@adminiumjs/meta 0.1.0-rc.1

package/dist/migrations/0008_llm_overrides.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Wave 0008 — LLM apply overrides (06-llm-assist.md §8.3, T10b).
+ *
+ * The apply-EXECUTOR persists each accepted suggestion as an
+ * `adminium_schema_overrides` row (`origin: 'llm'`, `llm_run_id`) whose §8.3
+ * shape also carries a per-suggestion `confidence`. The base table (0003) has no
+ * confidence column, so this migration ADDS one (never edits a shipped
+ * migration).
+ *
+ * The column is NULLABLE and additive: existing user-remap rows keep `confidence
+ * = NULL` (a human edit has no model confidence), and `overridesRepo` — which
+ * omits the column on insert — is unaffected. `real` is portable (PG real /
+ * MySQL real≡double / SQLite REAL) and stores a 0..1 score with room to spare.
+ */
+import { type Kysely } from 'kysely';
+/** No {@link ColumnHelpers} needed — `real` is portable and added via raw SQL. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=0008_llm_overrides.d.ts.map

package/dist/migrations/0008_llm_overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0008_llm_overrides.d.ts","sourceRoot":"","sources":["../../src/migrations/0008_llm_overrides.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAO,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAI1C,kFAAkF;AAClF,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3D"}

package/dist/migrations/0008_llm_overrides.js

@@ -0,0 +1,24 @@
+/**
+ * Wave 0008 — LLM apply overrides (06-llm-assist.md §8.3, T10b).
+ *
+ * The apply-EXECUTOR persists each accepted suggestion as an
+ * `adminium_schema_overrides` row (`origin: 'llm'`, `llm_run_id`) whose §8.3
+ * shape also carries a per-suggestion `confidence`. The base table (0003) has no
+ * confidence column, so this migration ADDS one (never edits a shipped
+ * migration).
+ *
+ * The column is NULLABLE and additive: existing user-remap rows keep `confidence
+ * = NULL` (a human edit has no model confidence), and `overridesRepo` — which
+ * omits the column on insert — is unaffected. `real` is portable (PG real /
+ * MySQL real≡double / SQLite REAL) and stores a 0..1 score with room to spare.
+ */
+import { sql } from 'kysely';
+import { metaTable } from '../prefix.js';
+/** No {@link ColumnHelpers} needed — `real` is portable and added via raw SQL. */
+export async function up(db) {
+    await db.schema
+        .alterTable(metaTable('schema_overrides'))
+        .addColumn('confidence', sql `real`)
+        .execute();
+}
+//# sourceMappingURL=0008_llm_overrides.js.map

package/dist/migrations/0008_llm_overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0008_llm_overrides.js","sourceRoot":"","sources":["../../src/migrations/0008_llm_overrides.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,GAAG,EAAe,MAAM,QAAQ,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB;IAC1C,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;SACzC,SAAS,CAAC,YAAY,EAAE,GAAG,CAAA,MAAM,CAAC;SAClC,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0009_views_kind.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Wave 0009 — `adminium_views.kind` (04-widget-registry.md §6.3, 07-meta-store.md
+ * §3.18).
+ *
+ * A saved-views row now carries a `kind` discriminator: `'filters'` (the M5
+ * saved page-crud grid state) or `'layout'` (a per-user dashboard layout
+ * override — the "Reset layout" surface). The base table (0004) predates the
+ * layout track, so this migration ADDS the column (never edits a shipped
+ * migration).
+ *
+ * The column is NOT NULL with `DEFAULT 'filters'`: every existing row is a
+ * saved filter view, so the backfill is correct and `viewsRepo` inserts stay
+ * unaffected (they pass `kind` explicitly, defaulting to `'filters'`). The
+ * `(page_id, user_id, name)` uniqueness index still holds — layout rows use a
+ * reserved sentinel name, so at most one layout override exists per (page,user).
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0009_views_kind.d.ts.map

package/dist/migrations/0009_views_kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0009_views_kind.d.ts","sourceRoot":"","sources":["../../src/migrations/0009_views_kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7E"}

