@cloudhal/storage 0.0.0-stage → 0.1.1

package/dist/migrations/0012_roles.js

@@ -0,0 +1,78 @@
+                                                   
+
+/**
+ * Staff roles and invites (RFC-0005 §11, ADR-0018). Additive.
+ *
+ * 1. `invitation` columns, declared to Better Auth as the organization plugin's invitation
+ *    `additionalFields` (`packages/api/src/auth.ts`); the types are what Better Auth 1.7.7 emits for
+ *    them (`string` → text, `date` → date). The token hash is unique (only `SHA-256(token)` is
+ *    stored; RFC-0005 §7.1).
+ * 2. The deployment organization (`id` and `slug` `deployment`, named after the first site), unless
+ *    it exists.
+ * 3. A `member` row for every existing user: the earliest (`createdAt`, then `id`) becomes `owner`,
+ *    any others `administrator` (the closest role to their former `*` that keeps exactly one Owner).
+ *    Two unique indexes then hold the invariants in the database itself: one membership per user
+ *    and organization, and at most one Owner (I2).
+ * 4. `agent_owner`: which person an agent actor belongs to (the creator of the key it used), kept
+ *    after the key is deleted so ownership of agent-written entries survives (RFC-0005 §4; the
+ *    server-side form of the optional `Actor.onBehalfOf`, §8). Back-filled from `apikey`.
+ * 5. `password_reset`: administrator-issued one-time reset links (open question 6), stored like
+ *    invite tokens (hash only).
+ *
+ * Keys are not changed: their effective scopes are computed per call (§5.1).
+ */
+export const migration0012Roles            = {
+  name: "0012_roles",
+  sql: `
+ALTER TABLE "invitation" ADD COLUMN "tokenHash" text;
+ALTER TABLE "invitation" ADD COLUMN "delivery" text;
+ALTER TABLE "invitation" ADD COLUMN "acceptedUserId" text;
+ALTER TABLE "invitation" ADD COLUMN "acceptedAt" date;
+ALTER TABLE "invitation" ADD COLUMN "canceledBy" text;
+ALTER TABLE "invitation" ADD COLUMN "canceledAt" date;
+CREATE UNIQUE INDEX "invitation_tokenHash_uidx" ON "invitation" ("tokenHash");
+CREATE INDEX "invitation_status_idx" ON "invitation" ("organizationId", "status");
+INSERT INTO "organization" ("id", "name", "slug", "createdAt")
+  SELECT 'deployment',
+         COALESCE((SELECT json_extract(body, '$.name') FROM nodes WHERE kind = 'site' ORDER BY created_at, id LIMIT 1), 'Cloudhal'),
+         'deployment',
+         strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  WHERE NOT EXISTS (SELECT 1 FROM "organization" WHERE "id" = 'deployment');
+INSERT INTO "member" ("id", "organizationId", "userId", "role", "createdAt")
+  SELECT 'mem_' || u."id",
+         'deployment',
+         u."id",
+         CASE
+           WHEN u."id" = (SELECT "id" FROM "user" ORDER BY "createdAt", "id" LIMIT 1)
+             AND NOT EXISTS (SELECT 1 FROM "member" WHERE "organizationId" = 'deployment' AND "role" = 'owner')
+           THEN 'owner'
+           ELSE 'administrator'
+         END,
+         strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  FROM "user" u
+  WHERE NOT EXISTS (SELECT 1 FROM "member" m WHERE m."userId" = u."id" AND m."organizationId" = 'deployment');
+CREATE UNIQUE INDEX "member_org_user_uidx" ON "member" ("organizationId", "userId");
+CREATE UNIQUE INDEX "member_one_owner_uidx" ON "member" ("organizationId") WHERE "role" = 'owner';
+CREATE TABLE agent_owner (
+  agent_id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL,
+  key_id TEXT,
+  created_at TEXT NOT NULL
+);
+CREATE INDEX agent_owner_user ON agent_owner (user_id);
+INSERT INTO agent_owner (agent_id, user_id, key_id, created_at)
+  SELECT 'agent_' || substr("id", 1, 32), "referenceId", "id", strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  FROM "apikey"
+  WHERE length("id") >= 6 AND "id" NOT GLOB '*[^A-Za-z0-9]*';
+CREATE TABLE password_reset (
+  id TEXT PRIMARY KEY,
+  token_hash TEXT NOT NULL UNIQUE,
+  user_id TEXT NOT NULL,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  used_at TEXT
+);
+CREATE INDEX password_reset_user ON password_reset (user_id);
+`,
+};

