spine-framework 0.3.124 → 0.3.126

package/.framework/migrations/{003_system_data.sql → 003_core_system_data.sql}

@@ -1,10 +1,5 @@
--- Migration 003: System Data
--- Seeds for day-zero operation including system role, system account, spine-core app,
--- runtime types, admin app, and RPC functions.
-
--- ============================================
--- 1. SYSTEM ROLE (system_admin)
--- ============================================
+-- Spine v2 consolidated core system data
+-- System roles and essential platform records.
 
 INSERT INTO public.roles (id, slug, name, description, permissions, is_system, is_active, is_protected, app_id, account_id)
 VALUES (
@@ -19,136 +14,25 @@ VALUES (
   NULL,
   NULL
 )
-ON CONFLICT (app_id, slug) DO NOTHING;
-
--- NOTE: System account inserted after types are seeded (section 5) to satisfy FK constraint.
-
--- ============================================
--- 3. SYSTEM APP (spine-core)
--- ============================================
-
-INSERT INTO public.apps (id, slug, name, description, version, app_type, source, is_active, is_system, renderer, route_prefix)
-VALUES (
-  gen_random_uuid(),
-  'spine-core',
-  'Spine Core',
-  'Core Spine runtime - provides accounts, people, items, threads, messages, links, attachments, watchers',
-  '1.0.0',
-  'system',
-  'builtin',
-  true,
-  true,
-  'none',
-  NULL
-)
 ON CONFLICT (slug) DO NOTHING;
 
