@cat-factory/local-server 0.26.1 → 0.27.0

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export { LocalContainerRunnerTransport, createLocalContainerTransportFromEnv, ty
 export { type ContainerRuntimeAdapter, type ContainerExec, type RuntimeId, createRuntimeAdapter, resolveRuntimeId, runtimeProfile, resolveHostAlias, DockerRuntimeAdapter, AppleContainerRuntimeAdapter, } from './runtimes/index.js';
 export { linkRepo, type LinkRepoOptions, type LinkedRepo } from './linkRepo.js';
 export { createLocalGitHubClient, StaticTokenAppRegistry } from './github.js';
+export { createLocalCredentialStore, type LocalCredentialStore } from './sqlite/credentialStore.js';
 export { registerAgentKind, registerAgentKinds, clearRegisteredAgentKinds, type AgentKindDefinition, } from '@cat-factory/agents';
 export { registerPipeline, registerPipelines, clearRegisteredPipelines } from '@cat-factory/kernel';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,EACpC,KAAK,oCAAoC,GAC1C,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAE/E,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAI7E,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,EACpC,KAAK,oCAAoC,GAC1C,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAE/E,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAO7E,OAAO,EAAE,0BAA0B,EAAE,KAAK,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAInG,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/index.js

@@ -16,6 +16,12 @@ export { createRuntimeAdapter, resolveRuntimeId, runtimeProfile, resolveHostAlia
 export { linkRepo } from './linkRepo.js';
 // PAT-backed GitHub access for the CI gate + merge / mergeability providers.
 export { createLocalGitHubClient, StaticTokenAppRegistry } from './github.js';
+// Mothership mode: the local `node:sqlite` credential store (the agent/model secrets that
+// stay on the laptop, sealed with the local key, while org/durable state lives on the
+// mothership). See docs/initiatives/mothership-mode.md. Only the factory + its type are
+// public; the raw db opener and the repo classes stay internal until the 1b composition
+// step proves a consumer needs them.
+export { createLocalCredentialStore } from './sqlite/credentialStore.js';
 // Installation-level extension points, re-exported for parity with the Node facade so
 // a local deployment can register custom agent kinds / pipelines before `startLocal()`.
 export { registerAgentKind, registerAgentKinds, clearRegisteredAgentKinds, } from '@cat-factory/agents';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kFAAkF;AAClF,iFAAiF;AACjF,sFAAsF;AACtF,yEAAyE;AACzE,gFAAgF;AAChF,4DAA4D;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,GAErC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAIL,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAA;AAC5B,qFAAqF;AACrF,gFAAgF;AAChF,sEAAsE;AACtE,OAAO,EAAE,QAAQ,EAAyC,MAAM,eAAe,CAAA;AAC/E,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAE7E,sFAAsF;AACtF,wFAAwF;AACxF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kFAAkF;AAClF,iFAAiF;AACjF,sFAAsF;AACtF,yEAAyE;AACzE,gFAAgF;AAChF,4DAA4D;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EACL,6BAA6B,EAC7B,oCAAoC,GAErC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAIL,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAA;AAC5B,qFAAqF;AACrF,gFAAgF;AAChF,sEAAsE;AACtE,OAAO,EAAE,QAAQ,EAAyC,MAAM,eAAe,CAAA;AAC/E,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAE7E,0FAA0F;AAC1F,sFAAsF;AACtF,wFAAwF;AACxF,wFAAwF;AACxF,qCAAqC;AACrC,OAAO,EAAE,0BAA0B,EAA6B,MAAM,6BAA6B,CAAA;AAEnG,sFAAsF;AACtF,wFAAwF;AACxF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/sqlite/credentialStore.d.ts

@@ -0,0 +1,45 @@
+import { DatabaseSync } from 'node:sqlite';
+import type { ApiKeyProvider, ApiKeyScope, ApiKeyScopeRef, LocalModelEndpointRecord, LocalModelEndpointRepository, ProviderApiKeyRecord, ProviderApiKeyRepository } from '@cat-factory/kernel';
+import type { LocalRunner } from '@cat-factory/contracts';
+/** Open (creating if absent) the local credential SQLite database and ensure its schema. */
+export declare function openLocalCredentialDb(path: string): DatabaseSync;
+export declare class SqliteProviderApiKeyRepository implements ProviderApiKeyRepository {
