anbaric-cloud-hosting 1.42.0 → 1.44.0

package/README.md

@@ -74,3 +74,10 @@ they are persisted.
 
 Postgres schema management is automatic on boot (`ensureSchema`): workflow
 tables in `public`, platform tables in `anbaric_system`.
+
+Schema changes are migrations. `src/data-store/PlatformMigrations.ts` lists them
+in order, each with a stable id; `migrate` records the ids it has applied in
+`anbaric_schema_migrations`, takes an advisory lock so two instances starting
+together take turns, and runs each migration in its own transaction. A migration
+that fails stops the boot. To change the schema, append a numbered entry —
+never edit one that has shipped, and never reuse an id.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.42.0",
+  "version": "1.44.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.42.0",
-    "anbaric-plugins": "^1.42.0",
-    "anbaric-tsapi": "^1.42.0",
-    "anbaric-web": "^1.42.0",
+    "anbaric-data-store": "^1.44.0",
+    "anbaric-plugins": "^1.44.0",
+    "anbaric-tsapi": "^1.44.0",
+    "anbaric-web": "^1.44.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.42.0",
-    "anbaric-state-machine": "^1.42.0",
+    "anbaric-impl-cloud": "^1.44.0",
+    "anbaric-state-machine": "^1.44.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/CliKey.ts

@@ -1,3 +1,5 @@
+import {TenantRole} from "./TenantRole";
+
 class CliKey {
 
     readonly id : string;
@@ -5,16 +7,20 @@ class CliKey {
     readonly clientName : string;
     readonly publicKey : string;
     readonly tenant? : string;
+    // The role the key's owner held in that tenant when it was issued; the
+    // platform re-reads it on every lookup, so a demotion takes effect at once.
+    readonly tenantRole? : TenantRole;
     readonly createdAt : Date;
 
     constructor(id : string, userId : string, clientName : string, publicKey : string,
-                tenant? : string, createdAt : Date = new Date()) {
+                tenant? : string, createdAt : Date = new Date(), tenantRole? : TenantRole) {
         this.id = id;
         this.userId = userId;
         this.clientName = clientName;
         this.publicKey = publicKey;
         this.tenant = tenant;
         this.createdAt = createdAt;
+        this.tenantRole = tenantRole;
     }
 
 }

package/src/auth/HttpCliKeyStore.ts

@@ -1,5 +1,6 @@
 import {CliKey} from "./CliKey";
 import {CliKeyStore} from "./CliKeyStore";
+import {TenantRole} from "./TenantRole";
 
 type FetchFn = (url : string, init : RequestInit) => Promise<Response>;
 
@@ -44,8 +45,10 @@ class HttpCliKeyStore implements CliKeyStore {
         if (response.status === 404) return undefined;
         if (!response.ok) throw new Error(`The key lookup failed with status ${response.status}`);
 
-        const found = await response.json() as { userId : string, clientName? : string, publicKey : string, tenant? : string };
-        return new CliKey(id, found.userId, found.clientName ?? "", found.publicKey, found.tenant ?? undefined);
+        const found = await response.json() as
+            { userId : string, clientName? : string, publicKey : string, tenant? : string, tenantRole? : TenantRole };
+        return new CliKey(id, found.userId, found.clientName ?? "", found.publicKey, found.tenant ?? undefined,
+            new Date(), found.tenantRole);
     }
 
 }

package/src/auth/HttpMembershipService.ts

@@ -1,40 +1,66 @@
 import {Inviter, MembershipService, PendingInvitation} from "./MembershipService";
+import {isTenantRole, TenantRole} from "./TenantRole";
 
 type FetchFn = (url : string, init : RequestInit) => Promise<Response>;
 
-/* Talks to the central login's invitation endpoints for one tenant, with the
-   same central api key the platform already holds for CLI key lookups. */
+const ROLE_CACHE_TTL_MS = 60_000;
+
+/* Talks to the central login about this one tenant, with the same central api
+   key the platform already holds for CLI key lookups. Roles are cached briefly
+   - every authenticated request asks for one, and a minute's staleness on a
+   role change is a fair trade for not calling central on each of them. */
 class HttpMembershipService implements MembershipService {
 