package/dist/migrations/0009_views_kind.js

@@ -0,0 +1,24 @@
+/**
+ * Wave 0009 — `adminium_views.kind` (04-widget-registry.md §6.3, 07-meta-store.md
+ * §3.18).
+ *
+ * A saved-views row now carries a `kind` discriminator: `'filters'` (the M5
+ * saved page-crud grid state) or `'layout'` (a per-user dashboard layout
+ * override — the "Reset layout" surface). The base table (0004) predates the
+ * layout track, so this migration ADDS the column (never edits a shipped
+ * migration).
+ *
+ * The column is NOT NULL with `DEFAULT 'filters'`: every existing row is a
+ * saved filter view, so the backfill is correct and `viewsRepo` inserts stay
+ * unaffected (they pass `kind` explicitly, defaulting to `'filters'`). The
+ * `(page_id, user_id, name)` uniqueness index still holds — layout rows use a
+ * reserved sentinel name, so at most one layout override exists per (page,user).
+ */
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('views'))
+        .addColumn('kind', c.str(12), (col) => col.notNull().defaultTo('filters'))
+        .execute();
+}
+//# sourceMappingURL=0009_views_kind.js.map

package/dist/migrations/0009_views_kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0009_views_kind.js","sourceRoot":"","sources":["../../src/migrations/0009_views_kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;SAC9B,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;SACzE,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0010_llm_prompt_version_width.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Wave 0010 — widen `adminium_llm_runs.prompt_version` (str(10) → str(40)).
+ *
+ * 0006 sized the column for a bare version tag, but the shipped prompt version
+ * is `adminium.prompt/v1` (@adminium/llm `PROMPT_VERSION`, 18 chars). SQLite
+ * masked the mismatch — `str(n)` maps to `text` there, lengths unenforced —
+ * while PostgreSQL and strict-mode MySQL reject every run insert with
+ * "value too long for type character varying(10)". 40 leaves headroom for
+ * future `adminium.prompt/vNN`-style tags.
+ *
+ * Up-only rule (index.ts): 0006 is applied and checksummed, so the fix ships
+ * as a compensating migration. Raw dialect-branched ALTERs because MySQL's
+ * MODIFY restates the whole column definition (NOT NULL must be repeated) and
+ * Kysely's `setDataType` would silently drop it; SQLite needs no ALTER at all.
+ */
+import { type Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0010_llm_prompt_version_width.d.ts.map

package/dist/migrations/0010_llm_prompt_version_width.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0010_llm_prompt_version_width.d.ts","sourceRoot":"","sources":["../../src/migrations/0010_llm_prompt_version_width.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAO,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAY7E"}

package/dist/migrations/0010_llm_prompt_version_width.js

@@ -0,0 +1,28 @@
+/**
+ * Wave 0010 — widen `adminium_llm_runs.prompt_version` (str(10) → str(40)).
+ *
+ * 0006 sized the column for a bare version tag, but the shipped prompt version
+ * is `adminium.prompt/v1` (@adminium/llm `PROMPT_VERSION`, 18 chars). SQLite
+ * masked the mismatch — `str(n)` maps to `text` there, lengths unenforced —
+ * while PostgreSQL and strict-mode MySQL reject every run insert with
+ * "value too long for type character varying(10)". 40 leaves headroom for
+ * future `adminium.prompt/vNN`-style tags.
+ *
+ * Up-only rule (index.ts): 0006 is applied and checksummed, so the fix ships
+ * as a compensating migration. Raw dialect-branched ALTERs because MySQL's
+ * MODIFY restates the whole column definition (NOT NULL must be repeated) and
+ * Kysely's `setDataType` would silently drop it; SQLite needs no ALTER at all.
+ */
+import { sql } from 'kysely';
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    const table = metaTable('llm_runs');
+    if (c.dialect === 'postgres') {
+        await sql `ALTER TABLE ${sql.table(table)} ALTER COLUMN prompt_version TYPE varchar(40)`.execute(db);
+    }
+    else if (c.dialect === 'mysql') {
+        await sql `ALTER TABLE ${sql.table(table)} MODIFY COLUMN prompt_version varchar(40) NOT NULL`.execute(db);
+    }
+    // sqlite: the column is `text`; nothing to widen.
+}
+//# sourceMappingURL=0010_llm_prompt_version_width.js.map

