@bevel-software/platform-core-backend 0.1.0

package/dist/modules/database/core-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOhB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAczB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAapB,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAepB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BxB,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUzB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAenB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCxB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBjB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAexB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBrB,CAAC;AAEJ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUhC,CAAC"}

package/dist/modules/database/core-schema.js

@@ -0,0 +1,413 @@
+/**
+ * CORE platform tables — the git-backed workspace/workflow, auth, access,
+ * change requests, locks, the pending-commits queue, the ontology-session
+ * touched-set, connection keys, MCP OAuth, and the Secrets Vault. A core-only
+ * deployment migrates and runs on exactly these tables.
+ *
+ * Enterprise-only tables (chat, routines, watchlist, connectors, LLM config,
+ * SharePoint/Atlassian links, feedback, upload, kb-revalidation) live in
+ * `enterprise-schema.ts`, which imports the FK targets (`users`,
+ * `externalApiKeys`) from here. `schema.ts` re-exports both, so existing
+ * imports keep working unchanged.
+ */
+import { sql } from 'drizzle-orm';
+import { boolean, check, index, integer, jsonb, pgTable, primaryKey, text, timestamp, uniqueIndex, uuid } from 'drizzle-orm/pg-core';
+export const users = pgTable('users', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    email: text('email').notNull().unique(),
+    name: text('name').notNull(),
+    avatarUrl: text('avatar_url'),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at').defaultNow().notNull(),
+});
+/**
+ * Per-file owner approvals on a PR. A PR is mergeable-in-Bevel when every
+ * touched path has a non-stale approval from its owner. Force-pushes invalidate
+ * approvals automatically because `head_sha` is part of the uniqueness key —
+ * an approval row for a superseded SHA stays in the DB (audit) but doesn't
+ * count toward the merge gate.
+ *
+ * Self-approval (approver == PR author) is allowed and flagged downstream in
+ * the assembled `FileApprovalState` — enforcement of "PR-author-can't-self-
+ * approve" belongs in the service layer, not the DB.
+ */
+export const prFileApprovals = pgTable('pr_file_approvals', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    prNumber: integer('pr_number').notNull(),
+    path: text('path').notNull(),
+    approverEmail: text('approver_email').notNull(), // lowercased at insert
+    approverName: text('approver_name').notNull(),
+    headSha: text('head_sha').notNull(),
+    approvedAt: timestamp('approved_at').defaultNow().notNull(),
+}, (t) => ({
+    // Idempotency: approving the same path on the same SHA twice must be a no-op,
+    // not a duplicate row. Unique on the (PR, path, approver, headSha) tuple.
+    unq: uniqueIndex('pr_file_approvals_unq')
+        .on(t.prNumber, t.path, t.approverEmail, t.headSha),
+    byPr: index('pr_file_approvals_by_pr').on(t.prNumber),
+}));
+/**
+ * Audit log for change-request merges the app executed. Captures the real Bevel
+ * user who clicked Merge, the SHA we merged, and whether the local merge+push
+ * succeeded. `pr_number` holds the change_requests number. One row per attempt —
+ * both success and failure paths insert so crash-loop scenarios are visible
+ * after the fact.
+ */
+export const prMergeLog = pgTable('pr_merge_log', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    prNumber: integer('pr_number').notNull(),
+    triggeredByEmail: text('triggered_by_email').notNull(),
+    triggeredByName: text('triggered_by_name').notNull(),
+    headShaAtMerge: text('head_sha_at_merge').notNull(),
+    mergeMethod: text('merge_method').notNull(),
+    succeeded: boolean('succeeded').notNull(),
+    error: text('error'),
+    startedAt: timestamp('started_at').defaultNow().notNull(),
+    completedAt: timestamp('completed_at'),
+}, (t) => ({
+    byPr: index('pr_merge_log_by_pr').on(t.prNumber),
+}));
+/**
+ * In-app PR comments. GitHub is authoritative for the diff + PR metadata;
+ * Bevel owns the review conversation. Comments never round-trip to GitHub.
+ *
+ * Shape encodes three comment kinds:
+ *   • General PR comment        — path null, line null
+ *   • File-level comment        — path set,  line null
