aimeat 2.7.0 → 3.1.0

package/dist/src/storage/providers/postgres-kysely/migrations/0026_finance.sql

@@ -0,0 +1,130 @@
+-- 0026_finance.sql
+--
+-- Company-in-a-box phase 1: the generic finance domain — sales invoices (Finvoice 3.0),
+-- accounting vouchers (tositteet), the node-global VAT-code registry, fiscal years and
+-- the atomic counters behind gapless invoice/voucher numbering.
+--
+-- Design notes:
+--   * Tables are prefixed Finance* because "invoice" already means the io.aimeat.invoice
+--     payment RAIL in src/commerce/ (settle offline); these are bookkeeping documents.
+--   * Money is integer minor units (cents); VAT rates are basis points (2550 = 25.5 %).
+--     Rates live in FinanceVatCode with validity windows — the reduced rate changed
+--     14 % -> 13.5 % on 2026-01-01, which is why rates are data, not code.
+--   * FinanceVoucher is append-only: no UPDATE path except the attachments list
+--     (added evidence never changes the booking). Corrections are new vouchers with
+--     "reversesVoucherId" set.
+--   * "numberSeq" is NULL while an invoice is a draft; the number is claimed atomically
+--     from FinanceCounter on the draft->sent transition so the sequence stays gapless
+--     (a deleted draft never consumes a number). The partial unique index enforces
+--     one number per owner among sent invoices only.
+--   * No foreign keys, matching the rest of the schema: "trackingCode" joins to the
+--     commerce books (memory records), "externalRef" to Stripe/bank ids.
+
+CREATE TABLE IF NOT EXISTS "FinanceInvoice" (
+  "id" TEXT NOT NULL,
+  "ownerGhii" TEXT NOT NULL,
+  "organismId" TEXT,
+  "type" TEXT NOT NULL DEFAULT 'invoice',
+  "creditsInvoiceId" TEXT,
+  "status" TEXT NOT NULL DEFAULT 'draft',
+  "numberSeq" INTEGER,
+  "invoiceNumber" TEXT,
+  "seller" JSONB NOT NULL,
+  "buyer" JSONB NOT NULL,
+  "lines" JSONB NOT NULL DEFAULT '[]',
+  "currency" TEXT NOT NULL DEFAULT 'EUR',
+  "totalNetMinor" BIGINT NOT NULL DEFAULT 0,
+  "totalVatMinor" BIGINT NOT NULL DEFAULT 0,
+  "totalGrossMinor" BIGINT NOT NULL DEFAULT 0,
+  "vatBreakdown" JSONB NOT NULL DEFAULT '[]',
+  "referenceNumber" TEXT,
+  "paymentTermsDays" INTEGER NOT NULL DEFAULT 14,
+  "invoiceDate" TEXT,
+  "dueDate" TEXT,
+  "deliveryMethod" TEXT,
+  "sentAt" TEXT,
+  "deliveryStatus" TEXT,
+  "operatorMessageId" TEXT,
+  "finvoiceXmlKey" TEXT,
+  "paidAt" TEXT,
+  "paidTrackingCode" TEXT,
+  "externalRef" TEXT,
+  "fiscalYearId" TEXT,
+  "notes" TEXT,
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  CONSTRAINT "FinanceInvoice_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX IF NOT EXISTS "FinanceInvoice_owner_idx" ON "FinanceInvoice"("ownerGhii", "status");
+CREATE INDEX IF NOT EXISTS "FinanceInvoice_owner_date_idx" ON "FinanceInvoice"("ownerGhii", "invoiceDate");
