@void/platform 0.20.0 → 0.20.2

package/dist/runtime/drizzle/0039_email_domains.sql

@@ -0,0 +1,32 @@
+CREATE TABLE "email_domains" (
+	"id" text PRIMARY KEY NOT NULL,
+	"project_id" text NOT NULL,
+	"domain" text NOT NULL,
+	"zone_id" text,
+	"account_id" text,
+	"mode" text,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"credential_kind" text NOT NULL,
+	"token_ciphertext" text NOT NULL,
+	"token_iv" text NOT NULL,
+	"token_key_version" text NOT NULL,
+	"relay_ciphertext" text NOT NULL,
+	"relay_iv" text NOT NULL,
+	"relay_key_version" text NOT NULL,
+	"relay_worker_name" text,
+	"relay_version" integer,
+	"token_id" text,
+	"token_expires_on" timestamp,
+	"setup_state" jsonb,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "email_domains_domain_uq" UNIQUE("domain"),
+	CONSTRAINT "email_domains_mode_check" CHECK ("email_domains"."mode" IN ('apex', 'subdomain')),
+	CONSTRAINT "email_domains_status_check" CHECK ("email_domains"."status" IN ('pending', 'active', 'token_revoked', 'token_expired', 'failed')),
+	CONSTRAINT "email_domains_credential_kind_check" CHECK ("email_domains"."credential_kind" IN ('oauth_grant', 'api_token'))
+);
+--> statement-breakpoint
+ALTER TABLE "email_domains" ADD CONSTRAINT "email_domains_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "idx_email_domains_project_id" ON "email_domains" USING btree ("project_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "email_domains_zone_uq" ON "email_domains" USING btree ("zone_id") WHERE "email_domains"."zone_id" IS NOT NULL AND "email_domains"."status" IN ('active', 'pending');--> statement-breakpoint
+CREATE UNIQUE INDEX "email_domains_relay_uq" ON "email_domains" USING btree ("account_id","relay_worker_name") WHERE "email_domains"."relay_worker_name" IS NOT NULL;

package/dist/runtime/drizzle/0040_productive_vector.sql

@@ -0,0 +1 @@
+ALTER TABLE "email_domains" ADD COLUMN "attempt_id" text;

