@flowdular/sdk 0.2.3 → 0.3.0

package/modules/documents/src/services/repository.ts

@@ -0,0 +1,48 @@
+import type { DocumentFilters, DocumentsFile } from '../domain/types.ts';
+
+/** The row order an export walks: creation time, then id to break a tie. */
+export interface DocumentPageCursor {
+	readonly createdAt: number;
+	readonly id: string;
+}
+
+/**
+ * The async, database-agnostic port. Every read is bounded by a limit the
+ * caller states, and every method carries the tenant id the transaction binds.
+ */
+export interface DocumentsRepository {
+	/**
+	 * Newest first: what the workspace still holds, plus its infected refusals.
+	 * `after` is the keyset of the last row the caller saw, so a screen pages
+	 * without an offset over rows another upload can move.
+	 */
+	list(
+		tenantId: string,
+		filters: DocumentFilters,
+		limit: number,
+		after?: DocumentPageCursor | null,
+	): Promise<readonly DocumentsFile[]>;
+	/**
+	 * Every row of one workspace, oldest first, paged by the keyset of the last
+	 * row a caller saw. Unlike `list` it hides nothing: an export of what the
+	 * workspace holds includes the deleted rows that are its trail.
+	 */
+	listForExport(
+		tenantId: string,
+		after: DocumentPageCursor | null,
+		limit: number,
+	): Promise<readonly DocumentsFile[]>;
+	find(tenantId: string, id: string): Promise<DocumentsFile | null>;
+	/** The same row, reached only through the reference its owner module knows. */
+	findAttached(
+		tenantId: string,
+		ownerModule: string,
+		recordRef: string,
+		id: string,
+	): Promise<DocumentsFile | null>;
+	create(record: DocumentsFile): Promise<DocumentsFile>;
+	/** The updated row, or null when it was already deleted or never existed. */
+	markDeleted(tenantId: string, id: string): Promise<DocumentsFile | null>;
+	/** Bytes the workspace still stores; the quota is measured against it. */
+	storedBytes(tenantId: string): Promise<number>;
+}