+CREATE UNIQUE INDEX IF NOT EXISTS "FinanceInvoice_owner_seq_key" ON "FinanceInvoice"("ownerGhii", "numberSeq") WHERE "numberSeq" IS NOT NULL;
+CREATE INDEX IF NOT EXISTS "FinanceInvoice_reference_idx" ON "FinanceInvoice"("ownerGhii", "referenceNumber") WHERE "referenceNumber" IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS "FinanceVoucher" (
+  "id" TEXT NOT NULL,
+  "ownerGhii" TEXT NOT NULL,
+  "organismId" TEXT,
+  "fiscalYearId" TEXT NOT NULL,
+  "voucherNumber" INTEGER NOT NULL,
+  "date" TEXT NOT NULL,
+  "description" TEXT NOT NULL,
+  "direction" TEXT NOT NULL,
+  "source" TEXT NOT NULL,
+  "amountMinor" BIGINT NOT NULL,
+  "currency" TEXT NOT NULL DEFAULT 'EUR',
+  "vatBreakdown" JSONB NOT NULL DEFAULT '[]',
+  "counterparty" TEXT,
+  "invoiceId" TEXT,
+  "trackingCode" TEXT,
+  "externalRef" TEXT,
+  "attachments" JSONB NOT NULL DEFAULT '[]',
+  "reversesVoucherId" TEXT,
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  CONSTRAINT "FinanceVoucher_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "FinanceVoucher_year_number_key" ON "FinanceVoucher"("ownerGhii", "fiscalYearId", "voucherNumber");
+CREATE INDEX IF NOT EXISTS "FinanceVoucher_owner_date_idx" ON "FinanceVoucher"("ownerGhii", "date");
+-- Webhook idempotency lookup: one booking per external event per owner.
+CREATE UNIQUE INDEX IF NOT EXISTS "FinanceVoucher_external_key" ON "FinanceVoucher"("ownerGhii", "externalRef") WHERE "externalRef" IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS "FinanceVatCode" (
+  "id" TEXT NOT NULL,
+  "countryCode" TEXT NOT NULL DEFAULT 'FI',
+  "category" TEXT NOT NULL,
+  "rateBp" INTEGER NOT NULL,
+  "label" JSONB NOT NULL,
+  "validFrom" TEXT NOT NULL,
+  "validTo" TEXT,
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  CONSTRAINT "FinanceVatCode_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE IF NOT EXISTS "FinanceFiscalYear" (
+  "id" TEXT NOT NULL,
+  "ownerGhii" TEXT NOT NULL,
+  "organismId" TEXT,
+  "label" TEXT NOT NULL,
+  "startDate" TEXT NOT NULL,
+  "endDate" TEXT NOT NULL,
+  "locked" BOOLEAN NOT NULL DEFAULT false,
+  "lockedAt" TEXT,
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  CONSTRAINT "FinanceFiscalYear_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX IF NOT EXISTS "FinanceFiscalYear_owner_idx" ON "FinanceFiscalYear"("ownerGhii", "startDate");
+
+-- Named counters: kind is 'invoice' (per owner) or 'voucher:{fiscalYearId}'.
+-- The next value is claimed with a single INSERT ... ON CONFLICT DO UPDATE RETURNING,
+-- so two concurrent sends can never share a number.
+CREATE TABLE IF NOT EXISTS "FinanceCounter" (
+  "ownerGhii" TEXT NOT NULL,
+  "kind" TEXT NOT NULL,
+  "value" INTEGER NOT NULL DEFAULT 0,
+  CONSTRAINT "FinanceCounter_pkey" PRIMARY KEY ("ownerGhii", "kind")
+);

