@crombolo/data 0.0.0-stage → 0.9.1

package/src/schema/content.ts

@@ -0,0 +1,263 @@
+/**
+ * Migration 002 — the content schema.
+ *
+ * `node` is the universal polymorphic tree; every other table here is a facet of
+ * it. See docs/02-data-model.md for the model and why it is kept.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_IDENTITY } from './identity.ts'
+
+export const STATE_CONTENT = '{6f1d4a8e-0002-4c21-9d3a-8b1e5c7a2f02}'
+
+export const contentMigration: Migration = {
+  from: STATE_IDENTITY,
+  to: STATE_CONTENT,
+  name: 'CreateContentSchema',
+  kind: 'expand',
+  release: '0.3.0',
+  async up(db: Db) {
+    const t = db.dialect.types
+
+    /**
+     * The tree. `path` is a materialised ancestor list ("-1,1060,1075") so a
+     * descendant query is a prefix match rather than a recursive walk.
+     */
+    await db.exec(
+      `CREATE TABLE node (
+         id ${t.identity},
+         unique_id ${t.uuid} NOT NULL UNIQUE,
+         parent_id ${t.integer} NOT NULL,
+         level ${t.integer} NOT NULL,
+         path ${t.varchar(150)} NOT NULL,
+         sort_order ${t.integer} NOT NULL,
+         trashed ${t.boolean} NOT NULL,
+         node_user ${t.integer},
+         text ${t.textCi},
+         node_object_type ${t.uuid},
+         create_date ${t.timestamp} NOT NULL
+       )`,
+    )
+    await db.exec('CREATE INDEX ix_node_parent_object ON node (parent_id, node_object_type)')
+    await db.exec(
+      'CREATE INDEX ix_node_object_trashed_sort ON node (node_object_type, trashed, sort_order, id)',
+    )
+    await db.exec('CREATE INDEX ix_node_path ON node (path)')
+    await db.exec('CREATE INDEX ix_node_trashed ON node (trashed)')
+
+    await db.exec(
+      `CREATE TABLE language (
+         id ${t.identity},
+         iso_code ${t.varchar(14)} NOT NULL UNIQUE,
+         culture_name ${t.varchar(100)} NOT NULL,
+         is_default ${t.boolean} NOT NULL,
+         is_mandatory ${t.boolean} NOT NULL,
+         fallback_language_id ${t.integer}
+       )`,
+    )
+
+    await db.exec(
+      `CREATE TABLE data_type (
+         node_id ${t.integer} PRIMARY KEY REFERENCES node (id),
+         editor_alias ${t.varchar(255)} NOT NULL,
+         editor_ui_alias ${t.varchar(255)},
+         db_type ${t.varchar(50)} NOT NULL,
+         config ${t.text}
+       )`,
+    )
+
+    /**
+     * The view file lives on disk at components/{alias}.tsx; the layout chain is
+     * declared in the file itself, exactly as Umbraco parses it out of Razor.
+     */
+    await db.exec(
+      `CREATE TABLE template (
+         node_id ${t.integer} PRIMARY KEY REFERENCES node (id),
+         alias ${t.varchar(100)} NOT NULL
+       )`,
+    )
+    await db.exec('CREATE UNIQUE INDEX ux_template_alias ON template (alias)')
+
+    await db.exec(
+      `CREATE TABLE content_type (
+         node_id ${t.integer} PRIMARY KEY REFERENCES node (id),
+         alias ${t.textCi} NOT NULL,
+         icon ${t.varchar(255)},
+         thumbnail ${t.varchar(255)},
+         description ${t.varchar(1500)},
+         list_view ${t.uuid},
+         is_element ${t.boolean} NOT NULL,
+         allow_in_library ${t.boolean} NOT NULL,
+         allow_at_root ${t.boolean} NOT NULL,
+         variations ${t.integer} NOT NULL,
+         prevent_cleanup ${t.boolean} NOT NULL,
+         keep_all_versions_newer_than_days ${t.integer},
+         keep_latest_version_per_day_for_days ${t.integer}
+       )`,
+    )
+    await db.exec('CREATE UNIQUE INDEX ux_content_type_alias ON content_type (alias)')
+
+    await db.exec(
+      `CREATE TABLE property_type_group (
+         id ${t.identity},
+         unique_id ${t.uuid} NOT NULL UNIQUE,
+         content_type_node_id ${t.integer} NOT NULL REFERENCES content_type (node_id),
+         type ${t.integer} NOT NULL,
+         text ${t.varchar(255)},
+         alias ${t.varchar(255)},
+         sort_order ${t.integer} NOT NULL,
+         parent_id ${t.integer}
+       )`,
+    )
+
+    await db.exec(
+      `CREATE TABLE property_type (
+         id ${t.identity},
+         unique_id ${t.uuid} NOT NULL UNIQUE,
+         data_type_id ${t.integer} NOT NULL REFERENCES data_type (node_id),
+         content_type_id ${t.integer} NOT NULL REFERENCES content_type (node_id),
+         property_type_group_id ${t.integer} REFERENCES property_type_group (id),
+         alias ${t.textCi} NOT NULL,
+         name ${t.varchar(255)} NOT NULL,
+         description ${t.varchar(2000)},
+         sort_order ${t.integer} NOT NULL,
+         mandatory ${t.boolean} NOT NULL,
+         mandatory_message ${t.varchar(500)},
+         validation_reg_exp ${t.text},
+         validation_reg_exp_message ${t.varchar(500)},
+         label_on_top ${t.boolean} NOT NULL,
+         variations ${t.integer} NOT NULL
+       )`,
+    )
+    await db.exec(
+      'CREATE UNIQUE INDEX ux_property_type_alias ON property_type (content_type_id, alias)',
