@flowdular/sdk 0.3.0 → 0.3.2

package/.ai/references/catalog/tests/migrations.test.ts

@@ -87,6 +87,7 @@ describe('catalog migrations', () => {
 	it('declares forced PostgreSQL row security for every tenant table', () => {
 		for (const migration of databaseMigrations) {
 			const sql = migration.sql.postgresql ?? '';
+			if (!sql.includes('CREATE TABLE')) continue;
 			expect(sql).toContain('ENABLE ROW LEVEL SECURITY');
 			expect(sql).toContain('FORCE ROW LEVEL SECURITY');
 			expect(sql).toContain("current_setting('coreloom.tenant_id', true)");
@@ -110,9 +111,9 @@ describe('catalog migrations', () => {
 				transaction.execute({
 					text: `INSERT INTO catalog_items
 				 (id, tenant_id, sku, sku_normalized, name, kind, unit,
-				  base_price_minor, currency, status, created_at)
+				  base_price_minor, currency, status, created_at, updated_at)
 				 VALUES ('item-1', 'tenant-a', 'SKU-1', 'sku-1', 'Bolt', 'product',
-				         'pcs', 500, 'EUR', 'active', 1)`,
+				         'pcs', 500, 'EUR', 'active', 1, 1)`,
 				}),
 			{ tenantId: 'tenant-a', access: 'write' },
 		);
@@ -139,6 +140,61 @@ describe('catalog migrations', () => {
 		).toEqual([{ sku: 'SKU-1' }]);
 	});
 
+	it('adds the update time and the list indexes, and refuses a half-applied schema', async () => {
+		await apply();
+		const schema = lease.database.schema;
+		expect(await schema.hasColumn('catalog_items', 'updated_at')).toBe(true);
+		expect(await schema.hasIndex('catalog_items_tenant_name_idx')).toBe(true);
+		expect(await schema.hasIndex('catalog_items_tenant_updated_idx')).toBe(
+			true,
+		);
+
+		await lease.database.execute({
+			text: 'DROP INDEX catalog_items_tenant_name_idx',
+		});
+		await lease.database.execute({
+			text: `DELETE FROM ${DATABASE_MIGRATION_LEDGER} WHERE namespace = 'catalog.core'`,
+		});
+		expect((await status()).at(-1)).toMatchObject({
+			id: '0005_catalog_list_indexes',
+			state: 'partial',
+		});
+	});
+
+	it('backfills the update time of rows that predate it', async () => {
+		await runDatabaseMigrations(
+			lease.database,
+			'catalog.core',
+			databaseMigrations.slice(0, 4),
+		);
+		await lease.database.transaction(
+			(transaction) =>
+				transaction.execute({
+					text: `INSERT INTO catalog_items
+				 (id, tenant_id, sku, sku_normalized, name, kind, unit,
+				  base_price_minor, currency, status, created_at)
+				 VALUES ('item-1', 'tenant-a', 'SKU-1', 'sku-1', 'Bolt', 'product',
+				         'pcs', 500, 'EUR', 'active', 1234)`,
+				}),
+			{ tenantId: 'tenant-a', access: 'write' },
+		);
+		expect((await apply()).at(-1)).toMatchObject({
+			id: '0005_catalog_list_indexes',
+			action: 'applied',
+		});
+		expect(
+			(
+				await lease.database.transaction(
+					(transaction) =>
+						transaction.query<{ updated_at: string | number }>({
+							text: 'SELECT updated_at FROM catalog_items',
+						}),
+					{ tenantId: 'tenant-a', access: 'read' },
+				)
+			).rows.map((row) => Number(row.updated_at)),
+		).toEqual([1234]);
+	});
+
 	it('runs clean on a second migration pass', async () => {
 		await apply();
 

package/.ai/references/catalog/tests/module.test.ts

@@ -13,6 +13,7 @@ import {
 	CatalogServiceError,
 } from '../src/services/catalog-service.ts';
 import {
+	allItems,
 	closeCatalogTestDatabases,
 	createCatalogTestDatabase,
 	type CatalogTestDatabase,
@@ -161,7 +162,7 @@ describe('catalog.core', () => {
 			},
 			TEST_ACTOR,
 		);
-		expect(await service.list('tenant-b')).toEqual([]);
+		expect(await allItems(service, 'tenant-b')).toEqual([]);
 	});
 
 	it('keeps lifecycle revisions append-only and tenant-scoped', async () => {

package/.ai/references/catalog/tests/support/database.ts

@@ -4,6 +4,20 @@ import {
 	DatabaseCatalogRepository,
 	migrateCatalogDatabase,
 } from '../../src/services/database-repository.ts';
+import {
+	FIRST_LIST_PAGE,
+	type CatalogService,
+} from '../../src/services/catalog-service.ts';
+import type { CatalogItem } from '../../src/domain/types.ts';
+
+/** The first page at the ceiling in SKU order: every item of a small test tenant. */
+export async function allItems(
+	service: CatalogService,
+	tenantId: string,
+): Promise<readonly CatalogItem[]> {
+	return (await service.listPage(tenantId, { ...FIRST_LIST_PAGE, sort: 'sku' }))
+		.items;
+}
 