package/dist/migrations/0013_media.d.ts

@@ -0,0 +1,16 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Assets and the media library (RFC-0004 §4.2). Asset nodes need no change of their own (`nodes.kind`
+ * is free text; their uniqueness key is the SHA-256). These tables hold what is not a node:
+ *
+ * - media_blobs: the ledger of content-addressed bytes per site (`media/<siteId>/<sha256>` in the
+ *   blob store). `state` is `stored`, `deleting` (garbage collection in progress) or `purged`
+ *   (takedown: the bytes are gone from every snapshot). An upload in flight holds `lease_until`,
+ *   which keeps garbage collection away (§4.5).
+ * - snapshot_blobs: which content each snapshot references, so bytes a snapshot needs are never
+ *   collected.
+ * - asset_refs: derived index of the live references (ImageRef.assetId and markdown `asset:<id>`)
+ *   of the current pages, entries and terms; rewritten in the same batch as each node write.
+ * - media_uploads: single-use upload tickets for the REST stream (§5.5).
+ */
+export declare const migration0013Media: Migration;

package/dist/migrations/0013_media.js

@@ -0,0 +1,69 @@
+                                                   
+
+/**
+ * Assets and the media library (RFC-0004 §4.2). Asset nodes need no change of their own (`nodes.kind`
+ * is free text; their uniqueness key is the SHA-256). These tables hold what is not a node:
+ *
+ * - media_blobs: the ledger of content-addressed bytes per site (`media/<siteId>/<sha256>` in the
+ *   blob store). `state` is `stored`, `deleting` (garbage collection in progress) or `purged`
+ *   (takedown: the bytes are gone from every snapshot). An upload in flight holds `lease_until`,
+ *   which keeps garbage collection away (§4.5).
+ * - snapshot_blobs: which content each snapshot references, so bytes a snapshot needs are never
+ *   collected.
+ * - asset_refs: derived index of the live references (ImageRef.assetId and markdown `asset:<id>`)
+ *   of the current pages, entries and terms; rewritten in the same batch as each node write.
+ * - media_uploads: single-use upload tickets for the REST stream (§5.5).
+ */
+export const migration0013Media            = {
+  name: "0013_media",
+  sql: `
+CREATE TABLE media_blobs (
+  site_id TEXT NOT NULL,
+  sha256 TEXT NOT NULL,
+  bytes INTEGER NOT NULL,
+  media_type TEXT NOT NULL,
+  original_sha256 TEXT,
+  state TEXT NOT NULL,
+  lease_until TEXT,
+  purge_reason TEXT,
+  purge_legal INTEGER,
+  purged_by TEXT,
+  purged_at TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (site_id, sha256)
+);
+CREATE INDEX media_blobs_original ON media_blobs (site_id, original_sha256);
+CREATE INDEX media_blobs_state ON media_blobs (site_id, state, created_at);
+CREATE TABLE snapshot_blobs (
+  snapshot_id TEXT NOT NULL,
+  site_id TEXT NOT NULL,
+  sha256 TEXT NOT NULL,
+  PRIMARY KEY (snapshot_id, sha256)
+);
+CREATE INDEX snapshot_blobs_site_sha ON snapshot_blobs (site_id, sha256);
+CREATE TABLE asset_refs (
+  site_id TEXT NOT NULL,
+  asset_id TEXT NOT NULL,
+  node_id TEXT NOT NULL,
+  node_kind TEXT NOT NULL,
+  field TEXT NOT NULL,
+  PRIMARY KEY (node_id, asset_id, field)
+);
+CREATE INDEX asset_refs_asset ON asset_refs (site_id, asset_id);
+CREATE TABLE media_uploads (
+  id TEXT PRIMARY KEY,
+  site_id TEXT NOT NULL,
+  actor_kind TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  sha256 TEXT,
+  bytes INTEGER NOT NULL,
+  media_type TEXT NOT NULL,
+  options TEXT NOT NULL,
+  state TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+CREATE INDEX media_uploads_actor ON media_uploads (site_id, actor_id, state);
+`,
+};

