@crowi/api 2.0.0-alpha.1 → 2.0.0-alpha.2

package/dist/mcp/tools/search.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.searchTools = void 0;
+exports.searchTools = exports.mapSearchResult = void 0;
 /**
  * RFC-0011 §8 — search tool catalog.
  *
@@ -10,17 +10,33 @@ exports.searchTools = void 0;
  */
 const api_contract_1 = require("@crowi/api-contract");
 const result_1 = require("../result");
+/**
+ * RFC-0011 §10.7 — a search snippet is a body excerpt = user-generated and
+ * untrusted, so it carries the same injection risk as a full page body. The
+ * path / count / pager around it are server-generated metadata and stay
+ * plain. We fence the snippets (not the whole line) so a single
+ * `wrapUntrusted` notice + nonce covers every snippet in the response while
+ * the structural `- <path>` scaffolding the model needs to act on stays
+ * outside the data region. The `structuredContent.data` array is left raw but
+ * flagged `trust: 'untrusted'` (parallel to `okResultWithBody`'s raw +
+ * flagged `structuredContent.body`).
+ */
 const mapSearchResult = (body) => {
     const env = body;
     const data = env.data ?? [];
+    // One nonce per response (see okResultWithBody): an attacker cannot guess
+    // it, so a forged close tag inside a snippet cannot break out of its fence.
+    const nonce = (0, result_1.generateNonce)();
     const lines = data.map((hit) => {
-        const snippet = typeof hit.snippet === 'string' ? ` — ${hit.snippet.replace(/\s+/g, ' ').trim()}` : '';
-        return `- ${String(hit.path)}${snippet}`;
+        const line = `- ${String(hit.path)}`;
+        const snippet = typeof hit.snippet === 'string' ? hit.snippet.replace(/\s+/g, ' ').trim() : '';
+        return snippet ? `${line} — ${(0, result_1.wrapUntrusted)(snippet, nonce)}` : line;
     });
     const total = env.meta?.total ?? data.length;
     const text = data.length ? `${total} match(es) (showing ${data.length}):\n${lines.join('\n')}` : 'No matching pages.';
-    return (0, result_1.okResult)(text, { data, meta: env.meta });
+    return (0, result_1.okResult)(text, { data, trust: 'untrusted', meta: env.meta });
 };
+exports.mapSearchResult = mapSearchResult;
 exports.searchTools = [
     {
         name: 'crowi_search_pages',
@@ -30,7 +46,7 @@ exports.searchTools = [
         schema: api_contract_1.SearchPagesRequestSchema.shape,
         kind: 'query',
         scope: 'pages:read',
-        resultMapper: mapSearchResult,
+        resultMapper: exports.mapSearchResult,
     },
 ];
 //# sourceMappingURL=search.js.map

package/dist/mcp/tools/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","sourceRoot":"","sources":["../../../src/mcp/tools/search.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,sDAA+D;AAG/D,sCAAqC;AAIrC,MAAM,eAAe,GAAG,CAAC,IAAa,EAAE,EAAE;IACxC,MAAM,GAAG,GAAG,IAA2C,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAI,GAAG,CAAC,IAAuC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,uBAAuB,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACtH,OAAO,IAAA,iBAAQ,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC;AAEW,QAAA,WAAW,GAAqB;IAC3C;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,yKAAyK;QAC3K,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,uCAAwB,CAAC,KAAK;QACtC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,YAAY;QACnB,YAAY,EAAE,eAAe;KAC9B;CACF,CAAC"}
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../../src/mcp/tools/search.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,sDAA+D;AAC/D,sCAAmE;AAKnE;;;;;;;;;;GAUG;AACI,MAAM,eAAe,GAAG,CAAC,IAAa,EAAE,EAAE;IAC/C,MAAM,GAAG,GAAG,IAA2C,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,IAAA,sBAAa,GAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,IAAA,sBAAa,EAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAI,GAAG,CAAC,IAAuC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,uBAAuB,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACtH,OAAO,IAAA,iBAAQ,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC,CAAC;AAdW,QAAA,eAAe,mBAc1B;AAEW,QAAA,WAAW,GAAqB;IAC3C;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,yKAAyK;QAC3K,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,uCAAwB,CAAC,KAAK;QACtC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,YAAY;QACnB,YAAY,EAAE,uBAAe;KAC9B;CACF,CAAC"}

package/dist/migration/helpers.d.ts

@@ -0,0 +1,13 @@
+import type { MigrationContext } from './types';
+/**
+ * Resolve the user id to credit a preflight migration's body rewrites to:
+ *   1. `CROWI_MIGRATE_USER=<email>` if set,
+ *   2. otherwise the oldest admin (`{ admin: true }` by `createdAt`).
+ *
+ * Throws with `migrationName` in the message when neither yields a user, so the
+ * operator sees which migration tripped instead of a per-page `user should have
+ * _id` failure deep inside the rewrite. Used by every preflight migration that
+ * pushes new revisions on the operator's behalf (`wikilink-format`,
+ * `files-url-to-attachments`, …).
+ */
+export declare function resolveActingUserId(ctx: MigrationContext, migrationName: string): Promise<string>;

