availsync 0.1.0

package/src/db/migrations/007_work_coordination.sql

@@ -0,0 +1,60 @@
+CREATE TABLE IF NOT EXISTS work_resources (
+  id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id        UUID NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  resource_type TEXT NOT NULL,
+  resource_key  TEXT NOT NULL,
+  label         TEXT NOT NULL,
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  UNIQUE (org_id, resource_type, resource_key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_work_resources_org
+  ON work_resources(org_id, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS work_claims (
+  id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id      UUID NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  agent_id    UUID NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+  resource_id UUID NOT NULL REFERENCES work_resources(id) ON DELETE CASCADE,
+  start_at    TIMESTAMPTZ NOT NULL,
+  end_at      TIMESTAMPTZ NOT NULL,
+  status      TEXT NOT NULL DEFAULT 'active'
+                CHECK (status IN ('active', 'superseded', 'released', 'expired', 'blocked')),
+  reason      TEXT,
+  metadata    JSONB,
+  created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  CONSTRAINT chk_work_claim_order CHECK (end_at > start_at)
+);
+
+CREATE INDEX IF NOT EXISTS idx_work_claims_org_created
+  ON work_claims(org_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_work_claims_resource_time
+  ON work_claims(resource_id, start_at, end_at)
+  WHERE status = 'active';
+
+CREATE INDEX IF NOT EXISTS idx_work_claims_agent
+  ON work_claims(agent_id, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS work_claim_events (
+  id                    UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  claim_id              UUID REFERENCES work_claims(id) ON DELETE CASCADE,
+  event_type            TEXT NOT NULL
+                          CHECK (event_type IN ('created', 'blocked', 'superseded', 'released', 'expired')),
+  agent_id              UUID NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+  org_id                UUID NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  resource_id           UUID REFERENCES work_resources(id) ON DELETE CASCADE,
+  conflicting_claim_id  UUID REFERENCES work_claims(id) ON DELETE SET NULL,
+  rule_applied          TEXT,
+  metadata              JSONB,
+  actor_type            TEXT,
+  actor_id              UUID,
+  actor_label           TEXT,
+  created_at            TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_work_claim_events_org
+  ON work_claim_events(org_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_work_claim_events_resource
+  ON work_claim_events(resource_id, created_at DESC);

package/src/db/migrations/008_work_claim_leases.sql

@@ -0,0 +1,20 @@
+ALTER TABLE work_claims ADD COLUMN IF NOT EXISTS last_renewed_at TIMESTAMPTZ;
+ALTER TABLE work_claims ADD COLUMN IF NOT EXISTS renewal_count INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE work_claims ADD COLUMN IF NOT EXISTS idempotency_key TEXT;
+ALTER TABLE work_claims ADD COLUMN IF NOT EXISTS expires_at TIMESTAMPTZ;
+
+UPDATE work_claims
+SET last_renewed_at = COALESCE(last_renewed_at, created_at),
+    expires_at = COALESCE(expires_at, end_at);
+
+ALTER TABLE work_claims ALTER COLUMN last_renewed_at SET NOT NULL;
+ALTER TABLE work_claims ALTER COLUMN expires_at SET NOT NULL;
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_work_claims_idempotency_key
+  ON work_claims(org_id, agent_id, idempotency_key)
+  WHERE idempotency_key IS NOT NULL;
+
+ALTER TABLE work_claim_events DROP CONSTRAINT IF EXISTS work_claim_events_event_type_check;
+ALTER TABLE work_claim_events
+  ADD CONSTRAINT work_claim_events_event_type_check
+  CHECK (event_type IN ('created', 'blocked', 'superseded', 'released', 'expired', 'extended'));

package/src/db/migrations/009_billing_subscription_state.sql

@@ -0,0 +1,23 @@
+ALTER TABLE orgs ADD COLUMN IF NOT EXISTS subscription_status TEXT NOT NULL DEFAULT 'free';
+ALTER TABLE orgs ADD COLUMN IF NOT EXISTS current_period_start TIMESTAMPTZ;
+ALTER TABLE orgs ADD COLUMN IF NOT EXISTS current_period_end TIMESTAMPTZ;
+ALTER TABLE orgs ADD COLUMN IF NOT EXISTS cancel_at_period_end BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE orgs ADD COLUMN IF NOT EXISTS billing_email TEXT;
+
+ALTER TABLE orgs DROP CONSTRAINT IF EXISTS orgs_subscription_status_check;
+ALTER TABLE orgs ADD CONSTRAINT orgs_subscription_status_check
+  CHECK (subscription_status IN (
+    'free',
+    'incomplete',
+    'incomplete_expired',
+    'trialing',
+    'active',
+    'past_due',
+    'canceled',
+    'unpaid',
+    'paused'
+  ));
+
+UPDATE orgs
+SET subscription_status = CASE WHEN plan = 'free' THEN 'free' ELSE 'active' END
+WHERE subscription_status IS NULL OR subscription_status = 'free';

