@flowdular/sdk 0.2.4 → 0.3.1

package/modules/approvals/src/services/repository.ts

@@ -0,0 +1,169 @@
+import type {
+	ApprovalAuditEntry,
+	ApprovalDecision,
+	ApprovalListPage,
+	ApprovalRequest,
+	ApprovalRequestDetail,
+	ApprovalRouting,
+	ApprovalStatus,
+	TerminalApprovalStatus,
+} from '../domain/types.ts';
+
+export interface ApprovalRequestFilters {
+	readonly status?: ApprovalStatus | undefined;
+	readonly subjectModule?: string | undefined;
+	readonly subjectRef?: string | undefined;
+	readonly requesterAccountId?: string | undefined;
+	/** Requests whose eligibility snapshot names this account. */
+	readonly decidableBy?: string | undefined;
+}
+
+export interface CreateApprovalResult {
+	readonly request: ApprovalRequest;
+	/** False when a pending request for the same subject already existed. */
+	readonly created: boolean;
+}
+
+/**
+ * One decision, written in a single tenant-scoped write transaction. `resolve`
+ * is pure and receives every decision recorded on the request including this
+ * one: the service owns when a request resolves, the adapter owns the
+ * transaction the count is taken in.
+ */
+export interface DecideApprovalInput {
+	readonly tenantId: string;
+	readonly requestId: string;
+	readonly decision: ApprovalDecision;
+	readonly resolve: (
+		decisions: readonly ApprovalDecision[],
+	) => TerminalApprovalStatus | null;
+	readonly resolvedAt: number;
+	/** Written in the same transaction when the request resolves; null writes nothing. */
+	readonly audit?: (request: ApprovalRequest) => ApprovalAuditEntry | null;
+}
+
+export type DecideApprovalResult =
+	| {
+			readonly outcome: 'recorded';
+			readonly request: ApprovalRequest;
+			readonly decisions: readonly ApprovalDecision[];
+			readonly resolved: boolean;
+	  }
+	/** The request left `pending` before this decision reached it. */
+	| { readonly outcome: 'not-pending'; readonly request: ApprovalRequest }
+	/** This account already approved or rejected this request. */
+	| { readonly outcome: 'duplicate'; readonly request: ApprovalRequest }
+	| { readonly outcome: 'not-found' };
+
+/**
+ * The persistence port. Async and database agnostic: the PostgreSQL statements,
+ * the tenant transactions and the background lease live in the adapter.
+ */
+export interface ApprovalsRepository {
+	/**
+	 * Idempotent while a request for the same subject is pending: a repeat
+	 * writes nothing and answers with the open request and `created: false`.
+	 */
+	create(
+		request: ApprovalRequest,
+		eligibleAccountIds: readonly string[],
+	): Promise<CreateApprovalResult>;
+	get(tenantId: string, id: string): Promise<ApprovalRequest | null>;
+	/**
+	 * The one request still asking about this subject, read on the unique index
+	 * that makes opening idempotent.
+	 */
+	findPendingBySubject(
+		tenantId: string,
+		subjectModule: string,
+		subjectRef: string,
+	): Promise<ApprovalRequest | null>;
+	detail(tenantId: string, id: string): Promise<ApprovalRequestDetail | null>;
