@adminiumjs/meta 0.2.2 → 0.2.4

package/dist/ids.d.ts

@@ -44,6 +44,8 @@ export declare const ID_PREFIXES: {
     readonly whd: "adminium_webhook_deliveries";
     readonly flag: "adminium_feature_flags";
     readonly mft: "adminium_manifests";
+    readonly mat: "adminium_manifest_attachments";
+    readonly aoc: "adminium_add_on_credentials";
     readonly loc: "adminium_locales";
     readonly trn: "adminium_translations";
     readonly pbk: "adminium_public_keys";

package/dist/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;GAWG;AAQH,QAAA,MAAM,QAAQ,QAAsB,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCd,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,WAAW,CAAC;AAOhD,sEAAsE;AACtE,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,qBAAa,cAAe,SAAQ,KAAK;IAC9B,IAAI,SAAoB;CAClC;AAiDD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAc9C;AAED,MAAM,WAAW,QAAQ;IACvB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC;IACjB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8FAA8F;AAC9F,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,CAY5C;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAQ5D;AAED,yDAAyD;AACzD,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,CAAC"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;GAWG;AAQH,QAAA,MAAM,QAAQ,QAAsB,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Cd,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,WAAW,CAAC;AAOhD,sEAAsE;AACtE,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,qBAAa,cAAe,SAAQ,KAAK;IAC9B,IAAI,SAAoB;CAClC;AAiDD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAc9C;AAED,MAAM,WAAW,QAAQ;IACvB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC;IACjB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8FAA8F;AAC9F,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,CAY5C;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAQ5D;AAED,yDAAyD;AACzD,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,CAAC"}

package/dist/ids.js

@@ -50,6 +50,13 @@ export const ID_PREFIXES = {
     whd: 'adminium_webhook_deliveries',
     flag: 'adminium_feature_flags',
     mft: 'adminium_manifests',
+    // 26-add-on-runtime.md §4. `mat` and `aoc` are separate spaces rather than
+    // reusing `mft`: an attachment and a credential are addressable rows with
+    // their own lifetimes (an attachment is disabled per host, a credential is
+    // deleted on disconnect while the manifest stays), and sharing an id space
+    // with the manifest they hang off would make a stray id look valid.
+    mat: 'adminium_manifest_attachments',
+    aoc: 'adminium_add_on_credentials',
     loc: 'adminium_locales',
     trn: 'adminium_translations',
     // 28-public-surface.md §3.3 — the public surface. `pbk` is deliberately not

