@storyshelf/core 0.6.2 → 0.7.0

package/dist/models/changeset.d.mts

@@ -0,0 +1,48 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { DatabaseAdapter } from "../adapter/database.mjs";
+import { Build } from "../schema/build.mjs";
+import { BuildComponent } from "../schema/build-component.mjs";
+//#region src/models/changeset.d.ts
+/** What the changeset shows of a component. */
+type ChangesetComponent = Pick<BuildComponent, "importPath" | "title" | "storyCount">;
+/** A component present in both builds whose hash differs. */
+interface ChangedComponent extends ChangesetComponent {
+  /** Stories in the baseline build's version. */
+  previousStoryCount: number;
+}
+/** Components added, removed and changed from a baseline build to a build. */
+interface Changeset {
+  added: ChangesetComponent[];
+  removed: ChangesetComponent[];
+  changed: ChangedComponent[];
+  /** Components with the same hash in both builds. */
+  unchanged: number;
+}
+/** A build's changeset and what it was measured against. */
+interface BuildChangeset {
+  /** The baseline build; null when there is none (every component then counts as added). */
+  baseline: Build | null;
+  changeset: Changeset;
+}
+/**
+ * Compare a build's components with the baseline's. Components match by story file, or by title
+ * when the index carries no file. With no baseline (`null`) every component is `added`.
+ */
+declare function computeChangeset(current: readonly BuildComponent[], baseline: readonly BuildComponent[] | null): Changeset;
+/**
+ * The build a build is compared with: the latest accepted build of its branch before it, else the
+ * latest accepted default-branch build (the rule baselines use). Null for the first build.
+ */
+declare function findChangesetBaseline(db: DatabaseAdapter, project: {
+  id: string;
+  gitDefaultBranch: string;
+}, build: Build): Promise<Build | null>;
+/** The changeset of `build` against its baseline; empty rows on both sides when it has no catalog. */
+declare function changesetOf(db: DatabaseAdapter, project: {
+  id: string;
+  gitDefaultBranch: string;
+}, build: Build): Promise<BuildChangeset>;
+//#endregion
+export { BuildChangeset, ChangedComponent, Changeset, ChangesetComponent, changesetOf, computeChangeset, findChangesetBaseline };
+//# sourceMappingURL=changeset.d.mts.map

package/dist/models/changeset.mjs

@@ -0,0 +1,81 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BuildModel } from "./build.mjs";
+import { BuildComponentModel } from "./build-component.mjs";
+//#region src/models/changeset.ts
+/**
+* Compare a build's components with the baseline's. Components match by story file, or by title
+* when the index carries no file. With no baseline (`null`) every component is `added`.
+*/
+function computeChangeset(current, baseline) {
+	const was = new Map((baseline ?? []).map((row) => [keyOf(row), row]));
+	const now = new Map(current.map((row) => [keyOf(row), row]));
+	const changeset = {
+		added: [],
+		removed: [],
+		changed: [],
+		unchanged: 0
+	};
+	for (const [key, row] of now) place(changeset, row, was.get(key));
+	for (const [key, row] of was) if (!now.has(key)) changeset.removed.push(summary(row));
+	return {
+		...changeset,
+		added: changeset.added.toSorted(byTitle),
+		removed: changeset.removed.toSorted(byTitle),
+		changed: changeset.changed.toSorted(byTitle)
+	};
+}
+/** File `row` under added, changed or unchanged, given the baseline's version of it. */
+function place(changeset, row, before) {
+	if (before === void 0) changeset.added.push(summary(row));
+	else if (before.hash === row.hash) changeset.unchanged += 1;
+	else changeset.changed.push({
+		...summary(row),
+		previousStoryCount: before.storyCount
+	});
+}
+/**
+* The build a build is compared with: the latest accepted build of its branch before it, else the
+* latest accepted default-branch build (the rule baselines use). Null for the first build.
+*/
+async function findChangesetBaseline(db, project, build) {
+	const builds = new BuildModel(db);
+	const branches = [.../* @__PURE__ */ new Set([build.gitBranch, project.gitDefaultBranch])];
+	const lists = await Promise.all(branches.map(async (branch) => await builds.list(project.id, {
+		branch,
+		status: "approved"
+	})));
+	for (const accepted of lists) {
+		const baseline = accepted.find((candidate) => candidate.id !== build.id && candidate.createdAt < build.createdAt);
+		if (baseline) return baseline;
+	}
+	return null;
+}
+/** The changeset of `build` against its baseline; empty rows on both sides when it has no catalog. */
+async function changesetOf(db, project, build) {
+	const components = new BuildComponentModel(db);
+	const baseline = await findChangesetBaseline(db, project, build);
+	const [current, before] = await Promise.all([components.listByBuild(build.id), baseline ? components.listByBuild(baseline.id) : Promise.resolve(null)]);
+	return {
+		baseline,
+		changeset: computeChangeset(current, before)
+	};
+}
+function keyOf(row) {
+	return row.importPath === "" ? `title:${row.title}` : row.importPath;
+}
+function summary(row) {
+	return {
+		importPath: row.importPath,
+		title: row.title,
+		storyCount: row.storyCount
+	};
+}
+function byTitle(a, b) {
+	return a.title.localeCompare(b.title) || a.importPath.localeCompare(b.importPath);
+}
+//#endregion
+export { changesetOf, computeChangeset, findChangesetBaseline };
+
+//# sourceMappingURL=changeset.mjs.map

