spine-framework 0.3.124 → 0.3.126

package/.framework/migrations/004_enhancements.sql

@@ -1,43 +0,0 @@
--- Migration 004: Enhancements
--- Additional enhancements and refinements to the Spine schema
-
--- ============================================
--- TYPE SCOPE STAMPING (from 012_type_scope.sql)
--- ============================================
--- Platform-scoped types: owned by spine-system, any authenticated user can read
-UPDATE public.types
-SET design_schema = design_schema || '{"scope":"platform"}'::jsonb
-WHERE slug IN ('kb_article', 'course_lesson', 'community_post', 'community_question');
-
--- Customer-scoped types: owned by the customer's account
-UPDATE public.types
-SET design_schema = design_schema || '{"scope":"customer"}'::jsonb
-WHERE slug IN ('support_ticket');
-
--- Account-scoped types: owned by the calling account (default, explicit for clarity)
-UPDATE public.types
-SET design_schema = design_schema || '{"scope":"account"}'::jsonb
-WHERE design_schema->>'scope' IS NULL;
-
--- ============================================
--- TABLE COMMENTS
--- ============================================
-
-COMMENT ON TABLE public.account_paths IS 
-'Stores ancestor-descendant relationships for account hierarchy traversal';
-
-COMMENT ON TABLE public.webhook_handlers IS 
-'Dynamic registry for webhook handlers. Custom functions self-register here to be discoverable by the integration-routes handler without static imports.';
-
--- ============================================
--- ENHANCEMENT NOTES
--- ============================================
--- This file contains miscellaneous enhancements that refine the core schema:
---
--- 1. Type scope stamping: Ensures all types have an explicit scope field
---    in their design_schema for proper RLS and visibility control.
---
--- 2. Table comments: Documentation for key infrastructure tables.
---
--- Future enhancements should be added here as ALTER statements or
--- configuration updates that don't require new table creation.

package/.framework/migrations/005_auth_user_trigger.sql

@@ -1,105 +0,0 @@
--- =============================================================================
--- 005_auth_user_trigger.sql
--- Creates or updates a people record whenever a new Supabase auth user signs up.
--- Run AFTER 001_schema.sql (requires spine-system account and person type).
---
--- Resolution order on new auth.users insert:
---
---   1. Stub match (invited/pending):
---      If a people row exists with matching email, status IN ('invited','pending'),
---      and no auth_uid yet → update it (set auth_uid, full_name).
---      - 'invited' stub  → flip status to 'active'   (invite = pre-approval)
---      - 'pending' stub  → keep status 'pending'      (access request needs approval)
---
---   2. First user ever → system_admin on spine-system (bootstrap).
---
---   3. Walk-up fallback → minimal active shell on spine-system with no role.
---      The frontend completes registration via the invites function
---      (creates account, assigns role, or creates access_request stub).
--- =============================================================================
-
-CREATE OR REPLACE FUNCTION public.handle_new_auth_user()
-RETURNS TRIGGER LANGUAGE plpgsql SECURITY DEFINER SET search_path = public AS $$
-DECLARE
-  v_account_id         uuid;
-  v_type_id            uuid;
-  v_role_id            uuid;
-  v_is_first           boolean;
-  v_design_schema      jsonb;
-  v_validation_schema  jsonb;
-  v_stub_id            uuid;
-  v_stub_status        text;
-BEGIN
-  -- ── Resolve core references ──────────────────────────────────────────────
-  SELECT id INTO v_account_id FROM public.accounts WHERE slug = 'spine-system' LIMIT 1;
-  SELECT id, design_schema, validation_schema
-    INTO v_type_id, v_design_schema, v_validation_schema
-  FROM public.types WHERE kind = 'person' AND slug = 'person' LIMIT 1;
-
-  IF v_account_id IS NULL OR v_type_id IS NULL THEN
-    RAISE WARNING 'handle_new_auth_user: spine-system account or person type not found — skipping';
-    RETURN NEW;
-  END IF;
-
-  -- ── 1. Stub match: invited or pending people row for this email ───────────
-  SELECT id, status
-    INTO v_stub_id, v_stub_status
-  FROM public.people
-  WHERE email = NEW.email
-    AND status IN ('invited', 'pending')
-    AND auth_uid IS NULL
-  LIMIT 1;
-
-  IF v_stub_id IS NOT NULL THEN
-    UPDATE public.people SET
-      auth_uid   = NEW.id,
-      full_name  = COALESCE(NEW.raw_user_meta_data->>'full_name', full_name, split_part(NEW.email, '@', 1)),
-      -- invited = pre-approved; pending = still needs approval
-      status     = CASE WHEN v_stub_status = 'invited' THEN 'active' ELSE 'pending' END,
-      updated_at = now()
-    WHERE id = v_stub_id;
-
-    RETURN NEW;
-  END IF;
-
-  -- ── 2. First user bootstrap → system_admin ───────────────────────────────
-  SELECT NOT EXISTS (SELECT 1 FROM public.people LIMIT 1) INTO v_is_first;
-  IF v_is_first THEN
-    SELECT id INTO v_role_id FROM public.roles WHERE slug = 'system_admin' LIMIT 1;
-  END IF;
-
-  -- ── 3. Walk-up fallback → minimal shell (frontend completes via invites fn) ─
-  INSERT INTO public.people (
-    id,
-    auth_uid,
-    email,
-    full_name,
-    account_id,
-    type_id,
-    role_id,
-    status,
-    is_active,
-    design_schema,
-    validation_schema
-  ) VALUES (
-    NEW.id,
-    NEW.id,
-    NEW.email,
-    COALESCE(NEW.raw_user_meta_data->>'full_name', split_part(NEW.email, '@', 1)),
-    v_account_id,
-    v_type_id,
-    v_role_id,   -- NULL unless first user
-    'active',    -- frontend will update if this becomes an access_request
-    true,
-    v_design_schema,
-    COALESCE(v_validation_schema, '{}'::jsonb)
-  )
-  ON CONFLICT (id) DO NOTHING;
-
-  RETURN NEW;
-END;
-$$;
-
-CREATE OR REPLACE TRIGGER on_auth_user_created
-  AFTER INSERT ON auth.users
-  FOR EACH ROW EXECUTE FUNCTION public.handle_new_auth_user();

