@adminiumjs/meta 0.2.2-rc.0 → 0.2.3

package/dist/migrations/0017_surface_binding.js

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0017 — key ↔ app-surface binding (29-app-surfaces.md D10, 29-T15).
+ *
+ * A hosted CUSTOMER surface is configured at serve time, not bake time: the
+ * surfaces plugin answers `GET /apps/<key>/customer/surface-config.json` with
+ * the newest live publishable key bound to that app, so rotating a key is
+ * Studio + reload rather than a rebuild. "Bound to that app" needs a COLUMN —
+ * before this wave, "minted per side per app" was a naming convention on
+ * `adminium_public_keys.name`, which nothing could query.
+ *
+ * `app_key` is the manifest key of the owning app (`clients`, `clinic`, …),
+ * nullable because binding is optional: a key minted for a standalone build
+ * or a third-party integration belongs to no hosted surface and stays NULL.
+ *
+ * Planned as `0016_surface_binding` (29 D10); renumbered to 0017 because
+ * plan 30's `0016_audit_entity` shipped first and the list is append-only.
+ */
+import { metaTable } from '../prefix.js';
+/** Matches the discovery layout: a surface directory name, e.g. `clients`. */
+export const PUBLIC_KEY_APP_KEY_MAX = 64;
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('public_keys'))
+        .addColumn('app_key', c.str(PUBLIC_KEY_APP_KEY_MAX))
+        .execute();
+    // (app_key, side): the config route's exact lookup — every live key for one
+    // app's side, newest picked in the query. The table is operator-scale (tens
+    // of rows), but the read is on an anonymous, unauthenticated path, so it
+    // should not scan by policy rather than by size.
+    await db.schema
+        .createIndex('ix_adminium_public_keys_app')
+        .on(metaTable('public_keys'))
+        .columns(['app_key', 'side'])
+        .execute();
+}
+//# sourceMappingURL=0017_surface_binding.js.map

package/dist/migrations/0017_surface_binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0017_surface_binding.js","sourceRoot":"","sources":["../../src/migrations/0017_surface_binding.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;SACpC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;SACnD,OAAO,EAAE,CAAC;IACb,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,6BAA6B,CAAC;SAC1C,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;SAC5B,OAAO,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;SAC5B,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0018_connection_timezone_source.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Wave 0018 — `adminium_connections.timezoneSource`: WHO chose the zone.
+ *
+ * ─── What changed under 0015 ───────────────────────────────────────────────
+ *
+ * 0015 added `timezone` and argued for no default at all: "a wrong zone is
+ * worse than a missing one, because it looks like data". `connectionsRepo`
+ * later seeded new rows from the SERVER's zone anyway, and for a good reason —
+ * a null zone made a hosted app surface refuse to render, so the cost of the
+ * missing value landed as total unavailability rather than an hour's drift.
+ *
+ * Both positions are right about their own failure, and the column below is
+ * what lets them both hold. A seeded zone keeps surfaces rendering; recording
+ * that it was seeded keeps it from passing as a decision nobody made.
+ *
+ * ─── Why provenance and not a different default ────────────────────────────
+ *
+ * Without this column a stored zone is two very different facts wearing one
+ * value: something an operator chose for the business, or something the server
+ * guessed from the clock of whatever machine it happens to run on (a developer
+ * laptop, a container defaulting to UTC, a VM in the wrong region). Studio
+ * renders them identically, so the guess reads as a decision — reproducing in
+ * the UI precisely the failure 0015 refused in the data.
+ *
+ * ─── Values, and why NULL is not backfilled ────────────────────────────────
+ *
+ *   'operator'  a human set this — the wizard, Studio, or `PATCH /connections`
+ *   'host'      `connectionsRepo.create` derived it from the server's own zone
+ *   NULL        unknown, or no zone to attribute
+ *
+ * Rows predating this column are left NULL rather than guessed at, and NULL
+ * must render as no claim at all. The asymmetry is deliberate: under-claiming
+ * costs an operator a badge they did not need, while over-claiming tells
+ * someone their correct, deliberately chosen zone is a guess — which is how a
+ * badge earns the right to be ignored.
+ *
+ * A zone that is itself NULL carries a NULL source: there is no choice to
+ * attribute, and "the operator chose nothing" is a state `timezone` already
+ * records on its own.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0018_connection_timezone_source.d.ts.map