--- ============================================
--- 4. ADMIN APP
--- ============================================
-
-INSERT INTO public.apps (
-  id, slug, name, description, icon, color, version,
-  app_type, source, config, nav_items, min_role,
-  is_active, is_system, route_prefix, renderer
-)
-VALUES (
-  gen_random_uuid(),
-  'admin',
-  'Admin',
-  'Spine system administration interface',
-  'settings',
-  'slate',
-  '1.0.0',
-  'system',
-  'builtin',
-  '{}'::jsonb,
-  '[]'::jsonb,
-  'system_admin',
-  true,
-  true,
-  '/admin',
-  'custom'
-)
-ON CONFLICT (slug) DO UPDATE SET
-  route_prefix = EXCLUDED.route_prefix,
-  renderer = EXCLUDED.renderer,
-  min_role = EXCLUDED.min_role,
-  is_system = EXCLUDED.is_system,
-  app_type = EXCLUDED.app_type;
-
--- ============================================
--- 5. RUNTIME ENTITY TYPES (8 core types)
--- ============================================
-
-DO $$
-DECLARE
-  v_spine_core_app_id uuid;
-  v_system_account_id uuid;
-BEGIN
-  SELECT id INTO v_spine_core_app_id FROM public.apps WHERE slug = 'spine-core' LIMIT 1;
-  SELECT id INTO v_system_account_id FROM public.accounts WHERE slug = 'spine-system' LIMIT 1;
-
-  -- 5.1 accounts type
-  INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
-  VALUES (
-    gen_random_uuid(),
-    v_spine_core_app_id,
-    'account',
-    'account',
-    'Account',
-    'Organization or tenant account',
-    jsonb_build_object(
-      'scope', 'account',
-      'record_permissions', jsonb_build_object('system_admin', ARRAY['create', 'read', 'update', 'delete']),
-      'fields', jsonb_build_object(
-        'slug', jsonb_build_object('data_type', 'text', 'label', 'Slug', 'required', true, 'system', true, 'validation', null),
-        'display_name', jsonb_build_object('data_type', 'text', 'label', 'Display Name', 'required', true, 'system', true, 'validation', null),
-        'description', jsonb_build_object('data_type', 'textarea', 'label', 'Description', 'required', false, 'system', true, 'validation', null),
-        'is_active', jsonb_build_object('data_type', 'boolean', 'label', 'Active', 'required', true, 'system', true, 'validation', null),
-        'created_at', jsonb_build_object('data_type', 'datetime', 'label', 'Created', 'required', false, 'system', true, 'readonly', true, 'validation', null),
-        'updated_at', jsonb_build_object('data_type', 'datetime', 'label', 'Updated', 'required', false, 'system', true, 'readonly', true, 'validation', null)
-      ),
-      'views', jsonb_build_object(
-        'default_list', jsonb_build_object('type', 'list', 'display', 'table', 'label', 'Accounts',
-          'fields', jsonb_build_object(
-            'display_name', jsonb_build_object('sortable', true, 'display_type', 'text'),
-            'slug', jsonb_build_object('sortable', true, 'display_type', 'text'),
-            'is_active', jsonb_build_object('sortable', true, 'display_type', 'badge')
-          )
-        ),
-        'default_detail', jsonb_build_object('type', 'detail', 'label', 'Account',
-          'sections', jsonb_build_array(
-            jsonb_build_object('title', 'Overview', 'fields', jsonb_build_array('slug', 'display_name', 'description', 'is_active')),
-            jsonb_build_object('title', 'Metadata', 'fields', jsonb_build_array('created_at', 'updated_at'))
-          )
-        )
-      )
-    ),
-    '{}'::jsonb,
-    'pack',
-    true
-  )
-
-  ON CONFLICT (app_id, kind, slug) DO NOTHING;
-
-  -- 2. MASTER SYSTEM ACCOUNT (inserted here to satisfy FK on type_id)
-  INSERT INTO public.accounts (id, slug, display_name, description, data, is_active, design_schema, validation_schema, type_id)
-  SELECT
-    gen_random_uuid(),
-    'spine-system',
-    'Spine System',
-    'Master system account for internal Spine operations',
-    '{}'::jsonb,
-    true,
-    design_schema,
-    validation_schema,
-    id
-  FROM public.types WHERE slug = 'account' LIMIT 1
-  ON CONFLICT (slug) DO NOTHING;
+INSERT INTO public.roles (id, slug, name, description, permissions, is_system, is_active, is_protected, app_id, account_id)
+VALUES
+  (gen_random_uuid(), 'engineering',       'Engineering',       'Engineering — work tracking, delivery, quality, and code intelligence',     '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'engineering_admin', 'Engineering Admin', 'Engineering administrator with invitation and configuration privileges',    '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'product',           'Product',           'Product — discovery, prioritization, and roadmap ownership',                 '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'docs',              'Docs',              'Docs — documentation and knowledge-base authoring',                          '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'qa',                'QA',                'QA — test plans, test runs, and quality gates',                              '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'devops',            'DevOps',            'DevOps — delivery, observability, and incident response',                  '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'management',        'Management',        'Management — cross-team oversight and operational control',                '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'sales',             'Sales',             'Sales — opportunities, deals, and customer communications',                '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'csm',               'Customer Success Manager', 'CSM — account health, support, and customer success',             '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'tam',               'Technical Account Manager', 'TAM — technical account health and technical signals',            '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'support',           'Support',           'Support — tickets, community moderation, and knowledge base',             '["*"]'::jsonb, true, true, false, NULL, NULL),
+  (gen_random_uuid(), 'support_admin',     'Support Admin',     'Support administrator — can invite and manage support staff',             '["*"]'::jsonb, true, true, false, NULL, NULL)
+ON CONFLICT (slug) DO NOTHING;
 
-  -- 5.2 people type
-  INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
+    INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
   VALUES (
     gen_random_uuid(),
     v_spine_core_app_id,
@@ -194,8 +78,7 @@ BEGIN
 
   ON CONFLICT (app_id, kind, slug) DO NOTHING;
 
-  -- 5.3 items type
-  INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
+    INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
   VALUES (
     gen_random_uuid(),
     v_spine_core_app_id,
@@ -238,8 +121,7 @@ BEGIN
 
   ON CONFLICT (app_id, kind, slug) DO NOTHING;
 
-  -- 5.4 threads type
-  INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
+    INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
   VALUES (
     gen_random_uuid(),
     v_spine_core_app_id,
@@ -290,8 +172,7 @@ BEGIN
 
   ON CONFLICT (app_id, kind, slug) DO NOTHING;
 
-  -- 5.5 messages type
-  INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
+    INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
   VALUES (
     gen_random_uuid(),
     v_spine_core_app_id,
@@ -341,8 +222,7 @@ BEGIN
 
   ON CONFLICT (app_id, kind, slug) DO NOTHING;
 
