@adminiumjs/meta 0.2.2-rc.0 → 0.2.3

package/dist/ids.d.ts

@@ -44,8 +44,14 @@ export declare const ID_PREFIXES: {
     readonly whd: "adminium_webhook_deliveries";
     readonly flag: "adminium_feature_flags";
     readonly mft: "adminium_manifests";
+    readonly mat: "adminium_manifest_attachments";
+    readonly aoc: "adminium_add_on_credentials";
     readonly loc: "adminium_locales";
     readonly trn: "adminium_translations";
+    readonly pbk: "adminium_public_keys";
+    readonly psc: "adminium_public_scopes";
+    readonly pss: "adminium_public_sessions";
+    readonly pch: "adminium_public_challenges";
 };
 export type IdPrefix = keyof typeof ID_PREFIXES;
 /** Maximum column width every id must fit (07-meta-store.md §2.1). */

package/dist/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;GAWG;AAQH,QAAA,MAAM,QAAQ,QAAsB,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6Bd,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,WAAW,CAAC;AAOhD,sEAAsE;AACtE,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,qBAAa,cAAe,SAAQ,KAAK;IAC9B,IAAI,SAAoB;CAClC;AAiDD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAc9C;AAED,MAAM,WAAW,QAAQ;IACvB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC;IACjB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8FAA8F;AAC9F,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,CAY5C;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAQ5D;AAED,yDAAyD;AACzD,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,CAAC"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;GAWG;AAQH,QAAA,MAAM,QAAQ,QAAsB,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Cd,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,WAAW,CAAC;AAOhD,sEAAsE;AACtE,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,qBAAa,cAAe,SAAQ,KAAK;IAC9B,IAAI,SAAoB;CAClC;AAiDD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAc9C;AAED,MAAM,WAAW,QAAQ;IACvB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC;IACjB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8FAA8F;AAC9F,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,CAY5C;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAQ5D;AAED,yDAAyD;AACzD,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,CAAC"}

package/dist/ids.js

@@ -50,8 +50,22 @@ export const ID_PREFIXES = {
     whd: 'adminium_webhook_deliveries',
     flag: 'adminium_feature_flags',
     mft: 'adminium_manifests',
+    // 26-add-on-runtime.md §4. `mat` and `aoc` are separate spaces rather than
+    // reusing `mft`: an attachment and a credential are addressable rows with
+    // their own lifetimes (an attachment is disabled per host, a credential is
+    // deleted on disconnect while the manifest stays), and sharing an id space
+    // with the manifest they hang off would make a stray id look valid.
+    mat: 'adminium_manifest_attachments',
+    aoc: 'adminium_add_on_credentials',
     loc: 'adminium_locales',
     trn: 'adminium_translations',
+    // 28-public-surface.md §3.3 — the public surface. `pbk` is deliberately not
+    // `key`: a publishable key is never an RbacPrincipal (28 D3) and sharing an
+    // id space with `adminium_api_keys` would blur exactly that boundary.
+    pbk: 'adminium_public_keys',
+    psc: 'adminium_public_scopes',
+    pss: 'adminium_public_sessions',
+    pch: 'adminium_public_challenges',
 };
 const PREFIX_SET = new Set(Object.keys(ID_PREFIXES));
 /** `<prefix>_<26 Crockford chars>` — Crockford charset excludes I, L, O, U. */

