thinkwork-cli 0.12.12 → 0.12.15

package/dist/drizzle/0159_eval_scoring_version.sql

@@ -0,0 +1,46 @@
+-- Purpose: honest eval aggregation (Evaluations Trust Core U2) — errors leave
+--          the pass rate. eval_runs gains an `errored` counter plus the
+--          scoring-semantics stamps, eval_results gains an error cause subtag.
+-- Plan: docs/plans/2026-06-12-003-feat-evaluations-trust-core-plan.md (U2)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0159_eval_scoring_version.sql
+--
+-- Hand-rolled (NOT registered in meta/_journal.json — the journal snapshot
+-- stopped at 0020; repo convention is psql-applied files gated by the
+-- db:migrate-manual drift reporter).
+--
+-- All columns are additive and nullable with NO defaults — null is
+-- semantically load-bearing:
+--   * eval_runs.scoring_version NULL  => legacy run (~v1 semantics: errors
+--     fold into `failed`); never recomputed under new semantics.
+--   * eval_runs.errored NULL          => counter not produced (legacy runs).
+--   * eval_runs.summary_scoring_version NULL => summary written by
+--     pre-stamp code; read path/reconciler recompute when it diverges from
+--     the run's stamped scoring_version.
+--   * eval_results.error_cause: 'timeout' | 'throttle' | 'evaluator_error'
+--     | 'reconciler' | 'infra_other' (enum-by-comment; NULL on pass/fail
+--     rows and on pre-migration error rows).
+--
+-- creates-column: public.eval_runs.errored
+-- creates-column: public.eval_runs.scoring_version
+-- creates-column: public.eval_runs.summary_scoring_version
+-- creates-column: public.eval_results.error_cause
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+
+ALTER TABLE public.eval_runs
+  ADD COLUMN IF NOT EXISTS errored integer;
+
+ALTER TABLE public.eval_runs
+  ADD COLUMN IF NOT EXISTS scoring_version integer;
+
+ALTER TABLE public.eval_runs
+  ADD COLUMN IF NOT EXISTS summary_scoring_version integer;
+
+ALTER TABLE public.eval_results
+  ADD COLUMN IF NOT EXISTS error_cause text;
+
+COMMIT;

package/dist/drizzle/0160_compliance_event_types_plugins.sql

@@ -0,0 +1,37 @@
+-- Hand-rolled — apply manually to dev via:
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0160_compliance_event_types_plugins.sql
+--
+-- See docs/solutions/workflow-issues/manually-applied-drizzle-migrations-drift-from-dev-2026-04-21.md
+--
+-- U5 of docs/plans/2026-06-12-001-feat-application-plugins-plan.md.
+-- Extends the event_type prefix CHECK constraints on compliance.audit_outbox
+-- and compliance.audit_events to recognize the plugin.* event-type family —
+-- so plugin.installed and plugin.uninstalled (and the U6 activation events
+-- plugin.activation_granted / plugin.activation_revoked) can be inserted.
+--
+-- The new constraints are renamed *_v3 so the drift reporter at
+-- scripts/db-migrate-manual.sh can verify application (probing by name).
+-- The old *_v2 constraints are DROPped in the same transaction.
+--
+-- creates-constraint: compliance.audit_outbox.audit_outbox_event_type_prefix_v3
+-- creates-constraint: compliance.audit_events.audit_events_event_type_prefix_v3
+
+BEGIN;
+
+ALTER TABLE compliance.audit_outbox
+  DROP CONSTRAINT IF EXISTS audit_outbox_event_type_prefix_v2;
+
+ALTER TABLE compliance.audit_outbox
+  ADD CONSTRAINT audit_outbox_event_type_prefix_v3 CHECK (
+    event_type ~ '^(auth|user|agent|mcp|workspace|data|policy|approval|attachment|skill|output|plugin)\.'
+  );
+
+ALTER TABLE compliance.audit_events
+  DROP CONSTRAINT IF EXISTS audit_events_event_type_prefix_v2;
+
+ALTER TABLE compliance.audit_events
+  ADD CONSTRAINT audit_events_event_type_prefix_v3 CHECK (
+    event_type ~ '^(auth|user|agent|mcp|workspace|data|policy|approval|attachment|skill|output|plugin)\.'
+  );
+
+COMMIT;