-  -- 5.6 links type
-  INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
+    INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
   VALUES (
     gen_random_uuid(),
     v_spine_core_app_id,
@@ -386,8 +266,7 @@ BEGIN
 
   ON CONFLICT (app_id, kind, slug) DO NOTHING;
 
-  -- 5.7 attachments type
-  INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
+    INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
   VALUES (
     gen_random_uuid(),
     v_spine_core_app_id,
@@ -432,8 +311,7 @@ BEGIN
 
   ON CONFLICT (app_id, kind, slug) DO NOTHING;
 
-  -- 5.8 watchers type
-  INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
+    INSERT INTO public.types (id, app_id, kind, slug, name, description, design_schema, validation_schema, ownership, is_active)
   VALUES (
     gen_random_uuid(),
     v_spine_core_app_id,
@@ -478,17 +356,12 @@ BEGIN
 
   ON CONFLICT (app_id, kind, slug) DO NOTHING;
 
-  -- Update the spine-system account with the actual accounts type_id
-  UPDATE public.accounts 
+    UPDATE public.accounts 
   SET type_id = (SELECT id FROM public.types WHERE slug = 'account' AND app_id = v_spine_core_app_id LIMIT 1)
   WHERE slug = 'spine-system';
 
 END $$;
 
--- ============================================
--- 6. RPC FUNCTION: get_account_apps
--- ============================================
-
 CREATE OR REPLACE FUNCTION public.get_account_apps(
   account_id uuid,
   include_system boolean DEFAULT true,
@@ -547,4 +420,4 @@ BEGIN
     a.app_type,
     a.name;
 END;
-$function$;
+$function$;