package/dist/migrations/0010_llm_prompt_version_width.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0010_llm_prompt_version_width.js","sourceRoot":"","sources":["../../src/migrations/0010_llm_prompt_version_width.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,GAAG,EAAe,MAAM,QAAQ,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,CAAA,eAAe,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,+CAA+C,CAAC,OAAO,CAC7F,EAAE,CACH,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,GAAG,CAAA,eAAe,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oDAAoD,CAAC,OAAO,CAClG,EAAE,CACH,CAAC;IACJ,CAAC;IACD,kDAAkD;AACpD,CAAC"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Ordered, append-only migration list (07-meta-store.md §4). Up-only: a
+ * mistake ships as a new compensating migration; an applied migration is never
+ * edited (enforced by the runner's checksum drift detection).
+ *
+ * MySQL DDL constraint: `CREATE INDEX IF NOT EXISTS` does not exist on MySQL
+ * (tables: fine; indexes: parse error), so index creation here carries no
+ * `.ifNotExists()` — the ledger's exactly-once guarantee is the idempotency
+ * mechanism, and a rerun after a mid-migration crash failing loudly on a
+ * duplicate index beats silently diverging. DECISION (2026-07-20,
+ * pre-release): stripping those 29 index guards changed 0001–0007's checksums.
+ * Acceptable exactly once — no release exists, a MySQL meta store could never
+ * have migrated at all (this parse error, first caught by CI's first-ever
+ * [mysql] meta leg), and dev stores re-init. The same 2026-07-20 window also
+ * converted 0001–0006's 47 column-level REFERENCES clauses — which MySQL
+ * parses and silently discards, leaving a MySQL meta store with zero
+ * referential integrity — to named table-level `fk_adminium_*` constraints.
+ * After v1.0, checksum-changing edits are forbidden; ship compensating
+ * migrations instead.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export interface MetaMigration {
+    /** Basename, e.g. `0001_core_auth` — the ledger PK. */
+    readonly name: string;
+    readonly up: (db: Kysely<unknown>, c: ColumnHelpers) => Promise<void>;
+}
+export declare const ALL_MIGRATIONS: readonly MetaMigration[];
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAYnD,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,eAAO,MAAM,cAAc,EAAE,SAAS,aAAa,EAWlD,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,43 @@
+/**
+ * Ordered, append-only migration list (07-meta-store.md §4). Up-only: a
+ * mistake ships as a new compensating migration; an applied migration is never
+ * edited (enforced by the runner's checksum drift detection).
+ *
+ * MySQL DDL constraint: `CREATE INDEX IF NOT EXISTS` does not exist on MySQL
+ * (tables: fine; indexes: parse error), so index creation here carries no
+ * `.ifNotExists()` — the ledger's exactly-once guarantee is the idempotency
+ * mechanism, and a rerun after a mid-migration crash failing loudly on a
+ * duplicate index beats silently diverging. DECISION (2026-07-20,
+ * pre-release): stripping those 29 index guards changed 0001–0007's checksums.
+ * Acceptable exactly once — no release exists, a MySQL meta store could never
+ * have migrated at all (this parse error, first caught by CI's first-ever
+ * [mysql] meta leg), and dev stores re-init. The same 2026-07-20 window also
+ * converted 0001–0006's 47 column-level REFERENCES clauses — which MySQL
+ * parses and silently discards, leaving a MySQL meta store with zero
+ * referential integrity — to named table-level `fk_adminium_*` constraints.
+ * After v1.0, checksum-changing edits are forbidden; ship compensating
+ * migrations instead.
+ */
+import { up as up0001 } from './0001_core_auth.js';
+import { up as up0002 } from './0002_rbac.js';
+import { up as up0003 } from './0003_connections_schema.js';
+import { up as up0004 } from './0004_pages_views.js';
+import { up as up0005 } from './0005_ops.js';
+import { up as up0006 } from './0006_platform.js';
+import { up as up0007 } from './0007_llm_runs.js';
+import { up as up0008 } from './0008_llm_overrides.js';
+import { up as up0009 } from './0009_views_kind.js';
+import { up as up0010 } from './0010_llm_prompt_version_width.js';
+export const ALL_MIGRATIONS = [
+    { name: '0001_core_auth', up: up0001 },
+    { name: '0002_rbac', up: up0002 },
+    { name: '0003_connections_schema', up: up0003 },
+    { name: '0004_pages_views', up: up0004 },
+    { name: '0005_ops', up: up0005 },
+    { name: '0006_platform', up: up0006 },
+    { name: '0007_llm_runs', up: up0007 },
+    { name: '0008_llm_overrides', up: up0008 },
+    { name: '0009_views_kind', up: up0009 },
+    { name: '0010_llm_prompt_version_width', up: up0010 },
+];
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAQlE,MAAM,CAAC,MAAM,cAAc,GAA6B;IACtD,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE;IACtC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE;IACjC,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE;IAC/C,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE;IACxC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE;IAChC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE;IACrC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE;IACrC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE;IAC1C,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE;IACvC,EAAE,IAAI,EAAE,+BAA+B,EAAE,EAAE,EAAE,MAAM,EAAE;CACtD,CAAC"}

