emdash 0.0.0-b → 0.0.2

package/src/database/migrations/008_auth.ts

@@ -0,0 +1,194 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+import { binaryType, currentTimestamp, currentTimestampValue } from "../dialect-helpers.js";
+
+/**
+ * Auth migration - passkey-first authentication
+ *
+ * Changes:
+ * - Removes password_hash from users (no passwords)
+ * - Adds role as integer (RBAC levels)
+ * - Adds email_verified, avatar_url, updated_at to users
+ * - Creates credentials table (passkeys)
+ * - Creates auth_tokens table (magic links, invites)
+ * - Creates oauth_accounts table (external provider links)
+ * - Creates allowed_domains table (self-signup)
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// SQLite doesn't support DROP COLUMN directly, so we need to recreate the table
+	// Create new users table with updated schema
+	await db.schema
+		.createTable("users_new")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("email", "text", (col) => col.notNull().unique())
+		.addColumn("name", "text")
+		.addColumn("avatar_url", "text")
+		.addColumn("role", "integer", (col) => col.notNull().defaultTo(10)) // SUBSCRIBER
+		.addColumn("email_verified", "integer", (col) => col.notNull().defaultTo(0))
+		.addColumn("data", "text")
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addColumn("updated_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+
+	// Migrate existing data (map old role strings to new integer levels)
+	await sql`
+		INSERT INTO users_new (id, email, name, role, data, created_at, updated_at)
+		SELECT
+			id,
+			email,
+			name,
+			CASE role
+				WHEN 'admin' THEN 50
+				WHEN 'editor' THEN 40
+				WHEN 'author' THEN 30
+				WHEN 'contributor' THEN 20
+				ELSE 10
+			END,
+			data,
+			created_at,
+			${currentTimestampValue(db)}
+		FROM users
+	`.execute(db);
+
+	// Drop old table and rename new one
+	await db.schema.dropTable("users").execute();
+	await sql`ALTER TABLE users_new RENAME TO users`.execute(db);
+
+	// Recreate index
+	await db.schema.createIndex("idx_users_email").on("users").column("email").execute();
+
+	// Passkey credentials
+	await db.schema
+		.createTable("credentials")
+		.addColumn("id", "text", (col) => col.primaryKey()) // Base64url credential ID
+		.addColumn("user_id", "text", (col) => col.notNull())
+		.addColumn("public_key", binaryType(db), (col) => col.notNull()) // COSE public key
+		.addColumn("counter", "integer", (col) => col.notNull().defaultTo(0))
+		.addColumn("device_type", "text", (col) => col.notNull()) // 'singleDevice' | 'multiDevice'
+		.addColumn("backed_up", "integer", (col) => col.notNull().defaultTo(0))
+		.addColumn("transports", "text") // JSON array
+		.addColumn("name", "text") // User-friendly name
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addColumn("last_used_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addForeignKeyConstraint("credentials_user_fk", ["user_id"], "users", ["id"], (cb) =>
+			cb.onDelete("cascade"),
+		)
+		.execute();
+
+	await db.schema.createIndex("idx_credentials_user").on("credentials").column("user_id").execute();
+
+	// Auth tokens (magic links, email verification, invites, recovery)
+	await db.schema
+		.createTable("auth_tokens")
+		.addColumn("hash", "text", (col) => col.primaryKey()) // SHA-256 hash of token
+		.addColumn("user_id", "text")
+		.addColumn("email", "text") // For pre-user tokens
+		.addColumn("type", "text", (col) => col.notNull()) // 'magic_link' | 'email_verify' | 'invite' | 'recovery'
+		.addColumn("role", "integer") // For invites
+		.addColumn("invited_by", "text")
+		.addColumn("expires_at", "text", (col) => col.notNull())
