@sonicjs-cms/core 2.19.0 → 3.0.0-beta.11

package/dist/chunk-2CB4KY7I.cjs

@@ -0,0 +1,771 @@
+'use strict';
+
+var chunkJEQ7FLOD_cjs = require('./chunk-JEQ7FLOD.cjs');
+
+// src/services/documents.ts
+var DEFAULT_MAX_VERSIONS = 50;
+function documentSecondsToMs(ts) {
+  return ts == null ? null : ts * 1e3;
+}
+function rowToDocument(row) {
+  return {
+    id: row.id,
+    rootId: row.root_id,
+    typeId: row.type_id,
+    typeVersion: row.type_version,
+    versionOfId: row.version_of_id,
+    versionNumber: row.version_number,
+    isCurrentDraft: row.is_current_draft === 1,
+    isPublished: row.is_published === 1,
+    status: row.status,
+    parentRootId: row.parent_root_id,
+    slug: row.slug,
+    path: row.path,
+    title: row.title,
+    zone: row.zone,
+    sortOrder: row.sort_order,
+    visible: row.visible === 1,
+    publishedAt: row.published_at,
+    scheduledAt: row.scheduled_at,
+    expiresAt: row.expires_at,
+    deletedAt: row.deleted_at,
+    tenantId: row.tenant_id,
+    locale: row.locale,
+    translationGroupId: row.translation_group_id,
+    data: JSON.parse(row.data),
+    metadata: JSON.parse(row.metadata),
+    ownerId: row.owner_id,
+    createdBy: row.created_by,
+    updatedBy: row.updated_by,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+var DocumentsService = class {
+  constructor(db, opts = {}) {
+    this.db = db;
+    this.opts = opts;
+    this.projection = new chunkJEQ7FLOD_cjs.DocumentProjection(db);
+    this.tenantId = opts.tenantId ?? "default";
+    this.versioning = opts.versioning ?? false;
+  }
+  projection;
+  tenantId;
+  versioning;
+  // ─── Create ───────────────────────────────────────────────────────────────
+  async create(input, createdBy) {
+    const now = Math.floor(Date.now() / 1e3);
+    const id = chunkJEQ7FLOD_cjs.nanoid();
+    const publish = input.publishOnCreate ?? false;
+    const createdAt = input.createdAt ?? now;
+    const updatedAt = input.updatedAt ?? now;
+    const doc = {
+      id,
+      rootId: id,
+      typeId: input.typeId,
+      typeVersion: this.opts.typeSchemaVersion ?? 1,
+      versionOfId: null,
+      versionNumber: 1,
+      isCurrentDraft: true,
+      isPublished: publish,
+      status: publish ? "published" : "draft",
+      parentRootId: input.parentRootId ?? "",
+      slug: input.slug ?? null,
+      path: null,
+      title: input.title ?? null,
+      zone: input.zone ?? null,
+      sortOrder: input.sortOrder ?? 0,
+      visible: input.visible ?? true,
+      publishedAt: publish ? createdAt : null,
+      scheduledAt: input.scheduledAt ?? null,
+      expiresAt: input.expiresAt ?? null,
+      deletedAt: null,
+      // Tenant comes from the service scope unless the caller passes one explicitly. Never trust a
+      // request-body tenant: route handlers must override with the resolved request-context tenant.
+      tenantId: input.tenantId ?? this.tenantId,
+      locale: input.locale ?? "default",
+      translationGroupId: "",
+      data: input.data ?? {},
+      metadata: input.metadata ?? {},
+      ownerId: input.ownerId ?? null,
+      createdBy: createdBy ?? null,
+      updatedBy: createdBy ?? null,
+      createdAt,
+      updatedAt
+    };
+    const insertDoc = this.db.prepare(
+      `INSERT INTO documents (id, root_id, type_id, type_version, version_of_id, version_number,
+         is_current_draft, is_published, status, parent_root_id, slug, path, title, zone,
+         sort_order, visible, published_at, scheduled_at, expires_at, deleted_at,
+         tenant_id, locale, translation_group_id, data, metadata,
+         owner_id, created_by, updated_by, created_at, updated_at)
+       VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`
+    ).bind(
+      doc.id,
+      doc.rootId,
+      doc.typeId,
+      doc.typeVersion,
+      null,
+      1,
+      1,
+      publish ? 1 : 0,
+      doc.status,
+      doc.parentRootId,
+      doc.slug,
+      null,
+      doc.title,
+      doc.zone,
+      doc.sortOrder,
+      doc.visible ? 1 : 0,
+      doc.publishedAt,
+      doc.scheduledAt,
+      doc.expiresAt,
+      null,
+      doc.tenantId,
+      doc.locale,
+      "",
+      JSON.stringify(doc.data),
+      JSON.stringify(doc.metadata),
+      doc.ownerId,
+      doc.createdBy,
+      doc.updatedBy,
+      createdAt,
+      updatedAt
+    );
+    const derivedInserts = this.projection.buildDerivedInsertStatements(doc, this.opts.queryableFields ?? [], now);
+    await this.db.batch([insertDoc, ...derivedInserts]);
+    return doc;
+  }
+  // ─── Save new draft ───────────────────────────────────────────────────────
+  // Atomically: demote previous draft → delete its derived rows (if not published) →
+  // insert new draft → materialize derived rows → prune excess versions.
