kempo 4.5.4 → 4.5.5

package/README.md

@@ -430,17 +430,28 @@ To edit the admin portal without rebuilding on every change, point the middlewar
 
 ### Running the tests
 
-Most of the suite needs nothing, but the extension-lifecycle and HTTP-contract tests drive a real database and skip themselves when none is reachable. To run everything:
+There are two tiers, and `npm test` needs nothing installed or running:
+
+```bash
+npm test                  # unit tier: no database service, nothing to start
+npm run test:integration  # integration tier: a real Postgres
+```
+
+**Unit tier.** The suites that use the database run against [PGlite](https://pglite.dev), real Postgres compiled to WebAssembly and running inside the test process (`KEMPO_DB=pglite`, set for you). It is not a mock: indexes, `ON CONFLICT`, jsonb, foreign keys and the system-protection triggers all behave as in production, and the schema is generated from the same Drizzle definitions. It starts in about a second and cannot be unreachable, so a database suite can never skip and read as a pass.
+
+**Integration tier.** The suites that boot a second server process, drive the make-admin script as a child, or use `LISTEN`/`NOTIFY` across connections cannot share an in-memory database, so they need a real Postgres. They show up in the unit tier as `(integration tier)` entries. Here an unreachable database is an error, not a skip:
 
 ```bash
 docker compose up -d                 # postgres on 5434, separate from kempo-demo's on 5433
 npx drizzle-kit push --force         # apply the schema
-npm test
+DATABASE_URL=postgresql://kempo:kempo_test_password@localhost:5434/kempo_test npm run test:integration
 ```
 
-`.env.example` has the matching `DATABASE_URL`. The suite seeds its own groups and permissions, and cleans up the rows it creates.
+`.env.example` has the matching `DATABASE_URL`. The suites seed their own groups and permissions (`server/utils/setup/seedDatabase.js`) and clean up the rows they create. CI runs the unit tier on every push with no service, the integration tier alongside it, and publishing is gated on both.
+
+Both tiers run only the Node-side suite. Admin components that need a real DOM run in an actual browser via `npm run test:browser` — no database or running server required, since it exercises the real component/SDK code with only `window.fetch` intercepted for canned responses. It temporarily junctions `/kempo-ui`, `/kempo-css` and `/kempo` onto `node_modules`/`dist` at the project root so the admin bundle's absolute imports resolve against kempo-testing-framework's static test server, and removes them afterward regardless of pass/fail.
 
-`npm test` (`kempo-test -n`) only runs the Node-side suite. Admin components that need a real DOM run in an actual browser via `npm run test:browser` — no database or running server required, since it exercises the real component/SDK code with only `window.fetch` intercepted for canned responses. It temporarily junctions `/kempo-ui`, `/kempo-css` and `/kempo` onto `node_modules`/`dist` at the project root so the admin bundle's absolute imports resolve against kempo-testing-framework's static test server, and removes them afterward regardless of pass/fail.
+A test that needs the database imports `./helpers/db.js` (`reachable`, `seedDatabase`, `integrationOnly`). Put a suite in the integration tier by exporting `integrationOnly('name')` when `unitTier` is true.
 
 ### Building for Distribution
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kempo",
-  "version": "4.5.4",
+  "version": "4.5.5",
   "type": "module",
   "description": "A fullstack CMS framework for creating websites with user authentication",
   "scripts": {
@@ -12,8 +12,9 @@
     "makeAdmin": "node ./scripts/make-admin.js",
     "removeAdmin": "node ./scripts/remove-admin.js",
     "test:email": "node ./scripts/test-email.js",
-    "test": "kempo-test -n",
-    "test:node": "kempo-test -n",
+    "test": "node scripts/run-tests.js unit",
+    "test:node": "node scripts/run-tests.js unit",
+    "test:integration": "node scripts/run-tests.js integration",
     "test:browser": "node scripts/run-browser-tests.js",
     "link:local": "npm install ../kempo-server ../kempo-ui --no-save",
     "db:reset": "node ./scripts/reset-db.js"
@@ -62,6 +63,7 @@
     "kempo-ui": ">=0.5.1"
   },
   "devDependencies": {
+    "@electric-sql/pglite": "^0.5.9",
     "esbuild": "^0.28.2",
     "html-minifier-terser": "^7.2.0",
     "kempo-testing-framework": "^1.4.6",

package/scripts/init-db.js

@@ -1,215 +1,4 @@
-import crypto from 'crypto';
-import db from '../server/db/index.js';
-import { permission, group, groupPermission, setting, createSettingProtectionTrigger, createGroupProtectionTrigger, createPermissionProtectionTrigger } from '../server/db/schema.js';
-import { eq, and, sql } from 'drizzle-orm';
+import seedDatabase from '../server/utils/setup/seedDatabase.js';
 
