codexLB-up 1.25.0b10__py3-none-any.whl

app/db/alembic/versions/20260911_030000_add_local_login_policy.py

@@ -0,0 +1,48 @@
+"""Add dashboard_settings.local_login_policy (PLAN §4.6: who may use the local password form).
+
+Revision ID: 20260911_030000_add_local_login_policy
+Revises: 20260911_020000_add_http_bridge_terminal_append_phase
+Create Date: 2026-09-10
+
+String, NOT NULL, server default ``enabled``: an upgraded install keeps
+today's behaviour (every active account holding a password may sign in) until
+an operator tightens the policy from the Settings page. No data backfill, and
+deliberately no environment variable.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260911_030000_add_local_login_policy"
+down_revision = "20260911_020000_add_http_bridge_terminal_append_phase"
+branch_labels = None
+depends_on = None
+
+_TABLE = "dashboard_settings"
+_COLUMN = "local_login_policy"
+_DEFAULT = "enabled"
+
+
+def _columns(connection: Connection) -> set[str]:
+    if not sa.inspect(connection).has_table(_TABLE):
+        return set()
+    return {column["name"] for column in sa.inspect(connection).get_columns(_TABLE)}
+
+
+def upgrade() -> None:
+    columns = _columns(op.get_bind())
+    if columns and _COLUMN not in columns:
+        with op.batch_alter_table(_TABLE) as batch_op:
+            batch_op.add_column(
+                sa.Column(_COLUMN, sa.String(length=32), server_default=sa.text(f"'{_DEFAULT}'"), nullable=False)
+            )
+
+
+def downgrade() -> None:
+    columns = _columns(op.get_bind())
+    if columns and _COLUMN in columns:
+        with op.batch_alter_table(_TABLE) as batch_op:
+            batch_op.drop_column(_COLUMN)

app/db/alembic/versions/20260911_040000_add_thread_cache_identity_mode.py

@@ -0,0 +1,48 @@
+"""Add the thread cache identity mode setting and its per-API-key override.
+
+Revision ID: 20260911_010000_add_thread_cache_identity_mode
+Revises: 20260911_010000_merge_pin_index_and_affinity_heads
+Create Date: 2026-09-11 01:00:00.000000
+
+Both columns are nullable and are created without a server default, so an
+upgrade introduces no decision: NULL on ``dashboard_settings`` inherits the
+environment value and then the ``shared`` code default, and NULL on
+``api_keys`` means "follow the fleet". ``shared`` reproduces today's outbound
+bytes exactly, so an upgraded install behaves identically until an operator
+sets a value.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260911_040000_add_thread_cache_identity_mode"
+down_revision = "20260911_030000_add_local_login_policy"
+branch_labels = None
+depends_on = None
+
+
+def _has_column(table_name: str, column_name: str) -> bool:
+    inspector = sa.inspect(op.get_bind())
+    return column_name in {column["name"] for column in inspector.get_columns(table_name)}
+
+
+def upgrade() -> None:
+    if not _has_column("dashboard_settings", "thread_cache_identity_mode"):
+        op.add_column(
+            "dashboard_settings",
+            sa.Column("thread_cache_identity_mode", sa.String(), nullable=True),
+        )
+    if not _has_column("api_keys", "thread_cache_identity_override"):
+        op.add_column(
+            "api_keys",
+            sa.Column("thread_cache_identity_override", sa.String(), nullable=True),
+        )
+
+
+def downgrade() -> None:
+    if _has_column("api_keys", "thread_cache_identity_override"):
+        op.drop_column("api_keys", "thread_cache_identity_override")
+    if _has_column("dashboard_settings", "thread_cache_identity_mode"):
+        op.drop_column("dashboard_settings", "thread_cache_identity_mode")

app/db/alembic/versions/20260911_060000_add_bridge_session_continuity_abandonment.py

