openship 0.1.0 → 0.1.7

package/dist/server/migrations/0001_brief_tomorrow_man.sql

@@ -0,0 +1,47 @@
+-- Schema hardening: drop legacy organization_meta (folded into organization.is_team),
+-- add missing FKs + indexes flagged by the enterprise audit, and the partial
+-- unique index that race-guards concurrent deployment creation.
+--
+-- All statements are idempotent so re-running on DBs already partway through
+-- the consolidation succeeds. Greenfield installs apply the same SQL with the
+-- IF (NOT) EXISTS guards as no-op when conditions are met.
+
+DROP TABLE IF EXISTS "organization_meta" CASCADE;--> statement-breakpoint
+ALTER TABLE "organization" ADD COLUMN IF NOT EXISTS "is_team" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+
+-- FK: domain.service_id → service.id (CASCADE delete to prevent stale routing)
+DO $$ BEGIN
+  ALTER TABLE "domain" ADD CONSTRAINT "domain_service_id_service_id_fk"
+    FOREIGN KEY ("service_id") REFERENCES "public"."service"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+-- FK: env_var.service_id → service.id (CASCADE delete to prevent orphan env vars)
+DO $$ BEGIN
+  ALTER TABLE "env_var" ADD CONSTRAINT "env_var_service_id_service_id_fk"
+    FOREIGN KEY ("service_id") REFERENCES "public"."service"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+-- Race guard: only one in-flight deployment per project. The race-prone
+-- (SELECT-then-INSERT) in build.service.ts now relies on this constraint.
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_deployment_one_active_per_project"
+  ON "deployment" USING btree ("project_id")
+  WHERE status IN ('queued', 'building', 'deploying');--> statement-breakpoint
+
+-- Routing hot path — every hostname lookup hits the (project_id) and
+-- (project_id, hostname) indexes.
+CREATE INDEX IF NOT EXISTS "idx_domain_project" ON "domain" USING btree ("project_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_domain_project_hostname" ON "domain" USING btree ("project_id","hostname");--> statement-breakpoint
+
+-- Env var resolution runs on every build.
+CREATE INDEX IF NOT EXISTS "idx_env_var_project_env_service" ON "env_var" USING btree ("project_id","environment","service_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_env_var_project" ON "env_var" USING btree ("project_id");--> statement-breakpoint
+
+-- GitHub App installation lookup: unique (provider, owner, user_id) backs
+-- atomic onConflictDoUpdate; (organization_id, provider, owner) backs the
+-- org-scoped resolution path used by every authed request that mints an
+-- installation token.
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_git_installation_provider_owner_user" ON "git_installation" USING btree ("provider","owner","user_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_git_installation_org" ON "git_installation" USING btree ("organization_id","provider","owner");--> statement-breakpoint
+
+-- Build pipeline + deployment setup iterate services per project.
+CREATE INDEX IF NOT EXISTS "idx_service_project_id" ON "service" USING btree ("project_id");

package/dist/server/migrations/0002_funny_dazzler.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "cloud_workspace_id" text;--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_project_cloud_workspace_id" ON "project" USING btree ("cloud_workspace_id") WHERE "project"."cloud_workspace_id" IS NOT NULL AND "project"."deleted_at" IS NULL;

package/dist/server/migrations/0003_third_killer_shrike.sql

@@ -0,0 +1 @@
+ALTER TABLE "instance_settings" ADD COLUMN "invitation_mail_source" text DEFAULT 'platform' NOT NULL;

package/dist/server/migrations/0004_session_active_org_not_null.sql

@@ -0,0 +1,10 @@
+-- Backfill any remaining nulls (from sessions created before the
+-- create-time hook landed) to the user's personal org. The
+-- provisionUser convention is org_<userId>, and provisionUser
+-- guarantees that org + owner-member row exist for every user.
+UPDATE "session" SET "active_organization_id" = 'org_' || "user_id"
+  WHERE "active_organization_id" IS NULL;
+--> statement-breakpoint
+-- Promote to NOT NULL — the schema itself now enforces the
+-- invariant. No code path can violate it.
+ALTER TABLE "session" ALTER COLUMN "active_organization_id" SET NOT NULL;

