@cloudhal/storage 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,27 @@
-# Temporary Holding Version
+# @cloudhal/storage
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Storage interfaces and adapters for Cloudhal. The interface is shaped by the most constrained backend, Cloudflare D1: **no interactive transactions**, atomic `batch()` only, and D1's bind/size limits enforced by every adapter so local behaviour matches production (ADR-0002).
+
+| Export | What |
+|---|---|
+| `@cloudhal/storage` | `SqlDriver`, `BlobStore`, limits, `migrate()`, `migrations`, `MemoryBlobStore` |
+| `@cloudhal/storage/sqlite` | `BetterSqlite3Driver` — local files or `:memory:` |
+| `@cloudhal/storage/d1` | `D1Driver` — Cloudflare D1 binding |
+| `@cloudhal/storage/fs` | `FsBlobStore` — directory on disk |
+| `@cloudhal/storage/r2` | `R2BlobStore` — Cloudflare R2 binding |
+| `@cloudhal/storage/testing` | conformance suites + Miniflare helpers (`createMiniflareD1`, `createMiniflareR2`) |
+
+```ts
+import { migrate, migrations } from "@cloudhal/storage";
+import { BetterSqlite3Driver } from "@cloudhal/storage/sqlite";
+
+const sql = await BetterSqlite3Driver.open("cloudhal.db");
+await migrate(sql, migrations);
+await sql.batch([
+  { sql: "UPDATE nodes SET rev = rev + 1, body = ? WHERE id = ? AND rev = ?", params: [body, id, rev] },
+]);
+```
+
+Migrations are TypeScript modules under `migrations/` (plain SQL strings) so they bundle for Workers without filesystem access. Each migration is applied as one atomic batch.
+
+Every adapter must pass `describeSqlDriverConformance` / `describeBlobStoreConformance`; the D1 and R2 suites run against Miniflare (workerd in-process), so no Cloudflare account is needed.

package/dist/migrations/0001_init.d.ts

@@ -0,0 +1,12 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Site Graph storage, version 1 (RFC-0001).
+ * - projects: one row per Project, body is the contract JSON.
+ * - nodes: every site-scoped node (site, page, contentEntry). `key` is the uniqueness key per kind:
+ *     site         → "site"
+ *     page         → "<locale>:<path>"
+ *     contentEntry → "<collection>:<locale>:<slug>"
+ * - snapshots: immutable Snapshot contracts, linked by parent_id.
+ * Timestamps are ISO 8601 strings; booleans are integers; bodies are JSON text.
+ */
+export declare const migration0001Init: Migration;

package/dist/migrations/0001_init.js

@@ -0,0 +1,46 @@
+                                                   
+
+/**
+ * Site Graph storage, version 1 (RFC-0001).
+ * - projects: one row per Project, body is the contract JSON.
+ * - nodes: every site-scoped node (site, page, contentEntry). `key` is the uniqueness key per kind:
+ *     site         → "site"
+ *     page         → "<locale>:<path>"
+ *     contentEntry → "<collection>:<locale>:<slug>"
+ * - snapshots: immutable Snapshot contracts, linked by parent_id.
+ * Timestamps are ISO 8601 strings; booleans are integers; bodies are JSON text.
+ */
+export const migration0001Init            = {
+  name: "0001_init",
+  sql: `
+CREATE TABLE projects (
+  id TEXT PRIMARY KEY,
+  rev INTEGER NOT NULL,
+  body TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE TABLE nodes (
+  id TEXT PRIMARY KEY,
+  site_id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  key TEXT NOT NULL,
+  rev INTEGER NOT NULL,
+  hash TEXT NOT NULL,
+  body TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE UNIQUE INDEX nodes_site_kind_key ON nodes (site_id, kind, key);
+CREATE INDEX nodes_site_kind ON nodes (site_id, kind);
+CREATE TABLE snapshots (
+  id TEXT PRIMARY KEY,
+  site_id TEXT NOT NULL,
+  parent_id TEXT,
+  site_rev INTEGER NOT NULL,
+  body TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+CREATE INDEX snapshots_site_created ON snapshots (site_id, created_at);
+`,
+};

