@arcblock/did-connect-service 4.0.5 → 4.0.6

package/dist/store.js

@@ -1,1366 +0,0 @@
-/**
- * D1Store — D1-backed storage for passkey auth + team management.
- *
- * Uses the same schema as blocklet-server (users + connected_accounts tables)
- * to ensure interoperability. Unused fields default to null/empty.
- */
-import { dbToAccessType } from "./access-policy.js";
-const SCHEMA_SQL = `
-CREATE TABLE IF NOT EXISTS users (
-  did TEXT PRIMARY KEY,
-  pk TEXT NOT NULL DEFAULT '',
-  fullName TEXT,
-  email TEXT,
-  avatar TEXT,
-  role TEXT,
-  remark TEXT DEFAULT '',
-  sourceProvider TEXT,
-  locale TEXT DEFAULT 'en',
-  approved INTEGER DEFAULT 1,
-  extra TEXT DEFAULT '{}',
-  firstLoginAt TEXT,
-  lastLoginAt TEXT,
-  lastLoginIp TEXT,
-  createdAt TEXT,
-  updatedAt TEXT,
-  sourceAppPid TEXT,
-  didSpace TEXT,
-  url TEXT DEFAULT '',
-  phone TEXT,
-  inviter TEXT,
-  generation INTEGER DEFAULT 0,
-  emailVerified INTEGER DEFAULT 0,
-  phoneVerified INTEGER DEFAULT 0,
-  passkeyCount INTEGER DEFAULT 0,
-  metadata TEXT DEFAULT '{}',
-  address TEXT DEFAULT '{}',
-  name TEXT,
-  createdByAppPid TEXT
-);
-
-CREATE TABLE IF NOT EXISTS connected_accounts (
-  did TEXT PRIMARY KEY,
-  pk TEXT,
-  userDid TEXT REFERENCES users(did),
-  provider TEXT NOT NULL,
-  id TEXT,
-  firstLoginAt TEXT,
-  lastLoginAt TEXT,
-  lastLoginIp TEXT,
-  userInfo TEXT,
-  extra TEXT,
-  counter INTEGER DEFAULT 0
-);
-
-CREATE TABLE IF NOT EXISTS challenges (
-  id TEXT PRIMARY KEY,
-  challenge TEXT NOT NULL,
-  invitationId TEXT,
-  createdAt TEXT DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS invitations (
-  id TEXT PRIMARY KEY,
-  teamDid TEXT NOT NULL,
-  role TEXT NOT NULL,
-  remark TEXT DEFAULT '',
-  inviterDid TEXT NOT NULL,
-  expireAt TEXT NOT NULL,
-  maxUses INTEGER DEFAULT 1,
-  useCount INTEGER DEFAULT 0,
-  status TEXT DEFAULT 'active',
-  createdAt TEXT DEFAULT (datetime('now')),
-  updatedAt TEXT DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS audit_logs (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  action TEXT NOT NULL,
-  operatorDid TEXT NOT NULL,
-  targetDid TEXT,
-  metadata TEXT DEFAULT '{}',
-  ip TEXT,
-  createdAt TEXT DEFAULT (datetime('now'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
-CREATE INDEX IF NOT EXISTS idx_users_pk ON users(pk);
-CREATE INDEX IF NOT EXISTS idx_users_createdAt ON users(createdAt);
-CREATE INDEX IF NOT EXISTS idx_connected_accounts_userDid ON connected_accounts(userDid);
-CREATE INDEX IF NOT EXISTS idx_connected_accounts_pk ON connected_accounts(pk);
-CREATE INDEX IF NOT EXISTS idx_invitations_status ON invitations(status);
-CREATE INDEX IF NOT EXISTS idx_invitations_expireAt ON invitations(expireAt);
-CREATE INDEX IF NOT EXISTS idx_audit_logs_action ON audit_logs(action);
-CREATE INDEX IF NOT EXISTS idx_audit_logs_operatorDid ON audit_logs(operatorDid);
-CREATE INDEX IF NOT EXISTS idx_audit_logs_createdAt ON audit_logs(createdAt);
-
-CREATE TABLE IF NOT EXISTS access_policies (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL,
-  description TEXT DEFAULT '',
-  roles TEXT,
-  reverse INTEGER DEFAULT 0,
-  isProtected INTEGER DEFAULT 0,
-  createdAt TEXT DEFAULT (datetime('now')),
-  updatedAt TEXT DEFAULT (datetime('now'))
-);
-
-CREATE TABLE IF NOT EXISTS security_rules (
-  id TEXT PRIMARY KEY,
-  pathPattern TEXT NOT NULL,
-  priority INTEGER DEFAULT 0,
-  accessPolicyId TEXT NOT NULL REFERENCES access_policies(id),
-  enabled INTEGER DEFAULT 1,
-  remark TEXT DEFAULT '',
-  createdAt TEXT DEFAULT (datetime('now')),
-  updatedAt TEXT DEFAULT (datetime('now'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_security_rules_priority ON security_rules(priority);
-CREATE INDEX IF NOT EXISTS idx_security_rules_accessPolicyId ON security_rules(accessPolicyId);
-
-CREATE TABLE IF NOT EXISTS access_keys (
-  accessKeyId TEXT PRIMARY KEY,
-  accessKeyPublic TEXT NOT NULL,
-  role TEXT NOT NULL,
-  remark TEXT DEFAULT '',
-  createdBy TEXT NOT NULL,
-  expireAt TEXT,
-  lastUsedAt TEXT,
-  createdAt TEXT DEFAULT (datetime('now')),
-  updatedAt TEXT DEFAULT (datetime('now'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_access_keys_createdBy ON access_keys(createdBy);
-CREATE INDEX IF NOT EXISTS idx_access_keys_expireAt ON access_keys(expireAt);
-CREATE INDEX IF NOT EXISTS idx_access_keys_lastUsedAt ON access_keys(lastUsedAt);
-
-CREATE TABLE IF NOT EXISTS connect_tokens (
-  token TEXT PRIMARY KEY,
-  data TEXT NOT NULL,
-  expiresAt INTEGER NOT NULL
-);
-`;
-// Module-level flag: schema migration runs once per isolate lifetime.
-// Safe because CREATE TABLE IF NOT EXISTS is idempotent — if the isolate
-// is recycled the flag resets and the migration re-runs harmlessly.
