@cat-factory/worker 0.224.2 → 0.225.2

package/dist/infrastructure/repositories/D1DirectoryRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"D1DirectoryRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1DirectoryRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EAIxB,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EAClC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAkG3D,qBAAa,qBAAsB,YAAW,mBAAmB;IAC/D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,GAC5B,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAuBlC;IAEK,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhD;IAEK,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAajE;IAEK,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMzD;IAEK,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlD;IAEK,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,GAC5B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAW/B;IAEK,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,EAAE,CAAC,CAW1B;IAEK,sBAAsB,CAC1B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAUvC;IAEK,wBAAwB,CAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,sBAAsB,GAAG,IAAI,EACpC,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,GAC5B,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAoBzC;IAEK,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,gBAAgB,GAAG,IAAI,EAC9B,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,GAC5B,OAAO,CAAC,aAAa,EAAE,CAAC,CAqB1B;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAanF;IAEK,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAczE;IAEK,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAavC;IAEK,uBAAuB,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,sBAAsB,EAAE,GAC7B,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAezC;IAEK,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAgBpF;CACF"}

package/dist/infrastructure/repositories/D1DirectoryRepository.js

@@ -0,0 +1,240 @@
+import { directoryChangeFromRow, WORKSPACE_DIRECTORY_ENTITY_TYPES, } from '@cat-factory/kernel';
+import {} from '@cat-factory/contracts';
+import { chunkForIn } from './chunk';
+import { parseRoles } from './D1MembershipRepository';
+const toWorkspace = (row) => ({
+    id: row.id,
+    name: row.name,
+    description: row.description,
+    accessMode: row.access_mode === 'restricted' ? 'restricted' : 'account',
+});
+const toUser = (row) => ({
+    id: row.id,
+    name: row.name,
+    email: row.email,
+    avatarUrl: row.avatar_url,
+});
+const toAccountMembership = (row) => ({
+    userId: row.user_id,
+    roles: parseRoles(row.roles),
+    createdAt: row.created_at,
+});
+const toWorkspaceMembership = (row) => ({
+    workspaceId: row.workspace_id,
+    userId: row.user_id,
+    role: row.role === 'admin' || row.role === 'member' ? row.role : 'viewer',
+    createdAt: row.created_at,
+});
+const toRepo = (row) => ({
+    workspaceId: row.workspace_id,
+    repoId: row.github_id,
+    provider: row.provider === 'gitlab' ? 'gitlab' : 'github',
+    owner: row.owner,
+    name: row.name,
+    defaultBranch: row.default_branch,
+    private: row.private === 1,
+    monorepo: row.is_monorepo === 1,
+});
+/** `AND <column> IN (...)` for a workspace reach, or nothing for an unrestricted one. */
+function reachClause(column, workspaceIds) {
+    if (workspaceIds === null)
+        return { sql: '', binds: [] };
+    if (workspaceIds.length === 0)
+        return { sql: ' AND 0 = 1', binds: [] };
+    return {
+        sql: ` AND ${column} IN (${workspaceIds.map(() => '?').join(', ')})`,
+        binds: workspaceIds,
+    };
+}
+export class D1DirectoryRepository {
+    db;
+    constructor({ db }) {
+        this.db = db;
+    }
+    async listChanges(accountId, afterSeq, upToSeq, limit, workspaceIds) {
+        // A restricted key reads its workspaces' changes plus the deletion of ANY workspace that no
+        // longer exists: deleting a board also drops the key's grant on it, so without the second arm
+        // the key would never learn that a board it mirrored is gone.
+        const reach = reachClause('workspace_id', workspaceIds);
+        const restricted = workspaceIds === null
+            ? { sql: '', binds: [] }
+            : {
+                sql: ` AND ((entity_type IN (${WORKSPACE_DIRECTORY_ENTITY_TYPES.map(() => '?').join(', ')})${reach.sql})
+                    OR (entity_type = 'workspace'
+                        AND NOT EXISTS (SELECT 1 FROM workspaces w WHERE w.id = directory_changes.entity_id)))`,
+                binds: [...WORKSPACE_DIRECTORY_ENTITY_TYPES, ...reach.binds],
+            };
+        const { results } = await this.db
+            .prepare(`SELECT * FROM directory_changes
+          WHERE account_id = ? AND seq > ? AND seq <= ?${restricted.sql}
+          ORDER BY seq ASC LIMIT ?`)
+            .bind(accountId, afterSeq, upToSeq, ...restricted.binds, limit)
+            .all();
+        return results.map(directoryChangeFromRow);
+    }
+    async headSeq(accountId) {
+        const row = await this.db
+            .prepare('SELECT MAX(seq) AS head FROM directory_changes WHERE account_id = ?')
+            .bind(accountId)
+            .first();
+        return row?.head ?? 0;
+    }
+    async headSeqs(accountIds) {
+        const heads = new Map(accountIds.map((id) => [id, 0]));
+        for (const chunk of chunkForIn(accountIds)) {
+            const { results } = await this.db
+                .prepare(`SELECT account_id, MAX(seq) AS head FROM directory_changes
+            WHERE account_id IN (${chunk.map(() => '?').join(', ')}) GROUP BY account_id`)
+                .bind(...chunk)
+                .all();
+            for (const row of results ?? [])
+                heads.set(row.account_id, row.head);
+        }
+        return heads;
+    }
+    async oldestSeq(accountId) {
+        const row = await this.db
+            .prepare('SELECT MIN(seq) AS oldest FROM directory_changes WHERE account_id = ?')
+            .bind(accountId)
+            .first();
+        return row?.oldest ?? null;
+    }
+    async pruneChanges(before) {
+        // A `seq` PREFIX per account, up to its newest row older than the cutoff. `at` is not monotonic
+        // in `seq` (a writer stamps it before waiting on the feed's ordering), so deleting by `at` alone
+        // could remove a row while keeping an older-`seq` one, leaving a hole behind the oldest row that
+        // the reader's expiry check cannot see.
+        const result = await this.db
