limn-review 0.1.123

package/dist/db/migrations-pg/0029_repo_reviewers.sql

@@ -0,0 +1,127 @@
+-- THE BOT OBJECT BECOMES PER REPO — the Postgres twin of the sqlite migration
+-- 0042_repo_reviewers. Hand-written additive (like 0027/0028), idempotent. Migration 0030 then
+-- splits the ACTOR grain back out; read the two together, they are one change in two steps:
+--
+--   0029  RE-KEY     (account, author)        →  (account, repo, author)     columns unchanged
+--   0030  NORMALISE  the actor-grain columns  →  their own table `account_reviewers`
+--
+-- `bot_review_classification` answered "is this login a bot, and what kind" once per ACCOUNT.
+-- `repo_reviewers` answers it once per (account, REPO, author), and that row IS the bot object.
+-- A bot is installed per repository; a team is a bag of repos someone can re-bag tomorrow. There
+-- is no team key, no inheritance chain, no merge and NO DEDUPLICATION — a vendor running on six
+-- repos is six rows, which is the intended display.
+--
+-- The old table is DROPPED at the bottom rather than left behind: a second, differently-keyed
+-- answer to the same question sitting in every database is exactly how two surfaces disagree.
+--
+-- `kind` / `label` / `identity_source` ARE CREATED HERE AND REMOVED AGAIN IN 0030. This step is a
+-- pure re-key — every column of the old row is carried across unchanged — so that the fan-out and
+-- the normalisation can be read one at a time.
+--
+-- TENANCY IS STRUCTURAL. `repo_id` is the first column here that arrives in a REQUEST BODY
+-- rather than from sync, and a plain `REFERENCES repos(id)` accepts (account 2, repo 10) where
+-- repo 10 belongs to account 1. The FK is therefore COMPOSITE against `repos(id, account_id)`,
+-- which the unique index below makes legal — Postgres accepts a plain UNIQUE INDEX as an FK
+-- parent key (verified on 16.13; it does not require a named UNIQUE CONSTRAINT), and SQLite
+-- requires exactly the same thing, so the twins stay identical. The cross-account insert now
+-- fails in the database, in every code path, not in one handler's predicate.
+--
+-- THE CONSTRAINT IS NAMED, and the name is the one `schema.pg.ts` declares. Postgres quotes it in
+-- the violation message ("violates foreign key constraint \"repo_reviewers_repo_account_fk\""),
+-- so it is a real, greppable identifier. Previously the SQL named nothing and pg auto-named the
+-- constraint `repo_reviewers_repo_id_account_id_fkey`, i.e. drizzle's `name:` field matched no
+-- live constraint in any database. (SQLite stores the same clause but never reports it.)
+--
+-- THE BACKFILL IS ASYMMETRIC ON PURPOSE. MANUAL rows fan out to EVERY repo in the account — a
+-- human judgement is the only thing here that cannot be regenerated, it was made account-wide,
+-- and fanning it out reproduces that meaning with every repo row agreeing. AUTO rows land only on
+-- repos where the actor actually has a FOOTPRINT (a review, an inline thread, or a PR comment
+-- there): an auto verdict is re-derived on the next classification pass, and a row for a repo the
+-- reviewer has never touched is not a bot object but a fabricated one. See the sqlite twin.
+--
+-- The footprint CTE is MATERIALIZED so the planner cannot inline it into the correlated EXISTS
+-- and re-scan three tables per (row, repo) pair.
+--
+-- WHY THE BACKFILL IS WRAPPED IN A DO BLOCK: this file ends by dropping
+-- `bot_review_classification`, so a hand-replay would otherwise fail on "relation does not exist"
+-- rather than no-op. `to_regclass` is the guard; plpgsql does not resolve the branch's SQL until
+-- it executes, so naming the dropped table inside it is safe. The sqlite twin reaches the same
+-- end with a `CREATE TABLE IF NOT EXISTS` stub of the legacy table, which is the nearest thing
+-- that dialect has to a conditional. Same intent, two dialects, stated rather than discovered.
+-- Not for lookups (`id` is already the PK) — it exists solely as the composite FK's parent key.
+CREATE UNIQUE INDEX IF NOT EXISTS "repos_id_account" ON "repos" USING btree ("id","account_id");--> statement-breakpoint
