create-flowdular 0.3.0 → 0.3.2

package/agent-template/.ai/references/catalog/tests/migrations.test.ts

@@ -87,6 +87,7 @@ describe('catalog migrations', () => {
 	it('declares forced PostgreSQL row security for every tenant table', () => {
 		for (const migration of databaseMigrations) {
 			const sql = migration.sql.postgresql ?? '';
+			if (!sql.includes('CREATE TABLE')) continue;
 			expect(sql).toContain('ENABLE ROW LEVEL SECURITY');
 			expect(sql).toContain('FORCE ROW LEVEL SECURITY');
 			expect(sql).toContain("current_setting('coreloom.tenant_id', true)");
@@ -110,9 +111,9 @@ describe('catalog migrations', () => {
 				transaction.execute({
 					text: `INSERT INTO catalog_items
 				 (id, tenant_id, sku, sku_normalized, name, kind, unit,
-				  base_price_minor, currency, status, created_at)
+				  base_price_minor, currency, status, created_at, updated_at)
 				 VALUES ('item-1', 'tenant-a', 'SKU-1', 'sku-1', 'Bolt', 'product',
-				         'pcs', 500, 'EUR', 'active', 1)`,
+				         'pcs', 500, 'EUR', 'active', 1, 1)`,
 				}),
 			{ tenantId: 'tenant-a', access: 'write' },
 		);
@@ -139,6 +140,61 @@ describe('catalog migrations', () => {
 		).toEqual([{ sku: 'SKU-1' }]);
 	});
 
+	it('adds the update time and the list indexes, and refuses a half-applied schema', async () => {
+		await apply();
+		const schema = lease.database.schema;
+		expect(await schema.hasColumn('catalog_items', 'updated_at')).toBe(true);
+		expect(await schema.hasIndex('catalog_items_tenant_name_idx')).toBe(true);
+		expect(await schema.hasIndex('catalog_items_tenant_updated_idx')).toBe(
+			true,
+		);
+
+		await lease.database.execute({
+			text: 'DROP INDEX catalog_items_tenant_name_idx',
+		});
+		await lease.database.execute({
+			text: `DELETE FROM ${DATABASE_MIGRATION_LEDGER} WHERE namespace = 'catalog.core'`,
+		});
+		expect((await status()).at(-1)).toMatchObject({
+			id: '0005_catalog_list_indexes',
+			state: 'partial',
+		});
+	});
+
+	it('backfills the update time of rows that predate it', async () => {
+		await runDatabaseMigrations(
+			lease.database,
+			'catalog.core',
+			databaseMigrations.slice(0, 4),
+		);
+		await lease.database.transaction(
+			(transaction) =>
+				transaction.execute({
+					text: `INSERT INTO catalog_items
+				 (id, tenant_id, sku, sku_normalized, name, kind, unit,
+				  base_price_minor, currency, status, created_at)
+				 VALUES ('item-1', 'tenant-a', 'SKU-1', 'sku-1', 'Bolt', 'product',
+				         'pcs', 500, 'EUR', 'active', 1234)`,
+				}),
+			{ tenantId: 'tenant-a', access: 'write' },
+		);
+		expect((await apply()).at(-1)).toMatchObject({
+			id: '0005_catalog_list_indexes',
+			action: 'applied',
+		});
+		expect(
+			(
+				await lease.database.transaction(
+					(transaction) =>
+						transaction.query<{ updated_at: string | number }>({
+							text: 'SELECT updated_at FROM catalog_items',
+						}),
+					{ tenantId: 'tenant-a', access: 'read' },
+				)
+			).rows.map((row) => Number(row.updated_at)),
+		).toEqual([1234]);
+	});
+
 	it('runs clean on a second migration pass', async () => {
 		await apply();
 

package/agent-template/.ai/references/catalog/tests/module.test.ts

@@ -13,6 +13,7 @@ import {
 	CatalogServiceError,
 } from '../src/services/catalog-service.ts';
 import {
+	allItems,
 	closeCatalogTestDatabases,
 	createCatalogTestDatabase,
 	type CatalogTestDatabase,
@@ -161,7 +162,7 @@ describe('catalog.core', () => {
 			},
 			TEST_ACTOR,
 		);
-		expect(await service.list('tenant-b')).toEqual([]);
+		expect(await allItems(service, 'tenant-b')).toEqual([]);
 	});
 
 	it('keeps lifecycle revisions append-only and tenant-scoped', async () => {

package/agent-template/.ai/references/catalog/tests/support/database.ts

@@ -4,6 +4,20 @@ import {
 	DatabaseCatalogRepository,
 	migrateCatalogDatabase,
 } from '../../src/services/database-repository.ts';
+import {
+	FIRST_LIST_PAGE,
+	type CatalogService,
+} from '../../src/services/catalog-service.ts';
+import type { CatalogItem } from '../../src/domain/types.ts';
+
+/** The first page at the ceiling in SKU order: every item of a small test tenant. */
+export async function allItems(
+	service: CatalogService,
+	tenantId: string,
+): Promise<readonly CatalogItem[]> {
+	return (await service.listPage(tenantId, { ...FIRST_LIST_PAGE, sort: 'sku' }))
+		.items;
+}
 
