@crowi/api 2.0.0-alpha.2 → 2.0.0-alpha.3

package/dist/migration/migrations/code-mask.js

@@ -0,0 +1,224 @@
+"use strict";
+/**
+ * Markdown code-region segmentation for the body-rewrite migrations.
+ *
+ * `WIKILINK_DETECTION_REGEX` (and the sibling `files-url` / `html-recover`
+ * probes) scan a page's *raw* body with no Markdown awareness, so `</…>`
+ * tokens written as code examples — inside a ```` ``` ```` fence or `` `…` ``
+ * inline span — get misdetected as v1 wikilinks and rewritten, corrupting the
+ * code (e.g. ```` ```tsx\n</AppShell>\n``` ```` → `[[/AppShell]]`).
+ *
+ * The renderer already solves this at the AST level — `renderer/core/
+ * wikilinks.ts` skips `node.type === 'code' || 'inlineCode'`. The migration
+ * layer cannot import the renderer pipeline (jiti/ESM), so this is a
+ * string-level parallel of that intent: split the body into ordered
+ * `code` / non-`code` segments so callers can run their rewrite **only on
+ * the non-`code` segments** and re-join in original order.
+ *
+ * Why segmentation and NOT a same-length `\x00` fill + slice restore: a fill
+ * pass keeps the body length-invariant, but the rewrite step changes the
+ * length of the *non-code* text, so a positional restore drifts. Worse, three
+ * structural failures cause silent data loss — adjacent code regions whose
+ * fills touch merge into one `/\x00+/g` match (one region is dropped), a
+ * fence-first stash with text-order restore swaps two regions, and a `\x00`
+ * already present in pasted/binary content collides with the sentinel. By
+ * returning an ordered segment list with no restore step, all three are
+ * avoided *by construction*: adjacent regions are distinct segments (no
+ * merge), order is preserved by the list (no swap), and no sentinel is ever
+ * introduced (no collision).
+ *
+ * Coverage: fenced code blocks (CommonMark §4.5, backtick **and** tilde) and
+ * inline code spans (§6.1). Indented code blocks (4-space / 1-tab, §4.4) are
+ * deliberately NOT covered: a flat "4-space line = code" rule over-suppresses
+ * (mdast treats a 4-space paragraph/list continuation line as text/html, i.e.
+ * rewritable), so an indented-code `</…>` token stays rewritable — an accepted
+ * known divergence from the renderer (see the spec's "out of scope").
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.splitCodeSegments = splitCodeSegments;
+exports.rewriteOutsideCode = rewriteOutsideCode;
+/** A fenced-code-block opener: ≥3 backticks or ≥3 tildes with 0–3 leading spaces. */
+const FENCE_OPEN_REGEX = /^( {0,3})(`{3,}|~{3,})/;
+/**
+ * Split `body` into ordered `code` / non-`code` segments.
+ *
+ * Fenced blocks are matched line-by-line (a fence runs to its closing fence of
+ * the same char, ≥ the opening length; an unclosed fence runs to EOF). Within
+ * non-fence text, inline code spans are matched by the CommonMark §6.1 rule: an
+ * opening run of N backticks closed by the next run of *exactly* N backticks.
+ * An unmatched backtick run is left as literal non-code text.
+ *
+ * Pure: no I/O, no mutation of inputs. Concatenating the returned segments'
+ * `text` reproduces `body` byte-for-byte.
+ */
+function splitCodeSegments(body) {
+    const segments = [];
+    // Buffer of pending non-code text; flushed (after inline-span extraction)
+    // whenever a fence boundary or EOF is reached.
+    let pendingText = '';
+    const flushPendingText = () => {
+        if (pendingText.length === 0)
+            return;
+        for (const seg of splitInlineCode(pendingText))
+            segments.push(seg);
+        pendingText = '';
+    };
+    // Walk the body line by line, preserving each line's trailing newline so the
+    // re-join is byte-identical. `lineStart` indexes the current line's first
+    // char in `body`.
+    let lineStart = 0;
+    while (lineStart < body.length) {
+        let lineEnd = body.indexOf('\n', lineStart);
+        if (lineEnd === -1)
+            lineEnd = body.length;
+        else
+            lineEnd += 1; // include the newline
+        const line = body.slice(lineStart, lineEnd);
+        // No `\r?\n` strip on the opener: `FENCE_OPEN_REGEX` is `^`-anchored and
+        // carries no end-of-line pattern, so a trailing newline never affects the
+        // match (unlike the closing-fence test below, where the strip is
+        // load-bearing — see `closeRegex.test(...)`).
+        const fenceMatch = FENCE_OPEN_REGEX.exec(line);
+        if (fenceMatch) {
+            // A fenced code block opens here. Flush text accumulated before it, then
+            // consume lines up to (and including) the matching closing fence or EOF.
+            flushPendingText();
+            // `fenceChar` is exactly one of `` ` `` / `~` because group 2 of
+            // `FENCE_OPEN_REGEX` is `` (`{3,}|~{3,}) ``, so it can be inlined into the
+            // close pattern verbatim (no per-char ternary needed).
+            const fenceChar = fenceMatch[2][0];
+            const fenceLen = fenceMatch[2].length;
+            const closeRegex = new RegExp(`^ {0,3}${fenceChar}{${fenceLen},}[ \\t]*$`);
+            // Consume lines up to (and including) the closing fence; an unclosed
+            // fence runs to EOF. Either way the whole span is one code segment.
+            let fenceText = line;
+            let cursor = lineEnd;
+            while (cursor < body.length) {
+                let nextEnd = body.indexOf('\n', cursor);
