fix(self-host): entrypoint-based seed prevents concurrent SQLite corruption

Seeds the DB sequentially before the server starts so WAL write conflicts
cannot corrupt the database. Rewrites seed-self-host.ts to use
createSqliteDriver (auto-migrate + WAL) instead of mixing a raw
better-sqlite3 connection with the driver — safe to run before first boot.

Adds docker-entrypoint.sh to Dockerfile; updates E2E smoke spec to use
page.request for cookie sharing and API-based auth verification.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: lane711

Dockerfile

@@ -67,12 +67,15 @@ ENV SONICJS_STORAGE_PATH=/app/data/media
 ENV SONICJS_KV_PATH=/app/data/kv.json
 ENV PORT=3000
 
+# Copy entrypoint script.
+COPY docker-entrypoint.sh /app/docker-entrypoint.sh
+
 # Run as non-root for security.
-RUN chown -R node:node /app
+RUN chown -R node:node /app && chmod +x /app/docker-entrypoint.sh
 USER node
 
 HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
   CMD node -e "fetch('http://localhost:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
 
-# Run via Node with native ESM + TypeScript stripping (Node 22+).
-CMD ["node", "--experimental-strip-types", "my-sonicjs-app/src/self-host.ts"]
+# Entrypoint: seeds DB on first boot then starts server (sequential, no concurrent SQLite access).
+ENTRYPOINT ["/app/docker-entrypoint.sh"]

docker-entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# SonicJS Docker entrypoint
+# On first boot (no DB file): runs seed which auto-migrates + creates admin.
+# On subsequent boots: skips seed (idempotent check inside seed script).
+# Sequential execution guarantees no concurrent SQLite writer conflict.
+set -e
+
+DB_PATH="${SONICJS_DB_PATH:-/app/data/sonicjs.db}"
+
+if [ ! -f "$DB_PATH" ]; then
+  echo "[entrypoint] First boot — running migrations + seed..."
+  (cd /app/my-sonicjs-app && node --experimental-strip-types src/seed-self-host.ts)
+fi
+
+echo "[entrypoint] Starting SonicJS server..."
+exec node --experimental-strip-types /app/my-sonicjs-app/src/self-host.ts

my-sonicjs-app/src/seed-self-host.ts

@@ -3,22 +3,22 @@
  *
  * Creates an initial admin user when the database has no users yet.
  * Safe to run multiple times — exits silently if an admin already exists.
+ * Safe to run BEFORE the server starts — applies migrations automatically.
  *
  * Usage:
  *   node --experimental-strip-types src/seed-self-host.ts
- *   # or via npm script:
+ *   # or via npm script (from my-sonicjs-app/):
  *   npm run reset
  *
  * Configure via environment variables:
- *   SONICJS_DB_PATH       Path to SQLite file (default: ./data/sonicjs.db)
- *   SONICJS_ADMIN_EMAIL   Admin email         (default: admin@sonicjs.com)
- *   SONICJS_ADMIN_PASSWORD Admin password     (default: sonicjs!)
+ *   SONICJS_DB_PATH        Path to SQLite file (default: ./data/sonicjs.db)
+ *   SONICJS_ADMIN_EMAIL    Admin email         (default: admin@sonicjs.com)
+ *   SONICJS_ADMIN_PASSWORD Admin password      (default: sonicjs!)
  */
 
-import Database from 'better-sqlite3'
 import { hashPassword } from '@better-auth/utils/password'
-import { existsSync } from 'node:fs'
-import { resolve } from 'node:path'
+import { resolve, dirname } from 'node:path'
+import { mkdirSync } from 'node:fs'
 import { createSqliteDriver } from '@sonicjs-cms/core/adapters'
 import { bootstrapDocumentTypes, RbacService } from '@sonicjs-cms/core'
 
@@ -27,18 +27,17 @@ const ADMIN_EMAIL = process.env.SONICJS_ADMIN_EMAIL ?? 'admin@sonicjs.com'
 const ADMIN_PASSWORD = process.env.SONICJS_ADMIN_PASSWORD ?? 'sonicjs!'
 
 async function seed() {
-  if (!existsSync(DB_PATH)) {
-    console.error(`[seed] Database not found at ${DB_PATH}`)
-    console.error('[seed] Start the server first so it auto-migrates, then run this script.')
-    process.exit(1)
-  }
+  // Ensure data directory exists before opening DB.
+  mkdirSync(dirname(DB_PATH), { recursive: true })
 
-  const db = new Database(DB_PATH)
+  // createSqliteDriver: opens DB, enables WAL, auto-migrates schema if absent.
+  // Safe to run before the server — no concurrent connection needed.
+  const driver = await createSqliteDriver({ dbPath: DB_PATH, autoMigrate: true })
 
   try {
     // Idempotency check — skip if any user already exists.
-    const existing = db.prepare('SELECT COUNT(*) as n FROM auth_user').get() as { n: number }
-    if (existing.n > 0) {
+    const existing = await driver.prepare('SELECT COUNT(*) as n FROM auth_user').first<{ n: number }>()
+    if (existing && existing.n > 0) {
       console.log('[seed] Admin already exists — skipping.')
       return
     }
@@ -49,42 +48,36 @@ async function seed() {
 
     const passwordHash = await hashPassword(ADMIN_PASSWORD)
 
