lurqrun 0.1.6 → 0.1.7

package/dist/chunk-LYMPYETA.js

@@ -0,0 +1,965 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  EMBEDDING_DIM
+} from "./chunk-GPTKSNR6.js";
+import {
+  __export,
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/db/schema.ts
+var schema_exports = {};
+__export(schema_exports, {
+  UNBOUNDED_ARITY: () => UNBOUNDED_ARITY,
+  apiKeys: () => apiKeys,
+  apiSurfaces: () => apiSurfaces,
+  askSpendDaily: () => askSpendDaily,
+  claims: () => claims,
+  compatEdges: () => compatEdges,
+  compatVerifyQueue: () => compatVerifyQueue,
+  discoveryQueue: () => discoveryQueue,
+  entities: () => entities,
+  environments: () => environments,
+  mcpChangeEvents: () => mcpChangeEvents,
+  mcpContracts: () => mcpContracts,
+  mcpDeployments: () => mcpDeployments,
+  mcpObservations: () => mcpObservations,
+  mcpPublicReports: () => mcpPublicReports,
+  notificationChannels: () => notificationChannels,
+  notificationDeliveries: () => notificationDeliveries,
+  notificationItems: () => notificationItems,
+  notificationPreferences: () => notificationPreferences,
+  observations: () => observations,
+  ownerUsageDaily: () => ownerUsageDaily,
+  packageVersions: () => packageVersions,
+  packages: () => packages,
+  policyDecisions: () => policyDecisions,
+  recommendationOutcomes: () => recommendationOutcomes,
+  repoAlerts: () => repoAlerts,
+  repos: () => repos,
+  resolvedClosures: () => resolvedClosures,
+  seedPackages: () => seedPackages,
+  selectionPolicies: () => selectionPolicies,
+  selectionPolicyChanges: () => selectionPolicyChanges,
+  stackResolutions: () => stackResolutions,
+  subscriptions: () => subscriptions,
+  surfaceQueue: () => surfaceQueue,
+  symbols: () => symbols,
+  syncRuns: () => syncRuns,
+  upgradeRuns: () => upgradeRuns,
+  verificationRuns: () => verificationRuns,
+  watchState: () => watchState
+});
+init_esm_shims();
+import { sql } from "drizzle-orm";
+import {
+  bigint,
+  boolean,
+  customType,
+  date,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  primaryKey,
+  real,
+  serial,
+  text,
+  timestamp,
+  uniqueIndex,
+  vector
+} from "drizzle-orm/pg-core";
+var tsvector = customType({
+  dataType() {
+    return "tsvector";
+  }
+});
+var ts = (name) => timestamp(name, { withTimezone: true, mode: "date" });
+var packages = pgTable(
+  "packages",
+  {
+    id: serial("id").primaryKey(),
+    name: text("name").notNull(),
+    ecosystem: text("ecosystem").$type().notNull().default("npm"),
+    // Classification + descriptive text
+    category: text("category").$type(),
+    /** Whether `category` was hand-curated or inferred at ingest (§2A). */
+    categorySource: text("category_source").$type(),
+    description: text("description"),
+    summary: text("summary"),
+    repoUrl: text("repo_url"),
+    homepage: text("homepage"),
+    latestVersion: text("latest_version"),
+    license: text("license"),
+    // Lifecycle flags
+    deprecated: boolean("deprecated").notNull().default(false),
+    archived: boolean("archived").notNull().default(false),
+    // Age / maintenance signals
+    firstPublishedAt: ts("first_published_at"),
+    lastReleaseAt: ts("last_release_at"),
+    // Adoption signals
+    weeklyDownloads: bigint("weekly_downloads", { mode: "number" }),
+    downloadGrowth90d: real("download_growth_90d"),
+    stars: integer("stars"),
+    /**
+     * Dependent counts from deps.dev, kept split rather than summed.
+     *
+     * `direct_dependents` counts packages that name this one in their own
+     * manifest; `indirect_dependents` counts those that inherited it through
+     * someone else's tree. The ratio is what distinguishes a library a human
+     * chose from plumbing npm dragged in — a distinction weekly downloads and
+     * GitHub stars both fail to make, because a monorepo's internal utility
+     * inherits its parent's stars and every sibling's download volume.
+     */
+    directDependents: integer("direct_dependents"),
+    indirectDependents: integer("indirect_dependents"),
+    openIssues: integer("open_issues"),
+    closedIssues: integer("closed_issues"),
+    // Reliability / efficiency signals
+    scorecard: real("scorecard"),
+    bundleMinGzipKb: real("bundle_min_gzip_kb"),
+    advisories: jsonb("advisories").$type(),
+    // Compatibility metadata (Tier-1): declared peer-deps + engines of the
+    // latest version, so a whole-stack peer-range check is one indexed query.
+    peerDependencies: jsonb("peer_dependencies").$type(),
+    peerDependenciesMeta: jsonb("peer_dependencies_meta").$type(),
+    engines: jsonb("engines").$type(),
+    /** Where this package runs, classified from its own manifest at ingest.
+     *  Resolves the `framework` category's frontend/backend ambiguity for the
+     *  architecture diagram. Null = the manifest did not say clearly enough. */
+    runtimeTarget: text("runtime_target").$type(),
+    // Computed outputs
+    healthScore: integer("health_score"),
+    /** Intrinsic-quality axis (§1), adoption-independent. Blends with health at
+     *  ranking time (composite); never folded into health_score itself. */
+    qualityScore: integer("quality_score"),
+    confidence: text("confidence").$type(),
+    scoreBreakdown: jsonb("score_breakdown").$type(),
+    usageGuide: jsonb("usage_guide").$type(),
+    embedding: vector("embedding", { dimensions: EMBEDDING_DIM }),
+    // Identity of the vector space `embedding` was produced in (e.g.