+                if (nextEnd === -1)
+                    nextEnd = body.length;
+                else
+                    nextEnd += 1;
+                const nextLine = body.slice(cursor, nextEnd);
+                fenceText += nextLine;
+                cursor = nextEnd;
+                // The `\r?\n` strip here is LOAD-BEARING — do NOT remove it. `closeRegex`
+                // ends in `[ \t]*$` and is built with no `m` flag, so its `$` anchors at
+                // end-of-string. `nextLine` still carries its trailing newline (we keep
+                // it for a byte-identical re-join), and `[ \t]*` cannot consume a `\n`,
+                // so without the strip the close test fails on every newline-terminated
+                // fence line (CRLF or LF). The fence would then run to EOF, wrongly
+                // swallowing text that follows the closing fence into the code segment.
+                // (An EOF-only fence happens to pass either way because `$` also matches
+                // end-of-string — which is why a content-after-close-fence test is what
+                // actually guards this. See code-mask.test.ts.)
+                if (closeRegex.test(nextLine.replace(/\r?\n$/, '')))
+                    break;
+            }
+            segments.push({ code: true, text: fenceText });
+            lineStart = cursor;
+            continue;
+        }
+        pendingText += line;
+        lineStart = lineEnd;
+    }
+    flushPendingText();
+    // The common "no code at all" body yields exactly one `{ code: false }`
+    // segment (the whole body, via `splitInlineCode`'s trailing `pushPlain`), so
+    // the caller's by-reference cheap-skip still works on the re-join.
+    return segments;
+}
+/**
+ * Apply `fn` only to the non-code segments of `body`, re-joining in original
+ * order. Returns `body` BY REFERENCE when `fn` left every non-code segment
+ * unchanged (preserving the caller's `result === body` cheap-skip for
+ * isPending). Code regions (fenced + inline, per `splitCodeSegments`) are
+ * passed through byte-identical.
+ *
+ * `fn` may be impure (carry an accumulator in a closure) — e.g. a `body.replace`
+ * callback that pushes occurrences / bumps counts. It is invoked once per
+ * non-code segment in document order; the code segments between them are never
+ * passed to `fn`, so a token written as a code example stays untouched and is
+ * never misdetected.
+ *
+ * This is the shared entry point for all three body-rewrite migrations
+ * (`wikilink-format`, `files-url-to-attachments`, `wikilink-html-recover`); the
+ * segment-and-rewrite scheme (vs. a fill/restore one) is justified in this
+ * file's header. The by-reference cheap-skip is owned here, via per-segment
+ * `!==` identity tracking, so a caller that still keeps its own accumulator
+ * guard stays consistent (both agree on "changed").
+ */
+function rewriteOutsideCode(body, fn) {
+    let changed = false;
+    const out = splitCodeSegments(body).map((seg) => {
+        if (seg.code)
+            return seg.text;
+        const next = fn(seg.text);
+        if (next !== seg.text)
+            changed = true;
+        return next;
+    });
+    return changed ? out.join('') : body;
+}
+/**
+ * Split a run of non-fence text into inline-code (`code: true`) and plain
+ * (`code: false`) segments per CommonMark §6.1: an opening run of N backticks
+ * closed by the next run of *exactly* N backticks is a code span. An unmatched
+ * backtick run stays literal (folded into the surrounding plain segment).
+ */
+function splitInlineCode(text) {
+    const segments = [];
+    let plainStart = 0;
+    let i = 0;
+    const pushPlain = (end) => {
+        if (end > plainStart)
+            segments.push({ code: false, text: text.slice(plainStart, end) });
+    };
+    while (i < text.length) {
+        if (text[i] !== '`') {
+            i += 1;
+            continue;
+        }
+        // Measure the opening backtick run length.
+        const openStart = i;
+        let runLen = 0;
+        while (i < text.length && text[i] === '`') {
+            runLen += 1;
+            i += 1;
+        }
+        // Look for a closing run of exactly `runLen` backticks.
+        let scan = i;
+        let closeStart = -1;
+        while (scan < text.length) {
+            if (text[scan] !== '`') {
+                scan += 1;
+                continue;
+            }
+            let closeLen = 0;
+            const thisRunStart = scan;
+            while (scan < text.length && text[scan] === '`') {
+                closeLen += 1;
+                scan += 1;
+            }
+            if (closeLen === runLen) {
+                closeStart = thisRunStart;
+                break;
+            }
+            // A run of a different length is not a valid closer; keep scanning.
+        }
+        if (closeStart === -1) {
+            // Unmatched opener — leave the backtick run as literal text and continue
+            // scanning from just after it (so a later valid span is still found).
+            continue;
+        }
+        // Emit the plain text before the span, then the span itself.
+        pushPlain(openStart);
+        const spanEnd = closeStart + runLen;
+        segments.push({ code: true, text: text.slice(openStart, spanEnd) });
+        plainStart = spanEnd;
+        i = spanEnd;
+    }
+    pushPlain(text.length);
+    return segments;
+}
+//# sourceMappingURL=code-mask.js.map