package/dist/drizzle/0160_eval_datasets.sql

@@ -0,0 +1,75 @@
+-- Purpose: dataset substrate for Evaluations Trust Core U4 — versioned
+--          per-tenant eval datasets live in S3 (tenants/<slug>/eval-datasets/);
+--          eval_datasets is the derived write-through index and
+--          eval_test_cases gains the (dataset_id, dataset_case_id) linkage
+--          the runner will fan out from in U6. Lands inert: nothing consumes
+--          the new columns yet.
+-- Plan: docs/plans/2026-06-12-003-feat-evaluations-trust-core-plan.md (U4)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0160_eval_datasets.sql
+--
+-- Hand-rolled (NOT registered in meta/_journal.json — the journal snapshot
+-- stopped at 0020; repo convention is psql-applied files gated by the
+-- db:migrate-manual drift reporter).
+--
+-- Semantics:
+--   * eval_datasets is fully reconstructible from S3 (manifest_sha is the
+--     drift detector); rows soft-archive via archived_at — never hard
+--     delete while eval_test_cases / eval_results history references them.
+--   * eval_test_cases.dataset_id is ON DELETE NO ACTION by design: case
+--     removal is a manifest tombstone + enabled=false, never a row delete
+--     (eval_results FK the case rows for trend history).
+--   * uq_eval_test_cases_dataset_case is partial (WHERE dataset_id IS NOT
+--     NULL) so legacy rows with null linkage are unconstrained.
+--
+-- creates: public.eval_datasets
+-- creates: public.uq_eval_datasets_tenant_slug
+-- creates: public.idx_eval_datasets_tenant_created
+-- creates-constraint: public.eval_datasets.eval_datasets_tenant_id_tenants_id_fk
+-- creates-column: public.eval_test_cases.dataset_id
+-- creates-column: public.eval_test_cases.dataset_case_id
+-- creates-constraint: public.eval_test_cases.eval_test_cases_dataset_id_eval_datasets_id_fk
+-- creates: public.uq_eval_test_cases_dataset_case
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+
+CREATE TABLE IF NOT EXISTS public.eval_datasets (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  slug text NOT NULL,
+  name text,
+  kind text NOT NULL DEFAULT 'custom',
+  version integer NOT NULL DEFAULT 1,
+  manifest_sha text,
+  archived_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT eval_datasets_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_eval_datasets_tenant_slug
+  ON public.eval_datasets (tenant_id, slug);
+
+CREATE INDEX IF NOT EXISTS idx_eval_datasets_tenant_created
+  ON public.eval_datasets (tenant_id, created_at);
+
+ALTER TABLE public.eval_test_cases
+  ADD COLUMN IF NOT EXISTS dataset_id uuid
+    CONSTRAINT eval_test_cases_dataset_id_eval_datasets_id_fk
+    REFERENCES public.eval_datasets(id);
+
+ALTER TABLE public.eval_test_cases
+  ADD COLUMN IF NOT EXISTS dataset_case_id text;
+
+-- Case identity within a dataset is unique; partial so pre-dataset rows
+-- (null dataset_id) stay unconstrained.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_eval_test_cases_dataset_case
+  ON public.eval_test_cases (dataset_id, dataset_case_id)
+  WHERE dataset_id IS NOT NULL;
+
+COMMIT;

