@triagepilot/db 1.1.0

package/migrations/0006_decision_outbox.sql

@@ -0,0 +1,24 @@
+create table decision_outbox (
+  id uuid primary key default gen_random_uuid(),
+  workspace_id uuid not null,
+  decision_id uuid not null,
+  schema_version integer not null,
+  payload jsonb not null,
+  occurred_at timestamptz not null,
+  available_at timestamptz not null default now(),
+  published_at timestamptz,
+  attempt_count integer not null default 0,
+  last_error text,
+  constraint decision_outbox_workspace_fkey
+    foreign key (workspace_id) references workspaces(id) on delete cascade,
+  constraint decision_outbox_workspace_decision_fkey
+    foreign key (workspace_id, decision_id)
+    references routing_decisions(workspace_id, id) on delete cascade,
+  constraint decision_outbox_workspace_decision_schema_key
+    unique (workspace_id, decision_id, schema_version),
+  constraint decision_outbox_attempt_count_check check (attempt_count >= 0)
+);
+
+create index decision_outbox_claim_idx
+  on decision_outbox (available_at, occurred_at)
+  where published_at is null;

package/migrations/0007_workspace_reviewer_availability.sql

@@ -0,0 +1,192 @@
+create table workspace_operational_settings (
+  workspace_id uuid primary key references workspaces(id) on delete cascade,
+  timezone text not null default 'UTC',
+  updated_at timestamptz not null default now()
+);
+
+insert into workspace_operational_settings (workspace_id, timezone, updated_at)
+select workspaces.id, organization_settings.timezone, organization_settings.updated_at
+from workspaces
+cross join organization_settings
+where organization_settings.id = true;
+
+drop table organization_settings;
+
+alter table reviewer_absences drop constraint reviewer_absences_no_overlap;
+drop index reviewer_absences_active_lookup;
+
+alter table reviewer_absences
+  add column workspace_id uuid,
+  add column provider text,
+  add column provider_connection_id uuid;
+
+update reviewer_absences
+set workspace_id = local_connection.workspace_id,
+    provider = local_connection.provider,
+    provider_connection_id = local_connection.id
+from (
+  select connections.id, connections.workspace_id, connections.provider
+  from provider_connections connections
+  join workspaces on workspaces.id = connections.workspace_id
+  where workspaces.external_key = 'self-hosted'
+    and connections.status = 'active'
+  order by connections.created_at, connections.id
+  limit 1
+) local_connection;
+
+alter table reviewer_absences rename column reviewer_handle to external_actor_id;
+alter table reviewer_absences drop constraint reviewer_absences_normalized_handle;
+alter table reviewer_absences alter column workspace_id set not null;
+alter table reviewer_absences alter column provider set not null;
+alter table reviewer_absences alter column provider_connection_id set not null;
+alter table reviewer_absences
+  add constraint reviewer_absences_workspace_fkey
+  foreign key (workspace_id) references workspaces(id) on delete cascade;
+alter table reviewer_absences
+  add constraint reviewer_absences_workspace_provider_connection_fkey
+  foreign key (workspace_id, provider, provider_connection_id)
+  references provider_connections(workspace_id, provider, id) on delete cascade;
+alter table reviewer_absences
+  add constraint reviewer_absences_scoped_id_key
+  unique (workspace_id, provider, provider_connection_id, id);
+alter table reviewer_absences
+  add constraint reviewer_absences_no_overlap exclude using gist (
+    workspace_id with =,
+    provider with =,
+    provider_connection_id with =,
+    external_actor_id with =,
+    tstzrange(start_at, end_at, '[)') with &&
+  ) where (status = 'scheduled');
+
+create index reviewer_absences_active_lookup
+  on reviewer_absences (
+    workspace_id, provider, provider_connection_id, external_actor_id, start_at, end_at
+  )
+  where status = 'scheduled';
+
+alter table reviewer_replacements
+  add column workspace_id uuid,
+  add column provider text,
+  add column provider_connection_id uuid,
+  add column state text not null default 'completed',
+  add column last_error text;
+
+update reviewer_replacements replacements
+set workspace_id = absences.workspace_id,
+    provider = absences.provider,
+    provider_connection_id = absences.provider_connection_id
+from reviewer_absences absences
+where absences.id = replacements.absence_id;
+
+alter table reviewer_replacements rename column unavailable_reviewer to unavailable_actor_id;
+alter table reviewer_replacements rename column replacement_reviewer to replacement_actor_id;
+alter table reviewer_replacements alter column workspace_id set not null;
+alter table reviewer_replacements alter column provider set not null;
