@kelpie/server 0.1.0

package/dist/lib/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/lib/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;;;;;;GAcG;AAEH,+FAA+F;AAC/F,MAAM,SAAS,GAAG,aAAa,CAAA;AAC/B,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,kFAAkF;AAClF,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,MAAM,SAAS,GAAG,EAAE,CAAA;AAEpB;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,CAAA;AAE3B,sFAAsF;AACtF,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,MAAc,EAAE,OAA6B;QACvD,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;QAEnC,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC5B,CAAC;IACH,CAAC;CACF;AAwBD,MAAM,WAAW,GAAG,WAAW,MAAM,CAAC,SAAS,CAAC,0GAA0G,CAAA;AAE1J;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,qBAAqB,EAAE,CAAC;SACrB,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAE9E;;;;;;;;;OASG;IACH,8BAA8B,EAAE,CAAC;SAC9B,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;SAC7F,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAA;AAClC,CAAC;AAID,gGAAgG;AAChG,SAAS,SAAS,CAAC,KAAa;IAC9B,uEAAuE;IACvE,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAE5C,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3D,CAAC;AAeD,8EAA8E;AAC9E,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAEjE,IAAI,OAAO,KAAK,cAAc,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC7G,MAAM,IAAI,qBAAqB,CAAC,gDAAgD,CAAC,CAAA;IACnF,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAE5C,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,qBAAqB,CAAC,yCAAyC,CAAC,CAAA;IAC5E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAA;AACzE,CAAC;AAED,4FAA4F;AAC5F,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAkB;IAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;IAC3D,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAE9B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAE5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IACzE,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA8B;IAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,uBAAuB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;IACjF,MAAM,aAAa,GAAG,MAAM,CAAC,8BAA8B,CAAA;IAE3D,6EAA6E;IAC7E,MAAM,QAAQ,GACZ,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;QACnD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAC,gCAAgC,EAAE,aAAa,CAAC,CAAA;IAEjE,+EAA+E;IAC/E,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAErE,SAAS,IAAI,CAAC,SAAiB;QAC7B,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QAEpF,OAAO;YACL,cAAc;YACd,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxB,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACzC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;SACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACb,CAAC;IAED,SAAS,IAAI,CAAC,MAAc;QAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;QAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAEtC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAA;YAClB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,qBAAqB,CAC7B,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,2EAA2E,CAChF,CAAA;IACH,CAAC;IAED,SAAS,MAAM,CAAC,MAAc;QAC5B,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3B,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAC/B,CAAC"}

package/dist/lib/timezones.d.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+/**
+ * An IANA zone name, checked by asking `Intl` to build a formatter for it.
+ *
+ * A stored zone the platform cannot resolve would throw at render time, in a
+ * component far from the request that accepted it, so the refusal belongs here.
+ *
+ * What `Intl` resolves is wider than the canonical list: it is case-insensitive
+ * and takes legacy aliases, so `australia/sydney` and `Asia/Calcutta` both pass.
+ * The value is stored as it was sent, so nothing downstream may assume a stored
+ * zone is in canonical form. It is also whatever the running Node's ICU knows,
+ * so a self-hosted deployment on a long-stale runtime could refuse a zone a
+ * current browser resolved. Node 24 ships full ICU and knows every zone added
+ * so far.
+ *
+ * This runs on write only, and there is no backfill. Every route that sets a
+ * workspace zone has validated it since the first one shipped, so a stored zone
+ * `dayIn` cannot resolve is corrupt data rather than a row that predates the
+ * check. Refusing the next write hands the correction to whoever is editing it.
+ */
+export declare const timezoneSchema: z.ZodString;
+/**
+ * The calendar day it is in `timezone` at the instant `at`, as `YYYY-MM-DD`.
+ *
+ * Overdue is a question about days, not instants, and which day it is depends on
+ * where the workspace is. Reading the server's own clock would put a Melbourne
+ * workspace on yesterday's date for ten hours of every day.
+ *
+ * `en-CA` renders `YYYY-MM-DD` already, so the parts need no reassembling. The
+ * formatter is built per call rather than cached, because the zone varies by
+ * workspace and a cache keyed on it would outlive the request that needed it.
+ *
+ * @throws RangeError when the platform cannot resolve `timezone`. Every write
+ *   path validates against `timezoneSchema`, so one that fails here is corrupt
+ *   data; a 500 naming it is more use than silently answering in UTC.
+ */
+export declare function dayIn(timezone: string, at: Date): string;
+//# sourceMappingURL=timezones.d.ts.map

