thinkwork-cli 0.12.16 → 0.12.17

package/dist/drizzle/0219_document_section_waivers.sql

@@ -0,0 +1,29 @@
+-- THINK-183 U5: per-document section waivers (suitability waivers).
+-- A plate's section manifest can require sections; when the model cannot
+-- back one with data it waives explicitly, and the waiver is recorded here
+-- so counts and reasons are queryable per document and per plate (the
+-- THINK-189 conformance seam). Rows are rewritten per emission head
+-- (delete + reinsert). Additive — safe to apply ahead of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0219_document_section_waivers.sql
+-- creates: public.document_section_waivers
+
+CREATE TABLE IF NOT EXISTS public.document_section_waivers (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  artifact_id uuid NOT NULL REFERENCES public.artifacts(id) ON DELETE CASCADE,
+  plate_slug text NOT NULL,
+  section_id text NOT NULL,
+  tier text NOT NULL,
+  reason text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT document_section_waivers_tier_check
+    CHECK (tier IN ('required', 'required-if-material'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS document_section_waivers_artifact_section_uidx
+  ON public.document_section_waivers (artifact_id, section_id);
+
+CREATE INDEX IF NOT EXISTS document_section_waivers_tenant_plate_idx
+  ON public.document_section_waivers (tenant_id, plate_slug);

package/dist/drizzle/0220_artifacts_created_by_user.sql

@@ -0,0 +1,21 @@
+-- Artifacts carry the generating user directly: created_by_user_id is
+-- stamped at creation (source thread's owner, or the acting caller) so list
+-- surfaces resolve the User column without a thread join. Nullable: system
+-- jobs with no user context. The backfill below covers all pre-existing rows
+-- reachable through their source thread. Additive — safe to apply ahead of
+-- code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0220_artifacts_created_by_user.sql
+-- creates-column: public.artifacts.created_by_user_id
+
+ALTER TABLE public.artifacts
+  ADD COLUMN IF NOT EXISTS created_by_user_id uuid REFERENCES public.users(id);
+
+-- Backfill existing artifacts from their source thread's owner.
+UPDATE public.artifacts a
+SET created_by_user_id = t.user_id
+FROM public.threads t
+WHERE a.thread_id = t.id
+  AND a.created_by_user_id IS NULL
+  AND t.user_id IS NOT NULL;

package/dist/drizzle/0221_artifact_shares.sql

@@ -0,0 +1,29 @@
+-- THINK-208 U1: public artifact share links.
+-- One row per public "anyone with the link" grant on a document artifact.
+-- The URL token is an HMAC signature over id — no token material at rest.
+-- Revoke-only lifecycle (revoked_at flips the row dead); artifact delete
+-- cascades rows away so the link 404s. Additive — safe to apply ahead of
+-- code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0221_artifact_shares.sql
+-- creates: public.artifact_shares
+
+CREATE TABLE IF NOT EXISTS public.artifact_shares (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  artifact_id uuid NOT NULL REFERENCES public.artifacts(id) ON DELETE CASCADE,
+  created_by uuid NOT NULL REFERENCES public.users(id),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  revoked_at timestamptz,
+  revoked_by uuid REFERENCES public.users(id)
+);
+
+-- One active public link per artifact (get-or-create dedupe, R4).
+CREATE UNIQUE INDEX IF NOT EXISTS artifact_shares_active_artifact_uidx
+  ON public.artifact_shares (artifact_id)
+  WHERE revoked_at IS NULL;
+
+-- Operator tenant-wide share list.
+CREATE INDEX IF NOT EXISTS artifact_shares_tenant_created_idx
+  ON public.artifact_shares (tenant_id, created_at);