package/dist/migration/helpers.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveActingUserId = resolveActingUserId;
+/**
+ * Resolve the user id to credit a preflight migration's body rewrites to:
+ *   1. `CROWI_MIGRATE_USER=<email>` if set,
+ *   2. otherwise the oldest admin (`{ admin: true }` by `createdAt`).
+ *
+ * Throws with `migrationName` in the message when neither yields a user, so the
+ * operator sees which migration tripped instead of a per-page `user should have
+ * _id` failure deep inside the rewrite. Used by every preflight migration that
+ * pushes new revisions on the operator's behalf (`wikilink-format`,
+ * `files-url-to-attachments`, …).
+ */
+async function resolveActingUserId(ctx, migrationName) {
+    const User = ctx.crowi.model('User');
+    const explicit = process.env.CROWI_MIGRATE_USER;
+    if (explicit) {
+        const named = await User.findOne({ email: explicit }).select('_id').lean().exec();
+        if (named)
+            return String(named._id);
+        throw new Error(`CROWI_MIGRATE_USER='${explicit}' but no user with that email exists.`);
+    }
+    const admin = await User.findOne({ admin: true }).sort({ createdAt: 1 }).select('_id').lean().exec();
+    if (admin)
+        return String(admin._id);
+    throw new Error(`${migrationName}: no admin user found; set CROWI_MIGRATE_USER=<email> or create an admin user first.`);
+}
+//# sourceMappingURL=helpers.js.map

package/dist/migration/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../src/migration/helpers.ts"],"names":[],"mappings":";;AAaA,kDAWC;AAtBD;;;;;;;;;;GAUG;AACI,KAAK,UAAU,mBAAmB,CAAC,GAAqB,EAAE,aAAqB;IACpF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAClF,IAAI,KAAK;YAAE,OAAO,MAAM,CAAE,KAA0B,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,uCAAuC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACrG,IAAI,KAAK;QAAE,OAAO,MAAM,CAAE,KAA0B,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,sFAAsF,CAAC,CAAC;AAC1H,CAAC"}

package/dist/migration/migrations/files-url-to-attachments.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Per-body breakdown of what a rewrite touched / skipped, returned alongside
+ * the rewritten body so callers walk the regex once.
+ *   - `relative`: rule 1 (relative `/files/<id>`) rewrites.
+ *   - `selfHostAbsolute`: rule 2 (self-host absolute) rewrites.
+ *   - `externalSkipped`: rule 3 (external absolute) left untouched.
+ */
+export interface FilesUrlRewriteCounts {
+    relative: number;
+    selfHostAbsolute: number;
+    externalSkipped: number;
+}
+/**
+ * Single-pass detect-and-rewrite. Returns the rewritten body plus a count
+ * breakdown so callers don't walk the regex twice. Pure — no I/O. Returns
+ * `body` by reference when nothing changed (no rule-1/2 rewrite), letting
+ * callers cheap-skip via `result.body === body`.
+ *
+ * `origins` is the self-host allow-list (`getAppOrigins()`); pass `[]` to
+ * disable rule 2 (CLIENT_URL / BASE_URL unset).
+ */
+export declare function rewriteFilesUrls(body: string, origins: readonly string[]): {
+    body: string;
+    counts: FilesUrlRewriteCounts;
+};
+/**
+ * True iff `body` holds at least one *rewritable* v1 file URL — a relative
+ * `/files/<id>` or a self-host absolute one (external-only bodies report
+ * false). `/files/` is a cheap prefilter so bodies that can't contain one skip
+ * the regex; the verdict itself is the full rule (external skips don't count)
+ * so a body whose only `/files/<id>` is external correctly reports false.
+ * Shared by `isPending` and `collectRewritablePages`.
+ */
+export declare function bodyHasRewritableFilesUrl(body: string, origins: readonly string[]): boolean;
+export declare const filesUrlToAttachments: import("../types").MigrationDefinition;

