@docstack/client 0.0.3 → 0.0.5

package/lib/core/datamodel/index.js

@@ -0,0 +1,1308 @@
+import semver from "semver";
+const syspatches = [];
+const hashContent = async (content) => {
+    const data = new TextEncoder().encode(content);
+    const hashBuffer = await globalThis.crypto.subtle.digest('SHA-256', data);
+    return Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, '0')).join('');
+};
+// TODO: implement _rev auto handler:
+// If patches include updates to existing documents, 
+// we need to ensure that the _rev field is handled correctly to avoid conflicts.
+const sys_001 = {
+    "_id": "~sys-0.0.1",
+    "~class": "patch",
+    "version": "0.0.1",
+    "target": "system",
+    "changelog": "### Initial patch with originators: Class and Domain",
+    "docs": [
+        {
+            "_id": "class",
+            "active": true,
+            "name": "class",
+            "description": "A class document representing a data model class",
+            "~class": "~self",
+            "schema": {
+                "name": {
+                    "name": "name",
+                    "type": "string",
+                    "config": {
+                        "primaryKey": true,
+                        "mandatory": true,
+                        "isArray": false,
+                        "maxLength": 100
+                    }
+                },
+                "description": {
+                    "name": "description",
+                    "type": "string",
+                    "config": {
+                        "mandatory": false,
+                        "isArray": false,
+                        "maxLength": 500
+                    }
+                },
+                "~class": {
+                    "name": "~class",
+                    "type": "string",
+                    "config": {
+                        "mandatory": true,
+                        "isArray": false,
+                        "maxLength": 50,
+                        "defaultValue": "class"
+                    }
+                },
+                "schema": { "name": "schema", "type": "object", "config": { "maxLength": 1000, "isArray": false } },
+            }
+        },
+        {
+            "_id": "domain",
+            "active": true,
+            "name": "domain",
+            "description": "A domain document representing a data model domain",
+            "~class": "~self",
+            "schema": {
+                "~class": { name: "~class", type: "string", config: { defaultValue: "domain" } },
+                "relation": {
+                    name: "relation", type: "enum", config: {
+                        isArray: false, values: [
+                            { value: "1:1" }, { value: "1:N" }, { value: "N:1" }, { value: "N:N" }
+                        ]
+                    }
+                },
+                "sourceClass": {
+                    name: "sourceClass",
+                    type: "foreign_key",
+                    config: {
+                        targetClass: "class",
+                        isArray: false
+                    }
+                },
+                "targetClass": {
+                    name: "targetClass",
+                    type: "foreign_key",
+                    config: {
+                        targetClass: "class",
+                        isArray: false
+                    }
+                },
+            }
+        }
+    ]
+};
+// const sys_002: Patch = {
+//     "_id": "~sys-0.0.2",
+//     "~class": "patch",
+//     "version": "0.0.2",
+//     "target": "system",
+//     "changelog": "### Initial patch with system classes and domains",
+//     "docs": [
+//         {
+//             "_id": "log",
+//             "active": true,
+//             "name": "log",
+//             "description": "Contains the system logs",
+//             "~class": "class",
+//             "schema": {
+//                 "log": {
+//                     "name": "log",
+//                     "type": "object",
+//                     "config": {
+//                         "isArray": false
+//                     }
+//                 }
+//             }
+//         }
+//     ]
+// }
+const sys_003 = {
+    "_id": "~sys-0.0.3",
+    "~class": "patch",
+    "version": "0.0.3",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.3\\\n#### New Classes: ~User, ~UserSession",
+    "docs": [
+        {
+            "_id": "~User",
+            "active": true,
+            "name": "User",
+            "description": "A user class for secure login",
+            "~class": "class",
+            "schema": {
+                "username": {
+                    "name": "username",
+                    "type": "string",
+                    "config": {
+                        "primaryKey": true,
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false
+                    }
+                },
+                "password": {
+                    "name": "password",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false
+                    }
+                },
+                "email": {
+                    "name": "email",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "firstName": {
+                    "name": "firstName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "lastName": {
+                    "name": "lastName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                }
+            }
+        },
+        {
+            "_id": "~UserSession",
+            "name": "UserSession",
+            "active": true,
+            "description": "Tracks user sessions",
+            "~class": "class",
+            "schema": {
+                "username": {
