spine-framework 0.3.124 → 0.3.126

package/.framework/migrations/002_rls_and_functions.sql

@@ -1,763 +0,0 @@
--- Migration 002: Functions, RLS Policies, Indexes, and Foreign Keys
--- Consolidated from migrations 003, 004, 005, 006, 012, 014
-
--- ============================================
--- FUNCTIONS
--- ============================================
-
--- Account hierarchy traversal
-CREATE OR REPLACE FUNCTION public.get_accessible_accounts(actor_id uuid)
-RETURNS TABLE (account_id uuid) AS $$
-BEGIN
-  IF EXISTS (
-    SELECT 1 FROM public.people p
-    JOIN public.roles r ON p.role_id = r.id
-    WHERE p.id = actor_id AND r.slug = 'system_admin'
-  ) THEN
-    RETURN QUERY SELECT a.id FROM public.accounts a;
-    RETURN;
-  END IF;
-  RETURN QUERY
-  WITH RECURSIVE account_tree AS (
-    SELECT p.account_id as id FROM public.people p WHERE p.id = actor_id
-    UNION ALL
-    SELECT ap.descendant_id
-    FROM public.account_paths ap
-    JOIN account_tree at ON ap.ancestor_id = at.id
-  )
-  SELECT id FROM account_tree;
-END;
-$$ LANGUAGE plpgsql SECURITY DEFINER;
-
--- Get current actor ID from auth
-CREATE OR REPLACE FUNCTION public.current_actor_id()
-RETURNS uuid AS $$
-DECLARE
-  v_auth_id UUID;
-  v_person_id UUID;
-BEGIN
-  v_auth_id := auth.uid();
-  
-  -- Look up internal person ID from auth_uid
-  SELECT p.id INTO v_person_id
-  FROM public.people p
-  WHERE p.auth_uid = v_auth_id AND p.is_active = true
-  LIMIT 1;
-  
-  RETURN v_person_id;
-END;
-$$ LANGUAGE plpgsql SECURITY DEFINER STABLE;
-
--- Check if person is system admin
-CREATE OR REPLACE FUNCTION public.person_is_system_admin(person_uuid uuid)
-RETURNS boolean AS $$
-BEGIN
-  RETURN EXISTS (
-    SELECT 1 FROM public.people p
-    JOIN public.roles r ON p.role_id = r.id
-    WHERE p.id = person_uuid AND r.slug = 'system_admin'
-  );
-END;
-$$ LANGUAGE plpgsql STABLE;
-
--- Update account paths on account changes
-CREATE OR REPLACE FUNCTION public.update_account_paths()
-RETURNS TRIGGER AS $$
-BEGIN
-  IF TG_OP = 'INSERT' THEN
-    IF NEW.parent_id IS NOT NULL THEN
-      INSERT INTO public.account_paths (ancestor_id, descendant_id, depth)
-      SELECT ancestor_id, NEW.id, depth + 1 FROM public.account_paths WHERE descendant_id = NEW.parent_id;
-      INSERT INTO public.account_paths (ancestor_id, descendant_id, depth) VALUES (NEW.parent_id, NEW.id, 1);
-    END IF;
-    RETURN NEW;
-  END IF;
-  IF TG_OP = 'UPDATE' AND OLD.parent_id IS DISTINCT FROM NEW.parent_id THEN
-    DELETE FROM public.account_paths WHERE descendant_id = NEW.id;
-    IF NEW.parent_id IS NOT NULL THEN
-      INSERT INTO public.account_paths (ancestor_id, descendant_id, depth)
-      SELECT ancestor_id, NEW.id, depth + 1 FROM public.account_paths WHERE descendant_id = NEW.parent_id;
-      INSERT INTO public.account_paths (ancestor_id, descendant_id, depth) VALUES (NEW.parent_id, NEW.id, 1);
-    END IF;
-    RETURN NEW;
-  END IF;
-  IF TG_OP = 'DELETE' THEN
-    DELETE FROM public.account_paths WHERE descendant_id = OLD.id;
-    RETURN OLD;
-  END IF;
-  RETURN NULL;
-END;
-$$ LANGUAGE plpgsql;
-
--- Trigger for account paths
-DROP TRIGGER IF EXISTS account_paths_trigger ON public.accounts;
-CREATE TRIGGER account_paths_trigger
-AFTER INSERT OR UPDATE OR DELETE ON public.accounts
-FOR EACH ROW EXECUTE FUNCTION public.update_account_paths();
-
--- set_updated_at trigger function (from 014_webhook_registry.sql)
-CREATE OR REPLACE FUNCTION public.set_updated_at()
-RETURNS TRIGGER AS $$
-BEGIN
-  NEW.updated_at = now();
-  RETURN NEW;
-END;
-$$ LANGUAGE plpgsql;
-
--- ============================================
--- FOREIGN KEYS
--- ============================================
-
--- accounts FKs
-ALTER TABLE public.accounts ADD CONSTRAINT fk_accounts_parent 
-  FOREIGN KEY (parent_id) REFERENCES public.accounts(id) ON DELETE SET NULL;
-ALTER TABLE public.accounts ADD CONSTRAINT fk_accounts_type 
-  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
-ALTER TABLE public.accounts ADD CONSTRAINT fk_accounts_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE SET NULL;