package/dist/migration/migrations/code-mask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-mask.js","sourceRoot":"","sources":["../../../src/migration/migrations/code-mask.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;AAyBH,8CA4EC;AAsBD,gDASC;AA1HD,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,WAAW,GAAG,EAAE,CAAC;IAErB,MAAM,gBAAgB,GAAG,GAAS,EAAE;QAClC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrC,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,WAAW,GAAG,EAAE,CAAC;IACnB,CAAC,CAAC;IAEF,6EAA6E;IAC7E,0EAA0E;IAC1E,kBAAkB;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;;YACrC,OAAO,IAAI,CAAC,CAAC,CAAC,sBAAsB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE5C,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,8CAA8C;QAC9C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,UAAU,EAAE,CAAC;YACf,yEAAyE;YACzE,yEAAyE;YACzE,gBAAgB,EAAE,CAAC;YACnB,iEAAiE;YACjE,2EAA2E;YAC3E,uDAAuD;YACvD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACtC,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,UAAU,SAAS,IAAI,QAAQ,YAAY,CAAC,CAAC;YAE3E,qEAAqE;YACrE,oEAAoE;YACpE,IAAI,SAAS,GAAG,IAAI,CAAC;YACrB,IAAI,MAAM,GAAG,OAAO,CAAC;YACrB,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC5B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACzC,IAAI,OAAO,KAAK,CAAC,CAAC;oBAAE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;;oBACrC,OAAO,IAAI,CAAC,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC7C,SAAS,IAAI,QAAQ,CAAC;gBACtB,MAAM,GAAG,OAAO,CAAC;gBACjB,0EAA0E;gBAC1E,yEAAyE;gBACzE,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,oEAAoE;gBACpE,wEAAwE;gBACxE,yEAAyE;gBACzE,wEAAwE;gBACxE,gDAAgD;gBAChD,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;oBAAE,MAAM;YAC7D,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/C,SAAS,GAAG,MAAM,CAAC;YACnB,SAAS;QACX,CAAC;QAED,WAAW,IAAI,IAAI,CAAC;QACpB,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC;IAED,gBAAgB,EAAE,CAAC;IAEnB,wEAAwE;IACxE,6EAA6E;IAC7E,mEAAmE;IACnE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,kBAAkB,CAAC,IAAY,EAAE,EAA4B;IAC3E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9C,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,MAAM,SAAS,GAAG,CAAC,GAAW,EAAQ,EAAE;QACtC,IAAI,GAAG,GAAG,UAAU;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC;IAEF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,2CAA2C;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC;QACpB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;QACD,wDAAwD;QACxD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;QACpB,OAAO,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,CAAC;gBACV,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,MAAM,YAAY,GAAG,IAAI,CAAC;YAC1B,OAAO,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAChD,QAAQ,IAAI,CAAC,CAAC;gBACd,IAAI,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,UAAU,GAAG,YAAY,CAAC;gBAC1B,MAAM;YACR,CAAC;YACD,oEAAoE;QACtE,CAAC;QAED,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,yEAAyE;YACzE,sEAAsE;YACtE,SAAS;QACX,CAAC;QAED,6DAA6D;QAC7D,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,MAAM,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACpE,UAAU,GAAG,OAAO,CAAC;QACrB,CAAC,GAAG,OAAO,CAAC;IACd,CAAC;IAED,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/migration/migrations/files-url-to-attachments.d.ts

