@openlup/platform 0.0.0 → 0.16.0

package/src/identity/privacyUseCases.ts

@@ -0,0 +1,48 @@
+import { privacyExportResponseSchema, erasureReceiptSchema, privacySubjectSchema, privacyEraseRequestSchema } from "./contracts/privacy.js";
+import { PrivacyRefusal, type PrivacyUseCaseDependencies, type AuthorizedHumanAdministrator, type PrivacyOperations } from "./privacyPorts.js";
+import type { PrivacySubjectRef, PrivacyEraseRequest, PrivacyExport, ErasureReceipt } from "./contracts/privacy.js";
+
+export async function exportPersonalData<C>(deps: PrivacyUseCaseDependencies<C>, actor: AuthorizedHumanAdministrator, input: PrivacySubjectRef): Promise<PrivacyExport> {
+  const subject = privacySubjectSchema.parse(input);
+  return deps.unitOfWork.run(async context => {
+    const resolved = await deps.store.resolve(context, subject);
+    if (!resolved) throw new PrivacyRefusal("PRIVACY_SUBJECT_NOT_FOUND");
+    const documents = [];
+    for (const contributor of deps.registry.contributors) {
+      const document = await contributor.export(context, resolved);
+      if (document.contributorId !== contributor.id || document.version !== contributor.version) throw new PrivacyRefusal("PRIVACY_OWNERSHIP_UNDECLARED");
+      documents.push(document);
+    }
+    return privacyExportResponseSchema.parse({ format: "personal-data.v1", generatedAt: deps.now().toISOString(), subject, documents, missingContributors: [...deps.registry.missingContributors], erasure: await deps.store.findReceipt(context, subject) });
+  });
+}
+export async function erasePersonalData<C>(deps: PrivacyUseCaseDependencies<C>, actor: AuthorizedHumanAdministrator, request: PrivacyEraseRequest): Promise<ErasureReceipt> {
+  const input = privacyEraseRequestSchema.parse(request);
+  // Capability refusal precedes even opening a managed transaction or provider request.
+  if (!deps.store.erasureSupported) throw new PrivacyRefusal("MANAGED_PRIVACY_ERASURE_UNAVAILABLE");
+  if (deps.registry.missingContributors.length || !deps.registry.contributors.some(c => c.id === "identity")) throw new PrivacyRefusal("PRIVACY_CONTRIBUTOR_MISSING");
+  return deps.unitOfWork.run(async context => {
+    await deps.store.prepareErasure(context);
+    // Domain relation locks precede subject/member row locks and remain held to commit.
+    for (const contributor of deps.registry.contributors) await contributor.prepareErasure(context);
+    const resolved = await deps.store.resolve(context, input.subject, actor);
+    await deps.store.authorizeErasure(context, actor);
+    const previous = await deps.store.findReceipt(context, input.subject, input.idempotencyKey);
+    if (previous) return erasureReceiptSchema.parse({ ...previous, outcome: "ALREADY_ERASED" });
+    if (!resolved) throw new PrivacyRefusal("PRIVACY_SUBJECT_NOT_FOUND");
+    const assessments = [];
+    for (const contributor of deps.registry.contributors) {
+      const assessment = await contributor.assessErasure(context, resolved);
+      if (assessment.obligations.some(o => o.disposition === "unresolved")) throw new PrivacyRefusal("PRIVACY_OWNERSHIP_UNDECLARED");
+      assessments.push(assessment);
+    }
+    const dispositions = [];
+    for (let i = 0; i < deps.registry.contributors.length; i++) dispositions.push(await deps.registry.contributors[i]!.eraseOrRetain(context, resolved, assessments[i]!, actor));
+    const receipt = erasureReceiptSchema.parse({ version: "identity.erasure.v1", erasureId: deps.randomId(), completedAt: deps.now().toISOString(), outcome: "ERASED", obligations: dispositions.flatMap(d => d.obligations) });
+    await deps.store.saveReceipt(context, resolved, actor, input.idempotencyKey, receipt, dispositions);
+    return receipt;
+  });
+}
+export function createPrivacyOperations<C>(deps: PrivacyUseCaseDependencies<C>): PrivacyOperations {
+  return { export: (actor, subject) => exportPersonalData(deps, actor, subject), erase: (actor, input) => erasePersonalData(deps, actor, input) };
+}