package/dist/migrator.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Adminium-owned migration runner (07-meta-store.md §4).
+ *
+ * - Up-only, append-only, sequential migrations (src/migrations/).
+ * - `adminium_migrations` ledger (name PK, checksum, applied_at, duration_ms,
+ *   adminium_version) — created with CREATE TABLE IF NOT EXISTS, the only DDL
+ *   outside migration files.
+ * - Checksum drift detection: an applied migration whose contents changed
+ *   aborts with the migration name and remedy.
+ * - Unknown ledger rows (database migrated by a newer Adminium) abort with an
+ *   upgrade message.
+ * - Transactional per migration on PostgreSQL/SQLite (transactional DDL); on
+ *   MySQL the ledger row is written immediately after the last statement and
+ *   every DDL statement is individually re-runnable (ifNotExists guards).
+ */
+import { type Kysely } from 'kysely';
+import { type MetaDialect } from './columns.js';
+import { type MetaMigration } from './migrations/index.js';
+import type { MetaDB } from './schema/tables.js';
+/**
+ * Package version recorded in the ledger, read from package.json at module
+ * load — the same trick `apps/server/src/version.ts` uses, and for the same
+ * reason: the relative hop works from both `src/` (vitest/tsx) and `dist/`
+ * (compiled) because both sit one level below the package root.
+ *
+ * It was a hardcoded `'0.0.0'`, which meant `adminium_migrations.adminium_version`
+ * — the column whose whole job is telling support which build touched a meta
+ * store — recorded a version that never shipped. Neither production caller
+ * passes `version`, so the literal was what every row got.
+ */
+export declare const META_PACKAGE_VERSION: string;
+export declare class MigrationChecksumDriftError extends Error {
+    readonly migrationName: string;
+    name: string;
+    constructor(migrationName: string);
+}
+export declare class UnknownMigrationError extends Error {
+    readonly migrationName: string;
+    name: string;
+    constructor(migrationName: string);
+}
+export declare class MigrationOrderError extends Error {
+    name: string;
+}
+/**
+ * SHA-256 over the migration name + its compiled `up` body. Editing an applied
+ * migration changes the digest, tripping drift detection on the next boot.
+ */
+export declare function migrationChecksum(migration: MetaMigration): string;
+export interface MigratorOptions {
+    dialect: MetaDialect;
+    /** Override the built-in list — tests only. */
+    migrations?: readonly MetaMigration[];
+    /** Version stamped into the ledger; defaults to {@link META_PACKAGE_VERSION}. */
+    version?: string;
+    /** Clock override — tests only. */
+    now?: () => number;
+}
+export interface ApplyResult {
+    /** Names applied by this call, in order (empty ⇒ already up to date). */
+    applied: string[];
+}
+export interface MigrationStatusEntry {
+    name: string;
+    applied: boolean;
+    appliedAt: number | null;
+    /** True when the ledger checksum no longer matches the file. */
+    drift: boolean;
+    /** False for ledger rows this Adminium version does not know. */
+    known: boolean;
+}
+/** SQLite enforces FKs per connection; must run before any FK-dependent work (§2.2). */
+export declare function enableSqliteForeignKeys(db: Kysely<MetaDB>): Promise<void>;
+/**
+ * Apply all pending migrations, in order. Idempotent: already-applied
+ * migrations are skipped via the ledger; concurrent runners racing on the same
+ * migration collide on the ledger PK inside the transaction (PG/SQLite), so
+ * each migration is applied exactly once.
+ */
+export declare function applyMigrations(db: Kysely<MetaDB>, options: MigratorOptions): Promise<ApplyResult>;
+/** Ledger vs file status for `adminium migrate --status`. */
+export declare function migrationStatus(db: Kysely<MetaDB>, options: MigratorOptions): Promise<MigrationStatusEntry[]>;
+//# sourceMappingURL=migrator.d.ts.map