 const TENANT_TABLES = [
 	'catalog_items',

package/.ai/references/catalog/translations/en.json

@@ -7,6 +7,16 @@
 	"drawer.editTitle": "Edit catalog item",
 	"action.edit": "Edit",
 	"action.history": "History",
+	"action.archiveSelected": "Archive selected",
+	"action.restoreSelected": "Restore selected",
+	"action.archiveRefused": "Select at least one active item.",
+	"action.restoreRefused": "Select at least one archived item.",
+	"action.close": "Close",
+	"archiveMany.title": "Archive selected items",
+	"archiveMany.description": "Archive {count} selected items? Archived items can be restored later.",
+	"common.messages": "Messages",
+	"denied.title": "Catalog access denied",
+	"denied.description": "Your account may not read catalog items in this workspace.",
 	"delete.title": "Delete catalog item",
 	"delete.description": "Delete {name} permanently? This cannot be undone.",
 	"delete.drawerDescription": "This permanently removes the archived catalog item.",
@@ -17,7 +27,13 @@
 	"error.delete": "Could not delete the catalog item.",
 	"error.history": "Could not load catalog item history.",
 	"error.load": "Could not load catalog items.",
+	"error.archiveMany": "Could not archive the selected items.",
+	"error.restoreMany": "Could not restore the selected items.",
 	"error.request": "The catalog operation failed.",
+	"export.action": "Export CSV",
+	"export.started": "The catalog export started. It appears on the Exports screen once the file is ready.",
+	"export.link": "Open Exports",
+	"export.error": "Could not start the export.",
 	"form.cancel": "Cancel",
 	"form.currency": "Currency",
 	"form.kind": "Kind",
@@ -37,27 +53,42 @@
 	"status.active": "Active",
 	"status.archived": "Archived",
 	"filters.label": "Filters",
-	"filters.includeArchived": "Include archived items",
+	"filters.kind": "Kind",
+	"filters.allKinds": "All kinds",
+	"filters.status": "Status",
+	"filters.allStatuses": "All statuses",
 	"lifecycle.title": "Lifecycle",
 	"lifecycle.description": "Archive an item before deleting it permanently.",
 	"lifecycle.history": "View history",
 	"lifecycle.archive": "Archive item",
 	"lifecycle.restore": "Restore item",
 	"lifecycle.delete": "Delete item",
+	"notice.archivedMany": "Archived {updated}, missing {missing}, refused {refused}.",
+	"notice.restoredMany": "Restored {updated}, missing {missing}, refused {refused}.",
 	"page.action.new": "New item",
 	"page.action.refresh": "Refresh",
 	"page.description": "Products and services with stable tenant-scoped SKUs.",
 	"page.eyebrow": "Commercial master data",
 	"page.title": "Catalog",
+	"pagination.label": "Catalog pages",
+	"pagination.previous": "Previous",
+	"pagination.next": "Next",
+	"pagination.size": "Items per page",
+	"pagination.summary": "Page {page} · from item {from}",
 	"price.fallback": "{amount} {currency} minor",
+	"selection.label": "Select all items on screen",
+	"selection.rowLabel": "Select {name}",
+	"selection.clear": "Clear selection",
+	"selection.summary": "{count} selected",
 	"table.caption": "Catalog items",
-	"table.column.item": "Item",
+	"table.column.name": "Name",
+	"table.column.sku": "SKU",
 	"table.column.kind": "Kind",
 	"table.column.price": "Price",
 	"table.column.status": "Status",
+	"table.column.updated": "Updated",
 	"table.column.actions": "Actions",
-	"table.count.one": "1 item",
-	"table.count.other": "items: {count}",
+	"table.count.page": "{count} on this page",
 	"table.empty.hint": "Create the first product or service.",
 	"table.empty.title": "No catalog items yet",
 	"table.emptyFiltered.hint": "No item in this workspace matches the current filter.",