package/dist/migration/migrations/files-url-to-attachments.js

@@ -0,0 +1,291 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.filesUrlToAttachments = void 0;
+exports.rewriteFilesUrls = rewriteFilesUrls;
+exports.bodyHasRewritableFilesUrl = bodyHasRewritableFilesUrl;
+const linkDetector_1 = __importDefault(require("../../util/linkDetector"));
+const page_1 = require("../../models/page");
+const helpers_1 = require("../helpers");
+const types_1 = require("../types");
+/**
+ * v1 → v2 — `files-url-to-attachments` (preflight layer).
+ *
+ * v1 embedded attachment / image references in page bodies as the v1 file
+ * URL `/files/<24hex>` (absolute `https://<host>/files/<id>` when the editor
+ * pasted a full URL, or relative `/files/<id>`). v2 serves attachments from a
+ * dedicated stream route at `/api/v2/attachments/<id>` and the legacy
+ * `/files/<id>` compat redirect was removed with the Express host (RFC-0006
+ * Phase 6 Sub-batch D), so those v1 URLs now 404 — every such image is
+ * broken. The id is identical in both forms (the same 24-hex `Attachment._id`;
+ * `attachment.ts` `ATTACHMENT_URI_RE` extracts the same id from either), so the
+ * fix is a pure URL rewrite — no id mapping.
+ *
+ * Modelled on `wikilink-format.ts` (the sibling v1→v2 body-rewrite preflight):
+ * walk published (+ legacy `null`) pages, rewrite each current-revision body
+ * with a single-pass detect-and-rewrite, route every write through
+ * `ctx.rewritePageBody` (the `updatePage`-equivalent path that nulls
+ * `yjsState` / `yjsCheckpointAt` so an active editor can't revert the rewrite
+ * from a stale `Y.Doc` — see wikilink-format §4.3.1), and use a cheap
+ * substring prefilter (`/files/`) before the detail regex in `isPending`.
+ *
+ * Rewrite rules (Markdown `![alt](url)` images and `[text](url)` links only —
+ * raw HTML `<img src>` / `<a href>` is out of scope; v1 emitted Markdown):
+ *
+ *   1. relative `/files/<id>`                  → `/api/v2/attachments/<id>`
+ *      (unconditional — a root-relative path is always this site).
+ *   2. self-host absolute `https://<origin>/files/<id>`
+ *                                              → `/api/v2/attachments/<id>`
+ *      (relativised — drops the host so the URL is portable). `<origin>` must
+ *      match `linkDetector.getAppOrigins()` (CLIENT_URL / BASE_URL).
+ *   3. external absolute `https://other/files/<id>` → left untouched
+ *      (we must not rewrite an unrelated third-party `/files/<id>` image).
+ *
+ * Host moves (v1 domain ≠ v2 domain) are out of scope: the separate `replace
+ * url` admin-cli command rewrites the old host → new host first, after which
+ * the self-host absolute URLs match CLIENT_URL and rule 2 relativises them.
+ *
+ * Idempotent: the output `/api/v2/attachments/<id>` never matches the
+ * `/files/` regex, so a re-apply is a no-op (no double rewrite).
+ *
+ * CLIENT_URL / BASE_URL unset: `getAppOrigins()` returns `[]`, so the
+ * self-host alternation is empty and rule 2 is skipped — only relative
+ * `/files/<id>` (rule 1) is rewritten and absolute URLs are left alone.
+ */
+/** v2 attachment URL prefix the rewrite targets. */
+const V2_ATTACHMENT_PREFIX = '/api/v2/attachments/';
+/**
+ * Substring that necessarily precedes every rewritable v1 file URL: `/files/`.
+ * Cheapest probe guaranteed present whenever a real `/files/<id>` reference
+ * exists, so a body without it can skip the regex entirely (no false
+ * negatives). The actual verdict still applies the full detect rule — see
+ * `bodyHasRewritableFilesUrl`.
+ */
+const FILES_SUBSTRING_PROBE = '/files/';
+const emptyCounts = () => ({ relative: 0, selfHostAbsolute: 0, externalSkipped: 0 });
+/**
+ * Build the per-body rewrite regex. It matches a Markdown image/link whose URL
+ * payload points at `/files/<24hex>` in one of two forms:
+ *
+ *   - relative: the URL part starts with `/files/<id>`
+ *   - absolute: the URL part is `<scheme>://<host>.../files/<id>`
+ *
+ * The `![alt]` / `[text]` head and the trailing path/query/fragment after the
+ * id are captured verbatim and re-emitted unchanged; only the host + `/files/`
+ * → `/api/v2/attachments/` portion is rewritten. Self-host classification of
+ * absolute URLs is decided in the callback (not the regex) so external hosts
+ * fall through untouched.
+ *
+ * A fresh `RegExp` per call keeps `lastIndex` state local (the regex is `g`).
+ */
+function buildFilesUrlRegex() {
+    // Group layout:
+    //   1: the markdown head `![alt]` or `[text]` (incl. the leading `!` if image)
+    //   2: optional `<scheme>://<host>` for an absolute URL (undefined when relative)
+    //   3: the 24-hex attachment id
+    //   4: the trailing remainder inside the parens after the id (path/query/#),
+    //      excluding the closing `)` and whitespace
+    return /(!?\[[^\]]*\])\((https?:\/\/[^\s)/]+)?\/files\/([0-9a-fA-F]{24})([^\s)]*)\)/g;
+}
+/**
+ * Decide whether an absolute URL's `<scheme>://<host>` prefix belongs to this
+ * Crowi instance. `origins` are the normalised `getAppOrigins()` values
+ * (trailing slash trimmed). A match means the URL is self-host and should be
+ * relativised (rule 2); a non-match is external and left untouched (rule 3).
+ *
+ * The match is exact against the captured `<scheme>://<host>` (no path), so
+ * `https://wiki.example.com` matches origin `https://wiki.example.com` but not
+ * `https://evil.example.com`.
+ */
+function isSelfHostOrigin(schemeAndHost, origins) {
+    return origins.includes(schemeAndHost);
+}
+/**
+ * Single-pass detect-and-rewrite. Returns the rewritten body plus a count
+ * breakdown so callers don't walk the regex twice. Pure — no I/O. Returns
+ * `body` by reference when nothing changed (no rule-1/2 rewrite), letting
+ * callers cheap-skip via `result.body === body`.
+ *
+ * `origins` is the self-host allow-list (`getAppOrigins()`); pass `[]` to
+ * disable rule 2 (CLIENT_URL / BASE_URL unset).
+ */
+function rewriteFilesUrls(body, origins) {
+    const counts = emptyCounts();
+    const rewritten = body.replace(buildFilesUrlRegex(), (whole, head, schemeAndHost, id, rest) => {
+        if (schemeAndHost === undefined) {
+            // Rule 1 — relative `/files/<id>` is unconditionally this site.
+            counts.relative += 1;
+            return `${head}(${V2_ATTACHMENT_PREFIX}${id}${rest})`;
+        }
+        if (isSelfHostOrigin(schemeAndHost, origins)) {
+            // Rule 2 — self-host absolute URL; relativise (drop the host).
+            counts.selfHostAbsolute += 1;
+            return `${head}(${V2_ATTACHMENT_PREFIX}${id}${rest})`;
+        }
+        // Rule 3 — external host; leave untouched.
+        counts.externalSkipped += 1;
+        return whole;
+    });
+    const changed = counts.relative > 0 || counts.selfHostAbsolute > 0;
+    return { body: changed ? rewritten : body, counts };
+}
+/**
+ * True iff `body` holds at least one *rewritable* v1 file URL — a relative
+ * `/files/<id>` or a self-host absolute one (external-only bodies report
+ * false). `/files/` is a cheap prefilter so bodies that can't contain one skip
+ * the regex; the verdict itself is the full rule (external skips don't count)
+ * so a body whose only `/files/<id>` is external correctly reports false.