package/dist/migrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrator.d.ts","sourceRoot":"","sources":["../src/migrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAO,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE1C,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAI1B,CAAC;AAIV,qBAAa,2BAA4B,SAAQ,KAAK;IAExC,QAAQ,CAAC,aAAa,EAAE,MAAM;IADjC,IAAI,SAAiC;gBACzB,aAAa,EAAE,MAAM;CAM3C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAElC,QAAQ,CAAC,aAAa,EAAE,MAAM;IADjC,IAAI,SAA2B;gBACnB,aAAa,EAAE,MAAM;CAM3C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IACnC,IAAI,SAAyB;CACvC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,GAAG,MAAM,CAElE;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,WAAW,CAAC;IACrB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACtC,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gEAAgE;IAChE,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,KAAK,EAAE,OAAO,CAAC;CAChB;AA6BD,wFAAwF;AACxF,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/E;AAsBD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAuCxG;AAED,6DAA6D;AAC7D,wBAAsB,eAAe,CACnC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAClB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAuBjC"}

package/dist/migrator.js

@@ -0,0 +1,173 @@
+/**
+ * Adminium-owned migration runner (07-meta-store.md §4).
+ *
+ * - Up-only, append-only, sequential migrations (src/migrations/).
+ * - `adminium_migrations` ledger (name PK, checksum, applied_at, duration_ms,
+ *   adminium_version) — created with CREATE TABLE IF NOT EXISTS, the only DDL
+ *   outside migration files.
+ * - Checksum drift detection: an applied migration whose contents changed
+ *   aborts with the migration name and remedy.
+ * - Unknown ledger rows (database migrated by a newer Adminium) abort with an
+ *   upgrade message.
+ * - Transactional per migration on PostgreSQL/SQLite (transactional DDL); on
+ *   MySQL the ledger row is written immediately after the last statement and
+ *   every DDL statement is individually re-runnable (ifNotExists guards).
+ */
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { sql } from 'kysely';
+import { columnHelpers } from './columns.js';
+import { ALL_MIGRATIONS } from './migrations/index.js';
+/**
+ * Package version recorded in the ledger, read from package.json at module
+ * load — the same trick `apps/server/src/version.ts` uses, and for the same
+ * reason: the relative hop works from both `src/` (vitest/tsx) and `dist/`
+ * (compiled) because both sit one level below the package root.
+ *
+ * It was a hardcoded `'0.0.0'`, which meant `adminium_migrations.adminium_version`
+ * — the column whose whole job is telling support which build touched a meta
+ * store — recorded a version that never shipped. Neither production caller
+ * passes `version`, so the literal was what every row got.
+ */
+export const META_PACKAGE_VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+const LEDGER = 'adminium_migrations';
+export class MigrationChecksumDriftError extends Error {
+    migrationName;
+    name = 'MigrationChecksumDriftError';
+    constructor(migrationName) {
+        super(`Migration "${migrationName}" was modified after it was applied to this database. ` +
+            'Restore the original migration file or ship a new compensating migration — applied migrations are never edited.');
+        this.migrationName = migrationName;
+    }
+}
+export class UnknownMigrationError extends Error {
+    migrationName;
+    name = 'UnknownMigrationError';
+    constructor(migrationName) {
+        super(`The migration ledger contains "${migrationName}", which this Adminium version does not know. ` +
+            'This database was migrated by a newer Adminium — upgrade the app.');
+        this.migrationName = migrationName;
+    }
+}
+export class MigrationOrderError extends Error {
+    name = 'MigrationOrderError';
+}
+/**
+ * SHA-256 over the migration name + its compiled `up` body. Editing an applied
+ * migration changes the digest, tripping drift detection on the next boot.
+ */
+export function migrationChecksum(migration) {
+    return createHash('sha256').update(`${migration.name}\n${migration.up.toString()}`).digest('hex');
+}
+function orderedMigrations(migrations) {
+    const names = new Set();
+    let prev = '';
+    for (const m of migrations) {
+        if (names.has(m.name))
+            throw new MigrationOrderError(`duplicate migration name: ${m.name}`);
