create-safest-tools 0.2.0

package/template/migrations/0021_abuse_evidence_operations.sql

@@ -0,0 +1,324 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE intake_decisions (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  integration_id TEXT REFERENCES application_integrations(id),
+  report_id TEXT REFERENCES reports(id) ON DELETE SET NULL,
+  request_id TEXT NOT NULL,
+  decision TEXT NOT NULL CHECK (decision IN ('accept', 'challenge', 'reject', 'quarantine', 'group')),
+  reason_codes_json TEXT NOT NULL,
+  source TEXT NOT NULL CHECK (source IN ('signed_widget', 'public_page', 'server_api', 'connector')),
+  network_key_hash TEXT,
+  contact_key_hash TEXT,
+  target_key_hash TEXT,
+  campaign_fingerprint TEXT,
+  turnstile_outcome TEXT,
+  rate_summary_json TEXT NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL,
+  UNIQUE (installation_id, request_id)
+);
+
+CREATE INDEX intake_decisions_installation_idx
+  ON intake_decisions(installation_id, created_at DESC, id DESC);
+CREATE INDEX intake_decisions_campaign_idx
+  ON intake_decisions(installation_id, campaign_fingerprint, created_at DESC, id);
+
+CREATE TABLE duplicate_groups (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  fingerprint_version TEXT NOT NULL,
+  fingerprint TEXT NOT NULL,
+  target_type TEXT NOT NULL,
+  target_reference_hash TEXT NOT NULL,
+  reason_family TEXT,
+  state TEXT NOT NULL CHECK (state IN ('active', 'split', 'merged', 'closed')),
+  canonical_report_id TEXT REFERENCES reports(id) ON DELETE SET NULL,
+  member_count INTEGER NOT NULL DEFAULT 0 CHECK (member_count >= 0),
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (installation_id, fingerprint_version, fingerprint)
+);
+
+CREATE INDEX duplicate_groups_activity_idx
+  ON duplicate_groups(installation_id, state, last_seen_at DESC, id DESC);
+
+CREATE TABLE duplicate_group_members (
+  group_id TEXT NOT NULL REFERENCES duplicate_groups(id) ON DELETE CASCADE,
+  report_id TEXT NOT NULL UNIQUE REFERENCES reports(id) ON DELETE CASCADE,
+  similarity_basis_json TEXT NOT NULL,
+  added_at TEXT NOT NULL,
+  removed_at TEXT,
+  PRIMARY KEY (group_id, report_id)
+);
+
+CREATE INDEX duplicate_group_members_report_idx
+  ON duplicate_group_members(report_id, group_id);
+
+ALTER TABLE reports ADD COLUMN intake_decision_id TEXT REFERENCES intake_decisions(id);
+ALTER TABLE reports ADD COLUMN duplicate_group_id TEXT REFERENCES duplicate_groups(id);
+ALTER TABLE reports ADD COLUMN quarantine_reason_code TEXT;
+
+CREATE INDEX reports_duplicate_group_idx
+  ON reports(duplicate_group_id, received_at DESC, id DESC);
+
+CREATE TABLE abuse_surge_states (
+  installation_id TEXT PRIMARY KEY REFERENCES installations(id) ON DELETE CASCADE,
+  state TEXT NOT NULL CHECK (state IN ('normal', 'elevated', 'surge', 'recovery')),
+  reason_codes_json TEXT NOT NULL,
+  activated_at TEXT,
+  recover_after TEXT,
+  revision INTEGER NOT NULL DEFAULT 1 CHECK (revision >= 1),
+  updated_by TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE report_queue_assignments (
+  id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  queue_id TEXT NOT NULL REFERENCES queue_definitions(id),
+  queue_version_id TEXT REFERENCES queue_versions(id),
+  routing_rule_version_id TEXT REFERENCES routing_rule_versions(id),
+  routing_agent_version_id TEXT,
+  assignment_kind TEXT NOT NULL CHECK (assignment_kind IN ('initial', 'reassignment', 'handoff', 'fallback')),
+  reason_json TEXT NOT NULL,
+  assigned_by_type TEXT NOT NULL,
+  assigned_by_id TEXT NOT NULL,
+  assigned_at TEXT NOT NULL,
+  ended_at TEXT
+);
+
+CREATE UNIQUE INDEX report_queue_assignments_one_active_idx
+  ON report_queue_assignments(report_id) WHERE ended_at IS NULL;
+CREATE INDEX report_queue_assignments_queue_idx
+  ON report_queue_assignments(queue_id, ended_at, assigned_at, report_id);
+
+INSERT INTO report_queue_assignments (
+  id, report_id, queue_id, queue_version_id, routing_rule_version_id,