package/dist/migrations/0018_connection_timezone_source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0018_connection_timezone_source.d.ts","sourceRoot":"","sources":["../../src/migrations/0018_connection_timezone_source.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7E"}

package/dist/migrations/0018_connection_timezone_source.js

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0018 — `adminium_connections.timezoneSource`: WHO chose the zone.
+ *
+ * ─── What changed under 0015 ───────────────────────────────────────────────
+ *
+ * 0015 added `timezone` and argued for no default at all: "a wrong zone is
+ * worse than a missing one, because it looks like data". `connectionsRepo`
+ * later seeded new rows from the SERVER's zone anyway, and for a good reason —
+ * a null zone made a hosted app surface refuse to render, so the cost of the
+ * missing value landed as total unavailability rather than an hour's drift.
+ *
+ * Both positions are right about their own failure, and the column below is
+ * what lets them both hold. A seeded zone keeps surfaces rendering; recording
+ * that it was seeded keeps it from passing as a decision nobody made.
+ *
+ * ─── Why provenance and not a different default ────────────────────────────
+ *
+ * Without this column a stored zone is two very different facts wearing one
+ * value: something an operator chose for the business, or something the server
+ * guessed from the clock of whatever machine it happens to run on (a developer
+ * laptop, a container defaulting to UTC, a VM in the wrong region). Studio
+ * renders them identically, so the guess reads as a decision — reproducing in
+ * the UI precisely the failure 0015 refused in the data.
+ *
+ * ─── Values, and why NULL is not backfilled ────────────────────────────────
+ *
+ *   'operator'  a human set this — the wizard, Studio, or `PATCH /connections`
+ *   'host'      `connectionsRepo.create` derived it from the server's own zone
+ *   NULL        unknown, or no zone to attribute
+ *
+ * Rows predating this column are left NULL rather than guessed at, and NULL
+ * must render as no claim at all. The asymmetry is deliberate: under-claiming
+ * costs an operator a badge they did not need, while over-claiming tells
+ * someone their correct, deliberately chosen zone is a guess — which is how a
+ * badge earns the right to be ignored.
+ *
+ * A zone that is itself NULL carries a NULL source: there is no choice to
+ * attribute, and "the operator chose nothing" is a state `timezone` already
+ * records on its own.
+ */
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('connections'))
+        // 'operator' is the longest value at 8; 16 leaves room for a third source
+        // (an inherited or probed zone) without a second ALTER.
+        .addColumn('timezone_source', c.str(16))
+        .execute();
+}
+//# sourceMappingURL=0018_connection_timezone_source.js.map

package/dist/migrations/0018_connection_timezone_source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0018_connection_timezone_source.js","sourceRoot":"","sources":["../../src/migrations/0018_connection_timezone_source.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACrC,0EAA0E;QAC1E,wDAAwD;SACvD,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SACvC,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0019_connection_disabled.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Wave 0019 — `adminium_connections.disabled_at`: the operator PAUSED this
+ * source, and when.
+ *
+ * ─── Why not a `status` value ──────────────────────────────────────────────
+ *
+ * `status` is a HEALTH reading — `connected` / `error` / `unconfigured` — and
+ * every writer of it is a probe (`recordTestResult`, the create path). Folding
+ * a pause into that enum would mean the next successful test silently unpaused
+ * the connection, because a probe's whole job is to overwrite `status` with
+ * what it just observed. It would also destroy the reading underneath: an
+ * operator who pauses a source that is currently failing, fixes the database,
+ * and resumes has no way back to `error` because nothing recorded it.
+ *
+ * Health is observed; a pause is INTENDED. Two facts, two columns, and the
+ * card can say "paused, and it was failing when you paused it".
+ *
+ * ─── Why a timestamp and not a boolean ─────────────────────────────────────
+ *
+ * A pause is meant to be temporary, so "how long has this been off?" is the
+ * question that follows it — a source paused an hour ago during a migration
+ * and one paused five weeks ago and forgotten are the same boolean and very
+ * different situations. NULL means enabled; anything else is the epoch-ms
+ * instant it was paused (07-meta-store.md §2.1: never a native datetime).
+ *
+ * WHO paused it is not stored here. The audit log already records the actor
+ * for `connection.disable` / `connection.enable` alongside every other
+ * connection action, and a second, unjoined copy on the row would be one more
+ * thing that can disagree with it.
+ *
+ * ─── Backfill ──────────────────────────────────────────────────────────────
+ *
+ * None. Every pre-0019 row was serving, which is exactly what NULL means.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0019_connection_disabled.d.ts.map