+    )
+
+    /**
+     * The composition graph, which is NOT the folder tree: `node.parent_id`
+     * places a type in a folder, while this table says which types it inherits
+     * properties from.
+     */
+    await db.exec(
+      `CREATE TABLE content_type_composition (
+         parent_content_type_id ${t.integer} NOT NULL REFERENCES node (id),
+         child_content_type_id ${t.integer} NOT NULL REFERENCES node (id),
+         PRIMARY KEY (parent_content_type_id, child_content_type_id)
+       )`,
+    )
+
+    await db.exec(
+      `CREATE TABLE content_type_allowed_child (
+         content_type_id ${t.integer} NOT NULL REFERENCES content_type (node_id),
+         allowed_content_type_id ${t.integer} NOT NULL REFERENCES content_type (node_id),
+         sort_order ${t.integer} NOT NULL,
+         PRIMARY KEY (content_type_id, allowed_content_type_id)
+       )`,
+    )
+
+    await db.exec(
+      `CREATE TABLE content_type_template (
+         content_type_node_id ${t.integer} NOT NULL REFERENCES content_type (node_id),
+         template_node_id ${t.integer} NOT NULL REFERENCES template (node_id),
+         is_default ${t.boolean} NOT NULL,
+         PRIMARY KEY (content_type_node_id, template_node_id)
+       )`,
+    )
+
+    // ---- documents and versions (Phase 4 uses these) ----
+
+    await db.exec(
+      `CREATE TABLE content (
+         node_id ${t.integer} PRIMARY KEY REFERENCES node (id),
+         content_type_id ${t.integer} NOT NULL REFERENCES content_type (node_id)
+       )`,
+    )
+    await db.exec('CREATE INDEX ix_content_content_type ON content (content_type_id)')
+
+    /** `current = true` marks the draft; exactly one row per node. */
+    await db.exec(
+      `CREATE TABLE content_version (
+         id ${t.identity},
+         node_id ${t.integer} NOT NULL REFERENCES content (node_id),
+         version_date ${t.timestamp} NOT NULL,
+         user_id ${t.integer},
+         current ${t.boolean} NOT NULL,
+         text ${t.textCi},
+         prevent_cleanup ${t.boolean} NOT NULL
+       )`,
+    )
+    await db.exec(
+      'CREATE INDEX ix_content_version_node_current ON content_version (node_id, current)',
+    )
+    await db.exec('CREATE INDEX ix_content_version_date ON content_version (version_date)')
+
+    await db.exec(
+      `CREATE TABLE document (
+         node_id ${t.integer} PRIMARY KEY REFERENCES content (node_id),
+         published ${t.boolean} NOT NULL,
+         edited ${t.boolean} NOT NULL
+       )`,
+    )
+    await db.exec('CREATE INDEX ix_document_published ON document (published)')
+
+    /** `published = true` marks the published version; at most one per document. */
+    await db.exec(
+      `CREATE TABLE document_version (
+         id ${t.integer} PRIMARY KEY REFERENCES content_version (id),
+         template_id ${t.integer} REFERENCES template (node_id),
+         published ${t.boolean} NOT NULL
+       )`,
+    )
+
+    /**
+     * Property values. Five typed columns selected by `data_type.db_type`; the
+     * unique key is the value's identity.
+     */
+    await db.exec(
+      `CREATE TABLE property_data (
+         id ${t.identity},
+         version_id ${t.integer} NOT NULL REFERENCES content_version (id),
+         property_type_id ${t.integer} NOT NULL REFERENCES property_type (id),
+         language_id ${t.integer} REFERENCES language (id),
+         segment ${t.varchar(256)},
+         int_value ${t.integer},
+         decimal_value ${t.numeric},
+         date_value ${t.timestamp},
+         varchar_value ${t.varchar(512)},
+         text_value ${t.text},
+         sortable_value ${t.varchar(512)}
+       )`,
+    )
+    // A NULL language or segment means invariant/neutral, and NULLs do not
+    // compare equal, so uniqueness is enforced over coalesced sentinels.
+    await db.exec(
+      `CREATE UNIQUE INDEX ux_property_data ON property_data
+         (version_id, property_type_id, COALESCE(language_id, -1), COALESCE(segment, ''))`,
+    )
+
+    await db.exec(
+      `CREATE TABLE content_version_culture_variation (
+         id ${t.identity},
+         version_id ${t.integer} NOT NULL REFERENCES content_version (id),
+         language_id ${t.integer} NOT NULL REFERENCES language (id),
+         name ${t.textCi} NOT NULL,
+         date ${t.timestamp} NOT NULL,
+         available_user_id ${t.integer},
+         UNIQUE (version_id, language_id)
+       )`,
+    )
+
+    await db.exec(
+      `CREATE TABLE document_culture_variation (
+         id ${t.identity},
+         node_id ${t.integer} NOT NULL REFERENCES node (id),
+         language_id ${t.integer} NOT NULL REFERENCES language (id),
+         edited ${t.boolean} NOT NULL,
+         available ${t.boolean} NOT NULL,
+         published ${t.boolean} NOT NULL,
+         name ${t.textCi},
+         UNIQUE (node_id, language_id)
+       )`,
+    )
+  },
+}

