fluxmail 0.4.1 → 0.6.0

package/dist/storage/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/storage/db.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGjF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUnB,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcpB,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW/B,CAAC;AAEF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOtB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO7B,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyBxB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBlB,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc5B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWhC,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMvB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB3B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,qBAAqB,CAAC;AA6I/C,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CA2HjD"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/storage/db.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AASjF,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAC5C,eAAO,MAAM,0BAA0B,IAAuB,CAAC;AAC/D,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAKrC,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAGnC,QAAQ,CAAC,aAAa,EAAE,kBAAkB;IAFtD,QAAQ,CAAC,IAAI,wBAAwB;gBAEhB,aAAa,EAAE,kBAAkB;CAcvD;AAED,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWnB,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcpB,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW/B,CAAC;AAEF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOtB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ7B,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyBxB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBlB,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe1B,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkB5B,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ1B,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG3B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe5B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWhC,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMvB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB3B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,qBAAqB,CAAC;AA0M/C,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,CAAC;AAExE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,wBAAwB,CAwCzG;AAiBD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,SAA4D,GAClE,kBAAkB,CAUpB;AAwQD,wBAAgB,MAAM,CACpB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,UAAU,CAkBZ;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAUzD"}

package/dist/storage/db.js

@@ -1,11 +1,39 @@
 import Database from 'better-sqlite3';
 import { drizzle } from 'drizzle-orm/better-sqlite3';
 import { index, integer, primaryKey, sqliteTable, text, uniqueIndex } from 'drizzle-orm/sqlite-core';
+import { existsSync, mkdirSync, statSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import path from 'node:path';
+import { VERSION } from '../version.js';
+import { decryptString } from './crypto.js';
+import { withFileLock } from './fileLock.js';
+export const CURRENT_STORE_FORMAT = 2;
+export const MIN_SUPPORTED_STORE_FORMAT = 1;
+export const MAX_SUPPORTED_STORE_FORMAT = CURRENT_STORE_FORMAT;
+export const LEGACY_STORE_FORMAT = 0;
+const MIGRATION_LOCK_TIMEOUT_MS = 5 * 60_000;
+const MIGRATION_LOCK_STALE_MS = 30 * 60_000;
+export class IncompatibleStoreError extends Error {
+    compatibility;
+    code = 'incompatible_store';
+    constructor(compatibility) {
+        const supportedFormats = compatibility.minimumSupportedFormat === compatibility.maximumSupportedFormat
+            ? `format ${compatibility.minimumSupportedFormat}`
+            : `formats ${compatibility.minimumSupportedFormat} through ${compatibility.maximumSupportedFormat}`;
