@crowi/api 2.0.0-alpha.0

package/dist/migration/migrations/page-status-default.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pageStatusDefault = void 0;
+const page_1 = require("../../models/page");
+const types_1 = require("../types");
+/**
+ * RFC-0008 §10.1 — `page-status-default` (boot layer).
+ *
+ * Ported from the former standalone `runPageStatusMigration`
+ * (`src/util/page-status-migration.ts`). RFC-0004 introduced a first-class
+ * `Page.status` field; pages created before it read back as `null`. This
+ * boot migration backfills `status='published'` onto every such legacy row.
+ *
+ * Why: `Page.isPublished()` already treats `null` as published for
+ * back-compat, but the query-level `$or` filters and the collab draft gate
+ * are clearer — and future-proof against a stricter `required: true` — when
+ * every row carries an explicit value.
+ *
+ * Behaviour preserved exactly from the old util:
+ *   - `{ status: null }` matches both an explicit `null` and a missing field
+ *     in MongoDB query semantics, so a single condition covers every legacy
+ *     shape.
+ *   - Idempotent: the filter only matches rows still unset, so a second run
+ *     touches nothing.
+ *   - Pages already `published` / `draft` / `deleted` / `deprecated` / `wip`
+ *     are left exactly as they are — in particular this never rewrites a
+ *     `draft` back to `published`, which would violate the one-way
+ *     transition rule.
+ */
+exports.pageStatusDefault = (0, types_1.defineMigration)({
+    id: 'page-status-default',
+    fromVersion: '1.x',
+    toVersion: '2.0',
+    layer: 'boot',
+    description: 'Backfill page.status (RFC-0004)',
+    /**
+     * Cheap, index-backed probe: `Page.status` is declared `index: true`
+     * (models/page.ts), so a single `findOne({ status: null })` lookup is
+     * covered by that index and never scans the collection. Pending iff at
+     * least one legacy page is still missing a status.
+     */
+    isPending: async (ctx) => {
+        const Page = ctx.crowi.model('Page');
+        const legacy = await Page.findOne({ status: null }).select('_id').lean().exec();
+        return legacy != null;
+    },
+    /**
+     * Optional `plan` detail: count the remaining legacy rows. Not called at
+     * boot — only `isPending` runs there.
+     */
+    detect: async (ctx) => {
+        const Page = ctx.crowi.model('Page');
+        const remaining = await Page.countDocuments({ status: null }).exec();
+        return {
+            summary: `${remaining} legacy page row(s) without status`,
+            counts: { remaining },
+        };
+    },
+    stages: [
+        {
+            name: 'backfill-status',
+            fn: async (ctx) => {
+                if (ctx.dryRun) {
+                    return { name: 'backfill-status', transformed: 0 };
+                }
+                const Page = ctx.crowi.model('Page');
+                const result = await Page.updateMany({ status: null }, { $set: { status: page_1.STATUS_PUBLISHED } });
+                // Mongoose's UpdateResult exposes `modifiedCount`; fall back to 0 for
+                // any driver shape that omits it.
+                const modified = result.modifiedCount ?? 0;
+                if (modified > 0) {
+                    ctx.logger.info(`page-status-default: backfilled status='published' on ${modified} legacy page row(s)`);
+                }
+                return { name: 'backfill-status', transformed: modified };
+            },
+        },
+    ],
+});
+//# sourceMappingURL=page-status-default.js.map

package/dist/migration/migrations/page-status-default.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-status-default.js","sourceRoot":"","sources":["../../../src/migration/migrations/page-status-default.ts"],"names":[],"mappings":";;;AAAA,0CAAmD;AAEnD,oCAA2C;AAE3C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACU,QAAA,iBAAiB,GAAG,IAAA,uBAAe,EAAC;IAC/C,EAAE,EAAE,qBAAqB;IACzB,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,MAAM;IACb,WAAW,EAAE,iCAAiC;IAE9C;;;;;OAKG;IACH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAChF,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,OAAO;YACL,OAAO,EAAE,GAAG,SAAS,oCAAoC;YACzD,MAAM,EAAE,EAAE,SAAS,EAAE;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,EAAE;QACN;YACE,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;gBACrD,CAAC;gBACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,uBAAgB,EAAE,EAAE,CAAC,CAAC;gBAC/F,sEAAsE;gBACtE,kCAAkC;gBAClC,MAAM,QAAQ,GAAI,MAAqC,CAAC,aAAa,IAAI,CAAC,CAAC;gBAC3E,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBACjB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,QAAQ,qBAAqB,CAAC,CAAC;gBAC1G,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;YAC5D,CAAC;SACF;KACF;CACF,CAAC,CAAC"}

package/dist/migration/migrations/revisions-schema-unify.d.ts

@@ -0,0 +1,33 @@
+/**
+ * RFC-0008 §10.3 step5 — `revisions-schema-unify`.
