sdlc-agent-4-enterprise-server 1.53.12 → 1.54.1

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-1.53.4-blue?style=for-the-badge" alt="Version">
+  <img src="https://img.shields.io/badge/version-1.54.0-blue?style=for-the-badge" alt="Version">
   <img src="https://img.shields.io/badge/tools-66+-teal?style=for-the-badge" alt="Tools">
   <img src="https://img.shields.io/badge/node-%3E%3D18-green?style=for-the-badge" alt="Node">
 </p>
@@ -233,6 +233,7 @@ The embedding model is expected at `.code-intel/models/model.onnx`. Download it:
 
 | Version | Date | Ticket | Changes |
 |---------|------|--------|---------|
+| 1.54.0 | 2026-10-21 | SA4E-369/370/373/374/375 | PeerBus release (agent-to-agent messaging), 77 extension test failures fixed, ide_launch DevToolsActivePort fix, backend test alignment (SA4E-374 SRP + SA4E-375 deterministic projectId/auto-upsert), CI fully GREEN (3,330 backend + 3,224 extension tests). |
 | 1.53.0 | 2026-10-15 | SA4E-360 | Version sync with extension release v1.53.0 (Multi-Resolution Context Supply P1 — skeleton + agentic loading, UAT-verified; backend runtime unchanged).
 | 1.48.0 | 2026-10-10 | SA4E-341 | Version sync (E2E testing framework delivered in standalone `e2e/` package — no backend runtime changes). Also includes SA4E-335 DB-layer 6 bugfixes (memoized id-column check, literal-safe placeholder translation, identifier quoting SQLi guard, safeExec SQLSTATE filter, writable test-backend data dir), SA4E-349 auth 401 fail-loud fixes, SA4E-350 Pega '@baseclass' appliesTo passthrough fix, enrichment retry scoped via X-Project-Id + runtime settings module. |
 | 1.47.1 | 2026-10-04 | — | Fix Docker CI fail (Trivy CVE-2026-103111 libpcre2-8-0 HIGH), defensive JSON parse on `/auth/refresh`, SA4E-100 Pega BELONGS_TO edges. |

package/dist/admin/db/schema-ddl.d.ts

@@ -0,0 +1,14 @@
+/** Per-engine admin schema DDL (BR-18 extraction from schema.ts). */
+import type { DatabaseEngine } from '../../database/adapters/DatabaseAdapter.js';
+/** SQLite `INSERT OR IGNORE` has no direct PG equivalent — PG uses ON CONFLICT DO NOTHING.
+ * We use the target-less form so it does not require a specific named unique
+ * constraint to exist (legacy PG tables created before a UNIQUE clause was added
+ * would otherwise raise "no unique or exclusion constraint matching the ON CONFLICT
+ * specification"). Target-less DO NOTHING applies to any arbiter index/constraint. */
+export declare function insertIgnore(engine: DatabaseEngine, sql: string): string;
+/** Per-engine "current timestamp" default expression. */
+export declare function nowExpr(engine: DatabaseEngine): string;
+/** Per-engine auto-increment integer primary key clause. */
+export declare function autoIncPk(engine: DatabaseEngine): string;
+/** Full admin schema DDL — parameterized per engine for cross-DB compatibility. */
+export declare function schemaSql(engine: DatabaseEngine): string;

