@miragon/pulse-widget-shell 0.0.0-bootstrap.0 → 0.21.0

package/dist/profile-slice.js

@@ -0,0 +1,73 @@
+import { resolveProfileKey } from "./profile.js";
+/**
+ * The `profile.modules.<module>` slice contract, shared by every module so
+ * the subtle rules cannot drift: WHOSE record a save touches (the canonical
+ * keyless refusal), HOW a slice patch is saved (the patch alone, merged by
+ * the store over the RAW stored slice under its lock, so foreign and
+ * concurrently saved fields survive), and HOW a slice reads (fail-soft per
+ * FIELD, so one bad value cannot reset the rest).
+ */
+/**
+ * Fail-soft slice read: absent slices and garbage degrade to the schema's
+ * defaults — and degradation is per FIELD, not per slice: a single invalid
+ * value (say, one written by a newer build and then rolled back) drops to its
+ * own default while every other saved preference survives. Fields the schema
+ * doesn't know stay out of the VIEW but are preserved in storage: a save
+ * ({@link saveModuleSlice}) merges over the raw stored slice.
+ *
+ * Read-side only — save inputs keep validating loudly at the tool boundary;
+ * a write must never silently coerce.
+ */
+export function parseModuleSlice(schema, slice) {
+    const whole = schema.safeParse(slice ?? {});
+    if (whole.success)
+        return whole.data;
+    const raw = typeof slice === "object" && slice !== null ? slice : {};
+    const kept = {};
+    for (const [key, field] of Object.entries(schema.shape)) {
+        const value = raw[key];
+        if (value === undefined)
+            continue;
+        if (field.safeParse(value).success)
+            kept[key] = value;
+    }
+    const recovered = schema.safeParse(kept);
+    return recovered.success ? recovered.data : schema.parse({});
+}
+/**
+ * Resolve the profile key for a durable write, refusing without one. Settings
+ * are saved per signed-in user: a request without OAuth resolves no key (see
+ * `resolveProfileKey`) — writing anyway would silently share one record across
+ * unrelated callers, so every module's save tool throws this same,
+ * operator-actionable error instead.
+ */
+export function requireProfileKey(ctx) {
+    const key = resolveProfileKey(ctx);
+    if (!key) {
+        throw new Error("No caller identity to save the profile under — settings are saved per signed-in user, so the server needs MCP_OAUTH.");
+    }
+    return key;
+}
+/**
+ * Persist a partial update of `module`'s slice: hand the store the PATCH
+ * alone, never a slice pre-read outside the store's lock. Every
+ * `ProfileStore` merges a `modules.<module>` patch one level deep over the
+ * RAW stored slice INSIDE its per-key serialization (the postgres
+ * transaction lock, the filesystem store's per-key mutex, the in-memory
+ * store's synchronous merge), so a concurrent save of another field in the
+ * same slice (or of another module's slice) survives, fields a newer build
+ * wrote survive, and no defaults are materialized into storage. A field set
+ * to `undefined` in the patch CLEARS the stored value; an absent field keeps
+ * it.
+ *
+ * Returns the saved slice, raw (the caller parses it fail-soft for its
+ * report): read off the record `save` returns (every shipped store returns
+ * it), or read back when a custom port implementation returns nothing.
+ */
+export async function saveModuleSlice(store, key, module, patch, opts) {
+    const saved = await store.save(key, { modules: { [module]: patch } }, opts);
+    const record = isProfileSlice(saved) ? saved : await store.get(key);
+    return record?.modules?.[module];
+}
+const isProfileSlice = (value) => typeof value === "object" && value !== null && "modules" in value;
+//# sourceMappingURL=profile-slice.js.map

package/dist/profile-slice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-slice.js","sourceRoot":"","sources":["../src/profile-slice.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAGhD;;;;;;;GAOG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAsB,EACtB,KAAc;IAEd,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAC3C,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAA;IACpC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IACjG,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAK,KAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACtE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAa;IAC7C,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA8E,EAC9E,GAAW,EACX,MAAc,EACd,KAA8B,EAC9B,IAA0B;IAE1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;IAC3E,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACnE,OAAO,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,KAAc,EAAyB,EAAE,CAC/D,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,IAAI,KAAK,CAAA"}

package/dist/profile-slice.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=profile-slice.test.d.ts.map