package/dist/drizzle/0221_workflow_interpreter_thin_slice.sql

@@ -0,0 +1,71 @@
+-- THINK-219 U2: workflow interpreter thin slice — additive schema room.
+-- Contents:
+--   * workflow_runs_status_check widened with 'waiting_for_human' (approval
+--     suspension state for task-token waits).
+--   * workflow_engine_bindings_type_check widened with
+--     'step_functions_interpreter' (the shared interpreter machine binding).
+--   * scheduled_jobs.workflow_id — nullable FK binding a schedule trigger to
+--     a workflow (workflow_schedule trigger type; trigger_type itself is
+--     unconstrained text, no CHECK exists for it).
+--   * workflow_task_tokens — Step Functions task-token store keyed by
+--     (run, step, iteration, purpose); tokens never travel in payloads.
+--
+-- NOT done here (deliberately): no agent_loops changes, no destructive
+-- drops, no event_type constraints (workflow_run_events.event_type stays
+-- convention-enforced text).
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0221_workflow_interpreter_thin_slice.sql
+-- creates: public.workflow_task_tokens
+-- creates-column: public.scheduled_jobs.workflow_id
+-- creates-constraint: public.workflow_runs.workflow_runs_status_check
+-- creates-constraint: public.workflow_engine_bindings.workflow_engine_bindings_type_check
+
+ALTER TABLE public.workflow_runs
+  DROP CONSTRAINT IF EXISTS workflow_runs_status_check;
+ALTER TABLE public.workflow_runs
+  ADD CONSTRAINT workflow_runs_status_check CHECK (
+    status IN (
+      'queued', 'running', 'waiting_for_human', 'succeeded', 'failed',
+      'canceled', 'timed_out', 'blocked_not_ready'
+    )
+  );
+
+ALTER TABLE public.workflow_engine_bindings
+  DROP CONSTRAINT IF EXISTS workflow_engine_bindings_type_check;
+ALTER TABLE public.workflow_engine_bindings
+  ADD CONSTRAINT workflow_engine_bindings_type_check CHECK (
+    binding_type IN (
+      'step_functions_routine', 'step_functions_interpreter', 'n8n_bridge',
+      'n8n_import', 'twenty_crm', 'connected_app', 'native'
+    )
+  );
+
+ALTER TABLE public.scheduled_jobs
+  ADD COLUMN IF NOT EXISTS workflow_id uuid REFERENCES public.workflows(id) ON DELETE CASCADE;
+
+CREATE INDEX IF NOT EXISTS idx_scheduled_jobs_workflow
+  ON public.scheduled_jobs (workflow_id);
+
+CREATE TABLE IF NOT EXISTS public.workflow_task_tokens (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  workflow_run_id uuid NOT NULL REFERENCES public.workflow_runs(id) ON DELETE CASCADE,
+  step_id text NOT NULL,
+  iteration integer NOT NULL DEFAULT 1,
+  purpose text NOT NULL,
+  token text NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  consumed_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT workflow_task_tokens_purpose_check
+    CHECK (purpose IN ('agent_step', 'approval')),
+  CONSTRAINT workflow_task_tokens_status_check
+    CHECK (status IN ('pending', 'consumed', 'expired'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS workflow_task_tokens_step_uidx
+  ON public.workflow_task_tokens (workflow_run_id, step_id, iteration, purpose);
+
+CREATE INDEX IF NOT EXISTS workflow_task_tokens_tenant_idx
+  ON public.workflow_task_tokens (tenant_id);

package/dist/drizzle/0222_compliance_drainer_select_audit_events.sql

@@ -0,0 +1,21 @@
+-- Compliance outbox drainer: grant SELECT on audit_events.
+--
+-- The drainer computes the per-tenant hash chain by reading the current
+-- chain head (`SELECT event_hash FROM compliance.audit_events WHERE
+-- tenant_id = … ORDER BY … LIMIT 1`, compliance-outbox-drainer.ts) before
+-- INSERTing the next event. 0070 granted INSERT but not SELECT, so every
+-- drain attempt fails with "permission denied for table audit_events" and
+-- the outbox backlog grows (observed on dev: all events since 2026-05-07
+-- stuck with that drainer_error). Read access to the append-only log does
+-- not weaken the immutability boundary — DELETE/TRUNCATE/UPDATE remain
+-- ungranted and the U1 triggers still apply.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0222_compliance_drainer_select_audit_events.sql
+-- creates: public._noop_marker_0222 (grants-only migration; marker view for the drift reporter)
+
+GRANT SELECT ON compliance.audit_events TO compliance_drainer;
+
+-- Drift-reporter marker: grants aren't introspectable via the reporter's
+-- object checks, so declare a tiny marker view it can verify.
+CREATE OR REPLACE VIEW public._noop_marker_0222 AS SELECT 1 AS applied;