+	/**
+	 * The first `limit` matches, newest first, ties on createdAt broken by id
+	 * descending. It answers the `approvals.requests.v1` capability; the inbox
+	 * pages through `listPage`.
+	 */
+	list(
+		tenantId: string,
+		filters: ApprovalRequestFilters,
+		limit: number,
+	): Promise<readonly ApprovalRequest[]>;
+	/** One keyset page of the same order, in either direction. */
+	listPage(
+		tenantId: string,
+		filters: ApprovalRequestFilters,
+		page: ApprovalListPage,
+	): Promise<readonly ApprovalRequest[]>;
+	/** Whether the snapshot taken when the request opened names this account. */
+	isSnapshotDecider(
+		tenantId: string,
+		requestId: string,
+		accountId: string,
+	): Promise<boolean>;
+	/** Pending requests this account is in the eligibility snapshot of. */
+	countDecidable(tenantId: string, accountId: string): Promise<number>;
+	decide(input: DecideApprovalInput): Promise<DecideApprovalResult>;
+	/** The issuance ledger of one request, oldest first. */
+	listAudit(
+		tenantId: string,
+		requestId: string,
+	): Promise<readonly ApprovalAuditEntry[]>;
+	/** Cross-tenant, routing columns only, on the read-only background lease. */
+	listDueExpiries(
+		now: number,
+		limit: number,
+	): Promise<readonly ApprovalRouting[]>;
+
+	/* The operations behind the declared data class. Each runs on this module's
+	   own lease, inside its own tenant-scoped transaction, in bounded batches. */
+
+	/**
+	 * Keyset page of the workspace's requests with their ledgers, ordered by id.
+	 * `afterId` is the id of the last request the previous page carried.
+	 */
+	exportRequestsPage(
+		tenantId: string,
+		afterId: string | null,
+		limit: number,
+	): Promise<readonly ApprovalRequestDetail[]>;
+	/**
+	 * Removes at most `limit` requests resolved strictly before `before`, with
+	 * their eligibility and decision rows. A pending request is never taken.
+	 */
+	deleteResolvedBefore(
+		tenantId: string,
+		before: number,
+		limit: number,
+	): Promise<number>;
+	/**
+	 * Removes at most `limit` resolved requests this account opened, with their
+	 * eligibility and decision rows.
+	 */
+	deleteResolvedRequestedBy(
+		tenantId: string,
+		accountId: string,
+		limit: number,
+	): Promise<number>;
+	/**
+	 * Redacts at most `limit` decisions this account recorded, keeping the rows:
+	 * the comment becomes a fixed marker and the account a per-row tombstone.
+	 */
+	redactDecisionsBy(
+		tenantId: string,
+		accountId: string,
+		limit: number,
+	): Promise<number>;
+	/**
+	 * Redacts at most `limit` eligibility rows naming this account, in requests
+	 * pending as well as resolved, keeping the rows so a snapshot goes on
+	 * reporting how many people could answer. The other deciders are untouched.
+	 */
+	redactEligibilityOf(
+		tenantId: string,
+		accountId: string,
+		limit: number,
+	): Promise<number>;
+	/** Requests this account opened, in any state. */
+	countRequestedBy(tenantId: string, accountId: string): Promise<number>;
+}

