import { _ as __exportAll } from './chunk-DDP5xfzh.js';
import { s as sqliteTable, t as text, a as index, i as integer } from './indexes-aYlULWG3.js';
import { u as unique, p as primaryKey } from './unique-constraint-BM-Apx1H.js';
import { s as sql } from './utils-BvHPJOVk.js';

//#region ../core/dist/store/schema/cleo-global/agent-registry.js
/**
* Global-scope `cleo.db` — consolidated **Agent Registry** domain (13 tables).
*
* The Agent Registry is the GLOBAL agent-identity tier (formerly labelled
* "signaldock" — the rename landed under T11622 / SG-AGENT-IDENTITY E4). It holds
* agents / capabilities / skills / credentials and has ZERO send/receive
* functions — agent-to-agent messaging is owned by the conduit domain. The
* external `api.signaldock.io` URL retained below is an EXTERNAL Conduit transport
* channel, NOT this local registry; it intentionally keeps the legacy hostname.
*
* Part of the consolidated GLOBAL-scope `cleo.db` target shape authored for
* SG-DB-SUBSTRATE-V2 (saga T11242, epic T11245/E2, task T11361). The Agent
* Registry FOLDS into the global `cleo.db` per D1 (no standalone identity-DB file
* survives). Physical names carry the `agent_registry_` domain prefix — these are
* the runtime READ + WRITE tables after the T11622 cutover (folds T11578 AC2).
*
* ## Idempotent prefixer (AC1)
*
* All 13 source tables are bare and gain the `agent_registry_` prefix at exodus:
* `users` → `agent_registry_users` · `organization` → `agent_registry_organization` ·
* `agents` → `agent_registry_agents` · `claim_codes` → `agent_registry_claim_codes` ·
* `capabilities` → `agent_registry_capabilities` · `skills` → `agent_registry_skills`
* (the global agent CAPABILITY/SKILL catalog — distinct from the `skills_*`
* installed-skills registry) · `agent_capabilities` →
* `agent_registry_agent_capabilities` · `agent_skills` → `agent_registry_agent_skills`
* · `agent_connections` → `agent_registry_agent_connections` · `accounts` →
* `agent_registry_accounts` · `sessions` → `agent_registry_sessions` · `verifications`
* → `agent_registry_verifications` · `org_agent_keys` → `agent_registry_org_agent_keys`.
*
* ## E10 typing applied
*
* - **§4 timestamps (INTEGER epoch non-conformers → TEXT ISO8601):** the
*   agent-registry cloud-sync tables stored `created_at` / `updated_at` (and
*   `expires_at` / `used_at` / `last_seen` / `last_used_at` / `connected_at`)
*   as raw INTEGER epoch. Every column the audit flagged `timestamp-epoch`
*   becomes canonical `text` ISO8601; the matching `CHECK (col GLOB
*   'YYYY-MM-DD*')` ships at exodus. (`agent_connections.last_heartbeat` is
*   classified `numeric` by the audit — a heartbeat counter, NOT a flagged
*   timestamp — so it stays `integer`. The better-auth `accounts` / `sessions`
*   / `verifications` tables already use TEXT timestamps; left as-is.)
* - **§5b enum-like bare TEXT → `{ enum }`:** `agent_registry_users.role` →
*   `{ enum: AGENT_REGISTRY_USER_ROLES }` and `agent_registry_agents.status` →
*   `{ enum: AGENT_REGISTRY_AGENT_STATUSES }` (the two agent-registry §5b
*   non-conformers; const arrays minted in-module per §8.3 from the cloud-sync
*   writer conventions — better-auth roles + the conduit presence set).
* - **§3b boolean non-conformer:** `agent_registry_agents.is_active` was untyped
*   INTEGER 0/1 → `integer({ mode:'boolean' })`. The remaining 0/1 columns the
*   audit classified `numeric` (`email_verified`, `banned`, `two_factor_enabled`,
*   `requires_reauth`, `can_spawn`, `sessions.active`) are NOT flagged as
*   boolean non-conformers by the audit, so they keep their plain `integer`
*   affinity (faithful to the audit classification).