+            .prepare(`WITH cut AS (SELECT account_id, MAX(seq) AS upto FROM directory_changes
+                       WHERE at < ? GROUP BY account_id)
+         DELETE FROM directory_changes
+          WHERE account_id IN (SELECT account_id FROM cut)
+            AND seq <= (SELECT upto FROM cut WHERE cut.account_id = directory_changes.account_id)
+            AND seq < (SELECT MAX(d.seq) FROM directory_changes d
+                        WHERE d.account_id = directory_changes.account_id)`)
+            .bind(before)
+            .run();
+        return result.meta.changes ?? 0;
+    }
+    async listWorkspaces(accountId, after, limit, workspaceIds) {
+        const reach = reachClause('id', workspaceIds);
+        const { results } = await this.db
+            .prepare(`SELECT id, name, description, access_mode FROM workspaces
+          WHERE account_id = ? AND id > ?${reach.sql}
+          ORDER BY id ASC LIMIT ?`)
+            .bind(accountId, after ?? '', ...reach.binds, limit)
+            .all();
+        return results.map(toWorkspace);
+    }
+    async listUsers(accountId, after, limit) {
+        const { results } = await this.db
+            .prepare(`SELECT u.id, u.name, u.email, u.avatar_url FROM users u
+           JOIN memberships m ON m.user_id = u.id
+          WHERE m.account_id = ? AND u.id > ?
+          ORDER BY u.id ASC LIMIT ?`)
+            .bind(accountId, after ?? '', limit)
+            .all();
+        return results.map(toUser);
+    }
+    async listAccountMemberships(accountId, after, limit) {
+        const { results } = await this.db
+            .prepare(`SELECT user_id, roles, created_at FROM memberships
+          WHERE account_id = ? AND user_id > ?
+          ORDER BY user_id ASC LIMIT ?`)
+            .bind(accountId, after ?? '', limit)
+            .all();
+        return results.map(toAccountMembership);
+    }
+    async listWorkspaceMemberships(accountId, after, limit, workspaceIds) {
+        const reach = reachClause('m.workspace_id', workspaceIds);
+        const { results } = await this.db
+            .prepare(`SELECT m.workspace_id, m.user_id, m.role, m.created_at
+           FROM workspace_members m JOIN workspaces w ON w.id = m.workspace_id
+          WHERE w.account_id = ?
+            AND (m.workspace_id > ? OR (m.workspace_id = ? AND m.user_id > ?))${reach.sql}
+          ORDER BY m.workspace_id ASC, m.user_id ASC LIMIT ?`)
+            .bind(accountId, after?.workspaceId ?? '', after?.workspaceId ?? '', after?.userId ?? '', ...reach.binds, limit)
+            .all();
+        return results.map(toWorkspaceMembership);
+    }
+    async listRepos(accountId, after, limit, workspaceIds) {
+        const reach = reachClause('r.workspace_id', workspaceIds);
+        const { results } = await this.db
+            .prepare(`SELECT r.workspace_id, r.github_id, r.provider, r.owner, r.name, r.default_branch,
+                r.private, r.is_monorepo
+           FROM github_repos r JOIN workspaces w ON w.id = r.workspace_id
+          WHERE w.account_id = ? AND r.deleted_at IS NULL
+            AND (r.workspace_id > ? OR (r.workspace_id = ? AND r.github_id > ?))${reach.sql}
+          ORDER BY r.workspace_id ASC, r.github_id ASC LIMIT ?`)
+            .bind(accountId, after?.workspaceId ?? '', after?.workspaceId ?? '', after?.repoId ?? -1, ...reach.binds, limit)
+            .all();
+        return results.map(toRepo);
+    }
+    async getWorkspaces(accountId, ids) {
+        const out = [];
+        for (const chunk of chunkForIn(ids)) {
+            const { results } = await this.db
+                .prepare(`SELECT id, name, description, access_mode FROM workspaces
+            WHERE account_id = ? AND id IN (${chunk.map(() => '?').join(', ')})`)
+                .bind(accountId, ...chunk)
+                .all();
+            out.push(...results.map(toWorkspace));
+        }
+        return out;
+    }
+    async getUsers(accountId, ids) {
+        const out = [];
+        for (const chunk of chunkForIn(ids)) {
+            const { results } = await this.db
+                .prepare(`SELECT u.id, u.name, u.email, u.avatar_url FROM users u
+             JOIN memberships m ON m.user_id = u.id
+            WHERE m.account_id = ? AND u.id IN (${chunk.map(() => '?').join(', ')})`)
+                .bind(accountId, ...chunk)
+                .all();
+            out.push(...results.map(toUser));
+        }
+        return out;
+    }
+    async getAccountMemberships(accountId, userIds) {
+        const out = [];
+        for (const chunk of chunkForIn(userIds)) {
+            const { results } = await this.db
+                .prepare(`SELECT user_id, roles, created_at FROM memberships
+            WHERE account_id = ? AND user_id IN (${chunk.map(() => '?').join(', ')})`)
+                .bind(accountId, ...chunk)
+                .all();
+            out.push(...results.map(toAccountMembership));
+        }
+        return out;
+    }
+    async getWorkspaceMemberships(accountId, keys) {
+        const out = [];
+        for (const chunk of chunkForIn(keys, 2)) {
+            const match = chunk.map(() => '(m.workspace_id = ? AND m.user_id = ?)').join(' OR ');
+            const { results } = await this.db
+                .prepare(`SELECT m.workspace_id, m.user_id, m.role, m.created_at
+             FROM workspace_members m JOIN workspaces w ON w.id = m.workspace_id
+            WHERE w.account_id = ? AND (${match})`)
+                .bind(accountId, ...chunk.flatMap((k) => [k.workspaceId, k.userId]))
+                .all();
+            out.push(...results.map(toWorkspaceMembership));
+        }
+        return out;
+    }
+    async getRepos(accountId, keys) {
+        const out = [];
+        for (const chunk of chunkForIn(keys, 2)) {
+            const match = chunk.map(() => '(r.workspace_id = ? AND r.github_id = ?)').join(' OR ');
+            const { results } = await this.db
+                .prepare(`SELECT r.workspace_id, r.github_id, r.provider, r.owner, r.name, r.default_branch,
+                  r.private, r.is_monorepo
+             FROM github_repos r JOIN workspaces w ON w.id = r.workspace_id
+            WHERE w.account_id = ? AND r.deleted_at IS NULL AND (${match})`)
+                .bind(accountId, ...chunk.flatMap((k) => [k.workspaceId, k.repoId]))
+                .all();
+            out.push(...results.map(toRepo));
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=D1DirectoryRepository.js.map

