create-ailk 0.23.0 → 0.25.1

package/templates/database/migrations/20260912120000_listing_owner_link/migration.sql

@@ -1,49 +0,0 @@
--- The verified owner link on `project_listings` (#5295).
---
--- A listing carried `founder_email` and `lead_id` and no user link, so there
--- was no query for "the listings belonging to this signed-in person". The only
--- join available was a session's email against `founder_email` — and
--- `founder_email` is an UNVERIFIED string typed into an anonymous form, so that
--- join hands a stranger someone else's submission the first time two people
--- type the same address. These two columns are the ownership claim instead.
---
--- Plain scalars, no foreign key into `users`: ADR 0009 invariant #1 forbids a
--- relation across the namespace boundary, and `leads.promoted_user_id` /
--- `promoted_at` (20260714000000_add_lead_promotion_fields) are the same shape
--- for the same reason. The join is stable-id matching in the service layer.
---
--- `apps/api/src/services/listing-promotion.ts` is the sole writer, and it sets
--- the pair only when all three of these hold:
---   1. the reconciling user's OWN email is verified (`users.email_verified`) —
---      never a claimed or session-asserted address;
---   2. that verified address matches the row's `founder_email`;
---   3. the row's `site_id` is one of that user's own tenant workspaces.
--- Any one failing writes nothing.
---
--- NO BACKFILL, deliberately and permanently. Every existing row predates
--- verification, so deriving `owner_user_id` from `founder_email` here would
--- assert exactly the link nobody proved — the bug the column exists to remove.
--- Existing rows stay null, and a listing submitted by someone who never signs
--- in stays null for the life of the row: that is a legitimate resting state,
--- not a backlog to clean up.
---
--- The index backs the self-scoped read's whole WHERE clause
--- (`GET /v1/project-listings/me` — `owner_user_id = $1`, and nothing else: the
--- owner link IS the scope, so no site term joins it). Single-column by design —
--- the promotion match (`founder_email` + `site_id` + a null owner) is already
--- served by the existing (site_id, founder_email) index.
---
--- Forward-additive only: both columns are nullable with no default, so every
--- existing read and write is unaffected.
---
--- Rollback:
---   DROP INDEX "project_listings_owner_user_id_idx";
---   ALTER TABLE "project_listings" DROP COLUMN "owner_linked_at";
---   ALTER TABLE "project_listings" DROP COLUMN "owner_user_id";
-
--- AlterTable
-ALTER TABLE "project_listings" ADD COLUMN     "owner_user_id" TEXT,
-ADD COLUMN     "owner_linked_at" TIMESTAMP(3);
-
--- CreateIndex
-CREATE INDEX "project_listings_owner_user_id_idx" ON "project_listings"("owner_user_id");

package/templates/database/migrations/20260914120000_listing_founder_identity/migration.sql

@@ -1,123 +0,0 @@
--- The founder's structured identity and PROVEN email address on
--- `project_listings` (#5407).
---
--- Step one of the application collected ONE `founder_name` line and an email.
--- samhenry spec 316 D1 asks for first name, last name, email and phone, with
--- the two name parts stored separately, and 316 D6b asks that an application
--- whose emailed resume link was opened be marked verified so the operator can
--- filter on it at review.
---
--- FIVE NULLABLE COLUMNS, NO BACKFILL, NO CHANGE TO ANY EXISTING ONE.
---
--- `founder_first_name` / `founder_last_name` sit BESIDE `founder_name`, not
--- instead of it — the #5279 precedent that put six address parts beside the
--- single-line `address`. `founder_name` stays NOT NULL and stays the DISPLAY
--- string every existing reader already reads (the submit-time slug fallback,
--- the approve/reject email's greeting, the Slack review card's Founder row,
--- the build issue, the `routeLead` identity); where the parts are written the
--- server COMPOSES it from them, and where they are not it is the line the
--- founder typed, verbatim.
---
--- Composition runs ONE WAY ONLY, and that is why nothing here backfills.