+    private roles = new Map<string, { role : TenantRole | undefined, expires : number }>();
+
     constructor(private centralUrl : string, private secret : string, private tenantSlug : string,
-                private fetchFn : FetchFn = (url, init) => fetch(url, init)) {}
+                private fetchFn : FetchFn = (url, init) => fetch(url, init),
+                private cacheTtlMs : number = ROLE_CACHE_TTL_MS) {}
+
+    async roleFor(userId : string) : Promise<TenantRole | undefined> {
+        const cached = this.roles.get(userId);
+        if (cached && cached.expires > Date.now()) return cached.role;
+
+        const response = await this.call("GET", `/members/${encodeURIComponent(userId)}`, undefined, [404]);
+        const role = response.status === 404
+            ? undefined
+            : (await response.json() as { role? : unknown }).role;
+        const found = isTenantRole(role) ? role : undefined;
+
+        this.roles.set(userId, { role: found, expires: Date.now() + this.cacheTtlMs });
+        return found;
+    }
 
-    async invite(email : string, invitedBy : Inviter) : Promise<PendingInvitation> {
-        const response = await this.call("POST", "", { email, invitedBy });
+    async invite(email : string, role : TenantRole, invitedBy : Inviter) : Promise<PendingInvitation> {
+        const response = await this.call("POST", "/invitations", { email, role, invitedBy });
         return await response.json() as PendingInvitation;
     }
 
-    async pending() : Promise<Array<PendingInvitation>> {
-        const response = await this.call("GET", "");
+    async pending(asking : Inviter) : Promise<Array<PendingInvitation>> {
+        const response = await this.call("GET", "/invitations", undefined, [], asking);
         return await response.json() as Array<PendingInvitation>;
     }
 
-    async revoke(token : string) : Promise<boolean> {
-        const response = await this.call("DELETE", `/${encodeURIComponent(token)}`, undefined, [404]);
+    async revoke(token : string, asking : Inviter) : Promise<boolean> {
+        const response = await this.call("DELETE", `/invitations/${encodeURIComponent(token)}`, undefined, [403, 404], asking);
         return response.status === 204;
     }
 
-    private async call(method : string, path : string, body? : unknown, tolerated : Array<number> = []) : Promise<Response> {
+    private async call(method : string, path : string, body? : unknown,
+                       tolerated : Array<number> = [], asking? : Inviter) : Promise<Response> {
         const headers : Record<string, string> = { "x-anbaric-central-key": this.secret };
         if (body !== undefined) headers["content-type"] = "application/json";
+        // Central checks the acting person's role, not just the api key, so who
+        // is asking travels on every call that is not already carrying them.
+        if (asking) headers["x-anbaric-user"] = asking.id;
 
         const response = await this.fetchFn(
-            `${this.centralUrl.replace(/\/$/, "")}/tenants/${encodeURIComponent(this.tenantSlug)}/invitations${path}`,
+            `${this.centralUrl.replace(/\/$/, "")}/tenants/${encodeURIComponent(this.tenantSlug)}${path}`,
             { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
 
         if (! response.ok && ! tolerated.includes(response.status)) {
             const problem = await response.json().catch(() => ({})) as { error? : string };
-            throw new Error(problem.error ?? `The invitation request failed with status ${response.status}`);
+            throw new Error(problem.error ?? `The request to the central login failed with status ${response.status}`);
         }
         return response;
     }

package/src/auth/InMemoryMembershipService.ts

@@ -1,19 +1,29 @@
 import {randomUUID} from "node:crypto";
 import {Inviter, MembershipService, PendingInvitation} from "./MembershipService";
+import {canInvite, TenantRole} from "./TenantRole";
 
