create-ailk 0.14.0 → 0.16.0

package/templates/database/inbox/schema.prisma

@@ -63,6 +63,27 @@ model Lead {
   promotedUserId String?   @map("promoted_user_id")
   promotedAt     DateTime? @map("promoted_at")
 
+  // #7869 (roadmap D5) — the caller's `Idempotency-Key` header on
+  // `POST /v1/leads/submit`, stored verbatim so a retried write finds the
+  // first lead. Written only by `apps/api/src/services/lead-routing.ts`'s
+  // submit branch and read only by its two scoped lookups. Untrusted,
+  // client-supplied text — never echo it. Nullable, no default: every
+  // pre-#7869 row and every keyless lead reads NULL, and Postgres treats
+  // NULLs as distinct under the unique below. Same shape as
+  // `FlowCheckout.idempotencyKey` (#4912).
+  idempotencyKey String? @map("idempotency_key")
+
+  // #852 D1 — the Person this lead belongs to: one client of this workspace,
+  // stamped at creation by `apps/api/src/services/lead-routing.ts` through
+  // `findOrCreatePerson`. Plain scalar, no @relation (the inbox house style,
+  // `FlowCheckout.leadId`). NULL only when the email is not a storable
+  // address or the Person step failed — a Person step never refuses a lead.
+  // Backfilled by database/migrations/20261010121000_person_backfill.
+  personId String? @map("person_id")
+
+  // #7869 — the idempotency guarantee, scoped per workspace so a key can
+  // never reach another tenant's row.
+  @@unique([workspaceId, idempotencyKey])
   @@index([siteId])
   @@index([createdAt])
   @@index([email])
@@ -78,9 +99,93 @@ model Lead {
   // `'flow:' + <magnet slug>` value, not the `handledAt` index's allowlist
   // `IN` — a distinct query shape that composite does not serve.
   @@index([workspaceId, source])
+  @@index([personId])
   @@map("leads")
 }
 
