@intelligo-dev/core 1.0.0-beta.1 → 1.0.0-beta.3

package/dist/documents/index.js

@@ -7,7 +7,7 @@
  *
  * Use via subpath import: @intelligo-dev/core/documents
  */
-export { getUserDocuments, getDocument, saveDocument, deleteDocumentVersions, } from "./service";
-export { DocumentServiceError, isDocumentServiceError, } from "./errors";
-export { registerDocumentPatterns, classifyDocumentTitle, isProductDocument, listRegisteredDocumentPatterns, clearDocumentPatternRegistry, } from "./classifier";
+export { getUserDocuments, getDocument, saveDocument, deleteDocumentVersions, } from "./service.js";
+export { DocumentServiceError, isDocumentServiceError, } from "./errors.js";
+export { registerDocumentPatterns, classifyDocumentTitle, isProductDocument, listRegisteredDocumentPatterns, clearDocumentPatternRegistry, } from "./classifier.js";
 //# sourceMappingURL=index.js.map

package/dist/documents/service.d.ts

@@ -22,7 +22,7 @@
  *
  * This module is SERVER-ONLY. Do not import from client components.
  */
-import type { DocumentActor, DocumentFilter, DocumentListItem } from "./types";
+import type { DocumentActor, DocumentFilter, DocumentListItem } from "./types.js";
 /**
  * Get all documents for the actor. Ordered by most recently created
  * first. Uses DISTINCT ON to get the latest version of each document.

package/dist/documents/service.js

@@ -23,10 +23,10 @@
  * This module is SERVER-ONLY. Do not import from client components.
  */
 import { and, desc, eq, gt } from "drizzle-orm";
-import { db } from "../db";
-import { documents } from "../db/schema";
-import { classifyDocumentTitle, isProductDocument } from "./classifier";
-import { DocumentServiceError } from "./errors";
+import { db } from "../db/index.js";
+import { documents } from "../db/schema/index.js";
+import { classifyDocumentTitle, isProductDocument } from "./classifier.js";
+import { DocumentServiceError } from "./errors.js";
 function toListItem(doc) {
     return {
         id: doc.id,

package/dist/email/index.d.ts

@@ -1,5 +1,5 @@
-export { sendEmail, type SendEmailParams, type SendEmailWithComponentParams, type SendEmailResult, } from "./send";
-export { getEmailProvider, resetEmailProviderCache, type EmailProvider, type EmailProviderName, type EmailSendParams, type EmailTemplateRef, ResendProvider, LoopsProvider, ConsoleProvider, } from "./provider";
-export * from "./templates";
-export * from "./senders";
+export { sendEmail, type SendEmailParams, type SendEmailWithComponentParams, type SendEmailResult, } from "./send.js";
+export { getEmailProvider, resetEmailProviderCache, type EmailProvider, type EmailProviderName, type EmailSendParams, type EmailTemplateRef, ResendProvider, LoopsProvider, ConsoleProvider, } from "./provider.js";
+export * from "./templates/index.js";
+export * from "./senders.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/email/index.js

@@ -1,5 +1,5 @@
-export { sendEmail, } from "./send";
-export { getEmailProvider, resetEmailProviderCache, ResendProvider, LoopsProvider, ConsoleProvider, } from "./provider";
-export * from "./templates";
-export * from "./senders";
+export { sendEmail, } from "./send.js";
+export { getEmailProvider, resetEmailProviderCache, ResendProvider, LoopsProvider, ConsoleProvider, } from "./provider.js";
+export * from "./templates/index.js";
+export * from "./senders.js";
 //# sourceMappingURL=index.js.map

package/dist/email/send.d.ts

@@ -1,5 +1,5 @@
 import type React from "react";
-import { type EmailTemplateRef } from "./provider";
+import { type EmailTemplateRef } from "./provider.js";
 export interface SendEmailParams {
     to: string | string[];
     subject: string;

