dns-worker 1.0.2-3.3

package/migrations/0000_init.sql

@@ -0,0 +1,80 @@
+-- Profiles table
+CREATE TABLE IF NOT EXISTS profiles (
+    id TEXT PRIMARY KEY, -- 6-char alphanumeric ID
+    name TEXT NOT NULL,
+    settings TEXT NOT NULL, -- JSON object: { upstream, ecs, log_retention, default_policy }
+    owner_id TEXT REFERENCES users(id),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+);
+
+-- Users table
+CREATE TABLE IF NOT EXISTS users (
+    id TEXT PRIMARY KEY,
+    username TEXT NOT NULL UNIQUE COLLATE NOCASE,
+    hashed_password TEXT NOT NULL,
+    role TEXT DEFAULT 'user' CHECK(role IN ('admin', 'user')),
+    created_at INTEGER NOT NULL
+);
+
+-- Sessions table (Lucia v3 requirement)
+CREATE TABLE IF NOT EXISTS sessions (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    expires_at INTEGER NOT NULL,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+-- Custom Rules table
+CREATE TABLE IF NOT EXISTS rules (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    profile_id TEXT NOT NULL,
+    type TEXT CHECK(type IN ('ALLOW', 'BLOCK', 'REDIRECT')) NOT NULL,
+    pattern TEXT NOT NULL, -- Domain or wildcard
+    value TEXT, -- legacy redirect value (optional)
+    record_type TEXT DEFAULT 'A',
+    v_a TEXT,
+    v_aaaa TEXT,
+    v_txt TEXT,
+    v_cname TEXT,
+    priority INTEGER DEFAULT 0,
+    FOREIGN KEY (profile_id) REFERENCES profiles(id) ON DELETE CASCADE
+);
+
+-- External Blocklists subscriptions
+CREATE TABLE IF NOT EXISTS lists (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    profile_id TEXT NOT NULL,
+    url TEXT NOT NULL,
+    enabled INTEGER DEFAULT 1,
+    last_synced_at INTEGER,
+    FOREIGN KEY (profile_id) REFERENCES profiles(id) ON DELETE CASCADE
+);
+
+-- Resolution Logs table
+CREATE TABLE IF NOT EXISTS logs (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    profile_id TEXT NOT NULL,
+    timestamp INTEGER NOT NULL, -- Unix timestamp
+    client_ip TEXT,
+    geo_country TEXT, -- ISO 3166-1 alpha-2
+    domain TEXT NOT NULL,
+    record_type TEXT NOT NULL,
+    action TEXT CHECK(action IN ('PASS', 'BLOCK', 'REDIRECT', 'FAIL')) NOT NULL,
+    reason TEXT, -- Rule ID or List Name
+    answer TEXT,
+    dest_geoip TEXT,
+    ecs TEXT,
+    upstream TEXT,
+    latency INTEGER,
+    FOREIGN KEY (profile_id) REFERENCES profiles(id) ON DELETE CASCADE
+);
+
+-- Indexes
+CREATE INDEX IF NOT EXISTS idx_rules_profile ON rules(profile_id);
+CREATE INDEX IF NOT EXISTS idx_lists_profile ON lists(profile_id);
+CREATE INDEX IF NOT EXISTS idx_logs_profile_time ON logs(profile_id, timestamp);
+CREATE INDEX IF NOT EXISTS idx_logs_domain ON logs(domain);
+CREATE INDEX IF NOT EXISTS idx_users_username ON users(username COLLATE NOCASE);
+CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id);
+CREATE INDEX IF NOT EXISTS idx_profiles_owner ON profiles(owner_id);

package/migrations/0001_move_lists_to_d1.sql

@@ -0,0 +1,12 @@
+-- Migration to move external list data from KV to D1
+CREATE TABLE IF NOT EXISTS list_entries (
+    profile_id TEXT NOT NULL,
+    domain TEXT NOT NULL,
+    PRIMARY KEY (profile_id, domain)
+);
+
+CREATE INDEX IF NOT EXISTS idx_list_entries_profile ON list_entries(profile_id);
+
+-- We also need a way to store the Bloom Filter and sync metadata in D1
+ALTER TABLE profiles ADD COLUMN list_bloom BLOB;
+ALTER TABLE profiles ADD COLUMN list_updated_at INTEGER;