+  routing_agent_version_id, assignment_kind, reason_json,
+  assigned_by_type, assigned_by_id, assigned_at
+)
+SELECT
+  'migration-assignment:' || r.id,
+  r.id,
+  r.queue_id,
+  r.queue_version_id,
+  r.routing_rule_version_id,
+  r.routing_agent_version_id,
+  'initial',
+  COALESCE(r.routing_reason_json, '{"reason_code":"legacy_assignment"}'),
+  'system',
+  'system:migration',
+  r.received_at
+FROM reports r
+WHERE r.queue_id IS NOT NULL;
+
+CREATE TABLE evidence_fetch_requests (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  evidence_reference_id TEXT NOT NULL REFERENCES evidence_references(id) ON DELETE CASCADE,
+  run_id TEXT REFERENCES workflow_runs(id) ON DELETE SET NULL,
+  step_run_id TEXT REFERENCES workflow_step_runs(id) ON DELETE SET NULL,
+  connection_version_id TEXT NOT NULL REFERENCES connection_versions(id),
+  requested_fields_json TEXT NOT NULL,
+  freshness_requirement_seconds INTEGER CHECK (freshness_requirement_seconds IS NULL OR freshness_requirement_seconds >= 0),
+  state TEXT NOT NULL CHECK (state IN ('pending', 'fetching', 'available', 'unavailable', 'failed')),
+  operation_id TEXT NOT NULL UNIQUE,
+  next_attempt_at TEXT NOT NULL,
+  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  last_error_code TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX evidence_fetch_requests_due_idx
+  ON evidence_fetch_requests(state, next_attempt_at, id);
+CREATE INDEX evidence_fetch_requests_report_idx
+  ON evidence_fetch_requests(report_id, created_at DESC, id DESC);
+
+CREATE TABLE evidence_fetch_attempts (
+  id TEXT PRIMARY KEY,
+  request_id TEXT NOT NULL REFERENCES evidence_fetch_requests(id) ON DELETE CASCADE,
+  attempt_number INTEGER NOT NULL CHECK (attempt_number >= 1),
+  request_digest TEXT NOT NULL,
+  response_status INTEGER,
+  response_digest TEXT,
+  response_class TEXT NOT NULL,
+  error_code TEXT,
+  started_at TEXT NOT NULL,
+  finished_at TEXT NOT NULL,
+  UNIQUE (request_id, attempt_number)
+);
+
+CREATE TABLE evidence_snapshots (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  evidence_reference_id TEXT REFERENCES evidence_references(id) ON DELETE SET NULL,
+  fetch_request_id TEXT REFERENCES evidence_fetch_requests(id) ON DELETE SET NULL,
+  r2_object_key TEXT NOT NULL UNIQUE,
+  content_type TEXT NOT NULL,
+  size_bytes INTEGER NOT NULL CHECK (size_bytes >= 0),
+  digest TEXT NOT NULL,
+  encryption_key_reference TEXT,
+  retention_class TEXT NOT NULL,
+  access_policy_json TEXT NOT NULL,
+  source_observed_at TEXT,
+  created_by_type TEXT NOT NULL,
+  created_by_id TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  deleted_at TEXT
+);
+
+CREATE INDEX evidence_snapshots_report_idx
+  ON evidence_snapshots(report_id, created_at DESC, id DESC);
+
+CREATE TABLE evidence_access_events (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  evidence_reference_id TEXT REFERENCES evidence_references(id) ON DELETE SET NULL,
+  snapshot_id TEXT REFERENCES evidence_snapshots(id) ON DELETE SET NULL,
+  actor_type TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  purpose_code TEXT NOT NULL,
+  request_id TEXT NOT NULL,
+  accessed_at TEXT NOT NULL
+);
+
+CREATE INDEX evidence_access_events_report_idx
+  ON evidence_access_events(report_id, accessed_at DESC, id DESC);
+CREATE INDEX evidence_access_events_actor_idx
+  ON evidence_access_events(actor_id, accessed_at DESC, id DESC);
+
+CREATE TABLE operations_incidents (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  incident_key TEXT NOT NULL,
+  severity TEXT NOT NULL CHECK (severity IN ('info', 'low', 'medium', 'high', 'critical')),
+  category TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('open', 'acknowledged', 'mitigated', 'resolved')),
+  title TEXT NOT NULL,
+  summary TEXT NOT NULL,
+  entity_type TEXT,
+  entity_id TEXT,
+  occurrence_count INTEGER NOT NULL DEFAULT 1 CHECK (occurrence_count >= 1),