 const TENANT_TABLES = [
 	'catalog_items',

package/agent-template/.ai/references/catalog/translations/en.json

@@ -7,6 +7,16 @@
 	"drawer.editTitle": "Edit catalog item",
 	"action.edit": "Edit",
 	"action.history": "History",
+	"action.archiveSelected": "Archive selected",
+	"action.restoreSelected": "Restore selected",
+	"action.archiveRefused": "Select at least one active item.",
+	"action.restoreRefused": "Select at least one archived item.",
+	"action.close": "Close",
+	"archiveMany.title": "Archive selected items",
+	"archiveMany.description": "Archive {count} selected items? Archived items can be restored later.",
+	"common.messages": "Messages",
+	"denied.title": "Catalog access denied",
+	"denied.description": "Your account may not read catalog items in this workspace.",
 	"delete.title": "Delete catalog item",
 	"delete.description": "Delete {name} permanently? This cannot be undone.",
 	"delete.drawerDescription": "This permanently removes the archived catalog item.",
@@ -17,7 +27,13 @@
 	"error.delete": "Could not delete the catalog item.",
 	"error.history": "Could not load catalog item history.",
 	"error.load": "Could not load catalog items.",
+	"error.archiveMany": "Could not archive the selected items.",
+	"error.restoreMany": "Could not restore the selected items.",
 	"error.request": "The catalog operation failed.",
+	"export.action": "Export CSV",
+	"export.started": "The catalog export started. It appears on the Exports screen once the file is ready.",
+	"export.link": "Open Exports",
+	"export.error": "Could not start the export.",
 	"form.cancel": "Cancel",
 	"form.currency": "Currency",
 	"form.kind": "Kind",
@@ -37,27 +53,42 @@
 	"status.active": "Active",
 	"status.archived": "Archived",
 	"filters.label": "Filters",
-	"filters.includeArchived": "Include archived items",
+	"filters.kind": "Kind",
+	"filters.allKinds": "All kinds",
+	"filters.status": "Status",
+	"filters.allStatuses": "All statuses",
 	"lifecycle.title": "Lifecycle",
 	"lifecycle.description": "Archive an item before deleting it permanently.",
 	"lifecycle.history": "View history",
 	"lifecycle.archive": "Archive item",
 	"lifecycle.restore": "Restore item",
 	"lifecycle.delete": "Delete item",
+	"notice.archivedMany": "Archived {updated}, missing {missing}, refused {refused}.",
+	"notice.restoredMany": "Restored {updated}, missing {missing}, refused {refused}.",
 	"page.action.new": "New item",
 	"page.action.refresh": "Refresh",
 	"page.description": "Products and services with stable tenant-scoped SKUs.",
 	"page.eyebrow": "Commercial master data",
 	"page.title": "Catalog",
+	"pagination.label": "Catalog pages",
+	"pagination.previous": "Previous",
+	"pagination.next": "Next",
+	"pagination.size": "Items per page",
+	"pagination.summary": "Page {page} · from item {from}",
 	"price.fallback": "{amount} {currency} minor",
+	"selection.label": "Select all items on screen",
+	"selection.rowLabel": "Select {name}",
+	"selection.clear": "Clear selection",
+	"selection.summary": "{count} selected",
 	"table.caption": "Catalog items",
-	"table.column.item": "Item",
+	"table.column.name": "Name",
+	"table.column.sku": "SKU",
 	"table.column.kind": "Kind",
 	"table.column.price": "Price",
 	"table.column.status": "Status",
+	"table.column.updated": "Updated",
 	"table.column.actions": "Actions",
-	"table.count.one": "1 item",
-	"table.count.other": "items: {count}",
+	"table.count.page": "{count} on this page",
 	"table.empty.hint": "Create the first product or service.",
 	"table.empty.title": "No catalog items yet",
 	"table.emptyFiltered.hint": "No item in this workspace matches the current filter.",

