@nbt-dev/nbt 0.0.1 → 0.0.3

package/stdlib/phone/migrations/20260605205722_initial/schema_snapshot.nbt

@@ -0,0 +1,56 @@
+entity TwilioAccount {
+  name: string
+  subAccountSid: string
+  authToken: string
+  publicUrlBase: string
+  status: string
+  retentionDays: s32
+  @@unique([name])
+  @@index([subAccountSid])
+}
+
+entity PhoneNumber {
+  accountId: string
+  phoneNumber: string
+  numberSid: string
+  friendlyName: string
+  capabilities: string
+  @@index([accountId])
+  @@unique([phoneNumber])
+  @@index([numberSid])
+}
+
+entity SmsMessage {
+  accountId: string
+  numberId: string
+  direction: string
+  fromE164: string
+  toE164: string
+  body: string
+  twilioSid: string
+  status: string
+  errorCode: s32
+  errorMessage: string
+  priceMicros: s64
+  priceCurrency: string
+  numSegments: s32
+  numMedia: s32
+  mediaUrls: string
+  senderUserId: string
+  dateSentMs: u64
+  dateDeliveredMs: u64
+  @@index([accountId])
+  @@index([numberId])
+  @@index([twilioSid])
+}
+
+entity PhoneUsageDaily {
+  accountId: string
+  date: string
+  smsCount: s64
+  smsSegmentsTotal: s64
+  smsPriceMicros: s64
+  @@unique([accountId, date])
+  @@index([accountId])
+}
+

package/stdlib/phone/schema.nbt

@@ -0,0 +1,95 @@
+# Phone cartridge — Twilio number management, SMS, click-to-call.
+#
+# Per-tenant model (see modules/twilio/module.jai for the rationale):
+#   - One master Twilio account owned by the platform (SID + auth token in
+#     env: TWILIO_MASTER_SID, TWILIO_MASTER_TOKEN).
+#   - Each tenant gets a TwilioAccount row with its own subaccount SID and
+#     auth token. All per-tenant API calls authenticate as the subaccount.
+#   - Webhooks are configured to URLs under the tenant's public base
+#     (TwilioAccount.publicUrlBase), which the gateway routes back to this
+#     cart. Signature verification uses the subaccount's auth token.
+
+# Behavior (the former jai{} helper blocks + actions) lives in
+# native/runtime.jai over the generated ORM — see phone_register_extra_routes,
+# which registers the HTTP routes.
+
+# Auth policy for the hand-written routes (formerly @public actions). The
+# handlers live in native/runtime.jai; these keep the daemon's public-route
+# manifest correct so the /api/* auth gate is bypassed for Twilio webhooks.
+@public_route "/api/phone/webhook/sms"
+@public_route "/api/phone/webhook/status"
+
+entity TwilioAccount {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  name: string               # operator-facing label
+  subAccountSid: string      # AC... — populated by provision()
+  authToken: string          # subaccount auth token (TODO: encrypt at rest)
+  publicUrlBase: string      # e.g. "https://acme.console.app"
+  status: string             # PENDING | ACTIVE | SUSPENDED | CLOSED
+  retentionDays: s32         # 0 = keep message bodies forever; N = null body after N days
+
+  @@unique([name])
+  @@index([subAccountSid])
+}
+
+entity PhoneNumber {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  accountId: string          # FK TwilioAccount.id
+  phoneNumber: string        # E.164 "+15551234567"
+  numberSid: string          # PN...
+  friendlyName: string
+  capabilities: string       # "sms"
+
+  @@index([accountId])
+  @@unique([phoneNumber])
+  @@index([numberSid])
+}
+
+entity SmsMessage {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  accountId: string
+  numberId: string           # FK PhoneNumber.id (empty on inbound if not matched)
+  direction: string          # inbound | outbound
+  fromE164: string
+  toE164: string
+  body: string               # nulled after retentionDays if TwilioAccount configured
+  twilioSid: string          # SM...
+  status: string             # queued | sent | delivered | failed | received
+  errorCode: s32
+  errorMessage: string       # human-readable sibling of errorCode
+  priceMicros: s64           # negative = charged (Twilio convention); 0 until status callback
+  priceCurrency: string      # "USD" / "CAD"
+  numSegments: s32
+  numMedia: s32
+  mediaUrls: string          # JSON array of MMS media URLs
+  senderUserId: string       # who triggered the send (empty for inbound)
+  dateSentMs: u64            # Twilio canonical timestamp (ms since epoch)
+  dateDeliveredMs: u64
+
+  @@index([accountId])
+  @@index([numberId])
+  @@index([twilioSid])
+}
+
+# Per-tenant per-day usage rollup. Written by the nightly rollup workflow;
+# read by the portal to generate invoices.
+entity PhoneUsageDaily {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  accountId: string
+  date: string                # "YYYY-MM-DD" in UTC
+  smsCount: s64
+  smsSegmentsTotal: s64
+  smsPriceMicros: s64
+
+  @@unique([accountId, date])
+  @@index([accountId])
+}
+