-ALTER TABLE public.accounts ADD CONSTRAINT fk_accounts_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-ALTER TABLE public.accounts ADD CONSTRAINT fk_accounts_updated_by 
-  FOREIGN KEY (updated_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- people FKs
-ALTER TABLE public.people ADD CONSTRAINT people_account_id_fkey 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.people ADD CONSTRAINT people_app_id_fkey 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE SET NULL;
-ALTER TABLE public.people ADD CONSTRAINT people_role_id_fkey 
-  FOREIGN KEY (role_id) REFERENCES public.roles(id) ON DELETE SET NULL;
-ALTER TABLE public.people ADD CONSTRAINT people_type_id_fkey 
-  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
-ALTER TABLE public.people ADD CONSTRAINT people_created_by_fkey 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- types FK
-ALTER TABLE public.types ADD CONSTRAINT fk_types_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE SET NULL;
-
--- apps FKs
-ALTER TABLE public.apps ADD CONSTRAINT fk_apps_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE SET NULL;
-ALTER TABLE public.apps ADD CONSTRAINT fk_apps_owner_account 
-  FOREIGN KEY (owner_account_id) REFERENCES public.accounts(id) ON DELETE SET NULL;
-
--- roles FKs
-ALTER TABLE public.roles ADD CONSTRAINT fk_roles_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
-ALTER TABLE public.roles ADD CONSTRAINT fk_roles_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-
--- items FKs
-ALTER TABLE public.items ADD CONSTRAINT fk_items_type 
-  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
-ALTER TABLE public.items ADD CONSTRAINT fk_items_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.items ADD CONSTRAINT fk_items_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE SET NULL;
-ALTER TABLE public.items ADD CONSTRAINT fk_items_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-ALTER TABLE public.items ADD CONSTRAINT fk_items_updated_by 
-  FOREIGN KEY (updated_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- threads FKs
-ALTER TABLE public.threads ADD CONSTRAINT fk_threads_type 
-  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
-ALTER TABLE public.threads ADD CONSTRAINT fk_threads_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.threads ADD CONSTRAINT fk_threads_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-ALTER TABLE public.threads ADD CONSTRAINT fk_threads_updated_by 
-  FOREIGN KEY (updated_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- messages FKs
-ALTER TABLE public.messages ADD CONSTRAINT fk_messages_type 
-  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
-ALTER TABLE public.messages ADD CONSTRAINT fk_messages_thread 
-  FOREIGN KEY (thread_id) REFERENCES public.threads(id) ON DELETE CASCADE;
-ALTER TABLE public.messages ADD CONSTRAINT fk_messages_person 
-  FOREIGN KEY (person_id) REFERENCES public.people(id) ON DELETE SET NULL;
-ALTER TABLE public.messages ADD CONSTRAINT fk_messages_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- links FKs
-ALTER TABLE public.links ADD CONSTRAINT fk_links_type 
-  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
-ALTER TABLE public.links ADD CONSTRAINT fk_links_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.links ADD CONSTRAINT fk_links_link_type 
-  FOREIGN KEY (link_type_id) REFERENCES public.link_types(id) ON DELETE SET NULL;
-ALTER TABLE public.links ADD CONSTRAINT fk_links_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-ALTER TABLE public.links ADD CONSTRAINT fk_links_updated_by 
-  FOREIGN KEY (updated_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- attachments FKs
-ALTER TABLE public.attachments ADD CONSTRAINT fk_attachments_type 
-  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
-ALTER TABLE public.attachments ADD CONSTRAINT fk_attachments_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.attachments ADD CONSTRAINT fk_attachments_uploaded_by 
-  FOREIGN KEY (uploaded_by) REFERENCES public.people(id) ON DELETE SET NULL;
-ALTER TABLE public.attachments ADD CONSTRAINT fk_attachments_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- watchers FKs
