@crowi/api 2.0.0-alpha.0

package/dist/middlewares/index.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const accessTokenParser_1 = __importDefault(require("./accessTokenParser"));
+const adminRequired_1 = __importDefault(require("./adminRequired"));
+const applicationInstalled_1 = __importDefault(require("./applicationInstalled"));
+const applicationNotInstalled_1 = __importDefault(require("./applicationNotInstalled"));
+const basicAuth_1 = __importDefault(require("./basicAuth"));
+const csrfVerify_1 = __importDefault(require("./csrfVerify"));
+const encodeSpace_1 = __importDefault(require("./encodeSpace"));
+const fileAccessRightOrLoginRequired_1 = __importDefault(require("./fileAccessRightOrLoginRequired"));
+const jwtAuth_1 = __importDefault(require("./jwtAuth"));
+const loginChecker_1 = __importDefault(require("./loginChecker"));
+const loginRequired_1 = __importDefault(require("./loginRequired"));
+exports.default = (crowi, app) => ({
+    AccessTokenParser: (0, accessTokenParser_1.default)(crowi, app),
+    AdminRequired: (0, adminRequired_1.default)(),
+    ApplicationInstalled: (0, applicationInstalled_1.default)(),
+    ApplicationNotInstalled: (0, applicationNotInstalled_1.default)(),
+    BasicAuth: (0, basicAuth_1.default)(crowi, app),
+    CsrfVerify: (0, csrfVerify_1.default)(crowi),
+    EncodeSpace: (0, encodeSpace_1.default)(),
+    FileAccessRightOrLoginRequired: (0, fileAccessRightOrLoginRequired_1.default)(crowi),
+    JwtAuth: (0, jwtAuth_1.default)(crowi),
+    LoginChecker: (0, loginChecker_1.default)(crowi, app),
+    LoginRequired: (0, loginRequired_1.default)(crowi),
+});
+//# sourceMappingURL=index.js.map

package/dist/middlewares/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middlewares/index.ts"],"names":[],"mappings":";;;;;AAGA,4EAAoD;AACpD,oEAA4C;AAC5C,kFAA0D;AAC1D,wFAAgE;AAChE,4DAAoC;AACpC,8DAAsC;AACtC,gEAAwC;AACxC,sGAA8E;AAC9E,wDAAgC;AAChC,kEAA0C;AAC1C,oEAA4C;AAE5C,kBAAe,CAAC,KAAY,EAAE,GAAY,EAAE,EAAE,CAAC,CAAC;IAC9C,iBAAiB,EAAE,IAAA,2BAAiB,EAAC,KAAK,EAAE,GAAG,CAAC;IAChD,aAAa,EAAE,IAAA,uBAAa,GAAE;IAC9B,oBAAoB,EAAE,IAAA,8BAAoB,GAAE;IAC5C,uBAAuB,EAAE,IAAA,iCAAuB,GAAE;IAClD,SAAS,EAAE,IAAA,mBAAS,EAAC,KAAK,EAAE,GAAG,CAAC;IAChC,UAAU,EAAE,IAAA,oBAAU,EAAC,KAAK,CAAC;IAC7B,WAAW,EAAE,IAAA,qBAAW,GAAE;IAC1B,8BAA8B,EAAE,IAAA,wCAA8B,EAAC,KAAK,CAAC;IACrE,OAAO,EAAE,IAAA,iBAAO,EAAC,KAAK,CAAC;IACvB,YAAY,EAAE,IAAA,sBAAY,EAAC,KAAK,EAAE,GAAG,CAAC;IACtC,aAAa,EAAE,IAAA,uBAAa,EAAC,KAAK,CAAC;CACpC,CAAC,CAAC"}

package/dist/middlewares/jwtAdminRequired.d.ts

@@ -0,0 +1,8 @@
+import { Request, Response, NextFunction } from 'express';
+import Crowi from '../crowi';
+/**
+ * JWT authentication middleware with admin permission check
+ * Returns JSON error responses (401 or 403) for API endpoints
+ */
+declare const _default: (crowi: Crowi) => (req: Request, res: Response, next: NextFunction) => void;
+export default _default;