-let schemaMigrated = false;
-let _rulesCache = null;
-let _rulesCacheAt = 0;
-const RULES_CACHE_TTL = 3600_000; // 1h — write-through invalidation handles same-isolate immediately
-// Per-instance rules cache (same TTL + write-through invalidation as global rules cache)
-const _instanceRulesCache = new Map();
-function invalidateRulesCache() {
-    _rulesCache = null;
-    _rulesCacheAt = 0;
-    _instanceRulesCache.clear();
-}
-const _membershipCache = new Map();
-function membershipKey(userDid, instanceDid) {
-    return `${userDid}\0${instanceDid}`;
-}
-function invalidateMembership(userDid, instanceDid) {
-    _membershipCache.delete(membershipKey(userDid, instanceDid));
-}
-function invalidateMembershipsByInstance(instanceDid) {
-    const suffix = `\0${instanceDid}`;
-    for (const key of _membershipCache.keys()) {
-        if (key.endsWith(suffix))
-            _membershipCache.delete(key);
-    }
-}
-/** @internal Reset all module-level caches — for testing only. */
-export function _resetForTesting() {
-    schemaMigrated = false;
-    invalidateRulesCache();
-    _membershipCache.clear();
-}
-export class D1Store {
-    db;
-    constructor(db) {
-        this.db = db;
-    }
-    /** Run schema migration. Idempotent — only executes once per isolate. */
-    async migrate() {
-        if (schemaMigrated)
-            return;
-        const statements = SCHEMA_SQL.split(";")
-            .map((s) => s.trim())
-            .filter((s) => s.length > 0);
-        await this.db.batch(statements.map((sql) => this.db.prepare(sql)));
-        // Migrations (idempotent — ALTER fails silently if column exists)
-        for (const stmt of [
-            "ALTER TABLE challenges ADD COLUMN invitationId TEXT",
-            "ALTER TABLE users ADD COLUMN sourceDomain TEXT",
-            "ALTER TABLE users ADD COLUMN lastLoginDomain TEXT",
-            // Step 4: per-instance auth columns
-            "ALTER TABLE security_rules ADD COLUMN instance_did TEXT DEFAULT NULL",
-            "ALTER TABLE access_keys ADD COLUMN instance_did TEXT DEFAULT NULL",
-            "ALTER TABLE audit_logs ADD COLUMN instance_did TEXT DEFAULT NULL",
-            "ALTER TABLE access_policies ADD COLUMN instance_did TEXT DEFAULT NULL",
-            // Step 5: invitations instance scoping
-            "ALTER TABLE invitations ADD COLUMN instance_did TEXT DEFAULT NULL",
-        ]) {
-            try {
-                await this.db.prepare(stmt).run();
-            }
-            catch {
-                // Column already exists — expected after first migration
-            }
-        }
-        // Step 4: create memberships table (idempotent)
-        await this.db.batch([
-            this.db.prepare(`
-        CREATE TABLE IF NOT EXISTS memberships (
-          user_did TEXT NOT NULL,
-          instance_did TEXT NOT NULL,
-          role TEXT NOT NULL DEFAULT 'guest',
-          invited_by TEXT,
-          joined_at TEXT NOT NULL DEFAULT (datetime('now')),
-          PRIMARY KEY (user_did, instance_did)
-        )
-      `),
-            this.db.prepare(`CREATE INDEX IF NOT EXISTS idx_memberships_instance ON memberships(instance_did)`),
-        ]);
-        // Step 8: create settings table (idempotent)
-        await this.db
-            .prepare(`CREATE TABLE IF NOT EXISTS settings (
-          instance_did TEXT NOT NULL,
-          key TEXT NOT NULL,
-          value TEXT,
-          updated_at TEXT DEFAULT (datetime('now')),
-          PRIMARY KEY (instance_did, key)
-        )`)
-            .run();
-        // Step 9: create verify_codes table for email login (idempotent)
-        await this.db
-            .prepare(`CREATE TABLE IF NOT EXISTS verify_codes (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          code TEXT NOT NULL UNIQUE,
-          subject TEXT NOT NULL,
-          purpose TEXT DEFAULT 'login',
-          verified INTEGER DEFAULT 0,
-          verified_at TEXT,
-          sent INTEGER DEFAULT 0,
-          sent_at TEXT,
-          created_at TEXT DEFAULT (datetime('now'))
-        )`)
-            .run();
-        await this.db
-            .prepare("CREATE INDEX IF NOT EXISTS idx_vc_subject ON verify_codes(subject)")
-            .run();
-        // Step 10: create login_tickets table for federation (idempotent)
-        await this.db
-            .prepare(`CREATE TABLE IF NOT EXISTS login_tickets (
-          ticket TEXT PRIMARY KEY,
-          did TEXT NOT NULL,
-          target_origin TEXT,
-          created_at TEXT DEFAULT (datetime('now')),
-          expires_at TEXT NOT NULL
-        )`)
-            .run();
-        // Seed built-in access policies + default rule (idempotent via INSERT OR IGNORE)
-        await this.ensureBuiltinPolicies();
-        await this.ensureDefaultRule();
-        schemaMigrated = true;
-    }
-    /** @internal Backwards-compatible alias for migrate(). */
-    async ensureSchema() {
-        return this.migrate();
-    }
-    // ─── Challenge operations ──────────────────────────────────────────────
-    async saveChallenge(id, challenge, invitationId) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("INSERT OR REPLACE INTO challenges (id, challenge, invitationId) VALUES (?, ?, ?)")
-            .bind(id, challenge, invitationId ?? null)
-            .run();
-    }
-    async getChallenge(id) {
-        await this.ensureSchema();
-        const row = await this.db
-            .prepare("SELECT challenge, invitationId FROM challenges WHERE id = ?")
-            .bind(id)
-            .first();
-        return row ?? null;
-    }
-    async deleteChallenge(id) {
-        await this.ensureSchema();
-        await this.db.prepare("DELETE FROM challenges WHERE id = ?").bind(id).run();
-    }
-    async purgeExpiredChallenges() {
-        await this.ensureSchema();
-        // Purge challenges older than 5 minutes
-        await this.db
-            .prepare("DELETE FROM challenges WHERE createdAt < datetime('now', '-5 minutes')")
-            .run();
-    }
-    async isRegistrationOpen() {
-        await this.ensureSchema();
-        const row = await this.db
-            .prepare("SELECT accessPolicyId FROM security_rules WHERE id = 'default'")
-            .first();
-        return row?.accessPolicyId === "public";
-    }
-    // ─── User operations ──────────────────────────────────────────────────
-    async createUser(params) {
-        await this.ensureSchema();
-        const now = new Date().toISOString();
-        await this.db
-            .prepare(`INSERT INTO users (did, pk, fullName, email, sourceProvider, firstLoginAt, lastLoginAt, lastLoginIp, sourceDomain, lastLoginDomain, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .bind(params.did, params.pk, params.fullName ?? null, params.email ?? null, params.sourceProvider, now, now, params.ip ?? null, params.domain ?? null, params.domain ?? null, now, now)
-            .run();
-    }
-    async getUserByDid(did) {
-        await this.ensureSchema();
-        return this.db.prepare("SELECT * FROM users WHERE did = ?").bind(did).first();
-    }
-    async updateLastLogin(did, ip, domain) {
-        await this.ensureSchema();
-        const now = new Date().toISOString();
-        await this.db
-            .prepare("UPDATE users SET lastLoginAt = ?, lastLoginIp = ?, lastLoginDomain = ?, updatedAt = ? WHERE did = ?")
