@cat-factory/worker 0.6.0

package/dist/infrastructure/gateways/GitHubGateways.js

@@ -0,0 +1,48 @@
+/**
+ * Worker implementation of the GitHub backfill scheduler: creates a Cloudflare
+ * Workflows instance to durably drive a full-installation backfill. When no
+ * `GITHUB_BACKFILL_WORKFLOW` binding is present, returns false so the caller runs
+ * the backfill inline.
+ */
+export class WorkflowsBackfillScheduler {
+    workflow;
+    constructor(workflow) {
+        this.workflow = workflow;
+    }
+    async scheduleBackfill(installationId) {
+        if (!this.workflow)
+            return false;
+        await this.workflow
+            .create({
+            id: `backfill-${installationId}-${Date.now()}`,
+            params: { installationId },
+        })
+            .catch(() => { });
+        return true;
+    }
+}
+/**
+ * Worker implementation of GitHub webhook ingest: enqueues verified deliveries and
+ * incremental repo resyncs onto the `GITHUB_SYNC_QUEUE` so the request acks fast and
+ * the consumer applies projections asynchronously. Returns false when no queue is
+ * bound, so the caller handles the work inline (local/dev).
+ */
+export class CfGitHubWebhookIngest {
+    queue;
+    constructor(queue) {
+        this.queue = queue;
+    }
+    async enqueueWebhook(eventName, payload) {
+        if (!this.queue)
+            return false;
+        await this.queue.send({ kind: 'webhook', eventName, payload });
+        return true;
+    }
+    async queueRepoResync(workspaceId, repoGithubId) {
+        if (!this.queue)
+            return false;
+        await this.queue.send({ kind: 'resync-repo', workspaceId, repoGithubId });
+        return true;
+    }
+}
+//# sourceMappingURL=GitHubGateways.js.map

package/dist/infrastructure/gateways/GitHubGateways.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubGateways.js","sourceRoot":"","sources":["../../../src/infrastructure/gateways/GitHubGateways.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IACR,QAAQ;IAArC,YAA6B,QAAmB;wBAAnB,QAAQ;IAAc,CAAC;IAEpD,KAAK,CAAC,gBAAgB,CAAC,cAAsB;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAChC,MAAM,IAAI,CAAC,QAAQ;aAChB,MAAM,CAAC;YACN,EAAE,EAAE,YAAY,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;YAC9C,MAAM,EAAE,EAAE,cAAc,EAAE;SAC3B,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAClB,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACH,KAAK;IAAlC,YAA6B,KAAgC;qBAAhC,KAAK;IAA8B,CAAC;IAEjE,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,OAAgB;QACtD,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAA;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;QAC9D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,YAAoB;QAC7D,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAA;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAA;QACzE,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}

package/dist/infrastructure/github/FetchGitHubClient.d.ts

@@ -0,0 +1,2 @@
+export { FetchGitHubClient, GitHubApiError, type FetchGitHubClientDependencies, } from '@cat-factory/server';
+//# sourceMappingURL=FetchGitHubClient.d.ts.map

package/dist/infrastructure/github/FetchGitHubClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FetchGitHubClient.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/FetchGitHubClient.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/FetchGitHubClient.js

@@ -0,0 +1,4 @@
+// Moved to the runtime-neutral @cat-factory/server package (so the Node + local
+// facades run the same GitHub client); re-exported here for existing Worker imports.
+export { FetchGitHubClient, GitHubApiError, } from '@cat-factory/server';
+//# sourceMappingURL=FetchGitHubClient.js.map

package/dist/infrastructure/github/FetchGitHubClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FetchGitHubClient.js","sourceRoot":"","sources":["../../../src/infrastructure/github/FetchGitHubClient.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,qFAAqF;AACrF,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/FetchGitHubProvisioningClient.d.ts

@@ -0,0 +1,2 @@
+export { FetchGitHubProvisioningClient, type FetchGitHubProvisioningClientDependencies, } from '@cat-factory/server';
+//# sourceMappingURL=FetchGitHubProvisioningClient.d.ts.map

package/dist/infrastructure/github/FetchGitHubProvisioningClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FetchGitHubProvisioningClient.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/FetchGitHubProvisioningClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/FetchGitHubProvisioningClient.js

