@nocobase/app-template-default 1.0.0-beta.83 → 1.0.0-beta.85

package/tests/fixtures/submission/README.md

@@ -0,0 +1,35 @@
+# Submission acceptance fixture
+
+This is a synthetic equipment-borrowing module for disposable applications, using native application authentication. It adds an asset tag, `CUSTOM-` validation, a business permission gate, custom blue border, and a lifecycle approval transition whose transaction inserts an inventory entry. Never install these test-only routes into an application with real data; the permission switch exists only to exercise revocation. The real equipment-borrowing application is not required or accessed.
+
+## Fresh application
+
+Create the application with `pnpm create @nocobase/app submission-new --template=<target-template-directory-or-package> --no-install --json`, from a scratch working directory. Verify its `nocobase.templatePackage`, read its `AGENTS.md` and synchronized application Skills, and install the target's coordinated dependencies. For an unreleased source-workspace verification, link the generated application's `node_modules` to the target template's installed workspace modules; this exercises the pending source and is not a published-version certification. Do not run package-manager mutations through that shared link.
+
+Copy `migration.ts` to `database/main/migrations/202610260099_submission_fixture.ts`, `routes.ts` to `server/routes/submission-fixture.ts`, and `page.tsx` to `client/pages/submission-fixture.tsx`. Register the server contribution in `server/routes/index.ts`, preserving the template's submission provider. Add an authenticated application route at `/submission-check`, with `authz: 'skip'` and a component loader for the fixture page. The fixture's business endpoints own their authentication and synthetic permission gate independently of that page setting.
+
+Run `pnpm nocobase config init --dialect sqlite --json`, then start with `APP_PUBLIC_ORIGIN=http://127.0.0.1:<chosen-port> APP_SERVER_PORT=<chosen-port> I18N_DEFAULT_LOCALE=en-US pnpm dev`. Use the actual printed application entry URL, including its base path. Configuration initialization generates local secrets; do not publish its file or native session cookies.
+
+## Version upgrade acceptance
+
+For release acceptance, run this fixture through the shared [versioned template-upgrade procedure](../../../../../app/app-skills/skills/nocobase-app-upgrade/references/versioned-upgrade-verification.md). Start Default and Examples separately from published BASE tarballs and their original application Skills. Resolve an explicitly newer TARGET from the isolated candidate registry or the official registry, discover its instructions through the normal template diff, and coordinate dependencies and copied source within that same upgrade. Do not install target Skills or patch individual pages before starting the upgrade. Generate a fresh comparison application from each identical TARGET package.
+
+Record exact BASE/TARGET versions, registry and tarball provenance, integrity, lockfile hashes, BASE-to-TARGET and BASE-to-PROJECT differences, resolved custom conflicts and the validated final baseline. Missing targets and unresolved conflicts must leave the baseline unchanged. Preserve the original business fields, validation, native roles and user assignments, lifecycle history, styling and rows. Candidate-package results and official-package results are separate acceptance records; repeat the matrix from real target packages after publication. Source-workspace checks below are useful specialist checks, but do not satisfy version upgrade acceptance.
+
+The shared upgrade Skill, template entry documentation and versioned packaging procedure supply the common entry. This fixture supplies only the submission-specific business module, browser matrix and before/after evidence inputs. Integrate those inputs with the shared fixture rather than creating another packaging or upgrade mechanism.
+
+## Customized source verification
+
+Prepare a separate application from the BASE template, before this feature. Add the same custom business schema, validation, permission gate, style and lifecycle hook. For the pre-upgrade page, replace only the shared controller with a direct submit function and omit operation headers on Repository mutations. For its custom action call `runtime.fire` without the new outer receipt adapter. Start it on its own database, sign in through its own native login and reproduce two records from a double click while holding the first response. Preserve these synthetic record ids and complete JSON rows as the data baseline.