package/dist/runtime/drizzle/0041_military_beyonder.sql

@@ -0,0 +1,119 @@
+CREATE TABLE "platform_auth_attempts" (
+	"id" text PRIMARY KEY NOT NULL,
+	"connection_id" text NOT NULL,
+	"revision" integer NOT NULL,
+	"generation" integer NOT NULL,
+	"purpose" text NOT NULL,
+	"browser_hash" text NOT NULL,
+	"context" jsonb NOT NULL,
+	"expires_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "platform_auth_bootstrap" (
+	"singleton" boolean PRIMARY KEY DEFAULT true NOT NULL,
+	"installation_id" text NOT NULL,
+	"credential_hash" text NOT NULL,
+	"connection_id" text NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"consumed_at" timestamp,
+	CONSTRAINT "platform_auth_bootstrap_singleton" CHECK ("platform_auth_bootstrap"."singleton" = true)
+);
+--> statement-breakpoint
+CREATE TABLE "platform_auth_settings" (
+	"singleton" boolean PRIMARY KEY DEFAULT true NOT NULL,
+	"revision" integer DEFAULT 1 NOT NULL,
+	"admission" jsonb NOT NULL,
+	"protection" jsonb,
+	"session_seconds" integer DEFAULT 2592000 NOT NULL,
+	"sessions_required" boolean DEFAULT false NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "platform_auth_settings_singleton" CHECK ("platform_auth_settings"."singleton" = true),
+	CONSTRAINT "platform_auth_settings_revision" CHECK ("platform_auth_settings"."revision" > 0),
+	CONSTRAINT "platform_auth_settings_session_seconds" CHECK ("platform_auth_settings"."session_seconds" BETWEEN 300 AND 2592000)
+);
+--> statement-breakpoint
+CREATE TABLE "platform_company_identities" (
+	"user_id" text NOT NULL,
+	"issuer" text NOT NULL,
+	"subject" text NOT NULL,
+	CONSTRAINT "platform_company_identities_issuer_subject_pk" PRIMARY KEY("issuer","subject")
+);
+--> statement-breakpoint
+CREATE TABLE "platform_human_sessions" (
+	"id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"connection_id" text NOT NULL,
+	"generation" integer NOT NULL,
+	"audience" text NOT NULL,
+	"access_issuer" text,
+	"access_subject" text,
+	"expires_at" timestamp NOT NULL,
+	"revoked_at" timestamp,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "platform_human_sessions_audience" CHECK ("platform_human_sessions"."audience" IN ('api', 'admin')),
+	CONSTRAINT "platform_human_sessions_access_identity" CHECK (("platform_human_sessions"."access_issuer" IS NULL) = ("platform_human_sessions"."access_subject" IS NULL))
+);
+--> statement-breakpoint
+CREATE TABLE "platform_login_connections" (
+	"id" text PRIMARY KEY NOT NULL,
+	"kind" text NOT NULL,
+	"enabled" boolean DEFAULT false NOT NULL,
+	"active_revision" integer,
+	"revision" integer DEFAULT 1 NOT NULL,
+	"generation" integer DEFAULT 1 NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "platform_login_connections_kind" CHECK ("platform_login_connections"."kind" IN ('github', 'google', 'oidc', 'cloudflare-access')),
+	CONSTRAINT "platform_login_connections_revision" CHECK ("platform_login_connections"."revision" > 0 AND "platform_login_connections"."generation" > 0),
+	CONSTRAINT "platform_login_connections_active_revision" CHECK ("platform_login_connections"."active_revision" IS NULL OR "platform_login_connections"."active_revision" BETWEEN 1 AND "platform_login_connections"."revision"),
+	CONSTRAINT "platform_login_connections_enabled" CHECK (NOT "platform_login_connections"."enabled" OR "platform_login_connections"."active_revision" IS NOT NULL)
+);
+--> statement-breakpoint
+CREATE TABLE "platform_login_identities" (
+	"id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"connection_id" text NOT NULL,
+	"issuer" text NOT NULL,
+	"subject" text NOT NULL,
+	"last_authenticated_at" timestamp DEFAULT now() NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "platform_login_revisions" (
+	"connection_id" text NOT NULL,
+	"revision" integer NOT NULL,
+	"configuration" jsonb NOT NULL,
+	"secret" jsonb NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "platform_login_revisions_connection_id_revision_pk" PRIMARY KEY("connection_id","revision")
+);
+--> statement-breakpoint
+CREATE TABLE "platform_login_tests" (
+	"id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"connection_id" text NOT NULL,
+	"revision" integer NOT NULL,
+	"issuer" text NOT NULL,
+	"subject" text NOT NULL,
+	"expires_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "operator_sessions" ADD COLUMN "human_session_id" text;--> statement-breakpoint
+ALTER TABLE "platform_auth_attempts" ADD CONSTRAINT "platform_auth_attempts_connection_id_platform_login_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "public"."platform_login_connections"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "platform_auth_bootstrap" ADD CONSTRAINT "platform_auth_bootstrap_connection_id_platform_login_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "public"."platform_login_connections"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "platform_company_identities" ADD CONSTRAINT "platform_company_identities_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "platform_human_sessions" ADD CONSTRAINT "platform_human_sessions_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "platform_human_sessions" ADD CONSTRAINT "platform_human_sessions_connection_id_platform_login_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "public"."platform_login_connections"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "platform_login_identities" ADD CONSTRAINT "platform_login_identities_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "platform_login_identities" ADD CONSTRAINT "platform_login_identities_connection_id_platform_login_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "public"."platform_login_connections"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "platform_login_revisions" ADD CONSTRAINT "platform_login_revisions_connection_id_platform_login_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "public"."platform_login_connections"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "platform_login_tests" ADD CONSTRAINT "platform_login_tests_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "platform_login_tests" ADD CONSTRAINT "platform_login_tests_connection_id_platform_login_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "public"."platform_login_connections"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "platform_auth_attempts_expiry" ON "platform_auth_attempts" USING btree ("expires_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "platform_company_identity_user" ON "platform_company_identities" USING btree ("issuer","user_id");--> statement-breakpoint
+CREATE INDEX "platform_human_sessions_connection" ON "platform_human_sessions" USING btree ("connection_id");--> statement-breakpoint
+CREATE INDEX "platform_human_sessions_user" ON "platform_human_sessions" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "platform_human_sessions_expiry" ON "platform_human_sessions" USING btree ("expires_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "platform_login_identity_subject" ON "platform_login_identities" USING btree ("connection_id","issuer","subject");--> statement-breakpoint
+CREATE UNIQUE INDEX "platform_login_identity_user" ON "platform_login_identities" USING btree ("connection_id","user_id");--> statement-breakpoint
+CREATE INDEX "platform_login_tests_expiry" ON "platform_login_tests" USING btree ("expires_at");--> statement-breakpoint
+ALTER TABLE "operator_sessions" ADD CONSTRAINT "operator_sessions_human_session_id_platform_human_sessions_id_fk" FOREIGN KEY ("human_session_id") REFERENCES "public"."platform_human_sessions"("id") ON DELETE cascade ON UPDATE no action;