package/dist/ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,iDAAiD;AACjD,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AACpD,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,GAAG,EAAE,gBAAgB;IACrB,IAAI,EAAE,mBAAmB;IACzB,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,mBAAmB;IACxB,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,eAAe;IACpB,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,2BAA2B;IAChC,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,wBAAwB;IAC7B,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,0BAA0B;IAChC,GAAG,EAAE,4BAA4B;IACjC,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,kBAAkB;IACvB,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,0BAA0B;IAC/B,EAAE,EAAE,mBAAmB;IACvB,GAAG,EAAE,6BAA6B;IAClC,IAAI,EAAE,wBAAwB;IAC9B,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,uBAAuB;IAC5B,4EAA4E;IAC5E,4EAA4E;IAC5E,sEAAsE;IACtE,GAAG,EAAE,sBAAsB;IAC3B,GAAG,EAAE,wBAAwB;IAC7B,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,4BAA4B;CACzB,CAAC;AAIX,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AAE1E,+EAA+E;AAC/E,MAAM,KAAK,GAAG,kDAAkD,CAAC;AAEjE,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,GAAG,gBAAgB,CAAC;CAClC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC;QACpC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAS,QAAQ,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAI,KAAK,CAAC,CAAC,CAAY,GAAG,EAAE,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;AAClB,IAAI,QAAQ,GAAa,EAAE,CAAC;AAE5B,SAAS,aAAa,CAAC,IAAc;IACnC,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,sEAAsE;IACtE,MAAM,IAAI,cAAc,CAAC,qDAAqD,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,MAAgB;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,cAAc,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClB,0EAA0E;QAC1E,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,CAAC,CAAC;QACb,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAaD,8FAA8F;AAC9F,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAwC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,EAAE,CAAC,MAAM,GAAG,aAAa;QAAE,MAAM,IAAI,cAAc,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO;QACL,MAAM,EAAE,MAAkB;QAC1B,KAAK,EAAE,WAAW,CAAC,MAAkB,CAAC;QACtC,IAAI;QACJ,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,IAAI,CAAC,EAAW,EAAE,MAAiB;IACjD,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3B,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,MAAM,CAAC,EAAU;IAC/B,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,aAAa;IAC3B,QAAQ,GAAG,CAAC,CAAC,CAAC;IACd,QAAQ,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,CAAC"}
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,iDAAiD;AACjD,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AACpD,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,GAAG,EAAE,gBAAgB;IACrB,IAAI,EAAE,mBAAmB;IACzB,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,mBAAmB;IACxB,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,eAAe;IACpB,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,2BAA2B;IAChC,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,wBAAwB;IAC7B,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE,0BAA0B;IAChC,GAAG,EAAE,4BAA4B;IACjC,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,kBAAkB;IACvB,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,0BAA0B;IAC/B,EAAE,EAAE,mBAAmB;IACvB,GAAG,EAAE,6BAA6B;IAClC,IAAI,EAAE,wBAAwB;IAC9B,GAAG,EAAE,oBAAoB;IACzB,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,oEAAoE;IACpE,GAAG,EAAE,+BAA+B;IACpC,GAAG,EAAE,6BAA6B;IAClC,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,uBAAuB;IAC5B,4EAA4E;IAC5E,4EAA4E;IAC5E,sEAAsE;IACtE,GAAG,EAAE,sBAAsB;IAC3B,GAAG,EAAE,wBAAwB;IAC7B,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,4BAA4B;CACzB,CAAC;AAIX,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AAE1E,+EAA+E;AAC/E,MAAM,KAAK,GAAG,kDAAkD,CAAC;AAEjE,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,GAAG,gBAAgB,CAAC;CAClC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC;QACpC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAS,QAAQ,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAI,KAAK,CAAC,CAAC,CAAY,GAAG,EAAE,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;AAClB,IAAI,QAAQ,GAAa,EAAE,CAAC;AAE5B,SAAS,aAAa,CAAC,IAAc;IACnC,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,sEAAsE;IACtE,MAAM,IAAI,cAAc,CAAC,qDAAqD,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,MAAgB;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,cAAc,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClB,0EAA0E;QAC1E,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,CAAC,CAAC;QACb,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAaD,8FAA8F;AAC9F,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAwC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,EAAE,CAAC,MAAM,GAAG,aAAa;QAAE,MAAM,IAAI,cAAc,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO;QACL,MAAM,EAAE,MAAkB;QAC1B,KAAK,EAAE,WAAW,CAAC,MAAkB,CAAC;QACtC,IAAI;QACJ,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,IAAI,CAAC,EAAW,EAAE,MAAiB;IACjD,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3B,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,MAAM,CAAC,EAAU;IAC/B,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,aAAa;IAC3B,QAAQ,GAAG,CAAC,CAAC,CAAC;IACd,QAAQ,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,CAAC"}

package/dist/migrations/0015_connection_tenant_config.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Wave 0015 — `adminium_connections.timezone` / `.currency` (28-T34, D20).
+ *
+ * ─── Why these are connection columns and not a settings table ──────────────
+ *
+ * D20 ruled O7 as a hybrid: Adminium owns only what it needs to serve correct
+ * data, and it placed `timezone` on the SCOPE document — explicitly rejecting a
+ * global `adminium_settings` key, because that is "wrong the moment an instance
+ * holds two connections for businesses in different zones".
+ *
+ * That argument is right, and it points one level further than the ruling took
+ * it. The thing a zone belongs to is the BUSINESS, and the business is the
+ * database — the connection. A scope is a view onto a connection, and an
+ * instance can hold several scopes over one connection; putting the zone on the
+ * scope means the same business can be described by two scopes that disagree
+ * about what time it is there, with nothing to reconcile them.
+ *
+ * ─── What forced it ────────────────────────────────────────────────────────
+ *
+ * A surface hosted BY Adminium reads through the operator's session. It has no
+ * publishable key and therefore NO SCOPE, so under the old placement there was
+ * nowhere for it to read a zone from at all — the app took it as a build
+ * argument, which makes a property of the business a property of the artifact.
+ * Hosted mode postdates D20; this is the consequence, not a reversal.
+ *
+ * ─── What does not change ──────────────────────────────────────────────────
+ *
+ * `scope.timezone` stays, as an OVERRIDE. It becomes optional and inherits from
+ * the connection when omitted, and `compileScope` still refuses a scope that
+ * ends up with no valid IANA zone from either source — so D20's boot-fatal
+ * guarantee survives intact and every scope already stored keeps working
+ * unchanged.
+ *
+ * Both columns are nullable with no default. There is no defensible default for
+ * a timezone: a wrong zone is worse than a missing one, because it looks like
+ * data. `null` means "not configured", and the refusal happens where the value
+ * is needed rather than being papered over here.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0015_connection_tenant_config.d.ts.map

