create-ailk 0.24.0 → 0.26.0

package/templates/database/migrations/20260923120000_listing_capturing_magnet/migration.sql

@@ -1,210 +0,0 @@
--- #6314 — ProjectListing gains `captured_by_flow_id`: the listicle-kind
--- FlowDefinition that CAPTURED the application, so a magnet's own
--- Applications list can be scoped to its own submissions rather than to the
--- whole workspace. Nothing constrains a workspace to one listicle magnet
--- ("flow_definitions" carries a (site_id, slug) unique and no
--- (site_id, kind) one), so workspace-only scoping would silently conflate
--- two listicle magnets' applications.
---
--- A NEW MIGRATION DIRECTORY, not an amendment of the already-merged
--- 20260922120000_tenancy_fence (spec D8). #6254 AC-1's one-migration-per-
--- milestone rule names #6314 by number in that migration's own header, so
--- this is a DEPARTURE taken deliberately and with the operator's
--- confirmation (2026-09-20), not a gap that rule failed to cover. Two
--- reasons, in order of weight:
---   1. Prisma records a per-migration CHECKSUM. `prisma migrate deploy`
---      refuses a migration whose file no longer matches `_prisma_migrations`,
---      so a database that already applied the fence directory would never
---      receive this column or its index while the new code assumes both.
---      "Editing it in place is a silent no-op" is true of the SQL; it is not
---      true of the checksum.
---   2. apps/api/CLAUDE.md: "Never edit a shipped migration — add a new one."
---      Where a spec's convenience and an in-repo rule disagree, the rule wins.
---
--- PURELY ADDITIVE: one nullable column, one index. NO UPDATE, NO backfill,
--- and NO foreign key.
---
--- NO BACKFILL, deliberately (spec § 3.5 / AC-3, operator ruling 2026-09-19).
--- No existing row carries evidence naming the magnet that captured it — no
--- referrer, no session link, no slug. A backfill would have to guess "the
--- workspace's only listicle magnet", which is exactly the conflation this
--- column exists to remove, made permanent and unauditable. Every row written
--- before this migration therefore reads NULL for the life of the row:
--- unattributed, excluded from every per-magnet list (NULL never equals a
--- magnet id, so the exclusion is a property of the query, not a filter that
--- can be forgotten), and UNCHANGED in the workspace Inbox — no operator loses
--- access to any application. This is the same discipline the founder-name
--- parts (#5407), the address parts (#5279) and `owner_user_id` (#5295) each
--- follow: a value that can only be guessed must not be asserted.
---
--- NO foreign key, deliberately (spec § 3.2, operator decision 2026-09-20,
--- which withdrew the 2026-09-19 ruling's "on-delete set-null" clause). Both
--- models live in the `inbox` namespace, so ADR 0009 invariant #1 (which bans
--- CROSS-namespace relations) does not reach this column — permission was
--- never the question. The convention is: of the 24 foreign-key constraints
--- under database/migrations/**, every one targets the `auth` namespace
--- ("users"); the intra-inbox columns listing_id, lead_id, grant_id and
--- flow_session_id carry none. The composite (workspace_id, …) shape was
--- itself offered and declined on "listing_csv_sends" the day before this
--- spec's pin. Integrity rests on the server-side resolve in
--- `startProjectListingDraft` (site_id + workspace_id + kind = 'listicle')
--- and on the read carrying the injected workspace_id alongside the magnet id
--- — so a dangling or foreign value yields no rows, never another workspace's.
--- Nothing deletes a flow_definitions row either (routes/magnets D5: "No
--- DELETE"), so ON DELETE SET NULL would have described no live code path.
---
--- RE-RUNNABLE: IF NOT EXISTS on both DDL statements, the census temp table is
--- dropped-if-exists before it is built, and post-assertion 2 is skipped on a
--- re-apply (it proves this file grew no backfill, which only the first
--- application can show — see its own comment). So re-applying this directory
--- against a database that already has the column is inert rather than an abort
--- that would wedge the ledger.
---
--- ORDER-SAFE: the index references "workspace_id", added by
--- 20260919140000_inbox_workspace_key and made NOT NULL by
--- 20260922120000_tenancy_fence — both of which this migration sorts strictly
--- after. The guard below is therefore a formality in the normal case, kept
--- for the reason 20260920130000_lead_workspace_source_index keeps one: IF NOT
--- EXISTS guards the INDEX's own name, not the column it references, so an
--- unguarded CREATE INDEX would abort inside prisma migrate's per-migration
--- transaction and wedge the ledger for the whole deployment if that earlier
--- migration were ever skipped, renamed, or rolled back on a given database.