+/// Person — one client of one workspace (#852). Created only by
+/// apps/api/src/services/person.ts's findOrCreatePerson. Plain scalars, no
+/// @relation (ADR 0009): workspaceId and userId name rows in the auth
+/// namespace.
+///
+/// `email` is the lowercased, trimmed address (the `people_email_normalized`
+/// CHECK holds it to printable ASCII). `userId` is written only on a verified
+/// email match (`stampPersonUser`) and never overwritten. `billingCustomerId`
+/// is NOT unique — the spokes share one Stripe account — and the first
+/// writer wins. `planOffering` is written by a later phase (Epic 2's
+/// checkout-lead rule); this slice only carries the column.
+model Person {
+  id                String   @id @default(dbgenerated("('person_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId       String   @map("workspace_id")
+  email             String   @db.VarChar(254)
+  name              String?  @db.VarChar(200)
+  userId            String?  @map("user_id")
+  billingProvider   String?  @map("billing_provider") @db.VarChar(32)
+  billingCustomerId String?  @map("billing_customer_id") @db.VarChar(255)
+  planOffering      String?  @map("plan_offering") @db.VarChar(100)
+  createdAt         DateTime @default(now()) @map("created_at")
+  updatedAt         DateTime @updatedAt @map("updated_at")
+
+  pieces       Piece[]
+  interactions Interaction[]
+
+  @@unique([workspaceId, email])
+  @@unique([workspaceId, userId])
+  // #7877 D1 — redundant with the PK, load-bearing as the target of the
+  // composite (person_id, workspace_id) FKs from pieces and interactions:
+  // "a Person of the same workspace" is a database fact.
+  @@unique([id, workspaceId])
+  @@index([workspaceId, billingCustomerId])
+  @@index([workspaceId, createdAt])
+  @@map("people")
+}
+
+/// Piece — one deliverable for one client (#7877). Written only through
+/// tenantDb(tenant).memberArea; read by a client only through
+/// lib/member-store.ts. `stage` is one of the workspace's declared stages
+/// (WorkspacePieceStages), checked at write time, never an enum.
+model Piece {
+  id          String   @id @default(dbgenerated("('piece_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId String   @map("workspace_id")
+  personId    String   @map("person_id")
+  title       String   @db.VarChar(200)
+  stage       String   @db.VarChar(40)
+  needsClient Boolean  @default(false) @map("needs_client")
+  updatedBy   String   @map("updated_by")
+  createdAt   DateTime @default(now()) @map("created_at")
+  updatedAt   DateTime @updatedAt @map("updated_at")
+
+  person Person @relation(fields: [personId, workspaceId], references: [id, workspaceId], onDelete: Restrict, map: "pieces_person_fk")
+
+  @@index([workspaceId, personId, createdAt])
+  @@map("pieces")
+}
+
+/// Interaction — one message on a client's record (#7877): the original CRM
+/// spec's Interaction cut to one channel and one direction. An inbound reply
+/// is a later second `direction` value on this table. `readAt` is when a
+/// member read FIRST served the row to the client's spoke — a delivery
+/// stamp, not proof a human read it.
+model Interaction {
+  id          String    @id @default(dbgenerated("('intx_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId String    @map("workspace_id")
+  personId    String    @map("person_id")
+  channel     String    @db.VarChar(16)
+  direction   String    @db.VarChar(16)
+  subject     String    @db.VarChar(200)
+  body        String    @db.Text
+  assetId     String?   @map("asset_id")
+  createdBy   String    @map("created_by")
+  createdAt   DateTime  @default(now()) @map("created_at")
+  readAt      DateTime? @map("read_at")
+
+  person Person @relation(fields: [personId, workspaceId], references: [id, workspaceId], onDelete: Restrict, map: "interactions_person_fk")
+
+  @@index([workspaceId, personId, createdAt])
+  @@index([assetId])
+  @@map("interactions")
+}
+
 /// Subscriber — newsletter subscription (Phase B subscribe_newsletter tool / B6 route)
 model Subscriber {
   id        String   @id @default(dbgenerated("('subscr_'::text || (uuidv7())::text)")) @db.Text
@@ -1124,11 +1229,17 @@ model Appointment {
   noShowEventAt       DateTime? @map("no_show_event_at")
   createdAt           DateTime  @default(now()) @map("created_at")
   updatedAt           DateTime  @updatedAt @map("updated_at")
+  /// #852 D1 — the Person of the attendee, in this row's workspace. Stamped
+  /// at create (and on a spoke bind's move) by appointments.ts through
+  /// findOrCreatePerson. Plain scalar, no @relation. NULL when the attendee
+  /// email is not a storable address.
+  personId            String?   @map("person_id")
 
   @@unique([siteId, provider, providerBookingUid])
   @@index([siteId, startTime])
   @@index([createdAt])
   @@index([workspaceId])
+  @@index([personId])
   @@map("appointments")
 }
 

package/templates/database/jest.config.cjs

@@ -6,26 +6,22 @@ module.exports = {
   testPathIgnorePatterns: ["/node_modules/", "/generated/"],
   moduleFileExtensions: ["ts", "js", "json"],
   moduleNameMapper: {
-    // Map the validation workspace package to its TypeScript source so
-    // ts-jest compiles it directly (#3958) — mirrors apps/api/jest.config.cjs's
-    // identical mapping. The published dist is ESM-only and this package's
-    // CJS ts-jest transform can't load it; database/flows/presets.ts's test
-    // needs the real flowConfigSchema value at runtime.
-    "^@working-theory/validation$": "<rootDir>/../packages/validation/src/index.ts",
-    // ../tenancy.ts's `isSentinel` import from @working-theory/ids became a
-    // VALUE import (#5876 spec D2/D11) — no longer type-only, so it DOES need
-    // a mapping now, same reason as the validation mapping above.
-    "^@working-theory/ids$": "<rootDir>/../packages/ids/src/index.ts",
+    // @working-theory/validation and @working-theory/ids resolve from the
+    // installed packages; their ESM dist is converted by the transform below.
     "^(\\.{1,2}/.*)\\.js$": "$1",
   },
+  transformIgnorePatterns: [
+    "/node_modules/(?!(\\.pnpm/)?@working-theory(?:\\+[^/]*?@?[^/]*?|/[^/]+)(/|$))",
+  ],
   transform: {
-    "^.+\\.tsx?$": [
+    "^.+\\.[cm]?[tj]sx?$": [
       "ts-jest",
       {
         tsconfig: {
           target: "ES2020",
           module: "commonjs",
           lib: ["ES2020"],
+          allowJs: true,
           declaration: false,
           strict: true,
           esModuleInterop: true,

package/templates/database/migrations/20261008120000_user_last_workspace/migration.sql