package/.ai/references/catalog/translations/pl.json

@@ -7,6 +7,16 @@
 	"drawer.editTitle": "Edytuj pozycję katalogu",
 	"action.edit": "Edytuj",
 	"action.history": "Historia",
+	"action.archiveSelected": "Archiwizuj zaznaczone",
+	"action.restoreSelected": "Przywróć zaznaczone",
+	"action.archiveRefused": "Zaznacz co najmniej jedną aktywną pozycję.",
+	"action.restoreRefused": "Zaznacz co najmniej jedną zarchiwizowaną pozycję.",
+	"action.close": "Zamknij",
+	"archiveMany.title": "Archiwizuj zaznaczone pozycje",
+	"archiveMany.description": "Zarchiwizować zaznaczone pozycje ({count})? Zarchiwizowane pozycje można później przywrócić.",
+	"common.messages": "Komunikaty",
+	"denied.title": "Brak dostępu do katalogu",
+	"denied.description": "Twoje konto nie może odczytywać pozycji katalogu w tej przestrzeni roboczej.",
 	"delete.title": "Usuń pozycję katalogu",
 	"delete.description": "Usunąć trwale pozycję {name}? Tej operacji nie można cofnąć.",
 	"delete.drawerDescription": "Ta operacja trwale usuwa zarchiwizowaną pozycję katalogu.",
@@ -17,7 +27,13 @@
 	"error.delete": "Nie udało się usunąć pozycji katalogu.",
 	"error.history": "Nie udało się wczytać historii pozycji katalogu.",
 	"error.load": "Nie udało się wczytać pozycji katalogu.",
+	"error.archiveMany": "Nie udało się zarchiwizować zaznaczonych pozycji.",
+	"error.restoreMany": "Nie udało się przywrócić zaznaczonych pozycji.",
 	"error.request": "Operacja na katalogu nie powiodła się.",
+	"export.action": "Eksportuj CSV",
+	"export.started": "Eksport katalogu wystartował. Pojawi się na ekranie Eksporty, gdy plik będzie gotowy.",
+	"export.link": "Otwórz Eksporty",
+	"export.error": "Nie udało się rozpocząć eksportu.",
 	"form.cancel": "Anuluj",
 	"form.currency": "Waluta",
 	"form.kind": "Rodzaj",
@@ -37,27 +53,42 @@
 	"status.active": "Aktywna",
 	"status.archived": "Zarchiwizowana",
 	"filters.label": "Filtry",
-	"filters.includeArchived": "Pokaż zarchiwizowane pozycje",
+	"filters.kind": "Rodzaj",
+	"filters.allKinds": "Wszystkie rodzaje",
+	"filters.status": "Status",
+	"filters.allStatuses": "Wszystkie statusy",
 	"lifecycle.title": "Cykl życia",
 	"lifecycle.description": "Zarchiwizuj pozycję przed jej trwałym usunięciem.",
 	"lifecycle.history": "Zobacz historię",
 	"lifecycle.archive": "Archiwizuj pozycję",
 	"lifecycle.restore": "Przywróć pozycję",
 	"lifecycle.delete": "Usuń pozycję",
+	"notice.archivedMany": "Zarchiwizowano {updated}, brak {missing}, odrzucono {refused}.",
+	"notice.restoredMany": "Przywrócono {updated}, brak {missing}, odrzucono {refused}.",
 	"page.action.new": "Nowa pozycja",
 	"page.action.refresh": "Odśwież",
 	"page.description": "Produkty i usługi ze stałym SKU w obrębie przestrzeni roboczej.",
 	"page.eyebrow": "Dane podstawowe sprzedaży",
 	"page.title": "Katalog",
+	"pagination.label": "Strony katalogu",
+	"pagination.previous": "Poprzednia",
+	"pagination.next": "Następna",
+	"pagination.size": "Pozycji na stronie",
+	"pagination.summary": "Strona {page} · od pozycji {from}",
 	"price.fallback": "{amount} {currency} w groszach",
+	"selection.label": "Zaznacz wszystkie pozycje na ekranie",
+	"selection.rowLabel": "Zaznacz {name}",
+	"selection.clear": "Wyczyść zaznaczenie",
+	"selection.summary": "Zaznaczono: {count}",
 	"table.caption": "Pozycje katalogu",
-	"table.column.item": "Pozycja",
+	"table.column.name": "Nazwa",
+	"table.column.sku": "SKU",
 	"table.column.kind": "Rodzaj",
 	"table.column.price": "Cena",
 	"table.column.status": "Status",
+	"table.column.updated": "Zmieniono",
 	"table.column.actions": "Akcje",
-	"table.count.one": "1 pozycja",
-	"table.count.other": "pozycje: {count}",
+	"table.count.page": "Na tej stronie: {count}",
 	"table.empty.hint": "Dodaj pierwszy produkt lub usługę.",
 	"table.empty.title": "Nie ma jeszcze pozycji katalogu",
 	"table.emptyFiltered.hint": "Żadna pozycja w tej przestrzeni roboczej nie pasuje do filtra.",