package/dist/email/send.js

@@ -1,5 +1,5 @@
 import { render } from "@react-email/components";
-import { getEmailProvider } from "./provider";
+import { getEmailProvider } from "./provider.js";
 const MAX_ATTEMPTS = 3;
 const BASE_DELAY_MS = 1000;
 /**

package/dist/email/senders.d.ts

@@ -19,7 +19,7 @@
  * (quota-warning / quota-exceeded, trial-warning / trial-depleted) because
  * template providers branch per template, not per variable.
  */
-import { type SendEmailResult } from "./send";
+import { type SendEmailResult } from "./send.js";
 /** Send welcome email after signup (EMAIL-03) */
 export declare function sendWelcomeEmail(params: {
     to: string;

package/dist/email/senders.js

@@ -20,8 +20,8 @@
  * template providers branch per template, not per variable.
  */
 import * as React from "react";
-import { sendEmail } from "./send";
-import { WelcomeEmail, VerifyEmailEmail, PasswordResetEmail, WorkspaceInvitationEmail, QuotaWarningEmail, TrialWarningEmail, TrialExpiryEmail, PaymentFailedEmail, SubscriptionConfirmedEmail, } from "./templates";
+import { sendEmail } from "./send.js";
+import { WelcomeEmail, VerifyEmailEmail, PasswordResetEmail, WorkspaceInvitationEmail, QuotaWarningEmail, TrialWarningEmail, TrialExpiryEmail, PaymentFailedEmail, SubscriptionConfirmedEmail, } from "./templates/index.js";
 // ---------------------------------------------------------------------------
 // Auth Emails
 // ---------------------------------------------------------------------------

package/dist/email/templates/index.d.ts

@@ -1,11 +1,11 @@
-export { BaseLayout, type BaseLayoutProps } from "./base-layout";
-export { WelcomeEmail, type WelcomeEmailProps } from "./welcome";
-export { VerifyEmailEmail, type VerifyEmailEmailProps } from "./verify-email";
-export { PasswordResetEmail, type PasswordResetEmailProps, } from "./password-reset";
-export { WorkspaceInvitationEmail, type WorkspaceInvitationEmailProps, } from "./workspace-invitation";
-export { QuotaWarningEmail, type QuotaWarningEmailProps, } from "./quota-warning";
-export { TrialWarningEmail, type TrialWarningEmailProps, } from "./trial-warning";
-export { PaymentFailedEmail, type PaymentFailedEmailProps, } from "./payment-failed";
-export { SubscriptionConfirmedEmail, type SubscriptionConfirmedEmailProps, } from "./subscription-confirmed";
-export { TrialExpiryEmail, type TrialExpiryEmailProps } from "./trial-expiry";
+export { BaseLayout, type BaseLayoutProps } from "./base-layout.js";
+export { WelcomeEmail, type WelcomeEmailProps } from "./welcome.js";
+export { VerifyEmailEmail, type VerifyEmailEmailProps } from "./verify-email.js";
+export { PasswordResetEmail, type PasswordResetEmailProps, } from "./password-reset.js";
+export { WorkspaceInvitationEmail, type WorkspaceInvitationEmailProps, } from "./workspace-invitation.js";
+export { QuotaWarningEmail, type QuotaWarningEmailProps, } from "./quota-warning.js";
+export { TrialWarningEmail, type TrialWarningEmailProps, } from "./trial-warning.js";
+export { PaymentFailedEmail, type PaymentFailedEmailProps, } from "./payment-failed.js";
+export { SubscriptionConfirmedEmail, type SubscriptionConfirmedEmailProps, } from "./subscription-confirmed.js";
+export { TrialExpiryEmail, type TrialExpiryEmailProps } from "./trial-expiry.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/email/templates/index.js