--- "First" + "Last" composes into a display line deterministically; a display
--- line does not decompose into parts. Splitting on the last space mangles
--- "van der Berg", "Maria del Carmen" and every mononym, and a wrong split is
--- silent — it would put an invented surname on the row the approve email
--- greets and the operator reviews, with nothing to mark it as invented. A
--- null part is honest; a guessed one is not. Every existing row therefore
--- keeps `founder_name` byte-for-byte and keeps both parts NULL for the life
--- of the row.
---
--- `founder_phone` is the contact detail spec 316 D1 adds. Nullable at rest
--- for the #5036 D1 reason — every field the submit payload requires must be
--- storable half-filled — and nullable permanently besides: a row written
--- before #5407 has none, and a site may declare the question optional through
--- its own listing config. It NEVER rides the public read; the public row
--- shape omits it beside `founder_email`.
---
--- `email_verify_nonce_hash` and `email_verified_at` are the verification pair,
--- and the first is what makes the second mean what it says.
---
--- The obvious design is to stamp verification when the emailed resume link is
--- opened, keyed on the resume token that link carries. That design does not
--- work, and the reason is worth stating here because the column name does not
--- carry it: `start` returns the resume token to WHOEVER POSTED THE FORM, in
--- its own 201 body. The emailed link is a second copy of a credential the
--- applicant already holds — so two HTTP calls (open a draft under a
--- stranger's address, take the token out of the response, present it back)
--- would forge the stamp with no mailbox involved. Caught by this PR's
--- security review before it shipped.
---
--- So verification requires a SECOND credential the applicant never receives
--- any other way. `email_verify_nonce_hash` holds the sha-256 digest of a
--- 256-bit nonce minted at `start`, handed to nothing except the resume-email
--- builder (apps/api/src/services/project-listing-resume-email.ts), and
--- present in no response body and no log line. It reaches exactly one place:
--- the `?verify=` parameter of the link inside the email. Holding it means
--- having read mail sent to `founder_email`, which is what the stamp claims.
---
--- `email_verified_at` is therefore genuine evidence of address control, and
--- is still WRITE-ONCE: the verify call sets it only where it is still NULL,
--- by compare-and-swap, so a founder who opens the link five times is stamped
--- with the first opening and two concurrent openings produce one stamp
--- between them.
---
--- WHAT IT STILL DOES NOT SAY is who the founder is. `owner_user_id`
--- (20260912120000_listing_owner_link) is the identity claim and needs a
--- signed-in user whose own address the auth system verified. A row can carry
--- either, both, or neither.
---
--- Neither is a backfill target. Stamping an existing row would assert exactly
--- the event nobody recorded. NULL means "not verified", never "verification
--- failed" — and it is also what a site that has not switched the resume email
--- on will read forever, because the nonce is minted there and simply never
--- delivered. That is the correct outcome, not a gap.
---
--- `email_verify_nonce_hash` is UNIQUE, mirroring `resume_token_hash`: two
--- rows can never share a nonce, and the digest lookup is indexed. It is
--- cleared at `submit` beside the resume-token digest, so a credential that
--- leaks after the draft stops being a draft is inert twice over. It has NO
--- EXPIRY otherwise, by design and for the reason the service records: the
--- same message carries the resume token, so a TTL on the nonce alone would
--- bound nothing.
---
--- OPERATIONAL NOTE on the index. `CREATE UNIQUE INDEX` below is not
--- `CONCURRENTLY`, so it takes a SHARE lock and blocks writes to
--- `project_listings` while it builds. Every existing row is NULL there and
--- Postgres treats NULLs as distinct in a unique index (no NULLS NOT
--- DISTINCT), so it cannot fail on existing data and builds fast — and the
--- same property is why `submit` setting many rows back to NULL never
--- collides. Stated so whoever runs this against a large table knows it is
--- write-blocking DDL; it matches the `resume_token_hash` precedent.
---
--- Distinct from `owner_user_id` (20260912120000_listing_owner_link), which
--- needs a SIGNED-IN user whose own address the auth system verified. This
--- column needs no account at all: it records that a capability sent to
--- `founder_email` came back. A row can carry either, both, or neither.
