@storyshelf/core 0.6.1 → 0.7.0

package/dist/models/credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.mjs","names":[],"sources":["../../src/models/credentials.ts"],"sourcesContent":["/**\n * Stored-credential inventory and re-encryption for secret rotation.\n *\n * Webhook secrets, git-provider tokens, and notification-channel secrets are\n * encrypted under `ShelfConfig.secret`. After a rotation the old secret stays\n * available as `previousSecret` (decrypt-only); {@link probeCredentials} reports\n * which key each row needs and {@link reencryptCredentials} moves rows to the\n * current key. Neither returns or logs credential values.\n */\nimport type { DatabaseAdapter } from \"../adapters/database.ts\";\nimport { decryptWithKey, encrypt, type SecretKeys } from \"../utils/encrypt.ts\";\n\n/** Tables that hold encrypted credentials, with the column to read. */\nconst SOURCES = [\n  { name: \"webhooks\", table: \"webhooks\", column: \"secretEncrypted\" },\n  { name: \"git status tokens\", table: \"projectStatusConfigs\", column: \"tokenEncrypted\" },\n  { name: \"notification channels\", table: \"notificationChannels\", column: \"secretEncrypted\" },\n] as const;\n\n/** A row no configured key can decrypt. */\nexport interface UnreadableCredential {\n  source: string;\n  id: string;\n}\n\n/** Which key each stored credential needs. */\nexport interface CredentialProbe {\n  total: number;\n  /** Rows readable with the current secret. */\n  current: number;\n  /** Rows only readable with `previousSecret`; run re-encryption. */\n  previous: number;\n  unreadable: UnreadableCredential[];\n}\n\n/** Outcome of {@link reencryptCredentials}. */\nexport interface ReencryptResult {\n  reencrypted: number;\n  failed: number;\n  unreadable: UnreadableCredential[];\n}\n\ninterface StoredCredential {\n  source: (typeof SOURCES)[number];\n  id: string;\n  ciphertext: string;\n}\n\n/** Every non-empty encrypted value across the credential tables. */\nasync function storedCredentials(db: DatabaseAdapter): Promise<StoredCredential[]> {\n  const lists = await Promise.all(\n    SOURCES.map(async (source) => {\n      const rows = (await db.list(db.tables[source.table])) as unknown as (Record<\n        string,\n        unknown\n      > & {\n        id: string;\n      })[];\n      return rows.flatMap((row) => {\n        const ciphertext = row[source.column];\n        return typeof ciphertext === \"string\" && ciphertext !== \"\"\n          ? [{ source, id: row.id, ciphertext }]\n          : [];\n      });\n    }),\n  );\n  return lists.flat();\n}\n\nfunction classify(keys: SecretKeys, ciphertext: string): \"current\" | \"previous\" | \"unreadable\" {\n  try {\n    return decryptWithKey(keys, ciphertext).keyUsed;\n  } catch {\n    return \"unreadable\";\n  }\n}\n\n/** Count stored credentials by the key they need; read-only. */\nexport async function probeCredentials(\n  db: DatabaseAdapter,\n  keys: SecretKeys,\n): Promise<CredentialProbe> {\n  const stored = await storedCredentials(db);\n  const probe: CredentialProbe = { total: stored.length, current: 0, previous: 0, unreadable: [] };\n  for (const item of stored) {\n    const state = classify(keys, item.ciphertext);\n    if (state === \"unreadable\") {\n      probe.unreadable.push({ source: item.source.name, id: item.id });\n    } else {\n      probe[state] += 1;\n    }\n  }\n  return probe;\n}\n\n/**\n * Re-encrypt every credential still under `keys.previous` with `keys.current`.\n * Idempotent; unreadable rows are left untouched and reported, and one failed\n * write does not stop the rest.\n */\nexport async function reencryptCredentials(\n  db: DatabaseAdapter,\n  keys: SecretKeys,\n): Promise<ReencryptResult> {\n  const result: ReencryptResult = { reencrypted: 0, failed: 0, unreadable: [] };\n  const outcomes = await Promise.all(\n    (await storedCredentials(db)).map(async (item) => await reencryptOne(db, keys, item)),\n  );\n  for (const outcome of outcomes) {\n    if (outcome.state === \"unreadable\") {\n      result.unreadable.push(outcome.row);\n    } else if (outcome.state !== \"skipped\") {\n      result[outcome.state] += 1;\n    }\n  }\n  return result;\n}\n\ntype Outcome =\n  | { state: \"reencrypted\" | \"failed\" | \"skipped\" }\n  | { state: \"unreadable\"; row: UnreadableCredential };\n\nasync function reencryptOne(\n  db: DatabaseAdapter,\n  keys: SecretKeys,\n  item: StoredCredential,\n): Promise<Outcome> {\n  let plain: { plaintext: string; keyUsed: string };\n  try {\n    plain = decryptWithKey(keys, item.ciphertext);\n  } catch {\n    return { state: \"unreadable\", row: { source: item.source.name, id: item.id } };\n  }\n  if (plain.keyUsed === \"current\") {\n    return { state: \"skipped\" };\n  }\n  try {\n    await db.update(db.tables[item.source.table], item.id, {\n      [item.source.column]: encrypt(keys.current, plain.plaintext),\n    });\n    return { state: \"reencrypted\" };\n  } catch {\n    return { state: \"failed\" };\n  }\n}\n"],"mappings":";;;;;;AAaA,MAAM,UAAU;CACd;EAAE,MAAM;EAAY,OAAO;EAAY,QAAQ;CAAkB;CACjE;EAAE,MAAM;EAAqB,OAAO;EAAwB,QAAQ;CAAiB;CACrF;EAAE,MAAM;EAAyB,OAAO;EAAwB,QAAQ;CAAkB;AAC5F;;AAgCA,eAAe,kBAAkB,IAAkD;CAiBjF,QAAO,MAhBa,QAAQ,IAC1B,QAAQ,IAAI,OAAO,WAAW;EAO5B,QAAO,MANa,GAAG,KAAK,GAAG,OAAO,OAAO,MAAM,EAAA,CAMvC,SAAS,QAAQ;GAC3B,MAAM,aAAa,IAAI,OAAO;GAC9B,OAAO,OAAO,eAAe,YAAY,eAAe,KACpD,CAAC;IAAE;IAAQ,IAAI,IAAI;IAAI;GAAW,CAAC,IACnC,CAAC;EACP,CAAC;CACH,CAAC,CACH,EAAA,CACa,KAAK;AACpB;AAEA,SAAS,SAAS,MAAkB,YAA2D;CAC7F,IAAI;EACF,OAAO,eAAe,MAAM,UAAU,CAAC,CAAC;CAC1C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,iBACpB,IACA,MAC0B;CAC1B,MAAM,SAAS,MAAM,kBAAkB,EAAE;CACzC,MAAM,QAAyB;EAAE,OAAO,OAAO;EAAQ,SAAS;EAAG,UAAU;EAAG,YAAY,CAAC;CAAE;CAC/F,KAAK,MAAM,QAAQ,QAAQ;EACzB,MAAM,QAAQ,SAAS,MAAM,KAAK,UAAU;EAC5C,IAAI,UAAU,cACZ,MAAM,WAAW,KAAK;GAAE,QAAQ,KAAK,OAAO;GAAM,IAAI,KAAK;EAAG,CAAC;OAE/D,MAAM,UAAU;CAEpB;CACA,OAAO;AACT;;;;;;AAOA,eAAsB,qBACpB,IACA,MAC0B;CAC1B,MAAM,SAA0B;EAAE,aAAa;EAAG,QAAQ;EAAG,YAAY,CAAC;CAAE;CAC5E,MAAM,WAAW,MAAM,QAAQ,KAC5B,MAAM,kBAAkB,EAAE,EAAA,CAAG,IAAI,OAAO,SAAS,MAAM,aAAa,IAAI,MAAM,IAAI,CAAC,CACtF;CACA,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,UAAU,cACpB,OAAO,WAAW,KAAK,QAAQ,GAAG;MAC7B,IAAI,QAAQ,UAAU,WAC3B,OAAO,QAAQ,UAAU;CAG7B,OAAO;AACT;AAMA,eAAe,aACb,IACA,MACA,MACkB;CAClB,IAAI;CACJ,IAAI;EACF,QAAQ,eAAe,MAAM,KAAK,UAAU;CAC9C,QAAQ;EACN,OAAO;GAAE,OAAO;GAAc,KAAK;IAAE,QAAQ,KAAK,OAAO;IAAM,IAAI,KAAK;GAAG;EAAE;CAC/E;CACA,IAAI,MAAM,YAAY,WACpB,OAAO,EAAE,OAAO,UAAU;CAE5B,IAAI;EACF,MAAM,GAAG,OAAO,GAAG,OAAO,KAAK,OAAO,QAAQ,KAAK,IAAI,GACpD,KAAK,OAAO,SAAS,QAAQ,KAAK,SAAS,MAAM,SAAS,EAC7D,CAAC;EACD,OAAO,EAAE,OAAO,cAAc;CAChC,QAAQ;EACN,OAAO,EAAE,OAAO,SAAS;CAC3B;AACF"}
+{"version":3,"file":"credentials.mjs","names":[],"sources":["../../src/models/credentials.ts"],"sourcesContent":["/**\n * Stored-credential inventory and re-encryption for secret rotation.\n *\n * Webhook secrets, notification-channel secrets (chat webhooks and git tokens), and design-provider credentials are\n * encrypted under `ShelfConfig.secret`. After a rotation the old secret stays\n * available as `previousSecret` (decrypt-only); {@link probeCredentials} reports\n * which key each row needs and {@link reencryptCredentials} moves rows to the\n * current key. Neither returns or logs credential values.\n */\nimport type { DatabaseAdapter } from \"../adapters/database.ts\";\nimport { decryptWithKey, encrypt, type SecretKeys } from \"../utils/encrypt.ts\";\n\n/** Tables that hold encrypted credentials, with the column to read. */\nconst SOURCES = [\n  { name: \"webhooks\", table: \"webhooks\", column: \"secretEncrypted\" },\n  { name: \"design credentials\", table: \"designCredentials\", column: \"tokenEncrypted\" },\n  { name: \"user connections\", table: \"userConnections\", column: \"tokenEncrypted\" },\n  {\n    name: \"user connection refresh tokens\",\n    table: \"userConnections\",\n    column: \"refreshTokenEncrypted\",\n  },\n  { name: \"notification channels\", table: \"notificationChannels\", column: \"secretEncrypted\" },\n] as const;\n\n/** A row no configured key can decrypt. */\nexport interface UnreadableCredential {\n  source: string;\n  id: string;\n}\n\n/** Which key each stored credential needs. */\nexport interface CredentialProbe {\n  total: number;\n  /** Rows readable with the current secret. */\n  current: number;\n  /** Rows only readable with `previousSecret`; run re-encryption. */\n  previous: number;\n  unreadable: UnreadableCredential[];\n}\n\n/** Outcome of {@link reencryptCredentials}. */\nexport interface ReencryptResult {\n  reencrypted: number;\n  failed: number;\n  unreadable: UnreadableCredential[];\n}\n\ninterface StoredCredential {\n  source: (typeof SOURCES)[number];\n  id: string;\n  ciphertext: string;\n}\n\n/** Every non-empty encrypted value across the credential tables. */\nasync function storedCredentials(db: DatabaseAdapter): Promise<StoredCredential[]> {\n  const lists = await Promise.all(\n    SOURCES.map(async (source) => {\n      const rows = (await db.list(db.tables[source.table])) as unknown as (Record<\n        string,\n        unknown\n      > & {\n        id: string;\n      })[];\n      return rows.flatMap((row) => {\n        const ciphertext = row[source.column];\n        return typeof ciphertext === \"string\" && ciphertext !== \"\"\n          ? [{ source, id: row.id, ciphertext }]\n          : [];\n      });\n    }),\n  );\n  return lists.flat();\n}\n\nfunction classify(keys: SecretKeys, ciphertext: string): \"current\" | \"previous\" | \"unreadable\" {\n  try {\n    return decryptWithKey(keys, ciphertext).keyUsed;\n  } catch {\n    return \"unreadable\";\n  }\n}\n\n/** Count stored credentials by the key they need; read-only. */\nexport async function probeCredentials(\n  db: DatabaseAdapter,\n  keys: SecretKeys,\n): Promise<CredentialProbe> {\n  const stored = await storedCredentials(db);\n  const probe: CredentialProbe = { total: stored.length, current: 0, previous: 0, unreadable: [] };\n  for (const item of stored) {\n    const state = classify(keys, item.ciphertext);\n    if (state === \"unreadable\") {\n      probe.unreadable.push({ source: item.source.name, id: item.id });\n    } else {\n      probe[state] += 1;\n    }\n  }\n  return probe;\n}\n\n/**\n * Re-encrypt every credential still under `keys.previous` with `keys.current`.\n * Idempotent; unreadable rows are left untouched and reported, and one failed\n * write does not stop the rest.\n */\nexport async function reencryptCredentials(\n  db: DatabaseAdapter,\n  keys: SecretKeys,\n): Promise<ReencryptResult> {\n  const result: ReencryptResult = { reencrypted: 0, failed: 0, unreadable: [] };\n  const outcomes = await Promise.all(\n    (await storedCredentials(db)).map(async (item) => await reencryptOne(db, keys, item)),\n  );\n  for (const outcome of outcomes) {\n    if (outcome.state === \"unreadable\") {\n      result.unreadable.push(outcome.row);\n    } else if (outcome.state !== \"skipped\") {\n      result[outcome.state] += 1;\n    }\n  }\n  return result;\n}\n\ntype Outcome =\n  | { state: \"reencrypted\" | \"failed\" | \"skipped\" }\n  | { state: \"unreadable\"; row: UnreadableCredential };\n\nasync function reencryptOne(\n  db: DatabaseAdapter,\n  keys: SecretKeys,\n  item: StoredCredential,\n): Promise<Outcome> {\n  let plain: { plaintext: string; keyUsed: string };\n  try {\n    plain = decryptWithKey(keys, item.ciphertext);\n  } catch {\n    return { state: \"unreadable\", row: { source: item.source.name, id: item.id } };\n  }\n  if (plain.keyUsed === \"current\") {\n    return { state: \"skipped\" };\n  }\n  try {\n    await db.update(db.tables[item.source.table], item.id, {\n      [item.source.column]: encrypt(keys.current, plain.plaintext),\n    });\n    return { state: \"reencrypted\" };\n  } catch {\n    return { state: \"failed\" };\n  }\n}\n"],"mappings":";;;;;;AAaA,MAAM,UAAU;CACd;EAAE,MAAM;EAAY,OAAO;EAAY,QAAQ;CAAkB;CACjE;EAAE,MAAM;EAAsB,OAAO;EAAqB,QAAQ;CAAiB;CACnF;EAAE,MAAM;EAAoB,OAAO;EAAmB,QAAQ;CAAiB;CAC/E;EACE,MAAM;EACN,OAAO;EACP,QAAQ;CACV;CACA;EAAE,MAAM;EAAyB,OAAO;EAAwB,QAAQ;CAAkB;AAC5F;;AAgCA,eAAe,kBAAkB,IAAkD;CAiBjF,QAAO,MAhBa,QAAQ,IAC1B,QAAQ,IAAI,OAAO,WAAW;EAO5B,QAAO,MANa,GAAG,KAAK,GAAG,OAAO,OAAO,MAAM,EAAA,CAMvC,SAAS,QAAQ;GAC3B,MAAM,aAAa,IAAI,OAAO;GAC9B,OAAO,OAAO,eAAe,YAAY,eAAe,KACpD,CAAC;IAAE;IAAQ,IAAI,IAAI;IAAI;GAAW,CAAC,IACnC,CAAC;EACP,CAAC;CACH,CAAC,CACH,EAAA,CACa,KAAK;AACpB;AAEA,SAAS,SAAS,MAAkB,YAA2D;CAC7F,IAAI;EACF,OAAO,eAAe,MAAM,UAAU,CAAC,CAAC;CAC1C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,iBACpB,IACA,MAC0B;CAC1B,MAAM,SAAS,MAAM,kBAAkB,EAAE;CACzC,MAAM,QAAyB;EAAE,OAAO,OAAO;EAAQ,SAAS;EAAG,UAAU;EAAG,YAAY,CAAC;CAAE;CAC/F,KAAK,MAAM,QAAQ,QAAQ;EACzB,MAAM,QAAQ,SAAS,MAAM,KAAK,UAAU;EAC5C,IAAI,UAAU,cACZ,MAAM,WAAW,KAAK;GAAE,QAAQ,KAAK,OAAO;GAAM,IAAI,KAAK;EAAG,CAAC;OAE/D,MAAM,UAAU;CAEpB;CACA,OAAO;AACT;;;;;;AAOA,eAAsB,qBACpB,IACA,MAC0B;CAC1B,MAAM,SAA0B;EAAE,aAAa;EAAG,QAAQ;EAAG,YAAY,CAAC;CAAE;CAC5E,MAAM,WAAW,MAAM,QAAQ,KAC5B,MAAM,kBAAkB,EAAE,EAAA,CAAG,IAAI,OAAO,SAAS,MAAM,aAAa,IAAI,MAAM,IAAI,CAAC,CACtF;CACA,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,UAAU,cACpB,OAAO,WAAW,KAAK,QAAQ,GAAG;MAC7B,IAAI,QAAQ,UAAU,WAC3B,OAAO,QAAQ,UAAU;CAG7B,OAAO;AACT;AAMA,eAAe,aACb,IACA,MACA,MACkB;CAClB,IAAI;CACJ,IAAI;EACF,QAAQ,eAAe,MAAM,KAAK,UAAU;CAC9C,QAAQ;EACN,OAAO;GAAE,OAAO;GAAc,KAAK;IAAE,QAAQ,KAAK,OAAO;IAAM,IAAI,KAAK;GAAG;EAAE;CAC/E;CACA,IAAI,MAAM,YAAY,WACpB,OAAO,EAAE,OAAO,UAAU;CAE5B,IAAI;EACF,MAAM,GAAG,OAAO,GAAG,OAAO,KAAK,OAAO,QAAQ,KAAK,IAAI,GACpD,KAAK,OAAO,SAAS,QAAQ,KAAK,SAAS,MAAM,SAAS,EAC7D,CAAC;EACD,OAAO,EAAE,OAAO,cAAc;CAChC,QAAQ;EACN,OAAO,EAAE,OAAO,SAAS;CAC3B;AACF"}