---
--- CREATE INDEX is NOT CONCURRENT, and cannot be: CONCURRENTLY may not run
--- inside prisma migrate's per-migration transaction. It therefore takes a
--- lock on "project_listings" for its duration — the same accepted risk
--- 20260920130000_lead_workspace_source_index names. A deployment with a large
--- project_listings table should create this index out-of-band with
--- CONCURRENTLY first; the IF NOT EXISTS guard then makes the statement a
--- no-op.
---
--- Rollback:
---   DROP INDEX "project_listings_workspace_id_captured_by_flow_id_idx";
---   ALTER TABLE "project_listings" DROP COLUMN "captured_by_flow_id";
--- Safe at any point: the column is nullable and unconstrained, and no row's
--- correctness depends on it beyond per-magnet attribution.
-
--- A census, so the post-assertions below can prove nothing moved.
---
--- `column_preexisted` is captured HERE, before the ALTER, and it is what keeps
--- assertion 2 honest on a RE-APPLY. That assertion proves a property of THIS
--- FILE (it performs no backfill), which is only observable on the application
--- that first adds the column: once the application has written even one real
--- attribution, "no row is attributed" is false for reasons this migration had
--- nothing to do with. Asserting it unconditionally would abort inside prisma
--- migrate's per-migration transaction and wedge the ledger for every later
--- migration on that database — on a restored snapshot, a `migrate resolve
--- --rolled-back` redeploy, or a branch of production.
--- `pg_temp.`-qualified: DROP TABLE does not distinguish temporary from
--- permanent relations, and at this point the session holds no temp table, so
--- an unqualified name would resolve through search_path to `public` and drop
--- a same-named PERMANENT table — inside the transaction prisma commits.
-DROP TABLE IF EXISTS pg_temp."_6314_capture_census";
-CREATE TEMP TABLE "_6314_capture_census" AS
-  SELECT
-    count(*) AS p,
-    EXISTS (
-      SELECT 1 FROM information_schema.columns
-       -- `table_schema = current_schema()` is load-bearing, not tidiness:
-       -- `information_schema.columns` spans EVERY schema in the database, so
-       -- without it the probe answers "does any table anywhere named
-       -- project_listings carry this column" rather than "does the table this
-       -- migration is about to alter carry it". A pre-migration snapshot in a
-       -- side schema (`CREATE TABLE backup.project_listings AS SELECT ...`, a
-       -- `pg_dump -n` restore) would then make a genuine FIRST apply take the
-       -- skip branch below and wave a real backfill through unchecked — the
-       -- exact AC-8 property assertion 2 exists to prove.
-       WHERE table_schema = current_schema()
-         AND table_name = 'project_listings'
-         AND column_name = 'captured_by_flow_id'
-    ) AS column_preexisted
-  FROM "project_listings";
-
--- AlterTable — the capturing magnet's id. Nullable and unconstrained, so a
--- row predating this migration reads NULL and nothing here can reject it.
-ALTER TABLE "project_listings" ADD COLUMN IF NOT EXISTS "captured_by_flow_id" TEXT;
-
--- CreateIndex — the read is workspace_id = $1 AND captured_by_flow_id = $2,
--- ordered by created_at desc. A two-column (workspace_id, captured_by_flow_id)
--- index serves it directly. With no foreign key there is no cascade, so no
--- referencing-side index is owed beyond this one.
-DO $$ BEGIN
-  IF EXISTS (
-    SELECT 1 FROM information_schema.columns
-     -- `table_schema = current_schema()` for the same reason the census probe
-     -- above carries it, and the failure direction here is WORSE. A decoy
-     -- `project_listings` in another schema makes this EXISTS spuriously true;
-     -- the CREATE INDEX below then runs against the table search_path actually
-     -- resolves, hits `column "workspace_id" does not exist`, and aborts the
-     -- whole migration transaction — a wedged ledger, where the census probe's
-     -- equivalent merely skips an assertion. The guard must ask about the table
-     -- the statement it protects will really touch.