@@ -4,14 +4,14 @@
 // All React Email templates with Intelligo branding. Each template wraps
 // content in BaseLayout for consistent styling.
 // ---------------------------------------------------------------------------
-export { BaseLayout } from "./base-layout";
-export { WelcomeEmail } from "./welcome";
-export { VerifyEmailEmail } from "./verify-email";
-export { PasswordResetEmail, } from "./password-reset";
-export { WorkspaceInvitationEmail, } from "./workspace-invitation";
-export { QuotaWarningEmail, } from "./quota-warning";
-export { TrialWarningEmail, } from "./trial-warning";
-export { PaymentFailedEmail, } from "./payment-failed";
-export { SubscriptionConfirmedEmail, } from "./subscription-confirmed";
-export { TrialExpiryEmail } from "./trial-expiry";
+export { BaseLayout } from "./base-layout.js";
+export { WelcomeEmail } from "./welcome.js";
+export { VerifyEmailEmail } from "./verify-email.js";
+export { PasswordResetEmail, } from "./password-reset.js";
+export { WorkspaceInvitationEmail, } from "./workspace-invitation.js";
+export { QuotaWarningEmail, } from "./quota-warning.js";
+export { TrialWarningEmail, } from "./trial-warning.js";
+export { PaymentFailedEmail, } from "./payment-failed.js";
+export { SubscriptionConfirmedEmail, } from "./subscription-confirmed.js";
+export { TrialExpiryEmail } from "./trial-expiry.js";
 //# sourceMappingURL=index.js.map

package/dist/email/templates/password-reset.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button, Text } from "@react-email/components";
-import { BaseLayout } from "./base-layout";
+import { BaseLayout } from "./base-layout.js";
 export function PasswordResetEmail({ userName, resetUrl, locale = "en", }) {
     const text = locale === "mn"
         ? {

package/dist/email/templates/payment-failed.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button, Text } from "@react-email/components";
-import { BaseLayout } from "./base-layout";
+import { BaseLayout } from "./base-layout.js";
 export function PaymentFailedEmail({ workspaceName, amount, updatePaymentUrl, locale = "en", }) {
     const text = locale === "mn"
         ? {

package/dist/email/templates/quota-warning.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { Button, Text } from "@react-email/components";
-import { BaseLayout } from "./base-layout";
+import { BaseLayout } from "./base-layout.js";
 export function QuotaWarningEmail({ workspaceName, percentageUsed, tokensUsed, tokensLimit, upgradeUrl, isExceeded, locale = "en", }) {
     const text = locale === "mn"
         ? {

package/dist/email/templates/subscription-confirmed.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button, Text } from "@react-email/components";
-import { BaseLayout } from "./base-layout";
+import { BaseLayout } from "./base-layout.js";
 export function SubscriptionConfirmedEmail({ workspaceName, planName, amount, dashboardUrl, locale = "en", }) {
     const text = locale === "mn"
         ? {

package/dist/email/templates/trial-expiry.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { Button, Text } from "@react-email/components";
-import { BaseLayout } from "./base-layout";
+import { BaseLayout } from "./base-layout.js";
 export function TrialExpiryEmail({ workspaceName, expiryDate, daysRemaining, upgradeUrl, locale = "en", }) {
     const isExpired = daysRemaining <= 0;
     const isUrgent = daysRemaining <= 1 && daysRemaining > 0;

package/dist/email/templates/trial-warning.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { Button, Text } from "@react-email/components";
-import { BaseLayout } from "./base-layout";
+import { BaseLayout } from "./base-layout.js";
 export function TrialWarningEmail({ workspaceName, creditsRemaining, totalCredits, percentageRemaining, upgradeUrl, isDepleted, locale = "en", }) {
     const text = locale === "mn"
         ? {

package/dist/email/templates/verify-email.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button, Text } from "@react-email/components";
-import { BaseLayout } from "./base-layout";
+import { BaseLayout } from "./base-layout.js";
 export function VerifyEmailEmail({ userName, verificationUrl, locale = "en", }) {
     const text = locale === "mn"
         ? {