package/dist/models/design-credentials.d.mts

@@ -0,0 +1,41 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { DatabaseAdapter } from "../adapter/database.mjs";
+import { SecretInput } from "../utils/encrypt.mjs";
+import { DesignCredential } from "../schema/design.mjs";
+import { DesignCredentialStatus } from "./design-resolve.mjs";
+import { Table } from "drizzle-orm";
+//#region src/models/design-credentials.d.ts
+/** Tables required by {@link DesignCredentialModel}. */
+interface DesignCredentialTables {
+  designCredentials: Table;
+}
+/** Cache scope of the shared project credential (`design_nodes.viewer_id`); a user id marks a member's own connection. */
+declare const PROJECT_SCOPE = "";
+/**
+ * Data operations for design credentials. Every method addresses one
+ * `(project, provider)` row. Plaintext only ever leaves through {@link get}.
+ */
+declare class DesignCredentialModel {
+  private readonly tables;
+  private readonly db;
+  private readonly secret?;
+  constructor(db: DatabaseAdapter, secret?: SecretInput, tables?: DesignCredentialTables);
+  /** The credential row (never the plaintext), or null. */
+  info(projectId: string, provider: string): Promise<DesignCredential | null>;
+  /** Decrypted access token for API calls, or null when none is set. */
+  get(projectId: string, provider: string): Promise<string | null>;
+  /**
+   * Store (or rotate) a pasted token. A new credential restarts the rotation
+   * clock (`createdAt`) and resets health to `unknown`.
+   */
+  set(projectId: string, provider: string, token: string): Promise<void>;
+  /** Delete a credential. */
+  remove(projectId: string, provider: string): Promise<void>;
+  /** Record the last observed API outcome; never moves the rotation age. */
+  recordStatus(projectId: string, provider: string, status: DesignCredentialStatus): Promise<void>;
+  private replace;
+}
+//#endregion
+export { DesignCredentialModel, DesignCredentialTables, PROJECT_SCOPE };
+//# sourceMappingURL=design-credentials.d.mts.map