+alter table reviewer_replacements alter column provider_connection_id set not null;
+alter table reviewer_replacements drop constraint reviewer_replacements_absence_id_fkey;
+alter table reviewer_replacements drop constraint reviewer_replacements_decision_id_fkey;
+do $$
+declare
+  historical_source_key name;
+begin
+  select constraint_name into historical_source_key
+  from information_schema.table_constraints
+  where table_schema = 'public'
+    and table_name = 'reviewer_replacements'
+    and constraint_type = 'UNIQUE';
+  execute format(
+    'alter table reviewer_replacements drop constraint %I',
+    historical_source_key
+  );
+end
+$$;
+alter table reviewer_replacements
+  add constraint reviewer_replacements_workspace_fkey
+  foreign key (workspace_id) references workspaces(id) on delete cascade;
+alter table reviewer_replacements
+  add constraint reviewer_replacements_workspace_provider_connection_fkey
+  foreign key (workspace_id, provider, provider_connection_id)
+  references provider_connections(workspace_id, provider, id) on delete cascade;
+alter table reviewer_replacements
+  add constraint reviewer_replacements_scoped_absence_fkey
+  foreign key (workspace_id, provider, provider_connection_id, absence_id)
+  references reviewer_absences(workspace_id, provider, provider_connection_id, id);
+alter table reviewer_replacements
+  add constraint reviewer_replacements_workspace_decision_fkey
+  foreign key (workspace_id, decision_id)
+  references routing_decisions(workspace_id, id) on delete cascade;
+alter table reviewer_replacements
+  add constraint reviewer_replacements_scoped_source_key
+  unique (
+    workspace_id, provider, provider_connection_id,
+    absence_id, absence_revision, decision_id
+  );
+alter table reviewer_replacements
+  add constraint reviewer_replacements_workspace_id_key
+  unique (workspace_id, id);
+
+drop index reviewer_replacements_absence_history;
+create index reviewer_replacements_absence_history
+  on reviewer_replacements (
+    workspace_id, provider, provider_connection_id, absence_id, completed_at desc, id desc
+  );
+
+alter table routing_decisions add column change_request_id text;
+
+update routing_decisions decisions
+set change_request_id = outbox.payload ->> 'changeRequestId'
+from decision_outbox outbox
+where outbox.workspace_id = decisions.workspace_id
+  and outbox.decision_id = decisions.id
+  and outbox.schema_version = 1
+  and jsonb_typeof(outbox.payload -> 'changeRequestId') = 'string'
+  and length(outbox.payload ->> 'changeRequestId') > 0;
+
+alter table decision_outbox
+  add column event_id text,
+  add column event_type text,
+  add column reviewer_replacement_id uuid;
+
+update decision_outbox
+set event_id = coalesce(
+      payload ->> 'eventId',
+      'decision:' || decision_id::text || ':v' || schema_version::text
+    ),
+    event_type = coalesce(payload ->> 'eventType', 'routing_decision'),
+    payload = payload || jsonb_build_object(
+      'eventId', coalesce(
+        payload ->> 'eventId',
+        'decision:' || decision_id::text || ':v' || schema_version::text
+      ),
+      'eventType', coalesce(payload ->> 'eventType', 'routing_decision')
+    );
+
+alter table decision_outbox alter column event_id set not null;
+alter table decision_outbox alter column event_type set not null;
+alter table decision_outbox alter column decision_id drop not null;
+alter table decision_outbox drop constraint decision_outbox_workspace_decision_fkey;
+alter table decision_outbox drop constraint decision_outbox_workspace_decision_schema_key;
+alter table decision_outbox
+  add constraint decision_outbox_workspace_decision_fkey
+  foreign key (workspace_id, decision_id)
+  references routing_decisions(workspace_id, id) on delete cascade;
+alter table decision_outbox
+  add constraint decision_outbox_workspace_reviewer_replacement_fkey
+  foreign key (workspace_id, reviewer_replacement_id)
+  references reviewer_replacements(workspace_id, id) on delete cascade;
+alter table decision_outbox
+  add constraint decision_outbox_exactly_one_source
+  check (num_nonnulls(decision_id, reviewer_replacement_id) = 1);
+alter table decision_outbox
+  add constraint decision_outbox_event_type_check
+  check (event_type in ('routing_decision', 'reviewer_replacement'));
+alter table decision_outbox
+  add constraint decision_outbox_event_source_check
+  check (
+    num_nonnulls(decision_id, reviewer_replacement_id) <> 1 or
+    (event_type = 'routing_decision' and decision_id is not null) or
+    (event_type = 'reviewer_replacement' and reviewer_replacement_id is not null)
+  );
+alter table decision_outbox
+  add constraint decision_outbox_workspace_event_key
+  unique (workspace_id, event_id);

