Commit history for migrations
- Drop the moved tables from D1; the per-repository and per-account objects are the only copy nowb62048b⌁taigrr committed
f55fdae⌁
- Re-run the scope locator backfill for deployments that applied the earlier 0054; point the advisories binding at the created database9581a6f⌁taigrr committed
- Move CI runs, jobs, statuses, caches, webhooks, secrets, variables, environments and deploy tokens into RepoState1cbb8e5⌁taigrr committed
- Move security data (advisories, alerts, SARIF, dependencies, settings) into RepoState and signing keys into AccountState7794e8f⌁taigrr committed
- Add per-repo RepoState and per-account AccountState SQL stores, the involvement index, scope locators and the migration planc23c430⌁taigrr committed
- kill global search for do search21614f7⌁taigrr committed
- waitlist approval bypass875f546⌁taigrr committed
- fixup migrations and push6d8b711⌁taigrr committed
- Remove the security review and triage docs now that every finding is closed, keep operator contacts out of the repo (ABUSE_FORWARD_TO is a secret, ADMIN_EMAIL is unset), and drop the private go-live checklist16fdec6⌁taigrr committed
- Merge feat/remove-pages1823e11⌁taigrr committed
- Merge fix/abuse6c55473⌁taigrr committed
- Merge fix/billing2d2ca7c⌁taigrr committed
- Merge release/ratelimit3638708⌁taigrr committed
- Merge release/billing3619d8b⌁taigrr committed
- Merge release/abuse38a754f⌁taigrr committed
- Round 3 hosting fixes: backfill only active domains as verified, D1 lease and bounded R2 work for object GC with orphan skipping and admin alerts, safe duplicate add-on cancel, lapse clears after release and restarts on new domains, transfer cap enforcement, and 404 for Pages of deleted repos.f58928e⌁taigrr committed
- Harden hosting cost controls per review: GC re-checks before delete, aborts on unreadable manifests and takes a lease; custom domain grace covers pre-existing and ungranted domains, lapse/reconcile sweeps can't stall, quantity follows transfers and teardown, duplicate add-ons are cancelled, verified domains never expire; Pages follows the current repo owner; aliases are per-PR, reserved and dropped with their preview.9dc4854⌁taigrr committed
- Add hosting cost controls: same-day hard caps from counter flushes, metered Pages traffic with plan caps, resumable R2 object GC, SITES_ENABLED/PAGES_ENABLED kill switches with admin hosting suspension, and a global daily dynamic-site ceiling.1a38b42⌁taigrr committed
- Sell custom domains as a per-domain Stripe add-on: gate new domains on it (or a plan flag/admin grant without billing), cap 25 per account, sync quantity, release domains after a lapsed add-on's grace, and delete Cloudflare hostnames on expired claims, private Pages, repo and org deletion.9a3b4a9⌁taigrr committed
- Add pr-<N> preview aliases that follow a pull request's latest branch preview and drop on close, plus opt-in immutable <sha7> commit previews (last 5 per PR).110dfda⌁taigrr committed
- fixup stacks, fns5858d70⌁taigrr committed
- Add legal pages, signup terms acceptance, self-service account deletion and data export so the public forge meets launch compliance basics; PostHog runs cookieless so no cookie banner is needed.abe2e9c⌁taigrr committed
- Harden email replies, editor container billing and lifecycle, MCP merge/approval confirmation, GitHub pull mirrors and BYOK keys (INT-P2..P21)fa13453⌁taigrr committed
- Enforce the spending limit across meters inside the reservation transaction so concurrent holds cannot jointly overshoot it, and let admin-set plans stick until an admin hands the account back to Stripe billing.192c134⌁taigrr committed
- Harden the git proxy and bridges before deploy: trust only ok'd refs, restrict v2 commands, fail closed on unloadable thin-pack bases, rate-limit before auth, shorten public raw caching, and charge bridged bytes to the head owner (CI-P6, GIT-P4..P7, P9..P12, GIT-14/PR-12).23526ca⌁taigrr committed