-            .bind(now, ip ?? null, domain ?? null, now, did)
-            .run();
-    }
-    async incrementPasskeyCount(did) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("UPDATE users SET passkeyCount = passkeyCount + 1, updatedAt = ? WHERE did = ?")
-            .bind(new Date().toISOString(), did)
-            .run();
-    }
-    // ─── Team: User queries ────────────────────────────────────────────────
-    async getUserCount() {
-        await this.ensureSchema();
-        const row = await this.db
-            .prepare("SELECT COUNT(*) as count FROM users")
-            .first();
-        return Number(row?.count ?? 0);
-    }
-    async getUsers(opts) {
-        await this.ensureSchema();
-        const conditions = [];
-        const params = [];
-        if (opts.role) {
-            conditions.push("u.role = ?");
-            params.push(opts.role);
-        }
-        if (opts.approved !== undefined) {
-            conditions.push("u.approved = ?");
-            params.push(opts.approved);
-        }
-        if (opts.search) {
-            conditions.push("(u.fullName LIKE ? OR u.email LIKE ? OR u.did LIKE ?)");
-            const like = `%${opts.search}%`;
-            params.push(like, like, like);
-        }
-        if (opts.sourceProvider) {
-            conditions.push("u.sourceProvider = ?");
-            params.push(opts.sourceProvider);
-        }
-        const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-        const offset = (opts.page - 1) * opts.pageSize;
-        // Count query
-        const countRow = await this.db
-            .prepare(`SELECT COUNT(*) as count FROM users u ${where}`)
-            .bind(...params)
-            .first();
-        const total = countRow?.count ?? 0;
-        // Data query with JOIN to resolve inviter name
-        const rows = await this.db
-            .prepare(`SELECT u.did, u.fullName, u.email, u.avatar, u.role, u.approved, u.createdAt, u.lastLoginAt, u.passkeyCount, u.sourceDomain, u.lastLoginDomain, u.sourceProvider, u.inviter,
-                inv.fullName as inviterName
-         FROM users u
-         LEFT JOIN users inv ON u.inviter = inv.did
-         ${where}
-         ORDER BY u.createdAt DESC
-         LIMIT ? OFFSET ?`)
-            .bind(...params, opts.pageSize, offset)
-            .all();
-        return { users: rows.results ?? [], total };
-    }
-    async getMemberInfo(did) {
-        await this.ensureSchema();
-        const row = await this.db
-            .prepare(`SELECT u.did, u.fullName, u.email, u.avatar, u.role, u.approved, u.createdAt, u.lastLoginAt, u.passkeyCount, u.sourceDomain, u.lastLoginDomain, u.sourceProvider, u.inviter,
-                inv.fullName as inviterName
-         FROM users u
-         LEFT JOIN users inv ON u.inviter = inv.did
-         WHERE u.did = ?`)
-            .bind(did)
-            .first();
-        return row ?? null;
-    }
-    async updateUserRole(did, role) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("UPDATE users SET role = ?, updatedAt = ? WHERE did = ?")
-            .bind(role, new Date().toISOString(), did)
-            .run();
-    }
-    async updateUserApproval(did, approved) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("UPDATE users SET approved = ?, updatedAt = ? WHERE did = ?")
-            .bind(approved ? 1 : 0, new Date().toISOString(), did)
-            .run();
-    }
-    async updateUserProfile(did, fields) {
-        await this.ensureSchema();
-        const sets = [];
-        const params = [];
-        if (fields.fullName !== undefined) {
-            sets.push("fullName = ?");
-            params.push(fields.fullName);
-        }
-        if (fields.email !== undefined) {
-            sets.push("email = ?");
-            params.push(fields.email);
-        }
-        if (fields.avatar !== undefined) {
-            sets.push("avatar = ?");
-            params.push(fields.avatar);
-        }
-        if (sets.length === 0)
-            return;
-        sets.push("updatedAt = ?");
-        params.push(new Date().toISOString());
-        params.push(did);
-        await this.db
-            .prepare(`UPDATE users SET ${sets.join(", ")} WHERE did = ?`)
-            .bind(...params)
-            .run();
-    }
-    async removeUser(did) {
-        await this.ensureSchema();
-        // Delete connected accounts first, then user
-        await this.db.batch([
-            this.db.prepare("DELETE FROM connected_accounts WHERE userDid = ?").bind(did),
-            this.db.prepare("DELETE FROM users WHERE did = ?").bind(did),
-        ]);
-    }
-    async setUserInviter(did, inviterDid) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("UPDATE users SET inviter = ?, updatedAt = ? WHERE did = ? AND inviter IS NULL")
-            .bind(inviterDid, new Date().toISOString(), did)
-            .run();
-    }
-    /**
-     * Atomically transfer ownership: set target to owner, caller to admin.
-     * Uses D1 batch for atomicity.
-     */
-    async transferOwnership(currentOwnerDid, newOwnerDid) {
-        await this.ensureSchema();
-        const now = new Date().toISOString();
-        await this.db.batch([
-            this.db
-                .prepare("UPDATE users SET role = 'owner', updatedAt = ? WHERE did = ?")
-                .bind(now, newOwnerDid),
-            this.db
-                .prepare("UPDATE users SET role = 'admin', updatedAt = ? WHERE did = ?")
-                .bind(now, currentOwnerDid),
-        ]);
-    }
-    // ─── Team: Invitations ────────────────────────────────────────────────
-    async createInvitation(input) {
-        await this.ensureSchema();
-        const id = crypto.randomUUID();
-        const now = new Date().toISOString();
-        const expireHours = input.expireHours ?? 168; // 7 days
-        const maxUses = input.maxUses ?? 1;
-        const expireAt = new Date(Date.now() + expireHours * 60 * 60 * 1000).toISOString();
-        await this.db
-            .prepare(`INSERT INTO invitations (id, teamDid, role, remark, inviterDid, expireAt, maxUses, useCount, status, instance_did, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, ?, ?, ?, 0, 'active', ?, ?, ?)`)
-            .bind(id, input.teamDid, input.role, input.remark ?? "", input.inviterDid, expireAt, maxUses, input.instanceDid ?? null, now, now)
-            .run();
-        return {
-            id,
-            teamDid: input.teamDid,
-            role: input.role,
-            remark: input.remark ?? "",
-            inviterDid: input.inviterDid,
-            expireAt,
-            maxUses,
-            useCount: 0,
-            status: "active",
-            createdAt: now,
-            updatedAt: now,
-            instance_did: input.instanceDid ?? null,
-        };
-    }
-    async getInvitation(id) {
-        await this.ensureSchema();
-        return this.db
-            .prepare("SELECT * FROM invitations WHERE id = ?")
