@hollware/server 0.1.0 → 0.3.0

package/dist/store-Sq0pwUQv.mjs

@@ -0,0 +1,770 @@
+import { newId } from "@hollware/core";
+import { and, eq, gt, isNull, sql } from "drizzle-orm";
+import { check, foreignKey, index, integer, sqliteTable, text, unique, uniqueIndex } from "drizzle-orm/sqlite-core";
+//#region src/auth/roles.ts
+/**
+* The roles of a user, as the `users_role` CHECK of the schema lists them (ADR-026): the owner,
+* whom `hollware init` creates, and the editors and authors whom invitations bring in.
+*/
+const ROLES = [
+	"owner",
+	"editor",
+	"author"
+];
+/** Whether a string is one of the roles. */
+function isRole(value) {
+	return ROLES.some((role) => role === value);
+}
+/**
+* The scopes each role allows. What a token may do is its own scopes intersected with these,
+* read from the user's current role on every request (ADR-005, ADR-019). An operation asks for
+* scopes, never for a role.
+*
+* - `owner` may do everything: all four scopes.
+* - `editor` reads, writes and publishes.
+* - `author` reads and writes; what an author publishes goes through review (v0.3).
+*/
+const ROLE_SCOPES = {
+	owner: [
+		"content:read",
+		"content:write",
+		"content:publish",
+		"schema:admin"
+	],
+	editor: [
+		"content:read",
+		"content:write",
+		"content:publish"
+	],
+	author: ["content:read", "content:write"]
+};
+/**
+* The scopes a token really has: those it carries that the role of its user allows, in the order
+* of the role. A role that is not one of the roles allows nothing, so a role added to the schema
+* before this table knows it grants no access.
+*/
+function effectiveScopes(role, tokenScopes) {
+	if (!isRole(role)) return [];
+	return ROLE_SCOPES[role].filter((scope) => tokenScopes.includes(scope));
+}
+/**
+* The name a role had in v0.1 and v0.2, which the CHECK of `users.role` still allows: what a new
+* user's `users.role` gets. Roles live in `members` since v0.3; nothing reads `users.role`.
+*/
+function legacyRoleOf(role) {
+	return role === "author" ? "reviewer" : role;
+}
+//#endregion
+//#region src/db/columns.ts
+/**
+* The columns every table shares. Each helper returns a new builder, because a Drizzle column
+* belongs to one table. Only the repository functions write rows, so these defaults are what
+* every row gets.
+*/
+/** The current time in UTC, as ISO 8601 with milliseconds: `2026-10-12T18:30:00.000Z`. */
+function nowIso() {
+	return (/* @__PURE__ */ new Date()).toISOString();
+}
+/** The primary key: a prefixed ULID, such as `ent_01JAB3XQ8ZK4M6N2P5R7S9T0VW`. */
+function id(prefix) {
+	return text("id").primaryKey().$defaultFn(() => newId(prefix));
+}
+/**
+* The site a row belongs to: the site's key in `hollware.config.ts`, which is also the id of its
+* row in `sites`. Every table but the deployment-wide ones carries it (ADR-006).
+*/
+function siteId() {
+	return text("site_id").notNull();
+}
+/** `created_at` and `updated_at`, in UTC; `updated_at` moves on every update. */
+function timestamps() {
+	return {
+		createdAt: text("created_at").notNull().$defaultFn(nowIso),
+		updatedAt: text("updated_at").notNull().$defaultFn(nowIso).$onUpdateFn(nowIso)
+	};
+}
+sqliteTable("_hollware_meta", {
+	key: text("key").primaryKey().notNull(),
+	value: text("value").notNull()
+});
+/** The sites of the deployment. The id is the site's key in `hollware.config.ts`. */
+const sites = sqliteTable("sites", {
+	id: text("id").primaryKey(),
+	...timestamps()
+});
+/**
+* People. A user belongs to the deployment; what they may do in a site is their row of `members`.