package/dist/migrations/0014_analytics.d.ts

@@ -0,0 +1,19 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Site analytics (RFC-0006 §7.4). Additive; `@cloudhal/analytics` owns the accessors.
+ *
+ * - analytics_settings: per-site overrides of the deployment defaults, outside the site graph (a
+ *   content rollback never changes a privacy setting). CAS on `rev`. A missing row = the default.
+ * - analytics_salts: one random salt per UTC day for the deployment (unique-visitors mode only);
+ *   rows older than today are deleted hourly.
+ * - analytics_daily: daily rollups (UTC days). `dim` ∈ total | node | refHost | channel | utmSource
+ *   | utmMedium | utmCampaign | country | device | browser | os | status | redirect | crawler |
+ *   vitals.<metric>; key '(other)' holds what fell outside the top N, so totals add up. `good` and
+ *   `poor` (vitals: weighted samples per rating) extend the RFC's table so Studio can show the share
+ *   of good samples from rollups.
+ * - analytics_rollup_runs: which site-days are rolled up, written last, so the job is idempotent.
+ * - analytics_query_budget: uncached live (WAE) queries per UTC day (§7.7).
+ * - analytics_events: raw events for the SQLite store (local and Node self-host). Created everywhere
+ *   because migrations are one ledger; never written on Cloudflare.
+ */
+export declare const migration0014Analytics: Migration;

package/dist/migrations/0014_analytics.js

@@ -0,0 +1,105 @@
+                                                   
+
+/**
+ * Site analytics (RFC-0006 §7.4). Additive; `@cloudhal/analytics` owns the accessors.
+ *
+ * - analytics_settings: per-site overrides of the deployment defaults, outside the site graph (a
+ *   content rollback never changes a privacy setting). CAS on `rev`. A missing row = the default.
+ * - analytics_salts: one random salt per UTC day for the deployment (unique-visitors mode only);
+ *   rows older than today are deleted hourly.
+ * - analytics_daily: daily rollups (UTC days). `dim` ∈ total | node | refHost | channel | utmSource
+ *   | utmMedium | utmCampaign | country | device | browser | os | status | redirect | crawler |
+ *   vitals.<metric>; key '(other)' holds what fell outside the top N, so totals add up. `good` and
+ *   `poor` (vitals: weighted samples per rating) extend the RFC's table so Studio can show the share
+ *   of good samples from rollups.
+ * - analytics_rollup_runs: which site-days are rolled up, written last, so the job is idempotent.
+ * - analytics_query_budget: uncached live (WAE) queries per UTC day (§7.7).
+ * - analytics_events: raw events for the SQLite store (local and Node self-host). Created everywhere
+ *   because migrations are one ledger; never written on Cloudflare.
+ */
+export const migration0014Analytics            = {
+  name: "0014_analytics",
+  sql: `
+CREATE TABLE analytics_settings (
+  site_id TEXT PRIMARY KEY,
+  enabled INTEGER NOT NULL,
+  unique_visitors INTEGER NOT NULL,
+  vitals_one_in INTEGER NOT NULL,
+  rollup_retention_days INTEGER,
+  plan_hint TEXT,
+  rev INTEGER NOT NULL,
+  updated_at TEXT NOT NULL,
+  updated_by TEXT NOT NULL
+);
+CREATE TABLE analytics_salts (
+  day TEXT PRIMARY KEY,
+  salt TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+CREATE TABLE analytics_daily (
+  site_id TEXT NOT NULL,
+  day TEXT NOT NULL,
+  dim TEXT NOT NULL,
+  key TEXT NOT NULL,
+  pageviews INTEGER NOT NULL DEFAULT 0,
+  visits INTEGER NOT NULL DEFAULT 0,
+  visitors INTEGER,
+  hits INTEGER,
+  value REAL,
+  samples INTEGER,
+  good INTEGER,
+  poor INTEGER,
+  PRIMARY KEY (site_id, day, dim, key)
+);
+CREATE INDEX analytics_daily_key ON analytics_daily (site_id, dim, key, day);
+CREATE TABLE analytics_rollup_runs (
+  site_id TEXT NOT NULL,
+  day TEXT NOT NULL,
+  state TEXT NOT NULL,
+  rows INTEGER,
+  source TEXT NOT NULL,
+  error TEXT,
+  finished_at TEXT,
+  PRIMARY KEY (site_id, day)
+);
+CREATE TABLE analytics_query_budget (
+  day TEXT PRIMARY KEY,
+  queries INTEGER NOT NULL
+);
+CREATE TABLE analytics_events (
+  id INTEGER PRIMARY KEY,
+  site_id TEXT NOT NULL,
+  ts TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  path TEXT NOT NULL,
+  node_id TEXT,
+  node_kind TEXT,
+  ref_host TEXT,
+  ref_path TEXT,
+  channel TEXT,
+  utm_source TEXT,
+  utm_medium TEXT,
+  utm_campaign TEXT,
+  country TEXT,
+  device TEXT NOT NULL,
+  browser TEXT,
+  os TEXT,
+  visitor TEXT,
+  nav_type TEXT,
+  locale TEXT,
+  crawler TEXT,
+  redirect_to TEXT,
+  status INTEGER,
+  entrance INTEGER,
+  lcp INTEGER,
+  inp INTEGER,
+  cls REAL,
+  ttfb INTEGER,
+  fcp INTEGER,
+  render_ms INTEGER,
+  sample_one_in INTEGER NOT NULL DEFAULT 1
+);
+CREATE INDEX analytics_events_time ON analytics_events (site_id, kind, ts);
+CREATE INDEX analytics_events_node ON analytics_events (site_id, node_id, ts);
+`,
+};