+-- Unrelated to the FK, and the reason it rides in THIS migration: `review_threads
+-- .original_commenter_id` had no index at all, and it is one of the three columns the footprint
+-- CTE below unions on AND the column the per-repo footprint counts group by on every listing.
+CREATE INDEX IF NOT EXISTS "thread_original_commenter_idx" ON "review_threads" USING btree ("original_commenter_id");--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "repo_reviewers" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL REFERENCES "accounts"("id") ON DELETE cascade,
+	"repo_id" integer NOT NULL,
+	"author_user_id" integer NOT NULL REFERENCES "users"("id"),
+	"automated" boolean NOT NULL,
+	"kind" text,
+	"label" text,
+	"identity_source" text DEFAULT 'auto' NOT NULL,
+	"role" text DEFAULT 'review' NOT NULL,
+	"confidence" text NOT NULL,
+	"source" text NOT NULL,
+	"reasons_json" jsonb,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "repo_reviewers_repo_account_fk" FOREIGN KEY ("repo_id","account_id") REFERENCES "repos"("id","account_id") ON DELETE cascade
+);--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "repo_reviewers_account_repo_author" ON "repo_reviewers" USING btree ("account_id","repo_id","author_user_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "repo_reviewers_account_repo_idx" ON "repo_reviewers" USING btree ("account_id","repo_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "repo_reviewers_account_author_idx" ON "repo_reviewers" USING btree ("account_id","author_user_id");--> statement-breakpoint
+DO $$
+BEGIN
+  IF to_regclass('public.bot_review_classification') IS NOT NULL THEN
+    WITH footprint AS MATERIALIZED (
+      SELECT DISTINCT p.repo_id AS repo_id, x.uid AS author_user_id
+        FROM pull_requests p
+        JOIN (
+          SELECT pr_id, author_id             AS uid FROM reviews        WHERE author_id IS NOT NULL
+          UNION ALL
+          SELECT pr_id, original_commenter_id AS uid FROM review_threads WHERE original_commenter_id IS NOT NULL
+          UNION ALL
+          SELECT pr_id, author_id             AS uid FROM pr_comments    WHERE author_id IS NOT NULL
+        ) x ON x.pr_id = p.id
+    )
+    INSERT INTO "repo_reviewers"
+      ("account_id", "repo_id", "author_user_id", "automated", "kind", "label",
+       "identity_source", "role", "confidence", "source", "reasons_json", "updated_at")
+    -- `identity_source` is derived from the old row's `source`: the old model had ONE provenance
+    -- field covering both grains, and a manual row's kind/label WERE a human's opinion. Import
+    -- them as 'auto' and the next classification pass silently reverts a hand-made correction.
+    SELECT b.account_id, r.id, b.author_user_id, b.automated, b.kind, b.label,
+           CASE WHEN b.source = 'manual' THEN 'manual' ELSE 'auto' END,
+           'review', b.confidence, b.source, b.reasons_json, b.updated_at
+      FROM bot_review_classification b
+      JOIN repos r ON r.account_id = b.account_id
+     WHERE b.source = 'manual'
+        OR EXISTS (
+             SELECT 1 FROM footprint f
+              WHERE f.repo_id = r.id AND f.author_user_id = b.author_user_id
+           )
+    -- Never fires on a database this migration is meant for (the legacy table is unique on
+    -- (account_id, author_user_id)). It covers the state an unpushed rewrite can leave behind: a
+    -- machine that ran the deleted team-keyed draft has up to one row per (account, TEAM, author).
+    ON CONFLICT ("account_id", "repo_id", "author_user_id") DO NOTHING;
+  END IF;
+END $$;--> statement-breakpoint
+UPDATE "repo_reviewers"
+SET "role" = 'quality_check'
+WHERE "source" <> 'manual'
+  AND "author_user_id" IN (
+    SELECT "id" FROM "users" WHERE lower("github_login") IN (
+      'sonarqubecloud', 'sonarqubecloud[bot]',
+      'sonarcloud', 'sonarcloud[bot]',
+      'codecov', 'codecov[bot]',
+      'codeclimate', 'codeclimate[bot]',
+      'codefactor-io', 'codefactor-io[bot]',
+      'houndci-bot', 'houndci-bot[bot]',
+      'coveralls', 'coveralls[bot]',
+      'codacy-bot', 'codacy-bot[bot]'
+    )
+  );--> statement-breakpoint
+DROP TABLE IF EXISTS "bot_review_classification";