package/dist/drizzle/0160_eval_results_thread_turn.sql

@@ -0,0 +1,35 @@
+-- Purpose: eval results link to the thread turn whose stored workspace
+--   projection snapshot the test case asserted against (dynamic workspace
+--   U10, origin R17/AE5). Direct AgentCore eval sessions use synthetic
+--   session IDs that never join to thread_turns, so the linkage is an
+--   explicit nullable FK column. ON DELETE SET NULL: deleting a turn keeps
+--   the eval result row (assertion outcomes are snapshotted in
+--   eval_results.assertions) but drops the projection convenience read.
+-- Plan: docs/plans/2026-06-12-002-feat-dynamic-workspace-plan.md U10
+-- Apply manually (no CI migration runner):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0160_eval_results_thread_turn.sql
+-- creates-column: public.eval_results.thread_turn_id
+-- creates-constraint: public.eval_results.eval_results_thread_turn_id_thread_turns_id_fk
+
+\set ON_ERROR_STOP on
+
+SET lock_timeout = '5s';
+SET statement_timeout = '15min';
+
+SELECT pg_advisory_lock(hashtext('migration:0160_eval_results_thread_turn'));
+
+ALTER TABLE public.eval_results
+  ADD COLUMN IF NOT EXISTS thread_turn_id uuid;
+
+DO $$
+BEGIN
+  ALTER TABLE public.eval_results
+    ADD CONSTRAINT eval_results_thread_turn_id_thread_turns_id_fk
+    FOREIGN KEY (thread_turn_id)
+    REFERENCES public.thread_turns(id)
+    ON DELETE SET NULL;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
+
+SELECT pg_advisory_unlock(hashtext('migration:0160_eval_results_thread_turn'));

package/dist/drizzle/0161_eval_run_pinning.sql

@@ -0,0 +1,54 @@
+-- Purpose: run scope pinning (Evaluations Trust Core U6) — runs execute
+--          exactly the dataset version they were launched with. eval_runs
+--          gains the dataset linkage (dataset_id), the manifest version
+--          pinned at launch (dataset_version), and the resolved
+--          dataset_case_id scope (pinned_case_ids). Case CONTENT is not
+--          stored in the DB: launch copies each enabled case file to the
+--          run snapshot prefix tenants/<slug>/eval-datasets/.runs/<run-id>/
+--          in S3 (inside the guarded eval-datasets prefix, so the Pi-role
+--          IAM Deny and tenant teardown cover it by construction).
+-- Plan: docs/plans/2026-06-12-003-feat-evaluations-trust-core-plan.md (U6)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0161_eval_run_pinning.sql
+--
+-- Hand-rolled (NOT registered in meta/_journal.json — the journal snapshot
+-- stopped at 0020; repo convention is psql-applied files gated by the
+-- db:migrate-manual drift reporter). Requires 0160_eval_datasets.sql
+-- (the eval_datasets table this FK points at).
+--
+-- All columns are additive and nullable with NO defaults — null is
+-- semantically load-bearing:
+--   * eval_runs.dataset_id NULL       => legacy category/test-case launch
+--     (the pre-U6 path keeps working unchanged).
+--   * eval_runs.dataset_version NULL  => scope not yet pinned (the
+--     eval-runner stamps it when it captures the run snapshot, before
+--     fan-out) or a legacy launch.
+--   * eval_runs.pinned_case_ids NULL  => same. Non-null = the launch-time
+--     resolved dataset_case_ids; the reconciler reconstructs expected
+--     scope from THIS list, never the live enabled=true table filter
+--     (a case tombstoned mid-run must not wedge the run).
+--   * eval_runs.dataset_id is ON DELETE NO ACTION by design: datasets
+--     soft-archive (archived_at), never hard-delete while runs pin them.
+--
+-- creates-column: public.eval_runs.dataset_id
+-- creates-column: public.eval_runs.dataset_version
+-- creates-column: public.eval_runs.pinned_case_ids
+-- creates-constraint: public.eval_runs.eval_runs_dataset_id_eval_datasets_id_fk
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+
+ALTER TABLE public.eval_runs
+  ADD COLUMN IF NOT EXISTS dataset_id uuid
+    CONSTRAINT eval_runs_dataset_id_eval_datasets_id_fk
+    REFERENCES public.eval_datasets(id);
+
+ALTER TABLE public.eval_runs
+  ADD COLUMN IF NOT EXISTS dataset_version integer;
+
+ALTER TABLE public.eval_runs
+  ADD COLUMN IF NOT EXISTS pinned_case_ids text[];
+
+COMMIT;