package/agent-template/.ai/references/catalog/translations/pl.json

@@ -7,6 +7,16 @@
 	"drawer.editTitle": "Edytuj pozycję katalogu",
 	"action.edit": "Edytuj",
 	"action.history": "Historia",
+	"action.archiveSelected": "Archiwizuj zaznaczone",
+	"action.restoreSelected": "Przywróć zaznaczone",
+	"action.archiveRefused": "Zaznacz co najmniej jedną aktywną pozycję.",
+	"action.restoreRefused": "Zaznacz co najmniej jedną zarchiwizowaną pozycję.",
+	"action.close": "Zamknij",
+	"archiveMany.title": "Archiwizuj zaznaczone pozycje",
+	"archiveMany.description": "Zarchiwizować zaznaczone pozycje ({count})? Zarchiwizowane pozycje można później przywrócić.",
+	"common.messages": "Komunikaty",
+	"denied.title": "Brak dostępu do katalogu",
+	"denied.description": "Twoje konto nie może odczytywać pozycji katalogu w tej przestrzeni roboczej.",
 	"delete.title": "Usuń pozycję katalogu",
 	"delete.description": "Usunąć trwale pozycję {name}? Tej operacji nie można cofnąć.",
 	"delete.drawerDescription": "Ta operacja trwale usuwa zarchiwizowaną pozycję katalogu.",
@@ -17,7 +27,13 @@
 	"error.delete": "Nie udało się usunąć pozycji katalogu.",
 	"error.history": "Nie udało się wczytać historii pozycji katalogu.",
 	"error.load": "Nie udało się wczytać pozycji katalogu.",
+	"error.archiveMany": "Nie udało się zarchiwizować zaznaczonych pozycji.",
+	"error.restoreMany": "Nie udało się przywrócić zaznaczonych pozycji.",
 	"error.request": "Operacja na katalogu nie powiodła się.",
+	"export.action": "Eksportuj CSV",
+	"export.started": "Eksport katalogu wystartował. Pojawi się na ekranie Eksporty, gdy plik będzie gotowy.",
+	"export.link": "Otwórz Eksporty",
+	"export.error": "Nie udało się rozpocząć eksportu.",
 	"form.cancel": "Anuluj",
 	"form.currency": "Waluta",
 	"form.kind": "Rodzaj",
@@ -37,27 +53,42 @@
 	"status.active": "Aktywna",
 	"status.archived": "Zarchiwizowana",
 	"filters.label": "Filtry",
-	"filters.includeArchived": "Pokaż zarchiwizowane pozycje",
+	"filters.kind": "Rodzaj",
+	"filters.allKinds": "Wszystkie rodzaje",
+	"filters.status": "Status",
+	"filters.allStatuses": "Wszystkie statusy",
 	"lifecycle.title": "Cykl życia",
 	"lifecycle.description": "Zarchiwizuj pozycję przed jej trwałym usunięciem.",
 	"lifecycle.history": "Zobacz historię",
 	"lifecycle.archive": "Archiwizuj pozycję",
 	"lifecycle.restore": "Przywróć pozycję",
 	"lifecycle.delete": "Usuń pozycję",
+	"notice.archivedMany": "Zarchiwizowano {updated}, brak {missing}, odrzucono {refused}.",
+	"notice.restoredMany": "Przywrócono {updated}, brak {missing}, odrzucono {refused}.",
 	"page.action.new": "Nowa pozycja",
 	"page.action.refresh": "Odśwież",
 	"page.description": "Produkty i usługi ze stałym SKU w obrębie przestrzeni roboczej.",
 	"page.eyebrow": "Dane podstawowe sprzedaży",
 	"page.title": "Katalog",
+	"pagination.label": "Strony katalogu",
+	"pagination.previous": "Poprzednia",
+	"pagination.next": "Następna",
+	"pagination.size": "Pozycji na stronie",
+	"pagination.summary": "Strona {page} · od pozycji {from}",
 	"price.fallback": "{amount} {currency} w groszach",
+	"selection.label": "Zaznacz wszystkie pozycje na ekranie",
+	"selection.rowLabel": "Zaznacz {name}",
+	"selection.clear": "Wyczyść zaznaczenie",
+	"selection.summary": "Zaznaczono: {count}",
 	"table.caption": "Pozycje katalogu",
-	"table.column.item": "Pozycja",
+	"table.column.name": "Nazwa",
+	"table.column.sku": "SKU",
 	"table.column.kind": "Rodzaj",
 	"table.column.price": "Cena",
 	"table.column.status": "Status",
+	"table.column.updated": "Zmieniono",
 	"table.column.actions": "Akcje",
-	"table.count.one": "1 pozycja",
-	"table.count.other": "pozycje: {count}",
+	"table.count.page": "Na tej stronie: {count}",
 	"table.empty.hint": "Dodaj pierwszy produkt lub usługę.",
 	"table.empty.title": "Nie ma jeszcze pozycji katalogu",
 	"table.emptyFiltered.hint": "Żadna pozycja w tej przestrzeni roboczej nie pasuje do filtra.",