package/dist/runtime/drizzle/0042_dark_the_anarchist.sql

@@ -0,0 +1 @@
+ALTER TABLE "platform_login_tests" ADD COLUMN "login" text DEFAULT '' NOT NULL;

package/dist/runtime/drizzle/0043_nostalgic_meggan.sql

@@ -0,0 +1,21 @@
+ALTER TABLE "platform_auth_attempts" ALTER COLUMN "expires_at" SET DATA TYPE timestamp with time zone USING "expires_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_auth_bootstrap" ALTER COLUMN "expires_at" SET DATA TYPE timestamp with time zone USING "expires_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_auth_bootstrap" ALTER COLUMN "consumed_at" SET DATA TYPE timestamp with time zone USING "consumed_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_auth_settings" ALTER COLUMN "created_at" SET DATA TYPE timestamp with time zone USING "created_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_auth_settings" ALTER COLUMN "created_at" SET DEFAULT now();--> statement-breakpoint
+ALTER TABLE "platform_human_sessions" ALTER COLUMN "expires_at" SET DATA TYPE timestamp with time zone USING "expires_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_human_sessions" ALTER COLUMN "revoked_at" SET DATA TYPE timestamp with time zone USING "revoked_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_human_sessions" ALTER COLUMN "created_at" SET DATA TYPE timestamp with time zone USING "created_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_human_sessions" ALTER COLUMN "created_at" SET DEFAULT now();--> statement-breakpoint
+ALTER TABLE "platform_login_connections" ALTER COLUMN "created_at" SET DATA TYPE timestamp with time zone USING "created_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_login_connections" ALTER COLUMN "created_at" SET DEFAULT now();--> statement-breakpoint
+ALTER TABLE "platform_login_identities" ALTER COLUMN "last_authenticated_at" SET DATA TYPE timestamp with time zone USING "last_authenticated_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_login_identities" ALTER COLUMN "last_authenticated_at" SET DEFAULT now();--> statement-breakpoint
+ALTER TABLE "platform_login_identities" ALTER COLUMN "created_at" SET DATA TYPE timestamp with time zone USING "created_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_login_identities" ALTER COLUMN "created_at" SET DEFAULT now();--> statement-breakpoint
+ALTER TABLE "platform_login_revisions" ALTER COLUMN "created_at" SET DATA TYPE timestamp with time zone USING "created_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_login_revisions" ALTER COLUMN "created_at" SET DEFAULT now();--> statement-breakpoint
+ALTER TABLE "platform_login_tests" ALTER COLUMN "expires_at" SET DATA TYPE timestamp with time zone USING "expires_at" AT TIME ZONE 'UTC';--> statement-breakpoint
+ALTER TABLE "platform_auth_bootstrap" ADD COLUMN "request_hash" text DEFAULT '' NOT NULL;--> statement-breakpoint
+ALTER TABLE "platform_auth_bootstrap" ADD COLUMN "claim_hash" text;--> statement-breakpoint
+ALTER TABLE "platform_auth_bootstrap" ADD COLUMN "pending_identity" jsonb;

package/dist/runtime/drizzle/0044_smart_mentor.sql

@@ -0,0 +1,15 @@
+CREATE TABLE "project_deploy_credentials" (
+	"id" text PRIMARY KEY NOT NULL,
+	"project_id" text NOT NULL,
+	"issued_by" text NOT NULL,
+	"name" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"revoked_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "project_deploy_credentials_name" CHECK (length("project_deploy_credentials"."name") BETWEEN 1 AND 80)
+);
+--> statement-breakpoint
+ALTER TABLE "project_deploy_credentials" ADD CONSTRAINT "project_deploy_credentials_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "project_deploy_credentials" ADD CONSTRAINT "project_deploy_credentials_issued_by_users_id_fk" FOREIGN KEY ("issued_by") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "project_deploy_credentials_project" ON "project_deploy_credentials" USING btree ("project_id","created_at");--> statement-breakpoint
+CREATE INDEX "project_deploy_credentials_expiry" ON "project_deploy_credentials" USING btree ("expires_at");