package/migrations/0002_activity_tracking.sql

@@ -0,0 +1,7 @@
+-- Add activity tracking
+ALTER TABLE users ADD COLUMN last_active_at INTEGER;
+ALTER TABLE profiles ADD COLUMN last_active_at INTEGER;
+
+-- Initialize existing records
+UPDATE users SET last_active_at = created_at WHERE last_active_at IS NULL;
+UPDATE profiles SET last_active_at = created_at WHERE last_active_at IS NULL;

package/migrations/0003_fix_profiles_cascade.sql

@@ -0,0 +1,21 @@
+-- Fix profiles foreign key to support ON DELETE CASCADE
+-- 1. Create a temporary table with the correct constraint
+CREATE TABLE profiles_new (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    settings TEXT NOT NULL,
+    owner_id TEXT REFERENCES users(id) ON DELETE CASCADE,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    last_active_at INTEGER
+);
+
+-- 2. Copy data from old table
+INSERT INTO profiles_new SELECT id, name, settings, owner_id, created_at, updated_at, last_active_at FROM profiles;
+
+-- 3. Drop old table and rename new one
+DROP TABLE profiles;
+ALTER TABLE profiles_new RENAME TO profiles;
+
+-- 4. Re-create indexes for the new table
+CREATE INDEX IF NOT EXISTS idx_profiles_owner ON profiles(owner_id);

package/migrations/0004_system_settings.sql

@@ -0,0 +1,12 @@
+-- 系统全局配置表
+CREATE TABLE IF NOT EXISTS system_settings (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    updated_at INTEGER NOT NULL
+);
+
+-- 预设默认值
+INSERT OR IGNORE INTO system_settings (key, value, updated_at) VALUES ('turnstile_site_key', '', 0);
+INSERT OR IGNORE INTO system_settings (key, value, updated_at) VALUES ('turnstile_secret_key', '', 0);
+INSERT OR IGNORE INTO system_settings (key, value, updated_at) VALUES ('turnstile_enabled_signup', 'false', 0);
+INSERT OR IGNORE INTO system_settings (key, value, updated_at) VALUES ('turnstile_enabled_login', 'false', 0);

package/migrations/0005_add_bloom_storage.sql

@@ -0,0 +1,3 @@
+-- Add Bloom filter storage to profiles table
+ALTER TABLE profiles ADD COLUMN list_bloom TEXT;
+ALTER TABLE profiles ADD COLUMN list_updated_at INTEGER;

package/migrations/0006_cleanup_profiles_table.sql

@@ -0,0 +1,18 @@
+-- Remove Bloom filter columns from profiles table (deprecating migration 0005 approach)
+-- SQLite doesn't support DROP COLUMN, so we recreate the table
+CREATE TABLE profiles_temp (
+    id TEXT PRIMARY KEY,
+    owner_id TEXT REFERENCES users(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    settings TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    last_active_at INTEGER
+);
+
+INSERT INTO profiles_temp SELECT id, owner_id, name, settings, created_at, updated_at, last_active_at FROM profiles;
+
+DROP TABLE profiles;
+ALTER TABLE profiles_temp RENAME TO profiles;
+
+CREATE INDEX IF NOT EXISTS idx_profiles_owner ON profiles(owner_id);