package/agent-template/.ai/references/catalog.provenance.json

@@ -1,9 +1,9 @@
 {
 	"id": "catalog.core",
-	"version": "0.7.0",
+	"version": "0.8.0",
 	"repository": "Flowdular/official-modules",
-	"sourceCommit": "b8281b38498b1e3164e6619ec9e8fe922ad7dc10",
-	"artifactSha256": "6c98785c10fac14cb1a913c6462cb42e18fe824a7d0dd7620746605fd351441d",
+	"sourceCommit": "edad0ec198877c0359f11512b7c0055f87d5f8b4",
+	"artifactSha256": "3e1c8530eed822c35e12f24545492bf7614bbd47e3a9255a869423d7e1662ef4",
 	"files": {
 		"LICENSE": "155d722071bad9d0d832482e06fd5a47f7034389cb63aabcb39f4282aa3499fc",
 		"migrations/0001_catalog_core.down.sql": "0962a1edf0bde959cd4facccf77bd5b634d6cc25f125a0c79a61770c8871093f",
@@ -14,43 +14,51 @@
 		"migrations/0003_catalog_history_service_actors.up.sql": "7caae787ca2fc1e331ccbfda4df5982beec76136e8dc486aab5532ccd338a722",
 		"migrations/0004_catalog_idempotency_ledger.down.sql": "8ba72d8edc4d25ecf6d041888cf321690c25afdaf3723812ddd7d391d75370aa",
 		"migrations/0004_catalog_idempotency_ledger.up.sql": "41e86ba2051159c6cc9672bfae17c1d02051da975f1c43c566a2b66592673cb0",
+		"migrations/0005_catalog_list_indexes.down.sql": "3dd547d738e75513abef502afc4bf9b51851ec9405b6b719c6134b897c5b1776",
+		"migrations/0005_catalog_list_indexes.up.sql": "dc3ece30b93fba0c91be58f772d1ae421cfbba49439e8c72a06aead6720f5db5",
 		"migrations/README.md": "2a15fd001713c2552a3c82b186246aa5fec136f43143cc2d9aa15bd491a09d41",
-		"module.json": "1b512c9b97bdec2155103f521a6545e558e50491f90c74a93d33cc74511d2125",
-		"package.json": "67d50dc95723d21bb44bbab54ae14fe89641c52b9f62ba065908f67ebcf0ed7a",
-		"spec/module.yaml": "ec931c78f351c7fc53f43fdd5ec9cd1a46db485f642648329bf1612883a3c958",
+		"module.json": "4a4e5b5414f97a6b023c0ed64d0df313aa3ab4e8771f8e33137e589818ad20fd",
+		"package.json": "6dd4972624c2a141b038c024137a29b0e5223a28f9021653f2aa6517fb464b56",
+		"spec/module.yaml": "c30518bd28e5d184ef122f194f5c1308ff5c522df6638085ccc8121a78d40971",
 		"src/acl/permissions.ts": "3375521a5a229736ffac5a948140ec347dc7a7e4fba80e778c0baaf9e0622590",
-		"src/agent/tools.ts": "3204d20886d2b864482adc1ed3303c653aebd207e16c4fce0c67a4979ea8db07",
-		"src/api/endpoints.ts": "34f1036e759353550be2acf67c6fa254afc790942d09489db2e76a082df5c3a3",
+		"src/agent/tools.ts": "3403db7954906dc2c79227ba0420b5cb4bfb57063b7cfc285e6e556f16be9266",
+		"src/api/endpoints.ts": "205ef36d058f246f99b77336e7246a23aaca611c696a1f6f09758f66e8a93a29",
+		"src/api/list-cursor.ts": "dcb763edc0128a3aac95e9ca3c5158611a7f2c6a4c71484438c89b7f4d79bb0d",
 		"src/client/CatalogHistoryDrawer.tsrx": "6cdba5249be81e70da703cb34c1a2210943ce5e5fb596ee77cf7952e2acf3ee3",
 		"src/client/CatalogItemForm.tsrx": "7dafa4149975d9e7d5784c8a5391b5b64c2405991aaead713d94b61c41168c2c",
-		"src/client/CatalogView.tsrx": "7c507931f33afea8414b002e3ad815740c8db75016c53d8a81effc6427bd958d",
-		"src/client/api.ts": "5f404f6b25777bc8fe2eab5a35424593abc8e879fb83fa2ae4d637fc23fdce4b",
-		"src/client/contribution.tsrx": "e95f755882005ee090c99a119ce2dda2ec70420daed4ce06021193905858c62f",
+		"src/client/CatalogView.tsrx": "bc1e543690e07d52b51626832f36afe3fde87bf2dc45642324507df8384d7303",
+		"src/client/api.ts": "eaa55af81d26aa0190d19b3102c363c1ee25b2bdc05436446ac95dcde62aea75",
+		"src/client/contribution.tsrx": "6cbf79e6188bdf24b9cec4a06ae621e03efd5d0c76ad72b28828eee9155ab893",
 		"src/client/index.ts": "03eb0664cdafccb66cb25f2e1b07e6959c2dfa9bdbfffc3e7edf9b535ba4949a",
 		"src/client/navigation-copy.ts": "9a8757e64f4001a93e2bc2861c686a19f791f9d67a396d9e658023b1ec4cea8f",
-		"src/client/state.ts": "bc054bc269026b6abf60d99a2fc5dd94eb8a488fc1ce4c81a1ae1065d9db576b",
-		"src/domain/types.ts": "4b26be80954d792b09a3a34d29d845b9f6119640be505daba325fec820e06ef6",
+		"src/client/state.ts": "61601f6037c4bb8a709b69b10c1a37e59b45b0c941240c436f7861c2b034dcc1",
+		"src/domain/lists.ts": "83749967f99fa0c4f44abc0c614108b844321e50ce6408553215e6233ad6e350",
+		"src/domain/types.ts": "374efeb24c4f7d41e3c660336e721fa362418579837d44a46724076d03287a0b",