package/dist/lib/timezones.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timezones.d.ts","sourceRoot":"","sources":["../../src/lib/timezones.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,aAa1B,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,MAAM,CAOxD"}

package/dist/lib/timezones.js

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+/**
+ * An IANA zone name, checked by asking `Intl` to build a formatter for it.
+ *
+ * A stored zone the platform cannot resolve would throw at render time, in a
+ * component far from the request that accepted it, so the refusal belongs here.
+ *
+ * What `Intl` resolves is wider than the canonical list: it is case-insensitive
+ * and takes legacy aliases, so `australia/sydney` and `Asia/Calcutta` both pass.
+ * The value is stored as it was sent, so nothing downstream may assume a stored
+ * zone is in canonical form. It is also whatever the running Node's ICU knows,
+ * so a self-hosted deployment on a long-stale runtime could refuse a zone a
+ * current browser resolved. Node 24 ships full ICU and knows every zone added
+ * so far.
+ *
+ * This runs on write only, and there is no backfill. Every route that sets a
+ * workspace zone has validated it since the first one shipped, so a stored zone
+ * `dayIn` cannot resolve is corrupt data rather than a row that predates the
+ * check. Refusing the next write hands the correction to whoever is editing it.
+ */
+export const timezoneSchema = z.string().refine((value) => {
+    try {
+        new Intl.DateTimeFormat('en', { timeZone: value });
+        return true;
+    }
+    catch {
+        // Only a RangeError for an unknown zone reaches this. Intl throws nothing
+        // else for a well-formed options object.
+        return false;
+    }
+}, { message: 'Must be an IANA time zone name, e.g. Australia/Sydney' });
+/**
+ * The calendar day it is in `timezone` at the instant `at`, as `YYYY-MM-DD`.
+ *
+ * Overdue is a question about days, not instants, and which day it is depends on
+ * where the workspace is. Reading the server's own clock would put a Melbourne
+ * workspace on yesterday's date for ten hours of every day.
+ *
+ * `en-CA` renders `YYYY-MM-DD` already, so the parts need no reassembling. The
+ * formatter is built per call rather than cached, because the zone varies by
+ * workspace and a cache keyed on it would outlive the request that needed it.
+ *
+ * @throws RangeError when the platform cannot resolve `timezone`. Every write
+ *   path validates against `timezoneSchema`, so one that fails here is corrupt
+ *   data; a 500 naming it is more use than silently answering in UTC.
+ */
+export function dayIn(timezone, at) {
+    return new Intl.DateTimeFormat('en-CA', {
+        timeZone: timezone,
+        year: 'numeric',
+        month: '2-digit',
+        day: '2-digit',
+    }).format(at);
+}
+//# sourceMappingURL=timezones.js.map

package/dist/lib/timezones.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timezones.js","sourceRoot":"","sources":["../../src/lib/timezones.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAC7C,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QAElD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,yCAAyC;QACzC,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,uDAAuD,EAAE,CACrE,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,KAAK,CAAC,QAAgB,EAAE,EAAQ;IAC9C,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;QACtC,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,SAAS;KACf,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AACf,CAAC"}

package/dist/lib/tokens.d.ts

@@ -0,0 +1,10 @@
+export declare function generateToken(randomSource?: (size: number) => Buffer): string;
+export declare function hashToken(token: string): string;
+/**
+ * Compares two token hashes without leaking their difference through timing.
+ *
+ * Lookups are by hash, so this is for the cases that compare a stored hash to a
+ * freshly computed one rather than querying by it.
+ */
+export declare function tokenHashesMatch(left: string, right: string): boolean;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/lib/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/lib/tokens.ts"],"names":[],"mappings":"AAaA,wBAAgB,aAAa,CAAC,YAAY,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAoB,GAAG,MAAM,CAE1F;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CASrE"}