package/.framework/migrations/004_core_rpc_and_broker.sql

@@ -0,0 +1,421 @@
+-- Spine v2 consolidated RPCs and integration broker
+-- Vector search RPC, integration broker schema, and broker RLS/policies.
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_indexes
+    WHERE schemaname = 'public'
+      AND tablename  = 'embeddings'
+      AND indexname  = 'embeddings_embedding_hnsw_idx'
+  ) THEN
+    EXECUTE 'CREATE INDEX embeddings_embedding_hnsw_idx
+             ON public.embeddings
+             USING hnsw (embedding vector_cosine_ops)
+             WITH (m = 16, ef_construction = 64)';
+  END IF;
+END
+$$;
+
+CREATE OR REPLACE FUNCTION public.match_embeddings(
+  query_embedding     vector(1536),
+  match_count         int            DEFAULT 10,
+  filter_account_ids  uuid[]         DEFAULT NULL,
+  filter_vector_type  text           DEFAULT NULL,
+  similarity_threshold float         DEFAULT 0.15
+)
+RETURNS TABLE (
+  id              uuid,
+  document_id     text,
+  content         text,
+  metadata        jsonb,
+  account_id      uuid,
+  similarity      float
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  RETURN QUERY
+  SELECT
+    e.id,
+    e.document_id,
+    e.content,
+    e.metadata,
+    e.account_id,
+    1 - (e.embedding <=> query_embedding) AS similarity
+  FROM public.embeddings e
+  WHERE
+    (filter_account_ids IS NULL OR e.account_id = ANY(filter_account_ids))
+    AND (filter_vector_type IS NULL OR e.metadata->>'vector_type' = filter_vector_type)
+    AND (1 - (e.embedding <=> query_embedding)) >= similarity_threshold
+  ORDER BY e.embedding <=> query_embedding
+  LIMIT match_count;
+END
+$$;
+
+GRANT EXECUTE ON FUNCTION public.match_embeddings(vector, int, uuid[], text, float) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.match_embeddings(vector, int, uuid[], text, float) TO service_role;
+
+CREATE OR REPLACE FUNCTION public.search_similar_embeddings(
+  p_account_id uuid,
+  p_model_id text,
+  p_query_embedding vector(1536),
+  p_limit int DEFAULT 10,
+  p_threshold float DEFAULT 0.7
+)
+RETURNS TABLE (
+  id uuid,
+  document_id text,
+  content text,
+  metadata jsonb,
+  similarity float
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  RETURN QUERY
+  SELECT
+    e.id,
+    e.document_id,
+    e.content,
+    e.metadata,
+    1 - (e.embedding <=> p_query_embedding) AS similarity
+  FROM public.embeddings e
+  WHERE
+    e.account_id = p_account_id
+    AND e.model_id = p_model_id
+    AND e.approved_at IS NOT NULL
+    AND e.revoked_at IS NULL
+    AND (1 - (e.embedding <=> p_query_embedding)) >= p_threshold
+  ORDER BY e.embedding <=> p_query_embedding
+  LIMIT p_limit;
+END
+$$;
+
+GRANT EXECUTE ON FUNCTION public.search_similar_embeddings(uuid, text, vector, int, float) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.search_similar_embeddings(uuid, text, vector, int, float) TO service_role;
+
+-- ============================================
+-- INTEGRATIONS: restore/augment columns
+-- ============================================
+
+ALTER TABLE public.integrations
+  ADD COLUMN IF NOT EXISTS slug text,
+  ADD COLUMN IF NOT EXISTS integration_type text NOT NULL DEFAULT 'webhook',
+  ADD COLUMN IF NOT EXISTS provider text,
+  ADD COLUMN IF NOT EXISTS version text,
+  ADD COLUMN IF NOT EXISTS credentials jsonb DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS is_configured boolean DEFAULT false,
+  ADD COLUMN IF NOT EXISTS created_by uuid,
+  ADD COLUMN IF NOT EXISTS ownership text DEFAULT 'tenant';
+
+COMMENT ON COLUMN public.integrations.integration_type IS 'Semantic category: webhook, oauth, api, scheduled_sync';
+COMMENT ON COLUMN public.integrations.provider IS 'Provider name: stripe, kibo, make, openai, etc.';
+COMMENT ON COLUMN public.integrations.credentials IS 'Secrets map with source/value pairs: { field: { source: value|env_var, value: string } }';
+COMMENT ON COLUMN public.integrations.is_configured IS 'True when required credentials are present';
+
+-- Replace the old unique key with one that scopes by account
+ALTER TABLE public.integrations DROP CONSTRAINT IF EXISTS integrations_app_id_slug_key;
+ALTER TABLE public.integrations ADD CONSTRAINT integrations_app_account_slug_key UNIQUE (app_id, account_id, slug);
+
+ALTER TABLE public.integrations ADD CONSTRAINT fk_integrations_created_by
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- ============================================
+-- API KEYS: restore/augment columns