-            .bind(id)
-            .first();
-    }
-    async getInvitations(opts) {
-        await this.ensureSchema();
-        const offset = (opts.page - 1) * opts.pageSize;
-        const conditions = [];
-        const params = [];
-        if (opts.instanceDid !== undefined) {
-            conditions.push("i.instance_did = ?");
-            params.push(opts.instanceDid);
-        }
-        else {
-            conditions.push("i.instance_did IS NULL");
-        }
-        const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-        const countRow = await this.db
-            .prepare(`SELECT COUNT(*) as count FROM invitations i ${where}`)
-            .bind(...params)
-            .first();
-        const total = countRow?.count ?? 0;
-        const rows = await this.db
-            .prepare(`SELECT i.*, u.fullName as inviterName
-         FROM invitations i
-         LEFT JOIN users u ON i.inviterDid = u.did
-         ${where}
-         ORDER BY i.createdAt DESC
-         LIMIT ? OFFSET ?`)
-            .bind(...params, opts.pageSize, offset)
-            .all();
-        return { invitations: rows.results ?? [], total };
-    }
-    /**
-     * Atomically increment useCount. Returns false if maxUses already reached.
-     */
-    async incrementInvitationUseCount(id) {
-        await this.ensureSchema();
-        const result = await this.db
-            .prepare(`UPDATE invitations SET useCount = useCount + 1, updatedAt = ?
-         WHERE id = ? AND useCount < maxUses AND status = 'active'`)
-            .bind(new Date().toISOString(), id)
-            .run();
-        return (result.meta?.changes ?? 0) > 0;
-    }
-    async updateInvitationStatus(id, status) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("UPDATE invitations SET status = ?, updatedAt = ? WHERE id = ?")
-            .bind(status, new Date().toISOString(), id)
-            .run();
-    }
-    async deleteInvitation(id) {
-        await this.ensureSchema();
-        await this.db.prepare("DELETE FROM invitations WHERE id = ?").bind(id).run();
-    }
-    async purgeExpiredInvitations() {
-        await this.ensureSchema();
-        await this.db
-            .prepare("UPDATE invitations SET status = 'expired', updatedAt = ? WHERE status = 'active' AND expireAt < datetime('now')")
-            .bind(new Date().toISOString())
-            .run();
-    }
-    // ─── Team: Audit logs ─────────────────────────────────────────────────
-    async createAuditLog(input) {
-        await this.ensureSchema();
-        await this.db
-            .prepare(`INSERT INTO audit_logs (action, operatorDid, targetDid, metadata, ip, instance_did, createdAt)
-         VALUES (?, ?, ?, ?, ?, ?, ?)`)
-            .bind(input.action, input.operatorDid, input.targetDid ?? null, JSON.stringify(input.metadata ?? {}), input.ip ?? null, input.instanceDid ?? null, new Date().toISOString())
-            .run();
-    }
-    async getAuditLogs(opts) {
-        await this.ensureSchema();
-        const conditions = [];
-        const params = [];
-        if (opts.action) {
-            conditions.push("a.action = ?");
-            params.push(opts.action);
-        }
-        if (opts.instanceDid !== undefined) {
-            conditions.push("a.instance_did = ?");
-            params.push(opts.instanceDid);
-        }
-        else {
-            conditions.push("a.instance_did IS NULL");
-        }
-        const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-        const offset = (opts.page - 1) * opts.pageSize;
-        const countRow = await this.db
-            .prepare(`SELECT COUNT(*) as count FROM audit_logs a ${where}`)
-            .bind(...params)
-            .first();
-        const total = countRow?.count ?? 0;
-        const rows = await this.db
-            .prepare(`SELECT a.*, op.fullName as operatorName, tgt.fullName as targetName
-         FROM audit_logs a
-         LEFT JOIN users op ON a.operatorDid = op.did
-         LEFT JOIN users tgt ON a.targetDid = tgt.did
-         ${where}
-         ORDER BY a.createdAt DESC
-         LIMIT ? OFFSET ?`)
-            .bind(...params, opts.pageSize, offset)
-            .all();
-        return { logs: rows.results ?? [], total };
-    }
-    // ─── Instance-scoped audit log operations ────────────────────────────
-    async getAuditLogsForInstance(instanceDid, opts) {
-        await this.ensureSchema();
-        const conditions = ["a.instance_did = ?"];
-        const params = [instanceDid];
-        if (opts.action) {
-            conditions.push("a.action = ?");
-            params.push(opts.action);
-        }
-        const where = `WHERE ${conditions.join(" AND ")}`;
-        const offset = (opts.page - 1) * opts.pageSize;
-        const countRow = await this.db
-            .prepare(`SELECT COUNT(*) as count FROM audit_logs a ${where}`)
-            .bind(...params)
-            .first();
-        const total = countRow?.count ?? 0;
-        const rows = await this.db
-            .prepare(`SELECT a.*, op.fullName as operatorName, tgt.fullName as targetName
-         FROM audit_logs a
-         LEFT JOIN users op ON a.operatorDid = op.did
-         LEFT JOIN users tgt ON a.targetDid = tgt.did
-         ${where}
-         ORDER BY a.createdAt DESC
-         LIMIT ? OFFSET ?`)
-            .bind(...params, opts.pageSize, offset)
-            .all();
-        return { logs: rows.results ?? [], total };
-    }
-    async getAuditLogById(id, instanceDid) {
-        await this.ensureSchema();
-        return this.db
-            .prepare(`SELECT a.*, op.fullName as operatorName, tgt.fullName as targetName
-         FROM audit_logs a
-         LEFT JOIN users op ON a.operatorDid = op.did
-         LEFT JOIN users tgt ON a.targetDid = tgt.did
-         WHERE a.id = ? AND a.instance_did = ?`)
-            .bind(id, instanceDid)
-            .first();
-    }
-    // ─── Connected accounts operations ────────────────────────────────────
-    async createConnectedAccount(params) {
-        await this.ensureSchema();
-        const now = new Date().toISOString();
-        await this.db
-            .prepare(`INSERT INTO connected_accounts (did, pk, userDid, provider, id, extra, userInfo, firstLoginAt, lastLoginAt, lastLoginIp)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .bind(params.did, params.pk, params.userDid, params.provider, params.id, params.extra, params.userInfo, now, now, params.ip ?? null)
-            .run();
-    }
-    async upsertConnectedAccount(account) {
-        await this.ensureSchema();
-        await this.db
-            .prepare(`INSERT INTO connected_accounts (did, pk, userDid, provider, id, userInfo, firstLoginAt, lastLoginAt)
-         VALUES (?, ?, ?, ?, ?, ?, datetime('now'), datetime('now'))
-         ON CONFLICT (did) DO UPDATE SET
-           pk = excluded.pk, lastLoginAt = datetime('now'),
-           userInfo = COALESCE(excluded.userInfo, connected_accounts.userInfo)`)
-            .bind(account.did, account.pk, account.userDid, account.provider, account.id, account.userInfo || null)
-            .run();
-    }
-    async getConnectedAccountById(credentialId) {
-        await this.ensureSchema();
-        return this.db
-            .prepare("SELECT * FROM connected_accounts WHERE id = ?")