package/dist/server/migrations/0005_warm_amazoness.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "instance_settings" ADD COLUMN "team_mode" text DEFAULT 'single_user' NOT NULL;--> statement-breakpoint
+ALTER TABLE "instance_settings" ADD COLUMN "migration_target_url" text;--> statement-breakpoint
+ALTER TABLE "instance_settings" ADD COLUMN "migrated_at" timestamp;

package/dist/server/migrations/0006_lumpy_joystick.sql

@@ -0,0 +1 @@
+ALTER TABLE "instance_settings" ADD COLUMN "migration_server_id" text;

package/dist/server/migrations/0007_outgoing_maginty.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "instance_settings" ADD COLUMN "tunnel_slug" text;--> statement-breakpoint
+ALTER TABLE "instance_settings" ADD COLUMN "tunnel_id" text;

package/dist/server/migrations/0008_frozen_cutover.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "instance_settings" ADD COLUMN "migration_in_progress" boolean NOT NULL DEFAULT false;
+--> statement-breakpoint
+ALTER TABLE "instance_settings" ADD COLUMN "migration_started_at" timestamp;

package/dist/server/migrations/0009_credits_billing.sql

@@ -0,0 +1,142 @@
+-- Billing & credits: add per-org plan/subscription columns and the credit
+-- ledger tables. Idempotent (IF NOT EXISTS guards) so applying twice on a
+-- partway-through DB is a no-op.
+
+-- ── organization: billing columns ───────────────────────────────────────────
+ALTER TABLE "organization" ADD COLUMN IF NOT EXISTS "plan_tier_id" text DEFAULT 'free' NOT NULL;--> statement-breakpoint
+ALTER TABLE "organization" ADD COLUMN IF NOT EXISTS "stripe_customer_id" text;--> statement-breakpoint
+ALTER TABLE "organization" ADD COLUMN IF NOT EXISTS "subscription_status" text DEFAULT 'active' NOT NULL;--> statement-breakpoint
+ALTER TABLE "organization" ADD COLUMN IF NOT EXISTS "current_period_start" timestamp;--> statement-breakpoint
+ALTER TABLE "organization" ADD COLUMN IF NOT EXISTS "current_period_end" timestamp;--> statement-breakpoint
+ALTER TABLE "organization" ADD COLUMN IF NOT EXISTS "oblien_namespace" text;--> statement-breakpoint
+
+-- ── billing_customer ────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "billing_customer" (
+  "id" text PRIMARY KEY NOT NULL,
+  "organization_id" text NOT NULL,
+  "stripe_customer_id" text NOT NULL,
+  "email" text NOT NULL,
+  "created_at" timestamp DEFAULT now() NOT NULL,
+  "updated_at" timestamp DEFAULT now() NOT NULL
+);--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "billing_customer" ADD CONSTRAINT "billing_customer_organization_id_organization_id_fk"
+    FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_billing_customer_org" ON "billing_customer" USING btree ("organization_id");--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_billing_customer_stripe" ON "billing_customer" USING btree ("stripe_customer_id");--> statement-breakpoint
+
+-- ── billing_subscription ────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "billing_subscription" (
+  "id" text PRIMARY KEY NOT NULL,
+  "organization_id" text NOT NULL,
+  "stripe_subscription_id" text NOT NULL,
+  "stripe_price_id" text NOT NULL,
+  "plan_tier_id" text NOT NULL,
+  "interval" text NOT NULL,
+  "status" text NOT NULL,
+  "current_period_start" timestamp NOT NULL,
+  "current_period_end" timestamp NOT NULL,
+  "cancel_at_period_end" boolean DEFAULT false NOT NULL,
+  "created_at" timestamp DEFAULT now() NOT NULL,
+  "updated_at" timestamp DEFAULT now() NOT NULL
+);--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "billing_subscription" ADD CONSTRAINT "billing_subscription_organization_id_organization_id_fk"
+    FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_billing_subscription_stripe" ON "billing_subscription" USING btree ("stripe_subscription_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_billing_subscription_org" ON "billing_subscription" USING btree ("organization_id");--> statement-breakpoint
+
+-- ── credit_balance ──────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "credit_balance" (
+  "organization_id" text PRIMARY KEY NOT NULL,
+  "monthly_free_milli" bigint DEFAULT 0 NOT NULL,
+  "topup_milli" bigint DEFAULT 0 NOT NULL,