package/.framework/migrations/006_fix_current_actor_id.sql

@@ -1,21 +0,0 @@
--- Patch: fix uuid = text operator error in current_actor_id()
--- The previous version cast v_auth_id to text before comparing with auth_uid (uuid),
--- which causes PostgreSQL error 42883. This re-creates the function with matching types.
-
-CREATE OR REPLACE FUNCTION public.current_actor_id()
-RETURNS uuid AS $$
-DECLARE
-  v_auth_id UUID;
-  v_person_id UUID;
-BEGIN
-  v_auth_id := auth.uid();
-
-  -- Look up internal person ID from auth_uid
-  SELECT p.id INTO v_person_id
-  FROM public.people p
-  WHERE p.auth_uid = v_auth_id AND p.is_active = true
-  LIMIT 1;
-
-  RETURN v_person_id;
-END;
-$$ LANGUAGE plpgsql SECURITY DEFINER STABLE;

package/.framework/migrations/016_invites.sql

@@ -1,27 +0,0 @@
--- Migration 016: Invite system indexes
--- Invite and access_request stubs are stored as people rows with status
--- 'invited' or 'pending' and invite metadata in the data jsonb column.
---
--- people.status values:
---   active    — normal active person
---   inactive  — deactivated
---   invited   — admin-generated invite stub, unclaimed (pre-approval by definition)
---   pending   — walk-up access request stub, awaiting member_admin approval
---
--- Invite metadata stored in people.data:
---   invite_token       text     — 16-char random lookup key (URL: /register?t=TOKEN)
---   invite_kind        text     — 'invite' | 'access_request'
---   invite_expires_at  text     — ISO timestamp
---   invite_attempts    integer  — failed validation attempts
---   invite_blocked_at  text     — ISO timestamp, set after too many attempts
---   invite_invited_by  uuid     — person UUID of the inviter
-
--- Fast token lookup
-CREATE INDEX IF NOT EXISTS people_invite_token_idx
-  ON public.people ((data->>'invite_token'))
-  WHERE data->>'invite_token' IS NOT NULL;
-
--- Efficient scoped invite list queries
-CREATE INDEX IF NOT EXISTS people_invite_kind_account_idx
-  ON public.people (account_id, status)
-  WHERE data->>'invite_kind' IS NOT NULL;