package/dist/drizzle/0161_tenant_mcp_servers_plugin_source.sql

@@ -0,0 +1,62 @@
+-- Hand-rolled — apply manually to dev via:
+--   psql "$DATABASE_URL" -f packages/database-pg/drizzle/0161_tenant_mcp_servers_plugin_source.sql
+--
+-- See docs/solutions/workflow-issues/manually-applied-drizzle-migrations-drift-from-dev-2026-04-21.md
+--
+-- U10 of docs/plans/2026-06-12-001-feat-application-plugins-plan.md.
+-- Extends the tenant_mcp_servers management_source CHECK constraints
+-- (created by 0149) to recognize the 'plugin' ownership source used by the
+-- plugin engine's MCP component handler (0159 added plugin_install_id but
+-- did not relax the checks):
+--
+--   - management_source may now be 'manual' | 'managed_application' | 'plugin'
+--   - shape: plugin rows must carry plugin_install_id; managed_application
+--     rows must carry managed_application_key; manual rows carry neither
+--     ownership key. An ADOPTED Twenty row (U10 cutover) is
+--     management_source='plugin' with plugin_install_id set and its
+--     legacy managed_application_key retained — covered by the plugin arm,
+--     which does not constrain managed_application_key.
+--
+-- The new constraints are renamed *_v2 so the drift reporter at
+-- scripts/db-migrate-manual.sh can verify application (probing by name).
+-- The old constraints are DROPped in the same transaction.
+--
+-- creates-constraint: public.tenant_mcp_servers.tenant_mcp_servers_management_source_check_v2
+-- creates-constraint: public.tenant_mcp_servers.tenant_mcp_servers_managed_application_shape_check_v2
+
+\set ON_ERROR_STOP on
+
+SET lock_timeout = '5s';
+SET statement_timeout = '15min';
+
+BEGIN;
+
+SELECT pg_advisory_xact_lock(hashtext('migration:0161_tenant_mcp_servers_plugin_source'));
+
+ALTER TABLE public.tenant_mcp_servers
+  DROP CONSTRAINT IF EXISTS tenant_mcp_servers_management_source_check;
+
+ALTER TABLE public.tenant_mcp_servers
+  DROP CONSTRAINT IF EXISTS tenant_mcp_servers_management_source_check_v2;
+
+ALTER TABLE public.tenant_mcp_servers
+  ADD CONSTRAINT tenant_mcp_servers_management_source_check_v2
+  CHECK (management_source IN ('manual', 'managed_application', 'plugin'))
+  NOT VALID;
+
+ALTER TABLE public.tenant_mcp_servers
+  DROP CONSTRAINT IF EXISTS tenant_mcp_servers_managed_application_shape_check;
+
+ALTER TABLE public.tenant_mcp_servers
+  DROP CONSTRAINT IF EXISTS tenant_mcp_servers_managed_application_shape_check_v2;
+
+ALTER TABLE public.tenant_mcp_servers
+  ADD CONSTRAINT tenant_mcp_servers_managed_application_shape_check_v2
+  CHECK (
+    (management_source = 'manual' AND managed_application_key IS NULL)
+    OR (management_source = 'managed_application' AND managed_application_key IS NOT NULL)
+    OR (management_source = 'plugin' AND plugin_install_id IS NOT NULL)
+  )
+  NOT VALID;
+
+COMMIT;

package/dist/drizzle/0162_eval_result_override.sql

@@ -0,0 +1,49 @@
+-- Purpose: operator verdict override (Evaluations Trust Core U9). An
+--          operator can overturn a wrong judge verdict; the override is
+--          a SEPARATE field, never a mutation of `status` — the judge's
+--          original verdict + rendered rubric stay immutable on the row
+--          while aggregation reads the override last
+--          (effective = override_status ?? status).
+-- Plan: docs/plans/2026-06-12-003-feat-evaluations-trust-core-plan.md (U9)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0162_eval_result_override.sql
+--
+-- Hand-rolled (NOT registered in meta/_journal.json — the journal snapshot
+-- stopped at 0020; repo convention is psql-applied files gated by the
+-- db:migrate-manual drift reporter).
+--
+-- All columns are additive and nullable with NO defaults — null is
+-- semantically load-bearing:
+--   * eval_results.override_status NULL => no override; the judge's
+--     verdict stands. Non-null: 'pass' | 'fail' (enum-by-comment) —
+--     only scored rows (status pass|fail) may carry one; error rows
+--     are rejected at the mutation.
+--   * eval_results.overridden_by   => authenticated caller identity,
+--     derived server-side (never an argument).
+--   * eval_results.overridden_at   => when the override was written
+--     (last-write posture; no history table in v1).
+--   * eval_results.override_reason => required non-empty audit note.
+--
+-- creates-column: public.eval_results.override_status
+-- creates-column: public.eval_results.overridden_by
+-- creates-column: public.eval_results.overridden_at
+-- creates-column: public.eval_results.override_reason
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+
+ALTER TABLE public.eval_results
+  ADD COLUMN IF NOT EXISTS override_status text;
+
+ALTER TABLE public.eval_results
+  ADD COLUMN IF NOT EXISTS overridden_by text;
+
+ALTER TABLE public.eval_results
+  ADD COLUMN IF NOT EXISTS overridden_at timestamptz;
+
+ALTER TABLE public.eval_results
+  ADD COLUMN IF NOT EXISTS override_reason text;
+
+COMMIT;