+  "updated_at" timestamp DEFAULT now() NOT NULL
+);--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "credit_balance" ADD CONSTRAINT "credit_balance_organization_id_organization_id_fk"
+    FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+-- ── credit_grant ────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "credit_grant" (
+  "id" text PRIMARY KEY NOT NULL,
+  "organization_id" text NOT NULL,
+  "amount_milli" bigint NOT NULL,
+  "bucket" text NOT NULL,
+  "source" text NOT NULL,
+  "source_ref" text,
+  "expires_at" timestamp,
+  "created_at" timestamp DEFAULT now() NOT NULL
+);--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "credit_grant" ADD CONSTRAINT "credit_grant_organization_id_organization_id_fk"
+    FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+CREATE INDEX IF NOT EXISTS "idx_credit_grant_org_created" ON "credit_grant" USING btree ("organization_id","created_at");--> statement-breakpoint
+
+-- ── credit_consumption ──────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "credit_consumption" (
+  "id" text PRIMARY KEY NOT NULL,
+  "organization_id" text NOT NULL,
+  "oblien_event_id" text NOT NULL,
+  "resource_type" text NOT NULL,
+  "quantity_milli" bigint NOT NULL,
+  "credits_milli" bigint NOT NULL,
+  "bucket_consumed" text NOT NULL,
+  "occurred_at" timestamp NOT NULL,
+  "recorded_at" timestamp DEFAULT now() NOT NULL
+);--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "credit_consumption" ADD CONSTRAINT "credit_consumption_organization_id_organization_id_fk"
+    FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_credit_consumption_org_event" ON "credit_consumption" USING btree ("organization_id","oblien_event_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_credit_consumption_org_occurred" ON "credit_consumption" USING btree ("organization_id","occurred_at");--> statement-breakpoint
+
+-- ── credit_pack ─────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "credit_pack" (
+  "id" text PRIMARY KEY NOT NULL,
+  "name" text NOT NULL,
+  "credits_milli" bigint NOT NULL,
+  "price_cents" integer NOT NULL,
+  "stripe_product_id" text NOT NULL,
+  "stripe_price_id" text NOT NULL,
+  "active" boolean DEFAULT true NOT NULL,
+  "sort_order" integer DEFAULT 0 NOT NULL
+);--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_credit_pack_stripe_price" ON "credit_pack" USING btree ("stripe_price_id");--> statement-breakpoint
+
+-- ── oblien_usage_cursor ─────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "oblien_usage_cursor" (
+  "organization_id" text PRIMARY KEY NOT NULL,
+  "oblien_namespace" text NOT NULL,
+  "last_synced_at" timestamp NOT NULL,
+  "last_sync_run_at" timestamp NOT NULL,
+  "consecutive_failures" integer DEFAULT 0 NOT NULL
+);--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "oblien_usage_cursor" ADD CONSTRAINT "oblien_usage_cursor_organization_id_organization_id_fk"
+    FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+-- ── stripe_webhook_event ────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "stripe_webhook_event" (
+  "stripe_event_id" text PRIMARY KEY NOT NULL,
+  "event_type" text NOT NULL,
+  "received_at" timestamp DEFAULT now() NOT NULL,
+  "processed_at" timestamp
+);

package/dist/server/migrations/0010_credit_grant_dedupe.sql

@@ -0,0 +1,14 @@
+-- Partial unique index on credit_grant (organization_id, source, source_ref)
+-- where source_ref IS NOT NULL. Closes the race between the Stripe webhook
+-- and the monthly-reset cron: both used to mint a tier_grant for the same
+-- period boundary, producing two ledger rows + a doubled allowance in the
+-- cache. The unique index makes the second insert a conflict; the writers
+-- use ON CONFLICT DO NOTHING and skip the cache delta when no row landed.
+--
+-- Partial (source_ref IS NOT NULL) so admin/refund grants minted with a
+-- null source_ref are not coerced into uniqueness — those are intentionally
+-- distinct ledger rows.
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_credit_grant_org_source_ref"
+  ON "credit_grant" USING btree ("organization_id", "source", "source_ref")
+  WHERE "source_ref" IS NOT NULL;

