@aigne/afs-did-space 1.12.0-beta.5

package/dist/d1-schema.d.mts

@@ -0,0 +1,237 @@
+//#region src/d1-schema.d.ts
+/**
+ * D1 schema — the single source of truth for the did-space D1 DDL.
+ *
+ * Consumed by BOTH:
+ *   1. The runtime safety-net creators (`D1TreeIndex.ensureTable`,
+ *      `D1ResolveStore.ensureTable`, `D1GCQueue.ensureTable`) — fresh-DB
+ *      bootstrap for tests / first-ever deploys.
+ *   2. The generated wrangler migration (`0100_did_space_schema.sql`,
+ *      assembled by runtimes/cloudflare/scripts/apply-d1-migrations.mjs) —
+ *      the deploy-time path that lets production isolates SKIP the runtime
+ *      schema probe entirely (`AFS_SKIP_SCHEMA_PROBE`).
+ *
+ * Because the migration is GENERATED from these constants at build time,
+ * the two paths cannot drift — there is no hand-maintained SQL copy.
+ * (Same single-source pattern as changelog-schema.ts, which keeps the four
+ * device runtimes byte-equivalent.)
+ *
+ * Every statement is idempotent (`IF NOT EXISTS`) so re-applying on an
+ * existing database — including one originally bootstrapped by the runtime
+ * path — is a no-op.
+ */
+/**
+ * Inline-content column migration (Layer 0 inline capability, see
+ * `inline-content.ts`). Shipped as an ADDITIVE `ALTER TABLE` — NOT folded
+ * into `ENTRIES_TABLE_SQL` — because the generated 0100 migration is already
+ * recorded as applied on existing deployments and `ALTER TABLE ADD COLUMN`
+ * has no `IF NOT EXISTS` (folding it into the CREATE would make the additive
+ * migration fail on fresh databases with "duplicate column"). Same pattern
+ * as connect-service's 0002.
+ *
+ * Consumed by BOTH:
+ *   1. runtime guards (`D1TreeIndex.ensureTable`, `MetadataDB.open`) — they
+ *      probe `pragma_table_info('entries')` and apply this only when the
+ *      column is missing;
+ *   2. the generated wrangler migration
+ *      (`0102_entries_inline_content.sql`, apply-d1-migrations.mjs) — the
+ *      deploy-time path, applied exactly once per database via the
+ *      `d1_migrations` bookkeeping table.
+ *
+ * `LENGTH(CAST(content AS BLOB))` counts BYTES (TEXT `LENGTH()` counts
+ * characters and stops at an embedded NUL) — the hard cap is a byte cap.
+ * The CHECK is the fixed defensive upper bound; the configurable app-level
+ * threshold lives in `inline-content.ts` (two values, never conflated).
+ */
+declare const ENTRIES_INLINE_CONTENT_COLUMN_SQL = "ALTER TABLE ds_entries ADD COLUMN content TEXT CHECK (content IS NULL OR LENGTH(CAST(content AS BLOB)) <= 65536)";
+/**
+ * Application metadata column (planning/agent-hub/metadata-foundation.md).
+ * Stores `AFSWriteEntryPayload.meta` as a JSON blob — application-level
+ * dimension fields (`user_did / blocklet_id / hub / model / cost / ...`)
+ * that the application uses for filter / aggregate via collection-query's
+ * `meta.*` paths. NULL when the application wrote no meta. Provider-computed
+ * fields (`kind / size / cid / mimeType`) are NOT stored here — they live
+ * in their own columns and are merged into `entry.meta` at read time.
+ *
+ * Shipped as an ADDITIVE ALTER (same reasoning as
+ * `ENTRIES_INLINE_CONTENT_COLUMN_SQL`): the generated 0100 migration is
+ * already applied on existing deployments and ADD COLUMN has no
+ * IF NOT EXISTS, so this must stay separate from `ENTRIES_TABLE_SQL`.
+ *
+ * Consumed by BOTH:
+ *   1. runtime guards (`D1TreeIndex.ensureTable`, `MetadataDB.open`) —
+ *      they probe `pragma_table_info('entries')` and apply this only when
+ *      the column is missing;
+ *   2. the generated wrangler migration
+ *      (`0107_entries_metadata.sql`, apply-d1-migrations.mjs).
+ */
+declare const ENTRIES_METADATA_COLUMN_SQL = "ALTER TABLE ds_entries ADD COLUMN metadata TEXT";
+/**
+ * Dedup-on-write secondary index columns (#1159). Replace the old
+ * cid-in-path dedup scheme (`{collection}/{cid(url)}.json`) with a real
+ * DB-enforced unique index so a dedup record lives at a stable readable path
+ * (`{collection}/{uuid}.json`) and dedup resolves via an O(log n) point seek —
+ * not a `json_extract` scan and not a normalization-derived filename.
+ *
+ * - `dedup_scope` = the collection the record dedups within (the write `path`),
+ *   deliberately decoupled from the row's physical `parent` so flat and legacy
+ *   dir-per-record layouts dedup against the same scope.
+ * - `dedup_key`   = the normalized identity value (e.g. `normalizeItemUrl`).
+ *
+ * Shipped as ADDITIVE `ALTER`s (same reasoning as the inline-content / metadata
+ * columns: the base `ENTRIES_TABLE_SQL` and the generated 0100 migration are
+ * already applied on existing deployments, and `ADD COLUMN` has no
+ * `IF NOT EXISTS`). The partial UNIQUE index is created AFTER both columns
+ * exist. Precedent for the composite unique: `SHARES_TABLE_SQL`'s
+ * `UNIQUE(owner_did, decl_path)`.
+ *
+ * Consumed by BOTH runtime guards (`D1TreeIndex.ensureTable`,
+ * `MetadataDB.open`) and the generated wrangler migration
+ * (`0117_entries_dedup.sql`, apply-d1-migrations.mjs).
+ */
+declare const ENTRIES_DEDUP_SCOPE_COLUMN_SQL = "ALTER TABLE ds_entries ADD COLUMN dedup_scope TEXT";
+declare const ENTRIES_DEDUP_KEY_COLUMN_SQL = "ALTER TABLE ds_entries ADD COLUMN dedup_key TEXT";
+/**
+ * Partial UNIQUE index backing dedup-on-write. `WHERE dedup_key IS NOT NULL`
+ * keeps every non-dedup row (the overwhelming majority) out of the index, so it
+ * costs nothing for normal writes and only enforces uniqueness among records
+ * that opted into dedup. This is BOTH the fast lookup path (`findByDedupKey`)
+ * AND the concurrency backstop (a racing create collides here, the loser
+ * re-queries and merges).
+ */
+declare const ENTRIES_DEDUP_INDEX_SQL = "CREATE UNIQUE INDEX IF NOT EXISTS idx_entries_dedup ON ds_entries(scope, dedup_scope, dedup_key) WHERE dedup_key IS NOT NULL";
+/**
+ * Content-type virtual generated column (#1293). Materializes `$.type` from
+ * the inline-content JSON column. Virtual (not stored): zero write overhead —
+ * the value is computed on read from the already-present `content` column,
+ * NULL for entries whose `content` is NULL or is not valid JSON / lacks a
+ * `$.type` field.
+ *
+ * The column is RETAINED but INERT (#1367): its backing index
+ * `idx_entries_content_type` has been dropped (see
+ * `ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL` below) because no query ever referenced
+ * the generated column by name — collection-query's `compileLeaf` emits
+ * `lower(json_extract(content, '$.type')) = lower(?)` (tree-query.ts), which
+ * SQLite's expression-index equivalence cannot rewrite to `WHERE content_type
+ * = ?`, so the index was never hit and only taxed every write. The virtual
+ * column costs nothing (computed on read, currently never read) and is left in
+ * place; whether rare-type filtering is re-homed (via the generic `metadata`
+ * `meta.*` channel, NOT by the provider reaching into `content`) is the open
+ * decision in #1367. `$.type` is aside application schema; a generic storage
+ * provider should not hard-code it — hence no runtime re-creation of the index.
+ *
+ * Shipped as an ADDITIVE `ALTER` (same reasoning as every prior additive
+ * column: the generated 0100 migration is already recorded as applied on
+ * existing deployments and `ALTER TABLE ADD COLUMN` has no `IF NOT EXISTS`).
+ * SQLite explicitly permits virtual generated columns in `ALTER TABLE ADD
+ * COLUMN` — stored generated columns are prohibited, virtual ones are not.