package/dist/runtime/drizzle/0045_platform_settings.sql

@@ -0,0 +1,5 @@
+CREATE TABLE "platform_settings" (
+	"key" text PRIMARY KEY NOT NULL,
+	"value" jsonb NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);

package/dist/runtime/drizzle/0046_email_domains_platform_credential.sql

@@ -0,0 +1,8 @@
+ALTER TABLE "email_domains" DROP CONSTRAINT "email_domains_credential_kind_check";--> statement-breakpoint
+ALTER TABLE "email_domains" ALTER COLUMN "token_ciphertext" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "email_domains" ALTER COLUMN "token_iv" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "email_domains" ALTER COLUMN "token_key_version" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "email_domains" ADD COLUMN "managed_by" text DEFAULT 'owner' NOT NULL;--> statement-breakpoint
+ALTER TABLE "email_domains" ADD CONSTRAINT "email_domains_platform_token_check" CHECK (("email_domains"."credential_kind" = 'platform' AND "email_domains"."token_ciphertext" IS NULL AND "email_domains"."token_iv" IS NULL AND "email_domains"."token_key_version" IS NULL) OR ("email_domains"."credential_kind" <> 'platform' AND "email_domains"."token_ciphertext" IS NOT NULL AND "email_domains"."token_iv" IS NOT NULL AND "email_domains"."token_key_version" IS NOT NULL));--> statement-breakpoint
+ALTER TABLE "email_domains" ADD CONSTRAINT "email_domains_managed_by_check" CHECK ("email_domains"."managed_by" IN ('owner', 'admin'));--> statement-breakpoint
+ALTER TABLE "email_domains" ADD CONSTRAINT "email_domains_credential_kind_check" CHECK ("email_domains"."credential_kind" IN ('oauth_grant', 'api_token', 'platform'));