+*
+* `role` is the role of v0.1 and v0.2, kept with its CHECK of then: SQLite changes a CHECK only by
+* rebuilding the table, and D1, which never turns foreign keys off, refuses to drop a table that
+* other rows point at. Nothing reads it since v0.3. A new user gets the old name of their role
+* (`legacyRoleOf`), so that the column stays true to the CHECK.
+*/
+const users = sqliteTable("users", {
+	id: id("usr"),
+	name: text("name"),
+	role: text("role").notNull(),
+	...timestamps()
+}, (t) => [check("users_role", sql`${t.role} IN ('owner', 'editor', 'reviewer')`)]);
+/** What a person may do in a site (ADR-026): one role per person and site. */
+const members = sqliteTable("members", {
+	id: id("mbr"),
+	siteId: siteId(),
+	userId: text("user_id").notNull(),
+	role: text("role").notNull(),
+	...timestamps()
+}, (t) => [
+	unique("members_id_site").on(t.id, t.siteId),
+	unique("members_person").on(t.siteId, t.userId),
+	foreignKey({
+		name: "members_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "members_user",
+		columns: [t.userId],
+		foreignColumns: [users.id]
+	}),
+	check("members_role", sql`${t.role} IN ('owner', 'editor', 'author')`)
+]);
+/** Personal tokens (ADR-019): only the hash is stored. */
+const tokens = sqliteTable("tokens", {
+	id: id("tok"),
+	siteId: siteId(),
+	userId: text("user_id").notNull(),
+	label: text("label").notNull(),
+	hash: text("hash").notNull(),
+	/** A JSON array of scopes. */
+	scopes: text("scopes").notNull(),
+	expiresAt: text("expires_at"),
+	revokedAt: text("revoked_at"),
+	lastUsedAt: text("last_used_at"),
+	...timestamps()
+}, (t) => [
+	unique("tokens_id_site").on(t.id, t.siteId),
+	unique("tokens_hash").on(t.hash),
+	foreignKey({
+		name: "tokens_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "tokens_user",
+		columns: [t.userId],
+		foreignColumns: [users.id]
+	}),
+	check("tokens_scopes", sql`json_valid(${t.scopes}) AND json_type(${t.scopes}) = 'array'`)
+]);
+/** One entry per site, collection, locale and slug; its content lives in `revisions`. */
+const entries = sqliteTable("entries", {
+	id: id("ent"),
+	siteId: siteId(),
+	collection: text("collection").notNull(),
+	locale: text("locale").notNull(),
+	slug: text("slug").notNull(),
+	translationGroup: text("translation_group"),
+	status: text("status").notNull(),
+	/** Bumped by every change of the entry: the optimistic write compares it. */
+	version: integer("version").notNull(),
+	headRev: text("head_rev").notNull(),
+	publishedRev: text("published_rev"),
+	publishedAt: text("published_at"),
+	publishedSortKey: text("published_sort_key"),
+	scheduledAt: text("scheduled_at"),
+	...timestamps()
+}, (t) => [
+	unique("entries_id_site").on(t.id, t.siteId),
+	unique("entries_slug").on(t.siteId, t.collection, t.locale, t.slug),
+	unique("entries_translation").on(t.siteId, t.collection, t.translationGroup, t.locale),
+	index("entries_head").on(t.siteId, t.collection, t.updatedAt, t.id),
+	index("entries_head_locale").on(t.siteId, t.collection, t.locale, t.updatedAt, t.id),
+	index("entries_published").on(t.siteId, t.collection, t.locale, t.publishedSortKey, t.id).where(sql`${t.status} = 'published'`),
+	foreignKey({
+		name: "entries_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	check("entries_status", sql`${t.status} IN ('draft', 'scheduled', 'published')`),
+	check("entries_version", sql`${t.version} >= 1`),
+	check("entries_draft", sql`${t.status} <> 'draft' OR (${t.publishedRev} IS NULL AND ${t.publishedSortKey} IS NULL AND ${t.scheduledAt} IS NULL)`),
+	check("entries_published", sql`${t.status} <> 'published' OR (${t.publishedRev} IS NOT NULL AND ${t.publishedAt} IS NOT NULL AND ${t.publishedSortKey} IS NOT NULL)`),
+	check("entries_scheduled", sql`${t.status} <> 'scheduled' OR ${t.scheduledAt} IS NOT NULL`)
+]);
+/**
+* Every version of an entry, appended and never changed (ADR-021). `markdown` is the whole file,
+* frontmatter included; the derived columns can be rebuilt by `reparse`.