+    // `openai:text-embedding-3-small`, `local`). Vector search filters on the
+    // active provider so switching models can't compare incompatible spaces.
+    embeddingProvider: text("embedding_provider"),
+    // Lexical search vector (§3): name weighted highest (A), then category (B),
+    // then summary/description (C). Generated + STORED so it stays in sync with
+    // the row automatically; indexed with GIN for fast `@@` matching.
+    searchVector: tsvector("search_vector").generatedAlwaysAs(
+      sql`setweight(to_tsvector('english', coalesce(name, '')), 'A') || setweight(to_tsvector('english', coalesce(category, '')), 'B') || setweight(to_tsvector('english', coalesce(summary, description, '')), 'C')`
+    ),
+    // Freshness + bookkeeping
+    dataAsOf: timestamp("data_as_of", { withTimezone: true, mode: "date" }),
+    /** latest_version this package's direct deps were last expanded for by the
+     *  discovery graph channel (§2B). Discovery re-scans a package only when this
+     *  differs from latest_version — deps are version-pinned, so an unchanged
+     *  version has unchanged neighbors. NULL = never scanned. */
+    graphScannedVersion: text("graph_scanned_version"),
+    createdAt: ts("created_at").notNull().defaultNow(),
+    updatedAt: ts("updated_at").notNull().defaultNow(),
+    /** The individual account (api_keys.owner_id) whose on-demand query first
+     *  caused this package to be ingested — nobody had asked for it before them.
+     *  Null for crawler/_changes-created packages, or ones ingested before
+     *  dashboard accounts existed. Stamped once via a standalone WHERE ... IS NULL
+     *  update kept out of upsertPackage, so re-syncs can never clobber it. */
+    firstRequestedByOwnerId: text("first_requested_by_owner_id")
+  },
+  (table) => [
+    uniqueIndex("packages_ecosystem_name_idx").on(table.ecosystem, table.name),
+    index("packages_category_idx").on(table.category),
+    index("packages_health_score_idx").on(table.healthScore),
+    // pgvector HNSW index for cosine similarity search (§11).
+    index("packages_embedding_idx").using("hnsw", table.embedding.op("vector_cosine_ops")),
+    // GIN index for lexical full-text search (§3).
+    index("packages_search_vector_idx").using("gin", table.searchVector),
+    index("packages_first_requested_by_idx").on(table.firstRequestedByOwnerId)
+  ]
+);
+var syncRuns = pgTable("sync_runs", {
+  id: serial("id").primaryKey(),
+  startedAt: ts("started_at").notNull().defaultNow(),
+  finishedAt: ts("finished_at"),
+  packagesSeen: integer("packages_seen").notNull().default(0),
+  packagesUpdated: integer("packages_updated").notNull().default(0),
+  errors: jsonb("errors").$type().notNull().default([]),
+  status: text("status").$type().notNull().default("running"),
+  /** Which deployment started this run, `<environment>/<service>`, or null when
+   *  the host injects neither (local runs). Diagnostic only: two rows in the
+   *  same minute with *different* origins is a duplicate scheduler — a second
+   *  environment or a second service tile running the same cron — which is
+   *  otherwise invisible from the data and doubles the outbound request rate
+   *  until npm starts answering 429. */
+  origin: text("origin")
+});
+var seedPackages = pgTable("seed_packages", {
+  name: text("name").primaryKey(),
+  category: text("category").$type(),
+  addedAt: ts("added_at").notNull().defaultNow()
+});
+var discoveryQueue = pgTable(
+  "discovery_queue",
+  {
+    id: serial("id").primaryKey(),
+    name: text("name").notNull().unique(),
+    discoveredVia: text("discovered_via").$type().notNull(),
+    /** Lightweight quality-only pre-score (§2B). Null until the gate runs. */
+    preScore: integer("pre_score"),
+    status: text("status").$type().notNull().default("pending"),
+    /** Failed ingests bump this; past DISCOVERY.maxIngestAttempts the candidate
+     *  is marked `failed` and stops being retried. Without it a package that
+     *  throws after its summary call — a malformed manifest, a constraint
+     *  violation — is re-ingested every cycle forever, paying the LLM each time
+     *  and never reaching the write that would take it off the queue. Same
+     *  treatment `compat_verify_queue.attempts` already gives a failing set. */
+    attempts: integer("attempts").notNull().default(0),
+    discoveredAt: ts("discovered_at").notNull().defaultNow()
+  },
+  (table) => [index("discovery_queue_status_idx").on(table.status)]
+);
+var compatVerifyQueue = pgTable(
+  "compat_verify_queue",
+  {
+    id: serial("id").primaryKey(),
+    /** Canonical order-independent key of the package set — dedups pending requests. */
+    setKey: text("set_key").notNull().unique(),
+    /** The package names to co-install in the sandbox. */
+    packages: jsonb("packages").$type().notNull(),
+    /** Failed drains bump this; the worker drops a set that keeps failing. */
+    attempts: integer("attempts").notNull().default(0),
+    requestedAt: ts("requested_at").notNull().defaultNow()
+  },
+  (table) => [index("compat_verify_queue_requested_idx").on(table.requestedAt)]
+);
+var apiKeys = pgTable(
+  "api_keys",
+  {
+    id: serial("id").primaryKey(),
+    /** sha256 hex of the full key — the only form persisted. */
+    keyHash: text("key_hash").notNull().unique(),
+    /** Identifiable display prefix, e.g. `lurq_live_ab12cd` (safe to show/log). */
+    prefix: text("prefix").notNull(),
+    /** Free-text label (owner / org / purpose). */
+    label: text("label"),
+    /** Reserved for self-serve issuance: maps to a Clerk user id. */
+    ownerId: text("owner_id"),
+    tier: text("tier").notNull().default("free"),
+    /**
+     * Permissions beyond the default read-and-call access (see KEY_SCOPES).