package/src/identity/reconcileAccountForPrincipal.ts

@@ -0,0 +1,99 @@
+import { assessEmailTrust, type EmailTrustPolicy } from "./emailTrustPolicy.js";
+import type { EmailTrustFailureCode } from "./contracts/emailTrust.js";
+import type { AccountLinkStore } from "./ports.js";
+
+
+
+export interface ReconcileAccountInput {
+  principalId: string;
+  email: string | null;
+  emailVerified: boolean;
+}
+
+export type ReconcileAccountErrorCode =
+  | EmailTrustFailureCode
+  | "NO_VERIFIED_EMAIL"
+  | "RESERVED_PRINCIPAL_REFUSED"
+  | "PRINCIPAL_EMAIL_MISMATCH"
+  | "ACCOUNT_LINK_CONFLICT"
+  | "EMAIL_OWNED_BY_OTHER_PRINCIPAL";
+
+export type ReconcileAccountResult =
+  | { ok: true; accountId: string; created: boolean; linked: boolean }
+  | { ok: false; code: ReconcileAccountErrorCode; existingPrincipalId?: string | null };
+
+export async function reconcileAccountForPrincipal(
+  store: AccountLinkStore,
+  input: ReconcileAccountInput,
+  emailTrustPolicy: EmailTrustPolicy,
+): Promise<ReconcileAccountResult> {
+  const email = normalizeEmail(input.email);
+  if (!email || !input.emailVerified) {
+    return { ok: false, code: "NO_VERIFIED_EMAIL" };
+  }
+  if (await store.isReservedPrincipal(input.principalId)) {
+    return { ok: false, code: "RESERVED_PRINCIPAL_REFUSED" };
+  }
+
+  const byPrincipal = await store.findAccountByPrincipalId(input.principalId);
+  if (byPrincipal) {
+    const accountEmail = normalizeEmail(byPrincipal.email);
+    if (accountEmail && accountEmail !== email) {
+      return { ok: false, code: "PRINCIPAL_EMAIL_MISMATCH", existingPrincipalId: input.principalId };
+    }
+    return { ok: true, accountId: byPrincipal.id, created: false, linked: false };
+  }
+
+  const trust = await assessEmailTrust(emailTrustPolicy);
+  if (!trust.trusted) return { ok: false, code: trust.code };
+
+  const viaEmail = await resolveByEmail(store, email, input.principalId);
+  if (viaEmail) return viaEmail;
+  try {
+    const created = await store.createAccount({
+      email,
+      principalId: input.principalId,
+      acquisitionSource: "social_signup",
+      lifecycleStage: "lead",
+    });
+    return { ok: true, accountId: created.id, created: true, linked: true };
+  } catch (err) {
+    const retry = await resolveByEmail(store, email, input.principalId);
+    if (retry) return retry;
+    throw err;
+  }
+}
+
+function normalizeEmail(email: string | null | undefined): string {
+  return (email ?? "").trim().toLowerCase();
+}
+
+async function resolveByEmail(
+  store: AccountLinkStore,
+  email: string,
+  principalId: string,
+): Promise<ReconcileAccountResult | null> {
+  const account = await store.findAccountByEmail(email);
+  if (!account) return null;
+
+  if (account.principalId === principalId) {
+    return { ok: true, accountId: account.id, created: false, linked: false };
+  }
+  if (account.principalId !== null) {
+    return {
+      ok: false,
+      code: "EMAIL_OWNED_BY_OTHER_PRINCIPAL",
+      existingPrincipalId: account.principalId,
+    };
+  }
+
+  const link = await store.linkPrincipalToAccount(account.id, principalId);
+  if (link.ok === true) {
+    return { ok: true, accountId: account.id, created: false, linked: true };
+  }
+  return {
+    ok: false,
+    code: "ACCOUNT_LINK_CONFLICT",
+    existingPrincipalId: link.existingPrincipalId,
+  };
+}