package/dist/runtime/drizzle/0047_email_gateway.sql

@@ -0,0 +1,226 @@
+CREATE TABLE "email_cache_outbox" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"resource_kind" text NOT NULL,
+	"resource_id" text NOT NULL,
+	"version" integer NOT NULL,
+	"payload" jsonb,
+	"published_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "email_credentials" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"managed_by" text NOT NULL,
+	"manager_user_id" text,
+	"kind" text NOT NULL,
+	"account_id" text NOT NULL,
+	"zone_id" text NOT NULL,
+	"ciphertext" text,
+	"iv" text,
+	"key_version" text,
+	"token_id" text,
+	"expires_on" timestamp with time zone,
+	"generation" integer DEFAULT 1 NOT NULL,
+	"status" text DEFAULT 'healthy' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "email_credentials_material_check" CHECK (("email_credentials"."kind" = 'platform' AND "email_credentials"."ciphertext" IS NULL AND "email_credentials"."iv" IS NULL AND "email_credentials"."key_version" IS NULL) OR ("email_credentials"."kind" = 'api_token' AND "email_credentials"."ciphertext" IS NOT NULL AND "email_credentials"."iv" IS NOT NULL AND "email_credentials"."key_version" IS NOT NULL))
+);
+--> statement-breakpoint
+CREATE TABLE "email_domain_routes" (
+	"id" text PRIMARY KEY NOT NULL,
+	"domain" text NOT NULL,
+	"connection_id" text NOT NULL,
+	"project_id" text,
+	"addressing" text NOT NULL,
+	"managed_by" text NOT NULL,
+	"assigned_by_user_id" text,
+	"desired_state" text DEFAULT 'active' NOT NULL,
+	"inbound_status" text DEFAULT 'pending' NOT NULL,
+	"inbound_reason" text,
+	"inbound_observed_at" timestamp with time zone,
+	"outbound_status" text DEFAULT 'pending' NOT NULL,
+	"outbound_reason" text,
+	"outbound_observed_at" timestamp with time zone,
+	"desired_generation" integer DEFAULT 1 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "email_domain_routes_assignment_check" CHECK (("email_domain_routes"."addressing" = 'custom' AND "email_domain_routes"."project_id" IS NOT NULL) OR ("email_domain_routes"."addressing" = 'shared' AND "email_domain_routes"."project_id" IS NULL))
+);
+--> statement-breakpoint
+CREATE TABLE "email_operation_steps" (
+	"id" text PRIMARY KEY NOT NULL,
+	"operation_id" text NOT NULL,
+	"ordinal" integer NOT NULL,
+	"kind" text NOT NULL,
+	"resource_identity" text NOT NULL,
+	"request_digest" text NOT NULL,
+	"attempt" integer DEFAULT 0 NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"outcome" jsonb,
+	"failure_code" text,
+	"failure_detail" text,
+	"started_at" timestamp with time zone,
+	"finished_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE TABLE "email_operations" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"connection_id" text NOT NULL,
+	"route_id" text,
+	"route_generation" integer,
+	"actor_kind" text NOT NULL,
+	"actor_user_id" text,
+	"actor_scope" text NOT NULL,
+	"kind" text NOT NULL,
+	"idempotency_key" text NOT NULL,
+	"request_digest" text NOT NULL,
+	"desired_generation" integer NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"current_step" text,
+	"failure_code" text,
+	"failure_detail" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "email_zone_connections" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"account_id" text NOT NULL,
+	"zone_id" text NOT NULL,
+	"zone_name" text NOT NULL,
+	"managed_by" text NOT NULL,
+	"manager_user_id" text,
+	"credential_id" text,
+	"ingress_worker_name" text NOT NULL,
+	"ingress_version" integer,
+	"desired_generation" integer DEFAULT 1 NOT NULL,
+	"active_secret_generation" integer DEFAULT 0 NOT NULL,
+	"staged_secret_generation" integer,
+	"secret_ciphertext" text NOT NULL,
+	"secret_iv" text NOT NULL,
+	"secret_key_version" text NOT NULL,
+	"staged_secret_ciphertext" text,
+	"staged_secret_iv" text,
+	"staged_secret_key_version" text,
+	"previous_secret_hash" text,
+	"previous_secret_until" timestamp with time zone,
+	"inbound_status" text DEFAULT 'pending' NOT NULL,