package/dist/drizzle/0223_document_conformance_reports.sql

@@ -0,0 +1,38 @@
+-- THINK-189 U2: per-emission document conformance reports.
+-- One row per successful emission on a manifest-bearing plate: deterministic
+-- structural facts recorded at the emission seam, judge columns filled
+-- asynchronously by the conformance judge sweeper. Rows append as a corpus
+-- (never head-rewritten). Additive — safe to apply ahead of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0223_document_conformance_reports.sql
+-- creates: public.document_conformance_reports
+
+CREATE TABLE IF NOT EXISTS public.document_conformance_reports (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  artifact_id uuid NOT NULL REFERENCES public.artifacts(id) ON DELETE CASCADE,
+  plate_slug text NOT NULL,
+  document_status text NOT NULL,
+  digest_revision text NOT NULL,
+  manifest_snapshot jsonb NOT NULL,
+  sections jsonb NOT NULL,
+  analyses jsonb NOT NULL,
+  judge_status text NOT NULL DEFAULT 'pending',
+  judge_attempts integer NOT NULL DEFAULT 0,
+  judge_model text,
+  judge_findings jsonb,
+  judge_completed_at timestamptz,
+  judge_error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT document_conformance_reports_judge_status_check
+    CHECK (judge_status IN ('pending', 'complete', 'error', 'skipped'))
+);
+
+CREATE INDEX IF NOT EXISTS document_conformance_reports_tenant_plate_created_idx
+  ON public.document_conformance_reports (tenant_id, plate_slug, created_at);
+
+-- Sweeper scan: pending rows only, oldest first.
+CREATE INDEX IF NOT EXISTS document_conformance_reports_judge_pending_idx
+  ON public.document_conformance_reports (created_at)
+  WHERE judge_status = 'pending';

package/dist/drizzle/0224_artifact_refresh_state.sql

@@ -0,0 +1,11 @@
+-- THINK-155 U3: scheduled-refresh observability on document artifacts.
+-- Hand-rolled (db:generate is retired). Stamped only by the run-derived
+-- emission path: success sets last_refresh_at and clears refresh_failed_at;
+-- a failed scheduled refresh sets refresh_failed_at while the last good
+-- finalized head stays in place.
+-- creates-column: public.artifacts.last_refresh_at
+-- creates-column: public.artifacts.refresh_failed_at
+
+ALTER TABLE public.artifacts
+  ADD COLUMN IF NOT EXISTS last_refresh_at timestamptz,
+  ADD COLUMN IF NOT EXISTS refresh_failed_at timestamptz;

package/dist/drizzle/0225_think216_agent_loop_convergence.sql

@@ -0,0 +1,21 @@
+-- THINK-216: Automations (agent_loops) migrate to canonical workflows.
+-- Hand-rolled (db:generate is retired).
+--   workflows.source_agent_loop_id — idempotency + provenance link for the
+--     migration (one workflow per migrated loop; plain uuid, no FK, so the
+--     eventual agent_loops DROP needs no dependent-constraint ordering).
+--   webhooks.workflow_id — webhook rows repointed from an Automation to its
+--     workflow; the webhooks handler's `workflow` target branch starts a
+--     shared-interpreter run.
+-- creates-column: public.workflows.source_agent_loop_id
+-- creates-column: public.webhooks.workflow_id
+-- creates: public.workflows_source_agent_loop_uidx
+
+ALTER TABLE public.workflows
+  ADD COLUMN IF NOT EXISTS source_agent_loop_id uuid;
+
+CREATE UNIQUE INDEX IF NOT EXISTS workflows_source_agent_loop_uidx
+  ON public.workflows (tenant_id, source_agent_loop_id)
+  WHERE source_agent_loop_id IS NOT NULL;
+
+ALTER TABLE public.webhooks
+  ADD COLUMN IF NOT EXISTS workflow_id uuid REFERENCES public.workflows(id) ON DELETE CASCADE;

package/dist/drizzle/0226_drop_n8n_agent_step_runs.sql

@@ -0,0 +1,6 @@
+-- THINK-217/218: drop the retired n8n agent-step bridge run table. The
+-- code-removal deploy (PR #3519) landed first per the migration ordering
+-- rules; no readers or writers remain.
+-- drops: public.n8n_agent_step_runs
+
+DROP TABLE IF EXISTS public.n8n_agent_step_runs;