package/dist/server/migrations/0011_remove_credit_ledger.sql

@@ -0,0 +1,23 @@
+-- Demolish the local credit ledger.
+--
+-- Quota is now owned by Oblien (the runtime meters consumption directly and
+-- enforces `setQuota` limits). The local grant/consume/balance triplet and
+-- the Oblien pull-sync cursor are obsolete. The Stripe-side state lives on
+-- in billing_customer / billing_subscription / credit_pack / stripe_webhook_event.
+--
+-- Order matters: drop indexes first (defensive — DROP TABLE drops them too,
+-- but being explicit keeps the diff easy to audit), then the tables in
+-- dependency order. There are no FKs between the four dropped tables, but
+-- credit_consumption + credit_grant + credit_balance + oblien_usage_cursor
+-- all reference organization.id with ON DELETE CASCADE, which postgres
+-- handles cleanly regardless of drop order.
+
+DROP INDEX IF EXISTS "uq_credit_grant_org_source_ref";--> statement-breakpoint
+DROP INDEX IF EXISTS "idx_credit_grant_org_created";--> statement-breakpoint
+DROP INDEX IF EXISTS "uq_credit_consumption_org_event";--> statement-breakpoint
+DROP INDEX IF EXISTS "idx_credit_consumption_org_occurred";--> statement-breakpoint
+
+DROP TABLE IF EXISTS "credit_consumption";--> statement-breakpoint
+DROP TABLE IF EXISTS "credit_balance";--> statement-breakpoint
+DROP TABLE IF EXISTS "credit_grant";--> statement-breakpoint
+DROP TABLE IF EXISTS "oblien_usage_cursor";

package/dist/server/migrations/0012_smart_deploys_and_git_rollback.sql

@@ -0,0 +1,81 @@
+-- Smart per-service deploys + git-strategy rollback
+--
+-- Adds the schema surface for two related features:
+--
+--   1. Smart per-service deploys — record which paths changed between
+--      the previous successful deploy and this one (`changed_paths`),
+--      let the build pipeline skip services whose root_directory was
+--      untouched, and surface the result per-service in the existing
+--      service_deployment table.
+--
+--   2. Git-strategy rollback — instead of always archiving each
+--      deploy's image + workspace snapshot, projects can opt to roll
+--      back by checking out the prior commit and rebuilding
+--      (`rollback_strategy = "git"`). Cheaper on disk, slower to
+--      restore. Snapshotted per-deployment via `commit_sha_before`.
+--
+-- Idempotent (IF NOT EXISTS guards) so a partial re-apply is safe.
+
+-- ── deployment ───────────────────────────────────────────────────────────────
+ALTER TABLE "deployment" ADD COLUMN IF NOT EXISTS "commit_sha_before" text;--> statement-breakpoint
+ALTER TABLE "deployment" ADD COLUMN IF NOT EXISTS "changed_paths" jsonb;--> statement-breakpoint
+ALTER TABLE "deployment" ADD COLUMN IF NOT EXISTS "changed_paths_truncated" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "deployment" ADD COLUMN IF NOT EXISTS "force_all" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "deployment" ADD COLUMN IF NOT EXISTS "rollback_strategy" text DEFAULT 'snapshot' NOT NULL;--> statement-breakpoint
+
+-- ── project ──────────────────────────────────────────────────────────────────
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "default_rollback_strategy" text DEFAULT 'snapshot' NOT NULL;--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "force_deploy_next" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "monorepo_shared_paths" jsonb;--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "always_rebuild_paths" jsonb;--> statement-breakpoint
+
+-- ── service ──────────────────────────────────────────────────────────────────
+ALTER TABLE "service" ADD COLUMN IF NOT EXISTS "always_rebuild_globs" jsonb;--> statement-breakpoint
+
+-- ── service_deployment: smart-deploy tracking columns ───────────────────────
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "service_name" text;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "reason" text;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "reason_skipped" text;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "url" text;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "started_at" timestamp;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "finished_at" timestamp;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "duration_ms" integer;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "error_message" text;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "error" text;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "check_run_id" bigint;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "check_run_url" text;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "artifact_retained_at" timestamp;--> statement-breakpoint
+ALTER TABLE "service_deployment" ADD COLUMN IF NOT EXISTS "logs_ref" text;--> statement-breakpoint
+
+-- service_deployment indexes
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_service_deployment_dep_svc" ON "service_deployment" USING btree ("deployment_id","service_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ix_service_deployment_deployment" ON "service_deployment" USING btree ("deployment_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ix_service_deployment_service_status" ON "service_deployment" USING btree ("service_id","status");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ix_service_deployment_service_created" ON "service_deployment" USING btree ("service_id","created_at");--> statement-breakpoint
+
+-- ── deployment_check_run ─────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "deployment_check_run" (
+  "id" text PRIMARY KEY NOT NULL,
+  "deployment_id" text NOT NULL,
+  "check_run_id" bigint NOT NULL,
+  "name" text NOT NULL,
+  "kind" text NOT NULL,
+  "service_deployment_id" text,
+  "status" text NOT NULL,
+  "conclusion" text,
+  "created_at" timestamp DEFAULT now() NOT NULL,
+  "updated_at" timestamp DEFAULT now() NOT NULL
+);--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "deployment_check_run" ADD CONSTRAINT "deployment_check_run_deployment_id_deployment_id_fk"
+    FOREIGN KEY ("deployment_id") REFERENCES "public"."deployment"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "deployment_check_run" ADD CONSTRAINT "deployment_check_run_service_deployment_id_service_deployment_id_fk"
+    FOREIGN KEY ("service_deployment_id") REFERENCES "public"."service_deployment"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_deployment_check_run_per_kind" ON "deployment_check_run" USING btree ("deployment_id","kind","service_deployment_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ix_deployment_check_run_deployment" ON "deployment_check_run" USING btree ("deployment_id");