+ *
+ * Backfills `revision.type = 'snapshot'` onto v1.x revisions written before
+ * the field existed. `Revision.type` (`'snapshot' | 'incremental'`) was added
+ * by RFC-0003 and the read path already treats `undefined` as `'snapshot'`
+ * for back-compat. Phase 6 is therefore NOT a new-field addition — it is a
+ * one-time backfill of the existing field plus closing the write source so
+ * the value is always present going forward.
+ *
+ * Closing the write source: `models/revision.ts` now declares
+ * `type: { default: 'snapshot' }`, so every newly written revision — even on
+ * the HTTP API path (`Page.createPage` / `Page.updatePage`), which never
+ * passes an explicit `type` — lands with a concrete value. Without that
+ * default this migration would re-pend on every fresh revision and, as a boot
+ * migration, permanently block boot (the Phase 3 wikilink lesson).
+ *
+ * ── RFC LAYER DEVIATION ──────────────────────────────────────────────
+ * RFC-0008 §10.3 / Appendix A classify this as a `preflight` migration.
+ * We deliberately run it as `layer: 'boot'` instead: once the schema
+ * `default: 'snapshot'` closes the write source, the transform reduces to a
+ * single idempotent `updateMany({ type: null }, ...)` backfill — structurally
+ * identical to `page-status-default` (also boot). It is cheap, index-backed,
+ * and non-destructive, so boot-auto is the right fit. This deviation is noted
+ * in TODO.md as well.
+ * ─────────────────────────────────────────────────────────────────────
+ *
+ * Scope: `type` ONLY. `contributors` is left untouched (v1.x has no `savedBy`
+ * either; we do not fabricate collaboration history, and the wire format
+ * already omits an undefined `contributors`). `renderedAst` is the
+ * `rebuild renderer` task's responsibility per RFC-0008.
+ */
+export declare const revisionsSchemaUnify: import("../types").MigrationDefinition;

package/dist/migration/migrations/revisions-schema-unify.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revisionsSchemaUnify = void 0;
+const types_1 = require("../types");
+/**
+ * RFC-0008 §10.3 step5 — `revisions-schema-unify`.
+ *
+ * Backfills `revision.type = 'snapshot'` onto v1.x revisions written before
+ * the field existed. `Revision.type` (`'snapshot' | 'incremental'`) was added
+ * by RFC-0003 and the read path already treats `undefined` as `'snapshot'`
+ * for back-compat. Phase 6 is therefore NOT a new-field addition — it is a
+ * one-time backfill of the existing field plus closing the write source so
+ * the value is always present going forward.
+ *
+ * Closing the write source: `models/revision.ts` now declares
+ * `type: { default: 'snapshot' }`, so every newly written revision — even on
+ * the HTTP API path (`Page.createPage` / `Page.updatePage`), which never
+ * passes an explicit `type` — lands with a concrete value. Without that
+ * default this migration would re-pend on every fresh revision and, as a boot
+ * migration, permanently block boot (the Phase 3 wikilink lesson).
