@serve.zone/gitops 32.1.0 → 32.2.0

package/dist_ts_migrations/classes.migration-record.js

@@ -0,0 +1,80 @@
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+import * as plugins from '../dist_ts/plugins.js';
+import { GitopsDb } from '../dist_ts/db/index.js';
+/**
+ * The ledger of migrations that have run to completion.
+ *
+ * `migration` owns the stored `_id`, so a migration is looked up by primary key and can
+ * only ever be recorded once.
+ */
+let MigrationRecord = (() => {
+    let _classDecorators = [plugins.smartdata.Collection(() => GitopsDb.getInstance().getDb(), {
+            identityAsDocumentId: 'migration',
+        })];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = plugins.smartdata.SmartDataDbDoc;
+    let _migration_decorators;
+    let _migration_initializers = [];
+    let _migration_extraInitializers = [];
+    let _completedAt_decorators;
+    let _completedAt_initializers = [];
+    let _completedAt_extraInitializers = [];
+    var MigrationRecord = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _migration_decorators = [plugins.smartdata.unI(), plugins.smartdata.svDb()];
+            _completedAt_decorators = [plugins.smartdata.svDb()];
+            __esDecorate(null, null, _migration_decorators, { kind: "field", name: "migration", static: false, private: false, access: { has: obj => "migration" in obj, get: obj => obj.migration, set: (obj, value) => { obj.migration = value; } }, metadata: _metadata }, _migration_initializers, _migration_extraInitializers);
+            __esDecorate(null, null, _completedAt_decorators, { kind: "field", name: "completedAt", static: false, private: false, access: { has: obj => "completedAt" in obj, get: obj => obj.completedAt, set: (obj, value) => { obj.completedAt = value; } }, metadata: _metadata }, _completedAt_initializers, _completedAt_extraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            MigrationRecord = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        migration = __runInitializers(this, _migration_initializers, void 0);
+        completedAt = (__runInitializers(this, _migration_extraInitializers), __runInitializers(this, _completedAt_initializers, void 0));
+        constructor() {
+            super(...arguments);
+            __runInitializers(this, _completedAt_extraInitializers);
+        }
+    };
+    return MigrationRecord = _classThis;
+})();
+export { MigrationRecord };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5taWdyYXRpb24tcmVjb3JkLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfbWlncmF0aW9ucy9jbGFzc2VzLm1pZ3JhdGlvbi1yZWNvcmQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFDNUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBRTdDOzs7OztHQUtHO0lBSVUsZUFBZTs0QkFIM0IsT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLENBQUMsUUFBUSxDQUFDLFdBQVcsRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFO1lBQ2xFLG9CQUFvQixFQUFFLFdBQVc7U0FDbEMsQ0FBQzs7OztzQkFDbUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxjQUFjOzs7Ozs7OytCQUF4QyxTQUFRLFdBR3BDOzs7O3FDQUNFLE9BQU8sQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFLEVBQ3ZCLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFO3VDQUd4QixPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRTtZQUZ6Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQVU7WUFHMUIsbUxBQU8sV0FBVyw2QkFBWCxXQUFXLGlHQUFVO1lBVDlCLDZLQVVDOzs7WUFWWSx1REFBZTs7UUFNbkIsU0FBUyw0REFBVTtRQUduQixXQUFXLHVIQUFVOzs7Ozs7OztTQVRqQixlQUFlIn0=

package/dist_ts_migrations/import-filesystem-records.d.ts

@@ -0,0 +1,9 @@
+import type { IMigration } from './interfaces.js';
+/**
+ * Imports the key/value records that earlier releases kept as files.
+ *
+ * Both sources are read once and never written back: the ledger, not a renamed file, is
+ * what records that this ran. The legacy tree is left on disk untouched so an operator can
+ * archive it after confirming the import.
+ */
+export declare const importFilesystemRecords: IMigration;