+        const action = compatibility.storeFormat > compatibility.maximumSupportedFormat
+            ? 'Update Fluxmail'
+            : 'Use a Fluxmail version that supports this store';
+        super(`This Fluxmail data uses store format ${compatibility.storeFormat}, but Fluxmail ${compatibility.engineVersion} supports ${supportedFormats}. ${action} before opening ${compatibility.dataDir}. Fluxmail did not change the store.`);
+        this.compatibility = compatibility;
+        this.name = 'IncompatibleStoreError';
+    }
+}
 export const members = sqliteTable('members', {
     id: text('id').primaryKey(),
     name: text('name').notNull(),
     email: text('email'),
     role: text('role').notNull().default('member'),
+    status: text('status').notNull().default('pending'),
     createdAt: integer('created_at').notNull(),
 }, (table) => [uniqueIndex('members_email_unique').on(table.email)]);
 export const accounts = sqliteTable('accounts', {
@@ -15,11 +43,11 @@ export const accounts = sqliteTable('accounts', {
     displayName: text('display_name'),
     status: text('status').notNull().default('active'),
     createdAt: integer('created_at').notNull(),
-    /** Owning member. NULL is retained only for migrated installs with no members. */
-    memberId: text('member_id').references(() => members.id, { onDelete: 'set null' }),
-    sharingMode: text('sharing_mode').notNull().default('private'),
+    /** Transitional nulls only exist until a migrated installation claims its first administrator. */
+    ownerMemberId: text('member_id').references(() => members.id, { onDelete: 'restrict' }),
+    sharedWithAll: integer('shared_with_all', { mode: 'boolean' }).notNull().default(false),
 }, (table) => [uniqueIndex('accounts_provider_email_unique').on(table.provider, table.email)]);
-export const accountMemberShares = sqliteTable('account_member_shares', {
+export const accountMemberGrants = sqliteTable('account_member_grants', {
     accountId: text('account_id')
         .notNull()
         .references(() => accounts.id, { onDelete: 'cascade' }),
@@ -42,6 +70,7 @@ export const accountCredentials = sqliteTable('account_credentials', {
     /** AES-256-GCM encrypted provider-specific credentials. */
     encryptedCredentials: text('encrypted_credentials').notNull(),
     updatedAt: integer('updated_at').notNull(),
+    revision: integer('revision').notNull().default(1),
 });
 export const imapMessages = sqliteTable('imap_messages', {
     id: text('id').primaryKey(),
@@ -72,8 +101,10 @@ export const apiKeys = sqliteTable('api_keys', {
     keyHash: text('key_hash').notNull().unique(),
     createdAt: integer('created_at').notNull(),
     lastUsedAt: integer('last_used_at'),
-    /** Member the key was issued to; NULL is reserved for migrated system credentials. */
-    memberId: text('member_id').references(() => members.id, { onDelete: 'set null' }),
+    /** Member the key was issued to. */
+    memberId: text('member_id')
+        .notNull()
+        .references(() => members.id, { onDelete: 'cascade' }),
     /** Named MCP permission profile, or "custom" when customCapabilities is populated. */
     permissionProfile: text('permission_profile').notNull().default('full'),
     /** JSON array of explicit MCP capabilities for custom policies. */
@@ -83,12 +114,57 @@ export const apiKeys = sqliteTable('api_keys', {
     /** NULL means no extra narrowing; otherwise a JSON array of canonical account ids. */
     accountIds: text('account_ids'),
 });
+export const memberCredentials = sqliteTable('member_credentials', {
+    memberId: text('member_id')
+        .primaryKey()
+        .references(() => members.id, { onDelete: 'cascade' }),
+    passwordHash: text('password_hash').notNull(),
+    passwordVersion: integer('password_version').notNull().default(1),
+    updatedAt: integer('updated_at').notNull(),
+});