package/dist/profile-slice.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-slice.test.d.ts","sourceRoot":"","sources":["../src/profile-slice.test.ts"],"names":[],"mappings":""}

package/dist/profile-slice.test.js

@@ -0,0 +1,73 @@
+import { describe, expect, it, vi } from "vitest";
+import { z } from "zod";
+import { parseModuleSlice, requireProfileKey, saveModuleSlice } from "./profile-slice.js";
+import { runWithMcpRequestInfo } from "./request-context.js";
+describe("requireProfileKey", () => {
+    it("resolves the anonymous key for an explicitly declared local caller", () => {
+        expect(runWithMcpRequestInfo({ anonymousCaller: true }, () => requireProfileKey())).toBe("anonymous");
+    });
+    it("resolves the auth user id when the request carries one", () => {
+        expect(runWithMcpRequestInfo({ authUserId: "user-7" }, () => requireProfileKey())).toBe("user-7");
+    });
+    it("refuses an identity-less HTTP request with the operator-actionable error", () => {
+        expect(() => runWithMcpRequestInfo({}, () => requireProfileKey())).toThrow("No caller identity to save the profile under — settings are saved per signed-in user, so the server needs MCP_OAUTH.");
+    });
+    it("refuses without any request context (a missing middleware install) — never 'anonymous'", () => {
+        expect(() => requireProfileKey()).toThrow(/No caller identity/);
+    });
+});
+describe("saveModuleSlice", () => {
+    it("hands the store the patch alone and reports the slice off the saved record", async () => {
+        const save = vi.fn(() => Promise.resolve({ modules: { notes: { sortOrder: "desc", futureField: 42 } } }));
+        const get = vi.fn();
+        const slice = await saveModuleSlice({ get, save }, "k", "notes", { sortOrder: "desc" }, {
+            userId: "user-7",
+        });
+        expect(save).toHaveBeenCalledWith("k", { modules: { notes: { sortOrder: "desc" } } }, { userId: "user-7" });
+        // No pre-read: a slice read outside the store's lock would be stale.
+        expect(get).not.toHaveBeenCalled();
+        expect(slice).toEqual({ sortOrder: "desc", futureField: 42 });
+    });
+    it("reads the slice back when a custom store's save returns nothing", async () => {
+        const save = vi.fn(() => Promise.resolve(undefined));
+        const get = vi.fn(() => Promise.resolve({ modules: { notes: { sortOrder: "asc" } } }));
+        expect(await saveModuleSlice({ get, save }, "k", "notes", { sortOrder: "asc" })).toEqual({
+            sortOrder: "asc",
+        });
+        expect(get).toHaveBeenCalledWith("k");
+    });
+});
+describe("parseModuleSlice", () => {
+    const schema = z.object({
+        sortOrder: z.enum(["asc", "desc"]).default("asc"),
+        pageSize: z.number().int().min(1).optional(),
+        tags: z.array(z.string()).default([]),
+    });
+    it("parses a valid slice and applies defaults for absent fields", () => {
+        expect(parseModuleSlice(schema, { pageSize: 25 })).toEqual({
+            sortOrder: "asc",
+            pageSize: 25,
+            tags: [],
+        });
+    });
+    it("degrades absent and garbage slices to the full defaults", () => {
+        const defaults = { sortOrder: "asc", tags: [] };
+        expect(parseModuleSlice(schema, undefined)).toEqual(defaults);
+        expect(parseModuleSlice(schema, "garbage")).toEqual(defaults);
+        expect(parseModuleSlice(schema, 42)).toEqual(defaults);
+    });
+    it("recovers per FIELD: one invalid value keeps every other saved preference", () => {
+        // The failure mode this guards: a newer build writes a value this build's
+        // schema rejects; resetting the WHOLE slice would silently drop unrelated
+        // preferences (e.g. engine curation next to a bad preferredRole).
+        expect(parseModuleSlice(schema, { sortOrder: "newest-first", pageSize: 25, tags: ["a"] })).toEqual({ sortOrder: "asc", pageSize: 25, tags: ["a"] });
+    });
+    it("keeps unknown fields out of the view (the store's raw merge preserves them)", () => {
+        expect(parseModuleSlice(schema, { pageSize: 5, futureField: 42 })).toEqual({
+            sortOrder: "asc",
+            pageSize: 5,
+            tags: [],
+        });
+    });
+});
+//# sourceMappingURL=profile-slice.test.js.map