 class InMemoryMembershipService implements MembershipService {
 
     private invitations = new Map<string, PendingInvitation>();
+    private members = new Map<string, TenantRole>();
 
     constructor(private linkBase : string = "http://localhost/invitations") {}
 
-    async invite(email : string, invitedBy : Inviter) : Promise<PendingInvitation> {
+    add(userId : string, role : TenantRole) : void {
+        this.members.set(userId, role);
+    }
+
+    async roleFor(userId : string) : Promise<TenantRole | undefined> {
+        return this.members.get(userId);
+    }
+
+    async invite(email : string, role : TenantRole, invitedBy : Inviter) : Promise<PendingInvitation> {
         const token = randomUUID();
         const now = new Date();
         const invitation : PendingInvitation = {
             token,
             email: email.trim().toLowerCase(),
-            role: "member",
+            role,
             invitedBy: invitedBy.id,
             invitedByName: invitedBy.name,
             link: `${this.linkBase}/${token}`,
@@ -25,11 +35,13 @@ class InMemoryMembershipService implements MembershipService {
         return { ...invitation };
     }
 
-    async pending() : Promise<Array<PendingInvitation>> {
+    async pending(asking : Inviter) : Promise<Array<PendingInvitation>> {
+        if (! canInvite(this.members.get(asking.id))) return [];
         return Array.from(this.invitations.values()).map(invitation => ({ ...invitation })).reverse();
     }
 
-    async revoke(token : string) : Promise<boolean> {
+    async revoke(token : string, asking : Inviter) : Promise<boolean> {
+        if (! canInvite(this.members.get(asking.id))) return false;
         return this.invitations.delete(token);
     }
 

package/src/auth/MembershipService.ts

@@ -1,8 +1,10 @@
+import {TenantRole} from "./TenantRole";
+
 type PendingInvitation = {
 
     token : string,
     email : string,
-    role : string,
+    role : TenantRole,
     invitedBy : string,
     invitedByName? : string,
     link : string,
@@ -19,16 +21,19 @@ type Inviter = {
 
 };
 
-/* Invitations into this tenant. Membership itself is decided wherever people
-   sign in (Anbaric Cloud's central login), so a platform only asks that
-   service to invite, list and revoke on the tenant's behalf. */
+/* Who belongs to this tenant and as what, and the invitations that get them
+   here. Membership is decided wherever people sign in (Anbaric Cloud's central
+   login), which owns the tenant definitions; a platform asks it who its caller
+   is, and asks it to invite, list and revoke on the tenant's behalf. */
 interface MembershipService {
 
-    invite(email : string, invitedBy : Inviter) : Promise<PendingInvitation>;
+    roleFor(userId : string) : Promise<TenantRole | undefined>;
+
+    invite(email : string, role : TenantRole, invitedBy : Inviter) : Promise<PendingInvitation>;
 
-    pending() : Promise<Array<PendingInvitation>>;
+    pending(asking : Inviter) : Promise<Array<PendingInvitation>>;
 
-    revoke(token : string) : Promise<boolean>;
+    revoke(token : string, asking : Inviter) : Promise<boolean>;
 
 }
 

package/src/auth/SessionSigner.ts

@@ -3,6 +3,7 @@ import {ServerResponse} from "node:http";
 import {SESSION_COOKIE} from "./Authenticator";
 import {Role} from "./Role";
 import {Tenant} from "./Tenant";
+import {TenantRole, isTenantRole} from "./TenantRole";
 import {User} from "./User";
 
 const DEFAULT_TTL_SECONDS = 30 * 24 * 60 * 60;
@@ -43,6 +44,7 @@ class SessionSigner {
             name: user.name,
             picture: user.picture,
             email: user.email,
+            tenantRole: user.tenantRole,
             exp: nowSeconds() + this.ttlSeconds,
         };
         const payload = base64url(JSON.stringify(claims));
@@ -55,7 +57,7 @@ class SessionSigner {
         const [payload, signature] = token.split(".");
         if (!payload || !signature || !this.signatureMatches(payload, signature)) return undefined;
 