package/dist/migrations/0015_connection_tenant_config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0015_connection_tenant_config.d.ts","sourceRoot":"","sources":["../../src/migrations/0015_connection_tenant_config.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAY7E"}

package/dist/migrations/0015_connection_tenant_config.js

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0015 — `adminium_connections.timezone` / `.currency` (28-T34, D20).
+ *
+ * ─── Why these are connection columns and not a settings table ──────────────
+ *
+ * D20 ruled O7 as a hybrid: Adminium owns only what it needs to serve correct
+ * data, and it placed `timezone` on the SCOPE document — explicitly rejecting a
+ * global `adminium_settings` key, because that is "wrong the moment an instance
+ * holds two connections for businesses in different zones".
+ *
+ * That argument is right, and it points one level further than the ruling took
+ * it. The thing a zone belongs to is the BUSINESS, and the business is the
+ * database — the connection. A scope is a view onto a connection, and an
+ * instance can hold several scopes over one connection; putting the zone on the
+ * scope means the same business can be described by two scopes that disagree
+ * about what time it is there, with nothing to reconcile them.
+ *
+ * ─── What forced it ────────────────────────────────────────────────────────
+ *
+ * A surface hosted BY Adminium reads through the operator's session. It has no
+ * publishable key and therefore NO SCOPE, so under the old placement there was
+ * nowhere for it to read a zone from at all — the app took it as a build
+ * argument, which makes a property of the business a property of the artifact.
+ * Hosted mode postdates D20; this is the consequence, not a reversal.
+ *
+ * ─── What does not change ──────────────────────────────────────────────────
+ *
+ * `scope.timezone` stays, as an OVERRIDE. It becomes optional and inherits from
+ * the connection when omitted, and `compileScope` still refuses a scope that
+ * ends up with no valid IANA zone from either source — so D20's boot-fatal
+ * guarantee survives intact and every scope already stored keeps working
+ * unchanged.
+ *
+ * Both columns are nullable with no default. There is no defensible default for
+ * a timezone: a wrong zone is worse than a missing one, because it looks like
+ * data. `null` means "not configured", and the refusal happens where the value
+ * is needed rather than being papered over here.
+ */
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('connections'))
+        // IANA zone, e.g. `Europe/Lisbon`. 64 matches the scope schema's own cap.
+        .addColumn('timezone', c.str(64))
+        .execute();
+    await db.schema
+        .alterTable(metaTable('connections'))
+        // ISO-4217, three letters. Null when this business's data carries no money.
+        .addColumn('currency', c.str(3))
+        .execute();
+}
+//# sourceMappingURL=0015_connection_tenant_config.js.map