+                    "name": "username",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false,
+                        "primaryKey": true,
+                        "mandatory": true
+                    }
+                },
+                "sessionId": {
+                    "name": "sessionId",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 200,
+                        "primaryKey": true,
+                        "isArray": false,
+                        "mandatory": true
+                    }
+                },
+                "sessionStart": {
+                    "name": "sessionStart",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 100,
+                        "isArray": false,
+                        "mandatory": true
+                    }
+                },
+                "sessionStatus": {
+                    "name": "sessionStatus",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 100,
+                        "isArray": false,
+                        "mandatory": true
+                    }
+                },
+                "sessionEnd": {
+                    "name": "sessionEnd",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 100,
+                        "isArray": false,
+                        "mandatory": false
+                    }
+                }
+            }
+        }
+    ]
+};
+const classicAuthJobContent = `
+const toHex = (buffer) => Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+
+async function deriveKeyMaterial(password, salt, iterations = 120000, length = 32) {
+    if (!globalThis.crypto || !globalThis.crypto.subtle) {
+        throw new Error("WebCrypto unavailable for key derivation");
+    }
+
+    const encoder = new TextEncoder();
+    const keyMaterial = await globalThis.crypto.subtle.importKey(
+        "raw",
+        encoder.encode(String(password)),
+        { name: "PBKDF2" },
+        false,
+        ["deriveBits"]
+    );
+
+    const derived = await globalThis.crypto.subtle.deriveBits(
+        {
+            name: "PBKDF2",
+            salt: encoder.encode(String(salt)),
+            iterations,
+            hash: "SHA-256",
+        },
+        keyMaterial,
+        length * 8
+    );
+
+    return toHex(derived);
+}
+
+async function execute(_stack, params) {
+    const password = params?.password ?? "";
+    const salt = params?.salt ?? params?.keyDerivationSalt ?? "";
+
+    if (!password) {
+        throw new Error("Password is required for key derivation");
+    }
+    if (!salt) {
+        throw new Error("Salt is required for key derivation");
+    }
+
+    const derivedKey = await deriveKeyMaterial(password, salt);
+    const metadata = { derivedKey, derivedAt: Date.now() };
+    return { metadata };
+}
+`;
+const sys_004 = {
+    "_id": "~sys-0.0.4",
+    "~class": "patch",
+    "version": "0.0.4",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.4\\n#### New Classes: ~Job, ~JobRun, ~Policy, ~AuthModule\\n#### Updates: ~User authentication fields",
+    "docs": [
+        {
+            "_id": "~User",
+            "_rev": "auto",
+            "active": true,
+            "name": "User",
+            "description": "A user class for secure login",
+            "~class": "class",
+            "schema": {
+                "username": {
+                    "name": "username",
+                    "type": "string",
+                    "config": {
+                        "primaryKey": true,
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false
+                    }
+                },
+                "password": {
+                    "name": "password",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false
+                    }
+                },
+                "email": {
+                    "name": "email",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "firstName": {
+                    "name": "firstName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "lastName": {
+                    "name": "lastName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "authMethod": {
+                    "name": "authMethod",
+                    "type": "string",
+                    "config": {
+                        "mandatory": true,
+                        "maxLength": 100,
+                        "isArray": false
+                    }
+                },
+                "externalId": {
+                    "name": "externalId",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 200,
+                        "isArray": false
+                    }
+                },
+                "keyDerivationSalt": {
+                    "name": "keyDerivationSalt",
+                    "type": "string",
+                    "config": {
+                        "mandatory": true,
+                        "maxLength": 200,
+                        "isArray": false
+                    }
+                }
+            }
+        },
+        {
+            "_id": "~Job",
+            "active": true,
+            "name": "Job",
+            "description": "A long running or scheduled job",
+            "~class": "class",
+            "schema": {
+                "_id": { "name": "_id", "type": "string", "config": { "primaryKey": true, "mandatory": true } },
+                "name": { "name": "name", "type": "string", "config": { "mandatory": true } },
+                "description": { "name": "description", "type": "string", "config": { "isArray": false } },
+                "type": { "name": "type", "type": "string", "config": { "mandatory": true } },
+                "workerPlatform": { "name": "workerPlatform", "type": "string", "config": { "mandatory": true } },
+                "content": { "name": "content", "type": "string", "config": { "mandatory": true } },
