hearth-dash 1.1.2 → 1.1.3

package/cli/lib/wrangler.js

@@ -1,100 +1,150 @@
-import { spawn } from "node:child_process";
-import { readFileSync } from "node:fs";
-
-function spawnCmd(cmd, args, opts) {
-  if (process.platform === "win32") {
-    const full = [cmd, ...args].map((a) => a.includes(" ") ? `"${a}"` : a).join(" ");
-    return spawn(full, [], { ...opts, shell: true });
-  }
-  return spawn(cmd, args, opts);
-}
-
-export function execWrangler(args, cwd, stdinData) {
-  return new Promise((resolve) => {
-    const proc = spawnCmd("npx", ["wrangler", ...args], {
-      cwd, stdio: ["pipe", "pipe", "pipe"],
-      env: { ...process.env, FORCE_COLOR: "0" },
-    });
-    let stdout = "", stderr = "";
-    proc.stdout.on("data", (d) => { stdout += d.toString(); });
-    proc.stderr.on("data", (d) => { stderr += d.toString(); });
-    if (stdinData) { proc.stdin.write(stdinData); proc.stdin.end(); }
-    else { proc.stdin.end(); }
-    proc.on("close", (code) => resolve({ stdout: stdout.trim(), stderr: stderr.trim(), code }));
-  });
-}
-
-export function execCommand(command, args, cwd) {
-  return new Promise((resolve) => {
-    const proc = spawnCmd(command, args, {
-      cwd, stdio: ['ignore', 'pipe', 'pipe'],
-      env: { ...process.env, FORCE_COLOR: '0' },
-    });
-    let stdout = '', stderr = '';
-    proc.stdout.on('data', (data) => { stdout += data.toString(); });
-    proc.stderr.on('data', (data) => { stderr += data.toString(); });
-    proc.on('close', (code) => resolve({ stdout: stdout.trim(), stderr: stderr.trim(), code }));
-  });
-}
-
-export function parseD1CreateOutput(output) {
-  const combined = output.stdout + "\n" + output.stderr;
-  const match = combined.match(/database_id\s*=\s*"([^"]+)"/);
-  return match ? match[1] : null;
-}
-
-export function parseDeployOutput(output) {
-  const combined = output.stdout + "\n" + output.stderr;
-  const match = combined.match(/https:\/\/[^\s)]+\.workers\.dev/);
-  return match ? match[0] : null;
-}
-
-export async function checkWranglerAuth(cwd) {
-  const result = await execWrangler(["whoami"], cwd);
-  if (result.code !== 0) return false;
-  const combined = result.stdout + result.stderr;
-  return !combined.includes("Not logged in") && !combined.includes("not authenticated");
-}
-
-export async function wranglerLogin(cwd) {
-  return new Promise((resolve) => {
-    const proc = spawnCmd("npx", ["wrangler", "login"], { cwd, stdio: "inherit" });
-    proc.on("close", (code) => resolve(code === 0));
-  });
-}
-
-export async function setSecret(name, value, cwd) {
-  return execWrangler(["secret", "put", name], cwd, value + "\n");
-}
-
-export async function executeSchema(dbName, schemaPath, cwd) {
-  const result = await execWrangler(["d1", "execute", dbName, "--remote", "--file=" + schemaPath], cwd);
-  if (result.code === 0) return { ok: true };
-  const sql = readFileSync(schemaPath, "utf-8");
-  const statements = sql.split(";").map((s) => s.trim()).filter((s) => s.length > 0);
-  for (const stmt of statements) {
-    const r = await execWrangler(["d1", "execute", dbName, "--remote", "--command", stmt + ";"], cwd);
-    if (r.code !== 0) return { ok: false, error: r.stderr || r.stdout };
-  }
-  return { ok: true };
-}
-
-export async function listD1Databases(cwd) {
-  const result = await execWrangler(["d1", "list", "--json"], cwd);
-  if (result.code !== 0) return [];
-  try { return JSON.parse(result.stdout); } catch { return []; }
-}
-