---
--- NO INDEX on the other four. The verify write is keyed by the row's primary
--- key plus two digests, both already UNIQUE, and the operator filters
--- verified applications inside a site's already-indexed page of listings
--- (`project_listings_site_id_status_idx`) rather than by scanning on
--- `email_verified_at`.
---
--- Forward-additive only: all five columns are nullable with no default, so
--- every existing read and write is unaffected.
---
--- Rollback:
---   DROP INDEX "project_listings_email_verify_nonce_hash_key";
---   ALTER TABLE "project_listings" DROP COLUMN "email_verified_at";
---   ALTER TABLE "project_listings" DROP COLUMN "email_verify_nonce_hash";
---   ALTER TABLE "project_listings" DROP COLUMN "founder_phone";
---   ALTER TABLE "project_listings" DROP COLUMN "founder_last_name";
---   ALTER TABLE "project_listings" DROP COLUMN "founder_first_name";
-
--- AlterTable
-ALTER TABLE "project_listings" ADD COLUMN     "founder_first_name" TEXT,
-ADD COLUMN     "founder_last_name" TEXT,
-ADD COLUMN     "founder_phone" TEXT,
-ADD COLUMN     "email_verify_nonce_hash" TEXT,
-ADD COLUMN     "email_verified_at" TIMESTAMP(3);
-
--- CreateIndex
-CREATE UNIQUE INDEX "project_listings_email_verify_nonce_hash_key" ON "project_listings"("email_verify_nonce_hash");

package/templates/database/migrations/20260915120000_project_listing_solution/migration.sql

@@ -1,15 +0,0 @@
--- The founder's "how are you solving it?" answer on `project_listings` (#5096).
---
--- `problem` (step five) has had a column since the surface shipped; its
--- narrative other half has not, so samhenry PR #324's step six had nowhere to
--- write.
---
--- ONE NULLABLE COLUMN, NO DEFAULT, NO BACKFILL, NO CHANGE TO ANY EXISTING ONE.
--- Additive and opt-in: the field is absent from the platform's default
--- `collectedFields` mask (#5096 DD1), so no existing site can have it written
--- until that site names it. Every row written before this migration keeps a
--- NULL here, which the row schema already allows for every application field
--- (#5036 D1 — a half-filled draft is a legitimate row).
---
--- Rollback: ALTER TABLE "project_listings" DROP COLUMN "solution";
-ALTER TABLE "project_listings" ADD COLUMN "solution" TEXT;

package/templates/database/migrations/20260916120000_artifact_content_store/migration.sql

@@ -1,158 +0,0 @@
--- #5800 — the Artifact content store: roadmap D1 (generalize `Artifact`) and
--- D7 (`Asset`, workspace-scoped).
---
--- D1's one sentence: THE SESSION BECOMES PROVENANCE, THE WORKSPACE OWNS THE
--- ARTIFACT. Today `artifacts.session_id` is NOT NULL behind an ON DELETE
--- CASCADE, so deleting a conversation deletes the pages it produced. After this
--- migration the column is nullable behind ON DELETE SET NULL: the session is
--- where the artifact came from, not what keeps it alive.
---
--- The relaxation is bracketed by ZERO-ROW ASSERTIONS. It applies to an empty
--- database and to a populated one, and each assertion names a specific way the
--- relaxation could have lost data. A failed assertion aborts the transaction
--- with a message that says which rows to look at — the migration never proceeds
--- on a silent surprise, and it never backfills its way past one.
---
--- The rest is additive: four nullable-or-defaulted columns, two indexes, and a
--- new `assets` table. `content_type` is BACKFILLED from the legacy `type`
--- column rather than replacing it, because
--- apps/api/src/routes/workspaces/sessions.ts (a hard-floor surface) reads
--- `type` and must keep working unchanged; the two agree row-for-row when this
--- migration commits, and retiring `type` belongs to the card that moves that
--- route.
---
--- Rollback: drop the two indexes and the four columns, drop "assets", restore
--- the FK as NOT NULL + ON DELETE CASCADE. That restore is only safe while no
--- artifact has yet outlived its session.
