@beechcms/api 0.6.0-preview.1 → 0.6.0-preview.3

package/src/shared/d1-notification.repository.test.ts

@@ -1,128 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect, vi } from 'vitest'
-import { D1NotificationRepository } from './d1-notification.repository'
-import { FixedClock } from './fixed-clock'
-import { SequentialIdGenerator } from './sequential-id-generator'
-
-const clock = new FixedClock(1700000000_000)
-const makeIdGen = () => new SequentialIdGenerator()
-
-function makeMockDb(opts: { firstResult?: unknown; allResults?: unknown[] } = {}) {
-  const { firstResult = null, allResults = [] } = opts
-  const runMock = vi.fn().mockResolvedValue({ success: true })
-  const firstMock = vi.fn().mockResolvedValue(firstResult)
-  const allMock = vi.fn().mockResolvedValue({ results: allResults })
-  const bindMock = vi.fn(() => ({ first: firstMock, all: allMock, run: runMock }))
-  const prepareMock = vi.fn(() => ({
-    bind: bindMock,
-    first: firstMock,
-    all: allMock,
-    run: runMock,
-  }))
-  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock, allMock }
-}
-
-describe('D1NotificationRepository', () => {
-  describe('list', () => {
-    it('maps rows to NotificationRecord with isRead boolean', async () => {
-      const { db } = makeMockDb({
-        allResults: [
-          {
-            id: 'n-1',
-            title: 'T',
-            message: 'M',
-            type: 'success',
-            is_read: 0,
-            created_at: 100,
-          },
-          {
-            id: 'n-2',
-            title: 'T2',
-            message: 'M2',
-            type: 'info',
-            is_read: 1,
-            created_at: 99,
-          },
-        ],
-      })
-      const records = await new D1NotificationRepository(db, clock, makeIdGen()).list(10)
-      expect(records).toEqual([
-        { id: 'n-1', title: 'T', message: 'M', type: 'success', isRead: false, createdAt: 100 },
-        { id: 'n-2', title: 'T2', message: 'M2', type: 'info', isRead: true, createdAt: 99 },
-      ])
-    })
-
-    it('orders by created_at DESC with LIMIT bound', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      await new D1NotificationRepository(db, clock, makeIdGen()).list(25)
-      expect(prepareMock.mock.calls[0][0]).toMatch(/ORDER BY created_at DESC/)
-      expect(bindMock).toHaveBeenCalledWith(25)
-    })
-  })
-
-  describe('stats', () => {
-    it('returns aggregate counters mapped to camelCase', async () => {
-      const { db } = makeMockDb({
-        firstResult: { total_count: 7, latest_created_at: 1234, read_count: 3 },
-      })
-      const stats = await new D1NotificationRepository(db, clock, makeIdGen()).stats()
-      expect(stats).toEqual({ totalCount: 7, latestCreatedAt: 1234, readCount: 3 })
-    })
-
-    it('returns zeros when the table is empty', async () => {
-      const { db } = makeMockDb({
-        firstResult: { total_count: 0, latest_created_at: null, read_count: null },
-      })
-      const stats = await new D1NotificationRepository(db, clock, makeIdGen()).stats()
-      expect(stats).toEqual({ totalCount: 0, latestCreatedAt: 0, readCount: 0 })
-    })
-  })
-
-  describe('create', () => {
-    it('inserts a new notification and returns the generated id', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      const id = await new D1NotificationRepository(db, clock, makeIdGen()).create({
-        title: 'Hello',
-        message: 'World',
-        type: 'info',
-      })
-      expect(typeof id).toBe('string')
-      expect(id.length).toBeGreaterThan(0)
-      expect(prepareMock.mock.calls[0][0]).toMatch(/INSERT INTO notifications/)
-      expect(bindMock).toHaveBeenCalledWith(id, 'Hello', 'World', 'info')
-    })
-  })
-
-  describe('markRead / markUnread / delete / markAllRead', () => {
-    it('markRead binds the given id', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      await new D1NotificationRepository(db, clock, makeIdGen()).markRead('n-1')
-      expect(prepareMock.mock.calls[0][0]).toMatch(/UPDATE notifications SET is_read = 1 WHERE id = \?/)
-      expect(bindMock).toHaveBeenCalledWith('n-1')
-    })
-
-    it('markUnread binds the given id', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      await new D1NotificationRepository(db, clock, makeIdGen()).markUnread('n-2')
-      expect(prepareMock.mock.calls[0][0]).toMatch(/UPDATE notifications SET is_read = 0 WHERE id = \?/)
-      expect(bindMock).toHaveBeenCalledWith('n-2')
-    })
-
-    it('delete binds the given id', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      await new D1NotificationRepository(db, clock, makeIdGen()).delete('n-3')
-      expect(prepareMock.mock.calls[0][0]).toMatch(/DELETE FROM notifications WHERE id = \?/)
-      expect(bindMock).toHaveBeenCalledWith('n-3')
-    })
-
-    it('markAllRead runs without bindings', async () => {
-      const { db, prepareMock, runMock } = makeMockDb()
-      await new D1NotificationRepository(db, clock, makeIdGen()).markAllRead()
-      expect(prepareMock.mock.calls[0][0]).toMatch(/^UPDATE notifications SET is_read = 1$/)
-      expect(runMock).toHaveBeenCalled()
-    })
-  })
-})