-export async function listKvNamespaces(cwd) {
-  const result = await execWrangler(['kv', 'namespace', 'list'], cwd);
-  if (result.code !== 0) return [];
-  try { return JSON.parse(result.stdout); } catch { return []; }
-}
-
-export function parseKvCreateOutput(output) {
-  const combined = output.stdout + '\n' + output.stderr;
-  const toml = combined.match(/id\s*=\s*"([a-f0-9]{32})"/i);
-  if (toml) return toml[1];
-  const json = combined.match(/"id"\s*:\s*"([a-f0-9]{32})"/i);
-  return json ? json[1] : null;
-}
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+function spawnCmd(cmd, args, opts) {
+  if (process.platform === "win32") {
+    const full = [cmd, ...args].map((a) => a.includes(" ") ? `"${a}"` : a).join(" ");
+    return spawn(full, [], { ...opts, shell: true });
+  }
+  return spawn(cmd, args, opts);
+}
+
+export function execWrangler(args, cwd, stdinData) {
+  return new Promise((resolve) => {
+    const proc = spawnCmd("npx", ["wrangler", ...args], {
+      cwd, stdio: ["pipe", "pipe", "pipe"],
+      env: { ...process.env, FORCE_COLOR: "0" },
+    });
+    let stdout = "", stderr = "";
+    proc.stdout.on("data", (d) => { stdout += d.toString(); });
+    proc.stderr.on("data", (d) => { stderr += d.toString(); });
+    if (stdinData) { proc.stdin.write(stdinData); proc.stdin.end(); }
+    else { proc.stdin.end(); }
+    proc.on("close", (code) => resolve({ stdout: stdout.trim(), stderr: stderr.trim(), code }));
+  });
+}
+
+export function execCommand(command, args, cwd) {
+  return new Promise((resolve) => {
+    const proc = spawnCmd(command, args, {
+      cwd, stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, FORCE_COLOR: '0' },
+    });
+    let stdout = '', stderr = '';
+    proc.stdout.on('data', (data) => { stdout += data.toString(); });
+    proc.stderr.on('data', (data) => { stderr += data.toString(); });
+    proc.on('close', (code) => resolve({ stdout: stdout.trim(), stderr: stderr.trim(), code }));
+  });
+}
+
+export function parseD1CreateOutput(output) {
+  const combined = output.stdout + "\n" + output.stderr;
+  const match = combined.match(/database_id\s*=\s*"([^"]+)"/);
+  return match ? match[1] : null;
+}
+
+export function parseDeployOutput(output) {
+  const combined = output.stdout + "\n" + output.stderr;
+  const match = combined.match(/https:\/\/[^\s)]+\.workers\.dev/);
+  return match ? match[0] : null;
+}
+
+export async function checkWranglerAuth(cwd) {
+  const result = await execWrangler(["whoami"], cwd);
+  if (result.code !== 0) return false;
+  const combined = result.stdout + result.stderr;
+  return !combined.includes("Not logged in") && !combined.includes("not authenticated");
+}
+
+export async function wranglerLogin(cwd) {
+  return new Promise((resolve) => {
+    const proc = spawnCmd("npx", ["wrangler", "login"], { cwd, stdio: "inherit" });
+    proc.on("close", (code) => resolve(code === 0));
+  });
+}
+
+export async function setSecret(name, value, cwd) {
+  return execWrangler(["secret", "put", name], cwd, value + "\n");
+}
+
+export async function executeSchema(dbName, schemaPath, cwd) {
+  const result = await execWrangler(["d1", "execute", dbName, "--remote", "--file=" + schemaPath], cwd);
+  if (result.code === 0) return { ok: true };
+  const sql = readFileSync(schemaPath, "utf-8");
+  const statements = sql.split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+  for (const stmt of statements) {
+    const r = await execWrangler(["d1", "execute", dbName, "--remote", "--command", stmt + ";"], cwd);