package/dist/server/migrations/0013_fix_check_run_rollup_unique.sql

@@ -0,0 +1,38 @@
+-- ── Fix deployment_check_run uniqueness for rollup rows ─────────────────────
+--
+-- The previous `uq_deployment_check_run_per_kind` index covers
+-- (deployment_id, kind, service_deployment_id). PostgreSQL treats NULLs
+-- as distinct in unique indexes by default, so multiple rows with
+-- (deployment_id, 'rollup', NULL) could coexist — the rollup invariant
+-- of "one rollup row per deployment" was never actually enforced.
+--
+-- This migration replaces that single non-effective index with two
+-- partial unique indexes that match the actual data shapes:
+--
+--   - rollup rows  (kind = 'rollup', service_deployment_id IS NULL):
+--     unique on (deployment_id)
+--
+--   - service rows (service_deployment_id IS NOT NULL):
+--     unique on (deployment_id, service_deployment_id)
+--
+-- Also drops a couple of redundant secondary indexes whose lookups are
+-- already covered by the leading column of an existing unique index.
+
+DROP INDEX IF EXISTS "uq_deployment_check_run_per_kind";--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_deployment_check_run_rollup"
+  ON "deployment_check_run" ("deployment_id")
+  WHERE "kind" = 'rollup';--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_deployment_check_run_service"
+  ON "deployment_check_run" ("deployment_id", "service_deployment_id")
+  WHERE "service_deployment_id" IS NOT NULL;--> statement-breakpoint
+
+-- Redundant: covered by `uq_deployment_check_run_rollup` /
+-- `uq_deployment_check_run_service` (both have deployment_id as the
+-- leading column), so a separate ix on deployment_id buys nothing.
+DROP INDEX IF EXISTS "ix_deployment_check_run_deployment";--> statement-breakpoint
+
+-- Redundant: covered by `uq_service_deployment_dep_svc` whose leading
+-- column is deployment_id.
+DROP INDEX IF EXISTS "ix_service_deployment_deployment";