package/dist/lib/tokens.js

@@ -0,0 +1,31 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+/**
+ * Bearer secrets: session cookies, password reset links, invite links, API keys.
+ *
+ * These are high-entropy random strings, not passwords, so SHA-256 is the right
+ * store. A slow KDF here would buy nothing: there is no dictionary to attack.
+ * Passwords use argon2 (`lib/passwords.ts`); the two must not be confused.
+ */
+/** 256 bits. Long enough that guessing is not a threat model. */
+const TOKEN_BYTES = 32;
+export function generateToken(randomSource = randomBytes) {
+    return randomSource(TOKEN_BYTES).toString('base64url');
+}
+export function hashToken(token) {
+    return createHash('sha256').update(token, 'utf8').digest('hex');
+}
+/**
+ * Compares two token hashes without leaking their difference through timing.
+ *
+ * Lookups are by hash, so this is for the cases that compare a stored hash to a
+ * freshly computed one rather than querying by it.
+ */
+export function tokenHashesMatch(left, right) {
+    const leftBytes = Buffer.from(left, 'utf8');
+    const rightBytes = Buffer.from(right, 'utf8');
+    if (leftBytes.length !== rightBytes.length) {
+        return false;
+    }
+    return timingSafeEqual(leftBytes, rightBytes);
+}
+//# sourceMappingURL=tokens.js.map

package/dist/lib/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/lib/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEtE;;;;;;GAMG;AAEH,iEAAiE;AACjE,MAAM,WAAW,GAAG,EAAE,CAAA;AAEtB,MAAM,UAAU,aAAa,CAAC,YAAY,GAA6B,WAAW;IAChF,OAAO,YAAY,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAE7C,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;AAC/C,CAAC"}

package/dist/lib/url.d.ts

@@ -0,0 +1,25 @@
+/**
+ * What counts as an outbound endpoint Kelpie may POST to — webhook deliveries
+ * and agent-task dispatches share the rules.
+ *
+ * Deliberately permissive about *where* it points. A self-hosted Kelpie
+ * legitimately posts to `http://automation.internal:8080`, so there is no
+ * private-address filter here; adding one would break the self-hosted case to
+ * defend a cloud that does not exist yet. Registration is credentialled and the
+ * endpoint is the customer's own, which is what makes that acceptable today. A
+ * hosted deployment needs egress filtering, and it belongs there rather than in
+ * this check.
+ */
+export declare const DELIVERABLE_PROTOCOLS: readonly string[];
+export interface UrlProblem {
+    readonly message: string;
+}
+/**
+ * @param credentialsMessage What to tell a caller whose URL embeds credentials.
+ *   Each registration type names its own alternative — a webhook signs its
+ *   deliveries, an agent carries `auth_header` — so the advice is the caller's.
+ * @returns The problem with this URL, or undefined when it can be posted to.
+ *   A message rather than a boolean, so the `422` says which rule was broken.
+ */
+export declare function endpointUrlProblem(value: string, credentialsMessage: string): UrlProblem | undefined;
+//# sourceMappingURL=url.d.ts.map

package/dist/lib/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/lib/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAAwB,CAAA;AAE3E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,GACzB,UAAU,GAAG,SAAS,CAsBxB"}

package/dist/lib/url.js

@@ -0,0 +1,41 @@
+/**
+ * What counts as an outbound endpoint Kelpie may POST to — webhook deliveries
+ * and agent-task dispatches share the rules.
+ *
+ * Deliberately permissive about *where* it points. A self-hosted Kelpie
+ * legitimately posts to `http://automation.internal:8080`, so there is no
+ * private-address filter here; adding one would break the self-hosted case to
+ * defend a cloud that does not exist yet. Registration is credentialled and the
+ * endpoint is the customer's own, which is what makes that acceptable today. A
+ * hosted deployment needs egress filtering, and it belongs there rather than in
+ * this check.
+ */
+export const DELIVERABLE_PROTOCOLS = ['http:', 'https:'];
+/**
+ * @param credentialsMessage What to tell a caller whose URL embeds credentials.
+ *   Each registration type names its own alternative — a webhook signs its
+ *   deliveries, an agent carries `auth_header` — so the advice is the caller's.
+ * @returns The problem with this URL, or undefined when it can be posted to.
+ *   A message rather than a boolean, so the `422` says which rule was broken.
+ */
+export function endpointUrlProblem(value, credentialsMessage) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        // The only thing `new URL` throws for is a string it cannot parse, which is
+        // exactly the answer wanted here.
+        return { message: 'Expected an absolute URL, e.g. https://example.com/hooks/kelpie' };
+    }
+    if (!DELIVERABLE_PROTOCOLS.includes(parsed.protocol)) {
+        return { message: 'Expected an http:// or https:// URL' };
+    }
+    // Credentials in the URL would be sent on every POST and stored in plaintext
+    // beside it, which is a secret the registration's own mechanism replaces.
+    if (parsed.username.length > 0 || parsed.password.length > 0) {
+        return { message: credentialsMessage };
+    }
+    return undefined;
+}
+//# sourceMappingURL=url.js.map

