@krantho/persistence-postgres 0.0.0-stage → 1.0.1

package/dist/migration-runner.js

@@ -0,0 +1,123 @@
+import { createHash } from 'node:crypto';
+import { migrationFailedMessage, resolveCurrentVersion, validateChecksums, } from '@krantho/persistence';
+/** Compute SHA-256 checksum of a migration's identity */
+function computeChecksum(migration) {
+    const content = `v${migration.version}:${migration.name}`;
+    return createHash('sha256').update(content).digest('hex');
+}
+const CREATE_SCHEMA_MIGRATIONS = `
+CREATE TABLE IF NOT EXISTS schema_migrations (
+  version INTEGER PRIMARY KEY,
+  name TEXT NOT NULL,
+  checksum TEXT NOT NULL,
+  applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+)`;
+/**
+ * Advisory lock key that serializes migration runs across processes. A fixed
+ * value — the ASCII bytes of "krantho" — so every krantho process sharing a
+ * database contends for the same lock.
+ */
+const MIGRATION_LOCK_KEY = '30224656064259183';
+/** Read the applied-migration ledger, or null when it has not been created yet */
+async function readLedger(sql) {
+    try {
+        const rows = await sql `
+      SELECT version, name, checksum, applied_at FROM schema_migrations ORDER BY version`;
+        return new Map(rows.map((m) => [m.version, m]));
+    }
+    catch (err) {
+        if (isUndefinedTable(err))
+            return null;
+        throw err;
+    }
+}
+/** Apply every pending migration. Must run inside the transaction holding the migration lock. */
+async function applyPending(tx, migrations) {
+    await tx.unsafe(CREATE_SCHEMA_MIGRATIONS);
+    const ledger = (await readLedger(tx)) ?? new Map();
+    validateChecksums(migrations, ledger, computeChecksum);
+    const newlyApplied = [];
+    for (const migration of [...migrations].sort((a, b) => a.version - b.version)) {
+        if (ledger.has(migration.version))
+            continue;
+        const checksum = computeChecksum(migration);
+        const appliedAt = new Date().toISOString();
+        try {
+            await migration.apply(tx);
+            await tx.unsafe('INSERT INTO schema_migrations (version, name, checksum, applied_at) VALUES ($1, $2, $3, $4)', [migration.version, migration.name, checksum, appliedAt]);
+        }
+        catch (err) {
+            throw new Error(migrationFailedMessage(migration.version, migration.name, err));
+        }
+        newlyApplied.push({ version: migration.version, name: migration.name, checksum, appliedAt });
+    }
+    return {
+        applied: newlyApplied,
+        currentVersion: resolveCurrentVersion(ledger.keys(), newlyApplied),
+    };
+}
+/**
+ * Run pending migrations on a Postgres database.
+ *
+ * Self-bootstrapping: creates the schema_migrations table if it doesn't exist.
+ * All pending migrations run in one transaction. Halts on first failure, which
+ * rolls back the whole run.
+ *
+ * Deciding what is pending and applying it is a check-then-act, so it runs while
+ * holding a transaction-scoped advisory lock: the lock is taken before the ledger
+ * is read and released when the last migration commits. Serverless platforms
+ * cold-start several instances against the same database at once, and without
+ * the lock they all read an empty ledger and race to create the same tables. A
+ * losing instance waits on the lock and then re-reads the ledger inside it,
+ * finding the work already done.
+ */
+export async function runMigrations(sql, migrations) {
+    // Fast path — an already-migrated database is the common case, and reading the
+    // ledger without the lock is safe because "every migration is applied" is a
+    // state no concurrent migration run can take away.
+    const ledger = await readLedger(sql);
+    if (ledger) {
+        validateChecksums(migrations, ledger, computeChecksum);
+        if (migrations.every((m) => ledger.has(m.version))) {
+            return { applied: [], currentVersion: resolveCurrentVersion(ledger.keys(), []) };
+        }
+    }
+    return sql.begin(async (tx) => {
+        await tx.unsafe(`SELECT pg_advisory_xact_lock(${MIGRATION_LOCK_KEY})`);
+        return applyPending(tx, migrations);
+    });
+}
+/** Get the current schema version from the database */
+export async function getSchemaVersion(sql) {
+    try {
+        const rows = await sql `
+      SELECT MAX(version) as max_version FROM schema_migrations`;
+        return rows[0]?.max_version ?? 0;
+    }
+    catch (err) {
+        // 42P01 = "relation does not exist" — table not created yet
+        if (isUndefinedTable(err))
+            return 0;
+        throw err;
+    }
+}
+/** Get all applied migrations */
+export async function getAppliedMigrations(sql) {
+    const ledger = await readLedger(sql);
+    if (!ledger)
+        return [];
+    return [...ledger.values()].map((r) => ({
+        version: r.version,
+        name: r.name,
+        checksum: r.checksum,
+        appliedAt: r.applied_at instanceof Date ? r.applied_at.toISOString() : String(r.applied_at),
+    }));
+}
+/** Check if a Postgres error is "relation does not exist" (42P01) */
+function isUndefinedTable(err) {
+    if (typeof err === 'object' && err !== null && 'code' in err) {
+        return err.code === '42P01';
+    }
+    return false;
+}
+//# sourceMappingURL=migration-runner.js.map