-            .bind(credentialId)
-            .first();
-    }
-    async getConnectedAccountByDid(did) {
-        await this.ensureSchema();
-        return this.db
-            .prepare("SELECT * FROM connected_accounts WHERE did = ?")
-            .bind(did)
-            .first();
-    }
-    async updateCounter(did, counter) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("UPDATE connected_accounts SET counter = ?, lastLoginAt = ? WHERE did = ?")
-            .bind(counter, new Date().toISOString(), did)
-            .run();
-    }
-    async getConnectedAccountsByUserDid(userDid) {
-        await this.ensureSchema();
-        const rows = await this.db
-            .prepare("SELECT * FROM connected_accounts WHERE userDid = ?")
-            .bind(userDid)
-            .all();
-        return rows.results ?? [];
-    }
-    async getConnectedAccountByProviderAndUser(provider, userDid) {
-        await this.ensureSchema();
-        return this.db
-            .prepare("SELECT * FROM connected_accounts WHERE provider = ? AND userDid = ?")
-            .bind(provider, userDid)
-            .first();
-    }
-    async deleteConnectedAccount(did) {
-        await this.ensureSchema();
-        await this.db.prepare("DELETE FROM connected_accounts WHERE did = ?").bind(did).run();
-    }
-    // ─── Access keys ────────────────────────────────────────────────────────
-    async createAccessKey(input) {
-        await this.ensureSchema();
-        const now = new Date().toISOString();
-        await this.db
-            .prepare(`INSERT INTO access_keys (accessKeyId, accessKeyPublic, role, remark, createdBy, expireAt, instance_did, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .bind(input.accessKeyId, input.accessKeyPublic, input.role, input.remark ?? "", input.createdBy, input.expireAt ?? null, input.instanceDid ?? null, now, now)
-            .run();
-        return {
-            accessKeyId: input.accessKeyId,
-            accessKeyPublic: input.accessKeyPublic,
-            role: input.role,
-            remark: input.remark ?? "",
-            createdBy: input.createdBy,
-            expireAt: input.expireAt ?? null,
-            lastUsedAt: null,
-            createdAt: now,
-            updatedAt: now,
-            instance_did: input.instanceDid ?? null,
-        };
-    }
-    async getAccessKeyById(accessKeyId) {
-        await this.ensureSchema();
-        const row = await this.db
-            .prepare(`SELECT k.*, u.fullName as createdByName
-         FROM access_keys k
-         LEFT JOIN users u ON k.createdBy = u.did
-         WHERE k.accessKeyId = ?`)
-            .bind(accessKeyId)
-            .first();
-        if (!row)
-            return null;
-        const { instance_did, ...rest } = row;
-        return { ...rest, createdByName: row.createdByName ?? null, instanceDid: instance_did ?? null };
-    }
-    async getAccessKeys(opts) {
-        await this.ensureSchema();
-        const conditions = [];
-        const params = [];
-        if (opts.createdBy) {
-            conditions.push("k.createdBy = ?");
-            params.push(opts.createdBy);
-        }
-        if (opts.search) {
-            conditions.push("(k.remark LIKE ? OR k.accessKeyId LIKE ?)");
-            const like = `%${opts.search}%`;
-            params.push(like, like);
-        }
-        if (opts.instanceDid !== undefined) {
-            conditions.push("k.instance_did = ?");
-            params.push(opts.instanceDid);
-        }
-        else {
-            conditions.push("k.instance_did IS NULL");
-        }
-        const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-        const offset = (opts.page - 1) * opts.pageSize;
-        const countRow = await this.db
-            .prepare(`SELECT COUNT(*) as count FROM access_keys k ${where}`)
-            .bind(...params)
-            .first();
-        const total = countRow?.count ?? 0;
-        const rows = await this.db
-            .prepare(`SELECT k.*, u.fullName as createdByName
-         FROM access_keys k
-         LEFT JOIN users u ON k.createdBy = u.did
-         ${where}
-         ORDER BY k.createdAt DESC
-         LIMIT ? OFFSET ?`)
-            .bind(...params, opts.pageSize, offset)
-            .all();
-        return {
-            keys: (rows.results ?? []).map((r) => {
-                const { instance_did, ...rest } = r;
-                return {
-                    ...rest,
-                    createdByName: r.createdByName ?? null,
-                    instanceDid: instance_did ?? null,
-                };
-            }),
-            total,
-        };
-    }
-    async updateAccessKey(accessKeyId, input) {
-        await this.ensureSchema();
-        const sets = [];
-        const params = [];
-        if (input.remark !== undefined) {
-            sets.push("remark = ?");
-            params.push(input.remark);
-        }
-        if ("expireAt" in input) {
-            sets.push("expireAt = ?");
-            params.push(input.expireAt ?? null);
-        }
-        if (sets.length > 0) {
-            sets.push("updatedAt = ?");
-            params.push(new Date().toISOString());
-            params.push(accessKeyId);
-            await this.db
-                .prepare(`UPDATE access_keys SET ${sets.join(", ")} WHERE accessKeyId = ?`)
-                .bind(...params)
-                .run();
-        }
-        return this.getAccessKeyById(accessKeyId);
-    }
-    async deleteAccessKey(accessKeyId) {
-        await this.ensureSchema();
-        await this.db.prepare("DELETE FROM access_keys WHERE accessKeyId = ?").bind(accessKeyId).run();
-    }
-    async refreshAccessKeyLastUsed(accessKeyId) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("UPDATE access_keys SET lastUsedAt = ? WHERE accessKeyId = ?")