package/dist/lib/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/lib/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AAM3E;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,kBAA0B;IAE1B,IAAI,MAAW,CAAA;IAEf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,kCAAkC;QAClC,OAAO,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAAA;IACvF,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAA;IAC3D,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAA;IACxC,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/modules/activities/index.d.ts

@@ -0,0 +1,18 @@
+import type { KelpieModule } from '../../runtime/module.ts';
+import { createActivityRecorder } from './recorder.ts';
+import type { ActivityDraft, ActivityRecorder } from './recorder.ts';
+/**
+ * Activities: the history every other module writes into.
+ *
+ * This module owns the table and the read side. The write side is the recorder,
+ * which the emitting modules build for themselves from `context.createId` and
+ * `context.now` inside their own `register`. It holds no state, so three
+ * instances of it are three closures over the same two injectables, not three
+ * copies of anything. The alternative was threading one instance through
+ * `core.ts` into every module that emits, or a service locator, and neither is
+ * worth avoiding a stateless factory call.
+ */
+export declare function createActivitiesModule(migrationsDirectory: string): KelpieModule;
+export { createActivityRecorder };
+export type { ActivityDraft, ActivityRecorder };
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/activities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/activities/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAMpE;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,mBAAmB,EAAE,MAAM,GAAG,YAAY,CAoBhF;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAA;AACjC,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/modules/activities/index.js

@@ -0,0 +1,34 @@
+import { createActivityRecorder } from './recorder.js';
+import { mountActivitiesRoutes } from './routes.js';
+import * as schema from './schema.js';
+import { createActivitiesService } from './service.js';
+import { registerActivitiesTools } from './tools.js';
+/**
+ * Activities: the history every other module writes into.
+ *
+ * This module owns the table and the read side. The write side is the recorder,
+ * which the emitting modules build for themselves from `context.createId` and
+ * `context.now` inside their own `register`. It holds no state, so three
+ * instances of it are three closures over the same two injectables, not three
+ * copies of anything. The alternative was threading one instance through
+ * `core.ts` into every module that emits, or a service locator, and neither is
+ * worth avoiding a stateless factory call.
+ */
+export function createActivitiesModule(migrationsDirectory) {
+    return {
+        id: 'activities',
+        requires: ['workspace'],
+        structural: true,
+        register(context) {
+            const service = createActivitiesService({ db: context.db });
+            context.schema(schema, migrationsDirectory);
+            context.routes((router) => {
+                mountActivitiesRoutes(router, { db: context.db, now: context.now, service });
+            });
+            registerActivitiesTools(context.mcp, service);
+            return Promise.resolve();
+        },
+    };
+}
+export { createActivityRecorder };
+//# sourceMappingURL=index.js.map

package/dist/modules/activities/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/activities/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AAEpD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,mBAA2B;IAChE,OAAO;QACL,EAAE,EAAE,YAAY;QAChB,QAAQ,EAAE,CAAC,WAAW,CAAC;QACvB,UAAU,EAAE,IAAI;QAEhB,QAAQ,CAAC,OAAO;YACd,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;YAE3D,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAE3C,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxB,qBAAqB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC9E,CAAC,CAAC,CAAA;YAEF,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAE7C,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAA"}