package/dist/models/design-credentials.mjs

@@ -0,0 +1,86 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { decryptCredential, encrypt } from "../utils/encrypt.mjs";
+import { ulid } from "../utils/ulid.mjs";
+import { col } from "./columns.mjs";
+import { and, eq } from "drizzle-orm";
+//#region src/models/design-credentials.ts
+/** Encrypted design-provider credentials: the project-wide token an admin pastes. */
+/** Cache scope of the shared project credential (`design_nodes.viewer_id`); a user id marks a member's own connection. */
+const PROJECT_SCOPE = "";
+/**
+* Data operations for design credentials. Every method addresses one
+* `(project, provider)` row. Plaintext only ever leaves through {@link get}.
+*/
+var DesignCredentialModel = class {
+	tables;
+	db;
+	secret;
+	constructor(db, secret, tables) {
+		this.db = db;
+		this.secret = secret;
+		this.tables = tables ?? { designCredentials: db.tables.designCredentials };
+	}
+	/** The credential row (never the plaintext), or null. */
+	async info(projectId, provider) {
+		return (await this.db.list(this.tables.designCredentials, {
+			where: and(eq(col(this.tables.designCredentials, "projectId"), projectId), eq(col(this.tables.designCredentials, "provider"), provider)),
+			limit: 1
+		}))[0] ?? null;
+	}
+	/** Decrypted access token for API calls, or null when none is set. */
+	async get(projectId, provider) {
+		const row = await this.info(projectId, provider);
+		return row ? decryptCredential(this.secret, row.tokenEncrypted) : null;
+	}
+	/**
+	* Store (or rotate) a pasted token. A new credential restarts the rotation
+	* clock (`createdAt`) and resets health to `unknown`.
+	*/
+	async set(projectId, provider, token) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const values = {
+			tokenEncrypted: encrypt(this.secret, token),
+			status: "unknown",
+			checkedAt: null,
+			createdAt: now,
+			updatedAt: now
+		};
+		if (await this.replace(projectId, provider, values)) return;
+		try {
+			await this.db.insert(this.tables.designCredentials, {
+				id: ulid(),
+				projectId,
+				provider,
+				...values
+			});
+		} catch (error) {
+			if (!await this.replace(projectId, provider, values)) throw error;
+		}
+	}
+	/** Delete a credential. */
+	async remove(projectId, provider) {
+		const existing = await this.info(projectId, provider);
+		if (existing) await this.db.remove(this.tables.designCredentials, existing.id);
+	}
+	/** Record the last observed API outcome; never moves the rotation age. */
+	async recordStatus(projectId, provider, status) {
+		const existing = await this.info(projectId, provider);
+		if (!existing) return;
+		await this.db.update(this.tables.designCredentials, existing.id, {
+			status,
+			checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+	async replace(projectId, provider, values) {
+		const existing = await this.info(projectId, provider);
+		if (!existing) return false;
+		await this.db.update(this.tables.designCredentials, existing.id, { ...values });
+		return true;
+	}
+};
+//#endregion
+export { DesignCredentialModel, PROJECT_SCOPE };
+
+//# sourceMappingURL=design-credentials.mjs.map

package/dist/models/design-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"design-credentials.mjs","names":[],"sources":["../../src/models/design-credentials.ts"],"sourcesContent":["/** Encrypted design-provider credentials: the project-wide token an admin pastes. */\nimport { and, eq } from \"drizzle-orm\";\nimport type { Table } from \"drizzle-orm\";\nimport type { DatabaseAdapter } from \"../adapters/database.ts\";\nimport type { DesignCredential } from \"../schema/design.ts\";\nimport { decryptCredential, encrypt, type SecretInput } from \"../utils/encrypt.ts\";\nimport { ulid } from \"../utils/ulid.ts\";\nimport { col } from \"./columns.ts\";\nimport type { DesignCredentialStatus } from \"./design-resolve.ts\";\n\n/** Tables required by {@link DesignCredentialModel}. */\nexport interface DesignCredentialTables {\n  designCredentials: Table;\n}\n\n/** Cache scope of the shared project credential (`design_nodes.viewer_id`); a user id marks a member's own connection. */\nexport const PROJECT_SCOPE = \"\";\n\ntype Fields = Pick<\n  DesignCredential,\n  \"tokenEncrypted\" | \"status\" | \"checkedAt\" | \"createdAt\" | \"updatedAt\"\n>;\n\n/**\n * Data operations for design credentials. Every method addresses one\n * `(project, provider)` row. Plaintext only ever leaves through {@link get}.\n */\nexport class DesignCredentialModel {\n  private readonly tables: DesignCredentialTables;\n  private readonly db: DatabaseAdapter;\n  private readonly secret?: SecretInput;\n\n  constructor(db: DatabaseAdapter, secret?: SecretInput, tables?: DesignCredentialTables) {\n    this.db = db;\n    this.secret = secret;\n    this.tables = tables ?? { designCredentials: db.tables.designCredentials };\n  }\n\n  /** The credential row (never the plaintext), or null. */\n  async info(projectId: string, provider: string): Promise<DesignCredential | null> {\n    const rows = (await this.db.list(this.tables.designCredentials, {\n      where: and(\n        eq(col(this.tables.designCredentials, \"projectId\"), projectId),\n        eq(col(this.tables.designCredentials, \"provider\"), provider),\n      ),\n      limit: 1,\n    })) as unknown as DesignCredential[];\n    return rows[0] ?? null;\n  }\n\n  /** Decrypted access token for API calls, or null when none is set. */\n  async get(projectId: string, provider: string): Promise<string | null> {\n    const row = await this.info(projectId, provider);\n    return row ? decryptCredential(this.secret, row.tokenEncrypted) : null;\n  }\n\n  /**\n   * Store (or rotate) a pasted token. A new credential restarts the rotation\n   * clock (`createdAt`) and resets health to `unknown`.\n   */\n  async set(projectId: string, provider: string, token: string): Promise<void> {\n    const now = new Date().toISOString();\n    const values: Fields = {\n      tokenEncrypted: encrypt(this.secret, token),\n      status: \"unknown\",\n      checkedAt: null,\n      createdAt: now,\n      updatedAt: now,\n    };\n    if (await this.replace(projectId, provider, values)) return;\n    try {\n      await this.db.insert(this.tables.designCredentials, {\n        id: ulid(),\n        projectId,\n        provider,\n        ...values,\n      });\n    } catch (error) {\n      // A concurrent writer inserted first (unique project/provider): rotate theirs instead.\n      if (!(await this.replace(projectId, provider, values))) throw error;\n    }\n  }\n\n  /** Delete a credential. */\n  async remove(projectId: string, provider: string): Promise<void> {\n    const existing = await this.info(projectId, provider);\n    if (existing) await this.db.remove(this.tables.designCredentials, existing.id);\n  }\n\n  /** Record the last observed API outcome; never moves the rotation age. */\n  async recordStatus(\n    projectId: string,\n    provider: string,\n    status: DesignCredentialStatus,\n  ): Promise<void> {\n    const existing = await this.info(projectId, provider);\n    if (!existing) return;\n    await this.db.update(this.tables.designCredentials, existing.id, {\n      status,\n      checkedAt: new Date().toISOString(),\n    });\n  }\n\n  private async replace(projectId: string, provider: string, values: Fields): Promise<boolean> {\n    const existing = await this.info(projectId, provider);\n    if (!existing) return false;\n    await this.db.update(this.tables.designCredentials, existing.id, {\n      ...values,\n    });\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;;;AAgBA,MAAa,gBAAgB;;;;;AAW7B,IAAa,wBAAb,MAAmC;CACjC;CACA;CACA;CAEA,YAAY,IAAqB,QAAsB,QAAiC;EACtF,KAAK,KAAK;EACV,KAAK,SAAS;EACd,KAAK,SAAS,UAAU,EAAE,mBAAmB,GAAG,OAAO,kBAAkB;CAC3E;;CAGA,MAAM,KAAK,WAAmB,UAAoD;EAQhF,QAAO,MAPa,KAAK,GAAG,KAAK,KAAK,OAAO,mBAAmB;GAC9D,OAAO,IACL,GAAG,IAAI,KAAK,OAAO,mBAAmB,WAAW,GAAG,SAAS,GAC7D,GAAG,IAAI,KAAK,OAAO,mBAAmB,UAAU,GAAG,QAAQ,CAC7D;GACA,OAAO;EACT,CAAC,EAAA,CACW,MAAM;CACpB;;CAGA,MAAM,IAAI,WAAmB,UAA0C;EACrE,MAAM,MAAM,MAAM,KAAK,KAAK,WAAW,QAAQ;EAC/C,OAAO,MAAM,kBAAkB,KAAK,QAAQ,IAAI,cAAc,IAAI;CACpE;;;;;CAMA,MAAM,IAAI,WAAmB,UAAkB,OAA8B;EAC3E,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EACnC,MAAM,SAAiB;GACrB,gBAAgB,QAAQ,KAAK,QAAQ,KAAK;GAC1C,QAAQ;GACR,WAAW;GACX,WAAW;GACX,WAAW;EACb;EACA,IAAI,MAAM,KAAK,QAAQ,WAAW,UAAU,MAAM,GAAG;EACrD,IAAI;GACF,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,mBAAmB;IAClD,IAAI,KAAK;IACT;IACA;IACA,GAAG;GACL,CAAC;EACH,SAAS,OAAO;GAEd,IAAI,CAAE,MAAM,KAAK,QAAQ,WAAW,UAAU,MAAM,GAAI,MAAM;EAChE;CACF;;CAGA,MAAM,OAAO,WAAmB,UAAiC;EAC/D,MAAM,WAAW,MAAM,KAAK,KAAK,WAAW,QAAQ;EACpD,IAAI,UAAU,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,mBAAmB,SAAS,EAAE;CAC/E;;CAGA,MAAM,aACJ,WACA,UACA,QACe;EACf,MAAM,WAAW,MAAM,KAAK,KAAK,WAAW,QAAQ;EACpD,IAAI,CAAC,UAAU;EACf,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,mBAAmB,SAAS,IAAI;GAC/D;GACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EACpC,CAAC;CACH;CAEA,MAAc,QAAQ,WAAmB,UAAkB,QAAkC;EAC3F,MAAM,WAAW,MAAM,KAAK,KAAK,WAAW,QAAQ;EACpD,IAAI,CAAC,UAAU,OAAO;EACtB,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,mBAAmB,SAAS,IAAI,EAC/D,GAAG,OACL,CAAC;EACD,OAAO;CACT;AACF"}