+export const memberSessions = sqliteTable('member_sessions', {
+    id: text('id').primaryKey(),
+    memberId: text('member_id')
+        .notNull()
+        .references(() => members.id, { onDelete: 'cascade' }),
+    tokenHash: text('token_hash').notNull().unique(),
+    deviceName: text('device_name').notNull(),
+    createdAt: integer('created_at').notNull(),
+    expiresAt: integer('expires_at').notNull(),
+    lastUsedAt: integer('last_used_at').notNull(),
+    revokedAt: integer('revoked_at'),
+}, (table) => [index('member_sessions_member').on(table.memberId), index('member_sessions_expiry').on(table.expiresAt)]);
+export const memberAuthTokens = sqliteTable('member_auth_tokens', {
+    id: text('id').primaryKey(),
+    memberId: text('member_id')
+        .notNull()
+        .references(() => members.id, { onDelete: 'cascade' }),
+    kind: text('kind').notNull(),
+    tokenHash: text('token_hash').notNull().unique(),
+    createdByMemberId: text('created_by_member_id').references(() => members.id, { onDelete: 'set null' }),
+    createdAt: integer('created_at').notNull(),
+    expiresAt: integer('expires_at').notNull(),
+    usedAt: integer('used_at'),
+}, (table) => [
+    index('member_auth_tokens_member').on(table.memberId),
+    index('member_auth_tokens_expiry').on(table.expiresAt),
+]);
+export const authRateLimits = sqliteTable('auth_rate_limits', {
+    key: text('key').primaryKey(),
+    attempts: integer('attempts').notNull(),
+    windowStartedAt: integer('window_started_at').notNull(),
+}, (table) => [index('auth_rate_limits_window').on(table.windowStartedAt)]);
+export const instanceSettings = sqliteTable('instance_settings', {
+    key: text('key').primaryKey(),
+    value: text('value').notNull(),
+});
 export const adminAuditEvents = sqliteTable('admin_audit_events', {
     id: integer('id').primaryKey({ autoIncrement: true }),
     timestamp: integer('timestamp').notNull(),
     operation: text('operation').notNull(),
     outcome: text('outcome').notNull(),
     actorKeyId: text('actor_key_id'),
+    actorSessionId: text('actor_session_id'),
     actorMemberId: text('actor_member_id'),
     resourceType: text('resource_type'),
     resourceId: text('resource_id'),
@@ -98,10 +174,10 @@ export const gmailConnectionGrants = sqliteTable('gmail_connection_grants', {
     /** SHA-256 hex digest. The raw token is printed once and never stored. */
     tokenHash: text('token_hash').primaryKey(),
     scope: text('scope').notNull(),
-    memberId: text('member_id'),
+    ownerMemberId: text('owner_member_id'),
     reauthorizeAccountId: text('reauthorize_account_id'),
-    sharingMode: text('sharing_mode'),
-    sharedMemberIds: text('shared_member_ids'),
+    sharedWithAll: integer('shared_with_all', { mode: 'boolean' }),
+    grantedMemberIds: text('granted_member_ids'),
     createdAt: integer('created_at').notNull(),
     expiresAt: integer('expires_at').notNull(),
     consumedAt: integer('consumed_at'),
@@ -152,6 +228,7 @@ CREATE TABLE IF NOT EXISTS members (
   name TEXT NOT NULL,
   email TEXT,
   role TEXT NOT NULL DEFAULT 'member',
+  status TEXT NOT NULL DEFAULT 'pending',
   created_at INTEGER NOT NULL
 );
 CREATE UNIQUE INDEX IF NOT EXISTS members_email_unique ON members(email);
@@ -162,10 +239,10 @@ CREATE TABLE IF NOT EXISTS accounts (
   display_name TEXT,
   status TEXT NOT NULL DEFAULT 'active',
   created_at INTEGER NOT NULL,
-  member_id TEXT REFERENCES members(id) ON DELETE SET NULL,
-  sharing_mode TEXT NOT NULL DEFAULT 'private'
+  member_id TEXT REFERENCES members(id) ON DELETE RESTRICT,
+  shared_with_all INTEGER NOT NULL DEFAULT 0
 );
-CREATE TABLE IF NOT EXISTS account_member_shares (
+CREATE TABLE IF NOT EXISTS account_member_grants (
   account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
   member_id TEXT NOT NULL REFERENCES members(id) ON DELETE CASCADE,
