@yunsoft/yuncms-core 0.1.0

package/src/hooks.js

@@ -0,0 +1,121 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { randomUUID } from 'node:crypto';
+
+function hookError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+export class HookEmitter {
+  constructor({ maxDepth = 12 } = {}) {
+    if (!Number.isInteger(maxDepth) || maxDepth < 1 || maxDepth > 100) {
+      throw new Error('Hook maxDepth must be an integer between 1 and 100');
+    }
+
+    this.maxDepth = maxDepth;
+    this.filters = new Map();
+    this.actions = new Map();
+    this.initializers = new Map();
+    this.storage = new AsyncLocalStorage();
+  }
+
+  registerFilter(event, handler) {
+    return this.#register(this.filters, event, handler);
+  }
+
+  registerAction(event, handler) {
+    return this.#register(this.actions, event, handler);
+  }
+
+  registerInit(event, handler) {
+    return this.#register(this.initializers, event, handler);
+  }
+
+  #register(map, event, handler) {
+    if (typeof event !== 'string' || event.trim() === '') throw new Error('Hook event is required');
+    if (typeof handler !== 'function') throw new Error(`Hook handler for ${event} must be a function`);
+
+    const name = event.trim();
+    const handlers = map.get(name) ?? [];
+    handlers.push(handler);
+    map.set(name, handlers);
+
+    return () => {
+      const active = map.get(name) ?? [];
+      const next = active.filter((candidate) => candidate !== handler);
+      if (next.length === 0) map.delete(name);
+      else map.set(name, next);
+    };
+  }
+
+  #nextExecution(event) {
+    const current = this.storage.getStore();
+    const depth = (current?.depth ?? 0) + 1;
+    if (depth > this.maxDepth) {
+      throw hookError(
+        'HOOK_RECURSION_LIMIT',
+        `Hook recursion limit exceeded while dispatching ${event}`,
+      );
+    }
+
+    return {
+      chainId: current?.chainId ?? randomUUID(),
+      depth,
+      events: [...(current?.events ?? []), event],
+    };
+  }
+
+  async #runWithExecution(event, operation) {
+    const execution = this.#nextExecution(event);
+    return this.storage.run(execution, () => operation(execution));
+  }
+
+  async filter(event, payload, context = {}) {
+    const handlers = this.filters.get(event) ?? [];
+    if (handlers.length === 0) return payload;
+
+    return this.#runWithExecution(event, async (execution) => {
+      let current = payload;
+      for (const handler of handlers) {
+        const next = await handler(current, {
+          ...context,
+          hook: execution,
+          event,
+        });
+        if (next !== undefined) current = next;
+      }
+      return current;
+    });
+  }
+
+  async action(event, payload, context = {}) {
+    const handlers = this.actions.get(event) ?? [];
+    if (handlers.length === 0) return;
+
+    await this.#runWithExecution(event, async (execution) => {
+      for (const handler of handlers) {
+        await handler(payload, {
+          ...context,
+          hook: execution,
+          event,
+        });
+      }
+    });
+  }
+
+  async init(event, context = {}) {
+    const handlers = this.initializers.get(event) ?? [];
+    if (handlers.length === 0) return;
+
+    await this.#runWithExecution(`init:${event}`, async (execution) => {
+      for (const handler of handlers) {
+        await handler({
+          ...context,
+          hook: execution,
+          event,
+        });
+      }
+    });
+  }
+}

package/src/identifier.js

@@ -0,0 +1,13 @@
+const IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+export function assertIdentifier(value, label = 'identifier') {
+  if (typeof value !== 'string' || !IDENTIFIER_PATTERN.test(value)) {
+    throw new Error(`Invalid SQL ${label}: ${String(value)}`);
+  }
+
+  return value;
+}
+
+export function quoteIdentifier(value, label) {
+  return `\`${assertIdentifier(value, label)}\``;
+}