package/dist/db/migrations-pg/0030_account_reviewers.sql

@@ -0,0 +1,77 @@
+-- NORMALISE THE ACTOR GRAIN OUT OF `repo_reviewers` — the Postgres twin of the sqlite migration
+-- 0043_account_reviewers. Hand-written additive, idempotent. Second half of the change 0029
+-- starts:
+--
+--   0029  RE-KEY     (account, author)        →  (account, repo, author)     columns unchanged
+--   0030  NORMALISE  the actor-grain columns  →  their own table `account_reviewers`
+--
+-- WHY. After 0029, `kind` / `label` / `identity_source` sit REPLICATED on every one of an actor's
+-- repo rows, held consistent only by convention — the same hazard that giving cost its own
+-- storage was meant to eliminate, left in place for three other columns. It carried three
+-- standing obligations: a new repo row had to SEED all three from its siblings; persist() had to
+-- gate on TWO provenance flags in one row; and the account-wide identity was "a straight read of
+-- any one of them", which elects a winner the moment two rows disagree. One row per actor deletes
+-- all three. Full argument in the sqlite twin.
+--
+-- COST IS FOLDED IN rather than given a third table: a price is just another actor-level
+-- property, and a separate table on the same key would be this one with extra steps. One table
+-- per grain.
+--
+-- `monthly_cents` IS THEREFORE NULLABLE, where a standalone cost table had it NOT NULL ("no
+-- price" was "no row"). A row that also carries identity exists for reasons unrelated to money.
+-- That is SAFE here in a way it was not before: the old bug class was nullable-means-INHERIT,
+-- with a fallback chain behind it, where 0 ("free HERE") and NULL ("ask my parent") had to be
+-- told apart with `??` rather than `||`. NOTHING INHERITS ANY MORE — NULL is "no price set", 0 is
+-- "free", two states and no chain. Clearing a price is `SET monthly_cents = NULL`, not a DELETE.
+--
+-- `account_reviewers` is named for its KEY, exactly as `repo_reviewers` is, so the two names ARE
+-- the statement of the model. Not `reviewer_identities` (which would make `monthly_cents` look
+-- like a stray) and not `reviewer_costs` (which made `kind`/`label` look the same way).
+--
+-- ⚠ DRAFT-STATE HOUSEKEEPING — DELETE BEFORE THIS BRANCH MERGES. `reviewer_costs` was created by
+-- an earlier draft of this migration while the branch was unpushed and never existed in any
+-- released version. The guarded carry-over below exists ONLY so a machine that ran that draft
+-- keeps the prices it typed; everywhere else `to_regclass` is NULL and it does nothing. No
+-- Postgres deployment has ever run the draft — this is here for symmetry with the sqlite twin,
+-- which needs it, and both go at the same time.
+CREATE TABLE IF NOT EXISTS "account_reviewers" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL REFERENCES "accounts"("id") ON DELETE cascade,
+	"author_user_id" integer NOT NULL REFERENCES "users"("id"),
+	"kind" text,
+	"label" text,
+	"identity_source" text DEFAULT 'auto' NOT NULL,
+	"monthly_cents" integer,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "account_reviewers_account_author" ON "account_reviewers" USING btree ("account_id","author_user_id");--> statement-breakpoint
+-- ONE ROW PER ACTOR, LIFTED OFF WHICHEVER REPO ROW IS MOST AUTHORITATIVE. After 0029 an actor's
+-- rows agree by construction, so any of them would do; the tie-break is stated because this is
+-- exactly the "elect a winner" step the new shape abolishes, and doing it ONCE, here, with a
+-- written rule is the honest way to abolish it: prefer a MANUAL identity, then the most recently
+-- updated row. DISTINCT ON + ORDER BY is the same selection the sqlite twin spells with SQLite's
+-- bare-columns-follow-the-max() rule.
+INSERT INTO "account_reviewers"
+  ("account_id", "author_user_id", "kind", "label", "identity_source", "updated_at")
+SELECT DISTINCT ON ("account_id", "author_user_id")
+       "account_id", "author_user_id", "kind", "label", "identity_source", "updated_at"
+  FROM "repo_reviewers"
+ ORDER BY "account_id", "author_user_id", ("identity_source" = 'manual') DESC, "updated_at" DESC
+ON CONFLICT ("account_id", "author_user_id") DO NOTHING;--> statement-breakpoint
+DO $$
+BEGIN
+  IF to_regclass('public.reviewer_costs') IS NOT NULL THEN
+    UPDATE "account_reviewers" ar
+       SET "monthly_cents" = rc."monthly_cents"
+      FROM "reviewer_costs" rc
+     WHERE rc."account_id"     = ar."account_id"
+       AND rc."author_user_id" = ar."author_user_id";
+  END IF;
+END $$;--> statement-breakpoint
+DROP TABLE IF EXISTS "reviewer_costs";--> statement-breakpoint
+-- The point of the whole file: after this, a repo row can say nothing about WHO the actor is.
+-- `RepoReviewer` on the wire exposes no identity field and `ReviewerIdentity` exposes no
+-- judgement field, and now the storage says the same thing.
+ALTER TABLE "repo_reviewers" DROP COLUMN IF EXISTS "kind";--> statement-breakpoint
+ALTER TABLE "repo_reviewers" DROP COLUMN IF EXISTS "label";--> statement-breakpoint
+ALTER TABLE "repo_reviewers" DROP COLUMN IF EXISTS "identity_source";