@@ -0,0 +1,5 @@
+// Moved to the runtime-neutral @cat-factory/server package (so the Node + local
+// facades can also provision repos when a privileged App is configured);
+// re-exported here for existing Worker imports.
+export { FetchGitHubProvisioningClient, } from '@cat-factory/server';
+//# sourceMappingURL=FetchGitHubProvisioningClient.js.map

package/dist/infrastructure/github/FetchGitHubProvisioningClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FetchGitHubProvisioningClient.js","sourceRoot":"","sources":["../../../src/infrastructure/github/FetchGitHubProvisioningClient.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,yEAAyE;AACzE,gDAAgD;AAChD,OAAO,EACL,6BAA6B,GAE9B,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/GitHubAppAuth.d.ts

@@ -0,0 +1,2 @@
+export { GitHubAppAuth, type GitHubAppAuthDependencies } from '@cat-factory/server';
+//# sourceMappingURL=GitHubAppAuth.d.ts.map

package/dist/infrastructure/github/GitHubAppAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubAppAuth.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/GitHubAppAuth.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,KAAK,yBAAyB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/GitHubAppAuth.js

@@ -0,0 +1,5 @@
+// Moved to the runtime-neutral @cat-factory/server package (Web Crypto runs under
+// Node too, so the Node service mints installation tokens the same way);
+// re-exported here for existing Worker imports.
+export { GitHubAppAuth } from '@cat-factory/server';
+//# sourceMappingURL=GitHubAppAuth.js.map

package/dist/infrastructure/github/GitHubAppAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubAppAuth.js","sourceRoot":"","sources":["../../../src/infrastructure/github/GitHubAppAuth.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,yEAAyE;AACzE,gDAAgD;AAChD,OAAO,EAAE,aAAa,EAAkC,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/GitHubAppRegistry.d.ts

@@ -0,0 +1,2 @@
+export { GitHubAppRegistry, type GitHubAppRegistryDependencies, type RegisteredApp, } from '@cat-factory/server';
+//# sourceMappingURL=GitHubAppRegistry.d.ts.map

package/dist/infrastructure/github/GitHubAppRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubAppRegistry.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/GitHubAppRegistry.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/GitHubAppRegistry.js

@@ -0,0 +1,4 @@
+// Moved to the runtime-neutral @cat-factory/server package; re-exported here for
+// existing Worker imports.
+export { GitHubAppRegistry, } from '@cat-factory/server';
+//# sourceMappingURL=GitHubAppRegistry.js.map

package/dist/infrastructure/github/GitHubAppRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubAppRegistry.js","sourceRoot":"","sources":["../../../src/infrastructure/github/GitHubAppRegistry.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,2BAA2B;AAC3B,OAAO,EACL,iBAAiB,GAGlB,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/GitHubCiStatusProvider.d.ts

@@ -0,0 +1,2 @@
+export { GitHubCiStatusProvider, type GitHubCiStatusProviderDependencies, } from '@cat-factory/server';
+//# sourceMappingURL=GitHubCiStatusProvider.d.ts.map

package/dist/infrastructure/github/GitHubCiStatusProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubCiStatusProvider.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/GitHubCiStatusProvider.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/GitHubCiStatusProvider.js

@@ -0,0 +1,4 @@
+// Moved to the runtime-neutral @cat-factory/server package (so every facade can wire
+// the CI gate); re-exported here for existing Worker imports.
+export { GitHubCiStatusProvider, } from '@cat-factory/server';
+//# sourceMappingURL=GitHubCiStatusProvider.js.map

package/dist/infrastructure/github/GitHubCiStatusProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubCiStatusProvider.js","sourceRoot":"","sources":["../../../src/infrastructure/github/GitHubCiStatusProvider.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,8DAA8D;AAC9D,OAAO,EACL,sBAAsB,GAEvB,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/GitHubMergeabilityProvider.d.ts

@@ -0,0 +1,2 @@
+export { GitHubMergeabilityProvider, classifyMergeability, type GitHubMergeabilityProviderDependencies, } from '@cat-factory/server';
+//# sourceMappingURL=GitHubMergeabilityProvider.d.ts.map

package/dist/infrastructure/github/GitHubMergeabilityProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubMergeabilityProvider.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/GitHubMergeabilityProvider.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/GitHubMergeabilityProvider.js