+ *
+ * Consumed by BOTH runtime guards (`D1TreeIndex.ensureTable`,
+ * `MetadataDB.open`) and the generated wrangler migration
+ * (`0120_entries_content_type.sql`, apply-d1-migrations.mjs).
+ */
+declare const ENTRIES_CONTENT_TYPE_COLUMN_SQL = "ALTER TABLE ds_entries ADD COLUMN content_type TEXT GENERATED ALWAYS AS (CASE WHEN json_valid(content) THEN json_extract(content, '$.type') ELSE NULL END) VIRTUAL";
+/**
+ * The original composite index for the aside feed rare-type filter (#1293).
+ *
+ * RETAINED SOLELY to regenerate the already-shipped `0120` migration
+ * byte-for-byte (a shipped migration must never change — `d1_migrations`
+ * tracks by filename, so mutating 0120 would be silently skipped on deployed
+ * DBs anyway). It is NO LONGER created at runtime and is dropped by
+ * `ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL` / migration `0121` (#1367): nothing
+ * ever emitted `WHERE content_type = ?`, so it was pure write-cost tax.
+ */
+declare const ENTRIES_CONTENT_TYPE_INDEX_SQL = "CREATE INDEX IF NOT EXISTS idx_entries_content_type ON ds_entries(scope, parent, content_type, ctime)";
+/**
+ * Drop of the unused `idx_entries_content_type` (#1367). This is the reversing
+ * DDL for the historical `ENTRIES_CONTENT_TYPE_INDEX_SQL` create: the index
+ * was never wired to any query (see the column comment above) and only added
+ * B-tree maintenance to every `ds_entries` insert. Dropping it removes 100% of
+ * that waste; the virtual column itself stays (zero cost).
+ *
+ * Consumed by BOTH runtime guards (`D1TreeIndex.ensureTable`,
+ * `MetadataDB.open`) — as an idempotent one-time cleanup for existing DBs that
+ * a prior `ensureTable` already indexed — AND the generated wrangler migration
+ * (`0121_drop_content_type_index.sql`, apply-d1-migrations.mjs) for
+ * schema-probe-skipped production isolates.
+ */
+declare const ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL = "DROP INDEX IF EXISTS idx_entries_content_type";
+/** entries — the tree index (one row per file/dir node, scoped per user DID). */
+declare const ENTRIES_TABLE_SQL = "CREATE TABLE IF NOT EXISTS ds_entries (\n          scope TEXT NOT NULL,\n          path TEXT NOT NULL,\n          parent TEXT NOT NULL,\n          name TEXT NOT NULL,\n          kind TEXT NOT NULL DEFAULT 'file',\n          cid TEXT,\n          size INTEGER NOT NULL DEFAULT 0,\n          mime_type TEXT,\n          ctime INTEGER NOT NULL,\n          mtime INTEGER NOT NULL,\n          PRIMARY KEY (scope, path),\n          CHECK (LENGTH(path) <= 4096),\n          CHECK (LENGTH(name) <= 255),\n          CHECK (kind IN ('file', 'dir')),\n          CHECK (LENGTH(scope) <= 128)\n        ) WITHOUT ROWID";
+/** entries indexes. Order matches the historical ensureTable batch. */
+declare const ENTRIES_INDEX_SQL: readonly string[];
+/**
+ * versioned_scopes — completion markers for the versioned content store
+ * (Layer 1, `versioned-content-store.ts`). One row per fully-materialized
+ * scope; `seed_digest` is a metadata column (dev-mode stale detection),
+ * NEVER part of the scope key. Additive table — ships as the generated
+ * 0103 migration plus runtime ensureTable guards (idempotent CREATEs).
+ */
+declare const VERSIONED_SCOPES_TABLE_SQL = "CREATE TABLE IF NOT EXISTS ds_versioned_scopes (\n          scope TEXT PRIMARY KEY,\n          scope_group TEXT NOT NULL,\n          seed_digest TEXT,\n          ingested_at INTEGER NOT NULL,\n          file_count INTEGER NOT NULL DEFAULT 0,\n          CHECK (LENGTH(scope) <= 128),\n          CHECK (LENGTH(scope_group) <= 128)\n        )";
+declare const VERSIONED_SCOPES_INDEX_SQL: readonly string[];
+/**
+ * shares — materialised index of `.share` declaration files (share-out).
+ *
+ * Owner-scoped composite identity key `UNIQUE(owner_did, decl_path)`: the same
+ * relative `decl_path` (`.share`, `docs/.share`) is legitimately reusable by
+ * different owners that share one D1 (CF) or one daemon-global `_shares.db`
+ * (Node). `slug` stays globally UNIQUE — it is the public URL identifier.
+ *
+ * Single source of truth (same pattern as VERSIONED_SCOPES_TABLE_SQL): this
+ * constant feeds BOTH `ShareStore.ensureTable()` (runtime safety-net) AND the
+ * provider's canonical `migrations/0011_shares.sql` + the generated CF
+ * migration `0104_shares.sql`. `share-migration.test.ts` asserts the file is
+ * byte-equal (after DDL normalisation) to these constants, so they cannot
+ * drift.
+ */
+declare const SHARES_TABLE_SQL = "CREATE TABLE IF NOT EXISTS ds_shares (\n          id          TEXT PRIMARY KEY,\n          owner_did   TEXT NOT NULL,\n          source_path TEXT NOT NULL,\n          decl_path   TEXT NOT NULL,\n          slug        TEXT NOT NULL UNIQUE,\n          kind        TEXT NOT NULL DEFAULT 'raw',\n          status      TEXT NOT NULL DEFAULT 'active',\n          decl_cid    TEXT,\n          config_json TEXT NOT NULL DEFAULT '{}',\n          created_at  INTEGER NOT NULL,\n          updated_at  INTEGER NOT NULL,\n          UNIQUE(owner_did, decl_path)\n        )";
+declare const SHARES_INDEX_SQL: readonly string[];
+/** resolve_entries — the DID resolve store (key → value docs + owner/kind). */
+declare const RESOLVE_ENTRIES_TABLE_SQL = "CREATE TABLE IF NOT EXISTS ds_resolve_entries (\n          key        TEXT    PRIMARY KEY,\n          value      TEXT    NOT NULL,\n          owner      TEXT,\n          kind       TEXT,\n          updated_at INTEGER,\n          created_at INTEGER\n        )";
+/** resolve_entries indexes. Order matches the historical ensureTable sequence. */
+declare const RESOLVE_ENTRIES_INDEX_SQL: readonly string[];
+/** gc_queue — deferred-GC CID queue (GC plan §4.3, Model B global pool). */
+declare const GC_QUEUE_TABLE_SQL = "CREATE TABLE IF NOT EXISTS ds_gc_queue (\n          cid       TEXT    NOT NULL,\n          queued_at INTEGER NOT NULL,\n          PRIMARY KEY (cid)\n        )";
+/**
+ * gc_queue index. The deferred-GC sweep (`GcQueue.fetchCandidates`) selects
+ * `WHERE queued_at <= ? LIMIT ?` every cron tick. With only the `cid` primary
+ * key, that predicate has no usable index and full-scans the whole queue —
+ * `rows_read` grows with queue size (D1 Insights measured ~15k rows read per
+ * sweep at near-zero efficiency), the classic D1 rows_read cliff. This index
+ * makes the grace-boundary scan a range seek. Mirrors the table+index pairing
+ * the sibling base tables (entries/changelog/resolve_entries) already use.
+ */
+declare const GC_QUEUE_INDEX_SQL: readonly string[];
+/**
+ * upload_sessions — recoverable in-flight upload session registry (DID Space
+ * upload plane, design §9). Holds the prepared/committed/aborted lifecycle so
+ * (a) commit can re-validate against the prepared contract, and (b) GC can
+ * protect objects referenced by a non-expired `prepared` session (in-flight
+ * protection, §9 / reference-check.ts).
+ *
+ * scope de-identification discipline (§9, NON-negotiable): `scope` is the SAME
+ * `this._scope` derived value as `entries.scope` / `changelog.scope` (an opaque
+ * HMAC when de-id is on), NEVER a plaintext DID — `CHECK(LENGTH(scope)<=128)`
+ * mirrors `entries`. `caller` may hold ONLY a blocklet bareInstanceId (app DID),
+ * never a user `did:abt:` — a raw D1 dump must not re-attribute uploads to users.