   PRIMARY KEY (account_id, member_id)
@@ -178,7 +255,8 @@ CREATE TABLE IF NOT EXISTS oauth_tokens (
 CREATE TABLE IF NOT EXISTS account_credentials (
   account_id TEXT PRIMARY KEY REFERENCES accounts(id) ON DELETE CASCADE,
   encrypted_credentials TEXT NOT NULL,
-  updated_at INTEGER NOT NULL
+  updated_at INTEGER NOT NULL,
+  revision INTEGER NOT NULL DEFAULT 1
 );
 CREATE TABLE IF NOT EXISTS imap_messages (
   id TEXT PRIMARY KEY,
@@ -209,18 +287,59 @@ CREATE TABLE IF NOT EXISTS api_keys (
   key_hash TEXT NOT NULL UNIQUE,
   created_at INTEGER NOT NULL,
   last_used_at INTEGER,
-  member_id TEXT REFERENCES members(id) ON DELETE SET NULL,
+  member_id TEXT NOT NULL REFERENCES members(id) ON DELETE CASCADE,
   permission_profile TEXT NOT NULL DEFAULT 'full',
   custom_capabilities TEXT,
   supplemental_capabilities TEXT NOT NULL DEFAULT '[]',
   account_ids TEXT
 );
+CREATE TABLE IF NOT EXISTS member_credentials (
+  member_id TEXT PRIMARY KEY REFERENCES members(id) ON DELETE CASCADE,
+  password_hash TEXT NOT NULL,
+  password_version INTEGER NOT NULL DEFAULT 1,
+  updated_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS member_sessions (
+  id TEXT PRIMARY KEY,
+  member_id TEXT NOT NULL REFERENCES members(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  device_name TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  last_used_at INTEGER NOT NULL,
+  revoked_at INTEGER
+);
+CREATE INDEX IF NOT EXISTS member_sessions_member ON member_sessions(member_id);
+CREATE INDEX IF NOT EXISTS member_sessions_expiry ON member_sessions(expires_at);
+CREATE TABLE IF NOT EXISTS member_auth_tokens (
+  id TEXT PRIMARY KEY,
+  member_id TEXT NOT NULL REFERENCES members(id) ON DELETE CASCADE,
+  kind TEXT NOT NULL,
+  token_hash TEXT NOT NULL UNIQUE,
+  created_by_member_id TEXT REFERENCES members(id) ON DELETE SET NULL,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER
+);
+CREATE INDEX IF NOT EXISTS member_auth_tokens_member ON member_auth_tokens(member_id);
+CREATE INDEX IF NOT EXISTS member_auth_tokens_expiry ON member_auth_tokens(expires_at);
+CREATE TABLE IF NOT EXISTS auth_rate_limits (
+  key TEXT PRIMARY KEY,
+  attempts INTEGER NOT NULL,
+  window_started_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS auth_rate_limits_window ON auth_rate_limits(window_started_at);
+CREATE TABLE IF NOT EXISTS instance_settings (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
 CREATE TABLE IF NOT EXISTS admin_audit_events (
   id INTEGER PRIMARY KEY AUTOINCREMENT,
   timestamp INTEGER NOT NULL,
   operation TEXT NOT NULL,
   outcome TEXT NOT NULL,
   actor_key_id TEXT,
+  actor_session_id TEXT,
   actor_member_id TEXT,
   resource_type TEXT,
   resource_id TEXT,
@@ -228,13 +347,23 @@ CREATE TABLE IF NOT EXISTS admin_audit_events (
 );
 CREATE INDEX IF NOT EXISTS admin_audit_events_timestamp
   ON admin_audit_events(timestamp);
+CREATE TRIGGER IF NOT EXISTS admin_audit_events_no_update
+  BEFORE UPDATE ON admin_audit_events
+  BEGIN
+    SELECT RAISE(ABORT, 'security audit events are append-only');
+  END;
+CREATE TRIGGER IF NOT EXISTS admin_audit_events_no_delete
+  BEFORE DELETE ON admin_audit_events
+  BEGIN
+    SELECT RAISE(ABORT, 'security audit events are append-only');
+  END;
 CREATE TABLE IF NOT EXISTS gmail_connection_grants (
   token_hash TEXT PRIMARY KEY,
   scope TEXT NOT NULL,
-  member_id TEXT,
+  owner_member_id TEXT,
   reauthorize_account_id TEXT,
-  sharing_mode TEXT,
-  shared_member_ids TEXT,
+  shared_with_all INTEGER,
+  granted_member_ids TEXT,
   created_at INTEGER NOT NULL,
   expires_at INTEGER NOT NULL,
   consumed_at INTEGER
@@ -281,21 +410,108 @@ CREATE INDEX IF NOT EXISTS rest_idempotency_expires_at
 function tableColumns(sqlite, table) {
     return new Set(sqlite.prepare(`PRAGMA table_info(${table})`).all().map((column) => column.name));
 }
-export function openDb(dbPath) {
