@velora-cms/server 0.11.0

package/package.json

@@ -0,0 +1,96 @@
+{
+  "name": "@velora-cms/server",
+  "version": "0.11.0",
+  "engines": {
+    "node": ">=22.12"
+  },
+  "private": false,
+  "description": "Velora CMS server — API, admin UI at /velora, browser setup wizard",
+  "license": "Apache-2.0",
+  "type": "module",
+  "bin": {
+    "velora-server": "./dist/bin.js"
+  },
+  "main": "./dist/lib.js",
+  "exports": {
+    ".": "./dist/lib.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "!dist/prisma-clients",
+    "!dist/**/*.test.*",
+    "prisma/schema.prisma",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/velora-cms/velora.git",
+    "directory": "apps/server"
+  },
+  "bugs": {
+    "url": "https://github.com/velora-cms/velora/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "3.1079.0",
+    "@aws-sdk/s3-request-presigner": "3.1079.0",
+    "@fastify/cookie": "11.0.2",
+    "@fastify/cors": "11.1.0",
+    "@fastify/jwt": "10.1.0",
+    "@fastify/multipart": "10.0.0",
+    "@fastify/rate-limit": "10.3.0",
+    "@fastify/static": "10.1.3",
+    "@fastify/swagger": "9.7.0",
+    "@fastify/swagger-ui": "6.1.1",
+    "@lukeed/ms": "2.0.2",
+    "@pothos/core": "4.13.1",
+    "@prisma/client": "6.19.3",
+    "ajv": "8.20.0",
+    "bcrypt": "6.0.0",
+    "dotenv": "17.2.3",
+    "fastify": "5.8.5",
+    "fastify-type-provider-zod": "6.1.0",
+    "graphql": "16.14.2",
+    "graphql-scalars": "1.25.0",
+    "mercurius": "16.10.0",
+    "prisma": "6.19.3",
+    "zod": "4.4.3",
+    "@velora-cms/content-service": "0.11.0",
+    "@velora-cms/api-schemas": "0.11.0",
+    "@velora-cms/db-adapter": "0.11.0",
+    "@velora-cms/design-tokens": "0.11.0",
+    "@velora-cms/plugin-package": "0.11.0",
+    "@velora-cms/plugin-sdk": "0.11.0",
+    "@velora-cms/prisma-variants": "0.11.0"
+  },
+  "devDependencies": {
+    "@types/autocannon": "7.12.7",
+    "@types/bcrypt": "6.0.0",
+    "@types/node": "20.19.43",
+    "autocannon": "8.0.0",
+    "dotenv-cli": "11.0.0",
+    "form-data": "4.0.6",
+    "tar": "^7.5.22",
+    "tsx": "4.22.4",
+    "@velora-cms/docs": "0.1.0",
+    "create-velora-plugin": "0.11.0",
+    "@velora-cms/admin-ui": "0.1.0",
+    "@velora-cms/google-maps": "0.1.0",
+    "velora-plugin": "0.11.0",
+    "@velora-cms/reading-time": "0.1.0"
+  },
+  "scripts": {
+    "build": "prisma generate && tsc -p . && node dist/scripts/generate-prisma-clients.js && node dist/scripts/copy-docs-bundle.js && node dist/scripts/copy-admin-bundle.js && node dist/scripts/pack-bundled-templates.js",
+    "pack-templates": "tsx src/scripts/pack-bundled-templates.ts",
+    "start": "node dist/index.js",
+    "dev": "dotenv -e ../../.env -- tsx watch src/index.ts",
+    "test": "dotenv -e ../../.env -- vitest run",
+    "prisma:generate": "dotenv -e ../../.env -- prisma generate",
+    "prisma:migrate:dev": "dotenv -e ../../.env -- prisma migrate dev",
+    "perf:seed": "dotenv -e ../../.env -- tsx perf/seed-perf.ts",
+    "bench": "dotenv -e ../../.env -- tsx perf/bench.ts"
+  }
+}

package/prisma/schema.prisma

@@ -0,0 +1,303 @@
+// Prisma covers only the standard, non-performance-critical tables
+// (the Two-Tier ORM Strategy). Content nodes and
+// anything tree/versioning related go through the custom DatabaseAdapter
+// in packages/db-adapter instead — never through this schema.