+ */
+declare const UPLOAD_SESSIONS_TABLE_SQL = "CREATE TABLE IF NOT EXISTS ds_upload_sessions (\n          id          TEXT PRIMARY KEY,\n          scope       TEXT NOT NULL,\n          caller      TEXT,\n          expires_at  INTEGER NOT NULL,\n          status      TEXT NOT NULL,\n          created_at  INTEGER NOT NULL,\n          CHECK (LENGTH(scope) <= 128),\n          CHECK (status IN ('prepared','committed','aborted','expired'))\n        )";
+/**
+ * upload_session_entries — per-entry rows of an upload session. Carries NO
+ * independent identity column: it joins back to `upload_sessions` via
+ * `session_id` (§9 scope discipline — never duplicate the scope/DID here).
+ */
+declare const UPLOAD_SESSION_ENTRIES_TABLE_SQL = "CREATE TABLE IF NOT EXISTS ds_upload_session_entries (\n          session_id      TEXT NOT NULL,\n          path            TEXT NOT NULL,\n          cid             TEXT NOT NULL,\n          object_key      TEXT NOT NULL,\n          checksum_sha256 TEXT NOT NULL,\n          size            INTEGER NOT NULL,\n          mime_type       TEXT,\n          if_match        TEXT,\n          device_id       TEXT,\n          mtime           INTEGER,\n          status          TEXT NOT NULL,\n          PRIMARY KEY (session_id, path),\n          CHECK (status IN ('needs_upload','already_present','committed','failed'))\n        )";
+declare const UPLOAD_SESSIONS_INDEX_SQL: readonly string[];
+/**
+ * The complete did-space D1 schema, in apply order — exactly the statements
+ * `CloudflareSpaceResolver.ensureTables` would issue on a fresh database
+ * (TreeIndex: entries + changelog; ResolveStore; GCQueue). The generated
+ * migration serializes THIS list; the runtime probe checks for the four
+ * table names this list creates (entries, changelog, resolve_entries,
+ * gc_queue).
+ */
+declare const D1_DID_SPACE_SCHEMA_SQL: readonly string[];
+//#endregion
+export { D1_DID_SPACE_SCHEMA_SQL, ENTRIES_CONTENT_TYPE_COLUMN_SQL, ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL, ENTRIES_CONTENT_TYPE_INDEX_SQL, ENTRIES_DEDUP_INDEX_SQL, ENTRIES_DEDUP_KEY_COLUMN_SQL, ENTRIES_DEDUP_SCOPE_COLUMN_SQL, ENTRIES_INDEX_SQL, ENTRIES_INLINE_CONTENT_COLUMN_SQL, ENTRIES_METADATA_COLUMN_SQL, ENTRIES_TABLE_SQL, GC_QUEUE_INDEX_SQL, GC_QUEUE_TABLE_SQL, RESOLVE_ENTRIES_INDEX_SQL, RESOLVE_ENTRIES_TABLE_SQL, SHARES_INDEX_SQL, SHARES_TABLE_SQL, UPLOAD_SESSIONS_INDEX_SQL, UPLOAD_SESSIONS_TABLE_SQL, UPLOAD_SESSION_ENTRIES_TABLE_SQL, VERSIONED_SCOPES_INDEX_SQL, VERSIONED_SCOPES_TABLE_SQL };
+//# sourceMappingURL=d1-schema.d.mts.map

package/dist/d1-schema.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1-schema.d.mts","names":[],"sources":["../src/d1-schema.ts"],"mappings":";;AAgDA;;;;;AAuBA;;;;;AAyBA;;;;;AACA;;;;;AAUA;;;;;AAgCA;;;;;AAYA;;;;;AAeA;;;;;AAGA;;;AA9DA,cA3Da,iCAAA;;AA4Ib;;;;;AA4BA;;;;;AAUA;;;;;AAmBA;;;;;cA9Ka,2BAAA;;;;;AAoMb;;;;;AAUA;;;;;AAQA;;;;;AAeA;;;;cA5Ma,8BAAA;AAAA,cACA,4BAAA;;;;;AA4Ob;;;;cAlOa,uBAAA;AAkPb;;;;;AAsBA;;;;;;;;;;;;;;;;;;;;;;;;;AAtBA,cAlNa,+BAAA;;;;;;;;;;;cAYA,8BAAA;;;;;;;;;;;;;;cAeA,mCAAA;;cAGA,iBAAA;;cAmBA,iBAAA;;;;;;;;cA4BA,0BAAA;AAAA,cAUA,0BAAA;;;;;;;;;;;;;;;;cAmBA,gBAAA;AAAA,cAeA,gBAAA;;cAOA,yBAAA;;cAUA,yBAAA;;cAQA,kBAAA;;;;;;;;;;cAeA,kBAAA;;;;;;;;;;;;;;cAiBA,yBAAA;;;;;;cAgBA,gCAAA;AAAA,cAgBA,yBAAA;;;;;;;;;cAsBA,uBAAA"}

package/dist/d1-schema.mjs

@@ -0,0 +1,341 @@
+import { CHANGELOG_INDEX_SQL, CHANGELOG_TABLE_SQL } from "./changelog-schema.mjs";
+import { INLINE_CONTENT_HARD_CAP } from "./inline-content.mjs";
+
+//#region src/d1-schema.ts
+/**
+* D1 schema — the single source of truth for the did-space D1 DDL.
+*
+* Consumed by BOTH:
+*   1. The runtime safety-net creators (`D1TreeIndex.ensureTable`,
+*      `D1ResolveStore.ensureTable`, `D1GCQueue.ensureTable`) — fresh-DB
+*      bootstrap for tests / first-ever deploys.
+*   2. The generated wrangler migration (`0100_did_space_schema.sql`,
+*      assembled by runtimes/cloudflare/scripts/apply-d1-migrations.mjs) —
+*      the deploy-time path that lets production isolates SKIP the runtime
+*      schema probe entirely (`AFS_SKIP_SCHEMA_PROBE`).
+*
+* Because the migration is GENERATED from these constants at build time,
+* the two paths cannot drift — there is no hand-maintained SQL copy.
+* (Same single-source pattern as changelog-schema.ts, which keeps the four
+* device runtimes byte-equivalent.)
+*
+* Every statement is idempotent (`IF NOT EXISTS`) so re-applying on an
+* existing database — including one originally bootstrapped by the runtime
+* path — is a no-op.
+*/
+/**
+* Inline-content column migration (Layer 0 inline capability, see
+* `inline-content.ts`). Shipped as an ADDITIVE `ALTER TABLE` — NOT folded
+* into `ENTRIES_TABLE_SQL` — because the generated 0100 migration is already
+* recorded as applied on existing deployments and `ALTER TABLE ADD COLUMN`
+* has no `IF NOT EXISTS` (folding it into the CREATE would make the additive
+* migration fail on fresh databases with "duplicate column"). Same pattern
+* as connect-service's 0002.
+*
+* Consumed by BOTH:
+*   1. runtime guards (`D1TreeIndex.ensureTable`, `MetadataDB.open`) — they
+*      probe `pragma_table_info('entries')` and apply this only when the
+*      column is missing;
+*   2. the generated wrangler migration
+*      (`0102_entries_inline_content.sql`, apply-d1-migrations.mjs) — the
+*      deploy-time path, applied exactly once per database via the
+*      `d1_migrations` bookkeeping table.
+*
+* `LENGTH(CAST(content AS BLOB))` counts BYTES (TEXT `LENGTH()` counts
+* characters and stops at an embedded NUL) — the hard cap is a byte cap.
+* The CHECK is the fixed defensive upper bound; the configurable app-level
+* threshold lives in `inline-content.ts` (two values, never conflated).
+*/
+const ENTRIES_INLINE_CONTENT_COLUMN_SQL = `ALTER TABLE ds_entries ADD COLUMN content TEXT CHECK (content IS NULL OR LENGTH(CAST(content AS BLOB)) <= ${INLINE_CONTENT_HARD_CAP})`;
+/**
+* Application metadata column (planning/agent-hub/metadata-foundation.md).
+* Stores `AFSWriteEntryPayload.meta` as a JSON blob — application-level
+* dimension fields (`user_did / blocklet_id / hub / model / cost / ...`)
+* that the application uses for filter / aggregate via collection-query's
+* `meta.*` paths. NULL when the application wrote no meta. Provider-computed
+* fields (`kind / size / cid / mimeType`) are NOT stored here — they live
+* in their own columns and are merged into `entry.meta` at read time.
+*
+* Shipped as an ADDITIVE ALTER (same reasoning as
+* `ENTRIES_INLINE_CONTENT_COLUMN_SQL`): the generated 0100 migration is
+* already applied on existing deployments and ADD COLUMN has no
+* IF NOT EXISTS, so this must stay separate from `ENTRIES_TABLE_SQL`.
