create-ailk 0.23.0 → 0.25.1

package/templates/database/migrations/20261010121000_person_backfill/migration.sql

@@ -1,132 +0,0 @@
--- #852 — the Person backfill (spec
--- docs/specs/852-person-the-per-workspace-client-spec.md D2, D4).
---
--- Fills "people" from the rows the hub already holds and stamps
--- leads.person_id and appointments.person_id, so the People list is not
--- empty on the day it ships. Set-based and idempotent: every insert is
--- ON CONFLICT DO NOTHING and every update is guarded by IS NULL, so running
--- this text twice changes nothing the first run wrote.
---
--- THE SAME TEXT, byte for byte, is database/scripts/person-backfill.sql. The
--- previous deployment keeps writing leads and appointments without a
--- person_id between this migration and the cutover to the new code; run
--- that script ONCE against the hub database after the cutover to stamp them.
--- database/__tests__/person.db.test.ts asserts the two files are identical
--- and that a second run changes no row.
---
--- Normalization — the SQL twin of apps/api/src/services/person.ts's
--- normalizePersonEmail / isStorablePersonEmail:
---   N(x)     = lower(btrim(x, E' \t\n\r\f\x0B') COLLATE "C")
---              (\x0B is vertical tab; an E-string has no \v escape — E'\v'
---              is the letter v, which would strip the v of every .dev)
---   VALID(e) = e ~ '^[!-?A-~]+@[!-?A-~]+$' AND length(e) <= 254
---   NAME(x)  = C0/C1 controls and bidi controls removed, trimmed, cut to
---              200 characters; empty → NULL
--- A row whose email is not VALID makes no Person and keeps person_id NULL.
---
--- Sources, in order: leads (oldest first), then completed hub FlowCheckouts
--- through their lead (the customer id, first writer wins), then appointments
--- by attendee email. Subscriber is NOT a source; FlowSession, ProjectListing
--- and DeliverableGrant reach a Person through their lead at read time.
--- The join to "users" reads the auth namespace inside this one-off
--- statement only; it adds no foreign key (ADR 0009 invariant 1).
---
--- Rollback: nothing to undo on its own — dropping 20261010120000_person's
--- table and columns removes everything this wrote.
-
--- 1. Leads, oldest first: one Person per (workspace, normalized email). The
---    name is the oldest lead's payload.name when it is a JSON string.
-INSERT INTO "people" ("workspace_id", "email", "name", "created_at", "updated_at")
-SELECT DISTINCT ON (l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"))
-       l."workspace_id",
-       lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"),
-       CASE WHEN jsonb_typeof(l."payload" -> 'name') = 'string'
-            THEN NULLIF(left(btrim(regexp_replace(l."payload" ->> 'name', '[\x01-\x1F\x7F-\x9F\u200E\u200F\u202A-\u202E\u2066-\u2069]', '', 'g')), 200), '')
-       END,
-       l."created_at",
-       now()
-FROM "leads" l
-WHERE lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C") ~ '^[!-?A-~]+@[!-?A-~]+$'
-  AND length(lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C")) <= 254
-ORDER BY l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"), l."created_at" ASC, l."id" ASC
-ON CONFLICT ("workspace_id", "email") DO NOTHING;
-
--- 2. Hub FlowCheckouts, through their lead (same workspace): the oldest
---    completed checkout with a customer id writes it onto a Person that has
---    none. First writer wins — oldest by completed_at, then created_at, then id.