package/dist/migrations/0019_connection_disabled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0019_connection_disabled.d.ts","sourceRoot":"","sources":["../../src/migrations/0019_connection_disabled.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7E"}

package/dist/migrations/0019_connection_disabled.js

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0019 — `adminium_connections.disabled_at`: the operator PAUSED this
+ * source, and when.
+ *
+ * ─── Why not a `status` value ──────────────────────────────────────────────
+ *
+ * `status` is a HEALTH reading — `connected` / `error` / `unconfigured` — and
+ * every writer of it is a probe (`recordTestResult`, the create path). Folding
+ * a pause into that enum would mean the next successful test silently unpaused
+ * the connection, because a probe's whole job is to overwrite `status` with
+ * what it just observed. It would also destroy the reading underneath: an
+ * operator who pauses a source that is currently failing, fixes the database,
+ * and resumes has no way back to `error` because nothing recorded it.
+ *
+ * Health is observed; a pause is INTENDED. Two facts, two columns, and the
+ * card can say "paused, and it was failing when you paused it".
+ *
+ * ─── Why a timestamp and not a boolean ─────────────────────────────────────
+ *
+ * A pause is meant to be temporary, so "how long has this been off?" is the
+ * question that follows it — a source paused an hour ago during a migration
+ * and one paused five weeks ago and forgotten are the same boolean and very
+ * different situations. NULL means enabled; anything else is the epoch-ms
+ * instant it was paused (07-meta-store.md §2.1: never a native datetime).
+ *
+ * WHO paused it is not stored here. The audit log already records the actor
+ * for `connection.disable` / `connection.enable` alongside every other
+ * connection action, and a second, unjoined copy on the row would be one more
+ * thing that can disagree with it.
+ *
+ * ─── Backfill ──────────────────────────────────────────────────────────────
+ *
+ * None. Every pre-0019 row was serving, which is exactly what NULL means.
+ */
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('connections'))
+        .addColumn('disabled_at', c.ts)
+        .execute();
+}
+//# sourceMappingURL=0019_connection_disabled.js.map