+ *
+ * ── RFC LAYER DEVIATION ──────────────────────────────────────────────
+ * RFC-0008 §10.3 / Appendix A classify this as a `preflight` migration.
+ * We deliberately run it as `layer: 'boot'` instead: once the schema
+ * `default: 'snapshot'` closes the write source, the transform reduces to a
+ * single idempotent `updateMany({ type: null }, ...)` backfill — structurally
+ * identical to `page-status-default` (also boot). It is cheap, index-backed,
+ * and non-destructive, so boot-auto is the right fit. This deviation is noted
+ * in TODO.md as well.
+ * ─────────────────────────────────────────────────────────────────────
+ *
+ * Scope: `type` ONLY. `contributors` is left untouched (v1.x has no `savedBy`
+ * either; we do not fabricate collaboration history, and the wire format
+ * already omits an undefined `contributors`). `renderedAst` is the
+ * `rebuild renderer` task's responsibility per RFC-0008.
+ */
+exports.revisionsSchemaUnify = (0, types_1.defineMigration)({
+    id: 'revisions-schema-unify',
+    fromVersion: '2.0',
+    toVersion: '2.1',
+    layer: 'boot',
+    description: 'Unify revision schema (backfill type:snapshot)',
+    /**
+     * Cheap, index-backed probe: `Revision.type` is declared `index: true`
+     * (models/revision.ts), so `findOne({ type: null })` is covered by that
+     * index and never scans the collection. `{ type: null }` matches both a
+     * missing field and an explicit `null` in MongoDB query semantics, so a
+     * single condition covers every legacy shape. Pending iff at least one
+     * legacy revision is still missing a type. After apply (and because new
+     * revisions are filled by the schema `default`) this stays false — no
+     * permanent boot block.
+     */
+    isPending: async (ctx) => {
+        const Revision = ctx.crowi.model('Revision');
+        const legacy = await Revision.findOne({ type: null }).select('_id').lean().exec();
+        return legacy != null;
+    },
+    /**
+     * Optional `plan` detail: count the remaining legacy rows. Not called at
+     * boot — only `isPending` runs there. Index-backed count on `type`.
+     */
+    detect: async (ctx) => {
+        const Revision = ctx.crowi.model('Revision');
+        const remaining = await Revision.countDocuments({ type: null }).exec();
+        return {
+            summary: `${remaining} legacy revision row(s) without type`,
+            counts: { remaining },
+        };
+    },
+    stages: [
+        {
+            name: 'backfill-type',
+            fn: async (ctx) => {
+                if (ctx.dryRun) {
+                    return { name: 'backfill-type', transformed: 0 };
+                }
+                const Revision = ctx.crowi.model('Revision');
+                const result = await Revision.updateMany({ type: null }, { $set: { type: 'snapshot' } });
+                const modified = result.modifiedCount ?? 0;
+                if (modified > 0) {
+                    ctx.logger.info(`revisions-schema-unify: backfilled type='snapshot' on ${modified} legacy revision row(s)`);
+                }
+                return { name: 'backfill-type', transformed: modified };
+            },
+        },
+    ],
+});
+//# sourceMappingURL=revisions-schema-unify.js.map

package/dist/migration/migrations/revisions-schema-unify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revisions-schema-unify.js","sourceRoot":"","sources":["../../../src/migration/migrations/revisions-schema-unify.ts"],"names":[],"mappings":";;;AAEA,oCAA2C;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACU,QAAA,oBAAoB,GAAG,IAAA,uBAAe,EAAC;IAClD,EAAE,EAAE,wBAAwB;IAC5B,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,MAAM;IACb,WAAW,EAAE,gDAAgD;IAE7D;;;;;;;;;OASG;IACH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAkB,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAClF,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAkB,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,OAAO;YACL,OAAO,EAAE,GAAG,SAAS,sCAAsC;YAC3D,MAAM,EAAE,EAAE,SAAS,EAAE;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,EAAE;QACN;YACE,IAAI,EAAE,eAAe;YACrB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;gBACnD,CAAC;gBACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAkB,CAAC;gBAC9D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;gBACzF,MAAM,QAAQ,GAAI,MAAqC,CAAC,aAAa,IAAI,CAAC,CAAC;gBAC3E,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBACjB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,QAAQ,yBAAyB,CAAC,CAAC;gBAC9G,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;YAC1D,CAAC;SACF;KACF;CACF,CAAC,CAAC"}

package/dist/migration/migrations/user-unique-prepare.d.ts

@@ -0,0 +1 @@
+export declare const userUniquePrepare: import("../types").MigrationDefinition;

package/dist/migration/migrations/user-unique-prepare.js

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userUniquePrepare = void 0;
+const dedup_users_1 = require("../../util/dedup-users");
+const types_1 = require("../types");
+/**
+ * RFC-0008 §11 / feature-user-identity-uniqueness — `user-unique-prepare`
+ * (preflight layer).