package/dist/middlewares/jwtAdminRequired.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const jwtAuth_1 = __importDefault(require("./jwtAuth"));
+/**
+ * JWT authentication middleware with admin permission check
+ * Returns JSON error responses (401 or 403) for API endpoints
+ */
+exports.default = (crowi) => {
+    const checkJwtAuth = (0, jwtAuth_1.default)(crowi);
+    return (req, res, next) => {
+        // First check JWT authentication
+        checkJwtAuth(req, res, (err) => {
+            if (err) {
+                // JWT auth failed - already handled by jwtAuth middleware
+                return;
+            }
+            // Check if user has admin permission
+            const user = req.user;
+            if (!user?.admin) {
+                const errorResponse = {
+                    error: {
+                        code: 'ADMIN_REQUIRED',
+                        message: 'Admin permission required',
+                    },
+                };
+                return res.status(403).json(errorResponse);
+            }
+            next();
+        });
+    };
+};
+//# sourceMappingURL=jwtAdminRequired.js.map

package/dist/middlewares/jwtAdminRequired.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtAdminRequired.js","sourceRoot":"","sources":["../../src/middlewares/jwtAdminRequired.ts"],"names":[],"mappings":";;;;;AAIA,wDAAgC;AAIhC;;;GAGG;AACH,kBAAe,CAAC,KAAY,EAAE,EAAE;IAC9B,MAAM,YAAY,GAAG,IAAA,iBAAO,EAAC,KAAK,CAAC,CAAC;IAEpC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,iCAAiC;QACjC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7B,IAAI,GAAG,EAAE,CAAC;gBACR,0DAA0D;gBAC1D,OAAO;YACT,CAAC;YAED,qCAAqC;YACrC,MAAM,IAAI,GAAI,GAAgD,CAAC,IAAI,CAAC;YACpE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;gBACjB,MAAM,aAAa,GAAuB;oBACxC,KAAK,EAAE;wBACL,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EAAE,2BAA2B;qBACrC;iBACF,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/middlewares/jwtAuth.d.ts

@@ -0,0 +1,4 @@
+import { Request, Response, NextFunction } from 'express';
+import Crowi from '../crowi';
+declare const _default: (crowi: Crowi) => (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;
+export default _default;

package/dist/middlewares/jwtAuth.js

@@ -0,0 +1,104 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const debug_1 = __importDefault(require("debug"));
+const jwt_1 = require("../util/jwt");
+exports.default = (crowi) => {
+    const debug = (0, debug_1.default)('crowi:middlewares:jwtAuth');
+    const User = crowi.model('User');
+    const jwtUtil = (0, jwt_1.createJwtUtil)(crowi);
+    return async (req, res, next) => {
+        const authHeader = req.headers.authorization;
+        let token = jwtUtil.extractTokenFromHeader(authHeader);
+        if (!token) {
+            // Fallback: pull the JWT from a cookie. `<img src="/api/v2/...">`
+            // requests cannot carry an Authorization header (the browser
+            // builds them with no JS hook), so the web client mirrors the
+            // access token into the `crowi.accessToken` cookie at login
+            // time. Same-origin in production / via Next.js rewrite in dev,
+            // so the cookie always reaches the API.
+            const cookieHeader = req.headers.cookie;
+            if (cookieHeader) {
+                const match = cookieHeader.split(';').find((c) => c.trim().startsWith('crowi.accessToken='));
+                if (match) {
+                    token = decodeURIComponent(match.split('=', 2)[1] ?? '').trim() || null;
+                }
+            }
+        }
+        if (!token) {
+            const errorResponse = {
+                error: {
+                    code: 'AUTHENTICATION_REQUIRED',
+                    message: 'Authentication is required',
+                },
+            };
+            return res.status(401).json(errorResponse);
+        }
+        const payload = jwtUtil.verifyToken(token, 'access');
+        if (!payload) {
+            const errorResponse = {
+                error: {
+                    code: 'AUTHENTICATION_REQUIRED',
+                    message: 'Authentication is required',
+                },
+            };
+            return res.status(401).json(errorResponse);
+        }
+        try {
+            const user = await User.findById(payload.userId);
+            if (!user) {
+                const errorResponse = {
+                    error: {
+                        code: 'AUTHENTICATION_REQUIRED',
+                        message: 'Authentication is required',
+                    },
+                };
+                return res.status(401).json(errorResponse);
+            }
+            if (user.status !== User.STATUS_ACTIVE) {
+                let code = 'USER_NOT_ACTIVE';
+                let message = 'User account is not active';
+                if (user.status === User.STATUS_REGISTERED) {
+                    code = 'USER_REGISTERED';
+                    message = 'User registration is not complete';
+                }
+                else if (user.status === User.STATUS_SUSPENDED) {
+                    code = 'USER_SUSPENDED';
+                    message = 'User account is suspended';
+                }
+                else if (user.status === User.STATUS_INVITED) {
+                    code = 'USER_INVITED';
+                    message = 'User invitation is pending';
+                }
+                const errorResponse = {
+                    error: {
+                        code: code,
+                        message,
+                        redirectTo: user.status === User.STATUS_REGISTERED
+                            ? '/login/error/registered'
+                            : user.status === User.STATUS_SUSPENDED
+                                ? '/login/error/suspended'
+                                : '/login/invited',
+                    },
+                };
+                return res.status(403).json(errorResponse);
+            }
+            // Attach user to request
+            req.user = user;
+            next();
+        }
+        catch (error) {
+            debug('JWT authentication error:', error);
+            const errorResponse = {
+                error: {
+                    code: 'AUTHENTICATION_REQUIRED',
+                    message: 'Authentication is required',
+                },
+            };
+            return res.status(401).json(errorResponse);
+        }
+    };
+};
+//# sourceMappingURL=jwtAuth.js.map