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addForeignKeyConstraint("auth_tokens_user_fk", ["user_id"], "users", ["id"], (cb) =>
+			cb.onDelete("cascade"),
+		)
+		.addForeignKeyConstraint("auth_tokens_invited_by_fk", ["invited_by"], "users", ["id"], (cb) =>
+			cb.onDelete("set null"),
+		)
+		.execute();
+
+	await db.schema.createIndex("idx_auth_tokens_email").on("auth_tokens").column("email").execute();
+
+	// OAuth accounts (external provider links)
+	await db.schema
+		.createTable("oauth_accounts")
+		.addColumn("provider", "text", (col) => col.notNull())
+		.addColumn("provider_account_id", "text", (col) => col.notNull())
+		.addColumn("user_id", "text", (col) => col.notNull())
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addPrimaryKeyConstraint("oauth_accounts_pk", ["provider", "provider_account_id"])
+		.addForeignKeyConstraint("oauth_accounts_user_fk", ["user_id"], "users", ["id"], (cb) =>
+			cb.onDelete("cascade"),
+		)
+		.execute();
+
+	await db.schema
+		.createIndex("idx_oauth_accounts_user")
+		.on("oauth_accounts")
+		.column("user_id")
+		.execute();
+
+	// Allowed domains for self-signup
+	await db.schema
+		.createTable("allowed_domains")
+		.addColumn("domain", "text", (col) => col.primaryKey())
+		.addColumn("default_role", "integer", (col) => col.notNull().defaultTo(20)) // CONTRIBUTOR
+		.addColumn("enabled", "integer", (col) => col.notNull().defaultTo(1))
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+
+	// WebAuthn challenges (ephemeral, with TTL)
+	await db.schema
+		.createTable("auth_challenges")
+		.addColumn("challenge", "text", (col) => col.primaryKey()) // Base64url challenge
+		.addColumn("type", "text", (col) => col.notNull()) // 'registration' | 'authentication'
+		.addColumn("user_id", "text") // For registration, the user being registered
+		.addColumn("data", "text") // JSON for additional context
+		.addColumn("expires_at", "text", (col) => col.notNull())
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+
+	// Index for efficient cleanup of expired challenges
+	await db.schema
+		.createIndex("idx_auth_challenges_expires")
+		.on("auth_challenges")
+		.column("expires_at")
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	// Drop new tables
+	await db.schema.dropTable("auth_challenges").execute();
+	await db.schema.dropTable("allowed_domains").execute();
+	await db.schema.dropTable("oauth_accounts").execute();
+	await db.schema.dropTable("auth_tokens").execute();
+	await db.schema.dropTable("credentials").execute();
+
+	// Recreate old users table with password_hash
+	await db.schema
+		.createTable("users_old")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("email", "text", (col) => col.notNull().unique())
+		.addColumn("password_hash", "text", (col) => col.notNull())
+		.addColumn("name", "text")
+		.addColumn("role", "text", (col) => col.defaultTo("subscriber"))
+		.addColumn("avatar_id", "text")
+		.addColumn("data", "text")
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+
+	// Migrate data back (users will have empty password_hash)
+	await sql`
+		INSERT INTO users_old (id, email, password_hash, name, role, data, created_at)
+		SELECT
+			id,
+			email,
+			'', -- No way to restore password
+			name,
+			CASE role
+				WHEN 50 THEN 'admin'
+				WHEN 40 THEN 'editor'
+				WHEN 30 THEN 'author'
+				WHEN 20 THEN 'contributor'
+				ELSE 'subscriber'
+			END,
+			data,
+			created_at
+		FROM users
+	`.execute(db);
+
+	await db.schema.dropTable("users").execute();
+	await sql`ALTER TABLE users_old RENAME TO users`.execute(db);
+
+	await db.schema.createIndex("idx_users_email").on("users").column("email").execute();
+}