package/.ai/references/catalog.provenance.json

@@ -1,9 +1,9 @@
 {
 	"id": "catalog.core",
-	"version": "0.7.0",
+	"version": "0.8.0",
 	"repository": "Flowdular/official-modules",
-	"sourceCommit": "b8281b38498b1e3164e6619ec9e8fe922ad7dc10",
-	"artifactSha256": "6c98785c10fac14cb1a913c6462cb42e18fe824a7d0dd7620746605fd351441d",
+	"sourceCommit": "edad0ec198877c0359f11512b7c0055f87d5f8b4",
+	"artifactSha256": "3e1c8530eed822c35e12f24545492bf7614bbd47e3a9255a869423d7e1662ef4",
 	"files": {
 		"LICENSE": "155d722071bad9d0d832482e06fd5a47f7034389cb63aabcb39f4282aa3499fc",
 		"migrations/0001_catalog_core.down.sql": "0962a1edf0bde959cd4facccf77bd5b634d6cc25f125a0c79a61770c8871093f",
@@ -14,43 +14,51 @@
 		"migrations/0003_catalog_history_service_actors.up.sql": "7caae787ca2fc1e331ccbfda4df5982beec76136e8dc486aab5532ccd338a722",
 		"migrations/0004_catalog_idempotency_ledger.down.sql": "8ba72d8edc4d25ecf6d041888cf321690c25afdaf3723812ddd7d391d75370aa",
 		"migrations/0004_catalog_idempotency_ledger.up.sql": "41e86ba2051159c6cc9672bfae17c1d02051da975f1c43c566a2b66592673cb0",
+		"migrations/0005_catalog_list_indexes.down.sql": "3dd547d738e75513abef502afc4bf9b51851ec9405b6b719c6134b897c5b1776",
+		"migrations/0005_catalog_list_indexes.up.sql": "dc3ece30b93fba0c91be58f772d1ae421cfbba49439e8c72a06aead6720f5db5",
 		"migrations/README.md": "2a15fd001713c2552a3c82b186246aa5fec136f43143cc2d9aa15bd491a09d41",
-		"module.json": "1b512c9b97bdec2155103f521a6545e558e50491f90c74a93d33cc74511d2125",
-		"package.json": "67d50dc95723d21bb44bbab54ae14fe89641c52b9f62ba065908f67ebcf0ed7a",
-		"spec/module.yaml": "ec931c78f351c7fc53f43fdd5ec9cd1a46db485f642648329bf1612883a3c958",
+		"module.json": "4a4e5b5414f97a6b023c0ed64d0df313aa3ab4e8771f8e33137e589818ad20fd",
+		"package.json": "6dd4972624c2a141b038c024137a29b0e5223a28f9021653f2aa6517fb464b56",
+		"spec/module.yaml": "c30518bd28e5d184ef122f194f5c1308ff5c522df6638085ccc8121a78d40971",
 		"src/acl/permissions.ts": "3375521a5a229736ffac5a948140ec347dc7a7e4fba80e778c0baaf9e0622590",
-		"src/agent/tools.ts": "3204d20886d2b864482adc1ed3303c653aebd207e16c4fce0c67a4979ea8db07",
-		"src/api/endpoints.ts": "34f1036e759353550be2acf67c6fa254afc790942d09489db2e76a082df5c3a3",
+		"src/agent/tools.ts": "3403db7954906dc2c79227ba0420b5cb4bfb57063b7cfc285e6e556f16be9266",
+		"src/api/endpoints.ts": "205ef36d058f246f99b77336e7246a23aaca611c696a1f6f09758f66e8a93a29",
+		"src/api/list-cursor.ts": "dcb763edc0128a3aac95e9ca3c5158611a7f2c6a4c71484438c89b7f4d79bb0d",
 		"src/client/CatalogHistoryDrawer.tsrx": "6cdba5249be81e70da703cb34c1a2210943ce5e5fb596ee77cf7952e2acf3ee3",
 		"src/client/CatalogItemForm.tsrx": "7dafa4149975d9e7d5784c8a5391b5b64c2405991aaead713d94b61c41168c2c",
-		"src/client/CatalogView.tsrx": "7c507931f33afea8414b002e3ad815740c8db75016c53d8a81effc6427bd958d",
-		"src/client/api.ts": "5f404f6b25777bc8fe2eab5a35424593abc8e879fb83fa2ae4d637fc23fdce4b",
-		"src/client/contribution.tsrx": "e95f755882005ee090c99a119ce2dda2ec70420daed4ce06021193905858c62f",
+		"src/client/CatalogView.tsrx": "bc1e543690e07d52b51626832f36afe3fde87bf2dc45642324507df8384d7303",
+		"src/client/api.ts": "eaa55af81d26aa0190d19b3102c363c1ee25b2bdc05436446ac95dcde62aea75",
+		"src/client/contribution.tsrx": "6cbf79e6188bdf24b9cec4a06ae621e03efd5d0c76ad72b28828eee9155ab893",
 		"src/client/index.ts": "03eb0664cdafccb66cb25f2e1b07e6959c2dfa9bdbfffc3e7edf9b535ba4949a",
 		"src/client/navigation-copy.ts": "9a8757e64f4001a93e2bc2861c686a19f791f9d67a396d9e658023b1ec4cea8f",
-		"src/client/state.ts": "bc054bc269026b6abf60d99a2fc5dd94eb8a488fc1ce4c81a1ae1065d9db576b",
-		"src/domain/types.ts": "4b26be80954d792b09a3a34d29d845b9f6119640be505daba325fec820e06ef6",
+		"src/client/state.ts": "61601f6037c4bb8a709b69b10c1a37e59b45b0c941240c436f7861c2b034dcc1",
+		"src/domain/lists.ts": "83749967f99fa0c4f44abc0c614108b844321e50ce6408553215e6233ad6e350",
+		"src/domain/types.ts": "374efeb24c4f7d41e3c660336e721fa362418579837d44a46724076d03287a0b",