+-- ============================================
+
+ALTER TABLE public.api_keys
+  ADD COLUMN IF NOT EXISTS app_id uuid,
+  ADD COLUMN IF NOT EXISTS slug text,
+  ADD COLUMN IF NOT EXISTS integration_id uuid,
+  ADD COLUMN IF NOT EXISTS key_prefix text,
+  ADD COLUMN IF NOT EXISTS key_hash text,
+  ADD COLUMN IF NOT EXISTS key_type text NOT NULL DEFAULT 'inbound',
+  ADD COLUMN IF NOT EXISTS permissions jsonb DEFAULT '[]',
+  ADD COLUMN IF NOT EXISTS scopes text[] DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS rate_limit integer DEFAULT 100,
+  ADD COLUMN IF NOT EXISTS expires_at timestamptz,
+  ADD COLUMN IF NOT EXISTS is_internal boolean DEFAULT false,
+  ADD COLUMN IF NOT EXISTS machine_type text,
+  ADD COLUMN IF NOT EXISTS created_by uuid,
+  ADD COLUMN IF NOT EXISTS ownership text DEFAULT 'tenant';
+
+COMMENT ON COLUMN public.api_keys.integration_id IS 'The integration this key is bound to';
+COMMENT ON COLUMN public.api_keys.key_prefix IS 'Plaintext first N chars used for key lookup and UI';
+COMMENT ON COLUMN public.api_keys.key_hash IS 'Salted slow hash of the full key';
+COMMENT ON COLUMN public.api_keys.key_type IS 'inbound, outbound, internal, cli';
+COMMENT ON COLUMN public.api_keys.rate_limit IS 'Requests per rate_limit_window_seconds';
+
+ALTER TABLE public.api_keys ADD CONSTRAINT fk_api_keys_integration
+  FOREIGN KEY (integration_id) REFERENCES public.integrations(id) ON DELETE CASCADE;
+ALTER TABLE public.api_keys ADD CONSTRAINT fk_api_keys_created_by
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- Unique key for key_hash (multiple NULLs allowed)
+CREATE UNIQUE INDEX IF NOT EXISTS idx_api_keys_key_hash ON public.api_keys(key_hash) WHERE key_hash IS NOT NULL;
+
+-- Scope api_keys slug by account as well
+ALTER TABLE public.api_keys DROP CONSTRAINT IF EXISTS api_keys_app_id_slug_key;
+ALTER TABLE public.api_keys ADD CONSTRAINT api_keys_app_account_slug_key UNIQUE (app_id, account_id, slug);
+
+-- ============================================
+-- API KEY USAGE LOGS
+-- ============================================
+
+CREATE TABLE IF NOT EXISTS public.api_key_usage_logs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  api_key_id uuid NOT NULL,
+  account_id uuid,
+  request_method text,
+  request_path text,
+  request_ip text,
+  user_agent text,
+  response_status integer,
+  response_size integer,
+  duration_ms integer,
+  success boolean DEFAULT true,
+  error_message text,
+  metadata jsonb DEFAULT '{}',
+  created_at timestamptz DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_api_key_usage_logs_api_key_id ON public.api_key_usage_logs(api_key_id);
+CREATE INDEX IF NOT EXISTS idx_api_key_usage_logs_created_at ON public.api_key_usage_logs(created_at);
+
+ALTER TABLE public.api_key_usage_logs ADD CONSTRAINT fk_akul_api_key
+  FOREIGN KEY (api_key_id) REFERENCES public.api_keys(id) ON DELETE CASCADE;
+ALTER TABLE public.api_key_usage_logs ADD CONSTRAINT fk_akul_account
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE SET NULL;
+
+-- ============================================
+-- WEBHOOK HANDLERS
+-- ============================================
+
+CREATE TABLE IF NOT EXISTS public.webhook_handlers (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  app_id uuid,
+  account_id uuid,
+  name text NOT NULL,
+  function_name text NOT NULL,
+  description text,
+  events text[] DEFAULT '{}',
+  is_active boolean DEFAULT true,
+  is_deleted boolean DEFAULT false,
+  deleted_at timestamptz,
+  created_at timestamptz DEFAULT now(),
+  updated_at timestamptz DEFAULT now(),
+  UNIQUE (app_id, account_id, name)
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhook_handlers_name ON public.webhook_handlers(name) WHERE is_active = true AND is_deleted = false;
+CREATE INDEX IF NOT EXISTS idx_webhook_handlers_account ON public.webhook_handlers(account_id) WHERE is_deleted = false;
+CREATE INDEX IF NOT EXISTS idx_webhook_handlers_events ON public.webhook_handlers USING GIN(events) WHERE is_active = true;
+
+ALTER TABLE public.webhook_handlers ADD CONSTRAINT fk_webhook_handlers_app
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE SET NULL;
+ALTER TABLE public.webhook_handlers ADD CONSTRAINT fk_webhook_handlers_account
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+
+COMMENT ON TABLE public.webhook_handlers IS 'Dynamic registry for webhook handlers. Custom functions self-register here to be discoverable by the integration-routes handler without static imports.';