package/dist/db/migrations-pg/0031_workspaces.sql

@@ -0,0 +1,131 @@
+-- TEAMS BECOME WORKSPACES, AND A REPO GETS EXACTLY ONE. Postgres / cloud mode; the SQLite twin is
+-- migrations/0044_workspaces.sql. Migration 0032 then collapses the two bot tables onto the
+-- workspace key — read them together, they are one change in two steps:
+--
+--   0031  RE-HOME   repo grouping:  teams (m2m)  →  workspaces (1:N), + a Default per account
+--   0032  COLLAPSE  the bot object: repo_reviewers + account_reviewers → workspace_reviewers
+--
+-- WORKSPACE IDS ARE THE OLD TEAM IDS. Preserved deliberately: a URL, a bookmark, a persisted
+-- filter and (after the plugin's own 0020) a cache row all carry the number, and renumbering
+-- would silently repoint them at a different repo set.
+--
+-- ⚠ THE ONE THING THAT DIFFERS BETWEEN THE DIALECTS IS THE SEQUENCE. SQLite AUTOINCREMENT tracks
+-- max(rowid) ever seen, so an explicit-id INSERT advances it and the Default rows below get fresh
+-- ids for free. Postgres `serial` does NOT advance on an explicit-id INSERT, so this file MUST
+-- setval() between step 1 and step 2 or the very next workspace collides with a preserved team id.
+-- The failure is a LOUD BOOT FAILURE, not a later 500: step 2 takes nextval = 1, collides with
+-- preserved team id 1, `duplicate key value violates unique constraint "workspaces_pkey"` aborts
+-- the DO block, runMigrations() throws and cloud never boots.
+--
+-- ⚠ ONLY STEPS 1 AND 3 ARE GUARDED by `to_regclass`, because they are the only statements that
+-- READ `teams` / `team_repos` (this file drops both at the bottom, so a replay would otherwise
+-- fail on "relation does not exist" rather than no-op — the pg equivalent of the sqlite twin's
+-- `CREATE TABLE IF NOT EXISTS` legacy stubs). Steps 2 (a Default per account) and 4 (unassigned
+-- repos → Default) are PLAIN, UNGUARDED statements. Wrapping all four — the obvious reading of
+-- "same five steps" — would make a Postgres database that no longer has `teams` (a fresh cloud
+-- deploy, a replay after the DROP) create NO workspaces and NO memberships at all, while the
+-- sqlite twin's stub tables leave steps 2 and 4 always running. The runtime repair
+-- (ensureDefaultWorkspace / ensureRepoMemberships) hides it, so the two files would silently
+-- implement two different algorithms.
+CREATE TABLE IF NOT EXISTS "workspaces" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL REFERENCES "accounts"("id") ON DELETE cascade,
+	"name" text NOT NULL,
+	"is_default" boolean DEFAULT false NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "workspaces_account_name" ON "workspaces" USING btree ("account_id","name");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "workspaces_account_idx" ON "workspaces" USING btree ("account_id");--> statement-breakpoint
+-- Not for lookups (`id` is already the PK) — it is the PARENT KEY of the composite FKs on
+-- workspace_repos and workspace_reviewers, exactly as `repos_id_account` (0029) is for those
+-- tables' repo FKs. Postgres accepts a plain UNIQUE INDEX as an FK parent key; it does not require
+-- a named UNIQUE CONSTRAINT. Drop it and both composite FKs become unexpressible.
+CREATE UNIQUE INDEX IF NOT EXISTS "workspaces_id_account" ON "workspaces" USING btree ("id","account_id");--> statement-breakpoint
+-- 1. One workspace per existing team, IDS PRESERVED.
+DO $$
+BEGIN
+  IF to_regclass('public.teams') IS NOT NULL THEN
+    INSERT INTO "workspaces" ("id", "account_id", "name", "is_default", "created_at")
+    SELECT "id", "account_id", "name", false, "created_at" FROM "teams"
+    ON CONFLICT ("id") DO NOTHING;
+  END IF;
+END $$;--> statement-breakpoint
+-- 1b. ADVANCE THE SEQUENCE PAST THE PRESERVED IDS. No sqlite counterpart — do not "harmonise it
+--     away". `is_called` is false on an EMPTY table so the first id is 1, not 2: passing a bare
+--     `true` makes a fresh cloud deployment's very first workspace id 2, which reads as a bug to
+--     whoever finds it.
+SELECT setval(
+  pg_get_serial_sequence('workspaces','id'),
+  GREATEST(COALESCE((SELECT MAX("id") FROM "workspaces"), 0), 1),
+  COALESCE((SELECT MAX("id") FROM "workspaces"), 0) > 0
+);--> statement-breakpoint
+-- 2. A Default workspace for EVERY account, including accounts that never had a team.
+--    The three-level name CASE exists because `workspaces_account_name` is unique and a user may
+--    already own a team called "Default". The third form embeds the account id, so it cannot
+--    collide with the first two for the same account.
+INSERT INTO "workspaces" ("account_id", "name", "is_default", "created_at")