+
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+// Lowercase enum values on purpose — they match the API wire format
+// ('admin' | 'editor', UserRoleSchema in @velora/api-schemas) so no
+// mapping layer is needed anywhere.
+enum Role {
+  admin
+  editor
+}
+
+model User {
+  id           String      @id @default(uuid())
+  email        String      @unique
+  passwordHash String      @map("password_hash")
+  name         String?
+  role         Role        @default(editor)
+  createdAt    DateTime    @default(now()) @map("created_at")
+  updatedAt    DateTime    @updatedAt @map("updated_at")
+  sessions     Session[]
+  mediaFiles   MediaFile[]
+
+  @@map("users")
+}
+
+model Session {
+  id               String    @id @default(uuid())
+  userId           String    @map("user_id")
+  user             User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+  refreshTokenHash String    @unique @map("refresh_token_hash")
+  expiresAt        DateTime  @map("expires_at")
+  createdAt        DateTime  @default(now()) @map("created_at")
+  revokedAt        DateTime? @map("revoked_at")
+
+  @@index([userId])
+  @@map("sessions")
+}
+
+model Setting {
+  key       String   @id
+  value     Json
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  @@map("settings")
+}
+
+model MediaFile {
+  id         String   @id @default(uuid())
+  filename   String
+  mimeType   String   @map("mime_type")
+  size       Int
+  // Object key inside the S3 bucket — what upload/download/delete address.
+  // `url` is the canonical object URL persisted for API responses; actual
+  // downloads go through presigned URLs generated from the key.
+  storageKey String   @unique @map("storage_key")
+  url        String
+  uploadedBy String   @map("uploaded_by")
+  uploader   User     @relation(fields: [uploadedBy], references: [id])
+  uploadedAt DateTime @default(now()) @map("uploaded_at")
+
+  @@index([uploadedBy])
+  @@map("media_files")
+}
+
+model PluginRegistry {
+  id          String   @id @default(uuid())
+  pluginId    String   @unique @map("plugin_id")
+  name        String
+  type        String
+  version     String
+  // 'verified' | 'unverified' — the Trust model's two tiers. Real
+  // signature verification arrives with the Month 11 marketplace; until
+  // then every install records 'unverified' (also correct for local/dev
+  // plugins, which are unsigned by definition).
+  trustTier   String   @default("unverified") @map("trust_tier")
+  // 'simple' | 'structured' — persisted at install because uninstall only
+  // has this row, and the snapshot-before-uninstall rule (database.md)
+  // must be answerable without the manifest object.
+  storageType String   @map("storage_type")
+  enabled     Boolean  @default(false)
+  settings    Json?
+  // Dev-mode/sideloaded plugins' Module Federation remoteEntry.js URL —
+  // set by the local-plugin register script (velora-dev, Session 79).
+  // Marketplace-installed plugins will get their own remote-hosting story
+  // later; null here just means "no known remote to boot-load."
+  remoteUrl   String?  @map("remote_url")
+  // Where the installed package lives in the managed plugin store
+  // (Session 122) — the boot loader imports server/plugin.js from here
+  // on every restart. Null = no stored package: velora-dev live-source
+  // plugins, which the sandbox re-registers on each start.
+  packagePath String?  @map("package_path")
+  installedAt DateTime @default(now()) @map("installed_at")
+  updatedAt   DateTime @updatedAt @map("updated_at")
+
+  @@map("plugin_registry")
+}
+
+// Tracks which of a plugin's declared migrations have been applied, so
+// uninstall (which only has the PluginRegistry row's storageType, not
+// necessarily the manifest — see attachManifest) can look up rollback
+// targets by id even across a server restart. No @relation to
+// PluginRegistry: migrations run and get recorded BEFORE the
+// PluginRegistry row exists (install() runs them as the last gate
+// before row creation), so a DB-level FK would fail at write time.
+model PluginMigrationRecord {
+  id          String   @id @default(uuid())
+  pluginId    String   @map("plugin_id")
+  migrationId String   @map("migration_id")
+  appliedAt   DateTime @default(now()) @map("applied_at")
+
+  @@unique([pluginId, migrationId])
+  @@index([pluginId])
+  @@map("plugin_migration_records")
+}
+
+// Tracks which structured-storage tables (StructuredStorageAPI.defineTable,
+// Month 8 Session 85) belong to which plugin — physicalTableName is the
+// namespaced/hashed name actually created via DatabaseAdapter.createTable,
+// distinct from tableName (the logical name the plugin itself declared).