-
--- ── PRE-ASSERTIONS (zero rows, or this migration does not run) ──────────────
-DO $$
-DECLARE
-  already_null bigint;
-  orphaned     bigint;
-BEGIN
-  -- "session_id" is NOT NULL today. A non-zero count here means the column is
-  -- not the shape this migration was written against — stop rather than guess.
-  SELECT count(*) INTO already_null FROM "artifacts" WHERE "session_id" IS NULL;
-  IF already_null <> 0 THEN
-    RAISE EXCEPTION
-      '#5800 pre-assertion: % artifact row(s) already carry a NULL session_id before the FK was relaxed; the column was expected NOT NULL',
-      already_null;
-  END IF;
-
-  -- The outgoing FK is what guarantees this is zero. Proving it BEFORE the
-  -- swap is what lets the post-assertion below attribute any orphan to the
-  -- swap itself.
-  SELECT count(*) INTO orphaned
-    FROM "artifacts" a
-    LEFT JOIN "agent_sessions" s ON s."id" = a."session_id"
-   WHERE s."id" IS NULL;
-  IF orphaned <> 0 THEN
-    RAISE EXCEPTION
-      '#5800 pre-assertion: % artifact row(s) point at an agent_sessions row that does not exist',
-      orphaned;
-  END IF;
-END $$;
-
--- The census the post-assertion compares against. ON COMMIT DROP: `prisma
--- migrate` runs each migration in one transaction, so this disappears with it.
-CREATE TEMP TABLE "_5800_artifact_census" ON COMMIT DROP AS
-  SELECT count(*) AS n FROM "artifacts";
-
--- ── The FK relaxation (D1) ─────────────────────────────────────────────────
--- DropForeignKey
-ALTER TABLE "artifacts" DROP CONSTRAINT "artifacts_session_id_fkey";
-
--- AlterTable
-ALTER TABLE "artifacts" ADD COLUMN     "content_type" TEXT NOT NULL DEFAULT 'text/document',
-ADD COLUMN     "locale" TEXT NOT NULL DEFAULT 'en',
-ADD COLUMN     "published_version_id" TEXT,
-ADD COLUMN     "slug" TEXT,
-ALTER COLUMN "session_id" DROP NOT NULL;
-
--- AddForeignKey
-ALTER TABLE "artifacts" ADD CONSTRAINT "artifacts_session_id_fkey" FOREIGN KEY ("session_id") REFERENCES "agent_sessions"("id") ON DELETE SET NULL ON UPDATE CASCADE;
-
--- Backfill: the new discriminator starts life agreeing with the legacy one, so
--- a pre-existing chat artifact reads identically through either column.
-UPDATE "artifacts" SET "content_type" = "type";
-
--- ── POST-ASSERTIONS (zero rows lost, zero rows nulled, zero drift) ─────────
-DO $$
-DECLARE
-  before_n bigint;
-  after_n  bigint;
-  nulled   bigint;
-  drift    bigint;
-BEGIN
-  SELECT n INTO before_n FROM "_5800_artifact_census";
-  SELECT count(*) INTO after_n FROM "artifacts";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION
-      '#5800 post-assertion: artifact count changed across the FK relaxation (% -> %)',
-      before_n, after_n;
-  END IF;
-
-  -- Relaxing the constraint must not itself null anyone's provenance. Rows
-  -- become NULL later, one at a time, as sessions are deleted.
-  SELECT count(*) INTO nulled FROM "artifacts" WHERE "session_id" IS NULL;
-  IF nulled <> 0 THEN
-    RAISE EXCEPTION
-      '#5800 post-assertion: relaxing the FK left % artifact row(s) with a NULL session_id',
-      nulled;
-  END IF;
-
-  SELECT count(*) INTO drift
-    FROM "artifacts" WHERE "content_type" IS DISTINCT FROM "type";
-  IF drift <> 0 THEN
-    RAISE EXCEPTION
-      '#5800 post-assertion: % artifact row(s) disagree between content_type and the legacy type column',
-      drift;
-  END IF;
-END $$;
-
--- ── Content-store identity + the list index (D1) ───────────────────────────
--- CreateIndex
-CREATE INDEX "artifacts_workspace_id_content_type_updated_at_idx" ON "artifacts"("workspace_id", "content_type", "updated_at");
-
--- CreateIndex
--- `slug` is NULL until publish and NULLs never collide in a Postgres unique
--- index, so a workspace may hold any number of unpublished drafts while
--- exactly one artifact may claim a given published path.
