or3-provider-sqlite 0.0.1 → 0.0.2

package/README.md

@@ -5,7 +5,7 @@ SQLite sync and workspace store provider for OR3 Chat. Provides a lightweight, s
 ## What it provides
 
 - **AuthWorkspaceStore** (`sqlite`) — user identity mapping, workspace CRUD, role resolution
-- **SyncGatewayAdapter** (`sqlite`) — push/pull sync with LWW conflict resolution, cursor tracking, GC
+- **SyncGatewayAdapter** (`sqlite`) — push/pull sync, consistent materialized snapshot pages, LWW conflict resolution, and cursor tracking
 
 ## Install
 
@@ -54,10 +54,12 @@ Registration is skipped when `auth.enabled` is `false` (local-only mode).
 
 ### Schema
 
-Two migrations create all tables:
+Ordered migrations create and evolve all tables:
 
 - **001_init**: `users`, `auth_accounts`, `workspaces`, `workspace_members`
 - **002_sync_tables**: `server_version_counter`, `change_log`, `device_cursors`, `tombstones`, plus materialized entity tables (`s_threads`, `s_messages`, etc.)
+- **003–005**: workspace-scoped sync keys, invitations, and admin stores
+- **006_sync_snapshots**: winning operation IDs plus immutable snapshot headers/items
 
 All tables use snake_case aligned with the sync wire format.
 
@@ -65,8 +67,9 @@ All tables use snake_case aligned with the sync wire format.
 
 - **Push**: validates ops → checks `op_id` idempotency → allocates contiguous `server_version` block → applies LWW to materialized tables → writes change_log → upserts tombstones for deletes
 - **Pull**: returns ordered changes for `server_version > cursor` with limit/pagination and optional table filtering
+- **Snapshot**: captures canonical live rows and current tombstones with one `highWatermark` under `BEGIN IMMEDIATE`, then serves immutable, keyset-paginated pages ordered by `(tableName, pk, kind)`
 - **Cursor**: forward-only per-device cursor tracking
-- **GC**: tombstone and change_log cleanup respects min device cursor + retention window
+- **Retention safety**: tombstone and `change_log` GC is enabled only under the explicit `snapshot-v1` capability and deletes old revisions acknowledged by every registered device
 
 LWW conflict resolution: incoming wins when `clock` is higher, or when clocks are equal and `hlc` is lexicographically greater.
 

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "or3-provider-sqlite",
   "configKey": "or3-provider-sqlite",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/server/admin/adapters/sync-sqlite.js

