@sonicjs-cms/core 2.19.0 → 3.0.0-beta.10

package/dist/chunk-IHTXB7AT.cjs

@@ -0,0 +1,276 @@
+'use strict';
+
+// src/db/migrations-bundle.ts
+var bundledMigrations = [
+  {
+    id: "0001",
+    name: "Core",
+    filename: "0001_core.sql",
+    description: "Migration 0001: Core",
+    sql: "-- Migration 0001: Auth tables\n-- auth_user, auth_session, auth_account, auth_verification + BA plugin tables + RBAC + auth support.\n-- Only auth_* prefixed tables live here. All content lives in document_* tables (0002_documents.sql).\n\n-- \u2500\u2500 auth_user \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- BA user model + SonicJS domain columns as BA additionalFields.\nCREATE TABLE IF NOT EXISTS auth_user (\n  id TEXT PRIMARY KEY,\n  name TEXT,\n  email TEXT NOT NULL UNIQUE,\n  email_verified INTEGER NOT NULL DEFAULT 0,\n  image TEXT,\n  created_at INTEGER NOT NULL,\n  updated_at INTEGER NOT NULL,\n  -- SonicJS additionalFields\n  first_name TEXT NOT NULL,\n  last_name TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'viewer',\n  -- Platform super-admin: bypasses the multi-tenant membership gate, uses global roles in every\n  -- tenant. Opt-in (default 0); intentionally NOT derived from the 'admin' role.\n  is_super_admin INTEGER NOT NULL DEFAULT 0,\n  avatar TEXT,\n  password_hash TEXT,\n  is_active INTEGER NOT NULL DEFAULT 1,\n  last_login_at INTEGER,\n  phone TEXT,\n  bio TEXT,\n  timezone TEXT DEFAULT 'UTC',\n  language TEXT DEFAULT 'en',\n  email_notifications INTEGER DEFAULT 1,\n  theme TEXT DEFAULT 'dark',\n  invitation_token TEXT,\n  invited_by TEXT,\n  invited_at INTEGER,\n  accepted_invitation_at INTEGER,\n  failed_login_count INTEGER NOT NULL DEFAULT 0,\n  locked_until INTEGER\n);\n\nCREATE INDEX IF NOT EXISTS idx_auth_user_email ON auth_user(email);\nCREATE INDEX IF NOT EXISTS idx_auth_user_role ON auth_user(role);\nCREATE INDEX IF NOT EXISTS idx_auth_user_invitation_token ON auth_user(invitation_token);\nCREATE INDEX IF NOT EXISTS idx_auth_user_locked_until ON auth_user(locked_until) WHERE locked_until IS NOT NULL;\n\n-- \u2500\u2500 auth_session \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCREATE TABLE IF NOT EXISTS auth_session (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\n  token TEXT NOT NULL UNIQUE,\n  expires_at INTEGER NOT NULL,\n  ip_address TEXT,\n  user_agent TEXT,\n  created_at INTEGER NOT NULL,\n  updated_at INTEGER NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_auth_session_user_id ON auth_session(user_id);\nCREATE INDEX IF NOT EXISTS idx_auth_session_token ON auth_session(token);\nCREATE INDEX IF NOT EXISTS idx_auth_session_expires_at ON auth_session(expires_at);\n\n-- \u2500\u2500 auth_account \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCREATE TABLE IF NOT EXISTS auth_account (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\n  account_id TEXT NOT NULL,\n  provider_id TEXT NOT NULL,\n  access_token TEXT,\n  refresh_token TEXT,\n  access_token_expires_at INTEGER,\n  refresh_token_expires_at INTEGER,\n  scope TEXT,\n  id_token TEXT,\n  password TEXT,\n  created_at INTEGER NOT NULL,\n  updated_at INTEGER NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_auth_account_user_id ON auth_account(user_id);\nCREATE INDEX IF NOT EXISTS idx_auth_account_provider ON auth_account(provider_id, account_id);\n\n-- \u2500\u2500 auth_verification \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- Covers email verification, password reset, magic-link tokens, OTP codes.\nCREATE TABLE IF NOT EXISTS auth_verification (\n  id TEXT PRIMARY KEY,\n  identifier TEXT NOT NULL,\n  value TEXT NOT NULL,\n  expires_at INTEGER NOT NULL,\n  created_at INTEGER NOT NULL,\n  updated_at INTEGER NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_auth_verification_identifier ON auth_verification(identifier);\n\n-- \u2500\u2500 BA plugin tables \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nCREATE TABLE IF NOT EXISTS auth_two_factor (\n  id           TEXT PRIMARY KEY,\n  secret       TEXT NOT NULL,\n  backup_codes TEXT NOT NULL,\n  user_id      TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\n  verified     INTEGER NOT NULL DEFAULT 1,\n  created_at   INTEGER NOT NULL,\n  updated_at   INTEGER NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_auth_two_factor_user_id ON auth_two_factor(user_id);\n\nCREATE TABLE IF NOT EXISTS auth_tenant (\n  id         TEXT PRIMARY KEY,\n  name       TEXT NOT NULL,\n  slug       TEXT NOT NULL UNIQUE,\n  logo       TEXT,\n  metadata   TEXT,\n  -- SonicJS tenant-resolution fields (BA organization additionalFields):\n  status     TEXT NOT NULL DEFAULT 'active',\n  domain     TEXT,\n  notes      TEXT NOT NULL DEFAULT '',\n  created_at INTEGER NOT NULL,\n  updated_at INTEGER NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_domain ON auth_tenant(domain);\n\nCREATE TABLE IF NOT EXISTS auth_tenant_member (\n  id        TEXT PRIMARY KEY,\n  tenant_id TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\n  user_id   TEXT NOT NULL REFERENCES auth_user(id)   ON DELETE CASCADE,\n  role      TEXT NOT NULL DEFAULT 'member',\n  email     TEXT,\n  created_at INTEGER NOT NULL,\n  updated_at INTEGER NOT NULL,\n  UNIQUE(tenant_id, user_id)\n);\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_member_tenant ON auth_tenant_member(tenant_id);\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_member_user   ON auth_tenant_member(user_id);\n\nCREATE TABLE IF NOT EXISTS auth_tenant_invitation (\n  id         TEXT PRIMARY KEY,\n  tenant_id  TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\n  email      TEXT NOT NULL,\n  role       TEXT NOT NULL DEFAULT 'member',\n  status     TEXT NOT NULL DEFAULT 'pending',\n  expires_at INTEGER NOT NULL,\n  inviter_id TEXT REFERENCES auth_user(id) ON DELETE SET NULL,\n  created_at INTEGER NOT NULL,\n  updated_at INTEGER NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_invitation_tenant ON auth_tenant_invitation(tenant_id);\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_invitation_email  ON auth_tenant_invitation(email);\n\nCREATE TABLE IF NOT EXISTS auth_tenant_team (\n  id        TEXT PRIMARY KEY,\n  name      TEXT NOT NULL,\n  tenant_id TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\n  created_at INTEGER NOT NULL,\n  updated_at INTEGER NOT NULL\n);\n\n-- \u2500\u2500 RBAC \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- RBAC roles, verbs, and user-role assignments are document-backed (is_auth doc\n-- types rbac_role / rbac_verb / rbac_user_roles \u2014 see services/rbac.ts). The\n-- system roles/verbs/grants are seeded at bootstrap by RbacService.ensureSystemRbacSeed().\n-- No auth_rbac_* tables.\n\n-- \u2500\u2500 Auth support tables \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCREATE TABLE IF NOT EXISTS auth_password_history (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\n  password_hash TEXT NOT NULL,\n  created_at INTEGER NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_auth_password_history_user_id ON auth_password_history(user_id);\n\nCREATE TABLE IF NOT EXISTS auth_api_tokens (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  token TEXT NOT NULL UNIQUE,\n  user_id TEXT NOT NULL REFERENCES auth_user(id),\n  permissions TEXT NOT NULL,\n  expires_at INTEGER,\n  last_used_at INTEGER,\n  created_at INTEGER NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_auth_api_tokens_user ON auth_api_tokens(user_id);\nCREATE INDEX IF NOT EXISTS idx_auth_api_tokens_token ON auth_api_tokens(token);\n\n-- User profiles moved to the document model: a `user_profile` document (is_auth type),\n-- one per user, addressed by slug = userId. See services/document-types-seed.ts and\n-- plugins/core-plugins/user-profiles/user-profile-document.ts. No auth_user_profiles table.\n"
+  },
+  {
+    id: "0002",
+    name: "Documents",
+    filename: "0002_documents.sql",
+    description: "Migration 0002: Documents",