+SELECT a."id",
+       CASE
+         WHEN NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."account_id" = a."id" AND w."name" = 'Default')
+           THEN 'Default'
+         WHEN NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."account_id" = a."id" AND w."name" = 'Default workspace')
+           THEN 'Default workspace'
+         ELSE 'Default (workspace ' || a."id" || ')'
+       END,
+       true, now()
+  FROM "accounts" a
+ WHERE NOT EXISTS (SELECT 1 FROM "workspaces" w WHERE w."account_id" = a."id" AND w."is_default");--> statement-breakpoint
+-- 2b. ONE DEFAULT PER ACCOUNT, AS A DATABASE FACT. Created after the backfill so a hand-corrupted
+--     database fails on a statement whose meaning is obvious. This is what makes
+--     ensureDefaultWorkspace's "INSERT … ON CONFLICT DO NOTHING then re-SELECT" race-safe: it runs
+--     on effectively every request, and two concurrent calls for an account with no default would
+--     otherwise both SELECT nothing and both INSERT.
+CREATE UNIQUE INDEX IF NOT EXISTS "workspaces_one_default" ON "workspaces" USING btree ("account_id") WHERE "is_default";--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "workspace_repos" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL REFERENCES "accounts"("id") ON DELETE cascade,
+	"workspace_id" integer NOT NULL,
+	"repo_id" integer NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	-- Tenancy as a constraint. `workspace_id` arrives in a REQUEST BODY, so a plain
+	-- `REFERENCES workspaces(id)` would accept (account 2, workspace 10) where workspace 10 belongs
+	-- to account 1 — both halves individually valid. NAMED so Postgres quotes it in the violation
+	-- message and a grep for the name finds a live constraint.
+	CONSTRAINT "workspace_repos_workspace_account_fk" FOREIGN KEY ("workspace_id","account_id") REFERENCES "workspaces"("id","account_id") ON DELETE cascade,
+	CONSTRAINT "workspace_repos_repo_account_fk" FOREIGN KEY ("repo_id","account_id") REFERENCES "repos"("id","account_id") ON DELETE cascade
+);--> statement-breakpoint
+-- EXACTLY ONE WORKSPACE PER REPO, AS A DATABASE FACT — and the upsert conflict target for
+-- assignReposToWorkspace, so assigning a repo elsewhere is a MOVE and no code path can produce a
+-- second membership row.
+CREATE UNIQUE INDEX IF NOT EXISTS "workspace_repos_account_repo" ON "workspace_repos" USING btree ("account_id","repo_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "workspace_repos_account_workspace_idx" ON "workspace_repos" USING btree ("account_id","workspace_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "workspace_repos_repo_idx" ON "workspace_repos" USING btree ("repo_id");--> statement-breakpoint
+-- 3. D4's TIE-BREAK: a repo in 2+ teams keeps its EARLIEST assignment (lowest team_repos.id).
+--    Written as a correlated MIN() rather than DISTINCT ON, which SQLite does not have and which
+--    would therefore make the two dialects' files structurally different for no reason. The
+--    account predicate in the subquery is redundant (repos.id is a global PK, so repo_id already
+--    implies the account) and is spelled anyway so tenancy is visible in the statement.
+DO $$
+BEGIN
+  IF to_regclass('public.team_repos') IS NOT NULL THEN
+    INSERT INTO "workspace_repos" ("account_id", "workspace_id", "repo_id", "created_at")
+    SELECT tr."account_id", tr."team_id", tr."repo_id", tr."created_at"
+      FROM "team_repos" tr
+     WHERE tr."id" = (
+             SELECT MIN(tr2."id") FROM "team_repos" tr2
+              WHERE tr2."repo_id" = tr."repo_id" AND tr2."account_id" = tr."account_id")
+    ON CONFLICT ("account_id", "repo_id") DO NOTHING;
+  END IF;
+END $$;--> statement-breakpoint
+-- 4. Every repo with no resulting row → that account's Default. Covers repos that were in no team
+--    at all AND (on a replay) anything step 3 could not place. UNGUARDED — see the header.
+INSERT INTO "workspace_repos" ("account_id", "workspace_id", "repo_id", "created_at")
+SELECT r."account_id", w."id", r."id", now()
+  FROM "repos" r
+  JOIN "workspaces" w ON w."account_id" = r."account_id" AND w."is_default"
+ WHERE NOT EXISTS (SELECT 1 FROM "workspace_repos" wr WHERE wr."repo_id" = r."id")
+ON CONFLICT ("account_id", "repo_id") DO NOTHING;--> statement-breakpoint
+-- 5. Child first (team_repos FKs teams), then the parent. Leaving them behind would leave a
+--    second, differently-keyed answer to "which repos am I looking at" in every database.
+DROP TABLE IF EXISTS "team_repos";--> statement-breakpoint
+DROP TABLE IF EXISTS "teams";