package/stdlib/registry/migrations/20260602181932_initial/migration.nbt

@@ -0,0 +1,8 @@
+migration initial {
+  add_entity InstalledCartridge
+  add_field InstalledCartridge tier string default("")
+  add_field InstalledCartridge source string default("")
+  add_field InstalledCartridge schemaChecksum string default("")
+  add_field InstalledCartridge installedAt u64 default(0)
+  add_field InstalledCartridge status string default("")
+}

package/stdlib/registry/migrations/20260602181932_initial/schema_snapshot.nbt

@@ -0,0 +1,8 @@
+entity InstalledCartridge {
+  tier: string
+  source: string
+  schemaChecksum: string
+  installedAt: u64
+  status: string
+}
+

package/stdlib/registry/schema.nbt

@@ -0,0 +1,20 @@
+# Installed-cartridge registry — the single source of truth for which tier-2
+# (bundled) and customer cartridges are installed on this instance.
+#
+# Lives in replicated storage, so the install set is HA-safe and survives
+# restarts: on boot the console re-activates every InstalledCartridge row.
+#
+# The console daemon is the SINGLE WRITER (cartridge_registry.jai writes rows
+# through THIS cart's generated serializer — same code, no format drift). The
+# generated CRUD routes are read-mostly, for the portal/client. The row id is
+# the cartridge name.
+entity InstalledCartridge {
+  id: string @id   # the cartridge name (slug), NOT a ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  tier: string            # "bundled" | "customer"
+  source: string          # "bundled" | "customer"
+  schemaChecksum: string  # checksum of the installed schema (drift detection)
+  installedAt: u64        # ms epoch
+  status: string          # "installed" | "failed"
+}

package/stdlib/workflows/schema.nbt

@@ -0,0 +1,43 @@
+
+# Question: How do we tie in cartridge metadata and workflow side effects into all this?
+
+enum WorkerStatus {
+  WAITING
+  RUNNING
+  TERMINATED
+}
+
+entity Worker {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  source: blob
+  contentHash: string
+  queue?: string
+  # TODO: We need some sort of termination options like a restart policy
+}
+
+# Stub — flesh out execution lifecycle fields later.
+entity WorkflowExecution {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  status: string
+  events: WorkflowExecutionEvent[]
+}
+
+# Do we want this to be a string? 
+enum WorkflowExecutionEventKind {
+  WORKFLOW_EXECUTION_STARTED
+  WORKFLOW_STEP_SCHEDULED
+  WORKFLOW_STEP_STARTED
+  WORKFLOW_STEP_COMPLETED
+  WORKFLOW_EXECUTION_COMPLETED
+}
+
+entity WorkflowExecutionEvent {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  kind: WorkflowExecutionEventKind
+}

package/vendor/linux-x64/cartridges/auth/migrations/20260424144652_initial/migration.nbt