package/dist_ts_migrations/import-filesystem-records.js

@@ -0,0 +1,74 @@
+import * as plugins from '../dist_ts/plugins.js';
+/**
+ * Reads every regular file below `directoryArg` and yields it as a storage key relative to
+ * the tree root, so `<root>/connections/a.json` becomes `/connections/a.json`.
+ */
+const readDirectoryEntries = async (directoryArg) => {
+    try {
+        return await plugins.fs.readdir(directoryArg, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+};
+const readLegacyTree = async (directoryArg, prefixArg) => {
+    const entries = await readDirectoryEntries(directoryArg);
+    const records = [];
+    for (const entry of entries) {
+        const entryPath = plugins.path.join(directoryArg, entry.name);
+        if (entry.isDirectory()) {
+            records.push(...(await readLegacyTree(entryPath, `${prefixArg}/${entry.name}`)));
+        }
+        else if (entry.isFile()) {
+            records.push({
+                key: `${prefixArg}/${entry.name}`,
+                value: await plugins.fs.readFile(entryPath, 'utf8'),
+            });
+        }
+    }
+    return records;
+};
+/**
+ * Imports the key/value records that earlier releases kept as files.
+ *
+ * Both sources are read once and never written back: the ledger, not a renamed file, is
+ * what records that this ran. The legacy tree is left on disk untouched so an operator can
+ * archive it after confirming the import.
+ */
+export const importFilesystemRecords = {
+    name: 'import-filesystem-records',
+    run: async (contextArg) => {
+        // The development-time connections file was the authority over the tree before, and
+        // stays it here: it is written first and the tree import below skips existing keys.
+        try {
+            const legacyText = await plugins.fs.readFile(contextArg.legacyConnectionsFile, 'utf8');
+            const legacyConnections = JSON.parse(legacyText);
+            for (const connection of legacyConnections) {
+                await contextArg.storage.setJSON(`/connections/${connection.id}.json`, connection);
+            }
+            if (legacyConnections.length > 0) {
+                contextArg.log(`imported ${legacyConnections.length} connection(s) from the legacy file`);
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const records = await readLegacyTree(contextArg.legacyStoragePath, '');
+        let imported = 0;
+        for (const record of records) {
+            // A key that already exists was written by a newer authority — the legacy file above
+            // or a release that already ran against the database — so it is never overwritten.
+            if (await contextArg.storage.exists(record.key))
+                continue;
+            await contextArg.storage.set(record.key, record.value);
+            imported++;
+        }
+        if (imported > 0) {
+            contextArg.log(`imported ${imported} record(s) from ${contextArg.legacyStoragePath}`);
+        }
+    },
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW1wb3J0LWZpbGVzeXN0ZW0tcmVjb3Jkcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX21pZ3JhdGlvbnMvaW1wb3J0LWZpbGVzeXN0ZW0tcmVjb3Jkcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGtCQUFrQixDQUFDO0FBTzVDOzs7R0FHRztBQUNILE1BQU0sb0JBQW9CLEdBQUcsS0FBSyxFQUFFLFlBQW9CLEVBQUUsRUFBRTtJQUMxRCxJQUFJLENBQUM7UUFDSCxPQUFPLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsWUFBWSxFQUFFLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFLLEtBQStCLENBQUMsSUFBSSxLQUFLLFFBQVE7WUFBRSxPQUFPLEVBQUUsQ0FBQztRQUNsRSxNQUFNLEtBQUssQ0FBQztJQUNkLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLGNBQWMsR0FBRyxLQUFLLEVBQzFCLFlBQW9CLEVBQ3BCLFNBQWlCLEVBQzBCLEVBQUU7SUFDN0MsTUFBTSxPQUFPLEdBQUcsTUFBTSxvQkFBb0IsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUN6RCxNQUFNLE9BQU8sR0FBcUMsRUFBRSxDQUFDO0lBQ3JELEtBQUssTUFBTSxLQUFLLElBQUksT0FBTyxFQUFFLENBQUM7UUFDNUIsTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM5RCxJQUFJLEtBQUssQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO1lBQ3hCLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sY0FBYyxDQUFDLFNBQVMsRUFBRSxHQUFHLFNBQVMsSUFBSSxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDbkYsQ0FBQzthQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUM7WUFDMUIsT0FBTyxDQUFDLElBQUksQ0FBQztnQkFDWCxHQUFHLEVBQUUsR0FBRyxTQUFTLElBQUksS0FBSyxDQUFDLElBQUksRUFBRTtnQkFDakMsS0FBSyxFQUFFLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQzthQUNwRCxDQUFDLENBQUM7UUFDTCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUMsQ0FBQztBQUVGOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFlO0lBQ2pELElBQUksRUFBRSwyQkFBMkI7SUFDakMsR0FBRyxFQUFFLEtBQUssRUFBRSxVQUE2QixFQUFpQixFQUFFO1FBQzFELG9GQUFvRjtRQUNwRixvRkFBb0Y7UUFDcEYsSUFBSSxDQUFDO1lBQ0gsTUFBTSxVQUFVLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMscUJBQXFCLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDdkYsTUFBTSxpQkFBaUIsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBd0IsQ0FBQztZQUN4RSxLQUFLLE1BQU0sVUFBVSxJQUFJLGlCQUFpQixFQUFFLENBQUM7Z0JBQzNDLE1BQU0sVUFBVSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLFVBQVUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQztZQUNyRixDQUFDO1lBQ0QsSUFBSSxpQkFBaUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ2pDLFVBQVUsQ0FBQyxHQUFHLENBQUMsWUFBWSxpQkFBaUIsQ0FBQyxNQUFNLHFDQUFxQyxDQUFDLENBQUM7WUFDNUYsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSyxLQUErQixDQUFDLElBQUksS0FBSyxRQUFRO2dCQUFFLE1BQU0sS0FBSyxDQUFDO1FBQ3RFLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLGNBQWMsQ0FBQyxVQUFVLENBQUMsaUJBQWlCLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDdkUsSUFBSSxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ2pCLEtBQUssTUFBTSxNQUFNLElBQUksT0FBTyxFQUFFLENBQUM7WUFDN0IscUZBQXFGO1lBQ3JGLG1GQUFtRjtZQUNuRixJQUFJLE1BQU0sVUFBVSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQztnQkFBRSxTQUFTO1lBQzFELE1BQU0sVUFBVSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDdkQsUUFBUSxFQUFFLENBQUM7UUFDYixDQUFDO1FBQ0QsSUFBSSxRQUFRLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDakIsVUFBVSxDQUFDLEdBQUcsQ0FBQyxZQUFZLFFBQVEsbUJBQW1CLFVBQVUsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDLENBQUM7UUFDeEYsQ0FBQztJQUNILENBQUM7Q0FDRixDQUFDIn0=