-const DEFAULT_PERMISSIONS = [
-  { name: 'system:user:create', description: 'Create new users' },
-  { name: 'system:user:read', description: 'View users' },
-  { name: 'system:user:update', description: 'Edit users' },
-  { name: 'system:user:delete', description: 'Delete users' },
-  
-  { name: 'system:group:create', description: 'Create new groups' },
-  { name: 'system:group:read', description: 'View groups' },
-  { name: 'system:group:update', description: 'Edit groups and manage membership' },
-  { name: 'system:group:delete', description: 'Delete groups' },
-  
-  { name: 'system:permissions:read', description: 'View permissions for all users' },
-  { name: 'system:permissions:manage', description: 'Add or remove permissions' },
-  
-  { name: 'system:settings:read', description: 'View private settings' },
-  { name: 'system:settings:update', description: 'Update settings' },
-  { name: 'system:custom-settings:manage', description: 'Create and delete custom settings' },
-  
-  { name: 'system:pages:read', description: 'View pages in admin' },
-  { name: 'system:pages:create', description: 'Create new pages' },
-  { name: 'system:pages:update', description: 'Edit pages' },
-  { name: 'system:pages:delete', description: 'Delete pages' },
-  
-  { name: 'system:menus:create', description: 'Create new menus' },
-  { name: 'system:menus:read', description: 'View menus in admin' },
-  { name: 'system:menus:update', description: 'Edit menus and menu items' },
-  { name: 'system:menus:delete', description: 'Delete menus' },
-  
-  { name: 'system:fragments:read', description: 'View fragments in admin' },
-  { name: 'system:fragments:create', description: 'Create new fragments' },
-  { name: 'system:fragments:update', description: 'Edit fragments' },
-  { name: 'system:fragments:delete', description: 'Delete fragments' },
-  
-  { name: 'system:globals:read', description: 'View global content in admin' },
-  { name: 'system:globals:create', description: 'Create new global content' },
-  { name: 'system:globals:update', description: 'Edit global content' },
-  { name: 'system:globals:delete', description: 'Delete global content' },
-
-  { name: 'system:extensions:read', description: 'View installed extensions' },
-  { name: 'system:extensions:install', description: 'Install extensions' },
-  { name: 'system:extensions:uninstall', description: 'Uninstall extensions' },
-  { name: 'system:extensions:manage', description: 'Enable and disable extensions' },
-
-  { name: 'system:realtime:read', description: 'View realtime connections and channels' },
-
-  { name: 'system:admin:access', description: 'Access admin panel' },
-];
-
-const DEFAULT_GROUPS = {
-  'system:Users': {
-    description: 'Default group for all users',
-    permissions: []
-  },
-  'system:Administrators': {
-    description: 'Full system access',
-    permissions: [
-      'system:admin:access',
-      'system:user:create', 'system:user:read', 'system:user:update', 'system:user:delete',
-      'system:group:create', 'system:group:read', 'system:group:update', 'system:group:delete',
-      'system:permissions:list-own', 'system:permissions:check-others', 'system:permissions:list-others', 'system:permissions:manage',
-      'system:settings:read', 'system:settings:update', 'system:custom-settings:manage',
-      'system:pages:read', 'system:pages:create', 'system:pages:update', 'system:pages:delete',
-      'system:menus:create', 'system:menus:read', 'system:menus:update', 'system:menus:delete',
-      'system:fragments:read', 'system:fragments:create', 'system:fragments:update', 'system:fragments:delete',
-      'system:globals:read', 'system:globals:create', 'system:globals:update', 'system:globals:delete',
-      'system:extensions:read', 'system:extensions:install', 'system:extensions:uninstall', 'system:extensions:manage',
-      'system:realtime:read'
-    ]
-  }
-};
-
-console.log('=== Seeding Permissions ===\n');
-
-for(const perm of DEFAULT_PERMISSIONS) {
-  const existing = await db.select()
-    .from(permission)
-    .where(eq(permission.name, perm.name))
-    .limit(1);
-  
-  if(existing.length === 0) {
-    await db.insert(permission).values({
-      name: perm.name,
-      description: perm.description,
-      owner: 'system',
-      createdAt: new Date()
-    });
-    console.log(`✓ Created permission: ${perm.name}`);
-  } else {
-    console.log(`- Permission exists: ${perm.name}`);
-  }
-}
-
-console.log('\n=== Creating Groups ===\n');
-
-const allPermissions = await db.select().from(permission);
-const permissionMap = Object.fromEntries(