package/modules/approvals/src/services/service-error.ts

@@ -0,0 +1,70 @@
+export class ApprovalsServiceError extends Error {
+	constructor(
+		readonly code: string,
+		message: string,
+		readonly status = 400,
+	) {
+		super(message);
+		this.name = 'ApprovalsServiceError';
+	}
+}
+
+export function bounded(
+	value: string,
+	field: string,
+	minimum: number,
+	maximum: number,
+): string {
+	const normalized = value.trim();
+	if (normalized.length < minimum || normalized.length > maximum) {
+		throw new ApprovalsServiceError(
+			'INVALID_INPUT',
+			`${field} must contain between ${minimum} and ${maximum} characters.`,
+		);
+	}
+	if (normalized.includes('\u0000')) {
+		throw new ApprovalsServiceError(
+			'INVALID_INPUT',
+			`${field} contains an unsupported character.`,
+		);
+	}
+	return normalized;
+}
+
+export function optionalBounded(
+	value: string | null | undefined,
+	field: string,
+	maximum: number,
+): string | null {
+	if (value === undefined || value === null || value.trim() === '') return null;
+	return bounded(value, field, 1, maximum);
+}
+
+export function boundedInteger(
+	value: number,
+	field: string,
+	minimum: number,
+	maximum: number,
+): number {
+	if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+		throw new ApprovalsServiceError(
+			'INVALID_INPUT',
+			`${field} must be an integer between ${minimum} and ${maximum}.`,
+		);
+	}
+	return value;
+}
+
+export function oneOf<T extends string>(
+	value: string,
+	field: string,
+	allowed: readonly T[],
+): T {
+	if (!(allowed as readonly string[]).includes(value)) {
+		throw new ApprovalsServiceError(
+			'INVALID_INPUT',
+			`${field} must be one of: ${allowed.join(', ')}.`,
+		);
+	}
+	return value as T;
+}