-     WHERE table_schema = current_schema()
-       AND table_name = 'project_listings'
-       AND column_name = 'workspace_id'
-  ) THEN
-    CREATE INDEX IF NOT EXISTS "project_listings_workspace_id_captured_by_flow_id_idx"
-      ON "project_listings"("workspace_id", "captured_by_flow_id");
-  ELSE
-    RAISE NOTICE '#6314: project_listings.workspace_id absent — index skipped. 20260919140000_inbox_workspace_key has not run against this database; the per-magnet Applications read cannot be served efficiently until it does.';
-  END IF;
-END $$;
-
--- Post-assertions, in 20260922120000_tenancy_fence's own idiom.
-DO $$
-DECLARE
-  before_p bigint;
-  after_p  bigint;
-  attributed bigint;
-  preexisted boolean;
-BEGIN
-  SELECT p, column_preexisted INTO before_p, preexisted FROM "_6314_capture_census";
-  SELECT count(*) INTO after_p FROM "project_listings";
-
-  -- 1. Nothing LOST. Deliberately `<`, not `<>`.
-  --
-  --    An equality test here has no true-positive mode and one guaranteed
-  --    false-positive mode, which is the worst shape a guard can have. No
-  --    statement in this file modifies a row of "project_listings" (the whole
-  --    file is five statements; read them), so the two counts can only diverge
-  --    through a write committed by ANOTHER session between them. The census
-  --    takes ACCESS SHARE; the ALTER takes ACCESS EXCLUSIVE, and until it does,
-  --    the table stays open to writers. "project_listings" is written by an
-  --    ANONYMOUS, unauthenticated route, so on a live deploy one application
-  --    started mid-migration aborts the migration — and the retry meets the
-  --    same race. That is a wedged ledger caused by the system working
-  --    normally.
-  --
-  --    `<` keeps the property the assertion is actually for — this migration
-  --    must never destroy a row — while letting a concurrent INSERT through.
-  --    A DELETE or TRUNCATE creeping into this file still trips it.
-  IF after_p < before_p THEN
-    RAISE EXCEPTION
-      '#6314 post-assertion: project_listings LOST row(s) across a purely additive migration (% -> %)',
-      before_p, after_p;
-  END IF;
-
-  -- 2. Nothing guessed (AC-8): every PRE-EXISTING row reads NULL. This
-  --    migration performs no UPDATE, so a non-NULL row on the application that
-  --    first adds the column would mean the file grew a backfill the ruling
-  --    refused.
-  --
-  --    Skipped when the column already existed: on a re-apply, attributed rows
-  --    are the APPLICATION's own writes, not a backfill, and failing on them
-  --    would wedge the migration ledger (see the census above). The assertion
-  --    still fires where it can mean anything — the first application, which is
-  --    the only run that can introduce a backfill.
-  IF preexisted THEN
-    RAISE NOTICE '#6314 post-assertion 2 skipped: captured_by_flow_id already existed, so this is a re-apply and any attributed row is an application write rather than a backfill.';
-  ELSE
-    SELECT count(*) INTO attributed
-      FROM "project_listings" WHERE "captured_by_flow_id" IS NOT NULL;
-    IF attributed <> 0 THEN
-      RAISE EXCEPTION
-        '#6314 post-assertion: % project_listings row(s) carry a captured_by_flow_id after a migration that performs no UPDATE — existing rows must stay unattributed (no backfill by guess)',
-        attributed;
-    END IF;
-  END IF;
-END $$;
-
-DROP TABLE pg_temp."_6314_capture_census";

package/templates/database/migrations/20261003120000_spoke_registry/migration.sql

@@ -1,80 +0,0 @@
--- #7532 — the hub's spoke registry and the booking-origin record (spec
--- docs/specs/7532-a-spoke-s-public-reads-spec.md D1, D5).
---
---   spokes (auth)              — one row per separately deployed site that
---                                calls this hub, bound to ONE workspace. It
---                                stores the SHA-256 digest of the spoke's
---                                hub-minted key, never the key. Deleting a
---                                workspace deletes its spokes (the FK below).
---   appointment_origins (inbox) — (provider, booking uid) → workspace, written
---                                when a spoke's booking is created so the
---                                deployment-wide Cal.com webhook stores the
---                                booking in the spoke's workspace. One origin
---                                per booking uid. No foreign key and no
---                                relation (ADR 0009): workspace_id and
---                                spoke_id are plain columns with format CHECKs.
---
--- PURELY ADDITIVE: two new tables, their indexes and one FK to "workspaces".