+    private readonly db;
+    constructor(db: DatabaseSync);
+    listByScope(scope: ApiKeyScope, scopeId: string, provider?: ApiKeyProvider): Promise<ProviderApiKeyRecord[]>;
+    listForPool(scopes: ApiKeyScopeRef[], provider: ApiKeyProvider): Promise<ProviderApiKeyRecord[]>;
+    listConfiguredProviders(scopes: ApiKeyScopeRef[]): Promise<ApiKeyProvider[]>;
+    getById(scope: ApiKeyScope, scopeId: string, id: string): Promise<ProviderApiKeyRecord | null>;
+    add(record: ProviderApiKeyRecord): Promise<void>;
+    markLeased(id: string, at: number): Promise<void>;
+    leaseLeastUsed(scopes: ApiKeyScopeRef[], provider: ApiKeyProvider, now: number, windowMs: number): Promise<ProviderApiKeyRecord | null>;
+    recordUsage(id: string, usage: {
+        inputTokens: number;
+        outputTokens: number;
+    }, at: number, windowMs: number): Promise<void>;
+    softDelete(scope: ApiKeyScope, scopeId: string, id: string, at: number): Promise<void>;
+}
+export declare class SqliteLocalModelEndpointRepository implements LocalModelEndpointRepository {
+    private readonly db;
+    constructor(db: DatabaseSync);
+    listByUser(userId: string): Promise<LocalModelEndpointRecord[]>;
+    getByUserProvider(userId: string, provider: LocalRunner): Promise<LocalModelEndpointRecord | null>;
+    upsert(record: LocalModelEndpointRecord): Promise<void>;
+    remove(userId: string, provider: LocalRunner): Promise<void>;
+}
+/** The local-sqlite credential repositories plus a handle to close the underlying db. */
+export interface LocalCredentialStore {
+    providerApiKeyRepository: ProviderApiKeyRepository;
+    localModelEndpointRepository: LocalModelEndpointRepository;
+    close(): void;
+}
+/**
+ * Open the local credential store at `path` (e.g. a file under the developer's config dir,
+ * or `:memory:` in tests) and expose the two `local-sqlite` repositories over it.
+ *
+ * This holds ONLY credentials, never org/durable state — that all lives on the mothership.
+ * The secrets it stores are already sealed by the caller with the LOCAL key, so the
+ * mothership's `ENCRYPTION_KEY` need never reach this machine.
+ */
+export declare function createLocalCredentialStore(path: string): LocalCredentialStore;
+//# sourceMappingURL=credentialStore.d.ts.map

package/dist/sqlite/credentialStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialStore.d.ts","sourceRoot":"","sources":["../../src/sqlite/credentialStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,cAAc,EACd,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AA0DzD,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAQhE;AAmDD,qBAAa,8BAA+B,YAAW,wBAAwB;IACjE,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,YAAY,EAAI;IAE3C,WAAW,CACf,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAWjC;IAEK,WAAW,CACf,MAAM,EAAE,cAAc,EAAE,EACxB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAWjC;IAEK,uBAAuB,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAUjF;IAEK,OAAO,CACX,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAStC;IAEK,GAAG,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBrD;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;IAEK,cAAc,CAClB,MAAM,EAAE,cAAc,EAAE,EACxB,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAwBtC;IAEK,WAAW,CACf,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACpD,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAqBf;IAEK,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3F;CACF;AA0CD,qBAAa,kCAAmC,YAAW,4BAA4B;IACzE,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,YAAY,EAAI;IAE3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAQpE;IAEK,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAQ1C;IAEK,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB5D;IAEK,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjE;CACF;AAMD,yFAAyF;AACzF,MAAM,WAAW,oBAAoB;IACnC,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,4BAA4B,EAAE,4BAA4B,CAAA;IAC1D,KAAK,IAAI,IAAI,CAAA;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAO7E"}

package/dist/sqlite/credentialStore.js

@@ -0,0 +1,276 @@
+import { DatabaseSync } from 'node:sqlite';
+// The mothership-mode LOCAL credential store.