@@ -1,3 +1,4 @@
+import type { MigrationContext } from '../types';
 /**
  * Per-body breakdown of what a rewrite touched / skipped, returned alongside
  * the rewritten body so callers walk the regex once.
@@ -18,6 +19,14 @@ export interface FilesUrlRewriteCounts {
  *
  * `origins` is the self-host allow-list (`getAppOrigins()`); pass `[]` to
  * disable rule 2 (CLIENT_URL / BASE_URL unset).
+ *
+ * Code regions (fenced blocks + inline spans) are excluded via the shared
+ * `rewriteOutsideCode` primitive: a `/files/<id>` written as a code example is
+ * left byte-identical (never rewritten, never counted) so it cannot be
+ * corrupted, nor falsely report the migration as pending. Indented code is an
+ * accepted divergence (still rewritten). AD-2 (an `![alt](url)` whose alt text
+ * contains an inline-code span straddles a segment boundary, leaving its URL
+ * unrewritten) is documented in the spec — an accepted false-negative.
  */
 export declare function rewriteFilesUrls(body: string, origins: readonly string[]): {
     body: string;
@@ -32,4 +41,59 @@ export declare function rewriteFilesUrls(body: string, origins: readonly string[
  * Shared by `isPending` and `collectRewritablePages`.
  */
 export declare function bodyHasRewritableFilesUrl(body: string, origins: readonly string[]): boolean;
-export declare const filesUrlToAttachments: import("../types").MigrationDefinition;
+export declare const filesUrlToAttachments: {
+    id: string;
+    fromVersion: string;
+    toVersion: string;
+    layer: "preflight";
+    severity: "cosmetic";
+    description: string;
+    /**
+     * Pending verdict = at least one published page whose **current** revision
+     * body still contains a rewritable v1 file URL. Mirrors `wikilink-format`:
+     *
+     *  1. The verdict uses the **full rule** (`bodyHasRewritableFilesUrl`), not
+     *     the bare substring. `/files/` could appear in an external URL we leave
+     *     alone (rule 3); counting that would report pending forever after apply
+     *     (apply only rewrites self URLs), deadlocking boot under preflight +
+     *     `block`. The full rule reports false once only external `/files/`
+     *     references remain, so boot clears.
+     *  2. We scan only each page's **current** revision, never the whole
+     *     `revisions` collection — historical revisions keep their original
+     *     `/files/<id>` text forever (immutable), so a collection-wide scan
+     *     would pend permanently after any such page ever existed.
+     *
+     * Short-circuits at the first rewritable page.
+     */
+    isPending: (ctx: MigrationContext) => Promise<boolean>;
+    /**
+     * Full scan for `plan`: affected page count plus the rewrite breakdown
+     * (relative / self-host absolute rewrites + external skips, the last
+     * aggregated across every `/files/` page — see `scanFilesUrls`). Not called
+     * at boot.
+     */
+    detect: (ctx: MigrationContext) => Promise<{
+        summary: string;
+        counts: {
+            pages: number;
+            rewrites: number;
+            relative: number;
+            selfHostAbsolute: number;
+            externalSkipped: number;
+        };
+    }>;
+    stages: {
+        name: string;
+        fn: (ctx: MigrationContext) => Promise<{
+            name: string;
+            transformed: number;
+            stats: {
+                wouldRewrite: number;
+            };
+        } | {
+            name: string;
+            transformed: number;
+            stats?: undefined;
+        }>;
+    }[];
+};

package/dist/migration/migrations/files-url-to-attachments.js

@@ -10,6 +10,7 @@ const linkDetector_1 = __importDefault(require("../../util/linkDetector"));
 const page_1 = require("../../models/page");
 const helpers_1 = require("../helpers");
 const types_1 = require("../types");
+const code_mask_1 = require("./code-mask");
 /**
  * v1 → v2 — `files-url-to-attachments` (preflight layer).
  *
@@ -110,10 +111,18 @@ function isSelfHostOrigin(schemeAndHost, origins) {
  *
  * `origins` is the self-host allow-list (`getAppOrigins()`); pass `[]` to
  * disable rule 2 (CLIENT_URL / BASE_URL unset).
+ *
+ * Code regions (fenced blocks + inline spans) are excluded via the shared
+ * `rewriteOutsideCode` primitive: a `/files/<id>` written as a code example is
+ * left byte-identical (never rewritten, never counted) so it cannot be
+ * corrupted, nor falsely report the migration as pending. Indented code is an
+ * accepted divergence (still rewritten). AD-2 (an `![alt](url)` whose alt text
+ * contains an inline-code span straddles a segment boundary, leaving its URL
+ * unrewritten) is documented in the spec — an accepted false-negative.
  */
 function rewriteFilesUrls(body, origins) {
     const counts = emptyCounts();
-    const rewritten = body.replace(buildFilesUrlRegex(), (whole, head, schemeAndHost, id, rest) => {
+    const rewriteSegment = (text) => text.replace(buildFilesUrlRegex(), (whole, head, schemeAndHost, id, rest) => {
         if (schemeAndHost === undefined) {
             // Rule 1 — relative `/files/<id>` is unconditionally this site.
             counts.relative += 1;
@@ -128,6 +137,7 @@ function rewriteFilesUrls(body, origins) {
         counts.externalSkipped += 1;
         return whole;
     });
+    const rewritten = (0, code_mask_1.rewriteOutsideCode)(body, rewriteSegment);
     const changed = counts.relative > 0 || counts.selfHostAbsolute > 0;
     return { body: changed ? rewritten : body, counts };
 }
@@ -199,6 +209,10 @@ exports.filesUrlToAttachments = (0, types_1.defineMigration)({
     fromVersion: '1.x',
     toVersion: '2.1',
     layer: 'preflight',
+    // Body URL rewrite only; a `/files/<id>` → 302 fallback keeps pages working
+    // even unapplied. `isPending` scans the live corpus → re-triggers on new
+    // content. Cosmetic.
+    severity: 'cosmetic',
     description: 'Rewrite v1 /files/<id> attachment URLs to v2 /api/v2/attachments/<id>',
     /**
      * Pending verdict = at least one published page whose **current** revision