package/dist/modules/activities/recorder.d.ts

@@ -0,0 +1,53 @@
+import type { IdFactory } from '../../lib/ids.ts';
+import type { Queryable } from '../../runtime/transaction.ts';
+import type { Actor } from '../auth/actor.ts';
+import type { RecordTargetType } from '../recordTargets.ts';
+import type { ActivityKind } from './schema.ts';
+import type { ActivityWording } from './wording.ts';
+/**
+ * How a service writes history.
+ *
+ * The write goes through the caller's transaction, not through the event bus.
+ * The bus publishes after commit and its publication is not awaited
+ * (`runtime/events.ts`), which is right for a webhook and wrong for this: an
+ * activity is the record of what happened, so a change that commits while its
+ * activity is lost leaves a timeline that quietly disagrees with the data. Same
+ * transaction means both land or neither does.
+ *
+ * Services take this as a dependency rather than importing the repository, so a
+ * service can be built with a recorder that collects instead of writing.
+ */
+/** What happened, minus who did it and when. */
+export interface ActivityDraft extends ActivityWording {
+    readonly targetType: RecordTargetType;
+    readonly targetId: string;
+    readonly kind: ActivityKind;
+}
+/**
+ * Something that acts on the workspace without being anybody in it.
+ *
+ * A public form submit is the case this exists for: the request carries no
+ * credentials, so there is no `Actor` to resolve and no member to attribute the
+ * row to, but the timeline still has to say where it came from. `kind` keeps it
+ * a discriminated union with `Actor`, whose members are `session` and `api_key`.
+ */
+export interface SystemActor {
+    readonly kind: 'system';
+    /** What the timeline prints in place of a member's name: `Form`, `Gmail`. */
+    readonly label: string;
+}
+/** Who a timeline row is attributed to. */
+export type ActivityAuthor = Actor | SystemActor;
+/**
+ * @param workspaceId Passed rather than read off the author. Every caller has
+ *   already resolved it — through `requireWorkspaceId`, or from a form's
+ *   `publicKey` — and reaching for a nullable field here would need a default
+ *   that silently mis-files a row.
+ */
+export type ActivityRecorder = (db: Queryable, workspaceId: string, author: ActivityAuthor, draft: ActivityDraft) => Promise<void>;
+export interface ActivityRecorderDependencies {
+    readonly createId: IdFactory;
+    readonly now: () => Date;
+}
+export declare function createActivityRecorder(dependencies: ActivityRecorderDependencies): ActivityRecorder;
+//# sourceMappingURL=recorder.d.ts.map

package/dist/modules/activities/recorder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../../src/modules/activities/recorder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAE3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD;;;;;;;;;;;;GAYG;AAEH,gDAAgD;AAChD,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,WAAW,CAAA;AAEhD;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,aAAa,KACjB,OAAO,CAAC,IAAI,CAAC,CAAA;AAWlB,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;CACzB;AAgBD,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,4BAA4B,GACzC,gBAAgB,CAiBlB"}

package/dist/modules/activities/recorder.js

@@ -0,0 +1,36 @@
+import { actorMemberId } from '../auth/actor.js';
+import * as repository from './repository.js';
+/**
+ * The display name to show for a workspace key.
+ *
+ * A workspace key belongs to the workspace rather than to a person, so there is
+ * no member row to name. Anything else with no member behind it says so through
+ * a `SystemActor` and its own label.
+ */
+const WORKSPACE_KEY_LABEL = 'API key';
+/** The member row and the fallback label, exactly one of which is set. */
+function attribute(author) {
+    if (author.kind === 'system') {
+        return { memberId: null, label: author.label };
+    }
+    const memberId = actorMemberId(author);
+    return { memberId, label: memberId === null ? WORKSPACE_KEY_LABEL : null };
+}
+export function createActivityRecorder(dependencies) {
+    return async (db, workspaceId, author, draft) => {
+        const { memberId, label } = attribute(author);
+        await repository.insertActivity(db, {
+            id: dependencies.createId('activity'),
+            workspaceId,
+            targetType: draft.targetType,
+            targetId: draft.targetId,
+            kind: draft.kind,
+            actorMemberId: memberId,
+            actorLabel: label,
+            action: draft.action,
+            detail: draft.detail,
+            createdAt: dependencies.now(),
+        });
+    };
+}
+//# sourceMappingURL=recorder.js.map