package/modules/documents/src/settings.ts

@@ -0,0 +1,107 @@
+import {
+	defineModuleSettings,
+	PLATFORM_SETTINGS_TENANT,
+	type ModuleSettingsRuntime,
+} from '@flowdular/sdk/kernel';
+import {
+	DEFAULT_STORAGE_MAX_OBJECT_BYTES,
+	storageConfigFromEnvironment,
+	STORAGE_READ_URL_MAX_SECONDS,
+} from '@flowdular/sdk/storage';
+
+export const DOCUMENTS_MODULE_ID = 'documents.core';
+
+export const DEFAULT_DOCUMENTS_QUOTA_BYTES = 10 * 1024 * 1024 * 1024;
+export const DEFAULT_DOCUMENTS_READ_URL_SECONDS = 300;
+export const MIN_DOCUMENTS_READ_URL_SECONDS = 30;
+/* A quota is a workspace bound, not a licence: a terabyte is far past what the
+   25 MB object limit and one workspace's records reach, and a larger number is
+   a mistake rather than a policy. */
+export const MAX_DOCUMENTS_QUOTA_BYTES = 1024 * 1024 * 1024 * 1024;
+
+export const DOCUMENTS_MODULE_SETTINGS = defineModuleSettings({
+	moduleId: DOCUMENTS_MODULE_ID,
+	settings: {
+		quotaBytes: {
+			type: 'number',
+			defaultValue: DEFAULT_DOCUMENTS_QUOTA_BYTES,
+			min: 0,
+			max: MAX_DOCUMENTS_QUOTA_BYTES,
+			visibility: 'shared',
+			client: false,
+			scope: 'tenant',
+			labelKey: 'documents.settings.quotaBytes.label',
+			label: 'Storage quota (bytes)',
+			descriptionKey: 'documents.settings.quotaBytes.description',
+			description:
+				'Bytes this workspace may hold in document storage; 0 refuses every upload.',
+		},
+		readUrlSeconds: {
+			type: 'number',
+			defaultValue: DEFAULT_DOCUMENTS_READ_URL_SECONDS,
+			min: MIN_DOCUMENTS_READ_URL_SECONDS,
+			max: STORAGE_READ_URL_MAX_SECONDS,
+			visibility: 'private',
+			client: false,
+			scope: 'platform',
+			labelKey: 'documents.settings.readUrlSeconds.label',
+			label: 'Read URL lifetime (seconds)',
+			descriptionKey: 'documents.settings.readUrlSeconds.description',
+			description:
+				'How long a signed download link stays valid after it is issued.',
+		},
+	},
+});
+
+/* A setting read must never take an upload down, so both accessors fall back to
+   the declared default when the runtime has not registered the module yet. */
+function value(
+	settings: ModuleSettingsRuntime,
+	tenantId: string,
+	key: 'quotaBytes' | 'readUrlSeconds',
+	fallback: number,
+): number {
+	try {
+		return settings.get<number>(tenantId, DOCUMENTS_MODULE_ID, key);
+	} catch {
+		return fallback;
+	}
+}
+
+export function documentsQuotaBytes(
+	settings: ModuleSettingsRuntime,
+	tenantId: string,
+): number {
+	return value(settings, tenantId, 'quotaBytes', DEFAULT_DOCUMENTS_QUOTA_BYTES);
+}
+
+/**
+ * The object ceiling the platform built its storage port with, read through the
+ * storage package's own parser so there is one rule for it. It is not a module
+ * setting: the limit belongs to the deployment, and this module only repeats it
+ * to the uploader. A configuration this call refuses has already stopped the
+ * platform from composing a port, so the declared default is what a screen is
+ * told rather than a failure of its own.
+ */
+export function documentsMaxObjectBytes(
+	environment: NodeJS.ProcessEnv,
+	workspaceRoot: string,
+): number {
+	try {
+		return storageConfigFromEnvironment(environment, workspaceRoot)
+			.maxObjectBytes;
+	} catch {
+		return DEFAULT_STORAGE_MAX_OBJECT_BYTES;
+	}
+}
+
+export function documentsReadUrlSeconds(
+	settings: ModuleSettingsRuntime,
+): number {
+	return value(
+		settings,
+		PLATFORM_SETTINGS_TENANT,
+		'readUrlSeconds',
+		DEFAULT_DOCUMENTS_READ_URL_SECONDS,
+	);
+}