package/dist/models/changeset.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"changeset.mjs","names":[],"sources":["../../src/models/changeset.ts"],"sourcesContent":["/**\n * The changeset of a build without screenshots (ADR 0013, decision 8): which components the build\n * added, removed or changed against its baseline build, from the `build_components` hashes. A\n * changed hash means the component's stories changed, not that anything looks different.\n */\nimport type { DatabaseAdapter } from \"../adapters/database.ts\";\nimport type { BuildComponent } from \"../schema/build-component.ts\";\nimport type { Build } from \"../schema/build.ts\";\nimport { BuildComponentModel } from \"./build-component.ts\";\nimport { BuildModel } from \"./build.ts\";\n\n/** What the changeset shows of a component. */\nexport type ChangesetComponent = Pick<BuildComponent, \"importPath\" | \"title\" | \"storyCount\">;\n\n/** A component present in both builds whose hash differs. */\nexport interface ChangedComponent extends ChangesetComponent {\n  /** Stories in the baseline build's version. */\n  previousStoryCount: number;\n}\n\n/** Components added, removed and changed from a baseline build to a build. */\nexport interface Changeset {\n  added: ChangesetComponent[];\n  removed: ChangesetComponent[];\n  changed: ChangedComponent[];\n  /** Components with the same hash in both builds. */\n  unchanged: number;\n}\n\n/** A build's changeset and what it was measured against. */\nexport interface BuildChangeset {\n  /** The baseline build; null when there is none (every component then counts as added). */\n  baseline: Build | null;\n  changeset: Changeset;\n}\n\n/**\n * Compare a build's components with the baseline's. Components match by story file, or by title\n * when the index carries no file. With no baseline (`null`) every component is `added`.\n */\nexport function computeChangeset(\n  current: readonly BuildComponent[],\n  baseline: readonly BuildComponent[] | null,\n): Changeset {\n  const was = new Map((baseline ?? []).map((row) => [keyOf(row), row] as const));\n  const now = new Map(current.map((row) => [keyOf(row), row] as const));\n  const changeset: Changeset = { added: [], removed: [], changed: [], unchanged: 0 };\n  for (const [key, row] of now) {\n    place(changeset, row, was.get(key));\n  }\n  for (const [key, row] of was) {\n    if (!now.has(key)) {\n      changeset.removed.push(summary(row));\n    }\n  }\n  return {\n    ...changeset,\n    added: changeset.added.toSorted(byTitle),\n    removed: changeset.removed.toSorted(byTitle),\n    changed: changeset.changed.toSorted(byTitle),\n  };\n}\n\n/** File `row` under added, changed or unchanged, given the baseline's version of it. */\nfunction place(\n  changeset: Changeset,\n  row: BuildComponent,\n  before: BuildComponent | undefined,\n): void {\n  if (before === undefined) {\n    changeset.added.push(summary(row));\n  } else if (before.hash === row.hash) {\n    changeset.unchanged += 1;\n  } else {\n    changeset.changed.push({ ...summary(row), previousStoryCount: before.storyCount });\n  }\n}\n\n/**\n * The build a build is compared with: the latest accepted build of its branch before it, else the\n * latest accepted default-branch build (the rule baselines use). Null for the first build.\n */\nexport async function findChangesetBaseline(\n  db: DatabaseAdapter,\n  project: { id: string; gitDefaultBranch: string },\n  build: Build,\n): Promise<Build | null> {\n  const builds = new BuildModel(db);\n  const branches = [...new Set([build.gitBranch, project.gitDefaultBranch])];\n  const lists = await Promise.all(\n    branches.map(async (branch) => await builds.list(project.id, { branch, status: \"approved\" })),\n  );\n  for (const accepted of lists) {\n    const baseline = accepted.find(\n      (candidate) => candidate.id !== build.id && candidate.createdAt < build.createdAt,\n    );\n    if (baseline) {\n      return baseline;\n    }\n  }\n  return null;\n}\n\n/** The changeset of `build` against its baseline; empty rows on both sides when it has no catalog. */\nexport async function changesetOf(\n  db: DatabaseAdapter,\n  project: { id: string; gitDefaultBranch: string },\n  build: Build,\n): Promise<BuildChangeset> {\n  const components = new BuildComponentModel(db);\n  const baseline = await findChangesetBaseline(db, project, build);\n  const [current, before] = await Promise.all([\n    components.listByBuild(build.id),\n    baseline ? components.listByBuild(baseline.id) : Promise.resolve(null),\n  ]);\n  return { baseline, changeset: computeChangeset(current, before) };\n}\n\nfunction keyOf(row: Pick<BuildComponent, \"importPath\" | \"title\">): string {\n  return row.importPath === \"\" ? `title:${row.title}` : row.importPath;\n}\n\nfunction summary(row: BuildComponent): ChangesetComponent {\n  return { importPath: row.importPath, title: row.title, storyCount: row.storyCount };\n}\n\nfunction byTitle(a: ChangesetComponent, b: ChangesetComponent): number {\n  return a.title.localeCompare(b.title) || a.importPath.localeCompare(b.importPath);\n}\n"],"mappings":";;;;;;;;;;AAwCA,SAAgB,iBACd,SACA,UACW;CACX,MAAM,MAAM,IAAI,KAAK,YAAY,CAAC,EAAA,CAAG,KAAK,QAAQ,CAAC,MAAM,GAAG,GAAG,GAAG,CAAU,CAAC;CAC7E,MAAM,MAAM,IAAI,IAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,GAAG,GAAG,GAAG,CAAU,CAAC;CACpE,MAAM,YAAuB;EAAE,OAAO,CAAC;EAAG,SAAS,CAAC;EAAG,SAAS,CAAC;EAAG,WAAW;CAAE;CACjF,KAAK,MAAM,CAAC,KAAK,QAAQ,KACvB,MAAM,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC;CAEpC,KAAK,MAAM,CAAC,KAAK,QAAQ,KACvB,IAAI,CAAC,IAAI,IAAI,GAAG,GACd,UAAU,QAAQ,KAAK,QAAQ,GAAG,CAAC;CAGvC,OAAO;EACL,GAAG;EACH,OAAO,UAAU,MAAM,SAAS,OAAO;EACvC,SAAS,UAAU,QAAQ,SAAS,OAAO;EAC3C,SAAS,UAAU,QAAQ,SAAS,OAAO;CAC7C;AACF;;AAGA,SAAS,MACP,WACA,KACA,QACM;CACN,IAAI,WAAW,KAAA,GACb,UAAU,MAAM,KAAK,QAAQ,GAAG,CAAC;MAC5B,IAAI,OAAO,SAAS,IAAI,MAC7B,UAAU,aAAa;MAEvB,UAAU,QAAQ,KAAK;EAAE,GAAG,QAAQ,GAAG;EAAG,oBAAoB,OAAO;CAAW,CAAC;AAErF;;;;;AAMA,eAAsB,sBACpB,IACA,SACA,OACuB;CACvB,MAAM,SAAS,IAAI,WAAW,EAAE;CAChC,MAAM,WAAW,CAAC,mBAAG,IAAI,IAAI,CAAC,MAAM,WAAW,QAAQ,gBAAgB,CAAC,CAAC;CACzE,MAAM,QAAQ,MAAM,QAAQ,IAC1B,SAAS,IAAI,OAAO,WAAW,MAAM,OAAO,KAAK,QAAQ,IAAI;EAAE;EAAQ,QAAQ;CAAW,CAAC,CAAC,CAC9F;CACA,KAAK,MAAM,YAAY,OAAO;EAC5B,MAAM,WAAW,SAAS,MACvB,cAAc,UAAU,OAAO,MAAM,MAAM,UAAU,YAAY,MAAM,SAC1E;EACA,IAAI,UACF,OAAO;CAEX;CACA,OAAO;AACT;;AAGA,eAAsB,YACpB,IACA,SACA,OACyB;CACzB,MAAM,aAAa,IAAI,oBAAoB,EAAE;CAC7C,MAAM,WAAW,MAAM,sBAAsB,IAAI,SAAS,KAAK;CAC/D,MAAM,CAAC,SAAS,UAAU,MAAM,QAAQ,IAAI,CAC1C,WAAW,YAAY,MAAM,EAAE,GAC/B,WAAW,WAAW,YAAY,SAAS,EAAE,IAAI,QAAQ,QAAQ,IAAI,CACvE,CAAC;CACD,OAAO;EAAE;EAAU,WAAW,iBAAiB,SAAS,MAAM;CAAE;AAClE;AAEA,SAAS,MAAM,KAA2D;CACxE,OAAO,IAAI,eAAe,KAAK,SAAS,IAAI,UAAU,IAAI;AAC5D;AAEA,SAAS,QAAQ,KAAyC;CACxD,OAAO;EAAE,YAAY,IAAI;EAAY,OAAO,IAAI;EAAO,YAAY,IAAI;CAAW;AACpF;AAEA,SAAS,QAAQ,GAAuB,GAA+B;CACrE,OAAO,EAAE,MAAM,cAAc,EAAE,KAAK,KAAK,EAAE,WAAW,cAAc,EAAE,UAAU;AAClF"}