@@ -1,14 +1,6 @@
 import { createError } from "h3";
-import { createSqliteSyncGatewayAdapter } from "../../sync/sqlite-sync-gateway-adapter.js";
+import { SYNC_HISTORY_GC_POLICY } from "../../sync/history-gc-policy.js";
 const SQLITE_PROVIDER_ID = "sqlite";
-const DEFAULT_RETENTION_SECONDS = 30 * 24 * 3600;
-function resolveRetentionSeconds(payload) {
-  const days = typeof payload?.retentionDays === "number" ? payload.retentionDays : null;
-  const seconds = typeof payload?.retentionSeconds === "number" ? payload.retentionSeconds : null;
-  if (seconds && Number.isFinite(seconds) && seconds > 0) return Math.floor(seconds);
-  if (days && Number.isFinite(days) && days > 0) return Math.floor(days * 24 * 3600);
-  return DEFAULT_RETENTION_SECONDS;
-}
 export const sqliteSyncAdminAdapter = {
   id: SQLITE_PROVIDER_ID,
   kind: "sync",
@@ -26,6 +18,10 @@ export const sqliteSyncAdminAdapter = {
         message: "SQLite is configured with :memory:. Data will not persist across restarts."
       });
     }
+    warnings.push({
+      level: "warning",
+      message: SYNC_HISTORY_GC_POLICY.reason
+    });
     return {
       details: {
         dbPath: dbPath ?? ":memory:",
@@ -33,39 +29,21 @@ export const sqliteSyncAdminAdapter = {
         synchronous: process.env.OR3_SQLITE_PRAGMA_SYNCHRONOUS ?? "NORMAL"
       },
       warnings,
-      actions: [
-        {
-          id: "sync.gc-change-log",
-          label: "Run Sync Change Log GC",
-          description: "Purge old change_log entries after retention and device cursor checks.",
-          danger: true
-        },
-        {
-          id: "sync.gc-tombstones",
-          label: "Run Sync Tombstone GC",
-          description: "Purge old tombstones after retention and device cursor checks.",
-          danger: true
-        }
-      ]
+      actions: []
     };
   },
-  async runAction(event, actionId, payload, ctx) {
+  async runAction(_event, actionId, _payload, ctx) {
     if (!ctx.session.workspace?.id) {
       throw createError({
         statusCode: 400,
         statusMessage: "Workspace not resolved"
       });
     }
-    const adapter = createSqliteSyncGatewayAdapter();
-    const retentionSeconds = resolveRetentionSeconds(payload);
-    const scope = { workspaceId: ctx.session.workspace.id };
-    if (actionId === "sync.gc-change-log") {
-      await adapter.gcChangeLog?.(event, { scope, retentionSeconds });
-      return { ok: true, action: actionId, retentionSeconds };
-    }
-    if (actionId === "sync.gc-tombstones") {
-      await adapter.gcTombstones?.(event, { scope, retentionSeconds });
-      return { ok: true, action: actionId, retentionSeconds };
+    if (actionId === "sync.gc-change-log" || actionId === "sync.gc-tombstones") {
+      throw createError({
+        statusCode: 503,
+        statusMessage: SYNC_HISTORY_GC_POLICY.reason
+      });
     }
     throw createError({ statusCode: 400, statusMessage: "Unknown action" });
   }