+  async saveDraft(rootId, input, updatedBy) {
+    const now = Math.floor(Date.now() / 1e3);
+    const newId = chunkJEQ7FLOD_cjs.nanoid();
+    const prevDraftRow = await this.db.prepare("SELECT * FROM documents WHERE root_id = ? AND tenant_id = ? AND is_current_draft = 1").bind(rootId, this.tenantId).first();
+    if (!prevDraftRow) throw new Error(`No current draft found for root ${rootId}`);
+    const prevDraft = rowToDocument(prevDraftRow);
+    const mergedData = { ...prevDraft.data, ...input.data ?? {} };
+    const mergedMeta = { ...prevDraft.metadata, ...input.metadata ?? {} };
+    const newDoc = {
+      ...prevDraft,
+      id: newId,
+      rootId,
+      typeVersion: this.opts.typeSchemaVersion ?? prevDraft.typeVersion,
+      versionOfId: prevDraft.id,
+      versionNumber: 0,
+      // computed by SQL below
+      isCurrentDraft: true,
+      isPublished: false,
+      status: "draft",
+      slug: input.slug !== void 0 ? input.slug ?? null : prevDraft.slug,
+      title: input.title !== void 0 ? input.title ?? null : prevDraft.title,
+      zone: input.zone !== void 0 ? input.zone ?? null : prevDraft.zone,
+      sortOrder: input.sortOrder ?? prevDraft.sortOrder,
+      visible: input.visible ?? prevDraft.visible,
+      scheduledAt: input.scheduledAt !== void 0 ? input.scheduledAt : prevDraft.scheduledAt,
+      expiresAt: input.expiresAt !== void 0 ? input.expiresAt : prevDraft.expiresAt,
+      data: mergedData,
+      metadata: mergedMeta,
+      updatedBy: updatedBy ?? prevDraft.updatedBy,
+      updatedAt: now,
+      createdAt: now
+    };
+    const prevIsPublished = prevDraftRow.is_published === 1;
+    if (!this.versioning && !prevIsPublished) {
+      return this.updateInPlace(prevDraft, input, now, updatedBy);
+    }
+    const statements = [
+      // 1. Demote previous current draft FIRST (unique index: never two current drafts mid-batch).
+      this.db.prepare("UPDATE documents SET is_current_draft = 0, updated_at = ? WHERE id = ? AND tenant_id = ?").bind(now, prevDraft.id, this.tenantId),
+      // 2. If the previous draft was not also the published row, delete its derived rows.
+      ...!prevIsPublished ? this.projection.buildDerivedDeleteStatements(prevDraft.id) : [],
+      // 3. Insert new draft. version_number derived in SQL (COALESCE(MAX)+1 from existing rows).
+      // R5 arithmetic — keep balanced: 30 columns = 5 leading '?' + 1 version_number subquery
+      //   + 3 literals (1,0,'draft') + 21 trailing '?'. Total placeholders: 5 + 1 (subquery
+      //   root_id) + 21 = 27, which MUST equal the 27 .bind() args below. Do not change one side
+      //   without recounting the other.
+      this.db.prepare(
+        `INSERT INTO documents (id, root_id, type_id, type_version, version_of_id, version_number,
+           is_current_draft, is_published, status, parent_root_id, slug, path, title, zone,
+           sort_order, visible, published_at, scheduled_at, expires_at, deleted_at,
+           tenant_id, locale, translation_group_id, data, metadata,
+           owner_id, created_by, updated_by, created_at, updated_at)
+         SELECT ?,?,?,?,?,
+           (SELECT COALESCE(MAX(version_number), 0) + 1 FROM documents WHERE root_id = ?),
+           1,0,'draft',?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?