*
* ## FK reconciliation to single-file Pattern A (AC4)
*
* Every agent-registry FK is INTRA-domain (all 13 tables now live in the SAME global
* `cleo.db` file), so the source `.references()` are preserved as native FKs:
* `agents.owner_id` → `agent_registry_users.id`, `agents.organization_id` →
* `agent_registry_organization.id`, `claim_codes.{agent_id,used_by}`,
* `agent_capabilities`/`agent_skills` composite-PK junctions,
* `accounts.user_id` / `sessions.user_id`, `org_agent_keys.{organization_id,
* agent_id}`. None of these crossed a file boundary, so no soft-FK downgrade is
* required (AC4 — no ATTACH).
*
* @task T11361
* @epic T11245
* @saga T11242
* @see docs/migration/sqlite-schema-canonical.md §1 (D1″ · global counts) · §3b · §4 · §5b
* @see docs/migration/sqlite-schema-columns.json (per-column affinity SSoT)
* @see ../agent-registry-schema.ts (the legacy bare-named runtime schema module)
* @task T11622 (Signaldock → Agent Registry rename + runtime cutover; folds T11578 AC2)
*/
var agent_registry_exports = /* @__PURE__ */ __exportAll({
	AGENT_REGISTRY_AGENT_STATUSES: () => AGENT_REGISTRY_AGENT_STATUSES,
	AGENT_REGISTRY_USER_ROLES: () => AGENT_REGISTRY_USER_ROLES,
	agentRegistryAccounts: () => agentRegistryAccounts,
	agentRegistryAgentCapabilities: () => agentRegistryAgentCapabilities,
	agentRegistryAgentConnections: () => agentRegistryAgentConnections,
	agentRegistryAgentSkills: () => agentRegistryAgentSkills,
	agentRegistryAgents: () => agentRegistryAgents,
	agentRegistryCapabilities: () => agentRegistryCapabilities,
	agentRegistryClaimCodes: () => agentRegistryClaimCodes,
	agentRegistryOrgAgentKeys: () => agentRegistryOrgAgentKeys,
	agentRegistryOrganization: () => agentRegistryOrganization,
	agentRegistrySessions: () => agentRegistrySessions,
	agentRegistrySkills: () => agentRegistrySkills,
	agentRegistryUsers: () => agentRegistryUsers,
	agentRegistryVerifications: () => agentRegistryVerifications
});
/**
* Legal `agent_registry_users.role` values — better-auth account roles.
*
* E10 §5b: `users.role` was bare `text('role')` (default `'user'`). The
* agent-registry users table mirrors the api.signaldock.io better-auth admin-plugin
* role set; populated only on cloud sync. Default `'user'`.
*
* @task T11361
*/
var AGENT_REGISTRY_USER_ROLES = ["user", "admin"];
/**
* Legal `agent_registry_agents.status` values — agent presence.
*
* E10 §5b: `agents.status` was bare `text('status')` (default `'online'`). The
* presence set is the one the conduit client distinguishes (`status ===
* 'online'` for reachability) plus the standard presence states.
*
* @task T11361
*/
var AGENT_REGISTRY_AGENT_STATUSES = [
	"online",
	"offline",
	"busy",
	"away"
];
/**
* `agent_registry_users` — cloud-sync user accounts (zero rows in pure-local mode).
* Bare `users` → `agent_registry_users` under the AC1 idempotent prefixer.
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistryUsers = sqliteTable("agent_registry_users", {
	id: text("id").primaryKey(),
	email: text("email").notNull().unique(),
	passwordHash: text("password_hash").notNull(),
	name: text("name"),
	slug: text("slug"),
	defaultAgentId: text("default_agent_id"),
	username: text("username"),
	displayUsername: text("display_username"),
	emailVerified: integer("email_verified").notNull().default(0),
	image: text("image"),
	role: text("role", { enum: AGENT_REGISTRY_USER_ROLES }).notNull().default("user"),
	banned: integer("banned").notNull().default(0),
	banReason: text("ban_reason"),
	banExpires: text("ban_expires"),
	twoFactorEnabled: integer("two_factor_enabled").notNull().default(0),
	metadata: text("metadata"),
	createdAt: text("created_at").notNull(),
	updatedAt: text("updated_at").notNull()
}, (table) => [index("idx_agent_registry_users_slug").on(table.slug)]);
/**
* `agent_registry_organization` — cloud-sync org/team records (zero rows locally).