package/dist/drizzle/0163_eval_replay_tool_allowlist.sql

@@ -0,0 +1,50 @@
+-- Purpose: per-tenant read-only MCP tool allowlist for eval replay
+--          (Evaluations Trust Core U13). Replay strips all MCP tools by
+--          default (mcp_configs undefined); this table is a DEFAULT-DENY
+--          allowlist — a tool is restored on replay ONLY if an operator
+--          explicitly lists it for the tenant. One row per
+--          (tenant_id, server_name, tool_name).
+-- Plan: docs/plans/2026-06-12-003-feat-evaluations-trust-core-plan.md (U13)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0163_eval_replay_tool_allowlist.sql
+--
+-- Hand-rolled (NOT registered in meta/_journal.json — the journal snapshot
+-- stopped at 0020; repo convention is psql-applied files gated by the
+-- db:migrate-manual drift reporter).
+--
+-- Semantics:
+--   * Default-deny: an empty allowlist for a tenant means replay carries no
+--     MCP servers (mcp_configs stays undefined — current safe behavior).
+--   * Per-tool: only the listed (server_name, tool_name) pairs become the
+--     entry's toolWhitelist on replay; mutating tools and the email/web
+--     side-effect kill-list stay blocked regardless.
+--   * Lands inert until the eval payload/worker (same PR) reads it.
+--
+-- creates: public.eval_replay_tool_allowlist
+-- creates-constraint: public.eval_replay_tool_allowlist.eval_replay_tool_allowlist_tenant_id_tenants_id_fk
+-- creates: public.uq_eval_replay_tool_allowlist_tenant_server_tool
+-- creates: public.idx_eval_replay_tool_allowlist_tenant
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+
+CREATE TABLE IF NOT EXISTS public.eval_replay_tool_allowlist (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  server_name text NOT NULL,
+  tool_name text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT eval_replay_tool_allowlist_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_eval_replay_tool_allowlist_tenant_server_tool
+  ON public.eval_replay_tool_allowlist (tenant_id, server_name, tool_name);
+
+CREATE INDEX IF NOT EXISTS idx_eval_replay_tool_allowlist_tenant
+  ON public.eval_replay_tool_allowlist (tenant_id);
+
+COMMIT;