+*
+* Consumed by BOTH:
+*   1. runtime guards (`D1TreeIndex.ensureTable`, `MetadataDB.open`) —
+*      they probe `pragma_table_info('entries')` and apply this only when
+*      the column is missing;
+*   2. the generated wrangler migration
+*      (`0107_entries_metadata.sql`, apply-d1-migrations.mjs).
+*/
+const ENTRIES_METADATA_COLUMN_SQL = `ALTER TABLE ds_entries ADD COLUMN metadata TEXT`;
+/**
+* Dedup-on-write secondary index columns (#1159). Replace the old
+* cid-in-path dedup scheme (`{collection}/{cid(url)}.json`) with a real
+* DB-enforced unique index so a dedup record lives at a stable readable path
+* (`{collection}/{uuid}.json`) and dedup resolves via an O(log n) point seek —
+* not a `json_extract` scan and not a normalization-derived filename.
+*
+* - `dedup_scope` = the collection the record dedups within (the write `path`),
+*   deliberately decoupled from the row's physical `parent` so flat and legacy
+*   dir-per-record layouts dedup against the same scope.
+* - `dedup_key`   = the normalized identity value (e.g. `normalizeItemUrl`).
+*
+* Shipped as ADDITIVE `ALTER`s (same reasoning as the inline-content / metadata
+* columns: the base `ENTRIES_TABLE_SQL` and the generated 0100 migration are
+* already applied on existing deployments, and `ADD COLUMN` has no
+* `IF NOT EXISTS`). The partial UNIQUE index is created AFTER both columns
+* exist. Precedent for the composite unique: `SHARES_TABLE_SQL`'s
+* `UNIQUE(owner_did, decl_path)`.
+*
+* Consumed by BOTH runtime guards (`D1TreeIndex.ensureTable`,
+* `MetadataDB.open`) and the generated wrangler migration
+* (`0117_entries_dedup.sql`, apply-d1-migrations.mjs).
+*/
+const ENTRIES_DEDUP_SCOPE_COLUMN_SQL = `ALTER TABLE ds_entries ADD COLUMN dedup_scope TEXT`;
+const ENTRIES_DEDUP_KEY_COLUMN_SQL = `ALTER TABLE ds_entries ADD COLUMN dedup_key TEXT`;
+/**
+* Partial UNIQUE index backing dedup-on-write. `WHERE dedup_key IS NOT NULL`
+* keeps every non-dedup row (the overwhelming majority) out of the index, so it
+* costs nothing for normal writes and only enforces uniqueness among records
+* that opted into dedup. This is BOTH the fast lookup path (`findByDedupKey`)
+* AND the concurrency backstop (a racing create collides here, the loser
+* re-queries and merges).
+*/
+const ENTRIES_DEDUP_INDEX_SQL = `CREATE UNIQUE INDEX IF NOT EXISTS idx_entries_dedup ON ds_entries(scope, dedup_scope, dedup_key) WHERE dedup_key IS NOT NULL`;
+/**
+* Content-type virtual generated column (#1293). Materializes `$.type` from
+* the inline-content JSON column. Virtual (not stored): zero write overhead —
+* the value is computed on read from the already-present `content` column,
+* NULL for entries whose `content` is NULL or is not valid JSON / lacks a
+* `$.type` field.
+*
+* The column is RETAINED but INERT (#1367): its backing index
+* `idx_entries_content_type` has been dropped (see
+* `ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL` below) because no query ever referenced
+* the generated column by name — collection-query's `compileLeaf` emits
+* `lower(json_extract(content, '$.type')) = lower(?)` (tree-query.ts), which
+* SQLite's expression-index equivalence cannot rewrite to `WHERE content_type
+* = ?`, so the index was never hit and only taxed every write. The virtual
+* column costs nothing (computed on read, currently never read) and is left in
+* place; whether rare-type filtering is re-homed (via the generic `metadata`
+* `meta.*` channel, NOT by the provider reaching into `content`) is the open
+* decision in #1367. `$.type` is aside application schema; a generic storage
+* provider should not hard-code it — hence no runtime re-creation of the index.
+*
+* Shipped as an ADDITIVE `ALTER` (same reasoning as every prior additive
+* column: the generated 0100 migration is already recorded as applied on
+* existing deployments and `ALTER TABLE ADD COLUMN` has no `IF NOT EXISTS`).
+* SQLite explicitly permits virtual generated columns in `ALTER TABLE ADD
+* COLUMN` — stored generated columns are prohibited, virtual ones are not.
+*
+* Consumed by BOTH runtime guards (`D1TreeIndex.ensureTable`,
+* `MetadataDB.open`) and the generated wrangler migration
+* (`0120_entries_content_type.sql`, apply-d1-migrations.mjs).
+*/
+const ENTRIES_CONTENT_TYPE_COLUMN_SQL = `ALTER TABLE ds_entries ADD COLUMN content_type TEXT GENERATED ALWAYS AS (CASE WHEN json_valid(content) THEN json_extract(content, '$.type') ELSE NULL END) VIRTUAL`;
+/**
+* The original composite index for the aside feed rare-type filter (#1293).
+*
+* RETAINED SOLELY to regenerate the already-shipped `0120` migration
+* byte-for-byte (a shipped migration must never change — `d1_migrations`
+* tracks by filename, so mutating 0120 would be silently skipped on deployed
+* DBs anyway). It is NO LONGER created at runtime and is dropped by
+* `ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL` / migration `0121` (#1367): nothing
+* ever emitted `WHERE content_type = ?`, so it was pure write-cost tax.
+*/
+const ENTRIES_CONTENT_TYPE_INDEX_SQL = `CREATE INDEX IF NOT EXISTS idx_entries_content_type ON ds_entries(scope, parent, content_type, ctime)`;
+/**
+* Drop of the unused `idx_entries_content_type` (#1367). This is the reversing
+* DDL for the historical `ENTRIES_CONTENT_TYPE_INDEX_SQL` create: the index
+* was never wired to any query (see the column comment above) and only added
+* B-tree maintenance to every `ds_entries` insert. Dropping it removes 100% of
+* that waste; the virtual column itself stays (zero cost).
+*
+* Consumed by BOTH runtime guards (`D1TreeIndex.ensureTable`,
+* `MetadataDB.open`) — as an idempotent one-time cleanup for existing DBs that
+* a prior `ensureTable` already indexed — AND the generated wrangler migration
+* (`0121_drop_content_type_index.sql`, apply-d1-migrations.mjs) for
+* schema-probe-skipped production isolates.
+*/
+const ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL = `DROP INDEX IF EXISTS idx_entries_content_type`;
+/** entries — the tree index (one row per file/dir node, scoped per user DID). */
+const ENTRIES_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_entries (
+          scope TEXT NOT NULL,
+          path TEXT NOT NULL,
+          parent TEXT NOT NULL,
+          name TEXT NOT NULL,
+          kind TEXT NOT NULL DEFAULT 'file',
+          cid TEXT,
+          size INTEGER NOT NULL DEFAULT 0,
+          mime_type TEXT,
+          ctime INTEGER NOT NULL,
+          mtime INTEGER NOT NULL,
+          PRIMARY KEY (scope, path),
+          CHECK (LENGTH(path) <= 4096),
+          CHECK (LENGTH(name) <= 255),
+          CHECK (kind IN ('file', 'dir')),
+          CHECK (LENGTH(scope) <= 128)
+        ) WITHOUT ROWID`;
+/** entries indexes. Order matches the historical ensureTable batch. */
+const ENTRIES_INDEX_SQL = [
+	"CREATE INDEX IF NOT EXISTS idx_entries_children ON ds_entries(scope, parent, name)",
+	"CREATE INDEX IF NOT EXISTS idx_entries_cid ON ds_entries(cid) WHERE cid IS NOT NULL",
+	"CREATE INDEX IF NOT EXISTS idx_entries_mtime ON ds_entries(scope, mtime DESC)",
+	"CREATE INDEX IF NOT EXISTS idx_entries_kind ON ds_entries(scope, kind)",
+	"CREATE INDEX IF NOT EXISTS idx_entries_parent_mtime ON ds_entries(scope, parent, mtime, name)",
+	"CREATE INDEX IF NOT EXISTS idx_entries_parent_ctime ON ds_entries(scope, parent, ctime, name)"
+];
+/**
+* versioned_scopes — completion markers for the versioned content store
+* (Layer 1, `versioned-content-store.ts`). One row per fully-materialized
+* scope; `seed_digest` is a metadata column (dev-mode stale detection),
+* NEVER part of the scope key. Additive table — ships as the generated
+* 0103 migration plus runtime ensureTable guards (idempotent CREATEs).
