@devchitchat/chat 0.0.0

package/pages/public/themes/dark.css

@@ -0,0 +1,22 @@
+/* dark theme — default */
+:root, [data-theme="dark"] {
+  --bg-base:    #1a1b1e;
+  --bg-topbar:  #141517;
+  --bg-sidebar: #1e1f22;
+  --bg-hover:   rgba(255,255,255,0.06);
+  --bg-active:  rgba(88,166,255,0.12);
+  --bg-input:   #2b2d31;
+  --bg-call:    #1e1f22;
+
+  --text-primary:   #e3e5e8;
+  --text-secondary: #585c60;
+  --text-muted:     #6d6f78;
+
+  --border:  #2e3035;
+  --accent:  #58a6ff;
+
+  --color-success: #3ba55c;
+  --color-danger:  #ed4245;
+
+  --code-background: rgba(255,255,255,.1);
+}

package/pages/public/themes/forest.css

@@ -0,0 +1,22 @@
+/* forest theme — earthy greens */
+:root, [data-theme="forest"] {
+  --bg-base:    #141f14;
+  --bg-topbar:  #0e160e;
+  --bg-sidebar: #192419;
+  --bg-hover:   rgba(80,180,80,0.08);
+  --bg-active:  rgba(80,180,80,0.16);
+  --bg-input:   #1f2e1f;
+  --bg-call:    #192419;
+
+  --text-primary:   #d6e8d0;
+  --text-secondary: #3f533d;
+  --text-muted:     #4a6645;
+
+  --border:  #243524;
+  --accent:  #60c060;
+
+  --color-success: #4aad5a;
+  --color-danger:  #d05a3a;
+  --code-background: rgba(255,255,255,.1);
+
+}

package/pages/public/themes/light.css

@@ -0,0 +1,23 @@
+/* light theme */
+:root, [data-theme="light"] {
+  --bg-base:    #f9fafb;
+  --bg-topbar:  #ffffff;
+  --bg-sidebar: #f2f3f5;
+  --bg-hover:   rgba(0,0,0,0.05);
+  --bg-active:  rgba(0,100,220,0.1);
+  --bg-input:   #ffffff;
+  --bg-call:    #f2f3f5;
+
+  --text-primary:   #060607;
+  --text-secondary: #a2a7bb;
+  --text-muted:     #80848e;
+
+  --border:  #e3e5e8;
+  --accent:  #0068d6;
+
+  --color-success: #248046;
+  --color-danger:  #da373c;
+
+  --code-background: rgba(0,0,0,.1);
+
+}

package/pages/public/themes/ocean.css

@@ -0,0 +1,22 @@
+/* ocean theme — deep teal */
+:root, [data-theme="ocean"] {
+  --bg-base:    #0d1b2a;
+  --bg-topbar:  #091320;
+  --bg-sidebar: #0f2137;
+  --bg-hover:   rgba(0,200,200,0.08);
+  --bg-active:  rgba(0,200,200,0.15);
+  --bg-input:   #152a3e;
+  --bg-call:    #0f2137;
+
+  --text-primary:   #cde8f0;
+  --text-secondary: #475e65;
+  --text-muted:     #4a7080;
+
+  --border:  #1a3448;
+  --accent:  #00c8c8;
+
+  --color-success: #2fb57a;
+  --color-danger:  #e05a5a;
+
+  --code-background: rgba(255,255,255,.1);
+}

package/pages/public/themes/rose.css

@@ -0,0 +1,22 @@
+/* rose theme — warm pink */
+:root, [data-theme="rose"] {
+  --bg-base:    #1e1218;
+  --bg-topbar:  #160c11;
+  --bg-sidebar: #241520;
+  --bg-hover:   rgba(230,100,140,0.08);
+  --bg-active:  rgba(230,100,140,0.16);
+  --bg-input:   #2c1a26;
+  --bg-call:    #241520;
+
+  --text-primary:   #f0d8e4;
+  --text-secondary: #79596a;
+  --text-muted:     #7a4860;
+
+  --border:  #36202e;
+  --accent:  #e8688a;
+
+  --color-success: #5ab87a;
+  --color-danger:  #e05050;
+  --code-background: rgba(255,255,255,.1);
+
+}