-    db.prepare(`
+    await driver.prepare(`
       INSERT INTO auth_user (
         id, email, name, first_name, last_name,
         role, is_super_admin, is_active,
         email_verified, created_at, updated_at
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(userId, ADMIN_EMAIL, 'Admin', 'Admin', 'User', 'admin', 1, 1, 0, now, now)
+    `).bind(userId, ADMIN_EMAIL, 'Admin', 'Admin', 'User', 'admin', 1, 1, 0, now, now).run()
 
-    db.prepare(`
+    await driver.prepare(`
       INSERT INTO auth_account (
         id, user_id, account_id, provider_id, password, created_at, updated_at
       ) VALUES (?, ?, ?, ?, ?, ?, ?)
-    `).run(accountId, userId, userId, 'credential', passwordHash, now, now)
-
-    db.close()
+    `).bind(accountId, userId, userId, 'credential', passwordHash, now, now).run()
 
     // Bootstrap RBAC so the admin user can access /admin (requireRbac('portal', 'access')).
-    // Uses the D1-compatible SqliteDriver so RbacService writes to the same SQLite file.
-    const driver = await createSqliteDriver({ dbPath: DB_PATH, autoMigrate: false })
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     await bootstrapDocumentTypes(driver as any)
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const rbac = new RbacService(driver as any)
     await rbac.ensureSystemRbacSeed()
     await rbac.addUserRoleByName(userId, 'admin')
-    driver.close()
 
     console.log('[seed] Admin user created:')
     console.log(`  Email:    ${ADMIN_EMAIL}`)
     console.log(`  Password: ${ADMIN_PASSWORD}`)
     if (ADMIN_PASSWORD === 'sonicjs!') {
       console.log('  ⚠ Change this password after first login!')
     }
-    return
   } finally {
-    if (db.open) db.close()
+    driver.close()
   }
 }
 

packages/core/src/db/migrations-bundle.ts

@@ -1,7 +1,7 @@
 /**
  * AUTO-GENERATED FILE - DO NOT EDIT
  * Generated by: scripts/generate-migrations.ts
- * Generated at: 2026-07-02T01:18:29.586Z
+ * Generated at: 2026-07-02T22:07:06.083Z
  *
  * This file contains all migration SQL bundled for use in Cloudflare Workers
  * where filesystem access is not available at runtime.

packages/core/src/plugins/manifest-registry.ts

@@ -2,7 +2,7 @@
  * Plugin Registry - AUTO-GENERATED
  *
  * Generated by: packages/scripts/generate-plugin-registry.mjs
- * Generated at: 2026-07-02T01:18:18.271Z
+ * Generated at: 2026-07-02T22:07:05.438Z
  * Source: All manifest.json files in src/plugins/
  *
  * DO NOT EDIT MANUALLY - run the generator script instead.

tests/e2e/94-self-host-smoke.spec.ts

@@ -34,24 +34,21 @@ test.describe('Self-Host Smoke Tests', () => {
     expect(page.url()).toMatch(/login/)
   })
 
-  test('sign-in with seeded admin credentials', async ({ page }) => {
-    await page.goto('/admin')
-    await page.waitForURL(/login/)
-
-    // Fill credentials
-    const emailField = page.locator('input[type="email"], input[name="email"]').first()
-    const passwordField = page.locator('input[type="password"], input[name="password"]').first()
-    await emailField.fill(SELF_HOST_EMAIL)
-    await passwordField.fill(SELF_HOST_PASSWORD)
-
-    await page.locator('button[type="submit"], input[type="submit"]').first().click()
+  test('sign-in and access admin dashboard', async ({ page }) => {
+    // Use page.request so the session cookie is shared with the browser context.
+    const signIn = await page.request.post('/auth/sign-in/email', {
+      data: { email: SELF_HOST_EMAIL, password: SELF_HOST_PASSWORD },
+    })
+    expect(signIn.ok()).toBeTruthy()
 
-    // Should land on admin dashboard
-    await page.waitForURL(/\/admin/, { timeout: 10_000 })
-    expect(page.url()).toContain('/admin')
+    // Navigate to admin — cookie is now in the page's cookie jar.
+    await page.goto('/admin')
+    await page.waitForLoadState('networkidle', { timeout: 10_000 })
 
-    // Should NOT still be on login
-    expect(page.url()).not.toMatch(/login/)
+    // Should be on an admin page (not stuck on login).
+    const url = page.url()
+    expect(url).toContain('/admin')
+    expect(url).not.toContain('login')
   })
 
   test('admin content route accessible after sign-in', async ({ page, request }) => {