-ALTER TABLE public.watchers ADD CONSTRAINT fk_watchers_type 
-  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
-ALTER TABLE public.watchers ADD CONSTRAINT fk_watchers_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.watchers ADD CONSTRAINT fk_watchers_person 
-  FOREIGN KEY (person_id) REFERENCES public.people(id) ON DELETE CASCADE;
-ALTER TABLE public.watchers ADD CONSTRAINT fk_watchers_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- link_types FK
-ALTER TABLE public.link_types ADD CONSTRAINT fk_link_types_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
-
--- pipelines FKs
-ALTER TABLE public.pipelines ADD CONSTRAINT fk_pipelines_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
-ALTER TABLE public.pipelines ADD CONSTRAINT fk_pipelines_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.pipelines ADD CONSTRAINT fk_pipelines_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- pipeline_executions FKs
-ALTER TABLE public.pipeline_executions ADD CONSTRAINT fk_pe_pipeline 
-  FOREIGN KEY (pipeline_id) REFERENCES public.pipelines(id) ON DELETE CASCADE;
-ALTER TABLE public.pipeline_executions ADD CONSTRAINT fk_pe_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.pipeline_executions ADD CONSTRAINT fk_pe_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- triggers FKs
-ALTER TABLE public.triggers ADD CONSTRAINT fk_triggers_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
-ALTER TABLE public.triggers ADD CONSTRAINT fk_triggers_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.triggers ADD CONSTRAINT fk_triggers_pipeline 
-  FOREIGN KEY (pipeline_id) REFERENCES public.pipelines(id) ON DELETE SET NULL;
-ALTER TABLE public.triggers ADD CONSTRAINT fk_triggers_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- trigger_executions FK
-ALTER TABLE public.trigger_executions ADD CONSTRAINT fk_te_trigger 
-  FOREIGN KEY (trigger_id) REFERENCES public.triggers(id) ON DELETE CASCADE;
-
--- timers FKs
-ALTER TABLE public.timers ADD CONSTRAINT fk_timers_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
-ALTER TABLE public.timers ADD CONSTRAINT fk_timers_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.timers ADD CONSTRAINT fk_timers_pipeline 
-  FOREIGN KEY (pipeline_id) REFERENCES public.pipelines(id) ON DELETE SET NULL;
-ALTER TABLE public.timers ADD CONSTRAINT fk_timers_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- ai_agents FKs
-ALTER TABLE public.ai_agents ADD CONSTRAINT fk_ai_agents_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
-ALTER TABLE public.ai_agents ADD CONSTRAINT fk_ai_agents_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.ai_agents ADD CONSTRAINT fk_ai_agents_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- embeddings FK
-ALTER TABLE public.embeddings ADD CONSTRAINT fk_embeddings_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-
--- integrations FKs
-ALTER TABLE public.integrations ADD CONSTRAINT fk_integrations_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
-ALTER TABLE public.integrations ADD CONSTRAINT fk_integrations_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.integrations ADD CONSTRAINT fk_integrations_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- prompt_configs FKs
-ALTER TABLE public.prompt_configs ADD CONSTRAINT fk_prompt_configs_app 
-  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
-ALTER TABLE public.prompt_configs ADD CONSTRAINT fk_prompt_configs_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.prompt_configs ADD CONSTRAINT fk_prompt_configs_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- api_keys FKs
-ALTER TABLE public.api_keys ADD CONSTRAINT fk_api_keys_integration 
-  FOREIGN KEY (integration_id) REFERENCES public.integrations(id) ON DELETE SET NULL;
-ALTER TABLE public.api_keys ADD CONSTRAINT fk_api_keys_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.api_keys ADD CONSTRAINT fk_api_keys_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- api_key_usage_logs FKs
-ALTER TABLE public.api_key_usage_logs ADD CONSTRAINT fk_akul_api_key 
-  FOREIGN KEY (api_key_id) REFERENCES public.api_keys(id) ON DELETE CASCADE;