@@ -0,0 +1,35 @@
+-- #7803 — sign-in lands in the user's last workspace (spec
+-- docs/specs/7803-sign-in-last-workspace-spec.md D1).
+--
+--   users.last_workspace_id (auth) — the workspace this person last activated.
+--                   Written only by activateWorkspace after its membership
+--                   grant; read only by listTenancy, which reports it only
+--                   when the workspace is in the caller's own listing
+--                   (apps/api/src/services/tenant-context.ts). Deleting the
+--                   workspace sets it null.
+--
+-- PURELY ADDITIVE: one nullable column with no default, its index, one FK to
+-- "workspaces" and the ADR-0031 format CHECK on the new reference column. No
+-- backfill runs and no existing row changes, so there is no pre-assertion
+-- block — this migration cannot lose a row. A NULL passes the CHECK.
+--
+-- Rollout: deploy this migration BEFORE the API code that reads the column
+-- (SEC-7803-3). Being nullable, it is safe to apply ahead of the code.
+--
+-- Rollback: ALTER TABLE "users" DROP COLUMN "last_workspace_id"; (this drops
+-- the index, the FK and the CHECK with it). Safe while nothing but #7803's own
+-- code reads it.
+
+-- AlterTable
+ALTER TABLE "users" ADD COLUMN "last_workspace_id" TEXT;
+
+-- CreateIndex
+CREATE INDEX "users_last_workspace_id_idx" ON "users"("last_workspace_id");
+
+-- AddForeignKey
+-- A deleted workspace clears every pointer to it.
+ALTER TABLE "users" ADD CONSTRAINT "users_last_workspace_id_fkey" FOREIGN KEY ("last_workspace_id") REFERENCES "workspaces"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- ADR-0031 rule 3 — the reference column carries the format CHECK of the
+-- entity it names (wksp_), in the exact pattern the agents migration uses.
+ALTER TABLE "users" ADD CONSTRAINT "users_last_workspace_id_format" CHECK ("last_workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20261008130000_lead_idempotency_key/migration.sql

@@ -0,0 +1,20 @@
+-- #7869 (spoke-pattern roadmap Phase 1, D5) — Lead idempotency key: the
+-- caller's optional `Idempotency-Key` header on POST /v1/leads/submit, so a
+-- retried lead write (a client retry, a spoke's fulfilment replay) finds the
+-- first lead instead of writing a second. Mirrors the column-add shape of
+-- 20260906000000_add_flow_checkout_idempotency (one AlterTable, one unique
+-- index under the Prisma section headers).
+--
+-- The column is nullable with no default, so no pre-existing row needs a
+-- backfill and none collides on the new unique — Postgres treats NULLs as
+-- distinct. The unique is scoped by workspace_id: one key in two workspaces
+-- is two leads.
+--
+-- Rollback: ALTER TABLE "leads" DROP COLUMN "idempotency_key"; (the index
+-- goes with it).
+
+-- AlterTable
+ALTER TABLE "leads" ADD COLUMN     "idempotency_key" TEXT;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "leads_workspace_id_idempotency_key_key" ON "leads"("workspace_id", "idempotency_key");