package/dist/migrations/0015_connection_tenant_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0015_connection_tenant_config.js","sourceRoot":"","sources":["../../src/migrations/0015_connection_tenant_config.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACrC,0EAA0E;SACzE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAChC,OAAO,EAAE,CAAC;IAEb,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACrC,4EAA4E;SAC3E,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC/B,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0016_audit_entity.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Wave 0016 — per-record audit lookup (30-record-pages.md WS-A).
+ *
+ * The record page's Activity tab needs "every audit entry for THIS record".
+ * The entry's `entity` column stores a RecordRef, but as packed JSON text —
+ * filtering on it means either a per-dialect JSON-extract expression (three
+ * syntaxes, none of them indexable without generated columns) or a full scan
+ * of the `data` category. Both are the amplification anti-pattern D6 exists
+ * to rule out, so the ref's two lookup facts are denormalized into real,
+ * indexed columns instead:
+ *
+ *   entity_table  the ref's qualified table ("public.invoices")
+ *   entity_id     the canonical record-id string — `pkLabel` form: a single
+ *                 PK stringified, a composite PK as the JSON value tuple —
+ *                 the same string the record route and `rowIdOf` use. See
+ *                 `keysOf` for why a BACKFILLED composite reads the ref's
+ *                 `label` rather than re-deriving from `pk`.
+ *
+ * Both are clamped by `auditEntityKeyPart` (write AND query side, so a
+ * truncated key still matches itself), written by `auditRepo.append` from
+ * this wave on, and BACKFILLED here from the stored refs so pre-existing
+ * activity shows up on day one. The backfill parses each ref in JS — the
+ * only portable JSON reader across the three dialects — in id-keyset batches;
+ * audit volume is retention-bounded (§8 `audit-log` policy), so this is a
+ * one-time bounded cost.
+ *
+ * Bulk writes (`record.bulk-*`) carry no per-row entity and stay out of the
+ * feed by design (30 D6) — their rows simply keep NULL keys.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0016_audit_entity.d.ts.map

package/dist/migrations/0016_audit_entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0016_audit_entity.d.ts","sourceRoot":"","sources":["../../src/migrations/0016_audit_entity.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAuEnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA8C7E"}

package/dist/migrations/0016_audit_entity.js

@@ -0,0 +1,137 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0016 — per-record audit lookup (30-record-pages.md WS-A).
+ *
+ * The record page's Activity tab needs "every audit entry for THIS record".
+ * The entry's `entity` column stores a RecordRef, but as packed JSON text —
+ * filtering on it means either a per-dialect JSON-extract expression (three
+ * syntaxes, none of them indexable without generated columns) or a full scan
+ * of the `data` category. Both are the amplification anti-pattern D6 exists
+ * to rule out, so the ref's two lookup facts are denormalized into real,
+ * indexed columns instead:
+ *
+ *   entity_table  the ref's qualified table ("public.invoices")
+ *   entity_id     the canonical record-id string — `pkLabel` form: a single
+ *                 PK stringified, a composite PK as the JSON value tuple —
+ *                 the same string the record route and `rowIdOf` use. See
+ *                 `keysOf` for why a BACKFILLED composite reads the ref's
+ *                 `label` rather than re-deriving from `pk`.
+ *
+ * Both are clamped by `auditEntityKeyPart` (write AND query side, so a
+ * truncated key still matches itself), written by `auditRepo.append` from
+ * this wave on, and BACKFILLED here from the stored refs so pre-existing
+ * activity shows up on day one. The backfill parses each ref in JS — the
+ * only portable JSON reader across the three dialects — in id-keyset batches;
+ * audit volume is retention-bounded (§8 `audit-log` policy), so this is a
+ * one-time bounded cost.
+ *
+ * Bulk writes (`record.bulk-*`) carry no per-row entity and stay out of the
+ * feed by design (30 D6) — their rows simply keep NULL keys.
+ */
+import { metaTable } from '../prefix.js';
+import { AUDIT_ENTITY_KEY_MAX, auditEntityKeyOf, auditEntityKeyPart, recordRefSchema, } from '../schema/json-payloads.js';
+const BACKFILL_BATCH = 500;
+/**
+ * A STORED ref has lost the one thing `auditEntityKeyOf` reads for a composite
+ * key: the order of `pk`.
+ *
+ * `entity` is `jsonb` on postgres and `json` on mysql, and both normalise
+ * object keys on the way in — jsonb by key length then bytes, mysql likewise.
+ * So `{invoice_id, line}` comes back as `{line, invoice_id}` and
+ * `Object.values()` yields the tuple backwards, producing an id that matches no
+ * record. Only sqlite, which stores the column as text, keeps the written
+ * order, which is why deriving from `pk` passed there and failed on the other
+ * two. There is no recovering the order from the stored value: jsonb and mysql
+ * json are parsed forms, so even casting back to text returns the normalised
+ * key order rather than the original.
+ *
+ * A single-column key has no order to lose, so it still derives from `pk`.
+ *
+ * A composite one falls back to the ref's `label`, which the only writer of a
+ * record ref (`routes/data`) sets to `pkLabel(table, pk)` — the same tuple, in
+ * the table's primary-key order, as a plain string no store reorders. `label`
+ * is display text by contract and NOT guaranteed to be that tuple, so it is
+ * used only when it still parses as a JSON array of the right arity; anything
+ * else leaves the row NULL. A legacy row that opts out of the feed is the
+ * documented outcome for a ref this reader cannot trust — a confidently wrong
+ * key that silently attaches one record's history to another is not.
+ */
+function keysOf(entity) {
+    // Postgres `jsonb` columns come back as objects; sqlite/mysql as text.
+    let candidate = entity;
+    if (typeof entity === 'string') {
+        try {
+            candidate = JSON.parse(entity);
+        }
+        catch {
+            return null;
+        }
+    }
+    const parsed = recordRefSchema.safeParse(candidate);
+    if (!parsed.success)
+        return null;
+    const ref = parsed.data;
+    const arity = Object.keys(ref.pk).length;
+    if (arity <= 1)
+        return auditEntityKeyOf(ref);
+    let tuple;
+    try {
+        tuple = JSON.parse(ref.label);
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(tuple) || tuple.length !== arity)
+        return null;
+    return { entityTable: auditEntityKeyPart(ref.table), entityId: auditEntityKeyPart(ref.label) };
+}
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('audit_log'))
+        .addColumn('entity_table', c.str(AUDIT_ENTITY_KEY_MAX))
+        .execute();
+    await db.schema
+        .alterTable(metaTable('audit_log'))
+        .addColumn('entity_id', c.str(AUDIT_ENTITY_KEY_MAX))
+        .execute();
+    // (entity_table, entity_id, created_at): the feed's exact access path —
+    // equality on both keys, ordered by recency. 2×200×4 utf8mb4 bytes + the
+    // timestamp stays under MySQL's 3072-byte InnoDB index cap.
+    await db.schema
+        .createIndex('idx_adminium_audit_log_entity_created')
+        .on(metaTable('audit_log'))
+        .columns(['entity_table', 'entity_id', 'created_at'])
+        .execute();
+    // Backfill: id-keyset batches over rows that carry a ref. Unparseable JSON
+    // stays NULL — a row this reader cannot interpret must not fail the wave.
+    const backfill = db;
+    const audit = metaTable('audit_log');
+    let after = '';
+    for (;;) {
+        const rows = await backfill
+            .selectFrom(audit)
+            .select(['id', 'entity'])
+            .where('entity', 'is not', null)
+            .where('id', '>', after)
+            .orderBy('id', 'asc')
+            .limit(BACKFILL_BATCH)
+            .execute();
+        if (rows.length === 0)
+            break;
+        for (const row of rows) {
+            const keys = keysOf(row.entity);
+            if (keys === null)
+                continue;
+            await backfill
+                .updateTable(audit)
+                .set({ entityTable: keys.entityTable, entityId: keys.entityId })
+                .where('id', '=', row.id)
+                .execute();
+        }
+        const last = rows[rows.length - 1];
+        if (last === undefined || rows.length < BACKFILL_BATCH)
+            break;
+        after = last.id;
+    }
+}
+//# sourceMappingURL=0016_audit_entity.js.map