+     * Empty by default: `lurq setup` writes a key into agent config files, and
+     * a key an agent holds must never be able to loosen the rules it runs under.
+     */
+    scopes: text("scopes").array().notNull().default(sql`'{}'::text[]`),
+    createdAt: ts("created_at").notNull().defaultNow(),
+    lastUsedAt: ts("last_used_at"),
+    revokedAt: ts("revoked_at")
+  },
+  (table) => [index("api_keys_owner_idx").on(table.ownerId)]
+);
+var packageVersions = pgTable(
+  "package_versions",
+  {
+    packageName: text("package_name").notNull(),
+    version: text("version").notNull(),
+    publishedAt: ts("published_at"),
+    /** Peers/engines declared by this exact version. Lifted from the registry
+     *  document at ingest (it already carries every version's manifest), so a
+     *  conflict check against the versions a repo actually RUNS is one indexed
+     *  query rather than a registry read per dependency. */
+    peerDependencies: jsonb("peer_dependencies").$type(),
+    engines: jsonb("engines").$type()
+  },
+  (table) => [
+    primaryKey({ columns: [table.packageName, table.version] }),
+    index("package_versions_name_published_idx").on(table.packageName, table.publishedAt)
+  ]
+);
+var watchState = pgTable("watch_state", {
+  id: text("id").primaryKey(),
+  seq: text("seq").notNull(),
+  updatedAt: ts("updated_at")
+});
+var verificationRuns = pgTable(
+  "verification_runs",
+  {
+    id: serial("id").primaryKey(),
+    packageName: text("package_name").notNull(),
+    version: text("version").notNull(),
+    driver: text("driver").notNull(),
+    moduleSystem: text("module_system").notNull(),
+    installed: boolean("installed").notNull(),
+    imported: boolean("imported"),
+    ranScripts: boolean("ran_scripts").notNull().default(false),
+    durationMs: integer("duration_ms"),
+    error: text("error"),
+    ranAt: ts("ran_at")
+  },
+  (table) => [index("verification_runs_pkg_idx").on(table.packageName, table.version)]
+);
+var compatEdges = pgTable(
+  "compat_edges",
+  {
+    id: serial("id").primaryKey(),
+    packageA: text("package_a").notNull(),
+    versionA: text("version_a").notNull(),
+    packageB: text("package_b").notNull(),
+    versionB: text("version_b").notNull(),
+    status: text("status").$type().notNull(),
+    /** Evidence class (§4B). Existing rows are sandbox co-installs, so the column
+     *  defaults to `verified` to preserve their meaning. */
+    provenance: text("provenance").$type().notNull().default("verified"),
+    /** Distinct resolved graphs an `observed` edge was witnessed in (confidence).
+     *  Ignored for verified/conflict. Accumulates on conflict, never overwritten. */
+    witnessCount: integer("witness_count").notNull().default(0),
+    driver: text("driver").notNull(),
+    ranAt: ts("ran_at")
+  },
+  (table) => [
+    uniqueIndex("compat_edges_pair_idx").on(
+      table.packageA,
+      table.versionA,
+      table.packageB,
+      table.versionB
+    )
+  ]
+);
+var resolvedClosures = pgTable(
+  "resolved_closures",
+  {
+    id: serial("id").primaryKey(),
+    packageName: text("package_name").notNull(),
+    version: text("version").notNull(),
+    /** Full closure: [{ name, version }, …] — every node in node_modules. */
+    nodes: jsonb("nodes").$type().notNull(),
+    fetchedAt: ts("fetched_at").notNull().defaultNow()
+  },
+  (table) => [uniqueIndex("resolved_closures_pkg_idx").on(table.packageName, table.version)]
+);
+var apiSurfaces = pgTable(
+  "api_surfaces",
+  {
+    id: serial("id").primaryKey(),
+    packageName: text("package_name").notNull(),
+    version: text("version").notNull(),
+    /** Normalized export list: [{ name, kind, signature }, …]. */
+    surface: jsonb("surface").$type().notNull(),
+    extractedAt: ts("extracted_at").notNull().defaultNow()
+  },
+  (table) => [uniqueIndex("api_surfaces_pkg_idx").on(table.packageName, table.version)]
+);
+var recommendationOutcomes = pgTable(
+  "recommendation_outcomes",
+  {
+    id: serial("id").primaryKey(),
+    /** The individual user this outcome belongs to (api_keys.owner_id). Null for
+     *  anonymous/operator-issued keys. This is what turns the flywheel from a
+     *  global blob into a per-user asset — "what did *this* person succeed
+     *  with." Server-injected from the authenticated key, never caller-supplied. */
+    ownerId: text("owner_id"),
+    packageName: text("package_name").notNull(),
+    accepted: boolean("accepted").notNull(),
+    buildSignal: text("build_signal").$type(),
+    /** The original need text the recommendation was for — ties outcome back to
+     *  the ask. Optional, length-capped at the trust boundary; never source code. */
+    need: text("need"),