package/templates/database/migrations/20261009120000_agent_grants/migration.sql

@@ -0,0 +1,33 @@
+-- #7864 — grant an agent key five named abilities (spec
+-- docs/specs/7864-agent-key-grants-spec.md D2).
+--
+--   agents.grants (auth) — the permissions an owner or admin granted this
+--                   agent one by one. Written only by setServedAgentGrants
+--                   (apps/api/src/lib/agent-store.ts, the PUT
+--                   …/agents/:agentId/grants route); read by the auth
+--                   preHandler's key lookup and the agent list. The tenant
+--                   guards hold an agent to the grants its person's own role
+--                   also holds, so a stored grant never outranks the person.
+--
+-- The CHECK names the same five permissions as @working-theory/validation's
+-- AGENT_GRANTABLE_PERMISSIONS; database/__tests__/agents.db.test.ts reads
+-- this file and fails if the two lists differ (SEC-7864-G).
+--
+-- PURELY ADDITIVE: one NOT NULL column with an empty-array default and its
+-- CHECK. No backfill runs: every existing agent takes the default, no
+-- grants, and so behaves exactly as before. No existing row changes beyond
+-- the default fill, so there is no pre-assertion block.
+--
+-- Rollout: deploy this migration BEFORE the API code that reads the column.
+-- Code without the column fails closed — its key lookup errors and every
+-- agent is answered 401 (SEC-7864-F).
+--
+-- Rollback: ALTER TABLE "agents" DROP COLUMN "grants"; (this drops the CHECK
+-- with it). Safe while nothing but #7864's own code reads it.
+
+-- AlterTable
+ALTER TABLE "agents" ADD COLUMN "grants" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];
+
+-- Only the five grantable permissions may be stored.
+ALTER TABLE "agents" ADD CONSTRAINT "agents_grants_allowed"
+  CHECK ("grants" <@ ARRAY['content-edit','content-publish','assets-write','magnets-manage','meeting-types-manage']::TEXT[]);