package/dist/migration/migrations/files-url-to-attachments.js.map

@@ -1 +1 @@
-{"version":3,"file":"files-url-to-attachments.js","sourceRoot":"","sources":["../../../src/migration/migrations/files-url-to-attachments.ts"],"names":[],"mappings":";;;;;;AA+HA,4CAmBC;AAUD,8DAIC;AAhKD,yEAAwD;AACxD,0CAAmD;AAEnD,wCAAiD;AACjD,oCAA2C;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,oDAAoD;AACpD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAexC,MAAM,WAAW,GAAG,GAA0B,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;AAE5G;;;;;;;;;;;;;;GAcG;AACH,SAAS,kBAAkB;IACzB,gBAAgB;IAChB,+EAA+E;IAC/E,kFAAkF;IAClF,gCAAgC;IAChC,6EAA6E;IAC7E,gDAAgD;IAChD,OAAO,8EAA8E,CAAC;AACxF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,aAAqB,EAAE,OAA0B;IACzE,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAAC,IAAY,EAAE,OAA0B;IACvE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,aAAiC,EAAE,EAAU,EAAE,IAAY,EAAE,EAAE;QACxI,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,gEAAgE;YAChE,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACrB,OAAO,GAAG,IAAI,IAAI,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC;QACxD,CAAC;QACD,IAAI,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7C,+DAA+D;YAC/D,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC;YAC7B,OAAO,GAAG,IAAI,IAAI,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC;QACxD,CAAC;QACD,2CAA2C;QAC3C,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,IAAY,EAAE,OAA0B;IAChF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAqB;IAC9C,OAAO,IAAA,sBAAmB,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;AACxD,CAAC;AAoBD;;;;;;;;;;GAUG;AACH,KAAK,UAAU,aAAa,CAAC,GAAqB,EAAE,OAA0B;IAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SAChF,MAAM,CAAC,cAAc,CAAC;SACtB,IAAI,EAAE;SACN,MAAM,EAAE,CAAC;IAEZ,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAA4C,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,SAAS;QAChC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxF,MAAM,IAAI,GAAI,QAAsC,EAAE,IAAI,CAAC;QAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC1C,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC1D,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QACxD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QACnC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAEY,QAAA,qBAAqB,GAAG,IAAA,uBAAe,EAAC;IACnD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,WAAW;IAClB,WAAW,EAAE,uEAAuE;IAEpF;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;aAChF,MAAM,CAAC,cAAc,CAAC;aACtB,IAAI,EAAE;aACN,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAChC,MAAM,UAAU,GAAI,IAA+B,CAAC,QAAQ,CAAC;YAC7D,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAClF,MAAM,IAAI,GAAI,QAAsC,EAAE,IAAI,CAAC;YAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC3D,OAAO;YACL,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,2CAA2C,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,gBAAgB,wBAAwB,MAAM,CAAC,eAAe,oBAAoB;YACtN,MAAM,EAAE;gBACN,KAAK,EAAE,UAAU,CAAC,MAAM;gBACxB,QAAQ;gBACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE;QACN;YACE,IAAI,EAAE,mBAAmB;YACzB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBACzD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnG,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAA,6BAAmB,EAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;gBAChF,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAChE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAEpC,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,sEAAsE;gBACtE,mEAAmE;gBACnE,kDAAkD;gBAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC/E,SAAS,IAAI,CAAC,CAAC;oBACf,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC3B,CAAC;gBAED,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBAClB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,yDAAyD,CAAC,CAAC;gBAC3H,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;YAC/D,CAAC;SACF;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"files-url-to-attachments.js","sourceRoot":"","sources":["../../../src/migration/migrations/files-url-to-attachments.ts"],"names":[],"mappings":";;;;;;AAwIA,4CAqBC;AAUD,8DAIC;AA3KD,yEAAwD;AACxD,0CAAmD;AAEnD,wCAAiD;AACjD,oCAA2C;AAE3C,2CAAiD;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,oDAAoD;AACpD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAexC,MAAM,WAAW,GAAG,GAA0B,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;AAE5G;;;;;;;;;;;;;;GAcG;AACH,SAAS,kBAAkB;IACzB,gBAAgB;IAChB,+EAA+E;IAC/E,kFAAkF;IAClF,gCAAgC;IAChC,6EAA6E;IAC7E,gDAAgD;IAChD,OAAO,8EAA8E,CAAC;AACxF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,aAAqB,EAAE,OAA0B;IACzE,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,gBAAgB,CAAC,IAAY,EAAE,OAA0B;IACvE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE,CAC9C,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,aAAiC,EAAE,EAAU,EAAE,IAAY,EAAE,EAAE;QACtH,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,gEAAgE;YAChE,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACrB,OAAO,GAAG,IAAI,IAAI,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC;QACxD,CAAC;QACD,IAAI,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7C,+DAA+D;YAC/D,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC;YAC7B,OAAO,GAAG,IAAI,IAAI,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC;QACxD,CAAC;QACD,2CAA2C;QAC3C,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,IAAA,8BAAkB,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,IAAY,EAAE,OAA0B;IAChF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAqB;IAC9C,OAAO,IAAA,sBAAmB,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;AACxD,CAAC;AAoBD;;;;;;;;;;GAUG;AACH,KAAK,UAAU,aAAa,CAAC,GAAqB,EAAE,OAA0B;IAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SAChF,MAAM,CAAC,cAAc,CAAC;SACtB,IAAI,EAAE;SACN,MAAM,EAAE,CAAC;IAEZ,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAA4C,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,SAAS;QAChC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxF,MAAM,IAAI,GAAI,QAAsC,EAAE,IAAI,CAAC;QAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC1C,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC1D,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QACxD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QACnC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAEY,QAAA,qBAAqB,GAAG,IAAA,uBAAe,EAAC;IACnD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,WAAW;IAClB,4EAA4E;IAC5E,yEAAyE;IACzE,qBAAqB;IACrB,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,uEAAuE;IAEpF;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;aAChF,MAAM,CAAC,cAAc,CAAC;aACtB,IAAI,EAAE;aACN,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAChC,MAAM,UAAU,GAAI,IAA+B,CAAC,QAAQ,CAAC;YAC7D,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAClF,MAAM,IAAI,GAAI,QAAsC,EAAE,IAAI,CAAC;YAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC3D,OAAO;YACL,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,2CAA2C,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,gBAAgB,wBAAwB,MAAM,CAAC,eAAe,oBAAoB;YACtN,MAAM,EAAE;gBACN,KAAK,EAAE,UAAU,CAAC,MAAM;gBACxB,QAAQ;gBACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE;QACN;YACE,IAAI,EAAE,mBAAmB;YACzB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBACzD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnG,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAA,6BAAmB,EAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;gBAChF,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAChE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAEpC,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,sEAAsE;gBACtE,mEAAmE;gBACnE,kDAAkD;gBAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC/E,SAAS,IAAI,CAAC,CAAC;oBACf,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC3B,CAAC;gBAED,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBAClB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,yDAAyD,CAAC,CAAC;gBAC3H,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;YAC/D,CAAC;SACF;KACF;CACF,CAAC,CAAC"}