package/migrations/0008_reviewer_mutation_intents.sql

@@ -0,0 +1,160 @@
+alter table repositories
+  add constraint repositories_mutation_intent_source_key
+  unique (workspace_id, provider, provider_connection_id, id, external_repository_id);
+
+alter table routing_decisions
+  add constraint routing_decisions_mutation_intent_source_key
+  unique (workspace_id, id, repository_id);
+
+create table reviewer_mutation_intents (
+  id uuid primary key default gen_random_uuid(),
+  workspace_id uuid not null references workspaces(id) on delete cascade,
+  provider text not null,
+  provider_connection_id uuid not null,
+  absence_id uuid not null,
+  absence_revision integer not null check (absence_revision > 0),
+  decision_id uuid not null,
+  repository_record_id uuid not null,
+  repository_id text not null check (length(btrim(repository_id)) > 0),
+  change_request_id text not null check (length(btrim(change_request_id)) > 0),
+  expected_head_revision text not null check (length(btrim(expected_head_revision)) > 0),
+  unavailable_actor_id text not null check (length(btrim(unavailable_actor_id)) > 0),
+  replacement_actor_id text not null check (length(btrim(replacement_actor_id)) > 0),
+  created_at timestamptz not null default now(),
+  constraint reviewer_mutation_intents_workspace_provider_connection_fkey
+    foreign key (workspace_id, provider, provider_connection_id)
+    references provider_connections(workspace_id, provider, id) on delete cascade,
+  constraint reviewer_mutation_intents_scoped_absence_fkey
+    foreign key (workspace_id, provider, provider_connection_id, absence_id)
+    references reviewer_absences(workspace_id, provider, provider_connection_id, id),
+  constraint reviewer_mutation_intents_workspace_decision_fkey
+    foreign key (workspace_id, decision_id, repository_record_id)
+    references routing_decisions(workspace_id, id, repository_id),
+  constraint reviewer_mutation_intents_scoped_repository_fkey
+    foreign key (workspace_id, provider, provider_connection_id, repository_record_id, repository_id)
+    references repositories(workspace_id, provider, provider_connection_id, id, external_repository_id),
+  constraint reviewer_mutation_intents_source_key
+    unique (workspace_id, provider_connection_id, absence_id, absence_revision, decision_id),
+  constraint reviewer_mutation_intents_link_key
+    unique (
+      workspace_id, provider, provider_connection_id,
+      absence_id, absence_revision, decision_id, id
+    )
+);
+
+create function validate_reviewer_mutation_intent_insert() returns trigger
+language plpgsql as $$
+declare
+  current_revision integer;
+begin
+  select revision into current_revision
+  from reviewer_absences
+  where workspace_id = new.workspace_id
+    and provider = new.provider
+    and provider_connection_id = new.provider_connection_id
+    and id = new.absence_id
+  for update;
+  if current_revision is null or current_revision <> new.absence_revision then
+    raise exception 'reviewer mutation intent absence revision is not current';
+  end if;
+  return new;
+end;
+$$;
+
+create trigger reviewer_mutation_intents_validate_insert
+before insert on reviewer_mutation_intents
+for each row execute function validate_reviewer_mutation_intent_insert();
+
+create function reject_reviewer_mutation_intent_update() returns trigger
+language plpgsql as $$
+begin
+  raise exception 'reviewer mutation intents are immutable';
+end;
+$$;
+
+create trigger reviewer_mutation_intents_reject_update
+before update on reviewer_mutation_intents
+for each row execute function reject_reviewer_mutation_intent_update();
+
+alter table reviewer_replacements add column mutation_intent_id uuid;
+alter table reviewer_replacements
+  add constraint reviewer_replacements_mutation_intent_fkey
+  foreign key (
+    workspace_id, provider, provider_connection_id,
+    absence_id, absence_revision, decision_id, mutation_intent_id
+  ) references reviewer_mutation_intents (
+    workspace_id, provider, provider_connection_id,
+    absence_id, absence_revision, decision_id, id
+  );
+alter table reviewer_replacements
+  add constraint reviewer_replacements_replaced_intent_check
+  check (outcome <> 'replaced' or mutation_intent_id is not null) not valid;
+
+alter table reviewer_replacements
+  add constraint reviewer_replacements_state_outcome_check
+  check (
+    (state = 'finalizer_pending'
+      and outcome in ('replaced', 'skipped_policy_satisfied', 'no_replacement_available')
+      and last_error is null)
+    or (state = 'completed' and outcome <> 'permanent_failure' and last_error is null)
+    or (state = 'permanent_failure'
+      and last_error is not null and length(btrim(last_error)) > 0)
+  ) not valid;
+
+create function validate_reviewer_replacement_insert() returns trigger
+language plpgsql as $$
+begin
+  if new.outcome = 'permanent_failure' then
+    if new.state <> 'permanent_failure' or new.last_error is null or length(btrim(new.last_error)) = 0 then
+      raise exception 'permanent reviewer failure requires permanent_failure state and error';
+    end if;
+  elsif new.outcome in ('replaced', 'skipped_policy_satisfied', 'no_replacement_available') then
+    if new.state <> 'finalizer_pending' or new.last_error is not null then
+      raise exception 'mapped reviewer finalizer outcome requires finalizer_pending state';
+    end if;
+  elsif new.state <> 'completed' or new.last_error is not null then
+    raise exception 'reviewer outcome without finalizer requires completed state';
+  end if;
+  return new;
+end;
+$$;
+
+create trigger reviewer_replacements_validate_insert
+before insert on reviewer_replacements
+for each row execute function validate_reviewer_replacement_insert();
+
+create function validate_reviewer_replacement_update() returns trigger
+language plpgsql as $$
+begin
+  if (new.id, new.workspace_id, new.provider, new.provider_connection_id,
+      new.absence_id, new.absence_revision, new.decision_id,
+      new.unavailable_actor_id, new.replacement_actor_id, new.mutation_intent_id,
+      new.outcome, new.reason, new.started_at, new.completed_at)
+    is distinct from
+     (old.id, old.workspace_id, old.provider, old.provider_connection_id,
+      old.absence_id, old.absence_revision, old.decision_id,
+      old.unavailable_actor_id, old.replacement_actor_id, old.mutation_intent_id,
+      old.outcome, old.reason, old.started_at, old.completed_at) then
+    raise exception 'reviewer replacement provenance is immutable';
+  end if;
+  if old.state <> 'finalizer_pending' then
+    raise exception 'terminal reviewer replacement is immutable';
+  end if;
+  if new.state = 'completed' then
+    if new.outcome = 'permanent_failure' or new.last_error is not null then
+      raise exception 'completed reviewer replacement state is malformed';
+    end if;
+  elsif new.state = 'permanent_failure' then
+    if new.last_error is null or length(btrim(new.last_error)) = 0 then
+      raise exception 'permanent reviewer replacement state requires an error';
+    end if;
+  else
+    raise exception 'reviewer replacement may only leave finalizer_pending';
+  end if;
+  return new;
+end;
+$$;
+
+create trigger reviewer_replacements_validate_update
+before update on reviewer_replacements
+for each row execute function validate_reviewer_replacement_update();