package/dist_ts_migrations/index.d.ts

@@ -0,0 +1,12 @@
+import type { IMigrationContext } from './interfaces.js';
+export type { IMigration, IMigrationContext } from './interfaces.js';
+export { MigrationRecord } from './classes.migration-record.js';
+/**
+ * Runs the pending migrations against an already connected database.
+ *
+ * Called from startup only, after the database is up and before any manager reads a
+ * record. No lease is taken: every migration is idempotent, so two instances starting at
+ * the same time converge on the same result, while a lease would let one crashed claimant
+ * block every later start.
+ */
+export declare const runStartupMigrations: (contextArg: IMigrationContext) => Promise<void>;

package/dist_ts_migrations/index.js

@@ -0,0 +1,24 @@
+import { MigrationRecord } from './classes.migration-record.js';
+import { importFilesystemRecords } from './import-filesystem-records.js';
+export { MigrationRecord } from './classes.migration-record.js';
+/** Applied in order; a name that is already in the ledger is skipped. */
+const migrations = [importFilesystemRecords];
+/**
+ * Runs the pending migrations against an already connected database.
+ *
+ * Called from startup only, after the database is up and before any manager reads a
+ * record. No lease is taken: every migration is idempotent, so two instances starting at
+ * the same time converge on the same result, while a lease would let one crashed claimant
+ * block every later start.
+ */
+export const runStartupMigrations = async (contextArg) => {
+    for (const migration of migrations) {
+        if (await MigrationRecord.exists({ migration: migration.name }))
+            continue;
+        contextArg.log(`running migration ${migration.name}`);
+        await migration.run(contextArg);
+        await MigrationRecord.atomicUpdate({ migration: migration.name }, { $set: { completedAt: Date.now() } }, { upsert: true });
+        contextArg.log(`migration ${migration.name} completed`);
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19taWdyYXRpb25zL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxlQUFlLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUNoRSxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUl6RSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFFaEUseUVBQXlFO0FBQ3pFLE1BQU0sVUFBVSxHQUEwQixDQUFDLHVCQUF1QixDQUFDLENBQUM7QUFFcEU7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLEtBQUssRUFBRSxVQUE2QixFQUFpQixFQUFFO0lBQ3pGLEtBQUssTUFBTSxTQUFTLElBQUksVUFBVSxFQUFFLENBQUM7UUFDbkMsSUFBSSxNQUFNLGVBQWUsQ0FBQyxNQUFNLENBQWtCLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUFFLFNBQVM7UUFDM0YsVUFBVSxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDdEQsTUFBTSxTQUFTLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2hDLE1BQU0sZUFBZSxDQUFDLFlBQVksQ0FDaEMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksRUFBRSxFQUM3QixFQUFFLElBQUksRUFBRSxFQUFFLFdBQVcsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEVBQUUsRUFBRSxFQUNyQyxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FDakIsQ0FBQztRQUNGLFVBQVUsQ0FBQyxHQUFHLENBQUMsYUFBYSxTQUFTLENBQUMsSUFBSSxZQUFZLENBQUMsQ0FBQztJQUMxRCxDQUFDO0FBQ0gsQ0FBQyxDQUFDIn0=