package/dist/middlewares/jwtAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtAuth.js","sourceRoot":"","sources":["../../src/middlewares/jwtAuth.ts"],"names":[],"mappings":";;;;;AAEA,kDAA0B;AAC1B,qCAA4C;AAO5C,kBAAe,CAAC,KAAY,EAAE,EAAE;IAC9B,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,2BAA2B,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAA,mBAAa,EAAC,KAAK,CAAC,CAAC;IAErC,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,kEAAkE;YAClE,6DAA6D;YAC7D,8DAA8D;YAC9D,4DAA4D;YAC5D,gEAAgE;YAChE,wCAAwC;YACxC,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YACxC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBAC7F,IAAI,KAAK,EAAE,CAAC;oBACV,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,aAAa,GAAgC;gBACjD,KAAK,EAAE;oBACL,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,4BAA4B;iBACtC;aACF,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,aAAa,GAAgC;gBACjD,KAAK,EAAE;oBACL,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,4BAA4B;iBACtC;aACF,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,aAAa,GAAG;oBACpB,KAAK,EAAE;wBACL,IAAI,EAAE,yBAAkC;wBACxC,OAAO,EAAE,4BAA4B;qBACtC;iBACF,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvC,IAAI,IAAI,GAAG,iBAAiB,CAAC;gBAC7B,IAAI,OAAO,GAAG,4BAA4B,CAAC;gBAE3C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAC3C,IAAI,GAAG,iBAAiB,CAAC;oBACzB,OAAO,GAAG,mCAAmC,CAAC;gBAChD,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACjD,IAAI,GAAG,gBAAgB,CAAC;oBACxB,OAAO,GAAG,2BAA2B,CAAC;gBACxC,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;oBAC/C,IAAI,GAAG,cAAc,CAAC;oBACtB,OAAO,GAAG,4BAA4B,CAAC;gBACzC,CAAC;gBAED,MAAM,aAAa,GAAoB;oBACrC,KAAK,EAAE;wBACL,IAAI,EAAE,IAA6D;wBACnE,OAAO;wBACP,UAAU,EACR,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,iBAAiB;4BACpC,CAAC,CAAC,yBAAyB;4BAC3B,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,gBAAgB;gCACrC,CAAC,CAAC,wBAAwB;gCAC1B,CAAC,CAAC,gBAAgB;qBACzB;iBACF,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;YAED,yBAAyB;YACzB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAgC;gBACjD,KAAK,EAAE;oBACL,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,4BAA4B;iBACtC;aACF,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/middlewares/loginChecker.d.ts