package/dist/admin/db/schema-ddl.js

@@ -0,0 +1,164 @@
+/** SQLite `INSERT OR IGNORE` has no direct PG equivalent — PG uses ON CONFLICT DO NOTHING.
+ * We use the target-less form so it does not require a specific named unique
+ * constraint to exist (legacy PG tables created before a UNIQUE clause was added
+ * would otherwise raise "no unique or exclusion constraint matching the ON CONFLICT
+ * specification"). Target-less DO NOTHING applies to any arbiter index/constraint. */
+export function insertIgnore(engine, sql) {
+    if (engine === 'postgresql') {
+        return sql.replace(/INSERT OR IGNORE/i, 'INSERT') + ` ON CONFLICT DO NOTHING`;
+    }
+    return sql;
+}
+/** Per-engine "current timestamp" default expression. */
+export function nowExpr(engine) {
+    return engine === 'postgresql' ? 'now()' : `(datetime('now'))`;
+}
+/** Per-engine auto-increment integer primary key clause. */
+export function autoIncPk(engine) {
+    return engine === 'postgresql' ? 'SERIAL PRIMARY KEY' : 'INTEGER PRIMARY KEY AUTOINCREMENT';
+}
+/** Full admin schema DDL — parameterized per engine for cross-DB compatibility. */
+export function schemaSql(engine) {
+    const now = nowExpr(engine);
+    const idPk = autoIncPk(engine);
+    return `
+    CREATE TABLE IF NOT EXISTS users (
+      user_id TEXT PRIMARY KEY,
+      username TEXT UNIQUE NOT NULL,
+      email TEXT NOT NULL DEFAULT '',
+      password_hash TEXT,
+      status TEXT NOT NULL DEFAULT 'ACTIVE',
+      access_group_id TEXT NOT NULL,
+      force_password_change INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL,
+      last_login TEXT,
+      account_type TEXT NOT NULL DEFAULT 'LOCAL' CHECK (account_type IN ('LOCAL','SSO')),
+      external_provider TEXT,
+      external_subject_id TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS access_groups (
+      access_group_id TEXT PRIMARY KEY,
+      access_group_name TEXT UNIQUE NOT NULL,
+      is_system_group INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS group_permissions (
+      id ${idPk},
+      access_group_id TEXT NOT NULL,
+      permission_id TEXT NOT NULL,
+      role_data TEXT NOT NULL DEFAULT '{}',
+      FOREIGN KEY (access_group_id) REFERENCES access_groups(access_group_id) ON DELETE CASCADE,
+      UNIQUE(access_group_id, permission_id)
+    );
+
+    CREATE TABLE IF NOT EXISTS sessions (
+      session_id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      token TEXT UNIQUE NOT NULL,
+      device TEXT DEFAULT '',
+      ip_address TEXT DEFAULT '',
+      user_agent_hash TEXT DEFAULT '',
+      login_at TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      is_active INTEGER NOT NULL DEFAULT 1,
+      FOREIGN KEY (user_id) REFERENCES users(user_id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS refresh_tokens (
+      token_hash TEXT PRIMARY KEY,
+      session_id TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      family_id TEXT NOT NULL,
+      used_at TEXT,
+      revoked_at TEXT,
+      expires_at TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      FOREIGN KEY (session_id) REFERENCES sessions(session_id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS audit_log (
+      audit_id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      username TEXT NOT NULL,
+      action TEXT NOT NULL,
+      resource TEXT NOT NULL,
+      resource_id TEXT DEFAULT '',
+      changes TEXT DEFAULT '',
+      timestamp TEXT NOT NULL,
+      ip_address TEXT DEFAULT ''
+    );
+
+    CREATE TABLE IF NOT EXISTS config_changes (
+      id ${idPk},
+      section TEXT NOT NULL,
+      key TEXT NOT NULL,
+      old_value TEXT,
+      new_value TEXT NOT NULL,
+      changed_by TEXT NOT NULL,
+      changed_at TEXT NOT NULL,
+      requires_restart INTEGER NOT NULL DEFAULT 0
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_sessions_token ON sessions(token);
+    CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id);
+    CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON audit_log(timestamp);
+    CREATE INDEX IF NOT EXISTS idx_audit_user ON audit_log(user_id);
+    CREATE INDEX IF NOT EXISTS idx_config_changes_time ON config_changes(changed_at);
+
+    CREATE UNIQUE INDEX IF NOT EXISTS uq_users_external_identity ON users (external_provider, external_subject_id);
+
+    CREATE TABLE IF NOT EXISTS sso_providers (
+      provider_id TEXT PRIMARY KEY,
+      provider_type TEXT NOT NULL CHECK (provider_type IN ('entra','google','github','x','facebook','azuread')),
+      name TEXT NOT NULL,
+      enabled INTEGER NOT NULL DEFAULT 0,
+      client_id TEXT NOT NULL DEFAULT '',
+      client_secret TEXT NOT NULL DEFAULT '',
+      tenant_id TEXT NOT NULL DEFAULT '',
+      redirect_uri TEXT NOT NULL DEFAULT '',
+      allowed_redirects TEXT NOT NULL DEFAULT '',
+      scopes TEXT NOT NULL DEFAULT '',
+      login_ui_html TEXT NOT NULL DEFAULT '',
+      created_at TEXT NOT NULL DEFAULT ${now},
+      updated_at TEXT NOT NULL DEFAULT ${now}
+    );
+
+    CREATE UNIQUE INDEX IF NOT EXISTS uq_sso_providers_type ON sso_providers(provider_type);
+
+    CREATE TABLE IF NOT EXISTS graph_nodes (
+      entry_id TEXT PRIMARY KEY,
+      label TEXT NOT NULL DEFAULT '',
+      type TEXT NOT NULL DEFAULT 'DOCUMENT',
+      tier TEXT NOT NULL DEFAULT 'SHARED',
+      project_id TEXT NOT NULL DEFAULT '',
+      x REAL NOT NULL DEFAULT 0,
+      y REAL NOT NULL DEFAULT 0,
+      z REAL NOT NULL DEFAULT 0,
+      level INTEGER NOT NULL DEFAULT 2,
+      cluster_id TEXT DEFAULT NULL,
+      created_at TEXT NOT NULL DEFAULT ${now}
+    );
+
+    CREATE TABLE IF NOT EXISTS graph_edges (
+      id ${idPk},
+      source TEXT NOT NULL,
+      target TEXT NOT NULL,
+      weight REAL NOT NULL DEFAULT 0.5,
+      rel_type TEXT NOT NULL DEFAULT 'RELATED_TO',
+      UNIQUE(source, target)
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_graph_nodes_x ON graph_nodes(x);
+    CREATE INDEX IF NOT EXISTS idx_graph_nodes_y ON graph_nodes(y);
+    CREATE INDEX IF NOT EXISTS idx_graph_nodes_z ON graph_nodes(z);
+    CREATE INDEX IF NOT EXISTS idx_graph_nodes_level ON graph_nodes(level);
+    CREATE INDEX IF NOT EXISTS idx_graph_nodes_cluster ON graph_nodes(cluster_id);
+    CREATE INDEX IF NOT EXISTS idx_graph_edges_source ON graph_edges(source);
+    CREATE INDEX IF NOT EXISTS idx_graph_edges_target ON graph_edges(target);
+    CREATE INDEX IF NOT EXISTS idx_graph_edges_source_target ON graph_edges(source, target);
+`;
+}
+//# sourceMappingURL=schema-ddl.js.map