package/src/shared/d1-notification.repository.ts

@@ -1,118 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import type {
-  INotificationRepository,
-  NotificationRecord,
-  NotificationStats,
-  NotificationType,
-  IClock,
-  IIdGenerator,
-} from '@beechcms/core'
-
-interface NotificationRow {
-  id: string
-  title: string
-  message: string
-  type: string
-  is_read: number
-  created_at: number
-}
-
-interface NotificationStatsRow {
-  total_count: number | null
-  latest_created_at: number | null
-  read_count: number | null
-}
-
-/**
- * D1-backed implementation of {@link INotificationRepository}.
- */
-export class D1NotificationRepository implements INotificationRepository {
-  constructor(
-    private readonly database: D1Database,
-    private readonly clock: IClock,
-    private readonly idGenerator: IIdGenerator,
-  ) {}
-
-  async list(limit: number): Promise<NotificationRecord[]> {
-    const queryResult = await this.database
-      .prepare(
-        `SELECT id, title, message, type, is_read, created_at
-           FROM notifications
-           ORDER BY created_at DESC
-           LIMIT ?`
-      )
-      .bind(limit)
-      .all<NotificationRow>()
-
-    return (queryResult.results ?? []).map(mapRowToRecord)
-  }
-
-  async stats(): Promise<NotificationStats> {
-    const statsRow = await this.database
-      .prepare(
-        `SELECT COUNT(*) as total_count,
-                MAX(created_at) as latest_created_at,
-                SUM(is_read) as read_count
-           FROM notifications`
-      )
-      .first<NotificationStatsRow>()
-
-    return {
-      totalCount: statsRow?.total_count ?? 0,
-      latestCreatedAt: statsRow?.latest_created_at ?? 0,
-      readCount: statsRow?.read_count ?? 0,
-    }
-  }
-
-  async create(record: Omit<NotificationRecord, 'id' | 'createdAt' | 'isRead'>): Promise<string> {
-    const generatedId = this.idGenerator.uuid()
-    await this.database
-      .prepare(
-        `INSERT INTO notifications (id, title, message, type)
-         VALUES (?, ?, ?, ?)`
-      )
-      .bind(generatedId, record.title, record.message, record.type)
-      .run()
-    return generatedId
-  }
-
-  async markRead(notificationId: string): Promise<void> {
-    await this.database
-      .prepare('UPDATE notifications SET is_read = 1 WHERE id = ?')
-      .bind(notificationId)
-      .run()
-  }
-
-  async markUnread(notificationId: string): Promise<void> {
-    await this.database
-      .prepare('UPDATE notifications SET is_read = 0 WHERE id = ?')
-      .bind(notificationId)
-      .run()
-  }
-
-  async markAllRead(): Promise<void> {
-    await this.database.prepare('UPDATE notifications SET is_read = 1').run()
-  }
-
-  async delete(notificationId: string): Promise<void> {
-    await this.database
-      .prepare('DELETE FROM notifications WHERE id = ?')
-      .bind(notificationId)
-      .run()
-  }
-}
-
-function mapRowToRecord(row: NotificationRow): NotificationRecord {
-  return {
-    id: row.id,
-    title: row.title,
-    message: row.message,
-    type: row.type as NotificationType,
-    isRead: row.is_read === 1,
-    createdAt: row.created_at,
-  }
-}