+         WHERE 1=1`
+      ).bind(
+        newId,
+        rootId,
+        newDoc.typeId,
+        newDoc.typeVersion,
+        prevDraft.id,
+        rootId,
+        newDoc.parentRootId,
+        newDoc.slug,
+        null,
+        newDoc.title,
+        newDoc.zone,
+        newDoc.sortOrder,
+        newDoc.visible ? 1 : 0,
+        null,
+        newDoc.scheduledAt,
+        newDoc.expiresAt,
+        null,
+        newDoc.tenantId,
+        newDoc.locale,
+        newDoc.translationGroupId,
+        JSON.stringify(newDoc.data),
+        JSON.stringify(newDoc.metadata),
+        newDoc.ownerId,
+        newDoc.createdBy,
+        newDoc.updatedBy,
+        now,
+        now
+      ),
+      // 4. Materialize derived rows for new draft.
+      ...this.projection.buildDerivedInsertStatements(newDoc, this.opts.queryableFields ?? [], now)
+    ];
+    const maxVersions = this.opts.maxVersionsPerRoot ?? DEFAULT_MAX_VERSIONS;
+    statements.push(
+      this.db.prepare(
+        `DELETE FROM documents WHERE root_id = ? AND tenant_id = ? AND is_current_draft = 0 AND is_published = 0
+         AND id NOT IN (
+           SELECT id FROM documents WHERE root_id = ? AND tenant_id = ? AND is_current_draft = 0 AND is_published = 0
+           ORDER BY version_number DESC LIMIT ?
+         )
+         AND id NOT IN (SELECT version_of_id FROM documents WHERE version_of_id IS NOT NULL AND root_id = ? AND tenant_id = ?)`
+      ).bind(rootId, this.tenantId, rootId, this.tenantId, maxVersions, rootId, this.tenantId)
+    );
+    await this.db.batch(statements);
+    const saved = await this.db.prepare("SELECT * FROM documents WHERE id = ?").bind(newId).first();
+    return rowToDocument(saved);
+  }
+  // In-place draft update (versioning off). Mutates the existing draft row; preserves id/root_id/
+  // version_number/version_of_id and the is_current_draft/is_published flags. Rebuilds derived rows.
+  async updateInPlace(prevDraft, input, now, updatedBy) {
+    const mergedData = { ...prevDraft.data, ...input.data ?? {} };
+    const mergedMeta = { ...prevDraft.metadata, ...input.metadata ?? {} };
+    const updated = {
+      ...prevDraft,
+      slug: input.slug !== void 0 ? input.slug ?? null : prevDraft.slug,
+      title: input.title !== void 0 ? input.title ?? null : prevDraft.title,
+      zone: input.zone !== void 0 ? input.zone ?? null : prevDraft.zone,
+      sortOrder: input.sortOrder ?? prevDraft.sortOrder,
+      visible: input.visible ?? prevDraft.visible,
+      scheduledAt: input.scheduledAt !== void 0 ? input.scheduledAt : prevDraft.scheduledAt,
+      expiresAt: input.expiresAt !== void 0 ? input.expiresAt : prevDraft.expiresAt,
+      data: mergedData,
+      metadata: mergedMeta,
+      updatedBy: updatedBy ?? prevDraft.updatedBy,
+      updatedAt: now
+    };
+    const statements = [
+      // R5: 11 SET '?' + 2 WHERE '?' (id, tenant_id) = 13 binds, matching .bind() below.
+      this.db.prepare(
+        `UPDATE documents SET
+           slug = ?, title = ?, zone = ?, sort_order = ?, visible = ?,
+           scheduled_at = ?, expires_at = ?, data = ?, metadata = ?, updated_by = ?, updated_at = ?
+         WHERE id = ? AND tenant_id = ?`
+      ).bind(
+        updated.slug,
+        updated.title,
+        updated.zone,
+        updated.sortOrder,
+        updated.visible ? 1 : 0,
+        updated.scheduledAt,
+        updated.expiresAt,
+        JSON.stringify(updated.data),
+        JSON.stringify(updated.metadata),
+        updated.updatedBy,
+        now,
+        updated.id,
+        this.tenantId
+      ),
+      // R7: derived rows track the new data — delete then reinsert for this row.