package/dist/modules/activities/recorder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recorder.js","sourceRoot":"","sources":["../../../src/modules/activities/recorder.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAuD7C;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAOrC,0EAA0E;AAC1E,SAAS,SAAS,CAAC,MAAsB;IAIvC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAEtC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,YAA0C;IAE1C,OAAO,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAE7C,MAAM,UAAU,CAAC,cAAc,CAAC,EAAE,EAAE;YAClC,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;YACrC,WAAW;YACX,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,QAAQ;YACvB,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,YAAY,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}

package/dist/modules/activities/repository.d.ts

@@ -0,0 +1,52 @@
+import type { ListWindow, SortableFields } from '../../lib/pagination.ts';
+import type { Queryable } from '../../runtime/transaction.ts';
+import type { RecordTargetType } from '../recordTargets.ts';
+import { activities } from './schema.ts';
+export type ActivityRecord = typeof activities.$inferSelect;
+/** The writable column shape. The recorder builds one of these; nothing else knows the column names. */
+export type ActivityColumns = typeof activities.$inferInsert;
+/**
+ * Only `created_at`. An activity carries no other non-nullable value worth
+ * ordering by, and a keyset cannot seek past a null.
+ */
+export declare const ACTIVITY_SORTS: SortableFields<ActivityRecord>;
+export declare const DEFAULT_ACTIVITY_SORT = "-created_at";
+/** One `(target_type, target_id)` pair a timeline reads from. */
+export interface ActivityTarget {
+    readonly targetType: RecordTargetType;
+    readonly targetId: string;
+}
+export declare function insertActivity(db: Queryable, values: ActivityColumns): Promise<ActivityRecord>;
+/**
+ * The related records whose activity rolls up onto a person or company timeline.
+ *
+ * A deal moving to Proposal is the most useful thing on that company's timeline
+ * and it is not stored against the company. Which relations roll up was settled
+ * by the mockup (`activitiesFor` in `mockups/src/data/seed.ts`): deals,
+ * opportunities and partnerships for a company, and for a person only the two
+ * they can be attached to.
+ *
+ * Reads the pipeline tables directly rather than composing their repositories,
+ * which is the rule already set for a query spanning a relation
+ * (`architecture.md`).
+ *
+ * @returns The roll-up targets only. The caller adds the record's own.
+ */
+export declare function listRolledUpTargets(db: Queryable, workspaceId: string, targetType: RecordTargetType, targetId: string): Promise<ActivityTarget[]>;
+/**
+ * @param targets The record's own target plus its roll-up set. An empty list
+ *   answers no rows rather than every row in the workspace, which is what an
+ *   omitted condition would have meant.
+ * @returns Up to `window.fetchLimit` rows: one more than the page, so the caller
+ *   can tell there is a next one.
+ */
+export declare function listActivities(db: Queryable, workspaceId: string, targets: readonly ActivityTarget[], window: ListWindow<ActivityRecord>): Promise<ActivityRecord[]>;
+/**
+ * Removes every activity attached to a target.
+ *
+ * The target is polymorphic and carries no foreign key, so nothing in the
+ * database deletes these. The service that deletes the target calls this inside
+ * the same transaction (`schema.md`).
+ */
+export declare function deleteForTarget(db: Queryable, workspaceId: string, targetType: string, targetId: string): Promise<number>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/modules/activities/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../src/modules/activities/repository.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAI7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,MAAM,cAAc,GAAG,OAAO,UAAU,CAAC,YAAY,CAAA;AAE3D,wGAAwG;AACxG,MAAM,MAAM,eAAe,GAAG,OAAO,UAAU,CAAC,YAAY,CAAA;AAE5D;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,cAAc,CAAC,cAAc,CAEzD,CAAA;AAED,eAAO,MAAM,qBAAqB,gBAAgB,CAAA;AAElD,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,cAAc,CAAC,CAQzB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,EAAE,CAAC,CAkD3B;AA2BD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,GACjC,OAAO,CAAC,cAAc,EAAE,CAAC,CAa3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAajB"}