package/src/schema/created-packages.ts

@@ -0,0 +1,56 @@
+/**
+ * Migration 022 — the created-package definitions the Packages section builds.
+ *
+ * A definition, never an artifact: the zip is built when it is downloaded
+ * (`docs/17-bundles.md`), so there are no bytes here to go stale when a
+ * content type the package carries is edited afterwards.
+ *
+ * The selection lists are JSON text rather than a row each. They are read and
+ * written whole and never queried into, so a child table would be a join for
+ * nothing — and the contract hands them over as arrays in exactly this shape.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_SERVER_ROLE } from './server-role.ts'
+
+export const STATE_CREATED_PACKAGES = '{6f1d4a8e-0022-4e72-9a55-3d7c1b8e4f02}'
+
+export const createdPackagesMigration: Migration = {
+  from: STATE_SERVER_ROLE,
+  to: STATE_CREATED_PACKAGES,
+  name: 'AddCreatedPackages',
+  kind: 'expand',
+  release: '0.5.0',
+  async up(db: Db) {
+    const t = db.dialect.types
+
+    await db.exec(
+      `CREATE TABLE created_package (
+         id ${t.varchar(64)} NOT NULL,
+         name ${t.textCi} NOT NULL,
+         content_node_id ${t.varchar(64)},
+         content_load_child_nodes ${t.boolean} NOT NULL,
+         media_load_child_nodes ${t.boolean} NOT NULL,
+         media_ids ${t.text} NOT NULL,
+         element_ids ${t.text},
+         content_types ${t.text} NOT NULL,
+         media_types ${t.text} NOT NULL,
+         data_types ${t.text} NOT NULL,
+         templates ${t.text} NOT NULL,
+         partial_views ${t.text} NOT NULL,
+         stylesheets ${t.text} NOT NULL,
+         scripts ${t.text} NOT NULL,
+         languages ${t.text} NOT NULL,
+         dictionary_items ${t.text} NOT NULL,
+         create_date ${t.timestamp} NOT NULL,
+         update_date ${t.timestamp} NOT NULL,
+         PRIMARY KEY (id)
+       )`,
+    )
+    // Umbraco refuses two packages with the same name, and the list is ordered
+    // by it. `textCi` rather than `varchar` so the constraint means the same
+    // thing on both dialects: Postgres collates case-sensitively by default,
+    // where SQLite's varchar is already NOCASE.
+    await db.exec('CREATE UNIQUE INDEX ux_created_package_name ON created_package (name)')
+  },
+}