package/dist/src/storage/providers/postgres-kysely/migrations/0027_outbound.sql

@@ -0,0 +1,52 @@
+-- 0027_outbound.sql
+--
+-- Company-in-a-box phase 2: the outbound messaging door — recipient registry and the
+-- append-only send log.
+--
+--   * OutboundContact is the structural anti-spam device: /v1/outbound/send accepts a
+--     contact id, never a free address, so every recipient is a saved entry carrying its
+--     own opt-out and bounce state. One entry per owner per email (unique index on the
+--     lower-cased address). "optOutToken" backs the public unsubscribe link, so it gets
+--     its own unique index and must be unguessable.
+--   * OutboundMessage is the send log (GDPR-answerable "what left this node"), append-only.
+--     The daily limit counts rows here in SQL — a gate and a display must not drift.
+
+CREATE TABLE IF NOT EXISTS "OutboundContact" (
+  "id" TEXT NOT NULL,
+  "ownerGhii" TEXT NOT NULL,
+  "name" TEXT NOT NULL,
+  "email" TEXT NOT NULL,
+  "ghii" TEXT,
+  "tags" JSONB NOT NULL DEFAULT '[]',
+  "optedOut" BOOLEAN NOT NULL DEFAULT false,
+  "optOutAt" TEXT,
+  "optOutToken" TEXT NOT NULL,
+  "bounceCount" INTEGER NOT NULL DEFAULT 0,
+  "suppressedAt" TEXT,
+  "notes" TEXT,
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  CONSTRAINT "OutboundContact_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "OutboundContact_owner_email_key" ON "OutboundContact"("ownerGhii", lower("email"));
+CREATE UNIQUE INDEX IF NOT EXISTS "OutboundContact_token_key" ON "OutboundContact"("optOutToken");
+CREATE INDEX IF NOT EXISTS "OutboundContact_owner_idx" ON "OutboundContact"("ownerGhii", "createdAt");
+
+CREATE TABLE IF NOT EXISTS "OutboundMessage" (
+  "id" TEXT NOT NULL,
+  "ownerGhii" TEXT NOT NULL,
+  "contactId" TEXT NOT NULL,
+  "channel" TEXT NOT NULL,
+  "kind" TEXT NOT NULL,
+  "subject" TEXT NOT NULL,
+  "templateId" TEXT,
+  "status" TEXT NOT NULL,
+  "error" TEXT,
+  "invoiceId" TEXT,
+  "createdAt" TEXT NOT NULL,
+  CONSTRAINT "OutboundMessage_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX IF NOT EXISTS "OutboundMessage_owner_idx" ON "OutboundMessage"("ownerGhii", "createdAt");
+CREATE INDEX IF NOT EXISTS "OutboundMessage_contact_idx" ON "OutboundMessage"("contactId", "createdAt");

package/dist/src/storage/providers/postgres-kysely/migrations/0028_companies.sql

@@ -0,0 +1,44 @@
+-- 0028_companies.sql
+--
+-- The company registry (company-in-a-box): a company is a first-class entity like an app,
+-- and creating one reserves {slug}.co.<apex>. The co family is to companies what the apps
+-- family is to apps.
+--
+--   * The slug lives HERE rather than in "SubdomainSite" on purpose. That table holds one
+--     flat label namespace shared by the apps family, and a company named "tinki" must not
+--     collide with an app named "tinki" — they are different hosts. Separate registry,
+--     separate namespace, no coordination needed between the two.
+--   * The unique index on lower("slug") is the arbitration: two founders claiming the same
+--     name at the same moment cannot both win, without any read-then-write window.
+--   * The legal-identity columns are the seller-party snapshot an invoice needs, so a founder
+--     types them once here and every later invoice prefills from them.
+
+CREATE TABLE IF NOT EXISTS "Company" (
+  "id" TEXT NOT NULL,
+  "slug" TEXT NOT NULL,
+  "ownerGhii" TEXT NOT NULL,
+  "name" TEXT NOT NULL,
+  "description" TEXT,
+  "organismId" TEXT,
+  "frontPageKind" TEXT NOT NULL DEFAULT 'none',
+  "frontPageTarget" TEXT NOT NULL DEFAULT '',
+  "businessId" TEXT,
+  "vatId" TEXT,
+  "streetAddress" TEXT,
+  "postalCode" TEXT,
+  "city" TEXT,
+  "country" TEXT,
+  "email" TEXT,
+  "phone" TEXT,
+  "iban" TEXT,
+  "bic" TEXT,
+  "einvoiceAddress" TEXT,
+  "einvoiceOperator" TEXT,
+  "status" TEXT NOT NULL DEFAULT 'active',
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  CONSTRAINT "Company_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "Company_slug_key" ON "Company"(lower("slug"));
+CREATE INDEX IF NOT EXISTS "Company_owner_idx" ON "Company"("ownerGhii", "createdAt");

package/dist/src/storage/providers/postgres-kysely/migrations/0029_company_smtp.sql