+	"inbound_reason" text,
+	"inbound_observed_at" timestamp with time zone,
+	"management_status" text DEFAULT 'probe_failed' NOT NULL,
+	"management_reason" text,
+	"management_observed_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "email_zone_connections_manager_check" CHECK (("email_zone_connections"."managed_by" = 'owner' AND "email_zone_connections"."manager_user_id" IS NOT NULL) OR ("email_zone_connections"."managed_by" = 'admin'))
+);
+--> statement-breakpoint
+CREATE TABLE "email_action_recipients" (
+	"id" text PRIMARY KEY NOT NULL,
+	"action_id" text NOT NULL,
+	"project_id" text NOT NULL,
+	"recipient" text NOT NULL,
+	"state" text NOT NULL,
+	"error_code" text,
+	"provider_reference" text,
+	"reserved_at" timestamp with time zone,
+	"attempt_started_at" timestamp with time zone,
+	"completed_at" timestamp with time zone,
+	CONSTRAINT "email_action_recipients_action_recipient_uq" UNIQUE("action_id","recipient"),
+	CONSTRAINT "email_action_recipients_state_check" CHECK ("email_action_recipients"."state" IN ('rejected', 'reserved', 'attempt_started', 'provider_accepted', 'failed', 'outcome_unknown', 'cancelled'))
+);
+--> statement-breakpoint
+CREATE TABLE "email_actions" (
+	"id" text PRIMARY KEY NOT NULL,
+	"project_id" text NOT NULL,
+	"sender_domain" text NOT NULL,
+	"receipt_id" text,
+	"kind" text NOT NULL,
+	"idempotency_key" text NOT NULL,
+	"payload_digest" text NOT NULL,
+	"transport" text NOT NULL,
+	"policy_version" integer NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "email_actions_project_key_uq" UNIQUE("project_id","idempotency_key"),
+	CONSTRAINT "email_actions_kind_check" CHECK ("email_actions"."kind" IN ('direct', 'forward', 'reply'))
+);
+--> statement-breakpoint
+CREATE TABLE "email_monthly_usage" (
+	"project_id" text NOT NULL,
+	"month" text NOT NULL,
+	"recipient_attempts" integer DEFAULT 0 NOT NULL,
+	"inbound_receipts" integer DEFAULT 0 NOT NULL,
+	CONSTRAINT "email_monthly_usage_project_month_uq" UNIQUE("project_id","month"),
+	CONSTRAINT "email_monthly_usage_nonnegative_check" CHECK ("email_monthly_usage"."recipient_attempts" >= 0),
+	CONSTRAINT "email_monthly_usage_inbound_nonnegative_check" CHECK ("email_monthly_usage"."inbound_receipts" >= 0)
+);
+--> statement-breakpoint
+CREATE TABLE "email_project_controls" (
+	"project_id" text PRIMARY KEY NOT NULL,
+	"monthly_limit" integer DEFAULT 200 NOT NULL,
+	"burst_limit" integer DEFAULT 10 NOT NULL,
+	"suspended_at" timestamp with time zone,
+	"version" integer DEFAULT 1 NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "email_receipts" (
+	"id" text PRIMARY KEY NOT NULL,
+	"project_id" text NOT NULL,
+	"status" text DEFAULT 'received' NOT NULL,
+	"payload_digest" text,
+	"final_reject" boolean,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "email_unresolved_attempts" (
+	"id" text PRIMARY KEY NOT NULL,
+	"project_id" text NOT NULL,
+	"sender_domain" text NOT NULL,
+	"started_at" timestamp with time zone NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "email_domain_routes" ADD CONSTRAINT "email_domain_routes_connection_id_email_zone_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "public"."email_zone_connections"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "email_operation_steps" ADD CONSTRAINT "email_operation_steps_operation_id_email_operations_id_fk" FOREIGN KEY ("operation_id") REFERENCES "public"."email_operations"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "email_operations" ADD CONSTRAINT "email_operations_connection_id_email_zone_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "public"."email_zone_connections"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "email_operations" ADD CONSTRAINT "email_operations_route_id_email_domain_routes_id_fk" FOREIGN KEY ("route_id") REFERENCES "public"."email_domain_routes"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "email_action_recipients" ADD