package/dist/db/migrations-pg/0032_workspace_reviewers.sql

@@ -0,0 +1,165 @@
+-- THE BOT OBJECT COLLAPSES ONTO THE WORKSPACE KEY. Postgres / cloud mode; the SQLite twin is
+-- migrations/0045_workspace_reviewers.sql. Second half of the change 0031 starts.
+--
+-- `repo_reviewers` answered "is this login a bot" once per (account, repo). `account_reviewers`
+-- answered "who is it and what does it cost" once per (account, actor). With one workspace as the
+-- only scope, both questions have the same key, so both tables become one row per
+-- (account, workspace, actor) — and the fold that reads six repo rows into one metric answer
+-- disappears with them.
+--
+-- ⚠ WHAT MUST NOT BE LOST WITH THE MERGE: the two PROVENANCE FLAGS stay separate columns and are
+-- honoured INDEPENDENTLY. `source` owns automated/role/confidence/reasons; `identity_source` owns
+-- kind/label. `monthly_cents` is owned by nothing derived — exactly one writer (setReviewerCost)
+-- names exactly one row, and the column appears in no other `set:` object anywhere. NULL = no
+-- price set, 0 = "recorded as free"; nothing inherits, so there is no chain behind a `??`.
+--
+-- ── THE FOLD RULE ────────────────────────────────────────────────────────────────────────────
+-- For each (account, workspace, actor) with at least one repo_reviewers row on a repo now in
+-- that workspace:
+--   automated  = TRUE if ANY contributing row is automated              (union — this half DOES
+--   role       = 'review' if ANY contributing row roles it 'review'      reproduce resolveJudgements
+--                else 'quality_check'                                    exactly, for READS)
+--   confidence = the highest confidence among the rows that carried the WINNING `automated` value
+--                (folding the max across all rows lets an automated=false row hand `high` to an
+--                 automated=true verdict it disagreed with)
+--   updated_at = MAX of the contributing rows
+--
+--   source     = 'manual' if ANY contributing row is manual, regardless of which side won.
+--                ⚠ THIS IS DELIBERATELY *NOT* THE READ-TIME UNION RULE, and the difference is the
+--                whole point. For reads, `manualHuman` is only consulted when nothing in scope
+--                calls the actor automated. But `source` is not only a read input: it is the WRITE
+--                GATE in persist() and the flag behind the "Reset classification" affordance.
+--                Folding it to 'auto' would let the next classification pass silently overwrite a
+--                human's opinion, with no control offered to undo it and no trace in reasons_json.
+--                A visible, resettable pin the user can see is strictly better than a judgement
+--                that vanishes. ELSE the source of the winning evidence — carried, not invented:
+--                the highest confidence row on the winning side of `automated`, ties broken by
+--                updated_at DESC then repo_id ASC so both dialects pick the same row. ⚠ NEVER the
+--                literal 'auto': that is the `identity_source` vocabulary. `ClassificationSource`
+--                is 'manual'|'vendor_login'|'github_type'|'app_attribution'|'fingerprint'|
+--                'behavioral'|'ai_tiebreak' and an out-of-union value would never self-heal.
+--                'fingerprint' is the fallback if the subquery somehow finds nothing.
+--
+--   reasons_json = SYNTHESISED, not carried. One repo row's reason text does not describe a
+--                workspace verdict, the field is advisory display evidence, and the next
+--                classification pass overwrites it for every non-manual row. ⚠ A fold where a
+--                manual row LOST gets an explicit conflict string, so the one case where a human's
+--                judgement was superseded is visible on the card rather than inferred from a
+--                mismatched provenance flag.
+--
+--   kind, label, identity_source = copied from the actor's account_reviewers row. Account-grain
+--                today, so they REPLICATE into each workspace the actor appears in. That
+--                replication is the accepted D5 consequence: from here on they are per-workspace
+--                facts and may legitimately diverge.
+--   monthly_cents = copied into every workspace row of that actor, on exactly the same footing.
+--                This is the faithful carry-over of a value that WAS account-wide — a ONE-TIME
+--                SEED, not an invariant. From here on price is a per-workspace fact like kind and
+--                label: setReviewerCost writes ONE row, nothing fans out, nothing seeds a later
+--                row, and the copies diverge freely as the user edits them.
+--
+-- Actors with an account_reviewers row but NO repo_reviewers row anywhere are DROPPED — the
+-- listing has always been row-driven, and such an identity could never be displayed, edited or
+-- cleared (the same rule the 404 on the old identity route enforced).
+--
+-- ⚠ DIALECT DIVERGENCES THAT MAY NOT BE "UNIFIED" (the sqlite twin is the reference for each):
+--   • `bool_or(rr.automated)` — pg has no `max(boolean)`; `MAX()` would fail to plan.
+--   • bare booleans (`rr.automated`, `f.aut`) where sqlite writes `= 1`.
+--   • BUT `manual_aut` / `manual_any` / `any_review` are INTEGER `MAX(CASE … 1 ELSE 0 END)` in
+--     BOTH dialects, so they must still be compared with `= 1` here. `CASE WHEN f.aut AND
+--     f.manual_aut THEN …` is a HARD TYPE ERROR — Postgres has no implicit integer→boolean cast
+--     and raises `argument of AND must be type boolean, not type integer`, aborting the whole
+--     migration. (`rr2.automated = f.aut` is boolean = boolean here and integer = integer in
+--     sqlite, so that one line is genuinely identical in both files.)
+--   • `::jsonb` on the synthesised reasons — the pg column is jsonb, not text.
+--   • the backfill is wrapped in a `to_regclass` guard rather than preceded by legacy-table stubs:
+--     this file drops the tables its own backfill reads, and pg has conditional DDL while sqlite
+--     does not. Same intent, two dialects, stated rather than discovered.
+--   • no `WHERE true` before `ON CONFLICT` — that disambiguator is a sqlite parsing quirk only.
+CREATE TABLE IF NOT EXISTS "workspace_reviewers" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL REFERENCES "accounts"("id") ON DELETE cascade,
+	"workspace_id" integer NOT NULL,
+	-- No cascade: `users` is GLOBAL storage shared by every account and is never deleted.
+	"author_user_id" integer NOT NULL REFERENCES "users"("id"),
+	"automated" boolean NOT NULL,
+	"role" text DEFAULT 'review' NOT NULL,
+	"confidence" text NOT NULL,
+	"source" text NOT NULL,
+	"reasons_json" jsonb,
+	"kind" text,
+	"label" text,
+	"identity_source" text DEFAULT 'auto' NOT NULL,
+	"monthly_cents" integer,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "workspace_reviewers_workspace_account_fk" FOREIGN KEY ("workspace_id","account_id") REFERENCES "workspaces"("id","account_id") ON DELETE cascade
+);--> statement-breakpoint
+-- The upsert conflict target for EVERY writer. A stale target type-checks perfectly and raises
+-- "no unique or exclusion constraint matching the ON CONFLICT specification" at RUNTIME, in both
+-- dialects, only when a row is actually written.
+CREATE UNIQUE INDEX IF NOT EXISTS "workspace_reviewers_account_workspace_author" ON "workspace_reviewers" USING btree ("account_id","workspace_id","author_user_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "workspace_reviewers_account_workspace_idx" ON "workspace_reviewers" USING btree ("account_id","workspace_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "workspace_reviewers_account_author_idx" ON "workspace_reviewers" USING btree ("account_id","author_user_id");--> statement-breakpoint
+DO $$
+BEGIN
+  IF to_regclass('public.repo_reviewers') IS NOT NULL THEN
+    INSERT INTO "workspace_reviewers"
+      ("account_id", "workspace_id", "author_user_id", "automated", "role", "confidence", "source",
+       "reasons_json", "kind", "label", "identity_source", "monthly_cents", "updated_at")
+    SELECT f."account_id", f."workspace_id", f."author_user_id",
+           f."aut",
+           CASE WHEN f."any_review" = 1 THEN 'review' ELSE 'quality_check' END,
+           CASE WHEN f."aut" THEN
+                  CASE f."conf_aut" WHEN 3 THEN 'high' WHEN 2 THEN 'medium' ELSE 'low' END
+                ELSE
+                  CASE f."conf_any" WHEN 3 THEN 'high' WHEN 2 THEN 'medium' ELSE 'low' END
+           END,
+           -- source: 'manual' if ANY contributing row was manual (the pin survives, visibly);
+           -- otherwise the winning row's OWN source — a real ClassificationSource member, never
+           -- 'auto'.
+           CASE WHEN f."manual_any" = 1 THEN 'manual' ELSE COALESCE((
+                  SELECT rr2."source"
+                    FROM "repo_reviewers" rr2
+                    JOIN "workspace_repos" wr2
+                      ON wr2."repo_id" = rr2."repo_id" AND wr2."account_id" = rr2."account_id"
+                   WHERE rr2."account_id"     = f."account_id"
+                     AND wr2."workspace_id"   = f."workspace_id"
+                     AND rr2."author_user_id" = f."author_user_id"
+                     AND rr2."automated"      = f."aut"
+                   ORDER BY CASE rr2."confidence" WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END DESC,
+                            rr2."updated_at" DESC, rr2."repo_id" ASC
+                   LIMIT 1), 'fingerprint') END,
+           CASE WHEN f."aut" AND f."manual_aut" = 1
+                  THEN '["manually tagged as an automated reviewer"]'::jsonb
+                WHEN NOT f."aut" AND f."manual_any" = 1
+                  THEN '["manually confirmed as a human"]'::jsonb
+                -- The one lossy case, named out loud on the card rather than left to be inferred.
+                WHEN f."manual_any" = 1
+                  THEN '["migrated from the per-repo classification","⚠ conflicting per-repo judgements were merged — review this"]'::jsonb
+                ELSE '["migrated from the per-repo classification"]'::jsonb END,
+           ar."kind", ar."label", COALESCE(ar."identity_source", 'auto'), ar."monthly_cents",
+           f."upd"
+      FROM (
+        SELECT rr."account_id"                                                AS "account_id",
+               wr."workspace_id"                                              AS "workspace_id",
+               rr."author_user_id"                                            AS "author_user_id",
+               bool_or(rr."automated")                                        AS "aut",
+               MAX(CASE WHEN COALESCE(rr."role",'review') <> 'quality_check' THEN 1 ELSE 0 END) AS "any_review",
+               MAX(CASE WHEN rr."automated"
+                        THEN CASE rr."confidence" WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END
+                        ELSE 0 END)                                           AS "conf_aut",
+               MAX(CASE rr."confidence" WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END) AS "conf_any",
+               MAX(CASE WHEN rr."source" = 'manual' AND rr."automated" THEN 1 ELSE 0 END) AS "manual_aut",
+               MAX(CASE WHEN rr."source" = 'manual' THEN 1 ELSE 0 END)        AS "manual_any",
+               MAX(rr."updated_at")                                           AS "upd"
+          FROM "repo_reviewers" rr
+          JOIN "workspace_repos" wr
+            ON wr."repo_id" = rr."repo_id" AND wr."account_id" = rr."account_id"
+         GROUP BY rr."account_id", wr."workspace_id", rr."author_user_id"
+      ) f
+      LEFT JOIN "account_reviewers" ar
+        ON ar."account_id" = f."account_id" AND ar."author_user_id" = f."author_user_id"
+    ON CONFLICT ("account_id", "workspace_id", "author_user_id") DO NOTHING;
+  END IF;
+END $$;--> statement-breakpoint
+DROP TABLE IF EXISTS "repo_reviewers";--> statement-breakpoint
+DROP TABLE IF EXISTS "account_reviewers";