+      ...this.projection.buildDerivedDeleteStatements(updated.id),
+      ...this.projection.buildDerivedInsertStatements(updated, this.opts.queryableFields ?? [], now)
+    ];
+    await this.db.batch(statements);
+    const saved = await this.db.prepare("SELECT * FROM documents WHERE id = ?").bind(updated.id).first();
+    return rowToDocument(saved);
+  }
+  // ─── Publish ──────────────────────────────────────────────────────────────
+  async publish(documentId, publishedBy) {
+    const now = Math.floor(Date.now() / 1e3);
+    const targetRow = await this.db.prepare("SELECT * FROM documents WHERE id = ? AND tenant_id = ?").bind(documentId, this.tenantId).first();
+    if (!targetRow) throw new Error(`Document ${documentId} not found`);
+    const prevPublishedRow = await this.db.prepare("SELECT * FROM documents WHERE root_id = ? AND tenant_id = ? AND is_published = 1 AND id != ?").bind(targetRow.root_id, this.tenantId, documentId).first();
+    const statements = [];
+    if (prevPublishedRow) {
+      if (!this.versioning && prevPublishedRow.is_current_draft !== 1) {
+        statements.push(this.db.prepare("UPDATE documents SET version_of_id = NULL WHERE version_of_id = ? AND tenant_id = ?").bind(prevPublishedRow.id, this.tenantId));
+        statements.push(...this.projection.buildDerivedDeleteStatements(prevPublishedRow.id));
+        statements.push(this.db.prepare("DELETE FROM documents WHERE id = ? AND tenant_id = ?").bind(prevPublishedRow.id, this.tenantId));
+      } else {
+        statements.push(
+          this.db.prepare("UPDATE documents SET is_published = 0, updated_at = ? WHERE id = ?").bind(now, prevPublishedRow.id)
+        );
+        if (prevPublishedRow.is_current_draft !== 1) {
+          statements.push(...this.projection.buildDerivedDeleteStatements(prevPublishedRow.id));
+        }
+      }
+    }
+    statements.push(
+      this.db.prepare(
+        `UPDATE documents SET is_published = 1, status = 'published', published_at = ?, updated_at = ?, updated_by = ? WHERE id = ?`
+      ).bind(now, now, publishedBy ?? null, documentId)
+    );
+    if (targetRow.is_current_draft !== 1) {
+      const targetDoc = rowToDocument(targetRow);
+      statements.push(...this.projection.buildDerivedInsertStatements(targetDoc, this.opts.queryableFields ?? [], now));
+    }
+    await this.db.batch(statements);
+    const saved = await this.db.prepare("SELECT * FROM documents WHERE id = ?").bind(documentId).first();
+    return rowToDocument(saved);
+  }
+  // ─── Unpublish ────────────────────────────────────────────────────────────
+  async unpublish(documentId) {
+    const now = Math.floor(Date.now() / 1e3);
+    const row = await this.db.prepare("SELECT * FROM documents WHERE id = ? AND tenant_id = ?").bind(documentId, this.tenantId).first();
+    if (!row) throw new Error(`Document ${documentId} not found`);
+    if (!row.is_published) throw new Error(`Document ${documentId} is not published`);
+    const statements = [
+      this.db.prepare(`UPDATE documents SET is_published = 0, status = 'draft', updated_at = ? WHERE id = ?`).bind(now, documentId)
+    ];
+    if (row.is_current_draft !== 1) {
+      statements.push(...this.projection.buildDerivedDeleteStatements(documentId));
+    }
+    await this.db.batch(statements);
+    const saved = await this.db.prepare("SELECT * FROM documents WHERE id = ?").bind(documentId).first();
+    return rowToDocument(saved);
+  }
+  // ─── Soft delete ──────────────────────────────────────────────────────────
+  async softDelete(documentId) {
+    const now = Math.floor(Date.now() / 1e3);
+    await this.db.prepare("UPDATE documents SET deleted_at = ?, updated_at = ? WHERE id = ? AND tenant_id = ?").bind(now, now, documentId, this.tenantId).run();
+  }
+  // ─── Hard erase (PII types) ───────────────────────────────────────────────
+  // Deletes every version row for a root plus all derived data, in dependency order.