+
+-- ============================================
+-- WEBHOOK DELIVERIES (inbound + outbound ledger)
+-- ============================================
+
+CREATE TABLE IF NOT EXISTS public.webhook_deliveries (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  app_id uuid,
+  account_id uuid,
+  direction text NOT NULL CHECK (direction IN ('inbound', 'outbound')),
+  integration_id uuid,
+  api_key_id uuid,
+  handler_name text,
+  action_slug text,
+  record_id uuid,
+  external_id text,
+  payload jsonb DEFAULT '{}',
+  status text NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'processing', 'delivered', 'failed', 'cancelled')),
+  attempt_count integer DEFAULT 0,
+  max_attempts integer DEFAULT 3,
+  next_attempt_at timestamptz,
+  last_error text,
+  response_status integer,
+  response_body jsonb,
+  duration_ms integer,
+  created_at timestamptz DEFAULT now(),
+  updated_at timestamptz DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_status_next_attempt ON public.webhook_deliveries(status, next_attempt_at);
+CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_integration_external ON public.webhook_deliveries(integration_id, external_id);
+CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_account_created ON public.webhook_deliveries(account_id, created_at);
+
+ALTER TABLE public.webhook_deliveries ADD CONSTRAINT fk_webhook_deliveries_integration
+  FOREIGN KEY (integration_id) REFERENCES public.integrations(id) ON DELETE SET NULL;
+ALTER TABLE public.webhook_deliveries ADD CONSTRAINT fk_webhook_deliveries_api_key
+  FOREIGN KEY (api_key_id) REFERENCES public.api_keys(id) ON DELETE SET NULL;
+
+COMMENT ON TABLE public.webhook_deliveries IS 'Shared delivery/retry ledger for inbound and outbound integration calls.';
+
+-- ============================================
+-- DROP UNUSED integration_routes
+-- ============================================
+
+DROP TABLE IF EXISTS public.integration_routes CASCADE;
+
+-- ============================================
+-- RLS
+-- ============================================
+
+ALTER TABLE public.integrations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.api_keys ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.api_key_usage_logs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.webhook_handlers ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.webhook_deliveries ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS integrations_access ON public.integrations;
+CREATE POLICY integrations_access ON public.integrations FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+DROP POLICY IF EXISTS api_keys_access ON public.api_keys;
+CREATE POLICY api_keys_access ON public.api_keys FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+DROP POLICY IF EXISTS akul_access ON public.api_key_usage_logs;
+CREATE POLICY akul_access ON public.api_key_usage_logs FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+DROP POLICY IF EXISTS webhook_handlers_access ON public.webhook_handlers;
+CREATE POLICY webhook_handlers_access ON public.webhook_handlers FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+DROP POLICY IF EXISTS webhook_deliveries_access ON public.webhook_deliveries;
+CREATE POLICY webhook_deliveries_access ON public.webhook_deliveries FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- Service role bypass for all broker tables
+DROP POLICY IF EXISTS integrations_service_role ON public.integrations;
+CREATE POLICY integrations_service_role ON public.integrations FOR ALL TO service_role USING (true) WITH CHECK (true);
+
+DROP POLICY IF EXISTS api_keys_service_role ON public.api_keys;
+CREATE POLICY api_keys_service_role ON public.api_keys FOR ALL TO service_role USING (true) WITH CHECK (true);
+
+DROP POLICY IF EXISTS akul_service_role ON public.api_key_usage_logs;
+CREATE POLICY akul_service_role ON public.api_key_usage_logs FOR ALL TO service_role USING (true) WITH CHECK (true);
+
+DROP POLICY IF EXISTS webhook_handlers_service_role ON public.webhook_handlers;
+CREATE POLICY webhook_handlers_service_role ON public.webhook_handlers FOR ALL TO service_role USING (true) WITH CHECK (true);
+
+DROP POLICY IF EXISTS webhook_deliveries_service_role ON public.webhook_deliveries;
+CREATE POLICY webhook_deliveries_service_role ON public.webhook_deliveries FOR ALL TO service_role USING (true) WITH CHECK (true);
+
+-- ============================================
+-- updated_at triggers
+-- ============================================