package/pages/registration/index.js

@@ -0,0 +1,35 @@
+import { auth, sessionFromRequest, sessionCookie } from '../../src/context.js'
+import { p } from '../../src/config.js'
+
+export async function GET(req) {
+  const session = sessionFromRequest(req)
+  if (session) return Response.redirect(new URL(p('/'), req.url), 302)
+
+  const url = new URL(req.url)
+  const inviteToken = url.searchParams.get('invite') ?? ''
+  return { error: null, invite_token: inviteToken }
+}
+
+export async function POST(req) {
+  const form = await req.formData()
+  try {
+    const inviteToken = form.get('invite_token')?.trim()
+    const handle = form.get('handle')?.trim()
+    const display_name = form.get('display_name')?.trim() || handle
+    const password = form.get('password')
+    const result = await auth.redeemInvite({ inviteToken, profile: { handle, display_name }, password })
+    return new Response(null, {
+        status: 302,
+        headers: {
+            Location: p('/'),
+            'Set-Cookie': sessionCookie(result.sessionToken),
+        }
+    })
+  } catch (err) {
+    const invite_token = form.get('invite_token') ?? ''
+    return {
+      error: err.message ?? 'Something went wrong',
+      invite_token,
+    }
+  }
+}

package/pages/registration/index.phtml

@@ -0,0 +1,38 @@
+<section class="signin">
+{{#if error}}
+  <div class="alert alert-error" role="alert">{{error}}</div>
+{{/if}}
+
+  <!-- Sign up with invite -->
+  <section id="panel-signup" role="tabpanel">
+    <form method="POST" action="{{base}}/registration" class="auth-form" novalidate>
+      <input type="hidden" name="_action" value="signup">
+      <div class="field">
+        <label for="signup-token">Invite code</label>
+        <input id="signup-token" name="invite_token" type="text" autocomplete="off" required
+          placeholder="paste invite code" value="{{invite_token}}">
+      </div>
+      <div class="field">
+        <label for="signup-handle">Handle</label>
+        <input id="signup-handle" name="handle" type="text" autocomplete="username" autocapitalize="none" required
+          placeholder="choose-a-handle">
+      </div>
+      <div class="field">
+        <label for="signup-display">Display name</label>
+        <input id="signup-display" name="display_name" type="text" autocomplete="name" placeholder="Your Name">
+      </div>
+      <div class="field">
+        <label for="signup-password">Password</label>
+        <input id="signup-password" name="password" type="password" autocomplete="new-password" required
+          placeholder="••••••••">
+      </div>
+      <button type="submit" class="btn-primary">Create account</button>
+    </form>
+  </section>
+  <footer>
+    <div class="auth-tabs" role="tablist">
+      <a role="tab" aria-controls="panel-signin" aria-selected="false" href="{{base}}/login" title="Sign in">Sign in</a>
+      <a role="tab" aria-controls="panel-signup" aria-selected="true" href="{{base}}/registration" title="Sign up">Sign up</a>
+    </div>
+  </footer>
+</section>

package/pages/uploads/[uploadId]/[filename].js

@@ -0,0 +1,45 @@
+/**
+ * GET /uploads/:uploadId/:filename
+ *
+ * Authenticated file download handler.
+ * `:filename` is cosmetic — the actual file is located by uploadId + stored_name from DB.
+ * Path traversal is impossible because stored_name is opaque and never interpolated from URL.
+ */
+import { sessionFromRequest, botUserFromRequest, uploadService } from '../../../src/context.js'
+import { ServiceError, httpStatus } from '../../../src/util/errors.js'
+
+export async function GET(req) {
+  const session  = sessionFromRequest(req)
+  const botUser  = session ? null : await botUserFromRequest(req)
+  const reqUser  = session?.user ?? botUser
+  if (!reqUser) return new Response('Unauthorized', { status: 401 })
+
+  const parts = new URL(req.url).pathname.split('/')
+  // pathname: /uploads/<uploadId>/<filename>
+  const uploadId = parts[2]
+
+  if (!uploadId) return new Response('Not Found', { status: 404 })
+
+  try {
+    const { stream, mimeType, contentDisposition } = await uploadService.streamFile({
+      uploadId,
+      requestingUserId: reqUser.user_id,
+      userRoles: reqUser.roles ?? [],
+    })
+
+    return new Response(stream, {
+      status: 200,
+      headers: {
+        'Content-Type': mimeType,
+        'Content-Disposition': contentDisposition,
+        'Cache-Control': 'private, max-age=31536000, immutable',
+      },
+    })
+  } catch (err) {
+    if (err instanceof ServiceError) {
+      const status = httpStatus(err)
+      return new Response(err.message, { status })
+    }
+    throw err
+  }
+}

