feat(ql3): establish 3.0 incubation baseline

packages/ql3-cluster-postgres/src/migrations/pg-0011-api-credential-pepper-binding.ts

@@ -0,0 +1,43 @@
+import { definePostgresSqlMigration } from './sqlMigration';
+
+export const pg0011ApiCredentialPepperBindingMigration =
+  definePostgresSqlMigration({
+    id: 'pg-0011-api-credential-pepper-binding',
+    statements: [
+      `
+ALTER TABLE "ql3"."api_credentials"
+ADD COLUMN pepper_key_id varchar(64) NOT NULL DEFAULT 'legacy-v1'
+      `.trim(),
+      `
+ALTER TABLE "ql3"."api_credentials"
+ADD CONSTRAINT ql3_api_credentials_pepper_key_id_check
+CHECK (pepper_key_id ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$')
+      `.trim(),
+      `
+ALTER TABLE "ql3"."api_credentials"
+ALTER COLUMN pepper_key_id DROP DEFAULT
+      `.trim(),
+      `
+DO $ql3$
+BEGIN
+  UPDATE "ql3"."schema_capabilities"
+  SET contract_version = 10,
+      migration_id = 'pg-0011-api-credential-pepper-binding',
+      capabilities = '{"api_credential":1,"api_credential_admin":1,"api_credential_pepper_binding":1,"cluster_recovery":1,"cluster_recovery_claim":1,"identity_admin":1,"project_policy":1,"run_core":1,"run_dispatch_lease":1,"run_retry_policy":1,"security_audit":1,"security_audit_query":1,"worker_attestation":1,"worker_credential":1,"worker_session":1}'::jsonb,
+      updated_at_ms = floor(
+        extract(epoch FROM transaction_timestamp()) * 1000
+      )::bigint
+  WHERE contract_name = 'control-core'
+    AND contract_version = 9
+    AND migration_id = 'pg-0010-worker-ingress-attestation'
+    AND capabilities = '{"api_credential":1,"api_credential_admin":1,"cluster_recovery":1,"cluster_recovery_claim":1,"identity_admin":1,"project_policy":1,"run_core":1,"run_dispatch_lease":1,"run_retry_policy":1,"security_audit":1,"security_audit_query":1,"worker_attestation":1,"worker_credential":1,"worker_session":1}'::jsonb;
+
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'control-core capability is not at version 9'
+      USING ERRCODE = 'check_violation';
+  END IF;
+END
+$ql3$
+      `.trim(),
+    ],
+  });