package/dist/admin/db/schema-ddl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-ddl.js","sourceRoot":"","sources":["../../../src/admin/db/schema-ddl.ts"],"names":[],"mappings":"AAGA;;;;sFAIsF;AACtF,MAAM,UAAU,YAAY,CAAC,MAAsB,EAAE,GAAW;IAC9D,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,QAAQ,CAAC,GAAG,yBAAyB,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,OAAO,CAAC,MAAsB;IAC5C,OAAO,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACjE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,SAAS,CAAC,MAAsB;IAC9C,OAAO,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mCAAmC,CAAC;AAC9F,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,MAAsB;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;WAyBE,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8CJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCA8B0B,GAAG;yCACH,GAAG;;;;;;;;;;;;;;;;yCAgBH,GAAG;;;;WAIjC,IAAI;;;;;;;;;;;;;;;;CAgBd,CAAC;AACF,CAAC"}

package/dist/admin/db/schema-seed.d.ts

@@ -0,0 +1,6 @@
+import type { DatabaseAdapter } from '../../database/adapters/DatabaseAdapter.js';
+/** Full permission catalogue granted to the admin group. */
+export declare const ALL_PERMS: string[];
+export declare function seedAccessGroups(db: DatabaseAdapter): Promise<void>;
+export declare function ensureAdminPermissions(db: DatabaseAdapter): Promise<void>;
+export declare function seedAdminUser(db: DatabaseAdapter): Promise<void>;