package/dist/models/design-health.d.mts

@@ -0,0 +1,16 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { DesignNode } from "../schema/design.mjs";
+//#region src/models/design-health.d.ts
+/** Cached metadata younger than this is served without a refetch. */
+declare const DESIGN_TTL_MS: number;
+/** True when the design changed after the baseline it is compared with was approved. */
+declare function isDesignStale(node: Pick<DesignNode, "state" | "lastModified"> | null | undefined, baselineVersion: string | null | undefined): boolean;
+/**
+ * Days until a credential passes its provider's maximum lifetime (negative once
+ * past). `issuedAt` is when the credential was set or replaced — never a status write.
+ */
+declare function credentialDaysLeft(issuedAt: string, maxAgeDays: number, now?: Date): number;
+//#endregion
+export { DESIGN_TTL_MS, credentialDaysLeft, isDesignStale };
+//# sourceMappingURL=design-health.d.mts.map

package/dist/models/design-health.mjs

@@ -0,0 +1,25 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/models/design-health.ts
+/** Cached metadata younger than this is served without a refetch. */
+const DESIGN_TTL_MS = 9e5;
+/** True when the design changed after the baseline it is compared with was approved. */
+function isDesignStale(node, baselineVersion) {
+	if (node?.state !== "ok" || !node.lastModified || !baselineVersion) return false;
+	const modified = Date.parse(node.lastModified);
+	const approved = Date.parse(baselineVersion);
+	return Number.isFinite(modified) && Number.isFinite(approved) && modified > approved;
+}
+/**
+* Days until a credential passes its provider's maximum lifetime (negative once
+* past). `issuedAt` is when the credential was set or replaced — never a status write.
+*/
+function credentialDaysLeft(issuedAt, maxAgeDays, now = /* @__PURE__ */ new Date()) {
+	const ageDays = (now.getTime() - Date.parse(issuedAt)) / 864e5;
+	return Math.ceil(maxAgeDays - ageDays);
+}
+//#endregion
+export { DESIGN_TTL_MS, credentialDaysLeft, isDesignStale };
+
+//# sourceMappingURL=design-health.mjs.map

package/dist/models/design-health.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"design-health.mjs","names":[],"sources":["../../src/models/design-health.ts"],"sourcesContent":["/** Design cache freshness, staleness and credential-age rules (provider-neutral). */\nimport type { DesignNode } from \"../schema/design.ts\";\n\n/** Cached metadata younger than this is served without a refetch. */\nexport const DESIGN_TTL_MS = 15 * 60_000;\n\n/** True when the design changed after the baseline it is compared with was approved. */\nexport function isDesignStale(\n  node: Pick<DesignNode, \"state\" | \"lastModified\"> | null | undefined,\n  baselineVersion: string | null | undefined,\n): boolean {\n  if (node?.state !== \"ok\" || !node.lastModified || !baselineVersion) return false;\n  const modified = Date.parse(node.lastModified);\n  const approved = Date.parse(baselineVersion);\n  return Number.isFinite(modified) && Number.isFinite(approved) && modified > approved;\n}\n\n/**\n * Days until a credential passes its provider's maximum lifetime (negative once\n * past). `issuedAt` is when the credential was set or replaced — never a status write.\n */\nexport function credentialDaysLeft(\n  issuedAt: string,\n  maxAgeDays: number,\n  now: Date = new Date(),\n): number {\n  const ageDays = (now.getTime() - Date.parse(issuedAt)) / 86_400_000;\n  return Math.ceil(maxAgeDays - ageDays);\n}\n"],"mappings":";;;;;AAIA,MAAa,gBAAgB;;AAG7B,SAAgB,cACd,MACA,iBACS;CACT,IAAI,MAAM,UAAU,QAAQ,CAAC,KAAK,gBAAgB,CAAC,iBAAiB,OAAO;CAC3E,MAAM,WAAW,KAAK,MAAM,KAAK,YAAY;CAC7C,MAAM,WAAW,KAAK,MAAM,eAAe;CAC3C,OAAO,OAAO,SAAS,QAAQ,KAAK,OAAO,SAAS,QAAQ,KAAK,WAAW;AAC9E;;;;;AAMA,SAAgB,mBACd,UACA,YACA,sBAAY,IAAI,KAAK,GACb;CACR,MAAM,WAAW,IAAI,QAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK;CACzD,OAAO,KAAK,KAAK,aAAa,OAAO;AACvC"}

package/dist/models/design-nodes.d.mts

@@ -0,0 +1,83 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { DatabaseAdapter } from "../adapter/database.mjs";
+import { Logger } from "../logger.mjs";
+import { DesignProvider } from "../adapter/design.mjs";
+import { StorageAdapter } from "../adapter/storage.mjs";
+import { ConnectionModel } from "./connections.mjs";
+import { DesignNode } from "../schema/design.mjs";
+import { DesignCredentialModel } from "./design-credentials.mjs";
+import { Table } from "drizzle-orm";
+import { Buffer } from "node:buffer";
+//#region src/models/design-nodes.d.ts
+/** Tables required by {@link DesignNodeModel}. */
+interface DesignNodeTables {
+  designNodes: Table;
+}
+/** Options of {@link DesignNodeModel.refreshMany}. */
+interface RefreshOptions {
+  now?: Date;
+  /** Cancels in-flight provider calls (e.g. a page-render budget). */
+  signal?: AbortSignal;
+  /** The visiting user: their own connection is used when the project has no credential. */
+  viewerId?: string;
+}
+/** Cache of design file/node metadata and node renders with TTL refresh. */
+declare class DesignNodeModel {
+  private readonly tables;
+  private readonly renders;
+  private readonly logger;
+  private readonly connections;
+  private readonly db;
+  private readonly credentials;
+  private readonly providers;
+  constructor(db: DatabaseAdapter, credentials: DesignCredentialModel, providers: readonly DesignProvider[], options?: {
+    tables?: DesignNodeTables;
+    logger?: Logger;
+    storage?: StorageAdapter;
+    /** Members' own connections, used when the project has no credential. */
+    connections?: ConnectionModel;
+  });
+  /** Cached row by id, scoped to the project, or null. */
+  get(projectId: string, id: string): Promise<DesignNode | null>;
+  /** Cached render bytes of a node, or null when it has none (or storage is not wired). */
+  readRender(node: DesignNode): Promise<Buffer | null>;
+  /**
+   * Cached rows for the given design URLs, keyed by URL (unparseable or uncached URLs are
+   * absent). A row fetched with someone's own connection is only visible to that viewer.
+   */
+  cachedFor(projectId: string, urls: readonly string[], viewerId?: string): Promise<Map<string, DesignNode>>;
+  /** Refresh one link (see {@link refreshMany}); null for unsupported URLs or nothing cached. */
+  refresh(projectId: string, url: string, now?: Date, viewerId?: string): Promise<DesignNode | null>;
+  /**
+   * Refresh the given links' metadata and renders when missing or past the TTL.
+   * Links of one file share one metadata call and one render call, and files run
+   * with bounded concurrency. Transient failures keep the previous cache; auth
+   * failures update the credential's health. Never throws.
+   */
+  refreshMany(projectId: string, urls: readonly string[], options?: RefreshOptions): Promise<Map<string, DesignNode | null>>;
+  /** Refresh due links grouped by provider and file, files in parallel (bounded). */
+  private refreshDue;
+  private refreshFile;
+  /** Upsert a row per item that got a usable answer (`error` keeps its cached row), keyed by URL. */
+  private storeAll;
+  /** A client for the provider of `items` bound to the items' credential scope, or null without one. */
+  private clientFor;
+  /**
+   * Whose credential serves a provider: the project's when set (it is shared and
+   * wins), else the viewer's own connection, else the project scope (nothing to fetch with).
+   */
+  private scopeFor;
+  /** The shared row, else the viewer's own (a connected member's entries are never served to others). */
+  private visible;
+  private lookup;
+  /**
+   * Upsert the row. Non-ok states keep the last good name/version/modified time
+   * (an auth failure must not erase the label); a deleted node also drops its
+   * cached render, so a design that no longer exists is never shown as reference.
+   */
+  private store;
+}
+//#endregion
+export { DesignNodeModel, DesignNodeTables, RefreshOptions };
+//# sourceMappingURL=design-nodes.d.mts.map