-    const sqlite = new Database(dbPath);
-    sqlite.pragma('journal_mode = WAL');
-    sqlite.pragma('foreign_keys = ON');
-    sqlite.exec(BOOTSTRAP_SQL);
+function readStoreFormat(sqlite) {
+    return sqlite.pragma('user_version', { simple: true });
+}
+function sqliteTableExists(sqlite, table) {
+    return Boolean(sqlite.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table));
+}
+export function inspectStoreEncryptionKey(dbPath, encryptionKey) {
+    if (dbPath === ':memory:' || !existsSync(dbPath) || statSync(dbPath).size === 0)
+        return 'empty';
+    const sqlite = new Database(dbPath, { readonly: true, fileMustExist: true });
+    try {
+        const encryptedValues = [];
+        if (sqliteTableExists(sqlite, 'account_credentials')) {
+            encryptedValues.push(...sqlite.prepare('SELECT encrypted_credentials AS value FROM account_credentials').all().map((row) => row.value));
+        }
+        if (sqliteTableExists(sqlite, 'oauth_tokens')) {
+            encryptedValues.push(...sqlite.prepare('SELECT encrypted_tokens AS value FROM oauth_tokens').all().map((row) => row.value));
+        }
+        if (sqliteTableExists(sqlite, 'instance_settings')) {
+            encryptedValues.push(...sqlite.prepare("SELECT value FROM instance_settings WHERE value LIKE 'v1:%'").all().map((row) => row.value.slice('v1:'.length)));
+        }
+        if (!encryptedValues.length)
+            return 'empty';
+        try {
+            for (const value of encryptedValues)
+                decryptString(encryptionKey, value);
+            return 'matches';
+        }
+        catch {
+            return 'mismatch';
+        }
+    }
+    finally {
+        sqlite.close();
+    }
+}
+function compatibilityFor(dbPath, dataDir, storeFormat) {
+    return {
+        engineVersion: VERSION,
+        dataDir,
+        dbPath,
+        storeFormat,
+        minimumSupportedFormat: MIN_SUPPORTED_STORE_FORMAT,
+        maximumSupportedFormat: MAX_SUPPORTED_STORE_FORMAT,
+        compatible: storeFormat === LEGACY_STORE_FORMAT ||
+            (storeFormat >= MIN_SUPPORTED_STORE_FORMAT && storeFormat <= MAX_SUPPORTED_STORE_FORMAT),
+        requiresMigration: storeFormat === LEGACY_STORE_FORMAT || storeFormat < CURRENT_STORE_FORMAT,
+    };
+}
+export function inspectStoreCompatibility(dbPath, dataDir = dbPath === ':memory:' ? ':memory:' : path.dirname(dbPath)) {
+    if (dbPath === ':memory:' || !existsSync(dbPath) || statSync(dbPath).size === 0) {
+        return compatibilityFor(dbPath, dataDir, LEGACY_STORE_FORMAT);
+    }
+    const sqlite = new Database(dbPath, { readonly: true, fileMustExist: true });
+    try {
+        return compatibilityFor(dbPath, dataDir, readStoreFormat(sqlite));
+    }
+    finally {
+        sqlite.close();
+    }
+}
+function assertCompatible(compatibility) {
+    if (!compatibility.compatible)
+        throw new IncompatibleStoreError(compatibility);
+}
+function backupForMigration(sqlite, dbPath, fromFormat, toFormat) {
+    if (dbPath === ':memory:' || !existsSync(dbPath) || statSync(dbPath).size === 0)
+        return undefined;
+    const backupDir = path.join(path.dirname(dbPath), 'backups');
+    mkdirSync(backupDir, { recursive: true });
+    const stamp = new Date().toISOString().replaceAll(/[:.]/g, '-');
+    const databaseName = path.basename(dbPath, path.extname(dbPath)) || 'fluxmail';
+    const suffix = randomBytes(4).toString('hex');
+    const destination = path.join(backupDir, `${databaseName}-format-${fromFormat}-to-${toFormat}-${stamp}-${process.pid}-${suffix}.db`);
+    sqlite.exec(`VACUUM INTO '${destination.replaceAll("'", "''")}'`);
+    return destination;
+}
+function syncLegacyCredentialRows(sqlite) {
     // Keep the generic credential row in sync if an older binary updated the
     // legacy Gmail token table before this version reopened the database.
