@cat-factory/worker 0.86.0 → 0.86.1

package/dist/infrastructure/repositories/D1WorkspaceMemberRepository.d.ts

@@ -0,0 +1,17 @@
+import type { WorkspaceMemberRecord, WorkspaceMemberRepository, WorkspaceRole } from '@cat-factory/kernel';
+import type { D1Database } from '@cloudflare/workers-types';
+/** D1-backed store of workspace memberships (workspace RBAC; migration 0052). */
+export declare class D1WorkspaceMemberRepository implements WorkspaceMemberRepository {
+    private readonly db;
+    constructor({ db }: {
+        db: D1Database;
+    });
+    get(workspaceId: string, userId: string): Promise<WorkspaceMemberRecord | null>;
+    listByWorkspace(workspaceId: string): Promise<WorkspaceMemberRecord[]>;
+    listWorkspaceIdsForUser(userId: string): Promise<string[]>;
+    getRolesForUserInWorkspaces(userId: string, workspaceIds: string[]): Promise<Map<string, WorkspaceRole>>;
+    upsert(member: WorkspaceMemberRecord): Promise<void>;
+    remove(workspaceId: string, userId: string): Promise<void>;
+    removeByAccountMembership(accountId: string, userId: string): Promise<number>;
+}
+//# sourceMappingURL=D1WorkspaceMemberRepository.d.ts.map

package/dist/infrastructure/repositories/D1WorkspaceMemberRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"D1WorkspaceMemberRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1WorkspaceMemberRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,aAAa,EACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AA0B3D,iFAAiF;AACjF,qBAAa,2BAA4B,YAAW,yBAAyB;IAC3E,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAMpF;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAM3E;IAEK,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAM/D;IAEK,2BAA2B,CAC/B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAkBrC;IAEK,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CASzD;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/D;IAEK,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYlF;CACF"}

package/dist/infrastructure/repositories/D1WorkspaceMemberRepository.js

@@ -0,0 +1,87 @@
+import { chunkForIn } from './chunk';
+/** Coerce a stored role string to a valid {@link WorkspaceRole}, defaulting to viewer. */
+function parseRole(role) {
+    return role === 'admin' || role === 'member' || role === 'viewer' ? role : 'viewer';
+}
+function rowToMember(row) {
+    return {
+        workspaceId: row.workspace_id,
+        userId: row.user_id,
+        role: parseRole(row.role),
+        createdAt: row.created_at,
+        addedByUserId: row.added_by_user_id,
+    };
+}
+/** D1-backed store of workspace memberships (workspace RBAC; migration 0052). */
+export class D1WorkspaceMemberRepository {
+    db;
+    constructor({ db }) {
+        this.db = db;
+    }
+    async get(workspaceId, userId) {
+        const row = await this.db
+            .prepare('SELECT * FROM workspace_members WHERE workspace_id = ? AND user_id = ?')
+            .bind(workspaceId, userId)
+            .first();
+        return row ? rowToMember(row) : null;
+    }
+    async listByWorkspace(workspaceId) {
+        const { results } = await this.db
+            .prepare('SELECT * FROM workspace_members WHERE workspace_id = ? ORDER BY created_at ASC')
+            .bind(workspaceId)
+            .all();
+        return results.map(rowToMember);
+    }
+    async listWorkspaceIdsForUser(userId) {
+        const { results } = await this.db
+            .prepare('SELECT workspace_id FROM workspace_members WHERE user_id = ?')
+            .bind(userId)
+            .all();
+        return results.map((r) => r.workspace_id);
+    }
+    async getRolesForUserInWorkspaces(userId, workspaceIds) {
+        const out = new Map();
+        if (workspaceIds.length === 0)
+            return out;
+        // ONE chunked-IN read per chunk (never a per-board point-read loop). Chunk via the
+        // shared helper so each statement stays under D1's 100 bound-parameter ceiling — the
+        // leading `user_id = ?` is the reason the helper leaves headroom below 100.
+        for (const chunk of chunkForIn(workspaceIds)) {
+            const placeholders = chunk.map(() => '?').join(', ');
+            const { results } = await this.db
+                .prepare(`SELECT workspace_id, role FROM workspace_members
+             WHERE user_id = ? AND workspace_id IN (${placeholders})`)
+                .bind(userId, ...chunk)
+                .all();
+            for (const r of results)
+                out.set(r.workspace_id, parseRole(r.role));
+        }
+        return out;
+    }
+    async upsert(member) {
+        await this.db
+            .prepare(`INSERT INTO workspace_members (workspace_id, user_id, role, created_at, added_by_user_id)
+           VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT (workspace_id, user_id) DO UPDATE SET role = excluded.role`)
+            .bind(member.workspaceId, member.userId, member.role, member.createdAt, member.addedByUserId)
+            .run();
+    }
+    async remove(workspaceId, userId) {
+        await this.db
+            .prepare('DELETE FROM workspace_members WHERE workspace_id = ? AND user_id = ?')
+            .bind(workspaceId, userId)
+            .run();
+    }
+    async removeByAccountMembership(accountId, userId) {
+        // One DELETE joined on the owning account — drop every membership this user holds in
+        // boards of `accountId`. D1 has no `DELETE ... USING`, so scope by subquery.
+        const result = await this.db
+            .prepare(`DELETE FROM workspace_members
+           WHERE user_id = ?
+             AND workspace_id IN (SELECT id FROM workspaces WHERE account_id = ?)`)
+            .bind(userId, accountId)
+            .run();
+        return result.meta.changes ?? 0;
+    }
+}
+//# sourceMappingURL=D1WorkspaceMemberRepository.js.map