package/dist/runtime/server/admin/stores/sqlite-store.js

@@ -79,25 +79,80 @@ class SqliteWorkspaceAccessStore {
         ).execute();
       }
     }
+    const existingMembership = await this.db.selectFrom("workspace_members").select("role").where("workspace_id", "=", input.workspaceId).where("user_id", "=", userId).executeTakeFirst();
+    if (existingMembership) {
+      await this.setMemberRole({
+        workspaceId: input.workspaceId,
+        userId,
+        role: input.role
+      });
+      return;
+    }
     await this.db.insertInto("workspace_members").values({
       id: randomUUID(),
       workspace_id: input.workspaceId,
       user_id: userId,
       role: input.role,
       created_at: now
-    }).onConflict(
-      (oc) => oc.columns(["workspace_id", "user_id"]).doUpdateSet({ role: input.role })
-    ).execute();
+    }).execute();
   }
   async setMemberRole(input) {
-    const result = await this.db.updateTable("workspace_members").set({ role: input.role }).where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).executeTakeFirst();
-    const updated = Number(result.numUpdatedRows ?? 0);
-    if (updated === 0) {
-      throw new Error("Workspace member not found");
-    }
+    await this.db.transaction().execute(async (tx) => {
+      const member = await tx.selectFrom("workspace_members").select("role").where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).executeTakeFirst();
+      if (!member) {
+        throw new Error("Workspace member not found");
+      }
+      if (member.role === "owner" && input.role !== "owner") {
+        const owners = await tx.selectFrom("workspace_members").select("user_id").where("workspace_id", "=", input.workspaceId).where("role", "=", "owner").execute();
+        if (owners.length <= 1) {
+          throw new Error(
+            "Cannot demote the last workspace owner. Transfer ownership first."
+          );
+        }
+        const workspace = await tx.selectFrom("workspaces").select("owner_user_id").where("id", "=", input.workspaceId).executeTakeFirst();
+        if (workspace?.owner_user_id === input.userId) {
+          const replacement = owners.find(
+            (owner) => owner.user_id !== input.userId
+          );
+          if (!replacement) {
+            throw new Error(
+              "Cannot demote the last workspace owner. Transfer ownership first."
+            );
+          }
+          await tx.updateTable("workspaces").set({ owner_user_id: replacement.user_id }).where("id", "=", input.workspaceId).execute();
+        }
+      }
+      await tx.updateTable("workspace_members").set({ role: input.role }).where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).execute();
+    });
   }
   async removeMember(input) {
-    await this.db.deleteFrom("workspace_members").where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).execute();
+    await this.db.transaction().execute(async (tx) => {
+      const member = await tx.selectFrom("workspace_members").select("role").where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).executeTakeFirst();
+      if (!member) {
+        throw new Error("Workspace member not found");
+      }
+      if (member.role === "owner") {
+        const owners = await tx.selectFrom("workspace_members").select("user_id").where("workspace_id", "=", input.workspaceId).where("role", "=", "owner").execute();
+        if (owners.length <= 1) {
+          throw new Error(
+            "Cannot remove the last workspace owner. Transfer ownership first."
+          );
+        }
+        const workspace = await tx.selectFrom("workspaces").select("owner_user_id").where("id", "=", input.workspaceId).executeTakeFirst();
+        if (workspace?.owner_user_id === input.userId) {
+          const replacement = owners.find(
+            (owner) => owner.user_id !== input.userId
+          );
+          if (!replacement) {
+            throw new Error(
+              "Cannot remove the last workspace owner. Transfer ownership first."
+            );
+          }
+          await tx.updateTable("workspaces").set({ owner_user_id: replacement.user_id }).where("id", "=", input.workspaceId).execute();
+        }
+      }
+      await tx.deleteFrom("workspace_members").where("workspace_id", "=", input.workspaceId).where("user_id", "=", input.userId).execute();
+    });
   }
   async listWorkspaces(input) {
     const includeDeleted = input.includeDeleted === true;

package/dist/runtime/server/auth/sqlite-auth-workspace-store.d.ts

@@ -4,10 +4,11 @@
  * Maps provider identity -> internal user and manages workspace CRUD.
  * Uses Kysely for all queries. No Convex or Clerk SDK imports.
  */
-import type { AuthWorkspaceStore } from '~~/server/auth/store/types';
+import type { AuthWorkspaceStore, InviteProvisionResult, InviteValidationResult } from '~~/server/auth/store/types';
 import type { WorkspaceRole } from '~~/app/core/hooks/hook-types';
 export declare class SqliteAuthWorkspaceStore implements AuthWorkspaceStore {
     private get db();
+    protected onInviteProvisionStep(_step: 'invite_validated' | 'user_created' | 'membership_created' | 'invite_consumed'): void;
     getOrCreateUser(input: {
         provider: string;
         providerUserId: string;
@@ -27,6 +28,7 @@ export declare class SqliteAuthWorkspaceStore implements AuthWorkspaceStore {
     getOrCreateDefaultWorkspace(userId: string): Promise<{
         workspaceId: string;
         workspaceName: string;
+        created?: boolean;
     }>;
     getWorkspaceRole(input: {
         userId: string;
@@ -95,6 +97,19 @@ export declare class SqliteAuthWorkspaceStore implements AuthWorkspaceStore {
         inviteId: string;
         revokedByUserId: string;
     }): Promise<void>;
+    validateInvite(input: {
+        workspaceId: string;
+        email: string;
+        tokenHash: string;
+    }): Promise<InviteValidationResult>;
+    acceptInviteAndProvisionUser(input: {
+        provider: string;
+        providerUserId: string;
+        email: string;
+        displayName?: string;
+        workspaceId: string;
+        tokenHash: string;
+    }): Promise<InviteProvisionResult>;
     consumeInvite(input: {
         workspaceId: string;
         email: string;