     sqlite.exec(`
-    INSERT INTO account_credentials (account_id, encrypted_credentials, updated_at)
-    SELECT account_id, encrypted_tokens, updated_at FROM oauth_tokens WHERE true
+    INSERT INTO account_credentials (account_id, encrypted_credentials, updated_at, revision)
+    SELECT account_id, encrypted_tokens, updated_at, 1 FROM oauth_tokens WHERE true
     ON CONFLICT(account_id) DO UPDATE SET
       encrypted_credentials = excluded.encrypted_credentials,
-      updated_at = excluded.updated_at
+      updated_at = excluded.updated_at,
+      revision = account_credentials.revision + 1
     WHERE excluded.updated_at > account_credentials.updated_at
   `);
+}
+function migrateToFormatOne(sqlite) {
+    const existingMemberColumns = tableColumns(sqlite, 'members');
+    const existingApiKeyColumns = tableColumns(sqlite, 'api_keys');
+    const existingAccountColumns = tableColumns(sqlite, 'accounts');
+    const hadLegacyAccountShares = tableColumns(sqlite, 'account_member_shares').size > 0;
+    const legacyAuthentication = (existingMemberColumns.size > 0 && !existingMemberColumns.has('status')) ||
+        (existingMemberColumns.size === 0 && existingApiKeyColumns.size > 0);
+    sqlite.exec(BOOTSTRAP_SQL);
+    const credentialCols = tableColumns(sqlite, 'account_credentials');
+    if (!credentialCols.has('revision')) {
+        sqlite.exec('ALTER TABLE account_credentials ADD COLUMN revision INTEGER NOT NULL DEFAULT 1');
+    }
     const scheduledCols = tableColumns(sqlite, 'scheduled_sends');
     if (!scheduledCols.has('claim_token'))
         sqlite.exec('ALTER TABLE scheduled_sends ADD COLUMN claim_token TEXT');
@@ -310,29 +526,35 @@ export function openDb(dbPath) {
       WHERE id = (SELECT id FROM members ORDER BY created_at, id LIMIT 1)
     `);
     }
+    if (!memberCols.has('status')) {
+        sqlite.exec("ALTER TABLE members ADD COLUMN status TEXT NOT NULL DEFAULT 'pending'");
+    }
     if (!tableColumns(sqlite, 'accounts').has('member_id')) {
         sqlite.exec('ALTER TABLE accounts ADD COLUMN member_id TEXT REFERENCES members(id) ON DELETE SET NULL');
     }
     const accountCols = tableColumns(sqlite, 'accounts');
-    if (!accountCols.has('sharing_mode')) {
-        sqlite.exec('ALTER TABLE accounts ADD COLUMN sharing_mode TEXT');
-        sqlite.exec("UPDATE accounts SET sharing_mode = CASE WHEN member_id IS NULL THEN 'all' ELSE 'private' END");
+    if (!accountCols.has('shared_with_all')) {
+        sqlite.exec('ALTER TABLE accounts ADD COLUMN shared_with_all INTEGER NOT NULL DEFAULT 0');
+        sqlite.exec(existingAccountColumns.has('sharing_mode')
+            ? "UPDATE accounts SET shared_with_all = CASE WHEN sharing_mode = 'all' THEN 1 ELSE 0 END"
+            : 'UPDATE accounts SET shared_with_all = CASE WHEN member_id IS NULL THEN 1 ELSE 0 END');
     }
     sqlite.exec(`
-    CREATE TABLE IF NOT EXISTS account_member_shares (
+    CREATE TABLE IF NOT EXISTS account_member_grants (
       account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
       member_id TEXT NOT NULL REFERENCES members(id) ON DELETE CASCADE,
       PRIMARY KEY (account_id, member_id)
     )
   `);
-    // Migrated ownerless mailboxes remain shared with all, but receive an owner
-    // when the installation already has a member.
-    sqlite.exec(`
-    UPDATE accounts SET member_id = (
-      SELECT id FROM members ORDER BY CASE role WHEN 'admin' THEN 0 ELSE 1 END, created_at, id LIMIT 1
-    )
-    WHERE member_id IS NULL AND sharing_mode = 'all' AND EXISTS (SELECT 1 FROM members)
-  `);
+    if (hadLegacyAccountShares) {
+        sqlite.exec(`
+      INSERT OR IGNORE INTO account_member_grants (account_id, member_id)
+      SELECT account_id, member_id FROM account_member_shares
+    `);
+        sqlite.exec('DROP TABLE account_member_shares');
+    }
+    if (accountCols.has('sharing_mode'))
+        sqlite.exec('ALTER TABLE accounts DROP COLUMN sharing_mode');
     if (!tableColumns(sqlite, 'api_keys').has('member_id')) {
         sqlite.exec('ALTER TABLE api_keys ADD COLUMN member_id TEXT REFERENCES members(id) ON DELETE SET NULL');
     }
@@ -345,9 +567,10 @@ export function openDb(dbPath) {
     }
     if (!apiKeyCols.has('supplemental_capabilities')) {
         sqlite.exec("ALTER TABLE api_keys ADD COLUMN supplemental_capabilities TEXT NOT NULL DEFAULT '[]'");
-        // Preserve the account-management authority that admin and memberless keys
-        // held before administrative capabilities existed. Broader capabilities
-        // must still be granted explicitly.