package/dist/migration-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-runner.js","sourceRoot":"","sources":["../src/migration-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,sBAAsB,CAAA;AAU7B,yDAAyD;AACzD,SAAS,eAAe,CAAC,SAA4B;IACnD,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,CAAA;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,wBAAwB,GAAG;;;;;;EAM/B,CAAA;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,mBAAmB,CAAA;AAI9C,kFAAkF;AAClF,KAAK,UAAU,UAAU,CAAC,GAAyB;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAgB;yFAC+C,CAAA;QACrF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,gBAAgB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QACtC,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,YAAY,CACzB,EAAkB,EAClB,UAAwC;IAExC,MAAM,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,EAAwB,CAAA;IACxE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;IAEtD,MAAM,YAAY,GAAuB,EAAE,CAAA;IAE3C,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,SAAQ;QAE3C,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACzB,MAAM,EAAE,CAAC,MAAM,CACb,6FAA6F,EAC7F,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CACzD,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACjF,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;IAC9F,CAAC;IAED,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,cAAc,EAAE,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC;KACnE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAQ,EACR,UAAwC;IAExC,+EAA+E;IAC/E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,MAAM,EAAE,CAAC;QACX,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;QACtD,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAA;QAClF,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,EAAE,CAAC,MAAM,CAAC,gCAAgC,kBAAkB,GAAG,CAAC,CAAA;QACtE,OAAO,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAQ;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAuC;gEACD,CAAA;QAC5D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,4DAA4D;QAC5D,IAAI,gBAAgB,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAA;QACnC,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAQ;IACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAEtB,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,UAAU,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;KAC5F,CAAC,CAAC,CAAA;AACL,CAAC;AAED,qEAAqE;AACrE,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAC7D,OAAQ,GAAwB,CAAC,IAAI,KAAK,OAAO,CAAA;IACnD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,4 @@
+import type { PostgresMigration } from '../migration-runner.js';
+/** All registered Postgres migrations, in version order */
+export declare const postgresMigrations: readonly PostgresMigration[];
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAgB/D,2DAA2D;AAC3D,eAAO,MAAM,kBAAkB,EAAE,SAAS,iBAAiB,EAe1D,CAAA"}

package/dist/migrations/index.js

@@ -0,0 +1,32 @@
+import { v001InitialSchema } from './v001-initial-schema.js';
+import { v002AuthTables } from './v002-auth-tables.js';
+import { v003UserPermissions } from './v003-user-permissions.js';
+import { v004MediaHotspot } from './v004-media-hotspot.js';
+import { v005ContentLocks } from './v005-content-locks.js';
+import { v006WebhookDeliveries } from './v006-webhook-deliveries.js';
+import { v007MediaFolders } from './v007-media-folders.js';
+import { v008SiteSettings } from './v008-site-settings.js';
+import { v009SeoConfig } from './v009-seo-config.js';
+import { v010ContentLiveVersion } from './v010-content-live-version.js';
+import { v011Media } from './v011-media.js';
+import { v012PageCache } from './v012-page-cache.js';
+import { v013ContentContracts } from './v013-content-contracts.js';
+import { v014ContentManifestCommit } from './v014-content-manifest-commit.js';
+/** All registered Postgres migrations, in version order */
+export const postgresMigrations = [
+    v001InitialSchema,
+    v002AuthTables,
+    v003UserPermissions,
+    v004MediaHotspot,
+    v005ContentLocks,
+    v006WebhookDeliveries,
+    v007MediaFolders,
+    v008SiteSettings,
+    v009SeoConfig,
+    v010ContentLiveVersion,
+    v011Media,
+    v012PageCache,
+    v013ContentContracts,
+    v014ContentManifestCommit,
+];
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAE7E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAiC;IAC9D,iBAAiB;IACjB,cAAc;IACd,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,qBAAqB;IACrB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,sBAAsB;IACtB,SAAS;IACT,aAAa;IACb,oBAAoB;IACpB,yBAAyB;CAC1B,CAAA"}