package/dist_ts_migrations/interfaces.d.ts

@@ -0,0 +1,16 @@
+import type { StorageManager } from '../dist_ts/storage/index.js';
+export interface IMigrationContext {
+    /** The document-backed key/value store every migration writes through. */
+    storage: StorageManager;
+    /** Root of the key/value tree the releases before the document database wrote. */
+    legacyStoragePath: string;
+    /** The development-time connection list earlier releases imported on every start. */
+    legacyConnectionsFile: string;
+    /** Reports progress to the application log. */
+    log: (messageArg: string) => void;
+}
+export interface IMigration {
+    /** Stable identity recorded in the ledger once the migration completed. */
+    name: string;
+    run: (contextArg: IMigrationContext) => Promise<void>;
+}

package/dist_ts_migrations/interfaces.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZXJmYWNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX21pZ3JhdGlvbnMvaW50ZXJmYWNlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/gitops",
-  "version": "32.1.0",
+  "version": "32.2.0",
   "description": "GitOps management app for Gitea and GitLab - manage secrets, browse projects, view CI pipelines, and stream build logs",
   "main": "./dist_ts/index.js",
   "typings": "./dist_ts/index.d.ts",
@@ -31,10 +31,9 @@
     "@apiclient.xyz/gitlab": "^2.6.0",
     "@design.estate/dees-catalog": "3.83.0",
     "@design.estate/dees-element": "^2.2.4",
-    "@push.rocks/smartdata": "7.1.7",
+    "@lossless.org/client": "1.1.0",
     "@push.rocks/smartguard": "^3.1.0",
     "@push.rocks/smartjwt": "^2.2.2",
-    "@push.rocks/smartmongo": "9.0.0",
     "@push.rocks/smartsecret": "^1.0.2"
   },
   "devDependencies": {
@@ -45,16 +44,19 @@
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "6.1.1",
     "@git.zone/tswatch": "^3.3.5",
+    "@push.rocks/smartmongo": "9.0.0",
     "@types/node": "^26.5.1"
   },
   "files": [
     "ts/**/*",
     "binary/**/*",
     "ts_interfaces/**/*",
+    "ts_migrations/**/*",
     "ts_web/**/*",
     "dist_*/**/*",
     "dist_ts/**/*",
     "dist_ts_interfaces/**/*",
+    "dist_ts_migrations/**/*",
     "dist_ts_web/**/*",
     "dist_serve/**/*",
     "cli.js",
@@ -71,7 +73,7 @@
     "start": "(node ./cli.js)",
     "startTs": "(node ./cli.ts.js)",
     "test": "(pnpm run build && tstest \"test/*.node.ts\" --verbose --logfile --timeout 60)",
-    "build": "(tsbuild custom ts_interfaces ts && pnpm run bundle)",
+    "build": "(tsbuild custom ts_interfaces ts_migrations ts && pnpm run bundle)",
     "build:binary": "(pnpm run build && tsdeno compile)",
     "build:docker": "tsdocker build --verbose",
     "release:docker": "tsdocker push --verbose",