+ *   • Inline (line-anchored)    — path set,  line set
+ *
+ * Threading: replies point at their root via `parentId`. Root comments have
+ * `parentId = null`. We use a self-FK-less column (no DB-side constraint) to
+ * keep the parent row independently deletable — the service layer tolerates
+ * orphan replies rather than cascading deletes and losing discussion context.
+ */
+export const prComments = pgTable('pr_comments', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    prNumber: integer('pr_number').notNull(),
+    authorEmail: text('author_email').notNull(),
+    authorName: text('author_name').notNull(),
+    path: text('path'),
+    line: integer('line'),
+    headSha: text('head_sha').notNull(),
+    body: text('body').notNull(),
+    parentId: uuid('parent_id'),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at'),
+}, (t) => ({
+    byPr: index('pr_comments_by_pr').on(t.prNumber),
+    byThread: index('pr_comments_by_thread').on(t.prNumber, t.path, t.line),
+}));
+/**
+ * Change requests (the app's own "pull request" model). The app used to lean on
+ * GitHub PRs via the `gh` CLI; now a change request is a plain DB row plus git
+ * branches, so ANY git host (GitHub, GitLab, Bitbucket, Azure DevOps, self-
+ * hosted) works — the remote only stores commits/branches.
+ *
+ * `number` is the human-facing id and the join key the sibling tables
+ * (`pr_file_approvals`, `pr_comments`, `pr_merge_log`) reference in their
+ * `pr_number` column — those columns now hold THIS number, not a GitHub PR
+ * number. It's a DB-assigned identity so allocation is race-free.
+ *
+ * The diff, head/base SHAs, and mergeability are computed live from git (not
+ * stored) so a force-push or a new commit is always reflected; only durable
+ * facts live here — the pairing, title/body, author, lifecycle state.
+ */
+export const changeRequests = pgTable('change_requests', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    number: integer('number').generatedAlwaysAsIdentity(),
+    sourceBranch: text('source_branch').notNull(),
+    targetBranch: text('target_branch').notNull(),
+    title: text('title').notNull(),
+    body: text('body').notNull().default(''),
+    authorEmail: text('author_email').notNull(), // lowercased at insert
+    authorName: text('author_name').notNull(),
+    state: text('state').notNull().default('open'), // 'open' | 'merged' | 'closed'
+    mergedSha: text('merged_sha'),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at'),
+    closedAt: timestamp('closed_at'),
+}, (t) => ({
+    numberUnq: uniqueIndex('change_requests_number_unq').on(t.number),
+    // Enforce the "A→B blocks A→B while open" uniqueness rule at the DB level —
+    // a partial unique index on open rows only. B→A in parallel is still allowed
+    // because the pair differs. Replaces the previous race-prone list scan.
+    openPairUnq: uniqueIndex('change_requests_open_pair_unq')
+        .on(t.sourceBranch, t.targetBranch)
+        .where(sql `${t.state} = 'open'`),
+    byState: index('change_requests_by_state').on(t.state),
+    stateCheck: check('change_requests_state_check', sql `${t.state} IN ('open', 'merged', 'closed')`),
+}));
+/**
+ * Long-lived API tokens that authenticate remote agents (Claude Code and
+ * similar MCP clients) as a specific Bevel user. Plaintext token is shown
+ * once at mint time; we store only the SHA-256 hash. Verification is a hash
+ * lookup, so the unique index on `token_hash` is what makes lookup O(1)
+ * rather than a table scan.
+ *
+ * Tokens are revoked, not deleted — keeping the row preserves the audit
+ * trail for `last_used_at` and lets an operator see when a leaked key was
+ * actually used. A revoked row is rejected on verify because the service
+ * filters on `revoked_at IS NULL`; the unique index still applies, so a
+ * revoked token cannot be re-issued.
+ */
+export const externalApiKeys = pgTable('api_tokens', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    userId: uuid('user_id').notNull().references(() => users.id),
+    tokenHash: text('token_hash').notNull().unique(),
+    label: text('label').notNull(),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    lastUsedAt: timestamp('last_used_at'),
+    revokedAt: timestamp('revoked_at'),
+}, (t) => ({
+    byUser: index('api_tokens_by_user').on(t.userId),
+}));
+/**
+ * Per-(workspace, branch, path) edit locks. While the lock is held by a user,
+ * other users see the file as locked and can't edit it. The client pings
+ * `last_heartbeat_at` periodically; when `expires_at` passes without a
+ * heartbeat the lock is considered stale and may be reclaimed by another
