@oimlsmart/platform-server 0.1.0

package/README.md

@@ -0,0 +1,92 @@
+# @oimlsmart/platform-server
+
+The OIML SMART platform server kernel: the modules the certification
+platform (github.com/oimlsmart/smart) and the identity service
+(github.com/oimlsmart/identity) both consume, published once to npm so
+the two repositories never fork them. The boundary is measured, not
+aspirational: PROGRESS/41-identity-extraction-map.md §2 in the smart
+repository. Both consumers pin the published semver line; the version
+pin IS the contract (TODO.repos/01).
+
+## What it is
+
+- `store`, the ServerStore seam: the interface, every row type, the
+  demo-account plan, `installStore`/`getStore`. Worker-safe.
+- `store/d1`, the Cloudflare D1 implementation. Worker-safe.
+- `store/sqlite`, the node implementation (better-sqlite3): the server
+  store composed from the sync modules, the entity-store verbs, the raw
+  driver handle, the schema (`SQLITE_SCHEMA_PATH`), and the migration
+  set's location (`MIGRATIONS_DIR`). Node-only.
+- `migrations/`, the canonical D1 migration set. Both deployments point
+  wrangler's `migrations_dir` at this directory in the consumer's
+  node_modules; the live databases' journals key on the filenames.
+- `profile`, the deployment profile model (hub / IA / TL / identity):
+  parse, resolve, install, the account seed plan. Worker-safe.
+- `profile/node`, the file/env profile loader. Node-only (fs).
+- `mailer`, the transactional mail seam (provider dispatch + the D1
+  outbox). Worker-safe.
+- `rbac`, the instance's effective role to permission map
+  (`installRbacMap` / `effectiveRbacMap`). Worker-safe.
+- `rbac/node`, the map's node carriers (INSTANCE_RBAC_JSON, the
+  profile file's `rbac:` section). Node-only (fs).
+- `oidc`, the OIDC relying-party client (discovery, PKCE, the code
+  exchange, ID-token validation). Worker-safe.
+- `github`, the GitHub OAuth cone (state sign/verify, the authorized
+  users declaration, the org-membership check). Worker-safe.
+- `session`, the `oiml-session` cookie seam: `SESSION_COOKIE`,
+  `sessionUser(c)`, `sessionCookieOpts(c)`. Worker-safe.
+- `client-info`, the request's client context (user agent, IP).
+  Worker-safe.
+- `vocab`, the shared identity vocabulary: the role model, the role to
+  permission map, the action-permission catalog. Isomorphic.
+
+The worker-safe rule, at package granularity: every subpath except
+`store/sqlite`, `profile/node` and `rbac/node` carries no node
+built-ins; a Worker bundle never imports the three node subpaths.
+
+## The migration contract
+
+`migrations/` is the ONE schema-migration set both deployments apply
+(the smart platform's D1 databases and the identity service's account
+registry alike):
+
+- **Expand-only, filename-keyed.** A new schema act appends
+  `NNNN_name.sql`; existing files never change and never renumber.
+  wrangler records applied filenames in each database's
+  `d1_migrations` journal, so a rename or an edit would split the live
+  history.
+- Duplicate sequence numbers are legal siblings (the wave that landed
+  two stores the same week); apply order is the filename sort.
+- `test/migrations.test.ts` pins the set's end state to
+  `src/store/sqlite/schema.sql` (table and column sets), so the SQLite
+  DDL and the D1 journal path can never drift apart inside the
+  package.
+- Consumers read the set's location from `MIGRATIONS_DIR`
+  (`@oimlsmart/platform-server/store/sqlite`); deploy configs point at
+  `node_modules/@oimlsmart/platform-server/migrations`.
+
+## Source-form exports
+
+The package ships its TypeScript sources directly (the
+`@oimlsmart/site-shell` pattern, no build step): the consumers'
+toolchains (vite/astro, tsx, vitest, vue-tsc) compile them in place.
+
+## Development
+
+```
+npm ci
+npm run typecheck
+npm test
+```
+
+## Releasing
+
+Trusted publishing rides `v*` tags on this repository (the
+`.github/workflows/release.yml` machinery, npm OIDC, no stored token):
+bump `version` in `package.json` on `main` (the `package-lock.json`
+root fields bump with it), tag `v<x.y.z>` at the merge commit, push
+the tag. The workflow runs the gates, refuses a tag that does not
+equal the package version, and publishes with `--provenance`. The
+one-time bootstrap (the manual first publish + the npmjs.com trusted
+publisher enrollment) is done; the runbook is
+docs/deployment/npm-releases.md in the smart repository.