package/dist/migration/migrations/page-status-default.d.ts

@@ -22,4 +22,34 @@
  *     `draft` back to `published`, which would violate the one-way
  *     transition rule.
  */
-export declare const pageStatusDefault: import("../types").MigrationDefinition;
+export declare const pageStatusDefault: {
+    id: string;
+    fromVersion: string;
+    toVersion: string;
+    layer: "boot";
+    description: string;
+    /**
+     * Cheap, index-backed probe: `Page.status` is declared `index: true`
+     * (models/page.ts), so a single `findOne({ status: null })` lookup is
+     * covered by that index and never scans the collection. Pending iff at
+     * least one legacy page is still missing a status.
+     */
+    isPending: (ctx: import("../types").MigrationContext) => Promise<boolean>;
+    /**
+     * Optional `plan` detail: count the remaining legacy rows. Not called at
+     * boot — only `isPending` runs there.
+     */
+    detect: (ctx: import("../types").MigrationContext) => Promise<{
+        summary: string;
+        counts: {
+            remaining: number;
+        };
+    }>;
+    stages: {
+        name: string;
+        fn: (ctx: import("../types").MigrationContext) => Promise<{
+            name: string;
+            transformed: number;
+        }>;
+    }[];
+};

package/dist/migration/migrations/relocate-reserved-api-paths.d.ts

@@ -1,3 +1,39 @@
+import type { MigrationContext } from '../types';
 /** `/api` → `/api-legacy`, `/api/foo` → `/api-legacy/foo`, `/api/` → `/api-legacy/`. */
 export declare function relocatedApiPath(oldPath: string): string;
-export declare const relocateReservedApiPaths: import("../types").MigrationDefinition;
+export declare const relocateReservedApiPaths: {
+    id: string;
+    fromVersion: string;
+    toVersion: string;
+    layer: "preflight";
+    severity: "cosmetic";
+    description: string;
+    /**
+     * Pending iff any page still lives under `/api/*`. The anchored regex on
+     * the unique-indexed `path` field lets the planner use the index for the
+     * `/api` literal prefix, so this stays an index-assisted existence probe
+     * rather than a full-collection scan (§4.2.1).
+     */
+    isPending: (ctx: MigrationContext) => Promise<boolean>;
+    /** Full scan for `plan`: count the pages that would move. Not called at boot. */
+    detect: (ctx: MigrationContext) => Promise<{
+        summary: string;
+        counts: {
+            pages: number;
+        };
+    }>;
+    stages: {
+        name: string;
+        fn: (ctx: MigrationContext) => Promise<{
+            name: string;
+            transformed: number;
+            stats: {
+                wouldMove: number;
+            };
+        } | {
+            name: string;
+            transformed: number;
+            stats?: undefined;
+        }>;
+    }[];
+};