+    createdAt: ts("created_at").notNull().defaultNow()
+  },
+  (table) => [
+    index("recommendation_outcomes_pkg_idx").on(table.packageName),
+    index("recommendation_outcomes_owner_idx").on(table.ownerId)
+  ]
+);
+var askSpendDaily = pgTable(
+  "ask_spend_daily",
+  {
+    ownerId: text("owner_id").notNull(),
+    /** UTC day, 'YYYY-MM-DD'. */
+    date: date("date").notNull(),
+    usdMicros: bigint("usd_micros", { mode: "number" }).notNull().default(0)
+  },
+  (table) => [primaryKey({ columns: [table.ownerId, table.date] })]
+);
+var ownerUsageDaily = pgTable(
+  "owner_usage_daily",
+  {
+    ownerId: text("owner_id").notNull(),
+    /** UTC day, 'YYYY-MM-DD'. */
+    date: date("date").notNull(),
+    /** recommend | evaluate | compare | compat | verify | usage | diagram | plan | report_outcome */
+    tool: text("tool").notNull(),
+    count: integer("count").notNull().default(0)
+  },
+  (table) => [
+    primaryKey({ columns: [table.ownerId, table.date, table.tool] }),
+    index("owner_usage_daily_owner_date_idx").on(table.ownerId, table.date)
+  ]
+);
+var repos = pgTable(
+  "repos",
+  {
+    id: serial("id").primaryKey(),
+    /** Clerk user id — same identity as api_keys.owner_id. */
+    ownerId: text("owner_id").notNull(),
+    /** GitHub App installation this repo is reachable through. */
+    installationId: bigint("installation_id", { mode: "number" }).notNull(),
+    /** `owner/name`. */
+    fullName: text("full_name").notNull(),
+    defaultBranch: text("default_branch"),
+    isPrivate: boolean("is_private").notNull().default(false),
+    policy: jsonb("policy").$type().notNull(),
+    manifests: jsonb("manifests").$type(),
+    /** Install command detected from the lockfile at scan time, so the generated
+     *  workflow uses the repo's actual package manager instead of assuming npm. */
+    installCommand: text("install_command"),
+    drift: jsonb("drift").$type(),
+    lastScanAt: ts("last_scan_at"),
+    /** Last scan failure, surfaced in the dashboard. Null once a scan succeeds —
+     *  a stale error next to fresh drift numbers reads as a current outage. */
+    lastScanError: text("last_scan_error"),
+    createdAt: ts("created_at").notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("repos_owner_full_name_idx").on(table.ownerId, table.fullName),
+    index("repos_installation_idx").on(table.installationId)
+  ]
+);
+var upgradeRuns = pgTable(
+  "upgrade_runs",
+  {
+    id: serial("id").primaryKey(),
+    /** Resolved server-side from the authenticated API key. Never caller-supplied. */
+    ownerId: text("owner_id").notNull(),
+    /** Links to `repos` when the repo is also connected. Null when the workflow
+     *  runs somewhere lurq has no GitHub App installation — the CLI works
+     *  standalone, and losing those runs would bias every impact figure. */
+    repoId: integer("repo_id"),
+    /** `owner/name` from GITHUB_REPOSITORY. */
+    repoFullName: text("repo_full_name").notNull(),
+    packageName: text("package_name").notNull(),
+    fromVersion: text("from_version").notNull(),
+    toVersion: text("to_version").notNull(),
+    severity: text("severity").$type().notNull(),
+    status: text("status").$type().notNull(),
+    /** Referenced symbols the upgrade removes or re-shapes. */
+    symbolsAffected: jsonb("symbols_affected").$type().notNull().default([]),
+    /** How many references those symbols have in the repo. */
+    callSites: integer("call_sites").notNull().default(0),
+    /** Distinct files containing them. Opt-in per repo policy. */
+    callSiteFiles: jsonb("call_site_files").$type(),
+    filesChanged: integer("files_changed"),
+    /** Null when the repo has no test script — distinct from `false`, which
+     *  means the suite ran and failed. */
+    testsPassed: boolean("tests_passed"),
+    prUrl: text("pr_url"),
+    /**
+     * The GitHub Actions run, so a dashboard row links back to real logs.
+     * NOT NULL with an empty-string default rather than nullable: it is part of
+     * the dedup key below, and Postgres treats NULLs as distinct — a nullable
+     * column there would silently let every re-post insert a duplicate. Empty
+     * means "posted outside Actions" (a local CLI run), which then dedups to one
+     * row per package+target and updates in place.
+     */
+    runUrl: text("run_url").notNull().default(""),
+    createdAt: ts("created_at").notNull().defaultNow()
+  },
+  (table) => [
+    index("upgrade_runs_owner_created_idx").on(table.ownerId, table.createdAt),
+    index("upgrade_runs_repo_idx").on(table.repoId),
+    // One row per package per Actions run: a re-post of the same run must update
+    // rather than duplicate, or a retried job would double every impact figure.