--- No statement touches an existing table's rows or columns, so there is no
--- pre-assertion block — this migration cannot lose a row.
---
--- Rollback: DROP TABLE "appointment_origins"; DROP TABLE "spokes". Safe while
--- nothing but #7532's own code reads them.
-
--- CreateTable
-CREATE TABLE "spokes" (
-    "id" TEXT NOT NULL DEFAULT ('spoke_'::text || (uuidv7())::text),
-    "workspace_id" TEXT NOT NULL,
-    "name" VARCHAR(120) NOT NULL,
-    "credential_hash" CHAR(64) NOT NULL,
-    "credential_prefix" VARCHAR(24) NOT NULL,
-    "revoked_at" TIMESTAMP(3),
-    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updated_at" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "spokes_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "appointment_origins" (
-    "id" TEXT NOT NULL DEFAULT ('apptorg_'::text || (uuidv7())::text),
-    "provider" VARCHAR(32) NOT NULL DEFAULT 'cal',
-    "provider_booking_uid" VARCHAR(200) NOT NULL,
-    "workspace_id" TEXT NOT NULL,
-    "spoke_id" TEXT NOT NULL,
-    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-
-    CONSTRAINT "appointment_origins_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
--- The lookup a spoke's every request makes (`findSpokeByKeyHash`).
-CREATE UNIQUE INDEX "spokes_credential_hash_key" ON "spokes"("credential_hash");
-
--- CreateIndex
-CREATE INDEX "spokes_workspace_id_idx" ON "spokes"("workspace_id");
-
--- CreateIndex
-CREATE INDEX "appointment_origins_workspace_id_idx" ON "appointment_origins"("workspace_id");
-
--- CreateIndex
--- One origin per booking uid (spec D5). The bind inserts with
--- ON CONFLICT DO NOTHING against this key.
-CREATE UNIQUE INDEX "appointment_origins_provider_provider_booking_uid_key" ON "appointment_origins"("provider", "provider_booking_uid");
-
--- AddForeignKey
-ALTER TABLE "spokes" ADD CONSTRAINT "spokes_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- ADR-0031 rule 3 — spokes: spoke_, appointment_origins: apptorg_ (registered
--- in packages/ids/src/registry.ts; this migration's path is added to
--- migration-sync.test.ts's PK_CHECK_MIGRATIONS).
-ALTER TABLE "spokes" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "spokes" ALTER COLUMN "id" SET DEFAULT ('spoke_'::text || (uuidv7())::text);
-ALTER TABLE "spokes" ADD CONSTRAINT "spokes_id_format" CHECK ("id" ~ '^spoke_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "spokes" ADD CONSTRAINT "spokes_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-
-ALTER TABLE "appointment_origins" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "appointment_origins" ALTER COLUMN "id" SET DEFAULT ('apptorg_'::text || (uuidv7())::text);
-ALTER TABLE "appointment_origins" ADD CONSTRAINT "appointment_origins_id_format" CHECK ("id" ~ '^apptorg_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "appointment_origins" ADD CONSTRAINT "appointment_origins_spoke_id_format" CHECK ("spoke_id" ~ '^spoke_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "appointment_origins" ADD CONSTRAINT "appointment_origins_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20261003130000_scheduling_connection/migration.sql

@@ -1,49 +0,0 @@
--- #7533 — the SchedulingConnection model: a workspace's own scheduling
--- provider account (spec docs/specs/7533-a-scheduling-connection-per-workspace-spec.md
--- D1). One row per workspace, keyed `@unique(workspace_id)` like its config
--- sibling workspace_meetings; the credential and webhook secret columns hold
--- AES-256-GCM ciphertext written only by apps/api's
--- services/scheduling/connections.ts. `webhook_token` is the per-connection
--- webhook entry point's routing id, unique so a delivery resolves at most
--- one row.
---
--- One new table, two unique indexes, in the house style of
--- 20260919130000_workspace_meetings (CreateTable + CreateIndex immediately
--- followed by the ADR-0031 rule-3 id-format completion, in ONE migration
--- since the table is new and needs no retrofit). No `workspace_id_format`
--- CHECK and no `provider` CHECK, matching that same precedent (the API
--- accepts only the provider ids its factory table knows).
---
--- No backfill, no constraint relaxed, no existing table touched.