package/dist/admin/db/schema-seed.js

@@ -0,0 +1,52 @@
+/** Default access group / admin user seeding (BR-18 extraction from schema.ts). */
+import * as crypto from 'crypto';
+import { hashPassword } from './password.js';
+import { insertIgnore } from './schema-ddl.js';
+/** Full permission catalogue granted to the admin group. */
+export const ALL_PERMS = [
+    'DASHBOARD_VIEW', 'KB_READ', 'KB_WRITE', 'KB_PROMOTE', 'KB_IMPORT_EXPORT',
+    'MCP_ACCESS', 'MCP_MANAGE', 'USER_MANAGE', 'RBAC_MANAGE', 'CONFIG_EDIT',
+    'SEARCH_EXPLORE', 'AUDIT_VIEW', 'GRAPH_VIEW', 'ANALYTICS_VIEW', 'GRAPH_MAINTAIN',
+];
+/** Insert one access group + its permissions (idempotent, cross-engine). */
+async function seedGroup(db, engine, groupId, groupName, isSystem, perms) {
+    const now = new Date().toISOString();
+    await db.runAsync(insertIgnore(engine, `INSERT OR IGNORE INTO access_groups (access_group_id, access_group_name, is_system_group, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?)`), [groupId, groupName, isSystem, now, now]);
+    await insertPerms(db, engine, groupId, perms);
+}
+/** Insert permission rows for a group (idempotent, cross-engine). */
+async function insertPerms(db, engine, groupId, perms) {
+    for (const perm of perms) {
+        await db.runAsync(insertIgnore(engine, 'INSERT OR IGNORE INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)'), [groupId, perm, '{}']);
+    }
+}
+export async function seedAccessGroups(db) {
+    const engine = db.getEngine();
+    await seedGroup(db, engine, 'grp-admin', 'Administrators', 1, ALL_PERMS);
+    await seedGroup(db, engine, 'grp-dev', 'Developers', 0, ['DASHBOARD_VIEW', 'KB_READ', 'KB_WRITE', 'MCP_ACCESS', 'SEARCH_EXPLORE', 'GRAPH_VIEW', 'ANALYTICS_VIEW']);
+    await seedGroup(db, engine, 'grp-viewer', 'Viewers', 0, ['DASHBOARD_VIEW', 'KB_READ', 'SEARCH_EXPLORE', 'GRAPH_VIEW', 'ANALYTICS_VIEW']);
+    await seedGroup(db, engine, 'grp-mcp-ops', 'MCP Operators', 0, ['DASHBOARD_VIEW', 'MCP_ACCESS', 'MCP_MANAGE']);
+}
+export async function ensureAdminPermissions(db) {
+    await insertPerms(db, db.getEngine(), 'grp-admin', ALL_PERMS);
+}
+export async function seedAdminUser(db) {
+    const now = new Date().toISOString();
+    const envPassword = process.env.ADMIN_INITIAL_PASSWORD;
+    const initialPassword = envPassword && envPassword.length >= 12
+        ? envPassword
+        : crypto.randomBytes(18).toString('base64url');
+    const hash = hashPassword(initialPassword);
+    await db.runAsync(`INSERT INTO users (user_id, username, email, password_hash, status, access_group_id, force_password_change, created_at, account_type)
+     VALUES (?, ?, ?, ?, 'ACTIVE', 'grp-admin', 1, ?, 'LOCAL')`, ['user-admin-001', 'admin', 'admin@localhost', hash, now]);
+    if (!envPassword) {
+        process.stdout.write('\n============================================================\n' +
+            '  ADMIN ACCOUNT CREATED — generated one-time password:\n' +
+            `  username: admin\n  password: ${initialPassword}\n` +
+            '  You MUST change this on first login. Set ADMIN_INITIAL_PASSWORD\n' +
+            '  env var to control the initial password.\n' +
+            '============================================================\n');
+    }
+}
+//# sourceMappingURL=schema-seed.js.map

package/dist/admin/db/schema-seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-seed.js","sourceRoot":"","sources":["../../../src/admin/db/schema-seed.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB;IACzE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IACvE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB;CACjF,CAAC;AAEF,4EAA4E;AAC5E,KAAK,UAAU,SAAS,CACtB,EAAmB,EAAE,MAAsB,EAC3C,OAAe,EAAE,SAAiB,EAAE,QAAe,EAAE,KAAe;IAEpE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,QAAQ,CACf,YAAY,CAAC,MAAM,EACjB;8BACwB,CAAC,EAC3B,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CACzC,CAAC;IACF,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,WAAW,CACxB,EAAmB,EAAE,MAAsB,EAAE,OAAe,EAAE,KAAe;IAE7E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,QAAQ,CACf,YAAY,CAAC,MAAM,EACjB,sGAAsG,CAAC,EACzG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAmB;IACxD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACzE,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,EACpD,CAAC,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC7G,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,EACpD,CAAC,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnF,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,EAC3D,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAmB;IAC9D,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAmB;IACrD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACvD,MAAM,eAAe,GAAG,WAAW,IAAI,WAAW,CAAC,MAAM,IAAI,EAAE;QAC7D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,QAAQ,CACf;+DAC2D,EAC3D,CAAC,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAC1D,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kEAAkE;YAClE,0DAA0D;YAC1D,kCAAkC,eAAe,IAAI;YACrD,qEAAqE;YACrE,8CAA8C;YAC9C,gEAAgE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/admin/db/schema-sso.d.ts