package/migrations/0001_init.sql

@@ -0,0 +1,69 @@
+-- Migration 0001 — the platform schema (TODO.cs-e2e/14).
+-- Mirrors server/db/schema.sql STATEMENT-FOR-STATEMENT (the node
+-- posture applies schema.sql at boot; the D1 posture applies this
+-- migration via `wrangler d1 migrations apply`). When schema.sql
+-- changes, add the next migration here AND keep schema.sql current —
+-- src/__tests__/d1-store.test.ts pins the two to the same CREATE set.
+CREATE TABLE IF NOT EXISTS users (
+  id TEXT PRIMARY KEY,
+  email TEXT UNIQUE NOT NULL,
+  name TEXT NOT NULL,
+  avatar_url TEXT,
+  provider TEXT NOT NULL DEFAULT 'demo',
+  provider_account_id TEXT,
+  role TEXT NOT NULL DEFAULT 'user',
+  -- Organization linkage: manufacturer id (applicant), IA oiml_code (ia_officer),
+  -- TL oiml_id (tl_operator); NULL for cs_admin/admin/viewer.
+  org_id TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  last_login TEXT
+);
+
+CREATE TABLE IF NOT EXISTS sessions (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  token TEXT UNIQUE NOT NULL,
+  expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- The workflow entity store (TODO.ops/07 — server-side persistence):
+-- one JSON document per entity, keyed by (store, id) — the same shape
+-- the browser's IndexedDB stores hold, so the two repository backends
+-- are contract-identical. org_id carries the scoping column when the
+-- entity declares one (server-side enforcement for org-bound roles).
+CREATE TABLE IF NOT EXISTS entities (
+  store TEXT NOT NULL,
+  id TEXT NOT NULL,
+  org_id TEXT,
+  data TEXT NOT NULL,
+  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (store, id)
+);
+CREATE INDEX IF NOT EXISTS idx_entities_store_org ON entities (store, org_id);
+
+-- The change journal: every write appends (seq, store, type, id) —
+-- the SSE stream tails it (each client filters its stores).
+CREATE TABLE IF NOT EXISTS entity_changes (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  store TEXT NOT NULL,
+  type TEXT NOT NULL,
+  id TEXT NOT NULL,
+  at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- The evidence store (TODO.ops/09 — the monitor daemon's durable
+-- streams): append-only records across restarts. The adapter contract
+-- (src/evidence-store/adapter.ts) is tiny: append, query, getByIds,
+-- counts.
+CREATE TABLE IF NOT EXISTS evidence_records (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL,
+  twin_id TEXT,
+  monitor_id TEXT,
+  at TEXT NOT NULL,
+  data TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_evidence_kind_at ON evidence_records (kind, at);
+CREATE INDEX IF NOT EXISTS idx_evidence_twin ON evidence_records (twin_id, at);
+CREATE INDEX IF NOT EXISTS idx_evidence_monitor ON evidence_records (monitor_id, at);

package/migrations/0002_identity.sql

@@ -0,0 +1,24 @@
+-- Migration 0002 — identity federation (TODO.federation/10).
+-- Adds the RP-initiated-logout hint to sessions and the SSO approval
+-- queue. schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+ALTER TABLE sessions ADD COLUMN id_token_hint TEXT;
+
+CREATE TABLE IF NOT EXISTS identity_approvals (
+  id TEXT PRIMARY KEY,
+  email TEXT NOT NULL,
+  name TEXT NOT NULL,
+  issuer TEXT NOT NULL,
+  sub TEXT NOT NULL,
+  claims_json TEXT,
+  status TEXT NOT NULL DEFAULT 'pending',
+  decided_role TEXT,
+  decided_org TEXT,
+  decided_by TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  last_seen TEXT,
+  decided_at TEXT,
+  UNIQUE (issuer, sub)
+);