package/src/identity/reconcileAccountHandler.ts

@@ -0,0 +1,36 @@
+import type { EmailTrustPolicy } from "./emailTrustPolicy.js";
+import { createIdentityResponder, type IdentityResponseOptions } from "./response.js";
+import type { HttpRequest, HttpResponse } from "../http/index.js";
+import type { AccountLinkStore, IdentityVerifierPort } from "./ports.js";
+import { reconcileAccountForPrincipal, type ReconcileAccountErrorCode } from "./reconcileAccountForPrincipal.js";
+import { readBearerToken } from "./adminAuthorization.js";
+
+export function createReconcileAccountHandler(options: IdentityResponseOptions & {
+  verifier: IdentityVerifierPort;
+  store: AccountLinkStore;
+  emailTrustPolicy: EmailTrustPolicy;
+  message?: (code: ReconcileAccountErrorCode) => string;
+}) {
+  const { sendBffError, sendBffSuccess, sendMethodNotAllowed } = createIdentityResponder(options);
+  return async (req: HttpRequest, res: HttpResponse): Promise<void> => {
+    if (req.method !== "POST") return sendMethodNotAllowed(res, ["POST"]);
+    const token = readBearerToken(req);
+    if (!token) return sendBffError(res, "UNAUTHORIZED", "Customer session required");
+    try {
+      const principal = await options.verifier.verifyAccessToken(token);
+      if (!principal) return sendBffError(res, "UNAUTHORIZED", "Customer session required");
+      const result = await reconcileAccountForPrincipal(options.store, principal, options.emailTrustPolicy);
+      if (!result.ok) {
+        const code = result.code === "NO_VERIFIED_EMAIL" ? "BAD_REQUEST"
+          : result.code === "EMAIL_TRUST_SETTINGS_UNAVAILABLE" ? "UPSTREAM_UNAVAILABLE"
+          : result.code === "RESERVED_PRINCIPAL_REFUSED" || result.code === "EMAIL_TRUST_ENVELOPE_REFUSED" ? "FORBIDDEN" : "CONFLICT";
+        sendBffError(res, code,
+          options.message?.(result.code) ?? result.code, { details: { code: result.code } });
+        return;
+      }
+      sendBffSuccess(res, { accountId: result.accountId, created: result.created, linked: result.linked });
+    } catch {
+      sendBffError(res, "UPSTREAM_UNAVAILABLE", "Account reconciliation failed");
+    }
+  };
+}

package/src/identity/removeAdminUserUseCase.ts

@@ -0,0 +1,85 @@
+import type { OperatorInvitationStore } from "./operatorInvitationPorts.js";
+import { identityMessages, type IdentityMessages } from "./messages.js";
+export type RemoveAdminUserResponse = {
+  revoked?: true;
+  error?: string;
+  code?: string;
+};
+
+export interface RemoveAdminUserGateway {
+  getUser: (accessToken: string) => Promise<{
+    user: { id: string } | null;
+    error: unknown;
+  }>;
+  findAdminUser: (userId: string) => Promise<{ id: string; role: string } | null>;
+  revokeAdminUser: (userId: string) => Promise<{ error: { message: string } | null }>;
+}
+
+export async function runRemoveAdminUserUseCase(
+  request: { accessToken: string | null; userId: string },
+  gateway: RemoveAdminUserGateway,
+  messages: IdentityMessages = identityMessages.en,
+  invitationStore?: Pick<OperatorInvitationStore, "remove">,
+): Promise<{ status: number; body: RemoveAdminUserResponse }> {
+  try {
+    if (!request.accessToken) {
+      return { status: 401, body: { code: "UNAUTHORIZED", error: messages.unauthorized } };
+    }
+
+    const { user, error: authError } = await gateway.getUser(request.accessToken);
+    if (authError || !user) {
+      return { status: 401, body: { code: "INVALID_TOKEN", error: messages.invalidToken } };
+    }
+
+    const callerAdmin = await gateway.findAdminUser(user.id);
+    if (!callerAdmin || callerAdmin.role !== "admin") {
+      return { status: 403, body: { code: "REMOVE_FORBIDDEN", error: messages.removeForbidden } };
+    }
+
+    if (!request.userId) {
+      return { status: 400, body: { code: "USER_ID_REQUIRED", error: messages.userIdRequired } };
+    }
+
+    if (request.userId === user.id) {
+      return { status: 403, body: { code: "SELF_REVOKE_FORBIDDEN", error: messages.selfRemoveForbidden } };
+    }
+
+    if (invitationStore) {
+      try {
+        await invitationStore.remove({ actorPrincipalId: user.id, targetPrincipalId: request.userId });
+        return { status: 200, body: { revoked: true } };
+      } catch (error) {
+        const failure = error as { identityCode?: string; bffCode?: string; message?: string };
+        if (failure.identityCode) return { status: failure.bffCode === "FORBIDDEN" ? 403 : failure.bffCode === "BAD_REQUEST" ? 400 : 409, body: { code: failure.identityCode, error: failure.identityCode } };
+        return mapRevokeError(failure.message ?? "revoke_failed", messages);
+      }
+    }
+    const { error: revokeError } = await gateway.revokeAdminUser(request.userId);
+    if (revokeError) {
+      return mapRevokeError(revokeError.message, messages);
+    }
+
+    return { status: 200, body: { revoked: true } };
+  } catch (err) {
+    return { status: 500, body: { code: "IDENTITY_ACTION_FAILED", error: String(err) } };
+  }
+}
+
+function mapRevokeError(message: string, messages: IdentityMessages): { status: number; body: RemoveAdminUserResponse } {
+  if (message.includes("last_active_human_admin") || message.includes("last_admin_lockout")) {
+    return { status: 409, body: { code: "LAST_ACTIVE_HUMAN_ADMIN", error: messages.lastAdmin } };
+  }
+  if (message.includes("self_revoke_forbidden")) {
+    return { status: 403, body: { code: "SELF_REVOKE_FORBIDDEN", error: messages.selfRevoke } };
+  }
+  if (message.includes("machine_actor_revoke_forbidden")) {
+    return { status: 403, body: { code: "MACHINE_ACTOR_REVOKE_FORBIDDEN", error: messages.machineRevoke } };
+  }
+  if (message.includes("target_not_found") || message.includes("target_not_active")) {
+    return { status: 400, body: { code: "ADMIN_NOT_FOUND", error: messages.adminNotFound } };
+  }
+  if (message.includes("forbidden")) {
+    return { status: 403, body: { code: "ADMIN_REQUIRED", error: messages.adminRequired } };
+  }
+  return { status: 500, body: { code: "REVOKE_FAILED", error: messages.revokeFailed(message) } };
+}