package/dist/migrations/0015_analytics_privacy_signal.d.ts

@@ -0,0 +1,8 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * The privacy signal of a page view (RFC-0006 §6.2, `AnalyticsPageviewEvent.privacySignal`): 1 when
+ * the beacon request carried GPC or DNT, so Studio can say how many page views were counted without
+ * a visitor hash. Additive: older rows read as NULL (no signal recorded). Only `analytics_events`
+ * (the SQLite store) needs a column; daily rollups keep the count in a `signals` row.
+ */
+export declare const migration0015AnalyticsPrivacySignal: Migration;

package/dist/migrations/0015_analytics_privacy_signal.js

@@ -0,0 +1,14 @@
+                                                   
+
+/**
+ * The privacy signal of a page view (RFC-0006 §6.2, `AnalyticsPageviewEvent.privacySignal`): 1 when
+ * the beacon request carried GPC or DNT, so Studio can say how many page views were counted without
+ * a visitor hash. Additive: older rows read as NULL (no signal recorded). Only `analytics_events`
+ * (the SQLite store) needs a column; daily rollups keep the count in a `signals` row.
+ */
+export const migration0015AnalyticsPrivacySignal            = {
+  name: "0015_analytics_privacy_signal",
+  sql: `
+ALTER TABLE analytics_events ADD COLUMN privacy_signal INTEGER;
+`,
+};

package/dist/migrations/0016_comments.d.ts

@@ -0,0 +1,27 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Reader comments (RFC-0007 §4.1). Additive; `@cloudhal/comments` owns the accessors. Comments
+ * live outside the site graph: snapshots, diffs, rollbacks and bundles never read these tables.
+ *
+ * - comment_settings: per-site settings (a missing row = off), collections inside as JSON. CAS on `rev`.
+ * - comment_secrets: owner-supplied keys (the Turnstile secret), AES-GCM under a key derived from
+ *   CLOUDHAL_COMMENTS_KEY; write-only through the API.
+ * - comment_threads: per-entry overrides (a missing row = default). CAS on `rev`.
+ * - comments: one row per comment, keyed by entry id. `body` is plain text (NULL once deleted);
+ *   `email_id`, `ip_hmac` and `challenge_id` never leave the store (they are not in the contract).
+ *   `hash` is the SHA-256 of the canonical Comment record; `op` the last bulk operation, which
+ *   guards the statements that follow it in the same batch. No counter columns: counts are
+ *   indexed COUNTs on read.
+ * - commenter_emails: the only place an address lives (encrypted, plus a keyed hash for lookups).
+ * - comment_events: moderation history and statements of reasons (no text, no email).
+ * - comment_reports: notices (DSA Art. 16); a report never changes a comment by itself.
+ * - comment_bans: keyed hashes, never addresses.
+ * - comment_salts: one random salt per UTC month for IP HMACs; deleted when two months old.
+ * - comment_purge_queue: cache tags waiting for a coalesced purge.
+ * - cache_purge_log: purge requests sent by this deployment (publish and comments), for the
+ *   shared Free-tier purge budget.
+ *
+ * Beyond the RFC's listing: `comments_parent` (replies and tombstone checks) and
+ * `comment_reports_comment` (a comment's reports) indexes, both partial or small.
+ */
+export declare const migration0016Comments: Migration;