package/dist/profile-slice.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-slice.test.js","sourceRoot":"","sources":["../src/profile-slice.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAG5D,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,qBAAqB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CACtF,WAAW,CACZ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,qBAAqB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CACrF,QAAQ,CACT,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,CACxE,sHAAsH,CACvH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAqC,GAAG,EAAE,CAC1D,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAChF,CAAA;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,EAAwB,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,EAAE,GAAG,EAAE,IAAI,EAAE,EACb,GAAG,EACH,OAAO,EACP,EAAE,SAAS,EAAE,MAAM,EAAE,EACrB;YACE,MAAM,EAAE,QAAQ;SACjB,CACF,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAC/B,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAC7C,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAA;QACD,qEAAqE;QACrE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAqC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QACxF,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,CAAuB,GAAG,EAAE,CAC3C,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAC9D,CAAA;QACD,MAAM,CAAC,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACvF,SAAS,EAAE,KAAK;SACjB,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACtB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC5C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACtC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,EAAE;SACT,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;QAC/C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC7D,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC7D,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,0EAA0E;QAC1E,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,CACJ,gBAAgB,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CACnF,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACzE,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,EAAE;SACT,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/profile-store-env.d.ts

@@ -0,0 +1,34 @@
+import { type ProfileStore } from "./profile-store.js";
+/**
+ * The non-database profile store selection every composition root shares:
+ * filesystem-backed when `MCP_PROFILE_DIR` is set (survives restarts),
+ * in-memory otherwise. Roots with a database extend the precedence themselves
+ * (`DATABASE_URL` → `createPostgresProfileStore` beats this — see the stock
+ * app's `initRuntime`); the factories stay pure and injectable.
+ */
+export declare function profileStoreFromEnv(env?: NodeJS.ProcessEnv): ProfileStore;
+/** Where a composition root keeps a store. */
+export type PersistenceBackend = "postgres" | "filesystem" | "memory";
+/** The backend each store selected at boot. */
+export interface PersistenceSelection {
+    profiles: PersistenceBackend;
+    /** Omitted when the server registers no dashboard builder (`frameworkWritesAllowed`). */
+    dashboards?: PersistenceBackend;
+}
+/** The non-database selection {@link profileStoreFromEnv} and the dashboard knob make. */
+export declare function persistenceFromEnv(env?: NodeJS.ProcessEnv): Required<PersistenceSelection>;
+/**
+ * Announce the selected persistence on EVERY boot path — nobody should have
+ * to infer from silence that settings are volatile — and warn loudly when a
+ * production process (`NODE_ENV=production`, set by the Docker images) keeps a
+ * store in memory: every restart, redeploy or scale-to-zero stop then
+ * silently drops saved settings or dashboards. A warning, not a boot failure:
+ * failing would break every deployment that accepts volatile settings today.
+ * `remedy` names the knobs THIS composition root offers.
+ */
+export declare function announcePersistence(selection: PersistenceSelection, options?: {
+    env?: NodeJS.ProcessEnv;
+    label?: string;
+    remedy?: string;
+}): void;
+//# sourceMappingURL=profile-store-env.d.ts.map

package/dist/profile-store-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-store-env.d.ts","sourceRoot":"","sources":["../src/profile-store-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAA;AAE3B;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAItF;AAED,8CAA8C;AAC9C,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,CAAA;AAErE,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,yFAAyF;IACzF,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,QAAQ,CAAC,oBAAoB,CAAC,CAKhC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,oBAAoB,EAC/B,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACzE,IAAI,CAiBN"}