package/src/index.js

@@ -0,0 +1,67 @@
+export { loadConfig, loadEnvFileIfPresent } from './config.js';
+export { createDatabasePool, pingDatabase, closeDatabasePool } from './database.js';
+export { withTransaction, withConnectionTransaction } from './transaction.js';
+export { assertIdentifier, quoteIdentifier } from './identifier.js';
+export { YunCmsDatabaseError, normalizeDatabaseError, isRetryableDatabaseError } from './errors.js';
+export { withDatabaseRetry } from './retry.js';
+export {
+  createAccountability,
+  createPublicAccountability,
+  createSystemAccountability,
+  requireAccountability,
+} from './accountability.js';
+export { createRequestContext } from './context.js';
+export { createInitialAdmin, findExistingAdmin } from './setup.js';
+export { HookEmitter } from './hooks.js';
+export { createJsonLogger, LEVELS as LOG_LEVELS } from './logger.js';
+export { deleteM2MJunction } from './m2m-lifecycle.js';
+export {
+  MAX_EXPAND_FIELDS,
+  parseExpandInput,
+  readManyWithRelations,
+  readOneWithRelations,
+} from './relation-expansion.js';
+export { SmtpMailer } from './mail/smtp-mailer.js';
+export { LocalStorageDriver, assertStorageKey } from './storage/local-storage-driver.js';
+export { S3StorageDriver } from './storage/s3-storage-driver.js';
+export { createStorageRegistry } from './storage/storage-registry.js';
+export { BaseService } from './services/base-service.js';
+export { createServiceRegistry } from './services/service-registry.js';
+export { createCoreServiceRegistry } from './services/core-services.js';
+export { AuthService } from './services/auth-service.js';
+export { AuthTokensService } from './services/auth-tokens-service.js';
+export { ApiTokensService } from './services/api-tokens-service.js';
+export { AuditService, redactAuditValue } from './services/audit-service.js';
+export { ItemsService } from './services/items-service.js';
+export { CollectionsService } from './services/collections-service.js';
+export { FieldsService } from './services/fields-service.js';
+export { RelationsService } from './services/relations-service.js';
+export { UsersService } from './services/users-service.js';
+export { RolesService } from './services/roles-service.js';
+export { PermissionsService } from './services/permissions-service.js';
+export { FilesService } from './services/files-service.js';
+export { FileReconciliationService } from './services/file-reconciliation-service.js';
+export { SchemaMetadataRepository } from './schema-metadata-repository.js';
+export { loadSchemaSnapshot, SchemaCache } from './schema.js';
+export { assertFieldType, compileFieldColumn } from './field-types.js';
+export {
+  parseItemsQuery,
+  compileSelectFields,
+  compileSort,
+  compileFilter,
+} from './query.js';
+export { withAdvisoryLock } from './advisory-lock.js';
+export {
+  ensureMigrationJournal,
+  readAppliedMigrations,
+  validateMigration,
+  applyMigrations,
+  assertMigrationsApplied,
+} from './migrations.js';
+export { readSchemaVersion, incrementSchemaVersion } from './schema-version.js';
+export {
+  CORE_MIGRATIONS,
+  REQUIRED_CORE_MIGRATION_IDS,
+  bootstrapDatabase,
+  assertDatabaseCompatible,
+} from './bootstrap.js';

package/src/logger.js

@@ -0,0 +1,56 @@
+import { redactAuditValue } from './services/audit-service.js';
+
+const LEVELS = Object.freeze({ debug: 10, info: 20, warn: 30, error: 40 });
+
+function normalizeError(error) {
+  if (!(error instanceof Error)) return error;
+  return {
+    name: error.name,
+    code: error.code ?? null,
+    message: error.message,
+    stack: error.stack,
+  };
+}
+
+function normalizeMeta(meta) {
+  if (meta == null) return {};
+  if (meta instanceof Error) return { error: normalizeError(meta) };
+  if (typeof meta !== 'object' || Array.isArray(meta)) return { value: meta };
+
+  return Object.fromEntries(
+    Object.entries(meta).map(([key, value]) => [
+      key,
+      value instanceof Error ? normalizeError(value) : value,
+    ]),
+  );
+}
+
+export function createJsonLogger({
+  level = 'info',
+  output = process.stdout,
+  errorOutput = process.stderr,
+  now = () => new Date(),
+} = {}) {
+  const threshold = LEVELS[level] ?? LEVELS.info;
+
+  function write(logLevel, message, meta) {
+    if (LEVELS[logLevel] < threshold) return;
+    const record = redactAuditValue({
+      timestamp: now().toISOString(),
+      level: logLevel,
+      message: String(message),
+      ...normalizeMeta(meta),
+    });
+    const stream = logLevel === 'error' ? errorOutput : output;
+    stream.write(`${JSON.stringify(record)}\n`);
+  }
+
+  return Object.freeze({
+    debug(message, meta) { write('debug', message, meta); },
+    info(message, meta) { write('info', message, meta); },
+    warn(message, meta) { write('warn', message, meta); },
+    error(message, meta) { write('error', message, meta); },
+  });
+}
+
+export { LEVELS };

