@kelpie/server 0.1.0

package/README.md

@@ -0,0 +1,57 @@
+# @kelpie/server
+
+The [Kelpie](https://github.com/velvet-tiger/kelpie) service as a library.
+
+Kelpie is an open-source, agent-native CRM and company brain. This package holds the module runtime, the core CRM modules, the REST API, the MCP surface, and the shared migration pipeline.
+
+It is a library, not a program. Importing it starts nothing. You compose an **assembly**: a small app that lists its modules, wires its dependencies, and serves. That is what lets a self-hosted deployment and a commercial one run the same core with different module lists.
+
+## Install
+
+```bash
+npm install @kelpie/server @hono/node-server
+```
+
+Needs Node 24 or newer and a Postgres it can reach through `DATABASE_URL`.
+
+## Use
+
+```ts
+import { serve } from '@hono/node-server'
+import { connectDatabase, createApp, createEventBus, createIdFactory, createLogger, loadConfig, registerModules, runMigrations } from '@kelpie/server'
+
+import { modules } from './kelpie.config.ts'
+
+const config = loadConfig(process.env)
+const logger = createLogger(config.logLevel)
+const database = connectDatabase(config.databaseUrl, logger)
+const events = createEventBus(logger)
+
+const contributions = await registerModules({ modules, environment: process.env, logger, events, /* … */ })
+
+await runMigrations(database.db, contributions.schemas, logger)
+
+const app = createApp({ logger, probeDatabase: database.probe, contributions, /* … */ })
+
+serve({ fetch: app.fetch, port: config.port })
+```
+
+Registration runs before migrations. Modules declare their migrations directory while registering, so there is nothing to migrate until that pass has finished.
+
+The full entry point, including shutdown and error handling, is [`apps/kelpie/src/server.ts`](https://github.com/velvet-tiger/kelpie/blob/main/apps/kelpie/src/server.ts). Start from that rather than from the sketch above.
+
+## Migrations
+
+The package ships its migrations. `coreMigrationsDirectory` points at them, and `runMigrations` applies them per module at boot. Nothing else has to be installed to get a working schema.
+
+## Testing
+
+`@kelpie/server/testing` exports the harness the core suite uses: an app factory, a database connection helper, workspace fixtures, and a typed request client. A module's own tests can use the same tools.
+
+```ts
+import { createTestApp, insertWorkspaceFixture } from '@kelpie/server/testing'
+```
+
+## Licence
+
+AGPL-3.0-only. Running a modified version as a network service obliges you to offer its source to users.

package/dist/app.d.ts

@@ -0,0 +1,36 @@
+import { Hono } from 'hono';
+import type { DatabaseProbe } from './lib/database.ts';
+import type { IdFactory } from './lib/ids.ts';
+import type { Logger } from './lib/logger.ts';
+import type { CredentialDependencies } from './modules/auth/credentials.ts';
+import type { ModuleContributions } from './runtime/registry.ts';
+/**
+ * Builds the HTTP application. Everything it touches arrives as a dependency, so
+ * the app can be exercised without a database or a listening socket.
+ */
+export interface AppDependencies {
+    readonly logger: Logger;
+    readonly probeDatabase: () => Promise<DatabaseProbe>;
+    /** Produced by the registration pass. Routers mount under `/v1`. */
+    readonly contributions: ModuleContributions;
+    /**
+     * What `/mcp` checks a bearer key against. The REST routes resolve their own
+     * actor inside each module; the MCP endpoint is mounted here rather than by a
+     * module, because its tools come from every module and the last of those has to
+     * have registered before the listing exists.
+     */
+    readonly credentials: CredentialDependencies;
+    /** Injected so tests can pin the id echoed on responses. */
+    readonly generateRequestId?: () => string;
+    /** Injected so tests can pin the ids `idempotencyMiddleware` reserves rows under. */
+    readonly createId?: IdFactory;
+}
+/** Per-request values the middleware chain sets and handlers read. */
+export interface AppBindings {
+    Variables: {
+        requestId: string;
+        logger: Logger;
+    };
+}
+export declare function createApp(dependencies: AppDependencies): Hono<AppBindings>;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAItD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAI3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAEhE;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IACpD,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAA;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAA;IAC5C,4DAA4D;IAC5D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAA;IACzC,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAC9B;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE;QACT,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAqBD,wBAAgB,SAAS,CAAC,YAAY,EAAE,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,CA2F1E"}