+// Session 87's snapshot-before-uninstall reads this to know what to
+// snapshot. No @relation to PluginRegistry, same reasoning as
+// PluginMigrationRecord above.
+model PluginStructuredTable {
+  id                String   @id @default(uuid())
+  pluginId          String   @map("plugin_id")
+  tableName         String   @map("table_name")
+  physicalTableName String   @unique @map("physical_table_name")
+  schema            Json
+  createdAt         DateTime @default(now()) @map("created_at")
+
+  @@unique([pluginId, tableName])
+  @@index([pluginId])
+  @@map("plugin_structured_tables")
+}
+
+// Schema + full row dump of a structured-storage plugin's table, taken
+// before PluginRegistryService.uninstall() does anything destructive
+// (Month 8, Session 87). All of a plugin's tables snapshotted together
+// in one uninstall event share one snapshotGroupId. Distinct from the
+// content-tree Snapshot in packages/content-service — that one is a
+// version POINTER (content is immutable, nothing is ever really at
+// risk); structured-storage rows are genuinely mutable, so this has to
+// be a real data dump.
+model PluginStructuredSnapshot {
+  id                String   @id @default(uuid())
+  snapshotGroupId   String   @map("snapshot_group_id")
+  pluginId          String   @map("plugin_id")
+  tableName         String   @map("table_name")
+  physicalTableName String   @map("physical_table_name")
+  schema            Json
+  rows              Json
+  // Mapped to a non-reserved column name: TRIGGER is a reserved keyword in
+  // MySQL, and @map keeps the Prisma field name idiomatic while dodging
+  // that collision across all three prisma-variants dialects.
+  trigger           String?  @map("snapshot_trigger")
+  createdAt         DateTime @default(now()) @map("created_at")
+
+  @@index([pluginId])
+  @@index([snapshotGroupId])
+  @@map("plugin_structured_snapshots")
+}
+
+// Tracks which document types (created via DocumentTypeService during
+// PluginRegistryService.install(), Month 8 Session 88) belong to which
+// plugin. Pure Prisma-side ownership tracking, same reasoning as
+// PluginStructuredTable/PluginMigrationRecord: document types themselves
+// live in the raw DatabaseAdapter's document_types table, which has no
+// plugin_id column and would need a cross-dialect migration to gain one.
+// No @relation to PluginRegistry — document types are created before the
+// PluginRegistry row exists (install()'s sequencing), same reasoning as
+// PluginMigrationRecord.
+model PluginDocumentType {
+  id             String   @id @default(uuid())
+  pluginId       String   @map("plugin_id")
+  documentTypeId String   @unique @map("document_type_id")
+  createdAt      DateTime @default(now()) @map("created_at")
+
+  @@index([pluginId])
+  @@map("plugin_document_types")
+}
+
+// Tracks which members a BUNDLE plugin's install fan-out actually
+// installed (Session 152). A member that was already installed
+// independently gets NO row — the recorded decision is "skip, don't
+// claim" — so bundle uninstall's cascade (and S153's revocation
+// semantics later) only ever touch what the bundle itself brought in.
+// `position` preserves install order so the cascade can walk it in
+// reverse (rows are written in one createMany, so installedAt cannot
+// order them). No @relation to PluginRegistry, same reasoning as
+// PluginMigrationRecord above.
+model PluginBundleMember {
+  id             String   @id @default(uuid())
+  bundlePluginId String   @map("bundle_plugin_id")
+  memberPluginId String   @map("member_plugin_id")
+  position       Int
+  installedAt    DateTime @default(now()) @map("installed_at")
+
+  @@unique([bundlePluginId, memberPluginId])
+  @@index([bundlePluginId])
+  @@map("plugin_bundle_members")
+}
+
+// Public Content API keys (Month 9, Session 101). Only the SHA-256 hash
+// of a key is ever stored — the plaintext is shown once at creation and
+// unrecoverable after (`vk_...`, generated in src/auth/api-keys.ts).
+// revokedAt doubles as the revoked flag, matching Session.revokedAt.