package/modules/approvals/src/settings.ts

@@ -0,0 +1,102 @@
+import {
+	defineModuleSettings,
+	ModuleSettingsError,
+	PLATFORM_SETTINGS_TENANT,
+	type ModuleSettingsRuntime,
+} from '@flowdular/sdk/kernel';
+
+export const APPROVALS_MODULE_ID = 'approvals.core';
+
+export const APPROVALS_MODULE_SETTINGS = defineModuleSettings({
+	moduleId: APPROVALS_MODULE_ID,
+	settings: {
+		defaultExpiryDays: {
+			type: 'number',
+			defaultValue: 7,
+			min: 1,
+			max: 90,
+			visibility: 'shared',
+			client: false,
+			scope: 'tenant',
+			labelKey: 'approvals.settings.defaultExpiryDays.label',
+			label: 'Default expiry (days)',
+			descriptionKey: 'approvals.settings.defaultExpiryDays.description',
+			description:
+				'Days a request stays open when the requirement names no expiry of its own.',
+		},
+		expiryIntervalMinutes: {
+			type: 'number',
+			defaultValue: 15,
+			min: 1,
+			max: 1_440,
+			visibility: 'private',
+			client: false,
+			scope: 'platform',
+			labelKey: 'approvals.settings.expiryIntervalMinutes.label',
+			label: 'Expiry loop interval (minutes)',
+			descriptionKey: 'approvals.settings.expiryIntervalMinutes.description',
+			description:
+				'How often the expiry loop looks for due requests. Applied when the approvals runtime starts.',
+		},
+	},
+});
+
+const DEFAULTS = APPROVALS_MODULE_SETTINGS.settings;
+
+/* A setting read must never take a running loop down, so every accessor falls
+   back to the declared default when the runtime has not registered it yet. A
+   workspace nobody primed is a caller defect and stays loud: the accessors
+   below prime before they read. */
+function value(
+	settings: ModuleSettingsRuntime,
+	tenantId: string,
+	key: keyof typeof DEFAULTS,
+	fallback: number,
+): number {
+	try {
+		return settings.get<number>(tenantId, APPROVALS_MODULE_ID, key);
+	} catch (error) {
+		if (
+			error instanceof ModuleSettingsError &&
+			error.code === 'SETTINGS_NOT_PRIMED'
+		) {
+			throw error;
+		}
+		return fallback;
+	}
+}
+
+export function approvalsDefaultExpiryDays(
+	settings: ModuleSettingsRuntime,
+	tenantId: string,
+): number {
+	return value(settings, tenantId, 'defaultExpiryDays', 7);
+}
+
+export function approvalsExpiryIntervalMs(
+	settings: ModuleSettingsRuntime,
+): number {
+	return (
+		value(settings, PLATFORM_SETTINGS_TENANT, 'expiryIntervalMinutes', 15) *
+		60 *
+		1_000
+	);
+}
+
+/* The open capability and the expiry loop run in the background, where no
+   request middleware primed the workspace; prime is idempotent and memoised,
+   so a primed tenant costs one lookup. */
+export async function approvalsPrimedDefaultExpiryDays(
+	settings: ModuleSettingsRuntime,
+	tenantId: string,
+): Promise<number> {
+	await settings.prime(tenantId);
+	return approvalsDefaultExpiryDays(settings, tenantId);
+}
+
+export async function approvalsPrimedExpiryIntervalMs(
+	settings: ModuleSettingsRuntime,
+): Promise<number> {
+	await settings.prime(PLATFORM_SETTINGS_TENANT);
+	return approvalsExpiryIntervalMs(settings);
+}