+
+Stop the old application and commit its source baseline on a local branch. Back up its closed database and migration history. Reconcile BASE → TARGET and BASE → PROJECT through the [submission source-upgrade checklist](../../../../../app/app-skills/skills/nocobase-app-upgrade/references/submission-upgrade.md). Merge the provider/registration, receipt migration, three settings forms and client peer dependencies. For the customized page change only the controller and key forwarding; preserve the fields, validation and styling. For its custom server action add the receipt adapter around the existing lifecycle transition and join its transaction, preserving the permission check and inventory hook. Keep all business tables and records. Inspect `db apply --dry-run` and `db repair --dry-run`; this additive feature should add only the receipt migration with no old checksum changes. Apply it, restart the same application and retain its original database.
+
+For an unreleased source target, report its commit and keep the existing release marker instead of inventing a published target version. For a published target, advance `defaultTemplateVersion` only after source reconciliation and validation. Restore the paired old source and database backup for recovery.
+
+## Run the browser matrix
+
+Set `SUBMISSION_APPLICATIONS` to a JSON array of `{ "name": "new-template", "url": "http://127.0.0.1:<port>/main" }` and `{ "name": "upgraded-customized", "url": "http://127.0.0.1:<other-port>/main", "beforeData": "<path-to-pre-upgrade-evidence-JSON>", "beforePermissions": "<path-to-pre-upgrade-native-permissions-JSON>" }`. `beforeData` contains the fixture's `{ rows, entries, history }`, captured from its authenticated evidence endpoint before upgrading. `beforePermissions` contains the persisted `borrowing-clerk` permission set, explicit user assignment and native role scopes captured before the upgrade; the second browser case compares these and signs in as that ordinary user to exercise allowed reads/updates and forbidden deletion/approval. Fresh applications create equivalent synthetic native permissions in that case. Write the environment setup to a local file when it spans multiple lines. Use the synthetic initial administrator from the disposable template; never reuse a management-instance identity or credential.
+
+Run the application's local `pnpm exec playwright test -c tests/fixtures/submission/playwright.config.ts`. `PLAYWRIGHT_BROWSERS_PATH` must name an allowed scratch directory when installing a browser; use that same directory to run it. `SUBMISSION_EVIDENCE_DIR` selects a scratch output directory. The dedicated configuration keeps this opt-in fixture out of ordinary template browser tests. The test neither sleeps nor automatically retries failures.
+
+Each application checks validation and custom styling, double click, Enter plus programmatic submit while a committed response is held, normal identical new records, update, a definite server rejection with retained input, response loss after a server-confirmed commit, unchanged keys and bodies on retry, refusal of changed input during an uncertain operation, permission revocation, and lifecycle approval with exactly one history entry and inventory effect. Every original row must remain identical. English submitting/error/success screenshots and JSON invariant summaries are attached to the Playwright result. The service-level suites separately cover parallel HTTP attempts, rollback, changed-content conflicts, expiration after cleanup, strict/compatibility modes and query costs on SQLite, PostgreSQL and MySQL.

package/tests/fixtures/submission/browser.test.ts

@@ -0,0 +1,478 @@
+import { test, expect } from '@playwright/test';
+import { readFile } from 'node:fs/promises';
+
+// Run against disposable generated applications prepared with tests/fixtures/submission.