+    uniqueIndex("upgrade_runs_dedup_idx").on(
+      table.ownerId,
+      table.repoFullName,
+      table.packageName,
+      table.toVersion,
+      table.runUrl
+    )
+  ]
+);
+var repoAlerts = pgTable(
+  "repo_alerts",
+  {
+    id: serial("id").primaryKey(),
+    /** Clerk user id, copied from the repo — alerts are read owner-scoped. */
+    ownerId: text("owner_id").notNull(),
+    repoId: integer("repo_id").notNull(),
+    /** Denormalized so the feed renders without a join, as in `upgrade_runs`. */
+    repoFullName: text("repo_full_name").notNull(),
+    packageName: text("package_name").notNull(),
+    /** The range this repo declared when the release landed. */
+    range: text("range").notNull(),
+    /** What that range resolved to at the last scan. Null when the index had no
+     *  version timeline for the package yet — never guessed. */
+    fromVersion: text("from_version"),
+    /** The release that triggered this. */
+    toVersion: text("to_version").notNull(),
+    /**
+     * True when the declared range already admits `toVersion` — i.e. the next
+     * clean install silently takes the new major. That is the urgent case and the
+     * one no drift number expresses: the repo is not "behind", it is about to
+     * move on its own.
+     */
+    inRange: boolean("in_range").notNull(),
+    createdAt: ts("created_at").notNull().defaultNow()
+  },
+  (table) => [
+    index("repo_alerts_owner_created_idx").on(table.ownerId, table.createdAt),
+    // The notification sender scans recent alerts across every owner.
+    index("repo_alerts_created_idx").on(table.createdAt),
+    // One alert per repo per release. A re-sync of the same version — and the
+    // watcher re-syncs on every publish, including non-latest backports — must
+    // not re-notify.
+    uniqueIndex("repo_alerts_dedup_idx").on(table.repoId, table.packageName, table.toVersion)
+  ]
+);
+var surfaceQueue = pgTable(
+  "surface_queue",
+  {
+    id: serial("id").primaryKey(),
+    packageName: text("package_name").notNull(),
+    /** Null means "whatever latest resolves to at extraction time". */
+    version: text("version"),
+    /**
+     * Which extractor services this row.
+     *
+     * One queue, two drains: `package_surface` rows are fetched as tarballs and
+     * read statically, `mcp_server` rows are installed and probed over stdio.
+     * The discriminator is not optional bookkeeping — without it the npm drain
+     * picks up MCP rows and tries to extract exports from a server it should
+     * have handshaked with, and the failure is silent because "no exports
+     * found" is a legitimate answer for a package that has none.
+     */
+    kind: text("kind").$type().notNull().default("package_surface"),
+    /** Dedup key: `kind:name@version`. */
+    specKey: text("spec_key").notNull().unique(),
+    /** Failed drains bump this; the worker drops a spec that keeps failing. */
+    attempts: integer("attempts").notNull().default(0),
+    requestedAt: ts("requested_at").notNull().defaultNow()
+  },
+  (table) => [index("surface_queue_requested_idx").on(table.kind, table.requestedAt)]
+);
+var entities = pgTable(
+  "entities",
+  {
+    id: serial("id").primaryKey(),
+    kind: text("kind").$type().notNull(),
+    /** Registry or authority: npm, api.stripe.com, … */
+    namespace: text("namespace").notNull(),
+    name: text("name").notNull(),
+    /** Null for unversioned kinds. */
+    version: text("version"),
+    /** `kind:namespace:name:version` */
+    canonicalKey: text("canonical_key").notNull(),
+    /**
+     * 0 = the public graph; a real id = a private deployment's tenant. The spec
+     * models public as NULL, but Postgres UNIQUE treats NULLs as distinct, so
+     * (key, NULL) would insert unlimited duplicates and the dedup silently fails.
+     * A non-null sentinel is the cheap fix that works on every PG version.
+     */
+    tenantId: bigint("tenant_id", { mode: "number" }).notNull().default(0),
+    /** Tarball digest. THE extraction cache key: unchanged digest, no re-extraction.
+     *  This is what keeps cost sublinear as the index grows (§5, §6.5). */
+    artifactHash: text("artifact_hash"),
+    /** Dependent count. Drives sampling AND refresh priority — and note priority
+     *  is NOT popularity: the study found drift concentrates at LOW in-degree
+     *  (18.7% vs 8.3%), which is exactly where models have the weakest priors. */
+    inDegree: integer("in_degree"),
+    firstSeen: ts("first_seen").notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("entities_canonical_idx").on(table.canonicalKey, table.tenantId),
+    index("entities_kind_idx").on(table.kind, table.namespace, table.name),
+    index("entities_artifact_idx").on(table.artifactHash)
+  ]
+);
+var UNBOUNDED_ARITY = -1;
+var symbols = pgTable(
+  "symbols",
+  {
+    id: serial("id").primaryKey(),
+    entityId: integer("entity_id").notNull().references(() => entities.id),
+    /** 'default', 'foo', 'foo.bar' */
+    path: text("path").notNull(),
+    /** function | class | object | primitive | type_only */
+    kind: text("kind").$type().notNull(),
+    /** `fn.length` equivalent; null when not statically determinable. */
+    arity: integer("arity"),
+    /** 'local' | 'external:<pkg>' */
+    origin: text("origin").notNull().default("local"),
+    deprecated: boolean("deprecated").notNull().default(false),
+    tier: text("tier").$type().notNull(),
+    /** Full declaration text; tier C only (§6.2). */
+    signature: text("signature"),
+    sourceFile: text("source_file"),
+    sourceLine: integer("source_line"),
+    /** Character offset of the declaration. Two exports sharing file and offset
+     *  are one value under two names, which is how a diff read from storage finds
+     *  a proven rename. Null on rows extracted before it was recorded. */
+    sourceOffset: integer("source_offset"),
+    /** Most arguments the function reads: null when not measured, UNBOUNDED_ARITY
+     *  for a rest parameter or `arguments`. See SurfaceSymbol.maxArity. */
+    maxArity: integer("max_arity")
+  },
+  // Keyed by TIER as well as path: a package version has one surface per tier and
+  // they are not interchangeable (§6.4.3). Without the tier in the key, storing a
+  // tier-C surface would silently overwrite the tier-A one that answers runtime
+  // existence — replacing the authoritative answer with a type-level guess.