+*/
+const revisions = sqliteTable("revisions", {
+	id: id("rev"),
+	siteId: siteId(),
+	entryId: text("entry_id").notNull(),
+	markdown: text("markdown").notNull(),
+	/** Derived: the frontmatter as JSON. */
+	frontmatter: text("frontmatter").notNull(),
+	/** Derived: the Comark document as JSON. */
+	document: text("document").notNull(),
+	comarkVersion: text("comark_version").notNull(),
+	pipelineVersion: text("pipeline_version").notNull(),
+	wordCount: integer("word_count").notNull(),
+	/** The verdict of the contracts when the revision was written, as JSON. */
+	verdict: text("verdict").notNull(),
+	actorKind: text("actor_kind").notNull(),
+	actorUserId: text("actor_user_id").notNull(),
+	actorTokenId: text("actor_token_id"),
+	/** The client and, when it says, the model behind the write, as JSON. */
+	actorMeta: text("actor_meta"),
+	...timestamps()
+}, (t) => [
+	unique("revisions_id_site").on(t.id, t.siteId),
+	index("revisions_entry").on(t.entryId, t.createdAt),
+	foreignKey({
+		name: "revisions_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "revisions_entry",
+		columns: [t.entryId, t.siteId],
+		foreignColumns: [entries.id, entries.siteId]
+	}),
+	foreignKey({
+		name: "revisions_user",
+		columns: [t.actorUserId],
+		foreignColumns: [users.id]
+	}),
+	foreignKey({
+		name: "revisions_token",
+		columns: [t.actorTokenId, t.siteId],
+		foreignColumns: [tokens.id, tokens.siteId]
+	}),
+	check("revisions_actor_kind", sql`${t.actorKind} IN ('token', 'user', 'oauth_client')`),
+	check("revisions_json", sql`json_valid(${t.frontmatter}) AND json_valid(${t.document}) AND json_valid(${t.verdict}) AND (${t.actorMeta} IS NULL OR json_valid(${t.actorMeta}))`),
+	check("revisions_word_count", sql`${t.wordCount} >= 0`)
+]);
+/** The tags of a revision, for listing published entries by tag. Append-only, like revisions. */
+const revisionTags = sqliteTable("revision_tags", {
+	id: id("tag"),
+	siteId: siteId(),
+	revisionId: text("revision_id").notNull(),
+	tag: text("tag").notNull(),
+	...timestamps()
+}, (t) => [
+	unique("revision_tags_id_site").on(t.id, t.siteId),
+	unique("revision_tags_tag").on(t.revisionId, t.tag),
+	index("revision_tags_by_tag").on(t.siteId, t.tag),
+	foreignKey({
+		name: "revision_tags_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "revision_tags_revision",
+		columns: [t.revisionId, t.siteId],
+		foreignColumns: [revisions.id, revisions.siteId]
+	})
+]);
+/**
+* Every publish and unpublish, appended: the verdict of the publish phase and the warnings the
+* caller acknowledged (ADR-021).