+                "hash": { "name": "hash", "type": "string", "config": { "mandatory": true } },
+                "schedule": { "name": "schedule", "type": "string", "config": { "mandatory": false } },
+                "isSingleton": { "name": "isSingleton", "type": "boolean", "config": { "defaultValue": false } },
+                "isEnabled": { "name": "isEnabled", "type": "boolean", "config": { "mandatory": true, "defaultValue": true } },
+                "nextRunTimestamp": { "name": "nextRunTimestamp", "type": "integer", "config": { "mandatory": false } },
+                "defaultParams": { "name": "defaultParams", "type": "object", "config": { "mandatory": false } },
+                "metadata": { "name": "metadata", "type": "object", "config": { "mandatory": false } }
+            }
+        },
+        {
+            "_id": "~JobRun",
+            "active": true,
+            "name": "JobRun",
+            "description": "Execution history for jobs",
+            "~class": "class",
+            "schema": {
+                "_id": { "name": "_id", "type": "string", "config": { "primaryKey": true, "mandatory": true } },
+                "~class": { "name": "~class", "type": "string", "config": { "mandatory": true, "defaultValue": "~JobRun" } },
+                "jobId": { "name": "jobId", "type": "string", "config": { "mandatory": true } },
+                "status": { "name": "status", "type": "string", "config": { "mandatory": true } },
+                "triggerType": { "name": "triggerType", "type": "string", "config": { "mandatory": true } },
+                "startTime": { "name": "startTime", "type": "integer", "config": { "mandatory": true } },
+                "endTime": { "name": "endTime", "type": "integer", "config": { "mandatory": false } },
+                "durationMs": { "name": "durationMs", "type": "integer", "config": { "mandatory": false } },
+                "runtimeArgs": { "name": "runtimeArgs", "type": "object", "config": { "mandatory": false } },
+                "initialMetadata": { "name": "initialMetadata", "type": "object", "config": { "mandatory": false } },
+                "finalMetadata": { "name": "finalMetadata", "type": "object", "config": { "mandatory": false } },
+                "errorMessage": { "name": "errorMessage", "type": "string", "config": { "mandatory": false } },
+                "errorStack": { "name": "errorStack", "type": "string", "config": { "mandatory": false } },
+                "logs": { "name": "logs", "type": "object", "config": { "mandatory": false } },
+                "workerId": { "name": "workerId", "type": "string", "config": { "mandatory": false } }
+            }
+        },
+        {
+            "_id": "~Policy",
+            "active": true,
+            "name": "Policy",
+            "description": "Access policies for classes and documents",
+            "~class": "class",
+            "schema": {
+                "userId": { "name": "userId", "type": "string", "config": { "mandatory": true } },
+                "rule": { "name": "rule", "type": "string", "config": { "mandatory": true, "maxLength": 2000 } },
+                "description": { "name": "description", "type": "string", "config": { "mandatory": false } },
+                "targetClass": { "name": "targetClass", "type": "foreign_key", "config": { "mandatory": true, "isArray": true, "targetClass": "class" } }
+            }
+        },
+        {
+            "_id": "~AuthModule",
+            "active": true,
+            "name": "AuthModule",
+            "description": "Authentication module descriptor",
+            "~class": "class",
+            "schema": {
+                "name": { "name": "name", "type": "string", "config": { "mandatory": true } },
+                "config": { "name": "config", "type": "object", "config": { "mandatory": false } },
+                "jobId": { "name": "jobId", "type": "foreign_key", "config": { "mandatory": true, "targetClass": "~Job" } }
+            }
+        },
+    ]
+};
+const sys_005 = {
+    "_id": "~sys-0.0.5",
+    "~class": "patch",
+    "version": "0.0.5",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.5\\n#### New Documents: Job-Auth-Classic, AuthMod-Classic, Policy-System-Classes",
+    "docs": [
+        {
+            "_id": "Job-Auth-Classic",
+            "~class": "~Job",
+            "active": true,
+            "name": "Classic authentication",
+            "description": "Derive key material from password and salt",
+            "type": "user",
+            "workerPlatform": "client",
+            "content": classicAuthJobContent,
+            "hash": "e63887145113429477843420c388d35116e255403148163f4c4a436f0b8338b1", // Pre-calculated hash
+            "isEnabled": true,
+            "isSingleton": true,
+            "defaultParams": {},
+            "metadata": {}
+        },
+    ]
+};
+const sys_006 = {
+    "_id": "~sys-00.6",
+    "~class": "patch",
+    "version": "0.0.6",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.6\\n#### New Documents: AuthMod-Classic, Policy-System-Classes",
+    "docs": [
+        {
+            "_id": "AuthMod-Classic",
+            "~class": "~AuthModule",
+            "active": true,
+            "name": "Classic Email/Password",
+            "config": { "mode": "password" },
+            "jobId": "Job-Auth-Classic"
+        },
+        {
+            "_id": "Policy-System-Classes",
+            "~class": "~Policy",
+            "active": true,
+            "userId": "system",
+            "rule": "return true;",
+            "description": "Default system policy",
+            "targetClass": ["class", "~User", "~UserSession", "~Policy", "~Job", "~JobRun", "~AuthModule"]