package/dist/migrations/0002_auth.d.ts

@@ -0,0 +1,7 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Better Auth 1.7.7 schema (email+password core + `organization` + `admin` plugins), generated with
+ * `getMigrations(auth.options).compileMigrations()` and checked in so one migration pipeline governs
+ * every table (ADR-0010). Regenerate when plugins change; never edit by hand.
+ */
+export declare const migration0002Auth: Migration;

package/dist/migrations/0002_auth.js

@@ -0,0 +1,26 @@
+                                                   
+
+/**
+ * Better Auth 1.7.7 schema (email+password core + `organization` + `admin` plugins), generated with
+ * `getMigrations(auth.options).compileMigrations()` and checked in so one migration pipeline governs
+ * every table (ADR-0010). Regenerate when plugins change; never edit by hand.
+ */
+export const migration0002Auth            = {
+  name: "0002_auth",
+  sql: `
+create table "user" ("id" text not null primary key, "name" text not null, "email" text not null unique, "emailVerified" integer not null, "image" text, "createdAt" date not null, "updatedAt" date not null, "role" text, "banned" integer, "banReason" text, "banExpires" date);
+create table "session" ("id" text not null primary key, "expiresAt" date not null, "token" text not null unique, "createdAt" date not null, "updatedAt" date not null, "ipAddress" text, "userAgent" text, "userId" text not null references "user" ("id") on delete cascade, "activeOrganizationId" text, "impersonatedBy" text);
+create table "account" ("id" text not null primary key, "accountId" text not null, "providerId" text not null, "userId" text not null references "user" ("id") on delete cascade, "accessToken" text, "refreshToken" text, "idToken" text, "accessTokenExpiresAt" date, "refreshTokenExpiresAt" date, "scope" text, "password" text, "createdAt" date not null, "updatedAt" date not null);
+create table "verification" ("id" text not null primary key, "identifier" text not null, "value" text not null, "expiresAt" date not null, "createdAt" date not null, "updatedAt" date not null);
+create table "organization" ("id" text not null primary key, "name" text not null, "slug" text not null unique, "logo" text, "createdAt" date not null, "metadata" text);
+create table "member" ("id" text not null primary key, "organizationId" text not null references "organization" ("id") on delete cascade, "userId" text not null references "user" ("id") on delete cascade, "role" text not null, "createdAt" date not null);
+create table "invitation" ("id" text not null primary key, "organizationId" text not null references "organization" ("id") on delete cascade, "email" text not null, "role" text, "teamId" text, "status" text not null, "expiresAt" date not null, "createdAt" date not null, "inviterId" text not null references "user" ("id") on delete cascade);
+create index "session_userId_idx" on "session" ("userId");
+create index "account_userId_idx" on "account" ("userId");
+create index "verification_identifier_idx" on "verification" ("identifier");
+create index "member_organizationId_idx" on "member" ("organizationId");
+create index "member_userId_idx" on "member" ("userId");
+create index "invitation_organizationId_idx" on "invitation" ("organizationId");
+create index "invitation_email_idx" on "invitation" ("email");
+`,
+};

package/dist/migrations/0003_agent.d.ts

@@ -0,0 +1,6 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Agent layer (Sprint 5): the audit log every policy decision and tool call is written to, and the
+ * Better Auth `apikey` table (`@better-auth/api-key` 1.7.7 DDL) for non-interactive agent credentials.
+ */
+export declare const migration0003Agent: Migration;