package/dist/ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,iDAAiD;AACjD,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AACpD,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,GAAG,EAAE,gBAAgB;IACrB,IAAI,EAAE,mBAAmB;IACzB,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,mBAAmB;IACxB,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,eAAe;IACpB,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,2BAA2B;IAChC,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,wBAAwB;IAC7B,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,0BAA0B;IAChC,GAAG,EAAE,4BAA4B;IACjC,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,kBAAkB;IACvB,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,0BAA0B;IAC/B,EAAE,EAAE,mBAAmB;IACvB,GAAG,EAAE,6BAA6B;IAClC,IAAI,EAAE,wBAAwB;IAC9B,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,uBAAuB;CACpB,CAAC;AAIX,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AAE1E,+EAA+E;AAC/E,MAAM,KAAK,GAAG,kDAAkD,CAAC;AAEjE,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,GAAG,gBAAgB,CAAC;CAClC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC;QACpC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAS,QAAQ,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAI,KAAK,CAAC,CAAC,CAAY,GAAG,EAAE,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;AAClB,IAAI,QAAQ,GAAa,EAAE,CAAC;AAE5B,SAAS,aAAa,CAAC,IAAc;IACnC,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,sEAAsE;IACtE,MAAM,IAAI,cAAc,CAAC,qDAAqD,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,MAAgB;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,cAAc,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClB,0EAA0E;QAC1E,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,CAAC,CAAC;QACb,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAaD,8FAA8F;AAC9F,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAwC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,EAAE,CAAC,MAAM,GAAG,aAAa;QAAE,MAAM,IAAI,cAAc,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO;QACL,MAAM,EAAE,MAAkB;QAC1B,KAAK,EAAE,WAAW,CAAC,MAAkB,CAAC;QACtC,IAAI;QACJ,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,IAAI,CAAC,EAAW,EAAE,MAAiB;IACjD,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3B,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,MAAM,CAAC,EAAU;IAC/B,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,aAAa;IAC3B,QAAQ,GAAG,CAAC,CAAC,CAAC;IACd,QAAQ,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,CAAC"}
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,iDAAiD;AACjD,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AACpD,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,GAAG,EAAE,gBAAgB;IACrB,IAAI,EAAE,mBAAmB;IACzB,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,mBAAmB;IACxB,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,eAAe;IACpB,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,2BAA2B;IAChC,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,wBAAwB;IAC7B,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,0BAA0B;IAChC,GAAG,EAAE,4BAA4B;IACjC,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,kBAAkB;IACvB,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,0BAA0B;IAC/B,EAAE,EAAE,mBAAmB;IACvB,GAAG,EAAE,6BAA6B;IAClC,IAAI,EAAE,wBAAwB;IAC9B,GAAG,EAAE,oBAAoB;IACzB,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,oEAAoE;IACpE,GAAG,EAAE,+BAA+B;IACpC,GAAG,EAAE,6BAA6B;IAClC,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,uBAAuB;IAC5B,4EAA4E;IAC5E,4EAA4E;IAC5E,sEAAsE;IACtE,GAAG,EAAE,sBAAsB;IAC3B,GAAG,EAAE,wBAAwB;IAC7B,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,4BAA4B;CACzB,CAAC;AAIX,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AAE1E,+EAA+E;AAC/E,MAAM,KAAK,GAAG,kDAAkD,CAAC;AAEjE,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,GAAG,gBAAgB,CAAC;CAClC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC;QACpC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAS,QAAQ,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAI,KAAK,CAAC,CAAC,CAAY,GAAG,EAAE,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;AAClB,IAAI,QAAQ,GAAa,EAAE,CAAC;AAE5B,SAAS,aAAa,CAAC,IAAc;IACnC,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,sEAAsE;IACtE,MAAM,IAAI,cAAc,CAAC,qDAAqD,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,MAAgB;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,cAAc,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClB,0EAA0E;QAC1E,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,CAAC,CAAC;QACb,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAaD,8FAA8F;AAC9F,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAwC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,EAAE,CAAC,MAAM,GAAG,aAAa;QAAE,MAAM,IAAI,cAAc,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO;QACL,MAAM,EAAE,MAAkB;QAC1B,KAAK,EAAE,WAAW,CAAC,MAAkB,CAAC;QACtC,IAAI;QACJ,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,IAAI,CAAC,EAAW,EAAE,MAAiB;IACjD,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3B,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,MAAM,CAAC,EAAU;IAC/B,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,aAAa;IAC3B,QAAQ,GAAG,CAAC,CAAC,CAAC;IACd,QAAQ,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,CAAC"}

package/dist/migrations/0014_public_surface.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Wave 0014 — the public surface (28-public-surface.md §3).
+ *
+ * Four tables behind the scoped, off-by-default `/api/v1/public` namespace:
+ * the browser-safe key kind, the scope document that says what a key may reach,
+ * the end-customer session a `claim` mints, and the one-time challenge the
+ * `email-code` claim tier needs.
+ *
+ * WHY THESE ARE NOT `adminium_api_keys` ROWS WITH A `kind` COLUMN (28 §3.3).
+ * Two properties diverge and both are load-bearing:
+ *
+ *  1. The secret is RE-READABLE by an admin. `adminium_api_keys` reveals once
+ *     and never again, which is right for a server-side credential a human
+ *     copies into a deployment. An `adm_pub_` secret lives in a public bundle
+ *     and has to survive a rebuild months later, so the row keeps a reversible
+ *     copy alongside the hash.
+ *  2. A publishable key is NEVER an `RbacPrincipal` (28 D3). `parseBearerApiKey`
+ *     gates on the `adm_sk_` prefix, so a token from this table cannot resolve
+ *     through the rbac plugin at all — which is what makes it inert on every
+ *     other route BY CONSTRUCTION rather than by an allow-list somebody has to
+ *     maintain. Sharing a table would invite exactly the `kind`-check-per-route
+ *     that property exists to avoid.
+ *
+ * NO SETTINGS TABLE HERE, deliberately (28 D20). Tenant configuration is
+ * hybrid: the only key Adminium must own is the `timezone` it needs to
+ * interpret its own `timestamptz` values, and that rides on the SCOPE document
+ * below — already per-connection, already operator-authored, already served on
+ * `/public/config`. A global settings key would be one line cheaper and wrong
+ * the moment an instance holds two connections for businesses in different
+ * zones. Everything else an app needs (tax rates, tip presets, opening hours)
+ * stays in the app's own tables, where the generated dashboard edits it for
+ * free.
+ *
+ * `0013_connection_last_error_hint` is the latest applied migration; never edit
+ * a shipped one (the one-time checksum exception in `index.ts` was pre-release).
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0014_public_surface.d.ts.map