+        // Preserve the account-management authority held by legacy administrator
+        // keys before administrative capabilities existed. Broader capabilities
+        // must still be granted explicitly. The breaking auth migration below
+        // revokes these keys before authenticated service access resumes.
         sqlite.exec(`
       UPDATE api_keys
       SET supplemental_capabilities = '["admin.accounts"]'
@@ -373,13 +596,55 @@ export function openDb(dbPath) {
     if (!apiKeyCols.has('account_ids')) {
         sqlite.exec('ALTER TABLE api_keys ADD COLUMN account_ids TEXT');
     }
+    if (legacyAuthentication)
+        sqlite.exec('DELETE FROM api_keys');
+    if (!tableColumns(sqlite, 'admin_audit_events').has('actor_session_id')) {
+        sqlite.exec('ALTER TABLE admin_audit_events ADD COLUMN actor_session_id TEXT');
+    }
     const grantCols = tableColumns(sqlite, 'gmail_connection_grants');
-    if (!grantCols.has('sharing_mode')) {
-        sqlite.exec('ALTER TABLE gmail_connection_grants ADD COLUMN sharing_mode TEXT');
+    if (!grantCols.has('owner_member_id')) {
+        sqlite.exec('ALTER TABLE gmail_connection_grants ADD COLUMN owner_member_id TEXT');
+        if (grantCols.has('member_id')) {
+            sqlite.exec('UPDATE gmail_connection_grants SET owner_member_id = member_id');
+        }
+    }
+    if (!grantCols.has('shared_with_all')) {
+        sqlite.exec('ALTER TABLE gmail_connection_grants ADD COLUMN shared_with_all INTEGER');
+        if (grantCols.has('sharing_mode')) {
+            sqlite.exec("UPDATE gmail_connection_grants SET shared_with_all = CASE sharing_mode WHEN 'all' THEN 1 WHEN 'explicit' THEN 0 ELSE NULL END");
+        }
     }
-    if (!grantCols.has('shared_member_ids')) {
-        sqlite.exec('ALTER TABLE gmail_connection_grants ADD COLUMN shared_member_ids TEXT');
+    if (!grantCols.has('granted_member_ids')) {
+        sqlite.exec('ALTER TABLE gmail_connection_grants ADD COLUMN granted_member_ids TEXT');
+        if (grantCols.has('shared_member_ids')) {
+            sqlite.exec('UPDATE gmail_connection_grants SET granted_member_ids = shared_member_ids');
+        }
     }
+    if (grantCols.has('member_id'))
+        sqlite.exec('ALTER TABLE gmail_connection_grants DROP COLUMN member_id');
+    if (grantCols.has('sharing_mode'))
+        sqlite.exec('ALTER TABLE gmail_connection_grants DROP COLUMN sharing_mode');
+    if (grantCols.has('shared_member_ids')) {
+        sqlite.exec('ALTER TABLE gmail_connection_grants DROP COLUMN shared_member_ids');
+    }
+    // Login emails are case-insensitive. Keep the earliest duplicate address
+    // and require later legacy records to receive a new email before enrollment.