+//
+// In mothership mode the local node runs NO main database — every org/durable repository
+// call is forwarded to the hosted mothership over the persistence RPC (see
+// `@cat-factory/server` `persistence/`). The deliberate exception is the agent/model
+// CREDENTIALS: they are kept on the developer's machine, sealed with a LOCAL key, so the
+// mothership's `ENCRYPTION_KEY` never has to reach the laptop (confirmed product decision 3
+// in `docs/initiatives/mothership-mode.md`). This module is their persistence: a file-based
+// `node:sqlite` store implementing the two `local-sqlite` bucket ports —
+// `providerApiKeyRepository` (the direct-vendor API-key pool) and `localModelEndpointRepository`
+// (per-user locally-run model endpoints).
+//
+// It stores ONLY the sealed `keyCipher` / `apiKeyCipher` envelopes the service layer hands
+// it (the cipher itself is wired at composition time with the local key), so this layer is
+// crypto-agnostic. The schema mirrors the Drizzle/D1 columns column-for-column, and the
+// repositories mirror `DrizzleProviderApiKeyRepository` / `DrizzleLocalModelEndpointRepository`
+// behaviour exactly (usage-window rotation, lease-least-used ordering, upsert preserving
+// `createdAt`) so a mothership-mode node pools and rotates keys identically to a Postgres one.
+//
+// `node:sqlite`'s `DatabaseSync` is synchronous and single-process, so `leaseLeastUsed`'s
+// select-then-mark is inherently atomic: no other JavaScript runs between the two statements,
+// which is exactly the race the Postgres repo guards with `FOR UPDATE SKIP LOCKED`. The port
+// methods return Promises (to honour the async interface) but execute synchronously.
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS provider_api_keys (
+  id TEXT PRIMARY KEY,
+  scope TEXT NOT NULL,
+  scope_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  label TEXT NOT NULL,
+  key_cipher TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  last_used_at INTEGER,
+  window_started_at INTEGER,
+  input_tokens INTEGER NOT NULL DEFAULT 0,
+  output_tokens INTEGER NOT NULL DEFAULT 0,
+  request_count INTEGER NOT NULL DEFAULT 0,
+  deleted_at INTEGER
+);
+CREATE INDEX IF NOT EXISTS provider_api_keys_pool
+  ON provider_api_keys (scope, scope_id, provider, deleted_at);
+
+CREATE TABLE IF NOT EXISTS local_model_endpoints (
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  label TEXT NOT NULL,
+  base_url TEXT NOT NULL,
+  api_key_cipher TEXT,
+  models TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (user_id, provider)
+);
+`;
+/** Open (creating if absent) the local credential SQLite database and ensure its schema. */
+export function openLocalCredentialDb(path) {
+    const db = new DatabaseSync(path);
+    // WAL keeps readers and the single writer from blocking each other; the busy timeout
+    // absorbs a brief lock contention (e.g. an OS sync) instead of throwing SQLITE_BUSY.