-  allPermissions.map(p => [p.name, p.name])
-);
-
-for(const [groupName, groupData] of Object.entries(DEFAULT_GROUPS)) {
-  let groupRecord = await db.select()
-    .from(group)
-    .where(eq(group.name, groupName))
-    .limit(1);
-  
-  if(groupRecord.length === 0) {
-    groupRecord = await db.insert(group).values({
-      name: groupName,
-      description: groupData.description,
-      owner: 'system',
-      createdAt: new Date()
-    }).returning();
-    console.log(`✓ Created group: ${groupName}`);
-  } else {
-    console.log(`- Group exists: ${groupName}`);
-  }
-  
-  if(groupName === 'system:Administrators') {
-    console.log(`  Skipping permission assignments (admin has all permissions)`);
-    continue;
-  }
-  
-  console.log(`  Assigning permissions to ${groupName}:`);
-  
-  for(const permName of groupData.permissions) {
-    if(!permissionMap[permName]) {
-      console.log(`  ⚠ Permission not found: ${permName}`);
-      continue;
-    }
-    
-    const existing = await db.select()
-      .from(groupPermission)
-      .where(and(
-        eq(groupPermission.groupName, groupName),
-        eq(groupPermission.permissionName, permName)
-      ))
-      .limit(1);
-    
-    if(existing.length === 0) {
-      await db.insert(groupPermission).values({
-        id: crypto.randomUUID(),
-        groupName: groupName,
-        permissionName: permName,
-        createdAt: new Date()
-      });
-      console.log(`  ✓ ${permName}`);
-    }
-  }
-}
-
-console.log('\n=== Creating Default Settings ===\n');
-
-const DEFAULT_SETTINGS = [
-  { owner: 'system', name: 'site_name', value: 'Kempo Site', type: 'string', isPublic: true, description: 'The name of the website' },
-  { owner: 'system', name: 'session_duration_days', value: 7, type: 'number', isPublic: false, description: 'Session duration in days' },
-  { owner: 'system', name: 'allow_registration', value: true, type: 'boolean', isPublic: true, description: 'Allow new users to register' },
-  { owner: 'system', name: 'require_email_verification', value: false, type: 'boolean', isPublic: false, description: 'Require email verification before account access' },
-  { owner: 'system', name: 'verification_url', value: 'http://localhost:3000/verify-email/{{token}}', type: 'string', isPublic: false, description: 'Email verification URL template' },
-  { owner: 'system', name: 'notification_retention_days', value: 90, type: 'number', isPublic: false, description: 'Days to keep notifications before they are deleted (0 keeps them forever)' },
-  { owner: 'system', name: 'password_reset_url', value: 'http://localhost:3000/reset-password/{{token}}', type: 'string', isPublic: false, description: 'Password reset URL template' },
-];
-
-const { default: setSetting } = await import('../server/utils/settings/setSetting.js');
-for(const s of DEFAULT_SETTINGS){
-  await setSetting(s.owner, s.name, s.value, s.type, s.isPublic, s.description);
-  console.log(`✓ Created setting: ${s.owner}:${s.name} = ${s.value}`);
-}
-
-console.log('\n=== Updating Existing Records ===\n');
-
-const updatedPerms = await db.update(permission)
-  .set({ owner: 'system' })
-  .where(sql`name LIKE 'system:%'`)
-  .returning();
-console.log(`✓ Updated ${updatedPerms.length} permissions to owner='system'`);
-
-const updatedGroups = await db.update(group)
-  .set({ owner: 'system' })
-  .where(sql`name LIKE 'system:%'`)
-  .returning();
-console.log(`✓ Updated ${updatedGroups.length} groups to owner='system'`);
-
-console.log('\nCreating database triggers to protect system resources...');
-
-try {
-  await db.execute(sql.raw('DROP TRIGGER IF EXISTS protect_system_settings ON setting'));
-  await db.execute(sql.raw(createSettingProtectionTrigger()));
-  console.log('✓ System settings protection trigger created');
-} catch(e) {
-  console.log('- Settings trigger already exists');
-}
-
-try {
-  await db.execute(sql.raw('DROP TRIGGER IF EXISTS protect_system_groups ON "group"'));
-  await db.execute(sql.raw(createGroupProtectionTrigger()));
-  console.log('✓ System groups protection trigger created');
-} catch(e) {
-  console.log('- Groups trigger already exists');
-}
-
-try {
-  await db.execute(sql.raw('DROP TRIGGER IF EXISTS protect_system_permissions ON permission'));
-  await db.execute(sql.raw(createPermissionProtectionTrigger()));
-  console.log('✓ System permissions protection trigger created');
-} catch(e) {
-  console.log('- Permissions trigger already exists');
-}
-
-console.log('\n=== Group & Permission Seeding Complete ===');
+await seedDatabase();
 process.exit(0);