+    sql: "-- Migration 0002: Document Schema (v3 greenfield)\n-- Contains only the new document data model tables, generated columns, and indexes.\n\n-- Document type registry\nCREATE TABLE IF NOT EXISTS document_types (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL UNIQUE,\n  display_name TEXT NOT NULL,\n  description TEXT,\n  schema TEXT NOT NULL DEFAULT '{}',\n  queryable_fields TEXT NOT NULL DEFAULT '[]',\n  settings TEXT NOT NULL DEFAULT '{}',\n  plugin_id TEXT,\n  source TEXT NOT NULL DEFAULT 'code' CHECK (source IN ('code', 'plugin', 'system')),\n  schema_version INTEGER NOT NULL DEFAULT 1,\n  is_system INTEGER NOT NULL DEFAULT 0,\n  is_active INTEGER NOT NULL DEFAULT 1,\n  is_auth INTEGER NOT NULL DEFAULT 0,\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\n  updated_at INTEGER NOT NULL DEFAULT (unixepoch())\n);\n\nCREATE INDEX IF NOT EXISTS idx_document_types_plugin ON document_types(plugin_id);\nCREATE INDEX IF NOT EXISTS idx_document_types_active ON document_types(is_active);\n\n-- Documents: canonical document rows and historical versions.\nCREATE TABLE IF NOT EXISTS documents (\n  id TEXT PRIMARY KEY,\n  root_id TEXT NOT NULL,\n  type_id TEXT NOT NULL REFERENCES document_types(id),\n  type_version INTEGER NOT NULL DEFAULT 1,\n\n  version_of_id TEXT REFERENCES documents(id),\n  version_number INTEGER NOT NULL DEFAULT 1,\n\n  is_current_draft INTEGER NOT NULL DEFAULT 1,\n  is_published INTEGER NOT NULL DEFAULT 0,\n  status TEXT NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'published', 'archived')),\n\n  parent_root_id TEXT NOT NULL DEFAULT '',\n  slug TEXT,\n  path TEXT,\n  title TEXT,\n  zone TEXT,\n  sort_order INTEGER NOT NULL DEFAULT 0,\n  visible INTEGER NOT NULL DEFAULT 1,\n\n  published_at INTEGER,\n  scheduled_at INTEGER,\n  expires_at INTEGER,\n  deleted_at INTEGER,\n\n  tenant_id TEXT NOT NULL DEFAULT 'default',\n  locale TEXT NOT NULL DEFAULT 'default',\n  translation_group_id TEXT NOT NULL DEFAULT '',\n\n  data TEXT NOT NULL DEFAULT '{}',\n  metadata TEXT NOT NULL DEFAULT '{}',\n\n  owner_id TEXT,\n  created_by TEXT,\n  updated_by TEXT,\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\n  updated_at INTEGER NOT NULL DEFAULT (unixepoch())\n);\n\n-- Queryable scalar fields (VIRTUAL generated columns) and their q_* filter indexes\n-- are AUTO-GENERATED at runtime from each document type's queryableFields config \u2014\n-- see DocumentTypeRegistry.register() -> ensureScalarSchema() (document-scalar-schema.ts).\n-- Do not hand-add q_* columns/indexes here; declare the field in the type instead.\n\n-- Revision chain\nCREATE INDEX IF NOT EXISTS idx_documents_root ON documents(root_id, version_number DESC);\n\n-- List / lifecycle\nCREATE INDEX IF NOT EXISTS idx_documents_published ON documents(tenant_id, type_id, locale, is_published)\n  WHERE is_published = 1 AND deleted_at IS NULL;\nCREATE INDEX IF NOT EXISTS idx_documents_drafts ON documents(tenant_id, type_id, status, is_current_draft)\n  WHERE is_current_draft = 1;\nCREATE INDEX IF NOT EXISTS idx_documents_parent ON documents(tenant_id, parent_root_id, sort_order, is_published);\nCREATE INDEX IF NOT EXISTS idx_documents_path ON documents(tenant_id, path);\nCREATE INDEX IF NOT EXISTS idx_documents_translation ON documents(translation_group_id, locale);\nCREATE INDEX IF NOT EXISTS idx_documents_deleted ON documents(deleted_at);\nCREATE INDEX IF NOT EXISTS idx_documents_scheduled ON documents(scheduled_at) WHERE scheduled_at IS NOT NULL;\nCREATE INDEX IF NOT EXISTS idx_documents_expires ON documents(expires_at) WHERE expires_at IS NOT NULL;\n\n-- Stable keyset/cursor pagination for published lists\nCREATE INDEX IF NOT EXISTS idx_documents_published_cursor\n  ON documents(tenant_id, type_id, updated_at DESC, id DESC)\n  WHERE is_published = 1 AND deleted_at IS NULL;\n\n-- (q_* generated-column filter indexes are auto-created at runtime \u2014 see note above.)\n\n-- Partial unique indexes: the hard concurrency guarantees for draft/publish invariants.\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_current_draft\n  ON documents(root_id) WHERE is_current_draft = 1;\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_published\n  ON documents(root_id) WHERE is_published = 1;\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_unique_version\n  ON documents(root_id, version_number);\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_unique_slug\n  ON documents(tenant_id, locale, type_id, parent_root_id, slug)\n  WHERE is_current_draft = 1 AND deleted_at IS NULL AND slug IS NOT NULL;\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_translation_per_locale\n  ON documents(tenant_id, translation_group_id, locale)\n  WHERE is_current_draft = 1 AND translation_group_id <> '';\n\n-- Document references: typed document-to-document edges.\nCREATE TABLE IF NOT EXISTS document_references (\n  id TEXT PRIMARY KEY,\n  tenant_id TEXT NOT NULL,\n  from_root_id TEXT NOT NULL,\n  from_document_id TEXT NOT NULL REFERENCES documents(id) ON DELETE CASCADE,\n  field_name TEXT NOT NULL,\n  ordinal INTEGER NOT NULL DEFAULT 0,\n  to_root_id TEXT NOT NULL,\n  ref_strength TEXT NOT NULL DEFAULT 'weak' CHECK (ref_strength IN ('strong', 'weak')),\n  created_at INTEGER NOT NULL DEFAULT (unixepoch())\n);\n\nCREATE INDEX IF NOT EXISTS idx_docref_to   ON document_references(tenant_id, to_root_id);\nCREATE INDEX IF NOT EXISTS idx_docref_from ON document_references(from_document_id);\nCREATE UNIQUE INDEX IF NOT EXISTS idx_docref_unique\n  ON document_references(from_document_id, field_name, ordinal);\n\n-- Document facets: indexed rows for multi-valued scalar fields (e.g. tags arrays).\nCREATE TABLE IF NOT EXISTS document_facets (\n  id TEXT PRIMARY KEY,\n  tenant_id TEXT NOT NULL,\n  document_id TEXT NOT NULL REFERENCES documents(id) ON DELETE CASCADE,\n  root_id TEXT NOT NULL,\n  type_id TEXT NOT NULL,\n  field_name TEXT NOT NULL,\n  ordinal INTEGER NOT NULL DEFAULT 0,\n  value_text TEXT,\n  value_number REAL,\n  created_at INTEGER NOT NULL DEFAULT (unixepoch())\n);\n\nCREATE INDEX IF NOT EXISTS idx_facets_lookup ON document_facets(tenant_id, type_id, field_name, value_text);\nCREATE INDEX IF NOT EXISTS idx_facets_doc    ON document_facets(document_id);\nCREATE UNIQUE INDEX IF NOT EXISTS idx_facets_unique\n  ON document_facets(document_id, field_name, ordinal);\n\n-- Document permissions: per-document ACL overrides.\nCREATE TABLE IF NOT EXISTS document_permissions (\n  id TEXT PRIMARY KEY,\n  tenant_id TEXT NOT NULL,\n  root_id TEXT NOT NULL,\n  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'role', 'group', 'public', 'token')),\n  principal_id TEXT NOT NULL,\n  permission TEXT NOT NULL CHECK (permission IN ('read', 'create', 'update', 'delete', 'publish', 'manage')),\n  effect TEXT NOT NULL DEFAULT 'allow' CHECK (effect IN ('allow', 'deny')),\n  inherited INTEGER NOT NULL DEFAULT 0,\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\n  created_by TEXT\n);\n\nCREATE INDEX IF NOT EXISTS idx_document_permissions_root ON document_permissions(tenant_id, root_id);\nCREATE INDEX IF NOT EXISTS idx_document_permissions_principal\n  ON document_permissions(tenant_id, principal_type, principal_id, permission);\nCREATE UNIQUE INDEX IF NOT EXISTS idx_document_permissions_unique\n  ON document_permissions(root_id, principal_type, principal_id, permission);\n"
+  }
+];
+new Map(
+  bundledMigrations.map((m) => [m.id, m])
+);
+
+// src/services/document-scalar-schema.ts
+var SAFE_IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
+function affinity(type) {
+  if (type === "number") return "REAL";
+  if (type === "integer" || type === "boolean" || type === "date") return "INTEGER";
+  return "TEXT";
+}
+var slug = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+function resolveColumn(typeId, f) {
+  if (f.column) return f.column;
+  const name = `q_${slug(typeId)}_${slug(f.name)}`;
+  return name.length <= 60 ? name : `q_${slug(typeId).slice(0, 20)}_${slug(f.name).slice(0, 20)}`;
+}
+async function ensureScalarSchema(db, typeId, fields) {
+  const scalars = fields.filter((f) => f.kind === "scalar");
+  if (scalars.length === 0) return [];
+  let existing = /* @__PURE__ */ new Set();
+  try {
+    const info = await db.prepare("SELECT name FROM pragma_table_xinfo('documents')").all();
+    existing = new Set((info?.results ?? []).map((r) => r.name));
+  } catch {
+  }
+  const added = [];
+  for (const f of scalars) {
+    const col = resolveColumn(typeId, f);
+    if (!SAFE_IDENTIFIER.test(col)) {
+      console.error(`[scalar-schema] unsafe column name '${col}' for ${typeId}.${f.name} \u2014 skipped`);
+      continue;
+    }
+    const path = f.path ?? `$.${f.name}`;
+    if (path.includes("'")) {
+      console.error(`[scalar-schema] unsafe json path for ${col} (${typeId}.${f.name}) \u2014 skipped`);
+      continue;
+    }
+    if (!existing.has(col)) {
+      try {
+        await db.prepare(`ALTER TABLE documents ADD COLUMN ${col} ${affinity(f.type)} AS (json_extract(data, '${path}')) VIRTUAL`).run();
+        added.push(col);
+        console.log(`[scalar-schema] added documents.${col} for type '${typeId}'`);
+      } catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        if (!msg.includes("duplicate column name")) {
+          console.error(`[scalar-schema] failed to add documents.${col}:`, msg);
+          continue;
+        }
+      }
+    }
+    try {
+      await db.prepare(`CREATE INDEX IF NOT EXISTS idx_${col} ON documents(tenant_id, type_id, ${col}, updated_at DESC, id DESC)`).run();
+    } catch (error) {
+      console.error(`[scalar-schema] failed to create idx_${col}:`, error instanceof Error ? error.message : String(error));
+    }
+  }
+  return added;
+}
+
+// src/services/migrations.ts
+var MigrationService = class {
+  constructor(db) {
+    this.db = db;
+  }
+  /**
+   * Cloudflare D1 owns migration bookkeeping through `d1_migrations`.
