@withbuddi/buddi 0.1.0-pre.16 → 0.1.0-pre.18

package/node_modules/@buddi/core/dist/vault/resolve.d.ts

@@ -1,9 +1,9 @@
 /**
  * Resolving one secret: vault first, environment second.
  *
- * The environment is the *documented day-1 fallback* (ARCHITECTURE.md,
- * "Credential kinds": «Secrets come from the vault; in the day-1 build they
- * come from `.env` via an explicit env-name reference»), not an accident — but
+ * The environment is the *documented fallback* (docs/architecture.md,
+ * "Credential kinds": «Credentials come from the vault, or from `.env` by
+ * explicit name»), not an accident — but
  * it is a fallback, so a secret the owner moved into the keychain wins over a
  * stale copy left in `.env`.
  *

package/node_modules/@buddi/core/dist/vault/resolve.js

@@ -1,9 +1,9 @@
 /**
  * Resolving one secret: vault first, environment second.
  *
- * The environment is the *documented day-1 fallback* (ARCHITECTURE.md,
- * "Credential kinds": «Secrets come from the vault; in the day-1 build they
- * come from `.env` via an explicit env-name reference»), not an accident — but
+ * The environment is the *documented fallback* (docs/architecture.md,
+ * "Credential kinds": «Credentials come from the vault, or from `.env` by
+ * explicit name»), not an accident — but
  * it is a fallback, so a secret the owner moved into the keychain wins over a
  * stale copy left in `.env`.
  *

package/node_modules/@buddi/core/dist/vault/types.d.ts

@@ -1,5 +1,5 @@
 /**
- * The vault port (ARCHITECTURE.md, "Secrets and operations").
+ * The vault port (docs/architecture.md, "Secrets and operations").
  *
  * A secrets *table* would hand mail and model credentials to anyone with the
  * database file, so secrets never live in Postgres. They live in the OS

package/node_modules/@buddi/core/dist/vault/types.js

@@ -1,5 +1,5 @@
 /**
- * The vault port (ARCHITECTURE.md, "Secrets and operations").
+ * The vault port (docs/architecture.md, "Secrets and operations").
  *
  * A secrets *table* would hand mail and model credentials to anyone with the
  * database file, so secrets never live in Postgres. They live in the OS
@@ -50,7 +50,7 @@ export const VAULT_SERVICE = 'buddi';
  */
 const NAME_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
 /**
- * Where an owner secret's value is filed (docs/specs/owner-secrets.md §7): by
+ * Where an owner secret's value is filed (docs/owner-secrets.md §7): by
  * the row's id, never its name, so a rename never touches the vault. The one
  * shape of name that is not environment-variable shaped, and it cannot be one
  * by accident.

package/node_modules/@buddi/core/migrations/003_owner_surfaces.sql

@@ -25,7 +25,7 @@ create index if not exists surface_identities_owner_idx
   on core.surface_identities (owner_id, surface);
 
 -- Polling offset per surface. Advanced only after the update is persisted
--- (ARCHITECTURE.md, "Offline contract").
+-- (docs/architecture.md, "Offline contract").
 create table if not exists core.surface_cursors (
   surface text primary key,
   cursor text,

package/node_modules/@buddi/core/migrations/005_artifacts.sql

@@ -1,6 +1,6 @@
 -- Artifacts: the store for files a mission builds or a surface hands in.
 --
--- ARCHITECTURE.md names artifacts a first-class core concept ("Data model"):
+-- docs/architecture.md names artifacts a first-class core concept ("Data model"):
 -- previewable from any surface, referable by approvals, and — with surface
 -- attachment ingest — the landing place for a Telegram photo or PDF. Core owns
 -- the table; the bytes live outside the database under BUDDI_DATA_DIR, so a

package/node_modules/@buddi/core/migrations/009_queue.sql

@@ -1,5 +1,4 @@
--- The durable job queue (ARCHITECTURE.md, "Queue, concurrency, recovery" —
--- Phase 1, not Phase 2).
+-- The durable job queue (docs/architecture.md, "Queue, concurrency, recovery").
 --
 -- Even a single owner overlaps: a Telegram message, a mail ingest, a retry and
 -- startup recovery all want to run at once. The queue is the one place where