+        if (m.name <= prev) {
+            throw new MigrationOrderError(`migrations out of order: "${m.name}" after "${prev}"`);
+        }
+        names.add(m.name);
+        prev = m.name;
+    }
+    return migrations;
+}
+async function ensureLedger(db, dialect) {
+    const c = columnHelpers(dialect);
+    await db.schema
+        .createTable(LEDGER)
+        .ifNotExists()
+        .addColumn('name', c.str(120), (col) => col.primaryKey())
+        .addColumn('checksum', c.str(64), (col) => col.notNull())
+        .addColumn('applied_at', c.ts, (col) => col.notNull())
+        .addColumn('duration_ms', c.int, (col) => col.notNull())
+        .addColumn('adminium_version', c.str(20), (col) => col.notNull())
+        .execute();
+}
+/** SQLite enforces FKs per connection; must run before any FK-dependent work (§2.2). */
+export async function enableSqliteForeignKeys(db) {
+    await sql `PRAGMA foreign_keys = ON`.execute(db);
+}
+async function readAndValidateLedger(db, migrations) {
+    const rows = await db.selectFrom(LEDGER).selectAll().execute();
+    const byName = new Map(migrations.map((m) => [m.name, m]));
+    for (const row of rows) {
+        const migration = byName.get(row.name);
+        if (!migration)
+            throw new UnknownMigrationError(row.name);
+        if (migrationChecksum(migration) !== row.checksum) {
+            throw new MigrationChecksumDriftError(row.name);
+        }
+    }
+    return { appliedNames: new Set(rows.map((r) => r.name)) };
+}
+/**
+ * Apply all pending migrations, in order. Idempotent: already-applied
+ * migrations are skipped via the ledger; concurrent runners racing on the same
+ * migration collide on the ledger PK inside the transaction (PG/SQLite), so
+ * each migration is applied exactly once.
+ */
+export async function applyMigrations(db, options) {
+    const migrations = orderedMigrations(options.migrations ?? ALL_MIGRATIONS);
+    const now = options.now ?? Date.now;
+    const version = options.version ?? META_PACKAGE_VERSION;
+    const dialect = options.dialect;
+    if (dialect === 'sqlite')
+        await enableSqliteForeignKeys(db);
+    await ensureLedger(db, dialect);
+    const { appliedNames } = await readAndValidateLedger(db, migrations);
+    const c = columnHelpers(dialect);
+    const applied = [];
+    for (const migration of migrations) {
+        if (appliedNames.has(migration.name))
+            continue;
+        const startedAt = now();
+        const ledgerRow = () => ({
+            name: migration.name,
+            checksum: migrationChecksum(migration),
+            appliedAt: now(),
+            durationMs: Math.max(0, now() - startedAt),
+            adminiumVersion: version,
+        });
+        if (dialect === 'mysql') {
+            // No transactional DDL: statements are individually re-runnable
+            // (ifNotExists), and the ledger row lands right after the last one.
+            await migration.up(db, c);
+            await db.insertInto(LEDGER).values(ledgerRow()).execute();
+        }
+        else {
+            await db.transaction().execute(async (trx) => {
+                await migration.up(trx, c);
+                await trx.insertInto(LEDGER).values(ledgerRow()).execute();
+            });
+        }
+        applied.push(migration.name);
+    }
+    return { applied };
+}
+/** Ledger vs file status for `adminium migrate --status`. */
+export async function migrationStatus(db, options) {
+    const migrations = orderedMigrations(options.migrations ?? ALL_MIGRATIONS);
+    await ensureLedger(db, options.dialect);
+    const rows = await db.selectFrom(LEDGER).selectAll().execute();
+    const ledger = new Map(rows.map((r) => [r.name, r]));
+    const known = new Set(migrations.map((m) => m.name));
+    const entries = migrations.map((m) => {
+        const row = ledger.get(m.name);
+        return {
+            name: m.name,
+            applied: row !== undefined,
+            appliedAt: row?.appliedAt ?? null,
+            drift: row !== undefined && migrationChecksum(m) !== row.checksum,
+            known: true,
+        };
+    });
+    for (const row of rows) {
+        if (!known.has(row.name)) {
+            entries.push({ name: row.name, applied: true, appliedAt: row.appliedAt, drift: false, known: false });
+        }
+    }
+    return entries;
+}
+//# sourceMappingURL=migrator.js.map