package/src/m2m-lifecycle.js

@@ -0,0 +1,139 @@
+import { randomBytes } from 'node:crypto';
+
+import { withAdvisoryLock } from './advisory-lock.js';
+import { assertIdentifier, quoteIdentifier } from './identifier.js';
+import { SchemaMetadataRepository } from './schema-metadata-repository.js';
+import { incrementSchemaVersion } from './schema-version.js';
+import { assertSchemaManager } from './services/schema-access.js';
+import { withConnectionTransaction } from './transaction.js';
+
+function lifecycleError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function parseMetadata(value) {
+  if (value == null || typeof value === 'object') return value ?? {};
+  try {
+    return JSON.parse(value);
+  } catch {
+    return {};
+  }
+}
+
+function tombstoneName(collection) {
+  const suffix = randomBytes(6).toString('hex');
+  return `ydel_${collection.slice(0, Math.max(1, 46 - suffix.length))}_${suffix}`;
+}
+
+export async function deleteM2MJunction({
+  database,
+  accountability,
+  junctionCollection,
+  destructive = false,
+} = {}) {
+  assertSchemaManager(accountability);
+  if (!database) throw new Error('Database handle is required');
+  assertIdentifier(junctionCollection, 'junction collection');
+  if (destructive !== true) {
+    throw lifecycleError(
+      'DESTRUCTIVE_OPERATION_REQUIRED',
+      'M2M junction deletion requires destructive: true',
+    );
+  }
+
+  return withAdvisoryLock(database, 'yuncms:schema', async (connection) => {
+    const metadata = new SchemaMetadataRepository(connection);
+    const [collection, allRelations] = await Promise.all([
+      metadata.readCollection(junctionCollection),
+      metadata.listRelations(),
+    ]);
+
+    if (!collection) {
+      throw lifecycleError('COLLECTION_NOT_FOUND', `Unknown junction collection: ${junctionCollection}`);
+    }
+    if (collection.system) {
+      throw lifecycleError('SYSTEM_SCHEMA_READ_ONLY', 'System collections cannot be deleted as M2M junctions');
+    }
+
+    const relations = allRelations.filter((relation) => relation.junction_collection === junctionCollection);
+    const m2mRelations = relations.filter((relation) => parseMetadata(relation.metadata).kind === 'm2m');
+    if (m2mRelations.length !== 2 || relations.length !== 2) {
+      throw lifecycleError(
+        'M2M_JUNCTION_INVALID',
+        `Collection ${junctionCollection} is not a complete YunCMS M2M junction`,
+      );
+    }
+
+    const relationFields = new Set(m2mRelations.map((relation) => relation.many_field));
+    if (relationFields.size !== 2 || m2mRelations.some((relation) => relation.many_collection !== junctionCollection)) {
+      throw lifecycleError(
+        'M2M_JUNCTION_INVALID',
+        `M2M junction ${junctionCollection} has inconsistent relation metadata`,
+      );
+    }
+
+    const tombstone = tombstoneName(junctionCollection);
+    const tableSql = quoteIdentifier(junctionCollection, 'junction collection');
+    const tombstoneSql = quoteIdentifier(tombstone, 'junction tombstone');
+    await connection.query(`RENAME TABLE ${tableSql} TO ${tombstoneSql}`);
+
+    let committed = false;
+    try {
+      const result = await withConnectionTransaction(connection, async () => {
+        for (const relation of m2mRelations) {
+          const deleted = await metadata.deleteRelation(relation.many_collection, relation.many_field);
+          if (deleted !== 1) {
+            throw lifecycleError(
+              'SCHEMA_METADATA_DRIFT',
+              `M2M relation metadata disappeared during delete: ${relation.many_collection}.${relation.many_field}`,
+            );
+          }
+        }
+
+        await connection.query('DELETE FROM yuncms_permissions WHERE collection = ?', [junctionCollection]);
+        const deletedCollection = await metadata.deleteCollection(junctionCollection);
+        if (deletedCollection !== 1) {
+          throw lifecycleError(
+            'SCHEMA_METADATA_DRIFT',
+            `M2M junction metadata disappeared during delete: ${junctionCollection}`,
+          );
+        }
+        const schemaVersion = await incrementSchemaVersion(connection);
+        return {
+          deleted: true,
+          junctionCollection,
+          relations: m2mRelations,
+          schemaVersion,
+        };
+      });
+      committed = true;
+
+      try {
+        await connection.query(`DROP TABLE ${tombstoneSql}`);
+      } catch (cleanupError) {
+        const error = lifecycleError(
+          'SCHEMA_PARTIAL_FAILURE',
+          `M2M junction was logically deleted but tombstone cleanup failed: ${tombstone}`,
+        );
+        error.cleanupError = cleanupError;
+        error.cleanupObject = tombstone;
+        error.result = result;
+        throw error;
+      }
+
+      return result;
+    } catch (error) {
+      if (!committed) {
+        try {
+          await connection.query(`RENAME TABLE ${tombstoneSql} TO ${tableSql}`);
+        } catch (restoreError) {
+          error.restoreError = restoreError;
+          error.code ||= 'SCHEMA_PARTIAL_FAILURE';
+        }
+      }
+      throw error;
+    }
+  });
+}