-CREATE UNIQUE INDEX "artifacts_workspace_id_content_type_locale_slug_key" ON "artifacts"("workspace_id", "content_type", "locale", "slug");
-
--- ── Asset (D7) ─────────────────────────────────────────────────────────────
--- Shaped after `deliverable_assets` (20260811050000_add_deliverable_models):
--- the bytes live in the row. Same CreateTable + CreateIndex + ADR-0031 rule-3
--- id-format completion in ONE migration as
--- 20260911180000_consent_grants, since the table is new and needs no retrofit.
--- CreateTable
-CREATE TABLE "assets" (
-    "id" TEXT NOT NULL DEFAULT ('asset_'::text || (uuidv7())::text),
-    "workspace_id" TEXT NOT NULL,
-    "key" TEXT NOT NULL,
-    "filename" TEXT NOT NULL,
-    "content_type" TEXT NOT NULL,
-    "bytes" BYTEA NOT NULL,
-    "size" INTEGER NOT NULL,
-    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-
-    CONSTRAINT "assets_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE INDEX "assets_workspace_id_idx" ON "assets"("workspace_id");
-
--- CreateIndex
-CREATE UNIQUE INDEX "assets_workspace_id_key_key" ON "assets"("workspace_id", "key");
-
--- ADR-0031 rule 3 — assets: asset_ (registered in
--- packages/ids/src/registry.ts ENTITY_PREFIX.asset; this migration's path is
--- added to migration-sync.test.ts's PK_CHECK_MIGRATIONS). workspace_id is a
--- relation-free scope column (ADR-0009 invariant 1) and gets the same CHECK
--- every other content-namespace table's does.
-ALTER TABLE "assets" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "assets" ALTER COLUMN "id" SET DEFAULT ('asset_'::text || (uuidv7())::text);
-ALTER TABLE "assets" ADD CONSTRAINT "assets_id_format" CHECK ("id" ~ '^asset_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "assets" ALTER COLUMN "workspace_id" TYPE text COLLATE "C";
-ALTER TABLE "assets" ADD CONSTRAINT "assets_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20260917120000_callback_request_confirm/migration.sql

@@ -1,40 +0,0 @@
--- #5970 — request-and-confirm: the callback row gains a confirm/pay lifecycle
--- (D-67 / SUB-100, spec docs/specs/5970-request-and-confirm-spec.md § 4.3).
---
--- Eleven nullable columns and two indexes on "callbacks". Every column is
--- NULL-able with no default, so on Postgres this ALTER TABLE is metadata-only:
--- no table rewrite, no backfill, no lock held for the length of a scan.
---
--- Nothing here relaxes a constraint and nothing here backfills, so — unlike
--- 20260916120000_artifact_content_store — this migration carries no zero-row
--- pre-assertion block: there is no way for it to lose a row.
---
--- The two indexes are the webhook stamp's `where` (spec § D8). Without them
--- every checkout.session.completed carrying a payment_link would sequential-
--- scan "callbacks" on a hot path. "stripe_checkout_session_id" carries no
--- index deliberately: nothing queries by it — it is a support-lookup column.
---
--- Rollback: drop the two indexes and the eleven columns. Safe unconditionally
--- while nothing but #5970's own code reads them.