package/.framework/migrations/017_fix_get_account_apps.sql

@@ -1,78 +0,0 @@
--- Migration 017: Fix get_account_apps() to include globally-available apps
---
--- Problem: The RPC function excluded apps where owner_account_id IS NULL,
--- meaning installed apps (source='npm', owner_account_id=NULL) were invisible
--- to all users in the apps list.
---
--- Fix: Include apps where owner_account_id IS NULL (globally available apps).
--- Must DROP first because the return type changed (added route_prefix, renderer, etc.)
-
-DROP FUNCTION IF EXISTS public.get_account_apps(uuid, boolean, boolean);
-
-CREATE OR REPLACE FUNCTION public.get_account_apps(
-  account_id uuid,
-  include_system boolean DEFAULT true,
-  include_inactive boolean DEFAULT false
-)
-RETURNS TABLE(
-  id uuid,
-  slug text,
-  name text,
-  description text,
-  icon text,
-  color text,
-  version text,
-  app_type text,
-  source text,
-  owner_account_id uuid,
-  is_active boolean,
-  is_system boolean,
-  min_role text,
-  config jsonb,
-  nav_items jsonb,
-  route_prefix text,
-  renderer text,
-  metadata jsonb,
-  integration_deps jsonb,
-  created_at timestamptz
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-AS $$
-BEGIN
-  RETURN QUERY
-  SELECT
-    a.id,
-    a.slug,
-    a.name,
-    a.description,
-    a.icon,
-    a.color,
-    a.version,
-    a.app_type,
-    a.source,
-    a.owner_account_id,
-    a.is_active,
-    a.is_system,
-    a.min_role,
-    a.config,
-    a.nav_items,
-    a.route_prefix,
-    a.renderer,
-    a.metadata,
-    a.integration_deps,
-    a.created_at
-  FROM public.apps a
-  WHERE
-    (include_inactive OR a.is_active = true)
-    AND (
-      a.is_system = true                                              -- always include system apps
-      OR a.owner_account_id = get_account_apps.account_id            -- owned by this account
-      OR a.owner_account_id IS NULL                                   -- globally available (npm-installed apps)
-    )
-  ORDER BY
-    a.is_system DESC,
-    a.app_type,
-    a.name;
-END;
-$$;

package/.framework/migrations/018_apps_required_roles.sql

@@ -1,17 +0,0 @@
--- Migration 018: Add required_roles array to apps table
---
--- min_role (single string) only supports one role gate.
--- required_roles (jsonb array) supports gating by any of several roles.
--- e.g. ["support", "support_admin"] — user needs either role to access the app.
---
--- Both columns coexist. required_roles takes precedence at runtime;
--- min_role is kept as a legacy fallback and for display purposes.
-
-ALTER TABLE public.apps
-  ADD COLUMN IF NOT EXISTS required_roles jsonb DEFAULT '[]'::jsonb;
-
--- Backfill: migrate existing min_role values into the array
-UPDATE public.apps
-SET required_roles = jsonb_build_array(min_role)
-WHERE min_role IS NOT NULL
-  AND (required_roles = '[]'::jsonb OR required_roles IS NULL);

package/.framework/migrations/019_triggers_unique_constraint.sql

@@ -1,13 +0,0 @@
--- Migration 019: Add unique constraint on triggers(app_id, name)
---
--- The triggers table had no unique constraint, making idempotent upserts
--- impossible (re-runs would create duplicate rows). This adds a partial unique
--- index scoped to (app_id, name) so install-app can safely upsert seed triggers
--- using onConflict: 'app_id,name'.
---
--- NULL app_id rows (global triggers) are excluded from the uniqueness check
--- via the WHERE clause to avoid false conflicts between global triggers.
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_triggers_app_id_name
-  ON public.triggers(app_id, name)
-  WHERE app_id IS NOT NULL;