package/src/database/migrations/009_user_disabled.ts

@@ -0,0 +1,27 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+/**
+ * User disabled column - for soft-disabling users
+ *
+ * Changes:
+ * - Adds disabled column to users table (INTEGER, default 0)
+ * - Disabled users cannot log in
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// SQLite supports ADD COLUMN
+	await sql`ALTER TABLE users ADD COLUMN disabled INTEGER NOT NULL DEFAULT 0`.execute(db);
+
+	// Create index for querying active users
+	await db.schema.createIndex("idx_users_disabled").on("users").column("disabled").execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	// SQLite doesn't support DROP COLUMN directly, but we can drop the index
+	// For full rollback, table would need to be recreated
+	await db.schema.dropIndex("idx_users_disabled").execute();
+
+	// SQLite 3.35.0+ supports DROP COLUMN, but for compatibility:
+	// We'll leave the column but document that it's deprecated
+	// In production, you'd recreate the table without the column
+}

package/src/database/migrations/011_sections.ts

@@ -0,0 +1,65 @@
+import { type Kysely, sql } from "kysely";
+
+/**
+ * Migration: Add sections tables and performance indexes
+ *
+ * Sections are reusable content blocks that can be inserted into any Portable Text field.
+ * They provide a library of pre-built page sections (heroes, CTAs, testimonials, etc.)
+ * that content authors can browse and insert with a single click.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// Section categories table
+	await db.schema
+		.createTable("_emdash_section_categories")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("slug", "text", (col) => col.notNull().unique())
+		.addColumn("label", "text", (col) => col.notNull())
+		.addColumn("sort_order", "integer", (col) => col.defaultTo(0))
+		.addColumn("created_at", "text", (col) => col.defaultTo(sql`CURRENT_TIMESTAMP`))
+		.execute();
+
+	// Sections table
+	await db.schema
+		.createTable("_emdash_sections")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("slug", "text", (col) => col.notNull().unique())
+		.addColumn("title", "text", (col) => col.notNull())
+		.addColumn("description", "text")
+		// Categorization
+		.addColumn("category_id", "text", (col) =>
+			col.references("_emdash_section_categories.id").onDelete("set null"),
+		)
+		.addColumn("keywords", "text") // JSON array for search
+		// Content (Portable Text array)
+		.addColumn("content", "text", (col) => col.notNull()) // JSON
+		// Preview image (optional)
+		.addColumn("preview_media_id", "text")
+		// Source tracking
+		.addColumn("source", "text", (col) => col.notNull().defaultTo("user")) // 'theme', 'user', 'import'
+		.addColumn("theme_id", "text") // Which theme provided it (if source='theme')
+		// Metadata
+		.addColumn("created_at", "text", (col) => col.defaultTo(sql`CURRENT_TIMESTAMP`))
+		.addColumn("updated_at", "text", (col) => col.defaultTo(sql`CURRENT_TIMESTAMP`))
+		.execute();
+
+	// Index for efficient category lookups
+	await db.schema
+		.createIndex("idx_sections_category")
+		.on("_emdash_sections")
+		.columns(["category_id"])
+		.execute();
+
+	// Index for filtering by source
+	await db.schema
+		.createIndex("idx_sections_source")
+		.on("_emdash_sections")
+		.columns(["source"])
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropIndex("idx_content_taxonomies_term").execute();
+	await db.schema.dropIndex("idx_media_mime_type").execute();
+	await db.schema.dropTable("_emdash_sections").execute();
+	await db.schema.dropTable("_emdash_section_categories").execute();
+}

package/src/database/migrations/012_search.ts

@@ -0,0 +1,25 @@
+import type { Kysely } from "kysely";
+
+/**
+ * Migration: Search Support
+ *
+ * Adds search configuration to collections and searchable flag to fields.
+ * FTS5 tables are created dynamically when search is enabled for a collection.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// Add search_config to collections (JSON: { enabled, weights })
+	await db.schema.alterTable("_emdash_collections").addColumn("search_config", "text").execute();
+
+	// Add searchable flag to fields
+	await db.schema
+		.alterTable("_emdash_fields")
+		.addColumn("searchable", "integer", (col) => col.defaultTo(0))
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	// SQLite doesn't support DROP COLUMN in older versions, but modern SQLite does
+	// These columns are safe to drop
+	await db.schema.alterTable("_emdash_fields").dropColumn("searchable").execute();
+	await db.schema.alterTable("_emdash_collections").dropColumn("search_config").execute();
+}