package/migrations/0007_user_activity_and_totp.sql

@@ -0,0 +1,37 @@
+-- 用户安全活动日志
+CREATE TABLE IF NOT EXISTS user_activity_log (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    action TEXT NOT NULL CHECK(action IN (
+        'login_success', 'login_fail', 'logout',
+        'password_change_success', 'password_change_fail',
+        'totp_verify_success', 'totp_verify_fail',
+        'totp_setup', 'totp_removed',
+        'recovery_key_used'
+    )),
+    ip_address TEXT,
+    user_agent TEXT,
+    timestamp INTEGER NOT NULL,
+    extra TEXT, -- JSON 附加信息 (如失败原因)
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+-- 待验证的 TOTP 临时会话 (密码验证通过，等待 TOTP 验证)
+CREATE TABLE IF NOT EXISTS pending_totp_sessions (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    expires_at INTEGER NOT NULL,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+-- TOTP 相关字段
+ALTER TABLE users ADD COLUMN totp_secret TEXT;
+ALTER TABLE users ADD COLUMN totp_enabled INTEGER DEFAULT 0;
+-- 跳过密码模式：启用后登录只需 TOTP，不需要密码
+ALTER TABLE users ADD COLUMN totp_skip_password INTEGER DEFAULT 0;
+-- 恢复密钥：JSON 数组，存储 SHA-256 哈希后的 8 个一次性密钥
+ALTER TABLE users ADD COLUMN totp_recovery_keys TEXT;
+
+-- 索引
+CREATE INDEX IF NOT EXISTS idx_activity_log_user ON user_activity_log(user_id, timestamp DESC);
+CREATE INDEX IF NOT EXISTS idx_pending_totp_expires ON pending_totp_sessions(expires_at);

package/migrations/0008_add_profile_key.sql

@@ -0,0 +1,8 @@
+-- Add profile_key column to profiles table
+ALTER TABLE profiles ADD COLUMN profile_key TEXT;
+
+-- Backfill profile_key with existing id for backward compatibility
+UPDATE profiles SET profile_key = LOWER(id) WHERE profile_key IS NULL;
+
+-- Create unique index
+CREATE UNIQUE INDEX IF NOT EXISTS idx_profiles_key ON profiles(profile_key);

package/migrations/0009_add_profile_blooms.sql

@@ -0,0 +1,5 @@
+CREATE TABLE IF NOT EXISTS profile_blooms (
+  profile_id TEXT PRIMARY KEY,
+  bloom_filter BLOB,
+  updated_at INTEGER NOT NULL
+);

package/migrations/0010_session_device_info.sql

@@ -0,0 +1,3 @@
+-- Add device info to sessions table
+ALTER TABLE sessions ADD COLUMN ip_address TEXT;
+ALTER TABLE sessions ADD COLUMN user_agent TEXT;

package/migrations/0011_session_created_at.sql

@@ -0,0 +1,2 @@
+-- Add created_at to sessions table
+ALTER TABLE sessions ADD COLUMN created_at INTEGER;

package/migrations/0012_profile_bloom_chunks.sql

@@ -0,0 +1,9 @@
+DROP TABLE IF EXISTS profile_blooms;
+
+CREATE TABLE profile_blooms (
+  profile_id TEXT NOT NULL,
+  chunk_index INTEGER NOT NULL,
+  bloom_filter_chunk BLOB NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (profile_id, chunk_index)
+);

package/migrations/0013_add_session_revoked_to_activity_log.sql

@@ -0,0 +1,29 @@
+PRAGMA foreign_keys=off;
+
+CREATE TABLE user_activity_log_new (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    action TEXT NOT NULL CHECK(action IN (
+        'login_success', 'login_fail', 'logout',
+        'password_change_success', 'password_change_fail',
+        'totp_verify_success', 'totp_verify_fail',
+        'totp_setup', 'totp_removed',
+        'recovery_key_used',
+        'session_revoked'
+    )),
+    ip_address TEXT,
+    user_agent TEXT,
+    timestamp INTEGER NOT NULL,
+    extra TEXT,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+INSERT INTO user_activity_log_new SELECT * FROM user_activity_log;
+
+DROP TABLE user_activity_log;
+
+ALTER TABLE user_activity_log_new RENAME TO user_activity_log;
+
+CREATE INDEX IF NOT EXISTS idx_activity_log_user ON user_activity_log(user_id, timestamp DESC);
+
+PRAGMA foreign_keys=on;

