openship 0.4.7 → 0.5.0

package/dist/server/migrations/0073_project_volumes_object_storage.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "volumes" jsonb;
+--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "object_storage" jsonb;

package/dist/server/migrations/0074_project_compose_path.sql

@@ -0,0 +1 @@
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "compose_path" text;

package/dist/server/migrations/0075_service_command_argv.sql

@@ -0,0 +1 @@
+ALTER TABLE "service" ADD COLUMN IF NOT EXISTS "command_argv" jsonb;

package/dist/server/migrations/0076_rollback_retention.sql

@@ -0,0 +1,17 @@
+-- Rollback retention: auto-sized window inputs on the project, and the removal
+-- of a per-service artifact flag that was never written or read.
+--
+-- `rollback_window` keeps its existing meaning with one addition: NULL now means
+-- "auto" — resolve to `rollback_window_computed` (measured from the deploy host's
+-- free disk and this project's average snapshot size), falling back to
+-- instance_settings.default_rollback_window when nothing was measured yet. A
+-- non-null `rollback_window` is still an explicit operator override.
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "snapshot_size_bytes" bigint;
+--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "rollback_window_computed" integer;
+--> statement-breakpoint
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "capacity_measured_at" timestamp;
+--> statement-breakpoint
+-- Dead since it was introduced: the deployment-level `artifact_retained_at` is
+-- the only retention flag any code path writes or reads.
+ALTER TABLE "service_deployment" DROP COLUMN IF EXISTS "artifact_retained_at";

package/dist/server/migrations/0077_domain_redirect.sql

@@ -0,0 +1,13 @@
+-- Per-domain canonical redirect: this hostname answers with a redirect to another
+-- of the project's hostnames instead of serving the app.
+--
+-- Lives on `domain` rather than in a routing blob because the domain table IS the
+-- store for a project's public endpoints (deriveProjectRouteState builds
+-- publicEndpoints FROM these rows), and a redirect is a property of one hostname.
+--
+-- `redirect_to` NULL = serve the app (every existing row, unchanged).
+-- `redirect_status` NULL = 301. Kept nullable rather than DEFAULT 301 so "no
+-- redirect" is one state, not a status attached to a row that doesn't redirect.
+ALTER TABLE "domain" ADD COLUMN IF NOT EXISTS "redirect_to" text;
+--> statement-breakpoint
+ALTER TABLE "domain" ADD COLUMN IF NOT EXISTS "redirect_status" integer;

package/dist/server/migrations/0078_grant_source_scope.sql

@@ -0,0 +1,30 @@
+-- Per-repo source access scope on every grant-bearing table.
+--
+-- A grant already carries a VERB in `permissions_json` (read / write / admin).
+-- This column adds the SURFACE: may the holder read file CONTENT, and under which
+-- paths. The two do not overlap, and the absence of a scope is meaningful:
+--
+--   read + scope_json NULL                        -> metadata only (branches,
+--                                                    detect, deploy). THE DEFAULT.
+--   read + {"v":1,"read":{"paths":["src/**"]}}    -> file content under src only
+--   write + {"v":1,"write":{"paths":[...]}}       -> content writes under those paths
+--
+-- So a repo grant no longer implies the right to crawl the repository. NULL is the
+-- restrictive state, which is why this is nullable with no default and no backfill:
+-- every existing row correctly reads as metadata-only.
+--
+-- Encoded as JSON text (not jsonb, not text[]) to match `permissions_json` — the
+-- column types have to behave identically across PGlite and Postgres without
+-- driver-specific casting, and the repos already own (de)serialisation.
+--
+-- Shape + matching semantics: packages/core/src/source-access.ts. Malformed JSON,
+-- an unknown "v", or an unparseable pattern all resolve to NO access rather than
+-- unrestricted access.
+ALTER TABLE "resource_grant" ADD COLUMN IF NOT EXISTS "scope_json" text;
+--> statement-breakpoint
+ALTER TABLE "personal_access_token_grant" ADD COLUMN IF NOT EXISTS "scope_json" text;
+--> statement-breakpoint
+-- Pending invite grants carry the scope through acceptance; without it, a
+-- restricted invitee would materialise into a metadata-only grant and silently
+-- lose the content access the inviter picked.
+ALTER TABLE "invitation_pending_grant" ADD COLUMN IF NOT EXISTS "scope_json" text;

