@beechcms/api 0.6.7 → 0.8.0

package/migrations/_archive/0029_fts_all_text_branches.sql

@@ -0,0 +1,281 @@
+-- =============================================================================
+-- Beech CMS — FTS rebuild: index text + richtext branches
+--
+-- Previously only `richtext` branches were indexed. This migration rebuilds
+-- all per-seed FTS5 tables to also include `text` branches (with search:true).
+-- Seeds that had no FTS (team, testimonianze, clienti) get new tables here.
+-- =============================================================================
+
+-- ─── articoli ─────────────────────────────────────────────────────────────────
+-- Was: body only. Now: title, body, metaTitle, metaDescription
+
+DROP TRIGGER IF EXISTS fts_articoli_insert;
+DROP TRIGGER IF EXISTS fts_articoli_update;
+DROP TRIGGER IF EXISTS fts_articoli_delete;
+DROP TABLE IF EXISTS fts_articoli;
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_articoli USING fts5(
+  entry_id UNINDEXED,
+  title,
+  body,
+  metaTitle,
+  metaDescription,
+  tokenize = 'unicode61'
+);
+
+INSERT INTO fts_articoli(entry_id, title, body, metaTitle, metaDescription)
+SELECT id, title, body, metaTitle, metaDescription FROM content_articoli;
+
+CREATE TRIGGER IF NOT EXISTS fts_articoli_insert
+AFTER INSERT ON content_articoli BEGIN
+  INSERT INTO fts_articoli(entry_id, title, body, metaTitle, metaDescription)
+  VALUES (new.id, new.title, new.body, new.metaTitle, new.metaDescription);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_articoli_update
+AFTER UPDATE OF title, body, metaTitle, metaDescription ON content_articoli BEGIN
+  DELETE FROM fts_articoli WHERE entry_id = old.id;
+  INSERT INTO fts_articoli(entry_id, title, body, metaTitle, metaDescription)
+  VALUES (new.id, new.title, new.body, new.metaTitle, new.metaDescription);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_articoli_delete
+AFTER DELETE ON content_articoli BEGIN
+  DELETE FROM fts_articoli WHERE entry_id = old.id;
+END;
+
+
+-- ─── prodotti ─────────────────────────────────────────────────────────────────
+-- Was: description only. Now: name, description, metaTitle, metaDescription
+
+DROP TRIGGER IF EXISTS fts_prodotti_insert;
+DROP TRIGGER IF EXISTS fts_prodotti_update;
+DROP TRIGGER IF EXISTS fts_prodotti_delete;
+DROP TABLE IF EXISTS fts_prodotti;
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_prodotti USING fts5(
+  entry_id UNINDEXED,
+  name,
+  description,
+  metaTitle,
+  metaDescription,
+  tokenize = 'unicode61'
+);
+
+INSERT INTO fts_prodotti(entry_id, name, description, metaTitle, metaDescription)
+SELECT id, name, description, metaTitle, metaDescription FROM content_prodotti;
+
+CREATE TRIGGER IF NOT EXISTS fts_prodotti_insert
+AFTER INSERT ON content_prodotti BEGIN
+  INSERT INTO fts_prodotti(entry_id, name, description, metaTitle, metaDescription)
+  VALUES (new.id, new.name, new.description, new.metaTitle, new.metaDescription);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_prodotti_update
+AFTER UPDATE OF name, description, metaTitle, metaDescription ON content_prodotti BEGIN
+  DELETE FROM fts_prodotti WHERE entry_id = old.id;
+  INSERT INTO fts_prodotti(entry_id, name, description, metaTitle, metaDescription)
+  VALUES (new.id, new.name, new.description, new.metaTitle, new.metaDescription);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_prodotti_delete
+AFTER DELETE ON content_prodotti BEGIN
+  DELETE FROM fts_prodotti WHERE entry_id = old.id;
+END;
+
+
+-- ─── team ─────────────────────────────────────────────────────────────────────