package/templates/database/migrations/20261010120000_person/migration.sql

@@ -0,0 +1,106 @@
+-- #852 — Person, the per-workspace client record (spec
+-- docs/specs/852-person-the-per-workspace-client-spec.md D1, D2).
+--
+--   people (inbox) — one client of one workspace, keyed on a lowercased,
+--                    trimmed email unique per workspace. Created only by
+--                    apps/api/src/services/person.ts's findOrCreatePerson.
+--                    workspace_id and user_id are plain columns with no
+--                    foreign key (ADR 0009): they name auth-namespace rows.
+--   leads.person_id, appointments.person_id — the Person each row belongs
+--                    to, stamped at creation by the intake paths.
+--
+-- PURELY ADDITIVE, DDL ONLY: one new table with its indexes and CHECKs, and
+-- one nullable column with no default on each of "leads" and "appointments",
+-- so Postgres changes only the catalog for those two. No existing row's
+-- values change here — the backfill is the next migration,
+-- 20261010121000_person_backfill, split out so its row updates never run
+-- under the exclusive locks these ALTER TABLEs take (SEC-852-E). Prisma runs
+-- this file as one transaction, so each ALTER TABLE's ACCESS EXCLUSIVE lock
+-- is held until the file commits — through the plain CREATE INDEX on the new
+-- column — blocking reads AND writes of "leads" and "appointments" (lead
+-- capture included) for one heap scan of each. Accepted: the scan is short
+-- next to the backfill it is split from.
+--
+-- Rollout: deploy this migration (and the backfill) BEFORE the API code that
+-- writes person_id; code without the column fails every lead write.
+--
+-- Rollback: ALTER TABLE "leads" DROP COLUMN "person_id"; ALTER TABLE
+-- "appointments" DROP COLUMN "person_id"; DROP TABLE "people"; (the indexes
+-- and CHECKs go with them). Safe while nothing but #852's own code reads them.
+
+-- AlterTable
+ALTER TABLE "appointments" ADD COLUMN     "person_id" TEXT;
+
+-- AlterTable
+ALTER TABLE "leads" ADD COLUMN     "person_id" TEXT;
+
+-- CreateTable
+CREATE TABLE "people" (
+    "id" TEXT NOT NULL DEFAULT ('person_'::text || (uuidv7())::text),
+    "workspace_id" TEXT NOT NULL,
+    "email" VARCHAR(254) NOT NULL,
+    "name" VARCHAR(200),
+    "user_id" TEXT,
+    "billing_provider" VARCHAR(32),
+    "billing_customer_id" VARCHAR(255),
+    "plan_offering" VARCHAR(100),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "people_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+-- The webhook's first match: a customer id within one workspace (D3 step 2).
+-- NOT unique — the spokes share one Stripe account.
+CREATE INDEX "people_workspace_id_billing_customer_id_idx" ON "people"("workspace_id", "billing_customer_id");
+
+-- CreateIndex
+-- The People list: workspace_id = $1 ORDER BY created_at DESC (D7).
+CREATE INDEX "people_workspace_id_created_at_idx" ON "people"("workspace_id", "created_at");
+
+-- CreateIndex
+-- One Person per address per workspace — what findOrCreatePerson's
+-- INSERT … ON CONFLICT DO NOTHING absorbs a concurrent duplicate on.
+CREATE UNIQUE INDEX "people_workspace_id_email_key" ON "people"("workspace_id", "email");
+
+-- CreateIndex
+-- One Person per User per workspace. NULLs are distinct, so any number of
+-- unlinked Persons fit.
+CREATE UNIQUE INDEX "people_workspace_id_user_id_key" ON "people"("workspace_id", "user_id");
+
+-- CreateIndex
+CREATE INDEX "appointments_person_id_idx" ON "appointments"("person_id");
+
+-- CreateIndex
+CREATE INDEX "leads_person_id_idx" ON "leads"("person_id");
+
+-- ADR-0031 rule 3 — people: person_ (registered in packages/ids/src/registry.ts;
+-- this migration's path is added to migration-sync.test.ts's
+-- PK_CHECK_MIGRATIONS). Each reference column carries the format CHECK of the
+-- entity it names, in the agents-migration shape.
+ALTER TABLE "people" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "people" ALTER COLUMN "id" SET DEFAULT ('person_'::text || (uuidv7())::text);
+ALTER TABLE "people" ADD CONSTRAINT "people_id_format" CHECK ("id" ~ '^person_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "people" ADD CONSTRAINT "people_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "people" ADD CONSTRAINT "people_user_id_format" CHECK ("user_id" ~ '^user_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+-- The stored address is already normalized: printable ASCII only (no
+-- whitespace, no control or invisible character), exactly one @ with a
+-- non-empty side each, lower case. findOrCreatePerson's
+-- isStorablePersonEmail applies the same rule before any write (D3).
+ALTER TABLE "people" ADD CONSTRAINT "people_email_normalized"
+  CHECK ("email" = lower("email" COLLATE "C") AND "email" ~ '^[!-?A-~]+@[!-?A-~]+$');
+
+-- A provider and its customer id are written together or not at all — the
+-- same provider-agnostic pair User and Organization carry.
+ALTER TABLE "people" ADD CONSTRAINT "people_billing_pair"
+  CHECK (("billing_provider" IS NULL) = ("billing_customer_id" IS NULL));
+
+-- The two new reference columns carry the person_ format CHECK, added NOT
+-- VALID and then validated: the file runs as one transaction, so the ALTER
+-- TABLE's lock is still held, and the scan is of an all-NULL column.
+ALTER TABLE "leads" ADD CONSTRAINT "leads_person_id_format" CHECK ("person_id" ~ '^person_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$') NOT VALID;
+ALTER TABLE "leads" VALIDATE CONSTRAINT "leads_person_id_format";
+ALTER TABLE "appointments" ADD CONSTRAINT "appointments_person_id_format" CHECK ("person_id" ~ '^person_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$') NOT VALID;
+ALTER TABLE "appointments" VALIDATE CONSTRAINT "appointments_person_id_format";

package/templates/database/migrations/20261010121000_person_backfill/migration.sql