-UPDATE "people" p
-SET "billing_provider" = 'stripe',
-    "billing_customer_id" = c."stripe_customer_id",
-    "updated_at" = now()
-FROM (
-  SELECT DISTINCT ON (fc."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"))
-         fc."workspace_id",
-         lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C") AS "email",
-         fc."stripe_customer_id"
-  FROM "flow_checkouts" fc
-  JOIN "leads" l ON l."id" = fc."lead_id" AND l."workspace_id" = fc."workspace_id"
-  WHERE fc."status" = 'completed'
-    AND fc."stripe_customer_id" IS NOT NULL
-    AND fc."stripe_customer_id" <> ''
-    AND length(fc."stripe_customer_id") <= 255
-  ORDER BY fc."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"),
-           fc."completed_at" ASC NULLS LAST, fc."created_at" ASC, fc."id" ASC
-) c
-WHERE p."workspace_id" = c."workspace_id"
-  AND p."email" = c."email"
-  AND p."billing_customer_id" IS NULL;
-
--- 3. Appointments, by attendee email: a Person a lead already made keeps its
---    lead-derived name and created_at (ON CONFLICT DO NOTHING).
-INSERT INTO "people" ("workspace_id", "email", "name", "created_at", "updated_at")
-SELECT DISTINCT ON (a."workspace_id", lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C"))
-       a."workspace_id",
-       lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C"),
-       NULLIF(left(btrim(regexp_replace(a."attendee_name", '[\x01-\x1F\x7F-\x9F\u200E\u200F\u202A-\u202E\u2066-\u2069]', '', 'g')), 200), ''),
-       a."created_at",
-       now()
-FROM "appointments" a
-WHERE lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C") ~ '^[!-?A-~]+@[!-?A-~]+$'
-  AND length(lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C")) <= 254
-ORDER BY a."workspace_id", lower(btrim(a."attendee_email", E' \t\n\r\f\x0B') COLLATE "C"), a."created_at" ASC, a."id" ASC
-ON CONFLICT ("workspace_id", "email") DO NOTHING;
-
--- 4. Stamps: every lead and appointment with a storable email points at its
---    workspace's Person; a row already stamped is left alone.
-UPDATE "leads"
-SET "person_id" = p."id"
-FROM "people" p
-WHERE "leads"."person_id" IS NULL
-  AND p."workspace_id" = "leads"."workspace_id"
-  AND p."email" = lower(btrim("leads"."email", E' \t\n\r\f\x0B') COLLATE "C");
-
-UPDATE "appointments"
-SET "person_id" = p."id"
-FROM "people" p
-WHERE "appointments"."person_id" IS NULL
-  AND p."workspace_id" = "appointments"."workspace_id"
-  AND p."email" = lower(btrim("appointments"."attendee_email", E' \t\n\r\f\x0B') COLLATE "C");
-
--- 5. user_id, verified only: the oldest promoted lead (by promoted_at, then
---    created_at, then id) whose user is email-verified and whose verified
---    address normalizes to the Person's. An unverified or differing user is
---    never copied — the rule stampPersonUser applies to new rows.
-UPDATE "people" p
-SET "user_id" = c."user_id",
-    "updated_at" = now()
-FROM (
-  SELECT DISTINCT ON (l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"))
-         l."workspace_id",
-         lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C") AS "email",
-         l."promoted_user_id" AS "user_id"
-  FROM "leads" l
-  JOIN "users" u ON u."id" = l."promoted_user_id"
-  WHERE l."promoted_user_id" IS NOT NULL
-    AND u."email_verified" = true
-    AND lower(btrim(u."email", E' \t\n\r\f\x0B') COLLATE "C") = lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C")
-  ORDER BY l."workspace_id", lower(btrim(l."email", E' \t\n\r\f\x0B') COLLATE "C"),
-           l."promoted_at" ASC NULLS LAST, l."created_at" ASC, l."id" ASC
-) c
-WHERE p."workspace_id" = c."workspace_id"
-  AND p."email" = c."email"
-  AND p."user_id" IS NULL;

package/templates/database/migrations/20261010130000_agent_grants_people_read/migration.sql

@@ -1,20 +0,0 @@
--- #852 — an agent key may be granted people-read (spec
--- docs/specs/852-person-the-per-workspace-client-spec.md D9).
---
--- Widens the agents_grants_allowed CHECK from the five #7864 permissions to
--- six. The CHECK names the same six as @working-theory/validation's
--- AGENT_GRANTABLE_PERMISSIONS; database/__tests__/agents.db.test.ts reads
--- this file and fails if the two lists differ (SEC-7864-G).