package/dist/migrations/0016_audit_entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0016_audit_entity.js","sourceRoot":"","sources":["../../src/migrations/0016_audit_entity.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,cAAc,GAAG,GAAG,CAAC;AAW3B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,MAAM,CAAC,MAAe;IAC7B,uEAAuE;IACvE,IAAI,SAAS,GAAY,MAAM,CAAC;IAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE7C,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,EAAE,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;SAClC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;SACtD,OAAO,EAAE,CAAC;IACb,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;SAClC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;SACnD,OAAO,EAAE,CAAC;IACb,wEAAwE;IACxE,yEAAyE;IACzE,4DAA4D;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,uCAAuC,CAAC;SACpD,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;SAC1B,OAAO,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;SACpD,OAAO,EAAE,CAAC;IAEb,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,EAA2B,CAAC;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,QAAQ;aACxB,UAAU,CAAC,KAAK,CAAC;aACjB,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;aACxB,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC;aAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;aACvB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;aACpB,KAAK,CAAC,cAAc,CAAC;aACrB,OAAO,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC5B,MAAM,QAAQ;iBACX,WAAW,CAAC,KAAK,CAAC;iBAClB,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;iBAC/D,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;iBACxB,OAAO,EAAE,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc;YAAE,MAAM;QAC9D,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/migrations/0017_surface_binding.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Wave 0017 — key ↔ app-surface binding (29-app-surfaces.md D10, 29-T15).
+ *
+ * A hosted CUSTOMER surface is configured at serve time, not bake time: the
+ * surfaces plugin answers `GET /apps/<key>/customer/surface-config.json` with
+ * the newest live publishable key bound to that app, so rotating a key is
+ * Studio + reload rather than a rebuild. "Bound to that app" needs a COLUMN —
+ * before this wave, "minted per side per app" was a naming convention on
+ * `adminium_public_keys.name`, which nothing could query.
+ *
+ * `app_key` is the manifest key of the owning app (`clients`, `clinic`, …),
+ * nullable because binding is optional: a key minted for a standalone build
+ * or a third-party integration belongs to no hosted surface and stays NULL.
+ *
+ * Planned as `0016_surface_binding` (29 D10); renumbered to 0017 because
+ * plan 30's `0016_audit_entity` shipped first and the list is append-only.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+/** Matches the discovery layout: a surface directory name, e.g. `clients`. */
+export declare const PUBLIC_KEY_APP_KEY_MAX = 64;
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0017_surface_binding.d.ts.map