+  async erase(rootId, tenantId) {
+    const result = await this.db.prepare("SELECT id FROM documents WHERE root_id = ? AND tenant_id = ?").bind(rootId, tenantId).all();
+    const docIds = (result.results ?? []).map((r) => r.id);
+    if (docIds.length === 0) return;
+    const statements = [];
+    for (const id of docIds) {
+      statements.push(this.db.prepare("DELETE FROM document_facets WHERE document_id = ?").bind(id));
+      statements.push(this.db.prepare("DELETE FROM document_references WHERE from_document_id = ?").bind(id));
+    }
+    statements.push(this.db.prepare("DELETE FROM document_permissions WHERE root_id = ? AND tenant_id = ?").bind(rootId, tenantId));
+    for (const id of docIds) {
+      statements.push(this.db.prepare("DELETE FROM documents WHERE id = ?").bind(id));
+    }
+    await this.db.batch(statements);
+  }
+};
+
+// src/services/rbac.ts
+var TENANT = "default";
+var T_ROLE = "rbac_role";
+var T_VERB = "rbac_verb";
+var T_USER_ROLES = "rbac_user_roles";
+var SYSTEM_RESOURCES = [
+  { key: "*", label: "All resources", group: "system" },
+  { key: "portal", label: "Admin Portal", group: "system" },
+  { key: "dashboard", label: "Dashboard", group: "system" },
+  { key: "rbac", label: "Roles & Permissions", group: "system" },
+  { key: "documents", label: "Documents", group: "system" },
+  { key: "document_types", label: "Document Types", group: "system" },
+  { key: "email", label: "Email Management", group: "system" },
+  { key: "users", label: "Users", group: "system" },
+  { key: "settings", label: "Settings", group: "system" },
+  { key: "logs", label: "Logs", group: "system" }
+];
+var RbacService = class _RbacService {
+  constructor(db, kv) {
+    this.db = db;
+    this.kv = kv;
+  }
+  // Precedence for projecting the user's RBAC roles back onto the legacy
+  // users.role compat column (highest privilege first). Only `admin` is
+  // hardcoded as a seeded role — `editor` is listed here purely so that if an
+  // administrator chooses to recreate a role named `editor`, legacy code that
+  // still gates on the `editor` label keeps working.
+  static LEGACY_ROLE_PRECEDENCE = ["admin", "editor"];
+  _docs;
+  // ── Document access helpers ──────────────────────────────────────────────────
+  docs() {
+    if (!this._docs) {
+      this._docs = new DocumentsService(this.db, { tenantId: TENANT, maxVersionsPerRoot: 1, queryableFields: [] });
+    }
+    return this._docs;
+  }
+  parse(row) {
+    let data;
+    try {
+      data = JSON.parse(row.data);
+    } catch {
+      data = {};
+    }
+    return { id: row.id, rootId: row.root_id, slug: row.slug ?? "", data };
+  }
+  async listDocs(typeId) {
+    const res = await this.db.prepare(
+      `SELECT id, root_id, slug, data FROM documents
+         WHERE type_id = ? AND tenant_id = ? AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).bind(typeId, TENANT).all();
+    return (res.results ?? []).map((r) => this.parse(r));
+  }
+  async getDoc(typeId, slug) {
+    const row = await this.db.prepare(
+      `SELECT id, root_id, slug, data FROM documents
+         WHERE type_id = ? AND tenant_id = ? AND slug = ? AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).bind(typeId, TENANT, slug).first();
+    return row ? this.parse(row) : null;
+  }
+  async upsertDoc(typeId, slug, data, title) {
+    const existing = await this.db.prepare(
+      `SELECT root_id FROM documents
+         WHERE type_id = ? AND tenant_id = ? AND slug = ? AND is_current_draft = 1 AND deleted_at IS NULL`
+    ).bind(typeId, TENANT, slug).first();
+    const payload = data;
+    if (existing?.root_id) {
+      await this.docs().saveDraft(existing.root_id, { data: payload, title });
+    } else {
+      await this.docs().create({
+        typeId,
+        tenantId: TENANT,
+        locale: "default",
+        parentRootId: "",
+        slug,
+        title,
+        sortOrder: 0,
+        visible: true,
+        data: payload,
+        metadata: {},
+        ownerId: null,
+        publishOnCreate: false
+      });
+    }
+  }
+  async deleteDoc(typeId, slug) {
+    const doc = await this.getDoc(typeId, slug);
+    if (doc) await this.docs().softDelete(doc.id);
+  }
+  roleToRow(d) {
+    return {
+      id: d.slug,
+      name: d.data.name,
+      display_name: d.data.displayName,
+      description: d.data.description ?? null,
+      is_system: d.data.isSystem ? 1 : 0
+    };
+  }
+  // ── Reads ────────────────────────────────────────────────────────────────────
+  async getRoles() {
+    const docs = await this.listDocs(T_ROLE);
+    return docs.map((d) => this.roleToRow(d)).sort((a, b) => b.is_system - a.is_system || a.name.localeCompare(b.name));
+  }
+  async getVerbs() {
+    const docs = await this.listDocs(T_VERB);
+    return docs.map((d) => ({
+      id: d.slug,
+      name: d.data.name,