 		"src/domain/variables.ts": "131130e57838235b1f3fcb799da44baeae16522bb346d522827e022305c110b5",
 		"src/index.ts": "5b27943018db9a18651d62add7d6f8397d7c492a204381fae74547b99b91990d",
-		"src/platform.ts": "b5d809b071af812877f3fb09cce3ced4cdaed8f62611c3eb6d5fcaf6cd7333cb",
+		"src/platform.ts": "f048082a33c1c688e4952750c762c8b65a4626ff52cc9c4eaca2156014bac631",
 		"src/server/index.ts": "90eae107d863418124e5d10c4d1fe8a119bd14da605b36de708c18d8500c4b5e",
 		"src/server/runtime.ts": "5f4389a6adf8265f6737c489baf686f63cc3550662103d28b2da9800dd9f5b63",
-		"src/services/catalog-service.ts": "51f1dcd7c0335f7b417fb45ba700c0098e7193246ee91659c27cab8608282693",
+		"src/services/catalog-service.ts": "66e61dfbd9797d31e6814c18efcd21cfcb7b220f7df22677868f486f3fa0e9d1",
 		"src/services/data-classes.ts": "ea09b1a7def59fee43d57ca7dab6fdb4d646b51df2cacb60af96676c43602b33",
-		"src/services/database-repository.ts": "e6ff61ba197899d5618a02ce743c90d4bf09ae64dcfd1bd3a9985b18a2d23e80",
+		"src/services/database-repository.ts": "1b72ce91a2f85f6572825766781a806d94fe0d2abb91872ee9acae3b1e70db2e",
 		"src/services/index.ts": "a08aefe5101814538666f861536287fc382e6c655d62ba9b9ef4bbfbc6ede4af",
-		"src/services/migration.ts": "89c8e333482c80bc819deba0cf4f4e37e94137933af0f6503f4f9ebcb4f5f371",
-		"src/services/repository.ts": "98d27a40ff02137ec0c6d8799d9a853d40a76eab2564dd500806c4e84f6dc3a3",
+		"src/services/item-export.ts": "b2a4613b43a98d0d41699481bb5e85a770f9a60cb2241579b065effb6936c80b",
+		"src/services/migration.ts": "57c9a857d4074973e14b5e3a1c4548a92ad0faca371419e7daf2334f3ef701ab",
+		"src/services/repository.ts": "9f560033875d05654148b4a11897465ee4eefa0d7fa701439e8f562da9fba1db",
 		"src/services/target-idempotency.ts": "7111b56a30b691eaaaa64f5691895ac94b6e0735b0079794835bbbeba5102cb0",
-		"tests/agent-tools.test.ts": "3cdda30b5454d58c6e8791a98e3daf6fe58b9852cd5c437b3614c3f6123baa91",
+		"tests/agent-tools.test.ts": "7762c14bc353ee3085df46a91cf370eb5c25b2edb7096f0a4b0e033f220ea726",
+		"tests/client-state.test.ts": "ea146c793b14d0f9bc5e36d92e92894ced6531b8fcbd11c8be1486b62313b8c3",
 		"tests/data-classes.test.ts": "bea08e4d1d7380ccdebc211374b74a6034714b192fd98bfb90a2218067b35658",
-		"tests/endpoints.test.ts": "24d05c7dd52820f90c777a1b814529f5188a9a5a9daeaacda07314f17b7483cc",
-		"tests/idempotency.test.ts": "f2e0896635bcd95271b66181daa2c084411913cdf864ae8b4814f2beeb8c2943",
-		"tests/migrations.test.ts": "47d3d741eddde8677be287730d2f96af556b4b7bf0d8378f9a12a7309af17d78",
-		"tests/module.test.ts": "01bedfa1540470cc87c808c75120f6ede7c3b8e3d81e340d2076af0a66f1c7ab",
-		"tests/support/database.ts": "f108cf6390da7669f8935301fac125a7e5653f06ba75327f4bdc28fdd409ba73",
-		"translations/en.json": "406a40b77e3778e83cd4d30e7b3aee8f89c75baf7bc52f1befc6d16f3b877ab3",
-		"translations/pl.json": "db6325b4980d978e1a3098758b5259a68e32469baa09d194b9d6746462776d27",
+		"tests/endpoints.test.ts": "a2d700f4c3eb6fbbef5c57ed5591017a27c98e17fe84fba8426fcd3a2820b210",
+		"tests/export.test.ts": "de83066272cee5f7f5736d636d7b9b97dab09778ba661816e401bf926b826402",
+		"tests/idempotency.test.ts": "faea4a2cfa04e81b7155399cba807af4c1ba4448cdfeab733d1afe801d27734f",
+		"tests/list.test.ts": "97605b50020841cbdac62f9d44b65f0f7dce9c4c4972af6409afeb6b9b66e59a",
+		"tests/migrations.test.ts": "fb796aecedb997f6395c2c15e45bf4abfae4677953fa8cb420c94e9cfba8222f",
+		"tests/module.test.ts": "af961a5bcddc41d304d14841f8810976f43f46b46ab7814142fdb921a773e92a",
+		"tests/support/database.ts": "4ff6d093ca2e80baab3dea476018661473d6474db63d67655f1edc667b8472ac",
+		"translations/en.json": "a86d70e02ccf46a2a132d5bee0de7c528c0eb56a85c269a78e0c2e7e0de24e37",
+		"translations/pl.json": "8157d83467e9dd8d9700e2fb188f1a730073f805d2a8b3f0ba98f02f2ca9a264",
 		"tsconfig.json": "140bb4775df421146563d13d2f78ff74cb3c2decab6737db32938339248a92ba",
 		"vitest.config.ts": "d13725b13c3712ec91c1646e9226fb172eec2599f72f4e6608bece9912e2bd81"
 	}