package/modules/documents/translations/en.json

@@ -0,0 +1,111 @@
+{
+	"module.name": "Documents",
+	"navigation.label": "Documents",
+	"navigation.description": "Files attached to this workspace's records.",
+	"page.eyebrow": "Workspace",
+	"page.title": "Documents",
+	"page.description": "Every file this workspace stores, the record it belongs to and the state of its scan.",
+	"denied": "You need the documents read permission to see this workspace's files.",
+	"common.refresh": "Refresh",
+	"common.refreshing": "Refreshing…",
+	"common.filters": "Filters",
+	"common.actions": "Actions",
+	"common.messages": "Messages",
+	"common.close": "Close",
+	"common.accessDenied": "Access denied",
+	"table.title": "Stored documents",
+	"table.count": "{count} documents",
+	"table.countMore": "{count} documents, more to load",
+	"table.caption": "Documents of this workspace",
+	"table.loading": "Loading documents…",
+	"table.note": "Bytes live in platform storage under a key that starts with this workspace. A download link is signed and expires.",
+	"search.label": "Search documents",
+	"search.placeholder": "File name or description",
+	"filter.ownerModule": "Owner module",
+	"filter.allOwnerModules": "All modules",
+	"filter.scan": "Scan",
+	"filter.allScans": "Any scan state",
+	"column.filename": "File",
+	"column.ownerModule": "Owner module",
+	"column.recordRef": "Record",
+	"column.contentType": "Type",
+	"column.bytes": "Size",
+	"column.scan": "Scan",
+	"column.uploader": "Uploaded by",
+	"empty.title": "No documents yet",
+	"empty.hint": "A file uploaded for a record in this workspace appears here.",
+	"emptyFiltered.title": "No document matches",
+	"emptyFiltered.hint": "Clear the search or the filters.",
+	"loadFailed.title": "Could not load the documents",
+	"loadFailed.hint": "The request failed, so nothing was read. Refresh to try again.",
+	"action.download": "Download",
+	"action.more": "Load more",
+	"action.downloadRefusedInfected": "An infected file is removed the moment the scan finds it, so there is nothing to download.",
+	"action.downloadRefusedDeleted": "This document was deleted, so there is nothing to download.",
+	"action.delete": "Delete",
+	"action.deleteSelected": "Delete selected",
+	"action.deleteSelectedRefused": "None of the selected rows is a stored document you can delete.",
+	"selection.label": "Select all documents on screen",
+	"selection.rowLabel": "Select {name}",
+	"selection.clear": "Clear selection",
+	"selection.summary": "{count} selected",
+	"delete.title": "Delete this document?",
+	"delete.description": "{name} is removed from storage and its row is kept as the trail. This cannot be undone.",
+	"deleteMany.title": "Delete the selected documents?",
+	"deleteMany.description": "{count} documents are removed from storage and their rows are kept as the trail. This cannot be undone.",
+	"notice.uploaded": "{name} was stored.",
+	"notice.deleted": "{name} was deleted.",
+	"notice.deletedMany": "Deleted {deleted}, missing {missing}, refused {refused}.",
+	"upload.action.open": "Upload",
+	"upload.action.submit": "Upload file",
+	"upload.action.uploading": "Uploading…",
+	"upload.drawer.title": "Upload a document",
+	"upload.drawer.subtitle": "The file is stored encrypted and attached to the record you name.",
+	"upload.form.file": "File",
+	"upload.form.fileHelp": "Up to 25 MB. PDF, images, text, CSV and Office documents.",
+	"upload.form.fileHelpLimited": "Up to {limit}. PDF, images, text, CSV and Office documents.",
+	"upload.form.tooLarge": "This file is larger than {limit}, which is all the platform stores.",
+	"upload.form.typeRefused": "This kind of file is not one the platform stores.",
+	"upload.form.clear": "Remove",
+	"upload.form.chosen": "{name}, {size}",
+	"upload.form.ownerModule": "Owner module",
+	"upload.form.ownerModuleHelp": "The module that owns the record, for example directory.core.",
+	"upload.form.ownerModulePlaceholder": "directory.core",
+	"upload.form.recordRef": "Record reference",
+	"upload.form.recordRefHelp": "The owning module's own reference for the record.",
+	"upload.form.recordRefPlaceholder": "party-4711",
+	"upload.form.description": "Description",
+	"upload.form.descriptionHelp": "Optional note shown beside the file.",
+	"upload.form.constraint": "The declared type is verified against the bytes, and the workspace quota is checked before anything is stored.",
+	"scan.unscanned": "Unscanned",
+	"scan.clean": "Clean",
+	"scan.infected": "Infected",
+	"unit.bytes": "{value} B",
+	"unit.kb": "{value} KB",
+	"unit.mb": "{value} MB",
+	"unit.gb": "{value} GB",
+	"settings.quotaBytes.label": "Storage quota (bytes)",
+	"settings.quotaBytes.description": "Bytes this workspace may hold in document storage; 0 refuses every upload.",
+	"settings.readUrlSeconds.label": "Read URL lifetime (seconds)",
+	"settings.readUrlSeconds.description": "How long a signed download link stays valid after it is issued.",
+	"error.load": "Could not load the documents of this workspace.",
+	"error.upload": "Could not store the file.",
+	"error.readUrl": "Could not issue a download link.",
+	"error.downloadBlocked": "The browser blocked the download tab. Allow pop-ups for this page and try again.",
+	"error.delete": "Could not delete the document.",
+	"error.deleteMany": "Could not delete the selected documents.",
+	"error.request": "The documents operation failed.",
+	"error.code.QUOTA_EXCEEDED": "This workspace has no storage left. Delete a document or raise the quota.",
+	"error.code.DOCUMENT_TOO_LARGE": "The file is larger than the platform object limit.",
+	"error.code.CONTENT_TYPE_REFUSED": "This platform does not store files of that type.",
+	"error.code.CONTENT_MISMATCH": "The file does not carry the structure its type claims.",
+	"error.code.DOCUMENT_INFECTED": "The scanner reported this file as infected. Nothing was stored.",
+	"error.code.DOCUMENT_NOT_FOUND": "The document does not exist in this workspace.",
+	"error.code.DOCUMENT_DELETED": "The document was deleted.",
+	"error.code.STORAGE_UNAVAILABLE": "Document storage is unavailable. Try again shortly.",
+	"error.code.CONTENT_TYPE_REQUIRED": "The browser did not report the file type. Choose the file again.",
+	"error.code.CSRF_REJECTED": "The session proof expired. Reload the page and try again.",
+	"error.code.FORBIDDEN": "You are not allowed to perform this action.",
+	"error.code.TOKEN_MUTATION_DENIED": "An API token cannot make this change; sign in and try again.",
+	"error.code.CURSOR_INVALID": "That page is no longer available. Refresh the list."
+}