+ * caller — prevents a disconnected client from holding a file hostage.
+ *
+ * Composite primary key on (workspace, branch, path) — one lock per file
+ * per branch. The same physical path on another branch is independently
+ * lockable; the spec calls this out explicitly.
+ *
+ * Holder identity carries both the user id (FK into `users` for referential
+ * integrity) and a denormalised display name so consumers can render
+ * "Locked by Alice" without a JOIN on the hot read path.
+ */
+export const fileLocks = pgTable('file_locks', {
+    workspaceId: text('workspace_id').notNull(),
+    branch: text('branch').notNull(),
+    path: text('path').notNull(),
+    holderUserId: uuid('holder_user_id').notNull().references(() => users.id),
+    holderName: text('holder_name').notNull(),
+    acquiredAt: timestamp('acquired_at').defaultNow().notNull(),
+    lastHeartbeatAt: timestamp('last_heartbeat_at').defaultNow().notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+}, (t) => ({
+    pk: primaryKey({ columns: [t.workspaceId, t.branch, t.path] }),
+    // Sweep stale locks via `expires_at < now()` — an index avoids a full
+    // table scan once the lock count grows.
+    byExpiry: index('file_locks_by_expiry').on(t.expiresAt),
+    byHolder: index('file_locks_by_holder').on(t.holderUserId),
+}));
+/**
+ * Background commit queue. Every successful lock release enqueues a row
+ * here; the queue worker drains it by running `commitFile` + `pushBranch`
+ * (with the existing `pushWithRecovery` cooperative pull-rebase).
+ *
+ * Why a table and not an in-memory queue: the prior in-line lock-release
+ * commit path stranded files on disk whenever the process died (or git
+ * blipped) between disk-write and commit. A persistent queue means a
+ * process crash leaves the work resumable — the next worker pass picks
+ * it up. Schema choices follow from that:
+ *
+ *   - `id` UUID PK so the worker can `UPDATE ... WHERE id = ...` atomically
+ *     without locking the queue. Read order is `(workspace_id, queued_at)`
+ *     so per-workspace work stays FIFO.
+ *   - `(workspace_id, branch, path)` is NOT unique. Two consecutive saves
+ *     of the same file produce two rows; the worker collapses them by
+ *     committing once and deleting both (commitFile is a no-op on a
+ *     clean path, so the duplicate becomes a free deletion).
+ *   - Author identity is denormalised (email + name) at enqueue time, like
+ *     `file_locks.holder_name`. We don't FK into `users` because the
+ *     startup sweep enqueues orphans with synthetic `system-recovery`
+ *     attribution and there's no row for that user.
+ *   - `attempts` + `last_error` drive the worker's transient-retry budget
+ *     (1s/5s/30s backoff before handing off to the recovery agent) and
+ *     the agent's own retry ceiling (3 runs before `status = needs_attention`).
+ *   - `status` is a small enum (`pending` | `running` | `needs_attention`).
+ *     Workers claim a row by flipping `pending → running` in a single
+ *     UPDATE; terminal failure flips to `needs_attention` and the row
+ *     stays for admin / feedback review.
+ *   - `last_attempted_at` gates backoff scheduling so the worker doesn't
+ *     re-pop a row that just failed.
+ */
+export const pendingCommits = pgTable('pending_commits', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    workspaceId: text('workspace_id').notNull(),
+    branch: text('branch').notNull(),
+    path: text('path').notNull(),
+    // Author attribution captured at enqueue. The denormalised name/email pair
+    // lands on the eventual `git commit --author=` so the commit history shows
+    // the human who triggered the save, not the worker.
+    authorEmail: text('author_email').notNull(), // lowercased at insert
+    authorName: text('author_name').notNull(),
+    queuedAt: timestamp('queued_at').defaultNow().notNull(),
+    // `running` is set while the worker is mid-commit so a second worker
+    // (e.g. after a restart with another instance still draining) doesn't
+    // double-process the row. Set back to `pending` on transient failure;
+    // set to `needs_attention` after the recovery-agent retry ceiling.
+    status: text('status').notNull().default('pending'),
+    attempts: integer('attempts').notNull().default(0),
+    // Tracks how many full recovery-agent runs have fired for this row.
+    // Bounded so a genuinely-broken commit eventually escalates to
+    // `needs_attention` + feedback notice instead of looping forever.
+    recoveryAgentRuns: integer('recovery_agent_runs').notNull().default(0),