package/dist/server/migrations/0014_default_rollback_git.sql

@@ -0,0 +1,9 @@
+-- Flip the default rollback strategy for NEW projects from "snapshot" to
+-- "git". Existing rows are not touched — they keep whatever they were
+-- created with (a previously-deployed project relying on snapshot
+-- rollback should not silently lose its snapshots).
+--
+-- Users can change the per-project setting via the dashboard's git
+-- settings page.
+
+ALTER TABLE "project" ALTER COLUMN "default_rollback_strategy" SET DEFAULT 'git';

package/dist/server/migrations/0015_billing_idempotency_grants.sql

@@ -0,0 +1,41 @@
+-- Billing idempotency: per-checkout-session topup grants + per-period
+-- anniversary cron grants. Both protect read-modify-write Oblien quota
+-- mutations from being re-applied when their upstream driver retries:
+--   - stripe_topup_grant      Stripe webhook redelivery of checkout.session.completed
+--                              would otherwise call addQuota twice → double-credit.
+--   - billing_anniversary_grant  Cron crash between Oblien resetQuota and the
+--                              local period UPDATE would let the next tick
+--                              re-zero quota_used on the new period.
+-- Idempotent (IF NOT EXISTS guards) so applying twice on a partway-through
+-- DB is a no-op.
+
+CREATE TABLE IF NOT EXISTS "stripe_topup_grant" (
+  "id" text PRIMARY KEY NOT NULL,
+  "checkout_session_id" text NOT NULL,
+  "organization_id" text NOT NULL,
+  "pack_id" text NOT NULL,
+  "credits_milli" bigint NOT NULL,
+  "granted_at" timestamp DEFAULT now() NOT NULL
+);--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "stripe_topup_grant" ADD CONSTRAINT "stripe_topup_grant_organization_id_organization_id_fk"
+    FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_stripe_topup_grant_session" ON "stripe_topup_grant" USING btree ("checkout_session_id");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_stripe_topup_grant_org" ON "stripe_topup_grant" USING btree ("organization_id");--> statement-breakpoint
+
+CREATE TABLE IF NOT EXISTS "billing_anniversary_grant" (
+  "id" text PRIMARY KEY NOT NULL,
+  "organization_id" text NOT NULL,
+  "period_start" timestamp NOT NULL,
+  "granted_at" timestamp DEFAULT now() NOT NULL
+);--> statement-breakpoint
+
+DO $$ BEGIN
+  ALTER TABLE "billing_anniversary_grant" ADD CONSTRAINT "billing_anniversary_grant_organization_id_organization_id_fk"
+    FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_billing_anniversary_grant_org_period" ON "billing_anniversary_grant" USING btree ("organization_id","period_start");

package/dist/server/migrations/0016_github_auth_high_findings.sql

@@ -0,0 +1,30 @@
+-- HIGH-finding fixes for GitHub auth surface (audit, June 2026).
+--
+-- HIGH #6 — github_install_state: short-TTL nonces that bind the install
+-- URL the SaaS hands back to a specific local user/org. Resolves the
+-- "echo-back state with no local binding" hole in the install flow.
+CREATE TABLE "github_install_state" (
+	"id" text PRIMARY KEY NOT NULL,
+	"state" text NOT NULL,
+	"user_id" text NOT NULL,
+	"organization_id" text,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "github_install_state_state_unique" UNIQUE("state")
+);
+--> statement-breakpoint
+CREATE INDEX "github_install_state_expires_idx" ON "github_install_state" USING btree ("expires_at");--> statement-breakpoint
+CREATE INDEX "github_install_state_user_idx" ON "github_install_state" USING btree ("user_id");--> statement-breakpoint
+
+-- HIGH #9 — per-project webhook signing secret (encrypted via lib/encryption).
+-- Null on legacy rows; verifier falls back to env.GITHUB_WEBHOOK_SECRET there.
+ALTER TABLE "project" ADD COLUMN "webhook_secret" text;--> statement-breakpoint
+
+-- HIGH #7 — explicit operator opt-in for the gh CLI escape hatch.
+-- Without this, "owner of any org" gated transitive access to the
+-- operator's broad-scope PAT.
+ALTER TABLE "user_settings" ADD COLUMN "gh_cli_operator_opted_in" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+
+-- HIGH #10 — PAT scope cached from inspectPatScope so we can re-validate
+-- at use time without re-issuing `GET /user`.
+ALTER TABLE "user_settings" ADD COLUMN "pat_scope" jsonb;