package/src/db/migrations/010_agent_api_key_prefix.sql

@@ -0,0 +1,10 @@
+ALTER TABLE agents ADD COLUMN IF NOT EXISTS api_key_prefix TEXT;
+
+UPDATE agents
+SET api_key_prefix = substring(replace(id::text, '-', '') from 1 for 16)
+WHERE api_key_prefix IS NULL;
+
+ALTER TABLE agents ALTER COLUMN api_key_prefix SET NOT NULL;
+
+DROP INDEX IF EXISTS idx_agents_api_key_prefix;
+CREATE UNIQUE INDEX idx_agents_api_key_prefix ON agents(api_key_prefix);

package/src/db/migrations/011_org_verified_and_work_event_retention.sql

@@ -0,0 +1,11 @@
+ALTER TABLE orgs ADD COLUMN IF NOT EXISTS verified_at TIMESTAMPTZ;
+
+ALTER TABLE work_claim_events DROP CONSTRAINT IF EXISTS work_claim_events_claim_id_fkey;
+ALTER TABLE work_claim_events
+  ADD CONSTRAINT work_claim_events_claim_id_fkey
+  FOREIGN KEY (claim_id) REFERENCES work_claims(id) ON DELETE SET NULL;
+
+ALTER TABLE work_claim_events DROP CONSTRAINT IF EXISTS work_claim_events_resource_id_fkey;
+ALTER TABLE work_claim_events
+  ADD CONSTRAINT work_claim_events_resource_id_fkey
+  FOREIGN KEY (resource_id) REFERENCES work_resources(id) ON DELETE SET NULL;

package/src/db/migrations/012_agent_enforcement_mode.sql

@@ -0,0 +1,12 @@
+ALTER TABLE agents
+  ADD COLUMN IF NOT EXISTS enforcement_mode TEXT NOT NULL DEFAULT 'enforce';
+
+ALTER TABLE agents DROP CONSTRAINT IF EXISTS agents_enforcement_mode_check;
+ALTER TABLE agents
+  ADD CONSTRAINT agents_enforcement_mode_check
+  CHECK (enforcement_mode IN ('enforce', 'observe'));
+
+ALTER TABLE work_claim_events DROP CONSTRAINT IF EXISTS work_claim_events_event_type_check;
+ALTER TABLE work_claim_events
+  ADD CONSTRAINT work_claim_events_event_type_check
+  CHECK (event_type IN ('created', 'blocked', 'superseded', 'released', 'expired', 'extended', 'shadow_blocked', 'shadow_allowed'));

package/src/db/migrations/013_support_tickets.sql

@@ -0,0 +1,21 @@
+CREATE TABLE IF NOT EXISTS support_tickets (
+  id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id      UUID NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  user_id     UUID REFERENCES workspace_users(id) ON DELETE SET NULL,
+  email       TEXT NOT NULL,
+  subject     TEXT NOT NULL,
+  category    TEXT NOT NULL CHECK (category IN ('billing', 'setup', 'sdk', 'agent_error', 'bug', 'other')),
+  message     TEXT NOT NULL,
+  status      TEXT NOT NULL DEFAULT 'open' CHECK (status IN ('open', 'in_review', 'closed')),
+  priority    TEXT NOT NULL DEFAULT 'normal' CHECK (priority IN ('normal', 'high')),
+  plan        TEXT NOT NULL,
+  context     JSONB NOT NULL DEFAULT '{}',
+  created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_support_tickets_status_created
+  ON support_tickets(status, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_support_tickets_org_created
+  ON support_tickets(org_id, created_at DESC);