+    if (r.code !== 0) return { ok: false, error: r.stderr || r.stdout };
+  }
+  return { ok: true };
+}
+
+export function hasRequiredSchemaTables(output, requiredTables) {
+  try {
+    const parsed = JSON.parse(output);
+    const envelopes = Array.isArray(parsed) ? parsed : [parsed];
+    const names = new Set(envelopes.flatMap(item => item?.results || []).map(row => row.name));
+    return requiredTables.every(name => names.has(name));
+  } catch {
+    return false;
+  }
+}
+
+export function hasRequiredOAuthCsrfColumns(output) {
+  try {
+    const parsed = JSON.parse(output);
+    const envelopes = Array.isArray(parsed) ? parsed : [parsed];
+    const columns = new Map(envelopes.flatMap(item => item?.results || []).map(row => [row.name, row]));
+    const token = columns.get('token');
+    const fingerprint = columns.get('request_fingerprint');
+    const expires = columns.get('expires_at');
+    return columns.size === 3
+      && String(token?.type).toUpperCase() === 'TEXT' && Number(token?.pk) === 1
+      && String(fingerprint?.type).toUpperCase() === 'TEXT' && Number(fingerprint?.notnull) === 1
+      && String(expires?.type).toUpperCase() === 'INTEGER' && Number(expires?.notnull) === 1;
+  } catch {
+    return false;
+  }
+}
+
+export async function verifySecuritySchema(dbName, cwd) {
+  const requiredTables = ['rate_limits', 'oauth_csrf_tokens'];
+  const quoted = requiredTables.map(name => `'${name.replaceAll("'", "''")}'`).join(', ');
+  const query = `SELECT name FROM sqlite_master WHERE type = 'table' AND name IN (${quoted}) ORDER BY name;`;
+  const tables = await execWrangler(['d1', 'execute', dbName, '--remote', '--command', query, '--json'], cwd);
+  if (tables.code !== 0 || !hasRequiredSchemaTables(tables.stdout, requiredTables)) return false;
+  const columns = await execWrangler([
+    'd1', 'execute', dbName, '--remote', '--command', 'PRAGMA table_info(oauth_csrf_tokens);', '--json',
+  ], cwd);
+  return columns.code === 0 && hasRequiredOAuthCsrfColumns(columns.stdout);
+}
+
+export async function provisionAfterVerifiedSchema({ applySchema, verifySchema, provisionWorker, onSchemaVerified = () => {} }) {
+  const schemaResult = await applySchema();
+  if (!schemaResult.ok) return { ok: false, stage: 'schema', schemaResult };
+  const schemaVerified = await verifySchema();
+  if (!schemaVerified) return { ok: false, stage: 'verification', schemaResult };
+  onSchemaVerified();
+  const provisionResult = await provisionWorker();
+  return { ok: provisionResult.code === 0, stage: 'provision', schemaResult, provisionResult };
+}
+
+export async function listD1Databases(cwd) {
+  const result = await execWrangler(["d1", "list", "--json"], cwd);
+  if (result.code !== 0) return [];
+  try { return JSON.parse(result.stdout); } catch { return []; }
+}
+
+export async function listKvNamespaces(cwd) {
+  const result = await execWrangler(['kv', 'namespace', 'list'], cwd);
+  if (result.code !== 0) return [];
+  try { return JSON.parse(result.stdout); } catch { return []; }
+}
+
+export function parseKvCreateOutput(output) {
+  const combined = output.stdout + '\n' + output.stderr;
+  const toml = combined.match(/id\s*=\s*"([a-f0-9]{32})"/i);
+  if (toml) return toml[1];
+  const json = combined.match(/"id"\s*:\s*"([a-f0-9]{32})"/i);
+  return json ? json[1] : null;
+}

package/oauth-entry.js

@@ -1,47 +1,47 @@
-import { OAuthProvider } from '@cloudflare/workers-oauth-provider';