@@ -0,0 +1,4 @@
+import { Express, Request, Response, NextFunction } from 'express';
+import Crowi from '../crowi';
+declare const _default: (crowi: Crowi, app: Express) => (req: Request, res: Response, next: NextFunction) => void;
+export default _default;

package/dist/middlewares/loginChecker.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// const debug = Debug('crowi:middlewares:loginChecker')
+exports.default = (crowi, app) => {
+    return (req, res, next) => {
+        const User = crowi.model('User');
+        const csrfKey = req.session?.id || 'anon';
+        if (!req.csrfToken) {
+            req.csrfToken = crowi.getTokens().create(csrfKey);
+        }
+        // session に user object が入ってる
+        if (req.session?.user && '_id' in req.session.user) {
+            User.findById(req.session.user._id)
+                .select('+password +apiToken')
+                .exec()
+                .then((userData) => {
+                req.user = req.session.user = userData;
+                res.locals.user = req.user;
+                next();
+            })
+                .catch(() => {
+                next();
+            });
+        }
+        else {
+            req.user = req.session.user = null;
+            res.locals.user = req.user;
+            next();
+        }
+    };
+};
+//# sourceMappingURL=loginChecker.js.map

package/dist/middlewares/loginChecker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginChecker.js","sourceRoot":"","sources":["../../src/middlewares/loginChecker.ts"],"names":[],"mappings":";;AAEA,wDAAwD;AAExD,kBAAe,CAAC,KAAY,EAAE,GAAY,EAAE,EAAE;IAC5C,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,MAAM,CAAC;QAE1C,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QAED,8BAA8B;QAC9B,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;iBAChC,MAAM,CAAC,qBAAqB,CAAC;iBAC7B,IAAI,EAAE;iBACN,IAAI,CAAC,CAAC,QAAa,EAAE,EAAE;gBACtB,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE,CAAC;YACT,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE;gBACV,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/middlewares/loginRequired.d.ts

@@ -0,0 +1,4 @@
+import { Request, Response } from 'express';
+import Crowi from '../crowi';
+declare const _default: (crowi: Crowi) => (req: Request, res: Response, next: any) => Promise<any>;
+export default _default;

package/dist/middlewares/loginRequired.js

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const auth_1 = __importDefault(require("../util/auth"));
+const debug_1 = __importDefault(require("debug"));
+exports.default = (crowi) => {
+    const debug = (0, debug_1.default)('crowi:middlewares:loginRequired');
+    return async (req, res, next) => {
+        const User = crowi.model('User');
+        const config = crowi.getConfig();
+        const { originalUrl } = req;
+        const query = originalUrl === '/' ? '' : `?continue=${originalUrl}`;
+        const isAuthPage = originalUrl.startsWith('/me/auth/');
+        const isAPI = originalUrl.startsWith('/_api/');
+        if (!isAuthPage && auth_1.default.isAccessTokenExpired(req)) {
+            const success = await auth_1.default.reauth(req, config);
+            if (!success) {
+                const errorResponse = {
+                    error: {
+                        code: 'AUTHENTICATION_REQUIRED',
+                        message: 'Authentication is required',
+                        redirectTo: '/logout',
+                    },
+                };
+                return res.status(401).json(errorResponse);
+            }
+        }
+        if (req.user && '_id' in req.user) {
+            const { 'auth:requireThirdPartyAuth': requireThirdPartyAuth = '' } = config.crowi;
+            const hasValidThirdPartyId = req.user.hasValidThirdPartyId();
+            if (!isAuthPage && requireThirdPartyAuth && !hasValidThirdPartyId) {
+                const errorResponse = {
+                    error: {
+                        code: 'THIRD_PARTY_AUTH_REQUIRED',
+                        message: 'Third party authentication is required',
+                        redirectTo: `/me/auth/third-party${query}`,
+                    },
+                };
+                return res.status(403).json(errorResponse);
+            }
+            if (req.user.status === User.STATUS_ACTIVE) {
+                // Active の人だけ先に進める
+                return next();
+            }
+            else if (req.user.status === User.STATUS_REGISTERED) {
+                const errorResponse = {
+                    error: {
+                        code: 'USER_REGISTERED',
+                        message: 'User registration is not complete',
+                        redirectTo: '/login/error/registered',
+                    },
+                };
+                return res.status(403).json(errorResponse);
+            }
+            else if (req.user.status === User.STATUS_SUSPENDED) {
+                const errorResponse = {
+                    error: {
+                        code: 'USER_SUSPENDED',
+                        message: 'User account is suspended',
+                        redirectTo: '/login/error/suspended',
+                    },
+                };
+                return res.status(403).json(errorResponse);
+            }
+            else if (req.user.status === User.STATUS_INVITED) {
+                const errorResponse = {
+                    error: {
+                        code: 'USER_INVITED',
+                        message: 'User invitation is pending',
+                        redirectTo: '/login/invited',
+                    },
+                };
+                return res.status(403).json(errorResponse);
+            }
+        }
+        const errorResponse = {
+            error: {
+                code: 'AUTHENTICATION_REQUIRED',
+                message: 'Authentication is required',
+                redirectTo: `/login${query}`,
+            },
+        };
+        return res.status(401).json(errorResponse);
+    };
+};
+//# sourceMappingURL=loginRequired.js.map