package/dist/models/design-nodes.mjs

@@ -0,0 +1,222 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { parseDesignUrl } from "../adapter/design.mjs";
+import { ulid } from "../utils/ulid.mjs";
+import { col } from "./columns.mjs";
+import { mapLimit } from "../utils/map-limit.mjs";
+import "./design-credentials.mjs";
+import "./design-health.mjs";
+import { DesignRenderStore } from "./design-renders.mjs";
+import { and, eq } from "drizzle-orm";
+//#region src/models/design-nodes.ts
+/** Design metadata + render cache: TTL refresh, batched per file, bounded concurrency, abortable. */
+/** Most files refreshed in parallel by one {@link DesignNodeModel.refreshMany} call. */
+const FILE_CONCURRENCY = 3;
+/** Cache of design file/node metadata and node renders with TTL refresh. */
+var DesignNodeModel = class {
+	tables;
+	renders;
+	logger;
+	connections;
+	db;
+	credentials;
+	providers;
+	constructor(db, credentials, providers, options = {}) {
+		this.db = db;
+		this.credentials = credentials;
+		this.providers = providers;
+		this.tables = options.tables ?? { designNodes: db.tables.designNodes };
+		this.renders = new DesignRenderStore(db, this.tables.designNodes, options.storage, options.logger);
+		this.logger = options.logger;
+		this.connections = options.connections;
+	}
+	/** Cached row by id, scoped to the project, or null. */
+	async get(projectId, id) {
+		const row = await this.db.get(this.tables.designNodes, id);
+		return row?.projectId === projectId ? row : null;
+	}
+	/** Cached render bytes of a node, or null when it has none (or storage is not wired). */
+	async readRender(node) {
+		return await this.renders.read(node);
+	}
+	/**
+	* Cached rows for the given design URLs, keyed by URL (unparseable or uncached URLs are
+	* absent). A row fetched with someone's own connection is only visible to that viewer.
+	*/
+	async cachedFor(projectId, urls, viewerId) {
+		const rows = await Promise.all([...new Set(urls)].map(async (url) => {
+			const parsed = parseDesignUrl(this.providers, url);
+			return [url, parsed ? await this.visible(projectId, parsed.provider.metadata.kind, parsed.ref, viewerId) : null];
+		}));
+		return new Map(rows.flatMap(([url, row]) => row ? [[url, row]] : []));
+	}
+	/** Refresh one link (see {@link refreshMany}); null for unsupported URLs or nothing cached. */
+	async refresh(projectId, url, now, viewerId) {
+		return (await this.refreshMany(projectId, [url], {
+			...now ? { now } : {},
+			...viewerId ? { viewerId } : {}
+		})).get(url) ?? null;
+	}
+	/**
+	* Refresh the given links' metadata and renders when missing or past the TTL.
+	* Links of one file share one metadata call and one render call, and files run
+	* with bounded concurrency. Transient failures keep the previous cache; auth
+	* failures update the credential's health. Never throws.
+	*/
+	async refreshMany(projectId, urls, options = {}) {
+		const now = options.now ?? /* @__PURE__ */ new Date();
+		const scopes = /* @__PURE__ */ new Map();
+		const known = (await Promise.all([...new Set(urls)].map(async (url) => {
+			const parsed = parseDesignUrl(this.providers, url);
+			if (!parsed) return null;
+			const kind = parsed.provider.metadata.kind;
+			const scope = await memo(scopes, kind, async () => {
+				return await this.scopeFor(projectId, kind, options.viewerId);
+			});
+			const cached = await this.lookup(projectId, kind, parsed.ref, scope);
+			return {
+				url,
+				provider: parsed.provider,
+				ref: parsed.ref,
+				cached,
+				scope
+			};
+		}))).filter((item) => item !== null);
+		const results = new Map(known.map((item) => [item.url, item.cached]));
+		const due = known.filter((item) => isDue(item.cached, now));
+		if (due.length === 0) return results;
+		const fresh = await this.refreshDue(projectId, due, now, callOptions(this.logger, options));
+		for (const [url, node] of fresh) results.set(url, node);
+		return results;
+	}
+	/** Refresh due links grouped by provider and file, files in parallel (bounded). */
+	async refreshDue(projectId, due, now, call) {
+		const byFile = [...Map.groupBy(due, (item) => `${item.provider.metadata.kind}\u0000${item.ref.fileKey}`)];
+		const batches = await mapLimit(byFile, FILE_CONCURRENCY, async ([, items]) => {
+			return await this.refreshFile(projectId, items, now, call);
+		});
+		const merged = /* @__PURE__ */ new Map();
+		for (const batch of batches) for (const [url, node] of batch) merged.set(url, node);
+		return merged;
+	}
+	async refreshFile(projectId, items, now, call) {
+		const client = await this.clientFor(projectId, items);
+		const first = items[0];
+		if (!client || !first) return /* @__PURE__ */ new Map();
+		const { provider, ref } = first;
+		const metas = await client.fetchMetas(ref.fileKey, items.map((item) => item.ref), call);
+		const answered = [...metas.values()].find((meta) => meta.state !== "error");
+		if (answered && first.scope === "") await this.credentials.recordStatus(projectId, provider.metadata.kind, statusFor(answered.state));
+		const stored = await this.storeAll(projectId, items, metas, now);
+		return await this.renders.ensure(projectId, client, ref.fileKey, stored, call);
+	}
+	/** Upsert a row per item that got a usable answer (`error` keeps its cached row), keyed by URL. */
+	async storeAll(projectId, items, metas, now) {
+		const rows = await Promise.all(items.map(async (item) => {
+			const meta = metas.get(item.ref.nodeId ?? "");
+			const row = meta && meta.state !== "error" ? await this.store(projectId, item, meta, now) : null;
+			return row ? [item.url, row] : null;
+		}));
+		return new Map(rows.filter((entry) => entry !== null));
+	}
+	/** A client for the provider of `items` bound to the items' credential scope, or null without one. */
+	async clientFor(projectId, items) {
+		const first = items[0];
+		if (!first) return null;
+		const { provider, scope } = first;
+		const kind = provider.metadata.kind;
+		const own = scope !== "";
+		const credential = own ? await this.connections?.accessToken(scope, kind, provider.oauth).catch(() => null) : await this.credentials.get(projectId, kind).catch(() => null);
+		if (!credential) return null;
+		return provider.create({
+			credential,
+			authType: own ? "oauth" : "token",
+			...this.logger ? { logger: this.logger } : {}
+		});
+	}
+	/**
+	* Whose credential serves a provider: the project's when set (it is shared and
+	* wins), else the viewer's own connection, else the project scope (nothing to fetch with).
+	*/
+	async scopeFor(projectId, provider, viewerId) {
+		if (!viewerId || !this.connections || await this.credentials.info(projectId, provider)) return "";
+		return await this.connections.info(viewerId, provider) ? viewerId : "";
+	}
+	/** The shared row, else the viewer's own (a connected member's entries are never served to others). */
+	async visible(projectId, provider, ref, viewerId) {
+		const shared = await this.lookup(projectId, provider, ref, "");
+		if (shared || !viewerId) return shared;
+		return await this.lookup(projectId, provider, ref, viewerId);
+	}
+	async lookup(projectId, provider, ref, scope) {
+		return (await this.db.list(this.tables.designNodes, {
+			where: and(eq(col(this.tables.designNodes, "projectId"), projectId), eq(col(this.tables.designNodes, "provider"), provider), eq(col(this.tables.designNodes, "viewerId"), scope), eq(col(this.tables.designNodes, "fileKey"), ref.fileKey), eq(col(this.tables.designNodes, "nodeId"), ref.nodeId ?? "")),
+			limit: 1
+		}))[0] ?? null;
+	}
+	/**
+	* Upsert the row. Non-ok states keep the last good name/version/modified time
+	* (an auth failure must not erase the label); a deleted node also drops its
+	* cached render, so a design that no longer exists is never shown as reference.
+	*/
+	async store(projectId, item, meta, now) {
+		const { ref, cached } = item;
+		const stamp = now.toISOString();
+		const keep = meta.state !== "ok" && cached;
+		const values = {
+			name: keep ? cached.name : meta.name,
+			version: keep ? cached.version : meta.version,
+			lastModified: keep ? cached.lastModified : meta.lastModified,
+			state: meta.state,
+			fetchedAt: stamp,
+			updatedAt: stamp
+		};
+		if (!cached) return await this.db.insert(this.tables.designNodes, {
+			id: ulid(),
+			projectId,
+			provider: item.provider.metadata.kind,
+			viewerId: item.scope,
+			fileKey: ref.fileKey,
+			nodeId: ref.nodeId ?? "",
+			renderPath: null,
+			renderVersion: null,
+			createdAt: stamp,
+			...values
+		});
+		const dropRender = meta.state === "deleted" && cached.renderPath !== null;
+		if (dropRender) await this.renders.remove(cached);
+		return await this.db.update(this.tables.designNodes, cached.id, {
+			...values,
+			...dropRender ? {
+				renderPath: null,
+				renderVersion: null
+			} : {}
+		});
+	}
+};
+/** Never fetched, or cached longer ago than the TTL. */
+function isDue(cached, now) {
+	return !cached || now.getTime() - Date.parse(cached.fetchedAt) >= 9e5;
+}
+function callOptions(logger, options) {
+	return {
+		...logger ? { logger } : {},
+		...options.signal ? { signal: options.signal } : {}
+	};
+}
+function statusFor(state) {
+	return state === "unauthorized" || state === "forbidden" ? state : "ok";
+}
+/** Run `load` once per key, sharing the in-flight promise between concurrent callers. */
+async function memo(cache, key, load) {
+	const hit = cache.get(key);
+	if (hit) return await hit;
+	const created = load();
+	cache.set(key, created);
+	return await created;
+}
+//#endregion
+export { DesignNodeModel };
+
+//# sourceMappingURL=design-nodes.mjs.map