package/migrations/0014_add_session_geo.sql

@@ -0,0 +1,3 @@
+-- Add latitude and longitude columns to sessions table
+ALTER TABLE sessions ADD COLUMN latitude REAL;
+ALTER TABLE sessions ADD COLUMN longitude REAL;

package/migrations/0015_add_signup_to_activity_log.sql

@@ -0,0 +1,30 @@
+PRAGMA foreign_keys=off;
+
+CREATE TABLE user_activity_log_new (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    action TEXT NOT NULL CHECK(action IN (
+        'signup',
+        'login_success', 'login_fail', 'logout',
+        'password_change_success', 'password_change_fail',
+        'totp_verify_success', 'totp_verify_fail',
+        'totp_setup', 'totp_removed',
+        'recovery_key_used',
+        'session_revoked'
+    )),
+    ip_address TEXT,
+    user_agent TEXT,
+    timestamp INTEGER NOT NULL,
+    extra TEXT,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+INSERT INTO user_activity_log_new SELECT * FROM user_activity_log;
+
+DROP TABLE user_activity_log;
+
+ALTER TABLE user_activity_log_new RENAME TO user_activity_log;
+
+CREATE INDEX IF NOT EXISTS idx_activity_log_user ON user_activity_log(user_id, timestamp DESC);
+
+PRAGMA foreign_keys=on;

package/migrations/0016_add_session_rotation_counter.sql

@@ -0,0 +1,2 @@
+-- Add rotation_counter for Refresh Token Rotation (RTR) tracking
+ALTER TABLE sessions ADD COLUMN rotation_counter INTEGER DEFAULT 0;

package/migrations/0017_add_access_points.sql

@@ -0,0 +1,31 @@
+-- Create access_points table
+CREATE TABLE IF NOT EXISTS access_points (
+    id TEXT PRIMARY KEY,
+    profile_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    token TEXT NOT NULL UNIQUE,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    FOREIGN KEY (profile_id) REFERENCES profiles(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_access_points_profile ON access_points(profile_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_access_points_token ON access_points(token);
+
+-- Backfill access points for existing profiles
+-- We use lower(hex(randomblob(6))) to generate a 12-character hex ID for each existing profile's default access point
+INSERT INTO access_points (id, profile_id, name, token, created_at, updated_at)
+SELECT 
+    lower(hex(randomblob(6))), 
+    id, 
+    'Device-1', 
+    COALESCE(profile_key, lower(id)), 
+    created_at, 
+    updated_at
+FROM profiles;
+
+-- Alter logs table to add access_point_id
+ALTER TABLE logs ADD COLUMN access_point_id TEXT REFERENCES access_points(id) ON DELETE SET NULL;
+
+-- Create an index to speed up log filtering by access point
+CREATE INDEX IF NOT EXISTS idx_logs_access_point ON logs(access_point_id);

package/migrations/0018_add_list_updated_at.sql

@@ -0,0 +1,2 @@
+-- Add list_updated_at column to profiles table
+ALTER TABLE profiles ADD COLUMN list_updated_at INTEGER;

package/migrations/0019_add_list_sync_error.sql

@@ -0,0 +1,2 @@
+-- Add sync_error column to lists table
+ALTER TABLE lists ADD COLUMN sync_error TEXT;

package/migrations/0020_add_session_last_active.sql

@@ -0,0 +1,5 @@
+-- Add last_active_at to sessions table for idle timeout tracking
+ALTER TABLE sessions ADD COLUMN last_active_at INTEGER;
+
+-- Initialize last_active_at for existing sessions
+UPDATE sessions SET last_active_at = COALESCE(created_at, expires_at - 86400) WHERE last_active_at IS NULL;

package/migrations/0021_add_user_timezone.sql

@@ -0,0 +1,2 @@
+-- Add timezone column to users table for customized time formatting
+ALTER TABLE users ADD COLUMN timezone TEXT DEFAULT NULL;