+   * SonicJS intentionally does not create its own tracking table.
+   */
+  async initializeMigrationsTable() {
+  }
+  /**
+   * Get all available migrations from the bundled migrations
+   */
+  async getAvailableMigrations() {
+    const migrations = [];
+    const appliedMigrations = await this.getD1AppliedMigrations();
+    await this.ensureSchemaCompatibility();
+    for (const bundled of bundledMigrations) {
+      const applied = appliedMigrations.has(bundled.id);
+      const appliedData = appliedMigrations.get(bundled.id);
+      migrations.push({
+        id: bundled.id,
+        name: bundled.name,
+        filename: bundled.filename,
+        description: bundled.description,
+        applied,
+        appliedAt: applied ? appliedData?.applied_at : void 0,
+        size: bundled.sql.length
+      });
+    }
+    return migrations;
+  }
+  /**
+   * Read Wrangler/D1's canonical migration table. If the table is absent, no
+   * migrations have been applied by the supported migration runner yet.
+   */
+  async getD1AppliedMigrations() {
+    try {
+      const appliedResult = await this.db.prepare(
+        "SELECT name, applied_at FROM d1_migrations ORDER BY applied_at ASC"
+      ).all();
+      return new Map(
+        (appliedResult.results ?? []).map((row) => {
+          const filename = String(row.name ?? "");
+          const id = filename.match(/^(\d+)/)?.[1];
+          if (!id) return null;
+          return [id, {
+            id,
+            name: filename,
+            filename,
+            applied_at: row.applied_at
+          }];
+        }).filter((entry) => entry !== null)
+      );
+    } catch (error) {
+      return /* @__PURE__ */ new Map();
+    }
+  }
+  /**
+   * Run idempotent compatibility repairs that are safe outside migration state.
+   */
+  async ensureSchemaCompatibility() {
+    if (await this.checkTablesExist(["documents"])) {
+      await this.ensureDocumentGeneratedColumns();
+    }
+  }
+  /**
+   * Ensure the `documents` table exposes every queryable VIRTUAL generated column + index (D45).
+   * Data-driven repair: reconciles from each active type's `queryable_fields` rather than a hardcoded
+   * list, so it stays in sync with whatever types are registered. Generation of these columns is owned
+   * by DocumentTypeRegistry.register() (via ensureScalarSchema); this pass is a bootstrap safety net for
+   * a DB that has document_types rows but lost columns (e.g. table rebuilt). Idempotent.
+   */
+  async ensureDocumentGeneratedColumns() {
+    if (!await this.checkTablesExist(["document_types"])) return;
+    const rows = await this.db.prepare("SELECT id, queryable_fields FROM document_types WHERE is_active = 1").all();
+    for (const row of rows.results ?? []) {
+      let fields;
+      try {
+        fields = JSON.parse(row.queryable_fields);
+      } catch {
+        continue;
+      }
+      await ensureScalarSchema(this.db, row.id, fields);
+    }
+  }
+  /**
+   * Check if specific tables exist in the database
+   */
+  async checkTablesExist(tableNames) {
+    try {
+      for (const tableName of tableNames) {
+        const result = await this.db.prepare(
+          `SELECT name FROM sqlite_master WHERE type='table' AND name=?`
+        ).bind(tableName).first();
+        if (!result) {
+          return false;
+        }
+      }
+      return true;
+    } catch (error) {
+      return false;
+    }
+  }
+  /**
+   * Check if a specific column exists in a table
+   */
+  async checkColumnExists(tableName, columnName) {
+    try {
+      const result = await this.db.prepare(
+        `SELECT * FROM pragma_table_info(?) WHERE name = ?`
+      ).bind(tableName, columnName).first();
+      return !!result;
+    } catch (error) {
+      return false;
+    }
+  }
+  /**
+   * Get migration status summary
+   */
+  async getMigrationStatus() {
+    const migrations = await this.getAvailableMigrations();
+    const appliedMigrations = migrations.filter((m) => m.applied);
+    const pendingMigrations = migrations.filter((m) => !m.applied);
+    const lastApplied = appliedMigrations.length > 0 ? appliedMigrations[appliedMigrations.length - 1]?.appliedAt : void 0;
+    return {
+      totalMigrations: migrations.length,
+      appliedMigrations: appliedMigrations.length,
+      pendingMigrations: pendingMigrations.length,
+      lastApplied,
+      migrations
+    };
+  }
+  /**
+   * D1 migration state is managed by Wrangler.
+   */
+  async markMigrationApplied(migrationId, name, filename) {
+  }
+  /**
+   * D1 migration state is managed by Wrangler.
+   */
+  async removeMigrationApplied(migrationId) {
+  }
+  /**
+   * Check if a specific migration has been applied
+   */
+  async isMigrationApplied(migrationId) {
+    const appliedMigrations = await this.getD1AppliedMigrations();
+    return appliedMigrations.has(migrationId);
+  }
+  /**
+   * Get the last applied migration
+   */
+  async getLastAppliedMigration() {
+    const migrations = await this.getAvailableMigrations();
+    return migrations.filter((m) => m.applied).at(-1) ?? null;
+  }
+  /**
+   * Run pending migrations
+   */
+  async runPendingMigrations() {
+    return {
+      success: false,
+      message: "Migrations are managed by Cloudflare D1. Run `wrangler d1 migrations apply DB --local` or `wrangler d1 migrations apply DB --remote`.",
+      applied: [],
+      errors: []
+    };
+  }
+  /**
+   * Validate database schema
+   */
+  async validateSchema() {
+    const issues = [];
+    const requiredTables = [
+      "users",
+      "documents",
+      "document_types"
+    ];
+    for (const table of requiredTables) {
+      try {
+        await this.db.prepare(`SELECT COUNT(*) FROM ${table} LIMIT 1`).first();
+      } catch (error) {
+        issues.push(`Missing table: ${table}`);
+      }
+    }
+    return {
+      valid: issues.length === 0,
+      issues
+    };
+  }
+};
+
+exports.MigrationService = MigrationService;
+exports.ensureScalarSchema = ensureScalarSchema;
+//# sourceMappingURL=chunk-IHTXB7AT.cjs.map
+//# sourceMappingURL=chunk-IHTXB7AT.cjs.map

package/dist/chunk-IHTXB7AT.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/migrations-bundle.ts","../src/services/document-scalar-schema.ts","../src/services/migrations.ts"],"names":[],"mappings":";;;AAiBO,IAAM,iBAAA,GAAwC;AAAA,EACnD;AAAA,IACE,EAAA,EAAI,MAAA;AAAA,IACJ,IAAA,EAAM,MAAA;AAAA,IACN,QAAA,EAAU,eAAA;AAAA,IACV,WAAA,EAAa,sBAAA;AAAA,IACb,GAAA,EAAK;AAAA,GACP;AAAA,EACA;AAAA,IACE,EAAA,EAAI,MAAA;AAAA,IACJ,IAAA,EAAM,WAAA;AAAA,IACN,QAAA,EAAU,oBAAA;AAAA,IACV,WAAA,EAAa,2BAAA;AAAA,IACb,GAAA,EAAK;AAAA;AAET,CAAA;AAGiC,IAAI,GAAA;AAAA,EACnC,kBAAkB,GAAA,CAAI,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,EAAA,EAAI,CAAC,CAAC;AACtC;;;AC/BA,IAAM,eAAA,GAAkB,oBAAA;AAGxB,SAAS,SAAS,IAAA,EAA4D;AAC5E,EAAA,IAAI,IAAA,KAAS,UAAU,OAAO,MAAA;AAC9B,EAAA,IAAI,SAAS,SAAA,IAAa,IAAA,KAAS,SAAA,IAAa,IAAA,KAAS,QAAQ,OAAO,SAAA;AACxE,EAAA,OAAO,MAAA;AACT;AAEA,IAAM,IAAA,GAAO,CAAC,CAAA,KAAc,CAAA,CAAE,WAAA,EAAY,CAAE,OAAA,CAAQ,aAAA,EAAe,GAAG,CAAA,CAAE,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA;AAQvF,SAAS,aAAA,CAAc,QAAgB,CAAA,EAA2B;AACvE,EAAA,IAAI,CAAA,CAAE,MAAA,EAAQ,OAAO,CAAA,CAAE,MAAA;AACvB,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,EAAI,IAAA,CAAK,CAAA,CAAE,IAAI,CAAC,CAAA,CAAA;AAC9C,EAAA,OAAO,IAAA,CAAK,UAAU,EAAA,GAAK,IAAA,GAAO,KAAK,IAAA,CAAK,MAAM,EAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,IAAI,EAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AAC/F;AAaA,eAAsB,kBAAA,CACpB,EAAA,EACA,MAAA,EACA,MAAA,EACmB;AACnB,EAAA,MAAM,UAAU,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,QAAQ,CAAA;AACxD,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAGlC,EAAA,IAAI,QAAA,uBAAe,GAAA,EAAY;AAC/B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,EAAA,CAAG,OAAA,CAAQ,kDAAkD,EAAE,GAAA,EAAI;AACtF,IAAA,QAAA,GAAW,IAAI,GAAA,CAAA,CAAK,IAAA,EAAM,OAAA,IAAW,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EAClE,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,IAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AACnC,IAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,GAAG,CAAA,EAAG;AAC9B,MAAA,OAAA,CAAQ,KAAA,CAAM,uCAAuC,GAAG,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,eAAA,CAAY,CAAA;AAC7F,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,IAAA,IAAQ,CAAA,EAAA,EAAK,EAAE,IAAI,CAAA,CAAA;AAClC,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACtB,MAAA,OAAA,CAAQ,KAAA,CAAM,wCAAwC,GAAG,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,gBAAA,CAAa,CAAA;AAC3F,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACtB,MAAA,IAAI;AACF,QAAA,MAAM,EAAA,CACH,OAAA,CAAQ,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAA,EAAI,QAAA,CAAS,CAAA,CAAE,IAAI,CAAC,CAAA,yBAAA,EAA4B,IAAI,CAAA,WAAA,CAAa,EAChH,GAAA,EAAI;AACP,QAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AACd,QAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,gCAAA,EAAmC,GAAG,CAAA,WAAA,EAAc,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC3E,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