+ *
+ * Prepares the `users` collection so the plain unique indexes on
+ * `username` / `email` (declared in `models/user.ts`, built by autoIndex on
+ * boot) can build without E11000:
+ *
+ *   1. `dedup-username` — merge living users that collide on a
+ *      case-insensitive username, reassigning every ownership reference to the
+ *      survivor (uniqueness spec §c) and deleting the losers.
+ *   2. `dedup-email` — same for email.
+ *   3. `tombstone-deleted` — rename any STATUS_DELETED user whose original
+ *      username/email would collide with a living user (or another deleted
+ *      user) to the per-id `deleted-<id>` tombstone, matching the runtime
+ *      `statusDelete` behaviour. Without this, a legacy deleted row that kept
+ *      its original identity would collide a living user on index build.
+ *
+ * Index BUILDING is not done here (§9): the schema declares the indexes and
+ * Mongoose autoIndex builds them. This migration only prepares the data.
+ *
+ * `isPending` is conservative (§6.2): it reports pending whenever a residual
+ * collision exists that would fail an index build, and once the stages run it
+ * flips to false (no permanent boot block — same lesson as Phase 3). The
+ * comparison folds case (matching the index collation `{ locale:'en',
+ * strength:2 }`) via `$toLower` in the aggregation.
+ */
+// STATUS_DELETED is `4` (models/user.ts). Re-declared locally rather than
+// imported so this migration has no boot-order coupling to the User model
+// factory; the value is part of the v1 data contract and does not change.
+const STATUS_DELETED = 4;
+/**
+ * Find living-user duplicate groups for `field` (`username` | `email`), folding
+ * case so `Sotarok` and `sotarok` collide (mirrors the index collation).
+ * STATUS_DELETED users are excluded — they are handled by `tombstone-deleted`,
+ * not merged. Rows missing the field (e.g. INVITED with no username) are
+ * excluded so the sparse index's exempt rows never form a group.
+ */
+async function findLivingDuplicateGroups(ctx, field) {
+    const users = ctx.db.collection('users');
+    const rows = await users
+        .aggregate([
+        { $match: { status: { $ne: STATUS_DELETED }, [field]: { $type: 'string', $ne: '' } } },
+        { $group: { _id: { $toLower: `$${field}` }, ids: { $push: '$_id' }, n: { $sum: 1 } } },
+        { $match: { n: { $gt: 1 } } },
+    ])
+        .toArray();
+    return rows.map((r) => ({ key: String(r._id), ids: r.ids }));
+}
+/**
+ * Find STATUS_DELETED users whose stored username/email is NOT already the
+ * tombstone form for their id — i.e. legacy deleted rows that still hold a real
+ * identity which could collide a living user on index build. Returns their ids.