package/modules/approvals/translations/en.json

@@ -0,0 +1,104 @@
+{
+	"module.name": "Approvals",
+	"common.workspace": "Workspace",
+	"common.refresh": "Refresh",
+	"common.refreshing": "Refreshing…",
+	"common.filters": "Filters",
+	"common.accessDenied": "Access denied",
+	"common.notYet": "Not yet",
+	"common.messages": "Messages",
+	"common.close": "Close",
+	"navigation.inbox": "Approvals",
+	"navigation.inboxDescription": "Requests you opened and requests you may decide.",
+	"widget.label": "Approvals waiting for you",
+	"widget.note": "Pending requests you may decide.",
+	"widget.link": "Open approvals",
+	"pagination.label": "Pages",
+	"pagination.previous": "Previous",
+	"pagination.next": "Next",
+	"pagination.size": "Rows per page",
+	"pagination.summary": "Page {page} · from row {from}",
+	"inbox.title": "Approvals",
+	"inbox.description": "Requests waiting for a decision in this workspace.",
+	"inbox.table.title": "Requests",
+	"inbox.table.count": "{count} requests",
+	"inbox.table.caption": "Approval requests",
+	"inbox.table.loading": "Loading requests…",
+	"inbox.empty.title": "Nothing is waiting",
+	"inbox.empty.hint": "A module opens a request here when an action needs a person to agree to it.",
+	"inbox.emptyFiltered.title": "No request matches",
+	"inbox.emptyFiltered.hint": "Change the selection or the status to widen the list.",
+	"inbox.note": "You see the requests you opened and the requests you may decide.",
+	"inbox.error.title": "The requests could not be loaded",
+	"inbox.error.hint": "The server did not answer. Refresh to try again.",
+	"inbox.denied": "You need the approvals read permission to open this screen.",
+	"column.status": "Status",
+	"column.title": "Request",
+	"column.subjectModule": "Source module",
+	"column.action": "Action",
+	"column.requester": "Requested by",
+	"column.createdAt": "Created",
+	"column.expiresAt": "Expires",
+	"selection.label": "Select all requests on screen",
+	"selection.rowLabel": "Select {title}",
+	"selection.clear": "Clear selection",
+	"selection.summary": "{count} selected",
+	"filter.scope": "Show",
+	"filter.scopeDecidable": "Waiting for me",
+	"filter.scopeMine": "Opened by me",
+	"filter.scopeAll": "Every request",
+	"filter.status": "Status",
+	"filter.allStatuses": "All statuses",
+	"status.pending": "Pending",
+	"status.approved": "Approved",
+	"status.rejected": "Rejected",
+	"status.expired": "Expired",
+	"status.cancelled": "Cancelled",
+	"decision.approve": "Approved",
+	"decision.reject": "Rejected",
+	"decision.expire": "Expired",
+	"decision.cancel": "Cancelled",
+	"request.title": "Approval request",
+	"request.noSummary": "This request carries no further detail.",
+	"request.subjectRef": "Source reference",
+	"request.permission": "Permission",
+	"request.requirement": "Requirement",
+	"request.decisionsNeeded": "Approvals needed",
+	"request.resolvedAt": "Resolved",
+	"request.ledger": "Decisions",
+	"request.ledgerEmpty": "Nobody has decided yet.",
+	"request.byTheLoop": "expiry loop",
+	"request.comment": "Comment (optional)",
+	"requirement.summary": "{who}, {decisions} approvals, {days} days",
+	"requirement.role": "role {role}",
+	"requirement.scope": "permission {scope}",
+	"requirement.roleAndScope": "role {role} with {scope}",
+	"action.approve": "Approve",
+	"action.reject": "Reject",
+	"action.cancel": "Cancel request",
+	"action.approveSelected": "Approve selected",
+	"action.rejectSelected": "Reject selected",
+	"action.selectedRefused": "Select at least one pending request.",
+	"decideMany.approveTitle": "Approve the selected requests?",
+	"decideMany.rejectTitle": "Reject the selected requests?",
+	"decideMany.description": "{count} requests are decided one by one, each checked against your eligibility, and every decision is recorded with the comment below.",
+	"notice.decidedMany": "Decided {decided}, missing {missing}, refused {refused}.",
+	"error.request": "The request failed.",
+	"error.load": "Could not load the approval requests.",
+	"error.decide": "Could not record your decision.",
+	"error.decideMany": "Could not record your decisions.",
+	"error.code.APPROVAL_NOT_FOUND": "This request no longer exists.",
+	"error.code.APPROVAL_NOT_PENDING": "This request was already decided.",
+	"error.code.APPROVAL_ALREADY_DECIDED": "You already decided this request.",
+	"error.code.APPROVAL_NOT_ELIGIBLE": "You may not decide this request.",
+	"error.code.APPROVAL_NOT_CANCELLABLE": "Only the requester or a member who may manage requests can cancel it.",
+	"error.code.APPROVAL_NO_ELIGIBLE_DECIDER": "No member of this workspace can decide this request.",
+	"error.code.APPROVAL_ELIGIBLE_INSUFFICIENT": "Fewer members can decide than the request needs approvals.",
+	"error.code.APPROVAL_ELIGIBLE_TOO_MANY": "The requirement names too many deciders.",
+	"error.code.APPROVAL_REQUIREMENT_INVALID": "The requirement names neither a role nor a permission.",
+	"error.code.FORBIDDEN": "You need the manage permission to read every request.",
+	"settings.defaultExpiryDays.label": "Default expiry (days)",
+	"settings.defaultExpiryDays.description": "Days a request stays open when the requirement names no expiry of its own.",
+	"settings.expiryIntervalMinutes.label": "Expiry loop interval (minutes)",
+	"settings.expiryIntervalMinutes.description": "How often the expiry loop looks for due requests. Applied when the approvals runtime starts."
+}