package/dist/migrations/0014_public_surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0014_public_surface.d.ts","sourceRoot":"","sources":["../../src/migrations/0014_public_surface.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA6L7E"}

package/dist/migrations/0014_public_surface.js

@@ -0,0 +1,186 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0014 — the public surface (28-public-surface.md §3).
+ *
+ * Four tables behind the scoped, off-by-default `/api/v1/public` namespace:
+ * the browser-safe key kind, the scope document that says what a key may reach,
+ * the end-customer session a `claim` mints, and the one-time challenge the
+ * `email-code` claim tier needs.
+ *
+ * WHY THESE ARE NOT `adminium_api_keys` ROWS WITH A `kind` COLUMN (28 §3.3).
+ * Two properties diverge and both are load-bearing:
+ *
+ *  1. The secret is RE-READABLE by an admin. `adminium_api_keys` reveals once
+ *     and never again, which is right for a server-side credential a human
+ *     copies into a deployment. An `adm_pub_` secret lives in a public bundle
+ *     and has to survive a rebuild months later, so the row keeps a reversible
+ *     copy alongside the hash.
+ *  2. A publishable key is NEVER an `RbacPrincipal` (28 D3). `parseBearerApiKey`
+ *     gates on the `adm_sk_` prefix, so a token from this table cannot resolve
+ *     through the rbac plugin at all — which is what makes it inert on every
+ *     other route BY CONSTRUCTION rather than by an allow-list somebody has to
+ *     maintain. Sharing a table would invite exactly the `kind`-check-per-route
+ *     that property exists to avoid.
+ *
+ * NO SETTINGS TABLE HERE, deliberately (28 D20). Tenant configuration is
+ * hybrid: the only key Adminium must own is the `timezone` it needs to
+ * interpret its own `timestamptz` values, and that rides on the SCOPE document
+ * below — already per-connection, already operator-authored, already served on
+ * `/public/config`. A global settings key would be one line cheaper and wrong
+ * the moment an instance holds two connections for businesses in different
+ * zones. Everything else an app needs (tax rates, tip presets, opening hours)
+ * stays in the app's own tables, where the generated dashboard edits it for
+ * free.
+ *
+ * `0013_connection_last_error_hint` is the latest applied migration; never edit
+ * a shipped one (the one-time checksum exception in `index.ts` was pre-release).
+ */
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    /*
+     * The scope document. One row per (connection, side) the operator publishes.
+     *
+     * `document` is the compiled-from JSON: resources, their logical refs, the
+     * `expose` column allow-list, `filterable`/`searchable`/`orderable`, the
+     * mandatory `where` predicate, and the claim strategy. It is validated by
+     * `compileScope` on every write and on every boot — never trusted from disk.
+     *
+     * `timezone` is a COLUMN rather than a field inside `document` because it is
+     * the one datum the SERIALIZER needs, not the caller: a reader has to reach it
+     * without parsing and validating the whole document first.
+     *
+     * `proposed_from_manifest` records whether this row was seeded from a
+     * manifest's `publicApi.propose` block (O2 option b) or authored from scratch
+     * in Studio (option c). It exists so widening past a publisher's proposal can
+     * be audited, and it is nullable because option (c) is unblocked today and
+     * option (b) is not yet ruled.
+     */
+    await db.schema
+        .createTable(metaTable('public_scopes'))
+        .ifNotExists()
+        .addColumn('id', c.id, (col) => col.primaryKey())
+        .addColumn('connection_id', c.id, (col) => col.notNull())
+        .addColumn('side', c.str(16), (col) => col.notNull())
+        .addColumn('name', c.str(80), (col) => col.notNull())
+        /** IANA zone, e.g. `Europe/London`. Required — see 28 D20. */
+        .addColumn('timezone', c.str(64), (col) => col.notNull())
+        .addColumn('document', c.json, (col) => col.notNull())
+        .addColumn('proposed_from_manifest', c.str(80))
+        .addColumn('created_by', c.id)
+        .addColumn('created_at', c.ts, (col) => col.notNull())
+        .addColumn('updated_at', c.ts, (col) => col.notNull())
+        .addForeignKeyConstraint('fk_adminium_public_scopes_connection', ['connection_id'], metaTable('connections'), ['id'], (cb) => cb.onDelete('cascade'))
+        .addForeignKeyConstraint('fk_adminium_public_scopes_created_by', ['created_by'], metaTable('users'), ['id'], (cb) => cb.onDelete('set null'))
+        .execute();
+    await db.schema
+        .createIndex('ix_adminium_public_scopes_connection')
+        .on(metaTable('public_scopes'))
+        .columns(['connection_id'])
+        .execute();
+    /*
+     * The publishable key.
+     *
+     * `token_hash` is what a request is verified against. `token_encrypted` is the
+     * reversible copy that makes the secret re-readable (see the header) — it uses
+     * the same `dsnCryptoFromSecret` envelope as connection DSNs, so it is
+     * unreadable without `ADMINIUM_SECRET` and it never leaves the server except
+     * through an authenticated reveal.
+     *