package/src/adapters/InMemoryAuthRepository.js

@@ -0,0 +1,74 @@
+export class InMemoryAuthRepository {
+  constructor() {
+    this._users = new Map()     // userId → user record (with password_hash, roles_json)
+    this._sessions = new Map()  // sessionId → session record
+    this._invites = new Map()   // tokenHash → invite record
+  }
+
+  // ── Invites ────────────────────────────────────────────────────────────────
+
+  insertInvite({ inviteId, tokenHash, createdByUserId, now, expiresAt, maxUses, note, initialRolesJson }) {
+    this._invites.set(tokenHash, { invite_id: inviteId, token_hash: tokenHash, created_by_user_id: createdByUserId, created_at: now, expires_at: expiresAt, max_uses: maxUses, uses: 0, note, initial_roles_json: initialRolesJson, redeemed_by_user_id: null })
+  }
+
+  findInviteByTokenHash({ tokenHash }) {
+    return this._invites.get(tokenHash) ?? null
+  }
+
+  registerUser({ inviteId, userId, handle, displayName, rolesJson, passwordHash, now, sessionId, sessionTokenHash, sessionExpiresAt }) {
+    this._users.set(userId, { user_id: userId, handle, display_name: displayName, roles_json: rolesJson, password_hash: passwordHash, created_at: now })
+    for (const invite of this._invites.values()) {
+      if (invite.invite_id === inviteId) { invite.uses += 1; invite.redeemed_by_user_id = userId; break }
+    }
+    this._sessions.set(sessionId, { session_id: sessionId, user_id: userId, token_hash: sessionTokenHash, created_at: now, expires_at: sessionExpiresAt, last_seen_at: now, revoked_at: null })
+  }
+
+  registerBootstrapUser({ userId, handle, displayName, rolesJson, passwordHash, now, sessionId, sessionTokenHash, sessionExpiresAt }) {
+    this._users.set(userId, { user_id: userId, handle, display_name: displayName, roles_json: rolesJson, password_hash: passwordHash, created_at: now })
+    this._sessions.set(sessionId, { session_id: sessionId, user_id: userId, token_hash: sessionTokenHash, created_at: now, expires_at: sessionExpiresAt, last_seen_at: now, revoked_at: null })
+  }
+
+  // ── Users ──────────────────────────────────────────────────────────────────
+
+  findUserByHandle({ handle }) {
+    return [...this._users.values()].find(u => u.handle === handle) ?? null
+  }
+
+  findUserById({ userId }) {
+    const u = this._users.get(userId)
+    if (!u) return null
+    return { user_id: u.user_id, handle: u.handle, display_name: u.display_name, roles_json: u.roles_json }
+  }
+
+  getUserCount() {
+    return this._users.size
+  }
+
+  isHandleTaken({ handle }) {
+    return [...this._users.values()].some(u => u.handle === handle)
+  }
+
+  // ── Sessions ───────────────────────────────────────────────────────────────
+
+  insertSession({ sessionId, userId, tokenHash, now, expiresAt }) {
+    this._sessions.set(sessionId, { session_id: sessionId, user_id: userId, token_hash: tokenHash, created_at: now, expires_at: expiresAt, last_seen_at: now, revoked_at: null })
+  }
+
+  findSessionWithUser({ tokenHash }) {
+    const session = [...this._sessions.values()].find(s => s.token_hash === tokenHash)
+    if (!session) return null
+    const user = this._users.get(session.user_id)
+    if (!user) return null
+    return { session_id: session.session_id, user_id: user.user_id, expires_at: session.expires_at, revoked_at: session.revoked_at, handle: user.handle, display_name: user.display_name, roles_json: user.roles_json }
+  }
+
+  touchSession({ sessionId, now }) {
+    const s = this._sessions.get(sessionId)
+    if (s) s.last_seen_at = now
+  }
+
+  revokeSession({ sessionId, now }) {
+    const s = this._sessions.get(sessionId)
+    if (s) s.revoked_at = now
+  }
+}

