@useatlas/create 0.0.6 → 0.0.7

package/templates/nextjs-standalone/src/lib/db/migrations/0000_baseline.sql

@@ -0,0 +1,703 @@
+-- 0000_baseline.sql
+--
+-- Baseline migration: creates all internal DB tables.
+-- Idempotent — uses IF NOT EXISTS so it is safe on existing deployments.
+-- Matches the state of migrateInternalDB() as of v0.9.5.
+--
+-- Future migrations are generated by `drizzle-kit generate` from schema.ts.
+
+-- ── Core tables ─────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS audit_log (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  timestamp TIMESTAMPTZ NOT NULL DEFAULT now(),
+  user_id TEXT,
+  user_label TEXT,
+  auth_mode TEXT NOT NULL,
+  sql TEXT NOT NULL,
+  duration_ms INTEGER NOT NULL,
+  row_count INTEGER,
+  success BOOLEAN NOT NULL,
+  error TEXT,
+  source_id TEXT,
+  source_type TEXT,
+  target_host TEXT,
+  tables_accessed JSONB,
+  columns_accessed JSONB,
+  org_id TEXT,
+  deleted_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_timestamp ON audit_log(timestamp);
+CREATE INDEX IF NOT EXISTS idx_audit_log_user_id ON audit_log(user_id);
+CREATE INDEX IF NOT EXISTS idx_audit_log_source_id ON audit_log(source_id);
+CREATE INDEX IF NOT EXISTS idx_audit_log_tables_accessed ON audit_log USING GIN (tables_accessed);
+CREATE INDEX IF NOT EXISTS idx_audit_log_columns_accessed ON audit_log USING GIN (columns_accessed);
+CREATE INDEX IF NOT EXISTS idx_audit_log_org ON audit_log(org_id);
+CREATE INDEX IF NOT EXISTS idx_audit_log_deleted_at ON audit_log(deleted_at) WHERE deleted_at IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS conversations (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id TEXT,
+  title TEXT,
+  surface TEXT DEFAULT 'web',
+  connection_id TEXT,
+  created_at TIMESTAMPTZ DEFAULT now(),
+  updated_at TIMESTAMPTZ DEFAULT now(),
+  starred BOOLEAN NOT NULL DEFAULT false,
+  share_token VARCHAR(64),
+  share_expires_at TIMESTAMPTZ,
+  share_mode VARCHAR(10) NOT NULL DEFAULT 'public',
+  notebook_state JSONB,
+  org_id TEXT,
+  deleted_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_conversations_user ON conversations(user_id);
+CREATE INDEX IF NOT EXISTS idx_conversations_starred ON conversations(user_id, starred) WHERE starred = true;
+CREATE UNIQUE INDEX IF NOT EXISTS idx_conversations_share_token ON conversations(share_token) WHERE share_token IS NOT NULL;
+DO $$ BEGIN ALTER TABLE conversations ADD CONSTRAINT chk_share_mode CHECK (share_mode IN ('public', 'org')); EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+CREATE INDEX IF NOT EXISTS idx_conversations_org ON conversations(org_id);
+
+CREATE TABLE IF NOT EXISTS messages (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  conversation_id UUID REFERENCES conversations(id) ON DELETE CASCADE,
+  role TEXT NOT NULL,
+  content JSONB NOT NULL,
+  created_at TIMESTAMPTZ DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_messages_conversation ON messages(conversation_id);
+
+-- ── Slack integration ───────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS slack_installations (
+  team_id TEXT PRIMARY KEY,
+  bot_token TEXT NOT NULL,
+  org_id TEXT,
+  workspace_name TEXT,
+  installed_at TIMESTAMPTZ DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_slack_installations_org ON slack_installations(org_id);
+
+CREATE TABLE IF NOT EXISTS slack_threads (
+  thread_ts TEXT NOT NULL,
+  channel_id TEXT NOT NULL,
+  conversation_id UUID NOT NULL,
+  PRIMARY KEY (thread_ts, channel_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_slack_threads_conversation ON slack_threads(conversation_id);
+
+-- ── Action framework ────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS action_log (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  requested_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  resolved_at TIMESTAMPTZ,
+  executed_at TIMESTAMPTZ,
+  requested_by TEXT,
+  approved_by TEXT,
+  auth_mode TEXT NOT NULL,
+  action_type TEXT NOT NULL,
+  target TEXT NOT NULL,
+  summary TEXT NOT NULL,
+  payload JSONB NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  result JSONB,
+  error TEXT,