package/migrations/0022_add_user_locale.sql

@@ -0,0 +1,2 @@
+-- Add locale column to users table for customized date and time formatting
+ALTER TABLE users ADD COLUMN locale TEXT DEFAULT 'en-US';

package/migrations/0023_add_user_password_version.sql

@@ -0,0 +1,2 @@
+-- Add password_version to users table
+ALTER TABLE users ADD COLUMN password_version INTEGER DEFAULT 1;

package/migrations/0024_session_pin_and_pause.sql

@@ -0,0 +1,37 @@
+-- Add pin_hash to users
+ALTER TABLE users ADD COLUMN pin_hash TEXT;
+
+-- Add is_paused to sessions
+ALTER TABLE sessions ADD COLUMN is_paused INTEGER DEFAULT 0;
+
+-- Recreate user_activity_log to support pin_verify_success and pin_verify_fail check constraints
+CREATE TABLE IF NOT EXISTS user_activity_log_new (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    action TEXT NOT NULL CHECK(action IN (
+        'signup', 'login_success', 'login_fail', 'logout',
+        'password_change_success', 'password_change_fail',
+        'totp_verify_success', 'totp_verify_fail',
+        'totp_setup', 'totp_removed',
+        'recovery_key_used', 'session_revoked',
+        'pin_verify_success', 'pin_verify_fail'
+    )),
+    ip_address TEXT,
+    user_agent TEXT,
+    timestamp INTEGER NOT NULL,
+    extra TEXT,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+-- Copy data
+INSERT INTO user_activity_log_new (id, user_id, action, ip_address, user_agent, timestamp, extra)
+SELECT id, user_id, action, ip_address, user_agent, timestamp, extra FROM user_activity_log;
+
+-- Drop old table
+DROP TABLE user_activity_log;
+
+-- Rename new table
+ALTER TABLE user_activity_log_new RENAME TO user_activity_log;
+
+-- Recreate index
+CREATE INDEX IF NOT EXISTS idx_activity_log_user ON user_activity_log(user_id, timestamp DESC);

package/migrations/0025_add_secret_table.sql

@@ -0,0 +1,10 @@
+-- Create system_secrets table
+CREATE TABLE IF NOT EXISTS system_secrets (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    updated_at INTEGER NOT NULL
+);
+
+-- Migrate existing jwt_secret from system_settings if it exists
+INSERT OR IGNORE INTO system_secrets (key, value, updated_at)
+SELECT key, value, updated_at FROM system_settings WHERE key = 'jwt_secret';

package/migrations/0026_session_lock_config.sql

@@ -0,0 +1,2 @@
+-- Add session_lock_timeout to users table
+ALTER TABLE users ADD COLUMN session_lock_timeout INTEGER DEFAULT 15;

package/migrations/0027_add_session_id_to_activity_log.sql

@@ -0,0 +1,2 @@
+-- Add session_id column to user_activity_log table
+ALTER TABLE user_activity_log ADD COLUMN session_id TEXT;

package/migrations/0028_rename_session_id_to_session_id_hash.sql

@@ -0,0 +1,2 @@
+-- Rename session_id column to session_id_hash in user_activity_log table
+ALTER TABLE user_activity_log RENAME COLUMN session_id TO session_id_hash;

package/migrations/0029_profile_blooms_staging.sql

@@ -0,0 +1,12 @@
+-- A/B Bloom Filter upgrade: staging table holds the bloom currently being built.
+-- Active DNS queries always read from profile_blooms (the fully-completed bloom).
+-- Once all lists in a sync cycle are done, the staging bloom is atomically
+-- promoted to profile_blooms, eliminating partial/inconsistent states during sync.
+
+CREATE TABLE IF NOT EXISTS profile_blooms_staging (
+  profile_id    TEXT    NOT NULL,
+  chunk_index   INTEGER NOT NULL,
+  bloom_filter_chunk BLOB NOT NULL,
+  updated_at    INTEGER NOT NULL,
+  PRIMARY KEY (profile_id, chunk_index)
+);