package/dist/migrations/v001-initial-schema.d.ts

@@ -0,0 +1,10 @@
+import type { PostgresMigration } from '../migration-runner.js';
+/**
+ * V001: Initial schema — all core tables in their final form.
+ *
+ * Content uses the append-only versioning model (version, is_current, deleted_at).
+ * Collection schemas are append-only. Includes content manifest, migration
+ * conflicts, and checkpoint tables.
+ */
+export declare const v001InitialSchema: PostgresMigration;
+//# sourceMappingURL=v001-initial-schema.d.ts.map

package/dist/migrations/v001-initial-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v001-initial-schema.d.ts","sourceRoot":"","sources":["../../src/migrations/v001-initial-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,iBA0G/B,CAAA"}

package/dist/migrations/v001-initial-schema.js

@@ -0,0 +1,94 @@
+/**
+ * V001: Initial schema — all core tables in their final form.
+ *
+ * Content uses the append-only versioning model (version, is_current, deleted_at).
+ * Collection schemas are append-only. Includes content manifest, migration
+ * conflicts, and checkpoint tables.
+ */
+export const v001InitialSchema = {
+    version: 1,
+    name: 'initial_schema',
+    apply: async (sql) => {
+        // --- Content (append-only) ---
+        await sql.unsafe(`
+      CREATE TABLE content (
+        id TEXT PRIMARY KEY,
+        collection TEXT NOT NULL,
+        slug TEXT NOT NULL,
+        locale TEXT NOT NULL DEFAULT 'en',
+        version INTEGER NOT NULL,
+        is_current BOOLEAN NOT NULL DEFAULT TRUE,
+        status TEXT NOT NULL DEFAULT 'draft',
+        fields JSONB NOT NULL,
+        body TEXT NOT NULL,
+        html TEXT NOT NULL DEFAULT '',
+        sections JSONB NOT NULL DEFAULT '{}'::jsonb,
+        source TEXT NOT NULL DEFAULT 'api',
+        file_path TEXT,
+        changed_by TEXT,
+        deleted_at TIMESTAMPTZ,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        UNIQUE(collection, slug, locale, version)
+      )
+    `);
+        await sql.unsafe('CREATE INDEX idx_content_current ON content(collection, slug, locale) WHERE is_current = TRUE');
+        await sql.unsafe('CREATE INDEX idx_content_collection_status ON content(collection, status) WHERE is_current = TRUE');
+        await sql.unsafe('CREATE INDEX idx_content_slug ON content(slug) WHERE is_current = TRUE');
+        // --- Collection schemas (append-only) ---
+        await sql.unsafe(`
+      CREATE TABLE collection_schemas (
+        row_id TEXT PRIMARY KEY,
+        collection TEXT NOT NULL,
+        version INTEGER NOT NULL,
+        is_current BOOLEAN NOT NULL DEFAULT TRUE,
+        fields JSONB NOT NULL,
+        changed_by TEXT,
+        deleted_at TIMESTAMPTZ,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        UNIQUE(collection, version)
+      )
+    `);
+        await sql.unsafe('CREATE INDEX idx_schemas_current ON collection_schemas(collection) WHERE is_current = TRUE');
+        // --- Content manifest ---
+        await sql.unsafe(`
+      CREATE TABLE content_manifest (
+        id SERIAL PRIMARY KEY,
+        repo_version INTEGER NOT NULL,
+        imported_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        file_checksums JSONB NOT NULL
+      )
+    `);
+        await sql.unsafe(`
+      CREATE TABLE content_migration_conflicts (
+        id SERIAL PRIMARY KEY,
+        migration_id INTEGER NOT NULL,
+        collection TEXT NOT NULL,
+        slug TEXT NOT NULL,
+        repo_checksum TEXT NOT NULL,
+        db_checksum TEXT NOT NULL,
+        resolved BOOLEAN DEFAULT FALSE,
+        resolved_at TIMESTAMPTZ,
+        resolution TEXT
+      )
+    `);
+        await sql.unsafe('CREATE INDEX idx_content_conflicts_unresolved ON content_migration_conflicts(resolved) WHERE resolved = FALSE');
+        // --- Checkpoints ---
+        await sql.unsafe(`
+      CREATE TABLE checkpoints (
+        id SERIAL PRIMARY KEY,
+        version INTEGER NOT NULL UNIQUE,
+        name TEXT,
+        trigger TEXT NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+        await sql.unsafe(`
+      CREATE TABLE checkpoint_counter (
+        id INTEGER PRIMARY KEY CHECK (id = 1),
+        next INTEGER NOT NULL DEFAULT 1
+      )
+    `);
+        await sql.unsafe('INSERT INTO checkpoint_counter (id, next) VALUES (1, 1)');
+    },
+};
+//# sourceMappingURL=v001-initial-schema.js.map