@@ -0,0 +1,13 @@
+/** SSO provider migrations + seeds (BR-18 extraction from schema.ts). */
+import type { DatabaseAdapter, DatabaseEngine } from '../../database/adapters/DatabaseAdapter.js';
+/** Initialize admin schema tables (idempotent CREATE IF NOT EXISTS). */
+export declare function migrateUsersSso(db: DatabaseAdapter, engine: DatabaseEngine): Promise<void>;
+export declare function seedDefaultSsoProviders(db: DatabaseAdapter): Promise<void>;
+/**
+ * Rewrite legacy login_ui_html that embedded an absolute login URL
+ * (`<a href="/auth/{provider}/login">…</a>`) into a URL-less `<span>` so the
+ * login page can wrap it in a basePath-aware anchor. Runs outside any
+ * transaction (autocommit) — safe to re-run (idempotent on already-migrated rows).
+ */
+export declare function migrateLoginUiHtmlToUrlless(db: DatabaseAdapter): Promise<void>;
+export declare function seedSsoProvidersFromEnv(db: DatabaseAdapter): Promise<void>;

package/dist/admin/db/schema-sso.js

@@ -0,0 +1,173 @@
+/** Initialize admin schema tables (idempotent CREATE IF NOT EXISTS). */
+export async function migrateUsersSso(db, engine) {
+    try {
+        if (engine === 'postgresql') {
+            await db.execAsync(`ALTER TABLE users ADD COLUMN IF NOT EXISTS account_type TEXT NOT NULL DEFAULT 'LOCAL'`);
+            await db.execAsync(`ALTER TABLE users ADD COLUMN IF NOT EXISTS external_provider TEXT`);
+            await db.execAsync(`ALTER TABLE users ADD COLUMN IF NOT EXISTS external_subject_id TEXT`);
+            await db.execAsync(`ALTER TABLE users ALTER COLUMN password_hash DROP NOT NULL`);
+            await db.execAsync(`CREATE UNIQUE INDEX IF NOT EXISTS uq_users_external_identity ON users (external_provider, external_subject_id)`);
+        }
+        else {
+            await migrateUsersSsoSqlite(db);
+            await db.execAsync(`CREATE UNIQUE INDEX IF NOT EXISTS uq_users_external_identity ON users (external_provider, external_subject_id)`);
+        }
+    }
+    catch (err) {
+        console.debug('[schema] users_sso migration:', err.message);
+    }
+}
+async function migrateUsersSsoSqlite(db) {
+    try {
+        await db.execAsync(`ALTER TABLE users ADD COLUMN account_type TEXT NOT NULL DEFAULT 'LOCAL'`);
+    }
+    catch { }
+    try {
+        await db.execAsync(`ALTER TABLE users ADD COLUMN external_provider TEXT`);
+    }
+    catch { }
+    try {
+        await db.execAsync(`ALTER TABLE users ADD COLUMN external_subject_id TEXT`);
+    }
+    catch { }
+    // SQLite cannot ALTER COLUMN nullability; recreate table if password_hash is NOT NULL
+    try {
+        const info = await db.allAsync(`PRAGMA table_info(users)`);
+        const col = info.find(c => c.name === 'password_hash');
+        if (col && col.notnull === 1) {
+            await db.execAsync(`ALTER TABLE users RENAME TO users_old`);
+            await db.execAsync(`CREATE TABLE users (
+        user_id TEXT PRIMARY KEY,
+        username TEXT,
+        email TEXT UNIQUE,
+        password_hash TEXT,
+        status TEXT,
+        access_group_id TEXT,
+        force_password_change INTEGER,
+        created_at TEXT,
+        last_login TEXT,
+        account_type TEXT NOT NULL DEFAULT 'LOCAL',
+        external_provider TEXT,
+        external_subject_id TEXT
+      )`);
+            await db.execAsync(`INSERT INTO users SELECT user_id, username, email, password_hash, status, access_group_id, force_password_change, created_at, last_login, COALESCE(account_type,'LOCAL'), external_provider, external_subject_id FROM users_old`);
+            await db.execAsync(`DROP TABLE users_old`);
+        }
+    }
+    catch { }
+}
+export async function seedDefaultSsoProviders(db) {
