* refactor(db): port operations, settings, audit, activity, and misc service metadata to sqlc
Covers the cross-cutting surface: operations board reads, app settings,
notification producers, activity/audit inserts, builds upsert/cancel,
git clone credential resolution, invites, environments, registry auth,
project/service variables, HA resolver, boot sweeps, and admin user ops.
Dynamic filtered lists and Better Auth table probes stay raw by design.
Authored By: TDvorak <[email protected]>
* refactor(db): port apwhy gateway handlers and proxy data plane to sqlc
Final tranche — every static call site now uses generated queries. Raw SQL
remains only where the statement is assembled at runtime (filtered lists,
sparse updates, admin count closure) or probes Better Auth's auth_users
table, which lives outside the local schema.
Authored By: TDvorak <[email protected]>
* feat(filters): dynamic filter framework — typed schema, URL state, FilterBar
Port of dflow's filter.utils pattern, adapted to Containr:
- lib/dynamic-filter.ts: FilterConfig schema (search/select/multiselect/
boolean/date-range/status), FilterEngine with client-side apply,
derived options with counts, active-filter tracking, removal.
- lib/use-dynamic-filter.ts: filter state lives in ?f.<key> search
params — filtered views are shareable links. useFilterState exposes
URL state before data loads (server-backed filters); useDynamicFilter
adds the engine over fetched data.
- shared/components/FilterBar.tsx: renders a schema as compact controls
+ active-filter chips, matching design tokens.
- Applied: audit logs (server-backed — state in URL, params to API),
builds (server-backed + client date-range), activity (severity to the
server query, category/search on the fetched page).
- 8 unit tests for the engine.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(filters): erasableSyntaxOnly compat + BuildStatus cast
- Constructor parameter properties are banned under erasableSyntaxOnly —
declare fields explicitly.
- listBuilds status param needs the BuildStatus type, not raw string.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(notifications): producers round-out — backups, agent health, scans, upgrades
Four new emitters behind insertUserNotification:
- Backups: createBackupProcess notifies the database owner on
completion (with size) and on failure (docker-down, snapshot error).
- Agent health: StartAgentHealthSweep marks agents offline after 3 min
without heartbeat and back online on recovery — admins notified on
each transition.
- Security scans: Scanner.OnScanComplete callback notifies the project
owner with critical/high/total counts + score; scans with findings
get a distinct title.
- Upgrades: daily check against the latest GitHub release; admins
notified once per new tag (deduped via app_settings). Version stamped
into the image via Dockerfile ARG + ldflags on tag builds; "dev"
disables the check.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---------
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Tomáš Dvořák