package/dist/infrastructure/repositories/D1DirectoryRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"D1DirectoryRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1DirectoryRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EAEtB,gCAAgC,GAEjC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAMN,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AA6CrD,MAAM,WAAW,GAAG,CAAC,GAAiB,EAAsB,EAAE,CAAC,CAAC;IAC9D,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,WAAW,EAAE,GAAG,CAAC,WAAW;IAC5B,UAAU,EAAE,GAAG,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;CACxE,CAAC,CAAA;AAEF,MAAM,MAAM,GAAG,CAAC,GAAY,EAAiB,EAAE,CAAC,CAAC;IAC/C,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,SAAS,EAAE,GAAG,CAAC,UAAU;CAC1B,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG,CAAC,GAAyB,EAA8B,EAAE,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,CAAC,OAAO;IACnB,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;IAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;CAC1B,CAAC,CAAA;AAEF,MAAM,qBAAqB,GAAG,CAAC,GAA2B,EAAgC,EAAE,CAAC,CAAC;IAC5F,WAAW,EAAE,GAAG,CAAC,YAAY;IAC7B,MAAM,EAAE,GAAG,CAAC,OAAO;IACnB,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;IACzE,SAAS,EAAE,GAAG,CAAC,UAAU;CAC1B,CAAC,CAAA;AAEF,MAAM,MAAM,GAAG,CAAC,GAAY,EAAiB,EAAE,CAAC,CAAC;IAC/C,WAAW,EAAE,GAAG,CAAC,YAAY;IAC7B,MAAM,EAAE,GAAG,CAAC,SAAS;IACrB,QAAQ,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;IACzD,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,aAAa,EAAE,GAAG,CAAC,cAAc;IACjC,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;IAC1B,QAAQ,EAAE,GAAG,CAAC,WAAW,KAAK,CAAC;CAChC,CAAC,CAAA;AAEF,yFAAyF;AACzF,SAAS,WAAW,CAClB,MAAc,EACd,YAA6B;IAE7B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACxD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtE,OAAO;QACL,GAAG,EAAE,QAAQ,MAAM,QAAQ,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACpE,KAAK,EAAE,YAAY;KACpB,CAAA;AACH,CAAC;AAED,MAAM,OAAO,qBAAqB;IACf,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CACf,SAAiB,EACjB,QAAgB,EAChB,OAAe,EACf,KAAa,EACb,YAA6B;QAE7B,4FAA4F;QAC5F,8FAA8F;QAC9F,8DAA8D;QAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,EAAE,YAAY,CAAC,CAAA;QACvD,MAAM,UAAU,GACd,YAAY,KAAK,IAAI;YACnB,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAc,EAAE;YACpC,CAAC,CAAC;gBACE,GAAG,EAAE,0BAA0B,gCAAgC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG;;+GAEH;gBACnG,KAAK,EAAE,CAAC,GAAG,gCAAgC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;aAC7D,CAAA;QACP,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;yDACiD,UAAU,CAAC,GAAG;mCACpC,CAC5B;aACA,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC;aAC9D,GAAG,EAAyB,CAAA;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,qEAAqE,CAAC;aAC9E,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,EAA2B,CAAA;QACnC,OAAO,GAAG,EAAE,IAAI,IAAI,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAoB;QACjC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACtD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CACN;mCACyB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAChF;iBACA,IAAI,CAAC,GAAG,KAAK,CAAC;iBACd,GAAG,EAAwC,CAAA;YAC9C,KAAK,MAAM,GAAG,IAAI,OAAO,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACtE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,uEAAuE,CAAC;aAChF,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,EAA6B,CAAA;QACrC,OAAO,GAAG,EAAE,MAAM,IAAI,IAAI,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,wCAAwC;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,OAAO,CACN;;;;;;2EAMmE,CACpE;aACA,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,EAAE,CAAA;QACR,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,SAAiB,EACjB,KAAoB,EACpB,KAAa,EACb,YAA6B;QAE7B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;2CACmC,KAAK,CAAC,GAAG;kCAClB,CAC3B;aACA,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;aACnD,GAAG,EAAgB,CAAA;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACjC,CAAC;IAED,KAAK,CAAC,SAAS,CACb,SAAiB,EACjB,KAAoB,EACpB,KAAa;QAEb,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;;oCAG4B,CAC7B;aACA,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC;aACnC,GAAG,EAAW,CAAA;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,SAAiB,EACjB,KAAoB,EACpB,KAAa;QAEb,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;uCAE+B,CAChC;aACA,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC;aACnC,GAAG,EAAwB,CAAA;QAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,SAAiB,EACjB,KAAoC,EACpC,KAAa,EACb,YAA6B;QAE7B,MAAM,KAAK,GAAG,WAAW,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAA;QACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;;gFAGwE,KAAK,CAAC,GAAG;6DAC5B,CACtD;aACA,IAAI,CACH,SAAS,EACT,KAAK,EAAE,WAAW,IAAI,EAAE,EACxB,KAAK,EAAE,WAAW,IAAI,EAAE,EACxB,KAAK,EAAE,MAAM,IAAI,EAAE,EACnB,GAAG,KAAK,CAAC,KAAK,EACd,KAAK,CACN;aACA,GAAG,EAA0B,CAAA;QAChC,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CACb,SAAiB,EACjB,KAA8B,EAC9B,KAAa,EACb,YAA6B;QAE7B,MAAM,KAAK,GAAG,WAAW,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAA;QACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;;;kFAI0E,KAAK,CAAC,GAAG;+DAC5B,CACxD;aACA,IAAI,CACH,SAAS,EACT,KAAK,EAAE,WAAW,IAAI,EAAE,EACxB,KAAK,EAAE,WAAW,IAAI,EAAE,EACxB,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,EACnB,GAAG,KAAK,CAAC,KAAK,EACd,KAAK,CACN;aACA,GAAG,EAAW,CAAA;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,GAAa;QAClD,MAAM,GAAG,GAAyB,EAAE,CAAA;QACpC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CACN;8CACoC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvE;iBACA,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC;iBACzB,GAAG,EAAgB,CAAA;YACtB,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,GAAa;QAC7C,MAAM,GAAG,GAAoB,EAAE,CAAA;QAC/B,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CACN;;kDAEwC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3E;iBACA,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC;iBACzB,GAAG,EAAW,CAAA;YACjB,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,SAAiB,EACjB,OAAiB;QAEjB,MAAM,GAAG,GAAiC,EAAE,CAAA;QAC5C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CACN;mDACyC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5E;iBACA,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC;iBACzB,GAAG,EAAwB,CAAA;YAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAA;QAC/C,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,SAAiB,EACjB,IAA8B;QAE9B,MAAM,GAAG,GAAmC,EAAE,CAAA;QAC9C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,wCAAwC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CACN;;0CAEgC,KAAK,GAAG,CACzC;iBACA,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;iBACnE,GAAG,EAA0B,CAAA;YAChC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAA;QACjD,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,IAAwB;QACxD,MAAM,GAAG,GAAoB,EAAE,CAAA;QAC/B,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,0CAA0C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CACN;;;mEAGyD,KAAK,GAAG,CAClE;iBACA,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;iBACnE,GAAG,EAAW,CAAA;YACjB,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF"}