+*/
+const publications = sqliteTable("publications", {
+	id: id("pub"),
+	siteId: siteId(),
+	entryId: text("entry_id").notNull(),
+	action: text("action").notNull(),
+	revisionId: text("revision_id"),
+	verdict: text("verdict"),
+	/** A JSON array: the warnings the caller acknowledged to publish. */
+	acknowledged: text("acknowledged").notNull(),
+	actorKind: text("actor_kind").notNull(),
+	actorUserId: text("actor_user_id").notNull(),
+	actorTokenId: text("actor_token_id"),
+	actorMeta: text("actor_meta"),
+	...timestamps()
+}, (t) => [
+	unique("publications_id_site").on(t.id, t.siteId),
+	index("publications_entry").on(t.entryId, t.createdAt),
+	foreignKey({
+		name: "publications_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "publications_entry",
+		columns: [t.entryId, t.siteId],
+		foreignColumns: [entries.id, entries.siteId]
+	}),
+	foreignKey({
+		name: "publications_revision",
+		columns: [t.revisionId, t.siteId],
+		foreignColumns: [revisions.id, revisions.siteId]
+	}),
+	foreignKey({
+		name: "publications_user",
+		columns: [t.actorUserId],
+		foreignColumns: [users.id]
+	}),
+	foreignKey({
+		name: "publications_token",
+		columns: [t.actorTokenId, t.siteId],
+		foreignColumns: [tokens.id, tokens.siteId]
+	}),
+	check("publications_action", sql`${t.action} IN ('publish', 'unpublish')`),
+	check("publications_shape", sql`(${t.action} = 'publish' AND ${t.revisionId} IS NOT NULL AND ${t.verdict} IS NOT NULL) OR (${t.action} = 'unpublish' AND ${t.revisionId} IS NULL AND ${t.verdict} IS NULL)`),
+	check("publications_actor_kind", sql`${t.actorKind} IN ('token', 'user', 'oauth_client')`),
+	check("publications_json", sql`json_valid(${t.acknowledged}) AND json_type(${t.acknowledged}) = 'array' AND (${t.verdict} IS NULL OR json_valid(${t.verdict})) AND (${t.actorMeta} IS NULL OR json_valid(${t.actorMeta}))`)
+]);
+/**
+* Scheduled publications (ADR-025): one per entry at most. The cron trigger publishes the entry when
+* `scheduled_at` has passed, if it is still at `version`, with the warnings that were acknowledged
+* when it was scheduled, and in the name of who scheduled it.
+*/
+const schedules = sqliteTable("schedules", {
+	id: id("sch"),
+	siteId: siteId(),
+	entryId: text("entry_id").notNull(),
+	scheduledAt: text("scheduled_at").notNull(),
+	/** The version of the entry once scheduled: a later change cancels the schedule. */
+	version: integer("version").notNull(),
+	/** A JSON array: the warnings acknowledged when the publication was scheduled. */
+	acknowledged: text("acknowledged").notNull(),
+	actorKind: text("actor_kind").notNull(),
+	actorUserId: text("actor_user_id").notNull(),
+	actorTokenId: text("actor_token_id"),
+	actorMeta: text("actor_meta"),
+	...timestamps()
+}, (t) => [
+	unique("schedules_id_site").on(t.id, t.siteId),
+	unique("schedules_entry").on(t.siteId, t.entryId),
+	index("schedules_due").on(t.scheduledAt),
+	foreignKey({
+		name: "schedules_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "schedules_entry_fk",
+		columns: [t.entryId, t.siteId],
+		foreignColumns: [entries.id, entries.siteId]
+	}),
+	foreignKey({
+		name: "schedules_user",
+		columns: [t.actorUserId],
+		foreignColumns: [users.id]
+	}),
+	foreignKey({
+		name: "schedules_token",
+		columns: [t.actorTokenId, t.siteId],
+		foreignColumns: [tokens.id, tokens.siteId]
+	}),
+	check("schedules_actor_kind", sql`${t.actorKind} IN ('token', 'user', 'oauth_client')`),
+	check("schedules_json", sql`json_valid(${t.acknowledged}) AND json_type(${t.acknowledged}) = 'array' AND (${t.actorMeta} IS NULL OR json_valid(${t.actorMeta}))`)
+]);
+/**
+* The effects of a publication (ADR-025), written in the batch that publishes or unpublishes: one
+* row per event. The Queue consumer delivers each event to every subscriber, and records it in
+* `deliveries`; `sent_at` says that the event was put on the Queue.