+      description: d.data.description ?? null,
+      is_system: d.data.isSystem ? 1 : 0,
+      sort_order: d.data.sortOrder ?? 100
+    })).sort((a, b) => a.sort_order - b.sort_order || a.name.localeCompare(b.name));
+  }
+  /** System resources + one `document_type:<name>` per active document type. */
+  async getResources() {
+    const types = (await this.db.prepare("SELECT name, display_name FROM document_types WHERE is_active = 1 ORDER BY name").all()).results;
+    const documentTypeResources = [
+      { key: "document_type:*", label: "All document types", group: "document_type" },
+      ...types.map((t) => ({
+        key: `document_type:${t.name}`,
+        label: t.display_name || t.name,
+        group: "document_type"
+      }))
+    ];
+    return [...SYSTEM_RESOURCES, ...documentTypeResources];
+  }
+  async getGrants() {
+    const roles = await this.listDocs(T_ROLE);
+    const out = [];
+    for (const r of roles) {
+      for (const g of r.data.grants ?? []) {
+        out.push({ role_id: r.slug, resource: g.resource, verb: g.verb, scope: g.scope === "own" ? "own" : "any" });
+      }
+    }
+    return out;
+  }
+  async getRolesForUser(userId) {
+    const ur = await this.getDoc(T_USER_ROLES, userId);
+    const roleIds = new Set(ur?.data.roleIds ?? []);
+    if (roleIds.size === 0) return [];
+    const roles = await this.listDocs(T_ROLE);
+    return roles.filter((r) => roleIds.has(r.slug)).map((d) => this.roleToRow(d));
+  }
+  /** Grants attached to a set of role ids (from the embedded role grants). */
+  async grantsForRoleIds(roleIds) {
+    if (roleIds.length === 0) return [];
+    const want = new Set(roleIds);
+    const roles = await this.listDocs(T_ROLE);
+    const out = [];
+    for (const r of roles) {
+      if (!want.has(r.slug)) continue;
+      for (const g of r.data.grants ?? []) {
+        out.push({ resource: g.resource, verb: g.verb, scope: g.scope === "own" ? "own" : "any" });
+      }
+    }
+    return out;
+  }
+  /** Does a single grant row satisfy the requested (resource, verb)? */
+  grantMatches(g, resource, verb) {
+    const resourceOk = g.resource === "*" || g.resource === resource || g.resource === "document_type:*" && resource.startsWith("document_type:");
+    if (!resourceOk) return false;
+    return g.verb === "*" || g.verb === verb || g.verb === "manage";
+  }
+  strongestScope(scopes) {
+    if (scopes.includes("any")) return "any";
+    if (scopes.includes("own")) return "own";
+    return "none";
+  }
+  /** Can the user perform `verb` on `resource`? Reads the live grant matrix. */
+  async can(userId, resource, verb) {
+    return await this.getPermissionScope(userId, resource, verb) !== "none";
+  }
+  /** Highest scope granted to the user for `resource:verb`. */
+  async getPermissionScope(userId, resource, verb) {
+    const ur = await this.getDoc(T_USER_ROLES, userId);
+    const grants = await this.grantsForRoleIds(ur?.data.roleIds ?? []);
+    return this.strongestScope(
+      grants.filter((g) => this.grantMatches(g, resource, verb)).map((g) => g.scope === "own" ? "own" : "any")
+    );
+  }
+  /** Flattened, human-readable permission list for a user. Cached in KV for 60 s. */
+  async permissionsForUser(userId) {
+    if (this.kv) {
+      const cached = await this.kv.get(`rbac:perms:${userId}`);
+      if (cached !== null) return JSON.parse(cached);
+    }
+    const ur = await this.getDoc(T_USER_ROLES, userId);
+    const roleIds = ur?.data.roleIds ?? [];
+    if (roleIds.length === 0) return [];
+    const grants = await this.grantsForRoleIds(roleIds);
+    const resources = await this.getResources();
+    const verbs = await this.getVerbs();
+    const out = /* @__PURE__ */ new Set();
+    for (const r of resources) {
+      for (const v of verbs) {
+        if (grants.some((g) => this.grantMatches(g, r.key, v.name))) out.add(`${r.key}:${v.name}`);
+      }
+    }
+    const result = [...out].sort();
+    if (this.kv) {
+      await this.kv.put(`rbac:perms:${userId}`, JSON.stringify(result), { expirationTtl: 60 });
+    }
+    return result;
+  }
+  // ── Mutations ──────────────────────────────────────────────────────────────
+  async createRole(name, displayName, description = "") {
+    const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+    const id = `role-${slug}`;
+    await this.upsertDoc(
+      T_ROLE,
+      id,
+      { name: name.toLowerCase(), displayName, description, isSystem: false, grants: [] },
+      displayName
+    );
+  }
+  async deleteRole(roleId) {
+    const role = await this.getDoc(T_ROLE, roleId);
+    if (!role || role.data.isSystem) return;
+    await this.deleteDoc(T_ROLE, roleId);
+  }
+  /**
+   * Update a role's display name and description. The `name` (slug) can only be
+   * changed for custom roles — system role names are referenced by the legacy
+   * mapping, so they stay fixed.