@@ -0,0 +1,4 @@
+// Moved to the runtime-neutral @cat-factory/server package (so every facade can wire
+// the conflicts gate); re-exported here for existing Worker imports.
+export { GitHubMergeabilityProvider, classifyMergeability, } from '@cat-factory/server';
+//# sourceMappingURL=GitHubMergeabilityProvider.js.map

package/dist/infrastructure/github/GitHubMergeabilityProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubMergeabilityProvider.js","sourceRoot":"","sources":["../../../src/infrastructure/github/GitHubMergeabilityProvider.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,qEAAqE;AACrE,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/GitHubPullRequestMerger.d.ts

@@ -0,0 +1,2 @@
+export { GitHubPullRequestMerger, type GitHubPullRequestMergerDependencies, } from '@cat-factory/server';
+//# sourceMappingURL=GitHubPullRequestMerger.d.ts.map

package/dist/infrastructure/github/GitHubPullRequestMerger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubPullRequestMerger.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/GitHubPullRequestMerger.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/GitHubPullRequestMerger.js

@@ -0,0 +1,4 @@
+// Moved to the runtime-neutral @cat-factory/server package (so every facade can merge
+// for real); re-exported here for existing Worker imports.
+export { GitHubPullRequestMerger, } from '@cat-factory/server';
+//# sourceMappingURL=GitHubPullRequestMerger.js.map

package/dist/infrastructure/github/GitHubPullRequestMerger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubPullRequestMerger.js","sourceRoot":"","sources":["../../../src/infrastructure/github/GitHubPullRequestMerger.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,2DAA2D;AAC3D,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/WebCryptoWebhookVerifier.d.ts

@@ -0,0 +1,2 @@
+export { WebCryptoWebhookVerifier } from '@cat-factory/server';
+//# sourceMappingURL=WebCryptoWebhookVerifier.d.ts.map

package/dist/infrastructure/github/WebCryptoWebhookVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebCryptoWebhookVerifier.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/WebCryptoWebhookVerifier.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/WebCryptoWebhookVerifier.js

@@ -0,0 +1,5 @@
+// The webhook verifier is runtime-neutral and now lives in @cat-factory/server so
+// every facade verifies GitHub deliveries identically. Re-exported here to keep this
+// module's existing import path stable for the Worker infra.
+export { WebCryptoWebhookVerifier } from '@cat-factory/server';
+//# sourceMappingURL=WebCryptoWebhookVerifier.js.map

package/dist/infrastructure/github/WebCryptoWebhookVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebCryptoWebhookVerifier.js","sourceRoot":"","sources":["../../../src/infrastructure/github/WebCryptoWebhookVerifier.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,qFAAqF;AACrF,6DAA6D;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/encoding.d.ts

@@ -0,0 +1,2 @@
+export { base64url, base64urlToBytes, pkcs8PemToDer, timingSafeEqual } from '@cat-factory/server';
+//# sourceMappingURL=encoding.d.ts.map

package/dist/infrastructure/github/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/encoding.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/encoding.js

@@ -0,0 +1,3 @@
+// Moved to the shared @cat-factory/server package; re-exported for existing imports.
+export { base64url, base64urlToBytes, pkcs8PemToDer, timingSafeEqual } from '@cat-factory/server';
+//# sourceMappingURL=encoding.js.map

package/dist/infrastructure/github/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../../src/infrastructure/github/encoding.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/state.d.ts

@@ -0,0 +1,2 @@
+export { StateSigner, type InstallState } from '@cat-factory/server';
+//# sourceMappingURL=state.d.ts.map

package/dist/infrastructure/github/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/state.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/state.js

@@ -0,0 +1,3 @@
+// Moved to the shared @cat-factory/server package; re-exported for existing imports.
+export { StateSigner } from '@cat-factory/server';
+//# sourceMappingURL=state.js.map

package/dist/infrastructure/github/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../../src/infrastructure/github/state.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,WAAW,EAAqB,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/github/sync-consumer.d.ts