+    lastAttemptedAt: timestamp('last_attempted_at'),
+    lastError: text('last_error'),
+}, (t) => ({
+    // Primary read pattern: drain in queued order, scoped to a workspace.
+    byWorkspaceQueued: index('pending_commits_by_workspace_queued').on(t.workspaceId, t.queuedAt),
+    // Sweep: find rows ready to retry (status='pending' AND last_attempted_at < now() - backoff).
+    byStatus: index('pending_commits_by_status').on(t.status, t.lastAttemptedAt),
+    // Admin surface: enumerate everything stuck in needs_attention.
+    byStatusOnly: index('pending_commits_by_status_only').on(t.status),
+    statusCheck: check('pending_commits_status', sql `${t.status} IN ('pending', 'running', 'needs_attention')`),
+}));
+/**
+ * Secrets Vault — the per-user store of credentials that back UTCP tool
+ * variables (`${FOO_API_KEY}`). Distinct from `vault_sources` (which holds
+ * connector+URL POINTERS and no credentials): this table holds the actual
+ * secret values, encrypted at rest.
+ *
+ * Two kinds:
+ *  - `static`  — a value the user pasted (an API key). `value_encrypted` is the
+ *                AES-256-GCM ciphertext of the raw value.
+ *  - `oauth`   — an authorization-code credential. `value_encrypted` is the
+ *                ciphertext of a JSON blob `{ clientSecret?, tokens: { access_token,
+ *                refresh_token?, expires_at?, token_type? } }`; the non-secret
+ *                provider config (auth/token URLs, client id, scopes) lives in
+ *                `oauth_meta`. `resolve()` refreshes the access token on demand.
+ *
+ * `key` is the UTCP variable name a `.tool` manual references (`<manual>_<VAR>`).
+ * Two provisioning tiers share this table:
+ *  - `user_id` set  — a PER-USER secret (private to that user, cascade-deleted
+ *                     with them), unique per `(user_id, key)`.
+ *  - `user_id NULL` — a SHARED/admin secret, set by a writer of the `.tool` file
+ *                     and read by every invoker of that tool. Unique per `key`
+ *                     via the partial index below (a plain `(user_id, key)` index
+ *                     treats NULLs as distinct, so it can't enforce one shared
+ *                     row per key on its own).
+ * `kind` is validated in the service, not a DB CHECK.
+ */
+export const secrets = pgTable('secrets', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    userId: uuid('user_id').references(() => users.id, { onDelete: 'cascade' }),
+    /** The UTCP variable name this secret resolves (e.g. `FOO_API_KEY`). */
+    key: text('key').notNull(),
+    /** `static` | `oauth`. */
+    kind: text('kind').notNull().default('static'),
+    /** Operator-chosen display name. */
+    label: text('label'),
+    /** AES-256-GCM ciphertext (`iv:tag:ct`) — the value (static) or token JSON (oauth). */
+    valueEncrypted: text('value_encrypted').notNull(),
+    /** Non-secret OAuth provider config for `oauth` kind; null for `static`. */
+    oauthMeta: jsonb('oauth_meta').$type(),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at').defaultNow().notNull(),
+}, (t) => ({
+    byUser: index('secrets_by_user').on(t.userId),
+    userKeyUnq: uniqueIndex('secrets_user_key_unq').on(t.userId, t.key),
+    // One shared (admin) row per key: enforce uniqueness only across NULL-user rows.
+    sharedKeyUnq: uniqueIndex('secrets_shared_key_unq').on(t.key).where(sql `${t.userId} is null`),
+}));
+/**
+ * Ontology-session boundary — the per-session log of which named ontologies a
+ * run has TOUCHED (one row per `(session_id, ontology)`). Each agent operation
+ * that resolves to a named ontology records a row here (idempotent on the PK).
+ *
+ * The rule the gate enforces from this set:
+ *   - READS are always allowed; they just record the ontology they touched.
+ *   - WRITES are allowed only while the session's touched set is a SINGLE named
+ *     ontology equal to the write target. Once a session has touched two or
+ *     more ontologies (e.g. by reading across them), every write is blocked —
+ *     "read across ontologies → you can't write anymore at all."
+ *
+ * Postgres is the durable source of truth so the boundary holds across a
+ * backend restart (an in-memory set would reset and silently un-poison a run).
+ * A write-through in-process cache fronts this table for the chatty read path;
+ * a cache miss falls back here.
+ *
+ *   - PK is `(session_id, ontology)` — a set, idempotent on repeat touches.
+ *   - `ontology` is the resolved ontology id (e.g. `KnowledgeBase/Product`).
+ *     Neutral touches don't record, so they never write a row.
+ *   - `touched_at` drives the abandoned-run `sweepOlderThan` backstop; the