package/src/adapters/InMemoryChannelRepository.js

@@ -0,0 +1,138 @@
+export class InMemoryChannelRepository {
+  constructor() {
+    this._channels = new Map()    // channelId → channel record
+    this._members = new Map()     // `${channelId}:${userId}` → membership record
+  }
+
+  insertChannelWithOwner({ channelId, hubId, kind, name, topic, visibility, createdByUserId, now }) {
+    const nextOrder = [...this._channels.values()]
+      .filter(c => c.hub_id === hubId && !c.deleted_at)
+      .reduce((max, c) => Math.max(max, c.sort_order ?? 0), -1) + 1
+    this._channels.set(channelId, { channel_id: channelId, hub_id: hubId, kind, name, topic, visibility, sort_order: nextOrder, created_by_user_id: createdByUserId, created_at: now, deleted_at: null })
+    this._members.set(`${channelId}:${createdByUserId}`, { channel_id: channelId, user_id: createdByUserId, role: 'owner', joined_at: now, left_at: null, banned_at: null })
+  }
+
+  _sortOrder(a, b) {
+    const orderDiff = (a.sort_order ?? 0) - (b.sort_order ?? 0)
+    return orderDiff !== 0 ? orderDiff : (a.created_at ?? 0) - (b.created_at ?? 0)
+  }
+
+  _toPublic(c) {
+    return { channel_id: c.channel_id, hub_id: c.hub_id, name: c.name, kind: c.kind, visibility: c.visibility, topic: c.topic, sort_order: c.sort_order ?? 0 }
+  }
+
+  listInHub({ hubId }) {
+    return [...this._channels.values()]
+      .filter(c => c.hub_id === hubId && !c.deleted_at)
+      .sort((a, b) => this._sortOrder(a, b))
+      .map(c => this._toPublic(c))
+  }
+
+  listAccessibleInHub({ hubId, userId, isGuest = false }) {
+    return [...this._channels.values()]
+      .filter(c => {
+        if (c.hub_id !== hubId || c.deleted_at) return false
+        const m = this._members.get(`${c.channel_id}:${userId}`)
+        if (m && !m.left_at && !m.banned_at) return true
+        if (!isGuest && c.visibility === 'public') return true
+        return false
+      })
+      .sort((a, b) => this._sortOrder(a, b))
+      .map(c => this._toPublic(c))
+  }
+
+  listAll() {
+    return [...this._channels.values()]
+      .filter(c => !c.deleted_at)
+      .sort((a, b) => this._sortOrder(a, b))
+      .map(c => ({ ...this._toPublic(c), hub_name: c.hub_id }))
+  }
+
+  listAccessible({ userId, isGuest = false }) {
+    return [...this._channels.values()]
+      .filter(c => {
+        if (c.deleted_at) return false
+        const cm = this._members.get(`${c.channel_id}:${userId}`)
+        if (cm && !cm.left_at && !cm.banned_at) return true
+        if (!isGuest && c.visibility === 'public') return true
+        return false
+      })
+      .sort((a, b) => this._sortOrder(a, b))
+      .map(c => ({ ...this._toPublic(c), hub_name: c.hub_id }))
+  }
+
+  findById({ channelId }) {
+    return this._channels.get(channelId) ?? null
+  }
+
+  findMembership({ channelId, userId }) {
+    return this._members.get(`${channelId}:${userId}`) ?? null