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  acknowledged_by TEXT,
+  acknowledged_at TEXT,
+  resolved_by TEXT,
+  resolved_at TEXT,
+  resolution_summary TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  UNIQUE (installation_id, incident_key)
+);
+
+CREATE INDEX operations_incidents_state_idx
+  ON operations_incidents(installation_id, state, severity, last_seen_at DESC, id DESC);
+
+CREATE TABLE reconciliation_runs (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  reconciliation_kind TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('running', 'succeeded', 'failed', 'partial')),
+  cursor_json TEXT NOT NULL DEFAULT '{}',
+  scanned_count INTEGER NOT NULL DEFAULT 0 CHECK (scanned_count >= 0),
+  repaired_count INTEGER NOT NULL DEFAULT 0 CHECK (repaired_count >= 0),
+  incident_count INTEGER NOT NULL DEFAULT 0 CHECK (incident_count >= 0),
+  error_code TEXT,
+  started_at TEXT NOT NULL,
+  finished_at TEXT
+);
+
+CREATE INDEX reconciliation_runs_kind_idx
+  ON reconciliation_runs(installation_id, reconciliation_kind, started_at DESC, id DESC);
+
+CREATE TABLE repair_actions (
+  id TEXT PRIMARY KEY,
+  reconciliation_run_id TEXT REFERENCES reconciliation_runs(id) ON DELETE SET NULL,
+  incident_id TEXT REFERENCES operations_incidents(id) ON DELETE SET NULL,
+  action_type TEXT NOT NULL,
+  entity_type TEXT NOT NULL,
+  entity_id TEXT NOT NULL,
+  operation_key TEXT NOT NULL UNIQUE,
+  state TEXT NOT NULL CHECK (state IN ('planned', 'applied', 'failed', 'skipped')),
+  before_json TEXT,
+  after_json TEXT,
+  error_code TEXT,
+  planned_by TEXT NOT NULL,
+  planned_at TEXT NOT NULL,
+  applied_at TEXT
+);
+
+CREATE TABLE security_events (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  event_type TEXT NOT NULL,
+  severity TEXT NOT NULL CHECK (severity IN ('info', 'low', 'medium', 'high', 'critical')),
+  actor_type TEXT,
+  actor_id TEXT,
+  source_key_hash TEXT,
+  entity_type TEXT,
+  entity_id TEXT,
+  details_json TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX security_events_type_idx
+  ON security_events(installation_id, event_type, created_at DESC, id DESC);
+
+CREATE TABLE export_jobs (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  requested_by TEXT NOT NULL,
+  export_type TEXT NOT NULL CHECK (export_type IN ('reports_csv', 'reports_ndjson', 'audit_ndjson', 'configuration')),
+  filters_json TEXT NOT NULL,
+  redaction_policy_json TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('pending', 'running', 'ready', 'failed', 'expired', 'deleted')),
+  r2_object_key TEXT,
+  digest TEXT,
+  size_bytes INTEGER CHECK (size_bytes IS NULL OR size_bytes >= 0),
+  row_count INTEGER CHECK (row_count IS NULL OR row_count >= 0),
+  error_code TEXT,
+  requested_at TEXT NOT NULL,
+  ready_at TEXT,
+  expires_at TEXT,
+  deleted_at TEXT
+);
+
+CREATE INDEX export_jobs_state_idx
+  ON export_jobs(installation_id, state, requested_at DESC, id DESC);
+
+CREATE TABLE backup_manifests (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  environment TEXT NOT NULL,
+  schema_version INTEGER NOT NULL CHECK (schema_version >= 1),
+  application_version TEXT NOT NULL,
+  d1_export_reference TEXT NOT NULL,
+  d1_digest TEXT NOT NULL,
+  r2_manifest_reference TEXT,
+  r2_manifest_digest TEXT,
+  encryption_metadata_json TEXT NOT NULL DEFAULT '{}',
+  state TEXT NOT NULL CHECK (state IN ('planned', 'running', 'complete', 'failed', 'verified')),
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  completed_at TEXT,
+  verified_at TEXT
+);
+
+CREATE INDEX backup_manifests_created_idx
+  ON backup_manifests(installation_id, created_at DESC, id DESC);
+
+CREATE TABLE deletion_proofs (
+  id TEXT PRIMARY KEY,
+  deletion_request_id TEXT NOT NULL REFERENCES deletion_requests(id) ON DELETE CASCADE,
+  proof_json TEXT NOT NULL,
+  proof_digest TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (deletion_request_id)
+);