+*/
+const outbox = sqliteTable("outbox", {
+	id: id("evt"),
+	siteId: siteId(),
+	/** `entry.published` or `entry.unpublished`. */
+	kind: text("kind").notNull(),
+	entryId: text("entry_id").notNull(),
+	/** A JSON object: what subscribers get. */
+	payload: text("payload").notNull(),
+	sentAt: text("sent_at"),
+	...timestamps()
+}, (t) => [
+	unique("outbox_id_site").on(t.id, t.siteId),
+	index("outbox_unsent").on(t.sentAt, t.createdAt),
+	foreignKey({
+		name: "outbox_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	check("outbox_kind", sql`${t.kind} IN ('entry.published', 'entry.unpublished')`),
+	check("outbox_json", sql`json_valid(${t.payload}) AND json_type(${t.payload}) = 'object'`)
+]);
+/** Each delivery of an event to a subscriber, so that a retry never delivers it twice. */
+const deliveries = sqliteTable("deliveries", {
+	id: id("dlv"),
+	siteId: siteId(),
+	eventId: text("event_id").notNull(),
+	/** The subscriber, by its name in the config, such as `webhook:newsletter` or `indexnow`. */
+	subscriber: text("subscriber").notNull(),
+	attempts: integer("attempts").notNull(),
+	deliveredAt: text("delivered_at"),
+	lastError: text("last_error"),
+	...timestamps()
+}, (t) => [
+	unique("deliveries_id_site").on(t.id, t.siteId),
+	unique("deliveries_event_subscriber").on(t.eventId, t.subscriber),
+	foreignKey({
+		name: "deliveries_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "deliveries_event",
+		columns: [t.eventId, t.siteId],
+		foreignColumns: [outbox.id, outbox.siteId]
+	}),
+	check("deliveries_attempts", sql`${t.attempts} >= 0`)
+]);
+/** The passkeys of a person (ADR-026): WebAuthn credentials, by their id, with their public key. */
+const passkeys = sqliteTable("passkeys", {
+	id: id("pky"),
+	siteId: siteId(),
+	userId: text("user_id").notNull(),
+	/** The credential id, base64url, as the authenticator gives it. */
+	credentialId: text("credential_id").notNull(),
+	/** The COSE public key, base64url. */
+	publicKey: text("public_key").notNull(),
+	counter: integer("counter").notNull(),
+	/** A JSON array of the transports the authenticator reported. */
+	transports: text("transports").notNull(),
+	/** What the person calls it, such as "MacBook". */
+	label: text("label").notNull(),
+	lastUsedAt: text("last_used_at"),
+	...timestamps()
+}, (t) => [
+	unique("passkeys_id_site").on(t.id, t.siteId),
+	unique("passkeys_credential").on(t.credentialId),
+	index("passkeys_user").on(t.userId),
+	foreignKey({
+		name: "passkeys_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "passkeys_user_fk",
+		columns: [t.userId],
+		foreignColumns: [users.id]
+	}),
+	check("passkeys_counter", sql`${t.counter} >= 0`),
+	check("passkeys_json", sql`json_valid(${t.transports}) AND json_type(${t.transports}) = 'array'`)
+]);
+/**
+* Links that let a person in, once: the owner's setup link that `hollware init` prints (it names
+* the owner) and invitations (they carry a role, and the person they make is new). Only the hash
+* of the link's secret is stored.