package/dist/migrations/0019_connection_disabled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0019_connection_disabled.js","sourceRoot":"","sources":["../../src/migrations/0019_connection_disabled.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;SACpC,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC;SAC9B,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0020_manifests_add_on.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Wave 0020 — the add-on half of `adminium_manifests`, plus the attachment
+ * table an add-on needs and an app does not
+ * (26-add-on-runtime.md §4, as amended 2026-08-29).
+ *
+ * ─── This ALTERs. It does not create. ───────────────────────────────────────
+ *
+ * 26 §4 as first written said `adminium_manifests` "does not exist at all
+ * today, so this creates it rather than altering it", and `research/BRIEF.md`
+ * §6 and `16-milestones.md` M16-T02 repeated it. All three were wrong: the
+ * table has shipped since `0006_platform.ts:319-348`. It has no repo, no
+ * writer and zero rows, which is how three documents came to record a shipped
+ * table as absent — and it is why this migration adds two columns to something
+ * that is already there rather than creating a fourth copy of the idea.
+ *
+ * Three shipped columns this plan never accounted for come along for the ride:
+ * `connection_id`, `status`, and **`license_key_encrypted`** — a column 17
+ * defers by name. It is deliberately left alone rather than dropped: it is
+ * empty, dropping a column is the one irreversible thing a migration can do,
+ * and "17 defers licences" is an argument for never WRITING it, which costs
+ * nothing to honour. `repos/manifests.ts` never reads or writes it.
+ *
+ * ─── Why attachments are a table and not `attached_to` on the row ───────────
+ *
+ * 26 O3 asks how one add-on attaches to several hosts and recommends "two rows,
+ * keyed `(manifest_key, attached_to)`". **This does not do that**, and the
+ * reason is a cost O3 could not have weighed, because it was written believing
+ * the table did not exist yet:
+ *
+ *  1. **Two rows means two manifest documents.** `manifest` is the whole
+ *     validated JSON. An add-on attached to two hosts would store it twice, and
+ *     every upgrade would have to rewrite N rows atomically to avoid a
+ *     deployment where one attachment is on 1.1.0 and the other on 1.0.0.
+ *  2. **It makes the credential FK ambiguous.** `adminium_add_on_credentials`
+ *     (0021) is one row per CONNECTED add-on — a DHL API key belongs to the
+ *     add-on, not to one of its attachments. With two manifest rows, that FK
+ *     points at whichever row happened to be inserted first, and disconnecting
+ *     "the other one" either orphans a secret or deletes a live one.
+ *  3. **It requires editing a shipped constraint.** `uq_adminium_manifests_manifest_key`
+ *     is UNIQUE on `manifest_key` ALONE (`0006_platform.ts:344-348`). Two rows
+ *     per key violates it, so O3's shape means dropping and recreating a shipped
+ *     index across three dialects — against §4's own "never edit a shipped
+ *     migration".
+ *
+ * An attachment is a many-to-many fact between a manifest and a host app, so it
+ * gets the table that models one. The shipped unique index stays true (one
+ * manifest, one row, one document, one credential), and `attaches` in the
+ * manifest stays what it always was: the set of hosts this add-on MAY attach to,
+ * of which the rows below record the ones it actually is attached to.
+ *
+ * ─── Why `disabled_at` and not a boolean ───────────────────────────────────
+ *
+ * §5.1's `PATCH /add-ons/:key` enables and disables per surface, and that state
+ * belongs on the attachment rather than on the manifest: an add-on can be
+ * legitimately live on one host and switched off on another. The timestamp
+ * follows 0019's discipline verbatim — NULL means enabled, and "how long has
+ * this been off" is the question that follows a disable, which a boolean cannot
+ * answer.
+ *
+ * ─── Backfill ──────────────────────────────────────────────────────────────
+ *
+ * None, and not for the usual reason: the table has zero rows in every
+ * deployment, because nothing has ever written to it. `kind` still carries a
+ * default so the column is honest about what a pre-existing row would have
+ * meant — `adminium_manifests` was introduced for installed micro-SaaS apps
+ * (13-marketplace.md), so an unlabelled row is an app.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0020_manifests_add_on.d.ts.map

package/dist/migrations/0020_manifests_add_on.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0020_manifests_add_on.d.ts","sourceRoot":"","sources":["../../src/migrations/0020_manifests_add_on.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAiD7E"}