+-- Was: no FTS. Now: name, role, bio, linkedIn, metaTitle, metaDescription
+
+DROP TRIGGER IF EXISTS fts_team_insert;
+DROP TRIGGER IF EXISTS fts_team_update;
+DROP TRIGGER IF EXISTS fts_team_delete;
+DROP TABLE IF EXISTS fts_team;
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_team USING fts5(
+  entry_id UNINDEXED,
+  name,
+  role,
+  bio,
+  linkedIn,
+  metaTitle,
+  metaDescription,
+  tokenize = 'unicode61'
+);
+
+INSERT INTO fts_team(entry_id, name, role, bio, linkedIn, metaTitle, metaDescription)
+SELECT id, name, role, bio, linkedIn, metaTitle, metaDescription FROM content_team;
+
+CREATE TRIGGER IF NOT EXISTS fts_team_insert
+AFTER INSERT ON content_team BEGIN
+  INSERT INTO fts_team(entry_id, name, role, bio, linkedIn, metaTitle, metaDescription)
+  VALUES (new.id, new.name, new.role, new.bio, new.linkedIn, new.metaTitle, new.metaDescription);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_team_update
+AFTER UPDATE OF name, role, bio, linkedIn, metaTitle, metaDescription ON content_team BEGIN
+  DELETE FROM fts_team WHERE entry_id = old.id;
+  INSERT INTO fts_team(entry_id, name, role, bio, linkedIn, metaTitle, metaDescription)
+  VALUES (new.id, new.name, new.role, new.bio, new.linkedIn, new.metaTitle, new.metaDescription);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_team_delete
+AFTER DELETE ON content_team BEGIN
+  DELETE FROM fts_team WHERE entry_id = old.id;
+END;
+
+
+-- ─── testimonianze ────────────────────────────────────────────────────────────
+-- Was: no FTS. Now: author, company, quote, metaTitle, metaDescription
+
+DROP TRIGGER IF EXISTS fts_testimonianze_insert;
+DROP TRIGGER IF EXISTS fts_testimonianze_update;
+DROP TRIGGER IF EXISTS fts_testimonianze_delete;
+DROP TABLE IF EXISTS fts_testimonianze;
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_testimonianze USING fts5(
+  entry_id UNINDEXED,
+  author,
+  company,
+  quote,
+  metaTitle,
+  metaDescription,
+  tokenize = 'unicode61'
+);
+
+INSERT INTO fts_testimonianze(entry_id, author, company, quote, metaTitle, metaDescription)
+SELECT id, author, company, quote, metaTitle, metaDescription FROM content_testimonianze;
+
+CREATE TRIGGER IF NOT EXISTS fts_testimonianze_insert
+AFTER INSERT ON content_testimonianze BEGIN
+  INSERT INTO fts_testimonianze(entry_id, author, company, quote, metaTitle, metaDescription)
+  VALUES (new.id, new.author, new.company, new.quote, new.metaTitle, new.metaDescription);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_testimonianze_update
+AFTER UPDATE OF author, company, quote, metaTitle, metaDescription ON content_testimonianze BEGIN
+  DELETE FROM fts_testimonianze WHERE entry_id = old.id;
+  INSERT INTO fts_testimonianze(entry_id, author, company, quote, metaTitle, metaDescription)
+  VALUES (new.id, new.author, new.company, new.quote, new.metaTitle, new.metaDescription);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_testimonianze_delete
+AFTER DELETE ON content_testimonianze BEGIN
+  DELETE FROM fts_testimonianze WHERE entry_id = old.id;
+END;
+
+
+-- ─── pagine ───────────────────────────────────────────────────────────────────
+-- Was: body only. Now: title, body, metaTitle, metaDescription
+
+DROP TRIGGER IF EXISTS fts_pagine_insert;
+DROP TRIGGER IF EXISTS fts_pagine_update;
+DROP TRIGGER IF EXISTS fts_pagine_delete;
+DROP TABLE IF EXISTS fts_pagine;
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_pagine USING fts5(
+  entry_id UNINDEXED,
+  title,
+  body,
+  metaTitle,
+  metaDescription,
+  tokenize = 'unicode61'