package/dist/migrations/v001-initial-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v001-initial-schema.js","sourceRoot":"","sources":["../../src/migrations/v001-initial-schema.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,gCAAgC;QAEhC,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;KAoBhB,CAAC,CAAA;QAEF,MAAM,GAAG,CAAC,MAAM,CACd,+FAA+F,CAChG,CAAA;QACD,MAAM,GAAG,CAAC,MAAM,CACd,mGAAmG,CACpG,CAAA;QACD,MAAM,GAAG,CAAC,MAAM,CAAC,wEAAwE,CAAC,CAAA;QAE1F,2CAA2C;QAE3C,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;;;;;;KAYhB,CAAC,CAAA;QAEF,MAAM,GAAG,CAAC,MAAM,CACd,4FAA4F,CAC7F,CAAA;QAED,2BAA2B;QAE3B,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;KAOhB,CAAC,CAAA;QAEF,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;;;;;;KAYhB,CAAC,CAAA;QAEF,MAAM,GAAG,CAAC,MAAM,CACd,+GAA+G,CAChH,CAAA;QAED,sBAAsB;QAEtB,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;;KAQhB,CAAC,CAAA;QAEF,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;KAKhB,CAAC,CAAA;QAEF,MAAM,GAAG,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAA;IAC7E,CAAC;CACF,CAAA"}

package/dist/migrations/v002-auth-tables.d.ts

@@ -0,0 +1,8 @@
+import type { PostgresMigration } from '../migration-runner.js';
+/**
+ * V002: Auth tables — users and refresh tokens.
+ *
+ * Postgres uses UUID defaults, TEXT[] for roles, BOOLEAN, TIMESTAMPTZ.
+ */
+export declare const v002AuthTables: PostgresMigration;
+//# sourceMappingURL=v002-auth-tables.d.ts.map

package/dist/migrations/v002-auth-tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v002-auth-tables.d.ts","sourceRoot":"","sources":["../../src/migrations/v002-auth-tables.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,iBAgC5B,CAAA"}

package/dist/migrations/v002-auth-tables.js

@@ -0,0 +1,37 @@
+/**
+ * V002: Auth tables — users and refresh tokens.
+ *
+ * Postgres uses UUID defaults, TEXT[] for roles, BOOLEAN, TIMESTAMPTZ.
+ */
+export const v002AuthTables = {
+    version: 2,
+    name: 'auth_tables',
+    apply: async (sql) => {
+        await sql.unsafe(`
+      CREATE TABLE users (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        email TEXT UNIQUE,
+        name TEXT,
+        roles TEXT[] NOT NULL DEFAULT '{viewer}',
+        oidc_subject TEXT,
+        oidc_issuer TEXT,
+        is_active BOOLEAN NOT NULL DEFAULT true,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        UNIQUE(oidc_issuer, oidc_subject)
+      )
+    `);
+        await sql.unsafe(`
+      CREATE TABLE refresh_tokens (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        token_hash TEXT NOT NULL UNIQUE,
+        expires_at TIMESTAMPTZ NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+        await sql.unsafe('CREATE INDEX idx_refresh_user ON refresh_tokens(user_id)');
+        await sql.unsafe('CREATE INDEX idx_refresh_expires ON refresh_tokens(expires_at)');
+    },
+};
+//# sourceMappingURL=v002-auth-tables.js.map