-ALTER TABLE public.api_key_usage_logs ADD CONSTRAINT fk_akul_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-
--- logs FKs
-ALTER TABLE public.logs ADD CONSTRAINT fk_logs_person 
-  FOREIGN KEY (person_id) REFERENCES public.people(id) ON DELETE SET NULL;
-ALTER TABLE public.logs ADD CONSTRAINT fk_logs_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-
--- actions FKs
-ALTER TABLE public.actions ADD CONSTRAINT fk_actions_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.actions ADD CONSTRAINT fk_actions_machine_principal 
-  FOREIGN KEY (default_machine_principal_id) REFERENCES public.api_keys(id) ON DELETE SET NULL;
-ALTER TABLE public.actions ADD CONSTRAINT fk_actions_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- schedules FKs
-ALTER TABLE public.schedules ADD CONSTRAINT fk_schedules_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.schedules ADD CONSTRAINT fk_schedules_action 
-  FOREIGN KEY (action_id) REFERENCES public.actions(id) ON DELETE CASCADE;
-ALTER TABLE public.schedules ADD CONSTRAINT fk_schedules_machine 
-  FOREIGN KEY (machine_principal_id) REFERENCES public.api_keys(id) ON DELETE SET NULL;
-ALTER TABLE public.schedules ADD CONSTRAINT fk_schedules_created_by 
-  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
-
--- schedule_executions FKs
-ALTER TABLE public.schedule_executions ADD CONSTRAINT fk_se_schedule 
-  FOREIGN KEY (schedule_id) REFERENCES public.schedules(id) ON DELETE CASCADE;
-ALTER TABLE public.schedule_executions ADD CONSTRAINT fk_se_account 
-  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
-ALTER TABLE public.schedule_executions ADD CONSTRAINT fk_se_machine 
-  FOREIGN KEY (machine_principal_id) REFERENCES public.api_keys(id) ON DELETE SET NULL;
-
--- ============================================
--- INDEXES
--- ============================================
-
--- account_paths indexes
-CREATE INDEX IF NOT EXISTS idx_account_paths_ancestor ON public.account_paths(ancestor_id);
-CREATE INDEX IF NOT EXISTS idx_account_paths_descendant ON public.account_paths(descendant_id);
-
--- accounts
-CREATE INDEX IF NOT EXISTS idx_accounts_parent_id ON public.accounts(parent_id);
-CREATE INDEX IF NOT EXISTS idx_accounts_type_id ON public.accounts(type_id);
-CREATE INDEX IF NOT EXISTS idx_accounts_active ON public.accounts(is_active);
-
--- people
-CREATE INDEX IF NOT EXISTS idx_people_account ON public.people(account_id);
-CREATE INDEX IF NOT EXISTS idx_people_auth_uid ON public.people(auth_uid);
-CREATE INDEX IF NOT EXISTS idx_people_email ON public.people(email);
-CREATE INDEX IF NOT EXISTS idx_people_role ON public.people(role_id);
-CREATE INDEX IF NOT EXISTS idx_people_active ON public.people(is_active);
-
--- types
-CREATE INDEX IF NOT EXISTS idx_types_slug ON public.types(slug);
-CREATE INDEX IF NOT EXISTS idx_types_kind ON public.types(kind);
-
--- apps
-CREATE INDEX IF NOT EXISTS idx_apps_slug ON public.apps(slug);
-CREATE INDEX IF NOT EXISTS idx_apps_owner ON public.apps(owner_account_id);
-CREATE UNIQUE INDEX IF NOT EXISTS idx_apps_route_prefix ON public.apps(route_prefix) 
-  WHERE is_active = true AND route_prefix IS NOT NULL;
-
--- roles
-CREATE INDEX IF NOT EXISTS idx_roles_slug ON public.roles(slug);
-
--- items
-CREATE INDEX IF NOT EXISTS idx_items_type ON public.items(type_id);
-CREATE INDEX IF NOT EXISTS idx_items_account ON public.items(account_id);
-CREATE INDEX IF NOT EXISTS idx_items_active ON public.items(is_active);
-CREATE INDEX IF NOT EXISTS idx_items_created_at ON public.items(created_at);
-
--- threads
-CREATE INDEX IF NOT EXISTS idx_threads_type ON public.threads(type_id);
-CREATE INDEX IF NOT EXISTS idx_threads_account ON public.threads(account_id);
-CREATE INDEX IF NOT EXISTS idx_threads_target ON public.threads(target_type, target_id);
-CREATE INDEX IF NOT EXISTS idx_threads_active ON public.threads(is_active);
-
--- messages
-CREATE INDEX IF NOT EXISTS idx_messages_thread ON public.messages(thread_id);
-CREATE INDEX IF NOT EXISTS idx_messages_type ON public.messages(type_id);
-CREATE INDEX IF NOT EXISTS idx_messages_person ON public.messages(person_id);