 		"src/domain/variables.ts": "131130e57838235b1f3fcb799da44baeae16522bb346d522827e022305c110b5",
 		"src/index.ts": "5b27943018db9a18651d62add7d6f8397d7c492a204381fae74547b99b91990d",
-		"src/platform.ts": "b5d809b071af812877f3fb09cce3ced4cdaed8f62611c3eb6d5fcaf6cd7333cb",
+		"src/platform.ts": "f048082a33c1c688e4952750c762c8b65a4626ff52cc9c4eaca2156014bac631",
 		"src/server/index.ts": "90eae107d863418124e5d10c4d1fe8a119bd14da605b36de708c18d8500c4b5e",
 		"src/server/runtime.ts": "5f4389a6adf8265f6737c489baf686f63cc3550662103d28b2da9800dd9f5b63",
-		"src/services/catalog-service.ts": "51f1dcd7c0335f7b417fb45ba700c0098e7193246ee91659c27cab8608282693",
+		"src/services/catalog-service.ts": "66e61dfbd9797d31e6814c18efcd21cfcb7b220f7df22677868f486f3fa0e9d1",
 		"src/services/data-classes.ts": "ea09b1a7def59fee43d57ca7dab6fdb4d646b51df2cacb60af96676c43602b33",
-		"src/services/database-repository.ts": "e6ff61ba197899d5618a02ce743c90d4bf09ae64dcfd1bd3a9985b18a2d23e80",
+		"src/services/database-repository.ts": "1b72ce91a2f85f6572825766781a806d94fe0d2abb91872ee9acae3b1e70db2e",
 		"src/services/index.ts": "a08aefe5101814538666f861536287fc382e6c655d62ba9b9ef4bbfbc6ede4af",
-		"src/services/migration.ts": "89c8e333482c80bc819deba0cf4f4e37e94137933af0f6503f4f9ebcb4f5f371",
-		"src/services/repository.ts": "98d27a40ff02137ec0c6d8799d9a853d40a76eab2564dd500806c4e84f6dc3a3",
+		"src/services/item-export.ts": "b2a4613b43a98d0d41699481bb5e85a770f9a60cb2241579b065effb6936c80b",
+		"src/services/migration.ts": "57c9a857d4074973e14b5e3a1c4548a92ad0faca371419e7daf2334f3ef701ab",
+		"src/services/repository.ts": "9f560033875d05654148b4a11897465ee4eefa0d7fa701439e8f562da9fba1db",
 		"src/services/target-idempotency.ts": "7111b56a30b691eaaaa64f5691895ac94b6e0735b0079794835bbbeba5102cb0",
-		"tests/agent-tools.test.ts": "3cdda30b5454d58c6e8791a98e3daf6fe58b9852cd5c437b3614c3f6123baa91",
+		"tests/agent-tools.test.ts": "7762c14bc353ee3085df46a91cf370eb5c25b2edb7096f0a4b0e033f220ea726",
+		"tests/client-state.test.ts": "ea146c793b14d0f9bc5e36d92e92894ced6531b8fcbd11c8be1486b62313b8c3",
 		"tests/data-classes.test.ts": "bea08e4d1d7380ccdebc211374b74a6034714b192fd98bfb90a2218067b35658",
-		"tests/endpoints.test.ts": "24d05c7dd52820f90c777a1b814529f5188a9a5a9daeaacda07314f17b7483cc",
-		"tests/idempotency.test.ts": "f2e0896635bcd95271b66181daa2c084411913cdf864ae8b4814f2beeb8c2943",
-		"tests/migrations.test.ts": "47d3d741eddde8677be287730d2f96af556b4b7bf0d8378f9a12a7309af17d78",
-		"tests/module.test.ts": "01bedfa1540470cc87c808c75120f6ede7c3b8e3d81e340d2076af0a66f1c7ab",
-		"tests/support/database.ts": "f108cf6390da7669f8935301fac125a7e5653f06ba75327f4bdc28fdd409ba73",
-		"translations/en.json": "406a40b77e3778e83cd4d30e7b3aee8f89c75baf7bc52f1befc6d16f3b877ab3",
-		"translations/pl.json": "db6325b4980d978e1a3098758b5259a68e32469baa09d194b9d6746462776d27",
+		"tests/endpoints.test.ts": "a2d700f4c3eb6fbbef5c57ed5591017a27c98e17fe84fba8426fcd3a2820b210",
+		"tests/export.test.ts": "de83066272cee5f7f5736d636d7b9b97dab09778ba661816e401bf926b826402",
+		"tests/idempotency.test.ts": "faea4a2cfa04e81b7155399cba807af4c1ba4448cdfeab733d1afe801d27734f",
+		"tests/list.test.ts": "97605b50020841cbdac62f9d44b65f0f7dce9c4c4972af6409afeb6b9b66e59a",
+		"tests/migrations.test.ts": "fb796aecedb997f6395c2c15e45bf4abfae4677953fa8cb420c94e9cfba8222f",
+		"tests/module.test.ts": "af961a5bcddc41d304d14841f8810976f43f46b46ab7814142fdb921a773e92a",
+		"tests/support/database.ts": "4ff6d093ca2e80baab3dea476018661473d6474db63d67655f1edc667b8472ac",
+		"translations/en.json": "a86d70e02ccf46a2a132d5bee0de7c528c0eb56a85c269a78e0c2e7e0de24e37",
+		"translations/pl.json": "8157d83467e9dd8d9700e2fb188f1a730073f805d2a8b3f0ba98f02f2ca9a264",
 		"tsconfig.json": "140bb4775df421146563d13d2f78ff74cb3c2decab6737db32938339248a92ba",
 		"vitest.config.ts": "d13725b13c3712ec91c1646e9226fb172eec2599f72f4e6608bece9912e2bd81"
 	}