+  rollback_info JSONB,
+  conversation_id UUID,
+  request_id TEXT,
+  org_id TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_action_log_requested_by ON action_log(requested_by);
+CREATE INDEX IF NOT EXISTS idx_action_log_status ON action_log(status);
+CREATE INDEX IF NOT EXISTS idx_action_log_action_type ON action_log(action_type);
+CREATE INDEX IF NOT EXISTS idx_action_log_conversation ON action_log(conversation_id);
+CREATE INDEX IF NOT EXISTS idx_action_log_org ON action_log(org_id);
+
+-- ── Scheduled tasks ─────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS scheduled_tasks (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  owner_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  question TEXT NOT NULL,
+  cron_expression TEXT NOT NULL,
+  delivery_channel TEXT NOT NULL DEFAULT 'webhook',
+  recipients JSONB NOT NULL DEFAULT '[]',
+  connection_id TEXT,
+  approval_mode TEXT NOT NULL DEFAULT 'auto',
+  enabled BOOLEAN NOT NULL DEFAULT true,
+  last_run_at TIMESTAMPTZ,
+  next_run_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  org_id TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_owner ON scheduled_tasks(owner_id);
+CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_enabled ON scheduled_tasks(enabled) WHERE enabled = true;
+CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_next_run ON scheduled_tasks(next_run_at) WHERE enabled = true;
+CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_org ON scheduled_tasks(org_id);
+
+CREATE TABLE IF NOT EXISTS scheduled_task_runs (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  task_id UUID NOT NULL REFERENCES scheduled_tasks(id) ON DELETE CASCADE,
+  started_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  completed_at TIMESTAMPTZ,
+  status TEXT NOT NULL DEFAULT 'running',
+  conversation_id UUID,
+  action_id UUID,
+  error TEXT,
+  tokens_used INTEGER,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  delivery_status TEXT,
+  delivery_error TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_scheduled_task_runs_task ON scheduled_task_runs(task_id);
+CREATE INDEX IF NOT EXISTS idx_scheduled_task_runs_status ON scheduled_task_runs(status);
+
+-- ── Connections ─────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS connections (
+  id TEXT PRIMARY KEY,
+  url TEXT NOT NULL,
+  type TEXT NOT NULL,
+  description TEXT,
+  schema_name TEXT,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW(),
+  org_id TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_connections_org ON connections(org_id);
+
+-- ── Token usage ─────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS token_usage (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id TEXT,
+  conversation_id TEXT,
+  prompt_tokens INTEGER NOT NULL DEFAULT 0,
+  completion_tokens INTEGER NOT NULL DEFAULT 0,
+  model TEXT,
+  provider TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  org_id TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_token_usage_user_id ON token_usage(user_id);
+CREATE INDEX IF NOT EXISTS idx_token_usage_created_at ON token_usage(created_at);
+CREATE INDEX IF NOT EXISTS idx_token_usage_org ON token_usage(org_id);
+
+-- ── Invitations ─────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS invitations (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  email TEXT NOT NULL,
+  role TEXT NOT NULL DEFAULT 'member',
+  token TEXT NOT NULL UNIQUE,
+  status TEXT NOT NULL DEFAULT 'pending',
+  invited_by TEXT,
+  expires_at TIMESTAMPTZ NOT NULL,
+  accepted_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_invitations_email ON invitations(email);
+CREATE INDEX IF NOT EXISTS idx_invitations_token ON invitations(token);
+CREATE INDEX IF NOT EXISTS idx_invitations_status ON invitations(status);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_invitations_pending_email ON invitations(email) WHERE status = 'pending';
+
+-- ── Plugin & app settings ───────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS plugin_settings (
+  plugin_id TEXT PRIMARY KEY,
+  enabled BOOLEAN NOT NULL DEFAULT true,
+  config JSONB,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  org_id TEXT