-            .bind(new Date().toISOString(), accessKeyId)
-            .run();
-    }
-    // ─── Access policies: seeding ──────────────────────────────────────────
-    async ensureBuiltinPolicies() {
-        const policies = [
-            {
-                id: "public",
-                name: "Public",
-                description: "Anyone can access, no login required",
-                roles: null,
-                reverse: 0,
-            },
-            {
-                id: "invited-only",
-                name: "Invited Only",
-                description: "Any logged-in user can access",
-                roles: "[]",
-                reverse: 1,
-            },
-            {
-                id: "admin-only",
-                name: "Admin Only",
-                description: "Only owner and admin can access",
-                roles: '["owner","admin"]',
-                reverse: 0,
-            },
-            {
-                id: "owner-only",
-                name: "Owner Only",
-                description: "Only the owner can access",
-                roles: '["owner"]',
-                reverse: 0,
-            },
-        ];
-        const now = new Date().toISOString();
-        await this.db.batch(policies.map((p) => this.db
-            .prepare(`INSERT OR IGNORE INTO access_policies (id, name, description, roles, reverse, isProtected, createdAt, updatedAt)
-             VALUES (?, ?, ?, ?, ?, 1, ?, ?)`)
-            .bind(p.id, p.name, p.description, p.roles, p.reverse, now, now)));
-        invalidateRulesCache();
-    }
-    async ensureDefaultRule() {
-        const now = new Date().toISOString();
-        await this.db
-            .prepare(`INSERT OR IGNORE INTO security_rules (id, pathPattern, priority, accessPolicyId, enabled, remark, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-            .bind("default", "*", -1, "public", 1, "Default fallback rule", now, now)
-            .run();
-        invalidateRulesCache();
-    }
-    // ─── Access policies: CRUD ─────────────────────────────────────────────
-    async getAccessPolicies(instanceDid) {
-        await this.ensureSchema();
-        let sql = "SELECT * FROM access_policies";
-        const params = [];
-        if (instanceDid !== undefined) {
-            sql += " WHERE instance_did = ?";
-            params.push(instanceDid);
-        }
-        else {
-            sql += " WHERE instance_did IS NULL";
-        }
-        sql += " ORDER BY isProtected DESC, createdAt ASC";
-        const rows = await this.db
-            .prepare(sql)
-            .bind(...params)
-            .all();
-        const policies = rows.results ?? [];
-        const result = [];
-        for (const p of policies) {
-            const ruleCount = await this.getAccessPolicyRuleCount(p.id);
-            const { accessType, roles } = dbToAccessType(p.roles, p.reverse);
-            result.push({
-                id: p.id,
-                name: p.name,
-                description: p.description,
-                roles: roles ?? (p.roles !== null ? JSON.parse(p.roles) : null),
-                reverse: p.reverse === 1,
-                isProtected: p.isProtected === 1,
-                accessType,
-                ruleCount,
-                createdAt: p.createdAt,
-                updatedAt: p.updatedAt,
-                instanceDid: p.instance_did ?? null,
-            });
-        }
-        return result;
-    }
-    async getAccessPolicy(id) {
-        await this.ensureSchema();
-        const p = await this.db
-            .prepare("SELECT * FROM access_policies WHERE id = ?")
-            .bind(id)
-            .first();
-        if (!p)
-            return null;
-        const ruleCount = await this.getAccessPolicyRuleCount(p.id);
-        const { accessType, roles } = dbToAccessType(p.roles, p.reverse);
-        return {
-            id: p.id,
-            name: p.name,
-            description: p.description,
-            roles: roles ?? (p.roles !== null ? JSON.parse(p.roles) : null),
-            reverse: p.reverse === 1,
-            isProtected: p.isProtected === 1,
-            accessType,
-            ruleCount,
-            createdAt: p.createdAt,
-            updatedAt: p.updatedAt,
-            instanceDid: p.instance_did ?? null,
-        };
-    }
-    async createAccessPolicy(input) {
-        await this.ensureSchema();
-        const id = crypto.randomUUID();
-        const now = new Date().toISOString();
-        const { roles: dbRoles, reverse } = await import("./access-policy.js").then((m) => m.accessTypeToDb(input.accessType, input.roles));
-        await this.db
-            .prepare(`INSERT INTO access_policies (id, name, description, roles, reverse, isProtected, instance_did, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, ?, 0, ?, ?, ?)`)
-            .bind(id, input.name, input.description ?? "", dbRoles, reverse, input.instanceDid ?? null, now, now)
-            .run();
-        invalidateRulesCache();
-        return (await this.getAccessPolicy(id));
-    }
-    async updateAccessPolicy(id, input) {
-        await this.ensureSchema();
-        const now = new Date().toISOString();
-        const sets = [];
-        const params = [];
-        if (input.name !== undefined) {
-            sets.push("name = ?");
-            params.push(input.name);
-        }
-        if (input.description !== undefined) {
-            sets.push("description = ?");
-            params.push(input.description);
-        }
-        if (input.accessType !== undefined) {
-            const { roles: dbRoles, reverse } = await import("./access-policy.js").then((m) => m.accessTypeToDb(input.accessType, input.roles));
-            sets.push("roles = ?");
-            params.push(dbRoles);
-            sets.push("reverse = ?");
-            params.push(reverse);
-        }
-        if (sets.length > 0) {
-            sets.push("updatedAt = ?");
-            params.push(now);
-            params.push(id);
-            await this.db
-                .prepare(`UPDATE access_policies SET ${sets.join(", ")} WHERE id = ?`)
-                .bind(...params)
-                .run();
-        }
-        invalidateRulesCache();
-        return (await this.getAccessPolicy(id));
-    }
-    async deleteAccessPolicy(id) {
-        await this.ensureSchema();
-        await this.db.prepare("DELETE FROM access_policies WHERE id = ?").bind(id).run();
-        invalidateRulesCache();
-    }
-    async getAccessPolicyRuleCount(id) {
-        const row = await this.db
-            .prepare("SELECT COUNT(*) as count FROM security_rules WHERE accessPolicyId = ?")