package/src/identity/response.ts

@@ -0,0 +1,3 @@
+import { createBffResponder, type BffResponderOptions } from "../bff/index.js";
+export type IdentityResponseOptions = BffResponderOptions;
+export const createIdentityResponder = createBffResponder;

package/src/identity/sql.ts

@@ -0,0 +1,10 @@
+/** A projection of canonical migration units, never a second migration chain. */
+export const IDENTITY_MIGRATIONS = [
+  { id: "20260810180001_self_host_actor_auth", catalogPath: "db/platform/migrations/20260810180001_self_host_actor_auth.sql", position: 11, sha256: "84c80d328785151f1fdb5fc4b69220469ffb9c8579054c473ead910a273dfe7b", url: new URL("../../sql/20260810180001_self_host_actor_auth.sql", import.meta.url) },
+  { id: "20260810204057_customer_identity_read", catalogPath: "db/platform/migrations/20260810204057_customer_identity_read.sql", position: 12, sha256: "1aa626c0187a4ed9d08f152540e0d17c68cd678d2caf3e896ac444b5a38aafe3", url: new URL("../../sql/20260810204057_customer_identity_read.sql", import.meta.url) },
+  { id: "20260814090000_customer_selfservice_recovery", catalogPath: "db/platform/migrations/20260814090000_customer_selfservice_recovery.sql", position: 29, sha256: "ca7f58994533727eb58da148d549ff986fe8f55bb2ffc9eaf61e7d239675ba2e", url: new URL("../../sql/20260814090000_customer_selfservice_recovery.sql", import.meta.url) },
+  { id: "20260901143000_admin_membership_authority_foundation", catalogPath: "db/platform/migrations/20260901143000_admin_membership_authority_foundation.sql", position: 60, sha256: "bb4703b669d17e5a0eb4d9a4e8889d12e5286d4b5a813226a77ef2b71df8281f", url: new URL("../../sql/20260901143000_admin_membership_authority_foundation.sql", import.meta.url) },
+  { id: "20261018120000_identity_operator_invitations", catalogPath: "db/platform/migrations/20261018120000_identity_operator_invitations.sql", position: 67, sha256: "b73034908bd5e27819bcd421d17037a0f00a24aa3df1be1f8f9ca411bf984349", url: new URL("../../sql/20261018120000_identity_operator_invitations.sql", import.meta.url) },
+  { id: "20261018180000_identity_operator_challenges", catalogPath: "db/platform/migrations/20261018180000_identity_operator_challenges.sql", position: 68, sha256: "191cf0c151a5882ad20d6043624da50afad799df739fff326d67560d3e00a031", url: new URL("../../sql/20261018180000_identity_operator_challenges.sql", import.meta.url) },
+  { id: "20261018190000_identity_privacy_erasures", catalogPath: "db/platform/migrations/20261018190000_identity_privacy_erasures.sql", position: 69, sha256: "f39b691cb14c0e9ec1a7460d77dc46e16bca4d2448838e4882f78885a6d92351", url: new URL("../../sql/20261018190000_identity_privacy_erasures.sql", import.meta.url) },
+] as const;