package/modules/documents/translations/pl.json

@@ -0,0 +1,111 @@
+{
+	"module.name": "Dokumenty",
+	"navigation.label": "Dokumenty",
+	"navigation.description": "Pliki dołączone do rekordów tego obszaru roboczego.",
+	"page.eyebrow": "Obszar roboczy",
+	"page.title": "Dokumenty",
+	"page.description": "Wszystkie pliki tego obszaru roboczego, rekord, do którego należą, i stan skanowania.",
+	"denied": "Potrzebujesz uprawnienia odczytu dokumentów, aby zobaczyć pliki tego obszaru roboczego.",
+	"common.refresh": "Odśwież",
+	"common.refreshing": "Odświeżanie…",
+	"common.filters": "Filtry",
+	"common.actions": "Akcje",
+	"common.messages": "Komunikaty",
+	"common.close": "Zamknij",
+	"common.accessDenied": "Brak dostępu",
+	"table.title": "Zapisane dokumenty",
+	"table.count": "Liczba dokumentów: {count}",
+	"table.countMore": "Dokumenty: {count}, są kolejne",
+	"table.caption": "Dokumenty tego obszaru roboczego",
+	"table.loading": "Wczytywanie dokumentów…",
+	"table.note": "Bajty są przechowywane w magazynie platformy pod kluczem zaczynającym się od tego obszaru roboczego. Link do pobrania jest podpisany i wygasa.",
+	"search.label": "Szukaj dokumentów",
+	"search.placeholder": "Nazwa pliku lub opis",
+	"filter.ownerModule": "Moduł właściciela",
+	"filter.allOwnerModules": "Wszystkie moduły",
+	"filter.scan": "Skanowanie",
+	"filter.allScans": "Dowolny stan skanowania",
+	"column.filename": "Plik",
+	"column.ownerModule": "Moduł właściciela",
+	"column.recordRef": "Rekord",
+	"column.contentType": "Typ",
+	"column.bytes": "Rozmiar",
+	"column.scan": "Skanowanie",
+	"column.uploader": "Przesłał",
+	"empty.title": "Brak dokumentów",
+	"empty.hint": "Plik przesłany do rekordu w tym obszarze roboczym pojawi się tutaj.",
+	"emptyFiltered.title": "Brak pasujących dokumentów",
+	"emptyFiltered.hint": "Wyczyść wyszukiwanie lub filtry.",
+	"loadFailed.title": "Nie udało się wczytać dokumentów",
+	"loadFailed.hint": "Żądanie się nie powiodło, więc nic nie zostało odczytane. Odśwież, aby spróbować ponownie.",
+	"action.download": "Pobierz",
+	"action.more": "Wczytaj więcej",
+	"action.downloadRefusedInfected": "Zainfekowany plik jest usuwany w chwili wykrycia, więc nie ma czego pobrać.",
+	"action.downloadRefusedDeleted": "Ten dokument został usunięty, więc nie ma czego pobrać.",
+	"action.delete": "Usuń",
+	"action.deleteSelected": "Usuń zaznaczone",
+	"action.deleteSelectedRefused": "Żaden z zaznaczonych wierszy nie jest zapisanym dokumentem, który można usunąć.",
+	"selection.label": "Zaznacz wszystkie dokumenty na ekranie",
+	"selection.rowLabel": "Zaznacz {name}",
+	"selection.clear": "Wyczyść zaznaczenie",
+	"selection.summary": "Zaznaczono: {count}",
+	"delete.title": "Usunąć ten dokument?",
+	"delete.description": "{name} zostanie usunięty z magazynu, a jego wpis pozostanie jako ślad. Tej operacji nie można cofnąć.",
+	"deleteMany.title": "Usunąć zaznaczone dokumenty?",
+	"deleteMany.description": "Dokumenty ({count}) zostaną usunięte z magazynu, a ich wpisy pozostaną jako ślad. Tej operacji nie można cofnąć.",
+	"notice.uploaded": "Plik {name} został zapisany.",
+	"notice.deleted": "Plik {name} został usunięty.",
+	"notice.deletedMany": "Usunięto: {deleted}, brakujące: {missing}, odrzucone: {refused}.",
+	"upload.action.open": "Prześlij",
+	"upload.action.submit": "Prześlij plik",
+	"upload.action.uploading": "Przesyłanie…",
+	"upload.drawer.title": "Prześlij dokument",