+);
+
+CREATE TABLE IF NOT EXISTS settings (
+  key TEXT NOT NULL,
+  value TEXT NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_by TEXT,
+  org_id TEXT
+);
+
+-- Drop legacy PK if it exists (from pre-org-scoped schema)
+ALTER TABLE settings DROP CONSTRAINT IF EXISTS settings_pkey;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_settings_key_global ON settings(key) WHERE org_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_settings_key_org ON settings(key, org_id) WHERE org_id IS NOT NULL;
+
+-- ── Semantic entities ───────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS semantic_entities (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT NOT NULL,
+  entity_type TEXT NOT NULL,
+  name TEXT NOT NULL,
+  yaml_content TEXT NOT NULL,
+  connection_id TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_semantic_entities_org_type_name ON semantic_entities(org_id, entity_type, name);
+CREATE INDEX IF NOT EXISTS idx_semantic_entities_org ON semantic_entities(org_id);
+CREATE INDEX IF NOT EXISTS idx_semantic_entities_org_type ON semantic_entities(org_id, entity_type);
+
+-- ── Learned patterns ────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS learned_patterns (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT,
+  pattern_sql TEXT NOT NULL,
+  description TEXT,
+  source_entity TEXT,
+  source_queries JSONB,
+  confidence REAL NOT NULL DEFAULT 0.1,
+  repetition_count INTEGER NOT NULL DEFAULT 1,
+  status TEXT NOT NULL DEFAULT 'pending',
+  proposed_by TEXT,
+  reviewed_by TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  reviewed_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_learned_patterns_org_status ON learned_patterns(org_id, status);
+CREATE INDEX IF NOT EXISTS idx_learned_patterns_org_entity ON learned_patterns(org_id, source_entity);
+
+-- ── Prompt library ──────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS prompt_collections (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT,
+  name TEXT NOT NULL,
+  industry TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  is_builtin BOOLEAN NOT NULL DEFAULT false,
+  sort_order INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_prompt_collections_org ON prompt_collections(org_id);
+CREATE INDEX IF NOT EXISTS idx_prompt_collections_builtin ON prompt_collections(is_builtin) WHERE is_builtin = true;
+
+CREATE TABLE IF NOT EXISTS prompt_items (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  collection_id UUID NOT NULL REFERENCES prompt_collections(id) ON DELETE CASCADE,
+  question TEXT NOT NULL,
+  description TEXT,
+  category TEXT,
+  sort_order INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_prompt_items_collection ON prompt_items(collection_id);
+
+-- ── Query suggestions ───────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS query_suggestions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT,
+  description TEXT NOT NULL,
+  pattern_sql TEXT NOT NULL,
+  normalized_hash TEXT NOT NULL,
+  tables_involved JSONB NOT NULL DEFAULT '[]',
+  primary_table TEXT,
+  frequency INTEGER NOT NULL DEFAULT 1,
+  clicked_count INTEGER NOT NULL DEFAULT 0,
+  score REAL NOT NULL DEFAULT 0,
+  last_seen_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+DO $$ BEGIN
+  ALTER TABLE query_suggestions ADD CONSTRAINT uq_query_suggestions_org_hash UNIQUE NULLS NOT DISTINCT (org_id, normalized_hash);
+EXCEPTION WHEN duplicate_table THEN NULL; WHEN duplicate_object THEN NULL; END $$;
+CREATE INDEX IF NOT EXISTS idx_query_suggestions_org_table ON query_suggestions(org_id, primary_table);
+CREATE INDEX IF NOT EXISTS idx_query_suggestions_org_score ON query_suggestions(org_id, score DESC);
+CREATE INDEX IF NOT EXISTS idx_query_suggestions_tables ON query_suggestions USING GIN(tables_involved);
+
+-- ── Workspace lifecycle (extends Better Auth organization table) ─────────
+-- NOTE: These ALTER TABLEs are conditional — they only run if the organization
+-- table already exists (created by Better Auth migrations, which run separately).
+-- On first boot they are skipped; applied on subsequent restarts.