,MAAM,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACjE,QAAA,IAAI,CAAC,GAAA,CAAI,QAAA,CAAS,uBAAuB,CAAA,EAAG;AAC1C,UAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,wCAAA,EAA2C,GAAG,CAAA,CAAA,CAAA,EAAK,GAAG,CAAA;AACpE,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAMA,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,CACH,QAAQ,CAAA,+BAAA,EAAkC,GAAG,qCAAqC,GAAG,CAAA,2BAAA,CAA6B,EAClH,GAAA,EAAI;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,qCAAA,EAAwC,GAAG,CAAA,CAAA,CAAA,EAAK,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IACtH;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;;AC5EO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAAoB,EAAA,EAAgB;AAAhB,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrC,MAAM,yBAAA,GAA2C;AAAA,EAEjD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAA,GAA+C;AACnD,IAAA,MAAM,aAA0B,EAAC;AACjC,IAAA,MAAM,iBAAA,GAAoB,MAAM,IAAA,CAAK,sBAAA,EAAuB;AAC5D,IAAA,MAAM,KAAK,yBAAA,EAA0B;AAGrC,IAAA,KAAA,MAAW,WAAW,iBAAA,EAAmB;AACvC,MAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,EAAE,CAAA;AAChD,MAAA,MAAM,WAAA,GAAc,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,EAAE,CAAA;AAEpD,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,IAAI,OAAA,CAAQ,EAAA;AAAA,QACZ,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,UAAU,OAAA,CAAQ,QAAA;AAAA,QAClB,aAAa,OAAA,CAAQ,WAAA;AAAA,QACrB,OAAA;AAAA,QACA,SAAA,EAAW,OAAA,GAAU,WAAA,EAAa,UAAA,GAAa,MAAA;AAAA,QAC/C,IAAA,EAAM,QAAQ,GAAA,CAAI;AAAA,OACnB,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,UAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,sBAAA,GAAoD;AAChE,IAAA,IAAI;AACF,MAAA,MAAM,aAAA,GAAgB,MAAM,IAAA,CAAK,EAAA,CAAG,OAAA;AAAA,QAClC;AAAA,QACA,GAAA,EAAI;AAEN,MAAA,OAAO,IAAI,GAAA;AAAA,QAAA,CACR,cAAc,OAAA,IAAW,EAAC,EACxB,GAAA,CAAI,CAAC,GAAA,KAAa;AACjB,UAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAA;AACtC,UAAA,MAAM,EAAA,GAAK,QAAA,CAAS,KAAA,CAAM,QAAQ,IAAI,CAAC,CAAA;AACvC,UAAA,IAAI,CAAC,IAAI,OAAO,IAAA;AAChB,UAAA,OAAO,CAAC,EAAA,EAAI;AAAA,YACV,EAAA;AAAA,YACA,IAAA,EAAM,QAAA;AAAA,YACN,QAAA;AAAA,YACA,YAAY,GAAA,CAAI;AAAA,WACjB,CAAA;AAAA,QACH,CAAC,CAAA,CACA,MAAA,CAAO,CAAC,KAAA,KAAkC,UAAU,IAAI;AAAA,OAC7D;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,2BAAW,GAAA,EAAI;AAAA,IACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,yBAAA,GAA2C;AAC/C,IAAA,IAAI,MAAM,IAAA,CAAK,gBAAA,CAAiB,CAAC,WAAW,CAAC,CAAA,EAAG;AAC9C,MAAA,MAAM,KAAK,8BAAA,EAA+B;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,8BAAA,GAAgD;AAC5D,IAAA,IAAI,CAAE,MAAM,IAAA,CAAK,iBAAiB,CAAC,gBAAgB,CAAC,CAAA,EAAI;AACxD,IAAA,MAAM,OAAO,MAAM,IAAA,CAAK,GACrB,OAAA,CAAQ,qEAAqE,EAC7E,GAAA,EAA8C;AACjD,IAAA,KAAA,MAAW,GAAA,IAAO,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACpC,MAAA,IAAI,MAAA;AACJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,gBAAgB,CAAA;AAAA,MAC1C,CAAA,CAAA,MAAQ;AACN,QAAA;AAAA,MACF;AACA,MAAA,MAAM,kBAAA,CAAmB,IAAA,CAAK,EAAA,EAAI,GAAA,CAAI,IAAI,MAAM,CAAA;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBAAiB,UAAA,EAAwC;AACrE,IAAA,IAAI;AACF,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,EAAA,CAAG,OAAA;AAAA,UAC3B,CAAA,4DAAA;AAAA,SACF,CAAE,IAAA,CAAK,SAAS,CAAA,CAAE,KAAA,EAAM;AAExB,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,OAAO,KAAA;AAAA,QACT;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBAAA,CAAkB,SAAA,EAAmB,UAAA,EAAsC;AACvF,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,EAAA,CAAG,OAAA;AAAA,QAC3B,CAAA,iDAAA;AAAA,OACF,CAAE,IAAA,CAAK,SAAA,EAAW,UAAU,EAAE,KAAA,EAAM;AAEpC,MAAA,OAAO,CAAC,CAAC,MAAA;AAAA,IACX,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAA,GAA+C;AACnD,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,sBAAA,EAAuB;AACrD,IAAA,MAAM,iBAAA,GAAoB,UAAA,CAAW,MAAA,CAAO,CAAA,CAAA,KAAK,EAAE,OAAO,CAAA;AAC1D,IAAA,MAAM,oBAAoB,UAAA,CAAW,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,EAAE,OAAO,CAAA;AAE3D,IAAA,MAAM,WAAA,GAAc,kBAAkB,MAAA,GAAS,CAAA,GAC3C,kBAAkB,iBAAA,CAAkB,MAAA,GAAS,CAAC,CAAA,EAAG,SAAA,GACjD,MAAA;AAEJ,IAAA,OAAO;AAAA,MACL,iBAAiB,UAAA,CAAW,MAAA;AAAA,MAC5B,mBAAmB,iBAAA,CAAkB,MAAA;AAAA,MACrC,mBAAmB,iBAAA,CAAkB,MAAA;AAAA,MACrC,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,CAAqB,WAAA,EAAqB,IAAA,EAAc,QAAA,EAAiC;AAGxF,EACP;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAuB,WAAA,EAAoC;AAC1D,EACP;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,WAAA,EAAuC;AAC9D,IAAA,MAAM,iBAAA,GAAoB,MAAM,IAAA,CAAK,sBAAA,EAAuB;AAC5D,IAAA,OAAO,iBAAA,CAAkB,IAAI,WAAW,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAA,GAAqD;AACzD,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,sBAAA,EAAuB;AACrD,IAAA,OAAO,UAAA,CAAW,OAAO,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,CAAA,CAAE,EAAA,CAAG,EAAE,CAAA,IAAK,IAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAA,GAA4G;AAChH,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,OAAA,EAAS,uIAAA;AAAA,MACT,SAAS,EAAC;AAAA,MACV,QAAQ;AAAC,KACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,GAAgE;AACpE,IAAA,MAAM,SAAmB,EAAC;AAG1B,IAAA,MAAM,cAAA,GAAiB;AAAA,MACrB,OAAA;AAAA,MAAS,WAAA;AAAA,MAAa;AAAA,KACxB;AAEA,IAAA,KAAA,MAAW,SAAS,cAAA,EAAgB;AAClC,MAAA,IAAI;AACF,QAAA,MAAM,KAAK,EAAA,CAAG,OAAA,CAAQ,wBAAwB,KAAK,CAAA,QAAA,CAAU,EAAE,KAAA,EAAM;AAAA,MACvE,SAAS,KAAA,EAAO;AACd,QAAA,MAAA,CAAO,IAAA,CAAK,CAAA,eAAA,EAAkB,KAAK,CAAA,CAAE,CAAA;AAAA,MACvC;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,OAAO,MAAA,KAAW,CAAA;AAAA,MACzB;AAAA,KACF;AAAA,EACF;AACF","file":"chunk-IHTXB7AT.cjs","sourcesContent":["/**\n * AUTO-GENERATED FILE - DO NOT EDIT\n * Generated by: scripts/generate-migrations.ts\n * Generated at: 2026-06-23T20:54:23.135Z\n *\n * This file contains all migration SQL bundled for use in Cloudflare Workers\n * where filesystem access is not available at runtime.\n */\n\nexport interface BundledMigration {\n  id: string\n  name: string\n  filename: string\n  description: string\n  sql: string\n}\n\nexport const bundledMigrations: BundledMigration[] = [\n  {\n    id: '0001',\n    name: 'Core',\n    filename: '0001_core.sql',\n    description: 'Migration 0001: Core',\n    sql: \"-- Migration 0001: Auth tables\\n-- auth_user, auth_session, auth_account, auth_verification + BA plugin tables + RBAC + auth support.\\n-- Only auth_* prefixed tables live here. All content lives in document_* tables (0002_documents.sql).\\n\\n-- ── auth_user ────────────────────────────────────────────────────────────────\\n-- BA user model + SonicJS domain columns as BA additionalFields.\\nCREATE TABLE IF NOT EXISTS auth_user (\\n  id TEXT PRIMARY KEY,\\n  name TEXT,\\n  email TEXT NOT NULL UNIQUE,\\n  email_verified INTEGER NOT NULL DEFAULT 0,\\n  image TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL,\\n  -- SonicJS additionalFields\\n  first_name TEXT NOT NULL,\\n  last_name TEXT NOT NULL,\\n  role TEXT NOT NULL DEFAULT 'viewer',\\n  -- Platform super-admin: bypasses the multi-tenant membership gate, uses global roles in every\\n  -- tenant. Opt-in (default 0); intentionally NOT derived from the 'admin' role.\\n  is_super_admin INTEGER NOT NULL DEFAULT 0,\\n  avatar TEXT,\\n  password_hash TEXT,\\n  is_active INTEGER NOT NULL DEFAULT 1,\\n  last_login_at INTEGER,\\n  phone TEXT,\\n  bio TEXT,\\n  timezone TEXT DEFAULT 'UTC',\\n  language TEXT DEFAULT 'en',\\n  email_notifications INTEGER DEFAULT 1,\\n  theme TEXT DEFAULT 'dark',\\n  invitation_token TEXT,\\n  invited_by TEXT,\\n  invited_at INTEGER,\\n  accepted_invitation_at INTEGER,\\n  failed_login_count INTEGER NOT NULL DEFAULT 0,\\n  locked_until INTEGER\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_auth_user_email ON auth_user(email);\\nCREATE INDEX IF NOT EXISTS idx_auth_user_role ON auth_user(role);\\nCREATE INDEX IF NOT EXISTS idx_auth_user_invitation_token ON auth_user(invitation_token);\\nCREATE INDEX IF NOT EXISTS idx_auth_user_locked_until ON auth_user(locked_until) WHERE locked_until IS NOT NULL;\\n\\n-- ── auth_session ─────────────────────────────────────────────────────────────\\nCREATE TABLE IF NOT EXISTS auth_session (\\n  id TEXT PRIMARY KEY,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  token TEXT NOT NULL UNIQUE,\\n  expires_at INTEGER NOT NULL,\\n  ip_address TEXT,\\n  user_agent TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_session_user_id ON auth_session(user_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_session_token ON auth_session(token);\\nCREATE INDEX IF NOT EXISTS idx_auth_session_expires_at ON auth_session(expires_at);\\n\\n-- ── auth_account ─────────────────────────────────────────────────────────────\\nCREATE TABLE IF NOT EXISTS auth_account (\\n  id TEXT PRIMARY KEY,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  account_id TEXT NOT NULL,\\n  provider_id TEXT NOT NULL,\\n  access_token TEXT,\\n  refresh_token TEXT,\\n  access_token_expires_at INTEGER,\\n  refresh_token_expires_at INTEGER,\\n  scope TEXT,\\n  id_token TEXT,\\n  password TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_account_user_id ON auth_account(user_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_account_provider ON auth_account(provider_id, account_id);\\n\\n-- ── auth_verification ────────────────────────────────────────────────────────\\n-- Covers email verification, password reset, magic-link tokens, OTP codes.