-        let claims : { sub? : unknown, tenant? : unknown, roles? : unknown, name? : unknown, picture? : unknown, email? : unknown, exp? : unknown };
+        let claims : { sub? : unknown, tenant? : unknown, roles? : unknown, name? : unknown, picture? : unknown, email? : unknown, tenantRole? : unknown, exp? : unknown };
         try {
             claims = JSON.parse(Buffer.from(payload, "base64url").toString());
         } catch {
@@ -70,7 +72,8 @@ class SessionSigner {
         const name = typeof claims.name === "string" ? claims.name : undefined;
         const picture = typeof claims.picture === "string" ? claims.picture : undefined;
         const email = typeof claims.email === "string" ? claims.email : undefined;
-        return [new User(claims.sub, roles, [], name, picture, email), tenant];
+        const tenantRole = isTenantRole(claims.tenantRole) ? claims.tenantRole as TenantRole : undefined;
+        return [new User(claims.sub, roles, [], name, picture, email, tenantRole), tenant];
     }
 
     // Sets (or, for a still-valid session, refreshes) the session cookie.

package/src/auth/TenantRole.ts

@@ -0,0 +1,32 @@
+/* What a person may do in the tenant this platform serves. The roles are
+   assigned in Anbaric Cloud's central login, which owns the tenant definitions
+   and the user-to-tenant mapping; the platform only enforces them.
+
+   Mirrored by that control plane's own tenants/TenantRole.ts rather than
+   shared with it, so the two repos need not move in lockstep over a four-value
+   union. Keep them in step. */
+type TenantRole = "OWNER" | "ADMIN" | "BUILDER" | "USER";
+
+const TENANT_ROLES : Array<TenantRole> = ["OWNER", "ADMIN", "BUILDER", "USER"];
+
+const isTenantRole = (value : unknown) : value is TenantRole =>
+    typeof value === "string" && TENANT_ROLES.includes(value as TenantRole);
+
+/* Inviting and revoking members - administering who else is in the tenant. */
+const canInvite = (role : TenantRole | undefined) : boolean =>
+    role === "OWNER" || role === "ADMIN";
+
+/* Deploying and tearing down apps, and minting the CLI keypairs that do it.
+   A USER can use the tenant's console and its apps, but cannot change them. */
+const canBuild = (role : TenantRole | undefined) : boolean =>
+    role === "OWNER" || role === "ADMIN" || role === "BUILDER";
+
+/* A platform with no membership service in play - a local or unmanaged
+   install - resolves no roles at all, and there every caller is allowed, as
+   they were before roles existed. Where one is in play the authentication
+   middleware has already refused anyone with no membership, so an undefined
+   role at a handler means only that roles are not being enforced here. */
+const deniesBuild = (role : TenantRole | undefined) : boolean => role !== undefined && ! canBuild(role);
+
+export { TENANT_ROLES, isTenantRole, canInvite, canBuild, deniesBuild };
+export type { TenantRole };

package/src/auth/TokenAuthenticator.ts

@@ -37,7 +37,7 @@ class TokenAuthenticator {
         if (this.tenant && key.tenant && key.tenant !== this.tenant) return undefined;
         if (!this.signatureValid(headerPart, payloadPart, signaturePart, key.publicKey)) return undefined;
 
-        return new User(key.userId);
+        return new User(key.userId, [], [], undefined, undefined, undefined, key.tenantRole);
     }
 
     private signatureValid(headerPart : string, payloadPart : string, signaturePart : string,

package/src/auth/User.ts

@@ -1,5 +1,6 @@
 import {KeyPair} from "./KeyPair";
 import {Role} from "./Role";
+import {TenantRole} from "./TenantRole";
 
 class User {
 
@@ -9,15 +10,20 @@ class User {
     readonly name? : string;
     readonly picture? : string;
     readonly email? : string;
+    // What this person may do in the tenant they are signed in to. Kept apart
+    // from `roles`, which are the identity provider's and are what an app's own
+    // authorization matches on - a platform capability is not a domain role.
+    tenantRole? : TenantRole;
 