package/dist/app.js

@@ -0,0 +1,98 @@
+import { Hono } from 'hono';
+import { cors } from 'hono/cors';
+import { AppError, internalErrorBody, toErrorBody } from './lib/errors.js';
+import { PUBLIC_ROUTE_PREFIX } from './lib/http.js';
+import { createIdFactory } from './lib/ids.js';
+import { MCP_INSTRUCTIONS, MCP_ROUTE_PREFIX, MCP_SERVER_INFO } from './modules/mcp/index.js';
+import { createMcpEndpoint } from './modules/mcp/router.js';
+import { createIdempotencyMiddleware } from './modules/workspace/idempotencyMiddleware.js';
+const REQUEST_ID_HEADER = 'X-Request-Id';
+/**
+ * Any origin, because a public endpoint exists to be called from a customer's
+ * own website and Kelpie does not know that site's address.
+ *
+ * `credentials` stays off, which is what keeps this safe: a browser will not
+ * attach the session cookie to these requests, so an embedded form on an
+ * attacker's page cannot borrow a signed-in reader's identity. A public handler
+ * has no `Actor` in any case (`runtime/module.ts`).
+ */
+const PUBLIC_CORS = cors({
+    origin: '*',
+    allowMethods: ['GET', 'POST', 'OPTIONS'],
+    allowHeaders: ['Content-Type'],
+    credentials: false,
+    maxAge: 86_400,
+});
+export function createApp(dependencies) {
+    const generateRequestId = dependencies.generateRequestId ?? (() => crypto.randomUUID());
+    const createId = dependencies.createId ?? createIdFactory();
+    const app = new Hono();
+    app.use('*', async (context, next) => {
+        const requestId = context.req.header(REQUEST_ID_HEADER) ?? generateRequestId();
+        const logger = dependencies.logger.child({ requestId });
+        context.set('requestId', requestId);
+        context.set('logger', logger);
+        context.header(REQUEST_ID_HEADER, requestId);
+        const startedAt = performance.now();
+        await next();
+        logger.info('request', {
+            method: context.req.method,
+            path: context.req.path,
+            status: context.res.status,
+            durationMs: Math.round(performance.now() - startedAt),
+        });
+    });
+    // Every module's `POST` gets this the same way, decided once here rather than
+    // per route (`api.md`). It skips `/v1/public/*` itself — a public request has
+    // no `Actor` to scope a key to — so it is mounted ahead of the public CORS
+    // middleware without conflicting with it.
+    app.use('/v1/*', createIdempotencyMiddleware({
+        db: dependencies.credentials.db,
+        now: dependencies.credentials.now,
+        createId,
+        credentials: dependencies.credentials,
+        log: dependencies.logger,
+    }));
+    // Public first. `/v1/public/...` cannot collide with a `/v1` route unless a
+    // module names a resource `public`, and mounting in this order means the CORS
+    // middleware is attached before anything can answer under the prefix.
+    app.use(`${PUBLIC_ROUTE_PREFIX}/*`, PUBLIC_CORS);
+    for (const { router } of dependencies.contributions.publicRouters) {
+        app.route(PUBLIC_ROUTE_PREFIX, router);
+    }
+    for (const { router } of dependencies.contributions.routers) {
+        app.route('/v1', router);
+    }
+    const mcp = createMcpEndpoint({
+        ...dependencies.credentials,
+        tools: dependencies.contributions.mcpTools,
+        serverInfo: MCP_SERVER_INFO,
+        instructions: MCP_INSTRUCTIONS,
+        logger: dependencies.logger,
+    });
+    app.route(MCP_ROUTE_PREFIX, mcp.transport);
+    app.route('/v1', mcp.catalog);
+    app.onError((error, context) => {
+        if (error instanceof AppError) {
+            return context.json(toErrorBody(error), error.status);
+        }
+        context.get('logger').error('unhandled error', {
+            method: context.req.method,
+            path: context.req.path,
+            error: error.message,
+            stack: error.stack,
+        });
+        return context.json(internalErrorBody(), 500);
+    });
+    app.notFound((context) => context.json(toErrorBody(AppError.notFound()), 404));
+    app.get('/healthz', async (context) => {
+        const probe = await dependencies.probeDatabase();
+        if (!probe.reachable) {
+            context.get('logger').error('database unreachable', { reason: probe.reason });
+            return context.json({ status: 'degraded', database: 'down' }, 503);
+        }
+        return context.json({ status: 'ok', database: 'up' }, 200);
+    });
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGhC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAI9C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAA;AAkC1F,MAAM,iBAAiB,GAAG,cAAc,CAAA;AAExC;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,GAAG;IACX,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;IACxC,YAAY,EAAE,CAAC,cAAc,CAAC;IAC9B,WAAW,EAAE,KAAK;IAClB,MAAM,EAAE,MAAM;CACf,CAAC,CAAA;AAEF,MAAM,UAAU,SAAS,CAAC,YAA6B;IACrD,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;IACvF,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAA;IAC3D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAe,CAAA;IAEnC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,EAAE,CAAA;QAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAEvD,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC7B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAA;QAE5C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,IAAI,EAAE,CAAA;QAEZ,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE;YACrB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;SACtD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,0CAA0C;IAC1C,GAAG,CAAC,GAAG,CACL,OAAO,EACP,2BAA2B,CAAC;QAC1B,EAAE,EAAE,YAAY,CAAC,WAAW,CAAC,EAAE;QAC/B,GAAG,EAAE,YAAY,CAAC,WAAW,CAAC,GAAG;QACjC,QAAQ;QACR,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,GAAG,EAAE,YAAY,CAAC,MAAM;KACzB,CAAC,CACH,CAAA;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,GAAG,mBAAmB,IAAI,EAAE,WAAW,CAAC,CAAA;IAEhD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,GAAG,YAAY,CAAC,WAAW;QAC3B,KAAK,EAAE,YAAY,CAAC,aAAa,CAAC,QAAQ;QAC1C,UAAU,EAAE,eAAe;QAC3B,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;IAC1C,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAE7B,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE;YAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAA;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAE9E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,CAAA;QAEhD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC7E,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,46 @@