package/.ai/skills/cli-extension/SKILL.md

@@ -91,7 +91,7 @@ export default cliExtension;
 
 ## 4. What the runner does with the descriptor (`packages/cli/src/runner.ts`, `runExtensionCommand`)
 
-- `risk: 'external'`: refused with `APPROVAL_VERIFIER_REQUIRED`. `risk: 'destructive'` without `localOnly`: the same.
+- `risk: 'external'`, or `'destructive'` without `localOnly`: refused with `APPROVAL_VERIFIER_REQUIRED` unless `--grant <token> --tenant <id>` carries a verified approval grant for this capability and invocation digest (`APPROVAL_GRANT_INVALID`, `APPROVAL_GRANT_EXPIRED`, `APPROVAL_GRANT_MISMATCH` otherwise).
 - `localOnly: true`: refused with `LOCAL_ONLY_CAPABILITY` unless `FD_ENV` or `NODE_ENV` is `development` or `test` (unset counts as development).
 - `requiresApprovedSpec: true`: needs `--spec <path>` to a schema-valid spec with `status: approved`, otherwise `APPROVED_SPEC_REQUIRED`, `SPEC_VALIDATION_FAILED` or `SPEC_NOT_APPROVED`.
 - `destructive` with `--apply`: needs `--confirm <confirmation>` (`CONFIRMATION_REQUIRED`).