+const applications = JSON.parse(
+  process.env.SUBMISSION_APPLICATIONS ?? '[]',
+) as {
+  name: string;
+  url: string;
+  beforeData?: string;
+  beforePermissions?: string;
+}[];
+if (!applications.length)
+  throw new Error(
+    'Set SUBMISSION_APPLICATIONS to the generated and upgraded fixture application entry URLs.',
+  );
+type Evidence = {
+  rows: { id: string; name: string; assetTag: string; status: string }[];
+  entries: { borrowingId: string }[];
+  history: { recordId: string }[];
+};
+function gate() {
+  let release!: () => void;
+  const promise = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  return { promise, release };
+}
+
+for (const app of applications) {
+  test(`${app.name}: shared submission and retained business customizations`, async ({
+    page,
+  }, testInfo) => {
+    await page.goto(`${app.url}/submission-check`);
+    await page
+      .getByRole('textbox', { name: 'Username or email' })
+      .fill('nocobase');
+    await page.getByLabel('Password', { exact: true }).fill('admin123');
+    await page.getByRole('button', { name: 'Sign in', exact: true }).click();
+    await page.waitForURL((url) => !url.pathname.endsWith('/login'));
+    await page.goto(`${app.url}/submission-check`);
+    await page.getByRole('heading', { name: 'Equipment borrowing' }).waitFor();
+    const form = page
+      .getByRole('heading', { name: 'Equipment borrowing' })
+      .locator('..');
+    const status = form.getByRole('status');
+    const evidence = async (): Promise<Evidence> => {
+      const response = await page.request.get(
+        `${app.url}/api/submissionFixture/evidence`,
+      );
+      expect(response.ok()).toBe(true);
+      return (await response.json()).data as Evidence;
+    };
+    const original = await evidence();
+    if (app.beforeData) {
+      const before = JSON.parse(
+        await readFile(app.beforeData, 'utf8'),
+      ) as Evidence;
+      for (const row of before.rows)
+        expect(original.rows.find((item) => item.id === row.id)).toEqual(row);
+    }
+    await expect(form).toHaveCSS('border-top-color', 'rgb(37, 99, 235)');
+    await page.getByLabel('Custom asset tag').fill('invalid');
+    await form.getByRole('button', { name: 'Save', exact: true }).click();
+    await expect(status).toHaveText('Name and CUSTOM- asset tag are required');
+    expect((await evidence()).rows).toHaveLength(original.rows.length);
+    await page.getByLabel('Custom asset tag').fill('CUSTOM-001');
+
+    // Hold a committed response: double click, Enter and programmatic submit share one immediate lock.
+    let creates = 0;
+    const held = gate();
+    const committed = gate();
+    await page.route('**/api/borrowings/createOne', async (route) => {
+      creates++;
+      const response = await route.fetch();
+      expect(response.status()).toBe(200);
+      committed.release();
+      await held.promise;
+      await route.fulfill({ response });
+    });
+    await form.getByRole('button', { name: 'Save', exact: true }).dblclick();
+    await committed.promise;
+    await page.getByLabel('Equipment name').press('Enter');
+    await form
+      .locator('form')
+      .evaluate((element) =>
+        (element as { requestSubmit(): void }).requestSubmit(),
+      );
+    await expect(
+      form.getByRole('button', { name: 'Submitting…' }),
+    ).toBeDisabled();
+    expect(creates).toBe(1);
+    await form.screenshot({ path: testInfo.outputPath('submitting.png') });
+    await testInfo.attach('Submitting (English)', {
+      path: testInfo.outputPath('submitting.png'),
+      contentType: 'image/png',
+    });
+    held.release();
+    await expect(status).toHaveText('Saved successfully');
+    await page.unroute('**/api/borrowings/createOne');
+    const firstId = await page.getByTestId('record-id').innerText();
+    expect((await evidence()).rows).toHaveLength(original.rows.length + 1);
+
+    // A deliberate new operation with identical fields creates another record.
+    await form.getByRole('button', { name: 'Save', exact: true }).click();
+    await expect
+      .poll(async () => (await evidence()).rows.length)
+      .toBe(original.rows.length + 2);
+    const secondId = await page.getByTestId('record-id').innerText();
+    expect(secondId).not.toBe(firstId);
+    await page.getByLabel('Operation').selectOption('update');
+    await page.getByLabel('Equipment name').fill('Camera updated');
+    await form.getByRole('button', { name: 'Save', exact: true }).click();
+    await expect
+      .poll(
+        async () =>
+          (await evidence()).rows.find((row) => row.id === secondId)?.name,
+      )
+      .toBe('Camera updated');
+
+    // A definite server refusal retains the fields and allows correction/retry.