+
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = 'organization') THEN
+    ALTER TABLE organization ADD COLUMN IF NOT EXISTS workspace_status TEXT NOT NULL DEFAULT 'active';
+    ALTER TABLE organization ADD COLUMN IF NOT EXISTS plan_tier TEXT NOT NULL DEFAULT 'free';
+    ALTER TABLE organization ADD COLUMN IF NOT EXISTS suspended_at TIMESTAMPTZ;
+    ALTER TABLE organization ADD COLUMN IF NOT EXISTS deleted_at TIMESTAMPTZ;
+    ALTER TABLE organization ADD COLUMN IF NOT EXISTS byot BOOLEAN NOT NULL DEFAULT false;
+    ALTER TABLE organization ADD COLUMN IF NOT EXISTS stripe_customer_id TEXT;
+    ALTER TABLE organization ADD COLUMN IF NOT EXISTS trial_ends_at TIMESTAMPTZ;
+    ALTER TABLE organization ADD COLUMN IF NOT EXISTS region TEXT;
+    ALTER TABLE organization ADD COLUMN IF NOT EXISTS region_assigned_at TIMESTAMPTZ;
+
+    BEGIN
+      ALTER TABLE organization ADD CONSTRAINT chk_workspace_status CHECK (workspace_status IN ('active', 'suspended', 'deleted'));
+    EXCEPTION WHEN duplicate_object THEN NULL;
+    END;
+
+    ALTER TABLE organization DROP CONSTRAINT IF EXISTS chk_plan_tier;
+    BEGIN
+      ALTER TABLE organization ADD CONSTRAINT chk_plan_tier CHECK (plan_tier IN ('free', 'trial', 'team', 'enterprise'));
+    EXCEPTION WHEN duplicate_object THEN NULL;
+    END;
+
+    CREATE INDEX IF NOT EXISTS idx_organization_workspace_status ON organization(workspace_status);
+  END IF;
+END $$;
+
+-- ── Usage metering ──────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS usage_events (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  workspace_id TEXT,
+  user_id TEXT,
+  event_type TEXT NOT NULL,
+  quantity INTEGER NOT NULL DEFAULT 1,
+  metadata JSONB,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_usage_events_workspace ON usage_events(workspace_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_usage_events_type ON usage_events(event_type, created_at);
+CREATE INDEX IF NOT EXISTS idx_usage_events_user ON usage_events(user_id, created_at);
+
+CREATE TABLE IF NOT EXISTS usage_summaries (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  workspace_id TEXT NOT NULL,
+  period TEXT NOT NULL,
+  period_start TIMESTAMPTZ NOT NULL,
+  query_count INTEGER NOT NULL DEFAULT 0,
+  token_count INTEGER NOT NULL DEFAULT 0,
+  active_users INTEGER NOT NULL DEFAULT 0,
+  storage_bytes BIGINT NOT NULL DEFAULT 0,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_usage_summaries_ws_period ON usage_summaries(workspace_id, period, period_start);
+CREATE INDEX IF NOT EXISTS idx_usage_summaries_workspace ON usage_summaries(workspace_id, period_start);
+
+-- ── SSO providers ───────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS sso_providers (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT NOT NULL,
+  type TEXT NOT NULL,
+  issuer TEXT NOT NULL,
+  domain TEXT NOT NULL,
+  enabled BOOLEAN NOT NULL DEFAULT false,
+  config JSONB NOT NULL DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  sso_enforced BOOLEAN NOT NULL DEFAULT false
+);
+
+DO $$ BEGIN ALTER TABLE sso_providers ADD CONSTRAINT chk_sso_type CHECK (type IN ('saml', 'oidc')); EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+CREATE INDEX IF NOT EXISTS idx_sso_providers_org ON sso_providers(org_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_sso_providers_domain ON sso_providers(domain);
+CREATE INDEX IF NOT EXISTS idx_sso_providers_enabled ON sso_providers(org_id, enabled) WHERE enabled = true;
+
+-- ── Demo leads ──────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS demo_leads (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  email TEXT NOT NULL UNIQUE,
+  ip_address TEXT,
+  user_agent TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  last_active_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  session_count INTEGER NOT NULL DEFAULT 1
+);
+
+CREATE INDEX IF NOT EXISTS idx_demo_leads_created ON demo_leads(created_at);
+
+-- ── IP allowlist ────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS ip_allowlist (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT NOT NULL,
+  cidr TEXT NOT NULL,
+  description TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  created_by TEXT,
+  UNIQUE(org_id, cidr)
+);
+
+CREATE INDEX IF NOT EXISTS idx_ip_allowlist_org ON ip_allowlist(org_id);
+