package/dist/infrastructure/repositories/D1DirectoryWebhookRepository.d.ts

@@ -0,0 +1,17 @@
+import type { DirectoryWebhookRecord, DirectoryWebhookRepository } from '@cat-factory/kernel';
+import type { D1Database } from '@cloudflare/workers-types';
+export declare class D1DirectoryWebhookRepository implements DirectoryWebhookRepository {
+    private readonly db;
+    constructor({ db }: {
+        db: D1Database;
+    });
+    list(accountId: string): Promise<DirectoryWebhookRecord[]>;
+    get(accountId: string, id: string): Promise<DirectoryWebhookRecord | null>;
+    put(record: DirectoryWebhookRecord, limit: number): Promise<'stored' | 'limit_reached'>;
+    delete(accountId: string, id: string): Promise<void>;
+    listEnabled(): Promise<DirectoryWebhookRecord[]>;
+    claim(accountId: string, id: string, token: string, now: number, leaseUntil: number): Promise<number | null>;
+    complete(accountId: string, id: string, token: string, toSeq: number): Promise<boolean>;
+    release(accountId: string, id: string, token: string): Promise<void>;
+}
+//# sourceMappingURL=D1DirectoryWebhookRepository.d.ts.map

package/dist/infrastructure/repositories/D1DirectoryWebhookRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"D1DirectoryWebhookRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1DirectoryWebhookRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAC7F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AA4B3D,qBAAa,4BAA6B,YAAW,0BAA0B;IAC7E,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAM/D;IAEK,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAM/E;IAEK,GAAG,CAAC,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAC,CAgC5F;IAEK,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKzD;IAEK,WAAW,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAKrD;IAEK,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;IAEK,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS5F;IAEK,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzE;CACF"}