package/dist/migrations/v002-auth-tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v002-auth-tables.js","sourceRoot":"","sources":["../../src/migrations/v002-auth-tables.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;;;;;;;KAahB,CAAC,CAAA;QAEF,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;;KAQhB,CAAC,CAAA;QAEF,MAAM,GAAG,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAA;QAC5E,MAAM,GAAG,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAA;IACpF,CAAC;CACF,CAAA"}

package/dist/migrations/v003-user-permissions.d.ts

@@ -0,0 +1,6 @@
+import type { PostgresMigration } from '../migration-runner.js';
+/**
+ * V003: Per-collection permission overrides.
+ */
+export declare const v003UserPermissions: PostgresMigration;
+//# sourceMappingURL=v003-user-permissions.d.ts.map

package/dist/migrations/v003-user-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v003-user-permissions.d.ts","sourceRoot":"","sources":["../../src/migrations/v003-user-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,iBAajC,CAAA"}

package/dist/migrations/v003-user-permissions.js

@@ -0,0 +1,18 @@
+/**
+ * V003: Per-collection permission overrides.
+ */
+export const v003UserPermissions = {
+    version: 3,
+    name: 'user_permissions',
+    apply: async (sql) => {
+        await sql.unsafe(`
+      CREATE TABLE user_permissions (
+        user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        collection TEXT NOT NULL,
+        role TEXT NOT NULL,
+        PRIMARY KEY (user_id, collection)
+      )
+    `);
+    },
+};
+//# sourceMappingURL=v003-user-permissions.js.map

package/dist/migrations/v003-user-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v003-user-permissions.js","sourceRoot":"","sources":["../../src/migrations/v003-user-permissions.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,kBAAkB;IACxB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;KAOhB,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}

package/dist/migrations/v004-media-hotspot.d.ts

@@ -0,0 +1,14 @@
+import type { PostgresMigration } from '../migration-runner.js';
+/**
+ * V004: Add hotspot column to media table.
+ *
+ * Stores a JSON-encoded hotspot (center + ellipse) for adaptive
+ * aspect-ratio cropping. NULL means no hotspot defined.
+ *
+ * It ran before the `media` table was part of the migrated schema, so it is a
+ * no-op when the table is missing. It stays because applied migrations form
+ * the numbered ledger (the checksum covers only `version:name`); v011 creates
+ * `media` with the hotspot column.
+ */
+export declare const v004MediaHotspot: PostgresMigration;
+//# sourceMappingURL=v004-media-hotspot.d.ts.map

package/dist/migrations/v004-media-hotspot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v004-media-hotspot.d.ts","sourceRoot":"","sources":["../../src/migrations/v004-media-hotspot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,EAAE,iBAe9B,CAAA"}

package/dist/migrations/v004-media-hotspot.js

@@ -0,0 +1,25 @@
+/**
+ * V004: Add hotspot column to media table.
+ *
+ * Stores a JSON-encoded hotspot (center + ellipse) for adaptive
+ * aspect-ratio cropping. NULL means no hotspot defined.
+ *
+ * It ran before the `media` table was part of the migrated schema, so it is a
+ * no-op when the table is missing. It stays because applied migrations form
+ * the numbered ledger (the checksum covers only `version:name`); v011 creates
+ * `media` with the hotspot column.
+ */
+export const v004MediaHotspot = {
+    version: 4,
+    name: 'media_hotspot',
+    apply: async (sql) => {
+        const tables = await sql.unsafe(`SELECT table_name FROM information_schema.tables WHERE table_name = 'media' AND table_schema = current_schema()`);
+        if (tables.length === 0)
+            return;
+        const cols = await sql.unsafe(`SELECT column_name FROM information_schema.columns WHERE table_name = 'media' AND column_name = 'hotspot'`);
+        if (cols.length > 0)
+            return;
+        await sql.unsafe(`ALTER TABLE media ADD COLUMN hotspot JSONB DEFAULT NULL`);
+    },
+};
+//# sourceMappingURL=v004-media-hotspot.js.map

package/dist/migrations/v004-media-hotspot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v004-media-hotspot.js","sourceRoot":"","sources":["../../src/migrations/v004-media-hotspot.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAC7B,iHAAiH,CAClH,CAAA;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAE/B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAC3B,2GAA2G,CAC5G,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAM;QAC3B,MAAM,GAAG,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAA;IAC7E,CAAC;CACF,CAAA"}