@@ -0,0 +1,48 @@
+migration initial {
+  add_entity User
+  add_field User name string default("")
+  add_field User username string default("")
+  add_field User email string default("")
+  add_field User emailVerified bool default(false)
+  add_field User externalId string default("")
+  add_field User capsVersion u32 default(0)
+  add_index User [email]
+  add_index User [externalId]
+  add_entity UserRole
+  add_field UserRole userId string default("")
+  add_field UserRole cart string default("")
+  add_field UserRole role string default("")
+  add_index UserRole [userId]
+  add_entity Session
+  add_field Session userId string default("")
+  add_field Session token string default("")
+  add_field Session expiresAt DateTime default(0)
+  add_field Session ipAddress string default("")
+  add_field Session userAgent string default("")
+  add_index Session [token]
+  add_index Session [userId]
+  add_entity Account
+  add_field Account userId string default("")
+  add_field Account providerId string default("")
+  add_field Account password string default("")
+  add_field Account accessToken string default("")
+  add_field Account refreshToken string default("")
+  add_field Account idToken string default("")
+  add_field Account accessTokenExpiresAt DateTime default(0)
+  add_field Account refreshTokenExpiresAt DateTime default(0)
+  add_field Account scope string default("")
+  add_index Account [userId]
+  add_entity Verification
+  add_field Verification identifier string default("")
+  add_field Verification value string default("")
+  add_field Verification expiresAt DateTime default(0)
+  add_index Verification [identifier]
+  add_entity ApiKey
+  add_field ApiKey name string default("")
+  add_field ApiKey projectId string default("")
+  add_field ApiKey start string default("")
+  add_field ApiKey prefix string default("")
+  add_field ApiKey key string default("")
+  add_field ApiKey permissions string default("")
+  add_field ApiKey roles string default("")
+}

package/vendor/linux-x64/cartridges/auth/migrations/20260424144652_initial/schema_snapshot.nbt

@@ -0,0 +1,58 @@
+entity User {
+  name: string
+  username?: string
+  email?: string
+  emailVerified: bool
+  externalId?: string
+  capsVersion: u32
+  @@index([email])
+  @@index([externalId])
+}
+
+entity UserRole {
+  userId: string
+  cart: string
+  role: string
+  @@index([userId])
+}
+
+entity Session {
+  userId: string
+  token: string
+  expiresAt: DateTime
+  ipAddress?: string
+  userAgent?: string
+  @@index([token])
+  @@index([userId])
+}
+
+entity Account {
+  userId: string
+  providerId: string
+  password: string
+  accessToken: string
+  refreshToken: string
+  idToken: string
+  accessTokenExpiresAt: DateTime
+  refreshTokenExpiresAt: DateTime
+  scope: string
+  @@index([userId])
+}
+
+entity Verification {
+  identifier: string
+  value: string
+  expiresAt: DateTime
+  @@index([identifier])
+}
+
+entity ApiKey {
+  name: string
+  projectId: string
+  start: string
+  prefix: string
+  key: string
+  permissions: string
+  roles: string
+}
+

package/vendor/linux-x64/cartridges/auth/migrations/20260521191014_update_user/migration.nbt

@@ -0,0 +1,3 @@
+migration update_user {
+  add_unique User [email]
+}

package/vendor/linux-x64/cartridges/auth/migrations/20260521191014_update_user/schema_snapshot.nbt

@@ -0,0 +1,59 @@
+entity User {
+  name: string
+  username?: string
+  email?: string
+  emailVerified: bool
+  externalId?: string
+  capsVersion: u32
+  @@index([email])
+  @@index([externalId])
+  @@unique([email])
+}
+
+entity UserRole {
+  userId: string
+  cart: string
+  role: string
+  @@index([userId])
+}
+
+entity Session {
+  userId: string
+  token: string
+  expiresAt: DateTime
+  ipAddress?: string
+  userAgent?: string
+  @@index([token])
+  @@index([userId])
+}
+
+entity Account {
+  userId: string
+  providerId: string
+  password: string
+  accessToken: string
+  refreshToken: string
+  idToken: string
+  accessTokenExpiresAt: DateTime
+  refreshTokenExpiresAt: DateTime
+  scope: string
+  @@index([userId])
+}
+
+entity Verification {
+  identifier: string
+  value: string
+  expiresAt: DateTime
+  @@index([identifier])
+}
+
+entity ApiKey {
+  name: string
+  projectId: string
+  start: string
+  prefix: string
+  key: string
+  permissions: string
+  roles: string
+}
+