@@ -0,0 +1,40 @@
+"""Add continuity-abandonment markers to durable HTTP bridge sessions.
+
+Revision ID: 20260911_060000_add_bridge_session_continuity_abandonment
+Revises: 20260911_030000_add_local_login_policy
+Create Date: 2026-09-11
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260911_060000_add_bridge_session_continuity_abandonment"
+down_revision = "20260911_030000_add_local_login_policy"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Mirrors sticky_sessions' pair exactly: a scope-only marker is the new
+    # reader's tombstone, while a timestamp with NULL scope abandons globally.
+    # Both stay NULL on every existing row, so a rolling deploy keeps treating
+    # account_id as hard ownership until a writer retires a specific owner.
+    bind = op.get_bind()
+    columns = {column["name"] for column in sa.inspect(bind).get_columns("http_bridge_sessions")}
+    with op.batch_alter_table("http_bridge_sessions") as batch_op:
+        if "continuity_abandoned_at" not in columns:
+            batch_op.add_column(sa.Column("continuity_abandoned_at", sa.DateTime(timezone=True), nullable=True))
+        if "continuity_abandonment_scope" not in columns:
+            batch_op.add_column(sa.Column("continuity_abandonment_scope", sa.String(32), nullable=True))
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    columns = {column["name"] for column in sa.inspect(bind).get_columns("http_bridge_sessions")}
+    with op.batch_alter_table("http_bridge_sessions") as batch_op:
+        if "continuity_abandonment_scope" in columns:
+            batch_op.drop_column("continuity_abandonment_scope")
+        if "continuity_abandoned_at" in columns:
+            batch_op.drop_column("continuity_abandoned_at")

app/db/alembic/versions/20260912_000000_merge_thread_cache_and_bridge_retirement_heads.py

@@ -0,0 +1,22 @@
+"""Merge the thread-cache identity and bridge owner-retirement histories.
+
+Both revisions chained onto ``20260911_030000_add_local_login_policy`` and
+merged within minutes of each other, forking the graph. Neither is wrong on
+its own, so converge them rather than re-chaining either.
+"""
+
+revision = "20260912_000000_merge_thread_cache_and_bridge_retirement_heads"
+down_revision = (
+    "20260911_040000_add_thread_cache_identity_mode",
+    "20260911_060000_add_bridge_session_continuity_abandonment",
+)
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