package/dist/migrations/0016_comments.js

@@ -0,0 +1,173 @@
+                                                   
+
+/**
+ * Reader comments (RFC-0007 §4.1). Additive; `@cloudhal/comments` owns the accessors. Comments
+ * live outside the site graph: snapshots, diffs, rollbacks and bundles never read these tables.
+ *
+ * - comment_settings: per-site settings (a missing row = off), collections inside as JSON. CAS on `rev`.
+ * - comment_secrets: owner-supplied keys (the Turnstile secret), AES-GCM under a key derived from
+ *   CLOUDHAL_COMMENTS_KEY; write-only through the API.
+ * - comment_threads: per-entry overrides (a missing row = default). CAS on `rev`.
+ * - comments: one row per comment, keyed by entry id. `body` is plain text (NULL once deleted);
+ *   `email_id`, `ip_hmac` and `challenge_id` never leave the store (they are not in the contract).
+ *   `hash` is the SHA-256 of the canonical Comment record; `op` the last bulk operation, which
+ *   guards the statements that follow it in the same batch. No counter columns: counts are
+ *   indexed COUNTs on read.
+ * - commenter_emails: the only place an address lives (encrypted, plus a keyed hash for lookups).
+ * - comment_events: moderation history and statements of reasons (no text, no email).
+ * - comment_reports: notices (DSA Art. 16); a report never changes a comment by itself.
+ * - comment_bans: keyed hashes, never addresses.
+ * - comment_salts: one random salt per UTC month for IP HMACs; deleted when two months old.
+ * - comment_purge_queue: cache tags waiting for a coalesced purge.
+ * - cache_purge_log: purge requests sent by this deployment (publish and comments), for the
+ *   shared Free-tier purge budget.
+ *
+ * Beyond the RFC's listing: `comments_parent` (replies and tombstone checks) and
+ * `comment_reports_comment` (a comment's reports) indexes, both partial or small.
+ */
+export const migration0016Comments            = {
+  name: "0016_comments",
+  sql: `
+CREATE TABLE comment_settings (
+  site_id TEXT PRIMARY KEY,
+  enabled INTEGER NOT NULL,
+  show_when_off INTEGER NOT NULL,
+  collections TEXT NOT NULL,
+  close_after_days INTEGER,
+  protection TEXT NOT NULL,
+  turnstile_site_key TEXT,
+  allow_without_script INTEGER NOT NULL,
+  link_limit INTEGER NOT NULL,
+  watch_words TEXT NOT NULL,
+  blocked_words TEXT NOT NULL,
+  daily_cap INTEGER NOT NULL,
+  ai_labels TEXT NOT NULL,
+  retention TEXT NOT NULL,
+  plan_hint TEXT,
+  rev INTEGER NOT NULL,
+  updated_at TEXT NOT NULL,
+  updated_by TEXT NOT NULL
+);
+CREATE TABLE comment_secrets (
+  site_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  ciphertext TEXT NOT NULL,
+  iv TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  updated_by TEXT NOT NULL,
+  PRIMARY KEY (site_id, name)
+);
+CREATE TABLE comment_threads (
+  site_id TEXT NOT NULL,
+  node_id TEXT NOT NULL,
+  mode TEXT NOT NULL,
+  closes_at TEXT,
+  rev INTEGER NOT NULL,
+  updated_at TEXT NOT NULL,
+  updated_by TEXT NOT NULL,
+  PRIMARY KEY (site_id, node_id)