package/template/migrations/0022_workflow_dispatch_operations.sql

@@ -0,0 +1,42 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE dead_letter_items RENAME TO dead_letter_items_v3;
+
+CREATE TABLE dead_letter_items (
+  id TEXT PRIMARY KEY,
+  fingerprint TEXT NOT NULL UNIQUE,
+  source_queue TEXT NOT NULL,
+  source_message_id TEXT NOT NULL,
+  job_type TEXT NOT NULL CHECK (job_type IN (
+    'route_report', 'process_ai_report', 'run_enrichment', 'dispatch_workflow',
+    'deliver_action', 'deliver_notification', 'invalid'
+  )),
+  job_id TEXT,
+  report_id TEXT REFERENCES reports(id),
+  outbox_id TEXT,
+  state TEXT NOT NULL DEFAULT 'open' CHECK (state IN ('open', 'acknowledged', 'resolved')),
+  error_code TEXT NOT NULL,
+  occurrence_count INTEGER NOT NULL DEFAULT 1 CHECK (occurrence_count > 0),
+  details_json TEXT NOT NULL DEFAULT '{}',
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  resolved_at TEXT
+);
+
+INSERT INTO dead_letter_items (
+  id, fingerprint, source_queue, source_message_id, job_type, job_id,
+  report_id, outbox_id, state, error_code, occurrence_count,
+  details_json, first_seen_at, last_seen_at, resolved_at
+)
+SELECT
+  id, fingerprint, source_queue, source_message_id, job_type, job_id,
+  report_id, outbox_id, state, error_code, occurrence_count,
+  details_json, first_seen_at, last_seen_at, resolved_at
+FROM dead_letter_items_v3;
+
+DROP TABLE dead_letter_items_v3;
+
+CREATE INDEX dead_letter_items_state_idx
+  ON dead_letter_items(state, last_seen_at DESC, id DESC);
+CREATE INDEX dead_letter_items_report_idx
+  ON dead_letter_items(report_id, last_seen_at DESC, id DESC);