package/dist/migrations/0020_manifests_add_on.js

@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0020 — the add-on half of `adminium_manifests`, plus the attachment
+ * table an add-on needs and an app does not
+ * (26-add-on-runtime.md §4, as amended 2026-08-29).
+ *
+ * ─── This ALTERs. It does not create. ───────────────────────────────────────
+ *
+ * 26 §4 as first written said `adminium_manifests` "does not exist at all
+ * today, so this creates it rather than altering it", and `research/BRIEF.md`
+ * §6 and `16-milestones.md` M16-T02 repeated it. All three were wrong: the
+ * table has shipped since `0006_platform.ts:319-348`. It has no repo, no
+ * writer and zero rows, which is how three documents came to record a shipped
+ * table as absent — and it is why this migration adds two columns to something
+ * that is already there rather than creating a fourth copy of the idea.
+ *
+ * Three shipped columns this plan never accounted for come along for the ride:
+ * `connection_id`, `status`, and **`license_key_encrypted`** — a column 17
+ * defers by name. It is deliberately left alone rather than dropped: it is
+ * empty, dropping a column is the one irreversible thing a migration can do,
+ * and "17 defers licences" is an argument for never WRITING it, which costs
+ * nothing to honour. `repos/manifests.ts` never reads or writes it.
+ *
+ * ─── Why attachments are a table and not `attached_to` on the row ───────────
+ *
+ * 26 O3 asks how one add-on attaches to several hosts and recommends "two rows,
+ * keyed `(manifest_key, attached_to)`". **This does not do that**, and the
+ * reason is a cost O3 could not have weighed, because it was written believing
+ * the table did not exist yet:
+ *
+ *  1. **Two rows means two manifest documents.** `manifest` is the whole
+ *     validated JSON. An add-on attached to two hosts would store it twice, and
+ *     every upgrade would have to rewrite N rows atomically to avoid a
+ *     deployment where one attachment is on 1.1.0 and the other on 1.0.0.
+ *  2. **It makes the credential FK ambiguous.** `adminium_add_on_credentials`
+ *     (0021) is one row per CONNECTED add-on — a DHL API key belongs to the
+ *     add-on, not to one of its attachments. With two manifest rows, that FK
+ *     points at whichever row happened to be inserted first, and disconnecting
+ *     "the other one" either orphans a secret or deletes a live one.
+ *  3. **It requires editing a shipped constraint.** `uq_adminium_manifests_manifest_key`
+ *     is UNIQUE on `manifest_key` ALONE (`0006_platform.ts:344-348`). Two rows
+ *     per key violates it, so O3's shape means dropping and recreating a shipped
+ *     index across three dialects — against §4's own "never edit a shipped
+ *     migration".
+ *
+ * An attachment is a many-to-many fact between a manifest and a host app, so it
+ * gets the table that models one. The shipped unique index stays true (one
+ * manifest, one row, one document, one credential), and `attaches` in the
+ * manifest stays what it always was: the set of hosts this add-on MAY attach to,
+ * of which the rows below record the ones it actually is attached to.
+ *
+ * ─── Why `disabled_at` and not a boolean ───────────────────────────────────
+ *
+ * §5.1's `PATCH /add-ons/:key` enables and disables per surface, and that state
+ * belongs on the attachment rather than on the manifest: an add-on can be
+ * legitimately live on one host and switched off on another. The timestamp
+ * follows 0019's discipline verbatim — NULL means enabled, and "how long has
+ * this been off" is the question that follows a disable, which a boolean cannot
+ * answer.
+ *
+ * ─── Backfill ──────────────────────────────────────────────────────────────
+ *
+ * None, and not for the usual reason: the table has zero rows in every
+ * deployment, because nothing has ever written to it. `kind` still carries a
+ * default so the column is honest about what a pre-existing row would have
+ * meant — `adminium_manifests` was introduced for installed micro-SaaS apps
+ * (13-marketplace.md), so an unlabelled row is an app.
+ */
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    // `kind` — 'app' | 'add-on' (@adminium/manifest MANIFEST_KINDS). An add-on IS
+    // a manifest (26 §4), so install, upgrade, uninstall and the audit trail need
+    // no parallel code path; this column is what tells the two apart.
+    await db.schema
+        .alterTable(metaTable('manifests'))
+        .addColumn('kind', c.str(12), (col) => col.notNull().defaultTo('app'))
+        .execute();
+    await db.schema
+        .createTable(metaTable('manifest_attachments'))
+        .ifNotExists()
+        .addColumn('id', c.id, (col) => col.primaryKey())
+        .addColumn('manifest_id', c.id, (col) => col.notNull())
+        // The host app's `manifest_key` (24 §5.7) — 80 to match
+        // `adminium_manifests.manifest_key`, the column it points at by value.
+        .addColumn('attached_to', c.str(80), (col) => col.notNull())
+        /** NULL = enabled on this host. Epoch ms, never a native datetime. */
+        .addColumn('disabled_at', c.ts)
+        .addColumn('created_at', c.ts, (col) => col.notNull())
+        // CASCADE, unlike the shipped manifests FKs' `set null`: an attachment with
+        // no manifest is not a degraded row, it is a row that means nothing. A
+        // named table-level constraint because MySQL parses an inline column-level
+        // `REFERENCES` and silently discards it (the 2026-07-20 CI onion).
+        .addForeignKeyConstraint('fk_adminium_manifest_attachments_manifest_id', ['manifest_id'], metaTable('manifests'), ['id'], (cb) => cb.onDelete('cascade'))
+        .execute();
+    // One attachment per (manifest, host). Re-attaching is idempotent rather than
+    // a second row, and the enable/disable state has one home.
+    await db.schema
+        .createIndex('uq_adminium_manifest_attachments_pair')
+        .on(metaTable('manifest_attachments'))
+        .columns(['manifest_id', 'attached_to'])
+        .unique()
+        .execute();
+    // The read the runtime actually makes: "what is attached to this host app,
+    // and is it on?" — `GET /api/v1/add-ons` runs it on every host page load.
+    await db.schema
+        .createIndex('ix_adminium_manifest_attachments_host')
+        .on(metaTable('manifest_attachments'))
+        .columns(['attached_to'])
+        .execute();
+}
+//# sourceMappingURL=0020_manifests_add_on.js.map