package/dist/models/columns.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getTableColumns } from "drizzle-orm";
+//#region src/models/columns.ts
+/**
+* Column handle for query builders (`eq`, `inArray`, `desc`, …) from a table
+* handle and a property name. Throws on an unknown name instead of letting
+* `undefined` reach the query builder.
+*/
+function col(table, name) {
+	const column = getTableColumns(table)[name];
+	if (!column) throw new Error(`Unknown column "${name}"`);
+	return column;
+}
+//#endregion
+export { col };
+
+//# sourceMappingURL=columns.mjs.map

package/dist/models/columns.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"columns.mjs","names":[],"sources":["../../src/models/columns.ts"],"sourcesContent":["import { getTableColumns } from \"drizzle-orm\";\nimport type { Column, Table } from \"drizzle-orm\";\n\n/**\n * Column handle for query builders (`eq`, `inArray`, `desc`, …) from a table\n * handle and a property name. Throws on an unknown name instead of letting\n * `undefined` reach the query builder.\n */\nexport function col(table: Table, name: string): Column {\n  const column = getTableColumns(table)[name];\n  if (!column) {\n    throw new Error(`Unknown column \"${name}\"`);\n  }\n  return column as Column;\n}\n"],"mappings":";;;;;;;;;;AAQA,SAAgB,IAAI,OAAc,MAAsB;CACtD,MAAM,SAAS,gBAAgB,KAAK,CAAC,CAAC;CACtC,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,mBAAmB,KAAK,EAAE;CAE5C,OAAO;AACT"}

package/dist/models/comment.d.mts

@@ -11,8 +11,8 @@ interface CommentTables {
 }
 /** Data operations for review comments. */
 declare class CommentModel {
-  private readonly db;
   private readonly tables;
+  private readonly db;
   constructor(db: DatabaseAdapter, tables?: CommentTables);
   listByBuild(buildId: string): Promise<Comment[]>;
   create(projectId: string, buildId: string, userId: string | null, input: CommentCreateInput): Promise<Comment>;
@@ -21,7 +21,10 @@ declare class CommentModel {
 /** Input for creating a review comment. */
 interface CommentCreateInput {
   body: string;
+  /** Anchor to a snapshot (builds with snapshots). */
   snapshotId?: string;
+  /** Anchor to a story of the build's catalog; not together with `snapshotId` (ADR 0013, decision 2). */
+  storyId?: string;
   parentId?: string;
 }
 //#endregion

package/dist/models/comment.mjs

@@ -2,13 +2,14 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ulid } from "../utils/ulid.mjs";
-import { eq, getTableColumns } from "drizzle-orm";
+import { col } from "./columns.mjs";
+import { eq } from "drizzle-orm";
 //#region src/models/comment.ts
 /** Build and snapshot review comments. */
 /** Data operations for review comments. */
 var CommentModel = class {
-	db;
 	tables;
+	db;
 	constructor(db, tables) {
 		this.db = db;
 		this.tables = tables ?? {
@@ -17,16 +18,18 @@ var CommentModel = class {
 		};
 	}
 	async listByBuild(buildId) {
-		return await this.db.list(this.tables.comments, { where: eq(getTableColumns(this.tables.comments)["buildId"], buildId) });
+		return await this.db.list(this.tables.comments, { where: eq(col(this.tables.comments, "buildId"), buildId) });
 	}
 	async create(projectId, buildId, userId, input) {
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		if (!await this.db.get(this.tables.projects, projectId)) throw new Error(`Project not found: ${projectId}`);
+		if (input.snapshotId !== void 0 && input.storyId !== void 0) throw new Error("A comment anchors to a build, a story or a snapshot, not several");
 		return await this.db.insert(this.tables.comments, {
 			id: ulid(),
 			projectId,
 			buildId,
-			snapshotId: input.snapshotId,
+			snapshotId: input.snapshotId ?? null,
+			storyId: input.storyId ?? null,
 			userId,
 			body: input.body,
 			parentId: input.parentId,