package/dist/infrastructure/repositories/D1WorkspaceMemberRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"D1WorkspaceMemberRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1WorkspaceMemberRepository.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAUpC,0FAA0F;AAC1F,SAAS,SAAS,CAAC,IAAmB;IACpC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAA;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,GAAuB;IAC1C,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,aAAa,EAAE,GAAG,CAAC,gBAAgB;KACpC,CAAA;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,OAAO,2BAA2B;IACrB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,MAAc;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,wEAAwE,CAAC;aACjF,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;aACzB,KAAK,EAAsB,CAAA;QAC9B,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,gFAAgF,CAAC;aACzF,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAAsB,CAAA;QAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACjC,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,MAAc;QAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CAAC,8DAA8D,CAAC;aACvE,IAAI,CAAC,MAAM,CAAC;aACZ,GAAG,EAA4B,CAAA;QAClC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,MAAc,EACd,YAAsB;QAEtB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAA;QAC5C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAA;QACzC,mFAAmF;QACnF,qFAAqF;QACrF,4EAA4E;QAC5E,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CACN;sDAC4C,YAAY,GAAG,CAC5D;iBACA,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC;iBACtB,GAAG,EAAiD,CAAA;YACvD,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QACrE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA6B;QACxC,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN;;gFAEwE,CACzE;aACA,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC;aAC5F,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,MAAc;QAC9C,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,sEAAsE,CAAC;aAC/E,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;aACzB,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,SAAiB,EAAE,MAAc;QAC/D,qFAAqF;QACrF,6EAA6E;QAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,OAAO,CACN;;kFAE0E,CAC3E;aACA,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;aACvB,GAAG,EAAE,CAAA;QACR,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;IACjC,CAAC;CACF"}

package/dist/infrastructure/repositories/D1WorkspaceRepository.d.ts

@@ -1,5 +1,5 @@
-import type { ServiceRehome, WorkspaceRepository, WorkspaceVisibility } from '@cat-factory/kernel';
-import type { Workspace } from '@cat-factory/contracts';
+import type { ServiceRehome, WorkspaceAccessRow, WorkspaceRepository, WorkspaceVisibility } from '@cat-factory/kernel';
+import type { Workspace, WorkspaceAccessMode } from '@cat-factory/contracts';
 import type { D1Database } from '@cloudflare/workers-types';
 export declare const D1_ONLY_WORKSPACE_SCOPED_TABLES: readonly ['live_containers'];
 export declare class D1WorkspaceRepository implements WorkspaceRepository {
@@ -11,6 +11,8 @@ export declare class D1WorkspaceRepository implements WorkspaceRepository {
     get(id: string): Promise<Workspace | null>;
     ownerOf(id: string): Promise<string | null | undefined>;
     accountOf(id: string): Promise<string | null | undefined>;
+    accessRowOf(id: string): Promise<WorkspaceAccessRow | undefined>;
+    setAccessMode(id: string, mode: WorkspaceAccessMode): Promise<void>;
     create(workspace: Workspace, ownerUserId: string | null, accountId: string | null): Promise<void>;
     rename(id: string, name: string): Promise<void>;
     setDescription(id: string, description: string | null): Promise<void>;