package/dist/migrations/0020_manifests_add_on.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0020_manifests_add_on.js","sourceRoot":"","sources":["../../src/migrations/0020_manifests_add_on.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,8EAA8E;IAC9E,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;SAClC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;SACrE,OAAO,EAAE,CAAC;IAEb,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;SAC9C,WAAW,EAAE;SACb,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;SAChD,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACvD,wDAAwD;QACxD,uEAAuE;SACtE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5D,sEAAsE;SACrE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC;SAC9B,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACtD,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,mEAAmE;SAClE,uBAAuB,CACtB,8CAA8C,EAC9C,CAAC,aAAa,CAAC,EACf,SAAS,CAAC,WAAW,CAAC,EACtB,CAAC,IAAI,CAAC,EACN,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC/B;SACA,OAAO,EAAE,CAAC;IAEb,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,uCAAuC,CAAC;SACpD,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;SACrC,OAAO,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;SACvC,MAAM,EAAE;SACR,OAAO,EAAE,CAAC;IAEb,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,uCAAuC,CAAC;SACpD,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;SACrC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;SACxB,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0021_add_on_credentials.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Wave 0021 — `adminium_add_on_credentials`: the secret a connected add-on was
+ * given, and nothing else (26-add-on-runtime.md §4, D2, D5).
+ *
+ * ─── One row per connected add-on ──────────────────────────────────────────
+ *
+ * Not per attachment. A DHL API key belongs to the add-on the operator
+ * connected, not to each host app it happens to be mounted on — connecting it
+ * twice because it is attached twice would mean two copies of one secret, two
+ * places to revoke, and a disconnect that leaves one behind. The unique index
+ * on `manifest_id` is what makes "connected" a boolean fact about an add-on.
+ *
+ * ─── What is stored, and what is deliberately not ──────────────────────────
+ *
+ * `payload` is AES-256-GCM ciphertext over the whole credential envelope,
+ * encrypted with a key derived from `ADMINIUM_SECRET` — the same discipline
+ * `adminium_connections` uses for DSNs, reached through the same
+ * `config/secrets.ts` helpers rather than a second crypto path. Its plaintext
+ * shape is a JSON object whose keys differ per `kind`, which is precisely why
+ * it is one opaque column and not a set of typed ones: an `api-key` credential
+ * and an `oauth2` token pair have nothing in common worth normalising, and
+ * columns named `access_token` invite a log line that prints them.
+ *
+ * `expires_at` and `scopes` sit OUTSIDE the ciphertext on purpose. Both are
+ * needed to decide whether to refresh and what the consent dialog should say,
+ * and neither is a secret — putting them inside would mean decrypting a token
+ * to find out it had expired, on every request.
+ *
+ * There is no `refresh_token` column. It lives inside `payload` with the access
+ * token, because a refresh token IS the credential once an access token lapses,
+ * and a schema that stores it beside the ciphertext rather than inside it is a
+ * schema that will eventually have it read by something that thought it was
+ * metadata.
+ *
+ * ─── D5: disconnect deletes this row, and only this row ────────────────────
+ *
+ * 24 D16 / 26 D5 — disconnecting keeps every table the add-on brought and
+ * destroys the keys. That is a DELETE here plus nothing anywhere else, which is
+ * a property the schema should make easy to get right: this table holds only
+ * secrets, so "delete the secrets" is one statement and cannot take data with
+ * it by accident.
+ *
+ * The FK cascades for the uninstall path — a credential outliving its manifest
+ * is an orphaned secret nothing can reach to revoke, which is strictly worse
+ * than one that is gone.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0021_add_on_credentials.d.ts.map