package/dist/profile-store-env.js

@@ -0,0 +1,44 @@
+import { createFileSystemProfileStore, createInMemoryProfileStore, } from "./profile-store.js";
+/**
+ * The non-database profile store selection every composition root shares:
+ * filesystem-backed when `MCP_PROFILE_DIR` is set (survives restarts),
+ * in-memory otherwise. Roots with a database extend the precedence themselves
+ * (`DATABASE_URL` → `createPostgresProfileStore` beats this — see the stock
+ * app's `initRuntime`); the factories stay pure and injectable.
+ */
+export function profileStoreFromEnv(env = process.env) {
+    return env.MCP_PROFILE_DIR
+        ? createFileSystemProfileStore({ dir: env.MCP_PROFILE_DIR })
+        : createInMemoryProfileStore();
+}
+/** The non-database selection {@link profileStoreFromEnv} and the dashboard knob make. */
+export function persistenceFromEnv(env = process.env) {
+    return {
+        profiles: env.MCP_PROFILE_DIR ? "filesystem" : "memory",
+        dashboards: env.MCP_DASHBOARD_DIR ? "filesystem" : "memory",
+    };
+}
+/**
+ * Announce the selected persistence on EVERY boot path — nobody should have
+ * to infer from silence that settings are volatile — and warn loudly when a
+ * production process (`NODE_ENV=production`, set by the Docker images) keeps a
+ * store in memory: every restart, redeploy or scale-to-zero stop then
+ * silently drops saved settings or dashboards. A warning, not a boot failure:
+ * failing would break every deployment that accepts volatile settings today.
+ * `remedy` names the knobs THIS composition root offers.
+ */
+export function announcePersistence(selection, options = {}) {
+    const { env = process.env, label = "persistence", remedy = "Set MCP_PROFILE_DIR / MCP_DASHBOARD_DIR to directories on a persistent volume.", } = options;
+    const dashboards = selection.dashboards ? `, dashboards=${selection.dashboards}` : "";
+    console.log(`[${label}] persistence: profiles=${selection.profiles}${dashboards}`);
+    if (env.NODE_ENV !== "production")
+        return;
+    const volatile = [
+        ...(selection.profiles === "memory" ? ["user profiles"] : []),
+        ...(selection.dashboards === "memory" ? ["saved dashboards"] : []),
+    ];
+    if (volatile.length === 0)
+        return;
+    console.warn(`[${label}] WARNING: ${volatile.join(" and ")} are kept IN MEMORY in a production process — every restart, redeploy or scale-to-zero stop silently drops them. ${remedy}`);
+}
+//# sourceMappingURL=profile-store-env.js.map

package/dist/profile-store-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-store-env.js","sourceRoot":"","sources":["../src/profile-store-env.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAE3B,MAAM,oBAAoB,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,OAAO,GAAG,CAAC,eAAe;QACxB,CAAC,CAAC,4BAA4B,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC;QAC5D,CAAC,CAAC,0BAA0B,EAAE,CAAA;AAClC,CAAC;AAYD,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAChC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;QACvD,UAAU,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;KAC5D,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAA+B,EAC/B,UAAwE,EAAE;IAE1E,MAAM,EACJ,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,KAAK,GAAG,aAAa,EACrB,MAAM,GAAG,gFAAgF,GAC1F,GAAG,OAAO,CAAA;IACX,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACrF,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,2BAA2B,SAAS,CAAC,QAAQ,GAAG,UAAU,EAAE,CAAC,CAAA;IAClF,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAM;IACzC,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IACjC,OAAO,CAAC,IAAI,CACV,IAAI,KAAK,cAAc,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oHAAoH,MAAM,EAAE,CAC1K,CAAA;AACH,CAAC"}

package/dist/profile-store-env.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=profile-store-env.test.d.ts.map

package/dist/profile-store-env.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-store-env.test.d.ts","sourceRoot":"","sources":["../src/profile-store-env.test.ts"],"names":[],"mappings":""}