package/migrations/0003_federation_peers.sql

@@ -0,0 +1,21 @@
+-- Migration 0003 — federation peers (TODO.federation/04).
+-- The peer registry: pinned counterparty instances (descriptor + trust
+-- posture). schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+CREATE TABLE IF NOT EXISTS federation_peers (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  roles TEXT NOT NULL,
+  descriptor_url TEXT,
+  descriptor_json TEXT NOT NULL,
+  pinned_via TEXT NOT NULL DEFAULT 'url',
+  connectivity TEXT NOT NULL DEFAULT 'verified',
+  status TEXT NOT NULL DEFAULT 'active',
+  added_at TEXT NOT NULL DEFAULT (datetime('now')),
+  added_by TEXT,
+  refreshed_at TEXT,
+  revoked_at TEXT,
+  revoked_by TEXT
+);

package/migrations/0003_users_rbac.sql

@@ -0,0 +1,8 @@
+-- Migration 0003 — the RBAC user columns (TODO.federation/12).
+-- schema.sql (fresh node DBs) carries these columns in the users CREATE;
+-- THIS migration upgrades D1 databases created from 0001+0002. The node
+-- store's migrateAuthTables and the D1 store's column probe apply the
+-- same adds defensively (a dev database migrated before this file
+-- landed).
+ALTER TABLE users ADD COLUMN roles TEXT;
+ALTER TABLE users ADD COLUMN active INTEGER NOT NULL DEFAULT 1;

package/migrations/0004_oidc_op.sql

@@ -0,0 +1,61 @@
+-- Migration 0004 — the OIDC Provider (TODO.identity/01).
+-- Adds the OP's D1-backed state: the client registry, the pending
+-- authorizations, the one-time codes, the access tokens, and the
+-- signing-key rotation history (public halves only). schema.sql carries
+-- the same end state for fresh databases — src/__tests__/d1-store.test.ts
+-- pins the UNION of every migration to schema.sql's CREATE set.
+
+CREATE TABLE IF NOT EXISTS oidc_clients (
+  client_id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  secret_hash TEXT,
+  redirect_uris TEXT NOT NULL,
+  claims_policy TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  created_by TEXT
+);
+
+CREATE TABLE IF NOT EXISTS oidc_authorizations (
+  id TEXT PRIMARY KEY,
+  client_id TEXT NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  state TEXT NOT NULL,
+  nonce TEXT,
+  code_challenge TEXT NOT NULL,
+  user_id TEXT,
+  decision TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  expires_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS oidc_codes (
+  code TEXT PRIMARY KEY,
+  client_id TEXT NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  nonce TEXT,
+  code_challenge TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  expires_at TEXT NOT NULL,
+  consumed_at TEXT
+);
+
+CREATE TABLE IF NOT EXISTS oidc_access_tokens (
+  token TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS oidc_keys (
+  kid TEXT PRIMARY KEY,
+  public_jwk TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  retired_at TEXT
+);

package/migrations/0005_upstream_providers.sql

@@ -0,0 +1,34 @@
+-- Migration 0005 — the upstream provider registry (TODO.identity/08).
+-- Adds the OP's upstream sign-in registry (identity_providers: GitHub +
+-- Google + Apple + Entra + generic OIDC rows, secrets by env reference)
+-- and the linked identities (identity_links — TODO.identity/02's shape,
+-- landed additively here because 08's flows consume them; THE MATCH
+-- RULE: resolve by (provider, provider_account_id), never by email).
+-- schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+CREATE TABLE IF NOT EXISTS identity_providers (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL,
+  display_name TEXT NOT NULL,
+  brand_mark TEXT,
+  issuer TEXT,
+  client_id TEXT NOT NULL,
+  client_secret_ref TEXT,
+  scopes TEXT,
+  enabled INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  created_by TEXT,
+  updated_at TEXT
+);
+
+CREATE TABLE IF NOT EXISTS identity_links (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  provider TEXT NOT NULL,
+  provider_account_id TEXT NOT NULL,
+  linked_at TEXT NOT NULL DEFAULT (datetime('now')),
+  linked_by TEXT,
+  UNIQUE (provider, provider_account_id)
+);