-            .bind(id)
-            .first();
-        return Number(row?.count ?? 0);
-    }
-    // ─── Security rules: CRUD ─────────────────────────────────────────────
-    async getSecurityRules(instanceDid) {
-        await this.ensureSchema();
-        let sql = `SELECT r.*, p.name as accessPolicyName
-         FROM security_rules r
-         LEFT JOIN access_policies p ON r.accessPolicyId = p.id`;
-        const params = [];
-        if (instanceDid !== undefined) {
-            sql += ` WHERE r.instance_did = ?`;
-            params.push(instanceDid);
-        }
-        else {
-            sql += ` WHERE r.instance_did IS NULL`;
-        }
-        sql += ` ORDER BY CASE WHEN r.id = 'default' THEN 1 ELSE 0 END, r.priority ASC`;
-        const rows = await this.db
-            .prepare(sql)
-            .bind(...params)
-            .all();
-        return (rows.results ?? []).map((r) => ({
-            id: r.id,
-            pathPattern: r.pathPattern,
-            priority: r.priority,
-            accessPolicyId: r.accessPolicyId,
-            accessPolicyName: r.accessPolicyName ?? "",
-            enabled: r.enabled === 1,
-            remark: r.remark,
-            createdAt: r.createdAt,
-            updatedAt: r.updatedAt,
-            instanceDid: r.instance_did ?? null,
-        }));
-    }
-    async getSecurityRule(id) {
-        await this.ensureSchema();
-        const r = await this.db
-            .prepare(`SELECT r.*, p.name as accessPolicyName
-         FROM security_rules r
-         LEFT JOIN access_policies p ON r.accessPolicyId = p.id
-         WHERE r.id = ?`)
-            .bind(id)
-            .first();
-        if (!r)
-            return null;
-        return {
-            id: r.id,
-            pathPattern: r.pathPattern,
-            priority: r.priority,
-            accessPolicyId: r.accessPolicyId,
-            accessPolicyName: r.accessPolicyName ?? "",
-            enabled: r.enabled === 1,
-            remark: r.remark,
-            createdAt: r.createdAt,
-            updatedAt: r.updatedAt,
-            instanceDid: r.instance_did ?? null,
-        };
-    }
-    async createSecurityRule(input) {
-        await this.ensureSchema();
-        const id = crypto.randomUUID();
-        const now = new Date().toISOString();
-        await this.db
-            .prepare(`INSERT INTO security_rules (id, pathPattern, priority, accessPolicyId, enabled, remark, instance_did, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?)`)
-            .bind(id, input.pathPattern, input.priority ?? 0, input.accessPolicyId, input.remark ?? "", input.instanceDid ?? null, now, now)
-            .run();
-        invalidateRulesCache();
-        return (await this.getSecurityRule(id));
-    }
-    async updateSecurityRule(id, input) {
-        await this.ensureSchema();
-        const now = new Date().toISOString();
-        const sets = [];
-        const params = [];
-        if (input.pathPattern !== undefined) {
-            sets.push("pathPattern = ?");
-            params.push(input.pathPattern);
-        }
-        if (input.accessPolicyId !== undefined) {
-            sets.push("accessPolicyId = ?");
-            params.push(input.accessPolicyId);
-        }
-        if (input.priority !== undefined) {
-            sets.push("priority = ?");
-            params.push(input.priority);
-        }
-        if (input.enabled !== undefined) {
-            sets.push("enabled = ?");
-            params.push(input.enabled ? 1 : 0);
-        }
-        if (input.remark !== undefined) {
-            sets.push("remark = ?");
-            params.push(input.remark);
-        }
-        if (sets.length > 0) {
-            sets.push("updatedAt = ?");
-            params.push(now);
-            params.push(id);
-            await this.db
-                .prepare(`UPDATE security_rules SET ${sets.join(", ")} WHERE id = ?`)
-                .bind(...params)
-                .run();
-        }
-        invalidateRulesCache();
-        return (await this.getSecurityRule(id));
-    }
-    async deleteSecurityRule(id) {
-        await this.ensureSchema();
-        await this.db.prepare("DELETE FROM security_rules WHERE id = ?").bind(id).run();
-        invalidateRulesCache();
-    }
-    // ─── Membership operations ──────────────────────────────────────────────
-    async createMembership(userDid, instanceDid, role, invitedBy) {
-        await this.ensureSchema();
-        await this.db
-            .prepare(`INSERT INTO memberships (user_did, instance_did, role, invited_by) VALUES (?, ?, ?, ?)`)
-            .bind(userDid, instanceDid, role, invitedBy ?? null)
-            .run();
-        invalidateMembership(userDid, instanceDid);
-    }
-    async getMembership(userDid, instanceDid) {
-        const cacheKey = membershipKey(userDid, instanceDid);
-        const cached = _membershipCache.get(cacheKey);
-        if (cached && Date.now() - cached.at < RULES_CACHE_TTL) {
-            return cached.result;
-        }
-        await this.ensureSchema();
-        const result = await this.db
-            .prepare("SELECT * FROM memberships WHERE user_did = ? AND instance_did = ?")
-            .bind(userDid, instanceDid)
-            .first();
-        _membershipCache.set(cacheKey, { result: result ?? null, at: Date.now() });
-        return result ?? null;
-    }
-    async listMemberships(instanceDid) {
-        await this.ensureSchema();
-        const rows = await this.db
-            .prepare("SELECT * FROM memberships WHERE instance_did = ? ORDER BY joined_at ASC")
-            .bind(instanceDid)
-            .all();
-        return rows.results ?? [];
-    }
-    async listMembershipsWithUserInfo(instanceDid) {
-        await this.ensureSchema();
-        const rows = await this.db
-            .prepare(`SELECT m.user_did, m.instance_did, m.role, m.invited_by, m.joined_at,
-                u.fullName, u.email, u.avatar, COALESCE(u.approved, 1) as approved
-         FROM memberships m
-         LEFT JOIN users u ON m.user_did = u.did
-         WHERE m.instance_did = ?
-         ORDER BY
-           CASE m.role WHEN 'owner' THEN 0 WHEN 'admin' THEN 1 WHEN 'member' THEN 2 ELSE 3 END,
-           m.joined_at ASC`)
-            .bind(instanceDid)
-            .all();
-        return rows.results ?? [];
-    }
-    async updateMembershipRole(userDid, instanceDid, role) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("UPDATE memberships SET role = ? WHERE user_did = ? AND instance_did = ?")
-            .bind(role, userDid, instanceDid)
-            .run();
-        invalidateMembership(userDid, instanceDid);
-    }
-    async deleteMembership(userDid, instanceDid) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("DELETE FROM memberships WHERE user_did = ? AND instance_did = ?")
-            .bind(userDid, instanceDid)
-            .run();
-        invalidateMembership(userDid, instanceDid);
-    }
-    async deleteMembershipsByInstance(instanceDid) {
-        await this.ensureSchema();
-        await this.db.prepare("DELETE FROM memberships WHERE instance_did = ?").bind(instanceDid).run();
-        invalidateMembershipsByInstance(instanceDid);
-    }
-    // ─── Settings CRUD ─────────────────────────────────────────────────────
-    async getSetting(instanceDid, key) {
-        await this.ensureSchema();
-        const row = await this.db
-            .prepare("SELECT value FROM settings WHERE instance_did = ? AND key = ?")
-            .bind(instanceDid, key)
-            .first();
-        return row?.value ?? null;
-    }
-    async setSetting(instanceDid, key, value) {
-        await this.ensureSchema();
-        await this.db
-            .prepare(`INSERT INTO settings (instance_did, key, value, updated_at)
-         VALUES (?, ?, ?, datetime('now'))
-         ON CONFLICT(instance_did, key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`)
-            .bind(instanceDid, key, value)
-            .run();
-    }
-    async listSettings(instanceDid) {
-        await this.ensureSchema();
-        const rows = await this.db
-            .prepare("SELECT key, value, updated_at FROM settings WHERE instance_did = ? ORDER BY key")
-            .bind(instanceDid)
-            .all();
-        return rows.results ?? [];
-    }
-    async deleteSetting(instanceDid, key) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("DELETE FROM settings WHERE instance_did = ? AND key = ?")
-            .bind(instanceDid, key)
-            .run();
-    }
-    // ─── Verify codes (Email Login) ────────────────────────────────────────
-    async createVerifyCode(code, subject, purpose) {
-        await this.ensureSchema();
-        const result = await this.db
-            .prepare("INSERT INTO verify_codes (code, subject, purpose) VALUES (?, ?, ?)")