package/migrations/0030_add_list_blooms.sql

@@ -0,0 +1,7 @@
+-- Migration to add list-level Bloom Filters
+CREATE TABLE IF NOT EXISTS list_blooms (
+    list_id INTEGER PRIMARY KEY,
+    bloom_filter BLOB NOT NULL,
+    updated_at INTEGER NOT NULL,
+    FOREIGN KEY (list_id) REFERENCES lists(id) ON DELETE CASCADE
+);

package/migrations/0031_list_blooms_chunks.sql

@@ -0,0 +1,13 @@
+-- Migration to recreate list_blooms with chunking support
+DROP TABLE IF EXISTS list_blooms;
+
+CREATE TABLE list_blooms (
+    list_id INTEGER NOT NULL,
+    chunk_index INTEGER NOT NULL,
+    bloom_filter_chunk BLOB NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (list_id, chunk_index),
+    FOREIGN KEY (list_id) REFERENCES lists(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_list_blooms_list ON list_blooms(list_id);

package/migrations/0032_profile_blooms_cascade.sql

@@ -0,0 +1,40 @@
+-- Recreate profile_blooms with foreign key cascade constraint
+CREATE TABLE IF NOT EXISTS profile_blooms_new (
+  profile_id TEXT NOT NULL,
+  chunk_index INTEGER NOT NULL,
+  bloom_filter_chunk BLOB NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (profile_id, chunk_index),
+  FOREIGN KEY (profile_id) REFERENCES profiles(id) ON DELETE CASCADE
+);
+
+-- Copy existing data, automatically filter out orphan records
+INSERT INTO profile_blooms_new (profile_id, chunk_index, bloom_filter_chunk, updated_at)
+SELECT pb.profile_id, pb.chunk_index, pb.bloom_filter_chunk, pb.updated_at
+FROM profile_blooms pb
+INNER JOIN profiles p ON pb.profile_id = p.id;
+
+DROP TABLE profile_blooms;
+ALTER TABLE profile_blooms_new RENAME TO profile_blooms;
+
+-- Recreate profile_blooms_staging with foreign key cascade constraint
+CREATE TABLE IF NOT EXISTS profile_blooms_staging_new (
+  profile_id TEXT NOT NULL,
+  chunk_index INTEGER NOT NULL,
+  bloom_filter_chunk BLOB NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (profile_id, chunk_index),
+  FOREIGN KEY (profile_id) REFERENCES profiles(id) ON DELETE CASCADE
+);
+
+-- Copy existing data, automatically filter out orphan records
+INSERT INTO profile_blooms_staging_new (profile_id, chunk_index, bloom_filter_chunk, updated_at)
+SELECT pbs.profile_id, pbs.chunk_index, pbs.bloom_filter_chunk, pbs.updated_at
+FROM profile_blooms_staging pbs
+INNER JOIN profiles p ON pbs.profile_id = p.id;
+
+DROP TABLE profile_blooms_staging;
+ALTER TABLE profile_blooms_staging_new RENAME TO profile_blooms_staging;
+
+-- Clean up legacy jwt_secret from system_settings table
+DELETE FROM system_settings WHERE key = 'jwt_secret';

package/migrations/0033_remove_system_secrets.sql

@@ -0,0 +1,2 @@
+-- Drop system_secrets table
+DROP TABLE IF EXISTS system_secrets;

package/migrations/0034_remove_list_entries.sql

@@ -0,0 +1,2 @@
+-- Drop obsolete list_entries table
+DROP TABLE IF EXISTS list_entries;

package/migrations/0035_add_envelope_encryption_columns.sql

@@ -0,0 +1,5 @@
+-- Migration to add Envelope Encryption columns for user TOTP secrets
+ALTER TABLE users ADD COLUMN totp_secret_encrypted TEXT;
+ALTER TABLE users ADD COLUMN totp_secret_dek TEXT;
+ALTER TABLE users ADD COLUMN totp_recovery_keys_encrypted TEXT;
+ALTER TABLE users ADD COLUMN totp_recovery_keys_dek TEXT;