+    await page.getByLabel('Operation').selectOption('create');
+    await page.route('**/api/borrowings/createOne', (route) =>
+      route.fulfill({
+        status: 400,
+        contentType: 'application/json',
+        body: JSON.stringify({
+          error: {
+            code: 'INVALID_ARGUMENT',
+            status: 400,
+            reason: 'INVALID_INPUT',
+            domain: 'app',
+            message: 'Synthetic rejection',
+            requestId: 'synthetic',
+          },
+        }),
+      }),
+    );
+    await form.getByRole('button', { name: 'Save', exact: true }).click();
+    await expect(status).toHaveText(
+      'Request failed; input retained. Retry to confirm the outcome.',
+    );
+    await expect(page.getByLabel('Equipment name')).toHaveValue(
+      'Camera updated',
+    );
+    await form.screenshot({ path: testInfo.outputPath('failed.png') });
+    await testInfo.attach('Failure with retained input (English)', {
+      path: testInfo.outputPath('failed.png'),
+      contentType: 'image/png',
+    });
+    await page.unroute('**/api/borrowings/createOne');
+
+    // Commit on the server, then drop the response; retry uses exactly the original key and body.
+    let lostKey = '';
+    let lostBody = '';
+    let replayed = false;
+    await page.route('**/api/borrowings/createOne', async (route) => {
+      lostKey = route.request().headers()['idempotency-key'];
+      lostBody = route.request().postData() ?? '';
+      const response = await route.fetch();
+      expect(response.status()).toBe(200);
+      await route.abort('failed');
+    });
+    await form.getByRole('button', { name: 'Save', exact: true }).click();
+    await expect(status).toHaveText(
+      'Request failed; input retained. Retry to confirm the outcome.',
+    );
+    expect((await evidence()).rows).toHaveLength(original.rows.length + 3);
+    await page.unroute('**/api/borrowings/createOne');
+    await page.getByLabel('Equipment name').fill('Changed while uncertain');
+    await form.getByRole('button', { name: 'Save', exact: true }).click();
+    await expect(status).toHaveText(
+      'Retry the original operation before changing input',
+    );
+    await page.getByLabel('Equipment name').fill('Camera updated');
+    await page.route('**/api/borrowings/createOne', async (route) => {
+      expect(route.request().headers()['idempotency-key']).toBe(lostKey);
+      expect(route.request().postData()).toBe(lostBody);
+      const response = await route.fetch();
+      expect(response.status()).toBe(200);
+      replayed = response.headers()['idempotency-replayed'] === 'true';
+      await route.fulfill({ response });
+    });
+    await form.getByRole('button', { name: 'Save', exact: true }).click();
+    await expect(status).toHaveText('Saved successfully');
+    expect(replayed).toBe(true);
+    expect((await evidence()).rows).toHaveLength(original.rows.length + 3);
+    await page.unroute('**/api/borrowings/createOne');
+    const approvalId = await page.getByTestId('record-id').innerText();
+
+    // Lifecycle state, history and inventory effect join the same receipt transaction.