package/migrations/0006_op_accounts.sql

@@ -0,0 +1,28 @@
+-- Migration 0006 — the OP's account model (TODO.identity/02).
+-- Adds the password credentials (apart from the users row, so no
+-- SELECT * ever reads credential material) and the invite-only
+-- enrollment tokens (one-time, 24 h, atomically consumed). The linked
+-- identities table itself landed with 0005_upstream_providers (08's
+-- flows consume it); this migration adds the per-user index on it.
+-- schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+CREATE TABLE IF NOT EXISTS passwords (
+  user_id TEXT PRIMARY KEY REFERENCES users(id),
+  hash TEXT NOT NULL,
+  set_at TEXT NOT NULL DEFAULT (datetime('now')),
+  set_by TEXT
+);
+
+CREATE TABLE IF NOT EXISTS enrollment_tokens (
+  token TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  created_by TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  expires_at TEXT NOT NULL,
+  consumed_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_enrollment_tokens_user ON enrollment_tokens (user_id);
+
+CREATE INDEX IF NOT EXISTS idx_identity_links_user ON identity_links (user_id);

package/migrations/0007_org_join_requests.sql

@@ -0,0 +1,26 @@
+-- TODO.identity/10 — delegated organization administration: the
+-- self-service join requests. org_id set = a registered participant
+-- org's queue (its org admin decides); org_id NULL + org_name_text =
+-- the "my organization is not listed" path (BIML's new-organizations
+-- queue). The decision is atomic on status='pending'; approval records
+-- the invited account (invited_user_id).
+-- schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+CREATE TABLE IF NOT EXISTS org_join_requests (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  email TEXT NOT NULL,
+  org_id TEXT,
+  org_name_text TEXT,
+  requested_role TEXT NOT NULL,
+  note TEXT,
+  status TEXT NOT NULL DEFAULT 'pending',
+  decided_by TEXT,
+  decided_at TEXT,
+  refusal_reason TEXT,
+  invited_user_id TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_org_join_requests_org ON org_join_requests (org_id, status);

package/migrations/0008_op_client_roles.sql

@@ -0,0 +1,19 @@
+-- Migration 0008 — the central user registry's PER-CLIENT role
+-- assignments (TODO.identity/03). One row per (user, client): the ID
+-- token issued to that client carries these roles (filtered by the
+-- client's claims-policy role allowlist); no row = the account's
+-- OP-side role set is the federation-wide default (the pre-03
+-- behavior); roles='[]' = explicitly no roles on this client.
+-- schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+CREATE TABLE IF NOT EXISTS op_client_roles (
+  user_id TEXT NOT NULL REFERENCES users(id),
+  client_id TEXT NOT NULL,
+  roles TEXT NOT NULL,
+  assigned_by TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT,
+  PRIMARY KEY (user_id, client_id)
+);

package/migrations/0009_account_console.sql

@@ -0,0 +1,32 @@
+-- Migration 0009 — the account-holder console (TODO.identity/06).
+-- (The 0009 prefix is shared with 0009_sso_states.sql (TODO.identity/04);
+-- the D1 migrations journal keys on the FILE NAME — the double-0003
+-- precedent — and the two touch disjoint tables/columns. The name must
+-- stay exactly this: the shared preview D1 applied it under this name,
+-- and a rename re-runs the ALTERs there into duplicate-column errors.)
+--   users.email_verified_at      — the primary address's verification state
+--   sessions.user_agent / ip / last_seen_at — the sign-in context the
+--                                  sessions section lists
+--   email_change_tokens          — the verify-new-email ceremony (one-time,
+--                                  24 h, atomically consumed; delivered_by
+--                                  records the mailer vs on-screen channel)
+-- schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+ALTER TABLE users ADD COLUMN email_verified_at TEXT;
+
+ALTER TABLE sessions ADD COLUMN user_agent TEXT;
+ALTER TABLE sessions ADD COLUMN ip TEXT;
+ALTER TABLE sessions ADD COLUMN last_seen_at TEXT;
+
+CREATE TABLE IF NOT EXISTS email_change_tokens (
+  token TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  new_email TEXT NOT NULL,
+  delivered_by TEXT NOT NULL DEFAULT 'shown',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  expires_at TEXT NOT NULL,
+  consumed_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_email_change_tokens_user ON email_change_tokens (user_id);

package/migrations/0009_sso_states.sql

@@ -0,0 +1,13 @@
+-- TODO.identity/04 — the relying party's OIDC sign-in state jar (the
+-- /signin/oidc → /callback/oidc round trip's one-time state: the nonce +
+-- the PKCE verifier). STORE-BACKED so the Worker's isolates share it —
+-- the per-process Map intermittently failed the state check across
+-- isolates (the GitHub-flow lesson, retired for SSO too).
+CREATE TABLE IF NOT EXISTS sso_states (
+  state TEXT PRIMARY KEY,
+  nonce TEXT NOT NULL,
+  verifier TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  expires_at TEXT NOT NULL,
+  consumed_at TEXT
+);