package/modules/approvals/translations/pl.json

@@ -0,0 +1,104 @@
+{
+	"module.name": "Akceptacje",
+	"common.workspace": "Obszar roboczy",
+	"common.refresh": "Odśwież",
+	"common.refreshing": "Odświeżanie…",
+	"common.filters": "Filtry",
+	"common.accessDenied": "Brak dostępu",
+	"common.notYet": "Jeszcze nie",
+	"common.messages": "Komunikaty",
+	"common.close": "Zamknij",
+	"navigation.inbox": "Akceptacje",
+	"navigation.inboxDescription": "Wnioski, które zgłosiłeś, i wnioski, o których możesz zdecydować.",
+	"widget.label": "Akceptacje czekające na Ciebie",
+	"widget.note": "Otwarte wnioski, o których możesz zdecydować.",
+	"widget.link": "Otwórz akceptacje",
+	"pagination.label": "Strony",
+	"pagination.previous": "Poprzednia",
+	"pagination.next": "Następna",
+	"pagination.size": "Wierszy na stronę",
+	"pagination.summary": "Strona {page} · od wiersza {from}",
+	"inbox.title": "Akceptacje",
+	"inbox.description": "Wnioski czekające na decyzję w tym obszarze roboczym.",
+	"inbox.table.title": "Wnioski",
+	"inbox.table.count": "{count} wniosków",
+	"inbox.table.caption": "Wnioski o akceptację",
+	"inbox.table.loading": "Wczytywanie wniosków…",
+	"inbox.empty.title": "Nic nie czeka",
+	"inbox.empty.hint": "Moduł otwiera tu wniosek, gdy działanie wymaga zgody człowieka.",
+	"inbox.emptyFiltered.title": "Żaden wniosek nie pasuje",
+	"inbox.emptyFiltered.hint": "Zmień zakres lub status, aby poszerzyć listę.",
+	"inbox.note": "Widzisz wnioski, które zgłosiłeś, oraz te, o których możesz zdecydować.",
+	"inbox.error.title": "Nie udało się wczytać wniosków",
+	"inbox.error.hint": "Serwer nie odpowiedział. Odśwież, aby spróbować ponownie.",
+	"inbox.denied": "Potrzebujesz uprawnienia do odczytu akceptacji, aby otworzyć ten ekran.",
+	"column.status": "Status",
+	"column.title": "Wniosek",
+	"column.subjectModule": "Moduł źródłowy",
+	"column.action": "Działanie",
+	"column.requester": "Zgłosił",
+	"column.createdAt": "Utworzono",
+	"column.expiresAt": "Wygasa",
+	"selection.label": "Zaznacz wszystkie wnioski na ekranie",
+	"selection.rowLabel": "Zaznacz {title}",
+	"selection.clear": "Wyczyść zaznaczenie",
+	"selection.summary": "Zaznaczono: {count}",
+	"filter.scope": "Pokaż",
+	"filter.scopeDecidable": "Czekające na mnie",
+	"filter.scopeMine": "Zgłoszone przeze mnie",
+	"filter.scopeAll": "Wszystkie wnioski",
+	"filter.status": "Status",
+	"filter.allStatuses": "Wszystkie statusy",
+	"status.pending": "Oczekuje",
+	"status.approved": "Zaakceptowany",
+	"status.rejected": "Odrzucony",
+	"status.expired": "Wygasł",
+	"status.cancelled": "Anulowany",
+	"decision.approve": "Zaakceptowano",
+	"decision.reject": "Odrzucono",
+	"decision.expire": "Wygasło",
+	"decision.cancel": "Anulowano",
+	"request.title": "Wniosek o akceptację",
+	"request.noSummary": "Ten wniosek nie zawiera dodatkowych szczegółów.",