\\nCREATE TABLE IF NOT EXISTS auth_verification (\\n  id TEXT PRIMARY KEY,\\n  identifier TEXT NOT NULL,\\n  value TEXT NOT NULL,\\n  expires_at INTEGER NOT NULL,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_verification_identifier ON auth_verification(identifier);\\n\\n-- ── BA plugin tables ──────────────────────────────────────────────────────────\\n\\nCREATE TABLE IF NOT EXISTS auth_two_factor (\\n  id           TEXT PRIMARY KEY,\\n  secret       TEXT NOT NULL,\\n  backup_codes TEXT NOT NULL,\\n  user_id      TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  verified     INTEGER NOT NULL DEFAULT 1,\\n  created_at   INTEGER NOT NULL,\\n  updated_at   INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_two_factor_user_id ON auth_two_factor(user_id);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant (\\n  id         TEXT PRIMARY KEY,\\n  name       TEXT NOT NULL,\\n  slug       TEXT NOT NULL UNIQUE,\\n  logo       TEXT,\\n  metadata   TEXT,\\n  -- SonicJS tenant-resolution fields (BA organization additionalFields):\\n  status     TEXT NOT NULL DEFAULT 'active',\\n  domain     TEXT,\\n  notes      TEXT NOT NULL DEFAULT '',\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_domain ON auth_tenant(domain);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant_member (\\n  id        TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\\n  user_id   TEXT NOT NULL REFERENCES auth_user(id)   ON DELETE CASCADE,\\n  role      TEXT NOT NULL DEFAULT 'member',\\n  email     TEXT,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL,\\n  UNIQUE(tenant_id, user_id)\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_member_tenant ON auth_tenant_member(tenant_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_member_user   ON auth_tenant_member(user_id);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant_invitation (\\n  id         TEXT PRIMARY KEY,\\n  tenant_id  TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\\n  email      TEXT NOT NULL,\\n  role       TEXT NOT NULL DEFAULT 'member',\\n  status     TEXT NOT NULL DEFAULT 'pending',\\n  expires_at INTEGER NOT NULL,\\n  inviter_id TEXT REFERENCES auth_user(id) ON DELETE SET NULL,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_invitation_tenant ON auth_tenant_invitation(tenant_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_tenant_invitation_email  ON auth_tenant_invitation(email);\\n\\nCREATE TABLE IF NOT EXISTS auth_tenant_team (\\n  id        TEXT PRIMARY KEY,\\n  name      TEXT NOT NULL,\\n  tenant_id TEXT NOT NULL REFERENCES auth_tenant(id) ON DELETE CASCADE,\\n  created_at INTEGER NOT NULL,\\n  updated_at INTEGER NOT NULL\\n);\\n\\n-- ── RBAC ─────────────────────────────────────────────────────────────────────\\n-- RBAC roles, verbs, and user-role assignments are document-backed (is_auth doc\\n-- types rbac_role / rbac_verb / rbac_user_roles — see services/rbac.ts). The\\n-- system roles/verbs/grants are seeded at bootstrap by RbacService.ensureSystemRbacSeed().\\n-- No auth_rbac_* tables.\\n\\n-- ── Auth support tables ───────────────────────────────────────────────────────\\nCREATE TABLE IF NOT EXISTS auth_password_history (\\n  id TEXT PRIMARY KEY,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id) ON DELETE CASCADE,\\n  password_hash TEXT NOT NULL,\\n  created_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_password_history_user_id ON auth_password_history(user_id);\\n\\nCREATE TABLE IF NOT EXISTS auth_api_tokens (\\n  id TEXT PRIMARY KEY,\\n  name TEXT NOT NULL,\\n  token TEXT NOT NULL UNIQUE,\\n  user_id TEXT NOT NULL REFERENCES auth_user(id),\\n  permissions TEXT NOT NULL,\\n  expires_at INTEGER,\\n  last_used_at INTEGER,\\n  created_at INTEGER NOT NULL\\n);\\nCREATE INDEX IF NOT EXISTS idx_auth_api_tokens_user ON auth_api_tokens(user_id);\\nCREATE INDEX IF NOT EXISTS idx_auth_api_tokens_token ON auth_api_tokens(token);\\n\\n-- User profiles moved to the document model: a `user_profile` document (is_auth type),\\n-- one per user, addressed by slug = userId. See services/document-types-seed.ts and\\n-- plugins/core-plugins/user-profiles/user-profile-document.ts. No auth_user_profiles table.\\n\"\n  },\n  {\n    id: '0002',\n    name: 'Documents',\n    filename: '0002_documents.sql',\n    description: 'Migration 0002: Documents',\n    sql: \"-- Migration 0002: Document Schema (v3 greenfield)\\n-- Contains only the new document data model tables, generated columns, and indexes.\\n\\n-- Document type registry\\nCREATE TABLE IF NOT EXISTS document_types (\\n  id TEXT PRIMARY KEY,\\n  name TEXT NOT NULL UNIQUE,\\n  display_name TEXT NOT NULL,\\n  description TEXT,\\n  schema TEXT NOT NULL DEFAULT '{}',\\n  queryable_fields TEXT NOT NULL DEFAULT '[]',\\n  settings TEXT NOT NULL DEFAULT '{}',\\n  plugin_id TEXT,\\n  source TEXT NOT NULL DEFAULT 'code' CHECK (source IN ('code', 'plugin', 'system')),\\n  schema_version INTEGER NOT NULL DEFAULT 1,\\n  is_system INTEGER NOT NULL DEFAULT 0,\\n  is_active INTEGER NOT NULL DEFAULT 1,\\n  is_auth INTEGER NOT NULL DEFAULT 0,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\\n  updated_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_document_types_plugin ON document_types(plugin_id);\\nCREATE INDEX IF NOT EXISTS idx_document_types_active ON document_types(is_active);\\n\\n-- Documents: canonical document rows and historical versions.\\nCREATE TABLE IF NOT EXISTS documents (\\n  id TEXT PRIMARY KEY,\\n  root_id TEXT NOT NULL,\\n  type_id TEXT NOT NULL REFERENCES document_types(id),\\n  type_version INTEGER NOT NULL DEFAULT 1,\\n\\n  version_of_id TEXT REFERENCES documents(id),\\n  version_number INTEGER NOT NULL DEFAULT 1,\\n\\n  is_current_draft INTEGER NOT NULL DEFAULT 1,\\n  is_published INTEGER NOT NULL DEFAULT 0,\\n  status TEXT NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'published', 'archived')),\\n\\n  parent_root_id TEXT NOT NULL DEFAULT '',\\n  slug TEXT,\\n  path TEXT,\\n  title TEXT,\\n  zone TEXT,\\n  sort_order INTEGER NOT NULL DEFAULT 0,\\n  visible INTEGER NOT NULL DEFAULT 1,\\n\\n  published_at INTEGER,\\n  scheduled_at INTEGER,\\n  expires_at INTEGER,\\n  deleted_at INTEGER,\\n\\n  tenant_id TEXT NOT NULL DEFAULT 'default',\\n  locale TEXT NOT NULL DEFAULT 'default',\\n  translation_group_id TEXT NOT NULL DEFAULT '',\\n\\n  data TEXT NOT NULL DEFAULT '{}',\\n  metadata TEXT NOT NULL DEFAULT '{}',\\n\\n  owner_id TEXT,\\n  created_by TEXT,\\n  updated_by TEXT,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\\n  updated_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\n-- Queryable scalar fields (VIRTUAL generated columns) and their q_* filter indexes\\n-- are AUTO-GENERATED at runtime from each document type's queryableFields config —\\n-- see DocumentTypeRegistry.register() -> ensureScalarSchema() (document-scalar-schema.ts).\\n-- Do not hand-add q_* columns/indexes here; declare the field in the type instead.\\n\\n-- Revision chain\\nCREATE INDEX IF NOT EXISTS idx_documents_root ON documents(root_id, version_number DESC);\\n\\n-- List / lifecycle\\nCREATE INDEX IF NOT EXISTS idx_documents_published ON documents(tenant_id, type_id, locale, is_published)\\n  WHERE is_published = 1 AND deleted_at IS NULL;\\nCREATE INDEX IF NOT EXISTS idx_documents_drafts ON documents(tenant_id, type_id, status, is_current_draft)\\n  WHERE is_current_draft = 1;\\nCREATE INDEX IF NOT EXISTS idx_documents_parent ON documents(tenant_id, parent_root_id, sort_order, is_published);\\nCREATE INDEX IF NOT EXISTS idx_documents_path ON documents(tenant_id, path);\\nCREATE INDEX IF NOT EXISTS idx_documents_translation ON documents(translation_group_id, locale);\\nCREATE INDEX IF NOT EXISTS idx_documents_deleted ON documents(deleted_at);\\nCREATE INDEX IF NOT EXISTS idx_documents_scheduled ON documents(scheduled_at) WHERE scheduled_at IS NOT NULL;\\nCREATE INDEX IF NOT EXISTS idx_documents_expires ON documents(expires_at) WHERE expires_at IS NOT NULL;\\n\\n-- Stable keyset/cursor pagination for published lists\\nCREATE INDEX IF NOT EXISTS idx_documents_published_cursor\\n  ON documents(tenant_id, type_id, updated_at DESC, id DESC)\\n  WHERE is_published = 1 AND deleted_at IS NULL;\\n\\n-- (q_* generated-column filter indexes are auto-created at runtime — see note above.)\\n\\n-- Partial unique indexes: the hard concurrency guarantees for draft/publish invariants.\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_current_draft\\n  ON documents(root_id) WHERE is_current_draft = 1;\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_published\\n  ON documents(root_id) WHERE is_published = 1;\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_unique_version\\n  ON documents(root_id, version_number);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_unique_slug\\n  ON documents(tenant_id, locale, type_id, parent_root_id, slug)\\n  WHERE is_current_draft = 1 AND deleted_at IS NULL AND slug IS NOT NULL;\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_documents_one_translation_per_locale\\n  ON documents(tenant_id, translation_group_id, locale)\\n  WHERE is_current_draft = 1 AND translation_group_id <> '';\\n\\n-- Document references: typed document-to-document edges.