+ *     primary reclamation is an explicit delete of all of a session's rows at
+ *     run end.
+ */
+/**
+ * OAuth clients dynamically registered by MCP clients (RFC 7591 DCR). When an
+ * MCP client (claude.ai, Claude Code) connects to `/api/mcp` without a
+ * connection key, it registers itself here via `POST /register`, then runs the
+ * PKCE authorization-code flow against our authorize/token endpoints.
+ *
+ * `client_secret_encrypted` is AES-256-GCM ciphertext (`iv:tag:ct`), NOT a
+ * hash: the MCP SDK's token-endpoint client-auth middleware plaintext-compares
+ * `client.client_secret`, so `getClient` must return the original value. In
+ * practice MCP clients register as PUBLIC clients (`token_endpoint_auth_method
+ * 'none'`, PKCE only) and the column stays NULL. `metadata` snapshots the full
+ * registration object so `getClient` can rebuild it without lossy re-mapping.
+ */
+export const oauthClients = pgTable('oauth_clients', {
+    clientId: text('client_id').primaryKey(),
+    clientSecretEncrypted: text('client_secret_encrypted'),
+    clientSecretExpiresAt: timestamp('client_secret_expires_at'),
+    redirectUris: jsonb('redirect_uris').notNull().$type().default(sql `'[]'::jsonb`),
+    tokenEndpointAuthMethod: text('token_endpoint_auth_method').notNull().default('none'),
+    clientName: text('client_name'),
+    metadata: jsonb('metadata').notNull().$type().default(sql `'{}'::jsonb`),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+});
+/**
+ * One-time OAuth authorization codes, issued when a user clicks Finish on the
+ * `/connect` consent page and exchanged at `/token` within seconds. Stored as
+ * a SHA-256 hash like every other bearer secret here. The row binds the code
+ * to (user, client, redirect_uri, PKCE challenge) so the token exchange can
+ * verify all four; single-use is enforced by the atomic consume
+ * `UPDATE … SET consumed_at = now() WHERE consumed_at IS NULL` (same pattern
+ * as `upload_tokens.used_at`).
+ */
+export const oauthAuthCodes = pgTable('oauth_auth_codes', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    codeHash: text('code_hash').notNull().unique(),
+    clientId: text('client_id').notNull().references(() => oauthClients.clientId),
+    userId: uuid('user_id').notNull().references(() => users.id),
+    redirectUri: text('redirect_uri').notNull(),
+    codeChallenge: text('code_challenge').notNull(),
+    scope: text('scope'),
+    resource: text('resource'),
+    expiresAt: timestamp('expires_at').notNull(),
+    consumedAt: timestamp('consumed_at'),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+}, (t) => ({
+    // Sweep expired/spent rows without a full scan.
+    byExpiry: index('oauth_auth_codes_by_expiry').on(t.expiresAt),
+}));
+/**
+ * OAuth access/refresh token pairs minted by the token endpoint. Like
+ * `api_tokens`: plaintext shown only in the token response, SHA-256 hashes
+ * stored, revoked-not-deleted so `last_used_at` keeps its audit value and a
+ * revoked token can't be re-issued. One row per pair; refresh rotation
+ * revokes the old row and inserts a new one.
+ */
+export const oauthTokens = pgTable('oauth_tokens', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    accessTokenHash: text('access_token_hash').notNull().unique(),
+    refreshTokenHash: text('refresh_token_hash').unique(),
+    clientId: text('client_id').notNull().references(() => oauthClients.clientId),
+    userId: uuid('user_id').notNull().references(() => users.id),
+    scope: text('scope'),
+    resource: text('resource'),
+    expiresAt: timestamp('expires_at').notNull(),
+    refreshExpiresAt: timestamp('refresh_expires_at'),
+    revokedAt: timestamp('revoked_at'),
+    lastUsedAt: timestamp('last_used_at'),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+}, (t) => ({
+    byUser: index('oauth_tokens_by_user').on(t.userId),
+    byExpiry: index('oauth_tokens_by_expiry').on(t.expiresAt),
+}));
+export const sessionOntologyTouches = pgTable('session_ontology_touches', {
+    sessionId: text('session_id').notNull(),
+    ontology: text('ontology').notNull(),
+    touchedAt: timestamp('touched_at').defaultNow().notNull(),
+}, (t) => ({
+    // The composite PK leads with `session_id`, so a load-by-session SELECT is
+    // already served by the PK index — no separate `by_session` index needed.
+    pk: primaryKey({ columns: [t.sessionId, t.ontology] }),
+    // Backstop sweep of abandoned runs via `touched_at < cutoff`.
+    byTouchedAt: index('session_ontology_touches_by_touched_at').on(t.touchedAt),
+}));
+//# sourceMappingURL=core-schema.js.map