+);
+
+INSERT INTO fts_pagine(entry_id, title, body, metaTitle, metaDescription)
+SELECT id, title, body, metaTitle, metaDescription FROM content_pagine;
+
+CREATE TRIGGER IF NOT EXISTS fts_pagine_insert
+AFTER INSERT ON content_pagine BEGIN
+  INSERT INTO fts_pagine(entry_id, title, body, metaTitle, metaDescription)
+  VALUES (new.id, new.title, new.body, new.metaTitle, new.metaDescription);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_pagine_update
+AFTER UPDATE OF title, body, metaTitle, metaDescription ON content_pagine BEGIN
+  DELETE FROM fts_pagine WHERE entry_id = old.id;
+  INSERT INTO fts_pagine(entry_id, title, body, metaTitle, metaDescription)
+  VALUES (new.id, new.title, new.body, new.metaTitle, new.metaDescription);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_pagine_delete
+AFTER DELETE ON content_pagine BEGIN
+  DELETE FROM fts_pagine WHERE entry_id = old.id;
+END;
+
+
+-- ─── clienti ──────────────────────────────────────────────────────────────────
+-- Was: no FTS (no richtext). Now: name, tier, phone (email/passwordHash/internalNote excluded via search:false)
+
+DROP TRIGGER IF EXISTS fts_clienti_insert;
+DROP TRIGGER IF EXISTS fts_clienti_update;
+DROP TRIGGER IF EXISTS fts_clienti_delete;
+DROP TABLE IF EXISTS fts_clienti;
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_clienti USING fts5(
+  entry_id UNINDEXED,
+  name,
+  tier,
+  phone,
+  tokenize = 'unicode61'
+);
+
+INSERT INTO fts_clienti(entry_id, name, tier, phone)
+SELECT id, name, tier, phone FROM content_clienti;
+
+CREATE TRIGGER IF NOT EXISTS fts_clienti_insert
+AFTER INSERT ON content_clienti BEGIN
+  INSERT INTO fts_clienti(entry_id, name, tier, phone)
+  VALUES (new.id, new.name, new.tier, new.phone);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_clienti_update
+AFTER UPDATE OF name, tier, phone ON content_clienti BEGIN
+  DELETE FROM fts_clienti WHERE entry_id = old.id;
+  INSERT INTO fts_clienti(entry_id, name, tier, phone)
+  VALUES (new.id, new.name, new.tier, new.phone);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_clienti_delete
+AFTER DELETE ON content_clienti BEGIN
+  DELETE FROM fts_clienti WHERE entry_id = old.id;
+END;
+
+
+-- ─── messaggi ─────────────────────────────────────────────────────────────────
+-- Was: message (richtext) only. Now: name, email, subject, message
+
+DROP TRIGGER IF EXISTS fts_messaggi_insert;
+DROP TRIGGER IF EXISTS fts_messaggi_update;
+DROP TRIGGER IF EXISTS fts_messaggi_delete;
+DROP TABLE IF EXISTS fts_messaggi;
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_messaggi USING fts5(
+  entry_id UNINDEXED,
+  name,
+  email,
+  subject,
+  message,
+  tokenize = 'unicode61'
+);
+
+INSERT INTO fts_messaggi(entry_id, name, email, subject, message)
+SELECT id, name, email, subject, message FROM content_messaggi;
+
+CREATE TRIGGER IF NOT EXISTS fts_messaggi_insert
+AFTER INSERT ON content_messaggi BEGIN
+  INSERT INTO fts_messaggi(entry_id, name, email, subject, message)
+  VALUES (new.id, new.name, new.email, new.subject, new.message);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_messaggi_update
+AFTER UPDATE OF name, email, subject, message ON content_messaggi BEGIN
+  DELETE FROM fts_messaggi WHERE entry_id = old.id;
+  INSERT INTO fts_messaggi(entry_id, name, email, subject, message)
+  VALUES (new.id, new.name, new.email, new.subject, new.message);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_messaggi_delete
+AFTER DELETE ON content_messaggi BEGIN
+  DELETE FROM fts_messaggi WHERE entry_id = old.id;
+END;