package/dist/models/comment.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"comment.mjs","names":[],"sources":["../../src/models/comment.ts"],"sourcesContent":["/** Build and snapshot review comments. */\nimport { eq, getTableColumns } from \"drizzle-orm\";\nimport type { SQLWrapper, Table } from \"drizzle-orm\";\nimport type { DatabaseAdapter } from \"../adapters/database.ts\";\nimport type { Comment } from \"../schema/comment.ts\";\nimport { ulid } from \"../utils/ulid.ts\";\n\n/** Tables required by {@link CommentModel}. */\nexport interface CommentTables {\n  comments: Table;\n  projects: Table;\n}\n\n/** Data operations for review comments. */\nexport class CommentModel {\n  private readonly tables: CommentTables;\n  constructor(\n    private readonly db: DatabaseAdapter,\n    tables?: CommentTables,\n  ) {\n    this.tables = tables ?? {\n      comments: db.tables.comments,\n      projects: db.tables.projects,\n    };\n  }\n\n  async listByBuild(buildId: string): Promise<Comment[]> {\n    return (await this.db.list(this.tables.comments, {\n      where: eq(getTableColumns(this.tables.comments)[\"buildId\"] as unknown as SQLWrapper, buildId),\n    })) as unknown as Comment[];\n  }\n\n  async create(\n    projectId: string,\n    buildId: string,\n    userId: string | null,\n    input: CommentCreateInput,\n  ): Promise<Comment> {\n    const now = new Date().toISOString();\n    const project = (await this.db.get(this.tables.projects, projectId)) as unknown as {\n      id: string;\n    } | null;\n    if (!project) {\n      throw new Error(`Project not found: ${projectId}`);\n    }\n    return (await this.db.insert(this.tables.comments, {\n      id: ulid(),\n      projectId,\n      buildId,\n      snapshotId: input.snapshotId,\n      userId,\n      body: input.body,\n      parentId: input.parentId,\n      resolved: false,\n      createdAt: now,\n      updatedAt: now,\n    })) as unknown as Comment;\n  }\n\n  async resolve(id: string): Promise<Comment> {\n    return (await this.db.update(this.tables.comments, id, {\n      resolved: true,\n      updatedAt: new Date().toISOString(),\n    })) as unknown as Comment;\n  }\n}\n\n/** Input for creating a review comment. */\nexport interface CommentCreateInput {\n  body: string;\n  snapshotId?: string;\n  parentId?: string;\n}\n"],"mappings":";;;;;;;;AAcA,IAAa,eAAb,MAA0B;CAGL;CAFnB;CACA,YACE,IACA,QACA;EAFiB,KAAA,KAAA;EAGjB,KAAK,SAAS,UAAU;GACtB,UAAU,GAAG,OAAO;GACpB,UAAU,GAAG,OAAO;EACtB;CACF;CAEA,MAAM,YAAY,SAAqC;EACrD,OAAQ,MAAM,KAAK,GAAG,KAAK,KAAK,OAAO,UAAU,EAC/C,OAAO,GAAG,gBAAgB,KAAK,OAAO,QAAQ,CAAC,CAAC,YAAqC,OAAO,EAC9F,CAAC;CACH;CAEA,MAAM,OACJ,WACA,SACA,QACA,OACkB;EAClB,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAInC,IAAI,CAAC,MAHkB,KAAK,GAAG,IAAI,KAAK,OAAO,UAAU,SAAS,GAIhE,MAAM,IAAI,MAAM,sBAAsB,WAAW;EAEnD,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,UAAU;GACjD,IAAI,KAAK;GACT;GACA;GACA,YAAY,MAAM;GAClB;GACA,MAAM,MAAM;GACZ,UAAU,MAAM;GAChB,UAAU;GACV,WAAW;GACX,WAAW;EACb,CAAC;CACH;CAEA,MAAM,QAAQ,IAA8B;EAC1C,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,UAAU,IAAI;GACrD,UAAU;GACV,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EACpC,CAAC;CACH;AACF"}
+{"version":3,"file":"comment.mjs","names":[],"sources":["../../src/models/comment.ts"],"sourcesContent":["/** Build and snapshot review comments. */\nimport { eq } from \"drizzle-orm\";\nimport type { Table } from \"drizzle-orm\";\nimport type { DatabaseAdapter } from \"../adapters/database.ts\";\nimport type { Comment } from \"../schema/comment.ts\";\nimport { ulid } from \"../utils/ulid.ts\";\nimport { col } from \"./columns.ts\";\n\n/** Tables required by {@link CommentModel}. */\nexport interface CommentTables {\n  comments: Table;\n  projects: Table;\n}\n\n/** Data operations for review comments. */\nexport class CommentModel {\n  private readonly tables: CommentTables;\n  private readonly db: DatabaseAdapter;\n\n  constructor(db: DatabaseAdapter, tables?: CommentTables) {\n    this.db = db;\n    this.tables = tables ?? {\n      comments: db.tables.comments,\n      projects: db.tables.projects,\n    };\n  }\n\n  async listByBuild(buildId: string): Promise<Comment[]> {\n    return (await this.db.list(this.tables.comments, {\n      where: eq(col(this.tables.comments, \"buildId\"), buildId),\n    })) as unknown as Comment[];\n  }\n\n  async create(\n    projectId: string,\n    buildId: string,\n    userId: string | null,\n    input: CommentCreateInput,\n  ): Promise<Comment> {\n    const now = new Date().toISOString();\n    const project = (await this.db.get(this.tables.projects, projectId)) as unknown as {\n      id: string;\n    } | null;\n    if (!project) {\n      throw new Error(`Project not found: ${projectId}`);\n    }\n    if (input.snapshotId !== undefined && input.storyId !== undefined) {\n      throw new Error(\"A comment anchors to a build, a story or a snapshot, not several\");\n    }\n    return (await this.db.insert(this.tables.comments, {\n      id: ulid(),\n      projectId,\n      buildId,\n      snapshotId: input.snapshotId ?? null,\n      storyId: input.storyId ?? null,\n      userId,\n      body: input.body,\n      parentId: input.parentId,\n      resolved: false,\n      createdAt: now,\n      updatedAt: now,\n    })) as unknown as Comment;\n  }\n\n  async resolve(id: string): Promise<Comment> {\n    return (await this.db.update(this.tables.comments, id, {\n      resolved: true,\n      updatedAt: new Date().toISOString(),\n    })) as unknown as Comment;\n  }\n}\n\n/** Input for creating a review comment. */\nexport interface CommentCreateInput {\n  body: string;\n  /** Anchor to a snapshot (builds with snapshots). */\n  snapshotId?: string;\n  /** Anchor to a story of the build's catalog; not together with `snapshotId` (ADR 0013, decision 2). */\n  storyId?: string;\n  parentId?: string;\n}\n"],"mappings":";;;;;;;;;AAeA,IAAa,eAAb,MAA0B;CACxB;CACA;CAEA,YAAY,IAAqB,QAAwB;EACvD,KAAK,KAAK;EACV,KAAK,SAAS,UAAU;GACtB,UAAU,GAAG,OAAO;GACpB,UAAU,GAAG,OAAO;EACtB;CACF;CAEA,MAAM,YAAY,SAAqC;EACrD,OAAQ,MAAM,KAAK,GAAG,KAAK,KAAK,OAAO,UAAU,EAC/C,OAAO,GAAG,IAAI,KAAK,OAAO,UAAU,SAAS,GAAG,OAAO,EACzD,CAAC;CACH;CAEA,MAAM,OACJ,WACA,SACA,QACA,OACkB;EAClB,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EAInC,IAAI,CAAC,MAHkB,KAAK,GAAG,IAAI,KAAK,OAAO,UAAU,SAAS,GAIhE,MAAM,IAAI,MAAM,sBAAsB,WAAW;EAEnD,IAAI,MAAM,eAAe,KAAA,KAAa,MAAM,YAAY,KAAA,GACtD,MAAM,IAAI,MAAM,kEAAkE;EAEpF,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,UAAU;GACjD,IAAI,KAAK;GACT;GACA;GACA,YAAY,MAAM,cAAc;GAChC,SAAS,MAAM,WAAW;GAC1B;GACA,MAAM,MAAM;GACZ,UAAU,MAAM;GAChB,UAAU;GACV,WAAW;GACX,WAAW;EACb,CAAC;CACH;CAEA,MAAM,QAAQ,IAA8B;EAC1C,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,UAAU,IAAI;GACrD,UAAU;GACV,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EACpC,CAAC;CACH;AACF"}