package/src/job-ledger/index.ts

@@ -0,0 +1,25 @@
+export type {
+  PlatformJobBackstopState,
+  PlatformJobClaim,
+  PlatformJobFinishStatus,
+  PlatformJobFinishSummary,
+  PlatformJobInvocation,
+  PlatformJobRunLedgerPort,
+  PlatformJobTriggerKind,
+} from "./ports.js";
+export type { PgQueryExecutor } from "../data/index.js";
+export {
+  createPostgresPlatformJobRunLedger,
+  type PostgresPlatformJobRunLedgerOptions,
+} from "./postgres.js";
+export { JOB_RUN_LEDGER_MIGRATIONS, JOB_RUN_LEDGER_SQL_URL, JOB_RUN_LEDGER_V3_SQL_URL } from "./sql.js";
+export {
+  createManagedJobRunCalls,
+  createSupabasePlatformJobRunLedger,
+  platformJobInvocationForDriver,
+  type ManagedJobRunOptions,
+  type PlatformJobClient,
+  type PlatformJobDriver,
+  type PlatformJobSupabaseClient,
+  type SupabasePlatformJobRunLedgerOptions,
+} from "./supabase.js";

package/src/job-ledger/ports.ts

@@ -0,0 +1,27 @@
+// Persistence-neutral scheduled-job lease and attempt ledger port.
+//
+// The claim and finish contract is core's `JobLeasePort`. A job-run ledger adds the two reads a
+// scheduled job uses for its backstop and checkpoint. Invocation is deployment evidence supplied by
+// the composition root; a job never sees a database client, SDK query, RPC name, vendor driver or
+// environment configuration.
+
+import type { JobLeasePort } from "@openlup/core/platform-runtime";
+
+export type {
+  PlatformJobClaim,
+  PlatformJobFinishStatus,
+  PlatformJobFinishSummary,
+  PlatformJobInvocation,
+  PlatformJobTriggerKind,
+} from "@openlup/core/platform-runtime";
+
+export type PlatformJobBackstopState = {
+  lastStatus: string | null;
+  lastSuccessAt: string | null;
+};
+
+export interface PlatformJobRunLedgerPort extends JobLeasePort {
+  readJobBackstopState(jobName: string): Promise<PlatformJobBackstopState | null>;
+
+  readLatestTerminalRunMetadata(jobName: string): Promise<Record<string, unknown> | null>;
+}