+  (table) => [
+    uniqueIndex("symbols_entity_path_tier_idx").on(table.entityId, table.path, table.tier)
+  ]
+);
+var environments = pgTable("environments", {
+  id: serial("id").primaryKey(),
+  os: text("os").notNull(),
+  arch: text("arch").notNull(),
+  runtime: text("runtime").notNull(),
+  runtimeVer: text("runtime_ver").notNull(),
+  resolver: text("resolver"),
+  /** Hash of the above; the dedup key. */
+  fingerprint: text("fingerprint").notNull().unique()
+});
+var claims = pgTable(
+  "claims",
+  {
+    id: serial("id").primaryKey(),
+    subjectId: integer("subject_id").notNull().references(() => entities.id),
+    /** Null for unary claims ("does this install at all"). */
+    objectId: integer("object_id").references(() => entities.id),
+    relation: text("relation").notNull(),
+    /** NULL for DECLARED claims: a shipped-JS surface reads the same on every
+     *  machine, so there is no environment to fingerprint. Executed claims
+     *  (co-install, conflict, behaviour) always carry one (§5). */
+    environmentId: integer("environment_id").references(() => environments.id),
+    tenantId: bigint("tenant_id", { mode: "number" }).notNull().default(0)
+  },
+  (table) => [
+    uniqueIndex("claims_tuple_idx").on(
+      table.subjectId,
+      table.objectId,
+      table.relation,
+      table.environmentId,
+      table.tenantId
+    )
+  ]
+);
+var observations = pgTable(
+  "observations",
+  {
+    id: serial("id").primaryKey(),
+    claimId: integer("claim_id").notNull().references(() => claims.id),
+    verdict: text("verdict").$type().notNull(),
+    /** What KIND of evidence backs the verdict (§4.1) — orthogonal to the verdict
+     *  itself. A declared surface fact must never read as behavioural proof. */
+    class: text("class").$type().notNull().default("executed"),
+    /** Which extraction tier produced it; null for executed claims. */
+    tier: text("tier").$type(),
+    /** Evidence that makes the verdict auditable. Null only for `unknown`. */
+    evidence: text("evidence"),
+    oracleId: text("oracle_id").notNull(),
+    oracleVer: text("oracle_ver").notNull(),
+    costMillis: integer("cost_millis"),
+    observedAt: ts("observed_at").notNull().defaultNow()
+  },
+  (table) => [index("observations_claim_idx").on(table.claimId, table.observedAt)]
+);
+var selectionPolicies = pgTable("selection_policies", {
+  ownerId: text("owner_id").primaryKey(),
+  policy: jsonb("policy").$type().notNull(),
+  updatedAt: ts("updated_at").notNull().defaultNow()
+});
+var selectionPolicyChanges = pgTable(
+  "selection_policy_changes",
+  {
+    id: serial("id").primaryKey(),
+    ownerId: text("owner_id").notNull(),
+    /** `dashboard`, or the display prefix of the API key that pushed it. */
+    actor: text("actor").notNull(),
+    before: jsonb("before").$type().notNull(),
+    after: jsonb("after").$type().notNull(),
+    createdAt: ts("created_at").notNull().defaultNow()
+  },
+  (table) => [index("selection_policy_changes_owner_idx").on(table.ownerId, table.createdAt)]
+);
+var policyDecisions = pgTable(
+  "policy_decisions",
+  {
+    id: serial("id").primaryKey(),
+    ownerId: text("owner_id").notNull(),
+    packageName: text("package_name").notNull(),
+    rule: text("rule").$type().notNull(),
+    /** `blocked` under enforce, `warned` under warn. */
+    action: text("action").$type().notNull(),
+    /** The tool the agent called: recommend | evaluate. */
+    tool: text("tool").notNull(),
+    createdAt: ts("created_at").notNull().defaultNow()
+  },
+  (table) => [index("policy_decisions_owner_idx").on(table.ownerId, table.createdAt)]
+);
+var subscriptions = pgTable(
+  "subscriptions",
+  {
+    /** Clerk user id. One subscription per account. */
+    ownerId: text("owner_id").primaryKey(),
+    /** Stable across subscriptions: a customer who cancels and returns reuses it. */
+    stripeCustomerId: text("stripe_customer_id").notNull().unique(),
+    /** Null between creating a customer and completing a first checkout. */
+    stripeSubscriptionId: text("stripe_subscription_id").unique(),
+    tier: text("tier").$type().notNull().default("free"),
+    /** Raw Stripe subscription status. `null` = never subscribed. */
+    status: text("status"),
+    /** When the paid period lapses. Display only; `status` is what gates access. */
+    currentPeriodEnd: ts("current_period_end"),
+    /** Set when the user cancels but has paid through the period. */
+    cancelAtPeriodEnd: boolean("cancel_at_period_end").notNull().default(false),
+    /**
+     * Seats bought, from the Stripe subscription quantity. Only per-seat plans
+     * read it, and `billedSeats` floors it at the plan's minimum, so a flat plan
+     * or a pre-seat row carrying the default 1 resolves correctly either way.