package/dist/profile-store-env.test.js

@@ -0,0 +1,69 @@
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { describe, expect, it, vi } from "vitest";
+import { announcePersistence, persistenceFromEnv, profileStoreFromEnv, } from "./profile-store-env.js";
+describe("persistenceFromEnv", () => {
+    it("reports the non-database selection per store", () => {
+        expect(persistenceFromEnv({})).toEqual({ profiles: "memory", dashboards: "memory" });
+        expect(persistenceFromEnv({ MCP_PROFILE_DIR: "/p", MCP_DASHBOARD_DIR: "/d" })).toEqual({
+            profiles: "filesystem",
+            dashboards: "filesystem",
+        });
+    });
+});
+describe("announcePersistence", () => {
+    const capture = () => ({
+        log: vi.spyOn(console, "log").mockImplementation(() => { }),
+        warn: vi.spyOn(console, "warn").mockImplementation(() => { }),
+    });
+    it("logs the selected backends on every path", () => {
+        const { log, warn } = capture();
+        announcePersistence({ profiles: "postgres", dashboards: "postgres" }, { env: { NODE_ENV: "production" }, label: "root" });
+        expect(log).toHaveBeenCalledWith("[root] persistence: profiles=postgres, dashboards=postgres");
+        expect(warn).not.toHaveBeenCalled();
+        vi.restoreAllMocks();
+    });
+    it("warns LOUDLY when a production process keeps a store in memory — naming each", () => {
+        const { warn } = capture();
+        announcePersistence({ profiles: "memory", dashboards: "memory" }, { env: { NODE_ENV: "production" }, label: "root", remedy: "Set DATABASE_URL." });
+        expect(warn).toHaveBeenCalledOnce();
+        expect(warn.mock.calls[0][0]).toBe("[root] WARNING: user profiles and saved dashboards are kept IN MEMORY in a production process — every restart, redeploy or scale-to-zero stop silently drops them. Set DATABASE_URL.");
+        announcePersistence({ profiles: "filesystem", dashboards: "memory" }, { env: { NODE_ENV: "production" } });
+        expect(warn.mock.calls[1][0]).toMatch(/^\[persistence\] WARNING: saved dashboards are kept/);
+        expect(warn.mock.calls[1][0]).toContain("MCP_PROFILE_DIR / MCP_DASHBOARD_DIR");
+        vi.restoreAllMocks();
+    });
+    it("leaves dashboards out entirely when the server keeps none", () => {
+        const { log, warn } = capture();
+        announcePersistence({ profiles: "memory" }, { env: { NODE_ENV: "production" } });
+        expect(log).toHaveBeenCalledWith("[persistence] persistence: profiles=memory");
+        expect(warn.mock.calls[0][0]).toMatch(/WARNING: user profiles are kept IN MEMORY/);
+        announcePersistence({ profiles: "filesystem" }, { env: { NODE_ENV: "production" } });
+        expect(warn).toHaveBeenCalledOnce();
+        vi.restoreAllMocks();
+    });
+    it("stays quiet outside production (dev, tests)", () => {
+        const { warn } = capture();
+        announcePersistence({ profiles: "memory", dashboards: "memory" }, { env: {} });
+        announcePersistence({ profiles: "memory", dashboards: "memory" }, { env: { NODE_ENV: "development" } });
+        expect(warn).not.toHaveBeenCalled();
+        vi.restoreAllMocks();
+    });
+});
+describe("profileStoreFromEnv", () => {
+    it("selects the filesystem store when MCP_PROFILE_DIR is set (records persist)", async () => {
+        const dir = await mkdtemp(path.join(tmpdir(), "profile-env-"));
+        const store = profileStoreFromEnv({ MCP_PROFILE_DIR: dir });
+        await store.save("user-1", { language: "de" });
+        // A SECOND store over the same dir sees the record — proof it hit disk.
+        expect((await profileStoreFromEnv({ MCP_PROFILE_DIR: dir }).get("user-1"))?.language).toBe("de");
+    });
+    it("falls back to the in-memory store without the env knob", async () => {
+        const store = profileStoreFromEnv({});
+        await store.save("user-1", { language: "de" });
+        // A second instance shares nothing — proof it stayed in-process.
+        expect(await profileStoreFromEnv({}).get("user-1")).toBeUndefined();
+    });
+});
+//# sourceMappingURL=profile-store-env.test.js.map