@@ -0,0 +1,30 @@
+-- 0029_company_smtp.sql
+--
+-- Per-company sending identity for the outbound door: a company sends under its OWN domain
+-- and mailbox instead of the node's shared sender.
+--
+--   * Its own table rather than columns on "Company": most companies never set one, and a
+--     row that exists only when configured makes "does this company send as itself?" a
+--     presence question rather than a nullable-column question.
+--   * "passwordEnc" is AES-256-GCM ciphertext (services/encryption.ts), never plaintext —
+--     the same discipline the connection credentials use. The node refuses to store an SMTP
+--     password at all when AIMEAT_ENCRYPTION_KEY is unset, rather than writing it in the clear.
+--   * companyId is the primary key: one sending identity per company.
+
+CREATE TABLE IF NOT EXISTS "CompanySmtp" (
+  "companyId" TEXT NOT NULL,
+  "ownerGhii" TEXT NOT NULL,
+  "host" TEXT NOT NULL,
+  "port" INTEGER NOT NULL DEFAULT 587,
+  "secure" BOOLEAN NOT NULL DEFAULT false,
+  "username" TEXT,
+  "passwordEnc" TEXT,
+  "fromAddress" TEXT NOT NULL,
+  "fromName" TEXT,
+  "replyTo" TEXT,
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  CONSTRAINT "CompanySmtp_pkey" PRIMARY KEY ("companyId")
+);
+
+CREATE INDEX IF NOT EXISTS "CompanySmtp_owner_idx" ON "CompanySmtp"("ownerGhii");

package/dist/src/storage/providers/postgres-kysely/migrations/0030_invitation_node_level.sql

@@ -0,0 +1,31 @@
+-- 0030_invitation_node_level.sql
+--
+-- Let an invitation invite someone to the NODE, not only to an organism.
+--
+-- The agent door (remake 4b, 12-ai-rekisteroi.md) emails a single-use expiring token that ends in
+-- an account — which is exactly what this table already models. The only things that did not fit
+-- were the mandatory organism and the per-variant extras, so:
+--
+--   * "organismId" becomes NULLable. An invitation is "an emailed, single-use, expiring token that
+--     ends in an account"; which organism it ALSO joins you to belongs to one variant rather than
+--     to the shape. This is what let the registration invite reuse this record, its accept endpoint
+--     and its account-creation path instead of growing a second copy of all three.
+--
+--   * "meta" is one JSONB blob rather than a column per variant. A registration invite stores what
+--     the AI CLAIMED about itself (model, vendor, client) beside what the SERVER observed
+--     (ip, userAgent, at) — kept apart on purpose, because the first is a self-report and the
+--     second is evidence. Nothing in it is trusted for authorization; it exists so the recipient of
+--     an unrequested email can judge and trace the request that caused it.
+--
+--   * "type" gains 'registration' as a value. No constraint change is needed (the column is a plain
+--     text with a default), so this is documentation of intent rather than DDL.
+--
+-- Existing rows are untouched: every one of them has an organismId and no meta.
+
+ALTER TABLE "Invitation" ALTER COLUMN "organismId" DROP NOT NULL;
+
+ALTER TABLE "Invitation" ADD COLUMN IF NOT EXISTS "meta" JSONB;
+
+-- The per-address abuse cap on the open registration endpoint reads invitations by recipient, so
+-- that lookup gets an index of its own rather than scanning.
+CREATE INDEX IF NOT EXISTS "Invitation_emailHash_idx" ON "Invitation"("emailHash");

package/dist/src/storage/providers/postgres-kysely/migrations/0031_group_conversations.sql

@@ -0,0 +1,35 @@
+-- 0031_group_conversations.sql
+--
+-- A conversation with MORE than two participants.
+--
+-- Until now a thread was a pair: its id is a hash of the two sorted identities, so both nodes derive
+-- the same id with no coordination and no stored row (see utils/messaging.ts conversationIdFor).
+-- That is a good design for a pair and it cannot express three people, or two people and two AIs.
+--
+-- So a group thread gets a row, and a pair thread still does not. Nothing migrates: every
+-- conversation that existed before this table keeps deriving its id exactly as it did, and the
+-- absence of a row IS the statement "this is a pair".
+--
+-- "participants" is a JSONB array of identities (GHII, GAII or GEAI). It is the membership list, not
+-- a delivery list: each participant still gets their own mailbox copy of every message, which is
+-- what keeps read receipts, deletion and federation working per person rather than per thread.
+--
+-- "alias" records that the thread was OPENED through a named address rather than by picking people
+-- (support@operators fans out to whoever holds the operator role). It is kept because "who this was
+-- addressed to" and "who happened to be an operator that day" are different facts, and the second
+-- one changes.
+
+CREATE TABLE "Conversation" (
+    "id" TEXT NOT NULL,
+    "kind" TEXT NOT NULL DEFAULT 'group',
+    "subject" TEXT,
+    "participants" JSONB NOT NULL,
+    "createdBy" TEXT NOT NULL,
+    "alias" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "Conversation_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "Conversation_alias_updatedAt_idx" ON "Conversation"("alias", "updatedAt");

package/dist/src/storage/providers/postgres-kysely/migrations/0032_push_subscription_per_device.sql