@@ -0,0 +1,16 @@
+import type { Clock } from '@cat-factory/kernel';
+import type { MessageBatch } from '@cloudflare/workers-types';
+import type { GitHubModule } from '@cat-factory/orchestration';
+import type { Env, GitHubSyncMessage } from '../env';
+/** Apply one queued message to the projections via the GitHub module. */
+export declare function applyGitHubSyncMessage(github: GitHubModule, message: GitHubSyncMessage): Promise<void>;
+/** Queue consumer for `cat-factory-github-sync`: ack on success, retry on error. */
+export declare function handleGitHubSyncBatch(batch: MessageBatch<GitHubSyncMessage>, env: Env): Promise<void>;
+/**
+ * Reconciliation pass for the cron sweeper: enqueue an incremental resync for
+ * every tracked repo whose projection has gone stale (webhooks can be missed).
+ * Returns the number of repos scheduled. Falls back to a direct sync when no
+ * queue is bound.
+ */
+export declare function reconcileStaleRepos(env: Env, clock: Clock, staleMs: number): Promise<number>;
+//# sourceMappingURL=sync-consumer.d.ts.map

package/dist/infrastructure/github/sync-consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-consumer.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/github/sync-consumer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAA;AAYpD,yEAAyE;AACzE,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,oFAAoF;AACpF,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,YAAY,CAAC,iBAAiB,CAAC,EACtC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAyDjB"}

package/dist/infrastructure/github/sync-consumer.js

@@ -0,0 +1,130 @@
+import { buildContainer } from '../container';
+import { loadConfig } from '../config';
+import { D1RepoProjectionRepository } from '../repositories/D1RepoProjectionRepository';
+import { D1GitHubInstallationRepository } from '../repositories/D1GitHubInstallationRepository';
+import { logger } from '../observability/logger';
+// The async side of the GitHub integration: applying queued webhook deliveries /
+// resync jobs to the projections, and the periodic reconciliation pass. Pure
+// orchestration over the GitHub module + its ports, so it is unit-testable with
+// fakes (mirroring the execution sweeper's style).
+/** Apply one queued message to the projections via the GitHub module. */
+export async function applyGitHubSyncMessage(github, message) {
+    if (message.kind === 'webhook') {
+        await github.webhookService.handle(message.eventName, message.payload);
+    }
+    else {
+        await github.syncService.syncRepoById(message.workspaceId, message.repoGithubId);
+    }
+}
+/** Queue consumer for `cat-factory-github-sync`: ack on success, retry on error. */
+export async function handleGitHubSyncBatch(batch, env) {
+    const github = buildContainer(env).github;
+    for (const message of batch.messages) {
+        if (!github) {
+            message.ack(); // GitHub not configured here; drop rather than retry forever.
+            continue;
+        }
+        try {
+            await applyGitHubSyncMessage(github, message.body);
+            message.ack();
+        }
+        catch {
+            message.retry();
+        }
+    }
+}
+/**
+ * Reconciliation pass for the cron sweeper: enqueue an incremental resync for
+ * every tracked repo whose projection has gone stale (webhooks can be missed).
+ * Returns the number of repos scheduled. Falls back to a direct sync when no
+ * queue is bound.
+ */
+export async function reconcileStaleRepos(env, clock, staleMs) {
+    if (!loadConfig(env).github.enabled)
+        return 0;
+    const repoRepo = new D1RepoProjectionRepository({ db: env.DB });
+    const installationRepo = new D1GitHubInstallationRepository({ db: env.DB });
+    // `listStale` already excludes repos whose installation is tombstoned, so a dead
+    // installation stops being swept once it is known-gone; the handling below tombstones
+    // one the webhook never told us about (a missed uninstall), so it stops next pass.
+    const stale = await repoRepo.listStale(clock.now() - staleMs);
+    let scheduled = 0;
+    for (const repo of stale) {
+        try {
+            if (env.GITHUB_SYNC_QUEUE) {
+                await env.GITHUB_SYNC_QUEUE.send({
+                    kind: 'resync-repo',
+                    workspaceId: repo.workspaceId,
+                    repoGithubId: repo.githubId,
+                });
+            }
+            else {
+                const github = buildContainer(env).github;
+                if (github)
+                    await github.syncService.syncRepoById(repo.workspaceId, repo.githubId);
+            }
+            scheduled += 1;
+        }
+        catch (error) {
+            // Best-effort pass (webhooks are the primary path): one repo failing must not
+            // abort the rest or spam the error log every cron tick. A gone/forbidden GitHub
+            // App installation (uninstalled or revoked → 401/404 when minting its token) is
+            // an expected operational state for a stale projection, so log it at warn; any
+            // other fault is a real error. Either way, continue with the next repo.
+            const gone = isInstallationGoneError(error);
+            // A token-mint 404/410 means the installation itself is gone — uninstalled or
+            // revoked without us receiving the webhook (the cron's most common stuck state).
+            // Tombstone it so this and every future pass skip ALL its repos until it is
+            // reinstalled (the `unsuspend`/reinstall webhook clears the tombstone). Scoped to
+            // the mint error (not a repo-level 404, which means a single deleted repo) and to
+            // 404/410 (never 401, which can be a transient app-JWT fault hitting everything).
+            if (isInstallationTokenGoneError(error)) {
+                try {
+                    await installationRepo.softDelete(repo.installationId, clock.now());
+                }
+                catch {
+                    // Best-effort: a failed tombstone just means we retry (and warn) next pass.
+                }
+            }
+            logger[gone ? 'warn' : 'error']({
+                cron: 'github-reconcile',
+                workspaceId: repo.workspaceId,
+                repoGithubId: repo.githubId,
+                installationId: repo.installationId,
+                err: errInfo(error),
+            }, gone
+                ? 'skipping stale repo whose GitHub App installation is gone (uninstalled/revoked); reinstall the app to re-enable it'
+                : 'repo resync failed');
+        }
+    }
+    return scheduled;
+}
+/** Minimal error → log payload (mirrors the worker entry's `errInfo`). */
+function errInfo(error) {
+    if (error instanceof Error) {
+        return { message: error.message, ...(error.stack ? { stack: error.stack } : {}) };
+    }
+    return { message: String(error) };
+}
+/**
+ * Whether a sync error is a *gone/forbidden GitHub App installation* rather than a
+ * transient fault: minting an installation token for an uninstalled or revoked
+ * installation returns 401/404 (and a deleted repo 404/410). These are not worth
+ * an error-level log or a retry storm — the connection needs human action.
+ */
+function isInstallationGoneError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /\(HTTP (401|404|410)\)/.test(message);
+}
+/**
+ * Whether the error is specifically a *token mint* returning 404/410 — i.e. the
+ * installation itself is gone (uninstalled/revoked), not merely a single repo
+ * being inaccessible. Matches {@link GitHubAppAuth.mintInstallationToken}'s
+ * message. Excludes 401 (a transient app-JWT/clock fault would mint-fail for every
+ * installation, and must not tombstone a healthy connection).
+ */
+function isInstallationTokenGoneError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /Failed to mint installation token .*\(HTTP (404|410)\)/i.test(message);
+}
+//# sourceMappingURL=sync-consumer.js.map