+    try {
+        const templates = ssoProviderTemplates();
+        const now = new Date().toISOString();
+        for (const t of templates) {
+            const exists = await db.getAsync('SELECT 1 FROM sso_providers WHERE provider_type = ?', [t.provider_type]);
+            if (!exists) {
+                const provider_id = `${t.provider_type}-${Date.now()}`;
+                // 13 columns → 13 placeholders (fix SA4E-262: was 12 placeholders for 13 values)
+                await db.runAsync(`INSERT INTO sso_providers (provider_id, provider_type, name, enabled, client_id, client_secret, tenant_id, redirect_uri, allowed_redirects, scopes, login_ui_html, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`, [provider_id, t.provider_type, t.name, t.enabled, '', '', '', '', '', '', t.login_ui_html, now, now]);
+            }
+        }
+    }
+    catch (err) {
+        // Non-fatal: seed of default provider templates is optional, but surface the
+        // error (console.error, not debug) so a broken INSERT is not swallowed silently.
+        console.error('[schema] seedDefaultSsoProviders failed:', err.message);
+    }
+}
+/** Default provider button templates — login_ui_html holds only the visual (icon + label). */
+function ssoProviderTemplates() {
+    return [
+        {
+            // Hướng A (SA4E-262): Entra is configured via sso_providers like every
+            // other provider (single source of truth), so it must have a seed row too.
+            provider_type: 'entra',
+            name: 'Microsoft Entra ID',
+            enabled: 0,
+            login_ui_html: `<span class="sso-btn sso-entra"><svg width="18" height="18" viewBox="0 0 23 23"><path fill="#f35325" d="M1 1h10v10H1z"/><path fill="#81bc06" d="M12 1h10v10H12z"/><path fill="#05a6f0" d="M1 12h10v10H1z"/><path fill="#ffba08" d="M12 12h10v10H12z"/></svg> Sign in with Microsoft</span>`,
+        },
+        {
+            provider_type: 'google',
+            name: 'Google',
+            enabled: 0,
+            // login_ui_html holds only the visual (icon + label) — NO navigation URL.
+            // The login page wraps it in an anchor built from basePath so it works
+            // under sub-path deploys (ui-relative-paths: never embed absolute hrefs).
+            login_ui_html: `<span class="sso-btn sso-google"><svg width="18" height="18" viewBox="0 0 24 24"><path fill="#EA4335" d="M12 10.2v3.6h5.1c-.2 1.2-1.5 3.6-5.1 3.6-3.1 0-5.6-2.5-5.6-5.6s2.5-5.6 5.6-5.6c1.8 0 3 .8 3.7 1.4l2.5-2.4C17 2.9 14.7 1.8 12 1.8 6.8 1.8 2.5 6.1 2.5 11.3S6.8 20.8 12 20.8c5.6 0 9.3-4 9.3-9.3 0-.6 0-1.2-.1-1.8H12z"/></svg> Sign in with Google</span>`,
+        },
+        {
+            provider_type: 'github',
+            name: 'GitHub',
+            enabled: 0,
+            login_ui_html: `<span class="sso-btn sso-github"><svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor"><path d="M12 .5a12 12 0 0 0-3.79 23.4c.6.11.82-.26.82-.58v-2.02c-3.34.73-4.04-1.61-4.04-1.61-.55-1.39-1.34-1.76-1.34-1.76-1.1-.75.08-.73.08-.73 1.22.09 1.86 1.26 1.86 1.26 1.08 1.86 2.83 1.32 3.52 1.01.11-.79.42-1.32.76-1.62-2.67-.3-5.47-1.34-5.47-5.95 0-1.31.47-2.38 1.24-3.22-.12-.3-.54-1.52.12-3.18 0 0 1.01-.32 3.3 1.23a11.4 11.4 0 0 1 6 0c2.29-1.55 3.3-1.23 3.3-1.23.66 1.66.24 2.88.12 3.18.77.84 1.24 1.91 1.24 3.22 0 4.61-2.8 5.65-5.48 5.95.43.37.81 1.1.81 2.22v3.29c0 .32.22.69.82.58A12 12 0 0 0 12 .5Z"/></svg> Sign in with GitHub</span>`,
+        },
+        {
+            provider_type: 'x',
+            name: 'X',
+            enabled: 0,
+            login_ui_html: `<span class="sso-btn sso-x">Sign in with X</span>`,
+        },
+        {
