end_at > start_at),
+  constraint reviewer_absences_cancelled_at check (
+    (status = 'scheduled' and cancelled_at is null) or
+    (status = 'cancelled' and cancelled_at is not null)
+  ),
+  constraint reviewer_absences_no_overlap exclude using gist (
+    reviewer_handle with =,
+    tstzrange(start_at, end_at, '[)') with &&
+  ) where (status = 'scheduled')
+);
+
+create index reviewer_absences_active_lookup
+  on reviewer_absences (reviewer_handle, start_at, end_at)
+  where status = 'scheduled';
+
+create table reviewer_replacements (
+  id uuid primary key default gen_random_uuid(),
+  absence_id uuid not null references reviewer_absences(id),
+  absence_revision integer not null check (absence_revision > 0),
+  decision_id uuid not null references routing_decisions(id) on delete cascade,
+  unavailable_reviewer text not null,
+  replacement_reviewer text,
+  outcome text not null check (outcome in (
+    'replaced', 'simulated_replacement', 'no_replacement_available',
+    'skipped_approved', 'skipped_closed', 'skipped_changed_head',
+    'skipped_policy_satisfied', 'permanent_failure'
+  )),
+  reason text not null,
+  started_at timestamptz not null,
+  completed_at timestamptz not null,
+  unique (absence_id, absence_revision, decision_id)
+);
+
+create index reviewer_replacements_absence_history
+  on reviewer_replacements (absence_id, completed_at desc, id desc);

package/migrations/0005_workspace_scope.sql

@@ -0,0 +1,198 @@
+create table workspaces (
+  id uuid primary key default gen_random_uuid(),
+  external_key text not null unique,
+  created_at timestamptz not null default now()
+);
+
+insert into workspaces (external_key) values ('self-hosted');
+
+alter table installations rename to provider_connections;
+alter table provider_connections add column workspace_id uuid;
+alter table provider_connections add column provider text default 'github';
+alter table provider_connections rename column github_installation_id to external_connection_id;
+alter table provider_connections alter column external_connection_id type text using external_connection_id::text;
+alter table provider_connections rename column account_login to workspace_login;
+
+update provider_connections
+set workspace_id = (select id from workspaces where external_key = 'self-hosted');
+
+alter table provider_connections alter column workspace_id set not null;
+alter table provider_connections alter column provider set not null;
+alter table provider_connections alter column provider drop default;
+alter table provider_connections
+  add constraint provider_connections_workspace_fkey
+  foreign key (workspace_id) references workspaces(id) on delete cascade;
+alter table provider_connections
+  add constraint provider_connections_workspace_id_key unique (workspace_id, id);
+alter table provider_connections
+  add constraint provider_connections_workspace_provider_id_key unique (workspace_id, provider, id);
+alter table provider_connections drop constraint installations_github_installation_id_key;
+alter table provider_connections
+  add constraint provider_connections_workspace_external_key
+  unique (workspace_id, provider, external_connection_id);
+drop index one_active_installation_idx;
+create unique index one_active_provider_connection_idx
+  on provider_connections (workspace_id, status) where status = 'active';
+
+alter table repositories add column workspace_id uuid;
+alter table repositories add column provider text default 'github';
+alter table repositories rename column installation_id to provider_connection_id;
+alter table repositories rename column github_repository_id to external_repository_id;
+alter table repositories alter column external_repository_id type text using external_repository_id::text;
+
+update repositories repositories
+set workspace_id = provider_connections.workspace_id,
+    provider = provider_connections.provider
+from provider_connections
+where provider_connections.id = repositories.provider_connection_id;
+
+alter table repositories alter column workspace_id set not null;
+alter table repositories alter column provider set not null;
+alter table repositories alter column provider drop default;
+alter table repositories drop constraint repositories_installation_id_fkey;
+alter table repositories drop constraint repositories_github_repository_id_key;
+alter table repositories
+  add constraint repositories_workspace_fkey
+  foreign key (workspace_id) references workspaces(id) on delete cascade;
+alter table repositories
+  add constraint repositories_workspace_provider_connection_fkey
+  foreign key (workspace_id, provider, provider_connection_id)
+  references provider_connections(workspace_id, provider, id) on delete cascade;
+alter table repositories
+  add constraint repositories_workspace_id_key unique (workspace_id, id);
+alter table repositories
+  add constraint repositories_workspace_provider_repository_key
+  unique (workspace_id, provider, external_repository_id);
+
+alter table webhook_receipts add column id uuid default gen_random_uuid();
+alter table webhook_receipts add column workspace_id uuid;
+alter table webhook_receipts add column provider text default 'github';
+alter table webhook_receipts rename column installation_id to external_connection_id;
+alter table webhook_receipts alter column external_connection_id type text using external_connection_id::text;
+
+update webhook_receipts
+set workspace_id = (select id from workspaces where external_key = 'self-hosted');
+
+alter table webhook_receipts alter column id set not null;
+alter table webhook_receipts alter column workspace_id set not null;
+alter table webhook_receipts alter column provider set not null;
+alter table webhook_receipts alter column provider drop default;
+alter table webhook_receipts drop constraint webhook_receipts_pkey;