package/dist/migrations/0021_add_on_credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0021_add_on_credentials.d.ts","sourceRoot":"","sources":["../../src/migrations/0021_add_on_credentials.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAqC7E"}

package/dist/migrations/0021_add_on_credentials.js

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0021 — `adminium_add_on_credentials`: the secret a connected add-on was
+ * given, and nothing else (26-add-on-runtime.md §4, D2, D5).
+ *
+ * ─── One row per connected add-on ──────────────────────────────────────────
+ *
+ * Not per attachment. A DHL API key belongs to the add-on the operator
+ * connected, not to each host app it happens to be mounted on — connecting it
+ * twice because it is attached twice would mean two copies of one secret, two
+ * places to revoke, and a disconnect that leaves one behind. The unique index
+ * on `manifest_id` is what makes "connected" a boolean fact about an add-on.
+ *
+ * ─── What is stored, and what is deliberately not ──────────────────────────
+ *
+ * `payload` is AES-256-GCM ciphertext over the whole credential envelope,
+ * encrypted with a key derived from `ADMINIUM_SECRET` — the same discipline
+ * `adminium_connections` uses for DSNs, reached through the same
+ * `config/secrets.ts` helpers rather than a second crypto path. Its plaintext
+ * shape is a JSON object whose keys differ per `kind`, which is precisely why
+ * it is one opaque column and not a set of typed ones: an `api-key` credential
+ * and an `oauth2` token pair have nothing in common worth normalising, and
+ * columns named `access_token` invite a log line that prints them.
+ *
+ * `expires_at` and `scopes` sit OUTSIDE the ciphertext on purpose. Both are
+ * needed to decide whether to refresh and what the consent dialog should say,
+ * and neither is a secret — putting them inside would mean decrypting a token
+ * to find out it had expired, on every request.
+ *
+ * There is no `refresh_token` column. It lives inside `payload` with the access
+ * token, because a refresh token IS the credential once an access token lapses,
+ * and a schema that stores it beside the ciphertext rather than inside it is a
+ * schema that will eventually have it read by something that thought it was
+ * metadata.
+ *
+ * ─── D5: disconnect deletes this row, and only this row ────────────────────
+ *
+ * 24 D16 / 26 D5 — disconnecting keeps every table the add-on brought and
+ * destroys the keys. That is a DELETE here plus nothing anywhere else, which is
+ * a property the schema should make easy to get right: this table holds only
+ * secrets, so "delete the secrets" is one statement and cannot take data with
+ * it by accident.
+ *
+ * The FK cascades for the uninstall path — a credential outliving its manifest
+ * is an orphaned secret nothing can reach to revoke, which is strictly worse
+ * than one that is gone.
+ */
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    await db.schema
+        .createTable(metaTable('add_on_credentials'))
+        .ifNotExists()
+        .addColumn('id', c.id, (col) => col.primaryKey())
+        .addColumn('manifest_id', c.id, (col) => col.notNull())
+        /** `api-key` | `oauth2` — `none` never reaches this table (D2). */
+        .addColumn('kind', c.str(12), (col) => col.notNull())
+        /** AES-256-GCM ciphertext over the whole envelope. Never logged, never served. */
+        .addColumn('payload', c.text, (col) => col.notNull())
+        /** Epoch ms; NULL for a credential that does not expire (an API key). */
+        .addColumn('expires_at', c.ts)
+        /** The granted OAuth scopes, for the consent surface. Not a secret. */
+        .addColumn('scopes', c.json)
+        .addColumn('created_at', c.ts, (col) => col.notNull())
+        .addColumn('updated_at', c.ts, (col) => col.notNull())
+        // Named and table-level: MySQL parses an inline column-level `REFERENCES`
+        // and silently discards it, which would leave the cascade below existing
+        // only in this file (the 2026-07-20 CI onion).
+        .addForeignKeyConstraint('fk_adminium_add_on_credentials_manifest_id', ['manifest_id'], metaTable('manifests'), ['id'], (cb) => cb.onDelete('cascade'))
+        .execute();
+    // One credential per add-on — see the header. Unique rather than merely
+    // indexed, so a second connect is an upsert and can never become a duplicate
+    // secret the disconnect path would miss.
+    await db.schema
+        .createIndex('uq_adminium_add_on_credentials_manifest')
+        .on(metaTable('add_on_credentials'))
+        .columns(['manifest_id'])
+        .unique()
+        .execute();
+}
+//# sourceMappingURL=0021_add_on_credentials.js.map