-import { applicationHandler, isOAuthRoute, oauthApiHandler, oauthDefaultHandler, withinRateLimit } from './worker.js';
-
-const OAUTH_SCOPES = ['hearth:read', 'hearth:write'];
-
-function createOAuthProvider(request, env) {
-  const origin = new URL(request.url).origin;
-  const resource = `${origin}/mcp`;
-  return new OAuthProvider({
-    apiRoute: '/mcp',
-    apiHandler: oauthApiHandler,
-    defaultHandler: oauthDefaultHandler,
-    authorizeEndpoint: '/authorize',
-    tokenEndpoint: '/oauth/token',
-    clientRegistrationEndpoint: '/oauth/register',
-    async clientRegistrationCallback({ request: registrationRequest }) {
-      const allowed = await withinRateLimit(env, registrationRequest, 'oauth-register', 20, 3600);
-      if (!allowed) {
-        return { code: 'access_denied', description: 'Too many client registrations. Try again later.', status: 429 };
-      }
-    },
-    clientIdMetadataDocumentEnabled: true,
-    scopesSupported: OAUTH_SCOPES,
-    accessTokenTTL: 3600,
-    refreshTokenTTL: 30 * 24 * 60 * 60,
-    clientRegistrationTTL: 90 * 24 * 60 * 60,
-    resourceMetadata: {
-      resource,
-      authorization_servers: [origin],
-      scopes_supported: ['hearth:read'],
-      bearer_methods_supported: ['header'],
-      resource_name: 'Hearth Dash',
-    },
-  });
-}
-
-export default {
-  fetch(request, env, ctx) {
-    // Keep ordinary dashboard traffic out of the OAuth provider. Besides being
-    // unnecessary, wrapping /login and /api requests can obscure the browser's
-    // public origin on some Cloudflare routes and make valid CSRF checks fail.
-    if (!isOAuthRoute(new URL(request.url).pathname)) {
-      return applicationHandler.fetch(request, env, ctx);
-    }
-    return createOAuthProvider(request, env).fetch(request, env, ctx);
-  },
-};
+import { OAuthProvider } from '@cloudflare/workers-oauth-provider';
+import { applicationHandler, isOAuthRoute, oauthApiHandler, oauthDefaultHandler, withinRateLimit } from './worker.js';
+
+const OAUTH_SCOPES = ['hearth:read', 'hearth:write'];
+
+function createOAuthProvider(request, env) {
+  const origin = new URL(request.url).origin;
+  const resource = `${origin}/mcp`;
+  return new OAuthProvider({
+    apiRoute: '/mcp',
+    apiHandler: oauthApiHandler,
+    defaultHandler: oauthDefaultHandler,
+    authorizeEndpoint: '/authorize',
+    tokenEndpoint: '/oauth/token',
+    clientRegistrationEndpoint: '/oauth/register',
+    async clientRegistrationCallback({ request: registrationRequest }) {
+      const allowed = await withinRateLimit(env, registrationRequest, 'oauth-register', 20, 3600);
+      if (!allowed) {
+        return { code: 'access_denied', description: 'Too many client registrations. Try again later.', status: 429 };
+      }
+    },
+    clientIdMetadataDocumentEnabled: true,
+    scopesSupported: OAUTH_SCOPES,
+    accessTokenTTL: 3600,
+    refreshTokenTTL: 30 * 24 * 60 * 60,
+    clientRegistrationTTL: 90 * 24 * 60 * 60,
+    resourceMetadata: {
+      resource,
+      authorization_servers: [origin],
+      scopes_supported: ['hearth:read'],
+      bearer_methods_supported: ['header'],
+      resource_name: 'Hearth Dash',
+    },
+  });
+}
+
+export default {
+  fetch(request, env, ctx) {
+    // Keep ordinary dashboard traffic out of the OAuth provider. Besides being
+    // unnecessary, wrapping /login and /api requests can obscure the browser's
+    // public origin on some Cloudflare routes and make valid CSRF checks fail.