* Bare `organization` → `agent_registry_organization`.
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistryOrganization = sqliteTable("agent_registry_organization", {
	id: text("id").primaryKey().notNull(),
	name: text("name").notNull(),
	slug: text("slug"),
	logo: text("logo"),
	metadata: text("metadata"),
	ownerId: text("owner_id"),
	createdAt: text("created_at").notNull().default(sql`(datetime('now'))`),
	updatedAt: text("updated_at").notNull().default(sql`(datetime('now'))`)
}, (table) => [index("idx_agent_registry_organization_slug").on(table.slug)]);
/**
* `agent_registry_agents` — canonical cross-project agent registry (global
* identity). Bare `agents` → `agent_registry_agents`.
*
* T897 v3 columns: tier, can_spawn, orch_level, reports_to, cant_path,
* cant_sha256, installed_from, installed_at.
*
* @task T11361 (target shape) · T346 / T897 (original)
*/
var agentRegistryAgents = sqliteTable("agent_registry_agents", {
	id: text("id").primaryKey(),
	agentId: text("agent_id").notNull().unique(),
	name: text("name").notNull(),
	description: text("description"),
	class: text("class").notNull().default("custom"),
	privacyTier: text("privacy_tier").notNull().default("public"),
	ownerId: text("owner_id").references(() => agentRegistryUsers.id),
	endpoint: text("endpoint"),
	webhookSecret: text("webhook_secret"),
	capabilities: text("capabilities").notNull().default("[]"),
	skills: text("skills").notNull().default("[]"),
	avatar: text("avatar"),
	messagesSent: integer("messages_sent").notNull().default(0),
	messagesReceived: integer("messages_received").notNull().default(0),
	conversationCount: integer("conversation_count").notNull().default(0),
	friendCount: integer("friend_count").notNull().default(0),
	status: text("status", { enum: AGENT_REGISTRY_AGENT_STATUSES }).notNull().default("online"),
	lastSeen: integer("last_seen"),
	paymentConfig: text("payment_config"),
	apiKeyHash: text("api_key_hash"),
	organizationId: text("organization_id").references(() => agentRegistryOrganization.id, { onDelete: "set null" }),
	createdAt: text("created_at").notNull(),
	updatedAt: text("updated_at").notNull(),
	transportType: text("transport_type").notNull().default("http"),
	apiKeyEncrypted: text("api_key_encrypted"),
	apiBaseUrl: text("api_base_url").notNull().default("https://api.signaldock.io"),
	classification: text("classification"),
	transportConfig: text("transport_config").notNull().default("{}"),
	isActive: integer("is_active", { mode: "boolean" }).notNull().default(true),
	lastUsedAt: text("last_used_at"),
	requiresReauth: integer("requires_reauth").notNull().default(0),
	tier: text("tier").notNull().default("global"),
	canSpawn: integer("can_spawn").notNull().default(0),
	orchLevel: integer("orch_level").notNull().default(2),
	reportsTo: text("reports_to"),
	cantPath: text("cant_path"),
	cantSha256: text("cant_sha256"),
	installedFrom: text("installed_from"),
	installedAt: text("installed_at")
}, (table) => [
	index("idx_agent_registry_agents_owner").on(table.ownerId),
	index("idx_agent_registry_agents_class").on(table.class),
	index("idx_agent_registry_agents_privacy").on(table.privacyTier),
	index("idx_agent_registry_agents_org").on(table.organizationId),
	index("idx_agent_registry_agents_transport_type").on(table.transportType),
	index("idx_agent_registry_agents_is_active").on(table.isActive),
	index("idx_agent_registry_agents_last_used").on(table.lastUsedAt),
	index("idx_agent_registry_agents_tier").on(table.tier),
	index("idx_agent_registry_agents_cant_path").on(table.cantPath)
]);
/**
* `agent_registry_claim_codes` — one-time agent claim tokens (cloud provisioning).