@@ -0,0 +1,35 @@
+-- 0032_push_subscription_per_device.sql
+--
+-- A web-push subscription belongs to a DEVICE, not to a person.
+--
+-- The table was unique on "ownerName", and the provider upserted on that column, so registering a
+-- subscription REPLACED whatever the owner already had. Two consequences, and the second is the
+-- reason this is an audit item (H-8): the person's laptop went silent the moment their phone
+-- subscribed, and anything holding a token for the account could point the owner's entire
+-- notification stream at a destination of its choosing by subscribing once.
+--
+-- The identity of a subscription is therefore (ownerName, endpoint). A second device inserts beside
+-- the first; the same device subscribing again refreshes its keys. Sending fans out over every row
+-- an owner has, and a push service answering 404/410 prunes that one row rather than all of them.
+--
+-- SAFE ON EXISTING ROWS. "PushSubscription_ownerName_key" made a duplicate (ownerName, endpoint)
+-- impossible, so the new unique index cannot fail on today's data. The dedupe below runs anyway,
+-- because CREATE UNIQUE INDEX on data that violates it is a failed migration and therefore a node
+-- that will not boot; a database whose old index had been dropped by hand is worth the four lines.
+-- It keeps the most recently used row per (ownerName, endpoint).
+--
+-- "id" is untouched. Old rows carry id = ownerName, new ones get the gen_random_uuid() default from
+-- migration 0003. Nothing reads the column; the record type has no id field.
+
+DELETE FROM "PushSubscription" a
+      USING "PushSubscription" b
+      WHERE a."ownerName" = b."ownerName"
+        AND a."endpoint" = b."endpoint"
+        AND (a."lastUsedAt", a."id") < (b."lastUsedAt", b."id");
+
+DROP INDEX IF EXISTS "PushSubscription_ownerName_key";
+
+-- ownerName leads the index, so "every device of this owner" (the fan-out read) stays index-backed
+-- and no separate ownerName index is needed.
+CREATE UNIQUE INDEX IF NOT EXISTS "PushSubscription_ownerName_endpoint_key"
+    ON "PushSubscription"("ownerName", "endpoint");

package/dist/src/storage/providers/postgres-kysely/migrations/0033_drop_feedback.sql

@@ -0,0 +1,16 @@
+-- 0033_drop_feedback.sql
+--
+-- Remove the Node Feedback Channel.
+--
+-- It was a second inbox: an authenticated principal opened a thread to the operator, and the
+-- operator read it in an admin dashboard tab. The reports it collected were good — concrete ids,
+-- time windows, repro steps, a suggested fix — and on this node not one of the seven was ever
+-- answered or even triaged, because answering meant remembering that a separate queue existed.
+--
+-- Its job now belongs to `support@operators` (services/message-alias.ts): the same question arrives
+-- as an ordinary group conversation, in Messages, where the operators already reply to people.
+--
+-- The table goes with the feature. Keeping it would leave a store nothing reads and nothing writes,
+-- which is the kind of thing that survives three refactors and then confuses whoever finds it.
+
+DROP TABLE IF EXISTS "Feedback";

package/dist/src/storage/providers/postgres-kysely/migrations/0033_group_shares.sql