+        }
+    ]
+};
+const sys_007 = {
+    "_id": "~sys-0.0.7",
+    "~class": "patch",
+    "version": "0.0.7",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.7\\n#### Updates: enforce enum/foreign key definitions for job, policy, and user auth fields",
+    "docs": [
+        {
+            "_id": "~User",
+            "_rev": "auto",
+            "active": true,
+            "name": "User",
+            "description": "A user class for secure login",
+            "~class": "class",
+            "schema": {
+                "username": {
+                    "name": "username",
+                    "type": "string",
+                    "config": {
+                        "primaryKey": true,
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false
+                    }
+                },
+                "password": {
+                    "name": "password",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false
+                    }
+                },
+                "email": {
+                    "name": "email",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "firstName": {
+                    "name": "firstName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "lastName": {
+                    "name": "lastName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "authMethod": {
+                    "name": "authMethod",
+                    "type": "foreign_key",
+                    "config": { "mandatory": true, "targetClass": "~AuthModule" }
+                },
+                "externalId": {
+                    "name": "externalId",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 200,
+                        "isArray": false
+                    }
+                },
+                "keyDerivationSalt": {
+                    "name": "keyDerivationSalt",
+                    "type": "string",
+                    "config": {
+                        "mandatory": true,
+                        "maxLength": 200,
+                        "isArray": false
+                    }
+                }
+            }
+        },
+        {
+            "_id": "~Job",
+            "_rev": "auto",
+            "active": true,
+            "name": "Job",
+            "description": "A long running or scheduled job",
+            "~class": "class",
+            "schema": {
+                "_id": { "name": "_id", "type": "string", "config": { "primaryKey": true, "mandatory": true } },
+                "name": { "name": "name", "type": "string", "config": { "mandatory": true } },
+                "description": { "name": "description", "type": "string", "config": { "isArray": false } },
+                "type": {
+                    "name": "type",
+                    "type": "enum",
+                    "config": { "mandatory": true, "values": [{ value: "system" }, { value: "user" }] }
+                },
+                "workerPlatform": {
+                    "name": "workerPlatform",
+                    "type": "enum",
+                    "config": { "mandatory": true, "values": [{ value: "client" }, { value: "server" }, { value: "hybrid" }] }
+                },
+                "content": { "name": "content", "type": "string", "config": { "mandatory": true } },
+                "hash": { "name": "hash", "type": "string", "config": { "mandatory": true } },
+                "schedule": { "name": "schedule", "type": "string", "config": { "mandatory": false } },
+                "isSingleton": { "name": "isSingleton", "type": "boolean", "config": { "defaultValue": false } },
+                "isEnabled": { "name": "isEnabled", "type": "boolean", "config": { "mandatory": true, "defaultValue": true } },
+                "nextRunTimestamp": { "name": "nextRunTimestamp", "type": "integer", "config": { "mandatory": false } },
+                "defaultParams": { "name": "defaultParams", "type": "object", "config": { "mandatory": false } },
+                "metadata": { "name": "metadata", "type": "object", "config": { "mandatory": false } }
+            }
+        },
+        {
+            "_id": "~JobRun",
+            "_rev": "auto",
+            "active": true,
+            "name": "JobRun",
+            "description": "Execution history for jobs",
+            "~class": "class",
+            "schema": {
+                "_id": { "name": "_id", "type": "string", "config": { "primaryKey": true, "mandatory": true } },
+                "~class": { "name": "~class", "type": "string", "config": { "mandatory": true, "defaultValue": "~JobRun" } },
+                "jobId": { "name": "jobId", "type": "foreign_key", "config": { "mandatory": true, "targetClass": "~Job" } },
+                "status": {
+                    "name": "status",
+                    "type": "enum",
+                    "config": {
+                        "mandatory": true,
+                        "values": [
+                            { value: "PENDING" },
+                            { value: "RUNNING" },
+                            { value: "SUCCESS" },
+                            { value: "FAILURE" },
+                            { value: "CANCELED" },
+                            { value: "SKIPPED" }
+                        ]
+                    }
+                },
+                "triggerType": {
+                    "name": "triggerType",
+                    "type": "enum",
+                    "config": { "mandatory": true, "values": [{ value: "manual" }, { value: "scheduled" }, { value: "event" }] }
+                },
+                "startTime": { "name": "startTime", "type": "integer", "config": { "mandatory": true } },
+                "endTime": { "name": "endTime", "type": "integer", "config": { "mandatory": false } },