package/src/schema/elements.ts

@@ -0,0 +1,62 @@
+/**
+ * Migration 016 — the Elements recycle bin node.
+ *
+ * Elements are Umbraco 18's publishable content without a URL, and they need
+ * nothing new in the schema: an element is a node facet exactly as a document is
+ * (`node` + `content` + `content_version`), its folders are `node` rows with the
+ * ElementContainer object type, and the document repository takes it as a fifth
+ * `kind`. The one thing missing is somewhere to trash them into.
+ *
+ * `seedContent` creates all three bins on a fresh install; this adds the element
+ * one to a database seeded before elements existed. Umbraco's own id and object
+ * type are used (`Constants.System.RecycleBinElement = -22`), so a database here
+ * numbers its bins as Umbraco's does.
+ */
+
+import { ObjectTypes, SystemNodes } from '@crombolo/core'
+import type { Db } from '../database.ts'
+import { DbDate } from '../dialect.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_REDIRECTS } from './redirects.ts'
+
+export const STATE_ELEMENTS = '{6f1d4a8e-0016-4d8a-b1f7-5c3e9a204d61}'
+
+export const elementsMigration: Migration = {
+  from: STATE_REDIRECTS,
+  to: STATE_ELEMENTS,
+  name: 'AddElementRecycleBin',
+  kind: 'expand',
+  release: '0.3.0',
+  async up(db: Db) {
+    // One statement, with both guards in SQL, because `crombolo upgrade --plan`
+    // runs every migration against a recorder whose `query` refuses to read —
+    // a migration that reads cannot be planned, and the plan is the thing that
+    // lets a release be reviewed before it runs.
+    //
+    // `FROM node` is the first guard: a fresh database is seeded *after*
+    // migrations, and `seedContent` only seeds while `node` is empty, so
+    // inserting here would suppress the entire seed — data types included — and
+    // leave every content type unresolvable. No rows, no insert; the seed creates
+    // all three bins itself. `NOT EXISTS` is the second: idempotent for a
+    // database that already has the bin.
+    await db.exec(
+      `INSERT INTO node
+         (id, unique_id, parent_id, level, path, sort_order, trashed, text, node_object_type, create_date)
+       SELECT ?, ?, ?, 0, ?, 0, ?, ?, ?, ?
+         FROM node
+        WHERE NOT EXISTS (SELECT 1 FROM node WHERE id = ?)
+        LIMIT 1`,
+      [
+        SystemNodes.ElementRecycleBin,
+        crypto.randomUUID(),
+        SystemNodes.Root,
+        `${SystemNodes.Root},${SystemNodes.ElementRecycleBin}`,
+        db.dialect.boolValue(false),
+        'Recycle Bin',
+        ObjectTypes.ElementRecycleBin,
+        DbDate.toDb(new Date()),
+        SystemNodes.ElementRecycleBin,
+      ],
+    )
+  },
+}