@@ -0,0 +1,132 @@
+-- #852 — the Person backfill (spec
+-- docs/specs/852-person-the-per-workspace-client-spec.md D2, D4).
+--
+-- Fills "people" from the rows the hub already holds and stamps
+-- leads.person_id and appointments.person_id, so the People list is not
+-- empty on the day it ships. Set-based and idempotent: every insert is
+-- ON CONFLICT DO NOTHING and every update is guarded by IS NULL, so running
+-- this text twice changes nothing the first run wrote.
+--
+-- THE SAME TEXT, byte for byte, is database/scripts/person-backfill.sql. The
+-- previous deployment keeps writing leads and appointments without a
+-- person_id between this migration and the cutover to the new code; run
+-- that script ONCE against the hub database after the cutover to stamp them.
+-- database/__tests__/person.db.test.ts asserts the two files are identical
+-- and that a second run changes no row.
+--
+-- Normalization — the SQL twin of apps/api/src/services/person.ts's
+-- normalizePersonEmail / isStorablePersonEmail:
+--   N(x)     = lower(btrim(x, E' \t\n\r\f\x0B') COLLATE "C")
+--              (\x0B is vertical tab; an E-string has no \v escape — E'\v'
+--              is the letter v, which would strip the v of every .dev)
+--   VALID(e) = e ~ '^[!-?A-~]+@[!-?A-~]+$' AND length(e) <= 254
+--   NAME(x)  = C0/C1 controls and bidi controls removed, trimmed, cut to
+--              200 characters; empty → NULL
+-- A row whose email is not VALID makes no Person and keeps person_id NULL.
+--
+-- Sources, in order: leads (oldest first), then completed hub FlowCheckouts
+-- through their lead (the customer id, first writer wins), then appointments
+-- by attendee email. Subscriber is NOT a source; FlowSession, ProjectListing
+-- and DeliverableGrant reach a Person through their lead at read time.
+-- The join to "users" reads the auth namespace inside this one-off
+-- statement only; it adds no foreign key (ADR 0009 invariant 1).
+--
+-- Rollback: nothing to undo on its own — dropping 20261010120000_person's
+-- table and columns removes everything this wrote.
+
+-- 1. Leads, oldest first: one Person per (workspace, normalized email). The
+--    name is the oldest lead's payload.name when it is a JSON string.
+INSERT INTO "people" ("workspace_id", "email", "name", "created_at", "updated_at")
+SELECT DISTINCT ON (l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"))
+       l."workspace_id",
+       lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"),
+       CASE WHEN jsonb_typeof(l."payload" -> 'name') = 'string'
+            THEN NULLIF(left(btrim(regexp_replace(l."payload" ->> 'name', '[\x01-\x1F\x7F-\x9F\u200E\u200F\u202A-\u202E\u2066-\u2069]', '', 'g')), 200), '')
+       END,
+       l."created_at",
+       now()
+FROM "leads" l
+WHERE lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C") ~ '^[!-?A-~]+@[!-?A-~]+$'
+  AND length(lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C")) <= 254
+ORDER BY l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"), l."created_at" ASC, l."id" ASC
+ON CONFLICT ("workspace_id", "email") DO NOTHING;
+
+-- 2. Hub FlowCheckouts, through their lead (same workspace): the oldest
+--    completed checkout with a customer id writes it onto a Person that has
+--    none. First writer wins — oldest by completed_at, then created_at, then id.
+UPDATE "people" p
+SET "billing_provider" = 'stripe',
+    "billing_customer_id" = c."stripe_customer_id",
+    "updated_at" = now()
+FROM (
+  SELECT DISTINCT ON (fc."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"))
+         fc."workspace_id",
+         lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C") AS "email",
+         fc."stripe_customer_id"
+  FROM "flow_checkouts" fc
+  JOIN "leads" l ON l."id" = fc."lead_id" AND l."workspace_id" = fc."workspace_id"
+  WHERE fc."status" = 'completed'
+    AND fc."stripe_customer_id" IS NOT NULL
+    AND fc."stripe_customer_id" <> ''
+    AND length(fc."stripe_customer_id") <= 255
+  ORDER BY fc."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"),
+           fc."completed_at" ASC NULLS LAST, fc."created_at" ASC, fc."id" ASC
+) c
+WHERE p."workspace_id" = c."workspace_id"
+  AND p."email" = c."email"
+  AND p."billing_customer_id" IS NULL;
+
+-- 3. Appointments, by attendee email: a Person a lead already made keeps its
+--    lead-derived name and created_at (ON CONFLICT DO NOTHING).
+INSERT INTO "people" ("workspace_id", "email", "name", "created_at", "updated_at")
+SELECT DISTINCT ON (a."workspace_id", lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C"))
+       a."workspace_id",
+       lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C"),
+       NULLIF(left(btrim(regexp_replace(a."attendee_name", '[\x01-\x1F\x7F-\x9F\u200E\u200F\u202A-\u202E\u2066-\u2069]', '', 'g')), 200), ''),
+       a."created_at",
+       now()
+FROM "appointments" a
+WHERE lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C") ~ '^[!-?A-~]+@[!-?A-~]+$'
+  AND length(lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C")) <= 254
+ORDER BY a."workspace_id", lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C"), a."created_at" ASC, a."id" ASC
+ON CONFLICT ("workspace_id", "email") DO NOTHING;
+
+-- 4. Stamps: every lead and appointment with a storable email points at its
+--    workspace's Person; a row already stamped is left alone.
+UPDATE "leads"
+SET "person_id" = p."id"
+FROM "people" p
+WHERE "leads"."person_id" IS NULL
+  AND p."workspace_id" = "leads"."workspace_id"
+  AND p."email" = lower(btrim("leads"."email", E' \t\n\r\f\x0B') COLLATE "C");
+
+UPDATE "appointments"
+SET "person_id" = p."id"
+FROM "people" p
+WHERE "appointments"."person_id" IS NULL
+  AND p."workspace_id" = "appointments"."workspace_id"
+  AND p."email" = lower(btrim("appointments"."attendee_email", E' \t\n\r\f\x0B') COLLATE "C");
+
+-- 5. user_id, verified only: the oldest promoted lead (by promoted_at, then
+--    created_at, then id) whose user is email-verified and whose verified
+--    address normalizes to the Person's. An unverified or differing user is
+--    never copied — the rule stampPersonUser applies to new rows.
+UPDATE "people" p
+SET "user_id" = c."user_id",
+    "updated_at" = now()
+FROM (
+  SELECT DISTINCT ON (l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"))
+         l."workspace_id",
+         lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C") AS "email",
+         l."promoted_user_id" AS "user_id"
+  FROM "leads" l
+  JOIN "users" u ON u."id" = l."promoted_user_id"
+  WHERE l."promoted_user_id" IS NOT NULL
+    AND u."email_verified" = true
+    AND lower(btrim(u."email", E' \t\n\r\f\x0B') COLLATE "C") = lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C")
+  ORDER BY l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"),
+           l."promoted_at" ASC NULLS LAST, l."created_at" ASC, l."id" ASC
+) c
+WHERE p."workspace_id" = c."workspace_id"
+  AND p."email" = c."email"
+  AND p."user_id" IS NULL;