+ * Shared by `isPending` and `collectRewritablePages`.
+ */
+function bodyHasRewritableFilesUrl(body, origins) {
+    if (!body.includes(FILES_SUBSTRING_PROBE))
+        return false;
+    const { counts } = rewriteFilesUrls(body, origins);
+    return counts.relative > 0 || counts.selfHostAbsolute > 0;
+}
+/**
+ * The self-host origins for the current instance, via the same
+ * `linkDetector.getAppOrigins()` helper backlink classification uses
+ * (CLIENT_URL + BASE_URL, trailing slash trimmed, deduped). Returns `[]` when
+ * neither is configured — rule 2 is then disabled (relative-only rewrite).
+ */
+function resolveAppOrigins(ctx) {
+    return (0, linkDetector_1.default)(ctx.crowi).getAppOrigins();
+}
+/**
+ * One full scan of every published (+ legacy `null`) page (trash & deprecated
+ * are read-only fixtures — same scope as `wikilink-format`). Returns:
+ *   - `rewritable`: the pages that actually change (≥1 relative / self-host
+ *     rewrite), each with its rewritten body for `ctx.rewritePageBody`.
+ *   - `totals`: the rewrite breakdown aggregated across **every** page with a
+ *     `/files/` reference (so `externalSkipped` reflects external URLs even on
+ *     pages with no rewritable URL — an operator signal for "why some /files/
+ *     references remain").
+ * Stream-walks so memory stays constant on large installs.
+ */
+async function scanFilesUrls(ctx, origins) {
+    const Page = ctx.crowi.model('Page');
+    const Revision = ctx.crowi.model('Revision');
+    const rewritable = [];
+    const totals = emptyCounts();
+    const cursor = Page.find({ $or: [{ status: page_1.STATUS_PUBLISHED }, { status: null }] })
+        .select('_id revision')
+        .lean()
+        .cursor();
+    for await (const page of cursor) {
+        const pageDoc = page;
+        if (!pageDoc.revision)
+            continue;
+        const revision = await Revision.findById(pageDoc.revision).select('body').lean().exec();
+        const body = revision?.body;
+        if (typeof body !== 'string')
+            continue;
+        if (!body.includes(FILES_SUBSTRING_PROBE))
+            continue;
+        const result = rewriteFilesUrls(body, origins);
+        totals.relative += result.counts.relative;
+        totals.selfHostAbsolute += result.counts.selfHostAbsolute;
+        totals.externalSkipped += result.counts.externalSkipped;
+        if (result.body === body)
+            continue;
+        rewritable.push({ pageId: String(pageDoc._id), newBody: result.body, counts: result.counts });
+    }
+    return { rewritable, totals };
+}
+exports.filesUrlToAttachments = (0, types_1.defineMigration)({
+    id: 'files-url-to-attachments',
+    fromVersion: '1.x',
+    toVersion: '2.1',
+    layer: 'preflight',
+    description: 'Rewrite v1 /files/<id> attachment URLs to v2 /api/v2/attachments/<id>',
+    /**
+     * Pending verdict = at least one published page whose **current** revision
+     * body still contains a rewritable v1 file URL. Mirrors `wikilink-format`:
+     *
+     *  1. The verdict uses the **full rule** (`bodyHasRewritableFilesUrl`), not
+     *     the bare substring. `/files/` could appear in an external URL we leave
+     *     alone (rule 3); counting that would report pending forever after apply
+     *     (apply only rewrites self URLs), deadlocking boot under preflight +
+     *     `block`. The full rule reports false once only external `/files/`
+     *     references remain, so boot clears.
+     *  2. We scan only each page's **current** revision, never the whole
+     *     `revisions` collection — historical revisions keep their original
+     *     `/files/<id>` text forever (immutable), so a collection-wide scan
+     *     would pend permanently after any such page ever existed.
+     *
+     * Short-circuits at the first rewritable page.
+     */
+    isPending: async (ctx) => {
+        const origins = resolveAppOrigins(ctx);
+        const Page = ctx.crowi.model('Page');
+        const Revision = ctx.crowi.model('Revision');
+        const cursor = Page.find({ $or: [{ status: page_1.STATUS_PUBLISHED }, { status: null }] })
+            .select('_id revision')
+            .lean()
+            .cursor();
+        for await (const page of cursor) {
+            const revisionId = page.revision;
+            if (!revisionId)
+                continue;
+            const revision = await Revision.findById(revisionId).select('body').lean().exec();
+            const body = revision?.body;
+            if (typeof body === 'string' && bodyHasRewritableFilesUrl(body, origins)) {
+                await cursor.close();
+                return true;
+            }
+        }
+        return false;
+    },
+    /**
+     * Full scan for `plan`: affected page count plus the rewrite breakdown
+     * (relative / self-host absolute rewrites + external skips, the last
+     * aggregated across every `/files/` page — see `scanFilesUrls`). Not called
+     * at boot.
+     */
+    detect: async (ctx) => {
+        const origins = resolveAppOrigins(ctx);
+        const { rewritable, totals } = await scanFilesUrls(ctx, origins);
+        const rewrites = totals.relative + totals.selfHostAbsolute;
+        return {
+            summary: `${rewritable.length} page(s) need a v1 /files/<id> rewrite (${rewrites} rewrite(s): ${totals.relative} relative, ${totals.selfHostAbsolute} self-host absolute; ${totals.externalSkipped} external skipped)`,
+            counts: {
+                pages: rewritable.length,
+                rewrites,
+                relative: totals.relative,
+                selfHostAbsolute: totals.selfHostAbsolute,
+                externalSkipped: totals.externalSkipped,
+            },
+        };
+    },
+    stages: [
+        {
+            name: 'rewrite-files-url',
+            fn: async (ctx) => {
+                const origins = resolveAppOrigins(ctx);
+                if (ctx.dryRun) {
+                    const { rewritable } = await scanFilesUrls(ctx, origins);
+                    return { name: 'rewrite-files-url', transformed: 0, stats: { wouldRewrite: rewritable.length } };
+                }
+                const actingUserId = await (0, helpers_1.resolveActingUserId)(ctx, 'files-url-to-attachments');
+                const { rewritable: pages } = await scanFilesUrls(ctx, origins);
+                ctx.progress.setTotal(pages.length);
+                let rewritten = 0;
+                // Serial walk through `ctx.rewritePageBody` (each call re-fetches the
+                // live page, prepares a revision, and pushes it via the updatePage
+                // path so yjsState / yjsCheckpointAt are nulled).
+                for (const page of pages) {
+                    await ctx.rewritePageBody(page.pageId, page.newBody, { userId: actingUserId });
+                    rewritten += 1;
+                    ctx.progress.increment();
+                }
+                if (rewritten > 0) {
+                    ctx.logger.info(`files-url-to-attachments: rewrote ${rewritten} page(s) via the updatePage path (yjsState invalidated)`);
+                }
+                return { name: 'rewrite-files-url', transformed: rewritten };
+            },
+        },
+    ],
+});
+//# sourceMappingURL=files-url-to-attachments.js.map