package/dist/migrations/v005-content-locks.d.ts

@@ -0,0 +1,6 @@
+import type { PostgresMigration } from '../migration-runner.js';
+/**
+ * V005: Advisory content locks.
+ */
+export declare const v005ContentLocks: PostgresMigration;
+//# sourceMappingURL=v005-content-locks.d.ts.map

package/dist/migrations/v005-content-locks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v005-content-locks.d.ts","sourceRoot":"","sources":["../../src/migrations/v005-content-locks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,iBAgB9B,CAAA"}

package/dist/migrations/v005-content-locks.js

@@ -0,0 +1,21 @@
+/**
+ * V005: Advisory content locks.
+ */
+export const v005ContentLocks = {
+    version: 5,
+    name: 'content_locks',
+    apply: async (sql) => {
+        await sql.unsafe(`
+      CREATE TABLE content_locks (
+        collection TEXT NOT NULL,
+        slug TEXT NOT NULL,
+        locale TEXT NOT NULL DEFAULT 'en',
+        locked_by TEXT NOT NULL,
+        locked_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        expires_at TIMESTAMPTZ NOT NULL,
+        PRIMARY KEY (collection, slug, locale)
+      )
+    `);
+    },
+};
+//# sourceMappingURL=v005-content-locks.js.map

package/dist/migrations/v005-content-locks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v005-content-locks.js","sourceRoot":"","sources":["../../src/migrations/v005-content-locks.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;;;;KAUhB,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}

package/dist/migrations/v006-webhook-deliveries.d.ts

@@ -0,0 +1,6 @@
+import type { PostgresMigration } from '../migration-runner.js';
+/**
+ * V006: Webhook delivery log with retry support.
+ */
+export declare const v006WebhookDeliveries: PostgresMigration;
+//# sourceMappingURL=v006-webhook-deliveries.d.ts.map

package/dist/migrations/v006-webhook-deliveries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v006-webhook-deliveries.d.ts","sourceRoot":"","sources":["../../src/migrations/v006-webhook-deliveries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,iBAqBnC,CAAA"}

package/dist/migrations/v006-webhook-deliveries.js

@@ -0,0 +1,24 @@
+/**
+ * V006: Webhook delivery log with retry support.
+ */
+export const v006WebhookDeliveries = {
+    version: 6,
+    name: 'webhook_deliveries',
+    apply: async (sql) => {
+        await sql.unsafe(`
+      CREATE TABLE webhook_deliveries (
+        id SERIAL PRIMARY KEY,
+        webhook_url TEXT NOT NULL,
+        event TEXT NOT NULL,
+        payload JSONB NOT NULL,
+        status INTEGER,
+        attempts INTEGER NOT NULL DEFAULT 0,
+        next_retry_at TIMESTAMPTZ,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        delivered_at TIMESTAMPTZ
+      )
+    `);
+        await sql.unsafe('CREATE INDEX idx_webhook_pending ON webhook_deliveries(next_retry_at) WHERE delivered_at IS NULL AND attempts < 5');
+    },
+};
+//# sourceMappingURL=v006-webhook-deliveries.js.map

package/dist/migrations/v006-webhook-deliveries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v006-webhook-deliveries.js","sourceRoot":"","sources":["../../src/migrations/v006-webhook-deliveries.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,oBAAoB;IAC1B,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;;;;;;KAYhB,CAAC,CAAA;QACF,MAAM,GAAG,CAAC,MAAM,CACd,mHAAmH,CACpH,CAAA;IACH,CAAC;CACF,CAAA"}

package/dist/migrations/v007-media-folders.d.ts

@@ -0,0 +1,6 @@
+import type { PostgresMigration } from '../migration-runner.js';
+/**
+ * V007: Media folders — hierarchical folder structure for media organization.
+ */
+export declare const v007MediaFolders: PostgresMigration;
+//# sourceMappingURL=v007-media-folders.d.ts.map

package/dist/migrations/v007-media-folders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v007-media-folders.d.ts","sourceRoot":"","sources":["../../src/migrations/v007-media-folders.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,iBAc9B,CAAA"}