+                "durationMs": { "name": "durationMs", "type": "integer", "config": { "mandatory": false } },
+                "runtimeArgs": { "name": "runtimeArgs", "type": "object", "config": { "mandatory": false } },
+                "initialMetadata": { "name": "initialMetadata", "type": "object", "config": { "mandatory": false } },
+                "finalMetadata": { "name": "finalMetadata", "type": "object", "config": { "mandatory": false } },
+                "errorMessage": { "name": "errorMessage", "type": "string", "config": { "mandatory": false } },
+                "errorStack": { "name": "errorStack", "type": "string", "config": { "mandatory": false } },
+                "logs": { "name": "logs", "type": "object", "config": { "mandatory": false } },
+                "workerId": { "name": "workerId", "type": "string", "config": { "mandatory": false } }
+            }
+        },
+        {
+            "_id": "~Policy",
+            "_rev": "auto",
+            "active": true,
+            "name": "Policy",
+            "description": "Access policies for classes and documents",
+            "~class": "class",
+            "schema": {
+                "userId": { "name": "userId", "type": "foreign_key", "config": { "mandatory": false, "targetClass": "~User" } },
+                "rule": { "name": "rule", "type": "string", "config": { "mandatory": true, "maxLength": 2000 } },
+                "description": { "name": "description", "type": "string", "config": { "mandatory": false } },
+                "targetClass": { "name": "targetClass", "type": "foreign_key", "config": { "mandatory": true, "isArray": true, "targetClass": "class" } }
+            }
+        },
+        {
+            "_id": "system",
+            "~class": "~User",
+            "active": true,
+            "username": "system",
+            "password": "system",
+            "email": "",
+            "firstName": "System",
+            "lastName": "User",
+            "authMethod": "AuthMod-Classic",
+            "externalId": "",
+            "keyDerivationSalt": "system-salt"
+        }
+    ]
+};
+const sys_008 = {
+    "_id": "~sys-0.0.8",
+    "~class": "patch",
+    "version": "0.0.8",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.8\\n#### Updates: support wrapped document keys and encrypted user secrets",
+    "docs": [
+        {
+            "_id": "~User",
+            "_rev": "auto",
+            "active": true,
+            "name": "User",
+            "description": "A user class for secure login",
+            "~class": "class",
+            "schema": {
+                "username": {
+                    "name": "username",
+                    "type": "string",
+                    "config": {
+                        "primaryKey": true,
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false
+                    }
+                },
+                "password": {
+                    "name": "password",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false,
+                        "encrypted": true
+                    }
+                },
+                "email": {
+                    "name": "email",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "firstName": {
+                    "name": "firstName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "lastName": {
+                    "name": "lastName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "authMethod": {
+                    "name": "authMethod",
+                    "type": "foreign_key",
+                    "config": { "mandatory": true, "targetClass": "~AuthModule" }
+                },
+                "externalId": {
+                    "name": "externalId",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 200,
+                        "isArray": false
+                    }
+                },
+                "keyDerivationSalt": {
+                    "name": "keyDerivationSalt",
+                    "type": "string",
+                    "config": {
+                        "mandatory": true,
+                        "maxLength": 200,
+                        "isArray": false
+                    }
+                },
+                "wrappedDocumentKey": {
+                    "name": "wrappedDocumentKey",
+                    "type": "string",
+                    "config": {
+                        "mandatory": false,
+                        "maxLength": 4096,
+                        "isArray": false,
+                        "encrypted": false
+                    }
+                }
+            }
+        },
+        {
+            "_id": "system",
+            "_rev": "auto",
+            "~class": "~User",
+            "active": true,
+            "username": "system",
+            "password": "system",
+            "email": "",
+            "firstName": "System",
+            "lastName": "User",
+            "authMethod": "AuthMod-Classic",
+            "externalId": "",
+            "keyDerivationSalt": "system-salt",
+            "wrappedDocumentKey": ""
+        }
+    ]
+};
+const sys_009 = {
+    "_id": "~sys-0.0.9",
+    "~class": "patch",
+    "version": "0.0.9",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.9\\n#### Updates: restrict ~User access to the owner and system user",
+    "docs": [
+        {
+            "_id": "Policy-System-Classes",
+            "_rev": "auto",
+            "~class": "~Policy",
+            "active": true,
+            "userId": "system",
+            "rule": "return true;",
+            "description": "Default system policy",
+            "targetClass": ["class", "~UserSession", "~Policy", "~Job", "~JobRun", "~AuthModule"]
+        },
+        {
+            "_id": "Policy-User-SelfAccess",