+export { createApp } from './app.ts';
+export type { AppDependencies } from './app.ts';
+export { ConfigurationError, loadConfig } from './lib/config.ts';
+export type { Environment, KelpieConfig, LogLevel, RuntimeMode } from './lib/config.ts';
+export { ModuleConfigFileError, readModuleConfigFile } from './lib/moduleConfig.ts';
+export { FOREIGN_KEY_VIOLATION, RESTRICT_VIOLATION, UNIQUE_VIOLATION, connectDatabase, isReferenceViolation, postgresErrorCode, } from './lib/database.ts';
+export type { Database, DatabaseConnection, DatabaseProbe } from './lib/database.ts';
+export * as schema from './schema/index.ts';
+export { createEmailSender, createLogEmailSender, emailConfigSchema } from './lib/email.ts';
+export type { EmailConfig, EmailMessage, EmailSender } from './lib/email.ts';
+export { MINIMUM_PASSWORD_LENGTH, hashPassword, isPasswordStrongEnough, verifyPassword } from './lib/passwords.ts';
+export { generateToken, hashToken, tokenHashesMatch } from './lib/tokens.ts';
+export { SecretDecryptionError, createSecretCipher, secretEncryptionConfigSchema, } from './lib/secrets.ts';
+export type { SecretCipher, SecretEncryptionConfig } from './lib/secrets.ts';
+export { AppError, describeThrown, describeValidationIssue, internalErrorBody, toErrorBody, toErrorDetails, } from './lib/errors.ts';
+export type { ErrorBody, ErrorCode, ErrorDetail, ErrorStatus, ValidationIssue } from './lib/errors.ts';
+export { createIdFactory, idPrefixes } from './lib/ids.ts';
+export type { IdFactory, ObjectKind } from './lib/ids.ts';
+export { createLogger } from './lib/logger.ts';
+export type { LogFields, Logger, LogSink } from './lib/logger.ts';
+export type { KelpieModule, McpTool, McpToolDefinition, McpToolRegistry, ModuleCatalogEntry, ModuleContext, SchemaContribution, } from './runtime/module.ts';
+export { ModuleBootError, orderModules } from './runtime/order.ts';
+export { createEntitlementRegistry, limitFor, requireCapability } from './runtime/entitlements.ts';
+export type { Capability, Entitlement, EntitlementRegistry, FlagCapability, GrantProvider, LimitCapability, } from './runtime/entitlements.ts';
+export { SEATS_LIMIT } from './modules/workspace/capabilities.ts';
+export { DOMAIN_EVENT_NAMES, RECORD_OBJECT_TYPES, createEventBus } from './runtime/events.ts';
+export type { DomainEventName, DomainEvents, EventBus, EventHandler, RecordObjectType, StagedObjectType, } from './runtime/events.ts';
+export { createTransactionScope } from './runtime/transaction.ts';
+export type { BufferedEvents, Transaction, TransactionContext, TransactionScope, TransactionScopeDependencies, } from './runtime/transaction.ts';
+export { planMigrations, runMigrations } from './runtime/migrate.ts';
+export type { MigrationPlanStep } from './runtime/migrate.ts';
+export { coreMigrationsDirectory, coreModules } from './modules/core.ts';
+export { resealStoredSecrets } from './modules/reseal.ts';
+export type { ResealColumnOutcome, ResealOutcome } from './modules/reseal.ts';
+export { KEY_KINDS, kindOfSecret, mintKey, parseKeyKind, readBearerToken } from './modules/api-keys/keys.ts';
+export type { KeyKind, MintedKey } from './modules/api-keys/keys.ts';
+export { registerModules } from './runtime/registry.ts';
+export type { ModuleContributions, ModuleRouter, ModuleRuntimeOptions } from './runtime/registry.ts';
+export type { ModuleServices } from './runtime/module.ts';
+export type { Actor, ApiKeyActor, SessionActor } from './modules/auth/actor.ts';
+export { actorUserId, actorWorkspaceId, requireSessionActor } from './modules/auth/actor.ts';
+export { resolveActor, resolveActorFrom } from './modules/auth/credentials.ts';
+export type { CredentialDependencies } from './modules/auth/credentials.ts';
+export { MEMBER_ROLES, INVITABLE_ROLES, parseMemberRole, roleAllows } from './modules/workspace/roles.ts';
+export type { InvitableRole, MemberRole } from './modules/workspace/roles.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE/C,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAChE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEvF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAEnF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEpF,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAE3C,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC3F,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5E,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAE5E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAE5E,OAAO,EACL,QAAQ,EACR,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEtG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC1D,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAEjE,YAAY,EACV,YAAY,EACZ,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAElE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClG,YAAY,EACV,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AAEjE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC7F,YAAY,EACV,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,YAAY,EACV,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpE,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAE7E,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5G,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACpG,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAC9E,YAAY,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzG,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/index.js