     constructor(id : string, roles : Array<Role> = [], keyPairs : Array<KeyPair> = [],
-                name? : string, picture? : string, email? : string) {
+                name? : string, picture? : string, email? : string, tenantRole? : TenantRole) {
         this.id = id;
         this.roles = roles;
         this.keyPairs = keyPairs;
         this.name = name;
         this.picture = picture;
         this.email = email;
+        this.tenantRole = tenantRole;
     }
 
     hasRole(role : Role) : boolean {

package/src/data-store/Migrations.ts

@@ -0,0 +1,74 @@
+import {Pool, PoolClient} from "pg";
+
+type Migration = {
+
+    /* A stable identifier, recorded once the migration has run. Never reuse or
+       rename one: the record is the only thing standing between a second boot
+       and running the same change twice. Numbered prefixes keep the order
+       obvious to a reader ("003-tenant-roles"). */
+    id : string,
+
+    run : (client : PoolClient) => Promise<void>,
+
+};
+
+const TABLE = "anbaric_schema_migrations";
+
+// One well-known lock, so two instances booting together take it in turns
+// rather than racing to apply the same migration.
+const LOCK_KEY = 8_233_120;
+
+/* Applies whatever has not been applied yet, in order, each in its own
+   transaction. A migration that throws stops the boot: coming up against a
+   half-changed database is worse than not coming up at all. */
+const migrate = async (pool : Pool, migrations : Array<Migration>) : Promise<Array<string>> => {
+    const duplicate = migrations.find((migration, at) => migrations.findIndex(other => other.id === migration.id) !== at);
+    if (duplicate) throw new Error(`Duplicate migration id "${duplicate.id}"`);
+
+    const client = await pool.connect();
+    const applied : Array<string> = [];
+
+    try {
+        await client.query(`
+            CREATE TABLE IF NOT EXISTS ${TABLE} (
+                id         TEXT PRIMARY KEY,
+                applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+            )
+        `);
+        await client.query("SELECT pg_advisory_lock($1)", [LOCK_KEY]);
+
+        const done = new Set((await client.query(`SELECT id FROM ${TABLE}`)).rows.map(row => row.id));
+
+        for (const migration of migrations) {
+            if (done.has(migration.id)) continue;
+
+            try {
+                await client.query("BEGIN");
+                await migration.run(client);
+                await client.query(`INSERT INTO ${TABLE} (id) VALUES ($1)`, [migration.id]);
+                await client.query("COMMIT");
+            } catch (error) {
+                await client.query("ROLLBACK").catch(() => {});
+                throw new Error(`Migration "${migration.id}" failed: ${error instanceof Error ? error.message : error}`);
+            }
+            applied.push(migration.id);
+        }
+
+        return applied;
+    } finally {
+        await client.query("SELECT pg_advisory_unlock($1)", [LOCK_KEY]).catch(() => {});
+        client.release();
+    }
+};
+
+/* The common case: a migration that is just SQL. Several statements may be
+   given, and they run in the one transaction the migration already has. */
+const statements = (id : string, ...sql : Array<string>) : Migration => ({
+    id,
+    run: async (client) => {
+        for (const statement of sql) await client.query(statement);
+    },
+});
+
+export { migrate, statements };
+export type { Migration };