package/dist/migration/migrations/relocate-reserved-api-paths.js

@@ -22,9 +22,12 @@ const types_1 = require("../types");
  * so `api-legacy` does not collide). A pre-existing page at the relocation
  * target is avoided by appending a `-N` suffix.
  *
- * It is `preflight` because it rewrites user-visible page paths: boot
- * blocks until an operator runs `crowi-admin migrate apply` in a
- * maintenance window. The move is done with plain `updateOne` /
+ * It is `preflight` because it rewrites user-visible page paths, so it runs
+ * explicitly from `crowi-admin migrate apply` in a maintenance window rather
+ * than auto-applying at boot. Its `severity` is `cosmetic`: a stranded
+ * `/api/*` page is a display / availability issue, not an autoIndex E11000
+ * hazard, so a pending probe only warns and never refuses boot (§4.2.7
+ * amendment). The move is done with plain `updateOne` /
  * `updateMany` on the Page + Revision collections rather than
  * `Page.rename`, deliberately bypassing the `pageEvent('update')` chain
  * (mention dispatch / render-cache / backlink) — a path-only relocation of
@@ -73,6 +76,11 @@ exports.relocateReservedApiPaths = (0, types_1.defineMigration)({
     fromVersion: '1.x',
     toVersion: '2.0',
     layer: 'preflight',
+    // Path move only; no E11000 hazard. `isPending` is `Page.exists({path:/^\/api/})`
+    // and stabilises post-apply (does not re-trigger). Unapplied means old
+    // `/api/*` pages 404, which is a recommended pre-go-live fix, not a
+    // data-integrity risk. Cosmetic.
+    severity: 'cosmetic',
     description: 'Relocate v1 pages out of the v2-reserved /api namespace into /api-legacy',
     /**
      * Pending iff any page still lives under `/api/*`. The anchored regex on

package/dist/migration/migrations/relocate-reserved-api-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"relocate-reserved-api-paths.js","sourceRoot":"","sources":["../../../src/migration/migrations/relocate-reserved-api-paths.ts"],"names":[],"mappings":";;;AA+CA,4CAEC;AAjDD,oCAA2C;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC,oDAAoD;AACpD,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,wFAAwF;AACxF,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,OAAO,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,IAAkE,EAAE,SAAiB;IACjH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,SAAS,WAAW,mBAAmB,WAAW,CAAC,CAAC;AACnJ,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,eAAe,CAAC,GAAqB;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3F,OAAQ,IAAyC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/F,CAAC;AAEY,QAAA,wBAAwB,GAAG,IAAA,uBAAe,EAAC;IACtD,EAAE,EAAE,6BAA6B;IACjC,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,WAAW;IAClB,WAAW,EAAE,0EAA0E;IAEvF;;;;;OAKG;IACH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,2EAA2E;QAC3E,0EAA0E;QAC1E,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,iFAAiF;IACjF,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO;YACL,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,4DAA4D,aAAa,IAAI;YACrG,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE;QACN;YACE,IAAI,EAAE,oBAAoB;YAC1B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC7C,oEAAoE;gBACpE,oEAAoE;gBACpE,qEAAqE;gBACrE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBACzC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAEpC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,oEAAoE;oBACpE,6CAA6C;oBAC7C,IAAI,SAAS,GAAG,CAAC,CAAC;oBAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,MAAM,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;wBACxD,SAAS,IAAI,CAAC,CAAC;wBACf,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;oBAC3B,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC;gBAC9E,CAAC;gBAED,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBACvE,6DAA6D;oBAC7D,iEAAiE;oBACjE,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;oBACpE,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;oBAC3E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,CAAC,IAAI,SAAS,MAAM,GAAG,CAAC,CAAC;oBACpF,KAAK,IAAI,CAAC,CAAC;oBACX,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC3B,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC5D,CAAC;SACF;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"relocate-reserved-api-paths.js","sourceRoot":"","sources":["../../../src/migration/migrations/relocate-reserved-api-paths.ts"],"names":[],"mappings":";;;AAkDA,4CAEC;AApDD,oCAA2C;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC,oDAAoD;AACpD,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,wFAAwF;AACxF,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,OAAO,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,IAAkE,EAAE,SAAiB;IACjH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,SAAS,WAAW,mBAAmB,WAAW,CAAC,CAAC;AACnJ,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,eAAe,CAAC,GAAqB;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3F,OAAQ,IAAyC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/F,CAAC;AAEY,QAAA,wBAAwB,GAAG,IAAA,uBAAe,EAAC;IACtD,EAAE,EAAE,6BAA6B;IACjC,WAAW,EAAE,KAAK;IAClB,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,WAAW;IAClB,kFAAkF;IAClF,uEAAuE;IACvE,oEAAoE;IACpE,iCAAiC;IACjC,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,0EAA0E;IAEvF;;;;;OAKG;IACH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,2EAA2E;QAC3E,0EAA0E;QAC1E,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,iFAAiF;IACjF,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO;YACL,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,4DAA4D,aAAa,IAAI;YACrG,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE;QACN;YACE,IAAI,EAAE,oBAAoB;YAC1B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC7C,oEAAoE;gBACpE,oEAAoE;gBACpE,qEAAqE;gBACrE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBACzC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAEpC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,oEAAoE;oBACpE,6CAA6C;oBAC7C,IAAI,SAAS,GAAG,CAAC,CAAC;oBAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,MAAM,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;wBACxD,SAAS,IAAI,CAAC,CAAC;wBACf,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;oBAC3B,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC;gBAC9E,CAAC;gBAED,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBACvE,6DAA6D;oBAC7D,iEAAiE;oBACjE,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;oBACpE,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;oBAC3E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,CAAC,IAAI,SAAS,MAAM,GAAG,CAAC,CAAC;oBACpF,KAAK,IAAI,CAAC,CAAC;oBACX,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC3B,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAC5D,CAAC;SACF;KACF;CACF,CAAC,CAAC"}