* Bare `claim_codes` → `agent_registry_claim_codes`.
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistryClaimCodes = sqliteTable("agent_registry_claim_codes", {
	id: text("id").primaryKey(),
	agentId: text("agent_id").notNull().references(() => agentRegistryAgents.id),
	code: text("code").notNull().unique(),
	expiresAt: text("expires_at").notNull(),
	usedAt: text("used_at"),
	usedBy: text("used_by").references(() => agentRegistryUsers.id),
	createdAt: text("created_at").notNull()
}, (table) => [index("idx_agent_registry_claim_codes_agent").on(table.agentId)]);
/**
* `agent_registry_capabilities` — pre-seeded capability-slug catalog. Bare
* `capabilities` → `agent_registry_capabilities`.
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistryCapabilities = sqliteTable("agent_registry_capabilities", {
	id: text("id").primaryKey(),
	slug: text("slug").notNull().unique(),
	name: text("name").notNull(),
	description: text("description").notNull(),
	category: text("category").notNull(),
	createdAt: text("created_at").notNull()
});
/**
* `agent_registry_skills` — pre-seeded agent skill-slug catalog. Bare `skills` →
* `agent_registry_skills`. (The agent CAPABILITY catalog — distinct from the
* installed-skills `skills_*` registry in `./skills.ts`.)
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistrySkills = sqliteTable("agent_registry_skills", {
	id: text("id").primaryKey(),
	slug: text("slug").notNull().unique(),
	name: text("name").notNull(),
	description: text("description").notNull(),
	category: text("category").notNull(),
	createdAt: text("created_at").notNull()
});
/**
* `agent_registry_agent_capabilities` — agent ↔ capability junction. Bare
* `agent_capabilities` → `agent_registry_agent_capabilities`.
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistryAgentCapabilities = sqliteTable("agent_registry_agent_capabilities", {
	agentId: text("agent_id").notNull().references(() => agentRegistryAgents.id),
	capabilityId: text("capability_id").notNull().references(() => agentRegistryCapabilities.id)
}, (table) => [primaryKey({ columns: [table.agentId, table.capabilityId] })]);
/**
* `agent_registry_agent_skills` — agent ↔ skill junction. Bare `agent_skills` →
* `agent_registry_agent_skills`. T897 v3 columns: source, attached_at.
*
* @task T11361 (target shape) · T897 (original)
*/
var agentRegistryAgentSkills = sqliteTable("agent_registry_agent_skills", {
	agentId: text("agent_id").notNull().references(() => agentRegistryAgents.id),
	skillId: text("skill_id").notNull().references(() => agentRegistrySkills.id),
	source: text("source").notNull().default("manual"),
	attachedAt: text("attached_at").notNull().default(sql`(datetime('now'))`)
}, (table) => [primaryKey({ columns: [table.agentId, table.skillId] }), index("idx_agent_registry_agent_skills_source").on(table.source)]);
/**
* `agent_registry_agent_connections` — live transport connection tracking
* (heartbeat state). Bare `agent_connections` → `agent_registry_agent_connections`.
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistryAgentConnections = sqliteTable("agent_registry_agent_connections", {
	id: text("id").primaryKey().notNull(),
	agentId: text("agent_id").notNull(),
	transportType: text("transport_type").notNull().default("http"),
	connectionId: text("connection_id"),
	connectedAt: text("connected_at").notNull(),
	lastHeartbeat: integer("last_heartbeat").notNull(),
	connectionMetadata: text("connection_metadata"),
	createdAt: text("created_at").notNull()
}, (table) => [
	index("idx_agent_registry_agent_connections_agent").on(table.agentId),
	index("idx_agent_registry_agent_connections_transport").on(table.transportType),
	index("idx_agent_registry_agent_connections_heartbeat").on(table.lastHeartbeat),
	unique().on(table.agentId, table.connectionId)
]);
/**
* `agent_registry_accounts` — cloud-sync OAuth/provider accounts. Bare `accounts` →
* `agent_registry_accounts`. (better-auth timestamps already canonical TEXT, §4.)