package/dist/migrations/0017_surface_binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0017_surface_binding.d.ts","sourceRoot":"","sources":["../../src/migrations/0017_surface_binding.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAc7E"}

package/dist/migrations/0017_surface_binding.js

@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0017 — key ↔ app-surface binding (29-app-surfaces.md D10, 29-T15).
+ *
+ * A hosted CUSTOMER surface is configured at serve time, not bake time: the
+ * surfaces plugin answers `GET /apps/<key>/customer/surface-config.json` with
+ * the newest live publishable key bound to that app, so rotating a key is
+ * Studio + reload rather than a rebuild. "Bound to that app" needs a COLUMN —
+ * before this wave, "minted per side per app" was a naming convention on
+ * `adminium_public_keys.name`, which nothing could query.
+ *
+ * `app_key` is the manifest key of the owning app (`clients`, `clinic`, …),
+ * nullable because binding is optional: a key minted for a standalone build
+ * or a third-party integration belongs to no hosted surface and stays NULL.
+ *
+ * Planned as `0016_surface_binding` (29 D10); renumbered to 0017 because
+ * plan 30's `0016_audit_entity` shipped first and the list is append-only.
+ */
+import { metaTable } from '../prefix.js';
+/** Matches the discovery layout: a surface directory name, e.g. `clients`. */
+export const PUBLIC_KEY_APP_KEY_MAX = 64;
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('public_keys'))
+        .addColumn('app_key', c.str(PUBLIC_KEY_APP_KEY_MAX))
+        .execute();
+    // (app_key, side): the config route's exact lookup — every live key for one
+    // app's side, newest picked in the query. The table is operator-scale (tens
+    // of rows), but the read is on an anonymous, unauthenticated path, so it
+    // should not scan by policy rather than by size.
+    await db.schema
+        .createIndex('ix_adminium_public_keys_app')
+        .on(metaTable('public_keys'))
+        .columns(['app_key', 'side'])
+        .execute();
+}
+//# sourceMappingURL=0017_surface_binding.js.map