package/readme.md

@@ -11,7 +11,7 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 - Connects to Gitea and GitLab through provider adapters with a shared project, group, secret, pipeline, and file-content interface.
 - Stores provider tokens and BookStack job tokens through `@push.rocks/smartsecret`, using OS keychain support where available and an encrypted fallback otherwise.
 - Serves a bundled Lit/dees-catalog single page app through `@api.global/typedserver` with TypedRequest handlers for all backend actions.
-- Scans project and group CI/CD secrets into an embedded SmartMongo cache and refreshes that cache on startup and every 24 hours.
+- Scans project and group CI/CD secrets into the document database and refreshes that cache on startup and every 24 hours.
 - Mirrors repositories from a source connection to a target connection with group offset support, stable source-project mapping for subgroup/path shifts, metadata sync, optional release/asset and OCI image sync, stale target handling, and live sync logs.
 - Manages reusable secret definitions that can be pushed to selected project or group targets.
 - Runs scheduled jobs, currently focused on syncing `readme.md`, `changelog.md`, and `docs/*.md` content into BookStack shelves, books, and pages.
@@ -28,24 +28,26 @@ GitOps is a Node.js service packaged as an npm module. Deno is used only for com
 | Web server | `ts/opsserver/`, TypedServer plus TypedRequest handlers |
 | Shared contracts | `ts_interfaces/` data and request interfaces |
 | Frontend | `ts_web/`, Lit web components and smartstate |
-| Build output | `dist_ts/`, `dist_ts_interfaces/`, and `dist_serve/` generated by `tsbuild` and `tsbundle` |
-| Persistent storage | `~/.serve.zone/gitops/storage/` |
-| Cache database | `~/.serve.zone/gitops/tsmdb/` |
+| Build output | `dist_ts/`, `dist_ts_interfaces/`, `dist_ts_migrations/`, and `dist_serve/` generated by `tsbuild` and `tsbundle` |
+| Startup migrations | `ts_migrations/`, applied once against the connected database |
+| Persistence | One document database, reached through `@lossless.org/client/nosqldb` |
 
 ## Installation and Usage
 
+gitops keeps every durable record in one document database, so a MongoDB-compatible server must be reachable before the first start and its URL must be present in `GITOPS_MONGODB_URL`; without it the process refuses by name and exits. An installation upgrading from a release that kept its records under `~/.serve.zone/gitops/storage/` keeps that directory mounted for the first start, which imports the records once.
+
 Install the package through pnpm and start the public `gitops` binary:
 
 ```bash
 pnpm add -g @serve.zone/gitops
-GITOPS_PORT=3000 gitops server
+GITOPS_MONGODB_URL=mongodb://localhost:27017 GITOPS_PORT=3000 gitops server
 ```
 
 For local source runs, use the checked-in Node entrypoint:
 
 ```bash
-node ./cli.js server
-GITOPS_PORT=3001 node ./cli.js server
+GITOPS_MONGODB_URL=mongodb://localhost:27017 node ./cli.js server
+GITOPS_MONGODB_URL=mongodb://localhost:27017 GITOPS_PORT=3001 node ./cli.js server
 ```
 
 Container image sync shells out to `skopeo copy --all`; source runs need `skopeo` on `PATH`. The packaged Docker image installs `skopeo` for this path.
@@ -61,10 +63,10 @@ import type * as gitopsInterfaces from '@serve.zone/gitops/interfaces';
 
 | Component | Role |
 | --- | --- |
-| `GitopsApp` | Starts storage, provider connections, cache, sync, jobs, managed secrets, scans, and the OpsServer. |
+| `GitopsApp` | Connects the database, applies pending migrations, then starts provider connections, sync, jobs, managed secrets, scans, and the OpsServer. |
 | `ConnectionManager` | Persists Gitea/GitLab connections, migrates old plaintext tokens into SmartSecret, and background-checks connection health. |
 | `GiteaProvider` / `GitLabProvider` | Provider-specific adapters behind a shared `BaseProvider` interface. |
-| `SecretsScanService` | Fetches project and group secrets in batches and upserts them into cached SmartData documents. |
+| `SecretsScanService` | Fetches project and group secrets in batches and upserts them into `CachedSecret` documents. |
 | `SyncManager` | Mirrors repositories with bare git clones, stable source/target path mapping, deletion safeguards, branch/default-branch handling, metadata sync, release/asset sync, and OCI image sync. |
 | `ManagedSecretsManager` | Stores define-once secret records and pushes them to selected project or group targets. |
 | `JobManager` | Stores scheduled jobs, starts interval timers, masks persisted secrets, and dispatches job execution to registered runners. |
@@ -74,11 +76,15 @@ import type * as gitopsInterfaces from '@serve.zone/gitops/interfaces';
 
 | Variable | Default | Purpose |
 | --- | --- | --- |
+| `GITOPS_MONGODB_URL` | none, required | Connection URL of the document database. Startup fails without it. |
+| `GITOPS_MONGODB_NAME` | `gitops` | Database name inside that server. |
 | `GITOPS_PORT` | `3000` | HTTP and WebSocket server port. |
 | `GITOPS_ADMIN_USERNAME` | `admin` | Dashboard login username. |
 | `GITOPS_ADMIN_PASSWORD` | `admin` | Dashboard login password. |
 