package/src/database/migrations/013_scheduled_publishing.ts

@@ -0,0 +1,51 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+import { listTablesLike } from "../dialect-helpers.js";
+
+/**
+ * Migration: Add scheduled publishing support
+ *
+ * Adds scheduled_at column to all ec_* content tables.
+ * When scheduled_at is set and status is 'scheduled', the content
+ * will be auto-published when the scheduled time is reached.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// Get all ec_* content tables
+	const tableNames = await listTablesLike(db, "ec_%");
+
+	// Add scheduled_at column to each content table
+	for (const tableName of tableNames) {
+		const table = { name: tableName };
+		await sql`
+			ALTER TABLE ${sql.ref(table.name)} 
+			ADD COLUMN scheduled_at TEXT
+		`.execute(db);
+
+		// Create index for efficient scheduled content queries
+		await sql`
+			CREATE INDEX ${sql.ref(`idx_${table.name}_scheduled`)} 
+			ON ${sql.ref(table.name)} (scheduled_at)
+			WHERE scheduled_at IS NOT NULL AND status = 'scheduled'
+		`.execute(db);
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	// Get all ec_* content tables
+	const tableNames = await listTablesLike(db, "ec_%");
+
+	// Drop scheduled_at column from each content table
+	for (const tableName of tableNames) {
+		const table = { name: tableName };
+		// Drop index first
+		await sql`
+			DROP INDEX IF EXISTS ${sql.ref(`idx_${table.name}_scheduled`)}
+		`.execute(db);
+
+		await sql`
+			ALTER TABLE ${sql.ref(table.name)} 
+			DROP COLUMN scheduled_at
+		`.execute(db);
+	}
+}

package/src/database/migrations/014_draft_revisions.ts

@@ -0,0 +1,72 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// Get all content tables
+	const tables = await db
+		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Kysely migration runs against unknown schema
+		.selectFrom("_emdash_collections" as never)
+		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Kysely migration runs against unknown schema
+		.select("slug" as never)
+		.execute();
+
+	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Kysely execute returns unknown[]; narrowing to known shape
+	for (const row of tables as Array<{ slug: string }>) {
+		const tableName = `ec_${row.slug}`;
+
+		// Add live_revision_id column
+		await sql`
+			ALTER TABLE ${sql.ref(tableName)}
+			ADD COLUMN live_revision_id TEXT REFERENCES revisions(id)
+		`.execute(db);
+
+		// Add draft_revision_id column
+		await sql`
+			ALTER TABLE ${sql.ref(tableName)}
+			ADD COLUMN draft_revision_id TEXT REFERENCES revisions(id)
+		`.execute(db);
+
+		// Create indexes for the new columns
+		await sql`
+			CREATE INDEX ${sql.ref(`idx_${row.slug}_live_revision`)}
+			ON ${sql.ref(tableName)} (live_revision_id)
+		`.execute(db);
+
+		await sql`
+			CREATE INDEX ${sql.ref(`idx_${row.slug}_draft_revision`)}
+			ON ${sql.ref(tableName)} (draft_revision_id)
+		`.execute(db);
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	const tables = await db
+		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Kysely migration runs against unknown schema
+		.selectFrom("_emdash_collections" as never)
+		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Kysely migration runs against unknown schema
+		.select("slug" as never)
+		.execute();
+
+	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Kysely execute returns unknown[]; narrowing to known shape
+	for (const row of tables as Array<{ slug: string }>) {
+		const tableName = `ec_${row.slug}`;
+
+		await sql`
+			DROP INDEX IF EXISTS ${sql.ref(`idx_${row.slug}_draft_revision`)}
+		`.execute(db);
+
+		await sql`
+			DROP INDEX IF EXISTS ${sql.ref(`idx_${row.slug}_live_revision`)}
+		`.execute(db);
+
+		await sql`
+			ALTER TABLE ${sql.ref(tableName)}
+			DROP COLUMN draft_revision_id
+		`.execute(db);
+
+		await sql`
+			ALTER TABLE ${sql.ref(tableName)}
+			DROP COLUMN live_revision_id
+		`.execute(db);
+	}
+}