+     */
+    seats: integer("seats").notNull().default(1),
+    /** The subscription carries the metered overage item, so calls past the pool bill. */
+    overageEnabled: boolean("overage_enabled").notNull().default(false),
+    /** Calendar month ('YYYY-MM') that `overageReported` counts. */
+    overageMonth: text("overage_month"),
+    /** Overage calls already sent to Stripe for `overageMonth`. */
+    overageReported: integer("overage_reported").notNull().default(0),
+    /** The plan item's Stripe interval ('month' | 'year'). Null for manual grants. */
+    billingInterval: text("billing_interval"),
+    /**
+     * Stripe delivers out of order and retries, so a late duplicate of an older
+     * event must not overwrite newer state. The webhook drops any event whose
+     * timestamp is older than the one that produced the current row.
+     */
+    lastEventAt: ts("last_event_at"),
+    createdAt: ts("created_at").notNull().defaultNow(),
+    updatedAt: ts("updated_at").notNull().defaultNow()
+  },
+  (table) => [index("subscriptions_customer_idx").on(table.stripeCustomerId)]
+);
+var stackResolutions = pgTable(
+  "stack_resolutions",
+  {
+    id: serial("id").primaryKey(),
+    /** Canonical `name@version|name@version|…`, sorted. The cache key. */
+    setKey: text("set_key").notNull().unique(),
+    /** The exact members this verdict is about. */
+    packages: jsonb("packages").$type().notNull(),
+    /** Names only, for publish-driven invalidation. */
+    names: text("names").array().notNull(),
+    /** True when npm produced a lockfile for the set. */
+    resolved: boolean("resolved").notNull(),
+    /** 'ERESOLVE' for a proven conflict; null when it resolved. */
+    reason: text("reason"),
+    /** npm's own error text on a conflict — it names the packages and ranges. */
+    detail: text("detail"),
+    resolvedAt: ts("resolved_at").notNull().defaultNow()
+  },
+  (table) => [
+    index("stack_resolutions_names_idx").using("gin", table.names),
+    index("stack_resolutions_resolved_at_idx").on(table.resolvedAt)
+  ]
+);
+var mcpContracts = pgTable(
+  "mcp_contracts",
+  {
+    contentHash: text("content_hash").primaryKey(),
+    /** Schema-only hash; equal means calls validate identically. */
+    contractHash: text("contract_hash").notNull(),
+    tools: jsonb("tools").$type().notNull(),
+    prompts: jsonb("prompts").$type().notNull(),
+    resourceTemplates: jsonb("resource_templates").$type().notNull(),
+    instructions: text("instructions"),
+    toolCount: integer("tool_count").notNull(),
+    bytes: integer("bytes").notNull(),
+    /** Computed server-side at insert, never taken from the client. */
+    analysis: jsonb("analysis").$type().notNull(),
+    analyzerVersion: text("analyzer_version").notNull(),
+    createdAt: ts("created_at").notNull().defaultNow()
+  },
+  (table) => [index("mcp_contracts_contract_idx").on(table.contractHash)]
+);
+var mcpDeployments = pgTable(
+  "mcp_deployments",
+  {
+    id: serial("id").primaryKey(),
+    ownerId: text("owner_id").notNull(),
+    serverKey: text("server_key").notNull(),
+    configFingerprint: text("config_fingerprint").notNull(),
+    /** The name the user gave it, as last seen. Display only. */
+    alias: text("alias").notNull(),
+    registry: text("registry").$type().notNull(),
+    packageName: text("package_name"),
+    transport: text("transport").notNull(),
+    /** Self-reported by the server in its handshake. */
+    serverName: text("server_name"),
+    serverVersion: text("server_version"),
+    lastStatus: text("last_status").$type().notNull(),
+    lastError: text("last_error"),
+    /** The last contract actually read. Kept when a later scan fails. */
+    lastContentHash: text("last_content_hash"),
+    worstSeverity: text("worst_severity").$type(),
+    firstSeenAt: ts("first_seen_at").notNull().defaultNow(),
+    lastScannedAt: ts("last_scanned_at").notNull().defaultNow(),
+    lastChangedAt: ts("last_changed_at")
+  },
+  (table) => [
+    uniqueIndex("mcp_deployments_identity_idx").on(table.ownerId, table.serverKey, table.configFingerprint),
+    index("mcp_deployments_owner_idx").on(table.ownerId, table.lastScannedAt)
+  ]
+);
+var mcpObservations = pgTable(
+  "mcp_observations",
+  {
+    id: serial("id").primaryKey(),
+    deploymentId: integer("deployment_id").notNull().references(() => mcpDeployments.id),
+    ownerId: text("owner_id").notNull(),
+    status: text("status").$type().notNull(),
+    contentHash: text("content_hash"),
+    serverVersion: text("server_version"),
+    error: text("error"),
+    /** `cli` or `ci`: who ran the scan that opened this interval. */
+    source: text("source").notNull(),
+    scanCount: integer("scan_count").notNull().default(1),
+    firstSeenAt: ts("first_seen_at").notNull().defaultNow(),
+    lastSeenAt: ts("last_seen_at").notNull().defaultNow()
+  },
+  (table) => [index("mcp_observations_deployment_idx").on(table.deploymentId, table.firstSeenAt)]
+);
+var mcpChangeEvents = pgTable(