@@ -0,0 +1,26 @@
+export { createApp } from './app.js';
+export { ConfigurationError, loadConfig } from './lib/config.js';
+export { ModuleConfigFileError, readModuleConfigFile } from './lib/moduleConfig.js';
+export { FOREIGN_KEY_VIOLATION, RESTRICT_VIOLATION, UNIQUE_VIOLATION, connectDatabase, isReferenceViolation, postgresErrorCode, } from './lib/database.js';
+export * as schema from './schema/index.js';
+export { createEmailSender, createLogEmailSender, emailConfigSchema } from './lib/email.js';
+export { MINIMUM_PASSWORD_LENGTH, hashPassword, isPasswordStrongEnough, verifyPassword } from './lib/passwords.js';
+export { generateToken, hashToken, tokenHashesMatch } from './lib/tokens.js';
+export { SecretDecryptionError, createSecretCipher, secretEncryptionConfigSchema, } from './lib/secrets.js';
+export { AppError, describeThrown, describeValidationIssue, internalErrorBody, toErrorBody, toErrorDetails, } from './lib/errors.js';
+export { createIdFactory, idPrefixes } from './lib/ids.js';
+export { createLogger } from './lib/logger.js';
+export { ModuleBootError, orderModules } from './runtime/order.js';
+export { createEntitlementRegistry, limitFor, requireCapability } from './runtime/entitlements.js';
+export { SEATS_LIMIT } from './modules/workspace/capabilities.js';
+export { DOMAIN_EVENT_NAMES, RECORD_OBJECT_TYPES, createEventBus } from './runtime/events.js';
+export { createTransactionScope } from './runtime/transaction.js';
+export { planMigrations, runMigrations } from './runtime/migrate.js';
+export { coreMigrationsDirectory, coreModules } from './modules/core.js';
+export { resealStoredSecrets } from './modules/reseal.js';
+export { KEY_KINDS, kindOfSecret, mintKey, parseKeyKind, readBearerToken } from './modules/api-keys/keys.js';
+export { registerModules } from './runtime/registry.js';
+export { actorUserId, actorWorkspaceId, requireSessionActor } from './modules/auth/actor.js';
+export { resolveActor, resolveActorFrom } from './modules/auth/credentials.js';
+export { MEMBER_ROLES, INVITABLE_ROLES, parseMemberRole, roleAllows } from './modules/workspace/roles.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAGpC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAGhE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAEnF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAE3C,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAG3F,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAE5E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,QAAQ,EACR,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,cAAc,GACf,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAa9C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAElE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAUlG,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AAEjE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAU7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AASjE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAExE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAGzD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAG5G,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAKvD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAE9E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/lib/actor.d.ts