package/src/db/migrations/014_paid_plan_waitlist.sql

@@ -0,0 +1,23 @@
+CREATE TABLE IF NOT EXISTS paid_plan_waitlist (
+  id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  org_id      UUID REFERENCES orgs(id) ON DELETE SET NULL,
+  user_id     UUID REFERENCES workspace_users(id) ON DELETE SET NULL,
+  email       TEXT NOT NULL,
+  plan        TEXT NOT NULL CHECK (plan IN ('individual', 'team')),
+  source      TEXT NOT NULL DEFAULT 'pricing',
+  message     TEXT NOT NULL DEFAULT '',
+  status      TEXT NOT NULL DEFAULT 'new' CHECK (status IN ('new', 'contacted', 'closed')),
+  context     JSONB NOT NULL DEFAULT '{}',
+  created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_paid_plan_waitlist_status_created
+  ON paid_plan_waitlist(status, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_paid_plan_waitlist_org_created
+  ON paid_plan_waitlist(org_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_paid_plan_waitlist_email_created
+  ON paid_plan_waitlist(email, created_at DESC);
+

package/src/db/migrations/015_agent_last_seen.sql

@@ -0,0 +1,2 @@
+ALTER TABLE agents
+ADD COLUMN IF NOT EXISTS last_seen_at TIMESTAMPTZ;

package/src/db/migrations.ts

@@ -0,0 +1,164 @@
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import type { Pool, PoolClient } from 'pg';
+import pool from './client';
+import { log } from '../lib/logger';
+
+const MIGRATION_LOCK_KEY = 275019923;
+
+export type MigrationSummary = {
+  total: number;
+  applied: number;
+  failed: number;
+  pending: number;
+  latest: {
+    filename: string;
+    status: string;
+    finished_at: Date | null;
+    error_message: string | null;
+  } | null;
+};
+
+export function findMigrationsDir() {
+  return [
+    path.resolve(__dirname, 'migrations'),
+    path.resolve(process.cwd(), 'src/db/migrations'),
+  ].find((candidate) => fs.existsSync(candidate));
+}
+
+function checksum(sql: string) {
+  return crypto.createHash('sha256').update(sql).digest('hex');
+}
+
+async function ensureMigrationTable(client: PoolClient) {
+  await client.query(`
+    CREATE TABLE IF NOT EXISTS schema_migrations (
+      filename TEXT PRIMARY KEY,
+      checksum TEXT NOT NULL,
+      started_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      finished_at TIMESTAMPTZ,
+      status TEXT NOT NULL CHECK (status IN ('running', 'applied', 'failed')),
+      error_message TEXT
+    )
+  `);
+}
+
+export async function runMigrations(db: Pool = pool, migrationsDir = findMigrationsDir()) {
+  const resolvedMigrationsDir = migrationsDir;
+  if (!resolvedMigrationsDir) {
+    log.warn('No migrations directory found', {
+      paths: [
+        path.resolve(__dirname, 'migrations'),
+        path.resolve(process.cwd(), 'src/db/migrations'),
+      ],
+    });
+    return;
+  }
+
+  const files = fs.readdirSync(resolvedMigrationsDir).filter((file) => file.endsWith('.sql')).sort();
+  const client = await db.connect();
+  try {
+    await client.query('SELECT pg_advisory_lock($1)', [MIGRATION_LOCK_KEY]);
+    await ensureMigrationTable(client);
+
+    for (const file of files) {
+      const sql = fs.readFileSync(path.join(resolvedMigrationsDir, file), 'utf8');
+      const hash = checksum(sql);
+      const existing = await client.query(