package/dist/infrastructure/repositories/D1DirectoryWebhookRepository.js

@@ -0,0 +1,88 @@
+function toRecord(row) {
+    return {
+        accountId: row.account_id,
+        id: row.id,
+        url: row.url,
+        enabled: row.enabled === 1,
+        secretSealed: row.secret_sealed,
+        deliveredSeq: row.delivered_seq,
+        updatedAt: row.updated_at,
+    };
+}
+export class D1DirectoryWebhookRepository {
+    db;
+    constructor({ db }) {
+        this.db = db;
+    }
+    async list(accountId) {
+        const { results } = await this.db
+            .prepare('SELECT * FROM directory_webhooks WHERE account_id = ? ORDER BY id ASC')
+            .bind(accountId)
+            .all();
+        return results.map(toRecord);
+    }
+    async get(accountId, id) {
+        const row = await this.db
+            .prepare('SELECT * FROM directory_webhooks WHERE account_id = ? AND id = ?')
+            .bind(accountId, id)
+            .first();
+        return row ? toRecord(row) : null;
+    }
+    async put(record, limit) {
+        // One conditional statement, so the count and the insert cannot be split by a concurrent
+        // registration: an existing endpoint is always admitted (the count includes it), a new one only
+        // under the cap. SQLite serializes writers, which is what makes this single statement enough.
+        const result = await this.db
+            .prepare(`INSERT INTO directory_webhooks
+           (account_id, id, url, enabled, secret_sealed, delivered_seq, updated_at)
+         SELECT ?, ?, ?, ?, ?, ?, ?
+         WHERE EXISTS (SELECT 1 FROM directory_webhooks WHERE account_id = ? AND id = ?)
+            OR (SELECT COUNT(*) FROM directory_webhooks WHERE account_id = ?) < ?
+         ON CONFLICT (account_id, id) DO UPDATE SET
+           url = excluded.url,
+           enabled = excluded.enabled,
+           secret_sealed = excluded.secret_sealed,
+           updated_at = excluded.updated_at`)
+            .bind(record.accountId, record.id, record.url, record.enabled ? 1 : 0, record.secretSealed, record.deliveredSeq, record.updatedAt, record.accountId, record.id, record.accountId, limit)
+            .run();
+        return (result.meta.changes ?? 0) > 0 ? 'stored' : 'limit_reached';
+    }
+    async delete(accountId, id) {
+        await this.db
+            .prepare('DELETE FROM directory_webhooks WHERE account_id = ? AND id = ?')
+            .bind(accountId, id)
+            .run();
+    }
+    async listEnabled() {
+        const { results } = await this.db
+            .prepare('SELECT * FROM directory_webhooks WHERE enabled = 1 ORDER BY account_id, id')
+            .all();
+        return results.map(toRecord);
+    }
+    async claim(accountId, id, token, now, leaseUntil) {
+        const row = await this.db
+            .prepare(`UPDATE directory_webhooks SET lease_token = ?, lease_until = ?
+          WHERE account_id = ? AND id = ? AND enabled = 1
+            AND (lease_until IS NULL OR lease_until <= ?)
+          RETURNING delivered_seq`)
+            .bind(token, leaseUntil, accountId, id, now)
+            .first();
+        return row ? row.delivered_seq : null;
+    }
+    async complete(accountId, id, token, toSeq) {
+        const result = await this.db
+            .prepare(`UPDATE directory_webhooks SET delivered_seq = ?, lease_token = NULL, lease_until = NULL
+          WHERE account_id = ? AND id = ? AND lease_token = ?`)
+            .bind(toSeq, accountId, id, token)
+            .run();
+        return (result.meta.changes ?? 0) > 0;
+    }
+    async release(accountId, id, token) {
+        await this.db
+            .prepare(`UPDATE directory_webhooks SET lease_token = NULL, lease_until = NULL
+          WHERE account_id = ? AND id = ? AND lease_token = ?`)
+            .bind(accountId, id, token)
+            .run();
+    }
+}
+//# sourceMappingURL=D1DirectoryWebhookRepository.js.map

package/dist/infrastructure/repositories/D1DirectoryWebhookRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"D1DirectoryWebhookRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1DirectoryWebhookRepository.ts"],"names":[],"mappings":"AAiBA,SAAS,QAAQ,CAAC,GAAQ;IACxB,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;QAC1B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED,MAAM,OAAO,4BAA4B;IACtB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,uEAAuE,CAAC;aAChF,IAAI,CAAC,SAAS,CAAC;aACf,GAAG,EAAO,CAAA;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,EAAU;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,kEAAkE,CAAC;aAC3E,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;aACnB,KAAK,EAAO,CAAA;QACf,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAA8B,EAAE,KAAa;QACrD,yFAAyF;QACzF,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,OAAO,CACN;;;;;;;;;4CASoC,CACrC;aACA,IAAI,CACH,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACtB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,SAAS,EAChB,KAAK,CACN;aACA,GAAG,EAAE,CAAA;QACR,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,EAAU;QACxC,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,gEAAgE,CAAC;aACzE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;aACnB,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,4EAA4E,CAAC;aACrF,GAAG,EAAO,CAAA;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9B,CAAC;IAED,KAAK,CAAC,KAAK,CACT,SAAiB,EACjB,EAAU,EACV,KAAa,EACb,GAAW,EACX,UAAkB;QAElB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CACN;;;kCAG0B,CAC3B;aACA,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC;aAC3C,KAAK,EAA6B,CAAA;QACrC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,EAAU,EAAE,KAAa,EAAE,KAAa;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,OAAO,CACN;8DACsD,CACvD;aACA,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC;aACjC,GAAG,EAAE,CAAA;QACR,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,EAAU,EAAE,KAAa;QACxD,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN;8DACsD,CACvD;aACA,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC;aAC1B,GAAG,EAAE,CAAA;IACV,CAAC;CACF"}

package/dist/infrastructure/repositories/D1MembershipRepository.d.ts

@@ -1,5 +1,7 @@
-import type { Membership, MembershipRepository } from '@cat-factory/kernel';
+import type { AccountRole, Membership, MembershipRepository } from '@cat-factory/kernel';
 import type { D1Database } from '@cloudflare/workers-types';
+/** Parse the CSV `roles` column into a non-empty role set (defaults to developer). */
+export declare function parseRoles(csv: string | null): AccountRole[];
 /** D1-backed store of account memberships (user ↔ account + roles; migration 0043). */
 export declare class D1MembershipRepository implements MembershipRepository {
     private readonly db;