package/dist/modules/database/core-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-schema.js","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAErI,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE;IACpC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAC1D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAG,uBAAuB;IACzE,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC5D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,8EAA8E;IAC9E,0EAA0E;IAC1E,GAAG,EAAE,WAAW,CAAC,uBAAuB,CAAC;SACtC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CACtD,CAAC,CAAC,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE;IAChD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,cAAc,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACnD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,WAAW,EAAE,SAAS,CAAC,cAAc,CAAC;CACvC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CACjD,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE;IAC/C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;IACrB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/C,QAAQ,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;CACxE,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,yBAAyB,EAAE;IACrD,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,uBAAuB;IACpE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,+BAA+B;IAC/E,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC;CACjC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,SAAS,EAAE,WAAW,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,WAAW,EAAE,WAAW,CAAC,+BAA+B,CAAC;SACtD,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;SAClC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,WAAW,CAAC;IAClC,OAAO,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,UAAU,EAAE,KAAK,CACf,6BAA6B,EAC7B,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,kCAAkC,CAChD;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY,EAAE;IACnD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CACjD,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE;IAC7C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IAC3D,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACtE,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC7C,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9D,sEAAsE;IACtE,wCAAwC;IACxC,QAAQ,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,QAAQ,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;CAC3D,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAG,uBAAuB;IACrE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACvD,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,oEAAoE;IACpE,+DAA+D;IAC/D,kEAAkE;IAClE,iBAAiB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC;IAC/C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,sEAAsE;IACtE,iBAAiB,EAAE,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC7F,8FAA8F;IAC9F,QAAQ,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,eAAe,CAAC;IAC5E,gEAAgE;IAChE,YAAY,EAAE,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClE,WAAW,EAAE,KAAK,CAChB,wBAAwB,EACxB,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,+CAA+C,CAC9D;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE;IACxC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3E,wEAAwE;IACxE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAC1B,0BAA0B;IAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9C,oCAAoC;IACpC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,uFAAuF;IACvF,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,4EAA4E;IAC5E,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,EAA2B;IAC/D,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC;IACnE,iFAAiF;IACjF,YAAY,EAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,UAAU,CAAC;CAC9F,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE;IACnD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE;IACxC,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACtD,qBAAqB,EAAE,SAAS,CAAC,0BAA0B,CAAC;IAC5D,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAAY,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAC1F,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACrF,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAA2B,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAChG,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE;IACxD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,gDAAgD;IAChD,QAAQ,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC9D,CAAC,CAAC,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE;IACjD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC7D,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE;IACrD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,gBAAgB,EAAE,SAAS,CAAC,oBAAoB,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC1D,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,0BAA0B,EAAE;IACxE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,2EAA2E;IAC3E,0EAA0E;IAC1E,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtD,8DAA8D;IAC9D,WAAW,EAAE,KAAK,CAAC,wCAAwC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7E,CAAC,CAAC,CAAC"}