package/dist/migrations/0017_surface_binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0017_surface_binding.js","sourceRoot":"","sources":["../../src/migrations/0017_surface_binding.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;SACpC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;SACnD,OAAO,EAAE,CAAC;IACb,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,6BAA6B,CAAC;SAC1C,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;SAC5B,OAAO,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;SAC5B,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0018_connection_timezone_source.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Wave 0018 — `adminium_connections.timezoneSource`: WHO chose the zone.
+ *
+ * ─── What changed under 0015 ───────────────────────────────────────────────
+ *
+ * 0015 added `timezone` and argued for no default at all: "a wrong zone is
+ * worse than a missing one, because it looks like data". `connectionsRepo`
+ * later seeded new rows from the SERVER's zone anyway, and for a good reason —
+ * a null zone made a hosted app surface refuse to render, so the cost of the
+ * missing value landed as total unavailability rather than an hour's drift.
+ *
+ * Both positions are right about their own failure, and the column below is
+ * what lets them both hold. A seeded zone keeps surfaces rendering; recording
+ * that it was seeded keeps it from passing as a decision nobody made.
+ *
+ * ─── Why provenance and not a different default ────────────────────────────
+ *
+ * Without this column a stored zone is two very different facts wearing one
+ * value: something an operator chose for the business, or something the server
+ * guessed from the clock of whatever machine it happens to run on (a developer
+ * laptop, a container defaulting to UTC, a VM in the wrong region). Studio
+ * renders them identically, so the guess reads as a decision — reproducing in
+ * the UI precisely the failure 0015 refused in the data.
+ *
+ * ─── Values, and why NULL is not backfilled ────────────────────────────────
+ *
+ *   'operator'  a human set this — the wizard, Studio, or `PATCH /connections`
+ *   'host'      `connectionsRepo.create` derived it from the server's own zone
+ *   NULL        unknown, or no zone to attribute
+ *
+ * Rows predating this column are left NULL rather than guessed at, and NULL
+ * must render as no claim at all. The asymmetry is deliberate: under-claiming
+ * costs an operator a badge they did not need, while over-claiming tells
+ * someone their correct, deliberately chosen zone is a guess — which is how a
+ * badge earns the right to be ignored.
+ *
+ * A zone that is itself NULL carries a NULL source: there is no choice to
+ * attribute, and "the operator chose nothing" is a state `timezone` already
+ * records on its own.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0018_connection_timezone_source.d.ts.map

package/dist/migrations/0018_connection_timezone_source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0018_connection_timezone_source.d.ts","sourceRoot":"","sources":["../../src/migrations/0018_connection_timezone_source.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7E"}

package/dist/migrations/0018_connection_timezone_source.js

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0018 — `adminium_connections.timezoneSource`: WHO chose the zone.
+ *
+ * ─── What changed under 0015 ───────────────────────────────────────────────
+ *
+ * 0015 added `timezone` and argued for no default at all: "a wrong zone is
+ * worse than a missing one, because it looks like data". `connectionsRepo`
+ * later seeded new rows from the SERVER's zone anyway, and for a good reason —
+ * a null zone made a hosted app surface refuse to render, so the cost of the
+ * missing value landed as total unavailability rather than an hour's drift.
+ *
+ * Both positions are right about their own failure, and the column below is
+ * what lets them both hold. A seeded zone keeps surfaces rendering; recording
+ * that it was seeded keeps it from passing as a decision nobody made.
+ *
+ * ─── Why provenance and not a different default ────────────────────────────
+ *
+ * Without this column a stored zone is two very different facts wearing one
+ * value: something an operator chose for the business, or something the server
+ * guessed from the clock of whatever machine it happens to run on (a developer
+ * laptop, a container defaulting to UTC, a VM in the wrong region). Studio
+ * renders them identically, so the guess reads as a decision — reproducing in
+ * the UI precisely the failure 0015 refused in the data.
+ *
+ * ─── Values, and why NULL is not backfilled ────────────────────────────────
+ *
+ *   'operator'  a human set this — the wizard, Studio, or `PATCH /connections`
+ *   'host'      `connectionsRepo.create` derived it from the server's own zone
+ *   NULL        unknown, or no zone to attribute
+ *
+ * Rows predating this column are left NULL rather than guessed at, and NULL
+ * must render as no claim at all. The asymmetry is deliberate: under-claiming
+ * costs an operator a badge they did not need, while over-claiming tells
+ * someone their correct, deliberately chosen zone is a guess — which is how a
+ * badge earns the right to be ignored.
+ *
+ * A zone that is itself NULL carries a NULL source: there is no choice to
+ * attribute, and "the operator chose nothing" is a state `timezone` already
+ * records on its own.
+ */
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('connections'))
+        // 'operator' is the longest value at 8; 16 leaves room for a third source
+        // (an inherited or probed zone) without a second ALTER.
+        .addColumn('timezone_source', c.str(16))
+        .execute();
+}
+//# sourceMappingURL=0018_connection_timezone_source.js.map