+    sqlite.exec(`
+    UPDATE members
+    SET email = NULL
+    WHERE email IS NOT NULL
+      AND EXISTS (
+        SELECT 1 FROM members AS winner
+        WHERE winner.email IS NOT NULL
+          AND lower(winner.email) = lower(members.email)
+          AND (
+            winner.created_at < members.created_at
+            OR (winner.created_at = members.created_at AND winner.id < members.id)
+          )
+      )
+  `);
+    sqlite.exec('DROP INDEX IF EXISTS members_email_unique');
+    sqlite.exec('CREATE UNIQUE INDEX IF NOT EXISTS members_email_unique_ci ON members(lower(email))');
     // Account identity is the mailbox address, regardless of provider. Gmail
     // wins when an older database contains the same address as both Gmail and IMAP.
     sqlite.exec(`
@@ -403,6 +668,79 @@ export function openDb(dbPath) {
   `);
     sqlite.exec('DROP INDEX IF EXISTS accounts_provider_email_unique');
     sqlite.exec('CREATE UNIQUE INDEX IF NOT EXISTS accounts_email_unique_ci ON accounts(lower(email))');
-    return drizzle(sqlite);
+    sqlite.exec(`
+    INSERT INTO instance_settings (key, value) VALUES ('schema_version', '2')
+    ON CONFLICT(key) DO UPDATE SET value = excluded.value
+  `);
+    sqlite.exec(`
+    INSERT OR IGNORE INTO instance_settings (key, value) VALUES ('bootstrap_complete', '0')
+  `);
+}
+function migrateToFormatTwo(_sqlite) {
+    // Format 2 reserves encrypted instance settings for OAuth applications and
+    // license state. The instance_settings table was created by format 1.
+}
+const MIGRATIONS = [
+    { format: 1, run: migrateToFormatOne },
+    { format: 2, run: migrateToFormatTwo },
+];
+function openCompatibleDb(dbPath, dataDir, options) {
+    const sqlite = new Database(dbPath);
+    try {
+        sqlite.pragma('busy_timeout = 5000');
+        sqlite.pragma('foreign_keys = ON');
+        const beforeMigration = compatibilityFor(dbPath, dataDir, readStoreFormat(sqlite));
+        assertCompatible(beforeMigration);
+        if (beforeMigration.requiresMigration && options.backupBeforeMigration !== false) {
+            backupForMigration(sqlite, dbPath, beforeMigration.storeFormat, CURRENT_STORE_FORMAT);
+        }
+        const migrate = sqlite.transaction(() => {
+            let storeFormat = readStoreFormat(sqlite);
+            assertCompatible(compatibilityFor(dbPath, dataDir, storeFormat));
+            for (const migration of MIGRATIONS) {
+                if (storeFormat >= migration.format)
+                    continue;
+                migration.run(sqlite);
+                sqlite.pragma(`user_version = ${migration.format}`);
+                storeFormat = migration.format;
+            }
+            if (storeFormat !== CURRENT_STORE_FORMAT) {
+                throw new Error(`Fluxmail has no migration from store format ${storeFormat} to ${CURRENT_STORE_FORMAT}`);
+            }
+            syncLegacyCredentialRows(sqlite);
+        });
+        migrate.immediate();
+        sqlite.pragma('journal_mode = WAL');
+        return drizzle(sqlite);
+    }
+    catch (error) {
+        sqlite.close();
+        throw error;
+    }
+}
+export function openDb(dbPath, options = {}) {
+    const dataDir = options.dataDir ?? (dbPath === ':memory:' ? ':memory:' : path.dirname(dbPath));
+    const inspected = inspectStoreCompatibility(dbPath, dataDir);
+    assertCompatible(inspected);
+    if (dbPath === ':memory:' || !inspected.requiresMigration) {
+        return openCompatibleDb(dbPath, dataDir, options);
+    }
+    return withFileLock(`${dbPath}.migration.lock`, {
+        timeoutMs: MIGRATION_LOCK_TIMEOUT_MS,
+        staleMs: MIGRATION_LOCK_STALE_MS,
+        description: `migration of ${dbPath}`,
+    }, () => openCompatibleDb(dbPath, dataDir, options));
+}
+export function openReadonlyDb(dbPath) {
+    const sqlite = new Database(dbPath, { readonly: true, fileMustExist: true });
+    try {
+        sqlite.pragma('query_only = ON');
+        sqlite.pragma('foreign_keys = ON');
+        return drizzle(sqlite);
+    }
+    catch (error) {
+        sqlite.close();
+        throw error;
+    }
 }
 //# sourceMappingURL=db.js.map