package/dist/server/migrations/0079_project_readiness.sql

@@ -0,0 +1,18 @@
+-- Deploy-time readiness gate, per project.
+--
+-- Named `readiness`, NOT `health_check`, on purpose: a compose service already
+-- carries a `healthcheck` (the Docker HEALTHCHECK directive, stored in
+-- `service.advanced`) which the daemon runs and which has nothing to do with
+-- whether a DEPLOY is allowed to finish. Two fields one capital letter apart in
+-- the same openship.json would be a footgun.
+--
+-- Nullable with NO default, and no backfill: NULL means "off", so every existing
+-- project moves to the new off-by-default behaviour. Previously the 15s
+-- stabilization watch and the 45s TCP probe were hardcoded on every deploy and
+-- could fail (and then force-remove) a container that was running fine. Opting
+-- in is now explicit.
+--
+-- Shape (all fields optional, all defaults off) — see OpenshipReadiness:
+--   { enabled, path, port, timeoutSeconds,
+--     stabilization, stabilizationSeconds, onFailure: "warn" | "fail" }
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "readiness" jsonb;

package/dist/server/migrations/0080_deployment_error_classification.sql

@@ -0,0 +1,26 @@
+-- Durable failure classification for a deployment.
+--
+-- The pipeline already classifies failures precisely: a port conflict throws
+-- DeployError(msg, "PORT_IN_USE", {port, pid, command, systemdUnit,
+-- isManagedDeployment, …}) and that reaches onFailure intact. It was then split,
+-- and only half of it was kept: `error_message` went to this table while
+-- `errorCode`/`errorDetails` went ONLY to the in-memory SSE session. Once that
+-- session was evicted (or the API restarted) all that survived a port conflict
+-- was an English sentence, so nothing could offer the operator — or an MCP agent
+-- — a way forward.
+--
+-- The one attempt to recover the code was inverted: build-status re-derived it
+-- with error_message.includes("PORT_IN_USE"), and none of the coded messages
+-- contain that token (they read "Port 3000 is already in use by …"). So the
+-- failures we DID classify lost their code and the ones we didn't got it guessed.
+--
+-- `error_code` is free text with no check constraint, matching `status` on this
+-- table: codes come from DeployError call sites across packages/adapters and must
+-- be extendable without a migration. `error_details` is the DeployError details
+-- bag verbatim (never contains secrets — it is process/port metadata).
+--
+-- Both nullable with no backfill: NULL means "not classified", which is exactly
+-- true of every pre-existing row.
+ALTER TABLE "deployment" ADD COLUMN IF NOT EXISTS "error_code" text;
+--> statement-breakpoint
+ALTER TABLE "deployment" ADD COLUMN IF NOT EXISTS "error_details" jsonb;

package/dist/server/migrations/0081_project_readiness_repair.sql

@@ -0,0 +1,34 @@
+-- Repair: create `project.readiness` on a database that skipped 0079.
+--
+-- WHY THIS EXISTS (and why it is not just "0079 again"):
+--
+-- 0079 was originally `0079_project_health_check` (adding `project.health_check`)
+-- and was replaced in place by `0079_project_readiness` (adding
+-- `project.readiness`) before either shipped. Both journal entries carry the SAME
+-- `when` — 1785882107324 — because the second reused the first's slot.
+--
+-- drizzle's migrator reads only the single most recent applied row and applies a
+-- migration when `lastDbMigration.created_at < migration.folderMillis`
+-- (pg-core/dialect.js). That comparison is STRICT, so on any database that had
+-- already run the old 0079, the new one is equal, not greater — it is skipped
+-- without a word. 0080 carried a later stamp and applied normally, which is why
+-- such a database ends up with 0080's columns, an orphan `health_check`, and no
+-- `readiness` at all. Every query selecting the project row then dies with
+-- `column "readiness" does not exist` (42703).
+--
+-- Bumping 0079's `when` would NOT fix it: the max applied stamp is now 0080's, so
+-- anything ordered before 0080 still compares as already-applied. The repair has
+-- to sort AFTER 0080, which is what this file is.
+--
+-- Idempotent on purpose. A fresh database creates the column at 0079 and this is
+-- a no-op; a database that skipped 0079 creates it here. Either way the end state
+-- is identical, so this is safe to leave in history permanently rather than being
+-- a one-off someone has to remember to delete.
+ALTER TABLE "project" ADD COLUMN IF NOT EXISTS "readiness" jsonb;--> statement-breakpoint
+
+-- Drop the column the replaced migration left behind. `health_check` was only
+-- ever created by 0079_project_health_check, which never shipped in a release and
+-- is referenced by no schema, query, or type in the codebase — so on the
+-- databases that have it, it is dead weight with a confusingly similar name to
+-- the compose service `healthcheck`. Guarded, so this is a no-op everywhere else.
+ALTER TABLE "project" DROP COLUMN IF EXISTS "health_check";