package/agent-template/.ai/skills/cli-extension/SKILL.md

@@ -91,7 +91,7 @@ export default cliExtension;
 
 ## 4. What the runner does with the descriptor (`packages/cli/src/runner.ts`, `runExtensionCommand`)
 
-- `risk: 'external'`: refused with `APPROVAL_VERIFIER_REQUIRED`. `risk: 'destructive'` without `localOnly`: the same.
+- `risk: 'external'`, or `'destructive'` without `localOnly`: refused with `APPROVAL_VERIFIER_REQUIRED` unless `--grant <token> --tenant <id>` carries a verified approval grant for this capability and invocation digest (`APPROVAL_GRANT_INVALID`, `APPROVAL_GRANT_EXPIRED`, `APPROVAL_GRANT_MISMATCH` otherwise).
 - `localOnly: true`: refused with `LOCAL_ONLY_CAPABILITY` unless `FD_ENV` or `NODE_ENV` is `development` or `test` (unset counts as development).
 - `requiresApprovedSpec: true`: needs `--spec <path>` to a schema-valid spec with `status: approved`, otherwise `APPROVED_SPEC_REQUIRED`, `SPEC_VALIDATION_FAILED` or `SPEC_NOT_APPROVED`.
 - `destructive` with `--apply`: needs `--confirm <confirmation>` (`CONFIRMATION_REQUIRED`).

package/agent-template/.ai/skills/deploy-operate/SKILL.md

@@ -81,9 +81,12 @@ Both are served by `platform/src/server/health.ts`. The shipped Docker and Kuber
 pnpm flowdular database backup --output <dir>                            # dry run
 pnpm flowdular database backup --output <dir> --apply
 pnpm flowdular database restore --input <dir> --apply --confirm restore-database
+pnpm flowdular database restore-production --input <dir> --target <db> --grant <token> --tenant <id> [--platform-url <origin>|--platform-stopped] --apply --confirm restore-database
 ```
 
-The trap: **the encryption keys live outside the database.** Agent provider credentials, agent run grants, workflow payloads and cursors, automation secrets and MFA secrets are all stored as ciphertext, and the keys are environment variables (`FD_AGENT_CREDENTIAL_KEY`, `FD_AGENT_RUN_GRANT_KEY`, `FD_WORKFLOWS_PAYLOAD_KEY`, `FD_WORKFLOWS_CURSOR_KEY`, `FD_AUTOMATIONS_CREDENTIAL_KEY`, `FD_AUTH_MFA_KEY`, `FD_NOTIFICATIONS_SECRET_KEY`, `FD_STORAGE_ENCRYPTION_KEY`, `FD_CONNECTORS_SECRET_KEY`, `FD_AUDIT_ANCHOR_KEY`). A database backup without the matching keys restores rows nobody can read, and rotating a key without re-encrypting orphans everything encrypted under the old one. Back the keys up separately, restore them together with the dump, and record which key version a dump belongs to.
+Production restores run `database.restore.production`: an approval grant bound to the exact flags, `--target` equal to the migrator DSN database, a separate migrator DSN, a key mismatch refused unless the approval included `--allow-key-mismatch`, and a refusal while the health endpoint answers. PITR for the compose stack is `infra/docker/pitr.sh` (see `infra/README.md`); in Kubernetes it is the managed provider's job.
+
+The trap: **the encryption keys live outside the database.** Agent provider credentials, agent run grants, workflow payloads and cursors, automation secrets, MFA secrets, stored objects and connector credentials are all stored as ciphertext, and the keys are environment variables (`FD_AGENT_CREDENTIAL_KEY`, `FD_AGENT_RUN_GRANT_KEY`, `FD_WORKFLOWS_PAYLOAD_KEY`, `FD_WORKFLOWS_CURSOR_KEY`, `FD_AUTOMATIONS_CREDENTIAL_KEY`, `FD_AUTH_MFA_KEY`, `FD_NOTIFICATIONS_SECRET_KEY`, `FD_STORAGE_ENCRYPTION_KEY`, `FD_CONNECTORS_SECRET_KEY`, `FD_AUDIT_ANCHOR_KEY`). A database backup without the matching keys restores rows nobody can read, and rotating a key without re-encrypting orphans everything encrypted under the old one; every sealing key has a `secrets-rotate` command in the runbook's rotation table, the storage key two (`documents` and `exports`). Back the keys up separately, restore them together with the dump, and record which key version a dump belongs to.
 
 ## 6. Rollback
 
@@ -92,6 +95,8 @@ The trap: **the encryption keys live outside the database.** Agent provider cred
 3. To take one module out of service without a redeploy: `pnpm flowdular module disable <id> --apply` (it is a dry run without `--apply`), then rebuild the composition and redeploy. Its tables stay.
 4. If the rollback is because of a key change, restore the previous key first; the image alone will not fix unreadable ciphertext.
 
+- For data loss between two dumps use PITR (`pitr.sh restore --target-time`), never a `.down.sql`.
+
 ## 7. Production checklist
 
 - `pnpm verify` and `pnpm build` pass on the commit being shipped (the image build runs both).
@@ -103,7 +108,7 @@ The trap: **the encryption keys live outside the database.** Agent provider cred
 - Sign-up closed (`FD_AUTH_ALLOW_SIGN_UP`) unless the deployment is public; the first owner created with `flowdular auth workspace-create` (see `docs/cli.md`).
 - Liveness on `/api/health`, readiness on `/api/ready`.
 - `pnpm flowdular migration verify` clean after rollout, and `pnpm flowdular doctor --json` reports `status: healthy`.
-- A restore has been rehearsed once, keys included.
+- A restore has been rehearsed once, keys included, and a PITR restore once from the newest base backup.
 
 ## Pitfalls
 

package/agent-template/.claude/skills/cli-extension/SKILL.md

@@ -85,7 +85,7 @@ export default cliExtension;
 
 ## 4. What the runner does with the descriptor (`packages/cli/src/runner.ts`, `runExtensionCommand`)
 
-- `risk: 'external'`: refused with `APPROVAL_VERIFIER_REQUIRED`. `risk: 'destructive'` without `localOnly`: the same.
+- `risk: 'external'`, or `'destructive'` without `localOnly`: refused with `APPROVAL_VERIFIER_REQUIRED` unless `--grant <token> --tenant <id>` carries a verified approval grant for this capability and invocation digest (`APPROVAL_GRANT_INVALID`, `APPROVAL_GRANT_EXPIRED`, `APPROVAL_GRANT_MISMATCH` otherwise).
 - `localOnly: true`: refused with `LOCAL_ONLY_CAPABILITY` unless `FD_ENV` or `NODE_ENV` is `development` or `test` (unset counts as development).
 - `requiresApprovedSpec: true`: needs `--spec <path>` to a schema-valid spec with `status: approved`, otherwise `APPROVED_SPEC_REQUIRED`, `SPEC_VALIDATION_FAILED` or `SPEC_NOT_APPROVED`.
 - `destructive` with `--apply`: needs `--confirm <confirmation>` (`CONFIRMATION_REQUIRED`).

package/agent-template/.claude/skills/deploy-operate/SKILL.md

@@ -76,9 +76,12 @@ Both are served by `platform/src/server/health.ts`. The shipped Docker and Kuber
 pnpm flowdular database backup --output <dir>                            # dry run
 pnpm flowdular database backup --output <dir> --apply
 pnpm flowdular database restore --input <dir> --apply --confirm restore-database
+pnpm flowdular database restore-production --input <dir> --target <db> --grant <token> --tenant <id> [--platform-url <origin>|--platform-stopped] --apply --confirm restore-database
 ```
 