package/dist/modules/activities/repository.js

@@ -0,0 +1,127 @@
+import { and, eq, inArray, or, sql } from 'drizzle-orm';
+import { keysetCondition, orderByWindow, timestampSort } from '../../lib/pagination.js';
+import { dealPeople, deals } from '../deals/schema.js';
+import { opportunities } from '../opportunities/schema.js';
+import { partnershipPeople, partnerships } from '../partnerships/schema.js';
+import { activities } from './schema.js';
+/**
+ * Only `created_at`. An activity carries no other non-nullable value worth
+ * ordering by, and a keyset cannot seek past a null.
+ */
+export const ACTIVITY_SORTS = {
+    created_at: timestampSort(activities.createdAt, (activity) => activity.createdAt),
+};
+export const DEFAULT_ACTIVITY_SORT = '-created_at';
+export async function insertActivity(db, values) {
+    const [created] = await db.insert(activities).values(values).returning();
+    if (created === undefined) {
+        throw new Error(`Inserting activity ${values.id} returned no row`);
+    }
+    return created;
+}
+/**
+ * The related records whose activity rolls up onto a person or company timeline.
+ *
+ * A deal moving to Proposal is the most useful thing on that company's timeline
+ * and it is not stored against the company. Which relations roll up was settled
+ * by the mockup (`activitiesFor` in `mockups/src/data/seed.ts`): deals,
+ * opportunities and partnerships for a company, and for a person only the two
+ * they can be attached to.
+ *
+ * Reads the pipeline tables directly rather than composing their repositories,
+ * which is the rule already set for a query spanning a relation
+ * (`architecture.md`).
+ *
+ * @returns The roll-up targets only. The caller adds the record's own.
+ */
+export async function listRolledUpTargets(db, workspaceId, targetType, targetId) {
+    if (targetType === 'company') {
+        const [dealRows, opportunityRows, partnershipRows] = await Promise.all([
+            db
+                .select({ id: deals.id })
+                .from(deals)
+                .where(and(eq(deals.workspaceId, workspaceId), eq(deals.companyId, targetId))),
+            db
+                .select({ id: opportunities.id })
+                .from(opportunities)
+                .where(and(eq(opportunities.workspaceId, workspaceId), eq(opportunities.companyId, targetId))),
+            db
+                .select({ id: partnerships.id })
+                .from(partnerships)
+                .where(and(eq(partnerships.workspaceId, workspaceId), eq(partnerships.companyId, targetId))),
+        ]);
+        return [
+            ...dealRows.map((row) => ({ targetType: 'deal', targetId: row.id })),
+            ...opportunityRows.map((row) => ({ targetType: 'opportunity', targetId: row.id })),
+            ...partnershipRows.map((row) => ({ targetType: 'partnership', targetId: row.id })),
+        ];
+    }
+    if (targetType === 'person') {
+        // An opportunity has no people, so a person rolls up two relations, not three.
+        const [dealRows, partnershipRows] = await Promise.all([
+            db
+                .select({ id: deals.id })
+                .from(deals)
+                .innerJoin(dealPeople, eq(dealPeople.dealId, deals.id))
+                .where(and(eq(deals.workspaceId, workspaceId), eq(dealPeople.personId, targetId))),
+            db
+                .select({ id: partnerships.id })
+                .from(partnerships)
+                .innerJoin(partnershipPeople, eq(partnershipPeople.partnershipId, partnerships.id))
+                .where(and(eq(partnerships.workspaceId, workspaceId), eq(partnershipPeople.personId, targetId))),
+        ]);
+        return [
+            ...dealRows.map((row) => ({ targetType: 'deal', targetId: row.id })),
+            ...partnershipRows.map((row) => ({ targetType: 'partnership', targetId: row.id })),
+        ];
+    }
+    return [];
+}
+/**
+ * Grouped by target type, so the index on `(workspace_id, target_type,
+ * target_id)` stays usable for each group instead of degrading into a long list
+ * of independent pair comparisons.
+ */
+function matchesAnyTarget(targets) {
+    const idsByType = new Map();
+    for (const target of targets) {
+        const ids = idsByType.get(target.targetType);
+        if (ids === undefined) {
+            idsByType.set(target.targetType, [target.targetId]);
+        }
+        else {
+            ids.push(target.targetId);
+        }
+    }
+    return or(...[...idsByType].map(([targetType, ids]) => and(eq(activities.targetType, targetType), inArray(activities.targetId, ids))));
+}
+/**
+ * @param targets The record's own target plus its roll-up set. An empty list
+ *   answers no rows rather than every row in the workspace, which is what an
+ *   omitted condition would have meant.
+ * @returns Up to `window.fetchLimit` rows: one more than the page, so the caller
+ *   can tell there is a next one.
+ */
+export function listActivities(db, workspaceId, targets, window) {
+    return db
+        .select()
+        .from(activities)
+        .where(and(eq(activities.workspaceId, workspaceId), targets.length === 0 ? sql `false` : matchesAnyTarget(targets), keysetCondition(window, activities.id)))
+        .orderBy(...orderByWindow(window, activities.id))
+        .limit(window.fetchLimit);
+}
+/**
+ * Removes every activity attached to a target.
+ *
+ * The target is polymorphic and carries no foreign key, so nothing in the
+ * database deletes these. The service that deletes the target calls this inside
+ * the same transaction (`schema.md`).
+ */
+export async function deleteForTarget(db, workspaceId, targetType, targetId) {
+    const deleted = await db
+        .delete(activities)
+        .where(and(eq(activities.workspaceId, workspaceId), eq(activities.targetType, targetType), eq(activities.targetId, targetId)))
+        .returning({ id: activities.id });
+    return deleted.length;
+}
+//# sourceMappingURL=repository.js.map