+*/
+const invitations = sqliteTable("invitations", {
+	id: id("inv"),
+	siteId: siteId(),
+	hash: text("hash").notNull(),
+	role: text("role").notNull(),
+	/** The existing person the link is for, or null for an invitation that makes a new one. */
+	userId: text("user_id"),
+	expiresAt: text("expires_at").notNull(),
+	usedAt: text("used_at"),
+	...timestamps()
+}, (t) => [
+	unique("invitations_id_site").on(t.id, t.siteId),
+	unique("invitations_hash").on(t.hash),
+	foreignKey({
+		name: "invitations_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "invitations_user",
+		columns: [t.userId],
+		foreignColumns: [users.id]
+	}),
+	check("invitations_role", sql`${t.role} IN ('owner', 'editor', 'author')`)
+]);
+/** WebAuthn challenges, each used once and briefly (ADR-026). */
+const authChallenges = sqliteTable("auth_challenges", {
+	id: id("chl"),
+	siteId: siteId(),
+	challenge: text("challenge").notNull(),
+	/** `register` or `authenticate`. */
+	purpose: text("purpose").notNull(),
+	/** The invitation a registration redeems, or null for a sign-in. */
+	invitationId: text("invitation_id"),
+	/** The person a registration makes or adds a passkey to: the id the passkey is bound to. */
+	userId: text("user_id"),
+	expiresAt: text("expires_at").notNull(),
+	...timestamps()
+}, (t) => [
+	unique("auth_challenges_id_site").on(t.id, t.siteId),
+	foreignKey({
+		name: "auth_challenges_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	check("auth_challenges_purpose", sql`${t.purpose} IN ('register', 'authenticate')`)
+]);
+/** Signed-in people (ADR-026): the session cookie that `/authorize` reads, by its hash. */
+const sessions = sqliteTable("sessions", {
+	id: id("ses"),
+	siteId: siteId(),
+	userId: text("user_id").notNull(),
+	hash: text("hash").notNull(),
+	expiresAt: text("expires_at").notNull(),
+	...timestamps()
+}, (t) => [
+	unique("sessions_id_site").on(t.id, t.siteId),
+	unique("sessions_hash").on(t.hash),
+	foreignKey({
+		name: "sessions_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "sessions_user",
+		columns: [t.userId],
+		foreignColumns: [users.id]
+	})
+]);
+/**
+* Reviews (v0.3): a person who may write but not publish asks for a revision to be published, and
+* a person who may publish approves it, which publishes it, or asks for changes with a note. An
+* entry has at most one pending review; a new revision of the entry cancels it, and a publication
+* of the entry approves it, in the batch of that write.
+*/
+const reviews = sqliteTable("reviews", {
+	id: id("rvw"),
+	siteId: siteId(),
+	entryId: text("entry_id").notNull(),
+	/** The revision asked for: the head of the entry when the review was asked. */
+	revisionId: text("revision_id").notNull(),
+	status: text("status").notNull(),
+	/** A JSON array: the warnings the person who asked acknowledged. */
+	acknowledged: text("acknowledged").notNull(),
+	requestedBy: text("requested_by").notNull(),
+	/** What the client that asked said about itself, as JSON, or `null`. */
+	requestedMeta: text("requested_meta"),
+	decidedBy: text("decided_by"),
+	decidedAt: text("decided_at"),
+	/** What the person who asked for changes wrote. */
+	note: text("note"),
+	...timestamps()
+}, (t) => [
+	unique("reviews_id_site").on(t.id, t.siteId),
+	uniqueIndex("reviews_pending").on(t.siteId, t.entryId).where(sql`${t.status} = 'pending'`),
+	index("reviews_queue").on(t.siteId, t.status, t.createdAt),
+	foreignKey({
+		name: "reviews_site",
+		columns: [t.siteId],
+		foreignColumns: [sites.id]
+	}),
+	foreignKey({
+		name: "reviews_entry",
+		columns: [t.entryId, t.siteId],
+		foreignColumns: [entries.id, entries.siteId]
+	}),
+	foreignKey({
+		name: "reviews_revision",
+		columns: [t.revisionId, t.siteId],
+		foreignColumns: [revisions.id, revisions.siteId]
+	}),
+	foreignKey({
+		name: "reviews_requester",
+		columns: [t.requestedBy],
+		foreignColumns: [users.id]
+	}),
+	foreignKey({
+		name: "reviews_decider",
+		columns: [t.decidedBy],
+		foreignColumns: [users.id]
+	}),
+	check("reviews_status", sql`${t.status} IN ('pending', 'approved', 'changes_requested', 'cancelled')`),
+	check("reviews_decided", sql`(${t.status} IN ('pending', 'cancelled')) OR (${t.decidedBy} IS NOT NULL AND ${t.decidedAt} IS NOT NULL)`),
+	check("reviews_json", sql`json_valid(${t.acknowledged}) AND json_type(${t.acknowledged}) = 'array' AND (${t.requestedMeta} IS NULL OR json_valid(${t.requestedMeta}))`)
+]);
+//#endregion
+//#region src/identity/secrets.ts
+/**
+* The secrets of identity (ADR-026): an invitation link and a session cookie are 32 random bytes,
+* base64url, with a prefix that says what they are. Only the SHA-256 of a secret is stored.