package/dist/models/design-nodes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"design-nodes.mjs","names":[],"sources":["../../src/models/design-nodes.ts"],"sourcesContent":["/** Design metadata + render cache: TTL refresh, batched per file, bounded concurrency, abortable. */\nimport { and, eq } from \"drizzle-orm\";\nimport type { Table } from \"drizzle-orm\";\nimport type { Buffer } from \"node:buffer\";\nimport type { DatabaseAdapter } from \"../adapters/database.ts\";\nimport type {\n  DesignCallOptions,\n  DesignClient,\n  DesignMeta,\n  DesignProvider,\n  DesignRef,\n} from \"../adapters/design.ts\";\nimport { parseDesignUrl } from \"../adapters/design.ts\";\nimport type { StorageAdapter } from \"../adapters/storage.ts\";\nimport type { Logger } from \"../logger.ts\";\nimport type { DesignNode } from \"../schema/design.ts\";\nimport { mapLimit } from \"../utils/map-limit.ts\";\nimport { ulid } from \"../utils/ulid.ts\";\nimport { col } from \"./columns.ts\";\nimport type { ConnectionModel } from \"./connections.ts\";\nimport { PROJECT_SCOPE, type DesignCredentialModel } from \"./design-credentials.ts\";\nimport { DESIGN_TTL_MS } from \"./design-health.ts\";\nimport { DesignRenderStore } from \"./design-renders.ts\";\nimport type { DesignCredentialStatus } from \"./design-resolve.ts\";\n\n/** Most files refreshed in parallel by one {@link DesignNodeModel.refreshMany} call. */\nconst FILE_CONCURRENCY = 3;\n\n/** Tables required by {@link DesignNodeModel}. */\nexport interface DesignNodeTables {\n  designNodes: Table;\n}\n\n/** Options of {@link DesignNodeModel.refreshMany}. */\nexport interface RefreshOptions {\n  now?: Date;\n  /** Cancels in-flight provider calls (e.g. a page-render budget). */\n  signal?: AbortSignal;\n  /** The visiting user: their own connection is used when the project has no credential. */\n  viewerId?: string;\n}\n\ninterface Due {\n  url: string;\n  provider: DesignProvider;\n  ref: DesignRef;\n  cached: DesignNode | null;\n  /** Whose credential fetches this link: {@link PROJECT_SCOPE} or the viewer's user id. */\n  scope: string;\n}\n\n/** Cache of design file/node metadata and node renders with TTL refresh. */\nexport class DesignNodeModel {\n  private readonly tables: DesignNodeTables;\n  private readonly renders: DesignRenderStore;\n  private readonly logger: Logger | undefined;\n  private readonly connections: ConnectionModel | undefined;\n  private readonly db: DatabaseAdapter;\n  private readonly credentials: DesignCredentialModel;\n  private readonly providers: readonly DesignProvider[];\n\n  constructor(\n    db: DatabaseAdapter,\n    credentials: DesignCredentialModel,\n    providers: readonly DesignProvider[],\n    options: {\n      tables?: DesignNodeTables;\n      logger?: Logger;\n      storage?: StorageAdapter;\n      /** Members' own connections, used when the project has no credential. */\n      connections?: ConnectionModel;\n    } = {},\n  ) {\n    this.db = db;\n    this.credentials = credentials;\n    this.providers = providers;\n    this.tables = options.tables ?? { designNodes: db.tables.designNodes };\n    this.renders = new DesignRenderStore(\n      db,\n      this.tables.designNodes,\n      options.storage,\n      options.logger,\n    );\n    this.logger = options.logger;\n    this.connections = options.connections;\n  }\n\n  /** Cached row by id, scoped to the project, or null. */\n  async get(projectId: string, id: string): Promise<DesignNode | null> {\n    const row = (await this.db.get(this.tables.designNodes, id)) as unknown as DesignNode | null;\n    return row?.projectId === projectId ? row : null;\n  }\n\n  /** Cached render bytes of a node, or null when it has none (or storage is not wired). */\n  async readRender(node: DesignNode): Promise<Buffer | null> {\n    return await this.renders.read(node);\n  }\n\n  /**\n   * Cached rows for the given design URLs, keyed by URL (unparseable or uncached URLs are\n   * absent). A row fetched with someone's own connection is only visible to that viewer.\n   */\n  async cachedFor(\n    projectId: string,\n    urls: readonly string[],\n    viewerId?: string,\n  ): Promise<Map<string, DesignNode>> {\n    const rows = await Promise.all(\n      [...new Set(urls)].map(async (url) => {\n        const parsed = parseDesignUrl(this.providers, url);\n        const row = parsed\n          ? await this.visible(projectId, parsed.provider.metadata.kind, parsed.ref, viewerId)\n          : null;\n        return [url, row] as const;\n      }),\n    );\n    return new Map(rows.flatMap(([url, row]) => (row ? [[url, row] as const] : [])));\n  }\n\n  /** Refresh one link (see {@link refreshMany}); null for unsupported URLs or nothing cached. */\n  async refresh(\n    projectId: string,\n    url: string,\n    now?: Date,\n    viewerId?: string,\n  ): Promise<DesignNode | null> {\n    const results = await this.refreshMany(projectId, [url], {\n      ...(now ? { now } : {}),\n      ...(viewerId ? { viewerId } : {}),\n    });\n    return results.get(url) ?? null;\n  }\n\n  /**\n   * Refresh the given links' metadata and renders when missing or past the TTL.\n   * Links of one file share one metadata call and one render call, and files run\n   * with bounded concurrency. Transient failures keep the previous cache; auth\n   * failures update the credential's health. Never throws.\n   */\n  async refreshMany(\n    projectId: string,\n    urls: readonly string[],\n    options: RefreshOptions = {},\n  ): Promise<Map<string, DesignNode | null>> {\n    const now = options.now ?? new Date();\n    const scopes = new Map<string, Promise<string>>();\n    const lookups = await Promise.all(\n      [...new Set(urls)].map(async (url) => {\n        const parsed = parseDesignUrl(this.providers, url);\n        if (!parsed) return null;\n        const kind = parsed.provider.metadata.kind;\n        const scope = await memo(scopes, kind, async () => {\n          return await this.scopeFor(projectId, kind, options.viewerId);\n        });\n        const cached = await this.lookup(projectId, kind, parsed.ref, scope);\n        return { url, provider: parsed.provider, ref: parsed.ref, cached, scope };\n      }),\n    );\n    const known = lookups.filter((item) => item !== null);\n    const results = new Map<string, DesignNode | null>(\n      known.map((item) => [item.url, item.cached]),\n    );\n    const due = known.filter((item) => isDue(item.cached, now));\n    if (due.length === 0) return results;\n    const fresh = await this.refreshDue(projectId, due, now, callOptions(this.logger, options));\n    for (const [url, node] of fresh) results.set(url, node);\n    return results;\n  }\n\n  /** Refresh due links grouped by provider and file, files in parallel (bounded). */\n  private async refreshDue(\n    projectId: string,\n    due: Due[],\n    now: Date,\n    call: DesignCallOptions,\n  ): Promise<Map<string, DesignNode>> {\n    const byFile = [\n      ...Map.groupBy(due, (item) => `${item.provider.metadata.kind}\\u0000${item.ref.fileKey}`),\n    ];\n    const batches = await mapLimit(byFile, FILE_CONCURRENCY, async ([, items]) => {\n      return await this.refreshFile(projectId, items, now, call);\n    });\n    const merged = new Map<string, DesignNode>();\n    for (const batch of batches) {\n      for (const [url, node] of batch) merged.set(url, node);\n    }\n    return merged;\n  }\n\n  private async refreshFile(\n    projectId: string,\n    items: Due[],\n    now: Date,\n    call: DesignCallOptions,\n  ): Promise<Map<string, DesignNode>> {\n    const client = await this.clientFor(projectId, items);\n    const first = items[0];\n    if (!client || !first) return new Map();\n    const { provider, ref } = first;\n    const metas = await client.fetchMetas(\n      ref.fileKey,\n      items.map((item) => item.ref),\n      call,\n    );\n    const answered = [...metas.values()].find((meta) => meta.state !== \"error\");\n    if (answered && first.scope === PROJECT_SCOPE) {\n      await this.credentials.recordStatus(\n        projectId,\n        provider.metadata.kind,\n        statusFor(answered.state),\n      );\n    }\n    const stored = await this.storeAll(projectId, items, metas, now);\n    return await this.renders.ensure(projectId, client, ref.fileKey, stored, call);\n  }\n\n  /** Upsert a row per item that got a usable answer (`error` keeps its cached row), keyed by URL. */\n  private async storeAll(\n    projectId: string,\n    items: Due[],\n    metas: Map<string, DesignMeta>,\n    now: Date,\n  ): Promise<Map<string, DesignNode>> {\n    const rows = await Promise.all(\n      items.map(async (item) => {\n        const meta = metas.get(item.ref.nodeId ?? \"\");\n        const row =\n          meta && meta.state !== \"error\" ? await this.store(projectId, item, meta, now) : null;\n        return row ? ([item.url, row] as const) : null;\n      }),\n    );\n    return new Map(rows.filter((entry) => entry !== null));\n  }\n\n  /** A client for the provider of `items` bound to the items' credential scope, or null without one. */\n  private async clientFor(projectId: string, items: Due[]): Promise<DesignClient | null> {\n    const first = items[0];\n    if (!first) return null;\n    const { provider, scope } = first;\n    const kind = provider.metadata.kind;\n    const own = scope !== PROJECT_SCOPE;\n    const credential = own\n      ? await this.connections?.accessToken(scope, kind, provider.oauth).catch(() => null)\n      : await this.credentials.get(projectId, kind).catch(() => null);\n    if (!credential) return null;\n    return provider.create({\n      credential,\n      authType: own ? \"oauth\" : \"token\",\n      ...