package/dist/migrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrator.js","sourceRoot":"","sources":["../src/migrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,GAAG,EAAe,MAAM,QAAQ,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAoB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAsB,MAAM,uBAAuB,CAAC;AAG3E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAG7E,CAAC,OAAO,CAAC;AAEV,MAAM,MAAM,GAAG,qBAAqB,CAAC;AAErC,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAE/B;IADZ,IAAI,GAAG,6BAA6B,CAAC;IAC9C,YAAqB,aAAqB;QACxC,KAAK,CACH,cAAc,aAAa,wDAAwD;YACjF,iHAAiH,CACpH,CAAC;QAJiB,kBAAa,GAAb,aAAa,CAAQ;IAK1C,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEzB;IADZ,IAAI,GAAG,uBAAuB,CAAC;IACxC,YAAqB,aAAqB;QACxC,KAAK,CACH,kCAAkC,aAAa,gDAAgD;YAC7F,mEAAmE,CACtE,CAAC;QAJiB,kBAAa,GAAb,aAAa,CAAQ;IAK1C,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,GAAG,qBAAqB,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAwB;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpG,CAAC;AA2BD,SAAS,iBAAiB,CAAC,UAAoC;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAC,IAAI,YAAY,IAAI,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAkB,EAAE,OAAoB;IAClE,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,MAAM,CAAC;SACnB,WAAW,EAAE;SACb,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;SACxD,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACxD,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACvD,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SAChE,OAAO,EAAE,CAAC;AACf,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAkB;IAC9D,MAAM,GAAG,CAAA,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAMD,KAAK,UAAU,qBAAqB,CAClC,EAAkB,EAClB,UAAoC;IAEpC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAU,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,iBAAiB,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAkB,EAAE,OAAwB;IAChF,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAAC;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,IAAI,OAAO,KAAK,QAAQ;QAAE,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAErE,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC;YACtC,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,eAAe,EAAE,OAAO;SACzB,CAAC,CAAC;QAEH,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,gEAAgE;YAChE,oEAAoE;YACpE,MAAM,SAAS,CAAC,EAAE,CAAC,EAAgC,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC3C,MAAM,SAAS,CAAC,EAAE,CAAC,GAAiC,EAAE,CAAC,CAAC,CAAC;gBACzD,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAkB,EAClB,OAAwB;IAExB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC,CAAC;IAC3E,MAAM,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAU,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAErD,MAAM,OAAO,GAA2B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,GAAG,KAAK,SAAS;YAC1B,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI;YACjC,KAAK,EAAE,GAAG,KAAK,SAAS,IAAI,iBAAiB,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ;YACjE,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/prefix.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Table-name prefix guard (07-meta-store.md §1, §4 "prefix safety").
+ * All DDL and the migration runner go through {@link metaTable}, which asserts
+ * the final physical name carries the `adminium_` prefix — the runner refuses
+ * to touch any other table.
+ */
+export declare const META_PREFIX = "adminium_";
+export declare class MetaPrefixError extends Error {
+    name: string;
+}
+/**
+ * `metaTable('users')` → `'adminium_users'`.
+ * Rejects names that already carry the prefix (double-prefix bug) and names
+ * that would not resolve inside the adminium_ namespace.
+ */
+export declare function metaTable(name: string): string;
+/** Assert an already-qualified physical name lives in the adminium_ namespace. */
+export declare function assertMetaTable(name: string): void;
+//# sourceMappingURL=prefix.d.ts.map