package/dist/migrations/0003_agent.js

@@ -0,0 +1,32 @@
+                                                   
+
+/**
+ * Agent layer (Sprint 5): the audit log every policy decision and tool call is written to, and the
+ * Better Auth `apikey` table (`@better-auth/api-key` 1.7.7 DDL) for non-interactive agent credentials.
+ */
+export const migration0003Agent            = {
+  name: "0003_agent",
+  sql: `
+CREATE TABLE audit (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  actor_kind TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  site_id TEXT,
+  tool TEXT NOT NULL,
+  decision TEXT NOT NULL,
+  reason TEXT,
+  skill TEXT,
+  input TEXT,
+  outcome TEXT,
+  snapshot_id TEXT,
+  duration_ms INTEGER
+);
+CREATE INDEX audit_site_at ON audit (site_id, at);
+CREATE INDEX audit_actor_at ON audit (actor_id, at);
+create table "apikey" ("id" text not null primary key, "configId" text not null, "name" text, "start" text, "referenceId" text not null, "prefix" text, "key" text not null, "refillInterval" integer, "refillAmount" integer, "lastRefillAt" date, "enabled" integer, "rateLimitEnabled" integer, "rateLimitTimeWindow" integer, "rateLimitMax" integer, "requestCount" integer, "remaining" integer, "lastRequest" date, "expiresAt" date, "createdAt" date not null, "updatedAt" date not null, "permissions" text, "metadata" text);
+create index "apikey_configId_idx" on "apikey" ("configId");
+create index "apikey_referenceId_idx" on "apikey" ("referenceId");
+create index "apikey_key_idx" on "apikey" ("key");
+`,
+};

package/dist/migrations/0004_audit_actor_name.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../src/migrate.js";
+/** Keeps the actor's display name next to its id so activity feeds need no join. */
+export declare const migration0004AuditActorName: Migration;

package/dist/migrations/0004_audit_actor_name.js

@@ -0,0 +1,7 @@
+                                                   
+
+/** Keeps the actor's display name next to its id so activity feeds need no join. */
+export const migration0004AuditActorName            = {
+  name: "0004_audit_actor_name",
+  sql: `ALTER TABLE audit ADD COLUMN actor_name TEXT;`,
+};

package/dist/migrations/0005_auth_rate_limit.d.ts

@@ -0,0 +1,7 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Better Auth `rateLimit` table (DDL generated by better-auth 1.7.7 `getMigrations` with
+ * `rateLimit.storage: "database"`). On Workers the default in-memory limiter is per isolate and
+ * therefore ineffective, so rate-limit counters live in D1.
+ */
+export declare const migration0005AuthRateLimit: Migration;

package/dist/migrations/0005_auth_rate_limit.js

@@ -0,0 +1,11 @@
+                                                   
+
+/**
+ * Better Auth `rateLimit` table (DDL generated by better-auth 1.7.7 `getMigrations` with
+ * `rateLimit.storage: "database"`). On Workers the default in-memory limiter is per isolate and
+ * therefore ineffective, so rate-limit counters live in D1.
+ */
+export const migration0005AuthRateLimit            = {
+  name: "0005_auth_rate_limit",
+  sql: `create table "rateLimit" ("id" text not null primary key, "key" text not null unique, "count" integer not null, "lastRequest" bigint not null);`,
+};

package/dist/migrations/0006_approvals.d.ts

@@ -0,0 +1,7 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Out-of-band approvals: an agent's request to publish / roll back / delete waits here until a
+ * person decides in Studio. Single use (`consumed`), bound to the tool, the exact arguments, the
+ * requesting actor and the site's content at request time (`state_hash`).
+ */
+export declare const migration0006Approvals: Migration;

package/dist/migrations/0006_approvals.js

@@ -0,0 +1,31 @@
+                                                   
+
+/**
+ * Out-of-band approvals: an agent's request to publish / roll back / delete waits here until a
+ * person decides in Studio. Single use (`consumed`), bound to the tool, the exact arguments, the
+ * requesting actor and the site's content at request time (`state_hash`).
+ */
+export const migration0006Approvals            = {
+  name: "0006_approvals",
+  sql: `
+CREATE TABLE approvals (
+  id TEXT PRIMARY KEY,
+  site_id TEXT,
+  tool TEXT NOT NULL,
+  args_hash TEXT NOT NULL,
+  input TEXT,
+  actor_kind TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  actor_name TEXT,
+  prompt TEXT NOT NULL,
+  state_hash TEXT NOT NULL,
+  status TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  decided_at TEXT,
+  decided_by TEXT,
+  consumed_at TEXT
+);
+CREATE INDEX approvals_site_status ON approvals (site_id, status, created_at);
+`,
+};