@@ -0,0 +1,71 @@
+import type { MemberRole } from '@kelpie/schemas';
+/**
+ * Who is making a request. Resolved from credentials and passed explicitly to
+ * services; nothing reads auth state from a global.
+ *
+ * A union rather than a bag of optional fields, so a handler that needs a signed-in
+ * human cannot silently accept a workspace key that has no user behind it.
+ *
+ * It lives in `lib/` rather than in the auth module because the module runtime has
+ * to name it: an MCP tool receives its caller the same way a route handler does
+ * (`runtime/module.ts`), and `runtime/` must not import a feature module. Auth is
+ * still where an actor is *resolved* (`modules/auth/credentials.ts`), and
+ * `modules/auth/actor.ts` is still where modules read the type from.
+ */
+/** A browser session. `workspaceId` is null between signup and the first workspace. */
+export interface SessionActor {
+    readonly kind: 'session';
+    readonly userId: string;
+    readonly sessionId: string;
+    readonly workspaceId: string | null;
+    readonly role: MemberRole | null;
+    /** The `workspace_members` row behind this actor. Null when there is no membership. */
+    readonly memberId: string | null;
+}
+/**
+ * A bearer key, always bound to one workspace at creation (`api.md`).
+ *
+ * `userId` is set for a personal key, which acts as its user, and null for a
+ * workspace key, which acts as the workspace itself.
+ */
+export interface ApiKeyActor {
+    readonly kind: 'api_key';
+    readonly apiKeyId: string;
+    readonly userId: string | null;
+    readonly workspaceId: string;
+    readonly role: MemberRole;
+    /** Null for a workspace key: it belongs to the workspace, not to a member. */
+    readonly memberId: string | null;
+}
+export type Actor = SessionActor | ApiKeyActor;
+/** The workspace an actor is operating in, or null if a fresh account has none yet. */
+export declare function actorWorkspaceId(actor: Actor): string | null;
+/**
+ * The same thing, for the endpoints that cannot work without one.
+ *
+ * CRM routes carry no workspace path segment and read no workspace header: a key
+ * is bound to its workspace at creation and a session carries its active one
+ * (`api.md`). The only actor without a workspace is an account between signup and
+ * its first workspace create.
+ *
+ * @throws AppError 403 when the actor has no workspace.
+ */
+export declare function requireWorkspaceId(actor: Actor): string;
+/**
+ * Narrows to a signed-in human.
+ *
+ * @throws AppError 403 for a key, which has no session to manage and no password
+ *   to change.
+ */
+export declare function requireSessionActor(actor: Actor): SessionActor;
+/** The user behind the request, if there is one. A workspace key has none. */
+export declare function actorUserId(actor: Actor): string | null;
+/**
+ * The member row to attribute a write to: a note's author, an activity's actor.
+ *
+ * Null means nobody on the team did this. A workspace key is the case that
+ * reaches here today; an integration writing on the workspace's behalf is the
+ * one the `actor_label` column exists for.
+ */
+export declare function actorMemberId(actor: Actor): string | null;
+//# sourceMappingURL=actor.d.ts.map