package/server/db/index.js

@@ -18,7 +18,43 @@ if(existsSync(appSchemaPath) && realpathSync(appSchemaPath) !== realpathSync(fra
   appSchema = await import(pathToFileURL(appSchemaPath).href);
 }
 
-const client = postgres(process.env.DATABASE_URL);
-const db = drizzle(client, { schema: { ...frameworkSchema, ...appSchema } });
+const schema = { ...frameworkSchema, ...appSchema };
+
+let db;
+
+/*
+  KEMPO_DB=pglite swaps the server for an in-process, in-memory Postgres (PGlite) with the schema
+  applied, so the unit tier needs no service and cannot skip for want of one. It is real Postgres
+  (jsonb, partial indexes, ON CONFLICT, triggers), not a mock. Nothing outside tests sets it, and
+  PGlite is a dev dependency that is only imported on this branch.
+*/
+if(process.env.KEMPO_DB === 'pglite'){
+  const [{ PGlite }, { drizzle: drizzlePglite }, { generateDrizzleJson, generateMigration }] = await Promise.all([
+    import('@electric-sql/pglite'),
+    import('drizzle-orm/pglite'),
+    import('drizzle-kit/api')
+  ]);
+  const client = new PGlite();
+  db = drizzlePglite(client, { schema });
+
+  /*
+    The database is empty, so the whole schema is the diff from nothing. This is drizzle-kit's own
+    generator, so indexes, unique constraints and foreign keys match `drizzle-kit push` exactly.
+  */
+  const statements = await generateMigration(generateDrizzleJson({}), generateDrizzleJson(schema));
+  await client.exec(statements.join('\n'));
+
+  /*
+    postgres-js answers db.execute() with an array of rows and PGlite with `{ rows }`. Make PGlite look
+    like postgres-js (keeping `.rows`) so code and tests that read a raw result work on either.
+  */
+  const execute = db.execute.bind(db);
+  db.execute = async query => {
+    const result = await execute(query);
+    return Object.assign([...result.rows], { rows: result.rows });
+  };
+} else {
+  db = drizzle(postgres(process.env.DATABASE_URL), { schema });
+}
 
 export default db;