app/db/alembic/versions/20260912_010000_drop_legacy_dashboard_credentials.py

@@ -0,0 +1,140 @@
+"""Drop the legacy dashboard credential columns from ``dashboard_settings``.
+
+Revision ID: 20260912_010000_drop_legacy_dashboard_credentials
+Revises: 20260912_000000_merge_thread_cache_and_bridge_retirement_heads
+Create Date: 2026-09-12
+
+``dashboard_users`` has been the only authority for dashboard credentials since
+``20260909_020000_reproject_compat_admin_credentials`` copied the legacy values
+onto the account row; the three columns below were kept one release longer as a
+write-only projection so a replica of the previous release kept working. That
+projection is removed in this release, so the columns are now an unowned copy of
+a live password hash and an encrypted TOTP secret that no code path clears or
+rotates -- which is why they go in the same change.
+
+**This upgrade is not rolling-safe.** Every replica of an earlier release maps
+these columns and loads the settings row as a whole entity, so its settings
+reads (and, on release N, its credential mirror) fail the moment the columns are
+gone. Old replicas must be stopped before this runs, and ``run_upgrade`` says so
+out loud once. It refuses nothing: this revision descends from the reprojection,
+so a database stamped at any older revision re-projects and only then drops, in
+one command.
+
+The downgrade re-creates the columns and re-projects them from the account row
+carrying the deterministic compat id -- by id, because after this release the
+bootstrap account's *name* is no longer a stable way to find it.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260912_010000_drop_legacy_dashboard_credentials"
+down_revision = "20260912_000000_merge_thread_cache_and_bridge_retirement_heads"
+branch_labels = None
+depends_on = None
+
+_TABLE = "dashboard_settings"
+_USERS_TABLE = "dashboard_users"
+_SENTINELS_TABLE = "runtime_sentinels"
+
+#: Durable "the legacy credential layer is retired" marker, read by
+#: ``app.db.migrate.run_upgrade`` (which freezes the same literal, because
+#: neither side may import the other).
+#:
+#: The ledger cannot carry this, because the ledger is the thing that goes
+#: wrong: a database whose ledger was lost or rewound has the chain replayed
+#: over it, which re-creates these three columns *empty* a few revisions before
+#: dropping them again -- and the one-shot re-projection in between reads that
+#: emptiness as "the password was removed" and clears the account row, which by
+#: then holds the only credential the install has. A guard inside that
+#: re-projection cannot help: it is a published revision, so an install that
+#: already applied it never applies it again, and editing it would give one
+#: revision id two histories. ``run_upgrade`` sees the marker first and stamps
+#: the ledger at this revision instead of replaying over the schema. Only this
+#: revision writes the marker and only its downgrade removes it, so the marker
+#: means these columns are gone whatever the ledger claims.
+_RETIRED_SENTINEL = "dashboard_legacy_credentials_retired"
+
+#: Frozen copy of the runtime identifier (see 20260909_010000): a migration must
+#: not import transient application modules.
+COMPAT_ADMIN_USER_ID = "7a4fc02d-216e-5be7-b974-bc437f23df60"
+
+#: The three the projection wrote, and the only three that go. The guest
+#: credential, both bootstrap-token columns, both TOTP requirement flags and
+#: ``local_login_policy`` are live and stay.
+_DROPPED_COLUMN_NAMES: tuple[str, ...] = (
+    "password_hash",
+    "totp_secret_encrypted",
+    "totp_last_verified_step",
+)
+
+
+def _columns(connection: Connection, table: str) -> set[str]:
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(table):
+        return set()
+    return {column["name"] for column in inspector.get_columns(table)}
+
+
+def _set_retired_marker(bind: Connection, *, retired: bool) -> None:
+    if not sa.inspect(bind).has_table(_SENTINELS_TABLE):
+        return
+    bind.execute(sa.text(f"DELETE FROM {_SENTINELS_TABLE} WHERE name = :name"), {"name": _RETIRED_SENTINEL})
+    if retired:
+        bind.execute(
+            sa.text(f"INSERT INTO {_SENTINELS_TABLE} (name, value) VALUES (:name, :value)"),
+            {"name": _RETIRED_SENTINEL, "value": revision},
+        )
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    present = _columns(bind, _TABLE)
+    doomed = [name for name in _DROPPED_COLUMN_NAMES if name in present]
+    if doomed:
+        with op.batch_alter_table(_TABLE) as batch_op:
+            for name in doomed:
+                batch_op.drop_column(name)
+    _set_retired_marker(bind, retired=True)
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    _set_retired_marker(bind, retired=False)
+    present = _columns(bind, _TABLE)
+    if present and not {*_DROPPED_COLUMN_NAMES} <= present:
+        with op.batch_alter_table(_TABLE) as batch_op:
+            if "password_hash" not in present:
+                batch_op.add_column(sa.Column("password_hash", sa.Text(), nullable=True))
+            if "totp_secret_encrypted" not in present:
+                batch_op.add_column(sa.Column("totp_secret_encrypted", sa.LargeBinary(), nullable=True))
+            if "totp_last_verified_step" not in present:
+                batch_op.add_column(sa.Column("totp_last_verified_step", sa.Integer(), nullable=True))
+
+    if not _columns(bind, _TABLE) or not _columns(bind, _USERS_TABLE):
+        return
+    account = bind.execute(
+        sa.text(
+            f"SELECT password_hash, totp_secret_encrypted, totp_last_verified_step FROM {_USERS_TABLE} WHERE id = :id"
+        ),
+        {"id": COMPAT_ADMIN_USER_ID},
+    ).first()
+    if account is None:
+        # Nothing deterministic to project from (the account was deleted, or
+        # this install never bootstrapped one): leave the columns NULL.
+        return
+    bind.execute(
+        sa.text(
+            f"UPDATE {_TABLE} SET password_hash = :password_hash, "
+            "totp_secret_encrypted = :totp_secret_encrypted, "
+            "totp_last_verified_step = :totp_last_verified_step WHERE id = 1"
+        ),
+        {
+            "password_hash": account[0],
+            "totp_secret_encrypted": account[1],
+            "totp_last_verified_step": account[2],
+        },
+    )