(this.logger ? { logger: this.logger } : {}),\n    });\n  }\n\n  /**\n   * Whose credential serves a provider: the project's when set (it is shared and\n   * wins), else the viewer's own connection, else the project scope (nothing to fetch with).\n   */\n  private async scopeFor(projectId: string, provider: string, viewerId?: string): Promise<string> {\n    if (!viewerId || !this.connections || (await this.credentials.info(projectId, provider))) {\n      return PROJECT_SCOPE;\n    }\n    return (await this.connections.info(viewerId, provider)) ? viewerId : PROJECT_SCOPE;\n  }\n\n  /** The shared row, else the viewer's own (a connected member's entries are never served to others). */\n  private async visible(\n    projectId: string,\n    provider: string,\n    ref: DesignRef,\n    viewerId?: string,\n  ): Promise<DesignNode | null> {\n    const shared = await this.lookup(projectId, provider, ref, PROJECT_SCOPE);\n    if (shared || !viewerId) return shared;\n    return await this.lookup(projectId, provider, ref, viewerId);\n  }\n\n  private async lookup(\n    projectId: string,\n    provider: string,\n    ref: DesignRef,\n    scope: string,\n  ): Promise<DesignNode | null> {\n    const rows = (await this.db.list(this.tables.designNodes, {\n      where: and(\n        eq(col(this.tables.designNodes, \"projectId\"), projectId),\n        eq(col(this.tables.designNodes, \"provider\"), provider),\n        eq(col(this.tables.designNodes, \"viewerId\"), scope),\n        eq(col(this.tables.designNodes, \"fileKey\"), ref.fileKey),\n        eq(col(this.tables.designNodes, \"nodeId\"), ref.nodeId ?? \"\"),\n      ),\n      limit: 1,\n    })) as unknown as DesignNode[];\n    return rows[0] ?? null;\n  }\n\n  /**\n   * Upsert the row. Non-ok states keep the last good name/version/modified time\n   * (an auth failure must not erase the label); a deleted node also drops its\n   * cached render, so a design that no longer exists is never shown as reference.\n   */\n  private async store(\n    projectId: string,\n    item: Due,\n    meta: DesignMeta,\n    now: Date,\n  ): Promise<DesignNode> {\n    const { ref, cached } = item;\n    const stamp = now.toISOString();\n    const keep = meta.state !== \"ok\" && cached;\n    const values = {\n      name: keep ? cached.name : meta.name,\n      version: keep ? cached.version : meta.version,\n      lastModified: keep ? cached.lastModified : meta.lastModified,\n      state: meta.state,\n      fetchedAt: stamp,\n      updatedAt: stamp,\n    };\n    if (!cached) {\n      return (await this.db.insert(this.tables.designNodes, {\n        id: ulid(),\n        projectId,\n        provider: item.provider.metadata.kind,\n        viewerId: item.scope,\n        fileKey: ref.fileKey,\n        nodeId: ref.nodeId ?? \"\",\n        renderPath: null,\n        renderVersion: null,\n        createdAt: stamp,\n        ...values,\n      })) as unknown as DesignNode;\n    }\n    const dropRender = meta.state === \"deleted\" && cached.renderPath !== null;\n    if (dropRender) await this.renders.remove(cached);\n    return (await this.db.update(this.tables.designNodes, cached.id, {\n      ...values,\n      ...(dropRender ? { renderPath: null, renderVersion: null } : {}),\n    })) as unknown as DesignNode;\n  }\n}\n\n/** Never fetched, or cached longer ago than the TTL. */\nfunction isDue(cached: DesignNode | null, now: Date): boolean {\n  return !cached || now.getTime() - Date.parse(cached.fetchedAt) >= DESIGN_TTL_MS;\n}\n\nfunction callOptions(logger: Logger | undefined, options: RefreshOptions): DesignCallOptions {\n  return {\n    ...(logger ? { logger } : {}),\n    ...(options.signal ? { signal: options.signal } : {}),\n  };\n}\n\nfunction statusFor(state: DesignMeta[\"state\"]): DesignCredentialStatus {\n  return state === \"unauthorized\" || state === \"forbidden\" ? state : \"ok\";\n}\n\n/** Run `load` once per key, sharing the in-flight promise between concurrent callers. */\nasync function memo<T>(\n  cache: Map<string, Promise<T>>,\n  key: string,\n  load: () => Promise<T>,\n): Promise<T> {\n  const hit = cache.get(key);\n  if (hit) return await hit;\n  const created = load();\n  cache.set(key, created);\n  return await created;\n}\n"],"mappings":";;;;;;;;;;;;;;AA0BA,MAAM,mBAAmB;;AA0BzB,IAAa,kBAAb,MAA6B;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YACE,IACA,aACA,WACA,UAMI,CAAC,GACL;EACA,KAAK,KAAK;EACV,KAAK,cAAc;EACnB,KAAK,YAAY;EACjB,KAAK,SAAS,QAAQ,UAAU,EAAE,aAAa,GAAG,OAAO,YAAY;EACrE,KAAK,UAAU,IAAI,kBACjB,IACA,KAAK,OAAO,aACZ,QAAQ,SACR,QAAQ,MACV;EACA,KAAK,SAAS,QAAQ;EACtB,KAAK,cAAc,QAAQ;CAC7B;;CAGA,MAAM,IAAI,WAAmB,IAAwC;EACnE,MAAM,MAAO,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,aAAa,EAAE;EAC1D,OAAO,KAAK,cAAc,YAAY,MAAM;CAC9C;;CAGA,MAAM,WAAW,MAA0C;EACzD,OAAO,MAAM,KAAK,QAAQ,KAAK,IAAI;CACrC;;;;;CAMA,MAAM,UACJ,WACA,MACA,UACkC;EAClC,MAAM,OAAO,MAAM,QAAQ,IACzB,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,QAAQ;GACpC,MAAM,SAAS,eAAe,KAAK,WAAW,GAAG;GAIjD,OAAO,CAAC,KAHI,SACR,MAAM,KAAK,QAAQ,WAAW,OAAO,SAAS,SAAS,MAAM,OAAO,KAAK,QAAQ,IACjF,IACY;EAClB,CAAC,CACH;EACA,OAAO,IAAI,IAAI,KAAK,SAAS,CAAC,KAAK,SAAU,MAAM,CAAC,CAAC,KAAK,GAAG,CAAU,IAAI,CAAC,CAAE,CAAC;CACjF;;CAGA,MAAM,QACJ,WACA,KACA,KACA,UAC4B;EAK5B,QAAO,MAJe,KAAK,YAAY,WAAW,CAAC,GAAG,GAAG;GACvD,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;GACrB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EACjC,CAAC,EAAA,CACc,IAAI,GAAG,KAAK;CAC7B;;;;;;;CAQA,MAAM,YACJ,WACA,MACA,UAA0B,CAAC,GACc;EACzC,MAAM,MAAM,QAAQ,uBAAO,IAAI,KAAK;EACpC,MAAM,yBAAS,IAAI,IAA6B;EAahD,MAAM,SAAQ,MAZQ,QAAQ,IAC5B,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,QAAQ;GACpC,MAAM,SAAS,eAAe,KAAK,WAAW,GAAG;GACjD,IAAI,CAAC,QAAQ,OAAO;GACpB,MAAM,OAAO,OAAO,SAAS,SAAS;GACtC,MAAM,QAAQ,MAAM,KAAK,QAAQ,MAAM,YAAY;IACjD,OAAO,MAAM,KAAK,SAAS,WAAW,MAAM,QAAQ,QAAQ;GAC9D,CAAC;GACD,MAAM,SAAS,MAAM,KAAK,OAAO,WAAW,MAAM,OAAO,KAAK,KAAK;GACnE,OAAO;IAAE;IAAK,UAAU,OAAO;IAAU,KAAK,OAAO;IAAK;IAAQ;GAAM;EAC1E,CAAC,CACH,EAAA,CACsB,QAAQ,SAAS,SAAS,IAAI;EACpD,MAAM,UAAU,IAAI,IAClB,MAAM,KAAK,SAAS,CAAC,KAAK,KAAK,KAAK,MAAM,CAAC,CAC7C;EACA,MAAM,MAAM,MAAM,QAAQ,SAAS,MAAM,KAAK,QAAQ,GAAG,CAAC;EAC1D,IAAI,IAAI,WAAW,GAAG,OAAO;EAC7B,MAAM,QAAQ,MAAM,KAAK,WAAW,WAAW,KAAK,KAAK,YAAY,KAAK,QAAQ,OAAO,CAAC;EAC1F,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,IAAI,KAAK,IAAI;EACtD,OAAO;CACT;;CAGA,MAAc,WACZ,WACA,KACA,KACA,MACkC;EAClC,MAAM,SAAS,CACb,GAAG,IAAI,QAAQ,MAAM,SAAS,GAAG,KAAK,SAAS,SAAS,KAAK,QAAQ,KAAK,IAAI,SAAS,CACzF;EACA,MAAM,UAAU,MAAM,SAAS,QAAQ,kBAAkB,OAAO,GAAG,WAAW;GAC5E,OAAO,MAAM,KAAK,YAAY,WAAW,OAAO,KAAK,IAAI;EAC3D,CAAC;EACD,MAAM,yBAAS,IAAI,IAAwB;EAC3C,KAAK,MAAM,SAAS,SAClB,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,OAAO,IAAI,KAAK,IAAI;EAEvD,OAAO;CACT;CAEA,MAAc,YACZ,WACA,OACA,KACA,MACkC;EAClC,MAAM,SAAS,MAAM,KAAK,UAAU,WAAW,KAAK;EACpD,MAAM,QAAQ,MAAM;EACpB,IAAI,CAAC,UAAU,CAAC,OAAO,uBAAO,IAAI,IAAI;EACtC,MAAM,EAAE,UAAU,QAAQ;EAC1B,MAAM,QAAQ,MAAM,OAAO,WACzB,IAAI,SACJ,MAAM,KAAK,SAAS,KAAK,GAAG,GAC5B,IACF;EACA,MAAM,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,KAAK,UAAU,OAAO;EAC1E,IAAI,YAAY,MAAM,UAAA,IACpB,MAAM,KAAK,YAAY,aACrB,WACA,SAAS,SAAS,MAClB,UAAU,SAAS,KAAK,CAC1B;EAEF,MAAM,SAAS,MAAM,KAAK,SAAS,WAAW,OAAO,OAAO,GAAG;EAC/D,OAAO,MAAM,KAAK,QAAQ,OAAO,WAAW,QAAQ,IAAI,SAAS,QAAQ,IAAI;CAC/E;;CAGA,MAAc,SACZ,WACA,OACA,OACA,KACkC;EAClC,MAAM,OAAO,MAAM,QAAQ,IACzB,MAAM,IAAI,OAAO,SAAS;GACxB,MAAM,OAAO,MAAM,IAAI,KAAK,IAAI,UAAU,EAAE;GAC5C,MAAM,MACJ,QAAQ,KAAK,UAAU,UAAU,MAAM,KAAK,MAAM,WAAW,MAAM,MAAM,GAAG,IAAI;GAClF,OAAO,MAAO,CAAC,KAAK,KAAK,GAAG,IAAc;EAC5C,CAAC,CACH;EACA,OAAO,IAAI,IAAI,KAAK,QAAQ,UAAU,UAAU,IAAI,CAAC;CACvD;;CAGA,MAAc,UAAU,WAAmB,OAA4C;EACrF,MAAM,QAAQ,MAAM;EACpB,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,EAAE,UAAU,UAAU;EAC5B,MAAM,OAAO,SAAS,SAAS;EAC/B,MAAM,MAAM,UAAA;EACZ,MAAM,aAAa,MACf,MAAM,KAAK,aAAa,YAAY,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,IAAI,IACjF,MAAM,KAAK,YAAY,IAAI,WAAW,IAAI,CAAC,CAAC,YAAY,IAAI;EAChE,IAAI,CAAC,YAAY,OAAO;EACxB,OAAO,SAAS,OAAO;GACrB;GACA,UAAU,MAAM,UAAU;GAC1B,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;EAC/C,CAAC;CACH;;;;;CAMA,MAAc,SAAS,WAAmB,UAAkB,UAAoC;EAC9F,IAAI,CAAC,YAAY,CAAC,KAAK,eAAgB,MAAM,KAAK,YAAY,KAAK,WAAW,QAAQ,GACpF,OAAA;EAEF,OAAQ,MAAM,KAAK,YAAY,KAAK,UAAU,QAAQ,IAAK,WAAA;CAC7D;;CAGA,MAAc,QACZ,WACA,UACA,KACA,UAC4B;EAC5B,MAAM,SAAS,MAAM,KAAK,OAAO,WAAW,UAAU,KAAA,EAAkB;EACxE,IAAI,UAAU,CAAC,UAAU,OAAO;EAChC,OAAO,MAAM,KAAK,OAAO,WAAW,UAAU,KAAK,QAAQ;CAC7D;CAEA,MAAc,OACZ,WACA,UACA,KACA,OAC4B;EAW5B,QAAO,MAVa,KAAK,GAAG,KAAK,KAAK,OAAO,aAAa;GACxD,OAAO,IACL,GAAG,IAAI,KAAK,OAAO,aAAa,WAAW,GAAG,SAAS,GACvD,GAAG,IAAI,KAAK,OAAO,aAAa,UAAU,GAAG,QAAQ,GACrD,GAAG,IAAI,KAAK,OAAO,aAAa,UAAU,GAAG,KAAK,GAClD,GAAG,IAAI,KAAK,OAAO,aAAa,SAAS,GAAG,IAAI,OAAO,GACvD,GAAG,IAAI,KAAK,OAAO,aAAa,QAAQ,GAAG,IAAI,UAAU,EAAE,CAC7D;GACA,OAAO;EACT,CAAC,EAAA,CACW,MAAM;CACpB;;;;;;CAOA,MAAc,MACZ,WACA,MACA,MACA,KACqB;EACrB,MAAM,EAAE,KAAK,WAAW;EACxB,MAAM,QAAQ,IAAI,YAAY;EAC9B,MAAM,OAAO,KAAK,UAAU,QAAQ;EACpC,MAAM,SAAS;GACb,MAAM,OAAO,OAAO,OAAO,KAAK;GAChC,SAAS,OAAO,OAAO,UAAU,KAAK;GACtC,cAAc,OAAO,OAAO,eAAe,KAAK;GAChD,OAAO,KAAK;GACZ,WAAW;GACX,WAAW;EACb;EACA,IAAI,CAAC,QACH,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,aAAa;GACpD,IAAI,KAAK;GACT;GACA,UAAU,KAAK,SAAS,SAAS;GACjC,UAAU,KAAK;GACf,SAAS,IAAI;GACb,QAAQ,IAAI,UAAU;GACtB,YAAY;GACZ,eAAe;GACf,WAAW;GACX,GAAG;EACL,CAAC;EAEH,MAAM,aAAa,KAAK,UAAU,aAAa,OAAO,eAAe;EACrE,IAAI,YAAY,MAAM,KAAK,QAAQ,OAAO,MAAM;EAChD,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,aAAa,OAAO,IAAI;GAC/D,GAAG;GACH,GAAI,aAAa;IAAE,YAAY;IAAM,eAAe;GAAK,IAAI,CAAC;EAChE,CAAC;CACH;AACF;;AAGA,SAAS,MAAM,QAA2B,KAAoB;CAC5D,OAAO,CAAC,UAAU,IAAI,QAAQ,IAAI,KAAK,MAAM,OAAO,SAAS,KAAA;AAC/D;AAEA,SAAS,YAAY,QAA4B,SAA4C;CAC3F,OAAO;EACL,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;CACrD;AACF;AAEA,SAAS,UAAU,OAAoD;CACrE,OAAO,UAAU,kBAAkB,UAAU,cAAc,QAAQ;AACrE;;AAGA,eAAe,KACb,OACA,KACA,MACY;CACZ,MAAM,MAAM,MAAM,IAAI,GAAG;CACzB,IAAI,KAAK,OAAO,MAAM;CACtB,MAAM,UAAU,KAAK;CACrB,MAAM,IAAI,KAAK,OAAO;CACtB,OAAO,MAAM;AACf"}