package/dist/middlewares/loginRequired.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginRequired.js","sourceRoot":"","sources":["../../src/middlewares/loginRequired.ts"],"names":[],"mappings":";;;;;AAEA,yDAAiC;AACjC,kDAA0B;AAQ1B,kBAAe,CAAC,KAAY,EAAE,EAAE;IAC9B,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,iCAAiC,CAAC,CAAC;IAEvD,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAI,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;QAC5B,MAAM,KAAK,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,WAAW,EAAE,CAAC;QACpE,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE/C,IAAI,CAAC,UAAU,IAAI,cAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,MAAM,cAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,aAAa,GAAgC;oBACjD,KAAK,EAAE;wBACL,IAAI,EAAE,yBAAyB;wBAC/B,OAAO,EAAE,4BAA4B;wBACrC,UAAU,EAAE,SAAS;qBACtB;iBACF,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,EAAE,4BAA4B,EAAE,qBAAqB,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;YAClF,MAAM,oBAAoB,GAAG,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC7D,IAAI,CAAC,UAAU,IAAI,qBAAqB,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAClE,MAAM,aAAa,GAAgC;oBACjD,KAAK,EAAE;wBACL,IAAI,EAAE,2BAA2B;wBACjC,OAAO,EAAE,wCAAwC;wBACjD,UAAU,EAAE,uBAAuB,KAAK,EAAE;qBAC3C;iBACF,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,mBAAmB;gBACnB,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACtD,MAAM,aAAa,GAAoB;oBACrC,KAAK,EAAE;wBACL,IAAI,EAAE,iBAAiB;wBACvB,OAAO,EAAE,mCAAmC;wBAC5C,UAAU,EAAE,yBAAyB;qBACtC;iBACF,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACrD,MAAM,aAAa,GAAoB;oBACrC,KAAK,EAAE;wBACL,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EAAE,2BAA2B;wBACpC,UAAU,EAAE,wBAAwB;qBACrC;iBACF,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnD,MAAM,aAAa,GAAoB;oBACrC,KAAK,EAAE;wBACL,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,4BAA4B;wBACrC,UAAU,EAAE,gBAAgB;qBAC7B;iBACF,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAgC;YACjD,KAAK,EAAE;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,4BAA4B;gBACrC,UAAU,EAAE,SAAS,KAAK,EAAE;aAC7B;SACF,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/migration/cli-api.d.ts