+    db.exec('PRAGMA journal_mode = WAL');
+    db.exec('PRAGMA busy_timeout = 5000');
+    db.exec(SCHEMA);
+    return db;
+}
+function apiKeyRowToRecord(row) {
+    return {
+        id: row.id,
+        scope: row.scope,
+        scopeId: row.scope_id,
+        provider: row.provider,
+        label: row.label,
+        keyCipher: row.key_cipher,
+        createdAt: row.created_at,
+        lastUsedAt: row.last_used_at,
+        windowStartedAt: row.window_started_at,
+        inputTokens: row.input_tokens,
+        outputTokens: row.output_tokens,
+        requestCount: row.request_count,
+        deletedAt: row.deleted_at,
+    };
+}
+const API_KEY_COLUMNS = 'id, scope, scope_id, provider, label, key_cipher, created_at, last_used_at, ' +
+    'window_started_at, input_tokens, output_tokens, request_count, deleted_at';
+/** Build an `(scope = ? AND scope_id = ?) OR …` predicate plus its flattened params. */
+function scopeMatch(scopes) {
+    const sql = scopes.map(() => '(scope = ? AND scope_id = ?)').join(' OR ');
+    const params = scopes.flatMap((s) => [s.scope, s.scopeId]);
+    return { sql: `(${sql})`, params };
+}
+export class SqliteProviderApiKeyRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async listByScope(scope, scopeId, provider) {
+        const rows = this.db
+            .prepare(`SELECT ${API_KEY_COLUMNS} FROM provider_api_keys
+         WHERE scope = ? AND scope_id = ?
+           ${provider ? 'AND provider = ?' : ''}
+           AND deleted_at IS NULL
+         ORDER BY created_at ASC`)
+            .all(...(provider ? [scope, scopeId, provider] : [scope, scopeId]));
+        return rows.map(apiKeyRowToRecord);
+    }
+    async listForPool(scopes, provider) {
+        if (scopes.length === 0)
+            return [];
+        const match = scopeMatch(scopes);
+        const rows = this.db
+            .prepare(`SELECT ${API_KEY_COLUMNS} FROM provider_api_keys
+         WHERE ${match.sql} AND provider = ? AND deleted_at IS NULL
+         ORDER BY created_at ASC`)
+            .all(...match.params, provider);
+        return rows.map(apiKeyRowToRecord);
+    }
+    async listConfiguredProviders(scopes) {
+        if (scopes.length === 0)
+            return [];
+        const match = scopeMatch(scopes);
+        const rows = this.db
+            .prepare(`SELECT DISTINCT provider FROM provider_api_keys
+         WHERE ${match.sql} AND deleted_at IS NULL`)
+            .all(...match.params);
+        return rows.map((r) => r.provider);
+    }
+    async getById(scope, scopeId, id) {
+        const row = this.db
+            .prepare(`SELECT ${API_KEY_COLUMNS} FROM provider_api_keys
+         WHERE id = ? AND scope = ? AND scope_id = ? AND deleted_at IS NULL
+         LIMIT 1`)
+            .get(id, scope, scopeId);
+        return row ? apiKeyRowToRecord(row) : null;
+    }
+    async add(record) {
+        // A newly added key is always live, so `deleted_at` is forced NULL on insert (matching the
+        // D1 repo) — a tombstone is only ever set later by `softDelete`, never carried in at birth.
+        this.db
+            .prepare(`INSERT INTO provider_api_keys
+           (${API_KEY_COLUMNS})
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)`)
+            .run(record.id, record.scope, record.scopeId, record.provider, record.label, record.keyCipher, record.createdAt, record.lastUsedAt, record.windowStartedAt, record.inputTokens, record.outputTokens, record.requestCount);
+    }
+    async markLeased(id, at) {
+        this.db.prepare('UPDATE provider_api_keys SET last_used_at = ? WHERE id = ?').run(at, id);
+    }
+    async leaseLeastUsed(scopes, provider, now, windowMs) {
+        if (scopes.length === 0)
+            return null;
+        const match = scopeMatch(scopes);
+        // Mirror `chooseToken` / the Drizzle repo: rolling-window usage ASC, then
+        // least-recently-leased (NULL last_used_at first — SQLite sorts NULLs first in ASC, but
+        // be explicit), then oldest-created. Synchronous select-then-mark is atomic here (no
+        // interleaving), so no `FOR UPDATE` analogue is needed.
+        const usage = `CASE WHEN window_started_at IS NULL OR ? - window_started_at >= ?