package/dist/infrastructure/repositories/D1MembershipRepository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"D1MembershipRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1MembershipRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AACxF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AA4B3D,uFAAuF;AACvF,qBAAa,sBAAuB,YAAW,oBAAoB;IACjE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAMtD;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAM5D;IAEK,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAMvE;IAEK,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBlD;IAEK,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7D;CACF"}
+{"version":3,"file":"D1MembershipRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1MembershipRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AACxF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAU3D,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,EAAE,CAM5D;AAWD,uFAAuF;AACvF,qBAAa,sBAAuB,YAAW,oBAAoB;IACjE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAMtD;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAM5D;IAEK,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAMvE;IAEK,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBlD;IAEK,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7D;CACF"}

package/dist/infrastructure/repositories/D1MembershipRepository.js

@@ -1,6 +1,6 @@
 import { accountMembershipSource, appendDirectoryChanges } from './directoryFeed';
 /** Parse the CSV `roles` column into a non-empty role set (defaults to developer). */
-function parseRoles(csv) {
+export function parseRoles(csv) {
     const roles = (csv ?? '')
         .split(',')
         .map((r) => r.trim())

package/dist/infrastructure/repositories/D1MembershipRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"D1MembershipRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1MembershipRepository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AASjF,sFAAsF;AACtF,SAAS,UAAU,CAAC,GAAkB;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,SAAS,CAAC,CAAA;IACzF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,GAAkB;IACzC,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,OAAO,sBAAsB;IAChB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,qEAAqE,CAAC;aAC9E,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,EAAiB,CAAA;QACvB,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,wEAAwE,CAAC;aACjF,IAAI,CAAC,SAAS,CAAC;aACf,GAAG,EAAiB,CAAA;QACvB,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,MAAc;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,gEAAgE,CAAC;aACzE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;aACvB,KAAK,EAAiB,CAAA;QACzB,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAsB;QACjC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;YAClB,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;kFACwE,CACzE;iBACA,IAAI,CACH,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAC1B,UAAU,CAAC,SAAS,CACrB;YACH,sBAAsB,CACpB,IAAI,CAAC,EAAE,EACP,uBAAuB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,EAChE,IAAI,CAAC,GAAG,EAAE,CACX;SACF,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,MAAc;QAC5C,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YACvF,IAAI,CAAC,EAAE;iBACJ,OAAO,CAAC,8DAA8D,CAAC;iBACvE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"D1MembershipRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1MembershipRepository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AASjF,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,GAAkB;IAC3C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,SAAS,CAAC,CAAA;IACzF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,GAAkB;IACzC,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,OAAO,sBAAsB;IAChB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,qEAAqE,CAAC;aAC9E,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,EAAiB,CAAA;QACvB,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,wEAAwE,CAAC;aACjF,IAAI,CAAC,SAAS,CAAC;aACf,GAAG,EAAiB,CAAA;QACvB,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,MAAc;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,gEAAgE,CAAC;aACzE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;aACvB,KAAK,EAAiB,CAAA;QACzB,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAsB;QACjC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;YAClB,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;kFACwE,CACzE;iBACA,IAAI,CACH,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAC1B,UAAU,CAAC,SAAS,CACrB;YACH,sBAAsB,CACpB,IAAI,CAAC,EAAE,EACP,uBAAuB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,EAChE,IAAI,CAAC,GAAG,EAAE,CACX;SACF,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,MAAc;QAC5C,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YACvF,IAAI,CAAC,EAAE;iBACJ,OAAO,CAAC,8DAA8D,CAAC;iBACvE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/infrastructure/repositories/D1PublicApiKeyRepository.d.ts

@@ -1,6 +1,10 @@
 import type { PublicApiKeyRecord, PublicApiKeyRepository } from '@cat-factory/kernel';
 import type { D1Database } from '@cloudflare/workers-types';
-/** D1-backed store of the inbound public-API keys (migrations 0034 + 0053 + 0054 + 0081 + 0086 + 0089). */
+/**
+ * D1-backed store of the inbound public-API keys and their workspace grants (migrations 0034,
+ * 0053, 0054, 0081, 0086, 0089, 0108). The secret is stored ONLY as a one-way peppered hash: this
+ * repo never sees the raw key.
+ */
 export declare class D1PublicApiKeyRepository implements PublicApiKeyRepository {
     private readonly db;
     constructor({ db }: {
@@ -8,9 +12,12 @@ export declare class D1PublicApiKeyRepository implements PublicApiKeyRepository
     });
     add(record: PublicApiKeyRecord): Promise<void>;
     getById(id: string): Promise<PublicApiKeyRecord | null>;
-    listByWorkspace(workspaceId: string): Promise<PublicApiKeyRecord[]>;
+    listByAccount(accountId: string): Promise<PublicApiKeyRecord[]>;
+    countLiveByAccount(accountId: string): Promise<number>;
     markUsed(id: string, at: number): Promise<void>;
-    revoke(workspaceId: string, id: string, at: number): Promise<void>;
-    revokeMintedBy(workspaceId: string, minterId: string, at: number): Promise<void>;
+    revoke(accountId: string, id: string, at: number): Promise<void>;
+    revokeMintedBy(accountId: string, minterId: string, at: number): Promise<void>;
+    /** The workspace grants of each key, chunked under D1's bound-parameter ceiling. */
+    private grantsOf;
 }
 //# sourceMappingURL=D1PublicApiKeyRepository.d.ts.map