+    await page.getByLabel('Operation').selectOption('approve');
+    let approvalKey = '';
+    let approvalBody = '';
+    await page.route('**/api/submissionFixture/*/approve', async (route) => {
+      approvalKey = route.request().headers()['idempotency-key'];
+      approvalBody = route.request().postData() ?? '';
+      const response = await route.fetch();
+      expect(response.status()).toBe(200);
+      await route.abort('failed');
+    });
+    await form.getByRole('button', { name: 'Save', exact: true }).click();
+    await expect(status).toHaveText(
+      'Request failed; input retained. Retry to confirm the outcome.',
+    );
+    await page.unroute('**/api/submissionFixture/*/approve');
+    const accessChange = await page.request.post(
+      `${app.url}/api/submissionFixture/fixtureAccess`,
+      {
+        headers: { Origin: new URL(app.url).origin },
+        data: { revoked: true },
+      },
+    );
+    expect(accessChange.status()).toBe(200);
+    const denied = await page.request.post(
+      `${app.url}/api/submissionFixture/${approvalId}/approve`,
+      {
+        headers: {
+          'Idempotency-Key': approvalKey,
+          Origin: new URL(app.url).origin,
+        },
+        data: JSON.parse(approvalBody),
+      },
+    );
+    expect(denied.status()).toBe(403);
+    await form.getByRole('button', { name: 'Save', exact: true }).click();
+    await expect(status).toHaveText(
+      'Request failed; input retained. Retry to confirm the outcome.',
+    );
+    await page.request.post(`${app.url}/api/submissionFixture/fixtureAccess`, {
+      headers: { Origin: new URL(app.url).origin },
+      data: { revoked: false },
+    });
+    await form.getByRole('button', { name: 'Save', exact: true }).click();
+    await expect(status).toHaveText('Approved once');
+    const after = await evidence();
+    expect(after.rows.find((row) => row.id === approvalId)?.status).toBe(
+      'approved',
+    );
+    expect(
+      after.entries.filter((entry) => entry.borrowingId === approvalId),
+    ).toHaveLength(1);
+    expect(
+      after.history.filter((entry) => entry.recordId === approvalId),
+    ).toHaveLength(1);
+    for (const row of original.rows)
+      expect(after.rows.find((item) => item.id === row.id)).toEqual(row);
+    await form.screenshot({ path: testInfo.outputPath('success.png') });
+    await testInfo.attach('Successful approval (English)', {
+      path: testInfo.outputPath('success.png'),
+      contentType: 'image/png',
+    });
+    await testInfo.attach('Business invariants', {
+      body: Buffer.from(
+        JSON.stringify(
+          {
+            retainedRows: original.rows.length,
+            addedRows: 3,
+            effectsForApproval: 1,
+            historyForApproval: 1,
+            replayedCreate: replayed,
+          },
+          null,
+          2,
+        ),
+      ),
+      contentType: 'application/json',
+    });
+  });
+}
+
+for (const app of applications) {
+  test(`${app.name}: persisted ordinary-user permissions survive source upgrade`, async ({
+    page,
+    browser,
+  }, testInfo) => {
+    await page.goto(`${app.url}/login`);
+    await page
+      .getByRole('textbox', { name: 'Username or email' })
+      .fill('nocobase');
+    await page.getByLabel('Password', { exact: true }).fill('admin123');
+    await page.getByRole('button', { name: 'Sign in', exact: true }).click();
+    await page.waitForURL((url) => !url.pathname.endsWith('/login'));
+    const key = () => `${Date.now()}.${crypto.randomUUID()}`;
+    const api = async (path: string, data?: unknown, method = 'GET') =>
+      page.request.fetch(`${app.url}/api/${path}`, {
+        method,
+        headers: { Origin: new URL(app.url).origin, 'Idempotency-Key': key() },
+        ...(data === undefined ? {} : { data }),
+      });
+    type Baseline = {
+      role: unknown;
+      userId: string;
+      roleScopes: unknown;
+      assignments: unknown;
+      allowed: unknown;
+      denied: unknown;
+    };
+    let baseline: Baseline;
+    if (app.beforePermissions)
+      baseline = JSON.parse(
+        await readFile(app.beforePermissions, 'utf8'),
+      ) as Baseline;
+    else {
+      const role = {
+        key: 'borrowing-clerk',
+        title: 'Borrowing clerk',