package/migrations/0010_notify_events.sql

@@ -0,0 +1,23 @@
+-- TODO.notify/01 — the platform event store (the notification system's
+-- source of truth): one row per DECLARED notifiable act (the catalog,
+-- browser/src/notify/catalog.ts, is deliberate — not every write is an
+-- event). The hierarchical key <domain>/<entity-id>/<action> is SPLIT
+-- into columns so the subscription grammar's prefixes resolve in SQL
+-- (WHERE domain = ? AND entity_id = ?), never a string scan; the
+-- composed key is derived at read. payload is the catalog row's JSON
+-- envelope (the summary line, the deep link, the actors, the entity's
+-- store for the read-time visibility gate). seq is the feed cursor;
+-- written inside the acting request's envelope, never blocking the
+-- triggering flow (the mailer doctrine). The d1-store suite's drift
+-- tripwire pins this migration set's end state to schema.sql.
+CREATE TABLE IF NOT EXISTS events (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT UNIQUE NOT NULL,
+  domain TEXT NOT NULL,
+  entity_id TEXT NOT NULL,
+  action TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_events_domain_entity ON events (domain, entity_id);
+CREATE INDEX IF NOT EXISTS idx_events_domain_action ON events (domain, action);

package/migrations/0011_op_launch.sql

@@ -0,0 +1,18 @@
+-- Migration 0011 — the SSO home's launch metadata on the OIDC client
+-- registry (the identity service's post-login launcher: the spec is
+-- TODO.identity-extract/02a's "post-login landing"). One set of columns
+-- per client: the launch URL (the service's sign-in start; NULL = the
+-- client never appears on the launcher), the icon glyph's name, the
+-- one-line description, and the visibility rule for an account the
+-- computed role set does not admit ('roles' hides the card, 'request'
+-- shows it with the plain request-access state, 'open' never gates).
+-- Numbering: 0010 is the platform's notify wave; the identity repo's
+-- byte-identical set continues the shared numbering here.
+-- schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+ALTER TABLE oidc_clients ADD COLUMN launch_url TEXT;
+ALTER TABLE oidc_clients ADD COLUMN launch_icon TEXT;
+ALTER TABLE oidc_clients ADD COLUMN launch_description TEXT;
+ALTER TABLE oidc_clients ADD COLUMN launch_visibility TEXT NOT NULL DEFAULT 'roles';

package/migrations/0011_org_memberships.sql

@@ -0,0 +1,62 @@
+-- Migration 0011 — the multi-organization membership model
+-- (TODO.identity/11). An account can belong to SEVERAL organizations and
+-- acts AS one at a time (the GitHub context-switch pattern): the
+-- org_memberships table carries the account × org × per-org role set with
+-- the lifecycle state (invited → active ⇄ disabled); the session's
+-- active_org stamp names the context the account acts under; the OIDC
+-- code + access token carry the context the consent was given under (the
+-- token endpoint re-judges it against the live membership, so a
+-- membership disabled mid-flow never emits a dead org's claims).
+--
+-- (The 0011 prefix is shared with 0011_op_launch.sql (the SSO home's
+-- launch metadata); the D1 migrations journal keys on the FILE NAME —
+-- the double-0003 and double-0009 precedents — and the two touch
+-- disjoint tables/columns. The name must stay exactly this: a SHARED D1
+-- applied it under this name (the preview registry), and a rename
+-- re-runs the ALTERs there into duplicate-column errors.)
+--
+-- THE DUAL-READ DOCTRINE: the users row's org_id/roles columns stay the
+-- BACKWARD-COMPATIBLE read — the PRIMARY membership's mirror — until
+-- every consumer reads the memberships. The backfill below (idempotent;
+-- the stores' defensive ensures carry its twin for pre-migration dev
+-- databases) creates every org-bound account's primary membership from
+-- the legacy columns, so the legacy read and the membership read agree
+-- from the first request.
+-- schema.sql carries the same end state for fresh databases —
+-- src/__tests__/d1-store.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+CREATE TABLE IF NOT EXISTS org_memberships (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  org_id TEXT NOT NULL,
+  -- The per-org role set (JSON array): the roles the account's tokens
+  -- carry when it acts AS this org.
+  roles TEXT NOT NULL DEFAULT '[]',
+  state TEXT NOT NULL DEFAULT 'active',
+  -- The PRIMARY membership mirrors the users row's org_id/roles (the
+  -- dual-read doctrine; one per account).
+  is_primary INTEGER NOT NULL DEFAULT 0,
+  invited_by TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  activated_at TEXT,
+  disabled_at TEXT,
+  disabled_by TEXT,
+  UNIQUE (user_id, org_id)
+);
+CREATE INDEX IF NOT EXISTS idx_org_memberships_org ON org_memberships (org_id, state);
+CREATE INDEX IF NOT EXISTS idx_org_memberships_user ON org_memberships (user_id, state);
+
+ALTER TABLE sessions ADD COLUMN active_org TEXT;
+ALTER TABLE oidc_codes ADD COLUMN context_org TEXT;
+ALTER TABLE oidc_access_tokens ADD COLUMN context_org TEXT;
+
+-- The backfill: every org-bound account's primary membership, mirrored
+-- from the legacy columns (the full legacy role set, or the primary role
+-- when the set column is NULL). Idempotent (INSERT OR IGNORE + the
+-- deterministic id), so the stores' defensive twin never duplicates.
+INSERT OR IGNORE INTO org_memberships (id, user_id, org_id, roles, state, is_primary, activated_at)
+SELECT 'mbr-' || id, id, org_id,
+       CASE WHEN roles IS NOT NULL AND roles != '' THEN roles ELSE json_array(role) END,
+       'active', 1, COALESCE(last_login, created_at)
+FROM users WHERE org_id IS NOT NULL;