package/src/shared/d1-password-reset-token.repository.test.ts

@@ -1,81 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect, vi } from 'vitest'
-import { D1PasswordResetTokenRepository } from './d1-password-reset-token.repository'
-
-const NOW = Math.floor(Date.now() / 1000)
-const fixedIdGen = { uuid: () => 'prt-1' }
-
-function makeMockDb(opts: { firstResult?: unknown; runChanges?: number } = {}) {
-  const { firstResult = null, runChanges = 1 } = opts
-  const runMock = vi.fn().mockResolvedValue({ success: true, meta: { changes: runChanges } })
-  const firstMock = vi.fn().mockResolvedValue(firstResult)
-  const bindMock = vi.fn(() => ({ first: firstMock, run: runMock }))
-  const prepareMock = vi.fn(() => ({ bind: bindMock }))
-  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock }
-}
-
-describe('D1PasswordResetTokenRepository', () => {
-  describe('create', () => {
-    it('calls INSERT INTO password_reset_tokens', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1PasswordResetTokenRepository(db, fixedIdGen).create({
-        userId: 'u1', tokenHash: 'h', expiresAt: NOW + 1800,
-      })
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO password_reset_tokens'))
-    })
-
-    it('binds id, userId, tokenHash, and expiresAt in the correct order', async () => {
-      const { db, bindMock } = makeMockDb()
-      await new D1PasswordResetTokenRepository(db, fixedIdGen).create({
-        userId: 'u1', tokenHash: 'h', expiresAt: NOW + 1800,
-      })
-      expect(bindMock).toHaveBeenCalledWith('prt-1', 'u1', 'h', NOW + 1800)
-    })
-  })
-
-  describe('findValidByHashWithEmail', () => {
-    it('returns a ValidatedResetToken with the userId and email from the JOIN', async () => {
-      const row = { id: 'prt-1', user_id: 'u1', email: 'user@test.com' }
-      const { db } = makeMockDb({ firstResult: row })
-      const result = await new D1PasswordResetTokenRepository(db, fixedIdGen).findValidByHashWithEmail('h', NOW)
-      expect(result).toEqual({ id: 'prt-1', userId: 'u1', email: 'user@test.com' })
-    })
-
-    it('returns null when the token is not found, expired, or already used', async () => {
-      const { db } = makeMockDb({ firstResult: null })
-      expect(await new D1PasswordResetTokenRepository(db, fixedIdGen).findValidByHashWithEmail('bad-hash', NOW)).toBeNull()
-    })
-
-    it('passes tokenHash and nowTimestamp as bound values', async () => {
-      const { db, bindMock } = makeMockDb()
-      await new D1PasswordResetTokenRepository(db, fixedIdGen).findValidByHashWithEmail('my-hash', NOW)
-      expect(bindMock).toHaveBeenCalledWith('my-hash', NOW)
-    })
-  })
-
-  describe('markUsed', () => {
-    it('calls UPDATE password_reset_tokens SET used_at', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1PasswordResetTokenRepository(db, fixedIdGen).markUsed('prt-1', NOW)
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('used_at'))
-    })
-
-    it('binds nowTimestamp and tokenId in the correct order', async () => {
-      const { db, bindMock } = makeMockDb()
-      await new D1PasswordResetTokenRepository(db, fixedIdGen).markUsed('prt-1', NOW)
-      expect(bindMock).toHaveBeenCalledWith(NOW, 'prt-1')
-    })
-  })
-
-  describe('invalidatePending', () => {
-    it('calls UPDATE password_reset_tokens and includes the userId in the bound values', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      await new D1PasswordResetTokenRepository(db, fixedIdGen).invalidatePending('u1', NOW)
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE password_reset_tokens'))
-      expect((bindMock.mock.calls[0] as unknown[]).includes('u1')).toBe(true)
-    })
-  })
-})