package/dist/email/templates/welcome.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button, Text } from "@react-email/components";
-import { BaseLayout } from "./base-layout";
+import { BaseLayout } from "./base-layout.js";
 export function WelcomeEmail({ userName, dashboardUrl, locale = "en", }) {
     const text = locale === "mn"
         ? {

package/dist/email/templates/workspace-invitation.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button, Section, Text } from "@react-email/components";
-import { BaseLayout } from "./base-layout";
+import { BaseLayout } from "./base-layout.js";
 export function WorkspaceInvitationEmail({ inviterName, workspaceName, role, acceptUrl, declineUrl, locale = "en", }) {
     const text = locale === "mn"
         ? {

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA2EH,wBAAgB,WAAW,IAAI;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CA8CA;AAED;;;GAGG;AACH,wBAAgB,SAAS,IAAI,IAAI,CAgBhC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA4EH,wBAAgB,WAAW,IAAI;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CA4DA;AAED;;;GAGG;AACH,wBAAgB,SAAS,IAAI,IAAI,CAgBhC"}

package/dist/env.js

@@ -15,9 +15,9 @@ const ENV_VARS = [
         description: "PostgreSQL connection string",
     },
     {
-        name: "AUTH_SECRET",
+        name: "BETTER_AUTH_SECRET",
         required: true,
-        description: "Better-Auth session encryption key",
+        description: "Better-Auth session encryption key (AUTH_SECRET is accepted as a legacy alias)",
         minLength: 32,
     },
     {
@@ -75,7 +75,16 @@ export function validateEnv() {
     const errors = [];
     const warnings = [];
     for (const envVar of ENV_VARS) {
-        const value = process.env[envVar.name];
+        let value = process.env[envVar.name];
+        // One canonical name for the auth secret. Better-Auth itself reads
+        // BETTER_AUTH_SECRET then AUTH_SECRET; the CLI's doctor, the
+        // scaffold and this validator agree on the former.
+        if (envVar.name === "BETTER_AUTH_SECRET" &&
+            !value &&
+            process.env.AUTH_SECRET) {
+            value = process.env.AUTH_SECRET;
+            warnings.push("AUTH_SECRET is set but BETTER_AUTH_SECRET is not — rename it; AUTH_SECRET is a legacy alias");
+        }
         if (!value || value.trim() === "") {
             if (envVar.required) {
                 errors.push(`Missing required env var: ${envVar.name} — ${envVar.description}`);
@@ -101,10 +110,11 @@ export function validateEnv() {
             warnings.push("STRIPE_SECRET_KEY is a test key in production environment");
         }
         if (!process.env.CRON_SECRET || process.env.CRON_SECRET.length < 32) {
-            // Promote to error in production — an unset or weak cron secret
-            // means the cron endpoints are wide open to anyone who guesses
-            // the path.
-            errors.push("CRON_SECRET must be set (≥32 chars) in production for /api/cron/* auth");
+            // A warning, not an error: the framework ships no cron route of
+            // its own, so a deployment without one has nothing to protect.
+            // The maintenance route (`intelligo add maintenance`) refuses to
+            // serve without it.
+            warnings.push("CRON_SECRET unset or shorter than 32 chars — required by any /api/cron/* route you mount");
         }
     }
     return { valid: errors.length === 0, errors, warnings };

