Add separate version tracking for artifacts

backend/app/models.py

@@ -72,6 +72,9 @@ class Package(Base):
     consumers = relationship(
         "Consumer", back_populates="package", cascade="all, delete-orphan"
     )
+    versions = relationship(
+        "PackageVersion", back_populates="package", cascade="all, delete-orphan"
+    )
 
     __table_args__ = (
         Index("idx_packages_project_id", "project_id"),
@@ -113,6 +116,7 @@ class Artifact(Base):
 
     tags = relationship("Tag", back_populates="artifact")
     uploads = relationship("Upload", back_populates="artifact")
+    versions = relationship("PackageVersion", back_populates="artifact")
 
     @property
     def sha256(self) -> str:
@@ -197,6 +201,38 @@ class TagHistory(Base):
     )
 
 
+class PackageVersion(Base):
+    """Immutable version record for a package-artifact relationship.
+
+    Separates versions (immutable, set at upload) from tags (mutable labels).
+    Each artifact in a package can have at most one version.
+    """
+
+    __tablename__ = "package_versions"
+
+    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    package_id = Column(
+        UUID(as_uuid=True),
+        ForeignKey("packages.id", ondelete="CASCADE"),
+        nullable=False,
+    )
+    artifact_id = Column(String(64), ForeignKey("artifacts.id"), nullable=False)
+    version = Column(String(255), nullable=False)
+    version_source = Column(String(50))  # 'explicit', 'filename', 'metadata', 'migrated_from_tag'
+    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
+    created_by = Column(String(255), nullable=False)
+
+    package = relationship("Package", back_populates="versions")
+    artifact = relationship("Artifact", back_populates="versions")
+
+    __table_args__ = (
+        Index("idx_package_versions_package_id", "package_id"),
+        Index("idx_package_versions_artifact_id", "artifact_id"),
+        Index("idx_package_versions_package_version", "package_id", "version", unique=True),
+        Index("idx_package_versions_package_artifact", "package_id", "artifact_id", unique=True),
+    )
+
+
 class Upload(Base):
     __tablename__ = "uploads"