+	"request.subjectRef": "Odniesienie źródłowe",
+	"request.permission": "Uprawnienie",
+	"request.requirement": "Wymaganie",
+	"request.decisionsNeeded": "Wymagane akceptacje",
+	"request.resolvedAt": "Rozstrzygnięto",
+	"request.ledger": "Decyzje",
+	"request.ledgerEmpty": "Nikt jeszcze nie zdecydował.",
+	"request.byTheLoop": "pętla wygasania",
+	"request.comment": "Komentarz (opcjonalnie)",
+	"requirement.summary": "{who}, akceptacje: {decisions}, dni: {days}",
+	"requirement.role": "rola {role}",
+	"requirement.scope": "uprawnienie {scope}",
+	"requirement.roleAndScope": "rola {role} z {scope}",
+	"action.approve": "Zaakceptuj",
+	"action.reject": "Odrzuć",
+	"action.cancel": "Anuluj wniosek",
+	"action.approveSelected": "Zatwierdź zaznaczone",
+	"action.rejectSelected": "Odrzuć zaznaczone",
+	"action.selectedRefused": "Zaznacz co najmniej jeden oczekujący wniosek.",
+	"decideMany.approveTitle": "Zatwierdzić zaznaczone wnioski?",
+	"decideMany.rejectTitle": "Odrzucić zaznaczone wnioski?",
+	"decideMany.description": "Wnioski ({count}) zostaną rozstrzygnięte po kolei, każdy po sprawdzeniu Twoich uprawnień, a każda decyzja zostanie zapisana z poniższym komentarzem.",
+	"notice.decidedMany": "Rozstrzygnięto: {decided}, brakujące: {missing}, odrzucone: {refused}.",
+	"error.request": "Żądanie nie powiodło się.",
+	"error.load": "Nie udało się wczytać wniosków o akceptację.",
+	"error.decide": "Nie udało się zapisać Twojej decyzji.",
+	"error.decideMany": "Nie udało się zapisać decyzji.",
+	"error.code.APPROVAL_NOT_FOUND": "Ten wniosek już nie istnieje.",
+	"error.code.APPROVAL_NOT_PENDING": "Ten wniosek został już rozstrzygnięty.",
+	"error.code.APPROVAL_ALREADY_DECIDED": "Już zdecydowałeś o tym wniosku.",
+	"error.code.APPROVAL_NOT_ELIGIBLE": "Nie możesz zdecydować o tym wniosku.",
+	"error.code.APPROVAL_NOT_CANCELLABLE": "Anulować może tylko zgłaszający lub osoba zarządzająca wnioskami.",
+	"error.code.APPROVAL_NO_ELIGIBLE_DECIDER": "Żaden członek tego obszaru roboczego nie może zdecydować o tym wniosku.",
+	"error.code.APPROVAL_ELIGIBLE_INSUFFICIENT": "Mniej osób może zdecydować, niż wniosek wymaga akceptacji.",
+	"error.code.APPROVAL_ELIGIBLE_TOO_MANY": "Wymaganie wskazuje zbyt wiele osób decydujących.",
+	"error.code.APPROVAL_REQUIREMENT_INVALID": "Wymaganie nie wskazuje ani roli, ani uprawnienia.",
+	"error.code.FORBIDDEN": "Potrzebujesz uprawnienia do zarządzania, aby czytać wszystkie wnioski.",
+	"settings.defaultExpiryDays.label": "Domyślne wygaśnięcie (dni)",
+	"settings.defaultExpiryDays.description": "Liczba dni, przez które wniosek pozostaje otwarty, gdy wymaganie nie określa własnego terminu.",
+	"settings.expiryIntervalMinutes.label": "Interwał pętli wygasania (minuty)",
+	"settings.expiryIntervalMinutes.description": "Jak często pętla wygasania szuka wniosków po terminie. Stosowane przy starcie modułu akceptacji."
+}