+        grants: [
+          {
+            resource: { type: 'submissionBorrowing', id: '*' },
+            actions: [
+              { action: 'read' },
+              { action: 'create' },
+              { action: 'update' },
+            ],
+          },
+        ],
+      };
+      const roleResponse = await api(
+        'authorization/permissionSets',
+        role,
+        'POST',
+      );
+      expect(roleResponse.status()).toBe(201);
+      const userResponse = await api(
+        'users',
+        {
+          name: 'Synthetic clerk',
+          username: 'borrowclerk',
+          email: 'clerk@example.test',
+          password: 'Borrow-test-123!',
+          roleScopes: { app: ['borrowing-clerk'] },
+        },
+        'POST',
+      );
+      expect(userResponse.status()).toBe(201);
+      const user = (await userResponse.json()).data;
+      baseline = {
+        role: (await roleResponse.json()).data,
+        userId: user.id,
+        roleScopes: user.roleScopes,
+        assignments: (
+          await (
+            await api(
+              'authorization/permissionSets/borrowing-clerk/assignments',
+            )
+          ).json()
+        ).data,
+        allowed: { read: 200, update: 200 },
+        denied: { delete: 403, approve: 403 },
+      };
+    }
+    const storedRole = (
+      await (await api('authorization/permissionSets/borrowing-clerk')).json()
+    ).data;
+    const assignments = (
+      await (
+        await api('authorization/permissionSets/borrowing-clerk/assignments')
+      ).json()
+    ).data;
+    const user = (await (await api(`users/${baseline.userId}`)).json()).data;
+    expect(storedRole).toEqual(baseline.role);
+    expect(assignments).toEqual(baseline.assignments);
+    expect(user.roleScopes).toEqual(baseline.roleScopes);
+    const ordinary = await browser.newPage();
+    try {
+      await ordinary.goto(`${app.url}/login`);
+      await ordinary
+        .getByRole('textbox', { name: 'Username or email' })
+        .fill('borrowclerk');
+      await ordinary
+        .getByLabel('Password', { exact: true })
+        .fill('Borrow-test-123!');
+      await ordinary
+        .getByRole('button', { name: 'Sign in', exact: true })
+        .click();
+      await ordinary.waitForURL((url) => !url.pathname.endsWith('/login'));
+      await ordinary.goto(`${app.url}/submission-check`);
+      const form = ordinary
+        .getByRole('heading', { name: 'Equipment borrowing' })
+        .locator('..');
+      await form.getByRole('button', { name: 'Save', exact: true }).click();
+      await expect(form.getByRole('status')).toHaveText('Saved successfully');
+      const id = await ordinary.getByTestId('record-id').innerText();
+      const send = (path: string, data: unknown, operation = key()) =>
+        ordinary.request.post(`${app.url}/api/${path}`, {
+          headers: {
+            Origin: new URL(app.url).origin,
+            'Idempotency-Key': operation,
+          },
+          data,
+        });
+      const read = await send('borrowings/findMany', {});
+      const edit = await send('borrowings/updateOne', {
+        filter: { id },
+        values: { name: 'Preserved clerk customization' },
+      });
+      const deletion = await send('borrowings/deleteOne', { filter: { id } });
+      const approval = await send(`submissionFixture/${id}/approve`, {
+        note: 'Denied synthetic approval',
+      });
+      expect({ read: read.status(), update: edit.status() }).toEqual(
+        baseline.allowed,
+      );
+      expect({ delete: deletion.status(), approve: approval.status() }).toEqual(
+        baseline.denied,
+      );
+      await ordinary.getByLabel('Operation').selectOption('approve');
+      await form.getByRole('button', { name: 'Save', exact: true }).click();
+      await expect(form.getByRole('status')).toHaveText(
+        'Request failed; input retained. Retry to confirm the outcome.',
+      );
+      await form.screenshot({
+        path: testInfo.outputPath('ordinary-user-denied.png'),
+      });
+      const operation = key();
+      const input = {
+        values: {
+          id: operation.slice(14),
+          name: 'Native role replay',
+          assetTag: 'CUSTOM-ROLE',
+          statusChangedAt: new Date().toISOString(),