package/dist/lib/actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../src/lib/actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAIjD;;;;;;;;;;;;GAYG;AAEH,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IAChC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,MAAM,KAAK,GAAG,YAAY,GAAG,WAAW,CAAA;AAE9C,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,IAAI,CAE5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAMvD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,GAAG,YAAY,CAM9D;AAED,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,IAAI,CAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,IAAI,CAEzD"}

package/dist/lib/actor.js

@@ -0,0 +1,48 @@
+import { AppError } from './errors.js';
+/** The workspace an actor is operating in, or null if a fresh account has none yet. */
+export function actorWorkspaceId(actor) {
+    return actor.workspaceId;
+}
+/**
+ * The same thing, for the endpoints that cannot work without one.
+ *
+ * CRM routes carry no workspace path segment and read no workspace header: a key
+ * is bound to its workspace at creation and a session carries its active one
+ * (`api.md`). The only actor without a workspace is an account between signup and
+ * its first workspace create.
+ *
+ * @throws AppError 403 when the actor has no workspace.
+ */
+export function requireWorkspaceId(actor) {
+    if (actor.workspaceId === null) {
+        throw new AppError('forbidden', 'Create or join a workspace before using this endpoint');
+    }
+    return actor.workspaceId;
+}
+/**
+ * Narrows to a signed-in human.
+ *
+ * @throws AppError 403 for a key, which has no session to manage and no password
+ *   to change.
+ */
+export function requireSessionActor(actor) {
+    if (actor.kind !== 'session') {
+        throw new AppError('forbidden', 'This endpoint needs a signed-in user, not an API key');
+    }
+    return actor;
+}
+/** The user behind the request, if there is one. A workspace key has none. */
+export function actorUserId(actor) {
+    return actor.userId;
+}
+/**
+ * The member row to attribute a write to: a note's author, an activity's actor.
+ *
+ * Null means nobody on the team did this. A workspace key is the case that
+ * reaches here today; an integration writing on the workspace's behalf is the
+ * one the `actor_label` column exists for.
+ */
+export function actorMemberId(actor) {
+    return actor.memberId;
+}
+//# sourceMappingURL=actor.js.map

package/dist/lib/actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.js","sourceRoot":"","sources":["../../src/lib/actor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AA6CtC,uFAAuF;AACvF,MAAM,UAAU,gBAAgB,CAAC,KAAY;IAC3C,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAY;IAC7C,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,uDAAuD,CAAC,CAAA;IAC1F,CAAC;IAED,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAY;IAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,sDAAsD,CAAC,CAAA;IACzF,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,KAAY;IACtC,OAAO,KAAK,CAAC,MAAM,CAAA;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAY;IACxC,OAAO,KAAK,CAAC,QAAQ,CAAA;AACvB,CAAC"}

package/dist/lib/changes.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Which fields a PATCH actually changed.
+ *
+ * `record.updated` carries the changed fields, and a consumer that acts on
+ * "summary changed" should not be woken by a request that resent the summary it
+ * already had. A PATCH that changes nothing is also a write worth not doing:
+ * bumping `updated_at` for it would make every record look freshly touched.
+ */
+/**
+ * @param before The stored record.
+ * @param changes Partial by PATCH semantics: an absent key means "leave it", so
+ *   only the keys present here are considered. A key `before` does not carry
+ *   counts as a change, which is what a column added since the row was written
+ *   should look like.
+ */
+export declare function changedKeys(before: Readonly<Record<string, unknown>>, changes: Readonly<Record<string, unknown>>): readonly string[];
+//# sourceMappingURL=changes.d.ts.map

package/dist/lib/changes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes.d.ts","sourceRoot":"","sources":["../../src/lib/changes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACzC,SAAS,MAAM,EAAE,CAcnB"}