+	"upload.drawer.subtitle": "Plik zostanie zaszyfrowany i dołączony do wskazanego rekordu.",
+	"upload.form.file": "Plik",
+	"upload.form.fileHelp": "Do 25 MB. PDF, obrazy, tekst, CSV i dokumenty Office.",
+	"upload.form.fileHelpLimited": "Do {limit}. PDF, obrazy, tekst, CSV i dokumenty pakietu Office.",
+	"upload.form.tooLarge": "Ten plik jest większy niż {limit}, czyli tyle, ile platforma przechowuje.",
+	"upload.form.typeRefused": "Tego rodzaju pliku platforma nie przechowuje.",
+	"upload.form.clear": "Usuń",
+	"upload.form.chosen": "{name}, {size}",
+	"upload.form.ownerModule": "Moduł właściciela",
+	"upload.form.ownerModuleHelp": "Moduł, do którego należy rekord, na przykład directory.core.",
+	"upload.form.ownerModulePlaceholder": "directory.core",
+	"upload.form.recordRef": "Odwołanie do rekordu",
+	"upload.form.recordRefHelp": "Własne odwołanie modułu właściciela do rekordu.",
+	"upload.form.recordRefPlaceholder": "party-4711",
+	"upload.form.description": "Opis",
+	"upload.form.descriptionHelp": "Opcjonalna notatka wyświetlana obok pliku.",
+	"upload.form.constraint": "Zadeklarowany typ jest weryfikowany względem bajtów, a limit obszaru roboczego sprawdzany przed zapisem.",
+	"scan.unscanned": "Nieskanowany",
+	"scan.clean": "Czysty",
+	"scan.infected": "Zainfekowany",
+	"unit.bytes": "{value} B",
+	"unit.kb": "{value} KB",
+	"unit.mb": "{value} MB",
+	"unit.gb": "{value} GB",
+	"settings.quotaBytes.label": "Limit magazynu (bajty)",
+	"settings.quotaBytes.description": "Liczba bajtów, jaką ten obszar roboczy może przechowywać; 0 blokuje każde przesłanie.",
+	"settings.readUrlSeconds.label": "Czas życia linku do pobrania (sekundy)",
+	"settings.readUrlSeconds.description": "Jak długo podpisany link do pobrania pozostaje ważny po wystawieniu.",
+	"error.load": "Nie udało się wczytać dokumentów tego obszaru roboczego.",
+	"error.upload": "Nie udało się zapisać pliku.",
+	"error.readUrl": "Nie udało się wystawić linku do pobrania.",
+	"error.downloadBlocked": "Przeglądarka zablokowała kartę pobierania. Zezwól na wyskakujące okna dla tej strony i spróbuj ponownie.",
+	"error.delete": "Nie udało się usunąć dokumentu.",
+	"error.deleteMany": "Nie udało się usunąć zaznaczonych dokumentów.",
+	"error.request": "Operacja na dokumentach nie powiodła się.",
+	"error.code.QUOTA_EXCEEDED": "Ten obszar roboczy nie ma wolnego miejsca. Usuń dokument lub zwiększ limit.",
+	"error.code.DOCUMENT_TOO_LARGE": "Plik przekracza limit rozmiaru obiektu platformy.",
+	"error.code.CONTENT_TYPE_REFUSED": "Platforma nie przechowuje plików tego typu.",
+	"error.code.CONTENT_MISMATCH": "Zawartość pliku nie odpowiada deklarowanemu typowi.",
+	"error.code.DOCUMENT_INFECTED": "Skaner uznał ten plik za zainfekowany. Nic nie zostało zapisane.",
+	"error.code.DOCUMENT_NOT_FOUND": "Taki dokument nie istnieje w tym obszarze roboczym.",
+	"error.code.DOCUMENT_DELETED": "Dokument został usunięty.",
+	"error.code.STORAGE_UNAVAILABLE": "Magazyn dokumentów jest niedostępny. Spróbuj za chwilę.",
+	"error.code.CONTENT_TYPE_REQUIRED": "Przeglądarka nie podała typu pliku. Wybierz plik ponownie.",
+	"error.code.CSRF_REJECTED": "Potwierdzenie sesji wygasło. Odśwież stronę i spróbuj ponownie.",
+	"error.code.FORBIDDEN": "Nie masz uprawnień do tej operacji.",
+	"error.code.TOKEN_MUTATION_DENIED": "Token API nie może wykonać tej zmiany; zaloguj się i spróbuj ponownie.",
+	"error.code.CURSOR_INVALID": "Ta strona nie jest już dostępna. Odśwież listę."
+}