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,MAAM,QAAQ,GAAa;IACzB;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,oCAAoC;QACjD,SAAS,EAAE,EAAE;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,qCAAqC;KACnD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EACT,+EAA+E;KAClF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8DAA8D;KAC5E;IACD,gEAAgE;IAChE,gEAAgE;IAChE,+DAA+D;IAC/D,8DAA8D;IAC9D;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,2CAA2C;QACxD,SAAS,EAAE,EAAE;KACd;CACF,CAAC;AAEF,MAAM,UAAU,WAAW;IAKzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CACT,6BAA6B,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,CACnE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CACX,6BAA6B,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,CACnE,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,oBAAoB,MAAM,CAAC,SAAS,yBAAyB,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5G,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CACX,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpE,gEAAgE;YAChE,+DAA+D;YAC/D,YAAY;YACZ,MAAM,CAAC,IAAI,CACT,wEAAwE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;IAElD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,CAAC,MAAM,oDAAoD,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,MAAM,QAAQ,GAAa;IACzB;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,IAAI;QACd,WAAW,EACT,gFAAgF;QAClF,SAAS,EAAE,EAAE;KACd;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,qCAAqC;KACnD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EACT,+EAA+E;KAClF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8DAA8D;KAC5E;IACD,gEAAgE;IAChE,gEAAgE;IAChE,+DAA+D;IAC/D,8DAA8D;IAC9D;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,2CAA2C;QACxD,SAAS,EAAE,EAAE;KACd;CACF,CAAC;AAEF,MAAM,UAAU,WAAW;IAKzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,mEAAmE;QACnE,6DAA6D;QAC7D,mDAAmD;QACnD,IACE,MAAM,CAAC,IAAI,KAAK,oBAAoB;YACpC,CAAC,KAAK;YACN,OAAO,CAAC,GAAG,CAAC,WAAW,EACvB,CAAC;YACD,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAChC,QAAQ,CAAC,IAAI,CACX,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CACT,6BAA6B,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,CACnE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CACX,6BAA6B,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,CACnE,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,oBAAoB,MAAM,CAAC,SAAS,yBAAyB,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5G,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CACX,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpE,gEAAgE;YAChE,+DAA+D;YAC/D,iEAAiE;YACjE,oBAAoB;YACpB,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;IAElD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,CAAC,MAAM,oDAAoD,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/audit.d.ts

@@ -22,7 +22,7 @@
  * Not re-exported from `./index.ts`: it is this module's own
  * implementation detail, not identity's public API.
  */
-import type { AuditTargetKind, AuditAction, AuditActorKind, UserMemoryAuditRow } from "../db/schema";
+import type { AuditTargetKind, AuditAction, AuditActorKind, UserMemoryAuditRow } from "../db/schema/index.js";
 export type RecordMemoryAuditInput = {
     userId: string;
     workspaceId: string;

package/dist/identity/audit.js

@@ -22,9 +22,9 @@
  * Not re-exported from `./index.ts`: it is this module's own
  * implementation detail, not identity's public API.
  */
-import { db } from "../db";
-import { userMemoryAudit } from "../db/schema";
-import { IdentityServiceError } from "./errors";
+import { db } from "../db/index.js";
+import { userMemoryAudit } from "../db/schema/index.js";
+import { IdentityServiceError } from "./errors.js";
 export async function recordMemoryAudit(input) {
     const [row] = await db
         .insert(userMemoryAudit)

package/dist/identity/index.d.ts

@@ -10,7 +10,7 @@
  *
  * Use via subpath import: @intelligo-dev/core/identity
  */
-export { listFacts, deleteFact, exportIdentity, getAuditTrail, } from "./service";
-export { IdentityServiceError, isIdentityServiceError, type IdentityServiceErrorCode, } from "./errors";
-export type { IdentityActor, IdentityExport, UserFact, UserMemory, UserProfileSnapshot, UserMemoryAuditRow, } from "./types";
+export { listFacts, deleteFact, exportIdentity, getAuditTrail, } from "./service.js";
+export { IdentityServiceError, isIdentityServiceError, type IdentityServiceErrorCode, } from "./errors.js";
+export type { IdentityActor, IdentityExport, UserFact, UserMemory, UserProfileSnapshot, UserMemoryAuditRow, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/index.js