package/dist/lib/changes.js

@@ -0,0 +1,35 @@
+/**
+ * Which fields a PATCH actually changed.
+ *
+ * `record.updated` carries the changed fields, and a consumer that acts on
+ * "summary changed" should not be woken by a request that resent the summary it
+ * already had. A PATCH that changes nothing is also a write worth not doing:
+ * bumping `updated_at` for it would make every record look freshly touched.
+ */
+/** Dates compare by instant. Everything else compares by its JSON form, which covers arrays and objects. */
+function sameValue(before, after) {
+    if (before instanceof Date && after instanceof Date) {
+        return before.getTime() === after.getTime();
+    }
+    return JSON.stringify(before) === JSON.stringify(after);
+}
+/**
+ * @param before The stored record.
+ * @param changes Partial by PATCH semantics: an absent key means "leave it", so
+ *   only the keys present here are considered. A key `before` does not carry
+ *   counts as a change, which is what a column added since the row was written
+ *   should look like.
+ */
+export function changedKeys(before, changes) {
+    const changed = [];
+    for (const [key, value] of Object.entries(changes)) {
+        if (value === undefined) {
+            continue;
+        }
+        if (!sameValue(before[key], value)) {
+            changed.push(key);
+        }
+    }
+    return changed;
+}
+//# sourceMappingURL=changes.js.map

package/dist/lib/changes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes.js","sourceRoot":"","sources":["../../src/lib/changes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4GAA4G;AAC5G,SAAS,SAAS,CAAC,MAAe,EAAE,KAAc;IAChD,IAAI,MAAM,YAAY,IAAI,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CAAA;IAC7C,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,MAAyC,EACzC,OAA0C;IAE1C,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/lib/columns.d.ts