-Provider connections, sync configs, jobs, managed secrets, and action logs are persisted as JSON records below `~/.serve.zone/gitops/storage/`. Cached projects and secrets use a disposable NoSQLDB memory server through SmartMongo 9. The initial provider scan repopulates this cache after startup; it does not persist between processes.
+Provider connections, sync configs, jobs, managed secrets, and action logs are persisted as `StorageRecord` documents, keyed by the same `/connections/<id>.json`-style keys earlier releases used as file names. Cached projects and secrets are `CachedProject` and `CachedSecret` documents in the same database, bounded by their TTL and swept hourly by the cache cleaner.
+
+A release that finds records below `~/.serve.zone/gitops/storage/` imports them once, on the first start against the database, and records that in the migration ledger. The directory is read, never written, and is left in place so it can be archived after the import is confirmed.
 
 Provider connections may also define `registryUrl`, `registryUsername`, and `registryToken` for OCI registry mirroring. Registry tokens are stored through SmartSecret and masked in API/UI responses. GitLab image sync falls back to `oauth2:<provider token>` when no dedicated registry credentials are configured; Gitea requires an explicit registry username when registry auth is needed.
 
@@ -183,11 +189,11 @@ pnpm test
 pnpm run startTs
 ```
 
-Useful direct commands:
+Useful direct commands (each server start needs `GITOPS_MONGODB_URL`):
 
 ```bash
-node ./cli.js server
-GITOPS_PORT=3001 node ./cli.js server
+GITOPS_MONGODB_URL=mongodb://localhost:27017 node ./cli.js server
+GITOPS_MONGODB_URL=mongodb://localhost:27017 GITOPS_PORT=3001 node ./cli.js server
 pnpm run build:binary
 pnpm run build:docker
 pnpm run watch
@@ -206,11 +212,12 @@ gitops/
 ├── html/
 ├── ts/
 │   ├── classes/
-│   ├── cache/
+│   ├── db/
 │   ├── opsserver/
 │   ├── providers/
 │   └── storage/
 ├── ts_interfaces/
+├── ts_migrations/
 ├── ts_web/
 ├── dist_serve/
 └── test/

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/gitops',
-  version: '32.1.0',
+  version: '32.2.0',
   description: 'GitOps management app for Gitea and GitLab - manage secrets, browse projects, view CI pipelines, and stream build logs'
 }

package/ts/classes/actionlog.ts

@@ -6,7 +6,7 @@ const ACTIONLOG_PREFIX = '/actionlog/';
 
 /**
  * Persists and queries action log entries via StorageManager.
- * Entries are stored as individual JSON files keyed by timestamp-id.
+ * Entries are stored as individual records keyed by timestamp-id.
  */
 export class ActionLog {
   private storageManager: StorageManager;

package/ts/classes/connectionmanager.ts

@@ -4,7 +4,6 @@ import type * as interfaces from '../../ts_interfaces/index.js';
 import { BaseProvider, GiteaProvider, GitLabProvider } from '../providers/index.js';
 import type { StorageManager } from '../storage/index.js';
 
-const LEGACY_CONNECTIONS_FILE = './.nogit/connections.json';
 const CONNECTIONS_PREFIX = '/connections/';
 const KEYCHAIN_PREFIX = 'keychain:';
 
@@ -19,7 +18,7 @@ const mintWebhookSecret = (): string => plugins.crypto.randomBytes(32).toString(
 
 /**
  * Manages provider connections — persists each connection as an
- * individual JSON file via StorageManager. Tokens are stored in
+ * individual record via StorageManager. Tokens are stored in
  * the OS keychain (or encrypted file fallback) via SmartSecret.
  */
 export class ConnectionManager {
@@ -35,7 +34,6 @@ export class ConnectionManager {
   }
 
   async init(): Promise<void> {
-    await this.migrateLegacyFile();
     await this.loadConnections();
     // Auto-test all connections in the background
     this.healthCheckDone = this.testAllConnections();
@@ -59,27 +57,6 @@ export class ConnectionManager {
     }
   }
 