---
--- PURELY ADDITIVE in effect: the new CHECK admits every row the old one
--- admitted, so re-adding it cannot fail on existing data. No row changes.
---
--- Rollback: ALTER TABLE "agents" DROP CONSTRAINT "agents_grants_allowed";
--- then re-add the five-id CHECK from 20261009120000_agent_grants. That
--- re-add FAILS while any row holds people-read — remove those grants first.
-
-ALTER TABLE "agents" DROP CONSTRAINT "agents_grants_allowed";
-
--- Only the six grantable permissions may be stored.
-ALTER TABLE "agents" ADD CONSTRAINT "agents_grants_allowed"
-  CHECK ("grants" <@ ARRAY['content-edit','content-publish','assets-write','magnets-manage','meeting-types-manage','people-read']::TEXT[]);

package/templates/database/migrations/20261011120000_member_area/migration.sql

@@ -1,158 +0,0 @@
--- #7877 — the member area contract (spec
--- docs/specs/7877-the-member-area-contract-a-spec.md D1, D2, D3).
---
---   pieces (inbox)       — one deliverable for one client: a title, a stage
---                          drawn from the workspace's declared list, a
---                          needs-client flag. Written only through
---                          apps/api's tenantDb(tenant).memberArea.
---   interactions (inbox) — one outbound message on the 'member' channel to
---                          one client, optionally carrying a workspace
---                          library asset. The original CRM spec's
---                          Interaction table cut to one channel and one
---                          direction; an inbound reply is a later second
---                          direction value on this table.
---   workspace_piece_stages (config) — a workspace's declared piece stages,
---                          in order, one row per workspace. No row means the
---                          product default, which lives in apps/api only.
---   people_id_workspace_id_key — a unique index over a pair the PK already
---                          makes unique: the target of the composite
---                          (person_id, workspace_id) foreign keys, so "a
---                          Person of the same workspace" is a database fact.
---
--- Both foreign keys stay inside the inbox namespace (ADR 0009 invariant 1).
--- workspace_id, asset_id, created_by and updated_by name rows of other
--- namespaces: plain columns with format CHECKs, no foreign key. Neither new
--- inbox table carries an email.
---
--- PURELY ADDITIVE, DDL ONLY: three new tables and one unique index on
--- "people". No existing row changes. The unique index builds under the
--- file's transaction, holding a SHARE lock on "people" (writes wait, reads do
--- not) for one scan of a table that is one row per client.
---
--- Rollout: deploy this migration BEFORE the API code that reads or writes
--- these tables; code without them fails every member-area read and write.
---
--- Rollback: DROP TABLE "interactions"; DROP TABLE "pieces"; DROP TABLE
--- "workspace_piece_stages"; DROP INDEX "people_id_workspace_id_key"; (the
--- indexes, foreign keys and CHECKs go with them). Safe while nothing but
--- #7877's own code reads them.
-
--- CreateTable
-CREATE TABLE "workspace_piece_stages" (
-    "id" TEXT NOT NULL DEFAULT ('pstages_'::text || (uuidv7())::text),
-    "workspace_id" TEXT NOT NULL,
-    "stages" TEXT[],
-    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updated_at" TIMESTAMPTZ NOT NULL,
-
-    CONSTRAINT "workspace_piece_stages_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "pieces" (
-    "id" TEXT NOT NULL DEFAULT ('piece_'::text || (uuidv7())::text),
-    "workspace_id" TEXT NOT NULL,
-    "person_id" TEXT NOT NULL,
-    "title" VARCHAR(200) NOT NULL,
-    "stage" VARCHAR(40) NOT NULL,
-    "needs_client" BOOLEAN NOT NULL DEFAULT false,
-    "updated_by" TEXT NOT NULL,
-    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updated_at" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "pieces_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "interactions" (
-    "id" TEXT NOT NULL DEFAULT ('intx_'::text || (uuidv7())::text),
-    "workspace_id" TEXT NOT NULL,
-    "person_id" TEXT NOT NULL,
-    "channel" VARCHAR(16) NOT NULL,
-    "direction" VARCHAR(16) NOT NULL,
-    "subject" VARCHAR(200) NOT NULL,
-    "body" TEXT NOT NULL,
-    "asset_id" TEXT,
-    "created_by" TEXT NOT NULL,
-    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "read_at" TIMESTAMP(3),
-
-    CONSTRAINT "interactions_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
--- One stage list per workspace — the WorkspaceMeetings shape.