package/dist/models/component.d.mts

@@ -0,0 +1,43 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { SnapshotStatus } from "../types.mjs";
+import { Build } from "../schema/build.mjs";
+import { Snapshot } from "../schema/snapshot.mjs";
+//#region src/models/component.d.ts
+/** The most attention-worthy status of a set (unchanged when empty). */
+declare function worstStatus(statuses: readonly SnapshotStatus[]): SnapshotStatus;
+/** One build's view of a component. */
+interface ComponentHistoryRow {
+  build: Build;
+  /** Distinct stories (states) of the file captured in the build. */
+  states: number;
+  /** Distinct stories that are new or changed in the build. */
+  changedStates: number;
+  status: SnapshotStatus;
+  /** Snapshot the row links to: the first needing attention, else the first. */
+  snapshotId: string;
+}
+/** Per-build history of a component, newest build first; builds without a snapshot of it are skipped. */
+declare function componentHistory(snapshots: readonly Snapshot[], builds: readonly Build[]): ComponentHistoryRow[];
+/** Where a component page stands relative to the project's latest build. */
+type ComponentPresence = {
+  kind: "present";
+} | {
+  kind: "moved";
+  to: string;
+  title: string;
+} | {
+  kind: "deleted";
+  lastSeen: Build;
+} | {
+  kind: "unknown";
+};
+/**
+ * Classify a component against the latest build. `history` is the component's
+ * past builds (newest first); `latest` holds the latest build's snapshots of
+ * every file, used to find a moved file by its last-seen title.
+ */
+declare function componentPresence(history: readonly ComponentHistoryRow[], latestBuildId: string | null, latest: readonly Pick<Snapshot, "storyTitle" | "storyImportPath">[], lastTitle: string | null): ComponentPresence;
+//#endregion
+export { ComponentHistoryRow, ComponentPresence, componentHistory, componentPresence, worstStatus };
+//# sourceMappingURL=component.d.mts.map

package/dist/models/component.mjs

@@ -0,0 +1,60 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/models/component.ts
+/** Worst-first order used for status roll-ups. */
+const STATUS_PRIORITY = [
+	"rejected",
+	"changed",
+	"new",
+	"pending",
+	"approved",
+	"unchanged"
+];
+/** Statuses that count as "state changed" in a build. */
+const CHANGED = /* @__PURE__ */ new Set(["changed", "new"]);
+/** The most attention-worthy status of a set (unchanged when empty). */
+function worstStatus(statuses) {
+	return STATUS_PRIORITY.find((status) => statuses.includes(status)) ?? "unchanged";
+}
+/** Per-build history of a component, newest build first; builds without a snapshot of it are skipped. */
+function componentHistory(snapshots, builds) {
+	const byBuild = Map.groupBy(snapshots, (snapshot) => snapshot.buildId);
+	return builds.toSorted((a, b) => b.createdAt.localeCompare(a.createdAt)).flatMap((build) => {
+		const own = byBuild.get(build.id) ?? [];
+		const representative = own.find((snap) => snap.status === "changed" || snap.status === "new") ?? own[0];
+		if (!representative) return [];
+		const changed = own.filter((snap) => CHANGED.has(snap.status));
+		return [{
+			build,
+			states: new Set(own.map((snap) => snap.storyId)).size,
+			changedStates: new Set(changed.map((snap) => snap.storyId)).size,
+			status: worstStatus(own.map((snap) => snap.status)),
+			snapshotId: representative.id
+		}];
+	});
+}
+/**
+* Classify a component against the latest build. `history` is the component's
+* past builds (newest first); `latest` holds the latest build's snapshots of
+* every file, used to find a moved file by its last-seen title.
+*/
+function componentPresence(history, latestBuildId, latest, lastTitle) {
+	const [newest] = history;
+	if (!newest) return { kind: "unknown" };
+	if (newest.build.id === latestBuildId) return { kind: "present" };
+	const moved = latest.find((snap) => snap.storyTitle === lastTitle && snap.storyImportPath);
+	if (moved?.storyImportPath) return {
+		kind: "moved",
+		to: moved.storyImportPath,
+		title: moved.storyTitle
+	};
+	return {
+		kind: "deleted",
+		lastSeen: newest.build
+	};
+}
+//#endregion
+export { componentHistory, componentPresence, worstStatus };
+
+//# sourceMappingURL=component.mjs.map

package/dist/models/component.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"component.mjs","names":[],"sources":["../../src/models/component.ts"],"sourcesContent":["/** Component (story file) roll-ups: status priority, per-build history, and tombstone lookup. */\nimport type { Build } from \"../schema/build.ts\";\nimport type { Snapshot } from \"../schema/snapshot.ts\";\nimport type { SnapshotStatus } from \"../types.ts\";\n\n/** Worst-first order used for status roll-ups. */\nconst STATUS_PRIORITY: readonly SnapshotStatus[] = [\n  \"rejected\",\n  \"changed\",\n  \"new\",\n  \"pending\",\n  \"approved\",\n  \"unchanged\",\n];\n\n/** Statuses that count as \"state changed\" in a build. */\nconst CHANGED = new Set<SnapshotStatus>([\"changed\", \"new\"]);\n\n/** The most attention-worthy status of a set (unchanged when empty). */\nexport function worstStatus(statuses: readonly SnapshotStatus[]): SnapshotStatus {\n  return STATUS_PRIORITY.find((status) => statuses.includes(status)) ?? \"unchanged\";\n}\n\n/** One build's view of a component. */\nexport interface ComponentHistoryRow {\n  build: Build;\n  /** Distinct stories (states) of the file captured in the build. */\n  states: number;\n  /** Distinct stories that are new or changed in the build. */\n  changedStates: number;\n  status: SnapshotStatus;\n  /** Snapshot the row links to: the first needing attention, else the first. */\n  snapshotId: string;\n}\n\n/** Per-build history of a component, newest build first; builds without a snapshot of it are skipped. */\nexport function componentHistory(\n  snapshots: readonly Snapshot[],\n  builds: readonly Build[],\n): ComponentHistoryRow[] {\n  const byBuild = Map.groupBy(snapshots, (snapshot) => snapshot.buildId);\n  return builds\n    .toSorted((a, b) => b.createdAt.localeCompare(a.createdAt))\n    .flatMap((build): ComponentHistoryRow[] => {\n      const own = byBuild.get(build.id) ?? [];\n      const representative =\n        own.find((snap) => snap.status === \"changed\" || snap.status === \"new\") ?? own[0];\n      if (!representative) return [];\n      const changed = own.filter((snap) => CHANGED.has(snap.status));\n      return [\n        {\n          build,\n          states: new Set(own.map((snap) => snap.storyId)).size,\n          changedStates: new Set(changed.map((snap) => snap.storyId)).size,\n          status: worstStatus(own.map((snap) => snap.status)),\n          snapshotId: representative.id,\n        },\n      ];\n    });\n}\n\n/** Where a component page stands relative to the project's latest build. */\nexport type ComponentPresence =\n  | { kind: \"present\" }\n  | { kind: \"moved\"; to: string; title: string }\n  | { kind: \"deleted\"; lastSeen: Build }\n  | { kind: \"unknown\" };\n\n/**\n * Classify a component against the latest build. `history` is the component's\n * past builds (newest first); `latest` holds the latest build's snapshots of\n * every file, used to find a moved file by its last-seen title.\n */\nexport function componentPresence(\n  history: readonly ComponentHistoryRow[],\n  latestBuildId: string | null,\n  latest: readonly Pick<Snapshot, \"storyTitle\" | \"storyImportPath\">[],\n  lastTitle: string | null,\n): ComponentPresence {\n  const [newest] = history;\n  if (!newest) return { kind: \"unknown\" };\n  if (newest.build.id === latestBuildId) return { kind: \"present\" };\n  const moved = latest.find((snap) => snap.storyTitle === lastTitle && snap.storyImportPath);\n  if (moved?.storyImportPath) {\n    return { kind: \"moved\", to: moved.storyImportPath, title: moved.storyTitle };\n  }\n  return { kind: \"deleted\", lastSeen: newest.build };\n}\n"],"mappings":";;;;;AAMA,MAAM,kBAA6C;CACjD;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAM,0BAAU,IAAI,IAAoB,CAAC,WAAW,KAAK,CAAC;;AAG1D,SAAgB,YAAY,UAAqD;CAC/E,OAAO,gBAAgB,MAAM,WAAW,SAAS,SAAS,MAAM,CAAC,KAAK;AACxE;;AAeA,SAAgB,iBACd,WACA,QACuB;CACvB,MAAM,UAAU,IAAI,QAAQ,YAAY,aAAa,SAAS,OAAO;CACrE,OAAO,OACJ,UAAU,GAAG,MAAM,EAAE,UAAU,cAAc,EAAE,SAAS,CAAC,CAAC,CAC1D,SAAS,UAAiC;EACzC,MAAM,MAAM,QAAQ,IAAI,MAAM,EAAE,KAAK,CAAC;EACtC,MAAM,iBACJ,IAAI,MAAM,SAAS,KAAK,WAAW,aAAa,KAAK,WAAW,KAAK,KAAK,IAAI;EAChF,IAAI,CAAC,gBAAgB,OAAO,CAAC;EAC7B,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ,IAAI,KAAK,MAAM,CAAC;EAC7D,OAAO,CACL;GACE;GACA,QAAQ,IAAI,IAAI,IAAI,KAAK,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC;GACjD,eAAe,IAAI,IAAI,QAAQ,KAAK,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC;GAC5D,QAAQ,YAAY,IAAI,KAAK,SAAS,KAAK,MAAM,CAAC;GAClD,YAAY,eAAe;EAC7B,CACF;CACF,CAAC;AACL;;;;;;AAcA,SAAgB,kBACd,SACA,eACA,QACA,WACmB;CACnB,MAAM,CAAC,UAAU;CACjB,IAAI,CAAC,QAAQ,OAAO,EAAE,MAAM,UAAU;CACtC,IAAI,OAAO,MAAM,OAAO,eAAe,OAAO,EAAE,MAAM,UAAU;CAChE,MAAM,QAAQ,OAAO,MAAM,SAAS,KAAK,eAAe,aAAa,KAAK,eAAe;CACzF,IAAI,OAAO,iBACT,OAAO;EAAE,MAAM;EAAS,IAAI,MAAM;EAAiB,OAAO,MAAM;CAAW;CAE7E,OAAO;EAAE,MAAM;EAAW,UAAU,OAAO;CAAM;AACnD"}