-The trap: **the encryption keys live outside the database.** Agent provider credentials, agent run grants, workflow payloads and cursors, automation secrets and MFA secrets are all stored as ciphertext, and the keys are environment variables (`FD_AGENT_CREDENTIAL_KEY`, `FD_AGENT_RUN_GRANT_KEY`, `FD_WORKFLOWS_PAYLOAD_KEY`, `FD_WORKFLOWS_CURSOR_KEY`, `FD_AUTOMATIONS_CREDENTIAL_KEY`, `FD_AUTH_MFA_KEY`, `FD_NOTIFICATIONS_SECRET_KEY`, `FD_STORAGE_ENCRYPTION_KEY`, `FD_CONNECTORS_SECRET_KEY`, `FD_AUDIT_ANCHOR_KEY`). A database backup without the matching keys restores rows nobody can read, and rotating a key without re-encrypting orphans everything encrypted under the old one. Back the keys up separately, restore them together with the dump, and record which key version a dump belongs to.
+Production restores run `database.restore.production`: an approval grant bound to the exact flags, `--target` equal to the migrator DSN database, a separate migrator DSN, a key mismatch refused unless the approval included `--allow-key-mismatch`, and a refusal while the health endpoint answers. PITR for the compose stack is `infra/docker/pitr.sh` (see `infra/README.md`); in Kubernetes it is the managed provider's job.
+
+The trap: **the encryption keys live outside the database.** Agent provider credentials, agent run grants, workflow payloads and cursors, automation secrets, MFA secrets, stored objects and connector credentials are all stored as ciphertext, and the keys are environment variables (`FD_AGENT_CREDENTIAL_KEY`, `FD_AGENT_RUN_GRANT_KEY`, `FD_WORKFLOWS_PAYLOAD_KEY`, `FD_WORKFLOWS_CURSOR_KEY`, `FD_AUTOMATIONS_CREDENTIAL_KEY`, `FD_AUTH_MFA_KEY`, `FD_NOTIFICATIONS_SECRET_KEY`, `FD_STORAGE_ENCRYPTION_KEY`, `FD_CONNECTORS_SECRET_KEY`, `FD_AUDIT_ANCHOR_KEY`). A database backup without the matching keys restores rows nobody can read, and rotating a key without re-encrypting orphans everything encrypted under the old one; every sealing key has a `secrets-rotate` command in the runbook's rotation table, the storage key two (`documents` and `exports`). Back the keys up separately, restore them together with the dump, and record which key version a dump belongs to.
 