package/node_modules/@buddi/core/migrations/010_actions.sql

@@ -1,6 +1,6 @@
 -- Actions, approvals and the effect ledger — the authorization boundary.
 --
--- ARCHITECTURE.md, "Actions and approvals": nothing at tier `gated` executes
+-- docs/architecture.md, "Actions and approvals": nothing at tier `gated` executes
 -- without an approval bound to an *immutable action object created before the
 -- approval request*. The three tables here are that machinery:
 --

package/node_modules/@buddi/core/migrations/043_owner_notifications.sql

@@ -0,0 +1,77 @@
+-- Reaching the owner (docs/notifications.md).
+--
+-- One row per thing buddi told, or will tell, the owner unasked. The row is
+-- the record: where it went, when, whether it was seen and acted on. Routing
+-- moves a row through `state` with one guarded UPDATE per step, so a tick that
+-- runs twice moves nothing twice.
+--
+-- state:
+--   shown    on the dashboard; `due_at` is when it goes to the channel anyway
+--            if nobody has seen it
+--   held     waiting for `due_at`: the end of the day for `today`, the end of
+--            quiet hours for `now`
+--   stored   kept for the record and the recap, never sent (`digest`, or a
+--            kind the owner turned off)
+--   sending  claimed by one delivery
+--   sent     a channel took it
+--   failed   no channel took it; `error` says why
+create table if not exists core.owner_notifications (
+  id uuid primary key default gen_random_uuid(),
+  kind text not null check (kind in ('approval', 'question', 'watcher', 'reminder', 'failure', 'recap', 'plugin')),
+  urgency text not null check (urgency in ('now', 'today', 'digest')),
+  title text not null,
+  text text,
+  link text,
+  offers jsonb not null default '[]'::jsonb,
+  dedupe_key text,
+  agent_id text,
+  plugin_id text,
+  -- The approval this row asks about: a channel that draws cards draws this one.
+  action_id uuid,
+  state text not null check (state in ('shown', 'held', 'stored', 'sending', 'sent', 'failed')),
+  due_at timestamptz,
+  channel text,
+  -- How many times this key fired into this row, and whether the rate rule
+  -- lowered it (the title then carries one sentence saying so).
+  fired_count integer not null default 1,
+  lowered boolean not null default false,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  sent_at timestamptz,
+  seen_at timestamptz,
+  acted_at timestamptz,
+  error text
+);
+
+create index if not exists owner_notifications_created on core.owner_notifications (created_at desc);
+create index if not exists owner_notifications_due on core.owner_notifications (state, due_at)
+  where state in ('shown', 'held');
+create index if not exists owner_notifications_dedupe on core.owner_notifications (dedupe_key, created_at desc)
+  where dedupe_key is not null;
+create index if not exists owner_notifications_action on core.owner_notifications (action_id)
+  where action_id is not null;
+
+-- Where the owner is. One row per surface; "present" is active within two
+-- minutes on any of them and not marked away since. Never sent anywhere.
+create table if not exists core.owner_presence (
+  surface text primary key,
+  last_active_at timestamptz not null,
+  away_at timestamptz,
+  updated_at timestamptz not null default now()
+);
+
+-- The few choices the Notifications page edits. One row at most; every value
+-- has a default in code, so no row is a complete answer.
+create table if not exists core.notification_settings (
+  id boolean primary key default true check (id),
+  -- A registered channel kind, or null for "the first one there is".
+  default_channel text,
+  -- kind -> channel kind, or 'off'. Approvals and questions cannot be off.
+  per_kind jsonb not null default '{}'::jsonb,
+  -- The owner's local clock, 'HH:MM'. Both or neither.
+  quiet_start text,
+  quiet_end text,
+  -- When the day's held items go out as one message. Null is 18:00.
+  end_of_day text,
+  updated_at timestamptz not null default now()
+);