+model ApiKey {
+  id         String    @id @default(uuid())
+  name       String
+  keyHash    String    @unique @map("key_hash")
+  // read | write — write implies read. Every key created before S182 was
+  // migrated to "read" (secure default); write access is opt-in per key.
+  scope      String    @default("read")
+  createdAt  DateTime  @default(now()) @map("created_at")
+  lastUsedAt DateTime? @map("last_used_at")
+  revokedAt  DateTime? @map("revoked_at")
+
+  @@map("api_keys")
+}
+
+// F3 (fix wave 2, S164 review): a fixed-PK singleton row that turns "has
+// setup already completed a create" into a real INSERT-time unique-
+// constraint check instead of a COUNT-then-CREATE race. A plain
+// `$transaction(count, create)` does NOT serialize two genuinely
+// concurrent completions on separate connections — a COUNT inside a
+// Prisma interactive transaction is a non-locking snapshot read under
+// both Postgres's default READ COMMITTED and MySQL's default REPEATABLE
+// READ, with no phantom protection for a later INSERT in the same
+// transaction. Verified live: two concurrent createFirstAdmin-shaped
+// transactions on separate connections both committed a create on both
+// postgresql and mysql. Only SQLite hid this, because Prisma's
+// single-connection pool serializes ALL writes there regardless of
+// isolation level — the one dialect the pre-existing test exercised.
+// A unique-constraint violation on a fixed primary key, by contrast, is
+// enforced by the storage engine itself at INSERT time on every Tier 1
+// dialect: a second concurrent INSERT of the same key value waits for
+// the first inserting transaction to resolve, then fails with P2002 if
+// it committed. createFirstAdmin (routes/setup.ts) inserts this row
+// unconditionally, inside the same transaction as the admin count/create
+// — the loser's P2002 is mapped to the same 409 an existing admin gets.
+// This also closes M-3 (an unrelated race between two concurrent
+// setup-FULL completions, which has no pre-existing admin to count):
+// unconditional means both modes get the same guarantee.
+model SetupLock {
+  id        Int      @id
+  createdAt DateTime @default(now()) @map("created_at")
+
+  @@map("setup_lock")
+}
+
+// The core-migration ledger (apps/server/src/db/core-migrations/). Declared
+// here so `prisma db push` treats it as schema-owned and never a drop
+// candidate — the runner itself only ever INSERTs rows / CREATEs IF NOT
+// EXISTS. Nothing accesses this model through the Prisma client.
+model CoreMigration {
+  id        String @id
+  appliedAt String @map("applied_at")
+
+  @@map("velora_core_migrations")
+}
+
+model PluginLicense {
+  id               String    @id @default(uuid())
+  // One license per installed plugin. Tracked by pluginId rather than a
+  // relation, matching PluginMigrationRecord's convention — rows can
+  // outlive a registry row's lifecycle transitions.
+  pluginId         String    @unique @map("plugin_id")
+  // PLAINTEXT by necessity: S139's re-validation ping must replay this
+  // exact key to the license server on every check. Hashing it would
+  // make the CMS unable to prove its own license.
+  key              String
+  boundDomain      String?   @map("bound_domain")
+  // "valid" | "revoked" | "domain_mismatch" | "unknown" — the last verdict
+  // the license server gave for this key. domain_mismatch is deliberately
+  // distinct from revoked: a key running on a domain other than its
+  // boundDomain warns the admin but does not deactivate the plugin,
+  // whereas revoked does.
+  status           String    @default("valid")
+  lastReason       String?   @map("last_reason")
+  lastValidatedAt  DateTime? @map("last_validated_at")
+  // When a re-validation was last ATTEMPTED (successful or not) and why the
+  // last attempt failed to reach a verdict. With lastValidatedAt (the last
+  // SUCCESSFUL verdict) these make "unreachable since" computable without a
+  // third column: the stale warning fires when the last attempt errored AND
+  // lastValidatedAt is older than the threshold.
+  lastAttemptAt    DateTime? @map("last_attempt_at")
+  lastAttemptError String?   @map("last_attempt_error")
+  createdAt        DateTime  @default(now()) @map("created_at")
+  updatedAt        DateTime  @updatedAt @map("updated_at")
+
+  @@map("plugin_licenses")
+}