package/dist/models/connections.d.mts

@@ -0,0 +1,41 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { DatabaseAdapter } from "../adapter/database.mjs";
+import { OAuthClient, OAuthTokens } from "../adapter/oauth.mjs";
+import { SecretInput } from "../utils/encrypt.mjs";
+import { UserConnection } from "../schema/connection.mjs";
+import { Table } from "drizzle-orm";
+//#region src/models/connections.d.ts
+/** Tables required by {@link ConnectionModel}. */
+interface ConnectionTables {
+  userConnections: Table;
+}
+/**
+ * Data operations for user OAuth connections, addressed by `(user, service)`.
+ * Plaintext only leaves through {@link accessToken}; a token is refreshed lazily,
+ * when its owner (or a request on their behalf) needs it — never in the background.
+ */
+declare class ConnectionModel {
+  private readonly tables;
+  private readonly db;
+  private readonly secret?;
+  constructor(db: DatabaseAdapter, secret?: SecretInput, tables?: ConnectionTables);
+  /** The connection row (never the plaintext), or null. */
+  info(userId: string, service: string): Promise<UserConnection | null>;
+  /** Every connection of a user (no plaintext), for a "connected apps" list. */
+  listForUser(userId: string): Promise<UserConnection[]>;
+  /** Store (or replace) a connection from fresh tokens; resets it to healthy. */
+  connect(userId: string, service: string, tokens: OAuthTokens): Promise<void>;
+  /** Remove a connection. */
+  remove(userId: string, service: string): Promise<void>;
+  /**
+   * A usable access token, refreshing it (once, under concurrent calls) when it is
+   * about to expire. A failed refresh marks the connection `expired` and returns
+   * null until the user reconnects.
+   */
+  accessToken(userId: string, service: string, oauth?: Pick<OAuthClient, "refresh">, now?: Date): Promise<string | null>;
+  private refreshOnce;
+}
+//#endregion
+export { ConnectionModel, ConnectionTables };
+//# sourceMappingURL=connections.d.mts.map