---
--- Rollback: DROP TABLE "scheduling_connections". Every stored connection is
--- lost; each workspace returns to the unconfigured state (or, on a
--- one-workspace deployment, to the CAL_API_KEY env fallback).
-
--- CreateTable
-CREATE TABLE "scheduling_connections" (
-    "id" TEXT NOT NULL DEFAULT ('schconn_'::text || (uuidv7())::text),
-    "workspace_id" TEXT NOT NULL,
-    "provider" VARCHAR(32) NOT NULL,
-    "credential_ciphertext" TEXT NOT NULL,
-    "webhook_token" VARCHAR(64) NOT NULL,
-    "webhook_secret_ciphertext" TEXT NOT NULL,
-    "base_url" TEXT,
-    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updated_at" TIMESTAMPTZ NOT NULL,
-
-    CONSTRAINT "scheduling_connections_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE UNIQUE INDEX "scheduling_connections_workspace_id_key" ON "scheduling_connections"("workspace_id");
-
--- CreateIndex
-CREATE UNIQUE INDEX "scheduling_connections_webhook_token_key" ON "scheduling_connections"("webhook_token");
-
--- ADR-0031 rule 3 — scheduling_connections: schconn_ (registered in
--- packages/ids/src/registry.ts ENTITY_PREFIX.schedulingConnection; this
--- migration's path is added to migration-sync.test.ts's PK_CHECK_MIGRATIONS).
-ALTER TABLE "scheduling_connections" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "scheduling_connections" ALTER COLUMN "id" SET DEFAULT ('schconn_'::text || (uuidv7())::text);
-ALTER TABLE "scheduling_connections" ADD CONSTRAINT "scheduling_connections_id_format" CHECK ("id" ~ '^schconn_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20261005120000_agents/migration.sql

@@ -1,84 +0,0 @@
--- #3591 — the agent seat, step A (spec
--- docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1).
---
---   agents (auth) — one row per agent: a stored delegate of ONE person (its
---                   responsible Membership), bound to ONE workspace. It stores
---                   the SHA-256 digest of the agent's key, never the key.
---                   Deleting the organization, the workspace or the person's
---                   membership deletes the agent; deleting the membership of
---                   the person who was last shown its key sets
---                   key_issued_to_membership_id null, which the guard refuses
---                   until the agent is re-keyed. created_by_user_id is a plain
---                   column with no foreign key, so deleting the creator does
---                   not delete the agents they made for someone else.
---
--- PURELY ADDITIVE: one new enum, one new table, its indexes and four FKs (to
--- "organizations", "workspaces" and twice to "memberships"). No statement
--- touches an existing table's rows or columns, so there is no pre-assertion
--- block — this migration cannot lose a row.
---
--- Rollback: DROP TABLE "agents"; DROP TYPE "AgentPermissionLevel". Safe while
--- nothing but #3591's own code reads them.
-
--- CreateEnum
-CREATE TYPE "AgentPermissionLevel" AS ENUM ('member');
-
--- CreateTable
-CREATE TABLE "agents" (
-    "id" TEXT NOT NULL DEFAULT ('agent_'::text || (uuidv7())::text),
-    "organization_id" TEXT NOT NULL,
-    "workspace_id" TEXT NOT NULL,
-    "responsible_membership_id" TEXT NOT NULL,
-    "name" VARCHAR(80) NOT NULL,
-    "permission_level" "AgentPermissionLevel" NOT NULL DEFAULT 'member',
-    "enabled" BOOLEAN NOT NULL DEFAULT true,
-    "credential_hash" CHAR(64) NOT NULL,
-    "credential_prefix" VARCHAR(24) NOT NULL,
-    "last_active_at" TIMESTAMP(3),
-    "created_by_user_id" TEXT NOT NULL,
-    "key_issued_to_membership_id" TEXT,
-    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updated_at" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "agents_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
--- The lookup an agent's every request makes (`findAgentByKeyHash`).
-CREATE UNIQUE INDEX "agents_credential_hash_key" ON "agents"("credential_hash");
-
--- CreateIndex
-CREATE INDEX "agents_organization_id_idx" ON "agents"("organization_id");
-
--- CreateIndex
-CREATE INDEX "agents_workspace_id_idx" ON "agents"("workspace_id");
-
--- CreateIndex
-CREATE INDEX "agents_responsible_membership_id_idx" ON "agents"("responsible_membership_id");
-
--- AddForeignKey
-ALTER TABLE "agents" ADD CONSTRAINT "agents_organization_id_fkey" FOREIGN KEY ("organization_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "agents" ADD CONSTRAINT "agents_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
--- Leaving stops the agent: removing the person's membership deletes it.