package/src/mail/smtp-mailer.js

@@ -0,0 +1,65 @@
+import nodemailer from 'nodemailer';
+
+function mailError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function assertAddress(value, label) {
+  if (typeof value !== 'string' || !value.trim() || /[\r\n]/.test(value)) {
+    throw mailError('INVALID_MAIL_MESSAGE', `${label} is invalid`);
+  }
+  return value.trim();
+}
+
+export class SmtpMailer {
+  constructor({
+    host,
+    port = 587,
+    secure = false,
+    user = null,
+    password = null,
+    from,
+    transport = null,
+  } = {}) {
+    if (!transport && (!host || typeof host !== 'string')) throw new Error('SMTP host is required');
+    this.from = assertAddress(from, 'SMTP from address');
+    this.transport = transport ?? nodemailer.createTransport({
+      host,
+      port,
+      secure: secure === true,
+      ...(user || password ? {
+        auth: {
+          user: user ?? '',
+          pass: password ?? '',
+        },
+      } : {}),
+      disableFileAccess: true,
+      disableUrlAccess: true,
+    });
+  }
+
+  async verify() {
+    if (typeof this.transport.verify !== 'function') return true;
+    return this.transport.verify();
+  }
+
+  async send({ to, subject, text, html = undefined } = {}) {
+    const recipient = assertAddress(to, 'Recipient');
+    if (typeof subject !== 'string' || !subject.trim() || /[\r\n]/.test(subject)) {
+      throw mailError('INVALID_MAIL_MESSAGE', 'Mail subject is invalid');
+    }
+    if (typeof text !== 'string' || !text) {
+      throw mailError('INVALID_MAIL_MESSAGE', 'Mail text body is required');
+    }
+
+    return this.transport.sendMail({
+      from: this.from,
+      to: recipient,
+      subject: subject.trim(),
+      text,
+      ...(html ? { html } : {}),
+    });
+  }
+}