+                        THEN 0 ELSE input_tokens + output_tokens END`;
+        const picked = this.db
+            .prepare(`SELECT id FROM provider_api_keys
+         WHERE ${match.sql} AND provider = ? AND deleted_at IS NULL
+         ORDER BY (${usage}) ASC, last_used_at ASC NULLS FIRST, created_at ASC
+         LIMIT 1`)
+            .get(...match.params, provider, now, windowMs);
+        const id = picked?.id;
+        if (!id)
+            return null;
+        this.db.prepare('UPDATE provider_api_keys SET last_used_at = ? WHERE id = ?').run(now, id);
+        const row = this.db
+            .prepare(`SELECT ${API_KEY_COLUMNS} FROM provider_api_keys WHERE id = ?`)
+            .get(id);
+        return row ? apiKeyRowToRecord(row) : null;
+    }
+    async recordUsage(id, usage, at, windowMs) {
+        // One atomic statement (no read-modify-write), mirroring the Drizzle/D1 repos: keep the
+        // window's counters when it is still active, else reset it to `at` and start from this
+        // call. Named parameters so the repeated `:at`/`:windowMs` bind once and can't drift.
+        const active = '(window_started_at IS NOT NULL AND :at - window_started_at < :windowMs)';
+        this.db
+            .prepare(`UPDATE provider_api_keys SET
+           window_started_at = CASE WHEN ${active} THEN window_started_at ELSE :at END,
+           input_tokens = CASE WHEN ${active} THEN input_tokens ELSE 0 END + :inTokens,
+           output_tokens = CASE WHEN ${active} THEN output_tokens ELSE 0 END + :outTokens,
+           request_count = CASE WHEN ${active} THEN request_count ELSE 0 END + 1
+         WHERE id = :id`)
+            .run({
+            at,
+            windowMs,
+            inTokens: usage.inputTokens,
+            outTokens: usage.outputTokens,
+            id,
+        });
+    }
+    async softDelete(scope, scopeId, id, at) {
+        this.db
+            .prepare(`UPDATE provider_api_keys SET deleted_at = ?
+         WHERE id = ? AND scope = ? AND scope_id = ? AND deleted_at IS NULL`)
+            .run(at, id, scope, scopeId);
+    }
+}
+function endpointRowToRecord(row) {
+    return {
+        userId: row.user_id,
+        provider: row.provider,
+        label: row.label,
+        baseUrl: row.base_url,
+        apiKeyCipher: row.api_key_cipher,
+        models: parseModels(row.models),
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+function parseModels(json) {
+    try {
+        const parsed = JSON.parse(json);
+        return Array.isArray(parsed) ? parsed.map(String) : [];
+    }
+    catch {
+        return [];
+    }
+}
+const ENDPOINT_COLUMNS = 'user_id, provider, label, base_url, api_key_cipher, models, created_at, updated_at';
+export class SqliteLocalModelEndpointRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async listByUser(userId) {
+        const rows = this.db
+            .prepare(`SELECT ${ENDPOINT_COLUMNS} FROM local_model_endpoints
+         WHERE user_id = ? ORDER BY created_at ASC`)
+            .all(userId);
+        return rows.map(endpointRowToRecord);
+    }
+    async getByUserProvider(userId, provider) {
+        const row = this.db
+            .prepare(`SELECT ${ENDPOINT_COLUMNS} FROM local_model_endpoints
+         WHERE user_id = ? AND provider = ? LIMIT 1`)
+            .get(userId, provider);
+        return row ? endpointRowToRecord(row) : null;
+    }
+    async upsert(record) {
+        // Mirror the Drizzle upsert: on conflict, PRESERVE the original `created_at` (only the
+        // mutable fields + `updated_at` are overwritten).
+        this.db
+            .prepare(`INSERT INTO local_model_endpoints (${ENDPOINT_COLUMNS})
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (user_id, provider) DO UPDATE SET
+           label = excluded.label,
+           base_url = excluded.base_url,
+           api_key_cipher = excluded.api_key_cipher,
+           models = excluded.models,
+           updated_at = excluded.updated_at`)
+            .run(record.userId, record.provider, record.label, record.baseUrl, record.apiKeyCipher, JSON.stringify(record.models), record.createdAt, record.updatedAt);
+    }
+    async remove(userId, provider) {
+        this.db
+            .prepare('DELETE FROM local_model_endpoints WHERE user_id = ? AND provider = ?')