package/dist/drizzle/0164_eval_replay_tool_override_mode.sql

@@ -0,0 +1,52 @@
+-- Purpose: turn the per-tenant eval-replay MCP tool allowlist into an
+--          OPTIONAL OVERRIDE list (Evaluations Trust Core U14). Replay now
+--          DEFAULT-ALLOWS read-shaped tools by a name heuristic and blocks
+--          write-shaped tools (classified in @thinkwork/evals-core
+--          classifyMcpToolAccess). This table stops being the gate and
+--          becomes overrides: a row force-ALLOWS a tool the heuristic would
+--          block (e.g. a trusted write) or force-BLOCKS a tool the heuristic
+--          would allow (e.g. suppress a read). The `mode` column carries
+--          which.
+-- Plan: docs/plans/2026-06-12-003-feat-evaluations-trust-core-plan.md (U14)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0164_eval_replay_tool_override_mode.sql
+--
+-- Hand-rolled (NOT registered in meta/_journal.json — the journal snapshot
+-- stopped at 0020; repo convention is psql-applied files gated by the
+-- db:migrate-manual drift reporter).
+--
+-- Semantics:
+--   * Additive, nullable-with-default: every existing 0163 row defaults to
+--     mode 'allow', which preserves its prior force-allow meaning exactly.
+--   * mode is an enum-by-comment: 'allow' (force-allow this server/tool on
+--     replay even if the heuristic blocks it) | 'block' (force-block this
+--     server/tool on replay even if the heuristic allows it).
+--   * The unique key stays (tenant_id, server_name, tool_name) — one
+--     override per tool; toggling mode UPDATEs the existing row.
+--
+-- creates-column: public.eval_replay_tool_allowlist.mode
+-- creates-constraint: public.eval_replay_tool_allowlist.eval_replay_tool_allowlist_mode_check
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+
+ALTER TABLE public.eval_replay_tool_allowlist
+  ADD COLUMN IF NOT EXISTS mode text NOT NULL DEFAULT 'allow';
+
+-- Guard the comment-enum at the DB so a stray write can't smuggle an
+-- unknown mode (the selector treats only 'allow'/'block' meaningfully).
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'eval_replay_tool_allowlist_mode_check'
+  ) THEN
+    ALTER TABLE public.eval_replay_tool_allowlist
+      ADD CONSTRAINT eval_replay_tool_allowlist_mode_check
+      CHECK (mode IN ('allow', 'block'));
+  END IF;
+END $$;
+
+COMMIT;