package/dist/models/connections.mjs

@@ -0,0 +1,112 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { decryptCredential, encrypt } from "../utils/encrypt.mjs";
+import { ulid } from "../utils/ulid.mjs";
+import { col } from "./columns.mjs";
+import { and, eq } from "drizzle-orm";
+//#region src/models/connections.ts
+/** A user's own OAuth connections to external services: encrypted tokens, lazy refresh on use. */
+/** Refresh this long before expiry so a call never starts with a token about to lapse. */
+const REFRESH_MARGIN_MS = 6e4;
+/** In-flight refreshes by connection, so concurrent page views refresh once (per process). */
+const refreshing = /* @__PURE__ */ new Map();
+/**
+* Data operations for user OAuth connections, addressed by `(user, service)`.
+* Plaintext only leaves through {@link accessToken}; a token is refreshed lazily,
+* when its owner (or a request on their behalf) needs it — never in the background.
+*/
+var ConnectionModel = class {
+	tables;
+	db;
+	secret;
+	constructor(db, secret, tables) {
+		this.db = db;
+		this.secret = secret;
+		this.tables = tables ?? { userConnections: db.tables.userConnections };
+	}
+	/** The connection row (never the plaintext), or null. */
+	async info(userId, service) {
+		return (await this.db.list(this.tables.userConnections, {
+			where: and(eq(col(this.tables.userConnections, "userId"), userId), eq(col(this.tables.userConnections, "service"), service)),
+			limit: 1
+		}))[0] ?? null;
+	}
+	/** Every connection of a user (no plaintext), for a "connected apps" list. */
+	async listForUser(userId) {
+		return await this.db.list(this.tables.userConnections, { where: eq(col(this.tables.userConnections, "userId"), userId) });
+	}
+	/** Store (or replace) a connection from fresh tokens; resets it to healthy. */
+	async connect(userId, service, tokens) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const values = {
+			tokenEncrypted: encrypt(this.secret, tokens.accessToken),
+			refreshTokenEncrypted: tokens.refreshToken ? encrypt(this.secret, tokens.refreshToken) : null,
+			expiresAt: tokens.expiresAt,
+			status: "ok",
+			updatedAt: now
+		};
+		const existing = await this.info(userId, service);
+		if (existing) {
+			await this.db.update(this.tables.userConnections, existing.id, values);
+			return;
+		}
+		await this.db.insert(this.tables.userConnections, {
+			id: ulid(),
+			userId,
+			service,
+			createdAt: now,
+			...values
+		});
+	}
+	/** Remove a connection. */
+	async remove(userId, service) {
+		const existing = await this.info(userId, service);
+		if (existing) await this.db.remove(this.tables.userConnections, existing.id);
+	}
+	/**
+	* A usable access token, refreshing it (once, under concurrent calls) when it is
+	* about to expire. A failed refresh marks the connection `expired` and returns
+	* null until the user reconnects.
+	*/
+	async accessToken(userId, service, oauth, now = /* @__PURE__ */ new Date()) {
+		const row = await this.info(userId, service);
+		if (!row || row.status === "expired") return null;
+		if (!isExpiring(row.expiresAt, now)) return decryptCredential(this.secret, row.tokenEncrypted);
+		const inFlight = refreshing.get(row.id);
+		if (inFlight) return await inFlight;
+		const pending = this.refreshOnce(row, oauth).finally(() => {
+			refreshing.delete(row.id);
+		});
+		refreshing.set(row.id, pending);
+		return await pending;
+	}
+	async refreshOnce(row, oauth) {
+		try {
+			if (!oauth || !row.refreshTokenEncrypted) throw new Error("connection cannot be refreshed");
+			const tokens = await oauth.refresh({ refreshToken: decryptCredential(this.secret, row.refreshTokenEncrypted) });
+			await this.db.update(this.tables.userConnections, row.id, {
+				tokenEncrypted: encrypt(this.secret, tokens.accessToken),
+				refreshTokenEncrypted: tokens.refreshToken ? encrypt(this.secret, tokens.refreshToken) : row.refreshTokenEncrypted,
+				expiresAt: tokens.expiresAt,
+				status: "ok",
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			return tokens.accessToken;
+		} catch {
+			await this.db.update(this.tables.userConnections, row.id, {
+				status: "expired",
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			return null;
+		}
+	}
+};
+/** Expiring within the margin (null never expires). */
+function isExpiring(expiresAt, now) {
+	return expiresAt !== null && Date.parse(expiresAt) - now.getTime() < REFRESH_MARGIN_MS;
+}
+//#endregion
+export { ConnectionModel };
+
+//# sourceMappingURL=connections.mjs.map