-ALTER TABLE "agents" ADD CONSTRAINT "agents_responsible_membership_id_fkey" FOREIGN KEY ("responsible_membership_id") REFERENCES "memberships"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
--- A key dies with the person who received it: SET NULL, which the guard refuses.
-ALTER TABLE "agents" ADD CONSTRAINT "agents_key_issued_to_membership_id_fkey" FOREIGN KEY ("key_issued_to_membership_id") REFERENCES "memberships"("id") ON DELETE SET NULL ON UPDATE CASCADE;
-
--- ADR-0031 rule 3 — agents: agent_ (registered in packages/ids/src/registry.ts;
--- this migration's path is added to migration-sync.test.ts's
--- PK_CHECK_MIGRATIONS). Each reference column carries the format CHECK of the
--- entity it names, in the exact pattern the spoke migration uses.
-ALTER TABLE "agents" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "agents" ALTER COLUMN "id" SET DEFAULT ('agent_'::text || (uuidv7())::text);
-ALTER TABLE "agents" ADD CONSTRAINT "agents_id_format" CHECK ("id" ~ '^agent_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "agents" ADD CONSTRAINT "agents_organization_id_format" CHECK ("organization_id" ~ '^org_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "agents" ADD CONSTRAINT "agents_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "agents" ADD CONSTRAINT "agents_responsible_membership_id_format" CHECK ("responsible_membership_id" ~ '^member_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "agents" ADD CONSTRAINT "agents_key_issued_to_membership_id_format" CHECK ("key_issued_to_membership_id" ~ '^member_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "agents" ADD CONSTRAINT "agents_created_by_user_id_format" CHECK ("created_by_user_id" ~ '^user_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20261008120000_user_last_workspace/migration.sql

@@ -1,35 +0,0 @@
--- #7803 — sign-in lands in the user's last workspace (spec
--- docs/specs/7803-sign-in-last-workspace-spec.md D1).
---
---   users.last_workspace_id (auth) — the workspace this person last activated.
---                   Written only by activateWorkspace after its membership
---                   grant; read only by listTenancy, which reports it only
---                   when the workspace is in the caller's own listing
---                   (apps/api/src/services/tenant-context.ts). Deleting the
---                   workspace sets it null.
---
--- PURELY ADDITIVE: one nullable column with no default, its index, one FK to
--- "workspaces" and the ADR-0031 format CHECK on the new reference column. No
--- backfill runs and no existing row changes, so there is no pre-assertion
--- block — this migration cannot lose a row. A NULL passes the CHECK.
---
--- Rollout: deploy this migration BEFORE the API code that reads the column
--- (SEC-7803-3). Being nullable, it is safe to apply ahead of the code.
---
--- Rollback: ALTER TABLE "users" DROP COLUMN "last_workspace_id"; (this drops
--- the index, the FK and the CHECK with it). Safe while nothing but #7803's own
--- code reads it.
-
--- AlterTable
-ALTER TABLE "users" ADD COLUMN "last_workspace_id" TEXT;
-
--- CreateIndex
-CREATE INDEX "users_last_workspace_id_idx" ON "users"("last_workspace_id");
-
--- AddForeignKey
--- A deleted workspace clears every pointer to it.
-ALTER TABLE "users" ADD CONSTRAINT "users_last_workspace_id_fkey" FOREIGN KEY ("last_workspace_id") REFERENCES "workspaces"("id") ON DELETE SET NULL ON UPDATE CASCADE;
-
--- ADR-0031 rule 3 — the reference column carries the format CHECK of the
--- entity it names (wksp_), in the exact pattern the agents migration uses.
-ALTER TABLE "users" ADD CONSTRAINT "users_last_workspace_id_format" CHECK ("last_workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');

package/templates/database/migrations/20261008130000_lead_idempotency_key/migration.sql

@@ -1,20 +0,0 @@
--- #7869 (spoke-pattern roadmap Phase 1, D5) — Lead idempotency key: the
--- caller's optional `Idempotency-Key` header on POST /v1/leads/submit, so a
--- retried lead write (a client retry, a spoke's fulfilment replay) finds the
--- first lead instead of writing a second. Mirrors the column-add shape of
--- 20260906000000_add_flow_checkout_idempotency (one AlterTable, one unique
--- index under the Prisma section headers).