-CREATE UNIQUE INDEX "workspace_piece_stages_workspace_id_key" ON "workspace_piece_stages"("workspace_id");
-
--- CreateIndex
--- A client's pieces: workspace_id = $1 AND person_id = $2 ORDER BY created_at DESC.
-CREATE INDEX "pieces_workspace_id_person_id_created_at_idx" ON "pieces"("workspace_id", "person_id", "created_at");
-
--- CreateIndex
--- A client's messages, the same read shape as pieces.
-CREATE INDEX "interactions_workspace_id_person_id_created_at_idx" ON "interactions"("workspace_id", "person_id", "created_at");
-
--- CreateIndex
--- The public asset read's "is this asset attached to any message" count (D18).
-CREATE INDEX "interactions_asset_id_idx" ON "interactions"("asset_id");
-
--- CreateIndex
--- Redundant with the PK; the composite foreign keys below need it as their target.
-CREATE UNIQUE INDEX "people_id_workspace_id_key" ON "people"("id", "workspace_id");
-
--- AddForeignKey
--- A piece names a Person of ITS OWN workspace; deleting a Person with a piece is refused.
-ALTER TABLE "pieces" ADD CONSTRAINT "pieces_person_fk" FOREIGN KEY ("person_id", "workspace_id") REFERENCES "people"("id", "workspace_id") ON DELETE RESTRICT ON UPDATE CASCADE;
-
--- AddForeignKey
--- The same rule for a message.
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_person_fk" FOREIGN KEY ("person_id", "workspace_id") REFERENCES "people"("id", "workspace_id") ON DELETE RESTRICT ON UPDATE CASCADE;
-
--- ADR-0031 rule 3 — pieces: piece_, interactions: intx_,
--- workspace_piece_stages: pstages_ (registered in
--- packages/ids/src/registry.ts; this migration's path is added to
--- migration-sync.test.ts's PK_CHECK_MIGRATIONS). Each reference column
--- carries the format CHECK of the entity it names, in the person-migration
--- shape.
-ALTER TABLE "pieces" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "pieces" ALTER COLUMN "id" SET DEFAULT ('piece_'::text || (uuidv7())::text);
-ALTER TABLE "pieces" ADD CONSTRAINT "pieces_id_format" CHECK ("id" ~ '^piece_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "pieces" ADD CONSTRAINT "pieces_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "pieces" ADD CONSTRAINT "pieces_person_id_format" CHECK ("person_id" ~ '^person_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "pieces" ADD CONSTRAINT "pieces_updated_by_format" CHECK ("updated_by" ~ '^user_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-
-ALTER TABLE "interactions" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "interactions" ALTER COLUMN "id" SET DEFAULT ('intx_'::text || (uuidv7())::text);
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_id_format" CHECK ("id" ~ '^intx_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_person_id_format" CHECK ("person_id" ~ '^person_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_created_by_format" CHECK ("created_by" ~ '^user_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_asset_id_format" CHECK ("asset_id" ~ '^asset_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-
-ALTER TABLE "workspace_piece_stages" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "workspace_piece_stages" ALTER COLUMN "id" SET DEFAULT ('pstages_'::text || (uuidv7())::text);
-ALTER TABLE "workspace_piece_stages" ADD CONSTRAINT "workspace_piece_stages_id_format" CHECK ("id" ~ '^pstages_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "workspace_piece_stages" ADD CONSTRAINT "workspace_piece_stages_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-
--- A piece's title is 1–200 characters once trimmed; a stage is a slug. Which
--- slugs a workspace accepts is its declared list, checked at write time by
--- the API — never an enum here or in packages/validation.