 ## 6. Rollback
 
@@ -87,6 +90,8 @@ The trap: **the encryption keys live outside the database.** Agent provider cred
 3. To take one module out of service without a redeploy: `pnpm flowdular module disable <id> --apply` (it is a dry run without `--apply`), then rebuild the composition and redeploy. Its tables stay.
 4. If the rollback is because of a key change, restore the previous key first; the image alone will not fix unreadable ciphertext.
 
+- For data loss between two dumps use PITR (`pitr.sh restore --target-time`), never a `.down.sql`.
+
 ## 7. Production checklist
 
 - `pnpm verify` and `pnpm build` pass on the commit being shipped (the image build runs both).
@@ -98,7 +103,7 @@ The trap: **the encryption keys live outside the database.** Agent provider cred
 - Sign-up closed (`FD_AUTH_ALLOW_SIGN_UP`) unless the deployment is public; the first owner created with `flowdular auth workspace-create` (see `docs/cli.md`).
 - Liveness on `/api/health`, readiness on `/api/ready`.
 - `pnpm flowdular migration verify` clean after rollout, and `pnpm flowdular doctor --json` reports `status: healthy`.
-- A restore has been rehearsed once, keys included.
+- A restore has been rehearsed once, keys included, and a PITR restore once from the newest base backup.
 
 ## Pitfalls
 

package/agent-template/docs/cli.md

@@ -92,6 +92,8 @@ once the restored copy is staged. Being destructive, it needs
 `--apply --confirm restore-database` and, like `database reset`, runs only when
 `FD_ENV` or `NODE_ENV` is `development` or `test`.
 
+`database restore-production` is the same restore without the local gate: it runs only under an approval grant (`--grant <token> --tenant <id>`) bound to the exact flags, needs `--target` equal to the database the migrator DSN names, a separate migrator DSN, and either a health probe that finds the platform down (`--platform-url` or `FD_PORT`) or `--platform-stopped`; a key mismatch is refused unless the approved invocation carried `--allow-key-mismatch`. See docs/operations.md, "Restore in production".
+
 The full procedure, the key trap and the rotation status are in
 [operations.md](operations.md).
 
@@ -117,6 +119,9 @@ flowdular agents secrets-rotate [--apply]          # re-seal stored provider cre
 flowdular automations secrets-rotate [--apply]     # re-seal stored trigger secrets
 flowdular workflows secrets-rotate [--apply]       # re-seal stored run payloads
 flowdular notifications secrets-rotate [--apply]   # re-seal stored webhook signing secrets
+flowdular connectors secrets-rotate [--apply]      # re-seal stored connector credentials
+flowdular documents secrets-rotate [--apply]       # re-seal stored document objects with the storage key
+flowdular exports secrets-rotate [--apply]         # re-seal stored export files with the storage key
 
 flowdular sandbox access --tenant <tenant>         # grants and eligible members
 flowdular sandbox grant --email <email> --tenant <tenant> [--apply]

package/agent-template/docs/module-distribution.md

@@ -8,8 +8,8 @@ release artifacts. The landing is in [Flowdular/landing](https://github.com/Flow
 ```sh
 pnpm flowdular module search expenses
 pnpm flowdular module info expenses.core
-pnpm flowdular module install expenses.core@0.6.1
-pnpm flowdular module install expenses.core@0.6.1 --apply
+pnpm flowdular module install expenses.core@0.8.0
+pnpm flowdular module install expenses.core@0.8.0 --apply
 pnpm flowdular module enable expenses.core --apply
 pnpm flowdular module validate --locked
 ```

package/agent-template/docs/modules.md

@@ -147,6 +147,19 @@ A running `pnpm dev` picks the change up live: the octane plugin reloads server
 routes when the generated composition changes and the client hot-reloads, so no
 rebuild is needed. `pnpm dev` and `pnpm build` run the sync automatically.
 
+### Per-workspace activation
+
+Enabling composes a module into the application; whether a given workspace
+uses it is an owner's decision made in Administration, Modules. Every composed
+module is active until an owner deactivates it there, and the change applies to
+that workspace alone: its endpoints answer 403 `MODULE_INACTIVE`, and the shell
+hides the module's navigation, views, widgets and command search. `system.core`,
+`auth.core`, `users.core` and `profile.core` cannot be deactivated, and neither
+can a module another active module depends on; the refusal names the
+dependents. Each change is audited. The state lives in `system.core` and is
+published to other modules as the `system.modules.v1` capability; see
+`.ai/platform-capabilities.md`.
+
 ## Versions, ranges and capabilities
 
 A module carries one version in three places: `module.json` `version`,