+            .run(userId, provider);
+    }
+}
+/**
+ * Open the local credential store at `path` (e.g. a file under the developer's config dir,
+ * or `:memory:` in tests) and expose the two `local-sqlite` repositories over it.
+ *
+ * This holds ONLY credentials, never org/durable state — that all lives on the mothership.
+ * The secrets it stores are already sealed by the caller with the LOCAL key, so the
+ * mothership's `ENCRYPTION_KEY` need never reach this machine.
+ */
+export function createLocalCredentialStore(path) {
+    const db = openLocalCredentialDb(path);
+    return {
+        providerApiKeyRepository: new SqliteProviderApiKeyRepository(db),
+        localModelEndpointRepository: new SqliteLocalModelEndpointRepository(db),
+        close: () => db.close(),
+    };
+}
+//# sourceMappingURL=credentialStore.js.map

package/dist/sqlite/credentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialStore.js","sourceRoot":"","sources":["../../src/sqlite/credentialStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAY1C,8CAA8C;AAC9C,EAAE;AACF,yFAAyF;AACzF,2EAA2E;AAC3E,qFAAqF;AACrF,yFAAyF;AACzF,4FAA4F;AAC5F,4FAA4F;AAC5F,yEAAyE;AACzE,iGAAiG;AACjG,0CAA0C;AAC1C,EAAE;AACF,2FAA2F;AAC3F,2FAA2F;AAC3F,wFAAwF;AACxF,gGAAgG;AAChG,yFAAyF;AACzF,+FAA+F;AAC/F,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,6FAA6F;AAC7F,qFAAqF;AAErF,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8Bd,CAAA;AAED,4FAA4F;AAC5F,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAA;IACjC,qFAAqF;IACrF,qFAAqF;IACrF,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;IACpC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACrC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACf,OAAO,EAAE,CAAA;AACX,CAAC;AAsBD,SAAS,iBAAiB,CAAC,GAAc;IACvC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAoB;QAC/B,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,QAAQ,EAAE,GAAG,CAAC,QAA0B;QACxC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,eAAe,EAAE,GAAG,CAAC,iBAAiB;QACtC,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED,MAAM,eAAe,GACnB,8EAA8E;IAC9E,2EAA2E,CAAA;AAE7E,wFAAwF;AACxF,SAAS,UAAU,CAAC,MAAwB;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAC1D,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,MAAM,EAAE,CAAA;AACpC,CAAC;AAED,MAAM,OAAO,8BAA8B;IACZ,EAAE;IAA/B,YAA6B,EAAgB;kBAAhB,EAAE;IAAiB,CAAC;IAEjD,KAAK,CAAC,WAAW,CACf,KAAkB,EAClB,OAAe,EACf,QAAyB;QAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,UAAU,eAAe;;aAEpB,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE;;iCAEd,CAC1B;aACA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAA2B,CAAA;QAC/F,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAwB,EACxB,QAAwB;QAExB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,UAAU,eAAe;iBAChB,KAAK,CAAC,GAAG;iCACO,CAC1B;aACA,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,CAA2B,CAAA;QAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,MAAwB;QACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;iBACS,KAAK,CAAC,GAAG,yBAAyB,CAC5C;aACA,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAsC,CAAA;QAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAA0B,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,OAAO,CACX,KAAkB,EAClB,OAAe,EACf,EAAU;QAEV,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN,UAAU,eAAe;;iBAEhB,CACV;aACA,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAqC,CAAA;QAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAA4B;QACpC,2FAA2F;QAC3F,4FAA4F;QAC5F,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;cACM,eAAe;2DAC8B,CACpD;aACA,GAAG,CACF,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,YAAY,CACpB,CAAA;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,EAAU;QACrC