package/migrations/_archive/0031_site_settings.sql

@@ -0,0 +1,9 @@
+-- =============================================================================
+-- Beech CMS v0.4.0 — Site Settings
+-- Key-value store for site-level configuration (title, locale, timezone, etc.)
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS site_settings (
+    key   TEXT NOT NULL PRIMARY KEY,
+    value TEXT NOT NULL
+);

package/migrations/_archive/0032_seeds.sql

@@ -0,0 +1,28 @@
+-- =============================================================================
+-- Runtime Seeds — Seed definitions stored in D1 (source of truth at runtime)
+--
+-- `seeds`      : one row per content type. `definition` is the full Seed JSON.
+-- `seed_meta`  : single-row table holding the registry version token used for
+--                multi-isolate cache invalidation (see docs/Sprints/runtime-seeds).
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS seeds (
+    slug        TEXT    NOT NULL PRIMARY KEY,
+    definition  TEXT    NOT NULL,                       -- JSON-serialized Seed
+    status      TEXT    NOT NULL DEFAULT 'active'
+                        CHECK (status IN ('active', 'deleted')),
+    source      TEXT    NOT NULL DEFAULT 'runtime'
+                        CHECK (source IN ('code', 'runtime')),
+    created_at  INTEGER NOT NULL DEFAULT (unixepoch()),
+    updated_at  INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_seeds_status ON seeds(status);
+
+CREATE TABLE IF NOT EXISTS seed_meta (
+    id      TEXT NOT NULL PRIMARY KEY,
+    value   TEXT NOT NULL
+);
+
+-- registry_version starts at 1; bumped on every seed write (sprint 03/04).
+INSERT OR IGNORE INTO seed_meta (id, value) VALUES ('registry_version', '1');

package/migrations/_archive/0033_dashboard_layouts.sql

@@ -0,0 +1,14 @@
+-- =============================================================================
+-- Dashboard Layouts — per-scope dashboard composer layouts
+--
+-- `dashboard_layouts` : one row per scope. Sprint 02 only ever writes the
+--                        literal 'default' scope; Sprint 06 introduces
+--                        role-scoped rows ('role:admin', 'role:editor', ...).
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS dashboard_layouts (
+  scope        TEXT NOT NULL PRIMARY KEY,   -- 'default' | 'role:admin' | 'role:editor'
+  layout       TEXT NOT NULL,               -- JSON of DashboardLayout
+  updated_at   INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_by   TEXT NOT NULL                -- users.id of the writer
+);

package/migrations/_archive/0034_kanban_foundation.sql

@@ -0,0 +1,24 @@
+-- =============================================================================
+-- Kanban Foundation
+--  kanban_positions : per-(seed, axis, entry) fractional-index ordering.
+--                     System table — NEVER a column on content_{slug}.
+--  seed_layouts.view_config : additive JSON blob for per-seed dashboard view
+--                     preferences (kanban axis/sort/hidden columns). Nullable,
+--                     so existing rows are untouched.
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS kanban_positions (
+  seed_slug      TEXT    NOT NULL,
+  entry_id       TEXT    NOT NULL,
+  axis_branch_id TEXT    NOT NULL,                  -- Branch.id (br_XX), not alias
+  position       TEXT    NOT NULL,                  -- fractional-indexing key
+  updated_at     INTEGER NOT NULL DEFAULT (unixepoch()),
+  PRIMARY KEY (seed_slug, entry_id, axis_branch_id)
+);
+
+-- Column fetch path: ORDER BY position within one (seed, axis).
+CREATE INDEX IF NOT EXISTS idx_kanban_positions_column
+  ON kanban_positions (seed_slug, axis_branch_id, position);
+
+-- Per-seed dashboard view preferences (KB-S02). Additive, nullable.
+ALTER TABLE seed_layouts ADD COLUMN view_config TEXT;

package/migrations/_archive/0035_setup_lock.sql

@@ -0,0 +1,10 @@
+-- =============================================================================
+-- Beech CMS v0.4.0 — Setup Lock
+-- Single-row marker enforcing that /auth/setup can only complete once, even
+-- under concurrent requests. Insert into this table in the same transaction
+-- as the initial admin user; the PRIMARY KEY conflict rejects the loser.
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS setup_completed (
+    id INTEGER NOT NULL PRIMARY KEY CHECK (id = 1)
+);

package/migrations/_archive/0036_notification_type_success.sql

@@ -0,0 +1,23 @@
+-- =============================================================================
+-- Beech CMS v0.4.0 — Notification Type Success Support
+-- Updates notifications CHECK constraint to include 'success'
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS notifications_dg_tmp (
+    id         TEXT    NOT NULL PRIMARY KEY,
+    title      TEXT    NOT NULL,
+    message    TEXT    NOT NULL,
+    type       TEXT    NOT NULL DEFAULT 'info' CHECK (type IN ('info', 'success', 'warning', 'error')),
+    is_read    INTEGER NOT NULL DEFAULT 0 CHECK (is_read IN (0, 1)),
+    created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+INSERT INTO notifications_dg_tmp (id, title, message, type, is_read, created_at)
+SELECT id, title, message, type, is_read, created_at FROM notifications;
+
+DROP TABLE notifications;
+
+ALTER TABLE notifications_dg_tmp RENAME TO notifications;
+
+CREATE INDEX IF NOT EXISTS idx_notifications_created ON notifications(created_at);
+CREATE INDEX IF NOT EXISTS idx_notifications_unread  ON notifications(is_read);