package/migrations/0012_notify_subscriptions.sql

@@ -0,0 +1,57 @@
+-- TODO.notify/02 — the subscriptions store (the notification system's
+-- per-user rules, the GitHub shape; TODO.notify/00's contract). Three
+-- tables:
+--
+--   notify_rules: the per-user rule rows (mode subscribe|mute) on a key
+--   pattern in the catalog's grammar (application/**, certificate/**/
+--   issued, test-run/asg-…-001/**, or an exact key). The pattern's
+--   pinned legs are SPLIT into columns (domain is always pinned;
+--   entity_id/action NULL = the wild leg) so the recipient
+--   resolution's REVERSE match — every user's rules covering one event —
+--   resolves in SQL (WHERE domain = ? AND (entity_id IS NULL OR
+--   entity_id = ?) AND (action IS NULL OR action = ?)), never a string
+--   scan. channel_overrides is the subscribe row's per-rule email
+--   override (JSON; NULL = the category preference rules on); a mute
+--   row never carries one.
+CREATE TABLE IF NOT EXISTS notify_rules (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  pattern TEXT NOT NULL,
+  domain TEXT NOT NULL,
+  entity_id TEXT,
+  action TEXT,
+  mode TEXT NOT NULL,
+  channel_overrides TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE (user_id, pattern)
+);
+CREATE INDEX IF NOT EXISTS idx_notify_rules_user ON notify_rules (user_id);
+CREATE INDEX IF NOT EXISTS idx_notify_rules_event ON notify_rules (domain, entity_id, action);
+
+--   notify_entity_mutes: the thread-level mutes (the entity-page bell's
+--   Muted state; the email footer's one-click unsubscribe — TODO.notify/
+--   04 — sets the same row). A mute wins over every candidate class,
+--   subscriptions included; the access is unchanged.
+CREATE TABLE IF NOT EXISTS notify_entity_mutes (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  domain TEXT NOT NULL,
+  entity_id TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  UNIQUE (user_id, domain, entity_id)
+);
+CREATE INDEX IF NOT EXISTS idx_notify_entity_mutes_entity ON notify_entity_mutes (domain, entity_id);
+
+--   notify_preferences: one row per user — the per-category (the event
+--   catalog's domains) email posture as a JSON map { "<domain>":
+--   "immediate"|"digest"|"off" }. A domain ABSENT falls back to the
+--   catalog row's own email default; the inbox always carries the
+--   event. No row at all = every category on its catalog default.
+CREATE TABLE IF NOT EXISTS notify_preferences (
+  user_id TEXT PRIMARY KEY REFERENCES users(id),
+  channels TEXT NOT NULL DEFAULT '{}',
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- The d1-store suite's drift tripwire pins this migration set's end
+-- state to schema.sql (packages/platform-server/src/store/sqlite).