package/dist/migrations/0007_audit_mode.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../src/migrate.js";
+/** The agent mode a call ran under (ADR-0015), so the activity feed can show it. */
+export declare const migration0007AuditMode: Migration;

package/dist/migrations/0007_audit_mode.js

@@ -0,0 +1,7 @@
+                                                   
+
+/** The agent mode a call ran under (ADR-0015), so the activity feed can show it. */
+export const migration0007AuditMode            = {
+  name: "0007_audit_mode",
+  sql: `ALTER TABLE audit ADD COLUMN mode TEXT;`,
+};

package/dist/migrations/0008_policy_detail.d.ts

@@ -0,0 +1,7 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Policy detail as data (ADR-0015): approvals record the mode the agent worked in and why a person
+ * must decide; approvals and audit rows keep the `auto`-mode check behind a publish (JSON), so
+ * Studio no longer parses English reasons.
+ */
+export declare const migration0008PolicyDetail: Migration;

package/dist/migrations/0008_policy_detail.js

@@ -0,0 +1,17 @@
+                                                   
+
+/**
+ * Policy detail as data (ADR-0015): approvals record the mode the agent worked in and why a person
+ * must decide; approvals and audit rows keep the `auto`-mode check behind a publish (JSON), so
+ * Studio no longer parses English reasons.
+ */
+export const migration0008PolicyDetail            = {
+  name: "0008_policy_detail",
+  sql: `
+ALTER TABLE approvals ADD COLUMN mode TEXT;
+ALTER TABLE approvals ADD COLUMN cause TEXT;
+ALTER TABLE approvals ADD COLUMN auto_check TEXT;
+ALTER TABLE audit ADD COLUMN cause TEXT;
+ALTER TABLE audit ADD COLUMN auto_check TEXT;
+`,
+};

package/dist/migrations/0009_audit_elevation.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../src/migrate.js";
+/** Calls made under a time-boxed elevation (ADR-0016) record the key's own mode and the end (JSON). */
+export declare const migration0009AuditElevation: Migration;

package/dist/migrations/0009_audit_elevation.js

@@ -0,0 +1,7 @@
+                                                   
+
+/** Calls made under a time-boxed elevation (ADR-0016) record the key's own mode and the end (JSON). */
+export const migration0009AuditElevation            = {
+  name: "0009_audit_elevation",
+  sql: `ALTER TABLE audit ADD COLUMN elevation TEXT;`,
+};

package/dist/migrations/0010_approval_result.d.ts

@@ -0,0 +1,6 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * What the server did when it carried an approved request out itself (JSON), e.g. the elevation it
+ * granted for an agent's `request_elevation` — possibly shorter than asked (ADR-0016).
+ */
+export declare const migration0010ApprovalResult: Migration;

package/dist/migrations/0010_approval_result.js

@@ -0,0 +1,10 @@
+                                                   
+
+/**
+ * What the server did when it carried an approved request out itself (JSON), e.g. the elevation it
+ * granted for an agent's `request_elevation` — possibly shorter than asked (ADR-0016).
+ */
+export const migration0010ApprovalResult            = {
+  name: "0010_approval_result",
+  sql: `ALTER TABLE approvals ADD COLUMN result TEXT;`,
+};