package/dist/infrastructure/repositories/D1WorkspaceRepository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"D1WorkspaceRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1WorkspaceRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAElG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAS3D,eAAO,MAAM,+BAA+B,YAAI,iBAAiB,CAAU,CAAA;AAE3E,qBAAa,qBAAsB,YAAW,mBAAmB;IAC/D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,WAAW,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAsBlE;IAEK,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM/C;IAEK,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAO5D;IAEK,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAO9D;IAEK,MAAM,CACV,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAAC,IAAI,CAAC,CAcf;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAEK,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1E;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,GAAE,aAAa,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDpE;CACF"}
+{"version":3,"file":"D1WorkspaceRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1WorkspaceRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAS3D,eAAO,MAAM,+BAA+B,YAAI,iBAAiB,CAAU,CAAA;AAE3E,qBAAa,qBAAsB,YAAW,mBAAmB;IAC/D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,WAAW,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAsBlE;IAEK,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM/C;IAEK,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAO5D;IAEK,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAO9D;IAEK,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAerE;IAEK,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAExE;IAEK,MAAM,CACV,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAAC,IAAI,CAAC,CAcf;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAEK,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1E;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,GAAE,aAAa,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDpE;CACF"}

package/dist/infrastructure/repositories/D1WorkspaceRepository.js

@@ -56,6 +56,22 @@ export class D1WorkspaceRepository {
         // Row absent → undefined (missing); present → the (possibly null) account id.
         return row ? row.account_id : undefined;
     }
+    async accessRowOf(id) {
+        const row = await this.db
+            .prepare('SELECT account_id, owner_user_id, access_mode FROM workspaces WHERE id = ?')
+            .bind(id)
+            .first();
+        if (!row)
+            return undefined;
+        return {
+            accountId: row.account_id,
+            ownerUserId: row.owner_user_id,
+            accessMode: row.access_mode === 'restricted' ? 'restricted' : 'account',
+        };
+    }
+    async setAccessMode(id, mode) {
+        await this.db.prepare('UPDATE workspaces SET access_mode = ? WHERE id = ?').bind(mode, id).run();
+    }
     async create(workspace, ownerUserId, accountId) {
         await this.db
             .prepare('INSERT INTO workspaces (id, name, description, created_at, owner_user_id, account_id) VALUES (?, ?, ?, ?, ?, ?)')