+*/
+const VERSIONED_SCOPES_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_versioned_scopes (
+          scope TEXT PRIMARY KEY,
+          scope_group TEXT NOT NULL,
+          seed_digest TEXT,
+          ingested_at INTEGER NOT NULL,
+          file_count INTEGER NOT NULL DEFAULT 0,
+          CHECK (LENGTH(scope) <= 128),
+          CHECK (LENGTH(scope_group) <= 128)
+        )`;
+const VERSIONED_SCOPES_INDEX_SQL = ["CREATE INDEX IF NOT EXISTS idx_versioned_scopes_group ON ds_versioned_scopes(scope_group)"];
+/**
+* shares — materialised index of `.share` declaration files (share-out).
+*
+* Owner-scoped composite identity key `UNIQUE(owner_did, decl_path)`: the same
+* relative `decl_path` (`.share`, `docs/.share`) is legitimately reusable by
+* different owners that share one D1 (CF) or one daemon-global `_shares.db`
+* (Node). `slug` stays globally UNIQUE — it is the public URL identifier.
+*
+* Single source of truth (same pattern as VERSIONED_SCOPES_TABLE_SQL): this
+* constant feeds BOTH `ShareStore.ensureTable()` (runtime safety-net) AND the
+* provider's canonical `migrations/0011_shares.sql` + the generated CF
+* migration `0104_shares.sql`. `share-migration.test.ts` asserts the file is
+* byte-equal (after DDL normalisation) to these constants, so they cannot
+* drift.
+*/
+const SHARES_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_shares (
+          id          TEXT PRIMARY KEY,
+          owner_did   TEXT NOT NULL,
+          source_path TEXT NOT NULL,
+          decl_path   TEXT NOT NULL,
+          slug        TEXT NOT NULL UNIQUE,
+          kind        TEXT NOT NULL DEFAULT 'raw',
+          status      TEXT NOT NULL DEFAULT 'active',
+          decl_cid    TEXT,
+          config_json TEXT NOT NULL DEFAULT '{}',
+          created_at  INTEGER NOT NULL,
+          updated_at  INTEGER NOT NULL,
+          UNIQUE(owner_did, decl_path)
+        )`;
+const SHARES_INDEX_SQL = [
+	"CREATE INDEX IF NOT EXISTS idx_shares_owner_did ON ds_shares(owner_did)",
+	"CREATE INDEX IF NOT EXISTS idx_shares_owner_source ON ds_shares(owner_did, source_path)",
+	"CREATE INDEX IF NOT EXISTS idx_shares_slug ON ds_shares(slug)"
+];
+/** resolve_entries — the DID resolve store (key → value docs + owner/kind). */
+const RESOLVE_ENTRIES_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_resolve_entries (
+          key        TEXT    PRIMARY KEY,
+          value      TEXT    NOT NULL,
+          owner      TEXT,
+          kind       TEXT,
+          updated_at INTEGER,
+          created_at INTEGER
+        )`;
+/** resolve_entries indexes. Order matches the historical ensureTable sequence. */
+const RESOLVE_ENTRIES_INDEX_SQL = [
+	"CREATE INDEX IF NOT EXISTS idx_resolve_owner ON ds_resolve_entries(owner)",
+	"CREATE INDEX IF NOT EXISTS idx_resolve_kind ON ds_resolve_entries(kind)",
+	"CREATE INDEX IF NOT EXISTS idx_resolve_updated ON ds_resolve_entries(updated_at)",
+	"CREATE INDEX IF NOT EXISTS idx_resolve_created ON ds_resolve_entries(created_at)"
+];
+/** gc_queue — deferred-GC CID queue (GC plan §4.3, Model B global pool). */
+const GC_QUEUE_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_gc_queue (
+          cid       TEXT    NOT NULL,
+          queued_at INTEGER NOT NULL,
+          PRIMARY KEY (cid)
+        )`;
+/**
+* gc_queue index. The deferred-GC sweep (`GcQueue.fetchCandidates`) selects
+* `WHERE queued_at <= ? LIMIT ?` every cron tick. With only the `cid` primary
+* key, that predicate has no usable index and full-scans the whole queue —
+* `rows_read` grows with queue size (D1 Insights measured ~15k rows read per
+* sweep at near-zero efficiency), the classic D1 rows_read cliff. This index
+* makes the grace-boundary scan a range seek. Mirrors the table+index pairing
+* the sibling base tables (entries/changelog/resolve_entries) already use.
+*/
+const GC_QUEUE_INDEX_SQL = ["CREATE INDEX IF NOT EXISTS idx_gc_queue_queued_at ON ds_gc_queue(queued_at)"];
+/**
+* upload_sessions — recoverable in-flight upload session registry (DID Space
+* upload plane, design §9). Holds the prepared/committed/aborted lifecycle so
+* (a) commit can re-validate against the prepared contract, and (b) GC can
+* protect objects referenced by a non-expired `prepared` session (in-flight
+* protection, §9 / reference-check.ts).
+*
+* scope de-identification discipline (§9, NON-negotiable): `scope` is the SAME
+* `this._scope` derived value as `entries.scope` / `changelog.scope` (an opaque
+* HMAC when de-id is on), NEVER a plaintext DID — `CHECK(LENGTH(scope)<=128)`
+* mirrors `entries`. `caller` may hold ONLY a blocklet bareInstanceId (app DID),
+* never a user `did:abt:` — a raw D1 dump must not re-attribute uploads to users.
+*/
+const UPLOAD_SESSIONS_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_upload_sessions (
+          id          TEXT PRIMARY KEY,
+          scope       TEXT NOT NULL,
+          caller      TEXT,
+          expires_at  INTEGER NOT NULL,
+          status      TEXT NOT NULL,
+          created_at  INTEGER NOT NULL,
+          CHECK (LENGTH(scope) <= 128),
+          CHECK (status IN ('prepared','committed','aborted','expired'))
+        )`;
+/**
+* upload_session_entries — per-entry rows of an upload session. Carries NO
+* independent identity column: it joins back to `upload_sessions` via
+* `session_id` (§9 scope discipline — never duplicate the scope/DID here).
+*/
+const UPLOAD_SESSION_ENTRIES_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_upload_session_entries (
+          session_id      TEXT NOT NULL,
+          path            TEXT NOT NULL,
+          cid             TEXT NOT NULL,
+          object_key      TEXT NOT NULL,
+          checksum_sha256 TEXT NOT NULL,
+          size            INTEGER NOT NULL,
+          mime_type       TEXT,
+          if_match        TEXT,
+          device_id       TEXT,
+          mtime           INTEGER,
+          status          TEXT NOT NULL,
+          PRIMARY KEY (session_id, path),
+          CHECK (status IN ('needs_upload','already_present','committed','failed'))
+        )`;
+const UPLOAD_SESSIONS_INDEX_SQL = [
+	"CREATE INDEX IF NOT EXISTS idx_upload_session_entries_cid ON ds_upload_session_entries(cid)",
+	"CREATE INDEX IF NOT EXISTS idx_upload_sessions_expiry ON ds_upload_sessions(status, expires_at)",
+	"CREATE INDEX IF NOT EXISTS idx_upload_sessions_expires_at ON ds_upload_sessions(expires_at)"
+];
+/**
+* The complete did-space D1 schema, in apply order — exactly the statements
+* `CloudflareSpaceResolver.ensureTables` would issue on a fresh database
+* (TreeIndex: entries + changelog; ResolveStore; GCQueue). The generated
+* migration serializes THIS list; the runtime probe checks for the four
+* table names this list creates (entries, changelog, resolve_entries,
+* gc_queue).