package/dist/modules/database/migrate.d.ts

@@ -0,0 +1,10 @@
+import type { Database } from './connection.js';
+/** Apply the CORE migration history from `folder`, tracked in `__drizzle_migrations_core`. */
+export declare function runCoreMigrations(db: Database, folder: string): Promise<void>;
+/**
+ * Apply the ENTERPRISE migration history from `folder`, tracked in
+ * `__drizzle_migrations_enterprise`. Run AFTER {@link runCoreMigrations} —
+ * enterprise tables FK into core tables.
+ */
+export declare function runEnterpriseMigrations(db: Database, folder: string): Promise<void>;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/modules/database/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/modules/database/migrate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAyBhD,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAInF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzF"}

package/dist/modules/database/migrate.js

@@ -0,0 +1,40 @@
+import { migrate } from 'drizzle-orm/node-postgres/migrator';
+/*
+ * ── Per-tier migration folders ──────────────────────────────────────────────
+ *
+ * The schema is split into a CORE slice (this package's `core-schema.ts`,
+ * migration history in the packaged `migrations/` folder — see
+ * `coreMigrationsDir()` in `src/assets.ts`) and an optional ENTERPRISE slice
+ * maintained by the consuming product. Each history has its OWN drizzle
+ * tracking table (`migrationsTable`) so the two advance independently:
+ *
+ *   - `__drizzle_migrations_core`       — applied core migrations
+ *   - `__drizzle_migrations_enterprise` — applied enterprise migrations
+ *
+ * Run core BEFORE enterprise on every boot — enterprise tables FK into core
+ * tables (`users`, `api_tokens`). The core init migration is written to be
+ * IDEMPOTENT (`CREATE TABLE IF NOT EXISTS` + guarded DO-blocks) so a database
+ * that predates the split (tables created by a legacy single-folder history)
+ * no-ops instead of failing.
+ *
+ * Note: drizzle-orm's node-postgres `migrate()` accepts `migrationsTable` (and
+ * `migrationsSchema`) in the installed version (0.45.x) — see
+ * `drizzle-orm/migrator.d.ts` (`MigrationConfig`).
+ */
+/** Apply the CORE migration history from `folder`, tracked in `__drizzle_migrations_core`. */
+export async function runCoreMigrations(db, folder) {
+    console.log('Running core database migrations...');
+    await migrate(db, { migrationsFolder: folder, migrationsTable: '__drizzle_migrations_core' });
+    console.log('Core migrations complete.');
+}
+/**
+ * Apply the ENTERPRISE migration history from `folder`, tracked in
+ * `__drizzle_migrations_enterprise`. Run AFTER {@link runCoreMigrations} —
+ * enterprise tables FK into core tables.
+ */
+export async function runEnterpriseMigrations(db, folder) {
+    console.log('Running enterprise database migrations...');
+    await migrate(db, { migrationsFolder: folder, migrationsTable: '__drizzle_migrations_enterprise' });
+    console.log('Enterprise migrations complete.');
+}
+//# sourceMappingURL=migrate.js.map