package/template/migrations/0023_component_connection_execution.sql

@@ -0,0 +1,75 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE component_runs (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  workflow_run_id TEXT REFERENCES workflow_runs(id) ON DELETE SET NULL,
+  step_run_id TEXT REFERENCES workflow_step_runs(id) ON DELETE SET NULL,
+  component_version_id TEXT NOT NULL REFERENCES component_versions(id),
+  operation_id TEXT NOT NULL UNIQUE,
+  effect_class TEXT NOT NULL CHECK (effect_class IN ('read_only', 'side_effecting')),
+  state TEXT NOT NULL CHECK (state IN ('pending', 'running', 'succeeded', 'failed', 'timed_out', 'cancelled')),
+  input_json TEXT NOT NULL,
+  input_digest TEXT NOT NULL,
+  output_json TEXT,
+  output_digest TEXT,
+  finding_id TEXT REFERENCES findings(id),
+  cache_hit INTEGER NOT NULL DEFAULT 0 CHECK (cache_hit IN (0, 1)),
+  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  error_code TEXT,
+  started_at TEXT,
+  finished_at TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX component_runs_report_idx
+  ON component_runs(report_id, created_at DESC, id DESC);
+CREATE INDEX component_runs_due_idx
+  ON component_runs(state, updated_at, id);
+
+CREATE TABLE connection_attempts (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  connection_version_id TEXT NOT NULL REFERENCES connection_versions(id),
+  component_run_id TEXT REFERENCES component_runs(id) ON DELETE SET NULL,
+  action_proposal_id TEXT REFERENCES action_proposals(id) ON DELETE SET NULL,
+  operation_id TEXT NOT NULL,
+  attempt_number INTEGER NOT NULL CHECK (attempt_number >= 1),
+  method TEXT NOT NULL,
+  destination_origin TEXT NOT NULL,
+  destination_path_hash TEXT NOT NULL,
+  request_digest TEXT NOT NULL,
+  response_status INTEGER,
+  response_digest TEXT,
+  response_class TEXT NOT NULL CHECK (response_class IN (
+    'success', 'retryable', 'permanent', 'timeout', 'circuit_open', 'denied', 'invalid'
+  )),
+  error_code TEXT,
+  started_at TEXT NOT NULL,
+  finished_at TEXT NOT NULL,
+  UNIQUE (operation_id, attempt_number)
+);
+
+CREATE INDEX connection_attempts_connection_idx
+  ON connection_attempts(connection_version_id, started_at DESC, id DESC);
+CREATE INDEX connection_attempts_component_idx
+  ON connection_attempts(component_run_id, attempt_number, id);
+
+CREATE TABLE component_cache_entries (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  component_version_id TEXT NOT NULL REFERENCES component_versions(id) ON DELETE CASCADE,
+  subject_key_hash TEXT NOT NULL,
+  input_digest TEXT NOT NULL,
+  finding_id TEXT NOT NULL REFERENCES findings(id) ON DELETE CASCADE,
+  output_json TEXT NOT NULL,
+  output_digest TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  UNIQUE (component_version_id, subject_key_hash, input_digest)
+);
+
+CREATE INDEX component_cache_entries_expiry_idx
+  ON component_cache_entries(expires_at, id);

package/template/migrations/0024_access_runtime_integrity.sql

@@ -0,0 +1,72 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE operator_invitations RENAME TO operator_invitations_v1;
+
+CREATE TABLE operator_invitations (
+  id TEXT PRIMARY KEY,
+  email TEXT NOT NULL COLLATE NOCASE,
+  role TEXT NOT NULL CHECK (role IN (
+    'administrator', 'workflow_author', 'reviewer', 'appeal_reviewer',
+    'quality_reviewer', 'operations', 'auditor'
+  )),
+  token_hash TEXT NOT NULL UNIQUE,
+  status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'accepted', 'revoked')),
+  invited_by TEXT NOT NULL,
+  accepted_by TEXT REFERENCES operator_users(id),
+  expires_at TEXT NOT NULL,
+  accepted_at TEXT,
+  revoked_at TEXT,
+  created_at TEXT NOT NULL
+);
+
+INSERT INTO operator_invitations (
+  id, email, role, token_hash, status, invited_by, accepted_by,
+  expires_at, accepted_at, revoked_at, created_at
+)
+SELECT
+  id, email, role, token_hash, status, invited_by, accepted_by,
+  expires_at, accepted_at, revoked_at, created_at
+FROM operator_invitations_v1;
+
+DROP TABLE operator_invitations_v1;
+
+CREATE UNIQUE INDEX operator_invitations_pending_email_idx
+  ON operator_invitations(email) WHERE status = 'pending';
+CREATE INDEX operator_invitations_status_idx
+  ON operator_invitations(status, expires_at, created_at DESC, id);
+
+ALTER TABLE role_bindings RENAME TO role_bindings_v1;
+
+CREATE TABLE role_bindings (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('operator_user', 'access_group', 'service_identity')),
+  principal_id TEXT NOT NULL,
+  role TEXT NOT NULL CHECK (role IN (
+    'owner', 'administrator', 'workflow_author', 'reviewer', 'appeal_reviewer',
+    'quality_reviewer', 'operations', 'auditor'
+  )),
+  queue_scope_json TEXT NOT NULL DEFAULT '[]',
+  field_scope_json TEXT NOT NULL DEFAULT '{}',
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  revoked_at TEXT
+);
+
+INSERT INTO role_bindings (
+  id, installation_id, principal_type, principal_id, role,
+  queue_scope_json, field_scope_json, created_by, created_at, revoked_at
+)
+SELECT
+  id, installation_id, principal_type, principal_id,
+  CASE role WHEN 'operations_owner' THEN 'operations' ELSE role END,
+  queue_scope_json, field_scope_json, created_by, created_at, revoked_at
+FROM role_bindings_v1;
+
+DROP TABLE role_bindings_v1;
+
+CREATE INDEX role_bindings_principal_idx
+  ON role_bindings(installation_id, principal_type, principal_id, revoked_at, role);
+
+CREATE UNIQUE INDEX workflow_run_links_parent_node_idx
+  ON workflow_run_links(parent_run_id, node_id) WHERE node_id IS NOT NULL;