package/src/data-store/PlatformMigrations.ts

@@ -0,0 +1,209 @@
+import {Migration, statements} from "./Migrations";
+
+/* Workflow data (jobs, queue, documents) lives in the default public schema;
+   platform system tables are encapsulated in the anbaric_system schema so the
+   two never mix.
+
+   The baseline is everything the schema had grown to before migrations were
+   recorded, so it is written defensively (IF NOT EXISTS, guarded DO blocks) and
+   is safe against a database that already has all of it. Everything after it is
+   a numbered step that runs exactly once: write new changes as plain SQL and
+   never edit a migration that has shipped. */
+const PLATFORM_MIGRATIONS : Array<Migration> = [
+
+    statements("001-baseline",
+        `CREATE TABLE IF NOT EXISTS jobs (
+            id           TEXT PRIMARY KEY,
+            state        TEXT NOT NULL,
+            properties   JSONB NOT NULL DEFAULT '{}',
+            workflow_id  TEXT,
+            started_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+            started_by   TEXT NOT NULL DEFAULT 'system',
+            last_updated TIMESTAMPTZ NOT NULL DEFAULT now(),
+            transitions  JSONB NOT NULL DEFAULT '[]',
+            status       TEXT NOT NULL DEFAULT 'active',
+            inserted_at  BIGINT GENERATED ALWAYS AS IDENTITY
+        )`,
+        "ALTER TABLE jobs ADD COLUMN IF NOT EXISTS workflow_id TEXT",
+        "ALTER TABLE jobs ADD COLUMN IF NOT EXISTS started_at TIMESTAMPTZ NOT NULL DEFAULT now()",
+        "ALTER TABLE jobs ADD COLUMN IF NOT EXISTS started_by TEXT NOT NULL DEFAULT 'system'",
+        "ALTER TABLE jobs ADD COLUMN IF NOT EXISTS last_updated TIMESTAMPTZ NOT NULL DEFAULT now()",
+        "ALTER TABLE jobs ADD COLUMN IF NOT EXISTS transitions JSONB NOT NULL DEFAULT '[]'",
+        "ALTER TABLE jobs ADD COLUMN IF NOT EXISTS killed BOOLEAN NOT NULL DEFAULT false",
+        "ALTER TABLE jobs ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'active'",
+        "ALTER TABLE jobs ADD COLUMN IF NOT EXISTS app_id TEXT",
+        `UPDATE jobs
+            SET app_id = split_part(workflow_id, '/', 1),
+                workflow_id = substring(workflow_id from position('/' in workflow_id) + 1)
+            WHERE app_id IS NULL AND workflow_id LIKE '%/%'`,
+        `CREATE TABLE IF NOT EXISTS awaits (
+            id         UUID PRIMARY KEY,
+            metadata   JSONB NOT NULL DEFAULT '{}',
+            created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+        )`,
+        "ALTER TABLE jobs ADD COLUMN IF NOT EXISTS waiting_for UUID REFERENCES awaits(id) ON DELETE SET NULL",
+        `CREATE TABLE IF NOT EXISTS documents (
+            app_id      TEXT NOT NULL DEFAULT '',
+            collection  TEXT NOT NULL,
+            id          TEXT NOT NULL,
+            document    JSONB NOT NULL,
+            inserted_at BIGINT GENERATED ALWAYS AS IDENTITY,
+            PRIMARY KEY (app_id, collection, id)
+        )`,
+        "ALTER TABLE documents ADD COLUMN IF NOT EXISTS app_id TEXT NOT NULL DEFAULT ''",
+        `DO $$ BEGIN
+            IF NOT EXISTS (SELECT 1 FROM information_schema.key_column_usage
+                           WHERE table_name = 'documents' AND constraint_name = 'documents_pkey'
+                             AND column_name = 'app_id') THEN
+                ALTER TABLE documents DROP CONSTRAINT IF EXISTS documents_pkey;
+                ALTER TABLE documents ADD PRIMARY KEY (app_id, collection, id);
+            END IF;
+        END $$`,
+        `CREATE TABLE IF NOT EXISTS queue (
+            position     BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+            job_id       TEXT NOT NULL,
+            workflow_id  TEXT NOT NULL,
+            due          TIMESTAMPTZ,
+            leased_until TIMESTAMPTZ
+        )`,
+        "ALTER TABLE queue ADD COLUMN IF NOT EXISTS app_id TEXT",