package/migrations/0036_add_cf_proxy_cidrs_setting.sql

@@ -0,0 +1,7 @@
+-- 初始化 Cloudflare Proxy CIDR 列表至系统配置表
+INSERT OR IGNORE INTO system_settings (key, value, updated_at) VALUES (
+    'cf_proxy_cidrs',
+    '["173.245.48.0/20","103.21.244.0/22","103.22.200.0/22","103.31.4.0/22","141.101.64.0/18","108.162.192.0/18","190.93.240.0/20","188.114.96.0/20","197.234.240.0/22","198.41.128.0/17","162.158.0.0/15","104.16.0.0/13","104.24.0.0/14","172.64.0.0/13","131.0.72.0/22","2400:cb00::/32","2606:4700::/32","2803:f800::/32","2405:b500::/32","2405:8100::/32","2a06:98c0::/29","2c0f:f248::/32"]',
+    0
+);
+INSERT OR IGNORE INTO system_settings (key, value, updated_at) VALUES ('cf_proxy_cidrs_updated_at', '0', 0);

package/migrations/0037_optimize_logs_composite_indexes.sql

@@ -0,0 +1,25 @@
+-- 1. Composite indexes for high-frequency log filtering with time ordering
+-- Access point filtering
+CREATE INDEX IF NOT EXISTS idx_logs_profile_ap_time ON logs(profile_id, access_point_id, timestamp);
+
+-- Action / status filtering (PASS, BLOCK, etc.)
+CREATE INDEX IF NOT EXISTS idx_logs_profile_action_time ON logs(profile_id, action, timestamp);
+
+-- Client geo-country filtering
+CREATE INDEX IF NOT EXISTS idx_logs_profile_geo_time ON logs(profile_id, geo_country, timestamp);
+
+-- Block / allow reason filtering
+CREATE INDEX IF NOT EXISTS idx_logs_profile_reason_time ON logs(profile_id, reason, timestamp);
+
+-- Exact domain filtering per profile
+CREATE INDEX IF NOT EXISTS idx_logs_profile_domain_time ON logs(profile_id, domain, timestamp);
+
+-- DNS record type filtering (A, AAAA, HTTPS, etc.)
+CREATE INDEX IF NOT EXISTS idx_logs_profile_record_type_time ON logs(profile_id, record_type, timestamp);
+
+-- 2. System indexes to prevent full-table scans during scheduled jobs
+-- Profiles list sync ordering index (eliminates full table scan on cron list sync)
+CREATE INDEX IF NOT EXISTS idx_profiles_list_updated ON profiles(list_updated_at);
+
+-- Sessions expiration range index (eliminates full table scan on expired sessions purge)
+CREATE INDEX IF NOT EXISTS idx_sessions_expires ON sessions(expires_at);