package/dist/profile-store-env.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-store-env.test.js","sourceRoot":"","sources":["../src/profile-store-env.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,wBAAwB,CAAA;AAE/B,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;QACpF,MAAM,CAAC,kBAAkB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACrF,QAAQ,EAAE,YAAY;YACtB,UAAU,EAAE,YAAY;SACzB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;QACrB,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;QAC1D,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;KAC7D,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAA;QAC/B,mBAAmB,CACjB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,EAChD,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CACnD,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,4DAA4D,CAAC,CAAA;QAC9F,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QACnC,EAAE,CAAC,eAAe,EAAE,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAA;QAC1B,mBAAmB,CACjB,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAC5C,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAChF,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAA;QACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAChC,sLAAsL,CACvL,CAAA;QAED,mBAAmB,CACjB,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,EAChD,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CACpC,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAA;QAC5F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAA;QAC9E,EAAE,CAAC,eAAe,EAAE,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAA;QAC/B,mBAAmB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QAChF,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,4CAA4C,CAAC,CAAA;QAC9E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAA;QAClF,mBAAmB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QACpF,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAA;QACnC,EAAE,CAAC,eAAe,EAAE,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAA;QAC1B,mBAAmB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9E,mBAAmB,CACjB,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAC5C,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,CACrC,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QACnC,EAAE,CAAC,eAAe,EAAE,CAAA;IACtB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3D,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,wEAAwE;QACxE,MAAM,CAAC,CAAC,MAAM,mBAAmB,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAA;QACrC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,iEAAiE;QACjE,MAAM,CAAC,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACrE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/profile-store-postgres.d.ts

@@ -0,0 +1,33 @@
+import type postgres from "postgres";
+import { type ProfileStore } from "./profile-store.js";
+/**
+ * DDL owned by this store, executed by the composition root's migration runner
+ * (which tracks applied names in its `schema_migrations` table). The full
+ * profile record lives in one JSONB column — it is tiny (<1 KB) and its shape
+ * is governed by `profileRecordSchema`/`schemaVersion`, not by table columns.
+ * `user_id` mirrors the record's owner (the OAuth caller; NULL for the
+ * declared `anonymous` record).
+ */
+export declare const PROFILE_STORE_MIGRATIONS: ReadonlyArray<{
+    name: string;
+    statements: readonly string[];
+}>;
+/**
+ * Profiles stored one row per key in the `user_profiles` table. Selected when
+ * `DATABASE_URL` is set (see the composition root's persistence wiring); the
+ * caller owns the `sql` client's lifecycle, so this package carries no runtime
+ * dependency on the driver.
+ *
+ * Reads share the filesystem store's per-field fail-soft gate
+ * (`parseStoredProfile`): a value this build cannot validate degrades only its
+ * own field, and a newer build's row reads best-effort. Saves run the shared
+ * `mergeStoredProfile` over the RAW JSONB inside a per-key locked
+ * transaction, so concurrent partial updates of the same key serialize
+ * instead of losing fields, and nothing a newer replica wrote is dropped —
+ * safe for multiple server instances (and mixed versions) sharing one
+ * database.
+ */
+export declare function createPostgresProfileStore(options: {
+    sql: postgres.Sql;
+}): ProfileStore;
+//# sourceMappingURL=profile-store-postgres.d.ts.map

package/dist/profile-store-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-store-postgres.d.ts","sourceRoot":"","sources":["../src/profile-store-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAA;AAEpC,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,aAAa,CAAC;IACnD,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B,CAYA,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAA;CAAE,GAAG,YAAY,CAsDvF"}