+  "mcp_change_events",
+  {
+    id: serial("id").primaryKey(),
+    deploymentId: integer("deployment_id").notNull().references(() => mcpDeployments.id),
+    ownerId: text("owner_id").notNull(),
+    fromHash: text("from_hash").notNull(),
+    toHash: text("to_hash").notNull(),
+    severity: text("severity").$type().notNull(),
+    summary: text("summary").notNull(),
+    diff: jsonb("diff").$type().notNull(),
+    createdAt: ts("created_at").notNull().defaultNow(),
+    acknowledgedAt: ts("acknowledged_at")
+  },
+  (table) => [
+    uniqueIndex("mcp_change_events_pair_idx").on(table.deploymentId, table.fromHash, table.toHash),
+    index("mcp_change_events_owner_idx").on(table.ownerId, table.createdAt),
+    index("mcp_change_events_created_idx").on(table.createdAt)
+  ]
+);
+var mcpPublicReports = pgTable(
+  "mcp_public_reports",
+  {
+    registry: text("registry").notNull(),
+    packageName: text("package_name").notNull(),
+    version: text("version").notNull(),
+    contentHash: text("content_hash").notNull(),
+    ownerId: text("owner_id").notNull(),
+    reportedAt: ts("reported_at").notNull().defaultNow()
+  },
+  (table) => [
+    primaryKey({ columns: [table.registry, table.packageName, table.version, table.contentHash, table.ownerId] }),
+    index("mcp_public_reports_version_idx").on(table.registry, table.packageName, table.version)
+  ]
+);
+var notificationPreferences = pgTable("notification_preferences", {
+  ownerId: text("owner_id").primaryKey(),
+  urgentEmail: boolean("urgent_email").notNull().default(true),
+  weeklyDigest: boolean("weekly_digest").notNull().default(false),
+  unsubscribeToken: text("unsubscribe_token").notNull().unique(),
+  lastDigestAt: ts("last_digest_at"),
+  createdAt: ts("created_at").notNull().defaultNow(),
+  updatedAt: ts("updated_at").notNull().defaultNow()
+});
+var notificationDeliveries = pgTable(
+  "notification_deliveries",
+  {
+    id: serial("id").primaryKey(),
+    ownerId: text("owner_id").notNull(),
+    kind: text("kind").$type().notNull(),
+    /** Set on a channel delivery: the Slack/Discord/Teams/webhook it went to. */
+    channelId: integer("channel_id"),
+    status: text("status").$type().notNull(),
+    idempotencyKey: text("idempotency_key").notNull().unique(),
+    attempts: integer("attempts").notNull().default(0),
+    /** Why it failed or was skipped. Our own words, never a recipient address. */
+    error: text("error"),
+    providerId: text("provider_id"),
+    createdAt: ts("created_at").notNull().defaultNow(),
+    sentAt: ts("sent_at")
+  },
+  (table) => [
+    index("notification_deliveries_owner_idx").on(table.ownerId, table.kind, table.createdAt),
+    index("notification_deliveries_status_idx").on(table.status, table.createdAt)
+  ]
+);
+var notificationItems = pgTable(
+  "notification_items",
+  {
+    itemKey: text("item_key").primaryKey(),
+    ownerId: text("owner_id").notNull(),
+    deliveryId: integer("delivery_id").notNull().references(() => notificationDeliveries.id),
+    createdAt: ts("created_at").notNull().defaultNow()
+  },
+  (table) => [index("notification_items_delivery_idx").on(table.deliveryId)]
+);
+var notificationChannels = pgTable(
+  "notification_channels",
+  {
+    id: serial("id").primaryKey(),
+    ownerId: text("owner_id").notNull(),
+    kind: text("kind").$type().notNull(),
+    label: text("label"),
+    urlCiphertext: text("url_ciphertext").notNull(),
+    /** Enough of the URL to recognise it: host and the last four characters. */
+    urlHint: text("url_hint").notNull(),
+    /** Webhook kind only: the HMAC secret receivers verify with. Encrypted. */
+    signingSecretCiphertext: text("signing_secret_ciphertext"),
+    minSeverity: text("min_severity").$type().notNull().default("high"),
+    enabled: boolean("enabled").notNull().default(true),
+    consecutiveFailures: integer("consecutive_failures").notNull().default(0),
+    /** Why lurq switched it off, in words for the owner. Cleared on re-enable. */
+    disabledReason: text("disabled_reason"),
+    lastDeliveredAt: ts("last_delivered_at"),
+    lastError: text("last_error"),
+    createdAt: ts("created_at").notNull().defaultNow(),
+    updatedAt: ts("updated_at").notNull().defaultNow(),
+    deletedAt: ts("deleted_at")
+  },
+  (table) => [index("notification_channels_owner_idx").on(table.ownerId)]
+);
+
+export {
+  packages,
+  syncRuns,
+  seedPackages,
+  discoveryQueue,
+  compatVerifyQueue,
+  apiKeys,
+  packageVersions,
+  watchState,
+  verificationRuns,
+  compatEdges,
+  apiSurfaces,
+  recommendationOutcomes,
+  askSpendDaily,
+  ownerUsageDaily,
+  repos,
+  upgradeRuns,
+  repoAlerts,
+  surfaceQueue,
+  entities,
+  UNBOUNDED_ARITY,
+  symbols,
+  claims,
+  observations,
+  selectionPolicies,
+  selectionPolicyChanges,
+  policyDecisions,
+  subscriptions,
+  stackResolutions,
+  mcpContracts,
+  mcpDeployments,
+  mcpObservations,
+  mcpChangeEvents,
+  mcpPublicReports,
+  notificationPreferences,
+  notificationChannels,
+  schema_exports
+};