-ALTER TABLE "pieces" ADD CONSTRAINT "pieces_title_length"
-  CHECK (char_length(btrim("title")) BETWEEN 1 AND 200);
-ALTER TABLE "pieces" ADD CONSTRAINT "pieces_stage_format"
-  CHECK ("stage" ~ '^[a-z0-9][a-z0-9-]{0,39}$');
-
--- One channel and one direction in this slice. An inbound reply widens
--- interactions_direction_allowed in its own migration.
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_channel_allowed"
-  CHECK ("channel" = 'member');
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_direction_allowed"
-  CHECK ("direction" = 'outbound');
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_subject_length"
-  CHECK (char_length(btrim("subject")) BETWEEN 1 AND 200);
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_body_length"
-  CHECK (char_length(btrim("body")) BETWEEN 1 AND 10000);
-
--- A declared list holds 1–20 stages (never NULL: no row is the default).
-ALTER TABLE "workspace_piece_stages" ADD CONSTRAINT "workspace_piece_stages_count"
-  CHECK ("stages" IS NOT NULL AND cardinality("stages") BETWEEN 1 AND 20);

package/templates/database/migrations/20261011130000_agent_grants_member_pieces_manage/migration.sql

@@ -1,21 +0,0 @@
--- #7878 — an agent key may be granted member-pieces-manage: a client's
--- pieces, plan and outbound messages (#7877's operator writes).
---
--- Widens the agents_grants_allowed CHECK from the six #852 permissions to
--- seven. The CHECK names the same seven as @working-theory/validation's
--- AGENT_GRANTABLE_PERMISSIONS; database/__tests__/agents.db.test.ts reads
--- this file and fails if the two lists differ (SEC-7864-G).
---
--- PURELY ADDITIVE in effect: the new CHECK admits every row the old one
--- admitted, so re-adding it cannot fail on existing data. No row changes.
---
--- Rollback: ALTER TABLE "agents" DROP CONSTRAINT "agents_grants_allowed";
--- then re-add the six-id CHECK from 20261010130000_agent_grants_people_read.
--- That re-add FAILS while any row holds member-pieces-manage — remove those
--- grants first.
-
-ALTER TABLE "agents" DROP CONSTRAINT "agents_grants_allowed";
-
--- Only the seven grantable permissions may be stored.
-ALTER TABLE "agents" ADD CONSTRAINT "agents_grants_allowed"
-  CHECK ("grants" <@ ARRAY['content-edit','content-publish','assets-write','magnets-manage','meeting-types-manage','people-read','member-pieces-manage']::TEXT[]);

package/templates/database/migrations/20261012120000_member_contract/migration.sql

@@ -1,192 +0,0 @@
--- #8168 — the member area data model (spec
--- docs/specs/8168-member-area-data-model-spec.md D1–D3, D5, D7–D9, D12).
---
---   piece_versions (inbox)          — one delivery of a piece to its client:
---                                     a private library file OR an https
---                                     link, numbered from 1 per piece, with
---                                     the client's review recorded on it.
---                                     NO round count, limit or remaining
---                                     column (#8140 disposition 3).
---   pieces.approved_at              — set with an `approved` review; freezes
---                                     review (D5).
---   pieces_id_person_id_workspace_id_key — a unique index over a triple the
---                                     PK already makes unique: the target of
---                                     piece_versions_piece_fk, so "a piece of
---                                     THIS Person in THIS workspace" is one
---                                     database fact (D1).
---   interactions.kind / .payload    — `message` · `quote` · `review`, and the
---                                     stored payload of a quote or review;
---                                     `inbound` joins `outbound` (D3). An
---                                     outbound row stays a payload-free
---                                     `message` — #7877's rows, unchanged.