package/dist/server/migrations/0017_spooky_rumiko_fujikawa.sql

@@ -0,0 +1,6 @@
+CREATE TABLE "oblien_webhook_event" (
+	"oblien_event_id" text PRIMARY KEY NOT NULL,
+	"event_type" text NOT NULL,
+	"received_at" timestamp DEFAULT now() NOT NULL,
+	"processed_at" timestamp
+);

package/dist/server/migrations/0018_calm_shatterstar.sql

@@ -0,0 +1 @@
+ALTER TABLE "project" ADD COLUMN "deletion_in_progress" boolean DEFAULT false NOT NULL;

package/dist/server/migrations/0019_rename_workspace_install_to_prepare.sql

@@ -0,0 +1 @@
+ALTER TABLE "project" RENAME COLUMN "workspace_install_command" TO "workspace_prepare_command";

package/dist/server/migrations/0020_uneven_the_renegades.sql

@@ -0,0 +1,13 @@
+CREATE TABLE "server_tunnels" (
+	"id" text PRIMARY KEY NOT NULL,
+	"server_id" text NOT NULL,
+	"remote_port" integer NOT NULL,
+	"remote_host" text DEFAULT '127.0.0.1' NOT NULL,
+	"local_port" integer,
+	"auto_start" boolean DEFAULT false NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "server_tunnels" ADD CONSTRAINT "server_tunnels_server_id_servers_id_fk" FOREIGN KEY ("server_id") REFERENCES "public"."servers"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "uq_server_tunnel_target" ON "server_tunnels" USING btree ("server_id","remote_port","remote_host");

package/dist/server/migrations/0021_shiny_firestar.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "deployment" ADD COLUMN "version" integer;--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN "runtime_mode" text;

package/dist/server/migrations/0022_version_on_success_backfill.sql

@@ -0,0 +1,6 @@
+-- Versions now represent shipped releases: a deployment gets its version number
+-- in onSuccess (per-commit), not at create. Clear the per-attempt numbers that
+-- the old MAX(version)+1-at-create logic assigned to non-successful deploys so
+-- failed/in-flight rows stop showing a stale vN badge. Successful (ready) rows
+-- keep their existing numbers.
+UPDATE "deployment" SET "version" = NULL WHERE "status" <> 'ready';

package/dist/server/migrations/0023_productive_gorilla_man.sql

@@ -0,0 +1,17 @@
+CREATE TABLE "personal_access_token" (
+	"id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"organization_id" text,
+	"name" text NOT NULL,
+	"token_prefix" text NOT NULL,
+	"token_hash" text NOT NULL,
+	"read_only" boolean DEFAULT false NOT NULL,
+	"expires_at" timestamp,
+	"last_used_at" timestamp,
+	"revoked_at" timestamp,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "personal_access_token_token_hash_unique" UNIQUE("token_hash")
+);
+--> statement-breakpoint
+CREATE INDEX "personal_access_token_user_idx" ON "personal_access_token" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "personal_access_token_prefix_idx" ON "personal_access_token" USING btree ("token_prefix");

package/dist/server/migrations/0024_sleepy_peter_quill.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "service" ADD COLUMN "imported_spec" jsonb;--> statement-breakpoint
+ALTER TABLE "service" ADD COLUMN "drift_spec" jsonb;

package/dist/server/migrations/0025_smooth_blue_shield.sql

@@ -0,0 +1 @@
+ALTER TABLE "service" ADD COLUMN "advanced" jsonb DEFAULT '{}'::jsonb;