+            provider_type: 'facebook',
+            name: 'Facebook',
+            enabled: 0,
+            login_ui_html: `<span class="sso-btn sso-facebook"><svg width="18" height="18" viewBox="0 0 24 24"><path fill="#1877F2" d="M24 12.07C24 5.41 18.63 0 12 0S0 5.41 0 12.07C0 18.1 4.39 23.1 10.13 24v-8.44H7.08v-3.49h3.05V9.41c0-3.02 1.8-4.7 4.55-4.7 1.31 0 2.68.24 2.68.24v2.95h-1.51c-1.48 0-1.94.92-1.94 1.86v2.24h3.3l-.53 3.49h-2.77V24C19.61 23.1 24 18.1 24 12.07z"/></svg> Sign in with Facebook</span>`,
+        },
+    ];
+}
+/**
+ * Rewrite legacy login_ui_html that embedded an absolute login URL
+ * (`<a href="/auth/{provider}/login">…</a>`) into a URL-less `<span>` so the
+ * login page can wrap it in a basePath-aware anchor. Runs outside any
+ * transaction (autocommit) — safe to re-run (idempotent on already-migrated rows).
+ */
+export async function migrateLoginUiHtmlToUrlless(db) {
+    try {
+        const rows = await db.allAsync("SELECT provider_id, login_ui_html FROM sso_providers WHERE login_ui_html LIKE '%href=%/auth/%/login%'");
+        for (const row of rows || []) {
+            // Drop the opening <a ...> (keeping inner content) and turn </a> into </span>.
+            const migrated = row.login_ui_html
+                .replace(/<a\b[^>]*\bhref=["'][^"']*\/auth\/[^"']*\/login["'][^>]*>/i, '<span class="sso-btn">')
+                .replace(/<\/a>/i, '</span>');
+            await db.runAsync('UPDATE sso_providers SET login_ui_html = ? WHERE provider_id = ?', [migrated, row.provider_id]);
+        }
+        if (rows && rows.length > 0) {
+            console.debug(`[schema] migrated ${rows.length} login_ui_html row(s) to URL-less form`);
+        }
+    }
+    catch (err) {
+        // Non-fatal: surface the error but do not block schema init.
+        console.error('[schema] migrateLoginUiHtmlToUrlless failed:', err.message);
+    }
+}
+export async function seedSsoProvidersFromEnv(db) {
+    try {
+        const cnt = await db.getAsync('SELECT COUNT(*) as count FROM sso_providers');
+        if (cnt && cnt.count > 0)
+            return;
+        const env = process.env;
+        if (!env.SSO_ENABLED || env.SSO_ENABLED !== 'true')
+            return;
+        const tenant = env.ENTRA_TENANT_ID || '';
+        const clientId = env.ENTRA_CLIENT_ID || '';
+        const clientSecret = env.ENTRA_CLIENT_SECRET || '';
+        if (!tenant || !clientId)
+            return;
+        const now = new Date().toISOString();
+        const provider_id = `entra-${Date.now()}`;
+        const name = 'Entra ID';
+        const enabled = 1;
+        const redirect_uri = env.ENTRA_REDIRECT_URI || '';
+        const allowed_redirects = env.SSO_ALLOWED_REDIRECTS || '';
+        const scopes = env.ENTRA_SCOPES || 'openid profile email offline_access';
+        const login_ui_html = `<button class="sso-btn sso-entra">Sign in with Entra ID</button>`;
+        // 13 columns → 13 placeholders (fix SA4E-262: was 12 placeholders for 13 values)
+        await db.runAsync(`INSERT INTO sso_providers (provider_id, provider_type, name, enabled, client_id, client_secret, tenant_id, redirect_uri, allowed_redirects, scopes, login_ui_html, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`, [provider_id, 'entra', name, enabled, clientId, clientSecret, tenant, redirect_uri, allowed_redirects, scopes, login_ui_html, now, now]);
+        console.debug('[schema] sso_providers seeded from env');
+    }
+    catch (err) {
+        // Non-fatal, but surface the error so a broken INSERT is not swallowed silently.
+        console.error('[schema] seedSsoProvidersFromEnv failed:', err.message);
+    }
+}
+//# sourceMappingURL=schema-sso.js.map