package/src/migrations/0001-system-schema.js

@@ -0,0 +1,164 @@
+export const systemSchemaMigration = {
+  id: '0001-system-schema',
+  statements: [
+    `CREATE TABLE IF NOT EXISTS yuncms_schema_state (
+      id TINYINT UNSIGNED NOT NULL PRIMARY KEY,
+      version BIGINT UNSIGNED NOT NULL DEFAULT 0,
+      updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+      CONSTRAINT chk_yuncms_schema_state_singleton CHECK (id = 1)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+
+    `INSERT IGNORE INTO yuncms_schema_state (id, version) VALUES (1, 0)`,
+
+    `CREATE TABLE IF NOT EXISTS yuncms_collections (
+      collection VARCHAR(64) NOT NULL PRIMARY KEY,
+      primary_key VARCHAR(64) NOT NULL DEFAULT 'id',
+      note TEXT NULL,
+      singleton TINYINT(1) NOT NULL DEFAULT 0,
+      hidden TINYINT(1) NOT NULL DEFAULT 0,
+      \`system\` TINYINT(1) NOT NULL DEFAULT 0,
+      metadata JSON NULL,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+
+    `CREATE TABLE IF NOT EXISTS yuncms_fields (
+      id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
+      collection VARCHAR(64) NOT NULL,
+      field VARCHAR(64) NOT NULL,
+      type VARCHAR(32) NOT NULL,
+      required TINYINT(1) NOT NULL DEFAULT 0,
+      readonly TINYINT(1) NOT NULL DEFAULT 0,
+      hidden TINYINT(1) NOT NULL DEFAULT 0,
+      sort INT NULL,
+      interface VARCHAR(64) NULL,
+      options JSON NULL,
+      schema_metadata JSON NULL,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+      UNIQUE KEY uq_yuncms_fields_collection_field (collection, field),
+      CONSTRAINT fk_yuncms_fields_collection FOREIGN KEY (collection)
+        REFERENCES yuncms_collections (collection) ON DELETE CASCADE
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+
+    `CREATE TABLE IF NOT EXISTS yuncms_relations (
+      id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
+      many_collection VARCHAR(64) NOT NULL,
+      many_field VARCHAR(64) NOT NULL,
+      one_collection VARCHAR(64) NOT NULL,
+      one_field VARCHAR(64) NULL,
+      junction_collection VARCHAR(64) NULL,
+      junction_field VARCHAR(64) NULL,
+      on_delete VARCHAR(16) NOT NULL DEFAULT 'RESTRICT',
+      metadata JSON NULL,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      UNIQUE KEY uq_yuncms_relation_many (many_collection, many_field)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+
+    `CREATE TABLE IF NOT EXISTS yuncms_roles (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      name VARCHAR(100) NOT NULL,
+      description TEXT NULL,
+      admin TINYINT(1) NOT NULL DEFAULT 0,
+      public TINYINT(1) NOT NULL DEFAULT 0,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+      UNIQUE KEY uq_yuncms_roles_name (name)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+
+    `CREATE TABLE IF NOT EXISTS yuncms_users (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      email VARCHAR(191) NOT NULL,
+      password_hash VARCHAR(255) NULL,
+      role CHAR(36) NULL,
+      status VARCHAR(32) NOT NULL DEFAULT 'active',
+      email_verified_at DATETIME(3) NULL,
+      last_access DATETIME(3) NULL,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+      UNIQUE KEY uq_yuncms_users_email (email),
+      KEY idx_yuncms_users_role (role),
+      CONSTRAINT fk_yuncms_users_role FOREIGN KEY (role)
+        REFERENCES yuncms_roles (id) ON DELETE SET NULL
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+
+    `CREATE TABLE IF NOT EXISTS yuncms_sessions (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      user CHAR(36) NOT NULL,
+      token_hash CHAR(64) NOT NULL,
+      expires_at DATETIME(3) NOT NULL,
+      last_used_at DATETIME(3) NULL,
+      ip VARCHAR(45) NULL,
+      user_agent VARCHAR(512) NULL,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      UNIQUE KEY uq_yuncms_sessions_token_hash (token_hash),
+      KEY idx_yuncms_sessions_user (user),
+      KEY idx_yuncms_sessions_expires_at (expires_at),
+      CONSTRAINT fk_yuncms_sessions_user FOREIGN KEY (user)
+        REFERENCES yuncms_users (id) ON DELETE CASCADE
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+
+    `CREATE TABLE IF NOT EXISTS yuncms_permissions (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      role CHAR(36) NOT NULL,
+      collection VARCHAR(64) NOT NULL,
+      action VARCHAR(16) NOT NULL,
+      fields JSON NULL,
+      filter JSON NULL,
+      validation JSON NULL,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+      UNIQUE KEY uq_yuncms_permissions_scope (role, collection, action),
+      CONSTRAINT fk_yuncms_permissions_role FOREIGN KEY (role)
+        REFERENCES yuncms_roles (id) ON DELETE CASCADE
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+
+    `CREATE TABLE IF NOT EXISTS yuncms_api_tokens (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      user CHAR(36) NOT NULL,
+      name VARCHAR(100) NOT NULL,
+      token_hash CHAR(64) NOT NULL,
+      expires_at DATETIME(3) NULL,
+      last_used_at DATETIME(3) NULL,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      UNIQUE KEY uq_yuncms_api_tokens_hash (token_hash),
+      KEY idx_yuncms_api_tokens_user (user),
+      CONSTRAINT fk_yuncms_api_tokens_user FOREIGN KEY (user)
+        REFERENCES yuncms_users (id) ON DELETE CASCADE
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+
+    `CREATE TABLE IF NOT EXISTS yuncms_files (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      storage VARCHAR(64) NOT NULL DEFAULT 'local',
+      filename_disk VARCHAR(255) NOT NULL,
+      filename_download VARCHAR(255) NOT NULL,
+      title VARCHAR(255) NULL,
+      mimetype VARCHAR(191) NULL,
+      filesize BIGINT UNSIGNED NULL,
+      uploaded_by CHAR(36) NULL,
+      uploaded_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      metadata JSON NULL,
+      UNIQUE KEY uq_yuncms_files_disk (storage, filename_disk),
+      KEY idx_yuncms_files_uploaded_by (uploaded_by),
+      CONSTRAINT fk_yuncms_files_uploaded_by FOREIGN KEY (uploaded_by)
+        REFERENCES yuncms_users (id) ON DELETE SET NULL
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+
+    `CREATE TABLE IF NOT EXISTS yuncms_audit_log (
+      id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
+      user CHAR(36) NULL,
+      action VARCHAR(32) NOT NULL,
+      collection VARCHAR(64) NULL,
+      item_key VARCHAR(191) NULL,
+      request_id VARCHAR(64) NULL,
+      ip VARCHAR(45) NULL,
+      payload JSON NULL,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      KEY idx_yuncms_audit_user (user),
+      KEY idx_yuncms_audit_collection_item (collection, item_key),
+      KEY idx_yuncms_audit_created_at (created_at),
+      CONSTRAINT fk_yuncms_audit_user FOREIGN KEY (user)
+        REFERENCES yuncms_users (id) ON DELETE SET NULL
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+  ],
+};