package/dist/migrations/0011_op_guards.d.ts

@@ -0,0 +1,17 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Assertion rows for multi-node operations (RFC-0002 §4.3). D1 has no interactive transactions and
+ * a CAS `UPDATE` that matches no row is not an error, so a governance batch (rename, merge, retire,
+ * move, review) ends with `INSERT INTO op_guards … SELECT …, CASE WHEN <every node reached its
+ * expected hash> THEN 1 END`. A miss leaves `ok` NULL, the NOT NULL constraint fails, and the whole
+ * batch rolls back. `(op_id, seq)` makes a replayed operation fail instead of applying twice.
+ * Rows older than 30 days are swept by the store.
+ *
+ * RFC-0002 also adds node kinds without a storage change (`kind` is free text). Their uniqueness
+ * keys in `nodes.key`:
+ *   taxonomy → "<key>"
+ *   term     → "<taxonomyId>:<slug>" ("<taxonomyId>:~<id>" once retired; the slug stays reserved
+ *              by the store's guards until a person reclaims it)
+ *   redirect → "<from>"
+ */
+export declare const migration0011OpGuards: Migration;

package/dist/migrations/0011_op_guards.js

@@ -0,0 +1,30 @@
+                                                   
+
+/**
+ * Assertion rows for multi-node operations (RFC-0002 §4.3). D1 has no interactive transactions and
+ * a CAS `UPDATE` that matches no row is not an error, so a governance batch (rename, merge, retire,
+ * move, review) ends with `INSERT INTO op_guards … SELECT …, CASE WHEN <every node reached its
+ * expected hash> THEN 1 END`. A miss leaves `ok` NULL, the NOT NULL constraint fails, and the whole
+ * batch rolls back. `(op_id, seq)` makes a replayed operation fail instead of applying twice.
+ * Rows older than 30 days are swept by the store.
+ *
+ * RFC-0002 also adds node kinds without a storage change (`kind` is free text). Their uniqueness
+ * keys in `nodes.key`:
+ *   taxonomy → "<key>"
+ *   term     → "<taxonomyId>:<slug>" ("<taxonomyId>:~<id>" once retired; the slug stays reserved
+ *              by the store's guards until a person reclaims it)
+ *   redirect → "<from>"
+ */
+export const migration0011OpGuards            = {
+  name: "0011_op_guards",
+  sql: `
+CREATE TABLE op_guards (
+  op_id TEXT NOT NULL,
+  seq INTEGER NOT NULL,
+  ok INTEGER NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (op_id, seq)
+);
+CREATE INDEX op_guards_created ON op_guards (created_at);
+`,
+};

package/dist/migrations/0012_roles.d.ts

@@ -0,0 +1,23 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Staff roles and invites (RFC-0005 §11, ADR-0018). Additive.
+ *
+ * 1. `invitation` columns, declared to Better Auth as the organization plugin's invitation
+ *    `additionalFields` (`packages/api/src/auth.ts`); the types are what Better Auth 1.7.7 emits for
+ *    them (`string` → text, `date` → date). The token hash is unique (only `SHA-256(token)` is
+ *    stored; RFC-0005 §7.1).
+ * 2. The deployment organization (`id` and `slug` `deployment`, named after the first site), unless
+ *    it exists.
+ * 3. A `member` row for every existing user: the earliest (`createdAt`, then `id`) becomes `owner`,
+ *    any others `administrator` (the closest role to their former `*` that keeps exactly one Owner).
+ *    Two unique indexes then hold the invariants in the database itself: one membership per user
+ *    and organization, and at most one Owner (I2).
+ * 4. `agent_owner`: which person an agent actor belongs to (the creator of the key it used), kept
+ *    after the key is deleted so ownership of agent-written entries survives (RFC-0005 §4; the
+ *    server-side form of the optional `Actor.onBehalfOf`, §8). Back-filled from `apikey`.
+ * 5. `password_reset`: administrator-issued one-time reset links (open question 6), stored like
+ *    invite tokens (hash only).
+ *
+ * Keys are not changed: their effective scopes are computed per call (§5.1).
+ */
+export declare const migration0012Roles: Migration;