package/dist/admin/db/schema-sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-sso.js","sourceRoot":"","sources":["../../../src/admin/db/schema-sso.ts"],"names":[],"mappings":"AAGA,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAmB,EAAE,MAAsB;IAC/E,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,EAAE,CAAC,SAAS,CAAC,uFAAuF,CAAC,CAAC;YAC5G,MAAM,EAAE,CAAC,SAAS,CAAC,mEAAmE,CAAC,CAAC;YACxF,MAAM,EAAE,CAAC,SAAS,CAAC,qEAAqE,CAAC,CAAC;YAC1F,MAAM,EAAE,CAAC,SAAS,CAAC,4DAA4D,CAAC,CAAC;YACjF,MAAM,EAAE,CAAC,SAAS,CAAC,gHAAgH,CAAC,CAAC;QACvI,CAAC;aAAM,CAAC;YACN,MAAM,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAChC,MAAM,EAAE,CAAC,SAAS,CAAC,gHAAgH,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,EAAmB;IACtD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,yEAAyE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAC/G,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAC3F,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,uDAAuD,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAC7F,sFAAsF;IACtF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAI,IAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAClE,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,EAAE,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAC5D,MAAM,EAAE,CAAC,SAAS,CAAC;;;;;;;;;;;;;QAajB,CAAC,CAAC;YACJ,MAAM,EAAE,CAAC,SAAS,CAAC,iOAAiO,CAAC,CAAC;YACtP,MAAM,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAmB;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACvD,iFAAiF;gBACjF,MAAM,EAAE,CAAC,QAAQ,CAAC,+NAA+N,EAC/O,CAAC,WAAW,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,iFAAiF;QACjF,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,oBAAoB;IAC3B,OAAO;QACL;YACE,uEAAuE;YACvE,2EAA2E;YAC3E,aAAa,EAAE,OAAO;YACtB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,4RAA4R;SAC5S;QACD;YACE,aAAa,EAAE,QAAQ;YACvB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC;YACV,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,aAAa,EAAE,mWAAmW;SACnX;QACD;YACE,aAAa,EAAE,QAAQ;YACvB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,yoBAAyoB;SACzpB;QACD;YACE,aAAa,EAAE,GAAG;YAClB,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,mDAAmD;SACnE;QACD;YACE,aAAa,EAAE,UAAU;YACzB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,kYAAkY;SAClZ;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAAmB;IACnE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC5B,uGAAuG,CACxG,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7B,+EAA+E;YAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa;iBAC/B,OAAO,CAAC,4DAA4D,EAAE,wBAAwB,CAAC;iBAC/F,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAChC,MAAM,EAAE,CAAC,QAAQ,CAAC,kEAAkE,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,wCAAwC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAmB;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAiB,6CAA6C,CAAC,CAAC;QAC7F,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC;YAAE,OAAO;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM;YAAE,OAAO;QAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,OAAO;QACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC;QACxB,MAAM,OAAO,GAAG,CAAC,CAAC;QAClB,MAAM,YAAY,GAAG,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAClD,MAAM,iBAAiB,GAAG,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,qCAAqC,CAAC;QACzE,MAAM,aAAa,GAAG,kEAAkE,CAAC;QACzF,iFAAiF;QACjF,MAAM,EAAE,CAAC,QAAQ,CAAC,+NAA+N,EAC/O,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3I,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iFAAiF;QACjF,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}

package/dist/admin/db/schema.d.ts

@@ -3,6 +3,8 @@
  * SA4E-53: Accepts DatabaseAdapter (sync interface) instead of a raw Database handle.
  * Multi-engine: uses async adapter API + per-engine DDL/DML so it runs on both
  * SQLite and PostgreSQL (PostgresAdapter throws on the sync exec/get/run methods).
+ * Facade (BR-18): DDL in schema-ddl.ts, SSO migrations in schema-sso.ts,
+ * group/user seeding in schema-seed.ts.
  */
 import type { DatabaseAdapter } from '../../database/adapters/DatabaseAdapter.js';
 export declare function initSchema(db: DatabaseAdapter): Promise<void>;