+     * `origins` is a JSON array narrowing the instance-wide
+     * `ADMINIUM_PUBLIC_API_ORIGINS` allow-list for this one key. Empty array means
+     * "no narrowing" — it does NOT mean "any origin", because the env var is
+     * always the outer bound.
+     *
+     * `scope_id` is `restrict` on delete, not `cascade`: deleting a scope out from
+     * under a live key would silently turn a working public surface into a 500,
+     * so the operator has to revoke the key first and see what they are breaking.
+     */
+    await db.schema
+        .createTable(metaTable('public_keys'))
+        .ifNotExists()
+        .addColumn('id', c.id, (col) => col.primaryKey())
+        .addColumn('name', c.str(80), (col) => col.notNull())
+        /** Display fragment, e.g. `adm_pub_4f2a91cd`. */
+        .addColumn('prefix', c.str(32), (col) => col.notNull())
+        .addColumn('token_hash', c.str(128), (col) => col.notNull())
+        .addColumn('token_encrypted', c.text, (col) => col.notNull())
+        .addColumn('scope_id', c.id, (col) => col.notNull())
+        .addColumn('side', c.str(16), (col) => col.notNull())
+        .addColumn('origins', c.json, (col) => col.notNull())
+        .addColumn('expires_at', c.ts)
+        .addColumn('revoked_at', c.ts)
+        .addColumn('last_used_at', c.ts)
+        .addColumn('created_by', c.id)
+        .addColumn('created_at', c.ts, (col) => col.notNull())
+        .addColumn('updated_at', c.ts, (col) => col.notNull())
+        .addForeignKeyConstraint('fk_adminium_public_keys_scope', ['scope_id'], metaTable('public_scopes'), ['id'], (cb) => cb.onDelete('restrict'))
+        .addForeignKeyConstraint('fk_adminium_public_keys_created_by', ['created_by'], metaTable('users'), ['id'], (cb) => cb.onDelete('set null'))
+        .execute();
+    /* Lookup is by prefix on every public request — the hot path of this wave. */
+    await db.schema
+        .createIndex('ix_adminium_public_keys_prefix')
+        .on(metaTable('public_keys'))
+        .columns(['prefix'])
+        .execute();
+    /*
+     * The end-customer session minted by `POST /public/claim` (28 §3.4).
+     *
+     * `grants` is the resolved claim — the mandatory predicate later requests are
+     * filtered by, e.g. "patient_id = 41". It is stored RESOLVED rather than
+     * re-derived per request so that editing a scope cannot retroactively widen a
+     * session that is already in someone's browser.
+     *
+     * There is no `user_id`. An end customer is deliberately NOT an
+     * `adminium_users` row (28 §3.4) — Adminium grows no second identity system,
+     * and this table is the whole of what a claimed customer is.
+     */
+    await db.schema
+        .createTable(metaTable('public_sessions'))
+        .ifNotExists()
+        .addColumn('id', c.id, (col) => col.primaryKey())
+        .addColumn('key_id', c.id, (col) => col.notNull())
+        .addColumn('token_hash', c.str(128), (col) => col.notNull())
+        .addColumn('grants', c.json, (col) => col.notNull())
+        .addColumn('expires_at', c.ts, (col) => col.notNull())
+        .addColumn('created_at', c.ts, (col) => col.notNull())
+        .addColumn('last_seen_at', c.ts)
+        .addForeignKeyConstraint('fk_adminium_public_sessions_key', ['key_id'], metaTable('public_keys'), ['id'], (cb) => cb.onDelete('cascade'))
+        .execute();
+    await db.schema
+        .createIndex('ix_adminium_public_sessions_token_hash')
+        .on(metaTable('public_sessions'))
+        .columns(['token_hash'])
+        .execute();
+    /*
+     * One-time challenges for the `email-code` claim tier (28 D11/D17).
+     *
+     * `attempts` is on the row rather than in a counter elsewhere because the
+     * containment property this tier is bought for — a low-entropy code is only
+     * safe if guesses are bounded — has to survive a process restart, and the
+     * rate limiter is an in-process `Map` that does not.
+     *
+     * `destination_hash` rather than the address itself: a challenge table is a
+     * list of customer email addresses otherwise, which is a needless standing
+     * disclosure for a row whose whole life is five minutes.
+     */
+    await db.schema
+        .createTable(metaTable('public_challenges'))
+        .ifNotExists()
+        .addColumn('id', c.id, (col) => col.primaryKey())
+        .addColumn('key_id', c.id, (col) => col.notNull())
+        .addColumn('ref', c.str(64), (col) => col.notNull())
+        .addColumn('destination_hash', c.str(128), (col) => col.notNull())
+        .addColumn('code_hash', c.str(128), (col) => col.notNull())
+        .addColumn('attempts', c.int, (col) => col.notNull().defaultTo(0))
+        .addColumn('consumed_at', c.ts)
+        .addColumn('expires_at', c.ts, (col) => col.notNull())
+        .addColumn('created_at', c.ts, (col) => col.notNull())
+        .addForeignKeyConstraint('fk_adminium_public_challenges_key', ['key_id'], metaTable('public_keys'), ['id'], (cb) => cb.onDelete('cascade'))
+        .execute();
+    await db.schema
+        .createIndex('ix_adminium_public_challenges_key_ref')
+        .on(metaTable('public_challenges'))
+        .columns(['key_id', 'ref'])
+        .execute();
+}
+//# sourceMappingURL=0014_public_surface.js.map