+*/
+const D1_DID_SPACE_SCHEMA_SQL = [
+	ENTRIES_TABLE_SQL,
+	...ENTRIES_INDEX_SQL,
+	CHANGELOG_TABLE_SQL,
+	...CHANGELOG_INDEX_SQL,
+	RESOLVE_ENTRIES_TABLE_SQL,
+	...RESOLVE_ENTRIES_INDEX_SQL,
+	GC_QUEUE_TABLE_SQL,
+	...GC_QUEUE_INDEX_SQL
+];
+
+//#endregion
+export { D1_DID_SPACE_SCHEMA_SQL, ENTRIES_CONTENT_TYPE_COLUMN_SQL, ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL, ENTRIES_CONTENT_TYPE_INDEX_SQL, ENTRIES_DEDUP_INDEX_SQL, ENTRIES_DEDUP_KEY_COLUMN_SQL, ENTRIES_DEDUP_SCOPE_COLUMN_SQL, ENTRIES_INDEX_SQL, ENTRIES_INLINE_CONTENT_COLUMN_SQL, ENTRIES_METADATA_COLUMN_SQL, ENTRIES_TABLE_SQL, GC_QUEUE_INDEX_SQL, GC_QUEUE_TABLE_SQL, RESOLVE_ENTRIES_INDEX_SQL, RESOLVE_ENTRIES_TABLE_SQL, SHARES_INDEX_SQL, SHARES_TABLE_SQL, UPLOAD_SESSIONS_INDEX_SQL, UPLOAD_SESSIONS_TABLE_SQL, UPLOAD_SESSION_ENTRIES_TABLE_SQL, VERSIONED_SCOPES_INDEX_SQL, VERSIONED_SCOPES_TABLE_SQL };
+//# sourceMappingURL=d1-schema.mjs.map

package/dist/d1-schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1-schema.mjs","names":[],"sources":["../src/d1-schema.ts"],"sourcesContent":["/**\n * D1 schema — the single source of truth for the did-space D1 DDL.\n *\n * Consumed by BOTH:\n *   1. The runtime safety-net creators (`D1TreeIndex.ensureTable`,\n *      `D1ResolveStore.ensureTable`, `D1GCQueue.ensureTable`) — fresh-DB\n *      bootstrap for tests / first-ever deploys.\n *   2. The generated wrangler migration (`0100_did_space_schema.sql`,\n *      assembled by runtimes/cloudflare/scripts/apply-d1-migrations.mjs) —\n *      the deploy-time path that lets production isolates SKIP the runtime\n *      schema probe entirely (`AFS_SKIP_SCHEMA_PROBE`).\n *\n * Because the migration is GENERATED from these constants at build time,\n * the two paths cannot drift — there is no hand-maintained SQL copy.\n * (Same single-source pattern as changelog-schema.ts, which keeps the four\n * device runtimes byte-equivalent.)\n *\n * Every statement is idempotent (`IF NOT EXISTS`) so re-applying on an\n * existing database — including one originally bootstrapped by the runtime\n * path — is a no-op.\n */\n\nimport { CHANGELOG_INDEX_SQL, CHANGELOG_TABLE_SQL } from \"./changelog-schema.js\";\nimport { INLINE_CONTENT_HARD_CAP } from \"./inline-content.js\";\n\n/**\n * Inline-content column migration (Layer 0 inline capability, see\n * `inline-content.ts`). Shipped as an ADDITIVE `ALTER TABLE` — NOT folded\n * into `ENTRIES_TABLE_SQL` — because the generated 0100 migration is already\n * recorded as applied on existing deployments and `ALTER TABLE ADD COLUMN`\n * has no `IF NOT EXISTS` (folding it into the CREATE would make the additive\n * migration fail on fresh databases with \"duplicate column\"). Same pattern\n * as connect-service's 0002.\n *\n * Consumed by BOTH:\n *   1. runtime guards (`D1TreeIndex.ensureTable`, `MetadataDB.open`) — they\n *      probe `pragma_table_info('entries')` and apply this only when the\n *      column is missing;\n *   2. the generated wrangler migration\n *      (`0102_entries_inline_content.sql`, apply-d1-migrations.mjs) — the\n *      deploy-time path, applied exactly once per database via the\n *      `d1_migrations` bookkeeping table.\n *\n * `LENGTH(CAST(content AS BLOB))` counts BYTES (TEXT `LENGTH()` counts\n * characters and stops at an embedded NUL) — the hard cap is a byte cap.\n * The CHECK is the fixed defensive upper bound; the configurable app-level\n * threshold lives in `inline-content.ts` (two values, never conflated).\n */\nexport const ENTRIES_INLINE_CONTENT_COLUMN_SQL = `ALTER TABLE ds_entries ADD COLUMN content TEXT CHECK (content IS NULL OR LENGTH(CAST(content AS BLOB)) <= ${INLINE_CONTENT_HARD_CAP})`;\n\n/**\n * Application metadata column (planning/agent-hub/metadata-foundation.md).\n * Stores `AFSWriteEntryPayload.meta` as a JSON blob — application-level\n * dimension fields (`user_did / blocklet_id / hub / model / cost / ...`)\n * that the application uses for filter / aggregate via collection-query's\n * `meta.*` paths. NULL when the application wrote no meta. Provider-computed\n * fields (`kind / size / cid / mimeType`) are NOT stored here — they live\n * in their own columns and are merged into `entry.meta` at read time.\n *\n * Shipped as an ADDITIVE ALTER (same reasoning as\n * `ENTRIES_INLINE_CONTENT_COLUMN_SQL`): the generated 0100 migration is\n * already applied on existing deployments and ADD COLUMN has no\n * IF NOT EXISTS, so this must stay separate from `ENTRIES_TABLE_SQL`.\n *\n * Consumed by BOTH:\n *   1. runtime guards (`D1TreeIndex.ensureTable`, `MetadataDB.open`) —\n *      they probe `pragma_table_info('entries')` and apply this only when\n *      the column is missing;\n *   2. the generated wrangler migration\n *      (`0107_entries_metadata.sql`, apply-d1-migrations.mjs).\n */\nexport const ENTRIES_METADATA_COLUMN_SQL = `ALTER TABLE ds_entries ADD COLUMN metadata TEXT`;\n\n/**\n * Dedup-on-write secondary index columns (#1159). Replace the old\n * cid-in-path dedup scheme (`{collection}/{cid(url)}.json`) with a real\n * DB-enforced unique index so a dedup record lives at a stable readable path\n * (`{collection}/{uuid}.json`) and dedup resolves via an O(log n) point seek —\n * not a `json_extract` scan and not a normalization-derived filename.\n *\n * - `dedup_scope` = the collection the record dedups within (the write `path`),\n *   deliberately decoupled from the row's physical `parent` so flat and legacy\n *   dir-per-record layouts dedup against the same scope.\n * - `dedup_key`   = the normalized identity value (e.g. `normalizeItemUrl`).\n *\n * Shipped as ADDITIVE `ALTER`s (same reasoning as the inline-content / metadata\n * columns: the base `ENTRIES_TABLE_SQL` and the generated 0100 migration are\n * already applied on existing deployments, and `ADD COLUMN` has no\n * `IF NOT EXISTS`). The partial UNIQUE index is created AFTER both columns\n * exist. Precedent for the composite unique: `SHARES_TABLE_SQL`'s\n * `UNIQUE(owner_did, decl_path)`.\n *\n * Consumed by BOTH runtime guards (`D1TreeIndex.ensureTable`,\n * `MetadataDB.open`) and the generated wrangler migration\n * (`0117_entries_dedup.sql`, apply-d1-migrations.mjs).\n */\nexport const ENTRIES_DEDUP_SCOPE_COLUMN_SQL = `ALTER TABLE ds_entries ADD COLUMN dedup_scope TEXT`;\nexport const ENTRIES_DEDUP_KEY_COLUMN_SQL = `ALTER TABLE ds_entries ADD COLUMN dedup_key TEXT`;\n\n/**\n * Partial UNIQUE index backing dedup-on-write. `WHERE dedup_key IS NOT NULL`\n * keeps every non-dedup row (the overwhelming majority) out of the index, so it\n * costs nothing for normal writes and only enforces uniqueness among records\n * that opted into dedup. This is BOTH the fast lookup path (`findByDedupKey`)\n * AND the concurrency backstop (a racing create collides here, the loser\n * re-queries and merges).\n */\nexport const ENTRIES_DEDUP_INDEX_SQL = `CREATE UNIQUE INDEX IF NOT EXISTS idx_entries_dedup ON ds_entries(scope, dedup_scope, dedup_key) WHERE dedup_key IS NOT NULL`;\n\n/**\n * Content-type virtual generated column (#1293). Materializes `$.type` from\n * the inline-content JSON column. Virtual (not stored): zero write overhead —\n * the value is computed on read from the already-present `content` column,\n * NULL for entries whose `content` is NULL or is not valid JSON / lacks a\n * `$.type` field.