package/dist/prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefix.d.ts","sourceRoot":"","sources":["../src/prefix.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,WAAW,cAAc,CAAC;AAEvC,qBAAa,eAAgB,SAAQ,KAAK;IAC/B,IAAI,SAAqB;CACnC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU9C;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAIlD"}

package/dist/prefix.js

@@ -0,0 +1,33 @@
+/**
+ * Table-name prefix guard (07-meta-store.md §1, §4 "prefix safety").
+ * All DDL and the migration runner go through {@link metaTable}, which asserts
+ * the final physical name carries the `adminium_` prefix — the runner refuses
+ * to touch any other table.
+ */
+export const META_PREFIX = 'adminium_';
+export class MetaPrefixError extends Error {
+    name = 'MetaPrefixError';
+}
+/**
+ * `metaTable('users')` → `'adminium_users'`.
+ * Rejects names that already carry the prefix (double-prefix bug) and names
+ * that would not resolve inside the adminium_ namespace.
+ */
+export function metaTable(name) {
+    if (!/^[a-z][a-z0-9_]*$/.test(name)) {
+        throw new MetaPrefixError(`invalid meta table name: ${JSON.stringify(name)}`);
+    }
+    if (name.startsWith(META_PREFIX)) {
+        throw new MetaPrefixError(`table name already prefixed: ${name}`);
+    }
+    const full = `${META_PREFIX}${name}`;
+    assertMetaTable(full);
+    return full;
+}
+/** Assert an already-qualified physical name lives in the adminium_ namespace. */
+export function assertMetaTable(name) {
+    if (!name.startsWith(META_PREFIX)) {
+        throw new MetaPrefixError(`refusing to touch non-adminium table: ${name}`);
+    }
+}
+//# sourceMappingURL=prefix.js.map

package/dist/prefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefix.js","sourceRoot":"","sources":["../src/prefix.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AAEvC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,GAAG,iBAAiB,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC;IACrC,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/repos/api-keys.d.ts

@@ -0,0 +1,31 @@
+/**
+ * apiKeysRepo — adminium_api_keys (07-meta-store.md §3.7).
+ * Stripe-style `adm_live_…`: the secret is shown once by the server; only the
+ * SHA-256 hash lands here. The key acts with its role's permissions.
+ */
+import type { Selectable } from 'kysely';
+import type { MetaDb } from '../connect.js';
+import type { AdminiumApiKeysTable } from '../schema/tables.js';
+export type ApiKey = Selectable<AdminiumApiKeysTable>;
+export interface CreateApiKeyInput {
+    name: string;
+    /** Display fragment, e.g. `adm_live_4f2…`. */
+    prefix: string;
+    tokenHash: string;
+    roleId: string;
+    createdBy?: string | null;
+    expiresAt?: number | null;
+}
+export declare function apiKeysRepo(meta: MetaDb): {
+    create(input: CreateApiKeyInput, at?: number): Promise<ApiKey>;
+    findByPrefix(prefix: string): Promise<ApiKey[]>;
+    findById(id: string): Promise<ApiKey | null>;
+    /** Auth lookup: un-revoked and unexpired at `at`. */
+    findValidByTokenHash(tokenHash: string, at?: number): Promise<ApiKey | null>;
+    list(): Promise<ApiKey[]>;
+    revoke(id: string, at?: number): Promise<boolean>;
+    /** Throttled by the caller (server) like session touches. */
+    touchLastUsed(id: string, at?: number): Promise<void>;
+};
+export type ApiKeysRepo = ReturnType<typeof apiKeysRepo>;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/repos/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/repos/api-keys.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM;kBAGhB,iBAAiB,OAAM,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;yBAiBrD,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;iBAIlC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKlD,qDAAqD;oCACf,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAWhF,OAAO,CAAC,MAAM,EAAE,CAAC;eAId,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IAUnE,6DAA6D;sBACrC,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;EAI1E;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC"}