CONSTRAINT "email_action_recipients_action_id_email_actions_id_fk" FOREIGN KEY ("action_id") REFERENCES "public"."email_actions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "email_actions" ADD CONSTRAINT "email_actions_receipt_id_email_receipts_id_fk" FOREIGN KEY ("receipt_id") REFERENCES "public"."email_receipts"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "email_project_controls" ADD CONSTRAINT "email_project_controls_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "email_cache_outbox_version_uq" ON "email_cache_outbox" USING btree ("resource_kind","resource_id","version");--> statement-breakpoint
+CREATE INDEX "email_cache_outbox_pending_idx" ON "email_cache_outbox" USING btree ("published_at","created_at");--> statement-breakpoint
+CREATE INDEX "email_credentials_scope_idx" ON "email_credentials" USING btree ("installation_id","account_id","zone_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "email_domain_routes_domain_uq" ON "email_domain_routes" USING btree ("domain");--> statement-breakpoint
+CREATE INDEX "email_domain_routes_connection_idx" ON "email_domain_routes" USING btree ("connection_id");--> statement-breakpoint
+CREATE INDEX "email_domain_routes_project_idx" ON "email_domain_routes" USING btree ("project_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "email_operation_steps_order_uq" ON "email_operation_steps" USING btree ("operation_id","ordinal");--> statement-breakpoint
+CREATE UNIQUE INDEX "email_operations_key_uq" ON "email_operations" USING btree ("installation_id","actor_scope","idempotency_key");--> statement-breakpoint
+CREATE INDEX "email_operations_work_idx" ON "email_operations" USING btree ("status","updated_at");--> statement-breakpoint
+CREATE INDEX "email_operations_connection_idx" ON "email_operations" USING btree ("connection_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "email_zone_connections_zone_uq" ON "email_zone_connections" USING btree ("installation_id","account_id","zone_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "email_zone_connections_ingress_uq" ON "email_zone_connections" USING btree ("account_id","ingress_worker_name");--> statement-breakpoint
+CREATE INDEX "email_zone_connections_manager_idx" ON "email_zone_connections" USING btree ("manager_user_id");--> statement-breakpoint
+CREATE INDEX "idx_email_action_recipients_project_reserved" ON "email_action_recipients" USING btree ("project_id","reserved_at");--> statement-breakpoint
+CREATE INDEX "idx_email_action_recipients_expiring" ON "email_action_recipients" USING btree ("reserved_at") WHERE "email_action_recipients"."state" = 'reserved';--> statement-breakpoint
+CREATE INDEX "idx_email_actions_project_created" ON "email_actions" USING btree ("project_id","created_at");--> statement-breakpoint
+CREATE INDEX "idx_email_receipts_project_created" ON "email_receipts" USING btree ("project_id","created_at");--> statement-breakpoint
+CREATE INDEX "idx_email_unresolved_attempts_project" ON "email_unresolved_attempts" USING btree ("project_id");--> statement-breakpoint
+CREATE INDEX "idx_email_unresolved_attempts_domain" ON "email_unresolved_attempts" USING btree ("sender_domain");
+--> statement-breakpoint
+CREATE TABLE "email_destination_cleanups" (
+	"cf_destination_id" text PRIMARY KEY NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"attempts" integer DEFAULT 0 NOT NULL,
+	"next_attempt_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"lease_started_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "email_destination_cleanups_status_check" CHECK ("email_destination_cleanups"."status" IN ('pending', 'deleting', 'completed')),
+	CONSTRAINT "email_destination_cleanups_attempts_check" CHECK ("email_destination_cleanups"."attempts" >= 0)
+);
+--> statement-breakpoint
+CREATE INDEX "idx_email_destination_cleanups_due" ON "email_destination_cleanups" USING btree ("status","next_attempt_at","updated_at");