package/dist/migrations/0014_public_surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0014_public_surface.js","sourceRoot":"","sources":["../../src/migrations/0014_public_surface.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;SACvC,WAAW,EAAE;SACb,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;SAChD,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACxD,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACpD,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACrD,8DAA8D;SAC7D,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACxD,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,SAAS,CAAC,wBAAwB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC9C,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;SAC7B,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,uBAAuB,CACtB,sCAAsC,EACtC,CAAC,eAAe,CAAC,EACjB,SAAS,CAAC,aAAa,CAAC,EACxB,CAAC,IAAI,CAAC,EACN,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC/B;SACA,uBAAuB,CACtB,sCAAsC,EACtC,CAAC,YAAY,CAAC,EACd,SAAS,CAAC,OAAO,CAAC,EAClB,CAAC,IAAI,CAAC,EACN,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAChC;SACA,OAAO,EAAE,CAAC;IAEb,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,sCAAsC,CAAC;SACnD,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;SAC9B,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC;SAC1B,OAAO,EAAE,CAAC;IAEb;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;SACrC,WAAW,EAAE;SACb,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;SAChD,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACrD,iDAAiD;SAChD,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACtD,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SAC3D,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SAC5D,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACnD,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACpD,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACpD,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;SAC7B,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;SAC7B,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC;SAC/B,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;SAC7B,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,uBAAuB,CACtB,+BAA+B,EAC/B,CAAC,UAAU,CAAC,EACZ,SAAS,CAAC,eAAe,CAAC,EAC1B,CAAC,IAAI,CAAC,EACN,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAChC;SACA,uBAAuB,CACtB,oCAAoC,EACpC,CAAC,YAAY,CAAC,EACd,SAAS,CAAC,OAAO,CAAC,EAClB,CAAC,IAAI,CAAC,EACN,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAChC;SACA,OAAO,EAAE,CAAC;IAEb,8EAA8E;IAC9E,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,gCAAgC,CAAC;SAC7C,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;SAC5B,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;SACnB,OAAO,EAAE,CAAC;IAEb;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;SACzC,WAAW,EAAE;SACb,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;SAChD,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACjD,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SAC3D,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACnD,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC;SAC/B,uBAAuB,CACtB,iCAAiC,EACjC,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,aAAa,CAAC,EACxB,CAAC,IAAI,CAAC,EACN,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC/B;SACA,OAAO,EAAE,CAAC;IAEb,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,wCAAwC,CAAC;SACrD,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;SAChC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;SACvB,OAAO,EAAE,CAAC;IAEb;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;SAC3C,WAAW,EAAE;SACb,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;SAChD,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACjD,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACnD,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACjE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SAC1D,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACjE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC;SAC9B,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,uBAAuB,CACtB,mCAAmC,EACnC,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,aAAa,CAAC,EACxB,CAAC,IAAI,CAAC,EACN,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC/B;SACA,OAAO,EAAE,CAAC;IAEb,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,uCAAuC,CAAC;SACpD,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;SAClC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;SAC1B,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0015_connection_tenant_config.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Wave 0015 — `adminium_connections.timezone` / `.currency` (28-T34, D20).
+ *
+ * ─── Why these are connection columns and not a settings table ──────────────
+ *
+ * D20 ruled O7 as a hybrid: Adminium owns only what it needs to serve correct
+ * data, and it placed `timezone` on the SCOPE document — explicitly rejecting a
+ * global `adminium_settings` key, because that is "wrong the moment an instance
+ * holds two connections for businesses in different zones".
+ *
+ * That argument is right, and it points one level further than the ruling took
+ * it. The thing a zone belongs to is the BUSINESS, and the business is the
+ * database — the connection. A scope is a view onto a connection, and an
+ * instance can hold several scopes over one connection; putting the zone on the
+ * scope means the same business can be described by two scopes that disagree
+ * about what time it is there, with nothing to reconcile them.
+ *
+ * ─── What forced it ────────────────────────────────────────────────────────
+ *
+ * A surface hosted BY Adminium reads through the operator's session. It has no
+ * publishable key and therefore NO SCOPE, so under the old placement there was
+ * nowhere for it to read a zone from at all — the app took it as a build
+ * argument, which makes a property of the business a property of the artifact.
+ * Hosted mode postdates D20; this is the consequence, not a reversal.
+ *
+ * ─── What does not change ──────────────────────────────────────────────────
+ *
+ * `scope.timezone` stays, as an OVERRIDE. It becomes optional and inherits from
+ * the connection when omitted, and `compileScope` still refuses a scope that
+ * ends up with no valid IANA zone from either source — so D20's boot-fatal
+ * guarantee survives intact and every scope already stored keeps working
+ * unchanged.
+ *
+ * Both columns are nullable with no default. There is no defensible default for
+ * a timezone: a wrong zone is worse than a missing one, because it looks like
+ * data. `null` means "not configured", and the refusal happens where the value
+ * is needed rather than being papered over here.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0015_connection_tenant_config.d.ts.map