package/vendor/linux-x64/cartridges/auth/schema.nbt

@@ -0,0 +1,142 @@
+import crypto from "crypto"
+
+# Auth policy for the hand-written routes in native/runtime.jai (formerly the
+# @public actions + the `authenticate` middleware block). These keep the
+# daemon's public-route + middleware manifest correct: public routes bypass the
+# /api/* auth gate; @middleware tells the proxy this cart exports the global
+# authenticate gate (registered at /_middleware/authenticate). The @authn
+# (service) sync/role routes carry NO directive — they require auth, gated
+# inline in the handler.
+@public_route "/api/auth/user/signup"
+@public_route "/api/auth/user/signin"
+@public_route "/api/auth/session/signout"
+@public_route "/api/auth/session/current"
+@public_route "/api/auth/user/forgot_password"
+@public_route "/api/auth/user/reset_password"
+@public_route "/api/auth/user/verify_email"
+@middleware "authenticate"
+
+export entity User {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  name: string
+  username?: string
+  email?: string
+  emailVerified: bool
+  externalId?: string
+  capsVersion: u32 # what is this?
+
+  @@index([email])
+  @@index([externalId])
+  @@unique([email])
+}
+
+# Per-cartridge role assignments. Role names refer to entries in the owning
+# cartridge's `roles { }` block — this cartridge does not validate them.
+entity UserRole {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  userId:    string
+  cart: string
+  role:      string
+
+  @@index([userId])
+}
+
+entity Session {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  userId: string
+  token: string
+  expiresAt: DateTime
+  ipAddress?: string
+  userAgent?: string
+
+  @@index([token])
+  @@index([userId])
+}
+
+entity Account {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  userId: string
+  providerId: string
+  password: string
+  accessToken: string
+  refreshToken: string
+  idToken: string
+  accessTokenExpiresAt: DateTime
+  refreshTokenExpiresAt: DateTime
+  scope: string
+
+  @@index([userId])
+}
+
+entity Verification {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  identifier: string
+  value: string
+  expiresAt: DateTime
+
+  @@index([identifier])
+}
+
+entity ApiKey {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  name: string
+  projectId: string
+  start: string
+  prefix: string
+  key: string
+  permissions: string
+  roles: string
+}
+
+# Console-operator SSH public keys. The console daemon authenticates SSH
+# connections by looking up rows here via modules/auth_lookup/ (in-process,
+# direct storage read — auth cart liveness is not required).
+entity SshKey {
+  id: ulid
+  createdAt: DateTime @default(now())
+  updatedAt: DateTime @updatedAt
+  userId: string
+  label: string
+  blob: string
+
+  @@index([userId])
+  @@unique([blob])
+}
+
+jai {
+find_synced_user :: (requestedId: string, email: string) -> (User, bool) {
+  if requestedId.count > 0 {
+    by_id, by_id_ok := get_user(requestedId);
+    if by_id_ok return by_id, true;
+
+    by_external := find_users_by_externalId(requestedId);
+    if by_external.count > 0 {
+      u, ok := get_user(by_external[0].id);
+      if ok return u, true;
+    }
+  }
+
+  if email.count > 0 {
+    by_email := find_users_by_email(email);
+    if by_email.count > 0 {
+      u, ok := get_user(by_email[0].id);
+      if ok return u, true;
+    }
+  }
+
+  empty: User;
+  return empty, false;
+}
+}

package/vendor/linux-x64/cartridges/calendar/migrations/20260501210107_initial/migration.nbt