package/dist/runtime/server/auth/sqlite-auth-workspace-store.js

@@ -13,6 +13,8 @@ export class SqliteAuthWorkspaceStore {
   get db() {
     return getSqliteDb();
   }
+  onInviteProvisionStep(_step) {
+  }
   async getOrCreateUser(input) {
     this.db;
     const raw = getRawDb();
@@ -94,7 +96,8 @@ export class SqliteAuthWorkspaceStore {
     if (activeMembership) {
       return {
         workspaceId: activeMembership.id,
-        workspaceName: activeMembership.name
+        workspaceName: activeMembership.name,
+        created: false
       };
     }
     const membership = await db.selectFrom("workspace_members").innerJoin("workspaces", "workspaces.id", "workspace_members.workspace_id").select([
@@ -103,7 +106,11 @@ export class SqliteAuthWorkspaceStore {
     ]).where("workspace_members.user_id", "=", userId).where("workspaces.deleted", "=", 0).orderBy("workspace_members.created_at", "asc").executeTakeFirst();
     if (membership) {
       await db.updateTable("users").set({ active_workspace_id: membership.id }).where("id", "=", userId).execute();
-      return { workspaceId: membership.id, workspaceName: membership.name };
+      return {
+        workspaceId: membership.id,
+        workspaceName: membership.name,
+        created: false
+      };
     }
     const workspaceId = uid();
     const memberId = uid();
@@ -128,7 +135,7 @@ export class SqliteAuthWorkspaceStore {
       }).execute();
       await tx.updateTable("users").set({ active_workspace_id: workspaceId }).where("id", "=", userId).execute();
     });
-    return { workspaceId, workspaceName: name };
+    return { workspaceId, workspaceName: name, created: true };
   }
   async getWorkspaceRole(input) {
     const db = this.db;
@@ -277,6 +284,110 @@ export class SqliteAuthWorkspaceStore {
     }).where("workspace_id", "=", input.workspaceId).where("id", "=", input.inviteId).execute();
     void input.revokedByUserId;
   }
+  async validateInvite(input) {
+    this.db;
+    const raw = getRawDb();
+    const now = nowEpoch();
+    const invite = raw.prepare(
+      `SELECT role, status, email, expires_at
+                 FROM auth_invites
+                 WHERE workspace_id = ? AND token_hash = ?
+                 LIMIT 1`
+    ).get(input.workspaceId, input.tokenHash);
+    if (!invite) return { ok: false, reason: "not_found" };
+    if (invite.email !== normalizeEmail(input.email)) {
+      return { ok: false, reason: "email_mismatch" };
+    }
+    if (invite.status === "accepted") return { ok: false, reason: "already_used" };
+    if (invite.status === "revoked") return { ok: false, reason: "revoked" };
+    if (invite.status === "expired" || invite.expires_at <= now) {
+      return { ok: false, reason: "expired" };
+    }
+    return { ok: true, role: invite.role };
+  }
+  async acceptInviteAndProvisionUser(input) {
+    this.db;
+    const raw = getRawDb();
+    const now = nowEpoch();
+    const normalizedEmail = normalizeEmail(input.email);
+    return raw.transaction(() => {
+      const invite = raw.prepare(
+        `SELECT id, role, status, email, expires_at
+                         FROM auth_invites
+                         WHERE workspace_id = ? AND token_hash = ?
+                         LIMIT 1`
+      ).get(input.workspaceId, input.tokenHash);
+      if (!invite) return { ok: false, reason: "not_found" };
+      if (invite.email !== normalizedEmail) {
+        return { ok: false, reason: "email_mismatch" };
+      }
+      if (invite.status === "accepted") {
+        return { ok: false, reason: "already_used" };
+      }
+      if (invite.status === "revoked") {
+        return { ok: false, reason: "revoked" };
+      }
+      if (invite.status === "expired" || invite.expires_at <= now) {
+        return { ok: false, reason: "expired" };
+      }
+      this.onInviteProvisionStep("invite_validated");
+      const existingAccount = raw.prepare(
+        `SELECT user_id
+                         FROM auth_accounts
+                         WHERE provider = ? AND provider_user_id = ?
+                         LIMIT 1`
+      ).get(input.provider, input.providerUserId);
+      const userId = existingAccount?.user_id ?? uid();
+      const createdUser = !existingAccount;
+      if (createdUser) {
+        raw.prepare(
+          `INSERT INTO users (id, email, display_name, active_workspace_id, created_at)
+                         VALUES (?, ?, ?, NULL, ?)`
+        ).run(userId, normalizedEmail, input.displayName ?? null, now);
+        raw.prepare(
+          `INSERT INTO auth_accounts (id, user_id, provider, provider_user_id, created_at)
+                         VALUES (?, ?, ?, ?, ?)`
+        ).run(uid(), userId, input.provider, input.providerUserId, now);
+      }
+      this.onInviteProvisionStep("user_created");
+      const existingMembership = raw.prepare(
+        `SELECT id FROM workspace_members
+                         WHERE workspace_id = ? AND user_id = ?
+                         LIMIT 1`
+      ).get(input.workspaceId, userId);
+      if (existingMembership) {
+        raw.prepare("UPDATE workspace_members SET role = ? WHERE id = ?").run(
+          invite.role,
+          existingMembership.id
+        );
+      } else {
+        raw.prepare(
+          `INSERT INTO workspace_members (id, workspace_id, user_id, role, created_at)
+                         VALUES (?, ?, ?, ?, ?)`
+        ).run(uid(), input.workspaceId, userId, invite.role, now);
+      }
+      raw.prepare("UPDATE users SET active_workspace_id = ? WHERE id = ?").run(
+        input.workspaceId,
+        userId
+      );
+      this.onInviteProvisionStep("membership_created");
+      const consumed = raw.prepare(
+        `UPDATE auth_invites
+                     SET status = 'accepted', accepted_at = ?, accepted_user_id = ?, updated_at = ?
+                     WHERE id = ? AND status = 'pending'`
+      ).run(now, userId, now, invite.id);
+      if (consumed.changes !== 1) {
+        throw new Error("Invite state changed during atomic acceptance");
+      }
+      this.onInviteProvisionStep("invite_consumed");
+      return {
+        ok: true,
+        userId,
+        role: invite.role,
+        createdUser
+      };
+    }).immediate();
+  }
   async consumeInvite(input) {
     this.db;
     const raw = getRawDb();