package/dist/runtime/drizzle/0048_project_teams.sql

@@ -0,0 +1,133 @@
+CREATE TABLE "project_access_events" (
+	"id" text PRIMARY KEY NOT NULL,
+	"project_id" text NOT NULL,
+	"actor_user_id" text NOT NULL,
+	"subject_user_id" text,
+	"invitation_email_snapshot" text,
+	"previous_role" text,
+	"new_role" text,
+	"action" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "project_access_events_previous_role_check" CHECK ("project_access_events"."previous_role" IS NULL OR "project_access_events"."previous_role" IN ('reader', 'collaborator', 'admin')),
+	CONSTRAINT "project_access_events_new_role_check" CHECK ("project_access_events"."new_role" IS NULL OR "project_access_events"."new_role" IN ('reader', 'collaborator', 'admin')),
+	CONSTRAINT "project_access_events_action_check" CHECK ("project_access_events"."action" IN ('invited', 'invitation_resent', 'accepted', 'declined', 'invitation_revoked', 'role_changed', 'member_removed', 'left'))
+);
+--> statement-breakpoint
+CREATE TABLE "project_invitations" (
+	"id" text PRIMARY KEY NOT NULL,
+	"project_id" text NOT NULL,
+	"target_user_id" text NOT NULL,
+	"target_email_snapshot" text NOT NULL,
+	"role" text NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"invited_by_user_id" text NOT NULL,
+	"accepted_by_user_id" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"accepted_at" timestamp,
+	"revoked_at" timestamp,
+	"revoked_by_user_id" text,
+	CONSTRAINT "project_invitations_role_check" CHECK ("project_invitations"."role" IN ('reader', 'collaborator', 'admin')),
+	CONSTRAINT "project_invitations_status_check" CHECK ("project_invitations"."status" IN ('pending', 'accepted', 'declined', 'revoked', 'expired'))
+);
+--> statement-breakpoint
+CREATE TABLE "project_members" (
+	"project_id" text NOT NULL,
+	"user_id" text NOT NULL,
+	"role" text NOT NULL,
+	"added_by_user_id" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "project_members_project_id_user_id_pk" PRIMARY KEY("project_id","user_id"),
+	CONSTRAINT "project_members_role_check" CHECK ("project_members"."role" IN ('reader', 'collaborator', 'admin'))
+);
+--> statement-breakpoint
+CREATE TABLE "project_ownership_periods" (
+	"id" text PRIMARY KEY NOT NULL,
+	"project_id" text NOT NULL,
+	"owner_user_id" text NOT NULL,
+	"starts_at" timestamp NOT NULL,
+	"ends_at" timestamp,
+	"changed_by_user_id" text,
+	CONSTRAINT "project_ownership_periods_time_check" CHECK ("project_ownership_periods"."ends_at" IS NULL OR "project_ownership_periods"."ends_at" >= "project_ownership_periods"."starts_at")
+);
+--> statement-breakpoint
+ALTER TABLE "deployments" ADD COLUMN "billing_user_id" text;--> statement-breakpoint
+ALTER TABLE "deployments" ADD COLUMN "initiated_by_user_id" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "idx_project_ownership_periods_open" ON "project_ownership_periods" USING btree ("project_id") WHERE "project_ownership_periods"."ends_at" IS NULL;--> statement-breakpoint
+CREATE FUNCTION "void_set_missing_deployment_billing_user_id"()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+	IF NEW."billing_user_id" IS NULL THEN
+		SELECT "project"."user_id"
+		INTO NEW."billing_user_id"
+		FROM "public"."projects" AS "project"
+		WHERE "project"."id" = NEW."project_id";
+	END IF;
+	RETURN NEW;
+END;
+$$;--> statement-breakpoint
+CREATE TRIGGER "deployments_set_missing_billing_user_id"
+BEFORE INSERT ON "deployments"
+FOR EACH ROW
+WHEN (NEW."billing_user_id" IS NULL)
+EXECUTE FUNCTION "void_set_missing_deployment_billing_user_id"();--> statement-breakpoint
+CREATE FUNCTION "void_create_initial_project_ownership_period"()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+	INSERT INTO "public"."project_ownership_periods" (
+		"id",
+		"project_id",
+		"owner_user_id",
+		"starts_at"
+	)
+	VALUES (
+		'pown_' || NEW."id",
+		NEW."id",
+		NEW."user_id",
+		NEW."created_at"
+	)
+	ON CONFLICT DO NOTHING;
+	RETURN NEW;
+END;
+$$;--> statement-breakpoint
+CREATE TRIGGER "projects_create_initial_ownership_period"
+AFTER INSERT ON "projects"
+FOR EACH ROW
+EXECUTE FUNCTION "void_create_initial_project_ownership_period"();--> statement-breakpoint
+UPDATE "deployments" AS "deployment"
+SET "billing_user_id" = "project"."user_id"
+FROM "projects" AS "project"
+WHERE "deployment"."project_id" = "project"."id"
+	AND "deployment"."billing_user_id" IS NULL;--> statement-breakpoint
+INSERT INTO "project_ownership_periods" (
+	"id",
+	"project_id",
+	"owner_user_id",
+	"starts_at"
+)
+SELECT
+	'pown_' || "project"."id",
+	"project"."id",
+	"project"."user_id",
+	"project"."created_at"
+FROM "projects" AS "project"
+ON CONFLICT DO NOTHING;--> statement-breakpoint
+ALTER TABLE "project_access_events" ADD CONSTRAINT "project_access_events_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "project_invitations" ADD CONSTRAINT "project_invitations_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "project_invitations" ADD CONSTRAINT "project_invitations_target_user_id_users_id_fk" FOREIGN KEY ("target_user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "project_members" ADD CONSTRAINT "project_members_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "project_members" ADD CONSTRAINT "project_members_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "project_ownership_periods" ADD CONSTRAINT "project_ownership_periods_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "idx_project_access_events_project_created" ON "project_access_events" USING btree ("project_id","created_at");--> statement-breakpoint
+CREATE INDEX "idx_project_access_events_subject_created" ON "project_access_events" USING btree ("subject_user_id","created_at");--> statement-breakpoint
+CREATE INDEX "idx_project_invitations_project_status" ON "project_invitations" USING btree ("project_id","status");--> statement-breakpoint
+CREATE INDEX "idx_project_invitations_target_status" ON "project_invitations" USING btree ("target_user_id","status");--> statement-breakpoint
+CREATE UNIQUE INDEX "idx_project_invitations_pending_target" ON "project_invitations" USING btree ("project_id","target_user_id") WHERE "project_invitations"."status" = 'pending';--> statement-breakpoint
+CREATE INDEX "idx_project_members_user_project" ON "project_members" USING btree ("user_id","project_id");--> statement-breakpoint
+CREATE INDEX "idx_project_ownership_periods_owner_time" ON "project_ownership_periods" USING btree ("owner_user_id","starts_at","ends_at");--> statement-breakpoint
+CREATE INDEX "idx_project_ownership_periods_project_time" ON "project_ownership_periods" USING btree ("project_id","starts_at");

package/dist/runtime/drizzle/compatibility.json

@@ -21,6 +21,10 @@
     {
       "platformVersion": "0.10.14",
       "schemaDigest": "3dbf4c31d4bc97a11edca35c59b34ffad1f072df0ad7174d69e2de1057e2610b"
+    },
+    {
+      "platformVersion": "0.20.1",
+      "schemaDigest": "6de871d9524b082bba675d0d653ade45f95206895a962fea2b9be4b85d486313"
     }
   ]
 }