package/dist/modules/activities/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/modules/activities/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAGvF,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOxC;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmC;IAC5D,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;CAClF,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAA;AAQlD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAa,EACb,MAAuB;IAEvB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAA;IAExE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAA;IACpE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAa,EACb,WAAmB,EACnB,UAA4B,EAC5B,QAAgB;IAEhB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrE,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;iBACxB,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAChF,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC;iBAChC,IAAI,CAAC,aAAa,CAAC;iBACnB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CACvF;YACH,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;iBAC/B,IAAI,CAAC,YAAY,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;SAC/F,CAAC,CAAA;QAEF,OAAO;YACL,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,MAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,aAAsB,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,aAAsB,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;SAC5F,CAAA;IACH,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,+EAA+E;QAC/E,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpD,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;iBACxB,IAAI,CAAC,KAAK,CAAC;iBACX,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;iBACtD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpF,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;iBAC/B,IAAI,CAAC,YAAY,CAAC;iBAClB,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;iBAClF,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CACzF;SACJ,CAAC,CAAA;QAEF,OAAO;YACL,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,MAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,aAAsB,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;SAC5F,CAAA;IACH,CAAC;IAED,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAkC;IAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEvD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAE5C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QACrD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CACP,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,CAC1C,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAC9E,CACF,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,EAAa,EACb,WAAmB,EACnB,OAAkC,EAClC,MAAkC;IAElC,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EACvC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAC7D,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CACvC,CACF;SACA,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;SAChD,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAa,EACb,WAAmB,EACnB,UAAkB,EAClB,QAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,UAAU,CAAC;SAClB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EACvC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,EACrC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAClC,CACF;SACA,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;IAEnC,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC"}

package/dist/modules/activities/routes.d.ts

@@ -0,0 +1,17 @@
+import type { Hono } from 'hono';
+import type { CredentialDependencies } from '../auth/credentials.ts';
+import type { ActivitiesService, ActivityView } from './service.ts';
+/**
+ * `/v1/activities`, read-only.
+ *
+ * One list endpoint, and it always names a record. A workspace-wide feed is a
+ * different question with a different shape, and answering it accidentally
+ * through an omitted filter is how a client ends up paging the entire history of
+ * a workspace to render one sidebar.
+ */
+export interface ActivitiesRoutesDependencies extends CredentialDependencies {
+    readonly service: ActivitiesService;
+}
+export declare function activityResponse(activity: ActivityView): Record<string, unknown>;
+export declare function mountActivitiesRoutes(router: Hono, dependencies: ActivitiesRoutesDependencies): void;
+//# sourceMappingURL=routes.d.ts.map

package/dist/modules/activities/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/modules/activities/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAA;AAMzC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAGpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEnE;;;;;;;GAOG;AAEH,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;CACpC;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYhF;AA0BD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,IAAI,EACZ,YAAY,EAAE,4BAA4B,GACzC,IAAI,CAYN"}