package/dist/migrations/0021_add_on_credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0021_add_on_credentials.js","sourceRoot":"","sources":["../../src/migrations/0021_add_on_credentials.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;SAC5C,WAAW,EAAE;SACb,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;SAChD,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACvD,mEAAmE;SAClE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACrD,kFAAkF;SACjF,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACrD,yEAAyE;SACxE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;QAC9B,uEAAuE;SACtE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;SAC3B,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACrD,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACtD,0EAA0E;QAC1E,yEAAyE;QACzE,+CAA+C;SAC9C,uBAAuB,CACtB,4CAA4C,EAC5C,CAAC,aAAa,CAAC,EACf,SAAS,CAAC,WAAW,CAAC,EACtB,CAAC,IAAI,CAAC,EACN,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC/B;SACA,OAAO,EAAE,CAAC;IAEb,wEAAwE;IACxE,6EAA6E;IAC7E,yCAAyC;IACzC,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,yCAAyC,CAAC;SACtD,EAAE,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;SACnC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;SACxB,MAAM,EAAE;SACR,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0022_studio_namespace.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Wave 0022 — the Studio's messages moved namespace, so the operator's
+ * rewordings of them have to move with the messages (10-T06).
+ *
+ * ─── What moved, and why it is not a rename ────────────────────────────────
+ *
+ * `common.studio.*` and `common.studioPages.*` — 971 keys, the whole admin
+ * console — became the `studio` namespace's `*` and `pages.*`. The point was
+ * bundle weight: `studio` is fetched when somebody opens the Studio instead of
+ * shipping in every user's first load. But `adminium_translations` files a row
+ * by `(scope, locale, namespace, key)`, so an override an admin wrote against
+ * the old address stops resolving the moment the message answers to a new one.
+ * Nothing errors. The string simply reverts to the compiled English, on the
+ * one surface whose users are the people who did the rewording.
+ *
+ * So this is a DATA move, in JavaScript rather than SQL: `substr` and string
+ * concatenation are spelled three different ways across sqlite, postgres and
+ * mysql, and the row count here is bounded by how many messages a human has
+ * personally rewritten.
+ *
+ * ─── The two carried keys ──────────────────────────────────────────────────
+ *
+ * The topbar's Studio menu used to title its two items from `studio.hub.title`
+ * and `studio.settingsHub.title`. It paints on every route, long before any
+ * Studio chunk exists, so it now has its own `common:topbar.*` keys.
+ *
+ * An override on either old key is COPIED to the new one rather than only
+ * moved. The alternative is an operator who renamed "Data connections" to
+ * "Databases" finding the page still says Databases and the menu item that
+ * opens it saying Data connections — a split they did not ask for and cannot
+ * see the cause of. The cost is honest and small: two rows where there was
+ * one, so a later reset has to be done twice. Preserving what they configured
+ * is worth more than saving them a click they may never make.
+ *
+ * ─── No version bump ───────────────────────────────────────────────────────
+ *
+ * The i18n version counter in `adminium_settings` is what makes a warm browser
+ * refetch. It is deliberately untouched: a cached override under a key that no
+ * longer exists resolves for nothing and is inert, and the next ordinary write
+ * moves the counter anyway.
+ */
+import type { Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=0022_studio_namespace.d.ts.map

package/dist/migrations/0022_studio_namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0022_studio_namespace.d.ts","sourceRoot":"","sources":["../../src/migrations/0022_studio_namespace.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAwCrC,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAsD3D"}