+ */
+async function findUntombstonedDeleted(ctx) {
+    const users = ctx.db.collection('users');
+    const rows = await users.find({ status: STATUS_DELETED }).project({ _id: 1, username: 1, email: 1 }).toArray();
+    const out = [];
+    for (const row of rows) {
+        const id = row._id;
+        const expectedEmail = `deleted-${id.toString()}@deleted.invalid`;
+        const expectedUsername = `deleted-${id.toString()}`;
+        const email = row.email;
+        const username = row.username;
+        if (email !== expectedEmail || (username != null && username !== expectedUsername)) {
+            out.push(id);
+        }
+    }
+    return out;
+}
+/**
+ * True iff the not-yet-tombstoned deleted set collides (case-folded) with any
+ * living user — the only deleted-side condition that fails an index build. A
+ * deleted row whose identity is unique among living + other deleted rows would
+ * not fail the build, so we report pending only when a real collision exists
+ * (conservative but not over-eager).
+ */
+async function deletedCollidesWithLiving(ctx) {
+    const users = ctx.db.collection('users');
+    // For each field, group by lowercased value across ALL users (living +
+    // deleted) and look for a group that mixes a deleted row with a living one.
+    for (const field of ['email', 'username']) {
+        const rows = await users
+            .aggregate([
+            { $match: { [field]: { $type: 'string', $ne: '' } } },
+            {
+                $group: {
+                    _id: { $toLower: `$${field}` },
+                    living: { $sum: { $cond: [{ $ne: ['$status', STATUS_DELETED] }, 1, 0] } },
+                    deleted: { $sum: { $cond: [{ $eq: ['$status', STATUS_DELETED] }, 1, 0] } },
+                },
+            },
+            { $match: { living: { $gte: 1 }, deleted: { $gte: 1 } } },
+            { $limit: 1 },
+        ])
+            .toArray();
+        if (rows.length > 0)
+            return true;
+    }
+    return false;
+}
+exports.userUniquePrepare = (0, types_1.defineMigration)({
+    id: 'user-unique-prepare',
+    fromVersion: '1.x',
+    toVersion: '2.0',
+    layer: 'preflight',
+    description: 'Deduplicate users (unique index via autoIndex)',
+    /**
+     * Pending iff a plain unique index build would fail E11000. Two residual
+     * conditions (both folded to the index collation):
+     *
+     *   - a living-vs-living duplicate on username or email, or
+     *   - a not-yet-tombstoned DELETED user colliding with a living user.
+     *
+     * Conservative (§6.2): once `dedup-*` + `tombstone-deleted` run, every group
+     * is resolved and this returns false, so boot under preflight+block clears
+     * (no permanent block). Short-circuits at the first collision found.
+     */
+    isPending: async (ctx) => {
+        const usernameDupes = await findLivingDuplicateGroups(ctx, 'username');
+        if (usernameDupes.length > 0)
+            return true;
+        const emailDupes = await findLivingDuplicateGroups(ctx, 'email');
+        if (emailDupes.length > 0)
+            return true;
+        return deletedCollidesWithLiving(ctx);
+    },
+    /** Full-scan report for `plan`: duplicate group counts + tombstone targets. */
+    detect: async (ctx) => {
+        const usernameDupes = await findLivingDuplicateGroups(ctx, 'username');
+        const emailDupes = await findLivingDuplicateGroups(ctx, 'email');
+        const tombstoneTargets = await findUntombstonedDeleted(ctx);
+        return {
+            summary: `${usernameDupes.length} duplicate username group(s), ${emailDupes.length} duplicate email group(s), ${tombstoneTargets.length} deleted user(s) to tombstone`,
+            counts: {
+                usernameGroups: usernameDupes.length,
+                emailGroups: emailDupes.length,
+                tombstoneTargets: tombstoneTargets.length,
+            },
+        };
+    },
+    stages: [
+        {
+            name: 'dedup-username',
+            fn: async (ctx) => {
+                const groups = await findLivingDuplicateGroups(ctx, 'username');
+                const mergeGroups = [];
+                for (const group of groups) {
+                    mergeGroups.push(await (0, dedup_users_1.chooseSurvivor)(ctx.db, group.ids));
+                }