---
--- The column is nullable with no default, so no pre-existing row needs a
--- backfill and none collides on the new unique — Postgres treats NULLs as
--- distinct. The unique is scoped by workspace_id: one key in two workspaces
--- is two leads.
---
--- Rollback: ALTER TABLE "leads" DROP COLUMN "idempotency_key"; (the index
--- goes with it).
-
--- AlterTable
-ALTER TABLE "leads" ADD COLUMN     "idempotency_key" TEXT;
-
--- CreateIndex
-CREATE UNIQUE INDEX "leads_workspace_id_idempotency_key_key" ON "leads"("workspace_id", "idempotency_key");

package/templates/database/migrations/20261009120000_agent_grants/migration.sql

@@ -1,33 +0,0 @@
--- #7864 — grant an agent key five named abilities (spec
--- docs/specs/7864-agent-key-grants-spec.md D2).
---
---   agents.grants (auth) — the permissions an owner or admin granted this
---                   agent one by one. Written only by setServedAgentGrants
---                   (apps/api/src/lib/agent-store.ts, the PUT
---                   …/agents/:agentId/grants route); read by the auth
---                   preHandler's key lookup and the agent list. The tenant
---                   guards hold an agent to the grants its person's own role
---                   also holds, so a stored grant never outranks the person.
---
--- The CHECK names the same five permissions as @working-theory/validation's
--- AGENT_GRANTABLE_PERMISSIONS; database/__tests__/agents.db.test.ts reads
--- this file and fails if the two lists differ (SEC-7864-G).
---
--- PURELY ADDITIVE: one NOT NULL column with an empty-array default and its
--- CHECK. No backfill runs: every existing agent takes the default, no
--- grants, and so behaves exactly as before. No existing row changes beyond
--- the default fill, so there is no pre-assertion block.
---
--- Rollout: deploy this migration BEFORE the API code that reads the column.
--- Code without the column fails closed — its key lookup errors and every
--- agent is answered 401 (SEC-7864-F).
---
--- Rollback: ALTER TABLE "agents" DROP COLUMN "grants"; (this drops the CHECK
--- with it). Safe while nothing but #7864's own code reads it.
-
--- AlterTable
-ALTER TABLE "agents" ADD COLUMN "grants" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];
-
--- Only the five grantable permissions may be stored.
-ALTER TABLE "agents" ADD CONSTRAINT "agents_grants_allowed"
-  CHECK ("grants" <@ ARRAY['content-edit','content-publish','assets-write','magnets-manage','meeting-types-manage']::TEXT[]);

package/templates/database/migrations/20261010120000_person/migration.sql

@@ -1,106 +0,0 @@
--- #852 — Person, the per-workspace client record (spec
--- docs/specs/852-person-the-per-workspace-client-spec.md D1, D2).
---
---   people (inbox) — one client of one workspace, keyed on a lowercased,
---                    trimmed email unique per workspace. Created only by
---                    apps/api/src/services/person.ts's findOrCreatePerson.
---                    workspace_id and user_id are plain columns with no
---                    foreign key (ADR 0009): they name auth-namespace rows.
---   leads.person_id, appointments.person_id — the Person each row belongs
---                    to, stamped at creation by the intake paths.
---
--- PURELY ADDITIVE, DDL ONLY: one new table with its indexes and CHECKs, and
--- one nullable column with no default on each of "leads" and "appointments",
--- so Postgres changes only the catalog for those two. No existing row's
--- values change here — the backfill is the next migration,
--- 20261010121000_person_backfill, split out so its row updates never run
--- under the exclusive locks these ALTER TABLEs take (SEC-852-E). Prisma runs
--- this file as one transaction, so each ALTER TABLE's ACCESS EXCLUSIVE lock
--- is held until the file commits — through the plain CREATE INDEX on the new
--- column — blocking reads AND writes of "leads" and "appointments" (lead
--- capture included) for one heap scan of each. Accepted: the scan is short
--- next to the backfill it is split from.
---
--- Rollout: deploy this migration (and the backfill) BEFORE the API code that
--- writes person_id; code without the column fails every lead write.
---
--- Rollback: ALTER TABLE "leads" DROP COLUMN "person_id"; ALTER TABLE
--- "appointments" DROP COLUMN "person_id"; DROP TABLE "people"; (the indexes
--- and CHECKs go with them). Safe while nothing but #852's own code reads them.