package/dist/drizzle/0165_plugin_premium_entitlements.sql

@@ -0,0 +1,153 @@
+-- Purpose: add generic premium plugin entitlement and one-time install-key
+--   storage for Company Brain and future premium plugins. Entitlements are
+--   persistent tenant/plugin grants independent of install state; install keys
+--   store digests only and can be redeemed once into an entitlement.
+-- Plan: docs/plans/2026-06-13-002-feat-company-brain-premium-plugin-plan.md U2
+-- Apply manually (no CI migration runner):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0165_plugin_premium_entitlements.sql
+-- Pre-flight:
+--   SELECT count(*) FROM public.tenants;
+--   SELECT count(*) FROM public.users;
+--   SELECT count(*) FROM public.plugin_installs;
+-- creates: public.plugin_entitlements
+-- creates: public.plugin_install_keys
+-- creates: public.uq_plugin_entitlements_active_tenant_plugin
+-- creates: public.idx_plugin_entitlements_tenant_plugin
+-- creates: public.idx_plugin_entitlements_product_status
+-- creates: public.uq_plugin_install_keys_digest
+-- creates: public.idx_plugin_install_keys_lookup
+-- creates: public.idx_plugin_install_keys_plugin_status
+-- creates: public.idx_plugin_install_keys_tenant_status
+-- creates-constraint: public.plugin_entitlements.plugin_entitlements_pkey
+-- creates-constraint: public.plugin_entitlements.plugin_entitlements_tenant_id_tenants_id_fk
+-- creates-constraint: public.plugin_entitlements.plugin_entitlements_granted_by_user_id_users_id_fk
+-- creates-constraint: public.plugin_entitlements.plugin_entitlements_status_allowed
+-- creates-constraint: public.plugin_entitlements.plugin_entitlements_source_allowed
+-- creates-constraint: public.plugin_install_keys.plugin_install_keys_pkey
+-- creates-constraint: public.plugin_install_keys.plugin_install_keys_tenant_id_tenants_id_fk
+-- creates-constraint: public.plugin_install_keys.plugin_install_keys_issued_by_user_id_users_id_fk
+-- creates-constraint: public.plugin_install_keys.plugin_install_keys_redeemed_by_user_id_users_id_fk
+-- creates-constraint: public.plugin_install_keys.plugin_install_keys_redeemed_tenant_id_tenants_id_fk
+-- creates-constraint: public.plugin_install_keys.plugin_install_keys_redeemed_entitlement_id_fk
+-- creates-constraint: public.plugin_install_keys.plugin_install_keys_status_allowed
+-- creates-constraint: public.plugin_install_keys.plugin_install_keys_redeemed_fields
+
+\set ON_ERROR_STOP on
+
+SET lock_timeout = '5s';
+SET statement_timeout = '15min';
+
+SELECT pg_advisory_lock(hashtext('migration:0165_plugin_premium_entitlements'));
+
+-- ---------------------------------------------------------------------------
+-- plugin_entitlements — persistent tenant premium grants
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS public.plugin_entitlements (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  plugin_key text NOT NULL,
+  entitlement_product_key text NOT NULL,
+  status text NOT NULL DEFAULT 'active',
+  source text NOT NULL,
+  granted_by_user_id uuid,
+  granted_at timestamptz NOT NULL DEFAULT now(),
+  revoked_at timestamptz,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT plugin_entitlements_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT plugin_entitlements_granted_by_user_id_users_id_fk
+    FOREIGN KEY (granted_by_user_id)
+    REFERENCES public.users(id)
+    ON DELETE SET NULL,
+  CONSTRAINT plugin_entitlements_status_allowed
+    CHECK (status IN ('active', 'revoked')),
+  CONSTRAINT plugin_entitlements_source_allowed
+    CHECK (source IN ('install_key', 'backdoor_key', 'operator_grant', 'migration'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plugin_entitlements_active_tenant_plugin
+  ON public.plugin_entitlements (tenant_id, plugin_key)
+  WHERE status = 'active';
+
+CREATE INDEX IF NOT EXISTS idx_plugin_entitlements_tenant_plugin
+  ON public.plugin_entitlements (tenant_id, plugin_key);
+
+CREATE INDEX IF NOT EXISTS idx_plugin_entitlements_product_status
+  ON public.plugin_entitlements (entitlement_product_key, status);
+
+-- ---------------------------------------------------------------------------
+-- plugin_install_keys — digest-only one-time premium install keys
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS public.plugin_install_keys (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  plugin_key text NOT NULL,
+  entitlement_product_key text NOT NULL,
+  key_digest text NOT NULL,
+  digest_algorithm text NOT NULL DEFAULT 'sha256',
+  key_secret_version text,
+  tenant_id uuid,
+  status text NOT NULL DEFAULT 'issued',
+  issued_by_user_id uuid,
+  issued_at timestamptz NOT NULL DEFAULT now(),
+  expires_at timestamptz,
+  revoked_at timestamptz,
+  redeemed_by_user_id uuid,
+  redeemed_tenant_id uuid,
+  redeemed_entitlement_id uuid,
+  redeemed_at timestamptz,
+  audit_correlation_id text,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT plugin_install_keys_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE SET NULL,
+  CONSTRAINT plugin_install_keys_issued_by_user_id_users_id_fk
+    FOREIGN KEY (issued_by_user_id)
+    REFERENCES public.users(id)
+    ON DELETE SET NULL,
+  CONSTRAINT plugin_install_keys_redeemed_by_user_id_users_id_fk
+    FOREIGN KEY (redeemed_by_user_id)
+    REFERENCES public.users(id)
+    ON DELETE SET NULL,
+  CONSTRAINT plugin_install_keys_redeemed_tenant_id_tenants_id_fk
+    FOREIGN KEY (redeemed_tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE SET NULL,
+  CONSTRAINT plugin_install_keys_redeemed_entitlement_id_fk
+    FOREIGN KEY (redeemed_entitlement_id)
+    REFERENCES public.plugin_entitlements(id)
+    ON DELETE SET NULL,
+  CONSTRAINT plugin_install_keys_status_allowed
+    CHECK (status IN ('issued', 'redeemed', 'revoked', 'expired')),
+  CONSTRAINT plugin_install_keys_redeemed_fields
+    CHECK (
+      status <> 'redeemed'
+      OR (
+        redeemed_at IS NOT NULL
+        AND redeemed_tenant_id IS NOT NULL
+        AND redeemed_entitlement_id IS NOT NULL
+      )
+    )
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plugin_install_keys_digest
+  ON public.plugin_install_keys (key_digest);
+
+CREATE INDEX IF NOT EXISTS idx_plugin_install_keys_lookup
+  ON public.plugin_install_keys (plugin_key, key_digest);
+
+CREATE INDEX IF NOT EXISTS idx_plugin_install_keys_plugin_status
+  ON public.plugin_install_keys (plugin_key, status);
+
+CREATE INDEX IF NOT EXISTS idx_plugin_install_keys_tenant_status
+  ON public.plugin_install_keys (tenant_id, status);
+
+SELECT pg_advisory_unlock(hashtext('migration:0165_plugin_premium_entitlements'));