+
+CREATE OR REPLACE FUNCTION public.set_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS set_updated_at_integrations ON public.integrations;
+CREATE TRIGGER set_updated_at_integrations
+  BEFORE UPDATE ON public.integrations
+  FOR EACH ROW EXECUTE FUNCTION public.set_updated_at();
+
+DROP TRIGGER IF EXISTS set_updated_at_api_keys ON public.api_keys;
+CREATE TRIGGER set_updated_at_api_keys
+  BEFORE UPDATE ON public.api_keys
+  FOR EACH ROW EXECUTE FUNCTION public.set_updated_at();
+
+DROP TRIGGER IF EXISTS set_updated_at_webhook_handlers ON public.webhook_handlers;
+CREATE TRIGGER set_updated_at_webhook_handlers
+  BEFORE UPDATE ON public.webhook_handlers
+  FOR EACH ROW EXECUTE FUNCTION public.set_updated_at();
+
+DROP TRIGGER IF EXISTS set_updated_at_webhook_deliveries ON public.webhook_deliveries;
+CREATE TRIGGER set_updated_at_webhook_deliveries
+  BEFORE UPDATE ON public.webhook_deliveries
+  FOR EACH ROW EXECUTE FUNCTION public.set_updated_at();
+
+-- ============================================
+-- SEED: webhook_event type, openai integration, generic handler
+-- ============================================
+
+INSERT INTO public.types (
+  app_id, kind, slug, name, description, icon, color,
+  design_schema, validation_schema, ownership, is_active
+)
+VALUES (
+  NULL,
+  'item',
+  'webhook_event',
+  'Webhook Event',
+  'Raw or normalized inbound webhook payload captured by the generic adapter for debugging.',
+  'radio-receiver',
+  '#6366F1',
+  '{"scope":"account","fields":{"provider":{"data_type":"text","label":"Provider","required":false,"system":false},"event":{"data_type":"text","label":"Event","required":false,"system":false},"payload":{"data_type":"json","label":"Payload","required":true,"system":false},"headers":{"data_type":"json","label":"Headers","required":false,"system":false}},"views":{"default_list":{"type":"list","display":"table","label":"Webhook Events","fields":{"provider":{"display_type":"text"},"event":{"display_type":"text"},"created_at":{"display_type":"timestamp"}},"default_sort":{"field":"created_at","direction":"desc"}},"default_detail":{"type":"detail","label":"Webhook Event","sections":[{"title":"Payload","fields":{"provider":{"display_type":"input"},"event":{"display_type":"input"},"payload":{"display_type":"textarea"},"headers":{"display_type":"textarea"}}}]},"record_permissions":{"system-admin":["create","read","update","delete"]},"functionality":null}',
+  '{}',
+  'system',
+  true
+)
+ON CONFLICT (app_id, kind, slug) DO NOTHING;
+
+INSERT INTO public.integrations (
+  app_id, account_id, slug, name, description,
+  integration_type, provider, version, config, credentials,
+  is_active, is_system, is_configured, ownership
+)
+VALUES (
+  NULL, NULL, 'openai', 'OpenAI', 'System OpenAI integration for AI agent and embedding calls.', 'api', 'openai', 'v1',
+  '{"base_url":"https://api.openai.com/v1","outbound_adapter":"adapters/openai-outbound","models":{"chat":"gpt-4o-mini","embedding":"text-embedding-3-small"}}',
+  '{"api_token":{"source":"env_var","value":"OPENAI_API_KEY"}}',
+  true, true, true, 'system'
+)
+ON CONFLICT (app_id, account_id, slug) DO NOTHING;
+
+INSERT INTO public.webhook_handlers (
+  app_id, account_id, name, function_name, description, events, is_active
+)
+VALUES (
+  NULL, NULL, 'generic-webhook', 'adapters/generic-webhook-inbound',
+  'Generic pass-through adapter that stores the raw webhook payload as a webhook_event item.',
+  '{}', true
+)
+ON CONFLICT (app_id, account_id, name) DO NOTHING;
+
+INSERT INTO public.webhook_handlers (
+  app_id, account_id, name, function_name, description, events, is_active
+)
+VALUES (
+  NULL, NULL, 'portal-signals', 'custom/apps/portal/functions/custom_portal-signals',
+  'Portal funnel signal adapter that transforms portal engagement payloads into funnel_signal records.',
+  '{"funnel.signal"}', true
+)
+ON CONFLICT (app_id, account_id, name) DO NOTHING;
+
+INSERT INTO public.integrations (
+  app_id, account_id, slug, name, description,
+  integration_type, provider, version, config, credentials,
+  is_active, is_system, is_configured, ownership
+)
+VALUES (
+  NULL, NULL, 'generic-http', 'Generic HTTP Webhook', 'System generic outbound webhook for pipeline webhook stages.', 'api', 'generic', 'v1',
+  '{"outbound_adapter":"adapters/generic-webhook-outbound"}',
+  '{"api_token":{"source":"value","value":""}}',
+  true, true, true, 'system'
+)
+ON CONFLICT (app_id, account_id, slug) DO NOTHING;