@@ -10,6 +10,6 @@
  *
  * Use via subpath import: @intelligo-dev/core/identity
  */
-export { listFacts, deleteFact, exportIdentity, getAuditTrail, } from "./service";
-export { IdentityServiceError, isIdentityServiceError, } from "./errors";
+export { listFacts, deleteFact, exportIdentity, getAuditTrail, } from "./service.js";
+export { IdentityServiceError, isIdentityServiceError, } from "./errors.js";
 //# sourceMappingURL=index.js.map

package/dist/identity/service.d.ts

@@ -41,8 +41,8 @@
  *
  * This module is SERVER-ONLY. Do not import from client components.
  */
-import type { UserFact, UserMemoryAuditRow } from "../db/schema";
-import type { IdentityActor, IdentityExport } from "./types";
+import type { UserFact, UserMemoryAuditRow } from "../db/schema/index.js";
+import type { IdentityActor, IdentityExport } from "./types.js";
 /** List the actor's facts, most important and most confident first. */
 export declare function listFacts(actor: IdentityActor): Promise<UserFact[]>;
 /**

package/dist/identity/service.js

@@ -42,10 +42,10 @@
  * This module is SERVER-ONLY. Do not import from client components.
  */
 import { and, desc, eq } from "drizzle-orm";
-import { db } from "../db";
-import { userFacts, userMemories, userProfileSnapshots, userMemoryAudit, } from "../db/schema";
-import { recordMemoryAudit } from "./audit";
-import { IdentityServiceError } from "./errors";
+import { db } from "../db/index.js";
+import { userFacts, userMemories, userProfileSnapshots, userMemoryAudit, } from "../db/schema/index.js";
+import { recordMemoryAudit } from "./audit.js";
+import { IdentityServiceError } from "./errors.js";
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------

package/dist/identity/types.d.ts

@@ -1,7 +1,7 @@
 /**
  * Shared types for the identity service.
  */
-import type { UserFact, UserMemory, UserProfileSnapshot, UserMemoryAuditRow } from "../db/schema";
+import type { UserFact, UserMemory, UserProfileSnapshot, UserMemoryAuditRow } from "../db/schema/index.js";
 export type { UserFact, UserMemory, UserProfileSnapshot, UserMemoryAuditRow };
 /** Resolved actor identity — every query is scoped to this pair. */
 export type IdentityActor = {

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export declare const version = "0.0.0";
-export * from "./db";
+export * from "./db/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,6 +1,6 @@
 export const version = "0.0.0";
 // Re-export database client
-export * from "./db";
+export * from "./db/index.js";
 // Email module -- use subpath import: @intelligo-dev/core/email
 // Notifications module -- use subpath import: @intelligo-dev/core/notifications
 // Conversations module -- use subpath import: @intelligo-dev/core/conversations

package/dist/notifications/index.d.ts

@@ -8,9 +8,9 @@
  * Notifications are user-scoped (not workspace-scoped) so a user can see
  * all their notifications across workspaces.
  */
-import type { CreateNotificationParams } from "./types";
-export type { NotificationType, CreateNotificationParams } from "./types";
-export { triggerQuotaNotification, triggerTrialNotification, triggerPaymentFailedNotification, triggerTeamMemberJoinedNotification, } from "./triggers";
+import type { CreateNotificationParams } from "./types.js";
+export type { NotificationType, CreateNotificationParams } from "./types.js";
+export { triggerQuotaNotification, triggerTrialNotification, triggerPaymentFailedNotification, triggerTeamMemberJoinedNotification, } from "./triggers.js";
 /**
  * Create a new notification for a user
  *

package/dist/notifications/index.js

@@ -8,11 +8,11 @@
  * Notifications are user-scoped (not workspace-scoped) so a user can see
  * all their notifications across workspaces.
  */
-import { db } from "../db";
-import { notifications } from "../db/schema";
+import { db } from "../db/index.js";
+import { notifications } from "../db/schema/index.js";
 import { eq, and, desc, count } from "drizzle-orm";
 // Re-export trigger functions
-export { triggerQuotaNotification, triggerTrialNotification, triggerPaymentFailedNotification, triggerTeamMemberJoinedNotification, } from "./triggers";
+export { triggerQuotaNotification, triggerTrialNotification, triggerPaymentFailedNotification, triggerTeamMemberJoinedNotification, } from "./triggers.js";
 /**
  * Create a new notification for a user
  *