@@ -0,0 +1,35 @@
+-- 0033_group_shares.sql
+--
+-- Numbered 0033 rather than 0031: two other migrations with those numbers were in flight in a
+-- parallel branch when this landed. The gap is deliberate and harmless — migrations run in filename
+-- order, and a number nobody used is cheaper than two files claiming the same one.
+--
+-- A share becomes its own row: this owner lets this group read this key pattern.
+--
+-- Until now sharing was a field on the record ("visibility":'group' plus one "groupId"). That shape
+-- could only ever name ONE group, it had to be repeated on every write, and it could not describe a
+-- key space that does not exist yet. The last of those is what made it useless for the thing people
+-- actually want: a subscription writes tomorrow's record tomorrow, and the reader must not need a
+-- second act to see it. A pattern shared once covers whatever lands under it later.
+--
+-- The record it covers keeps its own visibility (normally 'private'). Visibility is the floor and a
+-- share is a named exception on top, so sharing something never changes what it is.
+--
+-- Both indexes are load-bearing rather than tidy. Every cross-owner read asks "is this key covered
+-- for one of the caller's groups", so the group direction is on the request path and must not
+-- become a scan; the owner direction is the Access tab answering "what have I given away, and to
+-- whom", which is the question ownership is judged by.
+
+CREATE TABLE IF NOT EXISTS "GroupShare" (
+  "id"         TEXT PRIMARY KEY,
+  "groupId"    TEXT NOT NULL,
+  "ownerGaii"  TEXT NOT NULL,
+  "keyPattern" TEXT NOT NULL,
+  "note"       TEXT,
+  "expiresAt"  TIMESTAMP(3),
+  "createdAt"  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "createdBy"  TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS "GroupShare_groupId_idx" ON "GroupShare"("groupId");
+CREATE INDEX IF NOT EXISTS "GroupShare_ownerGaii_groupId_idx" ON "GroupShare"("ownerGaii", "groupId");

package/dist/src/storage/providers/postgres-kysely/migrations/0034_agent_console_url.sql

@@ -0,0 +1,16 @@
+-- 0034_agent_console_url.sql
+--
+-- Where an agent is managed by whatever HOSTS it.
+--
+-- An agent created from a chat runs somewhere the node has never heard of: an agent hatchery
+-- instance, a CrewAI cockpit, a self-hosted daemon. The node knows the agent exists, what it may do
+-- and whether it has been seen lately, and it has no way to send the person to the place where the
+-- thing actually lives. So the person is told their agent is running and has nowhere to go and look
+-- at it.
+--
+-- The node cannot derive this address and must not guess it. The host reports it once: the owner,
+-- or a same-owner sibling such as the concierge agent that created this one, writes it through
+-- PATCH /v1/agents/:name/console-url. Display only — the node links it and never fetches it, and
+-- the http(s) check lives where it is written (services/agent-profile-write.ts).
+
+ALTER TABLE "Agent" ADD COLUMN IF NOT EXISTS "consoleUrl" TEXT;

package/dist/src/storage/providers/postgres-kysely/migrations/0035_agent_registered_by.sql

@@ -0,0 +1,19 @@
+-- 0035_agent_registered_by.sql
+--
+-- Who asked for this agent.
+--
+-- The node has always recorded it — `approvedBy` on the device-authorization record — and always
+-- thrown it away, because those records are swept when they expire. So half an hour after an agent
+-- appears, nothing on the node can say whether a person approved it or a sibling did, and an owner
+-- looking at forty agents has no way to find out where they came from.
+--
+-- It also fences agent-initiated deletion. A concierge in a fleet runtime must be able to end the
+-- agents it created when its container is deprovisioned, and must not be able to end the ones it did
+-- not: same owner is not a narrow enough test, or every agent an owner has could kill every sibling
+-- it has never seen. The entry is written once, at creation, and never rewritten — re-approval is an
+-- ordinary event and must not hand the right to delete an agent to whoever reconnected it last.
+--
+-- The value is the owner's bare name (a person approved) or the approving agent's GAII (a sibling
+-- did). Null on every agent that existed before this column.
+
+ALTER TABLE "Agent" ADD COLUMN IF NOT EXISTS "registeredBy" TEXT;