package/migrations/0038_optimize_logs_table_and_indexes.sql

@@ -0,0 +1,49 @@
+-- 1. Create the new optimized logs table
+-- Improvements:
+--   - Removed AUTOINCREMENT: uses SQLite native 64-bit rowid, eliminating 1 read and 1 write to sqlite_sequence per insert
+--   - Removed FOREIGN KEY constraints: eliminates 2 index-seek reads to profiles and access_points per insert
+CREATE TABLE IF NOT EXISTS logs_new (
+    id INTEGER PRIMARY KEY,
+    profile_id TEXT NOT NULL,
+    timestamp INTEGER NOT NULL,
+    client_ip TEXT,
+    geo_country TEXT,
+    domain TEXT NOT NULL,
+    record_type TEXT NOT NULL,
+    action TEXT CHECK(action IN ('PASS', 'BLOCK', 'REDIRECT', 'FAIL')) NOT NULL,
+    reason TEXT,
+    answer TEXT,
+    dest_geoip TEXT,
+    ecs TEXT,
+    upstream TEXT,
+    latency INTEGER,
+    access_point_id TEXT
+);
+
+-- 2. Migrate unexpired logs within 90-day retention window
+-- (Automatically purges expired records, reducing database disk size)
+INSERT INTO logs_new (id, profile_id, timestamp, client_ip, geo_country, domain, record_type, action, reason, answer, dest_geoip, ecs, upstream, latency, access_point_id)
+SELECT id, profile_id, timestamp, client_ip, geo_country, domain, record_type, action, reason, answer, dest_geoip, ecs, upstream, latency, access_point_id
+FROM logs
+WHERE timestamp >= (strftime('%s', 'now') - 7776000);
+
+-- 3. Replace logs table
+DROP TABLE logs;
+ALTER TABLE logs_new RENAME TO logs;
+
+-- 4. Clean up sqlite_sequence entry if present
+DELETE FROM sqlite_sequence WHERE name = 'logs';
+
+-- 5. Create strictly curated composite indexes (3 core indexes)
+-- Baseline time index for default profile queries and range cleanup
+CREATE INDEX IF NOT EXISTS idx_logs_profile_time ON logs(profile_id, timestamp);
+
+-- Device-level time index for access point filtering
+CREATE INDEX IF NOT EXISTS idx_logs_profile_ap_time ON logs(profile_id, access_point_id, timestamp);
+
+-- Action-level time index for ALLOW / BLOCK filtering and top stats
+CREATE INDEX IF NOT EXISTS idx_logs_profile_action_time ON logs(profile_id, action, timestamp);
+
+-- 6. System indexes to prevent full-table scans in background jobs
+CREATE INDEX IF NOT EXISTS idx_profiles_list_updated ON profiles(list_updated_at);
+CREATE INDEX IF NOT EXISTS idx_sessions_expires ON sessions(expires_at);

package/migrations/0039_add_lists_profile_id_index.sql

@@ -0,0 +1,5 @@
+-- Migration 0039: Add indexes to optimize list sync target queries
+-- Accelerates list sync target lookup in profiles and existence check on lists
+
+CREATE INDEX IF NOT EXISTS idx_profiles_list_updated_at ON profiles(list_updated_at);
+CREATE INDEX IF NOT EXISTS idx_lists_profile_id ON lists(profile_id);

package/migrations/0040_reduce_logs_indexes_write_cost.sql

@@ -0,0 +1,9 @@
+-- Migration 0040: Reduce logs index write amplification from 4 to 2 rows per insert
+-- Drops secondary action and access point indexes; retains single primary (profile_id, timestamp) index.
+-- This reduces D1 write rows per DNS log insert/delete by 50% and lowers database storage usage.
+
+DROP INDEX IF EXISTS idx_logs_profile_ap_time;
+DROP INDEX IF EXISTS idx_logs_profile_action_time;
+
+-- Ensure baseline profile time index is present for time-range filtering, pagination, and cleanup
+CREATE INDEX IF NOT EXISTS idx_logs_profile_time ON logs(profile_id, timestamp);

package/migrations/0041_create_log_hourly_rollups.sql

@@ -0,0 +1,21 @@
+-- Migration 0041: Create log_hourly_rollups table for high-performance analytics aggregation
+-- Reduces D1 read row scans on analytics queries (getSummary, getTrend) by >98%
+
+CREATE TABLE IF NOT EXISTS log_hourly_rollups (
+    profile_id TEXT NOT NULL,
+    hour_timestamp INTEGER NOT NULL,
+    action TEXT NOT NULL,
+    count INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (profile_id, hour_timestamp, action)
+);
+
+-- Backfill completed historical hours older than current hour
+INSERT OR REPLACE INTO log_hourly_rollups (profile_id, hour_timestamp, action, count)
+SELECT
+    profile_id,
+    (timestamp / 3600) * 3600 AS hour_timestamp,
+    action,
+    COUNT(*) AS count
+FROM logs
+WHERE timestamp < (CAST(strftime('%s', 'now') AS INTEGER) / 3600) * 3600
+GROUP BY profile_id, (timestamp / 3600) * 3600, action;