+*/
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** A new secret: `<prefix>_` and 43 base64url characters. */
+function newSecret(prefix) {
+	return `${prefix}_${base64url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)))}`;
+}
+/** The SHA-256 of a secret, in hex: what the database keeps. */
+async function hashSecret(secret) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** The bytes of a user id, as WebAuthn binds a passkey to them. */
+function userHandle(userId) {
+	const bytes = new TextEncoder().encode(userId);
+	const handle = new Uint8Array(bytes.length);
+	handle.set(bytes);
+	return handle;
+}
+//#endregion
+//#region src/identity/store.ts
+function roleOf(value) {
+	if (value === "owner" || value === "editor" || value === "author") return value;
+	throw new Error(`An invitation has the role ${value}, which the schema does not allow`);
+}
+/** Creates a link that lets one person in, and gives its secret, which is never stored. */
+async function createInvitation(db, input) {
+	const secret = newSecret("hw_inv");
+	const id = newId("inv");
+	const now = input.now.toISOString();
+	const expiresAt = new Date(input.now.getTime() + input.days * 864e5).toISOString();
+	await db.insert(invitations).values({
+		id,
+		siteId: input.site,
+		hash: await hashSecret(secret),
+		role: input.role,
+		userId: input.userId,
+		expiresAt,
+		usedAt: null,
+		createdAt: now,
+		updatedAt: now
+	});
+	return {
+		id,
+		secret,
+		expiresAt
+	};
+}
+/** The invitation of a secret, while it is unused and has not expired. */
+async function findInvitation(db, site, secret, now) {
+	const [row] = await db.select({
+		id: invitations.id,
+		role: invitations.role,
+		userId: invitations.userId
+	}).from(invitations).where(and(eq(invitations.siteId, site), eq(invitations.hash, await hashSecret(secret)), isNull(invitations.usedAt), gt(invitations.expiresAt, now.toISOString()))).limit(1);
+	return row === void 0 ? null : {
+		...row,
+		role: roleOf(row.role)
+	};
+}
+/** Uses an invitation, once: `false` when it was used already or has expired. */
+async function redeemInvitation(db, site, id, now) {
+	const at = now.toISOString();
+	return (await db.update(invitations).set({
+		usedAt: at,
+		updatedAt: at
+	}).where(and(eq(invitations.siteId, site), eq(invitations.id, id), isNull(invitations.usedAt), gt(invitations.expiresAt, at))).returning({ id: invitations.id })).length === 1;
+}
+/** Keeps a WebAuthn challenge for five minutes. */
+async function saveChallenge(db, input) {
+	const id = newId("chl");
+	const now = input.now.toISOString();
+	await db.insert(authChallenges).values({
+		id,
+		siteId: input.site,
+		challenge: input.challenge,
+		purpose: input.purpose,
+		invitationId: input.invitationId,
+		userId: input.userId,
+		expiresAt: new Date(input.now.getTime() + 3e5).toISOString(),
+		createdAt: now,
+		updatedAt: now
+	});
+	return id;
+}
+/** Takes a challenge, once, if it has the purpose asked and has not expired. */
+async function takeChallenge(db, input) {
+	const [row] = await db.delete(authChallenges).where(and(eq(authChallenges.siteId, input.site), eq(authChallenges.id, input.id))).returning();
+	if (row === void 0 || row.purpose !== input.purpose) return null;
+	if (row.expiresAt <= input.now.toISOString()) return null;
+	return row;
+}
+async function passkeysOf(db, site, userId) {
+	return db.select().from(passkeys).where(and(eq(passkeys.siteId, site), eq(passkeys.userId, userId)));