package/src/schema/form-permission-prefix.ts

@@ -0,0 +1,50 @@
+/**
+ * Migration 026 — the form verbs move from `Umb.` to `Crombolo.`.
+ *
+ * Migration 025 granted them under `Umb.Form.*` and `Umb.FormEntry.*`, which
+ * claimed they were Umbraco's. They are not: Umbraco has no forms in core, so
+ * nothing upstream defines them and the prefix was a lie a reader could not
+ * check. Every database seeded or upgraded since has the old spelling stored.
+ *
+ * A rewrite rather than a re-grant, so a verb an administrator removed by hand
+ * stays removed. `grantBuiltInPermissions` would have put it back.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_FORM_PERMISSIONS } from './form-permissions.ts'
+
+export const STATE_FORM_PERMISSION_PREFIX = '{6f1d4a8e-0026-4e72-9a55-3d7c1b8e4f02}'
+
+/** Old spelling to new, for every verb migration 025 could have written. */
+export const RENAMED_FORM_VERBS: ReadonlyArray<readonly [string, string]> = [
+  ['Umb.Form.Read', 'Crombolo.Form.Read'],
+  ['Umb.Form.Manage', 'Crombolo.Form.Manage'],
+  ['Umb.FormEntry.Read', 'Crombolo.FormEntry.Read'],
+  ['Umb.FormEntry.Manage', 'Crombolo.FormEntry.Manage'],
+  ['Umb.FormEntry.Sensitive', 'Crombolo.FormEntry.Sensitive'],
+]
+
+export const formPermissionPrefixMigration: Migration = {
+  from: STATE_FORM_PERMISSIONS,
+  to: STATE_FORM_PERMISSION_PREFIX,
+  name: 'PrefixFormPermissionsWithCrombolo',
+  kind: 'expand',
+  release: '0.5.0',
+  up: async (db: Db) => {
+    for (const [before, after] of RENAMED_FORM_VERBS) {
+      // The delete first: a group holding both spellings would otherwise break
+      // the row's uniqueness on the way through.
+      await db.exec(
+        `DELETE FROM user_group_permission
+         WHERE permission = ? AND user_group_key IN (
+           SELECT user_group_key FROM user_group_permission WHERE permission = ?
+         )`,
+        [before, after],
+      )
+      await db.exec('UPDATE user_group_permission SET permission = ? WHERE permission = ?', [
+        after,
+        before,
+      ])
+    }
+  },
+}

package/src/schema/form-permissions.ts

@@ -0,0 +1,26 @@
+/**
+ * Migration 025 — the form permission verbs, for databases seeded before they
+ * existed. `docs/18-forms.md`.
+ *
+ * The same shape as migration 007: granting what the seed now grants, so an
+ * upgraded site does not have a Forms section nobody can open. Idempotent, and
+ * it never takes a verb away.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_FORM_WORKFLOWS } from './form-workflows.ts'
+import { grantBuiltInPermissions } from './seed.ts'
+
+export const STATE_FORM_PERMISSIONS = '{6f1d4a8e-0025-4e72-9a55-3d7c1b8e4f02}'
+
+export const formPermissionsMigration: Migration = {
+  from: STATE_FORM_WORKFLOWS,
+  to: STATE_FORM_PERMISSIONS,
+  name: 'GrantFormPermissions',
+  kind: 'expand',
+  release: '0.5.0',
+  // Only the verbs: the `forms` section alias has been seeded on the admin and
+  // editor groups all along — Umbraco seeds it too — so there is nothing to add
+  // there. What was missing is a section to render, and that is code.
+  up: (db: Db) => grantBuiltInPermissions(db),
+}

package/src/schema/form-workflows.ts

@@ -0,0 +1,54 @@
+/**
+ * Migration 024 — the queue a form's workflows run from. `docs/18-forms.md`.
+ *
+ * A submission is stored and *then* its workflows run, so a mail server being
+ * down never loses an entry. That means a row per workflow per submission,
+ * claimed one node at a time and retried with a backoff.
+ *
+ * The values are carried on the row rather than read back from the entry,
+ * because a form may store no entries at all and still have workflows — the
+ * schema validator insists on exactly that, since a form that does neither has
+ * no effect.
+ *
+ * `run_on` rather than `trigger`: the latter is a reserved word in Postgres.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_FORMS } from './forms.ts'
+
+export const STATE_FORM_WORKFLOWS = '{6f1d4a8e-0024-4e72-9a55-3d7c1b8e4f02}'
+
+export const formWorkflowsMigration: Migration = {
+  from: STATE_FORMS,
+  to: STATE_FORM_WORKFLOWS,
+  name: 'AddFormWorkflowRuns',
+  kind: 'expand',
+  release: '0.5.0',
+  async up(db: Db) {
+    const t = db.dialect.types
+
+    await db.exec(
+      `CREATE TABLE form_workflow_run (
+         id ${t.varchar(64)} NOT NULL,
+         form_key ${t.varchar(64)} NOT NULL,
+         form_alias ${t.varchar(255)} NOT NULL,
+         workflow_name ${t.varchar(255)} NOT NULL,
+         workflow_type ${t.varchar(32)} NOT NULL,
+         run_on ${t.varchar(16)} NOT NULL,
+         entry_id ${t.varchar(64)},
+         payload ${t.text} NOT NULL,
+         state ${t.varchar(16)} NOT NULL,
+         attempts ${t.integer} NOT NULL,
+         last_error ${t.text},
+         run_after ${t.timestamp} NOT NULL,
+         create_date ${t.timestamp} NOT NULL,
+         update_date ${t.timestamp} NOT NULL,
+         PRIMARY KEY (id)
+       )`,
+    )
+    // The only query the runner makes: what is due now.
+    await db.exec('CREATE INDEX ix_form_workflow_run_due ON form_workflow_run (state, run_after)')
+    // And what the backoffice shows against one form.
+    await db.exec('CREATE INDEX ix_form_workflow_run_form ON form_workflow_run (form_key)')
+  },
+}