package/dist/migration/migrations/files-url-to-attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files-url-to-attachments.js","sourceRoot":"","sources":["../../../src/migration/migrations/files-url-to-attachments.ts"],"names":[],"mappings":";;;;;;AA+HA,4CAmBC;AAUD,8DAIC;AAhKD,yEAAwD;AACxD,0CAAmD;AAEnD,wCAAiD;AACjD,oCAA2C;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,oDAAoD;AACpD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAexC,MAAM,WAAW,GAAG,GAA0B,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;AAE5G;;;;;;;;;;;;;;GAcG;AACH,SAAS,kBAAkB;IACzB,gBAAgB;IAChB,+EAA+E;IAC/E,kFAAkF;IAClF,gCAAgC;IAChC,6EAA6E;IAC7E,gDAAgD;IAChD,OAAO,8EAA8E,CAAC;AACxF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,aAAqB,EAAE,OAA0B;IACzE,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAAC,IAAY,EAAE,OAA0B;IACvE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,aAAiC,EAAE,EAAU,EAAE,IAAY,EAAE,EAAE;QACxI,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,gEAAgE;YAChE,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACrB,OAAO,GAAG,IAAI,IAAI,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC;QACxD,CAAC;QACD,IAAI,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7C,+DAA+D;YAC/D,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC;YAC7B,OAAO,GAAG,IAAI,IAAI,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC;QACxD,CAAC;QACD,2CAA2C;QAC3C,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,IAAY,EAAE,OAA0B;IAChF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAqB;IAC9C,OAAO,IAAA,sBAAmB,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;AACxD,CAAC;AAoBD;;;;;;;;;;GAUG;AACH,KAAK,UAAU,aAAa,CAAC,GAAqB,EAAE,OAA0B;IAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SAChF,MAAM,CAAC,cAAc,CAAC;SACtB,IAAI,EAAE;SACN,MAAM,EAAE,CAAC;IAEZ,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAA4C,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,SAAS;QAChC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxF,MAAM,IAAI,GAAI,QAAsC,EAAE,IAAI,CAAC;QAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC1C,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC1D,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QACxD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QACnC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAEY,QAAA,qBAAqB,GAAG,IAAA,uBAAe,EAAC;IACnD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,WAAW;IAClB,WAAW,EAAE,uEAAuE;IAEpF;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;aAChF,MAAM,CAAC,cAAc,CAAC;aACtB,IAAI,EAAE;aACN,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAChC,MAAM,UAAU,GAAI,IAA+B,CAAC,QAAQ,CAAC;YAC7D,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAClF,MAAM,IAAI,GAAI,QAAsC,EAAE,IAAI,CAAC;YAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC3D,OAAO;YACL,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,2CAA2C,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,gBAAgB,wBAAwB,MAAM,CAAC,eAAe,oBAAoB;YACtN,MAAM,EAAE;gBACN,KAAK,EAAE,UAAU,CAAC,MAAM;gBACxB,QAAQ;gBACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE;QACN;YACE,IAAI,EAAE,mBAAmB;YACzB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBACzD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnG,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAA,6BAAmB,EAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;gBAChF,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAChE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAEpC,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,sEAAsE;gBACtE,mEAAmE;gBACnE,kDAAkD;gBAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC/E,SAAS,IAAI,CAAC,CAAC;oBACf,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC3B,CAAC;gBAED,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBAClB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,yDAAyD,CAAC,CAAC;gBAC3H,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;YAC/D,CAAC;SACF;KACF;CACF,CAAC,CAAC"}