\\nCREATE TABLE IF NOT EXISTS document_references (\\n  id TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL,\\n  from_root_id TEXT NOT NULL,\\n  from_document_id TEXT NOT NULL REFERENCES documents(id) ON DELETE CASCADE,\\n  field_name TEXT NOT NULL,\\n  ordinal INTEGER NOT NULL DEFAULT 0,\\n  to_root_id TEXT NOT NULL,\\n  ref_strength TEXT NOT NULL DEFAULT 'weak' CHECK (ref_strength IN ('strong', 'weak')),\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_docref_to   ON document_references(tenant_id, to_root_id);\\nCREATE INDEX IF NOT EXISTS idx_docref_from ON document_references(from_document_id);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_docref_unique\\n  ON document_references(from_document_id, field_name, ordinal);\\n\\n-- Document facets: indexed rows for multi-valued scalar fields (e.g. tags arrays).\\nCREATE TABLE IF NOT EXISTS document_facets (\\n  id TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL,\\n  document_id TEXT NOT NULL REFERENCES documents(id) ON DELETE CASCADE,\\n  root_id TEXT NOT NULL,\\n  type_id TEXT NOT NULL,\\n  field_name TEXT NOT NULL,\\n  ordinal INTEGER NOT NULL DEFAULT 0,\\n  value_text TEXT,\\n  value_number REAL,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch())\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_facets_lookup ON document_facets(tenant_id, type_id, field_name, value_text);\\nCREATE INDEX IF NOT EXISTS idx_facets_doc    ON document_facets(document_id);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_facets_unique\\n  ON document_facets(document_id, field_name, ordinal);\\n\\n-- Document permissions: per-document ACL overrides.\\nCREATE TABLE IF NOT EXISTS document_permissions (\\n  id TEXT PRIMARY KEY,\\n  tenant_id TEXT NOT NULL,\\n  root_id TEXT NOT NULL,\\n  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'role', 'group', 'public', 'token')),\\n  principal_id TEXT NOT NULL,\\n  permission TEXT NOT NULL CHECK (permission IN ('read', 'create', 'update', 'delete', 'publish', 'manage')),\\n  effect TEXT NOT NULL DEFAULT 'allow' CHECK (effect IN ('allow', 'deny')),\\n  inherited INTEGER NOT NULL DEFAULT 0,\\n  created_at INTEGER NOT NULL DEFAULT (unixepoch()),\\n  created_by TEXT\\n);\\n\\nCREATE INDEX IF NOT EXISTS idx_document_permissions_root ON document_permissions(tenant_id, root_id);\\nCREATE INDEX IF NOT EXISTS idx_document_permissions_principal\\n  ON document_permissions(tenant_id, principal_type, principal_id, permission);\\nCREATE UNIQUE INDEX IF NOT EXISTS idx_document_permissions_unique\\n  ON document_permissions(root_id, principal_type, principal_id, permission);\\n\"\n  }\n]\n\n// Map for quick lookup by ID\nexport const migrationsByIdMap = new Map<string, BundledMigration>(\n  bundledMigrations.map(m => [m.id, m])\n)\n\n// Get migration SQL by ID\nexport function getMigrationSQLById(id: string): string | null {\n  return migrationsByIdMap.get(id)?.sql ?? null\n}\n\n// Get all migration info (without SQL for lighter payloads)\nexport function getMigrationList(): Array<Omit<BundledMigration, 'sql'>> {\n  return bundledMigrations.map(({ sql, ...rest }) => rest)\n}\n","import { D1Database } from '@cloudflare/workers-types'\nimport type { QueryableField } from '../schemas/document'\n\n// Identifiers and JSON paths are interpolated into DDL (they cannot be bound), so\n// they are format-guarded here. Source is trusted code config, not user input —\n// this is defense-in-depth, mirroring document-repository.ts.\nconst SAFE_IDENTIFIER = /^[a-z_][a-z0-9_]*$/\n\n/** Map a queryable field's logical type to a SQLite column affinity. */\nfunction affinity(type?: QueryableField['type']): 'TEXT' | 'INTEGER' | 'REAL' {\n  if (type === 'number') return 'REAL'\n  if (type === 'integer' || type === 'boolean' || type === 'date') return 'INTEGER'\n  return 'TEXT'\n}\n\nconst slug = (s: string) => s.toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '')\n\n/**\n * Authoritative generated-column name for a scalar field. An explicit `column`\n * always wins (back-compat with every existing type definition); otherwise it is\n * derived deterministically from the type id + field name. The repository reads\n * the same `column`/derivation when building filter SQL, so the two never drift.\n */\nexport function resolveColumn(typeId: string, f: QueryableField): string {\n  if (f.column) return f.column\n  const name = `q_${slug(typeId)}_${slug(f.name)}`\n  return name.length <= 60 ? name : `q_${slug(typeId).slice(0, 20)}_${slug(f.name).slice(0, 20)}`\n}\n\n/**\n * Idempotently ensure the `documents` table has a VIRTUAL generated column and a\n * filter/sort index for each of a type's scalar queryable fields. Safe to call on\n * every registration and every bootstrap: existing columns/indexes are skipped,\n * and a concurrent add surfaces as a swallowed \"duplicate column name\".\n *\n * Facet and reference fields need no DDL (generic document_facets /\n * document_references tables), so they are ignored here.\n *\n * Returns the columns it actually created (empty when all already existed).\n */\nexport async function ensureScalarSchema(\n  db: D1Database,\n  typeId: string,\n  fields: QueryableField[],\n): Promise<string[]> {\n  const scalars = fields.filter((f) => f.kind === 'scalar')\n  if (scalars.length === 0) return []\n\n  // pragma_table_info does NOT list VIRTUAL generated columns — use table_xinfo, which does.\n  let existing = new Set<string>()\n  try {\n    const info = await db.prepare(\"SELECT name FROM pragma_table_xinfo('documents')\").all()\n    existing = new Set((info?.results ?? []).map((r: any) => r.name))\n  } catch {\n    // table_xinfo unavailable — fall back to attempting every ALTER (duplicate errors swallowed).\n  }\n\n  const added: string[] = []\n  for (const f of scalars) {\n    const col = resolveColumn(typeId, f)\n    if (!SAFE_IDENTIFIER.test(col)) {\n      console.error(`[scalar-schema] unsafe column name '${col}' for ${typeId}.${f.name} — skipped`)\n      continue\n    }\n    const path = f.path ?? `$.${f.name}`\n    if (path.includes(\"'\")) {\n      console.error(`[scalar-schema] unsafe json path for ${col} (${typeId}.${f.name}) — skipped`)\n      continue\n    }\n\n    if (!existing.has(col)) {\n      try {\n        await db\n          .prepare(`ALTER TABLE documents ADD COLUMN ${col} ${affinity(f.type)} AS (json_extract(data, '${path}')) VIRTUAL`)\n          .run()\n        added.push(col)\n        console.log(`[scalar-schema] added documents.${col} for type '${typeId}'`)\n      } catch (error) {\n        const msg = error instanceof Error ? error.message : String(error)\n        if (!msg.includes('duplicate column name')) {\n          console.error(`[scalar-schema] failed to add documents.${col}:`, msg)\n          continue\n        }\n      }\n    }\n\n    // One general index per column: the leading (tenant_id, type_id, col) prefix\n    // serves every equality filter the repository builds; the trailing\n    // (updated_at DESC, id DESC) matches the default keyset sort/cursor. Non-partial\n    // so a single index covers both draft and published lists.\n    try {\n      await db\n        .prepare(`CREATE INDEX IF NOT EXISTS idx_${col} ON documents(tenant_id, type_id, ${col}, updated_at DESC, id DESC)`)\n        .run()\n    } catch (error) {\n      console.error(`[scalar-schema] failed to create idx_${col}:`, error instanceof Error ? error.message : String(error))\n    }\n  }\n  return added\n}\n","import { D1Database } from '@cloudflare/workers-types'\nimport { bundledMigrations } from '../db/migrations-bundle'\nimport { ensureScalarSchema } from './document-scalar-schema'\nimport type { QueryableField } from '../schemas/document'\n\nexport interface Migration {\n  id: string\n  name: string\n  filename: string\n  description?: string\n  applied: boolean\n  appliedAt?: string\n  size?: number\n}\n\nexport interface MigrationStatus {\n  totalMigrations: number\n  appliedMigrations: number\n  pendingMigrations: number\n  lastApplied?: string\n  migrations: Migration[]\n}\n\nexport class MigrationService {\n  constructor(private db: D1Database) {}\n\n  /**\n   * Cloudflare D1 owns migration bookkeeping through `d1_migrations`.\n   * SonicJS intentionally does not create its own tracking table.\n   */\n  async initializeMigrationsTable(): Promise<void> {\n    // Kept as a no-op for compatibility with older callers.