-            .bind(code, subject, purpose)
-            .run();
-        // D1 returns last_row_id in meta
-        return result.meta.last_row_id ?? 0;
-    }
-    async consumeVerifyCode(code) {
-        await this.ensureSchema();
-        const row = await this.db
-            .prepare(`SELECT id, subject FROM verify_codes
-         WHERE code = ? AND verified = 0
-         AND created_at > datetime('now', '-30 minutes')`)
-            .bind(code)
-            .first();
-        if (!row)
-            return null;
-        await this.db
-            .prepare("UPDATE verify_codes SET verified = 1, verified_at = datetime('now') WHERE code = ?")
-            .bind(code)
-            .run();
-        return row;
-    }
-    async isVerifyCodeSent(subject) {
-        await this.ensureSchema();
-        const row = await this.db
-            .prepare(`SELECT 1 FROM verify_codes
-         WHERE subject = ? AND sent = 1
-         AND sent_at > datetime('now', '-1 minute')`)
-            .bind(subject)
-            .first();
-        return !!row;
-    }
-    async markVerifyCodeSent(code) {
-        await this.ensureSchema();
-        await this.db
-            .prepare("UPDATE verify_codes SET sent = 1, sent_at = datetime('now') WHERE code = ?")
-            .bind(code)
-            .run();
-    }
-    async purgeExpiredVerifyCodes() {
-        await this.ensureSchema();
-        await this.db
-            .prepare("DELETE FROM verify_codes WHERE created_at < datetime('now', '-1 hour')")
-            .run();
-    }
-    // ─── Login tickets (Federation) ────────────────────────────────────────
-    async createLoginTicket(ticket, did, targetOrigin, ttlSeconds = 300) {
-        await this.ensureSchema();
-        await this.db
-            .prepare(`INSERT INTO login_tickets (ticket, did, target_origin, expires_at)
-         VALUES (?, ?, ?, datetime('now', '+' || ? || ' seconds'))`)
-            .bind(ticket, did, targetOrigin || null, ttlSeconds)
-            .run();
-    }
-    async getLoginTicket(ticket) {
-        await this.ensureSchema();
-        return this.db
-            .prepare(`SELECT ticket, did, target_origin FROM login_tickets
-         WHERE ticket = ? AND expires_at > datetime('now')`)
-            .bind(ticket)
-            .first();
-    }
-    async deleteLoginTicket(ticket) {
-        await this.ensureSchema();
-        await this.db.prepare("DELETE FROM login_tickets WHERE ticket = ?").bind(ticket).run();
-    }
-    async purgeExpiredLoginTickets() {
-        await this.ensureSchema();
-        await this.db.prepare("DELETE FROM login_tickets WHERE expires_at < datetime('now')").run();
-    }
-    // ─── Instance default rule seeding ──────────────────────────────────────
-    async seedInstanceDefaults(instanceDid) {
-        await this.ensureSchema();
-        const now = new Date().toISOString();
-        // Seed instance-scoped copies of built-in policies
-        const policies = [
-            {
-                id: `public-${instanceDid}`,
-                name: "Public",
-                description: "Anyone can access, no login required",
-                roles: null,
-                reverse: 0,
-            },
-            {
-                id: `invited-only-${instanceDid}`,
-                name: "Invited Only",
-                description: "Any logged-in user can access",
-                roles: "[]",
-                reverse: 1,
-            },
-            {
-                id: `admin-only-${instanceDid}`,
-                name: "Admin Only",
-                description: "Only owner and admin can access",
-                roles: '["owner","admin"]',
-                reverse: 0,
-            },
-            {
-                id: `owner-only-${instanceDid}`,
-                name: "Owner Only",
-                description: "Only the owner can access",
-                roles: '["owner"]',
-                reverse: 0,
-            },
-        ];
-        await this.db.batch(policies.map((p) => this.db
-            .prepare(`INSERT OR IGNORE INTO access_policies (id, name, description, roles, reverse, isProtected, instance_did, createdAt, updatedAt)
-             VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)`)
-            .bind(p.id, p.name, p.description, p.roles, p.reverse, instanceDid, now, now)));
-        // Seed instance default rule referencing the instance-scoped public policy
-        const ruleId = `default-${instanceDid}`;
-        await this.db
-            .prepare(`INSERT OR IGNORE INTO security_rules
-         (id, pathPattern, priority, accessPolicyId, enabled, remark, instance_did, createdAt, updatedAt)
-         VALUES (?, '*', 0, ?, 1, 'Instance default: public access', ?, ?, ?)`)
-            .bind(ruleId, `public-${instanceDid}`, instanceDid, now, now)
-            .run();
-        invalidateRulesCache();
-    }
-    // ─── Instance-scoped rule query ────────────────────────────────────────
-    async getActiveRulesForInstance(instanceDid) {
-        const cached = _instanceRulesCache.get(instanceDid);
-        if (cached && Date.now() - cached.at < RULES_CACHE_TTL) {
-            return cached.rules;
-        }
-        await this.ensureSchema();
-        const rows = await this.db
-            .prepare(`SELECT r.id, r.pathPattern, r.priority, p.roles, p.reverse, r.enabled
-         FROM security_rules r
-         JOIN access_policies p ON r.accessPolicyId = p.id
-         WHERE r.enabled = 1
-           AND (r.instance_did = ?1 OR r.instance_did IS NULL)
-           AND (p.instance_did = ?1 OR p.instance_did IS NULL)
-         ORDER BY
-           CASE WHEN r.instance_did IS NOT NULL THEN 0 ELSE 1 END,
-           r.priority DESC`)
-            .bind(instanceDid)
-            .all();
-        const rules = rows.results ?? [];
-        _instanceRulesCache.set(instanceDid, { rules, at: Date.now() });
-        return rules;
-    }
-    /**
-     * Optimized query for enforcement: returns all enabled rules with inlined policy data.
-     * Results are cached per-isolate with TTL + write-through invalidation.
-     */
-    async getActiveRulesWithPolicies() {
-        if (_rulesCache && Date.now() - _rulesCacheAt < RULES_CACHE_TTL) {
-            return _rulesCache;
-        }
-        await this.ensureSchema();
-        const rows = await this.db
-            .prepare(`SELECT r.id, r.pathPattern, r.priority, p.roles, p.reverse, r.enabled
-         FROM security_rules r
-         JOIN access_policies p ON r.accessPolicyId = p.id
-         WHERE r.enabled = 1
-         ORDER BY CASE WHEN r.id = 'default' THEN 1 ELSE 0 END, r.priority ASC`)
-            .all();
-        _rulesCache = rows.results ?? [];
-        _rulesCacheAt = Date.now();
-        return _rulesCache;
-    }
-}
-//# sourceMappingURL=store.js.map