package/migrations/_archive/0037_time_trap_tokens.sql

@@ -0,0 +1,13 @@
+-- =============================================================================
+-- PUBLIC TIME-TRAP TOKENS
+-- Single-use tracking for HMAC time-trap tokens to prevent replay attacks.
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS public_time_trap_tokens (
+    token_hash  TEXT    NOT NULL PRIMARY KEY,
+    used_at     INTEGER NOT NULL,
+    expires_at  INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_time_trap_tokens_expires
+ON public_time_trap_tokens (expires_at);

package/migrations/_archive/0038_oauth_authorization.sql

@@ -0,0 +1,95 @@
+-- =============================================================================
+-- OAUTH 2.1 AUTHORIZATION SERVER
+-- Authorization code + PKCE grant. Every credential (code, access token, refresh
+-- token) is persisted as a SHA-256 hex hash only — never plaintext — replicating
+-- the refresh_tokens contract in 0000_v040_base.sql.
+-- Expired rows are filtered at read time via expires_at; no background pruning job.
+-- =============================================================================
+
+-- 1. CLIENTS -----------------------------------------------------------------
+-- Static registry. No dynamic client registration (RFC 7591) is supported.
+CREATE TABLE IF NOT EXISTS oauth_clients (
+    client_id       TEXT    NOT NULL PRIMARY KEY,
+    name            TEXT    NOT NULL,
+    redirect_uris   TEXT    NOT NULL,                       -- JSON array of strings
+    allowed_scopes  TEXT    NOT NULL,                       -- space-delimited, RFC 6749 §3.3
+    is_public       INTEGER NOT NULL DEFAULT 1
+                            CHECK (is_public IN (0, 1)),    -- 1 = public client, no secret
+    created_at      INTEGER NOT NULL DEFAULT (unixepoch()),
+    disabled_at     INTEGER DEFAULT NULL
+);
+
+-- 2. AUTHORIZATION CODES -----------------------------------------------------
+-- Single use. consumed_at is set on first redemption; a second redemption of the
+-- same code must cascade-revoke every token issued from it (OAuth 2.1 replay
+-- mitigation) via oauth_tokens.authorization_code_hash.
+CREATE TABLE IF NOT EXISTS oauth_authorization_codes (
+    code_hash               TEXT    NOT NULL PRIMARY KEY,
+    client_id               TEXT    NOT NULL REFERENCES oauth_clients(client_id) ON DELETE CASCADE,
+    user_id                 TEXT    NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    scope                   TEXT    NOT NULL,               -- space-delimited granted scopes
+    redirect_uri            TEXT    NOT NULL,
+    code_challenge          TEXT    NOT NULL,
+    code_challenge_method   TEXT    NOT NULL DEFAULT 'S256'
+                                    CHECK (code_challenge_method = 'S256'),
+    expires_at              INTEGER NOT NULL,
+    created_at              INTEGER NOT NULL DEFAULT (unixepoch()),
+    consumed_at             INTEGER DEFAULT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_oauth_codes_user    ON oauth_authorization_codes(user_id);
+CREATE INDEX IF NOT EXISTS idx_oauth_codes_expires ON oauth_authorization_codes(expires_at);
+
+-- 3. TOKENS ------------------------------------------------------------------
+-- Access and refresh tokens share one table: identical lifecycle, distinguished
+-- by token_type. authorization_code_hash links a token back to its originating
+-- code so replay of that code can revoke the whole family in one UPDATE.
+CREATE TABLE IF NOT EXISTS oauth_tokens (
+    id                      TEXT    NOT NULL PRIMARY KEY,
+    token_hash              TEXT    NOT NULL,
+    token_type              TEXT    NOT NULL
+                                    CHECK (token_type IN ('access', 'refresh')),
+    client_id               TEXT    NOT NULL REFERENCES oauth_clients(client_id) ON DELETE CASCADE,
+    user_id                 TEXT    NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    scope                   TEXT    NOT NULL,               -- space-delimited
+    authorization_code_hash TEXT    NOT NULL,
+    expires_at              INTEGER NOT NULL,
+    created_at              INTEGER NOT NULL DEFAULT (unixepoch()),
+    revoked_at              INTEGER DEFAULT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_oauth_tokens_hash    ON oauth_tokens(token_hash);
+CREATE INDEX IF NOT EXISTS idx_oauth_tokens_code    ON oauth_tokens(authorization_code_hash);
+CREATE INDEX IF NOT EXISTS idx_oauth_tokens_client  ON oauth_tokens(client_id, user_id);
+CREATE INDEX IF NOT EXISTS idx_oauth_tokens_user    ON oauth_tokens(user_id);
+CREATE INDEX IF NOT EXISTS idx_oauth_tokens_expires ON oauth_tokens(expires_at);
+
+-- 4. CONSENTS ---------------------------------------------------------------
+-- One live row per (client, user). scopes holds the cumulative granted set, so a
+-- repeat authorize request for an already-granted subset can skip the consent
+-- screen, while a superset must re-prompt for the delta only.
+CREATE TABLE IF NOT EXISTS oauth_consents (
+    id          TEXT    NOT NULL PRIMARY KEY,
+    client_id   TEXT    NOT NULL REFERENCES oauth_clients(client_id) ON DELETE CASCADE,
+    user_id     TEXT    NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    scopes      TEXT    NOT NULL,                           -- space-delimited
+    created_at  INTEGER NOT NULL DEFAULT (unixepoch()),
+    updated_at  INTEGER NOT NULL DEFAULT (unixepoch()),
+    revoked_at  INTEGER DEFAULT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_oauth_consents_pair ON oauth_consents(client_id, user_id);
+CREATE INDEX IF NOT EXISTS idx_oauth_consents_user ON oauth_consents(user_id);
+
+-- 5. SEEDED CLIENT -----------------------------------------------------------
+-- The MCP server is the only client today. Loopback redirect per OAuth 2.1
+-- §8.4.2: the port is assigned at runtime by the local listener, so Sprint 2
+-- matches host+path and ignores the port. No client secret: public client.
+INSERT OR IGNORE INTO oauth_clients (client_id, name, redirect_uris, allowed_scopes, is_public)
+VALUES (
+    'beech-mcp-cli',
+    'BeechCMS MCP Server',
+    '["http://127.0.0.1/callback"]',
+    'schema:read schema:write',
+    1
+);