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistryAccounts = sqliteTable("agent_registry_accounts", {
	id: text("id").primaryKey().notNull(),
	userId: text("user_id").notNull().references(() => agentRegistryUsers.id, { onDelete: "cascade" }),
	accountId: text("account_id").notNull(),
	providerId: text("provider_id").notNull(),
	accessToken: text("access_token"),
	refreshToken: text("refresh_token"),
	idToken: text("id_token"),
	accessTokenExpiresAt: text("access_token_expires_at"),
	refreshTokenExpiresAt: text("refresh_token_expires_at"),
	scope: text("scope"),
	password: text("password"),
	createdAt: text("created_at").notNull(),
	updatedAt: text("updated_at").notNull()
}, (table) => [index("idx_agent_registry_accounts_user_id").on(table.userId), unique("idx_agent_registry_accounts_provider").on(table.providerId, table.accountId)]);
/**
* `agent_registry_sessions` — cloud-sync authenticated sessions. Bare `sessions` →
* `agent_registry_sessions`.
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistrySessions = sqliteTable("agent_registry_sessions", {
	id: text("id").primaryKey().notNull(),
	userId: text("user_id").notNull().references(() => agentRegistryUsers.id, { onDelete: "cascade" }),
	token: text("token").notNull().unique(),
	ipAddress: text("ip_address"),
	userAgent: text("user_agent"),
	expiresAt: text("expires_at").notNull(),
	activeOrganizationId: text("active_organization_id"),
	impersonatedBy: text("impersonated_by"),
	active: integer("active").notNull().default(1),
	createdAt: text("created_at").notNull(),
	updatedAt: text("updated_at").notNull()
}, (table) => [index("idx_agent_registry_sessions_user_id").on(table.userId)]);
/**
* `agent_registry_verifications` — cloud-sync email/2FA verification tokens. Bare
* `verifications` → `agent_registry_verifications`.
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistryVerifications = sqliteTable("agent_registry_verifications", {
	id: text("id").primaryKey().notNull(),
	identifier: text("identifier").notNull(),
	value: text("value").notNull(),
	expiresAt: text("expires_at").notNull(),
	createdAt: text("created_at").notNull(),
	updatedAt: text("updated_at").notNull()
}, (table) => [index("idx_agent_registry_verifications_identifier").on(table.identifier)]);
/**
* `agent_registry_org_agent_keys` — org-scoped agent API keys (cloud use; zero rows
* locally). Bare `org_agent_keys` → `agent_registry_org_agent_keys`.
*
* @task T11361 (target shape) · T346 (original)
*/
var agentRegistryOrgAgentKeys = sqliteTable("agent_registry_org_agent_keys", {
	id: text("id").primaryKey().notNull(),
	organizationId: text("organization_id").notNull().references(() => agentRegistryOrganization.id, { onDelete: "cascade" }),
	agentId: text("agent_id").notNull().references(() => agentRegistryAgents.id, { onDelete: "cascade" }),
	createdBy: text("created_by").notNull(),
	createdAt: text("created_at").notNull()
}, (table) => [index("idx_agent_registry_org_agent_keys_org").on(table.organizationId), index("idx_agent_registry_org_agent_keys_agent").on(table.agentId)]);

export { AGENT_REGISTRY_AGENT_STATUSES as A, AGENT_REGISTRY_USER_ROLES as a, agentRegistryAccounts as b, agentRegistryAgentCapabilities as c, agentRegistryAgentConnections as d, agentRegistryAgentSkills as e, agentRegistryAgents as f, agentRegistryCapabilities as g, agentRegistryClaimCodes as h, agentRegistryOrgAgentKeys as i, agentRegistryOrganization as j, agentRegistrySessions as k, agentRegistrySkills as l, agentRegistryUsers as m, agentRegistryVerifications as n, agent_registry_exports as o };
//# sourceMappingURL=agent-registry-BtE5uhMO.js.map