package/dist/runtime/server/db/migrate.js

@@ -4,18 +4,61 @@ import * as m002 from "./migrations/002_sync_tables.js";
 import * as m003 from "./migrations/003_sync_hardening.js";
 import * as m004 from "./migrations/004_auth_invites.js";
 import * as m005 from "./migrations/005_admin_stores.js";
+import * as m006 from "./migrations/006_sync_snapshots.js";
+import * as m007 from "./migrations/007_device_cursor_ownership.js";
+import * as m008 from "./migrations/008_upload_intents.js";
+const REQUIRED_SCHEMA_TABLES = [
+  "users",
+  "auth_accounts",
+  "workspaces",
+  "workspace_members",
+  "server_version_counter",
+  "change_log",
+  "device_cursors",
+  "tombstones",
+  "s_threads",
+  "s_messages",
+  "s_projects",
+  "s_posts",
+  "s_kv",
+  "s_file_meta",
+  "s_notifications",
+  "auth_invites",
+  "admin_users",
+  "admin_workspace_settings",
+  "sync_snapshots",
+  "sync_snapshot_items",
+  "upload_intents"
+];
 const migrations = {
   "001_init": m001,
   "002_sync_tables": m002,
   "003_sync_hardening": m003,
   "004_auth_invites": m004,
-  "005_admin_stores": m005
+  "005_admin_stores": m005,
+  "006_sync_snapshots": m006,
+  "007_device_cursor_ownership": m007,
+  "008_upload_intents": m008
 };
 class StaticMigrationProvider {
   async getMigrations() {
     return migrations;
   }
 }
+async function assertLatestSchemaIntegrity(db) {
+  const tables = await db.introspection.getTables({
+    withInternalKyselyTables: true
+  });
+  const tableNames = new Set(tables.map((table) => table.name));
+  const missing = REQUIRED_SCHEMA_TABLES.filter(
+    (tableName) => !tableNames.has(tableName)
+  );
+  if (missing.length > 0) {
+    throw new Error(
+      `SQLite schema integrity check failed; required tables are missing: ${missing.join(", ")}`
+    );
+  }
+}
 export async function runMigrations(db) {
   const migrator = new Migrator({
     db,
@@ -35,4 +78,5 @@ export async function runMigrations(db) {
     console.error("[or3-sqlite] migration error:", error);
     throw error;
   }
+  await assertLatestSchemaIntegrity(db);
 }