package/dist/migrations/0015_connection_tenant_config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0015_connection_tenant_config.d.ts","sourceRoot":"","sources":["../../src/migrations/0015_connection_tenant_config.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAY7E"}

package/dist/migrations/0015_connection_tenant_config.js

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0015 — `adminium_connections.timezone` / `.currency` (28-T34, D20).
+ *
+ * ─── Why these are connection columns and not a settings table ──────────────
+ *
+ * D20 ruled O7 as a hybrid: Adminium owns only what it needs to serve correct
+ * data, and it placed `timezone` on the SCOPE document — explicitly rejecting a
+ * global `adminium_settings` key, because that is "wrong the moment an instance
+ * holds two connections for businesses in different zones".
+ *
+ * That argument is right, and it points one level further than the ruling took
+ * it. The thing a zone belongs to is the BUSINESS, and the business is the
+ * database — the connection. A scope is a view onto a connection, and an
+ * instance can hold several scopes over one connection; putting the zone on the
+ * scope means the same business can be described by two scopes that disagree
+ * about what time it is there, with nothing to reconcile them.
+ *
+ * ─── What forced it ────────────────────────────────────────────────────────
+ *
+ * A surface hosted BY Adminium reads through the operator's session. It has no
+ * publishable key and therefore NO SCOPE, so under the old placement there was
+ * nowhere for it to read a zone from at all — the app took it as a build
+ * argument, which makes a property of the business a property of the artifact.
+ * Hosted mode postdates D20; this is the consequence, not a reversal.
+ *
+ * ─── What does not change ──────────────────────────────────────────────────
+ *
+ * `scope.timezone` stays, as an OVERRIDE. It becomes optional and inherits from
+ * the connection when omitted, and `compileScope` still refuses a scope that
+ * ends up with no valid IANA zone from either source — so D20's boot-fatal
+ * guarantee survives intact and every scope already stored keeps working
+ * unchanged.
+ *
+ * Both columns are nullable with no default. There is no defensible default for
+ * a timezone: a wrong zone is worse than a missing one, because it looks like
+ * data. `null` means "not configured", and the refusal happens where the value
+ * is needed rather than being papered over here.
+ */
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('connections'))
+        // IANA zone, e.g. `Europe/Lisbon`. 64 matches the scope schema's own cap.
+        .addColumn('timezone', c.str(64))
+        .execute();
+    await db.schema
+        .alterTable(metaTable('connections'))
+        // ISO-4217, three letters. Null when this business's data carries no money.
+        .addColumn('currency', c.str(3))
+        .execute();
+}
+//# sourceMappingURL=0015_connection_tenant_config.js.map

package/dist/migrations/0015_connection_tenant_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0015_connection_tenant_config.js","sourceRoot":"","sources":["../../src/migrations/0015_connection_tenant_config.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACrC,0EAA0E;SACzE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAChC,OAAO,EAAE,CAAC;IAEb,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACrC,4EAA4E;SAC3E,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC/B,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0016_audit_entity.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Wave 0016 — per-record audit lookup (30-record-pages.md WS-A).
+ *
+ * The record page's Activity tab needs "every audit entry for THIS record".
+ * The entry's `entity` column stores a RecordRef, but as packed JSON text —
+ * filtering on it means either a per-dialect JSON-extract expression (three
+ * syntaxes, none of them indexable without generated columns) or a full scan
+ * of the `data` category. Both are the amplification anti-pattern D6 exists
+ * to rule out, so the ref's two lookup facts are denormalized into real,
+ * indexed columns instead:
+ *
+ *   entity_table  the ref's qualified table ("public.invoices")
+ *   entity_id     the canonical record-id string — `pkLabel` form: a single
+ *                 PK stringified, a composite PK as the JSON value tuple —
+ *                 the same string the record route and `rowIdOf` use. See
+ *                 `keysOf` for why a BACKFILLED composite reads the ref's
+ *                 `label` rather than re-deriving from `pk`.
+ *
+ * Both are clamped by `auditEntityKeyPart` (write AND query side, so a
+ * truncated key still matches itself), written by `auditRepo.append` from
+ * this wave on, and BACKFILLED here from the stored refs so pre-existing
+ * activity shows up on day one. The backfill parses each ref in JS — the
+ * only portable JSON reader across the three dialects — in id-keyset batches;
+ * audit volume is retention-bounded (§8 `audit-log` policy), so this is a
+ * one-time bounded cost.
+ *
+ * Bulk writes (`record.bulk-*`) carry no per-row entity and stay out of the
+ * feed by design (30 D6) — their rows simply keep NULL keys.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0016_audit_entity.d.ts.map