package/server/utils/setup/seedDatabase.js

@@ -0,0 +1,227 @@
+import crypto from 'crypto';
+import db from '../../db/index.js';
+import { permission, group, groupPermission, setting, createSettingProtectionTrigger, createGroupProtectionTrigger, createPermissionProtectionTrigger } from '../../db/schema.js';
+import { eq, and, sql } from 'drizzle-orm';
+
+const DEFAULT_PERMISSIONS = [
+  { name: 'system:user:create', description: 'Create new users' },
+  { name: 'system:user:read', description: 'View users' },
+  { name: 'system:user:update', description: 'Edit users' },
+  { name: 'system:user:delete', description: 'Delete users' },
+  
+  { name: 'system:group:create', description: 'Create new groups' },
+  { name: 'system:group:read', description: 'View groups' },
+  { name: 'system:group:update', description: 'Edit groups and manage membership' },
+  { name: 'system:group:delete', description: 'Delete groups' },
+  
+  { name: 'system:permissions:read', description: 'View permissions for all users' },
+  { name: 'system:permissions:manage', description: 'Add or remove permissions' },
+  
+  { name: 'system:settings:read', description: 'View private settings' },
+  { name: 'system:settings:update', description: 'Update settings' },
+  { name: 'system:custom-settings:manage', description: 'Create and delete custom settings' },
+  
+  { name: 'system:pages:read', description: 'View pages in admin' },
+  { name: 'system:pages:create', description: 'Create new pages' },
+  { name: 'system:pages:update', description: 'Edit pages' },
+  { name: 'system:pages:delete', description: 'Delete pages' },
+  
+  { name: 'system:menus:create', description: 'Create new menus' },
+  { name: 'system:menus:read', description: 'View menus in admin' },
+  { name: 'system:menus:update', description: 'Edit menus and menu items' },
+  { name: 'system:menus:delete', description: 'Delete menus' },
+  
+  { name: 'system:fragments:read', description: 'View fragments in admin' },
+  { name: 'system:fragments:create', description: 'Create new fragments' },
+  { name: 'system:fragments:update', description: 'Edit fragments' },
+  { name: 'system:fragments:delete', description: 'Delete fragments' },
+  
+  { name: 'system:globals:read', description: 'View global content in admin' },
+  { name: 'system:globals:create', description: 'Create new global content' },
+  { name: 'system:globals:update', description: 'Edit global content' },
+  { name: 'system:globals:delete', description: 'Delete global content' },
+
+  { name: 'system:extensions:read', description: 'View installed extensions' },
+  { name: 'system:extensions:install', description: 'Install extensions' },
+  { name: 'system:extensions:uninstall', description: 'Uninstall extensions' },
+  { name: 'system:extensions:manage', description: 'Enable and disable extensions' },
+
+  { name: 'system:realtime:read', description: 'View realtime connections and channels' },
+
+  { name: 'system:admin:access', description: 'Access admin panel' },
+];
+
+const DEFAULT_GROUPS = {
+  'system:Users': {
+    description: 'Default group for all users',
+    permissions: []
+  },
+  'system:Administrators': {
+    description: 'Full system access',
+    permissions: [
+      'system:admin:access',
+      'system:user:create', 'system:user:read', 'system:user:update', 'system:user:delete',
+      'system:group:create', 'system:group:read', 'system:group:update', 'system:group:delete',
+      'system:permissions:list-own', 'system:permissions:check-others', 'system:permissions:list-others', 'system:permissions:manage',
+      'system:settings:read', 'system:settings:update', 'system:custom-settings:manage',
+      'system:pages:read', 'system:pages:create', 'system:pages:update', 'system:pages:delete',
+      'system:menus:create', 'system:menus:read', 'system:menus:update', 'system:menus:delete',
+      'system:fragments:read', 'system:fragments:create', 'system:fragments:update', 'system:fragments:delete',
+      'system:globals:read', 'system:globals:create', 'system:globals:update', 'system:globals:delete',
+      'system:extensions:read', 'system:extensions:install', 'system:extensions:uninstall', 'system:extensions:manage',
+      'system:realtime:read'
+    ]
+  }
+};
+
+/*
+  Each trigger definition is a function plus a trigger in one string. node-postgres style drivers send
+  that as a simple query; PGlite's execute() prepares it and refuses multiple commands, so it uses exec().
+*/
+const runScript = text => db.$client?.exec ? db.$client.exec(text) : db.execute(sql.raw(text));
+
+/*
+  Seeds the system permissions, groups, settings and the triggers that protect them. Idempotent.
+  `scripts/init-db.js` runs it for a site; tests call it in-process so they can share a database
+  with the code under test (an in-memory PGlite cannot be reached from a child process).
+*/
+export default async ({ log = console.log } = {}) => {
+  log('=== Seeding Permissions ===\n');
+
+  for(const perm of DEFAULT_PERMISSIONS) {
+    const existing = await db.select()
+      .from(permission)