package/.ai/skills/deploy-operate/SKILL.md

@@ -81,9 +81,12 @@ Both are served by `platform/src/server/health.ts`. The shipped Docker and Kuber
 pnpm flowdular database backup --output <dir>                            # dry run
 pnpm flowdular database backup --output <dir> --apply
 pnpm flowdular database restore --input <dir> --apply --confirm restore-database
+pnpm flowdular database restore-production --input <dir> --target <db> --grant <token> --tenant <id> [--platform-url <origin>|--platform-stopped] --apply --confirm restore-database
 ```
 
-The trap: **the encryption keys live outside the database.** Agent provider credentials, agent run grants, workflow payloads and cursors, automation secrets and MFA secrets are all stored as ciphertext, and the keys are environment variables (`FD_AGENT_CREDENTIAL_KEY`, `FD_AGENT_RUN_GRANT_KEY`, `FD_WORKFLOWS_PAYLOAD_KEY`, `FD_WORKFLOWS_CURSOR_KEY`, `FD_AUTOMATIONS_CREDENTIAL_KEY`, `FD_AUTH_MFA_KEY`, `FD_NOTIFICATIONS_SECRET_KEY`, `FD_STORAGE_ENCRYPTION_KEY`, `FD_CONNECTORS_SECRET_KEY`, `FD_AUDIT_ANCHOR_KEY`). A database backup without the matching keys restores rows nobody can read, and rotating a key without re-encrypting orphans everything encrypted under the old one. Back the keys up separately, restore them together with the dump, and record which key version a dump belongs to.
+Production restores run `database.restore.production`: an approval grant bound to the exact flags, `--target` equal to the migrator DSN database, a separate migrator DSN, a key mismatch refused unless the approval included `--allow-key-mismatch`, and a refusal while the health endpoint answers. PITR for the compose stack is `infra/docker/pitr.sh` (see `infra/README.md`); in Kubernetes it is the managed provider's job.
+
+The trap: **the encryption keys live outside the database.** Agent provider credentials, agent run grants, workflow payloads and cursors, automation secrets, MFA secrets, stored objects and connector credentials are all stored as ciphertext, and the keys are environment variables (`FD_AGENT_CREDENTIAL_KEY`, `FD_AGENT_RUN_GRANT_KEY`, `FD_WORKFLOWS_PAYLOAD_KEY`, `FD_WORKFLOWS_CURSOR_KEY`, `FD_AUTOMATIONS_CREDENTIAL_KEY`, `FD_AUTH_MFA_KEY`, `FD_NOTIFICATIONS_SECRET_KEY`, `FD_STORAGE_ENCRYPTION_KEY`, `FD_CONNECTORS_SECRET_KEY`, `FD_AUDIT_ANCHOR_KEY`). A database backup without the matching keys restores rows nobody can read, and rotating a key without re-encrypting orphans everything encrypted under the old one; every sealing key has a `secrets-rotate` command in the runbook's rotation table, the storage key two (`documents` and `exports`). Back the keys up separately, restore them together with the dump, and record which key version a dump belongs to.
 
 ## 6. Rollback
 
@@ -92,6 +95,8 @@ The trap: **the encryption keys live outside the database.** Agent provider cred
 3. To take one module out of service without a redeploy: `pnpm flowdular module disable <id> --apply` (it is a dry run without `--apply`), then rebuild the composition and redeploy. Its tables stay.
 4. If the rollback is because of a key change, restore the previous key first; the image alone will not fix unreadable ciphertext.
 
+- For data loss between two dumps use PITR (`pitr.sh restore --target-time`), never a `.down.sql`.
+
 ## 7. Production checklist
 
 - `pnpm verify` and `pnpm build` pass on the commit being shipped (the image build runs both).
@@ -103,7 +108,7 @@ The trap: **the encryption keys live outside the database.** Agent provider cred
 - Sign-up closed (`FD_AUTH_ALLOW_SIGN_UP`) unless the deployment is public; the first owner created with `flowdular auth workspace-create` (see `docs/cli.md`).
 - Liveness on `/api/health`, readiness on `/api/ready`.
 - `pnpm flowdular migration verify` clean after rollout, and `pnpm flowdular doctor --json` reports `status: healthy`.
-- A restore has been rehearsed once, keys included.
+- A restore has been rehearsed once, keys included, and a PITR restore once from the newest base backup.
 
 ## Pitfalls
 

package/README.md

@@ -1,4 +1,4 @@
-[![Flowdular: Build your business platform](https://cdn.jsdelivr.net/npm/@flowdular/sdk@latest/assets/flowdular-banner.png)](https://flowdular.com)
+[![Flowdular: Build your business platform](https://cdn.jsdelivr.net/npm/@flowdular/sdk@latest/assets/flowdular-banner.webp)](https://flowdular.com)
 
 # Flowdular SDK
 

package/modules/access/module.json

@@ -14,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/access/spec/module.yaml

@@ -12,7 +12,7 @@ capabilities:
   - translations
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
 requires:

package/modules/agents/module.json

@@ -20,7 +20,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/agents/spec/module.yaml

@@ -14,7 +14,7 @@ capabilities:
   - cli
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
   - id: metering.core

package/modules/approvals/migrations/0005_approvals_grant_audit.down.sql

@@ -0,0 +1,4 @@
+-- The issuance ledger carries no data any other table depends on.
+DROP POLICY IF EXISTS approvals_audit_tenant_policy ON approvals_audit;
+DROP INDEX IF EXISTS approvals_audit_request_idx;
+DROP TABLE IF EXISTS approvals_audit;

package/modules/approvals/migrations/0005_approvals_grant_audit.up.sql

@@ -0,0 +1,20 @@
+-- The grant an approved request yields is derived from the row and the key on
+-- every read, so nothing about the token itself is stored. What is stored is
+-- the fact of its issuance: one row per resolved request whose subject names
+-- a capability, with the capability, the input digest, the key that signs and
+-- the moment the grant stops verifying, written in the deciding transaction.
+CREATE TABLE IF NOT EXISTS approvals_audit (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  request_id TEXT NOT NULL,
+  action TEXT NOT NULL,
+  metadata_json TEXT NOT NULL,
+  occurred_at BIGINT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS approvals_audit_request_idx
+  ON approvals_audit (tenant_id, request_id, occurred_at, id);
+ALTER TABLE approvals_audit ENABLE ROW LEVEL SECURITY;
+ALTER TABLE approvals_audit FORCE ROW LEVEL SECURITY;
+CREATE POLICY approvals_audit_tenant_policy ON approvals_audit
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));

package/modules/approvals/module.json

@@ -3,7 +3,7 @@
 	"schemaVersion": 1,
 	"id": "approvals.core",
 	"package": "@flowdular/module-approvals",
-	"version": "0.1.13",
+	"version": "0.1.14",
 	"platformApi": "^0.1.0",
 	"profile": "full",
 	"capabilities": ["api", "database", "client", "translations"],
@@ -14,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/approvals/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/module-approvals",
-	"version": "0.1.13",
+	"version": "0.1.14",
 	"private": true,
 	"type": "module",
 	"exports": {

package/modules/approvals/spec/module.yaml

@@ -1,6 +1,6 @@
 schemaVersion: 2
 id: approvals.core
-specVersion: 0.1.13
+specVersion: 0.1.14
 status: approved
 name: Approvals Core
 description: Turns a policy decision that needs a person into an approval request with named requirements, a decision record that is append-only, notifications to the people who can decide, and a workflow node that waits for the decision, so every module delegates who may decide instead of writing its own approval state machine.
@@ -12,7 +12,7 @@ capabilities:
   - translations
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
 tenancy: required
@@ -33,6 +33,7 @@ invariants:
   - A requirement naming both a role key and a scope is satisfied only by members holding both; a requirement that resolves to no eligible decider, to fewer deciders than the decisions it needs, or to more than 200 deciders is refused at open with a stable code and no request is created.
   - A member who gains eligibility after a request opened may decide it (eligibility is re-read at decision time) but is not listed as a decider, because the decider list is the snapshot taken at open.