+            "~class": "~Policy",
+            "active": true,
+            "rule": "if (!session || session.sessionStatus !== 'active') return false; if (session.username === 'system') return true; const targetUsername = document?.username || document?._id; return targetUsername === session.username;",
+            "description": "Allow users to access only their own user document or the system user",
+            "targetClass": ["~User"]
+        }
+    ]
+};
+const sys_010 = {
+    "_id": "~sys-0.0.10",
+    "~class": "patch",
+    "version": "0.0.10",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.10\\n#### Updates: enforce ~UserSession references an existing ~User via userId",
+    "docs": [
+        {
+            "_id": "~UserSession",
+            "_rev": "auto",
+            "name": "UserSession",
+            "active": true,
+            "description": "Tracks user sessions",
+            "~class": "class",
+            "schema": {
+                "userId": {
+                    "name": "userId",
+                    "type": "foreign_key",
+                    "config": {
+                        "mandatory": true,
+                        "targetClass": "~User",
+                        "isArray": false
+                    }
+                },
+                "username": {
+                    "name": "username",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false,
+                        "primaryKey": true,
+                        "mandatory": true
+                    }
+                },
+                "sessionId": {
+                    "name": "sessionId",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 200,
+                        "primaryKey": true,
+                        "isArray": false,
+                        "mandatory": true
+                    }
+                },
+                "sessionStart": {
+                    "name": "sessionStart",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 100,
+                        "isArray": false,
+                        "mandatory": true
+                    }
+                },
+                "sessionStatus": {
+                    "name": "sessionStatus",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 100,
+                        "isArray": false,
+                        "mandatory": true
+                    }
+                },
+                "sessionEnd": {
+                    "name": "sessionEnd",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 100,
+                        "isArray": false,
+                        "mandatory": false
+                    }
+                }
+            }
+        }
+    ]
+};
+syspatches.push(sys_001, /* sys_002 ,*/ sys_003, sys_004, sys_005, sys_006, sys_007, sys_008, sys_009, sys_010);
+const sys_011 = {
+    "_id": "~sys-0.0.11",
+    "~class": "patch",
+    "version": "0.0.11",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.11\\n#### New Class: ~Group",
+    "docs": [
+        {
+            "_id": "~Group",
+            "active": true,
+            "name": "Group",
+            "description": "Represents a user group",
+            "~class": "class",
+            "schema": {
+                "name": { "name": "name", "type": "string", "config": { "primaryKey": true, "mandatory": true, "maxLength": 100, "isArray": false } }
+            }
+        }
+    ]
+};
+const sys_012 = {
+    "_id": "~sys-0.0.12",
+    "~class": "patch",
+    "version": "0.0.12",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.12\\n#### Updates: introduce groups, optional policy principals, and group-aware sessions",
+    "docs": [
+        {
+            "_id": "~User",
+            "_rev": "auto",
+            "active": true,
+            "name": "User",
+            "description": "A user class for secure login",
+            "~class": "class",
+            "schema": {
+                "username": {
+                    "name": "username",
+                    "type": "string",
+                    "config": {
+                        "primaryKey": true,
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false
+                    }
+                },
+                "password": {
+                    "name": "password",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false,
+                        "encrypted": true
+                    }
+                },
+                "groupId": {
+                    "name": "groupId",
+                    "type": "foreign_key",
+                    "config": {
+                        "mandatory": true,
+                        "isArray": true,
+                        "targetClass": "~Group"
+                    }
+                },
+                "email": {
+                    "name": "email",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "firstName": {
+                    "name": "firstName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "lastName": {
+                    "name": "lastName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "authMethod": {
+                    "name": "authMethod",
+                    "type": "foreign_key",
+                    "config": { "mandatory": true, "targetClass": "~AuthModule" }
+                },
+                "externalId": {
+                    "name": "externalId",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 200,
+                        "isArray": false
+                    }
+                },
+                "keyDerivationSalt": {
+                    "name": "keyDerivationSalt",
+                    "type": "string",
+                    "config": {
+                        "mandatory": true,
+                        "maxLength": 200,