-
-ALTER TABLE "callbacks"
-  ADD COLUMN "confirm_token_hash" TEXT,
-  ADD COLUMN "confirm_token_expires_at" TIMESTAMP(3),
-  ADD COLUMN "confirmed_at" TIMESTAMP(3),
-  ADD COLUMN "confirmed_time" TEXT,
-  ADD COLUMN "buyer_email" TEXT,
-  ADD COLUMN "amount_minor" INTEGER,
-  ADD COLUMN "currency" TEXT,
-  ADD COLUMN "stripe_payment_link_id" TEXT,
-  ADD COLUMN "stripe_checkout_session_id" TEXT,
-  ADD COLUMN "stripe_invoice_id" TEXT,
-  ADD COLUMN "paid_at" TIMESTAMP(3);
-
--- The digest is unique: two rows sharing one is a mint bug, and the constraint
--- is what turns that bug into a write failure instead of a silent cross-row
--- credential.
-CREATE UNIQUE INDEX "callbacks_confirm_token_hash_key" ON "callbacks"("confirm_token_hash");
-
-CREATE INDEX "callbacks_stripe_payment_link_id_idx" ON "callbacks"("stripe_payment_link_id");
-
-CREATE INDEX "callbacks_stripe_invoice_id_idx" ON "callbacks"("stripe_invoice_id");

package/templates/database/migrations/20260918120000_add_appointment/migration.sql

@@ -1,67 +0,0 @@
--- #6085 — the Appointment model: a Cal.com booking normalized from the new
--- webhook receiver (brief H7, spec docs/specs/6085-appointments-from-cal-com-webhooks-spec.md § 4.3).
---
--- One new table, three indexes, in the house style of
--- 20260903010000_add_playbook_instance (CreateTable + CreateIndex immediately
--- followed by the ADR-0031 rule-3 id-format completion, in ONE migration
--- since the table is new and needs no retrofit).
---
--- The unique index over (site_id, provider, provider_booking_uid) is the
--- LOAD-BEARING line of this migration: it is the spec's own idempotency key
--- (§ D4) — a table without it makes "exactly one Appointment row per booking
--- uid" unenforceable, and § D7(a)'s guarded-write shape races on precisely
--- this index.
---
--- No backfill, no constraint relaxed, no existing table touched, so this
--- migration carries no zero-row pre-assertion block — there is no way for it
--- to lose a row.
---
--- Rollback: DROP TABLE "appointments". Safe unconditionally while nothing but
--- #6085's own code reads it.
-
--- CreateTable
-CREATE TABLE "appointments" (
-    "id" TEXT NOT NULL DEFAULT ('appt_'::text || (uuidv7())::text),
-    "site_id" VARCHAR(200) NOT NULL,
-    "provider_booking_uid" VARCHAR(200) NOT NULL,
-    "provider" VARCHAR(32) NOT NULL DEFAULT 'cal',
-    "start_time" TIMESTAMP(3) NOT NULL,
-    "end_time" TIMESTAMP(3) NOT NULL,
-    "title" VARCHAR(300),
-    "attendee_name" VARCHAR(120) NOT NULL,
-    "attendee_email" VARCHAR(254) NOT NULL,
-    "attendee_time_zone" VARCHAR(64),
-    "status" VARCHAR(32) NOT NULL,
-    "paid" BOOLEAN NOT NULL DEFAULT false,
-    "payment_initiated_at" TIMESTAMP(3),
-    "no_show" BOOLEAN NOT NULL DEFAULT false,
-    "cancelled_at" TIMESTAMP(3),
-    "lifecycle_event_at" TIMESTAMP(3) NOT NULL,
-    "payment_event_at" TIMESTAMP(3),
-    "no_show_event_at" TIMESTAMP(3),
-    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updated_at" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "appointments_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
--- The idempotency key (§ D4) — see the file header. `provider` is included
--- per § 9 SEC-10 so a second scheduling provider's uid space cannot collide
--- with this one's (#4288).
-CREATE UNIQUE INDEX "appointments_site_id_provider_provider_booking_uid_key" ON "appointments"("site_id", "provider", "provider_booking_uid");
-
--- CreateIndex
--- The read's `where` + `order by` (§ D6). Without it every appointments page
--- load sequential-scans "appointments".
-CREATE INDEX "appointments_site_id_start_time_idx" ON "appointments"("site_id", "start_time");
-
--- CreateIndex
-CREATE INDEX "appointments_created_at_idx" ON "appointments"("created_at");
-
--- ADR-0031 rule 3 — appointments: appt_ (registered in
--- packages/ids/src/registry.ts ENTITY_PREFIX.appointment; this migration's
--- path is added to migration-sync.test.ts's PK_CHECK_MIGRATIONS).