package/dist/runtime/server/db/migrations/006_sync_snapshots.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Migration 006: Durable, consistent sync snapshot pages.
+ *
+ * - Stores the winning operation ID on materialized rows and tombstones.
+ * - Adds immutable snapshot headers/items for pagination across requests.
+ * - Backfills deterministic operation IDs for existing materialized state.
+ */
+import type { Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/006_sync_snapshots.js

@@ -0,0 +1,106 @@
+import { sql } from "kysely";
+const SYNCED_TABLES = [
+  ["s_threads", "threads"],
+  ["s_messages", "messages"],
+  ["s_projects", "projects"],
+  ["s_posts", "posts"],
+  ["s_kv", "kv"],
+  ["s_file_meta", "file_meta"],
+  ["s_notifications", "notifications"]
+];
+export async function up(db) {
+  for (const [materializedTable, tableName] of SYNCED_TABLES) {
+    await sql.raw(
+      `ALTER TABLE "${materializedTable}" ADD COLUMN op_id TEXT NOT NULL DEFAULT ''`
+    ).execute(db);
+    await sql.raw(`
+            UPDATE "${materializedTable}" AS materialized
+            SET op_id = COALESCE(
+                (
+                    SELECT change.op_id
+                    FROM change_log AS change
+                    WHERE change.workspace_id = materialized.workspace_id
+                      AND change.table_name = '${tableName}'
+                      AND change.pk = materialized.id
+                      AND change.op = CASE WHEN materialized.deleted <> 0 THEN 'delete' ELSE 'put' END
+                      AND change.clock = materialized.clock
+                      AND change.hlc = materialized.hlc
+                    ORDER BY change.server_version DESC
+                    LIMIT 1
+                ),
+                'legacy:${tableName}:' || materialized.id || ':' || materialized.clock || ':' || materialized.hlc
+            )
+            WHERE materialized.op_id = ''
+        `).execute(db);
+  }
+  await sql.raw(
+    `ALTER TABLE tombstones ADD COLUMN hlc TEXT NOT NULL DEFAULT ''`
+  ).execute(db);
+  await sql.raw(
+    `ALTER TABLE tombstones ADD COLUMN op_id TEXT NOT NULL DEFAULT ''`
+  ).execute(db);
+  await sql.raw(`
+        UPDATE tombstones AS tombstone
+        SET
+            hlc = COALESCE(
+                (
+                    SELECT change.hlc
+                    FROM change_log AS change
+                    WHERE change.workspace_id = tombstone.workspace_id
+                      AND change.table_name = tombstone.table_name
+                      AND change.pk = tombstone.pk
+                      AND change.op = 'delete'
+                      AND change.server_version = tombstone.server_version
+                    LIMIT 1
+                ),
+                CASE WHEN tombstone.hlc <> '' THEN tombstone.hlc ELSE 'legacy:0' END
+            ),
+            op_id = COALESCE(
+                (
+                    SELECT change.op_id
+                    FROM change_log AS change
+                    WHERE change.workspace_id = tombstone.workspace_id
+                      AND change.table_name = tombstone.table_name
+                      AND change.pk = tombstone.pk
+                      AND change.op = 'delete'
+                      AND change.server_version = tombstone.server_version
+                    LIMIT 1
+                ),
+                'legacy:tombstone:' || tombstone.table_name || ':' || tombstone.pk || ':' || tombstone.clock
+            )
+        WHERE tombstone.hlc = '' OR tombstone.op_id = ''
+    `).execute(db);
+  await sql.raw(`
+        CREATE TABLE sync_snapshots (
+            id TEXT PRIMARY KEY,
+            workspace_id TEXT NOT NULL,
+            high_watermark INTEGER NOT NULL,
+            tables_json TEXT NOT NULL,
+            created_at INTEGER NOT NULL,
+            expires_at INTEGER NOT NULL
+        )
+    `).execute(db);
+  await sql.raw(`
+        CREATE INDEX idx_sync_snapshots_expires
+        ON sync_snapshots(expires_at)
+    `).execute(db);
+  await sql.raw(`
+        CREATE TABLE sync_snapshot_items (
+            snapshot_id TEXT NOT NULL,
+            table_name TEXT NOT NULL,
+            pk TEXT NOT NULL,
+            kind TEXT NOT NULL CHECK(kind IN ('row', 'tombstone')),
+            payload_json TEXT,
+            clock INTEGER NOT NULL,
+            hlc TEXT NOT NULL,
+            op_id TEXT NOT NULL,
+            server_deleted_at INTEGER,
+            PRIMARY KEY (snapshot_id, table_name, pk, kind),
+            FOREIGN KEY (snapshot_id) REFERENCES sync_snapshots(id) ON DELETE CASCADE
+        ) WITHOUT ROWID
+    `).execute(db);
+}
+export async function down(db) {
+  await db.schema.dropTable("sync_snapshot_items").ifExists().execute();
+  await db.schema.dropTable("sync_snapshots").ifExists().execute();
+}