package/dist/infrastructure/github/sync-consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-consumer.js","sourceRoot":"","sources":["../../../src/infrastructure/github/sync-consumer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAA;AACvF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAA;AAC/F,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAEhD,iFAAiF;AACjF,6EAA6E;AAC7E,gFAAgF;AAChF,mDAAmD;AAEnD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoB,EACpB,OAA0B;IAE1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IACxE,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IAClF,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAsC,EACtC,GAAQ;IAER,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IACzC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,EAAE,CAAA,CAAC,8DAA8D;YAC5E,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,MAAM,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YAClD,OAAO,CAAC,GAAG,EAAE,CAAA;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAQ,EACR,KAAY,EACZ,OAAe;IAEf,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,IAAI,0BAA0B,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/D,MAAM,gBAAgB,GAAG,IAAI,8BAA8B,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3E,iFAAiF;IACjF,sFAAsF;IACtF,mFAAmF;IACnF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAA;IAC7D,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC1B,MAAM,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC;oBAC/B,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,YAAY,EAAE,IAAI,CAAC,QAAQ;iBAC5B,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;gBACzC,IAAI,MAAM;oBAAE,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpF,CAAC;YACD,SAAS,IAAI,CAAC,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8EAA8E;YAC9E,gFAAgF;YAChF,gFAAgF;YAChF,+EAA+E;YAC/E,wEAAwE;YACxE,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;YAC3C,8EAA8E;YAC9E,iFAAiF;YACjF,4EAA4E;YAC5E,kFAAkF;YAClF,kFAAkF;YAClF,kFAAkF;YAClF,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC;oBACH,MAAM,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;gBACrE,CAAC;gBAAC,MAAM,CAAC;oBACP,4EAA4E;gBAC9E,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAC7B;gBACE,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;aACpB,EACD,IAAI;gBACF,CAAC,CAAC,oHAAoH;gBACtH,CAAC,CAAC,oBAAoB,CACzB,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,0EAA0E;AAC1E,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACnF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AACnC,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,4BAA4B,CAAC,KAAc;IAClD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,OAAO,yDAAyD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAChF,CAAC"}

package/dist/infrastructure/http/errorHandler.d.ts

@@ -0,0 +1,2 @@
+export { handleError } from '@cat-factory/server';
+//# sourceMappingURL=errorHandler.d.ts.map

package/dist/infrastructure/http/errorHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/http/errorHandler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/http/errorHandler.js