+      .where(eq(permission.name, perm.name))
+      .limit(1);
+  
+    if(existing.length === 0) {
+      await db.insert(permission).values({
+        name: perm.name,
+        description: perm.description,
+        owner: 'system',
+        createdAt: new Date()
+      });
+      log(`✓ Created permission: ${perm.name}`);
+    } else {
+      log(`- Permission exists: ${perm.name}`);
+    }
+  }
+
+  log('\n=== Creating Groups ===\n');
+
+  const allPermissions = await db.select().from(permission);
+  const permissionMap = Object.fromEntries(
+    allPermissions.map(p => [p.name, p.name])
+  );
+
+  for(const [groupName, groupData] of Object.entries(DEFAULT_GROUPS)) {
+    let groupRecord = await db.select()
+      .from(group)
+      .where(eq(group.name, groupName))
+      .limit(1);
+  
+    if(groupRecord.length === 0) {
+      groupRecord = await db.insert(group).values({
+        name: groupName,
+        description: groupData.description,
+        owner: 'system',
+        createdAt: new Date()
+      }).returning();
+      log(`✓ Created group: ${groupName}`);
+    } else {
+      log(`- Group exists: ${groupName}`);
+    }
+  
+    if(groupName === 'system:Administrators') {
+      log(`  Skipping permission assignments (admin has all permissions)`);
+      continue;
+    }
+  
+    log(`  Assigning permissions to ${groupName}:`);
+  
+    for(const permName of groupData.permissions) {
+      if(!permissionMap[permName]) {
+        log(`  ⚠ Permission not found: ${permName}`);
+        continue;
+      }
+    
+      const existing = await db.select()
+        .from(groupPermission)
+        .where(and(
+          eq(groupPermission.groupName, groupName),
+          eq(groupPermission.permissionName, permName)
+        ))
+        .limit(1);
+    
+      if(existing.length === 0) {
+        await db.insert(groupPermission).values({
+          id: crypto.randomUUID(),
+          groupName: groupName,
+          permissionName: permName,
+          createdAt: new Date()
+        });
+        log(`  ✓ ${permName}`);
+      }
+    }
+  }
+
+  log('\n=== Creating Default Settings ===\n');
+
+  const DEFAULT_SETTINGS = [
+    { owner: 'system', name: 'site_name', value: 'Kempo Site', type: 'string', isPublic: true, description: 'The name of the website' },
+    { owner: 'system', name: 'session_duration_days', value: 7, type: 'number', isPublic: false, description: 'Session duration in days' },
+    { owner: 'system', name: 'allow_registration', value: true, type: 'boolean', isPublic: true, description: 'Allow new users to register' },
+    { owner: 'system', name: 'require_email_verification', value: false, type: 'boolean', isPublic: false, description: 'Require email verification before account access' },
+    { owner: 'system', name: 'verification_url', value: 'http://localhost:3000/verify-email/{{token}}', type: 'string', isPublic: false, description: 'Email verification URL template' },
+    { owner: 'system', name: 'notification_retention_days', value: 90, type: 'number', isPublic: false, description: 'Days to keep notifications before they are deleted (0 keeps them forever)' },
+    { owner: 'system', name: 'password_reset_url', value: 'http://localhost:3000/reset-password/{{token}}', type: 'string', isPublic: false, description: 'Password reset URL template' },
+  ];
+
+  const { default: setSetting } = await import('../settings/setSetting.js');
+  for(const s of DEFAULT_SETTINGS){
+    await setSetting(s.owner, s.name, s.value, s.type, s.isPublic, s.description);
+    log(`✓ Created setting: ${s.owner}:${s.name} = ${s.value}`);
+  }
+
+  log('\n=== Updating Existing Records ===\n');
+
+  const updatedPerms = await db.update(permission)
+    .set({ owner: 'system' })
+    .where(sql`name LIKE 'system:%'`)
+    .returning();
+  log(`✓ Updated ${updatedPerms.length} permissions to owner='system'`);
+
+  const updatedGroups = await db.update(group)
+    .set({ owner: 'system' })
+    .where(sql`name LIKE 'system:%'`)
+    .returning();
+  log(`✓ Updated ${updatedGroups.length} groups to owner='system'`);
+
+  log('\nCreating database triggers to protect system resources...');
+
+  try {
+    await db.execute(sql.raw('DROP TRIGGER IF EXISTS protect_system_settings ON setting'));
+    await runScript(createSettingProtectionTrigger());
+    log('✓ System settings protection trigger created');
+  } catch(e) {
+    log('- Settings trigger already exists');
+  }
+
+  try {
+    await db.execute(sql.raw('DROP TRIGGER IF EXISTS protect_system_groups ON "group"'));
+    await runScript(createGroupProtectionTrigger());
+    log('✓ System groups protection trigger created');
+  } catch(e) {
+    log('- Groups trigger already exists');
+  }
+
+  try {
+    await db.execute(sql.raw('DROP TRIGGER IF EXISTS protect_system_permissions ON permission'));
+    await runScript(createPermissionProtectionTrigger());
+    log('✓ System permissions protection trigger created');
+  } catch(e) {
+    log('- Permissions trigger already exists');
+  }
+
+  log('\n=== Group & Permission Seeding Complete ===');
+};