\n  }\n\n  /**\n   * Get all available migrations from the bundled migrations\n   */\n  async getAvailableMigrations(): Promise<Migration[]> {\n    const migrations: Migration[] = []\n    const appliedMigrations = await this.getD1AppliedMigrations()\n    await this.ensureSchemaCompatibility()\n\n    // Use bundled migrations as the source of truth\n    for (const bundled of bundledMigrations) {\n      const applied = appliedMigrations.has(bundled.id)\n      const appliedData = appliedMigrations.get(bundled.id)\n\n      migrations.push({\n        id: bundled.id,\n        name: bundled.name,\n        filename: bundled.filename,\n        description: bundled.description,\n        applied,\n        appliedAt: applied ? appliedData?.applied_at : undefined,\n        size: bundled.sql.length\n      })\n    }\n\n    return migrations\n  }\n\n  /**\n   * Read Wrangler/D1's canonical migration table. If the table is absent, no\n   * migrations have been applied by the supported migration runner yet.\n   */\n  private async getD1AppliedMigrations(): Promise<Map<string, any>> {\n    try {\n      const appliedResult = await this.db.prepare(\n        'SELECT name, applied_at FROM d1_migrations ORDER BY applied_at ASC'\n      ).all()\n\n      return new Map(\n        (appliedResult.results ?? [])\n          .map((row: any) => {\n            const filename = String(row.name ?? '')\n            const id = filename.match(/^(\\d+)/)?.[1]\n            if (!id) return null\n            return [id, {\n              id,\n              name: filename,\n              filename,\n              applied_at: row.applied_at\n            }]\n          })\n          .filter((entry): entry is [string, any] => entry !== null)\n      )\n    } catch (error) {\n      return new Map()\n    }\n  }\n\n  /**\n   * Run idempotent compatibility repairs that are safe outside migration state.\n   */\n  async ensureSchemaCompatibility(): Promise<void> {\n    if (await this.checkTablesExist(['documents'])) {\n      await this.ensureDocumentGeneratedColumns()\n    }\n  }\n\n  /**\n   * Ensure the `documents` table exposes every queryable VIRTUAL generated column + index (D45).\n   * Data-driven repair: reconciles from each active type's `queryable_fields` rather than a hardcoded\n   * list, so it stays in sync with whatever types are registered. Generation of these columns is owned\n   * by DocumentTypeRegistry.register() (via ensureScalarSchema); this pass is a bootstrap safety net for\n   * a DB that has document_types rows but lost columns (e.g. table rebuilt). Idempotent.\n   */\n  private async ensureDocumentGeneratedColumns(): Promise<void> {\n    if (!(await this.checkTablesExist(['document_types']))) return\n    const rows = await this.db\n      .prepare('SELECT id, queryable_fields FROM document_types WHERE is_active = 1')\n      .all<{ id: string; queryable_fields: string }>()\n    for (const row of rows.results ?? []) {\n      let fields: QueryableField[]\n      try {\n        fields = JSON.parse(row.queryable_fields)\n      } catch {\n        continue\n      }\n      await ensureScalarSchema(this.db, row.id, fields)\n    }\n  }\n\n  /**\n   * Check if specific tables exist in the database\n   */\n  private async checkTablesExist(tableNames: string[]): Promise<boolean> {\n    try {\n      for (const tableName of tableNames) {\n        const result = await this.db.prepare(\n          `SELECT name FROM sqlite_master WHERE type='table' AND name=?`\n        ).bind(tableName).first()\n\n        if (!result) {\n          return false\n        }\n      }\n      return true\n    } catch (error) {\n      return false\n    }\n  }\n\n  /**\n   * Check if a specific column exists in a table\n   */\n  private async checkColumnExists(tableName: string, columnName: string): Promise<boolean> {\n    try {\n      const result = await this.db.prepare(\n        `SELECT * FROM pragma_table_info(?) WHERE name = ?`\n      ).bind(tableName, columnName).first()\n\n      return !!result\n    } catch (error) {\n      return false\n    }\n  }\n\n  /**\n   * Get migration status summary\n   */\n  async getMigrationStatus(): Promise<MigrationStatus> {\n    const migrations = await this.getAvailableMigrations()\n    const appliedMigrations = migrations.filter(m => m.applied)\n    const pendingMigrations = migrations.filter(m => !m.applied)\n\n    const lastApplied = appliedMigrations.length > 0\n      ? appliedMigrations[appliedMigrations.length - 1]?.appliedAt\n      : undefined\n\n    return {\n      totalMigrations: migrations.length,\n      appliedMigrations: appliedMigrations.length,\n      pendingMigrations: pendingMigrations.length,\n      lastApplied,\n      migrations\n    }\n  }\n\n  /**\n   * D1 migration state is managed by Wrangler.\n   */\n  async markMigrationApplied(migrationId: string, name: string, filename: string): Promise<void> {\n    void migrationId\n    void name\n    void filename\n  }\n\n  /**\n   * D1 migration state is managed by Wrangler.\n   */\n  async removeMigrationApplied(migrationId: string): Promise<void> {\n    void migrationId\n  }\n\n  /**\n   * Check if a specific migration has been applied\n   */\n  async isMigrationApplied(migrationId: string): Promise<boolean> {\n    const appliedMigrations = await this.getD1AppliedMigrations()\n    return appliedMigrations.has(migrationId)\n  }\n\n  /**\n   * Get the last applied migration\n   */\n  async getLastAppliedMigration(): Promise<Migration | null> {\n    const migrations = await this.getAvailableMigrations()\n    return migrations.filter(m => m.applied).at(-1) ?? null\n  }\n\n  /**\n   * Run pending migrations\n   */\n  async runPendingMigrations(): Promise<{ success: boolean; message: string; applied: string[]; errors: string[] }> {\n    return {\n      success: false,\n      message: 'Migrations are managed by Cloudflare D1. Run `wrangler d1 migrations apply DB --local` or `wrangler d1 migrations apply DB --remote`.',\n      applied: [],\n      errors: []\n    }\n  }\n\n  /**\n   * Validate database schema\n   */\n  async validateSchema(): Promise<{ valid: boolean; issues: string[] }> {\n    const issues: string[] = []\n\n    // Basic table existence checks\n    const requiredTables = [\n      'users', 'documents', 'document_types'\n    ]\n\n    for (const table of requiredTables) {\n      try {\n        await this.db.prepare(`SELECT COUNT(*) FROM ${table} LIMIT 1`).first()\n      } catch (error) {\n        issues.push(`Missing table: ${table}`)\n      }\n    }\n\n    return {\n      valid: issues.length === 0,\n      issues\n    }\n  }\n}\n"]}

package/dist/chunk-IVPRUGTY.js

@@ -0,0 +1,242 @@
+import { isFirstUserRegistration, isRegistrationEnabled } from './chunk-IESEVHXL.js';
+import { authTenantTeam, authTenantInvitation, authTenantMember, authTenant, authVerification, authAccount, authSession, authUser } from './chunk-AI663NBO.js';
+import { betterAuth } from 'better-auth';
+import { withCloudflare } from 'better-auth-cloudflare';
+import { hashPassword, verifyPassword } from 'better-auth/crypto';
+import { APIError } from 'better-auth/api';
+import { magicLink } from 'better-auth/plugins/magic-link';
+import { emailOTP } from 'better-auth/plugins/email-otp';
+import { organization } from 'better-auth/plugins/organization';
+import { drizzle } from 'drizzle-orm/d1';
+
+async function sendViaEmailPlugin(db, to, subject, html) {
+  try {
+    const row = await db.prepare("SELECT settings FROM plugins WHERE id = 'email'").first();
+    if (row?.settings) {
+      const { apiKey, fromEmail, fromName } = JSON.parse(row.settings);
+      if (apiKey && fromEmail) {
+        await fetch("https://api.resend.com/emails", {
+          method: "POST",
+          headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+          body: JSON.stringify({
+            from: `${fromName ?? "SonicJS"} <${fromEmail}>`,
+            to: [to],
+            subject,
+            html
+          })
+        });
+        return;
+      }
+    }
+  } catch {
+  }
+  console.log(`[email-dev] To:${to} | Subject:${subject}`);
+}
+async function verifyLegacyPbkdf2(password, stored) {
+  const parts = stored.split(":");
+  if (parts.length !== 4) return false;
+  const iterations = parseInt(parts[1], 10);
+  const saltBytes = parts[2].match(/.{2}/g);
+  if (!saltBytes || !Number.isFinite(iterations)) return false;
+  const salt = new Uint8Array(saltBytes.map((b) => parseInt(b, 16)));
+  const km = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits({ name: "PBKDF2", salt, iterations, hash: "SHA-256" }, km, 256);
+  const actual = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  const expected = parts[3];
+  if (actual.length !== expected.length) return false;
+  let diff = 0;
+  for (let i = 0; i < actual.length; i++) diff |= actual.charCodeAt(i) ^ expected.charCodeAt(i);
+  return diff === 0;
+}
+function getDefaultAuthOptions(env, requestBaseURL) {
+  const db = drizzle(env.DB);
+  return {
+    secret: env.BETTER_AUTH_SECRET,
+    baseURL: env.BETTER_AUTH_URL || requestBaseURL,
+    appName: "SonicJS",
+    ...withCloudflare(
+      {
+        autoDetectIpAddress: true,
+        geolocationTracking: false,
+        cf: {},
+        d1: {
+          db,
+          options: {
+            // Keys MUST match modelName values — BA resolves by modelName, not by JS variable name.