@@ -0,0 +1,3 @@
+// Moved to the shared @cat-factory/server package; re-exported for existing imports.
+export { handleError } from '@cat-factory/server';
+//# sourceMappingURL=errorHandler.js.map

package/dist/infrastructure/http/errorHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.js","sourceRoot":"","sources":["../../../src/infrastructure/http/errorHandler.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/http/params.d.ts

@@ -0,0 +1,2 @@
+export { param } from '@cat-factory/server';
+//# sourceMappingURL=params.d.ts.map

package/dist/infrastructure/http/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/http/params.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/http/params.js

@@ -0,0 +1,3 @@
+// Moved to the shared @cat-factory/server package; re-exported for existing imports.
+export { param } from '@cat-factory/server';
+//# sourceMappingURL=params.js.map

package/dist/infrastructure/http/params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.js","sourceRoot":"","sources":["../../../src/infrastructure/http/params.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/http/types.d.ts

@@ -0,0 +1,12 @@
+import type { AppEnv as ServerAppEnv } from '@cat-factory/server';
+import type { Env } from '../env';
+/**
+ * Hono generics for the Worker: the shared request Variables (`container`, `user`)
+ * from @cat-factory/server, plus the Cloudflare `Env` bindings that the Worker's own
+ * runtime controllers (events/webhooks/llm-proxy) read off `c.env`.
+ */
+export type AppEnv = {
+    Bindings: Env;
+    Variables: ServerAppEnv['Variables'];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/infrastructure/http/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/http/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,EAAE,GAAG,CAAA;IACb,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC,CAAA;CACrC,CAAA"}

package/dist/infrastructure/http/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/infrastructure/http/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/infrastructure/http/types.ts"],"names":[],"mappings":""}

package/dist/infrastructure/http/validation.d.ts

@@ -0,0 +1,2 @@
+export { jsonBody } from '@cat-factory/server';
+//# sourceMappingURL=validation.d.ts.map

package/dist/infrastructure/http/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/http/validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/http/validation.js

@@ -0,0 +1,3 @@
+// Moved to the shared @cat-factory/server package; re-exported for existing imports.
+export { jsonBody } from '@cat-factory/server';
+//# sourceMappingURL=validation.js.map

package/dist/infrastructure/http/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/infrastructure/http/validation.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/observability/logger.d.ts

@@ -0,0 +1,3 @@
+export { logger } from '@cat-factory/server';
+export type { Logger } from '@cat-factory/server';
+//# sourceMappingURL=logger.d.ts.map

package/dist/infrastructure/observability/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/observability/logger.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,YAAY,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/observability/logger.js

@@ -0,0 +1,4 @@
+// Moved to the shared, runtime-neutral @cat-factory/server package. Re-exported
+// here so existing `../observability/logger` imports keep resolving.
+export { logger } from '@cat-factory/server';
+//# sourceMappingURL=logger.js.map

package/dist/infrastructure/observability/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../src/infrastructure/observability/logger.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/repositories/D1AccountInvitationRepository.d.ts

@@ -0,0 +1,15 @@
+import type { AccountInvitationRecord, AccountInvitationRepository, InvitationStatus } from '@cat-factory/kernel';
+import type { D1Database } from '@cloudflare/workers-types';
+/** D1-backed store of account invitations (email-based org onboarding). */
+export declare class D1AccountInvitationRepository implements AccountInvitationRepository {
+    private readonly db;
+    constructor({ db }: {
+        db: D1Database;
+    });
+    create(record: AccountInvitationRecord): Promise<void>;
+    get(id: string): Promise<AccountInvitationRecord | null>;
+    findByTokenHash(tokenHash: string): Promise<AccountInvitationRecord | null>;
+    listByAccount(accountId: string): Promise<AccountInvitationRecord[]>;
+    setStatus(id: string, status: InvitationStatus): Promise<void>;
+}
+//# sourceMappingURL=D1AccountInvitationRepository.d.ts.map

package/dist/infrastructure/repositories/D1AccountInvitationRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"D1AccountInvitationRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1AccountInvitationRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAE3B,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAoC3D,2EAA2E;AAC3E,qBAAa,6BAA8B,YAAW,2BAA2B;IAC/E,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB3D;IAEK,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAM7D;IAEK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAMhF;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAMzE;IAEK,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnE;CACF"}