---   flow_definitions.customers_enabled — whether a signed-in client may submit
---                                     the magnet from the member area (D7).
---   the `request-quote` magnet      — one draft `contact` magnet with
---                                     customers_enabled = true, backfilled
---                                     into EVERY existing workspace (D8).
---
--- The only new foreign key stays inside the inbox namespace (ADR 0009
--- invariant 1). asset_id and delivered_by name rows of other namespaces:
--- plain columns with format CHECKs, no foreign key. The backfill reads
--- "workspaces" (auth namespace) in SQL only — no relation.
---
--- ADDITIVE: every ADD COLUMN is nullable or carries a constant default, so no
--- existing row fails a new CHECK — every existing interaction is an outbound
--- `message` with no payload, which the replaced and added CHECKs admit
--- (interactions_body_length keeps its 1–10000 rule for a `message`). The
--- unique index on "pieces" builds under the file's transaction, holding a
--- SHARE lock on "pieces" for one scan of a table that is a few rows per
--- client. The backfill inserts one row per workspace and NEVER overwrites a
--- workspace's existing (site_id, slug) row (ON CONFLICT DO NOTHING) —
--- re-running the block adds nothing.
---
--- Rollout: deploy this migration BEFORE any code that writes piece_versions,
--- pieces.approved_at, an inbound interaction, interactions.kind/payload or
--- flow_definitions.customers_enabled. Code written before it never names the
--- new columns, so it keeps working against the migrated database.
---
--- Rollback (safe while nothing but #8168's siblings use the new surface):
---   DELETE FROM "flow_definitions" WHERE "slug" = 'request-quote' AND "status" = 'draft' AND "customers_enabled";
---   ALTER TABLE "flow_definitions" DROP COLUMN "customers_enabled";
---   DELETE FROM "interactions" WHERE "direction" = 'inbound';
---   ALTER TABLE "interactions" DROP CONSTRAINT "interactions_kind_allowed",
---     DROP CONSTRAINT "interactions_outbound_shape", DROP CONSTRAINT "interactions_payload_by_kind",
---     DROP CONSTRAINT "interactions_payload_size", DROP CONSTRAINT "interactions_body_length",
---     DROP CONSTRAINT "interactions_direction_allowed";
---   ALTER TABLE "interactions" DROP COLUMN "kind", DROP COLUMN "payload";
---   then re-add #7877's interactions_direction_allowed (direction = 'outbound')
---   and interactions_body_length (1–10000 once trimmed) from
---   20261011120000_member_area;
---   DROP TABLE "piece_versions"; DROP INDEX "pieces_id_person_id_workspace_id_key";
---   ALTER TABLE "pieces" DROP COLUMN "approved_at";
--- The first DELETE also removes an operator's own edits to a still-draft
--- seeded magnet; check for those before rolling back.
-
--- AlterTable
-ALTER TABLE "flow_definitions" ADD COLUMN     "customers_enabled" BOOLEAN NOT NULL DEFAULT false;
-
--- AlterTable
--- Existing rows and #7877's writer (which names no kind) stay `message`.
-ALTER TABLE "interactions" ADD COLUMN     "kind" VARCHAR(16) NOT NULL DEFAULT 'message',
-ADD COLUMN     "payload" JSONB;
-
--- AlterTable
-ALTER TABLE "pieces" ADD COLUMN     "approved_at" TIMESTAMP(3);
-
--- CreateTable
-CREATE TABLE "piece_versions" (
-    "id" TEXT NOT NULL DEFAULT ('pver_'::text || (uuidv7())::text),
-    "workspace_id" TEXT NOT NULL,
-    "person_id" TEXT NOT NULL,
-    "piece_id" TEXT NOT NULL,
-    "version" INTEGER NOT NULL,
-    "asset_id" TEXT,
-    "link" VARCHAR(2048),
-    "note" TEXT,
-    "delivered_by" TEXT NOT NULL,
-    "delivered_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "review" VARCHAR(24),
-    "review_comment" TEXT,
-    "reviewed_at" TIMESTAMP(3),
-
-    CONSTRAINT "piece_versions_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
--- A client's artifacts: workspace_id = $1 AND person_id = $2 ORDER BY delivered_at DESC.