+);
+CREATE TABLE comments (
+  id TEXT PRIMARY KEY,
+  site_id TEXT NOT NULL,
+  node_id TEXT NOT NULL,
+  parent_id TEXT,
+  in_reply_to_id TEXT,
+  source TEXT NOT NULL,
+  origin TEXT,
+  author TEXT NOT NULL,
+  body TEXT,
+  status TEXT NOT NULL,
+  labels TEXT NOT NULL,
+  moderation TEXT,
+  email_id TEXT,
+  ip_hmac TEXT,
+  challenge_id TEXT,
+  proof TEXT NOT NULL,
+  op TEXT,
+  hash TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  edited_at TEXT,
+  rev INTEGER NOT NULL
+);
+CREATE INDEX comments_node ON comments (site_id, node_id, status, created_at);
+CREATE INDEX comments_queue ON comments (site_id, status, created_at);
+CREATE INDEX comments_client ON comments (site_id, ip_hmac, created_at) WHERE ip_hmac IS NOT NULL;
+CREATE UNIQUE INDEX comments_challenge ON comments (challenge_id) WHERE challenge_id IS NOT NULL;
+CREATE INDEX comments_email ON comments (email_id) WHERE email_id IS NOT NULL;
+CREATE INDEX comments_parent ON comments (parent_id) WHERE parent_id IS NOT NULL;
+CREATE TABLE commenter_emails (
+  id TEXT PRIMARY KEY,
+  site_id TEXT NOT NULL,
+  email_hmac TEXT NOT NULL,
+  email_ciphertext TEXT NOT NULL,
+  email_iv TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (site_id, email_hmac)
+);
+CREATE TABLE comment_events (
+  id TEXT PRIMARY KEY,
+  site_id TEXT NOT NULL,
+  comment_id TEXT NOT NULL,
+  action TEXT NOT NULL,
+  actor TEXT NOT NULL,
+  reason_code TEXT,
+  note TEXT,
+  automated INTEGER NOT NULL,
+  approval_id TEXT,
+  op TEXT,
+  at TEXT NOT NULL
+);
+CREATE INDEX comment_events_comment ON comment_events (comment_id, at);
+CREATE TABLE comment_reports (
+  id TEXT PRIMARY KEY,
+  site_id TEXT NOT NULL,
+  comment_id TEXT NOT NULL,
+  reason TEXT NOT NULL,
+  details TEXT,
+  email_id TEXT,
+  ip_hmac TEXT,
+  challenge_id TEXT,
+  created_at TEXT NOT NULL,
+  resolved_at TEXT,
+  resolved_by TEXT,
+  resolution TEXT
+);
+CREATE INDEX comment_reports_open ON comment_reports (site_id, resolved_at, created_at);
+CREATE UNIQUE INDEX comment_reports_challenge ON comment_reports (challenge_id) WHERE challenge_id IS NOT NULL;
+CREATE INDEX comment_reports_comment ON comment_reports (comment_id);
+CREATE TABLE comment_bans (
+  id TEXT PRIMARY KEY,
+  site_id TEXT NOT NULL,
+  subject TEXT NOT NULL,
+  value TEXT NOT NULL,
+  until TEXT,
+  reason_code TEXT NOT NULL,
+  note TEXT,
+  by_actor TEXT NOT NULL,
+  at TEXT NOT NULL,
+  UNIQUE (site_id, subject, value)
+);
+CREATE TABLE comment_salts (
+  month TEXT PRIMARY KEY,
+  salt TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+CREATE TABLE comment_purge_queue (
+  site_id TEXT NOT NULL,
+  tag TEXT NOT NULL,
+  priority TEXT NOT NULL,
+  enqueued_at TEXT NOT NULL,
+  attempts INTEGER NOT NULL,
+  next_at TEXT NOT NULL,
+  PRIMARY KEY (site_id, tag)
+);
+CREATE TABLE cache_purge_log (
+  id INTEGER PRIMARY KEY,
+  at TEXT NOT NULL,
+  source TEXT NOT NULL,
+  requests INTEGER NOT NULL
+);
+CREATE INDEX cache_purge_log_at ON cache_purge_log (at);
+`,
+};