package/dist/models/design-renders.mjs

@@ -0,0 +1,74 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { designRenderPath } from "../paths.mjs";
+//#region src/models/design-renders.ts
+/**
+* Renders live at `{projectId}/design/{provider}/{fileKey}/{node}.png` (a member's own
+* connection: `…/{provider}/user-{id}/{fileKey}/…`), one per
+* linked node and overwritten in place when the file version moves, so storage
+* is bounded by the number of distinct linked nodes. A deleted node drops its
+* render; a link removed from settings (or a deleted project) leaves its PNG behind.
+*/
+var DesignRenderStore = class {
+	db;
+	table;
+	storage;
+	logger;
+	constructor(db, table, storage, logger) {
+		this.db = db;
+		this.table = table;
+		this.storage = storage;
+		this.logger = logger;
+	}
+	/** Cached render bytes of a node, or null when it has none (or storage is not wired). */
+	async read(node) {
+		if (!this.storage || !node.renderPath) return null;
+		return await this.storage.read(node.renderPath).catch(() => null);
+	}
+	/** Delete a node's stored render (its row is cleared by the caller's update). */
+	async remove(node) {
+		if (node.renderPath) await this.storage?.delete(node.renderPath).catch(() => {});
+	}
+	/**
+	* Fetch renders (one call per file) for the ok node rows that are missing one
+	* or hold an older file version, keyed by link URL. Failures keep the previous
+	* render and the row unchanged.
+	*/
+	async ensure(projectId, client, fileKey, stored, call) {
+		const needing = [...stored].filter(([, node]) => needsRender(node));
+		if (!this.storage || needing.length === 0) return stored;
+		try {
+			const renders = await client.fetchRenders(fileKey, needing.map(([, node]) => node.nodeId), call);
+			const saved = await Promise.all(needing.map(async ([url, node]) => {
+				const png = renders.get(node.nodeId);
+				return png ? [url, await this.save(projectId, node, png)] : null;
+			}));
+			for (const entry of saved) if (entry) stored.set(entry[0], entry[1]);
+		} catch (error) {
+			this.logger?.warn({
+				err: error,
+				fileKey,
+				nodes: needing.length
+			}, "design render fetch failed");
+		}
+		return stored;
+	}
+	async save(projectId, node, png) {
+		const path = designRenderPath(projectId, node.provider, node.fileKey, node.nodeId, node.viewerId);
+		await this.storage?.write(path, png);
+		return await this.db.update(this.table, node.id, {
+			renderPath: path,
+			renderVersion: node.version,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+};
+/** An ok node row whose render is missing or taken at an older file version. */
+function needsRender(node) {
+	return node.state === "ok" && node.nodeId !== "" && node.version !== null && node.renderVersion !== node.version;
+}
+//#endregion
+export { DesignRenderStore };
+
+//# sourceMappingURL=design-renders.mjs.map