feat(db,contracts): full v0.1 data model migrations and shared zod contracts (W1-1)

- migrations 0002-0012 split by domain (foundation/instances/content/identity/
  sources/assets/policy/execution/agent/ops/organization): 41 tables, uuid pk,
  created_at/updated_at + touch trigger, text+CHECK status sets, pgcrypto/pg_trgm
- key constraints: source_release(site_id, site_release_id), observation(feed_id, guid),
  external_identity accepted partial unique, download_task(instance_id, torrent_hash),
  one active acquisition_plan per slot, one active path_binding per entity/season,
  asset_location root+path uniqueness, organization_record change_seq/change_xid cursor
- secret table (ciphertext/nonce/kdf) + secret_ref columns; outbox dispatch fields (ADR-002)
- src/types.ts generated from the migrated schema (scripts/gen-types.ts), drift-checked in tests;
  int8 -> number, date -> string parsers; migrator accepts migrationTableSchema
- contracts: Row/Create/Update schemas per domain, public organization-record API
  (changeSeq cursor), GlobalSettings, CapabilityDescriptor + 14 capability IO schemas,
  typed SSE events, Api endpoint table
- tests: migration up/down round trip on real PG in an isolated schema, constraint checks,
  contracts<->db column/enum sync, positive/negative parse for every exported schema

Co-Authored-By: Claude Fable 5.1 <[email protected]>

packages/db/src/migrator.ts

@@ -7,18 +7,28 @@ import { FileMigrationProvider, type MigrationResultSet, Migrator } from "kysely
 /** 迁移目录:packages/db/migrations,文件名 NNNN_name.ts,导出 up/down */
 export const MIGRATIONS_DIR = fileURLToPath(new URL("../migrations", import.meta.url));
 
+export interface MigratorOptions {
+  /**
+   * kysely_migration 表所在 schema。默认不指定(走 search_path)。
+   * 在非 public schema 里迁移(如测试隔离 schema)时必须显式指定,
+   * 否则 Kysely 会把 public 下已存在的迁移表当成当前库的迁移记录。
+   */
+  migrationTableSchema?: string;
+}
+
 // biome-ignore lint/suspicious/noExplicitAny: 迁移器不关心具体表类型
-export function createMigrator(db: Kysely<any>): Migrator {
+export function createMigrator(db: Kysely<any>, opts: MigratorOptions = {}): Migrator {
   return new Migrator({
     db,
     provider: new FileMigrationProvider({ fs, path, migrationFolder: MIGRATIONS_DIR }),
+    ...(opts.migrationTableSchema ? { migrationTableSchema: opts.migrationTableSchema } : {}),
   });
 }
 
 /** 迁移到最新;失败时抛出 */
 // biome-ignore lint/suspicious/noExplicitAny: 同上
-export async function migrateToLatest(db: Kysely<any>): Promise<MigrationResultSet> {
-  const result = await createMigrator(db).migrateToLatest();
+export async function migrateToLatest(db: Kysely<any>, opts: MigratorOptions = {}): Promise<MigrationResultSet> {
+  const result = await createMigrator(db, opts).migrateToLatest();
   if (result.error) throw result.error;
   return result;
 }