package/dist/modules/database/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../../src/modules/database/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAG7D;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,MAAc;IAClE,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACnD,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,MAAc;IACxE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,iCAAiC,EAAE,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACjD,CAAC"}

package/dist/modules/database/schema.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The database schema of the CORE platform.
+ *
+ * In this package `schema.ts` is a re-export of `core-schema.ts` ONLY — the
+ * enterprise tables live with the enterprise product, whose own schema file
+ * imports the FK targets (`users`, `apiTokens`) from
+ * `@bevel-software/platform-core-backend/schema`. Kept as a separate module (rather
+ * than folding the tables in here) so module code keeps importing
+ * `./schema.js` unchanged.
+ */
+export * from './core-schema.js';
+//# sourceMappingURL=schema.d.ts.map

package/dist/modules/database/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/database/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,cAAc,kBAAkB,CAAC"}

package/dist/modules/database/schema.js

@@ -0,0 +1,12 @@
+/**
+ * The database schema of the CORE platform.
+ *
+ * In this package `schema.ts` is a re-export of `core-schema.ts` ONLY — the
+ * enterprise tables live with the enterprise product, whose own schema file
+ * imports the FK targets (`users`, `apiTokens`) from
+ * `@bevel-software/platform-core-backend/schema`. Kept as a separate module (rather
+ * than folding the tables in here) so module code keeps importing
+ * `./schema.js` unchanged.
+ */
+export * from './core-schema.js';
+//# sourceMappingURL=schema.js.map

package/dist/modules/database/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/modules/database/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,cAAc,kBAAkB,CAAC"}

package/dist/modules/diff/diff-paths.d.ts

@@ -0,0 +1,2 @@
+export declare function assertWithinDirectory(absolutePath: string, dir: string): void;
+//# sourceMappingURL=diff-paths.d.ts.map

package/dist/modules/diff/diff-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-paths.d.ts","sourceRoot":"","sources":["../../../src/modules/diff/diff-paths.ts"],"names":[],"mappings":"AAEA,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAM7E"}

package/dist/modules/diff/diff-paths.js

@@ -0,0 +1,9 @@
+import path from 'node:path';
+export function assertWithinDirectory(absolutePath, dir) {
+    const resolved = path.resolve(absolutePath);
+    const root = path.resolve(dir);
+    if (!resolved.startsWith(root + path.sep) && resolved !== root) {
+        throw new Error('Path traversal detected');
+    }
+}
+//# sourceMappingURL=diff-paths.js.map

package/dist/modules/diff/diff-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-paths.js","sourceRoot":"","sources":["../../../src/modules/diff/diff-paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,GAAW;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/modules/diff/diff.config.d.ts

@@ -0,0 +1,8 @@
+/**
+ * File extensions that participate in diff review.
+ * Only these extensions get backup copies under <backupsRoot>/<userId>/...
+ * and surface in the pending-changes list.
+ */
+export declare const DIFFABLE_EXTENSIONS: ReadonlySet<string>;
+export declare function isDiffable(filePath: string): boolean;
+//# sourceMappingURL=diff.config.d.ts.map

package/dist/modules/diff/diff.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.config.d.ts","sourceRoot":"","sources":["../../../src/modules/diff/diff.config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAoB,CAAC;AAEzE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIpD"}

package/dist/modules/diff/diff.config.js

@@ -0,0 +1,13 @@
+/**
+ * File extensions that participate in diff review.
+ * Only these extensions get backup copies under <backupsRoot>/<userId>/...
+ * and surface in the pending-changes list.
+ */
+export const DIFFABLE_EXTENSIONS = new Set(['.md']);
+export function isDiffable(filePath) {
+    const dot = filePath.lastIndexOf('.');
+    if (dot < 0)
+        return false;
+    return DIFFABLE_EXTENSIONS.has(filePath.slice(dot).toLowerCase());
+}
+//# sourceMappingURL=diff.config.js.map

package/dist/modules/diff/diff.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.config.js","sourceRoot":"","sources":["../../../src/modules/diff/diff.config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAEzE,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACpE,CAAC"}