package/.framework/migrations/020_get_account_apps_role_filter.sql

@@ -1,117 +0,0 @@
--- Migration 020: Add role-based filtering to get_account_apps()
---
--- Previously the RPC returned all apps for an account and the frontend
--- filtered by role client-side.  This was fragile (race conditions around
--- stale roles) and leaked app metadata to users who couldn't access them.
---
--- New signature adds two optional params:
---   user_role_slugs  text[]   — the calling user's role slugs (e.g. ARRAY['support'])
---   is_system_admin  boolean  — true bypasses all role checks
---
--- Filtering logic:
---   1. system_admin always sees everything
---   2. Apps with no required_roles AND no min_role are visible to everyone
---   3. Apps with required_roles: user must have at least one matching role
---   4. Apps with only min_role (legacy): treated as required_roles = ARRAY[min_role]
---
--- Existing callers that omit the new params get the old behaviour (no filtering).
-
-DROP FUNCTION IF EXISTS public.get_account_apps(uuid, boolean, boolean);
-DROP FUNCTION IF EXISTS public.get_account_apps(uuid, boolean, boolean, text[], boolean);
-
-CREATE OR REPLACE FUNCTION public.get_account_apps(
-  account_id        uuid,
-  include_system    boolean  DEFAULT true,
-  include_inactive  boolean  DEFAULT false,
-  user_role_slugs   text[]   DEFAULT NULL,
-  is_system_admin   boolean  DEFAULT false
-)
-RETURNS TABLE(
-  id                uuid,
-  slug              text,
-  name              text,
-  description       text,
-  icon              text,
-  color             text,
-  version           text,
-  app_type          text,
-  source            text,
-  owner_account_id  uuid,
-  is_active         boolean,
-  is_system         boolean,
-  min_role          text,
-  required_roles    jsonb,
-  config            jsonb,
-  nav_items         jsonb,
-  route_prefix      text,
-  renderer          text,
-  metadata          jsonb,
-  integration_deps  jsonb,
-  created_at        timestamptz
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-AS $$
-BEGIN
-  RETURN QUERY
-  SELECT
-    a.id,
-    a.slug,
-    a.name,
-    a.description,
-    a.icon,
-    a.color,
-    a.version,
-    a.app_type,
-    a.source,
-    a.owner_account_id,
-    a.is_active,
-    a.is_system,
-    a.min_role,
-    a.required_roles,
-    a.config,
-    a.nav_items,
-    a.route_prefix,
-    a.renderer,
-    a.metadata,
-    a.integration_deps,
-    a.created_at
-  FROM public.apps a
-  WHERE
-    -- Active filter
-    (include_inactive OR a.is_active = true)
-    -- Ownership / visibility filter
-    AND (
-      a.is_system = true
-      OR a.owner_account_id = get_account_apps.account_id
-      OR a.owner_account_id IS NULL
-    )
-    -- Role filter (only applied when user_role_slugs is provided)
-    AND (
-      user_role_slugs IS NULL                              -- no filter requested (backward compat)
-      OR is_system_admin                                   -- system_admin sees everything
-      OR (                                                 -- no role requirement on this app
-        (a.required_roles IS NULL OR a.required_roles = '[]'::jsonb)
-        AND a.min_role IS NULL
-      )
-      OR (                                                 -- user has a matching required_role
-        a.required_roles IS NOT NULL
-        AND a.required_roles != '[]'::jsonb
-        AND EXISTS (
-          SELECT 1
-          FROM jsonb_array_elements_text(a.required_roles) AS rr(role_slug)
-          WHERE rr.role_slug = ANY(user_role_slugs)
-        )
-      )
-      OR (                                                 -- legacy min_role fallback
-        (a.required_roles IS NULL OR a.required_roles = '[]'::jsonb)
-        AND a.min_role IS NOT NULL
-        AND a.min_role = ANY(user_role_slugs)
-      )
-    )
-  ORDER BY
-    a.is_system DESC,
-    a.app_type,
-    a.name;
-END;
-$$;