package/dist/infrastructure/repositories/D1WorkspaceRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"D1WorkspaceRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1WorkspaceRepository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAqB,cAAc,EAAE,MAAM,WAAW,CAAA;AAE7D,6FAA6F;AAC7F,yFAAyF;AACzF,uFAAuF;AACvF,8FAA8F;AAC9F,2FAA2F;AAC3F,yFAAyF;AACzF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,iBAAiB,CAAU,CAAA;AAE3E,MAAM,OAAO,qBAAqB;IACf,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA0B;QAC1C,4EAA4E;QAC5E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CAAC,mDAAmD,CAAC;iBAC5D,GAAG,EAAgB,CAAA;YACtB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACpC,CAAC;QACD,8EAA8E;QAC9E,qEAAqE;QACrE,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;QAC3F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;kBACU,aAAa;;mCAEI,CAC5B;aACA,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC;aAC5C,GAAG,EAAgB,CAAA;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,uCAAuC,CAAC;aAChD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAgB,CAAA;QACxB,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,mDAAmD,CAAC;aAC5D,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAoC,CAAA;QAC5C,4EAA4E;QAC5E,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,gDAAgD,CAAC;aACzD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAiC,CAAA;QACzC,8EAA8E;QAC9E,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,SAAoB,EACpB,WAA0B,EAC1B,SAAwB;QAExB,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN,iHAAiH,CAClH;aACA,IAAI,CACH,SAAS,CAAC,EAAE,EACZ,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,WAAW,IAAI,IAAI,EAC7B,SAAS,CAAC,SAAS,EACnB,WAAW,EACX,SAAS,CACV;aACA,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAY;QACnC,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;IAC3F,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU,EAAE,WAA0B;QACzD,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,oDAAoD,CAAC;aAC7D,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAM,GAAoB,EAAE;QACnD,0FAA0F;QAC1F,wFAAwF;QACxF,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,2FAA2F;QAC3F,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,yEAAyE;QACzE,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;YACxE,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;0DACgD,CACjD;iBACA,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;YACjC,IAAI,CAAC,EAAE;iBACJ,OAAO,CAAC,yDAAyD,CAAC;iBAClE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;SAClC,CAAC,CAAA;QACF,wFAAwF;QACxF,2FAA2F;QAC3F,gGAAgG;QAChG,6FAA6F;QAC7F,wFAAwF;QACxF,MAAM,WAAW,GAAG,CAAC,GAAG,uBAAuB,EAAE,GAAG,+BAA+B,CAAC,CAAC,GAAG,CACtF,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,eAAe,KAAK,yBAAyB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CACnF,CAAA;QACD,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;YAClB,GAAG,gBAAgB;YACnB,sFAAsF;YACtF,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;+DAEqD,CACtD;iBACA,IAAI,CAAC,EAAE,CAAC;YACX,wFAAwF;YACxF,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,4FAA4F;YAC5F,oFAAoF;YACpF,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN,6FAA6F,CAC9F;iBACA,IAAI,CAAC,EAAE,CAAC;YACX,yFAAyF;YACzF,sFAAsF;YACtF,GAAG,WAAW;YACd,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"D1WorkspaceRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1WorkspaceRepository.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAqB,cAAc,EAAE,MAAM,WAAW,CAAA;AAE7D,6FAA6F;AAC7F,yFAAyF;AACzF,uFAAuF;AACvF,8FAA8F;AAC9F,2FAA2F;AAC3F,yFAAyF;AACzF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,iBAAiB,CAAU,CAAA;AAE3E,MAAM,OAAO,qBAAqB;IACf,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA0B;QAC1C,4EAA4E;QAC5E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC9B,OAAO,CAAC,mDAAmD,CAAC;iBAC5D,GAAG,EAAgB,CAAA;YACtB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACpC,CAAC;QACD,8EAA8E;QAC9E,qEAAqE;QACrE,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;QAC3F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN;kBACU,aAAa;;mCAEI,CAC5B;aACA,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC;aAC5C,GAAG,EAAgB,CAAA;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,uCAAuC,CAAC;aAChD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAgB,CAAA;QACxB,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,mDAAmD,CAAC;aAC5D,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAoC,CAAA;QAC5C,4EAA4E;QAC5E,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,gDAAgD,CAAC;aACzD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAiC,CAAA;QACzC,8EAA8E;QAC9E,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,4EAA4E,CAAC;aACrF,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAIF,CAAA;QACN,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAA;QAC1B,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,WAAW,EAAE,GAAG,CAAC,aAAa;YAC9B,UAAU,EAAE,GAAG,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SACxE,CAAA;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,IAAyB;QACvD,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;IAClG,CAAC;IAED,KAAK,CAAC,MAAM,CACV,SAAoB,EACpB,WAA0B,EAC1B,SAAwB;QAExB,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN,iHAAiH,CAClH;aACA,IAAI,CACH,SAAS,CAAC,EAAE,EACZ,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,WAAW,IAAI,IAAI,EAC7B,SAAS,CAAC,SAAS,EACnB,WAAW,EACX,SAAS,CACV;aACA,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAY;QACnC,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;IAC3F,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU,EAAE,WAA0B;QACzD,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,oDAAoD,CAAC;aAC7D,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAM,GAAoB,EAAE;QACnD,0FAA0F;QAC1F,wFAAwF;QACxF,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,2FAA2F;QAC3F,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,yEAAyE;QACzE,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;YACxE,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;0DACgD,CACjD;iBACA,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;YACjC,IAAI,CAAC,EAAE;iBACJ,OAAO,CAAC,yDAAyD,CAAC;iBAClE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;SAClC,CAAC,CAAA;QACF,wFAAwF;QACxF,2FAA2F;QAC3F,gGAAgG;QAChG,6FAA6F;QAC7F,wFAAwF;QACxF,MAAM,WAAW,GAAG,CAAC,GAAG,uBAAuB,EAAE,GAAG,+BAA+B,CAAC,CAAC,GAAG,CACtF,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,eAAe,KAAK,yBAAyB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CACnF,CAAA;QACD,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;YAClB,GAAG,gBAAgB;YACnB,sFAAsF;YACtF,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;+DAEqD,CACtD;iBACA,IAAI,CAAC,EAAE,CAAC;YACX,wFAAwF;YACxF,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,4FAA4F;YAC5F,oFAAoF;YACpF,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN,6FAA6F,CAC9F;iBACA,IAAI,CAAC,EAAE,CAAC;YACX,yFAAyF;YACzF,sFAAsF;YACtF,GAAG,WAAW;YACd,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;IACJ,CAAC;CACF"}