package/dist/migrations/0017_schedules.d.ts

@@ -0,0 +1,21 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Schedules (RFC-0008 §5.1). Additive: new tables, nullable columns on `audit` and `approvals`;
+ * `@cloudhal/schedules` owns the accessors (`SqlScheduleStore`). Releases, automations and runs
+ * live outside the site graph: snapshots, diffs, rollbacks and bundles never read these tables.
+ *
+ * - releases / release_items: a release and its pinned items. The tick looks only at
+ *   `releases_due`; `release_items.held` mirrors "the release is awaiting_approval, scheduled or
+ *   running" and drives locks and holds (`release_items_held`).
+ * - automations: recurring jobs and their per-automation key (`automations_key`, unique).
+ * - schedule_runs: one row per occurrence, keyed by a deterministic id (the idempotency key of
+ *   every scheduled effect); `schedule_runs_open` finds windows and leases to close.
+ * - system_jobs: watermarks of the deployment's periodic jobs (analytics rollup, comments, …).
+ * - scheduler_heartbeat: one row — is the scheduler alive, when does it expect to wake next.
+ * - schedule_settings: per-site kill switch and daily automation write cap, outside the graph so
+ *   a rollback cannot un-pause a site. A missing row means the defaults.
+ * - audit and approvals gain the run, release and automation they belong to.
+ *
+ * No counter columns: budget usage and daily caps are indexed COUNTs over audit rows.
+ */
+export declare const migration0017Schedules: Migration;