+  }
+
+  findByHubAndName({ hubId, name }) {
+    return [...this._channels.values()].find(c => c.hub_id === hubId && c.name === name && !c.deleted_at) ?? null
+  }
+
+  findDmByName({ name }) {
+    return [...this._channels.values()].find(c => c.kind === 'dm' && c.name === name && !c.deleted_at) ?? null
+  }
+
+  insertDmChannel({ channelId, name, userIdA, userIdB, now }) {
+    this._channels.set(channelId, { channel_id: channelId, hub_id: null, kind: 'dm', name, topic: null, visibility: 'private', sort_order: 0, created_by_user_id: userIdA, created_at: now, deleted_at: null })
+    this._members.set(`${channelId}:${userIdA}`, { channel_id: channelId, user_id: userIdA, role: 'member', joined_at: now, left_at: null, banned_at: null })
+    this._members.set(`${channelId}:${userIdB}`, { channel_id: channelId, user_id: userIdB, role: 'member', joined_at: now, left_at: null, banned_at: null })
+  }
+
+  listDmsByUser({ userId }) {
+    return [...this._channels.values()]
+      .filter(c => c.kind === 'dm' && !c.deleted_at)
+      .filter(c => {
+        const m = this._members.get(`${c.channel_id}:${userId}`)
+        return m && !m.left_at
+      })
+      .sort((a, b) => (b.created_at ?? 0) - (a.created_at ?? 0))
+      .map(c => {
+        const otherMember = [...this._members.values()].find(m => m.channel_id === c.channel_id && m.user_id !== userId && !m.left_at)
+        return { channel_id: c.channel_id, name: c.name, kind: c.kind, other_user_id: otherMember?.user_id ?? null }
+      })
+  }
+
+  upsertMembership({ channelId, userId, role, now }) {
+    const key = `${channelId}:${userId}`
+    const existing = this._members.get(key)
+    if (existing) { existing.left_at = null; existing.banned_at = null }
+    else { this._members.set(key, { channel_id: channelId, user_id: userId, role, joined_at: now, left_at: null, banned_at: null }) }
+  }
+
+  setMemberLeft({ channelId, userId, now }) {
+    const m = this._members.get(`${channelId}:${userId}`)
+    if (m) m.left_at = now
+  }
+
+  listActiveMembers({ channelId }) {
+    return [...this._members.values()]
+      .filter(m => m.channel_id === channelId && !m.left_at && !m.banned_at)
+      .map(m => ({ user_id: m.user_id, role: m.role }))
+  }
+
+  patchChannel({ channelId, name, topic, visibility }) {
+    const c = this._channels.get(channelId)
+    if (!c) return
+    if (name !== undefined) c.name = name
+    if (topic !== undefined) c.topic = topic
+    if (visibility !== undefined) c.visibility = visibility
+  }
+
+  softDeleteChannel({ channelId, now }) {
+    const c = this._channels.get(channelId)
+    if (c) c.deleted_at = now
+  }
+
+  reorderChannels({ hubId, channelIds }) {
+    channelIds.forEach((channelId, index) => {
+      const c = this._channels.get(channelId)
+      if (c && c.hub_id === hubId && !c.deleted_at) c.sort_order = index
+    })
+    return this.listInHub({ hubId })
+  }
+}