+        },
+      };
+      expect(
+        (await send('borrowings/createOne', input, operation)).status(),
+      ).toBe(200);
+      expect(
+        (
+          await api(
+            `users/${baseline.userId}`,
+            { roleScopes: { app: [] } },
+            'PATCH',
+          )
+        ).status(),
+      ).toBe(200);
+      expect(
+        (await send('borrowings/createOne', input, operation)).status(),
+      ).toBe(403);
+      expect(
+        (
+          await api(
+            `users/${baseline.userId}`,
+            { roleScopes: baseline.roleScopes },
+            'PATCH',
+          )
+        ).status(),
+      ).toBe(200);
+      const replay = await send('borrowings/createOne', input, operation);
+      expect(replay.status()).toBe(200);
+      expect(replay.headers()['idempotency-replayed']).toBe('true');
+      expect(
+        (
+          await (
+            await api(
+              'authorization/permissionSets/borrowing-clerk/assignments',
+            )
+          ).json()
+        ).data,
+      ).toEqual(baseline.assignments);
+      await testInfo.attach('Persistent business permissions', {
+        body: Buffer.from(
+          JSON.stringify({
+            rolePreserved: true,
+            assignmentsPreserved: true,
+            allowed: { read: read.status(), update: edit.status() },
+            denied: { delete: deletion.status(), approve: approval.status() },
+            revokedReplay: 403,
+            restoredReplay: 200,
+          }),
+        ),
+        contentType: 'application/json',
+      });
+    } finally {
+      await ordinary.close();
+    }
+  });
+}

package/tests/fixtures/submission/migration.ts

@@ -0,0 +1,61 @@
+import { defineMigration, type MigrationDefinition } from '@nocobase/db';
+const migration: MigrationDefinition = defineMigration({
+  name: '202610260099_submission_fixture',
+  async up({ builder }) {
+    await builder.createCollection('borrowings', (c) => {
+      c.string('id', { length: 64 }).primary().notNull();
+      c.string('name').notNull();
+      c.string('assetTag').notNull();
+      c.string('status').notNull().defaultTo('draft');
+      c.datetimeTz('statusChangedAt').notNull();
+      c.integer('lifecycleVersion').notNull().defaultTo(0);
+    });
+    await builder.createCollection('inventoryEntries', (c) => {
+      c.string('id', { length: 64 }).primary().notNull();
+      c.string('borrowingId', { length: 64 }).notNull();
+    });
+    await builder.createCollection('lifecycleTransitions', (c) => {
+      c.bigInt('id').primary().autoIncrement().notNull();
+      c.string('lifecycle').notNull();
+      c.string('recordId').notNull();
+      c.string('transition').notNull();
+      c.string('from').nullable();
+      c.string('to').notNull();
+      c.string('actorId').notNull();
+      c.json('input').notNull();
+      c.datetimeTz('at').notNull();
+      c.integer('version').notNull();
+      c.string('requestId').nullable();
+      c.string('requestKey').notNull();
+      c.unique(['lifecycle', 'recordId', 'version']);
+      c.unique(['lifecycle', 'recordId', 'requestKey']);
+    });
+    await builder.createCollection('lifecycleEffectRuns', (c) => {
+      c.bigInt('id').primary().autoIncrement().notNull();
+      c.bigInt('transitionId').notNull();
+      c.string('lifecycle').notNull();
+      c.string('recordId').notNull();
+      c.string('effect').notNull();
+      c.boolean('stayBound').notNull();
+      c.string('status').notNull();
+      c.integer('attempts').notNull();
+      c.integer('maxAttempts').notNull();
+      c.json('result').nullable();
+      c.text('error').nullable();
+      c.datetimeTz('createdAt').notNull();
+      c.datetimeTz('updatedAt').notNull();
+      c.datetimeTz('claimedAt').nullable();
+      c.datetimeTz('runAfter').nullable();
+      c.json('continuation').nullable();
+      c.datetimeTz('continuationDueAt').nullable();
+      c.datetimeTz('continuationAbandonedAt').nullable();
+    });
+  },
+  async down({ builder }) {
+    await builder.dropCollection('lifecycleEffectRuns');
+    await builder.dropCollection('lifecycleTransitions');
+    await builder.dropCollection('inventoryEntries');
+    await builder.dropCollection('borrowings');
+  },
+});
+export default migration;