-  /**
-   * One-time migration from the legacy .nogit/connections.json file.
-   */
-  private async migrateLegacyFile(): Promise<void> {
-    try {
-      const text = await plugins.fs.readFile(LEGACY_CONNECTIONS_FILE, 'utf8');
-      const legacy: interfaces.data.IProviderConnection[] = JSON.parse(text);
-      if (legacy.length > 0) {
-        logger.info(`Migrating ${legacy.length} connection(s) from legacy file...`);
-        for (const conn of legacy) {
-          await this.storageManager.setJSON(`${CONNECTIONS_PREFIX}${conn.id}.json`, conn);
-        }
-        // Rename legacy file so migration doesn't repeat
-        await plugins.fs.rename(LEGACY_CONNECTIONS_FILE, LEGACY_CONNECTIONS_FILE + '.migrated');
-        logger.success('Legacy connections migrated successfully');
-      }
-    } catch {
-      // No legacy file or already migrated — nothing to do
-    }
-  }
-
   private async loadConnections(): Promise<void> {
     const keys = await this.storageManager.list(CONNECTIONS_PREFIX);
     this.connections = [];
@@ -156,7 +133,7 @@ export class ConnectionManager {
   ): Promise<void> {
     try {
       await this.smartSecret.setSecret(conn.id, conn.token);
-      // Save sentinel to JSON file
+      // Save sentinel to the stored record
       const jsonConn = { ...conn, token: `${KEYCHAIN_PREFIX}${conn.id}` };
       await this.storageManager.setJSON(`${CONNECTIONS_PREFIX}${conn.id}.json`, jsonConn);
       logger.info(`Migrated token for connection "${conn.name}" to keychain`);
@@ -193,7 +170,7 @@ export class ConnectionManager {
   private async backfillWebhookSecret(conn: interfaces.data.IProviderConnection): Promise<void> {
     // A stored-but-unreadable secret is not a missing one. Minting here would write a new
     // secret over the same keychain id and destroy confirmed operator material because of
-    // a transient read failure, so this connection is left exactly as it is on disk.
+    // a transient read failure, so this connection is left exactly as it is stored.
     if (conn.webhookSecretUnreadable) return;
     if (conn.webhookSecret && conn.webhookStatus) return;
     if (!conn.webhookSecret) {
@@ -226,7 +203,7 @@ export class ConnectionManager {
     } else {
       await this.smartSecret.deleteSecret(getWebhookSecretId(conn.id));
     }
-    // Save JSON with sentinel value
+    // Save the record with sentinel values
     const jsonConn = {
       ...conn,
       token: `${KEYCHAIN_PREFIX}${conn.id}`,

package/ts/classes/gitopsapp.ts

@@ -7,10 +7,25 @@ import { ManagedSecretsManager } from './managedsecrets.manager.js';
 import { JobManager } from './jobmanager.js';
 import { OpsServer } from '../opsserver/index.js';
 import { StorageManager } from '../storage/index.js';
-import { CacheDb, CacheCleaner, CachedProject, CachedSecret, SecretsScanService } from '../cache/index.js';
+import { SecretsScanService } from './secrets.scan.service.js';
+import {
+  CacheCleaner,
+  CachedProject,
+  CachedSecret,
+  GitopsDb,
+  readGitopsDbOptionsFromEnvironment,
+  type IGitopsDbOptions,
+} from '../db/index.js';
 import { resolvePaths } from '../paths.js';
+import { runStartupMigrations } from '../../ts_migrations/index.js';
 import { unrefTimer } from '../timers.js';
 
+/**
+ * The connection list a development checkout kept next to itself before gitops had a
+ * database. Resolved against the working directory, exactly as the release that wrote it did.
+ */
+const legacyConnectionsFile = './.nogit/connections.json';
+
 /**
  * Main GitOps application orchestrator
  */
@@ -20,7 +35,7 @@ export class GitopsApp {
   public connectionManager: ConnectionManager;
   public actionLog: ActionLog;
   public opsServer: OpsServer;
-  public cacheDb: CacheDb;
+  public db: GitopsDb;
   public cacheCleaner: CacheCleaner;
   public syncManager!: SyncManager;
   public managedSecretsManager!: ManagedSecretsManager;
@@ -29,22 +44,19 @@ export class GitopsApp {
   private scanIntervalId: ReturnType<typeof setInterval> | null = null;
   private paths: ReturnType<typeof resolvePaths>;
 