package/.framework/migrations/021_app_domains.sql

@@ -1,112 +0,0 @@
--- Migration 021: Add preview/prod domain scoping to apps
---
--- Allows each app to declare which hostnames it should be served on
--- in preview and production environments. The frontend uses VITE_ENVIRONMENT
--- to pick the correct field and filters the routable app list by the
--- current hostname.
---
--- Apps with null preview_domain and prod_domain remain global (backward compatible).
-
-ALTER TABLE public.apps
-  ADD COLUMN IF NOT EXISTS preview_domain text,
-  ADD COLUMN IF NOT EXISTS prod_domain text;
-
-DROP FUNCTION IF EXISTS public.get_account_apps(uuid, boolean, boolean, text[], boolean);
-
-CREATE OR REPLACE FUNCTION public.get_account_apps(
-  account_id        uuid,
-  include_system    boolean  DEFAULT true,
-  include_inactive  boolean  DEFAULT false,
-  user_role_slugs   text[]   DEFAULT NULL,
-  is_system_admin   boolean  DEFAULT false
-)
-RETURNS TABLE(
-  id                uuid,
-  slug              text,
-  name              text,
-  description       text,
-  icon              text,
-  color             text,
-  version           text,
-  app_type          text,
-  source            text,
-  owner_account_id  uuid,
-  is_active         boolean,
-  is_system         boolean,
-  min_role          text,
-  required_roles    jsonb,
-  preview_domain    text,
-  prod_domain       text,
-  config            jsonb,
-  nav_items         jsonb,
-  route_prefix      text,
-  renderer          text,
-  metadata          jsonb,
-  integration_deps  jsonb,
-  created_at        timestamptz
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-AS $$
-BEGIN
-  RETURN QUERY
-  SELECT
-    a.id,
-    a.slug,
-    a.name,
-    a.description,
-    a.icon,
-    a.color,
-    a.version,
-    a.app_type,
-    a.source,
-    a.owner_account_id,
-    a.is_active,
-    a.is_system,
-    a.min_role,
-    a.required_roles,
-    a.preview_domain,
-    a.prod_domain,
-    a.config,
-    a.nav_items,
-    a.route_prefix,
-    a.renderer,
-    a.metadata,
-    a.integration_deps,
-    a.created_at
-  FROM public.apps a
-  WHERE
-    (include_inactive OR a.is_active = true)
-    AND (
-      a.is_system = true
-      OR a.owner_account_id = get_account_apps.account_id
-      OR a.owner_account_id IS NULL
-    )
-    AND (
-      user_role_slugs IS NULL
-      OR is_system_admin
-      OR (
-        (a.required_roles IS NULL OR a.required_roles = '[]'::jsonb)
-        AND a.min_role IS NULL
-      )
-      OR (
-        a.required_roles IS NOT NULL
-        AND a.required_roles != '[]'::jsonb
-        AND EXISTS (
-          SELECT 1
-          FROM jsonb_array_elements_text(a.required_roles) AS rr(role_slug)
-          WHERE rr.role_slug = ANY(user_role_slugs)
-        )
-      )
-      OR (
-        (a.required_roles IS NULL OR a.required_roles = '[]'::jsonb)
-        AND a.min_role IS NOT NULL
-        AND a.min_role = ANY(user_role_slugs)
-      )
-    )
-  ORDER BY
-    a.is_system DESC,
-    a.app_type,
-    a.name;
-END;
-$$;

package/.framework/migrations/022_route_prefix_domain_unique.sql

@@ -1,21 +0,0 @@
--- Migration 022: Allow multiple apps to share a route_prefix when they have
--- different prod_domains (i.e. they are served from different subdomains).
---
--- Before: UNIQUE(route_prefix) WHERE is_active AND route_prefix IS NOT NULL
---   → only one app could claim "/" across the entire database
---
--- After:  UNIQUE(route_prefix, COALESCE(prod_domain, '')) WHERE is_active AND route_prefix IS NOT NULL
---   → two apps can both use "/" as long as they have different prod_domains
---   → apps with no prod_domain still get a unique slot (COALESCE maps NULL → '')
---
--- This is required to support multiple domain-scoped apps (e.g. Cortex on
--- cortex.spine-framework.com and Portal on portal.spine-framework.com) that
--- each serve from the root path "/" of their respective domains.
-
--- Drop the old single-column unique index
-DROP INDEX IF EXISTS idx_apps_route_prefix;
-
--- Create the new composite unique index
-CREATE UNIQUE INDEX IF NOT EXISTS idx_apps_route_prefix_domain
-  ON public.apps(route_prefix, COALESCE(prod_domain, ''))
-  WHERE is_active = true AND route_prefix IS NOT NULL;