package/migrations/_archive/0039_oauth_client_beech_mcp.sql

@@ -0,0 +1,20 @@
+-- =============================================================================
+-- OAUTH CLIENT REGISTRY — @beechcms/mcp
+-- Static registration of the first-party MCP client. 0038 declares the registry
+-- static (no RFC 7591 dynamic registration), so the row is seeded by migration.
+-- Public client (is_public = 1): a stdio CLI cannot hold a secret, PKCE S256 is
+-- the proof of possession instead.
+-- The redirect URI is registered WITHOUT a port: matchesRegisteredRedirectUri()
+-- compares loopback URIs on protocol + hostname + pathname only (OAuth 2.1
+-- §8.4.2), because the CLI binds an ephemeral port at runtime.
+-- Idempotent: INSERT OR IGNORE keeps `beech db:reset` and re-runs safe.
+-- =============================================================================
+
+INSERT OR IGNORE INTO oauth_clients (client_id, name, redirect_uris, allowed_scopes, is_public)
+VALUES (
+    'beech-mcp',
+    'BeechCMS MCP Server',
+    '["http://127.0.0.1/oauth/callback"]',
+    'schema:read schema:write',
+    1
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/api",
-  "version": "0.6.7",
+  "version": "0.8.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/factory.d.ts",
@@ -12,15 +12,13 @@
   },
   "files": [
     "dist/",
-    "migrations/0000_v040_base.sql",
-    "migrations/0029_automations.sql",
-    "migrations/0030_test_seeds.sql",
+    "migrations/",
     "assets/"
   ],
   "dependencies": {
     "@aws-sdk/client-s3": "^3.995.0",
     "@aws-sdk/s3-request-presigner": "^3.995.0",
-    "@beechcms/core": "^0.6.7",
+    "@beechcms/core": "^0.8.0",
     "@upstash/qstash": "^2.11.0",
     "bcryptjs": "^2.4.3",
     "hono": "^4.12.34",