package/dist/server/migrations/meta/_journal.json

@@ -512,6 +512,69 @@
       "when": 1785358400651,
       "tag": "0072_gh_device_token_method",
       "breakpoints": true
+    },
+    {
+      "idx": 73,
+      "version": "7",
+      "when": 1785358401651,
+      "tag": "0073_project_volumes_object_storage",
+      "breakpoints": true
+    },
+    {
+      "idx": 74,
+      "version": "7",
+      "when": 1785450107324,
+      "tag": "0074_project_compose_path",
+      "breakpoints": true
+    },
+    {
+      "idx": 75,
+      "version": "7",
+      "when": 1785536507324,
+      "tag": "0075_service_command_argv",
+      "breakpoints": true
+    },
+    {
+      "idx": 76,
+      "version": "7",
+      "when": 1785622907324,
+      "tag": "0076_rollback_retention",
+      "breakpoints": true
+    },
+    {
+      "idx": 77,
+      "version": "7",
+      "when": 1785709307324,
+      "tag": "0077_domain_redirect",
+      "breakpoints": true
+    },
+    {
+      "idx": 78,
+      "version": "7",
+      "when": 1785795707324,
+      "tag": "0078_grant_source_scope",
+      "breakpoints": true
+    },
+    {
+      "idx": 79,
+      "version": "7",
+      "when": 1785882107324,
+      "tag": "0079_project_readiness",
+      "breakpoints": true
+    },
+    {
+      "idx": 80,
+      "version": "7",
+      "when": 1785968507324,
+      "tag": "0080_deployment_error_classification",
+      "breakpoints": true
+    },
+    {
+      "idx": 81,
+      "version": "7",
+      "when": 1786054907324,
+      "tag": "0081_project_readiness_repair",
+      "breakpoints": true
     }
   ]
 }

package/dist/{setup-2DMFIA74.js → setup-KELALK7H.js}

@@ -4,16 +4,16 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   SystemManager
-} from "./chunk-IPYPMI3S.js";
-import "./chunk-UXWAVM4C.js";
-import "./chunk-L2VOGB2X.js";
+} from "./chunk-NNPEG6HM.js";
+import "./chunk-NXFIRK2Z.js";
+import "./chunk-KZOBYJUW.js";
 import "./chunk-RPHRPFEH.js";
-import "./chunk-FXTBHTWY.js";
+import "./chunk-RB35YN3J.js";
 import "./chunk-FPRHYBY2.js";
-import "./chunk-R5BHFFAV.js";
+import "./chunk-6PIYRG5I.js";
 import "./chunk-ILFETZOM.js";
-import "./chunk-VFINNTUL.js";
-import "./chunk-6APULWSU.js";
+import "./chunk-EAAGSQXN.js";
+import "./chunk-UMQP7SYT.js";
 import "./chunk-KI2EY3WB.js";
 export {
   SystemManager

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openship",
-  "version": "0.4.7",
+  "version": "0.5.0",
   "description": "Openship CLI - deploy, manage, and open your Openship platform from the terminal",
   "license": "Apache-2.0",
   "repository": {