package/dist/migration/migrations/index.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.allMigrations = void 0;
+const files_url_to_attachments_1 = require("./files-url-to-attachments");
 const page_status_default_1 = require("./page-status-default");
 const relocate_reserved_api_paths_1 = require("./relocate-reserved-api-paths");
 const revisions_schema_unify_1 = require("./revisions-schema-unify");
 const user_unique_prepare_1 = require("./user-unique-prepare");
 const wikilink_format_1 = require("./wikilink-format");
+const wikilink_html_recover_1 = require("./wikilink-html-recover");
 /**
  * RFC-0008 §5.5 — the migration barrel.
  *
@@ -22,5 +24,7 @@ exports.allMigrations = [
     user_unique_prepare_1.userUniquePrepare, // phase 5 (preflight)
     revisions_schema_unify_1.revisionsSchemaUnify, // phase 6 (boot — RFC-classified preflight, see migration JSDoc)
     relocate_reserved_api_paths_1.relocateReservedApiPaths, // fix/mcp-endpoint (preflight) — v2 /api namespace reservation
+    files_url_to_attachments_1.filesUrlToAttachments, // feature-migration-files-url-rewrite (preflight) — v1 /files/<id> body rewrite (independent regex from wikilink-format/html-tag-fixes)
+    wikilink_html_recover_1.wikilinkHtmlRecover, // migration-html-tag-fixes (preflight) — recover </font> etc. corrupted by wikilink-format
 ];
 //# sourceMappingURL=index.js.map