-
--- links
-CREATE INDEX IF NOT EXISTS idx_links_type ON public.links(type_id);
-CREATE INDEX IF NOT EXISTS idx_links_account ON public.links(account_id);
-CREATE INDEX IF NOT EXISTS idx_links_source ON public.links(source_type, source_id);
-CREATE INDEX IF NOT EXISTS idx_links_target ON public.links(target_type, target_id);
-
--- attachments
-CREATE INDEX IF NOT EXISTS idx_attachments_type ON public.attachments(type_id);
-CREATE INDEX IF NOT EXISTS idx_attachments_account ON public.attachments(account_id);
-
--- watchers
-CREATE INDEX IF NOT EXISTS idx_watchers_type ON public.watchers(type_id);
-CREATE INDEX IF NOT EXISTS idx_watchers_target ON public.watchers(target_type, target_id);
-CREATE INDEX IF NOT EXISTS idx_watchers_person ON public.watchers(person_id);
-
--- link_types
-CREATE INDEX IF NOT EXISTS idx_link_types_slug ON public.link_types(slug);
-
--- pipelines
-CREATE INDEX IF NOT EXISTS idx_pipelines_app ON public.pipelines(app_id);
-CREATE INDEX IF NOT EXISTS idx_pipelines_account ON public.pipelines(account_id);
-
--- pipeline_executions
-CREATE INDEX IF NOT EXISTS idx_pe_pipeline ON public.pipeline_executions(pipeline_id);
-CREATE INDEX IF NOT EXISTS idx_pe_account ON public.pipeline_executions(account_id);
-CREATE INDEX IF NOT EXISTS idx_pe_status ON public.pipeline_executions(status);
-
--- triggers
-CREATE INDEX IF NOT EXISTS idx_triggers_app ON public.triggers(app_id);
-CREATE INDEX IF NOT EXISTS idx_triggers_account ON public.triggers(account_id);
-CREATE INDEX IF NOT EXISTS idx_triggers_pipeline ON public.triggers(pipeline_id);
-
--- trigger_executions
-CREATE INDEX IF NOT EXISTS idx_te_trigger ON public.trigger_executions(trigger_id);
-
--- timers
-CREATE INDEX IF NOT EXISTS idx_timers_app ON public.timers(app_id);
-CREATE INDEX IF NOT EXISTS idx_timers_account ON public.timers(account_id);
-CREATE INDEX IF NOT EXISTS idx_timers_pipeline ON public.timers(pipeline_id);
-
--- ai_agents
-CREATE INDEX IF NOT EXISTS idx_ai_agents_app ON public.ai_agents(app_id);
-CREATE INDEX IF NOT EXISTS idx_ai_agents_account ON public.ai_agents(account_id);
-
--- embeddings
-CREATE INDEX IF NOT EXISTS idx_embeddings_account ON public.embeddings(account_id);
-CREATE INDEX IF NOT EXISTS idx_embeddings_model_doc ON public.embeddings(model_id, document_id);
-
--- integrations
-CREATE INDEX IF NOT EXISTS idx_integrations_app ON public.integrations(app_id);
-CREATE INDEX IF NOT EXISTS idx_integrations_account ON public.integrations(account_id);
-
--- prompt_configs
-CREATE INDEX IF NOT EXISTS idx_prompt_configs_slug ON public.prompt_configs(slug);
-CREATE INDEX IF NOT EXISTS idx_prompt_configs_app ON public.prompt_configs(app_id);
-CREATE INDEX IF NOT EXISTS idx_prompt_configs_account ON public.prompt_configs(account_id);
-
--- api_keys
-CREATE INDEX IF NOT EXISTS idx_api_keys_integration ON public.api_keys(integration_id);
-CREATE INDEX IF NOT EXISTS idx_api_keys_account ON public.api_keys(account_id);
-CREATE INDEX IF NOT EXISTS idx_api_keys_key_value ON public.api_keys(key_value);
-
--- api_key_usage_logs
-CREATE INDEX IF NOT EXISTS idx_akul_api_key ON public.api_key_usage_logs(api_key_id);
-CREATE INDEX IF NOT EXISTS idx_akul_account ON public.api_key_usage_logs(account_id);
-CREATE INDEX IF NOT EXISTS idx_akul_created ON public.api_key_usage_logs(created_at);
-
--- logs
-CREATE INDEX IF NOT EXISTS idx_logs_account ON public.logs(account_id);
-CREATE INDEX IF NOT EXISTS idx_logs_level ON public.logs(level);
-CREATE INDEX IF NOT EXISTS idx_logs_created ON public.logs(created_at);
-CREATE INDEX IF NOT EXISTS idx_logs_source ON public.logs(source_type, source_id);
-
--- actions
-CREATE INDEX IF NOT EXISTS idx_actions_account ON public.actions(account_id);
-CREATE INDEX IF NOT EXISTS idx_actions_slug ON public.actions(slug);
-
--- schedules
-CREATE INDEX IF NOT EXISTS idx_schedules_account ON public.schedules(account_id);
-CREATE INDEX IF NOT EXISTS idx_schedules_action ON public.schedules(action_id);
-CREATE INDEX IF NOT EXISTS idx_schedules_next_run ON public.schedules(next_run_at);
-
--- schedule_executions