package/dist/infrastructure/repositories/D1PublicApiKeyRepository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"D1PublicApiKeyRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1PublicApiKeyRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAErF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAoC3D,2GAA2G;AAC3G,qBAAa,wBAAyB,YAAW,sBAAsB;IACrE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,GAAG,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBnD;IAEK,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAM5D;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAUxE;IAEK,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpD;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE;IAEK,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASrF;CACF"}
+{"version":3,"file":"D1PublicApiKeyRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1PublicApiKeyRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAErF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAqC3D;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,sBAAsB;IACrE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,GAAG,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BnD;IAEK,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAU5D;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAYpE;IAEK,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW3D;IAEK,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpD;IAEK,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrE;IAEK,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnF;IAED,oFAAoF;YACtE,QAAQ;CAkBvB"}

package/dist/infrastructure/repositories/D1PublicApiKeyRepository.js

@@ -1,8 +1,9 @@
-function rowToRecord(row) {
+import { chunkForIn } from './chunk';
+function rowToRecord(row, grants) {
     return {
         id: row.id,
         accountId: row.account_id,
-        workspaceId: row.workspace_id,
+        workspaceIds: row.all_workspaces === 1 ? null : [...grants].sort(),
         label: row.label,
         scope: row.scope,
         secretHash: row.secret_hash,
@@ -15,35 +16,62 @@ function rowToRecord(row) {
         revokedAt: row.revoked_at,
     };
 }
-/** D1-backed store of the inbound public-API keys (migrations 0034 + 0053 + 0054 + 0081 + 0086 + 0089). */
+/**
+ * D1-backed store of the inbound public-API keys and their workspace grants (migrations 0034,
+ * 0053, 0054, 0081, 0086, 0089, 0108). The secret is stored ONLY as a one-way peppered hash: this
+ * repo never sees the raw key.
+ */
 export class D1PublicApiKeyRepository {
     db;
     constructor({ db }) {
         this.db = db;
     }
     async add(record) {
-        await this.db
-            .prepare(`INSERT INTO public_api_keys
-          (id, account_id, workspace_id, label, scope, secret_hash, created_by_user_id, created_by_key_id, external_identity, acts_as_user_id, created_at, last_used_at, revoked_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .bind(record.id, record.accountId, record.workspaceId, record.label, record.scope, record.secretHash, record.createdByUserId, record.createdByKeyId, record.externalIdentity, record.actsAsUserId, record.createdAt, record.lastUsedAt, record.revokedAt)
-            .run();
+        const grants = (record.workspaceIds ?? []).map((workspaceId) => this.db
+            .prepare('INSERT INTO public_api_key_workspaces (key_id, workspace_id) VALUES (?, ?)')
+            .bind(record.id, workspaceId));
+        await this.db.batch([
+            this.db
+                .prepare(`INSERT INTO public_api_keys
+            (id, account_id, all_workspaces, label, scope, secret_hash, created_by_user_id, created_by_key_id, external_identity, acts_as_user_id, created_at, last_used_at, revoked_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .bind(record.id, record.accountId, record.workspaceIds === null ? 1 : 0, record.label, record.scope, record.secretHash, record.createdByUserId, record.createdByKeyId, record.externalIdentity, record.actsAsUserId, record.createdAt, record.lastUsedAt, record.revokedAt),
+            ...grants,
+        ]);
     }
     async getById(id) {
         const row = await this.db
             .prepare('SELECT * FROM public_api_keys WHERE id = ?')
             .bind(id)
             .first();
-        return row ? rowToRecord(row) : null;
+        if (!row)
+            return null;
+        // An unrestricted key has no grant rows, so the authentication hot path skips the second read.
+        if (row.all_workspaces === 1)
+            return rowToRecord(row, []);
+        const grants = await this.grantsOf([row.id]);
+        return rowToRecord(row, grants.get(row.id) ?? []);
     }
-    async listByWorkspace(workspaceId) {
+    async listByAccount(accountId) {
         const { results } = await this.db
             .prepare(`SELECT * FROM public_api_keys
-          WHERE workspace_id = ? AND revoked_at IS NULL
+          WHERE account_id = ? AND revoked_at IS NULL
           ORDER BY created_at DESC`)
-            .bind(workspaceId)
+            .bind(accountId)
             .all();
-        return (results ?? []).map(rowToRecord);
+        const rows = results ?? [];
+        const grants = await this.grantsOf(rows.filter((r) => r.all_workspaces !== 1).map((r) => r.id));
+        return rows.map((row) => rowToRecord(row, grants.get(row.id) ?? []));
+    }
+    async countLiveByAccount(accountId) {
+        const row = await this.db
+            .prepare(`SELECT COUNT(*) AS n FROM public_api_keys k
+          WHERE k.account_id = ? AND k.revoked_at IS NULL
+            AND (k.all_workspaces = 1
+              OR EXISTS (SELECT 1 FROM public_api_key_workspaces g WHERE g.key_id = k.id))`)
+            .bind(accountId)
+            .first();
+        return row?.n ?? 0;
     }
     async markUsed(id, at) {
         await this.db
@@ -51,19 +79,34 @@ export class D1PublicApiKeyRepository {
             .bind(at, id)
             .run();
     }
-    async revoke(workspaceId, id, at) {
+    async revoke(accountId, id, at) {
         await this.db
-            .prepare('UPDATE public_api_keys SET revoked_at = ? WHERE id = ? AND workspace_id = ? AND revoked_at IS NULL')
-            .bind(at, id, workspaceId)
+            .prepare('UPDATE public_api_keys SET revoked_at = ? WHERE id = ? AND account_id = ? AND revoked_at IS NULL')
+            .bind(at, id, accountId)
             .run();
     }
-    async revokeMintedBy(workspaceId, minterId, at) {
-        // One statement over the minter index, never a list-then-revoke: the set is small, but a
-        // read-then-write would let a key minted between the two reads survive the cascade.
+    async revokeMintedBy(accountId, minterId, at) {
         await this.db
-            .prepare('UPDATE public_api_keys SET revoked_at = ? WHERE created_by_key_id = ? AND workspace_id = ? AND revoked_at IS NULL')
-            .bind(at, minterId, workspaceId)
+            .prepare('UPDATE public_api_keys SET revoked_at = ? WHERE created_by_key_id = ? AND account_id = ? AND revoked_at IS NULL')
+            .bind(at, minterId, accountId)
             .run();
     }
+    /** The workspace grants of each key, chunked under D1's bound-parameter ceiling. */
+    async grantsOf(keyIds) {
+        const out = new Map();
+        for (const chunk of chunkForIn(keyIds)) {
+            const placeholders = chunk.map(() => '?').join(', ');
+            const { results } = await this.db
+                .prepare(`SELECT key_id, workspace_id FROM public_api_key_workspaces WHERE key_id IN (${placeholders})`)
+                .bind(...chunk)
+                .all();
+            for (const row of results ?? []) {
+                const list = out.get(row.key_id) ?? [];
+                list.push(row.workspace_id);
+                out.set(row.key_id, list);
+            }
+        }
+        return out;
+    }
 }
 //# sourceMappingURL=D1PublicApiKeyRepository.js.map