@@ -0,0 +1,83 @@
+import type Crowi from '../crowi';
+import { type MigrationRegistry } from './registry';
+import type { DetectReport, MigrationLayer } from './types';
+/**
+ * RFC-0008 §8 — the api-side surface the `@crowi/admin-cli` `migrate` /
+ * `rebuild` commands consume.
+ *
+ * The admin CLI is a separate, lightweight process that `require`s the api's
+ * compiled `dist/` (see `commands/*.ts` `loadApi()` rationale). Rather than
+ * have the CLI reach into `registry.ts` / `runner.ts` individually, this
+ * module exposes a small, stable façade so the CLI's structural types stay
+ * narrow and the framework internals can evolve without touching the CLI.
+ *
+ * No live Hocuspocus handle is wired here: the CLI runs preflight migrations
+ * mongo-only, so `broadcastForceReload` is intentionally absent (§4.3.1).
+ */
+/** One row in `migrate list` / `migrate plan`. */
+export interface MigrationSummary {
+    id: string;
+    fromVersion: string;
+    toVersion: string;
+    layer: MigrationLayer;
+    description: string;
+}
+export interface MigrationPlanEntry extends MigrationSummary {
+    pending: boolean;
+    /** `detect` report when the migration provides one, else null. */
+    detail: DetectReport | null;
+}
+export interface MigrationStatusEntry {
+    migrationId: string;
+    result: string;
+    appliedAt: Date;
+    durationMs?: number;
+    appliedBy?: string;
+}
+export interface MigrationStatus {
+    latestTarget: string | null;
+    recent: MigrationStatusEntry[];
+    pendingPreflight: number;
+    pendingBoot: number;
+}
+/**
+ * Façade over the registry + runner for the CLI. Constructed against a
+ * booted (`initForCli`) Crowi instance.
+ */
+export declare class MigrationCliApi {
+    private readonly crowi;
+    private readonly registry;
+    constructor(crowi: Crowi, registry?: MigrationRegistry);
+    /** `migrate list` — all registered migrations in order. */
+    list(): MigrationSummary[];
+    /** The latest reachable target version (or null when registry is empty). */
+    latestTarget(): string | null;
+    private buildRunner;
+    /**
+     * `migrate plan` — pending migrations + (where available) a `detect`
+     * preview. `allLayers` extends from preflight-only (default) to both
+     * layers (§4.2.2).
+     */
+    plan(options?: {
+        allLayers?: boolean;
+    }): Promise<MigrationPlanEntry[]>;
+    /**
+     * `migrate apply` — apply pending preflight migrations (or both layers
+     * with `allLayers`), in order. `dryRun` runs detect only. A single `id`
+     * narrows to one migration. Returns per-migration outcomes.
+     */
+    apply(options?: {
+        allLayers?: boolean;
+        dryRun?: boolean;
+        id?: string;
+        continueOnError?: boolean;
+    }): Promise<{
+        id: string;
+        result: string;
+        durationMs: number;
+    }[]>;
+    /** `migrate status` — recent applications + pending counts. */
+    status(recentLimit?: number): Promise<MigrationStatus>;
+}
+/** Convenience factory used by the CLI's `require(dist/migration/cli-api)`. */
+export declare function createMigrationCliApi(crowi: Crowi): MigrationCliApi;