-CREATE INDEX IF NOT EXISTS idx_se_schedule ON public.schedule_executions(schedule_id);
-CREATE INDEX IF NOT EXISTS idx_se_account ON public.schedule_executions(account_id);
-
--- test tables
-CREATE INDEX IF NOT EXISTS idx_test_results_run_id ON public.test_results(run_id);
-CREATE INDEX IF NOT EXISTS idx_test_runs_suite ON public.test_runs(suite);
-CREATE INDEX IF NOT EXISTS idx_test_runs_started_at ON public.test_runs(started_at DESC);
-
--- item_progress
-CREATE INDEX IF NOT EXISTS idx_item_progress_person ON public.item_progress(person_id);
-CREATE INDEX IF NOT EXISTS idx_item_progress_item ON public.item_progress(item_id);
-CREATE INDEX IF NOT EXISTS idx_item_progress_account ON public.item_progress(account_id);
-CREATE INDEX IF NOT EXISTS idx_item_progress_type ON public.item_progress(type_id);
-CREATE INDEX IF NOT EXISTS idx_item_progress_status ON public.item_progress(status);
-CREATE INDEX IF NOT EXISTS idx_item_progress_data_gin ON public.item_progress USING gin(data);
-CREATE INDEX IF NOT EXISTS idx_item_progress_active ON public.item_progress(account_id, is_active) WHERE is_active = true;
-
--- webhook_handlers
-CREATE INDEX IF NOT EXISTS idx_webhook_handlers_name ON public.webhook_handlers(name) WHERE is_active = true AND is_deleted = false;
-CREATE INDEX IF NOT EXISTS idx_webhook_handlers_account ON public.webhook_handlers(account_id) WHERE is_deleted = false;
-CREATE INDEX IF NOT EXISTS idx_webhook_handlers_events ON public.webhook_handlers USING GIN(events) WHERE is_active = true;
-
--- ============================================
--- ENABLE RLS ON ALL TABLES
--- ============================================
-
-ALTER TABLE public.accounts ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.people ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.types ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.apps ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.roles ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.items ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.threads ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.messages ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.links ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.attachments ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.watchers ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.link_types ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.pipelines ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.pipeline_executions ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.triggers ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.trigger_executions ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.timers ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.ai_agents ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.embeddings ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.integrations ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.prompt_configs ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.api_keys ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.api_key_usage_logs ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.logs ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.actions ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.schedules ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.schedule_executions ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.item_progress ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.webhook_handlers ENABLE ROW LEVEL SECURITY;
-
--- ============================================
--- RLS POLICIES
--- ============================================
-
--- accounts
-DROP POLICY IF EXISTS accounts_access ON public.accounts;
-CREATE POLICY accounts_access ON public.accounts FOR ALL
-  USING (id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))
-         OR public.current_actor_id() IS NULL);
-
--- people
-DROP POLICY IF EXISTS people_access ON public.people;
-CREATE POLICY people_access ON public.people FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))
-         OR public.current_actor_id() IS NULL);
-
--- types
-DROP POLICY IF EXISTS types_access ON public.types;