package/dist/migrations/0016_audit_entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0016_audit_entity.d.ts","sourceRoot":"","sources":["../../src/migrations/0016_audit_entity.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAuEnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA8C7E"}

package/dist/migrations/0016_audit_entity.js

@@ -0,0 +1,137 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0016 — per-record audit lookup (30-record-pages.md WS-A).
+ *
+ * The record page's Activity tab needs "every audit entry for THIS record".
+ * The entry's `entity` column stores a RecordRef, but as packed JSON text —
+ * filtering on it means either a per-dialect JSON-extract expression (three
+ * syntaxes, none of them indexable without generated columns) or a full scan
+ * of the `data` category. Both are the amplification anti-pattern D6 exists
+ * to rule out, so the ref's two lookup facts are denormalized into real,
+ * indexed columns instead:
+ *
+ *   entity_table  the ref's qualified table ("public.invoices")
+ *   entity_id     the canonical record-id string — `pkLabel` form: a single
+ *                 PK stringified, a composite PK as the JSON value tuple —
+ *                 the same string the record route and `rowIdOf` use. See
+ *                 `keysOf` for why a BACKFILLED composite reads the ref's
+ *                 `label` rather than re-deriving from `pk`.
+ *
+ * Both are clamped by `auditEntityKeyPart` (write AND query side, so a
+ * truncated key still matches itself), written by `auditRepo.append` from
+ * this wave on, and BACKFILLED here from the stored refs so pre-existing
+ * activity shows up on day one. The backfill parses each ref in JS — the
+ * only portable JSON reader across the three dialects — in id-keyset batches;
+ * audit volume is retention-bounded (§8 `audit-log` policy), so this is a
+ * one-time bounded cost.
+ *
+ * Bulk writes (`record.bulk-*`) carry no per-row entity and stay out of the
+ * feed by design (30 D6) — their rows simply keep NULL keys.
+ */
+import { metaTable } from '../prefix.js';
+import { AUDIT_ENTITY_KEY_MAX, auditEntityKeyOf, auditEntityKeyPart, recordRefSchema, } from '../schema/json-payloads.js';
+const BACKFILL_BATCH = 500;
+/**
+ * A STORED ref has lost the one thing `auditEntityKeyOf` reads for a composite
+ * key: the order of `pk`.
+ *
+ * `entity` is `jsonb` on postgres and `json` on mysql, and both normalise
+ * object keys on the way in — jsonb by key length then bytes, mysql likewise.
+ * So `{invoice_id, line}` comes back as `{line, invoice_id}` and
+ * `Object.values()` yields the tuple backwards, producing an id that matches no
+ * record. Only sqlite, which stores the column as text, keeps the written
+ * order, which is why deriving from `pk` passed there and failed on the other
+ * two. There is no recovering the order from the stored value: jsonb and mysql
+ * json are parsed forms, so even casting back to text returns the normalised
+ * key order rather than the original.
+ *
+ * A single-column key has no order to lose, so it still derives from `pk`.
+ *
+ * A composite one falls back to the ref's `label`, which the only writer of a
+ * record ref (`routes/data`) sets to `pkLabel(table, pk)` — the same tuple, in
+ * the table's primary-key order, as a plain string no store reorders. `label`
+ * is display text by contract and NOT guaranteed to be that tuple, so it is
+ * used only when it still parses as a JSON array of the right arity; anything
+ * else leaves the row NULL. A legacy row that opts out of the feed is the
+ * documented outcome for a ref this reader cannot trust — a confidently wrong
+ * key that silently attaches one record's history to another is not.
+ */
+function keysOf(entity) {
+    // Postgres `jsonb` columns come back as objects; sqlite/mysql as text.
+    let candidate = entity;
+    if (typeof entity === 'string') {
+        try {
+            candidate = JSON.parse(entity);
+        }
+        catch {
+            return null;
+        }
+    }
+    const parsed = recordRefSchema.safeParse(candidate);
+    if (!parsed.success)
+        return null;
+    const ref = parsed.data;
+    const arity = Object.keys(ref.pk).length;
+    if (arity <= 1)
+        return auditEntityKeyOf(ref);
+    let tuple;
+    try {
+        tuple = JSON.parse(ref.label);
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(tuple) || tuple.length !== arity)
+        return null;
+    return { entityTable: auditEntityKeyPart(ref.table), entityId: auditEntityKeyPart(ref.label) };
+}
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('audit_log'))
+        .addColumn('entity_table', c.str(AUDIT_ENTITY_KEY_MAX))
+        .execute();
+    await db.schema
+        .alterTable(metaTable('audit_log'))
+        .addColumn('entity_id', c.str(AUDIT_ENTITY_KEY_MAX))
+        .execute();
+    // (entity_table, entity_id, created_at): the feed's exact access path —
+    // equality on both keys, ordered by recency. 2×200×4 utf8mb4 bytes + the
+    // timestamp stays under MySQL's 3072-byte InnoDB index cap.
+    await db.schema
+        .createIndex('idx_adminium_audit_log_entity_created')
+        .on(metaTable('audit_log'))
+        .columns(['entity_table', 'entity_id', 'created_at'])
+        .execute();
+    // Backfill: id-keyset batches over rows that carry a ref. Unparseable JSON
+    // stays NULL — a row this reader cannot interpret must not fail the wave.
+    const backfill = db;
+    const audit = metaTable('audit_log');
+    let after = '';
+    for (;;) {
+        const rows = await backfill
+            .selectFrom(audit)
+            .select(['id', 'entity'])
+            .where('entity', 'is not', null)
+            .where('id', '>', after)
+            .orderBy('id', 'asc')
+            .limit(BACKFILL_BATCH)
+            .execute();
+        if (rows.length === 0)
+            break;
+        for (const row of rows) {
+            const keys = keysOf(row.entity);
+            if (keys === null)
+                continue;
+            await backfill
+                .updateTable(audit)
+                .set({ entityTable: keys.entityTable, entityId: keys.entityId })
+                .where('id', '=', row.id)
+                .execute();
+        }
+        const last = rows[rows.length - 1];
+        if (last === undefined || rows.length < BACKFILL_BATCH)
+            break;
+        after = last.id;
+    }
+}
+//# sourceMappingURL=0016_audit_entity.js.map