app/db/alembic/versions/20260913_000000_add_oidc_provider_flow.py

@@ -0,0 +1,134 @@
+"""Add the OIDC login-flow table, the provider's test-login proof and its seeded row.
+
+Revision ID: 20260913_000000_add_oidc_provider_flow
+Revises: 20260912_010000_drop_legacy_dashboard_credentials
+Create Date: 2026-09-13
+
+The connection settings themselves need no column: ``config_encrypted`` was
+reserved for them when the providers table landed. What is new is durable
+*flow* state -- the callback lands on whichever replica the load balancer picks,
+so the state, the nonce hash and the PKCE verifier cannot live in memory -- and
+the two columns that record an admin's pre-flight test login.
+
+The ``oidc/default`` row is seeded disabled with no role for an unmatched
+identity, through the same insert-ignore helper the other built-in rows use, so
+an install that never connects an identity provider is unchanged and a
+connected one denies unknown identities until an operator says otherwise.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+from app.modules.auth_providers.seed import seed_default_auth_providers
+
+revision = "20260913_000000_add_oidc_provider_flow"
+down_revision = "20260912_010000_drop_legacy_dashboard_credentials"
+branch_labels = None
+depends_on = None
+
+_PROVIDERS = "dashboard_auth_providers"
+_FLOWS = "dashboard_oidc_login_flows"
+_FLOWS_INDEX = "idx_dashboard_oidc_login_flows_expires_at"
+_PROOF_COLUMNS: tuple[str, ...] = ("test_login_user_id", "test_login_verified_at")
+_PROOF_FK = "fk_dashboard_auth_providers_test_login_user_id"
+
+
+def _provider_columns() -> tuple[sa.Column, ...]:
+    """Fresh Column objects per call: a Column may be bound to one table only."""
+
+    return (
+        sa.Column("id", sa.String(length=36), primary_key=True),
+        sa.Column("kind", sa.String(length=32), nullable=False),
+        sa.Column("provider_key", sa.String(length=64), nullable=False),
+        sa.Column("enabled", sa.Boolean(), server_default=sa.true(), nullable=False),
+        sa.Column("label", sa.String(length=64), nullable=False),
+        sa.Column("config_encrypted", sa.LargeBinary(), nullable=True),
+        sa.Column("unknown_identity_role_id", sa.String(length=36), nullable=True),
+        sa.Column("no_match_role_id", sa.String(length=36), nullable=True),
+        sa.Column("link_by_email", sa.Boolean(), server_default=sa.false(), nullable=False),
+        sa.Column("skip_role_sync", sa.Boolean(), server_default=sa.false(), nullable=False),
+        sa.Column("idp_mfa_enforced", sa.Boolean(), server_default=sa.false(), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+
+
+def _seed_table() -> sa.Table:
+    """Revision-pinned column list for the seed INSERT (no constraints needed to insert)."""
+
+    return sa.Table(_PROVIDERS, sa.MetaData(), *_provider_columns())
+
+
+def _proof_columns() -> tuple[sa.Column, ...]:
+    """Fresh Column objects per call: a Column may be bound to one table only."""
+
+    return (
+        sa.Column(
+            "test_login_user_id",
+            sa.String(length=36),
+            # Named because SQLite's batch mode rebuilds the table and refuses
+            # to re-add an anonymous constraint.
+            sa.ForeignKey("dashboard_users.id", ondelete="SET NULL", name=_PROOF_FK),
+            nullable=True,
+        ),
+        sa.Column("test_login_verified_at", sa.DateTime(timezone=True), nullable=True),
+    )
+
+
+def _existing_columns(inspector: sa.Inspector, table: str) -> set[str]:
+    if not inspector.has_table(table):
+        return set()
+    return {column["name"] for column in inspector.get_columns(table)}
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+
+    existing = _existing_columns(inspector, _PROVIDERS)
+    missing = [column for column in _proof_columns() if column.name not in existing]
+    if missing:
+        with op.batch_alter_table(_PROVIDERS) as batch_op:
+            for column in missing:
+                batch_op.add_column(column)
+
+    if not inspector.has_table(_FLOWS):
+        # Constraints are declared inline: SQLite cannot add them afterwards.
+        op.create_table(
+            _FLOWS,
+            sa.Column("state_hash", sa.String(length=64), primary_key=True),
+            sa.Column("provider_id", sa.String(length=36), nullable=False),
+            sa.Column("nonce_hash", sa.String(length=64), nullable=False),
+            sa.Column("code_verifier_encrypted", sa.LargeBinary(), nullable=False),
+            sa.Column("purpose", sa.String(length=16), nullable=False),
+            sa.Column("acting_user_id", sa.String(length=36), nullable=True),
+            sa.Column("redirect_uri", sa.String(length=512), nullable=False),
+            # The connection document this flow was started against, so a
+            # completed pre-flight can only stamp the configuration it proved.
+            sa.Column("config_fingerprint", sa.String(length=64), nullable=False),
+            sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+            sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+            sa.ForeignKeyConstraint(["provider_id"], [f"{_PROVIDERS}.id"], ondelete="CASCADE"),
+            sa.ForeignKeyConstraint(["acting_user_id"], ["dashboard_users.id"], ondelete="CASCADE"),
+        )
+        op.create_index(_FLOWS_INDEX, _FLOWS, ["expires_at"])
+
+    # Outside the guards so a re-run after a partial failure still seeds, and
+    # insert-ignore so an operator's configuration survives the upgrade.
+    if inspector.has_table(_PROVIDERS):
+        seed_default_auth_providers(bind, _seed_table())
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if inspector.has_table(_FLOWS):
+        op.drop_table(_FLOWS)
+    present = _existing_columns(inspector, _PROVIDERS)
+    to_drop = [name for name in _PROOF_COLUMNS if name in present]
+    if to_drop:
+        with op.batch_alter_table(_PROVIDERS) as batch_op:
+            for name in to_drop:
+                batch_op.drop_column(name)