+            schema: { auth_user: authUser, auth_session: authSession, auth_account: authAccount, auth_verification: authVerification, auth_tenant: authTenant, auth_tenant_member: authTenantMember, auth_tenant_invitation: authTenantInvitation, auth_tenant_team: authTenantTeam }
+          }
+        },
+        kv: env.CACHE_KV
+        // session secondary storage → getSession skips D1
+      },
+      {
+        basePath: "/auth",
+        emailAndPassword: {
+          enabled: true,
+          autoSignIn: true,
+          // Transparent migration of SonicJS legacy PBKDF2 hashes: verify against
+          // the old format on login, then re-hash to scrypt and persist. No
+          // mass-rehash, no forced password resets.
+          password: {
+            verify: async ({ hash, password }) => {
+              if (hash.startsWith("pbkdf2:")) {
+                const ok = await verifyLegacyPbkdf2(password, hash);
+                if (ok) {
+                  const upgraded = await hashPassword(password);
+                  await env.DB.prepare(
+                    "UPDATE auth_account SET password = ?, updated_at = ? WHERE password = ? AND provider_id = 'credential'"
+                  ).bind(upgraded, Math.floor(Date.now() / 1e3), hash).run();
+                }
+                return ok;
+              }
+              return verifyPassword({ hash, password });
+            }
+          }
+        },
+        user: {
+          modelName: "auth_user",
+          // Field-mapping values are Drizzle *property keys* (camelCase), which
+          // already match Better Auth's defaults for emailVerified/createdAt/
+          // updatedAt. Only `image` differs (SonicJS uses `avatar`).
+          fields: {
+            image: "avatar"
+          },
+          additionalFields: {
+            role: { type: "string", required: false, defaultValue: "viewer", input: false },
+            firstName: { type: "string", required: false, defaultValue: "", input: true },
+            lastName: { type: "string", required: false, defaultValue: "", input: true },
+            isSuperAdmin: { type: "boolean", required: false, defaultValue: false, input: false }
+          }
+        },
+        session: {
+          modelName: "auth_session",
+          // Drizzle property keys already match Better Auth defaults (userId,
+          // expiresAt, ipAddress, …) — no field overrides needed.
+          expiresIn: 60 * 60 * 24 * 7,
+          // 7 days
+          updateAge: 60 * 60 * 24
+          // refresh once per day
+        },
+        account: { modelName: "auth_account" },
+        verification: { modelName: "auth_verification" },
+        databaseHooks: {
+          user: {
+            create: {
+              before: async (userData) => {
+                const isFirst = await isFirstUserRegistration(env.DB);
+                if (!isFirst) {
+                  const enabled = await isRegistrationEnabled(env.DB);
+                  if (!enabled) {
+                    throw new APIError("BAD_REQUEST", { message: "Registration is currently disabled." });
+                  }
+                }
+                const d = userData;
+                const name = (d.name ?? "User").toString();
+                const parts = name.trim().split(/\s+/);
+                const firstName = d.firstName || parts[0] || "User";
+                const lastName = d.lastName || parts.slice(1).join(" ") || firstName;
+                return { data: { ...userData, name, firstName, lastName, role: "viewer" } };
+              },
+              after: async (user) => {
+                try {
+                  const { RbacService } = await import('./rbac-O73MFKDA.js');
+                  const rbac = new RbacService(env.DB);
+                  const roleName = await rbac.countPortalAdmins(user.id) === 0 ? "admin" : "viewer";
+                  await rbac.addUserRoleByName(user.id, roleName);
+                } catch {
+                }
+              }
+            }
+          }
+        }
+      }
+    ),
+    // ── Phase 4: BA-native login methods ─────────────────────────────────────
+    // Magic-link and Email-OTP replace the standalone SonicJS plugins that
+    // minted JWT cookies. Social providers replace the bespoke oauth-providers
+    // plugin. All are gated on the relevant env vars / email service config
+    // so they activate only when configured.
+    plugins: [
+      // Magic-link passwordless auth. Sends a one-time link to the user's inbox;
+      // the link resolves to a BA session. Requires a working email service.
+      magicLink({
+        sendMagicLink: async ({ email, url }, _request) => {
+          await sendViaEmailPlugin(
+            env.DB,
+            email,
+            "Your sign-in link",
+            `<div style="font-family:sans-serif;max-width:600px">
+              <h2>Sign in to SonicJS</h2>
+              <p>Click the link below to sign in. Expires in 15 minutes.</p>
+              <p><a href="${url}" style="background:#465FFF;color:#fff;padding:12px 24px;border-radius:6px;text-decoration:none">Sign in</a></p>
+              <p style="color:#666;font-size:12px">Or copy: ${url}</p>
+            </div>`
+          );
+        },
+        expiresIn: 15 * 60
+      }),
+      // Email OTP — 6-digit code sent to inbox. Replaces the otp-login-plugin.
+      emailOTP({
+        sendVerificationOTP: async (params, _request) => {
+          await sendViaEmailPlugin(
+            env.DB,
+            params.email,
+            "Your sign-in code",
+            `<div style="font-family:sans-serif;max-width:600px">
+              <h2>Your one-time code</h2>
+              <p style="font-size:36px;font-weight:bold;letter-spacing:8px;color:#465FFF">${params.otp}</p>
+              <p style="color:#666">Expires in 10 minutes. Do not share this code.</p>
+            </div>`
+          );
+        },
+        otpLength: 6,
+        expiresIn: 10 * 60
+      }),
+      organization({
+        schema: {
+          organization: {
+            modelName: "auth_tenant",
+            additionalFields: {
+              status: { type: "string", required: false, defaultValue: "active", input: true },
+              domain: { type: "string", required: false, input: true },
+              notes: { type: "string", required: false, defaultValue: "", input: true }
+            }
+          },
+          member: {
+            modelName: "auth_tenant_member",
+            fields: { organizationId: "tenant_id" }
+          },
+          invitation: {
+            modelName: "auth_tenant_invitation",
+            fields: { organizationId: "tenant_id" }
+          },
+          team: {
+            modelName: "auth_tenant_team",
+            fields: { organizationId: "tenant_id" }
+          }
+        }
+      })
+    ],
+    // ── Phase 4: Social providers ─────────────────────────────────────────
+    // Activated when the relevant env vars are set. Replaces the bespoke
+    // oauth-providers SonicJS plugin. Set via wrangler secret put / .dev.vars.
+    socialProviders: {
+      ...env.GITHUB_CLIENT_ID && env.GITHUB_CLIENT_SECRET ? { github: { clientId: env.GITHUB_CLIENT_ID, clientSecret: env.GITHUB_CLIENT_SECRET } } : {},
+      ...env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET ? { google: { clientId: env.GOOGLE_CLIENT_ID, clientSecret: env.GOOGLE_CLIENT_SECRET } } : {}
+    }
+  };
+}
+function createAuth(env, extendBetterAuth, requestBaseURL) {
+  if (!env.BETTER_AUTH_SECRET || env.BETTER_AUTH_SECRET.length < 16) {
+    throw new Error(
+      "BETTER_AUTH_SECRET is missing or too short. Set it as a Wrangler secret (wrangler secret put BETTER_AUTH_SECRET) or in a gitignored .dev.vars for local dev. Refusing to initialize auth without a strong signing secret."
+    );
+  }
+  const defaults = getDefaultAuthOptions(env, requestBaseURL);
+  const options = extendBetterAuth ? extendBetterAuth(defaults) : defaults;
+  return betterAuth(options);
+}
+
+export { createAuth, getDefaultAuthOptions };
+//# sourceMappingURL=chunk-IVPRUGTY.js.map
+//# sourceMappingURL=chunk-IVPRUGTY.js.map