+    if (!isOAuthRoute(new URL(request.url).pathname)) {
+      return applicationHandler.fetch(request, env, ctx);
+    }
+    return createOAuthProvider(request, env).fetch(request, env, ctx);
+  },
+};

package/package.json

@@ -1,47 +1,47 @@
-{
-  "name": "hearth-dash",
-  "version": "1.1.2",
-  "description": "Personal dashboard — moods, moments, food diary, weather, and more. Deploy to Cloudflare in one command.",
-  "type": "module",
-  "bin": {
-    "hearth-dash": "cli/index.js"
-  },
-  "scripts": {
-    "test": "node --test",
-    "dev": "npx wrangler dev",
-    "deploy": "npx wrangler deploy",
-    "db:init": "npx wrangler d1 execute hearth-dash-db --file schema.sql",
-    "db:init:remote": "npx wrangler d1 execute hearth-dash-db --remote --file schema.sql"
-  },
-  "keywords": [
-    "dashboard",
-    "cloudflare-workers",
-    "mcp",
-    "mood-tracker",
-    "food-diary",
-    "weather",
-    "personal"
-  ],
-  "author": "AIDHD",
-  "license": "SEE LICENSE IN LICENSE",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/martusha89/hearth-dash.git"
-  },
-  "engines": {
-    "node": ">=22"
-  },
-  "files": [
-    "worker.js",
-    "oauth-entry.js",
-    "schema.sql",
-    "wrangler.toml",
-    "cli/",
-    "README.md",
-    "LICENSE"
-  ],
-  "dependencies": {
-    "@cloudflare/workers-oauth-provider": "0.10.3",
-    "wrangler": "4.135.0"
-  }
-}
+{
+  "name": "hearth-dash",
+  "version": "1.1.3",
+  "description": "Personal dashboard — moods, moments, food diary, weather, and more. Deploy to Cloudflare in one command.",
+  "type": "module",
+  "bin": {
+    "hearth-dash": "cli/index.js"
+  },
+  "scripts": {
+    "test": "node --test",
+    "dev": "npx wrangler dev",
+    "deploy": "npx wrangler deploy",
+    "db:init": "npx wrangler d1 execute hearth-dash-db --file schema.sql",
+    "db:init:remote": "npx wrangler d1 execute hearth-dash-db --remote --file schema.sql"
+  },
+  "keywords": [
+    "dashboard",
+    "cloudflare-workers",
+    "mcp",
+    "mood-tracker",
+    "food-diary",
+    "weather",
+    "personal"
+  ],
+  "author": "AIDHD",
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/martusha89/hearth-dash.git"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "files": [
+    "worker.js",
+    "oauth-entry.js",
+    "schema.sql",
+    "wrangler.toml",
+    "cli/",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@cloudflare/workers-oauth-provider": "0.10.3",
+    "wrangler": "4.135.0"
+  }
+}

package/schema.sql

@@ -1,95 +1,104 @@
--- Hearth Dash — Database Schema
--- Deploy: npx wrangler d1 execute hearth-dash-db --file schema.sql
-
-CREATE TABLE IF NOT EXISTS config (
-  key TEXT PRIMARY KEY,
-  value TEXT NOT NULL
-);
-
--- v1.0.1's first-visit setup stored the dashboard password as plaintext.
--- Authentication now uses Cloudflare Worker secrets; remove any legacy copy.
-DELETE FROM config WHERE key = 'password';
-
-CREATE TABLE IF NOT EXISTS moods (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  partner TEXT NOT NULL,
-  mood TEXT NOT NULL,
-  note TEXT,
-  created_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS notes (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  from_partner TEXT NOT NULL,
-  content TEXT NOT NULL,
-  created_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS moments (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  date TEXT NOT NULL,
-  title TEXT NOT NULL,
-  description TEXT,
-  created_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS dates (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  date TEXT NOT NULL,
-  title TEXT NOT NULL,
-  recurring INTEGER DEFAULT 0,
-  created_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS shopping (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  item TEXT NOT NULL,
-  category TEXT DEFAULT 'Other',
-  checked INTEGER DEFAULT 0,
-  added_by TEXT NOT NULL,
-  created_at TEXT NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS pressure_log (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  pressure_hpa REAL NOT NULL,
-  temp REAL,
-  recorded_at TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_pressure_recorded ON pressure_log(recorded_at);
-
-CREATE TABLE IF NOT EXISTS food_diary (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  date TEXT NOT NULL,
-  time TEXT NOT NULL,
-  meal_type TEXT NOT NULL,
-  note TEXT,
-  photo_key TEXT,
-  created_at TEXT DEFAULT (datetime('now'))
-);
-CREATE INDEX IF NOT EXISTS idx_food_diary_date ON food_diary(date);
-
-CREATE TABLE IF NOT EXISTS water_log (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  date TEXT NOT NULL,
-  amount_ml INTEGER NOT NULL,
-  created_at TEXT DEFAULT (datetime('now'))
-);
-CREATE INDEX IF NOT EXISTS idx_water_log_date ON water_log(date);
-
-CREATE TABLE IF NOT EXISTS food_reviews (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  date TEXT UNIQUE NOT NULL,
-  review TEXT NOT NULL,
-  reviewer TEXT NOT NULL DEFAULT 'AI',
-  created_at TEXT DEFAULT (datetime('now'))
-);
-CREATE INDEX IF NOT EXISTS idx_food_reviews_date ON food_reviews(date);
-
--- Coarse per-IP request buckets. IP addresses are hashed before storage.