package/src/shared/d1-password-reset-token.repository.ts

@@ -1,56 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import type { IPasswordResetTokenRepository, NewPasswordResetToken, ValidatedResetToken, IIdGenerator } from '@beechcms/core'
-
-type ValidatedResetTokenRow = {
-  id: string
-  user_id: string
-  email: string
-}
-
-export class D1PasswordResetTokenRepository implements IPasswordResetTokenRepository {
-  constructor(
-    private readonly db: D1Database,
-    private readonly idGenerator: IIdGenerator,
-  ) {}
-
-  async invalidatePending(userId: string, nowTimestamp: number): Promise<void> {
-    await this.db
-      .prepare('UPDATE password_reset_tokens SET used_at = ? WHERE user_id = ? AND used_at IS NULL')
-      .bind(nowTimestamp, userId)
-      .run()
-  }
-
-  async create(record: NewPasswordResetToken): Promise<void> {
-    const generatedId = this.idGenerator.uuid()
-    await this.db
-      .prepare('INSERT INTO password_reset_tokens (id, user_id, token_hash, expires_at) VALUES (?, ?, ?, ?)')
-      .bind(generatedId, record.userId, record.tokenHash, record.expiresAt)
-      .run()
-  }
-
-  async findValidByHashWithEmail(tokenHash: string, nowTimestamp: number): Promise<ValidatedResetToken | null> {
-    const row = await this.db
-      .prepare(
-        `SELECT prt.id, prt.user_id, u.email
-         FROM password_reset_tokens prt
-         JOIN users u ON u.id = prt.user_id
-         WHERE prt.token_hash = ? AND prt.expires_at > ? AND prt.used_at IS NULL`
-      )
-      .bind(tokenHash, nowTimestamp)
-      .first<ValidatedResetTokenRow>()
-
-    if (!row) return null
-    return { id: row.id, userId: row.user_id, email: row.email }
-  }
-
-  async markUsed(tokenId: string, nowTimestamp: number): Promise<void> {
-    await this.db
-      .prepare('UPDATE password_reset_tokens SET used_at = ? WHERE id = ?')
-      .bind(nowTimestamp, tokenId)
-      .run()
-  }
-}

package/src/shared/d1-search.repository.test.ts

@@ -1,87 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect, vi } from 'vitest'
-import type { Seed } from '@beechcms/core'
-import { D1SearchRepository } from './d1-search.repository'
-
-function makeMockDb(allResults: unknown[] = [], firstResult: unknown = null) {
-  const allMock = vi.fn().mockResolvedValue({ results: allResults })
-  const firstMock = vi.fn().mockResolvedValue(firstResult)
-  const bindMock = vi.fn(() => ({ all: allMock, first: firstMock }))
-  const prepareMock = vi.fn(() => ({ bind: bindMock }))
-  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, allMock, firstMock }
-}
-
-const seeds: Seed[] = [
-  {
-    slug: 'posts',
-    label: 'Post',
-    displayNameAlias: 'title',
-    branches: [
-      { id: 'br_01', alias: 'title', type: 'text', label: 'Title' },
-      { id: 'br_02', alias: 'body',  type: 'richtext', label: 'Body' },
-    ],
-  },
-]
-
-describe('D1SearchRepository', () => {
-  it('maps FtsRow to camelCase SearchResultRow', async () => {
-    const ftsRow = {
-      entry_id: 'e1',
-      schema_slug: 'posts',
-      slug: 'hello',
-      status: 'published',
-      title: 'Hello',
-      excerpt: '<mark>Hi</mark>',
-      rank: -3.2,
-    }
-    const { db } = makeMockDb([ftsRow])
-    const result = await new D1SearchRepository(db).search(
-      { queryText: 'hello world', schemaSlug: null, statusFilter: null, limit: 10, cursor: null },
-      seeds,
-    )
-    expect(result).toEqual([
-      {
-        entryId: 'e1',
-        schemaSlug: 'posts',
-        slug: 'hello',
-        status: 'published',
-        title: 'Hello',
-        excerpt: '<mark>Hi</mark>',
-        rank: -3.2,
-      },
-    ])
-  })
-
-  it('returns [] on EMPTY_QUERY (single-character terms)', async () => {
-    const { db, prepareMock } = makeMockDb()
-    const result = await new D1SearchRepository(db).search(
-      { queryText: 'a', schemaSlug: null, statusFilter: null, limit: 10, cursor: null },
-      seeds,
-    )
-    expect(result).toEqual([])
-    expect(prepareMock).not.toHaveBeenCalled()
-  })
-
-  it('count returns { total: 0 } on EMPTY_QUERY', async () => {
-    const { db } = makeMockDb()
-    const result = await new D1SearchRepository(db).count(
-      { queryText: 'a', schemaSlug: null, statusFilter: null },
-      seeds,
-    )
-    expect(result).toEqual({ total: 0 })
-  })
-
-  it('count returns total from countSql', async () => {
-    const { db, prepareMock } = makeMockDb([], { total: 17 })
-    const result = await new D1SearchRepository(db).count(
-      { queryText: 'hello', schemaSlug: null, statusFilter: null },
-      seeds,
-    )
-    expect(result).toEqual({ total: 17 })
-    const sql = prepareMock.mock.calls[0]![0] as string
-    expect(sql).toMatch(/SUM\(c\)/)
-  })
-})