package/dist/migration/migrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migration/migrations/index.ts"],"names":[],"mappings":";;;AACA,+DAA0D;AAC1D,+EAAyE;AACzE,qEAAgE;AAChE,+DAA0D;AAC1D,uDAAmD;AAEnD;;;;;;;;;GASG;AACU,QAAA,aAAa,GAA0B;IAClD,uCAAiB,EAAE,iBAAiB;IACpC,gCAAc,EAAE,sBAAsB;IACtC,uCAAiB,EAAE,sBAAsB;IACzC,6CAAoB,EAAE,iEAAiE;IACvF,sDAAwB,EAAE,+DAA+D;CAC1F,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migration/migrations/index.ts"],"names":[],"mappings":";;;AACA,yEAAmE;AACnE,+DAA0D;AAC1D,+EAAyE;AACzE,qEAAgE;AAChE,+DAA0D;AAC1D,uDAAmD;AACnD,mEAA8D;AAE9D;;;;;;;;;GASG;AACU,QAAA,aAAa,GAA0B;IAClD,uCAAiB,EAAE,iBAAiB;IACpC,gCAAc,EAAE,sBAAsB;IACtC,uCAAiB,EAAE,sBAAsB;IACzC,6CAAoB,EAAE,iEAAiE;IACvF,sDAAwB,EAAE,+DAA+D;IACzF,gDAAqB,EAAE,wIAAwI;IAC/J,2CAAmB,EAAE,2FAA2F;CACjH,CAAC"}

package/dist/migration/migrations/published-current-revision.d.ts

@@ -0,0 +1,47 @@
+import type { MigrationContext } from '../types';
+/**
+ * Shared "walk every published page's current revision" helper for the
+ * preflight migrations that have to project a revision field (no index on
+ * `meta.toc.text` / `revision.body`, so an index-backed O(1) probe is
+ * impossible — matches `wikilink-format`'s accepted tradeoff). It exists so the
+ * walk skeleton + the page→revision pairing are defined once and cannot drift
+ * between `isPending` (early-stop verdict) and `detect`/stage (full scan).
+ *
+ * Streaming + batching:
+ *   - streams the published-page collection projecting only `_id revision`
+ *     (`status: published` or legacy `null`, treated as published — trash /
+ *     deprecated pages are read-only fixtures and out of scope), and
+ *   - batch-fetches the paired current revisions with a single
+ *     `Revision.find({ _id: { $in: batch } })` per `batchSize` pages instead of
+ *     one `findById` per page (eliminates the per-page N+1).
+ *
+ * Early stop: `visit` may return `STOP` to abort the walk at the first hit, so
+ * `isPending` can short-circuit without reading every page.
+ *
+ * NOTE: `wikilink-format` predates this helper and keeps its own copy on
+ * purpose (its tests pin the existing walk); it can adopt this later.
+ */
+/** Sentinel a `visit` callback returns to abort the walk early. */
+export declare const STOP: unique symbol;
+/** A current revision, with the `select(projection)` fields plus its page. */
+export interface RevisionVisit {
+    /** The projected revision fields (`select`-ed by `projection`). */
+    revision: Record<string, unknown>;
+    /** The owning page's `_id`, as a string. */
+    pageId: string;
+}
+export interface WalkOptions {
+    /**
+     * Mongoose `.select(...)` projection string for the revision fetch
+     * (e.g. `'meta.toc'`, `'body'`). `_id` is always available on the result.
+     */
+    projection: string;
+    /** Pages per `$in` revision batch. Defaults to 200. */
+    batchSize?: number;
+}
+/**
+ * Stream published pages, batch-fetch their current revisions with the given
+ * projection, and invoke `visit(revision)` for each. Returning `STOP` from
+ * `visit` aborts the walk immediately.
+ */
+export declare function forEachPublishedCurrentRevision(ctx: MigrationContext, options: WalkOptions, visit: (entry: RevisionVisit) => typeof STOP | void | Promise<typeof STOP | void>): Promise<void>;