+-- ── Custom roles ────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS custom_roles (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  permissions JSONB NOT NULL DEFAULT '[]',
+  is_builtin BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_custom_roles_org_name ON custom_roles(org_id, name);
+CREATE INDEX IF NOT EXISTS idx_custom_roles_org ON custom_roles(org_id);
+CREATE INDEX IF NOT EXISTS idx_custom_roles_builtin ON custom_roles(is_builtin) WHERE is_builtin = true;
+
+-- ── User onboarding ─────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS user_onboarding (
+  user_id TEXT PRIMARY KEY,
+  tour_completed_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- ── Audit retention config ──────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS audit_retention_config (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT NOT NULL UNIQUE,
+  retention_days INTEGER,
+  hard_delete_delay_days INTEGER NOT NULL DEFAULT 30,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_by TEXT,
+  last_purge_at TIMESTAMPTZ,
+  last_purge_count INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_audit_retention_config_org ON audit_retention_config(org_id);
+
+-- ── Workspace model config ──────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS workspace_model_config (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT NOT NULL UNIQUE,
+  provider TEXT NOT NULL,
+  model TEXT NOT NULL,
+  api_key_encrypted TEXT NOT NULL,
+  base_url TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+DO $$ BEGIN ALTER TABLE workspace_model_config ADD CONSTRAINT chk_model_provider CHECK (provider IN ('anthropic', 'openai', 'azure-openai', 'custom')); EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+CREATE INDEX IF NOT EXISTS idx_workspace_model_config_org ON workspace_model_config(org_id);
+
+-- ── Approval rules ──────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS approval_rules (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  rule_type TEXT NOT NULL,
+  pattern TEXT NOT NULL DEFAULT '',
+  threshold INTEGER,
+  enabled BOOLEAN NOT NULL DEFAULT true,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+DO $$ BEGIN ALTER TABLE approval_rules ADD CONSTRAINT chk_approval_rule_type CHECK (rule_type IN ('table', 'column', 'cost')); EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+CREATE INDEX IF NOT EXISTS idx_approval_rules_org ON approval_rules(org_id);
+CREATE INDEX IF NOT EXISTS idx_approval_rules_org_enabled ON approval_rules(org_id) WHERE enabled = true;
+
+-- ── Approval queue ──────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS approval_queue (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT NOT NULL,
+  rule_id UUID NOT NULL,
+  rule_name TEXT NOT NULL,
+  requester_id TEXT NOT NULL,
+  requester_email TEXT,
+  query_sql TEXT NOT NULL,
+  explanation TEXT,
+  connection_id TEXT NOT NULL DEFAULT 'default',
+  tables_accessed JSONB DEFAULT '[]',
+  columns_accessed JSONB DEFAULT '[]',
+  status TEXT NOT NULL DEFAULT 'pending',
+  reviewer_id TEXT,
+  reviewer_email TEXT,
+  review_comment TEXT,
+  reviewed_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + interval '24 hours')
+);
+
+DO $$ BEGIN ALTER TABLE approval_queue ADD CONSTRAINT chk_approval_status CHECK (status IN ('pending', 'approved', 'denied', 'expired')); EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+CREATE INDEX IF NOT EXISTS idx_approval_queue_org_status ON approval_queue(org_id, status);
+CREATE INDEX IF NOT EXISTS idx_approval_queue_expires ON approval_queue(expires_at) WHERE status = 'pending';
+CREATE INDEX IF NOT EXISTS idx_approval_queue_requester ON approval_queue(requester_id);
+
+-- ── Workspace branding ──────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS workspace_branding (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT NOT NULL UNIQUE,
+  logo_url TEXT,
+  logo_text TEXT,
+  primary_color TEXT,
+  favicon_url TEXT,
+  hide_atlas_branding BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_workspace_branding_org ON workspace_branding(org_id);
+
+-- ── Onboarding emails ───────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS onboarding_emails (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  step TEXT NOT NULL,
+  triggered_by TEXT NOT NULL,
+  sent_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_onboarding_emails_user_step ON onboarding_emails(user_id, step);
+CREATE INDEX IF NOT EXISTS idx_onboarding_emails_org ON onboarding_emails(org_id);