+        "ALTER TABLE queue ADD COLUMN IF NOT EXISTS retry_at TIMESTAMPTZ",
+        "ALTER TABLE queue ADD COLUMN IF NOT EXISTS attempts INT NOT NULL DEFAULT 0",
+        `UPDATE queue
+            SET app_id = split_part(workflow_id, '/', 1),
+                workflow_id = substring(workflow_id from position('/' in workflow_id) + 1)
+            WHERE app_id IS NULL AND workflow_id LIKE '%/%'`,
+        `CREATE TABLE IF NOT EXISTS job_run_schedule (
+            id          BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+            app_id      TEXT NOT NULL DEFAULT '',
+            workflow_id TEXT NOT NULL,
+            run_at      TIMESTAMPTZ NOT NULL,
+            claimed_at  TIMESTAMPTZ
+        )`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS job_run_schedule_run
+            ON job_run_schedule (app_id, workflow_id, run_at)`,
+        `CREATE INDEX IF NOT EXISTS job_run_schedule_due
+            ON job_run_schedule (run_at) WHERE claimed_at IS NULL`,
+        `CREATE TABLE IF NOT EXISTS app_docs (
+            app_id       TEXT NOT NULL,
+            slug         TEXT NOT NULL,
+            title        TEXT NOT NULL DEFAULT '',
+            markdown     TEXT NOT NULL,
+            parent_slug  TEXT,
+            position     INTEGER NOT NULL DEFAULT 0,
+            generated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+            PRIMARY KEY (app_id, slug)
+        )`,
+        "ALTER TABLE app_docs ADD COLUMN IF NOT EXISTS parent_slug TEXT",
+        "ALTER TABLE app_docs ADD COLUMN IF NOT EXISTS position INTEGER NOT NULL DEFAULT 0",
+        `CREATE TABLE IF NOT EXISTS entitlements (
+            app_id          TEXT,
+            entitlement_id  TEXT NOT NULL,
+            notes           TEXT NOT NULL DEFAULT '',
+            registered_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+        )`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS entitlements_key
+            ON entitlements (COALESCE(app_id, ''), entitlement_id)`,
+        `CREATE TABLE IF NOT EXISTS entitlement_grants (
+            id              TEXT PRIMARY KEY,
+            user_id         TEXT NOT NULL,
+            app_id          TEXT,
+            entitlement_id  TEXT NOT NULL,
+            notes           TEXT NOT NULL DEFAULT '',
+            granted_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+            granted_by      TEXT NOT NULL
+        )`,
+        `CREATE INDEX IF NOT EXISTS entitlement_grants_lookup
+            ON entitlement_grants (user_id, entitlement_id)`,
+        `INSERT INTO entitlements (app_id, entitlement_id, notes)
+            VALUES (NULL, 'access', 'Global access')
+            ON CONFLICT (COALESCE(app_id, ''), entitlement_id) DO NOTHING`,
+        `CREATE TABLE IF NOT EXISTS prompts (
+            app_id         TEXT NOT NULL,
+            prompt_id      TEXT NOT NULL,
+            version        INTEGER NOT NULL,
+            instructions   TEXT NOT NULL,
+            output_schema  JSONB,
+            created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+            PRIMARY KEY (app_id, prompt_id, version)
+        )`,
+        "ALTER TABLE prompts DROP COLUMN IF EXISTS input_schema",
+        "CREATE SCHEMA IF NOT EXISTS anbaric_system",
+        `CREATE TABLE IF NOT EXISTS anbaric_system.cli_keys (
+            id          TEXT PRIMARY KEY,
+            user_id     TEXT NOT NULL,
+            client_name TEXT NOT NULL,
+            public_key  TEXT NOT NULL,
+            tenant      TEXT,
+            created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+        )`,
+        "ALTER TABLE anbaric_system.cli_keys ADD COLUMN IF NOT EXISTS tenant TEXT",
+        `CREATE TABLE IF NOT EXISTS anbaric_system.users (
+            id          TEXT PRIMARY KEY,
+            name        TEXT NOT NULL DEFAULT '',