package/src/migrations/0002-session-access-tokens.js

@@ -0,0 +1,10 @@
+export const sessionAccessTokensMigration = {
+  id: '0002-session-access-tokens',
+  statements: [
+    `ALTER TABLE yuncms_sessions
+      ADD COLUMN access_token_hash CHAR(64) NULL AFTER token_hash,
+      ADD COLUMN access_expires_at DATETIME(3) NULL AFTER access_token_hash,
+      ADD UNIQUE KEY uq_yuncms_sessions_access_token_hash (access_token_hash),
+      ADD KEY idx_yuncms_sessions_access_expires_at (access_expires_at)`,
+  ],
+};

package/src/migrations/0003-public-role-constraints.js

@@ -0,0 +1,10 @@
+export const publicRoleConstraintsMigration = {
+  id: '0003-public-role-constraints',
+  statements: [
+    `ALTER TABLE yuncms_roles
+      ADD COLUMN public_singleton TINYINT
+        GENERATED ALWAYS AS (CASE WHEN public = 1 THEN 1 ELSE NULL END) STORED,
+      ADD UNIQUE KEY uq_yuncms_roles_single_public (public_singleton),
+      ADD CONSTRAINT chk_yuncms_roles_admin_not_public CHECK (NOT (admin = 1 AND public = 1))`,
+  ],
+};

package/src/migrations/0004-auth-action-tokens.js

@@ -0,0 +1,19 @@
+export const authActionTokensMigration = {
+  id: '0004-auth-action-tokens',
+  statements: [
+    `CREATE TABLE IF NOT EXISTS yuncms_auth_tokens (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      user CHAR(36) NOT NULL,
+      type VARCHAR(24) NOT NULL,
+      token_hash CHAR(64) NOT NULL,
+      expires_at DATETIME(3) NOT NULL,
+      used_at DATETIME(3) NULL,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      UNIQUE KEY uq_yuncms_auth_tokens_hash (token_hash),
+      KEY idx_yuncms_auth_tokens_user_type (user, type),
+      KEY idx_yuncms_auth_tokens_expires (expires_at),
+      CONSTRAINT fk_yuncms_auth_tokens_user FOREIGN KEY (user)
+        REFERENCES yuncms_users (id) ON DELETE CASCADE
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+  ],
+};