@@ -0,0 +1,152 @@
+import type { Column, SQL } from 'drizzle-orm';
+import type { PgColumn } from 'drizzle-orm/pg-core';
+/**
+ * Column conventions from `schema.md`, in one place so tables cannot drift.
+ *
+ * Primary keys are text `<prefix>_<ulid>` (see `lib/ids.ts`), not serials, so an
+ * id is meaningful on its own and safe to expose.
+ */
+/**
+ * Case-insensitive text, for emails and domains. Values are also normalised to
+ * lowercase on write; citext makes a stray uppercase comparison still match
+ * rather than silently creating a duplicate.
+ */
+export declare const citext: {
+    (): import("drizzle-orm/pg-core").PgCustomColumnBuilder<{
+        name: "";
+        dataType: 'custom';
+        columnType: 'PgCustomColumn';
+        data: string;
+        driverParam: string;
+        enumValues: undefined;
+    }>;
+    <TConfig extends Record<string, any> & unknown>(fieldConfig?: TConfig | undefined): import("drizzle-orm/pg-core").PgCustomColumnBuilder<{
+        name: "";
+        dataType: 'custom';
+        columnType: 'PgCustomColumn';
+        data: string;
+        driverParam: string;
+        enumValues: undefined;
+    }>;
+    <TName extends string>(dbName: TName, fieldConfig?: unknown): import("drizzle-orm/pg-core").PgCustomColumnBuilder<{
+        name: TName;
+        dataType: 'custom';
+        columnType: 'PgCustomColumn';
+        data: string;
+        driverParam: string;
+        enumValues: undefined;
+    }>;
+};
+export declare function primaryId(): import("drizzle-orm").IsPrimaryKey<import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTextBuilderInitial<"id", [string, ...string[]]>>>;
+/**
+ * A Postgres full-text vector, for the `search_vector` column every searchable
+ * table carries. Nothing selects it; it exists to be matched and ranked against.
+ */
+export declare const tsvector: {
+    (): import("drizzle-orm/pg-core").PgCustomColumnBuilder<{
+        name: "";
+        dataType: 'custom';
+        columnType: 'PgCustomColumn';
+        data: string;
+        driverParam: string;
+        enumValues: undefined;
+    }>;
+    <TConfig extends Record<string, any> & unknown>(fieldConfig?: TConfig | undefined): import("drizzle-orm/pg-core").PgCustomColumnBuilder<{
+        name: "";
+        dataType: 'custom';
+        columnType: 'PgCustomColumn';
+        data: string;
+        driverParam: string;
+        enumValues: undefined;
+    }>;
+    <TName extends string>(dbName: TName, fieldConfig?: unknown): import("drizzle-orm/pg-core").PgCustomColumnBuilder<{
+        name: TName;
+        dataType: 'custom';
+        columnType: 'PgCustomColumn';
+        data: string;
+        driverParam: string;
+        enumValues: undefined;
+    }>;
+};
+/**
+ * The one text search configuration every vector and every query is built with.
+ *
+ * It has to be a literal rather than a setting: a generated column's expression
+ * must be immutable, and `to_tsvector(text)` without an explicit configuration
+ * reads `default_text_search_config` at run time, which makes it merely stable.
+ * A per-workspace language would therefore need its own column, not a parameter.
+ */
+export declare const SEARCH_CONFIGURATION = "english";
+/**
+ * Where a field sits in a result's ranking. `ts_rank` weighs A heaviest.
+ *
+ * A is what the reader clicks: a name, a title, the body of a decision. B is the
+ * record's own prose. C is tags and other short arrays, which match usefully but
+ * should not outrank a name.
+ */
+export type SearchWeight = 'A' | 'B' | 'C';
+export interface SearchVectorPart {
+    readonly column: Column;
+    readonly weight: SearchWeight;
+    /**
+     * True for a `text[]` column. Arrays are flattened by
+     * `kelpie_text_array_to_string`, a wrapper that migration `0015` adds because
+     * `array_to_string` itself is stable rather than immutable and Postgres refuses
+     * a generated column built on it.
+     */
+    readonly array?: boolean;
+}
+/**
+ * The `search_vector` column: a stored, generated tsvector over the record's own
+ * text, indexed with GIN by the table that declares it.
+ *
+ * Generated rather than maintained by the service, so it cannot fall out of step
+ * with the row. A trigger or an application write would both leave a window where
+ * an updated record is unfindable, and an import that bypassed the service would
+ * leave one permanently.
+ *
+ * The declared return type is not decoration. Every part names a column of the
+ * table being declared, so an inferred one would send TypeScript around a cycle:
+ * the table's type needs this column's type, which would need the parts, which
+ * name the table. Naming the type up front cuts it, the same way Drizzle's own
+ * self-referencing examples annotate their generated expressions.
+ *
+ * @param parts Deferred for the same reason at run time. Reading them eagerly
+ *   would run before the table's own `const` is assigned.
+ */
+export declare function searchVector(parts: () => readonly SearchVectorPart[]): SearchVectorColumn;
+type SearchVectorColumn = ReturnType<ReturnType<typeof tsvector>['generatedAlwaysAs']>;
+/**
+ * Timestamps are `Date` in TypeScript, never strings. Postgres renders its own
+ * string format (`2026-08-02 11:23:26.138+00`), which is not the ISO 8601 that
+ * `api.md` requires, so string mode would leak a non-conforming value straight
+ * onto the wire. Routes call `toISOString()` at the boundary.
+ */
+export declare function createdAt(): import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTimestampBuilderInitial<"created_at">>>;
+export declare function updatedAt(): import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgTimestampBuilderInitial<"updated_at">>>;
+/** A timestamptz that carries a real domain meaning rather than row bookkeeping. */
+export declare function moment(name: string): import("drizzle-orm/pg-core").PgTimestampBuilderInitial<string>;
+/**
+ * A check constraint restricting a column to a fixed set, built from the same
+ * array the API validates against.
+ *
+ * `schema.md` stores fixed enums as text plus a check rather than as a Postgres
+ * enum, so that adding a value is a constraint swap instead of a type migration.
+ * The cost of that is two lists of the same values, one in the constraint and one
+ * at the boundary. Taking both from one array is what stops them drifting into a
+ * request the API accepts and the database rejects with a 500.
+ *
+ * @param values Literals from our own source, never request data. They are
+ *   inlined into DDL, so a quote in one would be a syntax error at boot.
+ */
+export declare function checkOneOf(name: string, column: PgColumn, values: readonly string[]): import("drizzle-orm/pg-core").CheckBuilder;
+/**
+ * The `column in (…)` half of such a constraint, for a column whose rule needs
+ * more than membership. A nullable enum is the case: `interview_stage` is either
+ * null or one of the stages, and only the second half comes from the array.
+ *
+ * @param constraintName Only for the error below, which fires at boot.
+ */
+export declare function oneOf(constraintName: string, column: Column, values: readonly string[]): SQL<unknown>;
+export {};
+//# sourceMappingURL=columns.d.ts.map