package/templates/database/migrations/20261010130000_agent_grants_people_read/migration.sql

@@ -0,0 +1,20 @@
+-- #852 — an agent key may be granted people-read (spec
+-- docs/specs/852-person-the-per-workspace-client-spec.md D9).
+--
+-- Widens the agents_grants_allowed CHECK from the five #7864 permissions to
+-- six. The CHECK names the same six as @working-theory/validation's
+-- AGENT_GRANTABLE_PERMISSIONS; database/__tests__/agents.db.test.ts reads
+-- this file and fails if the two lists differ (SEC-7864-G).
+--
+-- PURELY ADDITIVE in effect: the new CHECK admits every row the old one
+-- admitted, so re-adding it cannot fail on existing data. No row changes.
+--
+-- Rollback: ALTER TABLE "agents" DROP CONSTRAINT "agents_grants_allowed";
+-- then re-add the five-id CHECK from 20261009120000_agent_grants. That
+-- re-add FAILS while any row holds people-read — remove those grants first.
+
+ALTER TABLE "agents" DROP CONSTRAINT "agents_grants_allowed";
+
+-- Only the six grantable permissions may be stored.
+ALTER TABLE "agents" ADD CONSTRAINT "agents_grants_allowed"
+  CHECK ("grants" <@ ARRAY['content-edit','content-publish','assets-write','magnets-manage','meeting-types-manage','people-read']::TEXT[]);