+        `SELECT checksum, status
+         FROM schema_migrations
+         WHERE filename = $1`,
+        [file],
+      );
+
+      if (existing.rows[0]?.status === 'applied') {
+        if (existing.rows[0].checksum !== hash) {
+          throw new Error(`Migration checksum changed after apply: ${file}`);
+        }
+        continue;
+      }
+
+      await client.query(
+        `INSERT INTO schema_migrations (filename, checksum, started_at, status)
+         VALUES ($1, $2, NOW(), 'running')
+         ON CONFLICT (filename)
+         DO UPDATE SET checksum = EXCLUDED.checksum,
+                       started_at = NOW(),
+                       finished_at = NULL,
+                       status = 'running',
+                       error_message = NULL`,
+        [file, hash],
+      );
+
+      try {
+        await client.query('BEGIN');
+        await client.query(sql);
+        await client.query(
+          `UPDATE schema_migrations
+           SET status = 'applied',
+               finished_at = NOW(),
+               error_message = NULL
+           WHERE filename = $1`,
+          [file],
+        );
+        await client.query('COMMIT');
+        log.info('[migration] applied', { filename: file });
+      } catch (err) {
+        await client.query('ROLLBACK').catch(() => {});
+        const message = (err as Error).message;
+        await client.query(
+          `UPDATE schema_migrations
+           SET status = 'failed',
+               finished_at = NOW(),
+               error_message = $2
+           WHERE filename = $1`,
+          [file, message],
+        );
+        log.error('[migration] failed', { filename: file, error: message });
+        throw new Error(`Migration failed in ${file}: ${message}`);
+      }
+    }
+  } finally {
+    await client.query('SELECT pg_advisory_unlock($1)', [MIGRATION_LOCK_KEY]).catch(() => {});
+    client.release();
+  }
+}
+
+export async function migrationSummary(db: Pool = pool, migrationsDir = findMigrationsDir()): Promise<MigrationSummary> {
+  const resolvedMigrationsDir = migrationsDir;
+  const total = resolvedMigrationsDir
+    ? fs.readdirSync(resolvedMigrationsDir).filter((file) => file.endsWith('.sql')).length
+    : 0;
+
+  try {
+    const exists = await db.query("SELECT to_regclass('public.schema_migrations') AS table_name");
+    if (!exists.rows[0]?.table_name) {
+      return { total, applied: 0, failed: 0, pending: total, latest: null };
+    }
+
+    const result = await db.query(
+      `SELECT
+         COUNT(*) FILTER (WHERE status = 'applied')::int AS applied,
+         COUNT(*) FILTER (WHERE status = 'failed')::int AS failed
+       FROM schema_migrations`,
+    );
+    const latest = await db.query(
+      `SELECT filename, status, finished_at, error_message
+       FROM schema_migrations
+       ORDER BY COALESCE(finished_at, started_at) DESC
+       LIMIT 1`,
+    );
+    const applied = result.rows[0]?.applied ?? 0;
+    const failed = result.rows[0]?.failed ?? 0;
+    return {
+      total,
+      applied,
+      failed,
+      pending: Math.max(0, total - applied),
+      latest: latest.rows[0] ?? null,
+    };
+  } catch {
+    return { total, applied: 0, failed: 1, pending: total, latest: null };
+  }
+}