app/db/alembic/versions/20260914_000000_add_scim_tokens.py

@@ -0,0 +1,78 @@
+"""Add the SCIM bearer-token table and the identity's pushed user name.
+
+Revision ID: 20260914_000000_add_scim_tokens
+Revises: 20260913_000000_add_oidc_provider_flow
+Create Date: 2026-09-14
+
+``dashboard_scim_tokens`` holds only the SHA-256 digest of each secret, in a
+unique index, so verification is an index equality and no readable copy of the
+credential survives the response that issued it. ``provider_key`` is the
+identity namespace the token owns; it is read from the row on every request and
+never from the caller.
+
+``dashboard_identities.user_name`` is nullable and written only by the SCIM
+path: our usernames are slugs without ``@``, so a ``userName eq`` filter on the
+identity provider's own spelling can never match one, and an identity provider
+reconciling the resources it created would otherwise find none of them.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "20260914_000000_add_scim_tokens"
+down_revision = "20260913_000000_add_oidc_provider_flow"
+branch_labels = None
+depends_on = None
+
+_TOKENS = "dashboard_scim_tokens"
+_IDENTITIES = "dashboard_identities"
+_USER_NAME_COLUMN = "user_name"
+_CREATED_BY_FK = "fk_dashboard_scim_tokens_created_by_user_id"
+
+
+def _existing_columns(inspector: sa.Inspector, table: str) -> set[str]:
+    if not inspector.has_table(table):
+        return set()
+    return {column["name"] for column in inspector.get_columns(table)}
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+
+    if not inspector.has_table(_TOKENS):
+        # Constraints are declared inline: SQLite cannot add them afterwards.
+        op.create_table(
+            _TOKENS,
+            sa.Column("id", sa.String(length=36), primary_key=True),
+            sa.Column("label", sa.String(length=64), nullable=False),
+            sa.Column("token_hash", sa.String(length=64), nullable=False, unique=True),
+            sa.Column("token_prefix", sa.String(length=32), nullable=False),
+            sa.Column("provider_key", sa.String(length=128), nullable=False),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("created_by_user_id", sa.String(length=36), nullable=True),
+            sa.Column("last_used_at", sa.DateTime(timezone=True), nullable=True),
+            sa.Column("rotated_at", sa.DateTime(timezone=True), nullable=True),
+            sa.ForeignKeyConstraint(
+                ["created_by_user_id"],
+                ["dashboard_users.id"],
+                ondelete="SET NULL",
+                name=_CREATED_BY_FK,
+            ),
+        )
+
+    if _USER_NAME_COLUMN not in _existing_columns(inspector, _IDENTITIES):
+        with op.batch_alter_table(_IDENTITIES) as batch_op:
+            batch_op.add_column(sa.Column(_USER_NAME_COLUMN, sa.String(length=256), nullable=True))
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if _USER_NAME_COLUMN in _existing_columns(inspector, _IDENTITIES):
+        with op.batch_alter_table(_IDENTITIES) as batch_op:
+            batch_op.drop_column(_USER_NAME_COLUMN)
+    if inspector.has_table(_TOKENS):
+        op.drop_table(_TOKENS)