package/modules/audit/migrations/0001_audit_core.down.sql

@@ -0,0 +1,8 @@
+DROP POLICY IF EXISTS audit_events_tenant_policy ON audit_events;
+DROP POLICY IF EXISTS audit_export_runs_tenant_policy ON audit_export_runs;
+DROP POLICY IF EXISTS audit_sweep_runs_tenant_policy ON audit_sweep_runs;
+DROP POLICY IF EXISTS audit_data_classes_tenant_policy ON audit_data_classes;
+DROP TABLE IF EXISTS audit_events;
+DROP TABLE IF EXISTS audit_export_runs;
+DROP TABLE IF EXISTS audit_sweep_runs;
+DROP TABLE IF EXISTS audit_data_classes;

package/modules/audit/migrations/0001_audit_core.up.sql

@@ -0,0 +1,107 @@
+-- One row per workspace and declared class, materialised from the registry the
+-- first time the workspace reads it and refreshed on every read afterwards. The
+-- registry stays the truth about what a class is; this row carries only what
+-- the workspace owns: its period and when the sweep last ran.
+--
+-- retention_mode separates the two absent states the period has: 'default'
+-- follows the declaring module, 'none' keeps the rows until a person deletes
+-- them, and 'days' is the workspace's own number. A single nullable integer
+-- could not tell the first two apart.
+CREATE TABLE IF NOT EXISTS audit_data_classes (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  class_id TEXT NOT NULL,
+  module_id TEXT NOT NULL,
+  label TEXT NOT NULL,
+  exportable SMALLINT NOT NULL CHECK (exportable IN (0, 1)),
+  sweepable SMALLINT NOT NULL CHECK (sweepable IN (0, 1)),
+  default_retention_days BIGINT,
+  retention_mode TEXT NOT NULL CHECK (retention_mode IN ('default', 'days', 'none')),
+  retention_days BIGINT CHECK (retention_days IS NULL OR retention_days > 0),
+  last_swept_at BIGINT,
+  created_at BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL,
+  CHECK ((retention_mode = 'days') = (retention_days IS NOT NULL))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS audit_data_classes_tenant_class_idx
+  ON audit_data_classes (tenant_id, class_id);
+-- The sweep walks this index across tenants on the routing role. Ordering by
+-- last_swept_at first makes the walk start at the classes waiting longest.
+CREATE INDEX IF NOT EXISTS audit_data_classes_due_idx
+  ON audit_data_classes (sweepable, last_swept_at, tenant_id, class_id);
+ALTER TABLE audit_data_classes ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_data_classes FORCE ROW LEVEL SECURITY;
+CREATE POLICY audit_data_classes_tenant_policy ON audit_data_classes
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+CREATE TABLE IF NOT EXISTS audit_sweep_runs (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  class_id TEXT NOT NULL,
+  cutoff BIGINT NOT NULL,
+  removed BIGINT NOT NULL CHECK (removed >= 0),
+  status TEXT NOT NULL CHECK (status IN ('completed', 'partial', 'refused')),
+  reason TEXT,
+  occurred_at BIGINT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS audit_sweep_runs_tenant_time_idx
+  ON audit_sweep_runs (tenant_id, occurred_at DESC, id);
+-- A refusal stands until it is answered, so the loop asks for the newest run of
+-- one class instead of appending the same refusal every interval.
+CREATE INDEX IF NOT EXISTS audit_sweep_runs_tenant_class_time_idx
+  ON audit_sweep_runs (tenant_id, class_id, occurred_at DESC, id);
+ALTER TABLE audit_sweep_runs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_sweep_runs FORCE ROW LEVEL SECURITY;
+CREATE POLICY audit_sweep_runs_tenant_policy ON audit_sweep_runs
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+-- row_count rather than "rows": ROWS is a PostgreSQL keyword and an unquoted
+-- column of that name would have to be quoted at every use site.
+CREATE TABLE IF NOT EXISTS audit_export_runs (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  format_version TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('started', 'completed', 'failed')),
+  classes BIGINT NOT NULL CHECK (classes >= 0),
+  row_count BIGINT NOT NULL CHECK (row_count >= 0),
+  archive_digest TEXT,
+  requested_by TEXT NOT NULL,
+  started_at BIGINT NOT NULL,
+  completed_at BIGINT
+);
+CREATE INDEX IF NOT EXISTS audit_export_runs_tenant_time_idx
+  ON audit_export_runs (tenant_id, started_at DESC, id);
+ALTER TABLE audit_export_runs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_export_runs FORCE ROW LEVEL SECURITY;
+CREATE POLICY audit_export_runs_tenant_policy ON audit_export_runs
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+-- auth.core keeps its trail private to its own service, and it registers no
+-- public capability, so a module cannot append to it. This is audit.core's own
+-- tamper-evident trail: one chain per workspace, each event sealing the hash of
+-- the one before it, so a removed or edited row breaks every hash after it.
+CREATE TABLE IF NOT EXISTS audit_events (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  sequence BIGINT NOT NULL CHECK (sequence > 0),
+  actor_id TEXT NOT NULL,
+  action TEXT NOT NULL,
+  subject_type TEXT NOT NULL CHECK (subject_type IN ('data-class', 'sweep-run', 'export-run')),
+  subject_id TEXT NOT NULL,
+  metadata_json TEXT NOT NULL,
+  occurred_at BIGINT NOT NULL,
+  previous_hash TEXT,
+  event_hash TEXT NOT NULL,
+  UNIQUE (tenant_id, sequence),
+  UNIQUE (tenant_id, event_hash)
+);
+CREATE INDEX IF NOT EXISTS audit_events_tenant_time_idx
+  ON audit_events (tenant_id, occurred_at DESC, sequence DESC);
+ALTER TABLE audit_events ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_events FORCE ROW LEVEL SECURITY;
+CREATE POLICY audit_events_tenant_policy ON audit_events
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));

package/modules/audit/migrations/0002_audit_sweep_routing_role.down.sql

@@ -0,0 +1,2 @@
+REVOKE SELECT (tenant_id, class_id, sweepable, retention_mode, retention_days, default_retention_days, last_swept_at) ON audit_data_classes FROM coreloom_background;
+DROP POLICY IF EXISTS audit_data_classes_background_policy ON audit_data_classes;