package/dist/infrastructure/repositories/D1AccountInvitationRepository.js

@@ -0,0 +1,63 @@
+function parseRoles(csv) {
+    const roles = (csv ?? '')
+        .split(',')
+        .map((r) => r.trim())
+        .filter((r) => r === 'admin' || r === 'developer' || r === 'product');
+    return roles.length > 0 ? [...new Set(roles)] : ['developer'];
+}
+function rowToInvitation(row) {
+    return {
+        id: row.id,
+        accountId: row.account_id,
+        email: row.email,
+        roles: parseRoles(row.roles),
+        tokenHash: row.token_hash,
+        invitedBy: row.invited_by,
+        status: row.status,
+        expiresAt: row.expires_at,
+        createdAt: row.created_at,
+    };
+}
+/** D1-backed store of account invitations (email-based org onboarding). */
+export class D1AccountInvitationRepository {
+    db;
+    constructor({ db }) {
+        this.db = db;
+    }
+    async create(record) {
+        await this.db
+            .prepare(`INSERT INTO account_invitations
+           (id, account_id, email, roles, token_hash, invited_by, status, expires_at, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .bind(record.id, record.accountId, record.email, record.roles.join(','), record.tokenHash, record.invitedBy, record.status, record.expiresAt, record.createdAt)
+            .run();
+    }
+    async get(id) {
+        const row = await this.db
+            .prepare('SELECT * FROM account_invitations WHERE id = ?')
+            .bind(id)
+            .first();
+        return row ? rowToInvitation(row) : null;
+    }
+    async findByTokenHash(tokenHash) {
+        const row = await this.db
+            .prepare('SELECT * FROM account_invitations WHERE token_hash = ?')
+            .bind(tokenHash)
+            .first();
+        return row ? rowToInvitation(row) : null;
+    }
+    async listByAccount(accountId) {
+        const { results } = await this.db
+            .prepare('SELECT * FROM account_invitations WHERE account_id = ? ORDER BY created_at DESC')
+            .bind(accountId)
+            .all();
+        return results.map(rowToInvitation);
+    }
+    async setStatus(id, status) {
+        await this.db
+            .prepare('UPDATE account_invitations SET status = ? WHERE id = ?')
+            .bind(status, id)
+            .run();
+    }
+}
+//# sourceMappingURL=D1AccountInvitationRepository.js.map

package/dist/infrastructure/repositories/D1AccountInvitationRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"D1AccountInvitationRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1AccountInvitationRepository.ts"],"names":[],"mappings":"AAoBA,SAAS,UAAU,CAAC,GAAkB;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,SAAS,CAAC,CAAA;IACzF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,GAAkB;IACzC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,MAA0B;QACtC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,6BAA6B;IACvB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA+B;QAC1C,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN;;4CAEoC,CACrC;aACA,IAAI,CACH,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EACtB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,CACjB;aACA,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,gDAAgD,CAAC;aACzD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAiB,CAAA;QACzB,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,wDAAwD,CAAC;aACjE,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,EAAiB,CAAA;QACzB,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,iFAAiF,CAAC;aAC1F,IAAI,CAAC,SAAS,CAAC;aACf,GAAG,EAAiB,CAAA;QACvB,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAwB;QAClD,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,wDAAwD,CAAC;aACjE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;aAChB,GAAG,EAAE,CAAA;IACV,CAAC;CACF"}

package/dist/infrastructure/repositories/D1AccountRepository.d.ts

@@ -0,0 +1,15 @@
+import type { AccountRecord, AccountRepository, AccountSettingsPatch } from '@cat-factory/kernel';
+import type { D1Database } from '@cloudflare/workers-types';
+/** D1-backed store of accounts (the tenants that own workspaces; migration 0017). */
+export declare class D1AccountRepository implements AccountRepository {
+    private readonly db;
+    constructor({ db }: {
+        db: D1Database;
+    });
+    get(id: string): Promise<AccountRecord | null>;
+    create(account: AccountRecord): Promise<void>;
+    rename(id: string, name: string): Promise<void>;
+    updateSettings(id: string, patch: AccountSettingsPatch): Promise<void>;
+    findPersonalByUser(userId: string): Promise<AccountRecord | null>;
+}
+//# sourceMappingURL=D1AccountRepository.d.ts.map