+   */
+  async updateRole(roleId, displayName, description = "", name) {
+    const role = await this.getDoc(T_ROLE, roleId);
+    if (!role) return;
+    const next = { ...role.data, displayName, description };
+    if (!role.data.isSystem && name) {
+      next.name = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+    }
+    await this.upsertDoc(T_ROLE, roleId, next, displayName);
+  }
+  /** Update displayName + portal access in a single write to avoid double-saveDraft FK issues. */
+  async updateRoleAndPortalAccess(roleId, displayName, name, portalEnabled, description) {
+    const role = await this.getDoc(T_ROLE, roleId);
+    if (!role) return;
+    const next = { ...role.data, displayName, description: description ?? role.data.description ?? "" };
+    if (!role.data.isSystem && name) {
+      next.name = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+    }
+    const grants = (next.grants ?? []).filter((g) => !(g.resource === "portal" && g.verb === "access"));
+    if (portalEnabled) grants.push({ resource: "portal", verb: "access", scope: "any" });
+    next.grants = grants;
+    await this.upsertDoc(T_ROLE, roleId, next, displayName);
+  }
+  async createVerb(name, description = "") {
+    const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+    const id = `verb-${slug}`;
+    await this.upsertDoc(
+      T_VERB,
+      id,
+      { name: name.toLowerCase(), description, isSystem: false, sortOrder: 100 },
+      name
+    );
+  }
+  async deleteVerb(verbId) {
+    const verb = await this.getDoc(T_VERB, verbId);
+    if (!verb || verb.data.isSystem) return;
+    await this.deleteDoc(T_VERB, verbId);
+  }
+  /** Replace all grants for one role with the supplied (resource, verb, scope) rows. */
+  async setRoleGrants(roleId, pairs) {
+    const role = await this.getDoc(T_ROLE, roleId);
+    if (!role) return;
+    const grants = pairs.map((p) => ({ resource: p.resource, verb: p.verb, scope: p.scope === "own" ? "own" : "any" }));
+    await this.upsertDoc(T_ROLE, roleId, { ...role.data, grants }, role.data.displayName);
+  }
+  /**
+   * Count active users (optionally excluding one) who hold BOTH an effective
+   * portal:access grant and an effective rbac:manage grant — the users who could
+   * recover from a permission lockout. Powers the self-lockout guard.
+   */
+  async countPortalAdmins(excludeUserId) {
+    const active = (await this.db.prepare("SELECT id FROM auth_user WHERE is_active = 1").all()).results;
+    const activeIds = new Set(active.map((u) => u.id));
+    const roles = await this.listDocs(T_ROLE);
+    const grantsByRole = new Map(roles.map((r) => [r.slug, r.data.grants ?? []]));
+    const userRoles = await this.listDocs(T_USER_ROLES);
+    let count = 0;
+    for (const ur of userRoles) {
+      const userId = ur.slug;
+      if (!activeIds.has(userId)) continue;
+      if (excludeUserId && userId === excludeUserId) continue;
+      let portal = false;
+      let rbac = false;
+      for (const rid of ur.data.roleIds ?? []) {
+        for (const g of grantsByRole.get(rid) ?? []) {
+          if (this.grantMatches(g, "portal", "access")) portal = true;
+          if (this.grantMatches(g, "rbac", "manage")) rbac = true;
+        }
+      }
+      if (portal && rbac) count++;
+    }
+    return count;
+  }
+  /**
+   * Replace a user's RBAC role assignments. The `rbac_user_roles` document is the
+   * single source of truth for authorization; the legacy `auth_user.role` column
+   * is kept as a derived projection (highest-precedence system role, else
+   * 'viewer') so the two never diverge.
+   */
+  async setUserRoles(userId, roleIds) {
+    const allRoles = await this.listDocs(T_ROLE);
+    const byId = new Map(allRoles.map((r) => [r.slug, r.data]));
+    const names = roleIds.map((id) => byId.get(id)?.name).filter((n) => !!n);
+    const primaryRole = _RbacService.LEGACY_ROLE_PRECEDENCE.find((r) => names.includes(r)) || "viewer";
+    const newGrants = [];
+    for (const id of roleIds) for (const g of byId.get(id)?.grants ?? []) newGrants.push(g);
+    const userWillBeAdmin = newGrants.some((g) => this.grantMatches(g, "portal", "access")) && newGrants.some((g) => this.grantMatches(g, "rbac", "manage"));
+    if (!userWillBeAdmin && await this.countPortalAdmins(userId) === 0) {
+      throw new Error(
+        "Refusing to update roles: this would leave no user able to manage Roles & Permissions and access the portal. Grant another user portal access + Roles & Permissions first."