package/dist/migrations/0017_schedules.js

@@ -0,0 +1,108 @@
+                                                   
+
+/**
+ * Schedules (RFC-0008 §5.1). Additive: new tables, nullable columns on `audit` and `approvals`;
+ * `@cloudhal/schedules` owns the accessors (`SqlScheduleStore`). Releases, automations and runs
+ * live outside the site graph: snapshots, diffs, rollbacks and bundles never read these tables.
+ *
+ * - releases / release_items: a release and its pinned items. The tick looks only at
+ *   `releases_due`; `release_items.held` mirrors "the release is awaiting_approval, scheduled or
+ *   running" and drives locks and holds (`release_items_held`).
+ * - automations: recurring jobs and their per-automation key (`automations_key`, unique).
+ * - schedule_runs: one row per occurrence, keyed by a deterministic id (the idempotency key of
+ *   every scheduled effect); `schedule_runs_open` finds windows and leases to close.
+ * - system_jobs: watermarks of the deployment's periodic jobs (analytics rollup, comments, …).
+ * - scheduler_heartbeat: one row — is the scheduler alive, when does it expect to wake next.
+ * - schedule_settings: per-site kill switch and daily automation write cap, outside the graph so
+ *   a rollback cannot un-pause a site. A missing row means the defaults.
+ * - audit and approvals gain the run, release and automation they belong to.
+ *
+ * No counter columns: budget usage and daily caps are indexed COUNTs over audit rows.
+ */
+export const migration0017Schedules            = {
+  name: "0017_schedules",
+  sql: `
+CREATE TABLE releases (
+  id TEXT PRIMARY KEY, site_id TEXT NOT NULL, title TEXT,
+  state TEXT NOT NULL,
+  hash TEXT NOT NULL,
+  when_kind TEXT,
+  execute_at TEXT,
+  time_zone TEXT, local_time TEXT,
+  approval TEXT,
+  request_id TEXT,
+  outcome TEXT,
+  purge_plan TEXT,
+  lease_token TEXT, lease_until TEXT,
+  created_by TEXT NOT NULL,
+  metadata TEXT, rev INTEGER NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+);
+CREATE INDEX releases_due ON releases (execute_at) WHERE state = 'scheduled';
+CREATE INDEX releases_site ON releases (site_id, state, execute_at);
+CREATE TABLE release_items (
+  release_id TEXT NOT NULL, site_id TEXT NOT NULL, node_id TEXT NOT NULL,
+  op TEXT NOT NULL,
+  node_kind TEXT NOT NULL,
+  target_rev INTEGER, target_hash TEXT,
+  base_rev INTEGER, base_hash TEXT,
+  deps TEXT NOT NULL,
+  blob_sha TEXT,
+  held INTEGER NOT NULL,
+  PRIMARY KEY (release_id, node_id)
+);
+CREATE INDEX release_items_held ON release_items (site_id, node_id) WHERE held = 1;
+CREATE TABLE automations (
+  id TEXT PRIMARY KEY, site_id TEXT NOT NULL, name TEXT NOT NULL,
+  job TEXT NOT NULL,
+  key_id TEXT,
+  start_local TEXT NOT NULL, time_zone TEXT NOT NULL, rule TEXT, preset TEXT NOT NULL,
+  state TEXT NOT NULL, paused_reason TEXT, consecutive_failures INTEGER NOT NULL,
+  owner_id TEXT NOT NULL, owner_name TEXT,
+  next_run_at TEXT,
+  cursor TEXT,
+  lease_token TEXT, lease_until TEXT,
+  metadata TEXT, rev INTEGER NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+);
+CREATE INDEX automations_due ON automations (next_run_at) WHERE state = 'active';
+CREATE INDEX automations_site ON automations (site_id, state);
+CREATE UNIQUE INDEX automations_key ON automations (key_id) WHERE key_id IS NOT NULL;
+CREATE TABLE schedule_runs (
+  id TEXT PRIMARY KEY,
+  site_id TEXT NOT NULL, subject_kind TEXT NOT NULL, subject_id TEXT NOT NULL,
+  occurrence_at TEXT NOT NULL,
+  state TEXT NOT NULL, outcome TEXT, trigger TEXT, attempt INTEGER NOT NULL,
+  lease_token TEXT, lease_until TEXT,
+  window_opens TEXT, window_closes TEXT,
+  started_at TEXT, ended_at TEXT, lateness_s INTEGER, adjusted TEXT,
+  usage TEXT, taint TEXT, summary TEXT, counts TEXT, findings TEXT, approval_ids TEXT, error TEXT,
+  rev INTEGER NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+  UNIQUE (subject_id, occurrence_at)
+);
+CREATE INDEX schedule_runs_site ON schedule_runs (site_id, created_at);
+CREATE INDEX schedule_runs_open ON schedule_runs (window_closes) WHERE state IN ('ready', 'running');
+CREATE TABLE system_jobs (
+  name TEXT PRIMARY KEY,
+  next_run_at TEXT NOT NULL, last_run_at TEXT, last_ok_at TEXT,
+  lease_token TEXT, lease_until TEXT, last_error TEXT
+);
+CREATE TABLE scheduler_heartbeat (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  at TEXT NOT NULL, trigger TEXT NOT NULL, next_wake_at TEXT NOT NULL,
+  ran INTEGER NOT NULL, more INTEGER NOT NULL, lag_s INTEGER
+);
+CREATE TABLE schedule_settings (
+  site_id TEXT PRIMARY KEY,
+  paused INTEGER NOT NULL,
+  paused_by TEXT, paused_at TEXT, paused_reason TEXT,
+  daily_write_cap INTEGER NOT NULL,
+  rev INTEGER NOT NULL, updated_at TEXT NOT NULL, updated_by TEXT NOT NULL
+);
+ALTER TABLE audit ADD COLUMN run_id TEXT;
+ALTER TABLE audit ADD COLUMN release_id TEXT;
+ALTER TABLE audit ADD COLUMN automation_id TEXT;
+CREATE INDEX audit_run ON audit (run_id, at) WHERE run_id IS NOT NULL;
+CREATE INDEX audit_automation_day ON audit (automation_id, at) WHERE automation_id IS NOT NULL;
+ALTER TABLE approvals ADD COLUMN release_id TEXT;
+ALTER TABLE approvals ADD COLUMN run_id TEXT;
+`,
+};

package/dist/migrations/0018_query_indexes.d.ts

@@ -0,0 +1,12 @@
+import type { Migration } from "../src/migrate.js";
+/**
+ * Indexes for queries that scanned `nodes` or `media_uploads` (D1 bills rows read):
+ * - `nodes_sites`: `listSites()` (`WHERE kind = 'site' ORDER BY created_at, id`), which Studio's
+ *   notification poll runs, scanned every node of every site;
+ * - `nodes_site_kind_created`: per-site lists by kind in creation order (pages, media library)
+ *   sorted in a temporary B-tree. It covers `(site_id, kind)`, so `nodes_site_kind` goes;
+ * - `nodes_assets_created`: a key's daily upload limit (`created_at >= ?` over assets);
+ * - `media_uploads_expires`: removing expired upload tickets.
+ * Index-only: no table or row changes.
+ */
+export declare const migration0018QueryIndexes: Migration;