\n *\n * The column is RETAINED but INERT (#1367): its backing index\n * `idx_entries_content_type` has been dropped (see\n * `ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL` below) because no query ever referenced\n * the generated column by name — collection-query's `compileLeaf` emits\n * `lower(json_extract(content, '$.type')) = lower(?)` (tree-query.ts), which\n * SQLite's expression-index equivalence cannot rewrite to `WHERE content_type\n * = ?`, so the index was never hit and only taxed every write. The virtual\n * column costs nothing (computed on read, currently never read) and is left in\n * place; whether rare-type filtering is re-homed (via the generic `metadata`\n * `meta.*` channel, NOT by the provider reaching into `content`) is the open\n * decision in #1367. `$.type` is aside application schema; a generic storage\n * provider should not hard-code it — hence no runtime re-creation of the index.\n *\n * Shipped as an ADDITIVE `ALTER` (same reasoning as every prior additive\n * column: the generated 0100 migration is already recorded as applied on\n * existing deployments and `ALTER TABLE ADD COLUMN` has no `IF NOT EXISTS`).\n * SQLite explicitly permits virtual generated columns in `ALTER TABLE ADD\n * COLUMN` — stored generated columns are prohibited, virtual ones are not.\n *\n * Consumed by BOTH runtime guards (`D1TreeIndex.ensureTable`,\n * `MetadataDB.open`) and the generated wrangler migration\n * (`0120_entries_content_type.sql`, apply-d1-migrations.mjs).\n */\nexport const ENTRIES_CONTENT_TYPE_COLUMN_SQL = `ALTER TABLE ds_entries ADD COLUMN content_type TEXT GENERATED ALWAYS AS (CASE WHEN json_valid(content) THEN json_extract(content, '$.type') ELSE NULL END) VIRTUAL`;\n\n/**\n * The original composite index for the aside feed rare-type filter (#1293).\n *\n * RETAINED SOLELY to regenerate the already-shipped `0120` migration\n * byte-for-byte (a shipped migration must never change — `d1_migrations`\n * tracks by filename, so mutating 0120 would be silently skipped on deployed\n * DBs anyway). It is NO LONGER created at runtime and is dropped by\n * `ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL` / migration `0121` (#1367): nothing\n * ever emitted `WHERE content_type = ?`, so it was pure write-cost tax.\n */\nexport const ENTRIES_CONTENT_TYPE_INDEX_SQL = `CREATE INDEX IF NOT EXISTS idx_entries_content_type ON ds_entries(scope, parent, content_type, ctime)`;\n\n/**\n * Drop of the unused `idx_entries_content_type` (#1367). This is the reversing\n * DDL for the historical `ENTRIES_CONTENT_TYPE_INDEX_SQL` create: the index\n * was never wired to any query (see the column comment above) and only added\n * B-tree maintenance to every `ds_entries` insert. Dropping it removes 100% of\n * that waste; the virtual column itself stays (zero cost).\n *\n * Consumed by BOTH runtime guards (`D1TreeIndex.ensureTable`,\n * `MetadataDB.open`) — as an idempotent one-time cleanup for existing DBs that\n * a prior `ensureTable` already indexed — AND the generated wrangler migration\n * (`0121_drop_content_type_index.sql`, apply-d1-migrations.mjs) for\n * schema-probe-skipped production isolates.\n */\nexport const ENTRIES_CONTENT_TYPE_INDEX_DROP_SQL = `DROP INDEX IF EXISTS idx_entries_content_type`;\n\n/** entries — the tree index (one row per file/dir node, scoped per user DID). */\nexport const ENTRIES_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_entries (\n          scope TEXT NOT NULL,\n          path TEXT NOT NULL,\n          parent TEXT NOT NULL,\n          name TEXT NOT NULL,\n          kind TEXT NOT NULL DEFAULT 'file',\n          cid TEXT,\n          size INTEGER NOT NULL DEFAULT 0,\n          mime_type TEXT,\n          ctime INTEGER NOT NULL,\n          mtime INTEGER NOT NULL,\n          PRIMARY KEY (scope, path),\n          CHECK (LENGTH(path) <= 4096),\n          CHECK (LENGTH(name) <= 255),\n          CHECK (kind IN ('file', 'dir')),\n          CHECK (LENGTH(scope) <= 128)\n        ) WITHOUT ROWID`;\n\n/** entries indexes. Order matches the historical ensureTable batch. */\nexport const ENTRIES_INDEX_SQL: readonly string[] = [\n  \"CREATE INDEX IF NOT EXISTS idx_entries_children ON ds_entries(scope, parent, name)\",\n  \"CREATE INDEX IF NOT EXISTS idx_entries_cid ON ds_entries(cid) WHERE cid IS NOT NULL\",\n  \"CREATE INDEX IF NOT EXISTS idx_entries_mtime ON ds_entries(scope, mtime DESC)\",\n  \"CREATE INDEX IF NOT EXISTS idx_entries_kind ON ds_entries(scope, kind)\",\n  // Ordered listChildren (did-space-sorting Phase 2): WHERE scope=? AND\n  // parent=? ORDER BY mtime|ctime <dir>, name <dir> — the trailing `name`\n  // column makes the tiebreak index-only. ctime DESC is the aside feed's\n  // hot query. size/mimeType ride the (scope, parent, name) scan for now\n  // (observe before indexing). Additive only — existing deployments get\n  // these via migration 0101.\n  \"CREATE INDEX IF NOT EXISTS idx_entries_parent_mtime ON ds_entries(scope, parent, mtime, name)\",\n  \"CREATE INDEX IF NOT EXISTS idx_entries_parent_ctime ON ds_entries(scope, parent, ctime, name)\",\n  // No scope-composite cid index here: `entries` is WITHOUT ROWID with\n  // PRIMARY KEY(scope, path), so SQLite appends the PK to every secondary\n  // index — `idx_entries_cid` is physically (cid, scope, path) and already\n  // serves `isReferencedMany`'s `scope=? AND cid IN(…) AND path-range` branch\n  // as a tight covering seek (verified via EXPLAIN QUERY PLAN). Only the\n  // rowid-keyed `changelog` table needs an explicit `(scope, cid)` index.\n];\n\n/**\n * versioned_scopes — completion markers for the versioned content store\n * (Layer 1, `versioned-content-store.ts`). One row per fully-materialized\n * scope; `seed_digest` is a metadata column (dev-mode stale detection),\n * NEVER part of the scope key. Additive table — ships as the generated\n * 0103 migration plus runtime ensureTable guards (idempotent CREATEs).\n */\nexport const VERSIONED_SCOPES_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_versioned_scopes (\n          scope TEXT PRIMARY KEY,\n          scope_group TEXT NOT NULL,\n          seed_digest TEXT,\n          ingested_at INTEGER NOT NULL,\n          file_count INTEGER NOT NULL DEFAULT 0,\n          CHECK (LENGTH(scope) <= 128),\n          CHECK (LENGTH(scope_group) <= 128)\n        )`;\n\nexport const VERSIONED_SCOPES_INDEX_SQL: readonly string[] = [\n  \"CREATE INDEX IF NOT EXISTS idx_versioned_scopes_group ON ds_versioned_scopes(scope_group)\",\n];\n\n/**\n * shares — materialised index of `.share` declaration files (share-out).\n *\n * Owner-scoped composite identity key `UNIQUE(owner_did, decl_path)`: the same\n * relative `decl_path` (`.share`, `docs/.share`) is legitimately reusable by\n * different owners that share one D1 (CF) or one daemon-global `_shares.db`\n * (Node). `slug` stays globally UNIQUE — it is the public URL identifier.\n *\n * Single source of truth (same pattern as VERSIONED_SCOPES_TABLE_SQL): this\n * constant feeds BOTH `ShareStore.ensureTable()` (runtime safety-net) AND the\n * provider's canonical `migrations/0011_shares.sql` + the generated CF\n * migration `0104_shares.sql`. `share-migration.test.ts` asserts the file is\n * byte-equal (after DDL normalisation) to these constants, so they cannot\n * drift.