-  constructor() {
-    const paths = resolvePaths();
-    this.paths = paths;
-    this.storageManager = new StorageManager({
-      backend: 'filesystem',
-      fsPath: paths.defaultStoragePath,
-    });
+  /**
+   * @param dbOptions binding of the document database; read from the environment unless a
+   *   caller supplies one, which is how tests bind an isolated server.
+   */
+  constructor(dbOptions: IGitopsDbOptions = readGitopsDbOptionsFromEnvironment()) {
+    this.paths = resolvePaths();
+    this.storageManager = new StorageManager();
     this.smartSecret = new plugins.smartsecret.SmartSecret({ service: 'gitops' });
     this.connectionManager = new ConnectionManager(this.storageManager, this.smartSecret);
     this.actionLog = new ActionLog(this.storageManager);
 
-    this.cacheDb = CacheDb.getInstance({
-      storagePath: paths.defaultTsmDbPath,
-      dbName: 'gitops_cache',
-    });
-    this.cacheCleaner = new CacheCleaner(this.cacheDb);
+    this.db = GitopsDb.getInstance(dbOptions);
+    this.cacheCleaner = new CacheCleaner();
     this.cacheCleaner.registerClass(CachedProject);
     this.cacheCleaner.registerClass(CachedSecret);
 
@@ -54,8 +66,15 @@ export class GitopsApp {
   async start(port = 3000): Promise<void> {
     logger.info('Initializing GitOps...');
 
-    // Start CacheDb
-    await this.cacheDb.start();
+    // Every record below is read through the database, so it comes up first and the
+    // pending migrations run before any manager looks at a key.
+    await this.db.start();
+    await runStartupMigrations({
+      storage: this.storageManager,
+      legacyStoragePath: this.paths.legacyStoragePath,
+      legacyConnectionsFile: legacyConnectionsFile,
+      log: (messageArg) => logger.info(messageArg),
+    });
 
     // Initialize connection manager (loads saved connections)
     await this.connectionManager.init();
@@ -122,7 +141,7 @@ export class GitopsApp {
       await this.syncManager.stop();
     }
     this.cacheCleaner.stop();
-    await this.cacheDb.stop();
+    await this.db.stop();
     logger.success('GitOps shutdown complete');
   }
 }

package/ts/{cache/classes.secrets.scan.service.ts → classes/secrets.scan.service.ts}

@@ -1,7 +1,7 @@
 import { logger } from '../logging.js';
-import type { ConnectionManager } from '../classes/connectionmanager.js';
-import { CachedSecret } from './documents/classes.cached.secret.js';
-import { TTL } from './classes.cached.document.js';
+import type { ConnectionManager } from './connectionmanager.js';
+import { CachedSecret } from '../db/documents/classes.cached.secret.js';
+import { TTL } from '../db/classes.cached.document.js';
 import type { ISecret } from '../../ts_interfaces/data/secret.js';
 
 export interface IScanResult {

package/ts/{cache → db}/classes.cache.cleaner.ts

@@ -1,6 +1,5 @@
 import { logger } from '../logging.js';
 import { unrefTimer } from '../timers.js';
-import type { CacheDb } from './classes.cachedb.js';
 
 // deno-lint-ignore no-explicit-any
 type DocumentClass = { getInstances: (filter: any) => Promise<{ delete: () => Promise<void> }[]> };
@@ -14,10 +13,8 @@ export class CacheCleaner {
   private intervalId: ReturnType<typeof setInterval> | null = null;
   private intervalMs: number;
   private documentClasses: DocumentClass[] = [];
-  private cacheDb: CacheDb;
 
-  constructor(cacheDb: CacheDb, intervalMs = DEFAULT_INTERVAL_MS) {
-    this.cacheDb = cacheDb;
+  constructor(intervalMs = DEFAULT_INTERVAL_MS) {
     this.intervalMs = intervalMs;
   }
 

package/ts/{cache → db}/classes.cached.document.ts

@@ -12,7 +12,7 @@ export const TTL = {
 
 /**
  * Abstract base class for cached documents with TTL support.
- * Extend this class and add @Collection decorator pointing to your CacheDb.
+ * Extend this class and add a @Collection decorator bound to GitopsDb.
  */
 export abstract class CachedDocument<
   T extends CachedDocument<T>,