package/dist/profile-store-postgres.js

@@ -0,0 +1,87 @@
+import { parseStoredProfile } from "./profile-migrations.js";
+import { mergeStoredProfile } from "./profile-store.js";
+/**
+ * DDL owned by this store, executed by the composition root's migration runner
+ * (which tracks applied names in its `schema_migrations` table). The full
+ * profile record lives in one JSONB column — it is tiny (<1 KB) and its shape
+ * is governed by `profileRecordSchema`/`schemaVersion`, not by table columns.
+ * `user_id` mirrors the record's owner (the OAuth caller; NULL for the
+ * declared `anonymous` record).
+ */
+export const PROFILE_STORE_MIGRATIONS = [
+    {
+        name: "001_user_profiles",
+        statements: [
+            `CREATE TABLE IF NOT EXISTS user_profiles (
+        key TEXT PRIMARY KEY,
+        user_id TEXT,
+        profile JSONB NOT NULL,
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )`,
+        ],
+    },
+];
+/**
+ * Profiles stored one row per key in the `user_profiles` table. Selected when
+ * `DATABASE_URL` is set (see the composition root's persistence wiring); the
+ * caller owns the `sql` client's lifecycle, so this package carries no runtime
+ * dependency on the driver.
+ *
+ * Reads share the filesystem store's per-field fail-soft gate
+ * (`parseStoredProfile`): a value this build cannot validate degrades only its
+ * own field, and a newer build's row reads best-effort. Saves run the shared
+ * `mergeStoredProfile` over the RAW JSONB inside a per-key locked
+ * transaction, so concurrent partial updates of the same key serialize
+ * instead of losing fields, and nothing a newer replica wrote is dropped —
+ * safe for multiple server instances (and mixed versions) sharing one
+ * database.
+ */
+export function createPostgresProfileStore(options) {
+    const { sql } = options;
+    return {
+        async get(key) {
+            const rows = await sql `
+        SELECT profile FROM user_profiles WHERE key = ${key}
+      `;
+            return parseStoredProfile(rows[0]?.profile, key);
+        },
+        async save(key, input, opts) {
+            return await sql.begin(async (tx) => {
+                // Advisory lock, not just SELECT…FOR UPDATE: a row that doesn't exist
+                // yet cannot be row-locked, so two concurrent FIRST saves of the same
+                // key would otherwise both merge over defaults and the second upsert
+                // would silently drop the first one's fields. The per-key transaction
+                // lock serializes creates and updates alike (same primitive as the
+                // app's migration runner).
+                await tx `SELECT pg_advisory_xact_lock(hashtextextended('user_profiles:' || ${key}, 0))`;
+                const rows = await tx `
+          SELECT profile FROM user_profiles WHERE key = ${key} FOR UPDATE
+        `;
+                const { document, record } = mergeStoredProfile(key, rows[0]?.profile, input, new Date().toISOString(), opts);
+                // sql.json, not JSON.stringify: postgres.js serializes parameters by
+                // the server-described type, and the jsonb serializer stringifies
+                // itself — a pre-stringified value gets double-encoded into a jsonb
+                // string scalar.
+                await tx `
+          INSERT INTO user_profiles (key, user_id, profile, updated_at)
+          VALUES (
+            ${key},
+            ${record.userId ?? null},
+            ${tx.json(document)},
+            ${record.updatedAt}
+          )
+          ON CONFLICT (key) DO UPDATE SET
+            user_id = EXCLUDED.user_id,
+            profile = EXCLUDED.profile,
+            updated_at = EXCLUDED.updated_at
+        `;
+                return record;
+            });
+        },
+        async delete(key) {
+            const result = await sql `DELETE FROM user_profiles WHERE key = ${key}`;
+            return result.count > 0;
+        },
+    };
+}
+//# sourceMappingURL=profile-store-postgres.js.map

package/dist/profile-store-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-store-postgres.js","sourceRoot":"","sources":["../src/profile-store-postgres.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAA;AAE1E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAGhC;IACH;QACE,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE;YACV;;;;;QAKE;SACH;KACF;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA8B;IACvE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAEvB,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,IAAI,GAAG,MAAM,GAAG,CAAwB;wDACI,GAAG;OACpD,CAAA;YACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAClD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI;YACzB,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAClC,sEAAsE;gBACtE,sEAAsE;gBACtE,qEAAqE;gBACrE,sEAAsE;gBACtE,mEAAmE;gBACnE,2BAA2B;gBAC3B,MAAM,EAAE,CAAA,qEAAqE,GAAG,OAAO,CAAA;gBACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAwB;0DACK,GAAG;SACpD,CAAA;gBACD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAC7C,GAAG,EACH,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAChB,KAAK,EACL,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,IAAI,CACL,CAAA;gBACD,qEAAqE;gBACrE,kEAAkE;gBAClE,oEAAoE;gBACpE,iBAAiB;gBACjB,MAAM,EAAE,CAAA;;;cAGF,GAAG;cACH,MAAM,CAAC,MAAM,IAAI,IAAI;cACrB,EAAE,CAAC,IAAI,CAAC,QAA8B,CAAC;cACvC,MAAM,CAAC,SAAS;;;;;;SAMrB,CAAA;gBACD,OAAO,MAAM,CAAA;YACf,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,MAAM,GAAG,MAAM,GAAG,CAAA,yCAAyC,GAAG,EAAE,CAAA;YACtE,OAAO,MAAM,CAAC,KAAK,GAAG,CAAC,CAAA;QACzB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/profile-store-raw.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=profile-store-raw.test.d.ts.map

package/dist/profile-store-raw.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-store-raw.test.d.ts","sourceRoot":"","sources":["../src/profile-store-raw.test.ts"],"names":[],"mappings":""}