package/migrations/0052_workspace_rbac.sql

@@ -0,0 +1,22 @@
+-- Workspace-level RBAC & membership (see docs/initiatives/workspace-rbac.md). The tier BELOW
+-- account tenancy: an account admin can restrict a board to an explicit member roster with
+-- per-member workspace roles. Mirrors the Node/Drizzle `workspace_members` table + the
+-- `workspaces.access_mode` column (migration 20260716150654_fast_dracula) — keep the runtimes
+-- symmetric. D1 does not enforce foreign keys, so the workspace-delete cascade
+-- (WORKSPACE_SCOPED_TABLES lists `workspace_members`) is what reclaims a deleted board's roster.
+
+-- Access mode: 'account' (default — every account member sees the board, the legacy behaviour)
+-- or 'restricted' (only the explicit member roster). The default means zero change to existing rows.
+ALTER TABLE workspaces ADD COLUMN access_mode TEXT NOT NULL DEFAULT 'account';
+
+CREATE TABLE workspace_members (
+  workspace_id     TEXT    NOT NULL,   -- the board this membership scopes
+  user_id          TEXT    NOT NULL,   -- the internal users(id)
+  role             TEXT    NOT NULL,   -- single value: admin | member | viewer (strict hierarchy)
+  created_at       INTEGER NOT NULL,
+  added_by_user_id TEXT,               -- audit: who granted; null for system grants (creator auto-enroll)
+  PRIMARY KEY (workspace_id, user_id)
+);
+
+-- Drives listWorkspaceIdsForUser + the workspace-list visibility subquery.
+CREATE INDEX idx_workspace_members_user ON workspace_members (user_id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/worker",
-  "version": "0.86.0",
+  "version": "0.86.1",
   "description": "Reusable Cloudflare Worker library (Hono + D1) exposing the Agent Architecture Board core: the `createApp()` Hono factory, the default fetch/scheduled/queue handler, and the Durable Object + Workflow classes. Deployments (see deploy/backend) supply the wrangler.toml + config and re-export these.",
   "repository": {
     "type": "git",
@@ -42,22 +42,22 @@
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
     "workers-ai-provider": "^3.3.1",
-    "@cat-factory/agents": "0.61.0",
-    "@cat-factory/caching": "0.9.0",
-    "@cat-factory/contracts": "0.137.0",
-    "@cat-factory/eks": "0.1.85",
-    "@cat-factory/consensus": "0.10.58",
-    "@cat-factory/gates": "0.5.42",
-    "@cat-factory/gitlab": "0.10.4",
-    "@cat-factory/integrations": "0.84.7",
-    "@cat-factory/kernel": "0.131.0",
-    "@cat-factory/observability-langfuse": "0.7.212",
-    "@cat-factory/orchestration": "0.115.0",
-    "@cat-factory/observability-otel": "0.1.6",
-    "@cat-factory/prompt-fragments": "0.13.26",
-    "@cat-factory/provider-cloudflare": "0.7.229",
-    "@cat-factory/server": "0.127.0",
-    "@cat-factory/spend": "0.12.38"
+    "@cat-factory/agents": "0.61.1",
+    "@cat-factory/caching": "0.9.1",
+    "@cat-factory/consensus": "0.10.59",
+    "@cat-factory/contracts": "0.138.0",
+    "@cat-factory/eks": "0.1.86",
+    "@cat-factory/gates": "0.5.43",
+    "@cat-factory/gitlab": "0.10.5",
+    "@cat-factory/integrations": "0.84.8",
+    "@cat-factory/kernel": "0.132.0",
+    "@cat-factory/observability-langfuse": "0.7.213",
+    "@cat-factory/observability-otel": "0.1.7",
+    "@cat-factory/orchestration": "0.115.1",
+    "@cat-factory/prompt-fragments": "0.13.27",
+    "@cat-factory/provider-cloudflare": "0.7.230",
+    "@cat-factory/server": "0.127.1",
+    "@cat-factory/spend": "0.12.39"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.18.0",
@@ -65,7 +65,7 @@
     "typescript": "7.0.2",
     "vitest": "^4.1.10",
     "wrangler": "^4.110.0",
-    "@cat-factory/conformance": "0.11.1"
+    "@cat-factory/conformance": "0.11.2"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",