+}
+async function findPasskey(db, site, credentialId) {
+	const [row] = await db.select().from(passkeys).where(and(eq(passkeys.siteId, site), eq(passkeys.credentialId, credentialId))).limit(1);
+	return row ?? null;
+}
+/** Records a sign-in with a passkey: its new counter, and when. */
+async function touchPasskey(db, id, counter, now) {
+	const at = now.toISOString();
+	await db.update(passkeys).set({
+		counter,
+		lastUsedAt: at,
+		updatedAt: at
+	}).where(eq(passkeys.id, id));
+}
+/** Makes the person of a new invitation, a member of the site with its role, in one batch. */
+async function createUser(db, input) {
+	const at = input.now.toISOString();
+	await db.batch([db.insert(users).values({
+		id: input.id,
+		name: input.name,
+		role: legacyRoleOf(input.role),
+		createdAt: at,
+		updatedAt: at
+	}), db.insert(members).values({
+		id: newId("mbr"),
+		siteId: input.site,
+		userId: input.id,
+		role: input.role,
+		createdAt: at,
+		updatedAt: at
+	})]);
+}
+async function addPasskey(db, input) {
+	const at = input.now.toISOString();
+	await db.insert(passkeys).values({
+		id: newId("pky"),
+		siteId: input.site,
+		userId: input.userId,
+		credentialId: input.credentialId,
+		publicKey: input.publicKey,
+		counter: input.counter,
+		transports: JSON.stringify(input.transports),
+		label: input.label,
+		lastUsedAt: null,
+		createdAt: at,
+		updatedAt: at
+	});
+}
+/** Opens a session for a person, and gives the secret of its cookie, which is never stored. */
+async function createSession(db, input) {
+	const secret = newSecret("hw_ses");
+	const at = input.now.toISOString();
+	const expiresAt = new Date(input.now.getTime() + input.hours * 36e5).toISOString();
+	await db.insert(sessions).values({
+		id: newId("ses"),
+		siteId: input.site,
+		userId: input.userId,
+		hash: await hashSecret(secret),
+		expiresAt,
+		createdAt: at,
+		updatedAt: at
+	});
+	return {
+		secret,
+		expiresAt
+	};
+}
+/** The person of a session cookie, while it lasts, with their role in its site now. */
+async function findSession(db, site, secret, now) {
+	const [row] = await db.select({
+		userId: sessions.userId,
+		name: users.name,
+		role: members.role
+	}).from(sessions).innerJoin(users, eq(users.id, sessions.userId)).innerJoin(members, and(eq(members.userId, sessions.userId), eq(members.siteId, sessions.siteId))).where(and(eq(sessions.siteId, site), eq(sessions.hash, await hashSecret(secret)), gt(sessions.expiresAt, now.toISOString()))).limit(1);
+	return row ?? null;
+}
+/** An invitation by its id, used or not: what a registration redeems. */
+async function invitationById(db, site, id) {
+	const [row] = await db.select({
+		id: invitations.id,
+		role: invitations.role,
+		userId: invitations.userId
+	}).from(invitations).where(and(eq(invitations.siteId, site), eq(invitations.id, id))).limit(1);
+	return row === void 0 ? null : {
+		...row,
+		role: roleOf(row.role)
+	};
+}
+//#endregion
+export { isRole as A, revisions as C, users as D, tokens as E, ROLE_SCOPES as O, revisionTags as S, sites as T, invitations as _, findInvitation as a, publications as b, invitationById as c, saveChallenge as d, takeChallenge as f, entries as g, deliveries as h, createUser as i, effectiveScopes as k, passkeysOf as l, userHandle as m, createInvitation as n, findPasskey as o, touchPasskey as p, createSession as r, findSession as s, addPasskey as t, redeemInvitation as u, members as v, schedules as w, reviews as x, outbox as y };