@@ -0,0 +1,60 @@
+migration initial {
+  add_entity Calendar
+  add_field Calendar name string default("")
+  add_field Calendar description string default("")
+  add_field Calendar timezone string default("")
+  add_field Calendar slotDuration u32 default(0)
+  add_field Calendar slotInterval u32 default(0)
+  add_field Calendar isActive bool default(false)
+  add_field Calendar source string default("")
+  add_entity Appointment
+  add_field Appointment calendar Calendar default(0)
+  add_field Appointment contact Contact default(0)
+  add_field Appointment title string default("")
+  add_field Appointment address string default("")
+  add_field Appointment notes string default("")
+  add_field Appointment startTime DateTime default(0)
+  add_field Appointment endTime DateTime default(0)
+  add_field Appointment timezone string default("")
+  add_field Appointment status string default("")
+  add_field Appointment source string default("")
+  add_field Appointment assignedUser User default(0)
+  add_field Appointment isRescheduled bool default(false)
+  add_field Appointment originalStartTime DateTime default(0)
+  add_field Appointment originalEndTime DateTime default(0)
+  add_index Appointment [contactId]
+  add_index Appointment [calendarId]
+  add_entity Contact
+  add_field Contact firstName string default("")
+  add_field Contact lastName string default("")
+  add_field Contact fullName string default("")
+  add_field Contact phone string default("")
+  add_field Contact mobile string default("")
+  add_field Contact email string default("")
+  add_field Contact address string default("")
+  add_field Contact fullAddress string default("")
+  add_field Contact postalCode string default("")
+  add_field Contact city string default("")
+  add_field Contact stateOrProvince string default("")
+  add_field Contact country string default("")
+  add_field Contact timezone string default("")
+  add_field Contact lat float default(0)
+  add_field Contact lon float default(0)
+  add_field Contact company string default("")
+  add_field Contact website string default("")
+  add_field Contact title string default("")
+  add_field Contact industry string default("")
+  add_field Contact source string default("")
+  add_field Contact notes string default("")
+  add_field Contact data document default(0)
+  add_field Contact customData document default(0)
+  add_entity User
+  add_field User name string default("")
+  add_field User username string default("")
+  add_field User email string default("")
+  add_field User emailVerified bool default(false)
+  add_field User externalId string default("")
+  add_field User capsVersion u32 default(0)
+  add_index User [email]
+  add_index User [externalId]
+}

package/vendor/linux-x64/cartridges/calendar/migrations/20260501210107_initial/schema_snapshot.nbt

@@ -0,0 +1,66 @@
+entity Calendar {
+  name: string
+  description?: string
+  timezone?: string
+  slotDuration?: u32
+  slotInterval?: u32
+  isActive: bool
+  source?: string
+}
+
+entity Appointment {
+  calendar: Calendar
+  contact: Contact
+  title?: string
+  address?: string
+  notes?: string
+  startTime: DateTime
+  endTime: DateTime
+  timezone?: string
+  status: string
+  source?: string
+  assignedUser?: User
+  isRescheduled: bool
+  originalStartTime?: DateTime
+  originalEndTime?: DateTime
+  @@index([contactId])
+  @@index([calendarId])
+}
+
+entity Contact {
+  firstName?: string
+  lastName?: string
+  fullName?: string
+  phone?: string
+  mobile?: string
+  email?: string
+  address?: string
+  fullAddress?: string
+  postalCode?: string
+  city?: string
+  stateOrProvince?: string
+  country?: string
+  timezone?: string
+  lat?: float
+  lon?: float
+  company?: string
+  website?: string
+  title?: string
+  industry?: string
+  source?: string
+  notes?: string
+  data: document
+  customData: document
+}
+
+entity User {
+  name: string
+  username?: string
+  email?: string
+  emailVerified: bool
+  externalId?: string
+  capsVersion: u32
+  @@index([email])
+  @@index([externalId])
+}
+

package/vendor/linux-x64/cartridges/calendar/migrations/20260513151050_schema_update/migration.nbt

@@ -0,0 +1,17 @@
+migration schema_update {
+  add_field Appointment state string default("")
+  add_field Appointment outcomeClass string default("")
+  add_field Appointment embedText string default("")
+  add_index Appointment [state]
+  add_index Appointment [outcomeClass]
+  add_entity AppointmentParticipant
+  add_field AppointmentParticipant appointment Appointment default(0)
+  add_field AppointmentParticipant user User default(0)
+  add_field AppointmentParticipant role string default("")
+  add_field AppointmentParticipant assignedAt DateTime default(0)
+  add_field AppointmentParticipant assignedBy User default(0)
+  add_field AppointmentParticipant notes string default("")
+  add_index AppointmentParticipant [appointmentId]
+  add_index AppointmentParticipant [userId, role]
+  add_unique AppointmentParticipant [appointmentId, role, userId]
+}