package/dist/migration/migrations/revisions-schema-unify.d.ts

@@ -30,4 +30,38 @@
  * already omits an undefined `contributors`). `renderedAst` is the
  * `rebuild renderer` task's responsibility per RFC-0008.
  */
-export declare const revisionsSchemaUnify: import("../types").MigrationDefinition;
+export declare const revisionsSchemaUnify: {
+    id: string;
+    fromVersion: string;
+    toVersion: string;
+    layer: "boot";
+    description: string;
+    /**
+     * Cheap, index-backed probe: `Revision.type` is declared `index: true`
+     * (models/revision.ts), so `findOne({ type: null })` is covered by that
+     * index and never scans the collection. `{ type: null }` matches both a
+     * missing field and an explicit `null` in MongoDB query semantics, so a
+     * single condition covers every legacy shape. Pending iff at least one
+     * legacy revision is still missing a type. After apply (and because new
+     * revisions are filled by the schema `default`) this stays false — no
+     * permanent boot block.
+     */
+    isPending: (ctx: import("../types").MigrationContext) => Promise<boolean>;
+    /**
+     * Optional `plan` detail: count the remaining legacy rows. Not called at
+     * boot — only `isPending` runs there. Index-backed count on `type`.
+     */
+    detect: (ctx: import("../types").MigrationContext) => Promise<{
+        summary: string;
+        counts: {
+            remaining: number;
+        };
+    }>;
+    stages: {
+        name: string;
+        fn: (ctx: import("../types").MigrationContext) => Promise<{
+            name: string;
+            transformed: number;
+        }>;
+    }[];
+};

package/dist/migration/migrations/user-unique-prepare.d.ts

@@ -1 +1,55 @@
-export declare const userUniquePrepare: import("../types").MigrationDefinition;
+import type { MigrationContext } from '../types';
+export declare const userUniquePrepare: {
+    id: string;
+    fromVersion: string;
+    toVersion: string;
+    layer: "preflight";
+    severity: "blocking";
+    description: string;
+    /**
+     * Pending iff a plain unique index build would fail E11000. Two residual
+     * conditions (both folded to the index collation):
+     *
+     *   - a living-vs-living duplicate on username or email, or
+     *   - a not-yet-tombstoned DELETED user colliding with a living user.
+     *
+     * Conservative (§6.2): once `dedup-*` + `tombstone-deleted` run, every group
+     * is resolved and this returns false, so boot under preflight+block clears
+     * (no permanent block). Short-circuits at the first collision found.
+     */
+    isPending: (ctx: MigrationContext) => Promise<boolean>;
+    /** Full-scan report for `plan`: duplicate group counts + tombstone targets. */
+    detect: (ctx: MigrationContext) => Promise<{
+        summary: string;
+        counts: {
+            usernameGroups: number;
+            emailGroups: number;
+            tombstoneTargets: number;
+        };
+    }>;
+    stages: ({
+        name: string;
+        fn: (ctx: MigrationContext) => Promise<{
+            name: string;
+            transformed: number;
+            stats: {
+                groups: number;
+                reassigned: Record<string, number>;
+                deletedConflicting: number;
+            };
+        }>;
+    } | {
+        name: string;
+        fn: (ctx: MigrationContext) => Promise<{
+            name: string;
+            transformed: number;
+            stats: {
+                wouldTombstone: number;
+            };
+        } | {
+            name: string;
+            transformed: number;
+            stats?: undefined;
+        }>;
+    })[];
+};

package/dist/migration/migrations/user-unique-prepare.js

@@ -109,6 +109,11 @@ exports.userUniquePrepare = (0, types_1.defineMigration)({
     fromVersion: '1.x',
     toVersion: '2.0',
     layer: 'preflight',
+    // The ONLY blocking migration: dedups so the unique index can build without
+    // E11000 (RFC §9/§11). Booting unapplied risks an autoIndex failure, so a
+    // pending verdict must refuse boot under the `block` policy. Do NOT
+    // reclassify to cosmetic — that would re-expose E11000.
+    severity: 'blocking',
     description: 'Deduplicate users (unique index via autoIndex)',
     /**
      * Pending iff a plain unique index build would fail E11000. Two residual