-CREATE INDEX "piece_versions_workspace_id_person_id_delivered_at_idx" ON "piece_versions"("workspace_id", "person_id", "delivered_at");
-
--- CreateIndex
--- The public asset read's "is this asset a version file" check (AC-MAA-21).
-CREATE INDEX "piece_versions_asset_id_idx" ON "piece_versions"("asset_id");
-
--- CreateIndex
--- A version number is a fact per piece; the writer numbers, this is the backstop.
-CREATE UNIQUE INDEX "piece_versions_piece_id_version_key" ON "piece_versions"("piece_id", "version");
-
--- CreateIndex
--- Redundant with the PK; piece_versions_piece_fk needs it as its target.
-CREATE UNIQUE INDEX "pieces_id_person_id_workspace_id_key" ON "pieces"("id", "person_id", "workspace_id");
-
--- AddForeignKey
--- A version names a piece of THIS Person in THIS workspace (the piece's own
--- FK already ties it to a Person of its workspace); deleting a piece with a
--- version is refused.
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_piece_fk" FOREIGN KEY ("piece_id", "person_id", "workspace_id") REFERENCES "pieces"("id", "person_id", "workspace_id") ON DELETE RESTRICT ON UPDATE CASCADE;
-
--- ADR-0031 rule 3 — piece_versions: pver_ (registered in
--- packages/ids/src/registry.ts; this migration's path is added to
--- migration-sync.test.ts's PK_CHECK_MIGRATIONS). Each reference column
--- carries the format CHECK of the entity it names, in the #7877 shape.
-ALTER TABLE "piece_versions" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "piece_versions" ALTER COLUMN "id" SET DEFAULT ('pver_'::text || (uuidv7())::text);
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_id_format" CHECK ("id" ~ '^pver_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_person_id_format" CHECK ("person_id" ~ '^person_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_piece_id_format" CHECK ("piece_id" ~ '^piece_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_asset_id_format" CHECK ("asset_id" ~ '^asset_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_delivered_by_format" CHECK ("delivered_by" ~ '^user_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-
--- D2 — a version's shape is held here, not by the writer alone.
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_version_positive"
-  CHECK ("version" >= 1);
--- A delivery is a file or a link: exactly one.
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_one_target"
-  CHECK (("asset_id" IS NULL) <> ("link" IS NULL));
--- An https scheme, a host with no userinfo, no whitespace anywhere — the
--- database floor under packages/validation's isHttpsLink (SEC-8168-5).
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_link_https"
-  CHECK ("link" IS NULL OR ("link" ~ '^https://[^[:space:]/?#@]+([/?#][^[:space:]]*)?$' AND char_length("link") <= 2048));
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_note_length"
-  CHECK ("note" IS NULL OR char_length(btrim("note")) BETWEEN 1 AND 2000);
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_review_allowed"
-  CHECK ("review" IS NULL OR "review" IN ('approved', 'changes-requested'));
--- A review and its timestamp are set together or not at all.
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_review_stamped"
-  CHECK (("review" IS NULL) = ("reviewed_at" IS NULL));
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_comment_needs_review"
-  CHECK ("review_comment" IS NULL OR "review" IS NOT NULL);
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_changes_need_comment"
-  CHECK ("review" IS DISTINCT FROM 'changes-requested' OR char_length(btrim(coalesce("review_comment", ''))) >= 1);
-ALTER TABLE "piece_versions" ADD CONSTRAINT "piece_versions_comment_length"
-  CHECK ("review_comment" IS NULL OR char_length("review_comment") <= 5000);
-
--- D3 — the second direction and the kinds. Replaced IN PLACE under the same
--- names, so #7877's tests keep naming the same constraints.