package/dist/src/storage/providers/sqlite/index.d.ts

@@ -1,39 +1,36 @@
-/**
- * @file sqlite/index.ts
- * @description SQLite Storage implementation (better-sqlite3) of the full Storage
- *   interface. Synchronous prepared statements; schema created/migrated on
- *   construction via initializeSchema(). Backs `:memory:`, dev, and personal nodes.
- * @structure SqliteStorage class holds the fields, constructor and close(); every
- *   domain method group lives in ./methods/<group>.ts as an exported object literal
- *   (method shorthand, `this: SqliteStorage`) and is merged onto the prototype via
- *   Object.assign. The `interface SqliteStorage extends Storage, SqliteInternals`
- *   declaration merge tells the type-checker the class has every method the merge
- *   supplies at runtime. Split out of one 7.2k-line file to satisfy max-file-lines.
- * @usage new SqliteStorage(dbPath) — dbPath may be ':memory:' or a file path.
- * @version-history
- *   v1.0.0 — pre-2026-06 — Initial SQLite storage implementation
- *   v1.1.0 — 2026-06-05 — Add normalizeAppOwnerNames() to strip the legacy
- *     `@node` suffix from app ownerName values (bare-name normalization).
- *   v1.2.0 — 2026-06-09 — Add mergeForkedAppBuckets() to consolidate ownerGaii
- *     buckets forked across an owner's identity forms into one canonical bucket.
- *   v1.3.0 — 2026-06-12 — Add subdomain_sites CRUD (operator-managed
- *     subdomain → published-app/redirect mappings).
- *   v1.3.1 — 2026-06-19 — Security (CR-1): reject negative/non-finite amounts in
- *     debitBalance/creditBalance/creditBalanceCapped/transferBalance to prevent
- *     negative-amount morsel minting (0 still allowed — free/0-cost work escrow).
- *   v1.4.0 — 2026-06-20 — Add app_grants CRUD (owner-issued app authorizations →
- *     agent tokens; refresh-hash lookup, list-by-owner, rotate/revoke).
- *   v1.5.0 — 2026-07-13 — Split the method bodies into ./methods/<group>.ts modules
- *     (prototype-assignment + interface-merge) so every file is ≤800 lines; bodies
- *     are byte-identical, `db`/`chunkedUploads` widened to public for the groups.
- */
 import Database from 'better-sqlite3';
 import type { Storage, ChunkedUploadRecord } from '../../interface.js';
 import type { SqliteInternals } from './methods/internal.js';
 export declare class SqliteStorage {
     db: Database.Database;
     chunkedUploads: Map<string, ChunkedUploadRecord>;
+    /**
+     * Depth of the transaction open on this instance. SQLite gives the whole process ONE connection, so
+     * a transaction here is process-wide: this counter is what tells an inner call it is already inside
+     * one (join, do not re-BEGIN) and what tells the write guard below to let it through.
+     */
+    private txDepth;
+    /**
+     * Transactions run one at a time. Without this two concurrent operations would interleave their
+     * statements inside a single BEGIN and one ROLLBACK would discard the other's work.
+     */
+    private txQueue;
     constructor(dbPath: string);
+    /**
+     * True when the CALLER is running inside this instance's open transaction. The async-context
+     * marker, not the depth counter, is what distinguishes "a step of the transaction" from "another
+     * request that happens to be running while it is open" — and only the second one must wait.
+     */
+    get insideTransaction(): boolean;
+    /** Resolves when no transaction is open. Awaited by every async write made from outside one. */
+    waitForNoTransaction(): Promise<unknown>;
+    /**
+     * Run `fn` in one transaction. Nested calls join the open one. See the contract on
+     * `Storage.transaction`; the SQLite-specific part of it is enforced here rather than trusted:
+     * transactions are serialised against each other, and `guardWrites` below makes an async write
+     * started outside the transaction wait until it commits instead of landing inside it.
+     */
+    transaction<T>(fn: () => Promise<T>): Promise<T>;
     /** Close the database connection */
     close(): void;
 }

package/dist/src/storage/providers/sqlite/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/storage/providers/sqlite/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAGtC,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAmB7D,qBAAa,aAAa;IACxB,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,cAAc,mCAA0C;gBAE5C,MAAM,EAAE,MAAM;IAS1B,oCAAoC;IACpC,KAAK,IAAI,IAAI;CAGd;AAMD,MAAM,WAAW,aAAc,SAAQ,OAAO,EAAE,eAAe;CAAG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/storage/providers/sqlite/index.ts"],"names":[],"mappings":"AAkCA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAGtC,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA6B7D,qBAAa,aAAa;IACxB,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,cAAc,mCAA0C;IAExD;;;;OAIG;IACH,OAAO,CAAC,OAAO,CAAK;IACpB;;;OAGG;IACH,OAAO,CAAC,OAAO,CAAuC;gBAE1C,MAAM,EAAE,MAAM;IAS1B;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAED,gGAAgG;IAChG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC;IAIxC;;;;;OAKG;IACG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAyBtD,oCAAoC;IACpC,KAAK,IAAI,IAAI;CAGd;AAgCD,MAAM,WAAW,aAAc,SAAQ,OAAO,EAAE,eAAe;CAAG"}