package/migrations/0009_provider_connection_revocations.sql

@@ -0,0 +1,18 @@
+alter table provider_connections
+  add constraint provider_connections_status_check
+  check (status in ('active', 'suspended', 'revoked')) not valid;
+
+create table provider_connection_revocations (
+  workspace_id uuid not null references workspaces(id) on delete cascade,
+  provider text not null,
+  external_connection_id text not null,
+  revoked_connection_id uuid not null,
+  revoked_at timestamptz not null,
+  cleanup_completed_at timestamptz,
+  primary key (workspace_id, provider, revoked_connection_id),
+  unique (workspace_id, provider, external_connection_id)
+);
+
+create index provider_connection_revocations_cleanup_idx
+  on provider_connection_revocations (workspace_id, revoked_at, revoked_connection_id)
+  where cleanup_completed_at is null;

package/migrations/0010_provider_connection_preemptive_revocations.sql

@@ -0,0 +1,12 @@
+alter table provider_connection_revocations
+  add column physical_connection_id uuid;
+
+update provider_connection_revocations
+set physical_connection_id = revoked_connection_id;
+
+alter table provider_connection_revocations
+  alter column revoked_connection_id set default gen_random_uuid();
+
+create unique index provider_connection_revocations_physical_key
+  on provider_connection_revocations (workspace_id, provider, physical_connection_id)
+  where physical_connection_id is not null;

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@triagepilot/db",
+  "version": "1.1.0",
+  "license": "FSL-1.1-Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TriagePilot/triage-pilot.git",
+    "directory": "packages/db"
+  },
+  "type": "module",
+  "files": [
+    "dist",
+    "migrations",
+    "LICENSE"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@triagepilot/contracts": "1.1.0",
+    "kysely": "^0.28.17",
+    "pg": "^8.13.1"
+  },
+  "devDependencies": {
+    "@types/pg": "^8.11.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "publishedAt": "2026-09-22T09:41:47.000Z",
+  "futureLicenseEffectiveAt": "2028-09-22T09:41:47.000Z",
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "migrate": "tsx src/migrate.ts"
+  }
+}