-
--- AlterTable
-ALTER TABLE "appointments" ADD COLUMN     "person_id" TEXT;
-
--- AlterTable
-ALTER TABLE "leads" ADD COLUMN     "person_id" TEXT;
-
--- CreateTable
-CREATE TABLE "people" (
-    "id" TEXT NOT NULL DEFAULT ('person_'::text || (uuidv7())::text),
-    "workspace_id" TEXT NOT NULL,
-    "email" VARCHAR(254) NOT NULL,
-    "name" VARCHAR(200),
-    "user_id" TEXT,
-    "billing_provider" VARCHAR(32),
-    "billing_customer_id" VARCHAR(255),
-    "plan_offering" VARCHAR(100),
-    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updated_at" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "people_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
--- The webhook's first match: a customer id within one workspace (D3 step 2).
--- NOT unique — the spokes share one Stripe account.
-CREATE INDEX "people_workspace_id_billing_customer_id_idx" ON "people"("workspace_id", "billing_customer_id");
-
--- CreateIndex
--- The People list: workspace_id = $1 ORDER BY created_at DESC (D7).
-CREATE INDEX "people_workspace_id_created_at_idx" ON "people"("workspace_id", "created_at");
-
--- CreateIndex
--- One Person per address per workspace — what findOrCreatePerson's
--- INSERT … ON CONFLICT DO NOTHING absorbs a concurrent duplicate on.
-CREATE UNIQUE INDEX "people_workspace_id_email_key" ON "people"("workspace_id", "email");
-
--- CreateIndex
--- One Person per User per workspace. NULLs are distinct, so any number of
--- unlinked Persons fit.
-CREATE UNIQUE INDEX "people_workspace_id_user_id_key" ON "people"("workspace_id", "user_id");
-
--- CreateIndex
-CREATE INDEX "appointments_person_id_idx" ON "appointments"("person_id");
-
--- CreateIndex
-CREATE INDEX "leads_person_id_idx" ON "leads"("person_id");
-
--- ADR-0031 rule 3 — people: person_ (registered in packages/ids/src/registry.ts;
--- this migration's path is added to migration-sync.test.ts's
--- PK_CHECK_MIGRATIONS). Each reference column carries the format CHECK of the
--- entity it names, in the agents-migration shape.
-ALTER TABLE "people" ALTER COLUMN "id" TYPE text COLLATE "C";
-ALTER TABLE "people" ALTER COLUMN "id" SET DEFAULT ('person_'::text || (uuidv7())::text);
-ALTER TABLE "people" ADD CONSTRAINT "people_id_format" CHECK ("id" ~ '^person_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "people" ADD CONSTRAINT "people_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-ALTER TABLE "people" ADD CONSTRAINT "people_user_id_format" CHECK ("user_id" ~ '^user_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
-
--- The stored address is already normalized: printable ASCII only (no
--- whitespace, no control or invisible character), exactly one @ with a
--- non-empty side each, lower case. findOrCreatePerson's
--- isStorablePersonEmail applies the same rule before any write (D3).
-ALTER TABLE "people" ADD CONSTRAINT "people_email_normalized"
-  CHECK ("email" = lower("email" COLLATE "C") AND "email" ~ '^[!-?A-~]+@[!-?A-~]+$');
-
--- A provider and its customer id are written together or not at all — the
--- same provider-agnostic pair User and Organization carry.
-ALTER TABLE "people" ADD CONSTRAINT "people_billing_pair"
-  CHECK (("billing_provider" IS NULL) = ("billing_customer_id" IS NULL));
-
--- The two new reference columns carry the person_ format CHECK, added NOT
--- VALID and then validated: the file runs as one transaction, so the ALTER
--- TABLE's lock is still held, and the scan is of an all-NULL column.
-ALTER TABLE "leads" ADD CONSTRAINT "leads_person_id_format" CHECK ("person_id" ~ '^person_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$') NOT VALID;
-ALTER TABLE "leads" VALIDATE CONSTRAINT "leads_person_id_format";
-ALTER TABLE "appointments" ADD CONSTRAINT "appointments_person_id_format" CHECK ("person_id" ~ '^person_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$') NOT VALID;
-ALTER TABLE "appointments" VALIDATE CONSTRAINT "appointments_person_id_format";