package/dist/migrations/v007-media-folders.js

@@ -0,0 +1,19 @@
+/**
+ * V007: Media folders — hierarchical folder structure for media organization.
+ */
+export const v007MediaFolders = {
+    version: 7,
+    name: 'media_folders',
+    apply: async (sql) => {
+        await sql.unsafe(`
+      CREATE TABLE media_folders (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        parent_id TEXT REFERENCES media_folders(id),
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+        await sql.unsafe('CREATE INDEX idx_media_folders_parent ON media_folders(parent_id)');
+    },
+};
+//# sourceMappingURL=v007-media-folders.js.map

package/dist/migrations/v007-media-folders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v007-media-folders.js","sourceRoot":"","sources":["../../src/migrations/v007-media-folders.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;KAOhB,CAAC,CAAA;QACF,MAAM,GAAG,CAAC,MAAM,CAAC,mEAAmE,CAAC,CAAA;IACvF,CAAC;CACF,CAAA"}

package/dist/migrations/v008-site-settings.d.ts

@@ -0,0 +1,6 @@
+import type { PostgresMigration } from '../migration-runner.js';
+/**
+ * V008: Site settings — runtime-configurable key-value settings.
+ */
+export declare const v008SiteSettings: PostgresMigration;
+//# sourceMappingURL=v008-site-settings.d.ts.map

package/dist/migrations/v008-site-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v008-site-settings.d.ts","sourceRoot":"","sources":["../../src/migrations/v008-site-settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,iBAY9B,CAAA"}

package/dist/migrations/v008-site-settings.js

@@ -0,0 +1,17 @@
+/**
+ * V008: Site settings — runtime-configurable key-value settings.
+ */
+export const v008SiteSettings = {
+    version: 8,
+    name: 'site_settings',
+    apply: async (sql) => {
+        await sql.unsafe(`
+      CREATE TABLE site_settings (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL,
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+    },
+};
+//# sourceMappingURL=v008-site-settings.js.map

package/dist/migrations/v008-site-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v008-site-settings.js","sourceRoot":"","sources":["../../src/migrations/v008-site-settings.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;KAMhB,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}

package/dist/migrations/v009-seo-config.d.ts

@@ -0,0 +1,12 @@
+import type { PostgresMigration } from '../migration-runner.js';
+/**
+ * V009: SEO configuration — structured entity graph per site, collection,
+ * document, or route.
+ *
+ * Stores a single `config` JSONB column holding a `SeoConfigData` object
+ * with an ordered entity array and optional field-mapping overrides.
+ * A GIN index on the column enables containment queries for site-wide
+ * lookups (e.g. "find every doc that uses an Article entity").
+ */
+export declare const v009SeoConfig: PostgresMigration;
+//# sourceMappingURL=v009-seo-config.d.ts.map

package/dist/migrations/v009-seo-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v009-seo-config.d.ts","sourceRoot":"","sources":["../../src/migrations/v009-seo-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,EAAE,iBAkB3B,CAAA"}

package/dist/migrations/v009-seo-config.js

@@ -0,0 +1,27 @@
+/**
+ * V009: SEO configuration — structured entity graph per site, collection,
+ * document, or route.
+ *
+ * Stores a single `config` JSONB column holding a `SeoConfigData` object
+ * with an ordered entity array and optional field-mapping overrides.
+ * A GIN index on the column enables containment queries for site-wide
+ * lookups (e.g. "find every doc that uses an Article entity").
+ */
+export const v009SeoConfig = {
+    version: 9,
+    name: 'seo_config',
+    apply: async (sql) => {
+        await sql.unsafe(`
+      CREATE TABLE seo_config (
+        id TEXT PRIMARY KEY,
+        scope TEXT NOT NULL CHECK (scope IN ('site', 'collection', 'document', 'route')),
+        config JSONB NOT NULL DEFAULT '{"entities":[]}'::jsonb,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+        await sql.unsafe('CREATE INDEX idx_seo_config_scope ON seo_config(scope)');
+        await sql.unsafe('CREATE INDEX idx_seo_config_gin ON seo_config USING GIN (config jsonb_path_ops)');
+    },
+};
+//# sourceMappingURL=v009-seo-config.js.map

package/dist/migrations/v009-seo-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v009-seo-config.js","sourceRoot":"","sources":["../../src/migrations/v009-seo-config.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,GAAG,CAAC,MAAM,CAAC;;;;;;;;KAQhB,CAAC,CAAA;QACF,MAAM,GAAG,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAA;QAC1E,MAAM,GAAG,CAAC,MAAM,CACd,iFAAiF,CAClF,CAAA;IACH,CAAC;CACF,CAAA"}