+alter table webhook_receipts add constraint webhook_receipts_pkey primary key (id);
+alter table webhook_receipts
+  add constraint webhook_receipts_workspace_fkey
+  foreign key (workspace_id) references workspaces(id) on delete cascade;
+alter table webhook_receipts
+  add constraint webhook_receipts_workspace_provider_delivery_key
+  unique (workspace_id, provider, delivery_id);
+
+alter table jobs add column workspace_id uuid;
+alter table jobs add column provider text default 'github';
+alter table jobs add column provider_connection_id uuid;
+
+update jobs jobs
+set workspace_id = (select id from workspaces where external_key = 'self-hosted'),
+    provider = coalesce(jobs.payload -> 'changeRequest' -> 'repository' ->> 'provider', 'github'),
+    provider_connection_id = provider_connections.id
+from provider_connections
+where provider_connections.workspace_id = (select id from workspaces where external_key = 'self-hosted')
+  and provider_connections.external_connection_id = jobs.payload ->> 'providerConnectionId';
+
+update jobs jobs
+set workspace_id = (select id from workspaces where external_key = 'self-hosted'),
+    provider = provider_connections.provider,
+    provider_connection_id = provider_connections.id
+from provider_connections
+where jobs.provider_connection_id is null
+  and provider_connections.workspace_id = (select id from workspaces where external_key = 'self-hosted')
+  and provider_connections.id = (
+    select candidate.id
+    from provider_connections candidate
+    where candidate.workspace_id = provider_connections.workspace_id
+    order by (candidate.status = 'active') desc, candidate.created_at, candidate.id
+    limit 1
+  );
+
+insert into provider_connections (
+  workspace_id, provider, external_connection_id, workspace_login, account_type, status, permissions
+)
+select workspaces.id, 'github', 'legacy', 'self-hosted', 'Organization', 'active', '{}'::jsonb
+from workspaces
+where workspaces.external_key = 'self-hosted'
+  and exists (select 1 from jobs where provider_connection_id is null)
+  and not exists (
+    select 1 from provider_connections where provider_connections.workspace_id = workspaces.id
+  );
+
+update jobs jobs
+set workspace_id = provider_connections.workspace_id,
+    provider = provider_connections.provider,
+    provider_connection_id = provider_connections.id
+from provider_connections
+where jobs.provider_connection_id is null
+  and provider_connections.external_connection_id = 'legacy';
+
+alter table jobs alter column workspace_id set not null;
+alter table jobs alter column provider set not null;
+alter table jobs alter column provider drop default;
+alter table jobs alter column provider_connection_id set not null;
+alter table jobs drop constraint jobs_idempotency_key_key;
+alter table jobs
+  add constraint jobs_workspace_fkey
+  foreign key (workspace_id) references workspaces(id) on delete cascade;
+alter table jobs
+  add constraint jobs_workspace_provider_connection_fkey
+  foreign key (workspace_id, provider, provider_connection_id)
+  references provider_connections(workspace_id, provider, id) on delete cascade;
+alter table jobs
+  add constraint jobs_workspace_id_key unique (workspace_id, id);
+alter table jobs
+  add constraint jobs_workspace_idempotency_key unique (workspace_id, idempotency_key);
+
+alter table routing_decisions add column workspace_id uuid;
+alter table routing_decisions add column organization_config_version text;
+alter table routing_decisions add column repository_config_path text;
+alter table routing_decisions add column repository_config_revision text;
+alter table routing_decisions add column effective_config_hash text;
+alter table routing_decisions add column inheritance_mode text;
+alter table routing_decisions add column config_diagnostics jsonb not null default '[]'::jsonb;
+alter table routing_decisions add column config_sources jsonb not null default '{}'::jsonb;
+
+update routing_decisions decisions
+set workspace_id = coalesce(
+      repositories.workspace_id,
+      (select id from workspaces where external_key = 'self-hosted')
+    ),
+    effective_config_hash = encode(digest(decisions.details::text, 'sha256'), 'hex'),
+    inheritance_mode = 'legacy'
+from repositories
+where repositories.id = decisions.repository_id;
+
+update routing_decisions decisions
+set workspace_id = (select id from workspaces where external_key = 'self-hosted'),
+    effective_config_hash = encode(digest(decisions.details::text, 'sha256'), 'hex'),
+    inheritance_mode = 'legacy'
+where decisions.workspace_id is null;
+
+alter table routing_decisions alter column workspace_id set not null;
+alter table routing_decisions alter column effective_config_hash set not null;
+alter table routing_decisions alter column inheritance_mode set not null;
+alter table routing_decisions
+  add constraint routing_decisions_inheritance_mode_check
+  check (inheritance_mode in ('legacy', 'defaults', 'organization', 'replace', 'inherit'));
+alter table routing_decisions drop constraint routing_decisions_repository_id_fkey;
+alter table routing_decisions
+  add constraint routing_decisions_workspace_fkey
+  foreign key (workspace_id) references workspaces(id) on delete cascade;
+alter table routing_decisions
+  add constraint routing_decisions_workspace_repository_fkey
+  foreign key (workspace_id, repository_id)
+  references repositories(workspace_id, id) on delete set null (repository_id);
+alter table routing_decisions
+  add constraint routing_decisions_workspace_id_key unique (workspace_id, id);
+drop index routing_decisions_delivery_idx;
+create unique index routing_decisions_workspace_delivery_idx
+  on routing_decisions (workspace_id, delivery_id);
+drop index routing_decisions_routing_key_idx;
+create unique index routing_decisions_workspace_routing_key_idx
+  on routing_decisions (workspace_id, routing_key);