package/modules/exports/migrations/0001_exports_core.down.sql

@@ -0,0 +1,2 @@
+DROP POLICY IF EXISTS exports_jobs_tenant_policy ON exports_jobs;
+DROP TABLE IF EXISTS exports_jobs;

package/modules/exports/migrations/0001_exports_core.up.sql

@@ -0,0 +1,28 @@
+CREATE TABLE IF NOT EXISTS exports_jobs (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  list_id TEXT NOT NULL CHECK (length(list_id) BETWEEN 3 AND 96),
+  status TEXT NOT NULL CHECK (status IN ('requested', 'running', 'completed', 'failed')),
+  row_count BIGINT NOT NULL CHECK (row_count >= 0),
+  byte_count BIGINT NOT NULL CHECK (byte_count >= 0),
+  object_id TEXT CHECK (object_id IS NULL OR length(object_id) BETWEEN 1 AND 128),
+  requester_account_id TEXT NOT NULL CHECK (length(requester_account_id) BETWEEN 1 AND 128),
+  requester_json TEXT NOT NULL CHECK (length(requester_json) <= 8192 AND requester_json::jsonb IS NOT NULL),
+  failure_code TEXT CHECK (failure_code IS NULL OR length(failure_code) BETWEEN 1 AND 64),
+  claimed_at BIGINT,
+  started_at BIGINT NOT NULL,
+  completed_at BIGINT,
+  UNIQUE (tenant_id, object_id),
+  CHECK ((status IN ('completed', 'failed')) = (completed_at IS NOT NULL)),
+  CHECK ((failure_code IS NOT NULL) = (status = 'failed')),
+  CHECK (object_id IS NULL OR status = 'completed')
+);
+CREATE INDEX IF NOT EXISTS exports_jobs_tenant_started_idx
+  ON exports_jobs (tenant_id, started_at DESC, id);
+CREATE INDEX IF NOT EXISTS exports_jobs_tenant_export_idx
+  ON exports_jobs (tenant_id, started_at, id);
+ALTER TABLE exports_jobs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE exports_jobs FORCE ROW LEVEL SECURITY;
+CREATE POLICY exports_jobs_tenant_policy ON exports_jobs
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));