package/dist/notifications/triggers.js

@@ -16,8 +16,8 @@
  * - Payment failed trigger is called by billing email triggers
  * - Team member joined trigger is called by server actions
  */
-import { createNotification } from "./index";
-import { sendQuotaWarningEmail, sendTrialWarningEmail, sendPaymentFailedEmail, } from "../email/senders";
+import { createNotification } from "./index.js";
+import { sendQuotaWarningEmail, sendTrialWarningEmail, sendPaymentFailedEmail, } from "../email/senders.js";
 // ---------------------------------------------------------------------------
 // Quota Notifications (QUOTA-08, QUOTA-09)
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intelligo-dev/core",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.3",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -96,6 +96,6 @@
     "db:studio": "drizzle-kit studio",
     "db:push": "drizzle-kit push",
     "db:check": "tsx scripts/check-db.ts",
-    "build": "tsc -p tsconfig.build.json"
+    "build": "tsc -p tsconfig.build.json && node ../../scripts/fix-esm-extensions.mjs dist"
   }
 }

package/src/db/migrations/0041_audit_events_append_only.sql

@@ -0,0 +1,55 @@
+-- audit_events becomes what its package name promises.
+--
+-- Two gaps between the contract ("append-only who-did-what") and the
+-- table 0036 created:
+--   1. Nothing at the database level stopped UPDATE/DELETE. The guard
+--      user_memory_audit has had since 0018 (P0001 raise_exception,
+--      PII-free message) is applied here too.
+--   2. workspace_id cascaded on organization delete, erasing a
+--      workspace's whole trail with the workspace. It is now SET NULL:
+--      the row survives with its actor, action and resource intact.
+
+-- The one UPDATE that must pass is the database's own: ON DELETE SET
+-- NULL on workspace_id / actor_id is executed as an UPDATE of this row,
+-- so a trigger that refuses every UPDATE would make a workspace (or a
+-- user) with any audit history undeletable. An update that only clears
+-- one or both of those references, and touches nothing else, is
+-- allowed; every other UPDATE, and every DELETE, is refused.
+CREATE OR REPLACE FUNCTION public.audit_events_block_mutation()
+	RETURNS trigger AS $$
+BEGIN
+	IF TG_OP = 'UPDATE'
+		AND (NEW.workspace_id IS NULL OR NEW.workspace_id = OLD.workspace_id)
+		AND (NEW.actor_id IS NULL OR NEW.actor_id = OLD.actor_id)
+		AND (NEW.workspace_id IS DISTINCT FROM OLD.workspace_id OR NEW.actor_id IS DISTINCT FROM OLD.actor_id)
+		AND NEW.id = OLD.id
+		AND NEW.actor_kind = OLD.actor_kind
+		AND NEW.action = OLD.action
+		AND NEW.resource_kind = OLD.resource_kind
+		AND NEW.resource_id IS NOT DISTINCT FROM OLD.resource_id
+		AND NEW.outcome = OLD.outcome
+		AND NEW.metadata IS NOT DISTINCT FROM OLD.metadata
+		AND NEW.created_at = OLD.created_at
+	THEN
+		RETURN NEW;
+	END IF;
+	RAISE EXCEPTION 'audit_events is append-only'
+		USING ERRCODE = 'P0001', HINT = 'INSERT new audit rows; do not UPDATE or DELETE existing ones.';
+END;
+$$ LANGUAGE plpgsql;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS audit_events_no_update ON "audit_events";
+--> statement-breakpoint
+CREATE TRIGGER audit_events_no_update
+	BEFORE UPDATE ON "audit_events"
+	FOR EACH ROW EXECUTE FUNCTION public.audit_events_block_mutation();
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS audit_events_no_delete ON "audit_events";
+--> statement-breakpoint
+CREATE TRIGGER audit_events_no_delete
+	BEFORE DELETE ON "audit_events"
+	FOR EACH ROW EXECUTE FUNCTION public.audit_events_block_mutation();
+--> statement-breakpoint
+ALTER TABLE "audit_events" DROP CONSTRAINT IF EXISTS "audit_events_workspace_id_organization_id_fk";
+--> statement-breakpoint
+ALTER TABLE "audit_events" ADD CONSTRAINT "audit_events_workspace_id_organization_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."organization"("id") ON DELETE set null ON UPDATE no action;