-CREATE POLICY types_access ON public.types FOR ALL
-  USING (public.current_actor_id() IS NOT NULL OR true);
-
--- apps
-DROP POLICY IF EXISTS apps_access ON public.apps;
-CREATE POLICY apps_access ON public.apps FOR ALL
-  USING (is_system = true OR owner_account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- roles
-DROP POLICY IF EXISTS roles_read ON public.roles;
-CREATE POLICY roles_read ON public.roles FOR SELECT USING (true);
-DROP POLICY IF EXISTS roles_modify ON public.roles;
-CREATE POLICY roles_modify ON public.roles FOR ALL
-  USING ((is_system = true AND public.person_is_system_admin(public.current_actor_id()))
-         OR is_system = false OR public.current_actor_id() IS NULL);
-
--- items (with platform scope visibility from 012_rls_scope.sql)
-DROP POLICY IF EXISTS items_access ON public.items;
-CREATE POLICY items_access ON public.items FOR ALL
-  USING (
-    account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))
-    OR (design_schema->>'scope' = 'platform' AND public.current_actor_id() IS NOT NULL)
-    OR public.current_actor_id() IS NULL
-  );
-
--- threads (runtime record design_schema is the source of truth for scope)
-DROP POLICY IF EXISTS threads_access ON public.threads;
-CREATE POLICY threads_access ON public.threads FOR ALL
-  USING (
-    design_schema->>'scope' = 'platform' AND public.current_actor_id() IS NOT NULL
-    OR account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))
-    OR public.current_actor_id() IS NULL
-  );
-
--- messages (inherits thread access from the runtime record design_schema; visibility
--- filters internal notes to support/support_admin roles)
-DROP POLICY IF EXISTS messages_access ON public.messages;
-CREATE POLICY messages_access ON public.messages FOR ALL
-  USING (
-    EXISTS (
-      SELECT 1 FROM public.threads t
-      WHERE t.id = messages.thread_id
-      AND (
-        t.design_schema->>'scope' = 'platform' AND public.current_actor_id() IS NOT NULL
-        OR t.account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))
-      )
-    )
-    AND (
-      messages.visibility IS NULL
-      OR messages.visibility = 'external'
-      OR (
-        messages.visibility = 'internal'
-        AND EXISTS (
-          SELECT 1 FROM public.people p
-          JOIN public.roles r ON p.role_id = r.id
-          WHERE p.id = public.current_actor_id()
-          AND (r.slug IN ('support', 'support_admin') OR r.is_system = true)
-        )
-      )
-    )
-    OR public.current_actor_id() IS NULL
-  );
-
--- links (with platform scope visibility from 012_rls_scope.sql)
-DROP POLICY IF EXISTS links_access ON public.links;
-CREATE POLICY links_access ON public.links FOR ALL
-  USING (
-    account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-    OR (design_schema->>'scope' = 'platform' AND auth.uid() IS NOT NULL)
-    OR auth.uid() IS NULL
-  );
-
--- attachments (with platform scope visibility from 012_rls_scope.sql)
-DROP POLICY IF EXISTS attachments_access ON public.attachments;
-CREATE POLICY attachments_access ON public.attachments FOR ALL
-  USING (
-    account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-    OR (design_schema->>'scope' = 'platform' AND auth.uid() IS NOT NULL)
-    OR auth.uid() IS NULL
-  );
-
--- watchers
-DROP POLICY IF EXISTS watchers_access ON public.watchers;
-CREATE POLICY watchers_access ON public.watchers FOR ALL
-  USING (auth.uid() IS NOT NULL OR true);
-
--- link_types
-DROP POLICY IF EXISTS link_types_access ON public.link_types;
-CREATE POLICY link_types_access ON public.link_types FOR ALL
-  USING (app_id IS NULL
-         OR EXISTS (SELECT 1 FROM public.apps a WHERE a.id = link_types.app_id
-                    AND a.owner_account_id IN (SELECT public.get_accessible_accounts(auth.uid())))
-         OR auth.uid() IS NULL);
-
--- pipelines
-DROP POLICY IF EXISTS pipelines_access ON public.pipelines;
-CREATE POLICY pipelines_access ON public.pipelines FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- pipeline_executions
-DROP POLICY IF EXISTS pe_access ON public.pipeline_executions;