package/modules/exports/migrations/0002_exports_job_routing_role.down.sql

@@ -0,0 +1,4 @@
+REVOKE SELECT (tenant_id, id, status, started_at)
+  ON exports_jobs FROM coreloom_background;
+DROP POLICY IF EXISTS exports_jobs_background_policy ON exports_jobs;
+DROP INDEX IF EXISTS exports_jobs_routing_idx;

package/modules/exports/migrations/0002_exports_job_routing_role.up.sql

@@ -0,0 +1,21 @@
+-- The poll loop must find waiting jobs across workspaces before it knows whose
+-- they are, so it reads the routing columns alone on the background role: the
+-- list, the requester snapshot, the object and every count stay invisible to
+-- it, and each job it picks is claimed and run again under the workspace the
+-- routing row named. PostgreSQL checks column privileges in WHERE too, so
+-- `status` is part of the grant. A job already running is routed as well, so a
+-- claim whose process is gone is found again once its lease lapses.
+CREATE INDEX IF NOT EXISTS exports_jobs_routing_idx
+  ON exports_jobs (status, started_at, tenant_id, id);
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coreloom_background') THEN
+    RAISE EXCEPTION 'The coreloom_background role must exist before this migration.';
+  END IF;
+END
+$$;
+CREATE POLICY exports_jobs_background_policy ON exports_jobs
+  FOR SELECT TO coreloom_background
+  USING (status IN ('requested', 'running'));
+REVOKE SELECT ON exports_jobs FROM coreloom_background;
+GRANT SELECT (tenant_id, id, status, started_at) ON exports_jobs TO coreloom_background;

package/modules/exports/migrations/README.md

@@ -0,0 +1,3 @@
+# Migrations
+
+Migrations in this directory are append-only after release.

package/modules/exports/module.json

@@ -0,0 +1,28 @@
+{
+	"$schema": "../../packages/contracts/schemas/module.schema.json",
+	"schemaVersion": 1,
+	"id": "exports.core",
+	"package": "@flowdular/module-exports",
+	"version": "0.2.2",
+	"platformApi": "^0.1.2",
+	"profile": "full",
+	"capabilities": ["api", "database", "client", "translations"],
+	"platform": {
+		"server": true,
+		"client": true
+	},
+	"dependencies": [
+		{
+			"id": "system.core",
+			"range": "^0.7.0"
+		},
+		{
+			"id": "auth.core",
+			"range": "^0.13.0"
+		}
+	],
+	"provides": ["exports.lists.v1"],
+	"tenancy": "required",
+	"locales": ["en", "pl"],
+	"stability": "experimental"
+}

package/modules/exports/package.json

@@ -0,0 +1,44 @@
+{
+	"name": "@flowdular/module-exports",
+	"version": "0.2.2",
+	"private": true,
+	"type": "module",
+	"exports": {
+		".": "./src/index.ts",
+		"./client": "./src/client/index.ts",
+		"./server": "./src/server/index.ts",
+		"./platform": "./src/platform.ts",
+		"./module.json": "./module.json"
+	},
+	"files": [
+		"src",
+		"module.json",
+		"migrations",
+		"translations",
+		"spec",
+		"README.md"
+	],
+	"scripts": {
+		"typecheck": "tsrx-tsc --noEmit -p tsconfig.json",
+		"test": "vitest run"
+	},
+	"dependencies": {
+		"@flowdular/client": "workspace:*",
+		"@flowdular/contracts": "workspace:*",
+		"@flowdular/database": "workspace:*",
+		"@flowdular/kernel": "workspace:*",
+		"@flowdular/module-auth": "workspace:*",
+		"@flowdular/server": "workspace:*",
+		"@flowdular/storage": "workspace:*",
+		"@flowdular/ui": "workspace:*",
+		"octane": "0.1.51",
+		"segment-state": "0.2.1"
+	},
+	"devDependencies": {
+		"@flowdular/database-testing": "workspace:*",
+		"@tsrx/typescript-plugin": "0.3.120",
+		"@types/node": "24.13.3",
+		"typescript": "5.9.3",
+		"vitest": "4.1.11"
+	}
+}