package/dist/db/migrations-pg/0033_drop_inbox_watch.sql

@@ -0,0 +1,14 @@
+-- Drop the "watched" concept — the Postgres twin of the sqlite migration 0046_drop_inbox_watch.
+--
+-- `repos.inbox_watch` / `repos.inbox_watch_started_at` were a second visibility axis on top of
+-- "is this repo added to the account", quietly narrowing the Feed, recent activity, My Turn and
+-- the Pro digest collection to a watched subset. With Workspaces the Workspace IS the scope, so
+-- every repo in a Workspace is now fully live.
+--
+-- The property that mattered — adding a repo with 400 open PRs must not dump them all into My
+-- Turn on day one — moves to `repos.created_at` (when the repo was ADDED), which already exists
+-- and is NOT NULL, so there is no backfill.
+--
+-- `IF EXISTS` on both, so a database that somehow never had them replays cleanly.
+ALTER TABLE "repos" DROP COLUMN IF EXISTS "inbox_watch";--> statement-breakpoint
+ALTER TABLE "repos" DROP COLUMN IF EXISTS "inbox_watch_started_at";

package/dist/db/migrations-pg/0034_ml_comment_labels.sql

@@ -0,0 +1,33 @@
+-- Postgres twin of migrations/0047_ml_comment_labels.sql — ML severity/category labels for
+-- BOT-authored text (CORE, free tier, no LLM). HAND-WRITTEN ADDITIVE, like every pg migration
+-- since 0023: never regenerate the baseline with `pnpm db:generate:pg`, which squashes it.
+-- Index names are byte-identical to the sqlite twin (they are the drizzle index names).
+CREATE TABLE IF NOT EXISTS "ml_comment_labels" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL,
+	"repo_id" integer NOT NULL,
+	"pr_id" integer NOT NULL,
+	"target_kind" text NOT NULL,
+	"target_id" integer NOT NULL,
+	"author_user_id" integer NOT NULL,
+	"severity" text NOT NULL,
+	"severity_ord" integer NOT NULL,
+	"severity_prob" double precision NOT NULL,
+	"categories" jsonb NOT NULL,
+	"category_probs" jsonb NOT NULL,
+	"is_summary" boolean NOT NULL,
+	"backend" text NOT NULL,
+	"model_version" text NOT NULL,
+	"body_hash" text NOT NULL,
+	"target_created_at" timestamp with time zone NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "ml_comment_labels" ADD CONSTRAINT "ml_comment_labels_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "public"."accounts"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "ml_comment_labels" ADD CONSTRAINT "ml_comment_labels_repo_id_repos_id_fk" FOREIGN KEY ("repo_id") REFERENCES "public"."repos"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "ml_comment_labels" ADD CONSTRAINT "ml_comment_labels_pr_id_pull_requests_id_fk" FOREIGN KEY ("pr_id") REFERENCES "public"."pull_requests"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "ml_comment_labels" ADD CONSTRAINT "ml_comment_labels_author_user_id_users_id_fk" FOREIGN KEY ("author_user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "mcl_account_target" ON "ml_comment_labels" USING btree ("account_id","target_kind","target_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "mcl_account_pr_idx" ON "ml_comment_labels" USING btree ("account_id","pr_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "mcl_account_repo_author_idx" ON "ml_comment_labels" USING btree ("account_id","repo_id","author_user_id");

package/dist/db/migrations-pg/0035_ml_vendor_severity.sql

@@ -0,0 +1,16 @@
+-- The review bot's OWN declared severity — the Postgres twin of sqlite
+-- 0048_ml_vendor_severity.sql. HAND-WRITTEN ADDITIVE, like every pg migration since 0023:
+-- never regenerate the baseline with `pnpm db:generate:pg`, which squashes it.
+--
+-- See the sqlite twin for the full argument. In short: the severity-api's marker reader already
+-- extracts the vendor's self-declared severity and we were discarding it, so it is stored beside
+-- ours to be DISPLAYED next to it — never folded into it. On `gold_v2_sample` our model scores
+-- 0.700 exact / 0.303 ordinal MAE against the vendor badge's 0.474 / 0.697, so the vendor's claim
+-- is the less accurate of the two; nothing derives our severity from it.
+--
+-- Both columns are nullable: most comments carry no vendor badge, and an older severity-api
+-- omits the fields entirely (the client reads them defensively → null). No index (read out of an
+-- already-fetched row, never a predicate) and no backfill (labels are not re-scored; `pnpm
+-- ml:enrich --reset` is the refresh gesture).
+ALTER TABLE "ml_comment_labels" ADD COLUMN IF NOT EXISTS "vendor_severity" text;--> statement-breakpoint
+ALTER TABLE "ml_comment_labels" ADD COLUMN IF NOT EXISTS "vendor_severity_confidence" text;

package/dist/db/migrations-pg/0036_seat_pricing_repo_description.sql

@@ -0,0 +1,12 @@
+-- Per-seat bot pricing + repo descriptions — the Postgres twin of sqlite
+-- 0049_seat_pricing_repo_description.sql. HAND-WRITTEN ADDITIVE, like every pg migration
+-- since 0023: never regenerate the baseline with `pnpm db:generate:pg`, which squashes it.
+--
+-- See the sqlite twin for the full argument. In short: `cost_model` says how `monthly_cents`
+-- is read ('flat' = whole-workspace subscription, the default so every existing row keeps its
+-- meaning; 'per_seat' = unit price × the workspace's derived human seat count, product never
+-- stored), with ownership identical to `monthly_cents` (one writer, `setReviewerCost`).
+-- `repos.description` is the GitHub "About" text captured by the activity sync — grounding
+-- for the workspace-purpose sprint-chat preset.
+ALTER TABLE "repos" ADD COLUMN IF NOT EXISTS "description" text;--> statement-breakpoint
+ALTER TABLE "workspace_reviewers" ADD COLUMN IF NOT EXISTS "cost_model" text DEFAULT 'flat' NOT NULL;

package/dist/db/migrations-pg/0037_users_app_slug.sql

@@ -0,0 +1,9 @@
+-- Bot Tuning Advisor discovery: capture the GitHub App slug behind a bot's comments — the
+-- Postgres twin of sqlite 0050_users_app_slug.sql. HAND-WRITTEN ADDITIVE, like every pg
+-- migration since 0023: never regenerate the baseline with `pnpm db:generate:pg`, which
+-- squashes it.
+--
+-- See the sqlite twin for the full argument. In short: `users.app_slug` persists the
+-- `performed_via_github_app.slug` the app-attribution probe already receives (global fact,
+-- global table, nullable, never cleared by a later app-less comment).
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "app_slug" text;

package/dist/db/migrations-pg/0038_auto_merge_queue.sql

@@ -0,0 +1,10 @@
+-- Auto-merge ("merge when ready") learns GitHub's native merge queue — the Postgres twin of
+-- sqlite 0051_auto_merge_queue.sql. HAND-WRITTEN ADDITIVE, like every pg migration since
+-- 0023: never regenerate the baseline with `pnpm db:generate:pg`, which squashes it.
+--
+-- See the sqlite twin for the full argument. In short: `via_merge_queue` (arm-time fact —
+-- the watcher enqueues instead of direct-merging) + `enqueued_at` (the watcher's own
+-- enqueue, the attribution record for 'merged' vs 'disarmed_blocked').
+ALTER TABLE "auto_merge_requests" ADD COLUMN IF NOT EXISTS "via_merge_queue" boolean DEFAULT false NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "auto_merge_requests" ADD COLUMN IF NOT EXISTS "enqueued_at" timestamp with time zone;