package/src/database/migrations/015_indexes.ts

@@ -0,0 +1,82 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+import { listTablesLike } from "../dialect-helpers.js";
+
+/**
+ * Add performance indexes for common query patterns.
+ *
+ * Covers:
+ * 1. Media table: mime_type, filename, created_at
+ * 2. content_taxonomies: reverse lookup by taxonomy_id
+ * 3. taxonomies: parent_id FK
+ * 4. audit_logs: compound (resource_type, resource_id)
+ * 5. Retroactive author_id + updated_at on existing ec_* content tables
+ *    (new tables get these from createContentTable() in registry.ts)
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// ── Media indexes ────────────────────────────────────────────────
+	await db.schema.createIndex("idx_media_mime_type").on("media").column("mime_type").execute();
+	await db.schema.createIndex("idx_media_filename").on("media").column("filename").execute();
+	await db.schema.createIndex("idx_media_created_at").on("media").column("created_at").execute();
+
+	// ── Taxonomy indexes ─────────────────────────────────────────────
+	// Reverse lookup: find entries with a specific term
+	await db.schema
+		.createIndex("idx_content_taxonomies_term")
+		.on("content_taxonomies")
+		.column("taxonomy_id")
+		.execute();
+
+	// Hierarchical queries filter on parent_id FK
+	await db.schema
+		.createIndex("idx_taxonomies_parent")
+		.on("taxonomies")
+		.column("parent_id")
+		.execute();
+
+	// ── Audit log indexes ────────────────────────────────────────────
+	// findByResource() compound query
+	await db.schema
+		.createIndex("idx_audit_resource")
+		.on("audit_logs")
+		.columns(["resource_type", "resource_id"])
+		.execute();
+
+	// ── Retroactive content table indexes ────────────────────────────
+	// Add author_id and updated_at indexes to all existing ec_* tables.
+	// New tables created after this migration get these from createContentTable().
+	const tableNames = await listTablesLike(db, "ec_%");
+
+	for (const tableName of tableNames) {
+		const table = { name: tableName };
+		await sql`
+			CREATE INDEX ${sql.ref(`idx_${table.name}_author`)} 
+			ON ${sql.ref(table.name)} (author_id)
+		`.execute(db);
+
+		await sql`
+			CREATE INDEX ${sql.ref(`idx_${table.name}_updated`)} 
+			ON ${sql.ref(table.name)} (updated_at)
+		`.execute(db);
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	// Drop retroactive content table indexes
+	const tableNames = await listTablesLike(db, "ec_%");
+
+	for (const tableName of tableNames) {
+		const table = { name: tableName };
+		await sql`DROP INDEX IF EXISTS ${sql.ref(`idx_${table.name}_updated`)}`.execute(db);
+		await sql`DROP INDEX IF EXISTS ${sql.ref(`idx_${table.name}_author`)}`.execute(db);
+	}
+
+	// Drop system table indexes
+	await db.schema.dropIndex("idx_audit_resource").execute();
+	await db.schema.dropIndex("idx_taxonomies_parent").execute();
+	await db.schema.dropIndex("idx_content_taxonomies_term").execute();
+	await db.schema.dropIndex("idx_media_created_at").execute();
+	await db.schema.dropIndex("idx_media_filename").execute();
+	await db.schema.dropIndex("idx_media_mime_type").execute();
+}