package/dist/server/migrations/0026_mail_backup_source.sql

@@ -0,0 +1,11 @@
+ALTER TABLE "backup_policy" ALTER COLUMN "project_id" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "backup_policy" ADD COLUMN "source_kind" text DEFAULT 'service' NOT NULL;--> statement-breakpoint
+ALTER TABLE "backup_policy" ADD COLUMN "mail_server_id" text;--> statement-breakpoint
+ALTER TABLE "backup_restore" ADD COLUMN "fork_mail_server_id" text;--> statement-breakpoint
+ALTER TABLE "backup_run" ADD COLUMN "source_kind" text DEFAULT 'service' NOT NULL;--> statement-breakpoint
+ALTER TABLE "backup_run" ADD COLUMN "mail_server_id" text;--> statement-breakpoint
+ALTER TABLE "backup_policy" ADD CONSTRAINT "backup_policy_mail_server_id_mail_servers_server_id_fk" FOREIGN KEY ("mail_server_id") REFERENCES "public"."mail_servers"("server_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "backup_restore" ADD CONSTRAINT "backup_restore_fork_mail_server_id_mail_servers_server_id_fk" FOREIGN KEY ("fork_mail_server_id") REFERENCES "public"."mail_servers"("server_id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "backup_run" ADD CONSTRAINT "backup_run_mail_server_id_mail_servers_server_id_fk" FOREIGN KEY ("mail_server_id") REFERENCES "public"."mail_servers"("server_id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "uq_backup_policy_mail_server" ON "backup_policy" USING btree ("mail_server_id") WHERE "backup_policy"."mail_server_id" IS NOT NULL AND "backup_policy"."deleted_at" IS NULL;--> statement-breakpoint
+CREATE INDEX "idx_backup_policy_mail_server" ON "backup_policy" USING btree ("mail_server_id");

package/dist/server/migrations/0027_opposite_anthem.sql

@@ -0,0 +1,6 @@
+ALTER TABLE "service" ADD COLUMN "namespace_volumes" boolean DEFAULT true NOT NULL;--> statement-breakpoint
+-- Grandfather every EXISTING service to bare (un-scoped) volume names so their
+-- on-disk data is not orphaned. Rows created AFTER this migration take the
+-- column default (true) and get project-scoped volumes. Load-bearing: without
+-- it, ADD COLUMN DEFAULT true would scope existing services and lose their data.
+UPDATE "service" SET "namespace_volumes" = false;

package/dist/server/migrations/0028_stale_rogue.sql

@@ -0,0 +1,18 @@
+CREATE TABLE "orphaned_resource" (
+	"id" text PRIMARY KEY NOT NULL,
+	"organization_id" text NOT NULL,
+	"server_id" text,
+	"resource_type" text NOT NULL,
+	"ref" text NOT NULL,
+	"project_id" text,
+	"label" text,
+	"runtime_mode" text,
+	"payload" jsonb,
+	"attempts" integer DEFAULT 0 NOT NULL,
+	"last_attempt_at" timestamp,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "orphaned_resource" ADD CONSTRAINT "orphaned_resource_organization_id_organization_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "orphaned_resource_server_idx" ON "orphaned_resource" USING btree ("server_id");--> statement-breakpoint
+CREATE INDEX "orphaned_resource_org_created_idx" ON "orphaned_resource" USING btree ("organization_id","created_at");

package/dist/server/migrations/0029_bouncy_loners.sql

@@ -0,0 +1,16 @@
+CREATE TABLE "cloud_webhook_binding" (
+	"id" text PRIMARY KEY NOT NULL,
+	"organization_id" text NOT NULL,
+	"cloud_project_id" text NOT NULL,
+	"git_owner" text NOT NULL,
+	"git_repo" text NOT NULL,
+	"git_branch" text DEFAULT '' NOT NULL,
+	"webhook_id" integer,
+	"webhook_secret" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "cloud_webhook_binding" ADD CONSTRAINT "cloud_webhook_binding_organization_id_organization_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "uq_cloud_webhook_binding_repo_branch" ON "cloud_webhook_binding" USING btree ("git_owner","git_repo","git_branch");--> statement-breakpoint
+CREATE INDEX "idx_cloud_webhook_binding_cloud_project" ON "cloud_webhook_binding" USING btree ("cloud_project_id");

package/dist/server/migrations/0030_bright_darkstar.sql

@@ -0,0 +1,6 @@
+CREATE TABLE "github_webhook_event" (
+	"delivery_id" text PRIMARY KEY NOT NULL,
+	"event_type" text NOT NULL,
+	"received_at" timestamp DEFAULT now() NOT NULL,
+	"processed_at" timestamp
+);