package/dist/migrations/0018_connection_timezone_source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0018_connection_timezone_source.js","sourceRoot":"","sources":["../../src/migrations/0018_connection_timezone_source.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACrC,0EAA0E;QAC1E,wDAAwD;SACvD,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SACvC,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/migrations/0019_connection_disabled.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Wave 0019 — `adminium_connections.disabled_at`: the operator PAUSED this
+ * source, and when.
+ *
+ * ─── Why not a `status` value ──────────────────────────────────────────────
+ *
+ * `status` is a HEALTH reading — `connected` / `error` / `unconfigured` — and
+ * every writer of it is a probe (`recordTestResult`, the create path). Folding
+ * a pause into that enum would mean the next successful test silently unpaused
+ * the connection, because a probe's whole job is to overwrite `status` with
+ * what it just observed. It would also destroy the reading underneath: an
+ * operator who pauses a source that is currently failing, fixes the database,
+ * and resumes has no way back to `error` because nothing recorded it.
+ *
+ * Health is observed; a pause is INTENDED. Two facts, two columns, and the
+ * card can say "paused, and it was failing when you paused it".
+ *
+ * ─── Why a timestamp and not a boolean ─────────────────────────────────────
+ *
+ * A pause is meant to be temporary, so "how long has this been off?" is the
+ * question that follows it — a source paused an hour ago during a migration
+ * and one paused five weeks ago and forgotten are the same boolean and very
+ * different situations. NULL means enabled; anything else is the epoch-ms
+ * instant it was paused (07-meta-store.md §2.1: never a native datetime).
+ *
+ * WHO paused it is not stored here. The audit log already records the actor
+ * for `connection.disable` / `connection.enable` alongside every other
+ * connection action, and a second, unjoined copy on the row would be one more
+ * thing that can disagree with it.
+ *
+ * ─── Backfill ──────────────────────────────────────────────────────────────
+ *
+ * None. Every pre-0019 row was serving, which is exactly what NULL means.
+ */
+import type { Kysely } from 'kysely';
+import type { ColumnHelpers } from '../columns.js';
+export declare function up(db: Kysely<unknown>, c: ColumnHelpers): Promise<void>;
+//# sourceMappingURL=0019_connection_disabled.d.ts.map

package/dist/migrations/0019_connection_disabled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0019_connection_disabled.d.ts","sourceRoot":"","sources":["../../src/migrations/0019_connection_disabled.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7E"}

package/dist/migrations/0019_connection_disabled.js

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Wave 0019 — `adminium_connections.disabled_at`: the operator PAUSED this
+ * source, and when.
+ *
+ * ─── Why not a `status` value ──────────────────────────────────────────────
+ *
+ * `status` is a HEALTH reading — `connected` / `error` / `unconfigured` — and
+ * every writer of it is a probe (`recordTestResult`, the create path). Folding
+ * a pause into that enum would mean the next successful test silently unpaused
+ * the connection, because a probe's whole job is to overwrite `status` with
+ * what it just observed. It would also destroy the reading underneath: an
+ * operator who pauses a source that is currently failing, fixes the database,
+ * and resumes has no way back to `error` because nothing recorded it.
+ *
+ * Health is observed; a pause is INTENDED. Two facts, two columns, and the
+ * card can say "paused, and it was failing when you paused it".
+ *
+ * ─── Why a timestamp and not a boolean ─────────────────────────────────────
+ *
+ * A pause is meant to be temporary, so "how long has this been off?" is the
+ * question that follows it — a source paused an hour ago during a migration
+ * and one paused five weeks ago and forgotten are the same boolean and very
+ * different situations. NULL means enabled; anything else is the epoch-ms
+ * instant it was paused (07-meta-store.md §2.1: never a native datetime).
+ *
+ * WHO paused it is not stored here. The audit log already records the actor
+ * for `connection.disable` / `connection.enable` alongside every other
+ * connection action, and a second, unjoined copy on the row would be one more
+ * thing that can disagree with it.
+ *
+ * ─── Backfill ──────────────────────────────────────────────────────────────
+ *
+ * None. Every pre-0019 row was serving, which is exactly what NULL means.
+ */
+import { metaTable } from '../prefix.js';
+export async function up(db, c) {
+    await db.schema
+        .alterTable(metaTable('connections'))
+        .addColumn('disabled_at', c.ts)
+        .execute();
+}
+//# sourceMappingURL=0019_connection_disabled.js.map

package/dist/migrations/0019_connection_disabled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0019_connection_disabled.js","sourceRoot":"","sources":["../../src/migrations/0019_connection_disabled.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB,EAAE,CAAgB;IAC5D,MAAM,EAAE,CAAC,MAAM;SACZ,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;SACpC,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC;SAC9B,OAAO,EAAE,CAAC;AACf,CAAC"}