app/db/alembic/versions/20260914_000000_drop_subscription_overflow_schema.py

@@ -0,0 +1,132 @@
+"""Drop the subscription-exhaustion overflow schema.
+
+The feature was withdrawn (#2123): a 60-body capture sweep of real Codex
+traffic found nothing the portability predicate would ever pass, and making it
+pass would mean translating request bodies per provider. The code went in the
+preceding revert; this revision takes the storage with it.
+
+Production never wrote a row -- ``model_source_pins`` was empty, both
+``dashboard_settings`` columns were NULL -- so the upgrade cannot lose data.
+Every step is guarded so a database missing either object (a partial dump, a
+fresh install created from current metadata) upgrades cleanly. The downgrade
+restores exactly what ``20260908_000000_add_subscription_overflow`` and
+``20260911_000000_model_source_pins_kind_expires_index`` built, so the pair
+round-trips.
+
+**This upgrade is not rolling-safe.** Every release below this one maps both
+``dashboard_settings`` columns and loads the settings row as a whole entity, so
+its settings reads fail the moment the columns are gone -- and the chart's
+migration Job is a ``pre-upgrade`` hook, which runs before the new pods roll and
+therefore before the old ones drain. Pre-withdrawal replicas must be stopped
+before this runs; ``docs/deployment/kubernetes.md`` carries the procedure. It
+refuses nothing, and unlike ``20260912_010000_drop_legacy_dashboard_credentials``
+it says nothing either: that revision's pre-DDL drain warning in
+``app/db/migrate.py`` is written around the credential columns it protects.
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.engine import Connection
+
+revision = "20260914_000000_drop_subscription_overflow_schema"
+down_revision = "20260913_000000_add_oidc_provider_flow"
+branch_labels = None
+depends_on = None
+
+_SETTINGS_TABLE = "dashboard_settings"
+_PINS_TABLE = "model_source_pins"
+_PURGE_INDEX = "ix_model_source_pins_purge_at"
+_KIND_EXPIRES_INDEX = "ix_model_source_pins_kind_expires_at"
+
+
+def _settings_columns() -> tuple[sa.Column, ...]:
+    # Fresh Column objects per call: a Column binds to the table it is added
+    # to, so module-level instances could not be reused across one process.
+    return (
+        sa.Column("subscription_overflow_source_id", sa.String(), nullable=True),
+        sa.Column("subscription_overflow_drain_until", sa.DateTime(), nullable=True),
+    )
+
+
+def _column_names(connection: Connection, table_name: str) -> set[str]:
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(table_name):
+        return set()
+    return {str(column["name"]) for column in inspector.get_columns(table_name) if column.get("name") is not None}
+
+
+def _index_names(connection: Connection, table_name: str) -> set[str]:
+    # A fresh inspector per call, because the caller may have created the table
+    # after an earlier reflection filled another inspector's cache.
+    inspector = sa.inspect(connection)
+    if not inspector.has_table(table_name):
+        return set()
+    return {str(index["name"]) for index in inspector.get_indexes(table_name) if index.get("name") is not None}
+
+
+def _add_columns(names: Sequence[sa.Column]) -> None:
+    with op.batch_alter_table(_SETTINGS_TABLE) as batch_op:
+        for column in names:
+            batch_op.add_column(column)
+
+
+def _drop_columns(names: Sequence[str]) -> None:
+    with op.batch_alter_table(_SETTINGS_TABLE) as batch_op:
+        for column_name in names:
+            batch_op.drop_column(column_name)
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+
+    # DROP TABLE takes both indexes with it, so they need no separate step --
+    # and dropping them first would only widen the window where the table is
+    # unindexed. The table is empty, so the exclusive lock is instant.
+    if sa.inspect(bind).has_table(_PINS_TABLE):
+        op.drop_table(_PINS_TABLE)
+
+    existing_columns = _column_names(bind, _SETTINGS_TABLE)
+    present = [column.name for column in _settings_columns() if column.name in existing_columns]
+    if present:
+        _drop_columns(present)
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+
+    existing_columns = _column_names(bind, _SETTINGS_TABLE)
+    missing = [column for column in _settings_columns() if column.name not in existing_columns]
+    if existing_columns and missing:
+        _add_columns(missing)
+
+    if not sa.inspect(bind).has_table(_PINS_TABLE):
+        op.create_table(
+            _PINS_TABLE,
+            sa.Column("pin_key", sa.String(), nullable=False),
+            sa.Column("kind", sa.String(), nullable=False),
+            # No foreign key, as in the original: rows had to outlive a deleted
+            # source for the drain window instead of cascading away.
+            sa.Column("source_id", sa.String(), nullable=False),
+            sa.Column("api_key_id", sa.String(), nullable=True),
+            sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+            sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=False),
+            sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+            sa.Column("purge_at", sa.DateTime(timezone=True), nullable=False),
+            sa.PrimaryKeyConstraint("pin_key"),
+        )
+
+    # Each index is reflected on its own rather than ridden along with CREATE
+    # TABLE, exactly as 20260908_000000_add_subscription_overflow does it: a
+    # downgrade interrupted between the table and its indexes -- or a partial
+    # restore that already carries the table -- would otherwise land stamped at
+    # the parent with neither index, and nothing later would build them.
+    # Both tables are empty here, so the plain in-transaction build is right on
+    # either dialect; CONCURRENTLY would buy nothing and cannot run in this
+    # transaction.
+    existing_indexes = _index_names(bind, _PINS_TABLE)
+    if _PURGE_INDEX not in existing_indexes:
+        op.create_index(_PURGE_INDEX, _PINS_TABLE, ["purge_at"], unique=False)
+    if _KIND_EXPIRES_INDEX not in existing_indexes:
+        op.create_index(_KIND_EXPIRES_INDEX, _PINS_TABLE, ["kind", "expires_at"], unique=False)

app/db/alembic/versions/20260918_000000_merge_scim_and_overflow_heads.py

@@ -0,0 +1,17 @@
+"""Merge the SCIM token and subscription-overflow migration histories."""
+
+revision = "20260918_000000_merge_scim_and_overflow_heads"
+down_revision = (
+    "20260914_000000_add_scim_tokens",
+    "20260914_000000_drop_subscription_overflow_schema",
+)
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

app/db/alembic/versions/__init__.py

@@ -0,0 +1 @@
+from __future__ import annotations