package/src/job-ledger/postgres.ts

@@ -0,0 +1,121 @@
+// Direct PostgreSQL adapter for the public job-run ledger (claim, finish, backstop, checkpoint).
+//
+// The RPCs and tables come from the package's job-run ledger SQL. Every claim and finish row
+// carries the invocation and the deployment's release correlation in its metadata.
+
+import type { PgQueryExecutor } from "../data/index.js";
+import type { PlatformJobRunLedgerPort } from "./ports.js";
+
+const CLAIM_SQL = `
+  SELECT acquired, run_id, reason
+  FROM public.platform_claim_job_run_v3($1, $2, $3, $4, $5::jsonb)`;
+
+const FINISH_SQL = `
+  SELECT public.platform_finish_job_run_v3(
+    $1, $2::uuid, $3, $4, $5, $6, $7, $8::jsonb
+  ) AS released`;
+
+const BACKSTOP_SQL = `
+  SELECT last_status, last_success_at
+  FROM public.platform_job_controls
+  WHERE job_name = $1`;
+
+const LATEST_TERMINAL_METADATA_SQL = `
+  SELECT metadata
+  FROM public.platform_job_runs
+  WHERE job_name = $1
+    AND status IN ('success', 'failed')
+    AND finished_at IS NOT NULL
+  ORDER BY started_at DESC
+  LIMIT 1`;
+
+export interface PostgresPlatformJobRunLedgerOptions {
+  /** Release and deployment identity merged into every claim and finish row's metadata. */
+  releaseCorrelation: () => Record<string, string | null>;
+  /** Failure reason recorded when a failed run's summary carries none. */
+  defaultFailureReason: string;
+}
+
+/** Direct PostgreSQL adapter for the public neutral-vocabulary job-control rail. */
+export function createPostgresPlatformJobRunLedger(
+  executor: PgQueryExecutor,
+  options: PostgresPlatformJobRunLedgerOptions,
+): PlatformJobRunLedgerPort {
+  return {
+    async claimJobRun(jobName, invocation, leaseSeconds = 900) {
+      const invocationSource = requiredInvocationSource(invocation.invocationSource);
+      const result = await executor.query(CLAIM_SQL, [
+        jobName,
+        invocation.triggerKind,
+        invocationSource,
+        leaseSeconds,
+        {
+          triggerKind: invocation.triggerKind,
+          invocationSource,
+          ...options.releaseCorrelation(),
+        },
+      ]);
+      const row = plainRecord(result.rows[0]);
+      return {
+        acquired: row?.acquired === true,
+        runId: typeof row?.run_id === "string" ? row.run_id : null,
+        reason: typeof row?.reason === "string" ? row.reason : "unknown",
+      };
+    },
+
+    async finishJobRun(jobName, runId, invocation, status, summary, extraMetadata) {
+      const invocationSource = requiredInvocationSource(invocation.invocationSource);
+      const result = await executor.query(FINISH_SQL, [
+        jobName,
+        runId,
+        status,
+        summary.checked,
+        summary.updated,
+        status === "failed" ? summary.reason ?? options.defaultFailureReason : null,
+        null,
+        {
+          failures: summary.failures,
+          skipped: summary.skipped,
+          reason: summary.reason ?? null,
+          ...options.releaseCorrelation(),
+          ...(extraMetadata ?? {}),
+          triggerKind: invocation.triggerKind,
+          invocationSource,
+          driver: invocationSource,
+        },
+      ]);
+      return plainRecord(result.rows[0])?.released === true;
+    },
+
+    async readJobBackstopState(jobName) {
+      const result = await executor.query(BACKSTOP_SQL, [jobName]);
+      const row = plainRecord(result.rows[0]);
+      return row ? {
+        lastStatus: typeof row.last_status === "string" ? row.last_status : null,
+        lastSuccessAt: timestampString(row.last_success_at),
+      } : null;
+    },
+
+    async readLatestTerminalRunMetadata(jobName) {
+      const result = await executor.query(LATEST_TERMINAL_METADATA_SQL, [jobName]);
+      return plainRecord(plainRecord(result.rows[0])?.metadata);
+    },
+  };
+}
+
+function plainRecord(value: unknown): Record<string, unknown> | null {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  return { ...(value as Record<string, unknown>) };
+}
+
+function timestampString(value: unknown): string | null {
+  if (typeof value === "string") return value;
+  if (value instanceof Date) return value.toISOString();
+  return null;
+}
+
+function requiredInvocationSource(value: string): string {
+  const source = value.trim();
+  if (!source) throw new Error("platform_job_invocation_source_required");
+  return source;
+}

package/src/job-ledger/sql.ts

@@ -0,0 +1,12 @@
+// The job-run ledger SQL a fresh installation applies through its own migration chain, in order.
+// The first file's bytes and migration identity equal the reference application's platform
+// migration of the same name; the second adds the v3 claim and finish entry points.
+export const JOB_RUN_LEDGER_SQL_URL = new URL("../../sql/20260809150000_job_run_ledger.sql", import.meta.url);
+
+export const JOB_RUN_LEDGER_V3_SQL_URL = new URL("../../sql/20260809150001_job_run_ledger_v3.sql", import.meta.url);
+
+/** Every job-run ledger migration, ordered by migration identity. */
+export const JOB_RUN_LEDGER_MIGRATIONS: ReadonlyArray<{ readonly id: string; readonly url: URL }> = [
+  { id: "20260809150000_job_run_ledger", url: JOB_RUN_LEDGER_SQL_URL },
+  { id: "20260809150001_job_run_ledger_v3", url: JOB_RUN_LEDGER_V3_SQL_URL },
+];