package/src/database/migrations/016_api_tokens.ts

@@ -0,0 +1,89 @@
+import type { Kysely } from "kysely";
+
+import { currentTimestamp } from "../dialect-helpers.js";
+
+/**
+ * API token tables for programmatic access.
+ *
+ * Three tables:
+ * 1. _emdash_api_tokens — Personal Access Tokens (ec_pat_...)
+ * 2. _emdash_oauth_tokens — OAuth access/refresh tokens (ec_oat_/ec_ort_...)
+ * 3. _emdash_device_codes — OAuth Device Flow state (RFC 8628)
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// ── Personal Access Tokens ───────────────────────────────────────
+	await db.schema
+		.createTable("_emdash_api_tokens")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("name", "text", (col) => col.notNull())
+		.addColumn("token_hash", "text", (col) => col.notNull().unique())
+		.addColumn("prefix", "text", (col) => col.notNull())
+		.addColumn("user_id", "text", (col) => col.notNull())
+		.addColumn("scopes", "text", (col) => col.notNull()) // JSON array
+		.addColumn("expires_at", "text") // null = no expiry
+		.addColumn("last_used_at", "text")
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addForeignKeyConstraint("api_tokens_user_fk", ["user_id"], "users", ["id"], (cb) =>
+			cb.onDelete("cascade"),
+		)
+		.execute();
+
+	await db.schema
+		.createIndex("idx_api_tokens_token_hash")
+		.on("_emdash_api_tokens")
+		.column("token_hash")
+		.execute();
+
+	await db.schema
+		.createIndex("idx_api_tokens_user_id")
+		.on("_emdash_api_tokens")
+		.column("user_id")
+		.execute();
+
+	// ── OAuth Tokens ─────────────────────────────────────────────────
+	await db.schema
+		.createTable("_emdash_oauth_tokens")
+		.addColumn("token_hash", "text", (col) => col.primaryKey())
+		.addColumn("token_type", "text", (col) => col.notNull()) // 'access' | 'refresh'
+		.addColumn("user_id", "text", (col) => col.notNull())
+		.addColumn("scopes", "text", (col) => col.notNull()) // JSON array
+		.addColumn("client_type", "text", (col) => col.notNull().defaultTo("cli"))
+		.addColumn("expires_at", "text", (col) => col.notNull())
+		.addColumn("refresh_token_hash", "text") // links access → refresh
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addForeignKeyConstraint("oauth_tokens_user_fk", ["user_id"], "users", ["id"], (cb) =>
+			cb.onDelete("cascade"),
+		)
+		.execute();
+
+	await db.schema
+		.createIndex("idx_oauth_tokens_user_id")
+		.on("_emdash_oauth_tokens")
+		.column("user_id")
+		.execute();
+
+	await db.schema
+		.createIndex("idx_oauth_tokens_expires")
+		.on("_emdash_oauth_tokens")
+		.column("expires_at")
+		.execute();
+
+	// ── Device Codes (OAuth Device Flow, RFC 8628) ───────────────────
+	await db.schema
+		.createTable("_emdash_device_codes")
+		.addColumn("device_code", "text", (col) => col.primaryKey())
+		.addColumn("user_code", "text", (col) => col.notNull().unique())
+		.addColumn("scopes", "text", (col) => col.notNull()) // JSON array
+		.addColumn("user_id", "text") // set when user authorizes
+		.addColumn("status", "text", (col) => col.notNull().defaultTo("pending"))
+		.addColumn("expires_at", "text", (col) => col.notNull())
+		.addColumn("interval", "integer", (col) => col.notNull().defaultTo(5))
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropTable("_emdash_device_codes").execute();
+	await db.schema.dropTable("_emdash_oauth_tokens").execute();
+	await db.schema.dropTable("_emdash_api_tokens").execute();
+}

package/src/database/migrations/017_authorization_codes.ts

@@ -0,0 +1,45 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+import { currentTimestamp } from "../dialect-helpers.js";
+
+/**
+ * Authorization codes for OAuth 2.1 Authorization Code + PKCE flow.
+ *
+ * Used by MCP clients (Claude Desktop, VS Code, etc.) to authenticate
+ * via the standard OAuth authorization code grant.
+ *
+ * Also adds client_id tracking to oauth_tokens for per-client revocation.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await db.schema
+		.createTable("_emdash_authorization_codes")
+		.addColumn("code_hash", "text", (col) => col.primaryKey()) // SHA-256 hash of authorization code
+		.addColumn("client_id", "text", (col) => col.notNull()) // CIMD URL or opaque string
+		.addColumn("redirect_uri", "text", (col) => col.notNull()) // Must match exactly on exchange
+		.addColumn("user_id", "text", (col) => col.notNull())
+		.addColumn("scopes", "text", (col) => col.notNull()) // JSON array
+		.addColumn("code_challenge", "text", (col) => col.notNull()) // S256 challenge
+		.addColumn("code_challenge_method", "text", (col) => col.notNull().defaultTo("S256"))
+		.addColumn("resource", "text") // RFC 8707 resource indicator
+		.addColumn("expires_at", "text", (col) => col.notNull())
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addForeignKeyConstraint("auth_codes_user_fk", ["user_id"], "users", ["id"], (cb) =>
+			cb.onDelete("cascade"),
+		)
+		.execute();
+
+	await db.schema
+		.createIndex("idx_auth_codes_expires")
+		.on("_emdash_authorization_codes")
+		.column("expires_at")
+		.execute();
+
+	// Track which client obtained a token (for per-client revocation)
+	await sql`ALTER TABLE _emdash_oauth_tokens ADD COLUMN client_id TEXT`.execute(db);
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropTable("_emdash_authorization_codes").execute();
+	// SQLite doesn't support DROP COLUMN, but this is only for dev rollback
+}