+      );
+    }
+    await this.upsertDoc(T_USER_ROLES, userId, { roleIds }, null);
+    await this.db.prepare("UPDATE auth_user SET role = ?, updated_at = ? WHERE id = ?").bind(primaryRole, Date.now(), userId).run();
+    if (this.kv) await this.kv.delete(`rbac:perms:${userId}`);
+  }
+  async setRolePortalAccess(roleId, enabled) {
+    const role = await this.getDoc(T_ROLE, roleId);
+    if (!role) return;
+    const grants = (role.data.grants ?? []).filter((g) => !(g.resource === "portal" && g.verb === "access"));
+    if (enabled) grants.push({ resource: "portal", verb: "access", scope: "any" });
+    await this.upsertDoc(T_ROLE, roleId, { ...role.data, grants }, role.data.displayName);
+  }
+  // ── Bootstrap helpers ────────────────────────────────────────────────────────
+  /**
+   * Seed the system roles, verbs, and their grants as documents. Idempotent —
+   * existing roles/verbs (by slug) are left untouched. Replaces the INSERT OR
+   * IGNORE seeds that lived in migration 0001. Call at bootstrap, after the rbac
+   * document types are registered.
+   */
+  async ensureSystemRbacSeed() {
+    const roles = [
+      {
+        id: "role-admin",
+        name: "admin",
+        displayName: "Administrator",
+        description: "Full access to everything",
+        isSystem: true,
+        grants: [
+          { resource: "*", verb: "manage" },
+          { resource: "portal", verb: "access" },
+          { resource: "rbac", verb: "manage" },
+          { resource: "document_types", verb: "manage" },
+          { resource: "email", verb: "manage" },
+          { resource: "users", verb: "manage" }
+        ]
+      },
+      {
+        id: "role-editor",
+        name: "editor",
+        displayName: "Editor",
+        description: "Manage documents across all types",
+        isSystem: false,
+        grants: [
+          { resource: "portal", verb: "access" },
+          { resource: "documents", verb: "manage" },
+          { resource: "document_type:*", verb: "read" },
+          { resource: "document_type:*", verb: "create" },
+          { resource: "document_type:*", verb: "update" },
+          { resource: "document_type:*", verb: "delete" },
+          { resource: "settings", verb: "read" }
+        ]
+      }
+    ];
+    const verbs = [
+      { id: "verb-access", name: "access", description: "Enter or use a portal/resource", isSystem: true, sortOrder: 5 },
+      { id: "verb-read", name: "read", description: "View a resource", isSystem: true, sortOrder: 10 },
+      { id: "verb-create", name: "create", description: "Create a resource", isSystem: true, sortOrder: 20 },
+      { id: "verb-update", name: "update", description: "Edit a resource", isSystem: true, sortOrder: 30 },
+      { id: "verb-delete", name: "delete", description: "Remove a resource", isSystem: true, sortOrder: 40 },
+      { id: "verb-manage", name: "manage", description: "Full control (implies all verbs)", isSystem: true, sortOrder: 50 }
+    ];
+    for (const r of roles) {
+      if (await this.getDoc(T_ROLE, r.id)) continue;
+      const { id, ...data } = r;
+      await this.upsertDoc(T_ROLE, id, data, r.displayName);
+    }
+    for (const v of verbs) {
+      if (await this.getDoc(T_VERB, v.id)) continue;
+      const { id, ...data } = v;
+      await this.upsertDoc(T_VERB, id, data, v.name);
+    }
+  }
+  /** Assign a role to a user by role name (e.g. 'admin'), preserving existing roles. */
+  async addUserRoleByName(userId, roleName) {
+    const roles = await this.listDocs(T_ROLE);
+    const role = roles.find((r) => r.data.name === roleName.toLowerCase());
+    if (!role) return;
+    const ur = await this.getDoc(T_USER_ROLES, userId);
+    const roleIds = new Set(ur?.data.roleIds ?? []);
+    if (roleIds.has(role.slug)) return;
+    roleIds.add(role.slug);
+    await this.setUserRoles(userId, [...roleIds]);
+  }
+};
+
+exports.DocumentsService = DocumentsService;
+exports.RbacService = RbacService;
+exports.documentSecondsToMs = documentSecondsToMs;
+//# sourceMappingURL=chunk-2CB4KY7I.cjs.map
+//# sourceMappingURL=chunk-2CB4KY7I.cjs.map