package/src/schema/forms.ts

@@ -0,0 +1,63 @@
+/**
+ * Migration 023 — form entries. `docs/18-forms.md`.
+ *
+ * The definition is a file, so there is no form table and nothing to point at:
+ * an entry carries `form_key`, the UUID from `schema/forms/*.toml`, and keeps
+ * it even when that file is deleted. The entries are the business record and
+ * must not disappear because a developer removed a form; the backoffice lists
+ * orphaned ones under the name the form last had.
+ *
+ * Values are a row each rather than a JSON blob, because they are what an
+ * entries list filters, sorts and exports by field — which is a query, not a
+ * read of the whole thing.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_CREATED_PACKAGES } from './created-packages.ts'
+
+export const STATE_FORMS = '{6f1d4a8e-0023-4e72-9a55-3d7c1b8e4f02}'
+
+export const formsMigration: Migration = {
+  from: STATE_CREATED_PACKAGES,
+  to: STATE_FORMS,
+  name: 'AddFormEntries',
+  kind: 'expand',
+  release: '0.5.0',
+  async up(db: Db) {
+    const t = db.dialect.types
+
+    await db.exec(
+      `CREATE TABLE form_entry (
+         id ${t.varchar(64)} NOT NULL,
+         form_key ${t.varchar(64)} NOT NULL,
+         form_alias ${t.varchar(255)} NOT NULL,
+         state ${t.varchar(16)} NOT NULL,
+         culture ${t.varchar(14)},
+         page_key ${t.varchar(64)},
+         ip_hash ${t.varchar(64)},
+         user_agent ${t.varchar(512)},
+         spam ${t.boolean} NOT NULL,
+         create_date ${t.timestamp} NOT NULL,
+         update_date ${t.timestamp} NOT NULL,
+         PRIMARY KEY (id)
+       )`,
+    )
+    // The entries view is always "this form, newest first, within a date range",
+    // so that is the index rather than one per column.
+    await db.exec('CREATE INDEX ix_form_entry_form ON form_entry (form_key, create_date)')
+    await db.exec('CREATE INDEX ix_form_entry_state ON form_entry (form_key, state)')
+
+    await db.exec(
+      `CREATE TABLE form_entry_value (
+         entry_id ${t.varchar(64)} NOT NULL,
+         field_alias ${t.varchar(255)} NOT NULL,
+         sort_order ${t.integer} NOT NULL,
+         value ${t.text},
+         PRIMARY KEY (entry_id, field_alias, sort_order),
+         FOREIGN KEY (entry_id) REFERENCES form_entry (id) ON DELETE CASCADE
+       )`,
+    )
+    // Reading one entry's values, and filtering a list by one field's value.
+    await db.exec('CREATE INDEX ix_form_entry_value_field ON form_entry_value (field_alias)')
+  },
+}

package/src/schema/group-permissions.ts

@@ -0,0 +1,20 @@
+/**
+ * Migration 007 — the built-in groups' default permission verbs, for databases
+ * seeded before the seed granted them. Without them the backoffice hides
+ * Create, Publish, Delete and every other permission-gated action.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_RECYCLE_BIN } from './recycle-bin.ts'
+import { grantBuiltInPermissions } from './seed.ts'
+
+export const STATE_GROUP_PERMISSIONS = '{6f1d4a8e-0007-4c21-9d3a-8b1e5c7a2f07}'
+
+export const groupPermissionsMigration: Migration = {
+  from: STATE_RECYCLE_BIN,
+  to: STATE_GROUP_PERMISSIONS,
+  name: 'GrantBuiltInGroupPermissions',
+  kind: 'expand',
+  release: '0.3.0',
+  up: (db: Db) => grantBuiltInPermissions(db),
+}