+
+-- ── Email preferences ───────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS email_preferences (
+  user_id TEXT PRIMARY KEY,
+  onboarding_emails BOOLEAN NOT NULL DEFAULT true,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- ── Abuse events ────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS abuse_events (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  workspace_id TEXT NOT NULL,
+  level TEXT NOT NULL,
+  trigger_type TEXT NOT NULL,
+  message TEXT NOT NULL,
+  metadata JSONB NOT NULL DEFAULT '{}',
+  actor TEXT NOT NULL DEFAULT 'system',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_abuse_events_workspace ON abuse_events(workspace_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_abuse_events_level ON abuse_events(level);
+
+-- ── Custom domains ──────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS custom_domains (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  workspace_id TEXT NOT NULL,
+  domain TEXT NOT NULL UNIQUE,
+  status TEXT NOT NULL DEFAULT 'pending',
+  railway_domain_id TEXT,
+  cname_target TEXT,
+  certificate_status TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  verified_at TIMESTAMPTZ
+);
+
+DO $$ BEGIN ALTER TABLE custom_domains ADD CONSTRAINT chk_domain_status CHECK (status IN ('pending', 'verified', 'failed')); EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+CREATE INDEX IF NOT EXISTS idx_custom_domains_workspace ON custom_domains(workspace_id);
+CREATE INDEX IF NOT EXISTS idx_custom_domains_status ON custom_domains(status);
+
+-- ── EE: Backups ─────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS backups (
+  id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  size_bytes BIGINT,
+  status TEXT NOT NULL DEFAULT 'in_progress',
+  storage_path TEXT NOT NULL,
+  retention_expires_at TIMESTAMPTZ NOT NULL,
+  error_message TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_backups_status ON backups(status, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS backup_config (
+  id TEXT PRIMARY KEY DEFAULT '_default',
+  schedule TEXT NOT NULL DEFAULT '0 3 * * *',
+  retention_days INT NOT NULL DEFAULT 30,
+  storage_path TEXT NOT NULL DEFAULT './backups',
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- ── EE: PII column classifications ─────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS pii_column_classifications (
+  id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+  org_id TEXT NOT NULL,
+  table_name TEXT NOT NULL,
+  column_name TEXT NOT NULL,
+  connection_id TEXT NOT NULL DEFAULT 'default',
+  category TEXT NOT NULL,
+  confidence TEXT NOT NULL DEFAULT 'medium',
+  masking_strategy TEXT NOT NULL DEFAULT 'partial',
+  reviewed BOOLEAN NOT NULL DEFAULT false,
+  dismissed BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE(org_id, table_name, column_name, connection_id)
+);
+
+-- ── EE: SCIM group mappings ────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS scim_group_mappings (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id TEXT NOT NULL,
+  scim_group_name TEXT NOT NULL,
+  role_name TEXT NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE(org_id, scim_group_name)
+);
+
+-- ── EE: SLA metrics ────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS sla_metrics (
+  id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+  workspace_id TEXT NOT NULL,
+  latency_ms DOUBLE PRECISION NOT NULL,
+  is_error BOOLEAN NOT NULL DEFAULT false,
+  recorded_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_sla_metrics_ws_time ON sla_metrics(workspace_id, recorded_at DESC);
+
+CREATE TABLE IF NOT EXISTS sla_alerts (
+  id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+  workspace_id TEXT NOT NULL,
+  alert_type TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'firing',
+  current_value DOUBLE PRECISION NOT NULL,
+  threshold DOUBLE PRECISION NOT NULL,
+  message TEXT NOT NULL,
+  fired_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  resolved_at TIMESTAMPTZ,
+  acknowledged_at TIMESTAMPTZ,
+  acknowledged_by TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_sla_alerts_ws ON sla_alerts(workspace_id, status);
+
+CREATE TABLE IF NOT EXISTS sla_thresholds (
+  workspace_id TEXT PRIMARY KEY,
+  latency_p99_ms DOUBLE PRECISION NOT NULL DEFAULT 5000,
+  error_rate_pct DOUBLE PRECISION NOT NULL DEFAULT 5,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);