package/src/shared/d1-search.repository.ts

@@ -1,88 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import type {
-  Seed,
-  ISearchRepository,
-  SearchQueryOptions,
-  SearchResultRow,
-  SearchCountResult,
-} from '@beechcms/core'
-import { buildFtsQuery, type FtsRow } from '../search-utils'
-
-const EMPTY_QUERY_ERROR = 'EMPTY_QUERY'
-
-/**
- * D1-backed implementation of {@link ISearchRepository}.
- *
- * Delegates SQL composition to the pure `buildFtsQuery` helper to keep this
- * class focused on D1 wiring. Returns raw rows; the route handler is
- * responsible for mapping them via `mapFtsRow`.
- */
-export class D1SearchRepository implements ISearchRepository {
-  constructor(private readonly database: D1Database) {}
-
-  async search(options: SearchQueryOptions, seeds: Seed[]): Promise<SearchResultRow[]> {
-    let queryParts
-    try {
-      queryParts = buildFtsQuery(
-        {
-          q: options.queryText,
-          schemaSlug: options.schemaSlug,
-          status: options.statusFilter,
-          limit: options.limit,
-          cursor: options.cursor,
-        },
-        seeds,
-      )
-    } catch (error) {
-      if (error instanceof Error && error.message === EMPTY_QUERY_ERROR) return []
-      throw error
-    }
-
-    const result = await this.database.prepare(queryParts.sql).bind(...queryParts.binds).all<FtsRow>()
-    return (result.results ?? []).map(mapFtsRowToResultRow)
-  }
-
-  async count(
-    options: Omit<SearchQueryOptions, 'limit' | 'cursor'>,
-    seeds: Seed[],
-  ): Promise<SearchCountResult> {
-    let queryParts
-    try {
-      queryParts = buildFtsQuery(
-        {
-          q: options.queryText,
-          schemaSlug: options.schemaSlug,
-          status: options.statusFilter,
-          limit: 0,
-          cursor: null,
-        },
-        seeds,
-      )
-    } catch (error) {
-      if (error instanceof Error && error.message === EMPTY_QUERY_ERROR) return { total: 0 }
-      throw error
-    }
-
-    const row = await this.database
-      .prepare(queryParts.countSql)
-      .bind(...queryParts.countBinds)
-      .first<{ total: number }>()
-    return { total: row?.total ?? 0 }
-  }
-}
-
-function mapFtsRowToResultRow(row: FtsRow): SearchResultRow {
-  return {
-    entryId: row.entry_id,
-    schemaSlug: row.schema_slug,
-    slug: row.slug,
-    status: row.status,
-    title: row.title,
-    excerpt: row.excerpt,
-    rank: row.rank,
-  }
-}