package/dist/infrastructure/repositories/D1PublicApiKeyRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"D1PublicApiKeyRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1PublicApiKeyRepository.ts"],"names":[],"mappings":"AAoBA,SAAS,WAAW,CAAC,GAAoB;IACvC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAuB;QAClC,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,eAAe,EAAE,GAAG,CAAC,kBAAkB;QACvC,cAAc,EAAE,GAAG,CAAC,iBAAiB;QACrC,gBAAgB,EAAE,GAAG,CAAC,iBAAiB;QACvC,YAAY,EAAE,GAAG,CAAC,eAAe;QACjC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED,2GAA2G;AAC3G,MAAM,OAAO,wBAAwB;IAClB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAA0B;QAClC,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN;;wDAEgD,CACjD;aACA,IAAI,CACH,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,gBAAgB,EACvB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,SAAS,CACjB;aACA,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,4CAA4C,CAAC;aACrD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAmB,CAAA;QAC3B,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;mCAE2B,CAC5B;aACA,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAAmB,CAAA;QACzB,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,EAAU;QACnC,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,0DAA0D,CAAC;aACnE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;aACZ,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU,EAAE,EAAU;QACtD,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN,oGAAoG,CACrG;aACA,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC;aACzB,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,QAAgB,EAAE,EAAU;QACpE,yFAAyF;QACzF,oFAAoF;QACpF,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN,mHAAmH,CACpH;aACA,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC;aAC/B,GAAG,EAAE,CAAA;IACV,CAAC;CACF"}
+{"version":3,"file":"D1PublicApiKeyRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1PublicApiKeyRepository.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAkBpC,SAAS,WAAW,CAAC,GAAoB,EAAE,MAAgB;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,YAAY,EAAE,GAAG,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;QAClE,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAuB;QAClC,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,eAAe,EAAE,GAAG,CAAC,kBAAkB;QACvC,cAAc,EAAE,GAAG,CAAC,iBAAiB;QACrC,gBAAgB,EAAE,GAAG,CAAC,iBAAiB;QACvC,YAAY,EAAE,GAAG,CAAC,eAAe;QACjC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,wBAAwB;IAClB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAA0B;QAClC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAC7D,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,4EAA4E,CAAC;aACrF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CAChC,CAAA;QACD,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;YAClB,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;0DAEgD,CACjD;iBACA,IAAI,CACH,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACpC,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,gBAAgB,EACvB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,SAAS,CACjB;YACH,GAAG,MAAM;SACV,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,4CAA4C,CAAC;aACrD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAmB,CAAA;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,+FAA+F;QAC/F,IAAI,GAAG,CAAC,cAAc,KAAK,CAAC;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5C,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;;mCAE2B,CAC5B;aACA,IAAI,CAAC,SAAS,CAAC;aACf,GAAG,EAAmB,CAAA;QACzB,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,CAAA;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/F,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IACtE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAAiB;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CACN;;;2FAGmF,CACpF;aACA,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,EAAiB,CAAA;QACzB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,EAAU;QACnC,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,0DAA0D,CAAC;aACnE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;aACZ,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,EAAU,EAAE,EAAU;QACpD,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN,kGAAkG,CACnG;aACA,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC;aACvB,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,QAAgB,EAAE,EAAU;QAClE,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN,iHAAiH,CAClH;aACA,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC;aAC7B,GAAG,EAAE,CAAA;IACV,CAAC;IAED,oFAAoF;IAC5E,KAAK,CAAC,QAAQ,CAAC,MAAgB;QACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAoB,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CACN,+EAA+E,YAAY,GAAG,CAC/F;iBACA,IAAI,CAAC,GAAG,KAAK,CAAC;iBACd,GAAG,EAA4C,CAAA;YAClD,KAAK,MAAM,GAAG,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;gBACtC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;gBAC3B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF"}