package/src/db/run-migrations.ts

@@ -0,0 +1,13 @@
+import pool from './client';
+import { runMigrations } from './migrations';
+import { log } from '../lib/logger';
+
+runMigrations()
+  .then(async () => {
+    await pool.end();
+  })
+  .catch(async (err) => {
+    log.error('[migration] runner failed', { message: (err as Error).message });
+    await pool.end().catch(() => {});
+    process.exit(1);
+  });

package/src/index.ts

@@ -0,0 +1,183 @@
+import express from 'express';
+import type { Request, Response, NextFunction } from 'express';
+import helmet from 'helmet';
+import cors from 'cors';
+import rateLimit from 'express-rate-limit';
+import { createHash } from 'crypto';
+import pool from './db/client';
+import { runMigrations, migrationSummary } from './db/migrations';
+import { appVersion } from './lib/appInfo';
+import { envReadiness } from './lib/env';
+import { log } from './lib/logger';
+import { requestIdFrom, requestIdMiddleware } from './middleware/requestId';
+import availabilityRouter from './routes/availability';
+import holdsRouter from './routes/holds';
+import preferencesRouter from './routes/preferences';
+import orgsRouter from './routes/orgs';
+import billingRouter, { handleStripeWebhook } from './routes/billing';
+import sessionRouter from './routes/session';
+import auditRouter from './routes/audit';
+import authRouter from './routes/auth';
+import mcpRouter from './routes/mcp';
+import conflictsRouter from './routes/conflicts';
+import metricsRouter from './routes/metrics';
+import valueRouter from './routes/value';
+import activityRouter from './routes/activity';
+import workRouter from './routes/work';
+import adminRouter from './routes/admin';
+import onboardingRouter from './routes/onboarding';
+import supportRouter from './routes/support';
+import accountRouter from './routes/account';
+import waitlistRouter from './routes/waitlist';
+
+const app = express();
+
+export function validateEnv() {
+  const readiness = envReadiness();
+  if (!readiness.ok) {
+    if (process.env.NODE_ENV === 'production') {
+      log.error('Missing required environment variables', { missing: readiness.missing });
+      process.exit(1);
+    } else {
+      log.warn('Missing environment variables (non-fatal in dev)', { missing: readiness.missing });
+    }
+  }
+}
+
+// --- Security middleware ---
+
+app.use(helmet({
+  contentSecurityPolicy: false,
+}));
+
+app.use(requestIdMiddleware);
+
+app.use(cors({
+  origin: (process.env.CORS_ORIGINS || 'http://localhost:3001,http://127.0.0.1:3001')
+    .split(',')
+    .map((o) => o.trim())
+    .filter(Boolean),
+  credentials: true,
+  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Authorization', 'Idempotency-Key'],
+}));
+
+// --- Rate limiting ---
+
+const apiLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 100,
+  standardHeaders: true,
+  legacyHeaders: false,
+  keyGenerator: (req) => {
+    const authorization = req.header('Authorization');
+    if (!authorization) return 'anonymous';
+    return `auth:${createHash('sha256').update(authorization).digest('hex')}`;
+  },
+  message: { error: 'rate_limited', message: 'Too many requests, please try again later' },
+  validate: false,
+});
+
+const orgCreateLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'rate_limited', message: 'Too many org creation attempts' },
+  validate: false,
+});
+
+// --- Stripe webhook (raw body, BEFORE json middleware) ---
+
+app.post('/v1/billing/webhook', express.raw({ type: 'application/json' }), handleStripeWebhook);
+
+// --- Body parsing ---
+
+app.use(express.json());
+
+// --- Health check ---
+
+app.get('/health', async (_req, res) => {
+  const startedAt = Date.now();
+  try {
+    await pool.query('SELECT 1');
+    const migrations = await migrationSummary();
+    const status = migrations.failed > 0 || migrations.pending > 0 ? 'degraded' : 'ok';
+    res.status(status === 'ok' ? 200 : 503).json({
+      status,
+      db: 'connected',
+      migrations,
+      version: appVersion(),
+      uptime_seconds: Math.floor(process.uptime()),
+      latency_ms: Date.now() - startedAt,
+      timestamp: new Date().toISOString(),
+    });
+  } catch (err) {
+    res.status(503).json({
+      status: 'error',
+      db: 'disconnected',
+      error: 'database_unavailable',
+      request_id: requestIdFrom(res),
+      version: appVersion(),
+      uptime_seconds: Math.floor(process.uptime()),
+      timestamp: new Date().toISOString(),
+    });
+  }
+});
+
+// --- Rate limiters on route groups ---
+
+app.post('/v1/orgs', orgCreateLimiter);
+app.post('/v1/auth/signup', orgCreateLimiter);
+app.use('/v1', apiLimiter);
+
+// --- Routes ---
+
+app.use('/v1', authRouter);
+app.use('/v1', orgsRouter);
+app.use('/v1', billingRouter);
+app.use('/v1', sessionRouter);
+app.use('/v1', availabilityRouter);
+app.use('/v1', holdsRouter);
+app.use('/v1', conflictsRouter);
+app.use('/v1', preferencesRouter);
+app.use('/v1', auditRouter);
+app.use('/v1', mcpRouter);
+app.use('/v1', metricsRouter);
+app.use('/v1', valueRouter);
+app.use('/v1', activityRouter);
+app.use('/v1', workRouter);
+app.use('/v1', onboardingRouter);
+app.use('/v1', waitlistRouter);
+app.use('/v1', supportRouter);
+app.use('/v1', accountRouter);
+app.use('/v1', adminRouter);
+
+// --- Global error handler ---
+
+app.use((err: Error, req: Request, res: Response, _next: NextFunction) => {
+  const requestId = requestIdFrom(res);
+  log.error(`${req.method} ${req.path}`, { request_id: requestId, message: err.message, stack: err.stack });
+  if (process.env.NODE_ENV === 'development') {
+    return res.status(500).json({ error: 'internal_error', message: err.message, stack: err.stack, request_id: requestId });
+  }
+  return res.status(500).json({ error: 'internal_error', message: 'An unexpected error occurred', request_id: requestId });
+});
+
+// --- Start server ---
+
+const PORT = process.env.PORT || 3000;
+if (require.main === module && process.env.NODE_ENV !== 'test') {
+  validateEnv();
+
+  runMigrations()
+    .then(() => {
+      app.listen(PORT, () => log.info(`Availsync running on :${PORT}`));
+    })
+    .catch((err) => {
+      log.error('Migration failed', { message: err.message });
+      process.exit(1);
+    });
+}
+
+export default app;