-CREATE TABLE IF NOT EXISTS rate_limits (
-  bucket_key TEXT PRIMARY KEY,
-  count INTEGER NOT NULL DEFAULT 1,
-  expires_at INTEGER NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_rate_limits_expires ON rate_limits(expires_at);
+-- Hearth Dash — Database Schema
+-- Deploy: npx wrangler d1 execute hearth-dash-db --file schema.sql
+
+CREATE TABLE IF NOT EXISTS config (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+
+-- v1.0.1's first-visit setup stored the dashboard password as plaintext.
+-- Authentication now uses Cloudflare Worker secrets; remove any legacy copy.
+DELETE FROM config WHERE key = 'password';
+
+CREATE TABLE IF NOT EXISTS moods (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  partner TEXT NOT NULL,
+  mood TEXT NOT NULL,
+  note TEXT,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS notes (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  from_partner TEXT NOT NULL,
+  content TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS moments (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  date TEXT NOT NULL,
+  title TEXT NOT NULL,
+  description TEXT,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS dates (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  date TEXT NOT NULL,
+  title TEXT NOT NULL,
+  recurring INTEGER DEFAULT 0,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS shopping (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  item TEXT NOT NULL,
+  category TEXT DEFAULT 'Other',
+  checked INTEGER DEFAULT 0,
+  added_by TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS pressure_log (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  pressure_hpa REAL NOT NULL,
+  temp REAL,
+  recorded_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_pressure_recorded ON pressure_log(recorded_at);
+
+CREATE TABLE IF NOT EXISTS food_diary (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  date TEXT NOT NULL,
+  time TEXT NOT NULL,
+  meal_type TEXT NOT NULL,
+  note TEXT,
+  photo_key TEXT,
+  created_at TEXT DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_food_diary_date ON food_diary(date);
+
+CREATE TABLE IF NOT EXISTS water_log (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  date TEXT NOT NULL,
+  amount_ml INTEGER NOT NULL,
+  created_at TEXT DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_water_log_date ON water_log(date);
+
+CREATE TABLE IF NOT EXISTS food_reviews (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  date TEXT UNIQUE NOT NULL,
+  review TEXT NOT NULL,
+  reviewer TEXT NOT NULL DEFAULT 'AI',
+  created_at TEXT DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_food_reviews_date ON food_reviews(date);
+
+-- Coarse per-IP request buckets. IP addresses are hashed before storage.
+CREATE TABLE IF NOT EXISTS rate_limits (
+  bucket_key TEXT PRIMARY KEY,
+  count INTEGER NOT NULL DEFAULT 1,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_rate_limits_expires ON rate_limits(expires_at);
+
+-- Short-lived, single-use OAuth authorization transactions. D1 provides an
+-- atomic DELETE ... RETURNING consume step so consent forms cannot be replayed.
+CREATE TABLE IF NOT EXISTS oauth_csrf_tokens (
+  token TEXT PRIMARY KEY,
+  request_fingerprint TEXT NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_oauth_csrf_expires ON oauth_csrf_tokens(expires_at);