package/src/adapters/InMemoryDeliveryRepository.js

@@ -0,0 +1,52 @@
+import { newId } from '../util/ids.js'
+
+export class InMemoryDeliveryRepository {
+  constructor() {
+    this._store = new Map() // deliveryId → record
+  }
+
+  _key(channelId, userId) { return `${channelId}:${userId}` }
+
+  findByChannelAndUser({ channelId, userId }) {
+    for (const record of this._store.values()) {
+      if (record.channel_id === channelId && record.user_id === userId) return record
+    }
+    return null
+  }
+
+  create({ channelId, userId, now }) {
+    const deliveryId = newId('del')
+    const record = { delivery_id: deliveryId, user_id: userId, channel_id: channelId, after_seq: 0, mention_seq: 0, mention_priority: 'normal', last_delivered_at: now, status: 'active' }
+    this._store.set(deliveryId, record)
+    return { ...record }
+  }
+
+  advance({ channelId, userId, afterSeq, now }) {
+    for (const record of this._store.values()) {
+      if (record.channel_id === channelId && record.user_id === userId) {
+        record.after_seq = afterSeq
+        record.last_delivered_at = now
+        if (record.mention_seq > 0 && record.mention_seq <= afterSeq) record.mention_seq = 0
+        return
+      }
+    }
+  }
+
+  advanceMention({ channelId, userId, mentionSeq, priority = 'normal' }) {
+    for (const record of this._store.values()) {
+      if (record.channel_id === channelId && record.user_id === userId) {
+        if ((record.mention_seq ?? 0) < mentionSeq) {
+          record.mention_seq = mentionSeq
+          record.mention_priority = priority
+        }
+        return
+      }
+    }
+  }
+
+  buildDigestData({ userId }) {
+    return [...this._store.values()]
+      .filter(d => d.user_id === userId)
+      .map(d => ({ channel_id: d.channel_id, name: d.channel_id, kind: 'text', after_seq: d.after_seq, mention_seq: d.mention_seq ?? 0, mention_priority: d.mention_priority ?? 'normal', max_seq: 0, other_user_id: null }))
+  }
+}

package/src/adapters/InMemoryFileStore.js

@@ -0,0 +1,53 @@
+/**
+ * InMemoryFileStore — test double for IFileStore.
+ * Stores file contents as Uint8Array values in a Map keyed by "uploadId/storedName".
+ */
+
+import { ServiceError } from '../util/errors'
+export class InMemoryFileStore {
+  constructor() {
+    this._store = new Map()
+  }
+
+  #key(uploadId, storedName) {
+    return `${uploadId}/${storedName}`
+  }
+
+  async write({ uploadId, storedName, stream }) {
+    // Accept ReadableStream, Uint8Array, Buffer, or string
+    if (stream && typeof stream.getReader === 'function') {
+      const chunks = []
+      const reader = stream.getReader()
+      while (true) {
+        const { done, value } = await reader.read()
+        if (done) break
+        chunks.push(value)
+      }
+      const total = chunks.reduce((n, c) => n + c.length, 0)
+      const buf = new Uint8Array(total)
+      let offset = 0
+      for (const c of chunks) { buf.set(c, offset); offset += c.length }
+      this._store.set(this.#key(uploadId, storedName), buf)
+    } else {
+      const buf = stream instanceof Uint8Array ? stream : new Uint8Array(Buffer.from(stream))
+      this._store.set(this.#key(uploadId, storedName), buf)
+    }
+  }
+
+  async read({ uploadId, storedName }) {
+    const buf = this._store.get(this.#key(uploadId, storedName))
+    if (!buf) {
+      throw new ServiceError('NOT_FOUND', `File not found: ${uploadId}/${storedName}`)
+    }
+    return new ReadableStream({
+      start(controller) {
+        controller.enqueue(buf)
+        controller.close()
+      }
+    })
+  }
+
+  async delete({ uploadId, storedName }) {
+    this._store.delete(this.#key(uploadId, storedName))
+  }
+}