+                        "isArray": false
+                    }
+                },
+                "wrappedDocumentKey": {
+                    "name": "wrappedDocumentKey",
+                    "type": "string",
+                    "config": {
+                        "mandatory": false,
+                        "maxLength": 4096,
+                        "isArray": false,
+                        "encrypted": false
+                    }
+                }
+            }
+        },
+        {
+            "_id": "~UserSession",
+            "_rev": "auto",
+            "name": "UserSession",
+            "active": true,
+            "description": "Tracks user sessions",
+            "~class": "class",
+            "schema": {
+                "userId": {
+                    "name": "userId",
+                    "type": "foreign_key",
+                    "config": {
+                        "mandatory": true,
+                        "targetClass": "~User",
+                        "isArray": false
+                    }
+                },
+                "groupId": {
+                    "name": "groupId",
+                    "type": "foreign_key",
+                    "config": {
+                        "mandatory": true,
+                        "targetClass": "~Group",
+                        "isArray": true
+                    }
+                },
+                "username": {
+                    "name": "username",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false,
+                        "primaryKey": true,
+                        "mandatory": true
+                    }
+                },
+                "sessionId": {
+                    "name": "sessionId",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 200,
+                        "primaryKey": true,
+                        "isArray": false,
+                        "mandatory": true
+                    }
+                },
+                "sessionStart": {
+                    "name": "sessionStart",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 100,
+                        "isArray": false,
+                        "mandatory": true
+                    }
+                },
+                "sessionStatus": {
+                    "name": "sessionStatus",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 100,
+                        "isArray": false,
+                        "mandatory": true
+                    }
+                },
+                "sessionEnd": {
+                    "name": "sessionEnd",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 100,
+                        "isArray": false,
+                        "mandatory": false
+                    }
+                }
+            }
+        },
+        {
+            "_id": "~Policy",
+            "_rev": "auto",
+            "active": true,
+            "name": "Policy",
+            "description": "Access policies for classes and documents",
+            "~class": "class",
+            "schema": {
+                "userId": { "name": "userId", "type": "foreign_key", "config": { "mandatory": false, "targetClass": "~User" } },
+                "groupId": { "name": "groupId", "type": "foreign_key", "config": { "mandatory": false, "targetClass": "~Group" } },
+                "rule": { "name": "rule", "type": "string", "config": { "mandatory": true, "maxLength": 2000 } },
+                "description": { "name": "description", "type": "string", "config": { "mandatory": false } },
+                "targetClass": { "name": "targetClass", "type": "foreign_key", "config": { "mandatory": true, "isArray": true, "targetClass": "class" } }
+            }
+        }
+    ]
+};
+const sys_013 = {
+    "_id": "~sys-0.0.13",
+    "~class": "patch",
+    "version": "0.0.13",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.13\\n#### New Documents: Group-Admin, Group-Default\\n#### Updates: ~User with after trigger for wrappedDocumentKey",
+    "docs": [
+        {
+            "_id": "Group-Admin",
+            "~class": "~Group",
+            "active": true,
+            "name": "Admin"
+        },
+        {
+            "_id": "Group-Default",
+            "~class": "~Group",
+            "active": true,
+            "name": "Default"
+        },
+        {
+            "_id": "~User",
+            "_rev": "auto",
+            "active": true,
+            "name": "User",
+            "description": "A user class for secure login",
+            "~class": "class",
+            "triggers": [
+                {
+                    "name": "ensure-salt",
+                    "order": "before",
+                    "run": `if (!document.keyDerivationSalt) {
+                        const salt = stack.cryptoEngine.generateRandomString(32);
+                        document.keyDerivationSalt = salt;
+                    }
+                    return document;`
+                },
+                {
+                    "name": "auto-wrap-document-key",
+                    "order": "before",
+                    "run": `if (document.password && document.keyDerivationSalt && stack.cryptoEngine.getDocumentKey()) {
+        let shouldRecalculate = true;
+        if (document._id) {
+            try {
+                const currentDoc = await stack.db.get(document._id);
+                if (currentDoc && currentDoc.password === document.password && currentDoc.keyDerivationSalt === document.keyDerivationSalt && currentDoc.wrappedDocumentKey) {
+                    shouldRecalculate = false;
+                    if (!document.wrappedDocumentKey) {
+                        document.wrappedDocumentKey = currentDoc.wrappedDocumentKey;
+                    }