package/template/migrations/0025_installation_timezone.sql

@@ -0,0 +1,11 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE installations ADD COLUMN timezone TEXT NOT NULL DEFAULT 'UTC';
+
+ALTER TABLE assistant_sessions ADD COLUMN idempotency_key TEXT;
+CREATE UNIQUE INDEX assistant_sessions_idempotency_idx
+  ON assistant_sessions(principal_id, idempotency_key) WHERE idempotency_key IS NOT NULL;
+
+ALTER TABLE assistant_messages ADD COLUMN idempotency_key TEXT;
+CREATE UNIQUE INDEX assistant_messages_idempotency_idx
+  ON assistant_messages(session_id, idempotency_key) WHERE idempotency_key IS NOT NULL;

package/template/migrations/0026_ai_and_egress_execution_controls.sql

@@ -0,0 +1,49 @@
+PRAGMA foreign_keys = ON;
+
+CREATE UNIQUE INDEX workflow_runs_report_pin_once_idx
+  ON workflow_runs(report_id, pin_id) WHERE report_id IS NOT NULL AND pin_id IS NOT NULL;
+
+CREATE TABLE workflow_ai_runs (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  report_id TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+  workflow_run_id TEXT NOT NULL REFERENCES workflow_runs(id) ON DELETE CASCADE,
+  step_run_id TEXT NOT NULL REFERENCES workflow_step_runs(id) ON DELETE CASCADE,
+  component_version_id TEXT REFERENCES component_versions(id),
+  agent_version_id TEXT REFERENCES agent_versions(id),
+  authority_mode TEXT NOT NULL CHECK (authority_mode IN ('shadow', 'assist', 'bounded_auto')),
+  provider TEXT NOT NULL,
+  model TEXT NOT NULL,
+  prompt_version_id TEXT,
+  output_schema_digest TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('running', 'succeeded', 'invalid', 'failed', 'timed_out')),
+  input_digest TEXT NOT NULL,
+  output_json TEXT,
+  output_digest TEXT,
+  validation_errors_json TEXT NOT NULL DEFAULT '[]',
+  input_units INTEGER CHECK (input_units IS NULL OR input_units >= 0),
+  output_units INTEGER CHECK (output_units IS NULL OR output_units >= 0),
+  estimated_cost_microusd INTEGER NOT NULL DEFAULT 0 CHECK (estimated_cost_microusd >= 0),
+  provider_request_id TEXT,
+  started_at TEXT NOT NULL,
+  finished_at TEXT,
+  UNIQUE (step_run_id, component_version_id, agent_version_id)
+);
+
+CREATE INDEX workflow_ai_runs_report_idx
+  ON workflow_ai_runs(report_id, started_at DESC, id DESC);
+CREATE INDEX workflow_ai_runs_run_idx
+  ON workflow_ai_runs(workflow_run_id, step_run_id, id);
+
+CREATE TABLE connection_execution_leases (
+  id TEXT PRIMARY KEY,
+  connection_version_id TEXT NOT NULL REFERENCES connection_versions(id) ON DELETE CASCADE,
+  operation_id TEXT NOT NULL,
+  attempt_number INTEGER NOT NULL CHECK (attempt_number >= 1),
+  expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (operation_id, attempt_number)
+);
+
+CREATE INDEX connection_execution_leases_expiry_idx
+  ON connection_execution_leases(connection_version_id, expires_at, id);