-ALTER TABLE "appointments" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "appointments" ALTER COLUMN "id" SET DEFAULT ('appt_'::text || (uuidv7())::text);
-ALTER TABLE "appointments" ADD CONSTRAINT "appointments_id_format" CHECK ("id" ~ '^appt_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20260918120000_asset_metadata_columns/migration.sql

@@ -1,70 +0,0 @@
--- #6092 — S4's data tier: an asset carries title, description and tags.
---
--- Today `assets` holds bytes and a filename and nothing the owner wrote
--- (decisions.html D10: "an asset has a filename and dimensions only"). The
--- lightbox edits three things in place — a title, a description and a set of
--- tags — so the table gains exactly those three columns.
---
--- STRICTLY ADDITIVE. Nothing is dropped, renamed, relaxed or backfilled. The
--- `(workspace_id, key)` identity, the `assets_id_format` and
--- `assets_workspace_id_format` CHECKs and the `asset_`+UUIDv7 default are all
--- untouched, so a pre-existing row stays valid and an INSERT written before
--- this migration keeps working unchanged.
---
--- `tags` is TEXT[] with an empty-array default rather than a nullable column:
--- an untagged asset is an empty set, not an unknown one, and a NULL would give
--- two spellings of the same state. It carries tag SLUGS, never the human
--- labels, and it is deliberately UNCONSTRAINED — two vocabularies ride it (the
--- twelve asset tags and D9's four document tags, since a document is a row in
--- this same store), and the "fixed set" of D10 is a surface affordance. A tag
--- whose slug a surface cannot resolve is that surface's problem to render, not
--- a reason to reject an upload.
---
--- `title` and `description` are nullable with no default: NULL means the owner
--- has not written one, which is distinct from an empty string meaning they
--- cleared it. `title` is NOT backfilled from `filename` — they are different
--- facts and the lightbox shows both.
---
--- Rollback: ALTER TABLE "assets" DROP COLUMN "tags", DROP COLUMN
--- "description", DROP COLUMN "title". Safe unconditionally; the columns carry
--- no constraint and nothing references them.
-
--- The census the post-assertion compares against. ON COMMIT DROP: `prisma
--- migrate` runs each migration in one transaction, so this disappears with it.
-CREATE TEMP TABLE "_6092_asset_census" ON COMMIT DROP AS
-  SELECT count(*) AS n FROM "assets";
-
--- AlterTable
-ALTER TABLE "assets" ADD COLUMN     "title" TEXT,
-ADD COLUMN     "description" TEXT,
-ADD COLUMN     "tags" TEXT[] DEFAULT ARRAY[]::TEXT[];
-
--- ── POST-ASSERTIONS (no row lost; every pre-existing row reads back empty) ──
--- This is AC-1's second half, asserted against the rows the target database
--- actually holds rather than against a fixture's.
-DO $$
-DECLARE
-  before_n bigint;
-  after_n  bigint;
-  written  bigint;
-BEGIN
-  SELECT n INTO before_n FROM "_6092_asset_census";
-  SELECT count(*) INTO after_n FROM "assets";
-  IF before_n <> after_n THEN
-    RAISE EXCEPTION
-      '#6092 post-assertion: asset count changed across a purely additive migration (% -> %)',
-      before_n, after_n;
-  END IF;
-
-  -- Adding the columns must not itself author metadata for anyone. Rows gain a
-  -- title, a description or a tag later, one at a time, from the lightbox.
-  SELECT count(*) INTO written FROM "assets"
-   WHERE "title" IS NOT NULL
-      OR "description" IS NOT NULL
-      OR "tags" IS DISTINCT FROM ARRAY[]::TEXT[];
-  IF written <> 0 THEN
-    RAISE EXCEPTION
-      '#6092 post-assertion: % pre-existing asset row(s) came out of the migration with metadata already set',
-      written;
-  END IF;
-END $$;