+                ctx.progress.setTotal(mergeGroups.length);
+                const result = await (0, dedup_users_1.mergeUserGroups)(ctx.db, mergeGroups, { dryRun: ctx.dryRun, logger: ctx.logger });
+                if (!ctx.dryRun && result.usersRemoved > 0) {
+                    ctx.logger.info(`user-unique-prepare: merged ${result.usersRemoved} duplicate-username user(s) across ${result.groupsMerged} group(s)`);
+                }
+                return {
+                    name: 'dedup-username',
+                    transformed: result.usersRemoved,
+                    stats: { groups: result.groupsMerged, reassigned: result.reassigned, deletedConflicting: result.deletedConflicting },
+                };
+            },
+        },
+        {
+            name: 'dedup-email',
+            fn: async (ctx) => {
+                const groups = await findLivingDuplicateGroups(ctx, 'email');
+                const mergeGroups = [];
+                for (const group of groups) {
+                    mergeGroups.push(await (0, dedup_users_1.chooseSurvivor)(ctx.db, group.ids));
+                }
+                ctx.progress.setTotal(mergeGroups.length);
+                const result = await (0, dedup_users_1.mergeUserGroups)(ctx.db, mergeGroups, { dryRun: ctx.dryRun, logger: ctx.logger });
+                if (!ctx.dryRun && result.usersRemoved > 0) {
+                    ctx.logger.info(`user-unique-prepare: merged ${result.usersRemoved} duplicate-email user(s) across ${result.groupsMerged} group(s)`);
+                }
+                return {
+                    name: 'dedup-email',
+                    transformed: result.usersRemoved,
+                    stats: { groups: result.groupsMerged, reassigned: result.reassigned, deletedConflicting: result.deletedConflicting },
+                };
+            },
+        },
+        {
+            name: 'tombstone-deleted',
+            fn: async (ctx) => {
+                const targets = await findUntombstonedDeleted(ctx);
+                if (ctx.dryRun) {
+                    return { name: 'tombstone-deleted', transformed: 0, stats: { wouldTombstone: targets.length } };
+                }
+                const users = ctx.db.collection('users');
+                ctx.progress.setTotal(targets.length);
+                let tombstoned = 0;
+                for (const id of targets) {
+                    // Same tombstone shape as runtime statusDelete / tombstoneIdentity.
+                    await users.updateOne({ _id: id }, {
+                        $set: { username: `deleted-${id.toString()}`, email: `deleted-${id.toString()}@deleted.invalid` },
+                    });
+                    tombstoned += 1;
+                    ctx.progress.increment();
+                }
+                if (tombstoned > 0) {
+                    ctx.logger.info(`user-unique-prepare: tombstoned ${tombstoned} legacy deleted user(s)`);
+                }
+                return { name: 'tombstone-deleted', transformed: tombstoned };
+            },
+        },
+    ],
+});
+//# sourceMappingURL=user-unique-prepare.js.map

package/dist/migration/migrations/user-unique-prepare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-unique-prepare.js","sourceRoot":"","sources":["../../../src/migration/migrations/user-unique-prepare.ts"],"names":[],"mappings":";;;AAEA,sDAAuE;AAGvE,oCAA2C;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,MAAM,cAAc,GAAG,CAAC,CAAC;AAezB;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CAAC,GAAqB,EAAE,KAA2B;IACzF,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,KAAK;SACrB,SAAS,CAAC;QACT,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE;QACtF,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;QACtF,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE;KAC9B,CAAC;SACD,OAAO,EAAE,CAAC;IACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAE,CAAsB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAG,CAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CAAC,GAAqB;IAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/G,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAI,GAAyB,CAAC,GAAG,CAAC;QAC1C,MAAM,aAAa,GAAG,WAAW,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QACjE,MAAM,gBAAgB,GAAG,WAAW,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACpD,MAAM,KAAK,GAAI,GAA0B,CAAC,KAAK,CAAC;QAChD,MAAM,QAAQ,GAAI,GAA6B,CAAC,QAAQ,CAAC;QACzD,IAAI,KAAK,KAAK,aAAa,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,gBAAgB,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CAAC,GAAqB;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,uEAAuE;IACvE,4EAA4E;IAC5E,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU,CAAU,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,KAAK;aACrB,SAAS,CAAC;YACT,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE;YACrD;gBACE,MAAM,EAAE;oBACN,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,EAAE;oBAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;oBACzE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;iBAC3E;aACF;YACD,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YACzD,EAAE,MAAM,EAAE,CAAC,EAAE;SACd,CAAC;aACD,OAAO,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,iBAAiB,GAAG,IAAA,uBAAe,EAAC;IAC/C,EAAE,EAAE,qBAAqB;IACzB,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,WAAW;IAClB,WAAW,EAAE,gDAAgD;IAE7D;;;;;;;;;;OAUG;IACH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACvE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,+EAA+E;IAC/E,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,iCAAiC,UAAU,CAAC,MAAM,8BAA8B,gBAAgB,CAAC,MAAM,+BAA+B;YACtK,MAAM,EAAE;gBACN,cAAc,EAAE,aAAa,CAAC,MAAM;gBACpC,WAAW,EAAE,UAAU,CAAC,MAAM;gBAC9B,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;aAC1C;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE;QACN;YACE,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBAChE,MAAM,WAAW,GAAiB,EAAE,CAAC;gBACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,WAAW,CAAC,IAAI,CAAC,MAAM,IAAA,4BAAc,EAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;oBAC3C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,MAAM,CAAC,YAAY,sCAAsC,MAAM,CAAC,YAAY,WAAW,CAAC,CAAC;gBAC1I,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE;iBACrH,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,aAAa;YACnB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC7D,MAAM,WAAW,GAAiB,EAAE,CAAC;gBACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,WAAW,CAAC,IAAI,CAAC,MAAM,IAAA,4BAAc,EAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;oBAC3C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,MAAM,CAAC,YAAY,mCAAmC,MAAM,CAAC,YAAY,WAAW,CAAC,CAAC;gBACvI,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE;iBACrH,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClG,CAAC;gBACD,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACzC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACtC,IAAI,UAAU,GAAG,CAAC,CAAC;gBACnB,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;oBACzB,oEAAoE;oBACpE,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,EAA6B,EAAE;wBAC5D,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE;qBAClG,CAAC,CAAC;oBACH,UAAU,IAAI,CAAC,CAAC;oBAChB,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC3B,CAAC;gBACD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;oBACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,UAAU,yBAAyB,CAAC,CAAC;gBAC1F,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAChE,CAAC;SACF;KACF;CACF,CAAC,CAAC"}

package/dist/migration/migrations/wikilink-format.d.ts

@@ -0,0 +1,97 @@
+/**
+ * RFC-0008 §10.2 step 4 / §4.3.1 — `wikilink-format` (preflight layer).
+ *
+ * Ported from the former standalone `crowi-admin migrate --only=wikilink`
+ * (`packages/admin-cli/src/commands/migrate-wikilink.ts`). The migration
+ * rewrites v1 angle-bracket internal links (`</path>` / `</path|alias>`) to
+ * the v2 wikilink form (`[[path]]` / `[[path|alias]]`).
+ *
+ * Why this is a migration (not just a CLI command): the old command called
+ * `Revision.prepareRevision` + `Page.pushRevision` directly, bypassing
+ * `Page.updatePage`. That path never nulls `yjsState` / `yjsCheckpointAt`, so
+ * any user editing a rewritten page stayed pinned to a stale `Y.Doc` and could
+ * silently revert the migration on their next autosave (RFC-0008 §4.3.1
+ * "Motivating bug"). Routing every body rewrite through `ctx.rewritePageBody`
+ * (= the `updatePage`-equivalent path) repoints `currentRevision` and nulls the
+ * Yjs snapshot, so the next `onLoadDocument` rebuilds from the new body. As a
+ * preflight migration this is persistence-only (no live force-reload broadcast):
+ * preflight runs in a maintenance window with no connected editors (§4.3.1).