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAwB,EACxB,QAAwB,EACxB,GAAW,EACX,QAAgB;QAEhB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAChC,0EAA0E;QAC1E,wFAAwF;QACxF,qFAAqF;QACrF,wDAAwD;QACxD,MAAM,KAAK,GAAG;qEACmD,CAAA;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;iBACS,KAAK,CAAC,GAAG;qBACL,KAAK;iBACT,CACV;aACA,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAA+B,CAAA;QAC9E,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAA;QACrB,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACpB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,UAAU,eAAe,sCAAsC,CAAC;aACxE,GAAG,CAAC,EAAE,CAAqC,CAAA;QAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CACf,EAAU,EACV,KAAoD,EACpD,EAAU,EACV,QAAgB;QAEhB,wFAAwF;QACxF,uFAAuF;QACvF,sFAAsF;QACtF,MAAM,MAAM,GAAG,yEAAyE,CAAA;QACxF,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;2CACmC,MAAM;sCACX,MAAM;uCACL,MAAM;uCACN,MAAM;wBACrB,CACjB;aACA,GAAG,CAAC;YACH,EAAE;YACF,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,SAAS,EAAE,KAAK,CAAC,YAAY;YAC7B,EAAE;SACH,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAkB,EAAE,OAAe,EAAE,EAAU,EAAE,EAAU;QAC1E,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;4EACoE,CACrE;aACA,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAChC,CAAC;CACF;AAiBD,SAAS,mBAAmB,CAAC,GAAqB;IAChD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,QAAQ,EAAE,GAAG,CAAC,QAAuB;QACrC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,YAAY,EAAE,GAAG,CAAC,cAAc;QAChC,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GACpB,oFAAoF,CAAA;AAEtF,MAAM,OAAO,kCAAkC;IAChB,EAAE;IAA/B,YAA6B,EAAgB;kBAAhB,EAAE;IAAiB,CAAC;IAEjD,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,UAAU,gBAAgB;mDACiB,CAC5C;aACA,GAAG,CAAC,MAAM,CAAkC,CAAA;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,MAAc,EACd,QAAqB;QAErB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN,UAAU,gBAAgB;oDACkB,CAC7C;aACA,GAAG,CAAC,MAAM,EAAE,QAAQ,CAA4C,CAAA;QACnE,OAAO,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAgC;QAC3C,uFAAuF;QACvF,kDAAkD;QAClD,IAAI,CAAC,EAAE;aACJ,OAAO,CACN,sCAAsC,gBAAgB;;;;;;;4CAOlB,CACrC;aACA,GAAG,CACF,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,YAAY,EACnB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7B,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,CACjB,CAAA;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAqB;QAChD,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,sEAAsE,CAAC;aAC/E,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC1B,CAAC;CACF;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO;QACL,wBAAwB,EAAE,IAAI,8BAA8B,CAAC,EAAE,CAAC;QAChE,4BAA4B,EAAE,IAAI,kCAAkC,CAAC,EAAE,CAAC;QACxE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE;KACxB,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/local-server",
-  "version": "0.26.1",
+  "version": "0.27.0",
   "description": "Local-mode runtime facade for the Agent Architecture Board: the @cat-factory/node-server stack with agent jobs run as local Docker/Podman containers and GitHub accessed via a personal access token — a developer can run the whole product on their own machine.",
   "repository": {
     "type": "git",
@@ -26,13 +26,13 @@
   "dependencies": {
     "drizzle-orm": "1.0.0-rc.3",
     "@cat-factory/agents": "0.23.1",
-    "@cat-factory/contracts": "0.59.0",
     "@cat-factory/gitlab": "0.4.7",
+    "@cat-factory/contracts": "0.59.0",
     "@cat-factory/integrations": "0.40.0",
     "@cat-factory/kernel": "0.57.0",
     "@cat-factory/node-server": "0.45.0",
-    "@cat-factory/orchestration": "0.45.2",
-    "@cat-factory/server": "0.51.0"
+    "@cat-factory/server": "0.51.0",
+    "@cat-factory/orchestration": "0.45.2"
   },
   "devDependencies": {
     "@types/node": "^26.0.1",