package/dist/migration/cli-api.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MigrationCliApi = void 0;
+exports.createMigrationCliApi = createMigrationCliApi;
+const registry_1 = require("./registry");
+const runner_1 = require("./runner");
+function toSummary(def) {
+    return {
+        id: def.id,
+        fromVersion: def.fromVersion,
+        toVersion: def.toVersion,
+        layer: def.layer,
+        description: def.description,
+    };
+}
+/**
+ * Façade over the registry + runner for the CLI. Constructed against a
+ * booted (`initForCli`) Crowi instance.
+ */
+class MigrationCliApi {
+    crowi;
+    registry;
+    constructor(crowi, registry = (0, registry_1.createRegistry)()) {
+        this.crowi = crowi;
+        this.registry = registry;
+    }
+    /** `migrate list` — all registered migrations in order. */
+    list() {
+        return this.registry.all().map(toSummary);
+    }
+    /** The latest reachable target version (or null when registry is empty). */
+    latestTarget() {
+        return this.registry.latestTarget();
+    }
+    buildRunner(options = {}) {
+        return new runner_1.MigrationRunner(this.crowi, options);
+    }
+    /**
+     * `migrate plan` — pending migrations + (where available) a `detect`
+     * preview. `allLayers` extends from preflight-only (default) to both
+     * layers (§4.2.2).
+     */
+    async plan(options = {}) {
+        const runner = this.buildRunner();
+        const layers = options.allLayers ? ['boot', 'preflight'] : ['preflight'];
+        const entries = [];
+        for (const layer of layers) {
+            for (const def of this.registry.byLayer(layer)) {
+                const pending = await runner.isPending(def);
+                const detail = pending ? await runner.detect(def) : null;
+                entries.push({ ...toSummary(def), pending, detail });
+            }
+        }
+        return entries;
+    }
+    /**
+     * `migrate apply` — apply pending preflight migrations (or both layers
+     * with `allLayers`), in order. `dryRun` runs detect only. A single `id`
+     * narrows to one migration. Returns per-migration outcomes.
+     */
+    async apply(options = {}) {
+        const runner = this.buildRunner({ dryRun: options.dryRun });
+        const dispose = runner.installSigintHandler();
+        const layers = options.allLayers ? ['boot', 'preflight'] : ['preflight'];
+        const targets = [];
+        for (const layer of layers) {
+            for (const def of this.registry.byLayer(layer)) {
+                if (options.id && def.id !== options.id)
+                    continue;
+                targets.push(def);
+            }
+        }
+        const outcomes = [];
+        try {
+            for (const def of targets) {
+                try {
+                    const outcome = await runner.apply(def);
+                    outcomes.push({ id: outcome.id, result: outcome.result, durationMs: outcome.durationMs });
+                }
+                catch (err) {
+                    if (!options.continueOnError)
+                        throw err;
+                    outcomes.push({ id: def.id, result: 'failed', durationMs: 0 });
+                }
+                if (runner.aborted)
+                    break;
+            }
+        }
+        finally {
+            dispose();
+        }
+        return outcomes;
+    }
+    /** `migrate status` — recent applications + pending counts. */
+    async status(recentLimit = 10) {
+        const runner = this.buildRunner();
+        const MigrationApplication = this.crowi.model('MigrationApplication');
+        const recentDocs = await MigrationApplication.recent(recentLimit);
+        let pendingPreflight = 0;
+        for (const def of this.registry.byLayer('preflight')) {
+            if (await runner.isPending(def))
+                pendingPreflight++;
+        }
+        let pendingBoot = 0;
+        for (const def of this.registry.byLayer('boot')) {
+            if (await runner.isPending(def))
+                pendingBoot++;
+        }
+        return {
+            latestTarget: this.registry.latestTarget(),
+            recent: recentDocs.map((d) => ({
+                migrationId: d.migrationId,
+                result: d.result,
+                appliedAt: d.appliedAt,
+                durationMs: d.durationMs,
+                appliedBy: d.appliedBy,
+            })),
+            pendingPreflight,
+            pendingBoot,
+        };
+    }
+}
+exports.MigrationCliApi = MigrationCliApi;
+/** Convenience factory used by the CLI's `require(dist/migration/cli-api)`. */
+function createMigrationCliApi(crowi) {
+    return new MigrationCliApi(crowi);
+}
+//# sourceMappingURL=cli-api.js.map

package/dist/migration/cli-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-api.js","sourceRoot":"","sources":["../../src/migration/cli-api.ts"],"names":[],"mappings":";;;AAiLA,sDAEC;AAhLD,yCAAoE;AACpE,qCAA+D;AA+C/D,SAAS,SAAS,CAAC,GAAwB;IACzC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAa,eAAe;IACT,KAAK,CAAQ;IACb,QAAQ,CAAoB;IAE7C,YAAY,KAAY,EAAE,WAA8B,IAAA,yBAAc,GAAE;QACtE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,2DAA2D;IAC3D,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,4EAA4E;IAC5E,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACtC,CAAC;IAEO,WAAW,CAAC,UAAyB,EAAE;QAC7C,OAAO,IAAI,wBAAe,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,UAAmC,EAAE;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,MAAM,GAAqB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CACT,UAA6F,EAAE;QAE/F,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAqB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC3F,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,IAAI,OAAO,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE;oBAAE,SAAS;gBAClD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAyD,EAAE,CAAC;QAC1E,IAAI,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC5F,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,OAAO,CAAC,eAAe;wBAAE,MAAM,GAAG,CAAC;oBACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;gBACjE,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO;oBAAE,MAAM;YAC5B,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,EAAE;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAA8B,CAAC;QACnG,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAElE,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACrD,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;gBAAE,gBAAgB,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;gBAAE,WAAW,EAAE,CAAC;QACjD,CAAC;QAED,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;YAC1C,MAAM,EAAE,UAAU,CAAC,GAAG,CACpB,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC;gBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CACH;YACD,gBAAgB;YAChB,WAAW;SACZ,CAAC;IACJ,CAAC;CACF;AA7GD,0CA6GC;AAED,+EAA+E;AAC/E,SAAgB,qBAAqB,CAAC,KAAY;IAChD,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/migration/migrations/index.d.ts