+                }
+            } catch (e) { }
+        }
+        if (shouldRecalculate) {
+            const authModuleId = document.authMethod || "AuthMod-Classic";
+            const authModule = await stack.db.get(authModuleId);
+            const jobId = authModule.jobId;
+            const run = await stack.jobEngine.executeJob(jobId, {
+                password: document.password,
+                salt: document.keyDerivationSalt,
+                keyDerivationSalt: document.keyDerivationSalt,
+            });
+            const derivedKey = (run.finalMetadata)?.derivedKey ?? (run.initialMetadata)?.derivedKey;
+            const wrappedKey = await stack.cryptoEngine.wrapDocumentKey(stack.cryptoEngine.getDocumentKey(), derivedKey);
+            document.wrappedDocumentKey = wrappedKey;
+        }
+    }
+    return document;`
+                }
+            ],
+            "schema": {
+                "username": {
+                    "name": "username",
+                    "type": "string",
+                    "config": {
+                        "primaryKey": true,
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false
+                    }
+                },
+                "password": {
+                    "name": "password",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "mandatory": true,
+                        "isArray": false,
+                        "encrypted": true
+                    }
+                },
+                "groupId": {
+                    "name": "groupId",
+                    "type": "foreign_key",
+                    "config": {
+                        "mandatory": true,
+                        "isArray": true,
+                        "targetClass": "~Group"
+                    }
+                },
+                "email": {
+                    "name": "email",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "firstName": {
+                    "name": "firstName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "lastName": {
+                    "name": "lastName",
+                    "type": "string",
+                    "config": {
+                        "maxLength": 50,
+                        "isArray": false
+                    }
+                },
+                "authMethod": {
+                    "name": "authMethod",
+                    "type": "foreign_key",
+                    "config": { "mandatory": true, "targetClass": "~AuthModule" }
+                },
+                "externalId": {
+                    "name": "externalId",
+                    "type": "string",
+                    "config": { "maxLength": 200, "isArray": false }
+                },
+                "keyDerivationSalt": {
+                    "name": "keyDerivationSalt",
+                    "type": "string",
+                    "config": { "mandatory": true, "maxLength": 200, "isArray": false }
+                },
+                "wrappedDocumentKey": {
+                    "name": "wrappedDocumentKey",
+                    "type": "string",
+                    "config": { "mandatory": false, "maxLength": 4096, "isArray": false, "encrypted": false }
+                }
+            }
+        }
+    ]
+};
+const sys_014 = {
+    "_id": "~sys-0.0.14",
+    "~class": "patch",
+    "version": "0.0.14",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.14\\n#### New Documents: Policy-Admin, Policy-User-SelfAccess\\n#### Updates: system user with groupId",
+    "docs": [
+        {
+            "_id": "system",
+            "_rev": "auto",
+            "~class": "~User",
+            "active": true,
+            "username": "system",
+            "password": "system",
+            "groupId": ["Group-Admin"],
+            "email": "",
+            "firstName": "System",
+            "lastName": "User",
+            "authMethod": "AuthMod-Classic",
+            "externalId": "",
+        },
+        {
+            "_id": "Policy-Admin",
+            "~class": "~Policy",
+            "active": true,
+            "groupId": "Group-Admin",
+            "rule": "return true;",
+            "description": "Default admin policy",
+            "targetClass": ["class", "~UserSession", "~Policy", "~Job", "~JobRun", "~AuthModule", "~Group"]
+        },
+        {
+            "_id": "Policy-User-SelfAccess",
+            "_rev": "auto",
+            "~class": "~Policy",
+            "active": true,
+            "rule": "if (!session || session.sessionStatus !== 'active') return false; if (session.username === 'system') return true; const targetUsername = document?.username || document?._id; return targetUsername === session.username;",
+            "description": "Allow users to access only their own user document or the system user",
+            "targetClass": ["~User"]
+        }
+    ]
+};
+syspatches.push(sys_011, sys_012, sys_013, sys_014);
+export async function getSystemPatches(currentVersion) {
+    const classicAuthJobHash = await hashContent(classicAuthJobContent);
+    const jobAuthClassic = sys_005.docs.find(d => d._id === 'Job-Auth-Classic');
+    if (jobAuthClassic) {
+        jobAuthClassic.hash = classicAuthJobHash;
+    }
+    return syspatches
+        .sort((a, b) => semver.compare(a.version, b.version))
+        .filter((patch) => semver.gt(patch.version, currentVersion));
+}
+export async function getAllSystemPatches() {
+    const classicAuthJobHash = await hashContent(classicAuthJobContent);
+    const jobAuthClassic = sys_005.docs.find(d => d._id === 'Job-Auth-Classic');
+    if (jobAuthClassic) {
+        jobAuthClassic.hash = classicAuthJobHash;
+    }
+    return syspatches.sort((a, b) => semver.compare(a.version, b.version));
+}
+//# sourceMappingURL=index.js.map