package/dist/runtime/server/db/migrations/007_device_cursor_ownership.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Migration 007: bind device cursors to the authenticated user that created
+ * them. Legacy rows remain unbound until their next authenticated update.
+ */
+import type { Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(_db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/007_device_cursor_ownership.js

@@ -0,0 +1,5 @@
+export async function up(db) {
+  await db.schema.alterTable("device_cursors").addColumn("owner_user_id", "text").execute();
+}
+export async function down(_db) {
+}

package/dist/runtime/server/db/migrations/008_upload_intents.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Persisted upload intents are both one-time authorizations and quota reservations. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/008_upload_intents.js

@@ -0,0 +1,26 @@
+import { sql } from "kysely";
+export async function up(db) {
+  await sql`
+        CREATE TABLE upload_intents (
+            id TEXT PRIMARY KEY,
+            workspace_id TEXT NOT NULL,
+            hash TEXT NOT NULL,
+            mime_type TEXT NOT NULL,
+            size_bytes INTEGER NOT NULL,
+            reserved_bytes INTEGER NOT NULL,
+            expires_at INTEGER NOT NULL,
+            status TEXT NOT NULL CHECK (status IN ('active', 'consumed', 'cancelled', 'expired')),
+            storage_id TEXT,
+            created_at INTEGER NOT NULL,
+            consumed_at INTEGER,
+            cancelled_at INTEGER
+        )
+    `.execute(db);
+  await sql`CREATE INDEX upload_intents_workspace_status_expiry
+        ON upload_intents(workspace_id, status, expires_at, id)`.execute(db);
+  await sql`CREATE INDEX upload_intents_workspace_hash_status
+        ON upload_intents(workspace_id, hash, status)`.execute(db);
+}
+export async function down(db) {
+  await db.schema.dropTable("upload_intents").ifExists().execute();
+}