@@ -0,0 +1,12 @@
+import type { MigrationDefinition } from '../types';
+/**
+ * RFC-0008 §5.5 — the migration barrel.
+ *
+ * Every migration module under `packages/api/src/migration/migrations/`
+ * exports a `MigrationDefinition` (built with `defineMigration`). They are
+ * collected here into a flat array that `registry.ts` reads at startup,
+ * then orders by version range + `order`.
+ *
+ * Every phase appends its definition here.
+ */
+export declare const allMigrations: MigrationDefinition[];

package/dist/migration/migrations/index.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allMigrations = void 0;
+const page_status_default_1 = require("./page-status-default");
+const revisions_schema_unify_1 = require("./revisions-schema-unify");
+const user_unique_prepare_1 = require("./user-unique-prepare");
+const wikilink_format_1 = require("./wikilink-format");
+/**
+ * RFC-0008 §5.5 — the migration barrel.
+ *
+ * Every migration module under `packages/api/src/migration/migrations/`
+ * exports a `MigrationDefinition` (built with `defineMigration`). They are
+ * collected here into a flat array that `registry.ts` reads at startup,
+ * then orders by version range + `order`.
+ *
+ * Every phase appends its definition here.
+ */
+exports.allMigrations = [
+    page_status_default_1.pageStatusDefault, // phase 2 (boot)
+    wikilink_format_1.wikilinkFormat, // phase 3 (preflight)
+    user_unique_prepare_1.userUniquePrepare, // phase 5 (preflight)
+    revisions_schema_unify_1.revisionsSchemaUnify, // phase 6 (boot — RFC-classified preflight, see migration JSDoc)
+];
+//# sourceMappingURL=index.js.map

package/dist/migration/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migration/migrations/index.ts"],"names":[],"mappings":";;;AACA,+DAA0D;AAC1D,qEAAgE;AAChE,+DAA0D;AAC1D,uDAAmD;AAEnD;;;;;;;;;GASG;AACU,QAAA,aAAa,GAA0B;IAClD,uCAAiB,EAAE,iBAAiB;IACpC,gCAAc,EAAE,sBAAsB;IACtC,uCAAiB,EAAE,sBAAsB;IACzC,6CAAoB,EAAE,iEAAiE;CACxF,CAAC"}

package/dist/migration/migrations/page-status-default.d.ts

@@ -0,0 +1,25 @@
+/**
+ * RFC-0008 §10.1 — `page-status-default` (boot layer).
+ *
+ * Ported from the former standalone `runPageStatusMigration`
+ * (`src/util/page-status-migration.ts`). RFC-0004 introduced a first-class
+ * `Page.status` field; pages created before it read back as `null`. This
+ * boot migration backfills `status='published'` onto every such legacy row.
+ *
+ * Why: `Page.isPublished()` already treats `null` as published for
+ * back-compat, but the query-level `$or` filters and the collab draft gate
+ * are clearer — and future-proof against a stricter `required: true` — when
+ * every row carries an explicit value.
+ *
+ * Behaviour preserved exactly from the old util:
+ *   - `{ status: null }` matches both an explicit `null` and a missing field
+ *     in MongoDB query semantics, so a single condition covers every legacy
+ *     shape.
+ *   - Idempotent: the filter only matches rows still unset, so a second run
+ *     touches nothing.
+ *   - Pages already `published` / `draft` / `deleted` / `deprecated` / `wip`
+ *     are left exactly as they are — in particular this never rewrites a
+ *     `draft` back to `published`, which would violate the one-way
+ *     transition rule.
+ */
+export declare const pageStatusDefault: import("../types").MigrationDefinition;