package/src/adapters/InMemoryHubRepository.js

@@ -0,0 +1,85 @@
+export class InMemoryHubRepository {
+  constructor() {
+    this._hubs = new Map()        // hubId → hub record
+    this._members = new Map()     // `${hubId}:${userId}` → membership record
+  }
+
+  insertHubWithOwner({ hubId, name, description, visibility, createdByUserId, now }) {
+    this._hubs.set(hubId, { hub_id: hubId, name, description, visibility, created_by_user_id: createdByUserId, created_at: now, deleted_at: null })
+    const key = `${hubId}:${createdByUserId}`
+    this._members.set(key, { hub_id: hubId, user_id: createdByUserId, joined_at: now, left_at: null })
+  }
+
+  _channelCount(hubId) {
+    // Channels are tracked externally — return 0 in isolation
+    return 0
+  }
+
+  _toPublic(hub) {
+    return { hub_id: hub.hub_id, name: hub.name, description: hub.description, visibility: hub.visibility, channel_count: 0 }
+  }
+
+  listAllHubs() {
+    return [...this._hubs.values()].filter(h => !h.deleted_at).sort((a, b) => a.name.localeCompare(b.name)).map(h => this._toPublic(h))
+  }
+
+  listAccessibleHubs({ userId }) {
+    return [...this._hubs.values()]
+      .filter(h => {
+        if (h.deleted_at) return false
+        if (h.visibility === 'public') return true
+        const m = this._members.get(`${h.hub_id}:${userId}`)
+        return m && !m.left_at
+      })
+      .sort((a, b) => a.name.localeCompare(b.name))
+      .map(h => this._toPublic(h))
+  }
+
+  findById({ hubId }) {
+    return this._hubs.get(hubId) ?? null
+  }
+
+  findByName({ name }) {
+    return [...this._hubs.values()].find(h => h.name === name && !h.deleted_at) ?? null
+  }
+
+  findMembership({ hubId, userId }) {
+    return this._members.get(`${hubId}:${userId}`) ?? null
+  }
+
+  upsertMembership({ hubId, userId, now }) {
+    const key = `${hubId}:${userId}`
+    const existing = this._members.get(key)
+    if (existing) { existing.left_at = null }
+    else { this._members.set(key, { hub_id: hubId, user_id: userId, joined_at: now, left_at: null }) }
+  }
+
+  setMemberLeft({ hubId, userId, now }) {
+    const m = this._members.get(`${hubId}:${userId}`)
+    if (m) m.left_at = now
+  }
+
+  listMembers({ hubId }) {
+    return [...this._members.values()]
+      .filter(m => m.hub_id === hubId && !m.left_at)
+      .sort((a, b) => (a.joined_at ?? 0) - (b.joined_at ?? 0))
+      .map(m => ({ user_id: m.user_id, handle: null, display_name: null, joined_at: m.joined_at }))
+  }
+
+  patchHub({ hubId, name, description, visibility }) {
+    const hub = this._hubs.get(hubId)
+    if (!hub) return
+    if (name !== undefined) hub.name = name
+    if (description !== undefined) hub.description = description
+    if (visibility !== undefined) hub.visibility = visibility
+  }
+
+  listActiveChannelIds({ hubId }) {
+    return [] // channels not tracked in HubRepo; test via integration if needed
+  }
+
+  softDeleteHub({ hubId, now }) {
+    const hub = this._hubs.get(hubId)
+    if (hub) hub.deleted_at = now
+  }
+}

package/src/adapters/InMemoryMessageRepository.js

@@ -0,0 +1,35 @@
+export class InMemoryMessageRepository {
+  constructor() {
+    this._messages = [] // { msg_id, channel_id, seq, user_id, user_handle, ts, text, client_msg_id, deleted_at, edited_at }
+    this._seqs = new Map() // channelId → current max seq
+  }
+
+  insertMessage({ msgId, channelId, userId, now, text, clientMsgId }) {
+    const seq = (this._seqs.get(channelId) ?? 0) + 1
+    this._seqs.set(channelId, seq)
+    this._messages.push({ msg_id: msgId, channel_id: channelId, seq, user_id: userId, user_handle: userId, ts: now, text, client_msg_id: clientMsgId, deleted_at: null, edited_at: null })
+    return { seq }
+  }
+
+  getById(msgId) {
+    return this._messages.find(m => m.msg_id === msgId) ?? null
+  }
+
+  updateMessage({ msgId, text, editedAt }) {
+    const msg = this._messages.find(m => m.msg_id === msgId)
+    if (msg) { msg.text = text; msg.edited_at = editedAt }
+  }
+
+  deleteMessage({ msgId, deletedAt }) {
+    const msg = this._messages.find(m => m.msg_id === msgId)
+    if (msg) msg.deleted_at = deletedAt
+  }
+
+  listMessages({ channelId, afterSeq, limit }) {
+    return this._messages
+      .filter(m => m.channel_id === channelId && m.seq > afterSeq && m.deleted_at == null)
+      .sort((a, b) => a.seq - b.seq)
+      .slice(0, limit)
+      .map(m => ({ msg_id: m.msg_id, seq: m.seq, user_id: m.user_id, user_handle: m.user_handle, ts: m.ts, text: m.text, edited_at: m.edited_at ?? null }))
+  }
+}