-ALTER TABLE "interactions" DROP CONSTRAINT "interactions_direction_allowed";
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_direction_allowed"
-  CHECK ("direction" IN ('outbound', 'inbound'));
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_kind_allowed"
-  CHECK ("kind" IN ('message', 'quote', 'review'));
--- An outbound row is a payload-free `message` — #7877's rows, unchanged.
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_outbound_shape"
-  CHECK ("direction" <> 'outbound' OR ("kind" = 'message' AND "payload" IS NULL));
--- A quote or a review always carries its stored payload.
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_payload_by_kind"
-  CHECK ("kind" = 'message' OR "payload" IS NOT NULL);
--- 64 items of a 200-character label and a 2000-character value fit with room (SEC-8168-4).
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_payload_size"
-  CHECK ("payload" IS NULL OR octet_length("payload"::text) <= 262144);
--- A message body stays 1–10000 characters once trimmed; a quote or review
--- body may be empty; no body exceeds 10000.
-ALTER TABLE "interactions" DROP CONSTRAINT "interactions_body_length";
-ALTER TABLE "interactions" ADD CONSTRAINT "interactions_body_length"
-  CHECK (
-    char_length("body") <= 10000
-    AND ("kind" <> 'message' OR char_length(btrim("body")) BETWEEN 1 AND 10000)
-  );
-
--- D8/D9 — the request-quote magnet in every existing workspace. The config
--- literal below is test-held to `requestQuoteFlowConfig`
--- (packages/validation/src/schemas/flow.ts) by
--- database/__tests__/member-contract-migration.test.ts, and the block is
--- re-executed verbatim by member-contract.db.test.ts to prove it idempotent.
--- Do not edit one without the other.
--- BEGIN request-quote backfill
-INSERT INTO "flow_definitions" ("site_id", "workspace_id", "slug", "config", "kind", "title", "status", "customers_enabled", "updated_at")
-SELECT w."id", w."id", 'request-quote',
-  '{"slug":"request-quote","defaultLocale":"en","steps":[{"key":"request","type":"field","copy":{"title":{"en":"Request a quote"}},"fields":[{"name":"need","inputType":"textarea","required":true,"copy":{"label":{"en":"What do you need?"}}},{"name":"timing","inputType":"text","copy":{"label":{"en":"When do you need it?"}}},{"name":"budget","inputType":"text","copy":{"label":{"en":"Budget range"},"help":{"en":"A rough range is fine."}}},{"name":"link","inputType":"url","copy":{"label":{"en":"Link"},"help":{"en":"A brief, a document or an example. Must start with https://."}}}]}]}'::jsonb,
-  'contact', 'Request a quote', 'draft', true, CURRENT_TIMESTAMP
-FROM "workspaces" w
-ON CONFLICT ("site_id", "slug") DO NOTHING;
--- END request-quote backfill

package/templates/database/migrations/20261013120000_lead_spoke_checkout/migration.sql

@@ -1,20 +0,0 @@
--- #8185 — record, at the moment the hub writes it, that a lead is a spoke's
--- live paid checkout (spec docs/specs/8185-spoke-checkout-purchases-spec.md
--- D1, D6, D10).
---
---   leads.spoke_checkout — set true by apps/api/src/services/lead-routing.ts
---                          only for a spoke-keyed, unrelayed submit passing
---                          the #7877 checkout plan rule's predicate. Written
---                          at creation, never updated. NOT NULL with a
---                          constant default, so existing rows read false and
---                          nothing is rewritten; they are deliberately NOT
---                          backfilled (D6: no stored fact proves an older
---                          lead's provenance).
---
--- Rollout order (D10): apply this migration to a deployment's database BEFORE
--- deploying the API that writes the column. The old API is unaffected by it;
--- the new API's marked create fails without it.
---
--- Rollback: ALTER TABLE "leads" DROP COLUMN "spoke_checkout";
-
-ALTER TABLE "leads" ADD COLUMN "spoke_checkout" BOOLEAN NOT NULL DEFAULT false;