package/.framework/migrations/023_match_embeddings_rpc.sql

@@ -1,78 +0,0 @@
--- Migration 023: match_embeddings RPC for vector similarity search
---
--- Provides the `match_embeddings` Postgres function used by:
---   - custom_kb-embeddings.ts (handleSearchEmbeddings)
---   - agent-runner.ts (retrieveKnowledge — after upgrade)
---
--- Requires the `vector` extension (enabled in migration 002).
--- Uses cosine distance (<=>). Returns rows ordered best-first.
-
--- ============================================
--- HNSW INDEX (idempotent)
--- ============================================
--- Create HNSW index on the embedding column for fast approximate nearest-neighbour search.
--- Skip if it already exists (Postgres 15+ supports IF NOT EXISTS for indexes).
-DO $$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_indexes
-    WHERE schemaname = 'public'
-      AND tablename  = 'embeddings'
-      AND indexname  = 'embeddings_embedding_hnsw_idx'
-  ) THEN
-    EXECUTE 'CREATE INDEX embeddings_embedding_hnsw_idx
-             ON public.embeddings
-             USING hnsw (embedding vector_cosine_ops)
-             WITH (m = 16, ef_construction = 64)';
-  END IF;
-END
-$$;
-
--- ============================================
--- match_embeddings RPC
--- ============================================
-CREATE OR REPLACE FUNCTION public.match_embeddings(
-  query_embedding     vector(1536),
-  match_count         int            DEFAULT 10,
-  filter_account_ids  uuid[]         DEFAULT NULL,
-  filter_vector_type  text           DEFAULT NULL,
-  similarity_threshold float         DEFAULT 0.15
-)
-RETURNS TABLE (
-  id              uuid,
-  document_id     text,
-  content         text,
-  metadata        jsonb,
-  account_id      uuid,
-  similarity      float
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public
-AS $$
-BEGIN
-  RETURN QUERY
-  SELECT
-    e.id,
-    e.document_id,
-    e.content,
-    e.metadata,
-    e.account_id,
-    1 - (e.embedding <=> query_embedding) AS similarity
-  FROM public.embeddings e
-  WHERE
-    -- account scope filter (NULL = no filter — platform-wide search)
-    (filter_account_ids IS NULL OR e.account_id = ANY(filter_account_ids))
-    -- vector type filter (NULL = all types)
-    AND (filter_vector_type IS NULL OR e.metadata->>'vector_type' = filter_vector_type)
-    -- similarity gate (cosine similarity = 1 - cosine distance)
-    AND (1 - (e.embedding <=> query_embedding)) >= similarity_threshold
-  ORDER BY e.embedding <=> query_embedding   -- ascending distance = descending similarity
-  LIMIT match_count;
-END;
-$$;
-
--- Grant execute to authenticated and service roles
-GRANT EXECUTE ON FUNCTION public.match_embeddings(vector, int, uuid[], text, float) TO authenticated;
-GRANT EXECUTE ON FUNCTION public.match_embeddings(vector, int, uuid[], text, float) TO service_role;
-GRANT EXECUTE ON FUNCTION public.match_embeddings(vector, int, uuid[], text, float) TO anon;

package/.framework/migrations/024_messages_account_id.sql

@@ -1,9 +0,0 @@
--- Migration 024: Add account_id to messages table
--- messages was the only runtime table missing account_id.
--- Required by admin-data's create() (which stamps account_id on all runtime records)
--- and by RLS policies that scope rows to an account.
-
-ALTER TABLE public.messages
-  ADD COLUMN IF NOT EXISTS account_id uuid REFERENCES public.accounts(id);
-
-CREATE INDEX IF NOT EXISTS idx_messages_account_id ON public.messages(account_id);