-CREATE POLICY pe_access ON public.pipeline_executions FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- triggers
-DROP POLICY IF EXISTS triggers_access ON public.triggers;
-CREATE POLICY triggers_access ON public.triggers FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- trigger_executions
-DROP POLICY IF EXISTS te_access ON public.trigger_executions;
-CREATE POLICY te_access ON public.trigger_executions FOR ALL
-  USING (EXISTS (SELECT 1 FROM public.triggers t
-                 WHERE t.id = trigger_executions.trigger_id
-                 AND t.account_id IN (SELECT public.get_accessible_accounts(auth.uid())))
-         OR auth.uid() IS NULL);
-
--- timers
-DROP POLICY IF EXISTS timers_access ON public.timers;
-CREATE POLICY timers_access ON public.timers FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- ai_agents
-DROP POLICY IF EXISTS ai_agents_access ON public.ai_agents;
-CREATE POLICY ai_agents_access ON public.ai_agents FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- embeddings
-DROP POLICY IF EXISTS embeddings_access ON public.embeddings;
-CREATE POLICY embeddings_access ON public.embeddings FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- integrations
-DROP POLICY IF EXISTS integrations_access ON public.integrations;
-CREATE POLICY integrations_access ON public.integrations FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- prompt_configs
-DROP POLICY IF EXISTS prompt_configs_access ON public.prompt_configs;
-CREATE POLICY prompt_configs_access ON public.prompt_configs FOR ALL
-  USING ((app_id IS NULL OR EXISTS (SELECT 1 FROM public.apps a
-          WHERE a.id = prompt_configs.app_id
-          AND a.owner_account_id IN (SELECT public.get_accessible_accounts(auth.uid()))))
-         OR auth.uid() IS NULL);
-
--- api_keys
-DROP POLICY IF EXISTS api_keys_access ON public.api_keys;
-CREATE POLICY api_keys_access ON public.api_keys FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR id = auth.uid() OR auth.uid() IS NULL);
-
--- api_key_usage_logs
-DROP POLICY IF EXISTS akul_access ON public.api_key_usage_logs;
-CREATE POLICY akul_access ON public.api_key_usage_logs FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- logs
-DROP POLICY IF EXISTS logs_access ON public.logs;
-CREATE POLICY logs_access ON public.logs FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- actions
-DROP POLICY IF EXISTS actions_access ON public.actions;
-CREATE POLICY actions_access ON public.actions FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- schedules
-DROP POLICY IF EXISTS schedules_access ON public.schedules;
-CREATE POLICY schedules_access ON public.schedules FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- schedule_executions
-DROP POLICY IF EXISTS se_access ON public.schedule_executions;
-CREATE POLICY se_access ON public.schedule_executions FOR ALL
-  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-         OR auth.uid() IS NULL);
-
--- item_progress
-DROP POLICY IF EXISTS item_progress_access ON public.item_progress;
-CREATE POLICY item_progress_access ON public.item_progress FOR ALL
-  USING (
-    account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
-    OR auth.uid() IS NULL
-  );
-
--- webhook_handlers
-DROP POLICY IF EXISTS webhook_handlers_system_admin ON public.webhook_handlers;
-CREATE POLICY webhook_handlers_system_admin ON public.webhook_handlers
-  FOR ALL
-  TO authenticated
-  USING (
-    (SELECT raw_user_meta_data->>'role' FROM auth.users WHERE id = auth.uid()) = 'system_admin'
-  )
-  WITH CHECK (
-    (SELECT raw_user_meta_data->>'role' FROM auth.users WHERE id = auth.uid()) = 'system_admin'
-  );
-
-DROP POLICY IF EXISTS webhook_handlers_service_role ON public.webhook_handlers;
-CREATE POLICY webhook_handlers_service_role ON public.webhook_handlers
-  FOR ALL
-  TO service_role
-  USING (true)
-  WITH CHECK (true);
-
--- ============================================
--- TRIGGERS FOR UPDATED_AT
--- ============================================
-
-CREATE TRIGGER webhook_handlers_updated_at
-  BEFORE UPDATE ON public.webhook_handlers
-  FOR EACH ROW
-  EXECUTE FUNCTION public.set_updated_at();