feat(storage): migrate TinyArtifacts to TSD v2

.github/scripts/check-storage-engines.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly forbidden='^(rusqlite|libsqlite3-sys|mongodb|bson|aws-sdk-s3|lapin|amq-protocol|sqlx|redb|sled|rocksdb|tinystoragedrivers-(document|kv|blob|queue|secrets|connect)|tinystoragedrivers)$'
+
+tree_names() {
+  awk 'NF { print $1 }'
+}
+
+has_forbidden() {
+  local names
+  names="$(tree_names <<< "$1")"
+  [[ -n "$names" ]] || return 2
+  grep -Exq "$forbidden" <<< "$names"
+}
+
+self_test() {
+  local allowed forbidden_engine forbidden_tsd
+  allowed=$'tinystoragedrivers-types v2.0.1 (git+https://example.invalid/repo)\ntinystoragedrivers-api v2.0.1'
+  forbidden_engine=$'tiny-artifacts v0.1.0 (/workspace/crates/tiny-artifacts)\nrusqlite v0.40.2'
+  forbidden_tsd=$'tiny-artifacts v0.1.0 (/workspace/crates/tiny-artifacts)\ntinystoragedrivers-document v2.0.1 (git+https://example.invalid/repo)'
+
+  if has_forbidden "$allowed"; then
+    echo "engine guard rejected allowed API/types dependencies" >&2
+    return 1
+  fi
+  if ! has_forbidden "$forbidden_engine"; then
+    echo "engine guard missed a versioned engine tree row" >&2
+    return 1
+  fi
+  if ! has_forbidden "$forbidden_tsd"; then
+    echo "engine guard missed a path-qualified TSD engine tree row" >&2
+    return 1
+  fi
+  if has_forbidden ""; then
+    echo "engine guard accepted empty tree output" >&2
+    return 1
+  else
+    local status=$?
+    if [[ $status -ne 2 ]]; then
+      echo "engine guard failed to reject an empty tree predictably" >&2
+      return 1
+    fi
+  fi
+  echo "storage engine guard self-test passed"
+}
+
+if [[ "${1:-}" == "--self-test" ]]; then
+  self_test
+  exit
+fi
+
+self_test
+packages="$(cargo metadata --locked --no-deps --format-version 1 \
+  | jq -er '[.packages[] | select(any(.targets[]; any(.kind[]; . == "lib" or . == "cdylib" or . == "staticlib"))) | .name] | unique | .[]')"
+[[ -n "$packages" ]] || { echo "workspace metadata contains no library targets" >&2; exit 1; }
+
+while IFS= read -r package; do
+  [[ -n "$package" ]] || continue
+  names="$(cargo tree --locked --package "$package" --all-features --edges normal,build --prefix none | tree_names)"
+  [[ -n "$names" ]] || { echo "cargo tree returned no packages for $package" >&2; exit 1; }
+  if grep -Exq "$forbidden" <<< "$names"; then
+    printf 'storage engine dependency found in %s:\n' "$package" >&2
+    grep -Ex "$forbidden" <<< "$names" >&2
+    exit 1
+  fi
+  printf 'storage dependency boundary passed: %s\n' "$package"
+done <<< "$packages"

.github/workflows/ci.yml

@@ -41,6 +41,9 @@ jobs:
       - name: Check formatting
         run: cargo fmt --all -- --check
 
+      - name: Keep storage engines out of library dependencies
+        run: .github/scripts/check-storage-engines.sh
+
       - name: Clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
 

CHANGELOG.md

@@ -1,12 +1,19 @@
 # Changelog
 
+## Unreleased
+
+- Back artifact records with the host-bound document port and apply
+  artifact-owned migrations on open.
+- Adapt file bytes through the host-bound blob port; remove filesystem stores
+  so the library does not own host paths or persistence engines.
+- Accept serialized legacy record bytes for host-managed imports.
+
 ## 0.2.0
 
 - Add the `FileStore` port with filesystem and blob-store adapters so file
   versions can be shared across host processes.
 - Store `FileRef` values as opaque keys with size and media type, and preserve
   deserialization of legacy path-based references for import.
-- Configure file storage with `Artifacts::with_file_store` or
-  `Artifacts::with_version_files` (filesystem compatibility helper).
+- Configure file storage with `Artifacts::with_file_store`.
 - This changes the public `FileRef` fields and file-storage setup API. Hosts
   must provide a file store for file artifacts.