package/src/shared/d1-session.repository.test.ts

@@ -1,125 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect, vi } from 'vitest'
-import { D1SessionRepository } from './d1-session.repository'
-import { FixedClock } from './fixed-clock'
-
-const FIXED_NOW_MS = 1700000000_000
-const NOW = Math.floor(FIXED_NOW_MS / 1000)
-const FUTURE = NOW + 7 * 24 * 3600
-const clock = new FixedClock(FIXED_NOW_MS)
-
-function makeMockDb(opts: {
-  firstResult?: unknown
-  runChanges?: number
-  allResults?: unknown[]
-} = {}) {
-  const { firstResult = null, runChanges = 1, allResults = [] } = opts
-  const runMock = vi.fn().mockResolvedValue({ success: true, meta: { changes: runChanges } })
-  const firstMock = vi.fn().mockResolvedValue(firstResult)
-  const allMock = vi.fn().mockResolvedValue({ results: allResults })
-  const bindMock = vi.fn(() => ({ first: firstMock, all: allMock, run: runMock }))
-  const prepareMock = vi.fn(() => ({ bind: bindMock }))
-  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock, allMock }
-}
-
-describe('D1SessionRepository', () => {
-  describe('saveRefreshToken', () => {
-    it('calls INSERT INTO refresh_tokens with the correct bound values', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      await new D1SessionRepository(db, clock).saveRefreshToken({
-        id: 'rt-1', userId: 'u1', tokenHash: 'h', expiresAt: FUTURE,
-      })
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO refresh_tokens'))
-      expect(bindMock).toHaveBeenCalledWith('rt-1', 'u1', 'h', FUTURE, NOW)
-    })
-  })
-
-  describe('findActiveByHash', () => {
-    it('returns a RefreshTokenRecord with camelCase keys mapped from the snake_case row', async () => {
-      const row = {
-        id: 'rt-1', user_id: 'u1', token_hash: 'h',
-        expires_at: FUTURE, created_at: NOW, revoked_at: null,
-      }
-      const { db } = makeMockDb({ firstResult: row })
-      const result = await new D1SessionRepository(db, clock).findActiveByHash('h', NOW)
-      expect(result).toEqual({
-        id: 'rt-1', userId: 'u1', tokenHash: 'h',
-        expiresAt: FUTURE, createdAt: NOW, revokedAt: null,
-      })
-    })
-
-    it('returns null when no active token is found', async () => {
-      const { db } = makeMockDb({ firstResult: null })
-      expect(await new D1SessionRepository(db, clock).findActiveByHash('missing', NOW)).toBeNull()
-    })
-
-    it('passes tokenHash and nowTimestamp as bound values', async () => {
-      const { db, bindMock } = makeMockDb()
-      await new D1SessionRepository(db, clock).findActiveByHash('my-hash', NOW)
-      expect(bindMock).toHaveBeenCalledWith('my-hash', NOW)
-    })
-  })
-
-  describe('revokeByHash', () => {
-    it('returns true when one row is updated (changes = 1)', async () => {
-      const { db } = makeMockDb({ runChanges: 1 })
-      expect(await new D1SessionRepository(db, clock).revokeByHash('h', NOW)).toBe(true)
-    })
-
-    it('returns false when no row is updated (token already revoked or not found)', async () => {
-      const { db } = makeMockDb({ runChanges: 0 })
-      expect(await new D1SessionRepository(db, clock).revokeByHash('h', NOW)).toBe(false)
-    })
-  })
-
-  describe('revokeAllForUser', () => {
-    it('calls UPDATE refresh_tokens and includes the userId in the bound values', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb()
-      await new D1SessionRepository(db, clock).revokeAllForUser('u1', NOW)
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE refresh_tokens'))
-      expect((bindMock.mock.calls[0] as unknown[]).includes('u1')).toBe(true)
-    })
-  })
-
-  describe('listActiveForUser', () => {
-    it('returns mapped ActiveSessionSummary objects in the original order', async () => {
-      const rows = [
-        { id: 's1', created_at: NOW - 100, expires_at: FUTURE },
-        { id: 's2', created_at: NOW - 200, expires_at: FUTURE },
-      ]
-      const { db } = makeMockDb({ allResults: rows })
-      const sessions = await new D1SessionRepository(db, clock).listActiveForUser('u1', NOW, 20)
-      expect(sessions).toHaveLength(2)
-      expect(sessions[0]).toEqual({ id: 's1', createdAt: NOW - 100, expiresAt: FUTURE })
-      expect(sessions[1]).toEqual({ id: 's2', createdAt: NOW - 200, expiresAt: FUTURE })
-    })
-
-    it('returns an empty array when no active sessions exist', async () => {
-      const { db } = makeMockDb({ allResults: [] })
-      expect(await new D1SessionRepository(db, clock).listActiveForUser('u1', NOW, 20)).toEqual([])
-    })
-  })
-
-  describe('revokeById', () => {
-    it('returns true when the session is revoked (changes = 1)', async () => {
-      const { db } = makeMockDb({ runChanges: 1 })
-      expect(await new D1SessionRepository(db, clock).revokeById('s1', 'u1', NOW)).toBe(true)
-    })
-
-    it('returns false when the session is not found or belongs to another user (changes = 0)', async () => {
-      const { db } = makeMockDb({ runChanges: 0 })
-      expect(await new D1SessionRepository(db, clock).revokeById('s1', 'other-user', NOW)).toBe(false)
-    })
-
-    it('binds both sessionId and userId to prevent cross-user revocation', async () => {
-      const { db, bindMock } = makeMockDb({ runChanges: 1 })
-      await new D1SessionRepository(db, clock).revokeById('my-session', 'my-user', NOW)
-      const args = bindMock.mock.calls[0] as unknown[]
-      expect(args).toContain('my-session')
-      expect(args).toContain('my-user')
-    })
-  })
-})