   - approvals.core declares one data class to the platform registry while it composes, and performs its operations itself on its own lease under its own tenant transaction. approvals.core.requests holds the request row, the eligibility snapshot taken when it opened and every decision recorded on it, keeps them 400 days by default, sweeps only resolved requests in bounded batches so a request still asking is never taken from the people who have to answer it however old it is, and exports one workspace by keyset in bounded pages carrying each request with its decisions and their comments. An erasure removes the resolved requests the subject opened with their eligibility and decision rows, and keeps but redacts every row naming the subject in somebody else's request, a decision as well as an eligibility row of a pending request, writing a fixed marker over a comment and a tombstone unique to the row over the account, because the ledger is append-only and one fixed account value would collide with the unique decider index, or with the eligibility key, as soon as two erased subjects had answered or been eligible for the same request; the remaining deciders keep their own rows and no account of the subject survives; the answer counts the removals and the redactions apart, removed for the rows that went and redacted for the rows that stayed without the subject in them, and both fill the batch the run gave it so a pass that only redacted still moves the run on; the count answers every request the subject opened in any state.
+  - A request whose subject reference encodes a capability id and an input digest (the prefix capability, the id and the sha256 hex digest, separated by colons, within the subjectRef bound) yields, once approved, a grant signed with HMAC-SHA256 under FD_APPROVAL_GRANT_KEY that names the workspace, the capability, the digest, the request and a one hour window from the approving decision; the grant is derived from the row and the current key on every read of the grant operation of approvals.requests.v1, handed only to the subject module that opened the request and never stored, a previous key kept in FD_APPROVAL_GRANT_KEY_PREVIOUS still verifies grants it signed, no grant is yielded for a rejected, cancelled or expired request or once the window closed, the approving transaction writes one grant.issued row to the issuance ledger with the capability, the digest, the signing key id and the expiry, the agent harness admits one tool call per grant within a run and refuses the repeat, and the CLI runner, which runs outside the platform and records no use, accepts the same grant for the same invocation until the window closes.
   - Whether a member may read a request is settled before its state is reported. A member who is neither the requester, nor named by the eligibility snapshot, nor eligible now, nor holding approvals.requests.manage is answered as if the request did not exist, on the read, on a decision and on a cancellation alike, so none of them reveals that the request exists or what became of it.
 permissions:
   - id: approvals.requests.read
@@ -42,7 +43,7 @@ permissions:
   - id: approvals.requests.manage
     description: Read every request of the active workspace and cancel a pending one.
 dataOwnership:
-  - approvals.core owns approval requests, resolved eligibility snapshots and decision rows.
+  - approvals.core owns approval requests, resolved eligibility snapshots, decision rows and the grant issuance ledger.
   - The subject module owns the record the request gates and its own domain state; it changes that state only after reading the request's terminal state.
   - auth.core owns roles and memberships; eligibility is resolved through its public surface at creation and at decision time.
 entities:
@@ -267,6 +268,10 @@ decisions:
     question: Which data classes does approvals.core declare, how long are they kept, and what does an erasure leave behind?
     answer: One class, approvals.core.requests, covering requests, their eligibility rows and their decisions, kept 400 days by default. The sweep takes resolved requests only, with their eligibility and decision rows; a pending request is never swept however old it is. The export pages requests with their decisions and comments, keyset by id. An erasure removes the resolved requests the subject opened with their rows, and redacts rather than removes the rows naming the subject in somebody else's request, writing a fixed marker over a decision's comment and a per-row tombstone over the account on that decision and on the eligibility rows, in pending requests as well as resolved ones. The append-only ledger keeps its row count, a snapshot goes on reporting how many people could answer, the people who can still answer keep their own rows, and no account of the subject survives anywhere. The count answers how many requests the subject opened, in any state.
     decidedBy: default
+  - id: D-APPROVALS-GRANT
+    question: How does an approved request let the CLI runner or the harness run an external or destructive capability?
+    answer: The subject reference encodes the capability id and the digest of the exact invocation input; once approved the request yields a signed grant bound to the workspace, the capability, the digest and a one hour window, which the runner takes as the --grant flag and the harness as the run's grants. The token is read through the grant operation by the subject module alone, derived on read from the row and FD_APPROVAL_GRANT_KEY rather than stored, and the issuance is written to the ledger in the approving transaction; the harness spends a grant on one call, the runner cannot record use and is bounded by the window.
+    decidedBy: default
 acceptanceScenarios:
   - id: APPROVALS-OPEN
     given: A subject module needs a person to agree to an action on one of its records, with a role requirement and a count of 1.
@@ -312,6 +317,10 @@ acceptanceScenarios:
     given: A workspace holds more requests than one page of the inbox carries.
     when: A member pages through the inbox under a scope and a status filter.
     then: A page carries at most 200 requests (50 unless the request asks for more), ordered by createdAt in the requested direction with the id as the tie-break, and a full page answers an opaque cursor bound to the workspace, the member, the sort and the filters, so a cursor used under another workspace, sort or filter is refused rather than reinterpreted.
+  - id: APPROVALS-GRANT
+    given: A workspace with FD_APPROVAL_GRANT_KEY configured and a request opened with a subject reference that encodes a capability id and an input digest.
+    when: An eligible member approves it, another such request is rejected, a third cancelled and a fourth left to expire, and the key is later rotated with the old key kept as previous.
+    then: Reading the grant of the approved request through the capability as the subject module answers a grant that verifies for that workspace, capability and digest until one hour after the approving decision, the same token on every read under the same key and a token under the new key after the rotation that the rotated ring still verifies, the ledger carries one grant.issued row written with the approval naming the capability, the digest, the signing key id and the expiry, the rejected, cancelled and expired requests and an approved request whose subject names a record answer no grant and no ledger row, another module naming the request is answered no grant, and the retention sweep removes the ledger rows with the request.
   - id: APPROVALS-TENANT-BOUNDARY
     given: Two workspaces with requests and decisions.
     when: A runtime transaction bound to one workspace reads or writes any of them, or the expiry routing read runs.

package/modules/approvals/src/domain/capability.ts

@@ -50,6 +50,18 @@ export interface ApprovalsRequests {
 	 */
 	open(input: OpenApprovalInput): Promise<ApprovalRequest>;
 	get(tenantId: string, id: string): Promise<ApprovalRequest | null>;
+	/**
+	 * The signed token an approved request yields while its window is open:
+	 * what the CLI runner takes as `--grant` and the harness as `grants`. Only
+	 * a request whose `subjectRef` encodes a capability and an input digest
+	 * (`encodeCapabilitySubjectRef`) yields one, and only to the module that
+	 * opened it: `subjectModule` has to match the request's. Null otherwise.
+	 */
+	grant(
+		tenantId: string,
+		id: string,
+		subjectModule: string,
+	): Promise<string | null>;
 	/**
 	 * The first `limit` matches, newest first; two requests opened at the same
 	 * millisecond come in descending id order.