package/src/db/migrations/0042_sessions_active_organization_id.sql

@@ -0,0 +1,10 @@
+-- sessions.active_organization_id — the workspace a session last
+-- switched to (Better-Auth's organization plugin; @intelligo-dev/auth
+-- reads it for workspace switching). schema/auth.ts has carried the
+-- column for months, but no migration ever created it: every
+-- environment was provisioned by `db:push`, so the gap surfaced only
+-- when a database was built from this chain and the first sign-in
+-- failed inserting a session.
+--
+-- IF NOT EXISTS, because every pushed database already has it.
+ALTER TABLE "sessions" ADD COLUMN IF NOT EXISTS "active_organization_id" text;

package/src/db/migrations/README.md

@@ -13,6 +13,37 @@ That is how `0032` shipped documenting a unique constraint on a
 files. `0037` repairs it, and `intelligo doctor` now fails CI if the
 journal and the directory drift apart again.
 
+## In a consumer application
+
+This directory ships inside the published package (it is in `files`,
+next to `dist`), and `intelligo migrate` applies it: it resolves the
+chain from `node_modules/@intelligo-dev/core/src/db/migrations`, runs
+drizzle's migrator over it in journal order, and records what it applied
+in the default `drizzle.__drizzle_migrations` table — the same table
+`intelligo migrate --check` reads. On a database that already has the
+framework's tables but no records (one provisioned with `db:push`) it
+refuses and points here; baseline first, below.
+
+The tables an application owns are a second chain, kept apart on
+purpose: drizzle-kit applies by timestamp, so a framework migration
+published after the consumer generated one of theirs would be skipped
+silently if the two shared a journal. `intelligo create` scaffolds a
+`drizzle.config.ts` whose `schema` lists only the consumer's files,
+whose `out` is the app's own `./drizzle`, and whose `migrations.table`
+is `__app_migrations`. A consumer schema file may `references()` a
+framework table — drizzle-kit emits the foreign key by name and does
+not try to create the referenced table. The scaffold's scripts:
+
+```
+pnpm db:generate   # drizzle-kit generate           — your chain
+pnpm db:migrate    # intelligo migrate && drizzle-kit migrate
+pnpm db:check      # intelligo migrate --check      — deploy gate
+```
+
+`drizzle-kit push` has no place in this layout: it diffs the whole
+database against the schema it can see, and the consumer config sees
+only the consumer's tables.
+
 ## Adding a migration
 
 Prefer `pnpm --filter @intelligo-dev/core db:generate`, which writes both

package/src/db/migrations/meta/_journal.json

@@ -295,6 +295,20 @@
       "when": 1700000041000,
       "tag": "0040_ee_audit_chain",
       "breakpoints": true
+    },
+    {
+      "idx": 42,
+      "version": "7",
+      "when": 1788096433043,
+      "tag": "0041_audit_events_append_only",
+      "breakpoints": true
+    },
+    {
+      "idx": 43,
+      "version": "7",
+      "when": 1788180862360,
+      "tag": "0042_sessions_active_organization_id",
+      "breakpoints": true
     }
   ]
 }