package/dist/migrations/0016_audit_entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0016_audit_entity.js","sourceRoot":"","sources":["../../src/migrations/0016_audit_entity.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,cAAc,GAAG,GAAG,CAAC;AAW3B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,MAAM,CAAC,MAAe;IAC7B,uEAAuE;IACvE,IAAI,SAAS,GAAY,MAAM,CAAC;IAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE7C,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,EAAE,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;SAClC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;SACtD,OAAO,EAAE,CAAC;IACb,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;SAClC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;SACnD,OAAO,EAAE,CAAC;IACb,wEAAwE;IACxE,yEAAyE;IACzE,4DAA4D;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,uCAAuC,CAAC;SACpD,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;SAC1B,OAAO,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;SACpD,OAAO,EAAE,CAAC;IAEb,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,EAA2B,CAAC;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,QAAQ;aACxB,UAAU,CAAC,KAAK,CAAC;aACjB,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;aACxB,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC;aAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;aACvB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;aACpB,KAAK,CAAC,cAAc,CAAC;aACrB,OAAO,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC5B,MAAM,QAAQ;iBACX,WAAW,CAAC,KAAK,CAAC;iBAClB,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;iBAC/D,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;iBACxB,OAAO,EAAE,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc;YAAE,MAAM;QAC9D,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/migrations/0017_surface_binding.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Wave 0017 — key ↔ app-surface binding (29-app-surfaces.md D10, 29-T15).
+ *
+ * A hosted CUSTOMER surface is configured at serve time, not bake time: the
+ * surfaces plugin answers `GET /apps/<key>/customer/surface-config.json` with
+ * the newest live publishable key bound to that app, so rotating a key is
+ * Studio + reload rather than a rebuild. "Bound to that app" needs a COLUMN —
+ * before this wave, "minted per side per app" was a naming convention on
+ * `adminium_public_keys.name`, which nothing could query.
+ *
+ * `app_key` is the manifest key of the owning app (`clients`, `clinic`, …),
+ * nullable because binding is optional: a key minted for a standalone build
+ * or a third-party integration belongs to no hosted surface and stays NULL.
+ *
+ * Planned as `0016_surface_binding` (29 D10); renumbered to 0017 because
+ * plan 30's `0016_audit_entity` shipped first and the list is append-only.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+/** Matches the discovery layout: a surface directory name, e.g. `clients`. */
+export declare const PUBLIC_KEY_APP_KEY_MAX = 64;
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0017_surface_binding.d.ts.map

package/dist/migrations/0017_surface_binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0017_surface_binding.d.ts","sourceRoot":"","sources":["../../src/migrations/0017_surface_binding.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAc7E"}