\n */\nexport const SHARES_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_shares (\n          id          TEXT PRIMARY KEY,\n          owner_did   TEXT NOT NULL,\n          source_path TEXT NOT NULL,\n          decl_path   TEXT NOT NULL,\n          slug        TEXT NOT NULL UNIQUE,\n          kind        TEXT NOT NULL DEFAULT 'raw',\n          status      TEXT NOT NULL DEFAULT 'active',\n          decl_cid    TEXT,\n          config_json TEXT NOT NULL DEFAULT '{}',\n          created_at  INTEGER NOT NULL,\n          updated_at  INTEGER NOT NULL,\n          UNIQUE(owner_did, decl_path)\n        )`;\n\nexport const SHARES_INDEX_SQL: readonly string[] = [\n  \"CREATE INDEX IF NOT EXISTS idx_shares_owner_did ON ds_shares(owner_did)\",\n  \"CREATE INDEX IF NOT EXISTS idx_shares_owner_source ON ds_shares(owner_did, source_path)\",\n  \"CREATE INDEX IF NOT EXISTS idx_shares_slug ON ds_shares(slug)\",\n];\n\n/** resolve_entries — the DID resolve store (key → value docs + owner/kind). */\nexport const RESOLVE_ENTRIES_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_resolve_entries (\n          key        TEXT    PRIMARY KEY,\n          value      TEXT    NOT NULL,\n          owner      TEXT,\n          kind       TEXT,\n          updated_at INTEGER,\n          created_at INTEGER\n        )`;\n\n/** resolve_entries indexes. Order matches the historical ensureTable sequence. */\nexport const RESOLVE_ENTRIES_INDEX_SQL: readonly string[] = [\n  \"CREATE INDEX IF NOT EXISTS idx_resolve_owner ON ds_resolve_entries(owner)\",\n  \"CREATE INDEX IF NOT EXISTS idx_resolve_kind ON ds_resolve_entries(kind)\",\n  \"CREATE INDEX IF NOT EXISTS idx_resolve_updated ON ds_resolve_entries(updated_at)\",\n  \"CREATE INDEX IF NOT EXISTS idx_resolve_created ON ds_resolve_entries(created_at)\",\n];\n\n/** gc_queue — deferred-GC CID queue (GC plan §4.3, Model B global pool). */\nexport const GC_QUEUE_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_gc_queue (\n          cid       TEXT    NOT NULL,\n          queued_at INTEGER NOT NULL,\n          PRIMARY KEY (cid)\n        )`;\n\n/**\n * gc_queue index. The deferred-GC sweep (`GcQueue.fetchCandidates`) selects\n * `WHERE queued_at <= ? LIMIT ?` every cron tick. With only the `cid` primary\n * key, that predicate has no usable index and full-scans the whole queue —\n * `rows_read` grows with queue size (D1 Insights measured ~15k rows read per\n * sweep at near-zero efficiency), the classic D1 rows_read cliff. This index\n * makes the grace-boundary scan a range seek. Mirrors the table+index pairing\n * the sibling base tables (entries/changelog/resolve_entries) already use.\n */\nexport const GC_QUEUE_INDEX_SQL: readonly string[] = [\n  \"CREATE INDEX IF NOT EXISTS idx_gc_queue_queued_at ON ds_gc_queue(queued_at)\",\n];\n\n/**\n * upload_sessions — recoverable in-flight upload session registry (DID Space\n * upload plane, design §9). Holds the prepared/committed/aborted lifecycle so\n * (a) commit can re-validate against the prepared contract, and (b) GC can\n * protect objects referenced by a non-expired `prepared` session (in-flight\n * protection, §9 / reference-check.ts).\n *\n * scope de-identification discipline (§9, NON-negotiable): `scope` is the SAME\n * `this._scope` derived value as `entries.scope` / `changelog.scope` (an opaque\n * HMAC when de-id is on), NEVER a plaintext DID — `CHECK(LENGTH(scope)<=128)`\n * mirrors `entries`. `caller` may hold ONLY a blocklet bareInstanceId (app DID),\n * never a user `did:abt:` — a raw D1 dump must not re-attribute uploads to users.\n */\nexport const UPLOAD_SESSIONS_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_upload_sessions (\n          id          TEXT PRIMARY KEY,\n          scope       TEXT NOT NULL,\n          caller      TEXT,\n          expires_at  INTEGER NOT NULL,\n          status      TEXT NOT NULL,\n          created_at  INTEGER NOT NULL,\n          CHECK (LENGTH(scope) <= 128),\n          CHECK (status IN ('prepared','committed','aborted','expired'))\n        )`;\n\n/**\n * upload_session_entries — per-entry rows of an upload session. Carries NO\n * independent identity column: it joins back to `upload_sessions` via\n * `session_id` (§9 scope discipline — never duplicate the scope/DID here).\n */\nexport const UPLOAD_SESSION_ENTRIES_TABLE_SQL = `CREATE TABLE IF NOT EXISTS ds_upload_session_entries (\n          session_id      TEXT NOT NULL,\n          path            TEXT NOT NULL,\n          cid             TEXT NOT NULL,\n          object_key      TEXT NOT NULL,\n          checksum_sha256 TEXT NOT NULL,\n          size            INTEGER NOT NULL,\n          mime_type       TEXT,\n          if_match        TEXT,\n          device_id       TEXT,\n          mtime           INTEGER,\n          status          TEXT NOT NULL,\n          PRIMARY KEY (session_id, path),\n          CHECK (status IN ('needs_upload','already_present','committed','failed'))\n        )`;\n\nexport const UPLOAD_SESSIONS_INDEX_SQL: readonly string[] = [\n  \"CREATE INDEX IF NOT EXISTS idx_upload_session_entries_cid ON ds_upload_session_entries(cid)\",\n  \"CREATE INDEX IF NOT EXISTS idx_upload_sessions_expiry ON ds_upload_sessions(status, expires_at)\",\n  // sweepExpired's predicate is `expires_at < ?` with NO status equality, so\n  // idx_upload_sessions_expiry (status-leading) cannot serve it — both sweep\n  // statements full-scan upload_sessions (EXPLAIN: `SCAN upload_sessions`;\n  // production D1 measured ~2k rows_read per sweep call during upload bursts).\n  // Same rows_read-cliff class + fix as idx_gc_queue_queued_at (migration 0111).\n  // idx_upload_sessions_expiry stays: reference-check's in-flight protection\n  // filters `status = 'prepared' AND expires_at > ?`, which needs the\n  // status-leading form.\n  \"CREATE INDEX IF NOT EXISTS idx_upload_sessions_expires_at ON ds_upload_sessions(expires_at)\",\n];\n\n/**\n * The complete did-space D1 schema, in apply order — exactly the statements\n * `CloudflareSpaceResolver.ensureTables` would issue on a fresh database\n * (TreeIndex: entries + changelog; ResolveStore; GCQueue). The generated\n * migration serializes THIS list; the runtime probe checks for the four\n * table names this list creates (entries, changelog, resolve_entries,\n * gc_queue).\n */\nexport const D1_DID_SPACE_SCHEMA_SQL: readonly string[] = [\n  ENTRIES_TABLE_SQL,\n  ...ENTRIES_INDEX_SQL,\n  CHANGELOG_TABLE_SQL,\n  ...CHANGELOG_INDEX_SQL,\n  RESOLVE_ENTRIES_TABLE_SQL,\n  ...RESOLVE_ENTRIES_INDEX_SQL,\n  GC_QUEUE_TABLE_SQL,\n  ...GC_QUEUE_INDEX_SQL,\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,MAAa,oCAAoC,6GAA6G,wBAAwB;;;;;;;;;;;;;;;;;;;;;;AAuBtL,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;AAyB3C,MAAa,iCAAiC;AAC9C,MAAa,+BAA+B;;;;;;;;;AAU5C,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCvC,MAAa,kCAAkC;;;;;;;;;;;AAY/C,MAAa,iCAAiC;;;;;;;;;;;;;;AAe9C,MAAa,sCAAsC;;AAGnD,MAAa,oBAAoB;;;;;;;;;;;;;;;;;;AAmBjC,MAAa,oBAAuC;CAClD;CACA;CACA;CACA;CAOA;CACA;CAOD;;;;;;;;AASD,MAAa,6BAA6B;;;;;;;;;AAU1C,MAAa,6BAAgD,CAC3D,4FACD;;;;;;;;;;;;;;;;AAiBD,MAAa,mBAAmB;;;;;;;;;;;;;;AAehC,MAAa,mBAAsC;CACjD;CACA;CACA;CACD;;AAGD,MAAa,4BAA4B;;;;;;;;;AAUzC,MAAa,4BAA+C;CAC1D;CACA;CACA;CACA;CACD;;AAGD,MAAa,qBAAqB;;;;;;;;;;;;;;AAelC,MAAa,qBAAwC,CACnD,8EACD;;;;;;;;;;;;;;AAeD,MAAa,4BAA4B;;;;;;;;;;;;;;;AAgBzC,MAAa,mCAAmC;;;;;;;;;;;;;;;AAgBhD,MAAa,4BAA+C;CAC1D;CACA;CASA;CACD;;;;;;;;;AAUD,MAAa,0BAA6C;CACxD;CACA,GAAG;CACH;CACA,GAAG;CACH;CACA,GAAG;CACH;CACA,GAAG;CACJ"}