+ *
+ * The textual conversion logic below is moved verbatim from the old command so
+ * the rewrite output is byte-identical to the legacy migrator.
+ */
+/**
+ * HTML5 element name set used to reject `</foo>` matches whose first path
+ * segment is actually a closing HTML tag. Source:
+ * https://developer.mozilla.org/en-US/docs/Web/HTML/Element — the full
+ * standard element list as of the HTML Living Standard.
+ *
+ * Kept as a top-level `Set<string>` so detection runs O(1) per match.
+ * `h1`..`h6` are listed explicitly because the regex captures `foo` for
+ * `</foo>` and we want both `</h1>` and `</h6>` to be rejected.
+ */
+export declare const KNOWN_HTML_ELEMENTS: ReadonlySet<string>;
+/**
+ * v1 angle-bracket internal link form. The capture group grabs the path-style
+ * payload (starts with `/`, no whitespace, no `<` / `>` / `|` other than the
+ * optional `|alias` segment). See `packages/api/src/util/linkDetector.ts` — v1
+ * used `<(/[^>]+)>` for the same primitive; we tighten it here to:
+ *
+ *   - leading `/` to keep this strictly path-style (not arbitrary text)
+ *   - no whitespace inside the **path** (Crowi page paths cannot contain spaces)
+ *   - no `<` / `>` until the closing `>` and no `|` until the optional alias
+ *   - optional `|alias` (free-form text, no `<` / `>`)
+ *
+ * Detection only — see `shouldRewriteWikilink` for the HTML-element filter.
+ */
+export declare const WIKILINK_DETECTION_REGEX: RegExp;
+/**
+ * True iff `body` contains at least one *genuine* legacy wikilink — i.e. a
+ * `</...>` match that survives the full `shouldRewriteWikilink` HTML-element
+ * filter. `</div>` and other close tags return false.
+ *
+ * `</` is used as a cheap prefilter so bodies that cannot possibly contain a
+ * legacy wikilink skip the regex entirely; the verdict itself is the full
+ * detection rule (not the substring), so a body whose only `</` occurrences are
+ * HTML close tags correctly reports false. Shared by `isPending` (current-
+ * revision verdict) and `collectRewritablePages` (full detect/stage scan) so
+ * the detection logic lives in one place.
+ */
+export declare function bodyHasRewritableWikilink(body: string): boolean;
+/**
+ * Decide whether a detected `</...>` match is a v1 wikilink we should rewrite,
+ * or a coincidental HTML close tag we must leave alone.
+ *
+ * The rule: reject when the **first path segment** (everything between the
+ * leading `/` and the next `/`, `#`, or end-of-payload) is a known HTML element
+ * name (lowercased). Crowi page paths are case-sensitive, so `</Section>` is a
+ * wikilink (page `Section`) while `</section>` is the HTML element.
+ */
+export declare function shouldRewriteWikilink(innerPath: string): boolean;
+/**
+ * Per-body detection result — `occurrences[].raw` preserves the original raw
+ * match (e.g. `</docs/api>`) so a dry-run report can print the exact textual
+ * substring being touched.
+ */
+export interface WikilinkOccurrence {
+    raw: string;
+    path: string;
+    alias?: string;
+}
+/**
+ * Single-pass detect-and-rewrite. Returns the rewritten body together with the
+ * occurrence list so callers don't walk the regex twice. `body` is returned by
+ * reference when nothing changed, letting callers cheap-skip via
+ * `result.body === body`. Pure function — no side effects, no I/O.
+ */
+export declare function rewriteAndDetect(body: string): {
+    body: string;
+    occurrences: WikilinkOccurrence[];
+};
+/**
+ * Convenience wrapper for tests / callers that only need the rewritten body.
+ * The migration hot path uses `rewriteAndDetect` to avoid walking the regex
+ * twice.
+ */
+export declare function rewriteWikilinks(body: string): string;
+export declare const wikilinkFormat: import("../types").MigrationDefinition;