+            email       TEXT NOT NULL DEFAULT '',
+            picture     TEXT,
+            first_seen  TIMESTAMPTZ NOT NULL DEFAULT now(),
+            last_seen   TIMESTAMPTZ NOT NULL DEFAULT now()
+        )`,
+        `DO $$ BEGIN
+            CREATE TYPE anbaric_system.audit_interaction AS ENUM
+                ('CREATE', 'UPDATE_PROPERTIES', 'CHANGE_STATE', 'DELETE', 'READ', 'LIST');
+        EXCEPTION WHEN duplicate_object THEN null;
+        END $$`,
+        `CREATE TABLE IF NOT EXISTS anbaric_system.audit_records (
+            id            BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+            resource_type TEXT NOT NULL,
+            resource_id   TEXT NOT NULL,
+            actor_id      TEXT NOT NULL,
+            actor_type    TEXT NOT NULL,
+            interaction   TEXT[] NOT NULL,
+            description   TEXT NOT NULL,
+            details       JSONB,
+            at            TIMESTAMPTZ NOT NULL DEFAULT now()
+        )`,
+        "ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS resource_type TEXT",
+        "ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS resource_id TEXT",
+        "ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS app_id TEXT",
+        "ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS interaction TEXT[]",
+        `DO $$ BEGIN
+            IF EXISTS (SELECT 1 FROM information_schema.columns
+                       WHERE table_schema = 'anbaric_system' AND table_name = 'audit_records'
+                         AND column_name = 'interaction' AND data_type <> 'ARRAY') THEN
+                ALTER TABLE anbaric_system.audit_records
+                    ALTER COLUMN interaction TYPE anbaric_system.audit_interaction[] USING ARRAY[interaction];
+            END IF;
+        END $$`,
+        `DO $$ BEGIN
+            IF EXISTS (SELECT 1 FROM information_schema.columns
+                       WHERE table_schema = 'anbaric_system' AND table_name = 'audit_records'
+                         AND column_name = 'job_id') THEN
+                UPDATE anbaric_system.audit_records
+                    SET resource_type = COALESCE(resource_type, 'job'),
+                        resource_id = COALESCE(resource_id, job_id),
+                        interaction = COALESCE(interaction, ARRAY[change::text::anbaric_system.audit_interaction])
+                    WHERE resource_id IS NULL OR interaction IS NULL;
+                ALTER TABLE anbaric_system.audit_records DROP COLUMN job_id;
+                ALTER TABLE anbaric_system.audit_records DROP COLUMN change;
+            END IF;
+        END $$`,
+        `DO $$ BEGIN
+            IF EXISTS (SELECT 1 FROM information_schema.columns
+                       WHERE table_schema = 'anbaric_system' AND table_name = 'audit_records'
+                         AND column_name = 'interaction' AND udt_name = '_audit_interaction') THEN
+                ALTER TABLE anbaric_system.audit_records
+                    ALTER COLUMN interaction TYPE TEXT[] USING interaction::text[];
+            END IF;
+        END $$`,
+        "UPDATE anbaric_system.audit_records SET resource_type = 'job' WHERE resource_type IS NULL",
+        "UPDATE anbaric_system.audit_records SET resource_id = 'unknown' WHERE resource_id IS NULL",
+        "UPDATE anbaric_system.audit_records SET interaction = ARRAY['UPDATE_PROPERTIES']::text[] WHERE interaction IS NULL",
+        "ALTER TABLE anbaric_system.audit_records ALTER COLUMN resource_type SET NOT NULL",
+        "ALTER TABLE anbaric_system.audit_records ALTER COLUMN resource_id SET NOT NULL",
+        "ALTER TABLE anbaric_system.audit_records ALTER COLUMN interaction SET NOT NULL",
+        "CREATE INDEX IF NOT EXISTS audit_records_resource ON anbaric_system.audit_records (resource_type, resource_id)",
+    ),
+
+];
+
+export { PLATFORM_MIGRATIONS };