package/template/migrations/0027_prompt_and_ai_registry.sql

@@ -0,0 +1,37 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE prompt_versions (
+  id TEXT PRIMARY KEY,
+  installation_id TEXT NOT NULL REFERENCES installations(id) ON DELETE CASCADE,
+  prompt_key TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK (version >= 1),
+  name TEXT NOT NULL,
+  template_text TEXT NOT NULL,
+  variable_schema_json TEXT NOT NULL DEFAULT '{"type":"object"}',
+  prompt_digest TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'published' CHECK (status IN ('published', 'retired')),
+  published_at TEXT NOT NULL,
+  retired_at TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (installation_id, prompt_key, version),
+  UNIQUE (installation_id, prompt_digest)
+);
+
+CREATE INDEX prompt_versions_lookup_idx
+  ON prompt_versions(installation_id, prompt_key, status, version DESC, id);
+
+CREATE TABLE ai_registry_mutations (
+  idempotency_key TEXT PRIMARY KEY,
+  action TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  target_id TEXT NOT NULL,
+  response_json TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX model_aliases_admin_idx
+  ON model_aliases(installation_id, status, name, id);
+CREATE INDEX agent_definitions_admin_idx
+  ON agent_definitions(installation_id, status, agent_kind, name, id);
+

package/template/migrations/0028_step_attempt_ai_provenance.sql

@@ -0,0 +1,13 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE workflow_step_attempts ADD COLUMN external_request_id TEXT;
+ALTER TABLE workflow_step_attempts ADD COLUMN cost_microusd INTEGER NOT NULL DEFAULT 0 CHECK (cost_microusd >= 0);
+
+CREATE UNIQUE INDEX workflow_ai_runs_component_once_idx
+  ON workflow_ai_runs(step_run_id, component_version_id)
+  WHERE component_version_id IS NOT NULL;
+
+CREATE UNIQUE INDEX workflow_ai_runs_agent_once_idx
+  ON workflow_ai_runs(step_run_id, agent_version_id)
+  WHERE agent_version_id IS NOT NULL;
+

package/template/migrations/0029_evidence_fetch_transport.sql

@@ -0,0 +1,5 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE evidence_fetch_requests ADD COLUMN request_method TEXT NOT NULL DEFAULT 'POST';
+ALTER TABLE evidence_fetch_requests ADD COLUMN request_path TEXT NOT NULL DEFAULT '/v1/evidence/fetch';
+

package/template/migrations/0030_evidence_dlq_incidents.sql

@@ -0,0 +1,45 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE dead_letter_items RENAME TO dead_letter_items_v4;
+
+CREATE TABLE dead_letter_items (
+  id TEXT PRIMARY KEY,
+  fingerprint TEXT NOT NULL UNIQUE,
+  source_queue TEXT NOT NULL,
+  source_message_id TEXT NOT NULL,
+  job_type TEXT NOT NULL CHECK (job_type IN (
+    'route_report', 'process_ai_report', 'run_enrichment', 'fetch_evidence',
+    'dispatch_workflow', 'deliver_action', 'deliver_notification', 'deliver_email', 'invalid'
+  )),
+  job_id TEXT,
+  report_id TEXT REFERENCES reports(id),
+  outbox_id TEXT,
+  incident_id TEXT REFERENCES operations_incidents(id) ON DELETE SET NULL,
+  state TEXT NOT NULL DEFAULT 'open' CHECK (state IN ('open', 'acknowledged', 'resolved')),
+  error_code TEXT NOT NULL,
+  occurrence_count INTEGER NOT NULL DEFAULT 1 CHECK (occurrence_count > 0),
+  details_json TEXT NOT NULL DEFAULT '{}',
+  first_seen_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  resolved_at TEXT
+);
+
+INSERT INTO dead_letter_items (
+  id, fingerprint, source_queue, source_message_id, job_type, job_id,
+  report_id, outbox_id, state, error_code, occurrence_count,
+  details_json, first_seen_at, last_seen_at, resolved_at
+)
+SELECT
+  id, fingerprint, source_queue, source_message_id, job_type, job_id,
+  report_id, outbox_id, state, error_code, occurrence_count,
+  details_json, first_seen_at, last_seen_at, resolved_at
+FROM dead_letter_items_v4;
+
+DROP TABLE dead_letter_items_v4;
+
+CREATE INDEX dead_letter_items_state_idx
+  ON dead_letter_items(state, last_seen_at DESC, id DESC);
+CREATE INDEX dead_letter_items_report_idx
+  ON dead_letter_items(report_id, last_seen_at DESC, id DESC);
+CREATE INDEX dead_letter_items_incident_idx
+  ON dead_letter_items(incident_id, state, last_seen_at DESC, id DESC);