package/dist/migration/migrations/published-current-revision.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STOP = void 0;
+exports.forEachPublishedCurrentRevision = forEachPublishedCurrentRevision;
+const page_1 = require("../../models/page");
+/**
+ * Shared "walk every published page's current revision" helper for the
+ * preflight migrations that have to project a revision field (no index on
+ * `meta.toc.text` / `revision.body`, so an index-backed O(1) probe is
+ * impossible — matches `wikilink-format`'s accepted tradeoff). It exists so the
+ * walk skeleton + the page→revision pairing are defined once and cannot drift
+ * between `isPending` (early-stop verdict) and `detect`/stage (full scan).
+ *
+ * Streaming + batching:
+ *   - streams the published-page collection projecting only `_id revision`
+ *     (`status: published` or legacy `null`, treated as published — trash /
+ *     deprecated pages are read-only fixtures and out of scope), and
+ *   - batch-fetches the paired current revisions with a single
+ *     `Revision.find({ _id: { $in: batch } })` per `batchSize` pages instead of
+ *     one `findById` per page (eliminates the per-page N+1).
+ *
+ * Early stop: `visit` may return `STOP` to abort the walk at the first hit, so
+ * `isPending` can short-circuit without reading every page.
+ *
+ * NOTE: `wikilink-format` predates this helper and keeps its own copy on
+ * purpose (its tests pin the existing walk); it can adopt this later.
+ */
+/** Sentinel a `visit` callback returns to abort the walk early. */
+exports.STOP = Symbol('stop-walk');
+const DEFAULT_BATCH_SIZE = 200;
+/**
+ * Stream published pages, batch-fetch their current revisions with the given
+ * projection, and invoke `visit(revision)` for each. Returning `STOP` from
+ * `visit` aborts the walk immediately.
+ */
+async function forEachPublishedCurrentRevision(ctx, options, visit) {
+    const Page = ctx.crowi.model('Page');
+    const Revision = ctx.crowi.model('Revision');
+    const projection = options.projection;
+    const batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
+    const cursor = Page.find({ $or: [{ status: page_1.STATUS_PUBLISHED }, { status: null }] })
+        .select('_id revision')
+        .lean()
+        .cursor();
+    // Buffer of pages whose current revision still needs fetching.
+    let batch = [];
+    // Fetch the batch's revisions in one `$in` round-trip and pair each back to
+    // its page (preserving page order). Returns STOP if `visit` asked to abort.
+    const flush = async () => {
+        if (batch.length === 0)
+            return;
+        const ids = batch.map((p) => p.revision);
+        const revisions = await Revision.find({ _id: { $in: ids } })
+            .select(projection)
+            .lean()
+            .exec();
+        const byId = new Map();
+        for (const rev of revisions) {
+            if (rev?._id != null)
+                byId.set(String(rev._id), rev);
+        }
+        const pages = batch;
+        batch = [];
+        for (const page of pages) {
+            const revision = byId.get(String(page.revision));
+            if (!revision)
+                continue;
+            const result = await visit({ revision, pageId: String(page._id) });
+            if (result === exports.STOP)
+                return exports.STOP;
+        }
+    };
+    try {
+        for await (const raw of cursor) {
+            const page = raw;
+            if (!page.revision)
+                continue;
+            batch.push(page);
+            if (batch.length >= batchSize) {
+                if ((await flush()) === exports.STOP)
+                    return;
+            }
+        }
+        await flush();
+    }
+    finally {
+        await cursor.close();
+    }
+}
+//# sourceMappingURL=published-current-revision.js.map

package/dist/migration/migrations/published-current-revision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"published-current-revision.js","sourceRoot":"","sources":["../../../src/migration/migrations/published-current-revision.ts"],"names":[],"mappings":";;;AA4DA,0EAsDC;AAlHD,0CAAmD;AAGnD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,mEAAmE;AACtD,QAAA,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;AA0BxC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;GAIG;AACI,KAAK,UAAU,+BAA+B,CACnD,GAAqB,EACrB,OAAoB,EACpB,KAAiF;IAEjF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SAChF,MAAM,CAAC,cAAc,CAAC;SACtB,IAAI,EAAE;SACN,MAAM,EAAE,CAAC;IAEZ,+DAA+D;IAC/D,IAAI,KAAK,GAAc,EAAE,CAAC;IAE1B,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,KAAK,IAAiC,EAAE;QACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;aACzD,MAAM,CAAC,UAAU,CAAC;aAClB,IAAI,EAAE;aACN,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,SAAgC,EAAE,CAAC;YACnD,IAAI,GAAG,EAAE,GAAG,IAAI,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAA8B,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC;QACpB,KAAK,GAAG,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,MAAM,KAAK,YAAI;gBAAE,OAAO,YAAI,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,GAAc,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,KAAK,YAAI;oBAAE,OAAO;YACvC,CAAC;QACH,CAAC;QACD,MAAM,KAAK,EAAE,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/migration/migrations/wikilink-format.d.ts

@@ -20,17 +20,6 @@
  * The textual conversion logic below is moved verbatim from the old command so
  * the rewrite output is byte-identical to the legacy migrator.
  */
-/**
- * HTML5 element name set used to reject `</foo>` matches whose first path
- * segment is actually a closing HTML tag. Source:
- * https://developer.mozilla.org/en-US/docs/Web/HTML/Element — the full
- * standard element list as of the HTML Living Standard.
- *
- * Kept as a top-level `Set<string>` so detection runs O(1) per match.
- * `h1`..`h6` are listed explicitly because the regex captures `foo` for
- * `</foo>` and we want both `</h1>` and `</h6>` to be rejected.
- */
-export declare const KNOWN_HTML_ELEMENTS: ReadonlySet<string>;
 /**
  * v1 angle-bracket internal link form. The capture group grabs the path-style
  * payload (starts with `/`, no whitespace, no `<` / `>` / `|` other than the