package/dist/models/connections.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.mjs","names":[],"sources":["../../src/models/connections.ts"],"sourcesContent":["/** A user's own OAuth connections to external services: encrypted tokens, lazy refresh on use. */\nimport { and, eq } from \"drizzle-orm\";\nimport type { Table } from \"drizzle-orm\";\nimport type { DatabaseAdapter } from \"../adapters/database.ts\";\nimport type { OAuthClient, OAuthTokens } from \"../adapters/oauth.ts\";\nimport type { UserConnection } from \"../schema/connection.ts\";\nimport { decryptCredential, encrypt, type SecretInput } from \"../utils/encrypt.ts\";\nimport { ulid } from \"../utils/ulid.ts\";\nimport { col } from \"./columns.ts\";\n\n/** Tables required by {@link ConnectionModel}. */\nexport interface ConnectionTables {\n  userConnections: Table;\n}\n\n/** Refresh this long before expiry so a call never starts with a token about to lapse. */\nconst REFRESH_MARGIN_MS = 60_000;\n\n/** In-flight refreshes by connection, so concurrent page views refresh once (per process). */\nconst refreshing = new Map<string, Promise<string | null>>();\n\n/**\n * Data operations for user OAuth connections, addressed by `(user, service)`.\n * Plaintext only leaves through {@link accessToken}; a token is refreshed lazily,\n * when its owner (or a request on their behalf) needs it — never in the background.\n */\nexport class ConnectionModel {\n  private readonly tables: ConnectionTables;\n  private readonly db: DatabaseAdapter;\n  private readonly secret?: SecretInput;\n\n  constructor(db: DatabaseAdapter, secret?: SecretInput, tables?: ConnectionTables) {\n    this.db = db;\n    this.secret = secret;\n    this.tables = tables ?? { userConnections: db.tables.userConnections };\n  }\n\n  /** The connection row (never the plaintext), or null. */\n  async info(userId: string, service: string): Promise<UserConnection | null> {\n    const rows = (await this.db.list(this.tables.userConnections, {\n      where: and(\n        eq(col(this.tables.userConnections, \"userId\"), userId),\n        eq(col(this.tables.userConnections, \"service\"), service),\n      ),\n      limit: 1,\n    })) as unknown as UserConnection[];\n    return rows[0] ?? null;\n  }\n\n  /** Every connection of a user (no plaintext), for a \"connected apps\" list. */\n  async listForUser(userId: string): Promise<UserConnection[]> {\n    return (await this.db.list(this.tables.userConnections, {\n      where: eq(col(this.tables.userConnections, \"userId\"), userId),\n    })) as unknown as UserConnection[];\n  }\n\n  /** Store (or replace) a connection from fresh tokens; resets it to healthy. */\n  async connect(userId: string, service: string, tokens: OAuthTokens): Promise<void> {\n    const now = new Date().toISOString();\n    const values = {\n      tokenEncrypted: encrypt(this.secret, tokens.accessToken),\n      refreshTokenEncrypted: tokens.refreshToken ? encrypt(this.secret, tokens.refreshToken) : null,\n      expiresAt: tokens.expiresAt,\n      status: \"ok\",\n      updatedAt: now,\n    };\n    const existing = await this.info(userId, service);\n    if (existing) {\n      await this.db.update(this.tables.userConnections, existing.id, values);\n      return;\n    }\n    await this.db.insert(this.tables.userConnections, {\n      id: ulid(),\n      userId,\n      service,\n      createdAt: now,\n      ...values,\n    });\n  }\n\n  /** Remove a connection. */\n  async remove(userId: string, service: string): Promise<void> {\n    const existing = await this.info(userId, service);\n    if (existing) await this.db.remove(this.tables.userConnections, existing.id);\n  }\n\n  /**\n   * A usable access token, refreshing it (once, under concurrent calls) when it is\n   * about to expire. A failed refresh marks the connection `expired` and returns\n   * null until the user reconnects.\n   */\n  async accessToken(\n    userId: string,\n    service: string,\n    oauth?: Pick<OAuthClient, \"refresh\">,\n    now = new Date(),\n  ): Promise<string | null> {\n    const row = await this.info(userId, service);\n    if (!row || row.status === \"expired\") return null;\n    if (!isExpiring(row.expiresAt, now)) return decryptCredential(this.secret, row.tokenEncrypted);\n    const inFlight = refreshing.get(row.id);\n    if (inFlight) return await inFlight;\n    const pending = this.refreshOnce(row, oauth).finally(() => {\n      refreshing.delete(row.id);\n    });\n    refreshing.set(row.id, pending);\n    return await pending;\n  }\n\n  private async refreshOnce(\n    row: UserConnection,\n    oauth: Pick<OAuthClient, \"refresh\"> | undefined,\n  ): Promise<string | null> {\n    try {\n      if (!oauth || !row.refreshTokenEncrypted) throw new Error(\"connection cannot be refreshed\");\n      const tokens = await oauth.refresh({\n        refreshToken: decryptCredential(this.secret, row.refreshTokenEncrypted),\n      });\n      await this.db.update(this.tables.userConnections, row.id, {\n        tokenEncrypted: encrypt(this.secret, tokens.accessToken),\n        refreshTokenEncrypted: tokens.refreshToken\n          ? encrypt(this.secret, tokens.refreshToken)\n          : row.refreshTokenEncrypted,\n        expiresAt: tokens.expiresAt,\n        status: \"ok\",\n        updatedAt: new Date().toISOString(),\n      });\n      return tokens.accessToken;\n    } catch {\n      await this.db.update(this.tables.userConnections, row.id, {\n        status: \"expired\",\n        updatedAt: new Date().toISOString(),\n      });\n      return null;\n    }\n  }\n}\n\n/** Expiring within the margin (null never expires). */\nfunction isExpiring(expiresAt: string | null, now: Date): boolean {\n  return expiresAt !== null && Date.parse(expiresAt) - now.getTime() < REFRESH_MARGIN_MS;\n}\n"],"mappings":";;;;;;;;;;AAgBA,MAAM,oBAAoB;;AAG1B,MAAM,6BAAa,IAAI,IAAoC;;;;;;AAO3D,IAAa,kBAAb,MAA6B;CAC3B;CACA;CACA;CAEA,YAAY,IAAqB,QAAsB,QAA2B;EAChF,KAAK,KAAK;EACV,KAAK,SAAS;EACd,KAAK,SAAS,UAAU,EAAE,iBAAiB,GAAG,OAAO,gBAAgB;CACvE;;CAGA,MAAM,KAAK,QAAgB,SAAiD;EAQ1E,QAAO,MAPa,KAAK,GAAG,KAAK,KAAK,OAAO,iBAAiB;GAC5D,OAAO,IACL,GAAG,IAAI,KAAK,OAAO,iBAAiB,QAAQ,GAAG,MAAM,GACrD,GAAG,IAAI,KAAK,OAAO,iBAAiB,SAAS,GAAG,OAAO,CACzD;GACA,OAAO;EACT,CAAC,EAAA,CACW,MAAM;CACpB;;CAGA,MAAM,YAAY,QAA2C;EAC3D,OAAQ,MAAM,KAAK,GAAG,KAAK,KAAK,OAAO,iBAAiB,EACtD,OAAO,GAAG,IAAI,KAAK,OAAO,iBAAiB,QAAQ,GAAG,MAAM,EAC9D,CAAC;CACH;;CAGA,MAAM,QAAQ,QAAgB,SAAiB,QAAoC;EACjF,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EACnC,MAAM,SAAS;GACb,gBAAgB,QAAQ,KAAK,QAAQ,OAAO,WAAW;GACvD,uBAAuB,OAAO,eAAe,QAAQ,KAAK,QAAQ,OAAO,YAAY,IAAI;GACzF,WAAW,OAAO;GAClB,QAAQ;GACR,WAAW;EACb;EACA,MAAM,WAAW,MAAM,KAAK,KAAK,QAAQ,OAAO;EAChD,IAAI,UAAU;GACZ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,iBAAiB,SAAS,IAAI,MAAM;GACrE;EACF;EACA,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,iBAAiB;GAChD,IAAI,KAAK;GACT;GACA;GACA,WAAW;GACX,GAAG;EACL,CAAC;CACH;;CAGA,MAAM,OAAO,QAAgB,SAAgC;EAC3D,MAAM,WAAW,MAAM,KAAK,KAAK,QAAQ,OAAO;EAChD,IAAI,UAAU,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,iBAAiB,SAAS,EAAE;CAC7E;;;;;;CAOA,MAAM,YACJ,QACA,SACA,OACA,sBAAM,IAAI,KAAK,GACS;EACxB,MAAM,MAAM,MAAM,KAAK,KAAK,QAAQ,OAAO;EAC3C,IAAI,CAAC,OAAO,IAAI,WAAW,WAAW,OAAO;EAC7C,IAAI,CAAC,WAAW,IAAI,WAAW,GAAG,GAAG,OAAO,kBAAkB,KAAK,QAAQ,IAAI,cAAc;EAC7F,MAAM,WAAW,WAAW,IAAI,IAAI,EAAE;EACtC,IAAI,UAAU,OAAO,MAAM;EAC3B,MAAM,UAAU,KAAK,YAAY,KAAK,KAAK,CAAC,CAAC,cAAc;GACzD,WAAW,OAAO,IAAI,EAAE;EAC1B,CAAC;EACD,WAAW,IAAI,IAAI,IAAI,OAAO;EAC9B,OAAO,MAAM;CACf;CAEA,MAAc,YACZ,KACA,OACwB;EACxB,IAAI;GACF,IAAI,CAAC,SAAS,CAAC,IAAI,uBAAuB,MAAM,IAAI,MAAM,gCAAgC;GAC1F,MAAM,SAAS,MAAM,MAAM,QAAQ,EACjC,cAAc,kBAAkB,KAAK,QAAQ,IAAI,qBAAqB,EACxE,CAAC;GACD,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,iBAAiB,IAAI,IAAI;IACxD,gBAAgB,QAAQ,KAAK,QAAQ,OAAO,WAAW;IACvD,uBAAuB,OAAO,eAC1B,QAAQ,KAAK,QAAQ,OAAO,YAAY,IACxC,IAAI;IACR,WAAW,OAAO;IAClB,QAAQ;IACR,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GACpC,CAAC;GACD,OAAO,OAAO;EAChB,QAAQ;GACN,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,iBAAiB,IAAI,IAAI;IACxD,QAAQ;IACR,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GACpC,CAAC;GACD,OAAO;EACT;CACF;AACF;;AAGA,SAAS,WAAW,WAA0B,KAAoB;CAChE,OAAO,cAAc,QAAQ,KAAK,MAAM,SAAS,IAAI,IAAI,QAAQ,IAAI;AACvE"}

package/dist/models/content-ref.d.mts

@@ -6,8 +6,8 @@ import { Table } from "drizzle-orm";
 //#region src/models/content-ref.d.ts
 /** Content refs for deduplicated Storybook assets. */
 declare class ContentRefModel {
-  private readonly db;
   private readonly tables;
+  private readonly db;
   constructor(db: DatabaseAdapter, tables?: {
     contentRefs: Table;
   });

package/dist/models/content-ref.mjs

@@ -4,8 +4,8 @@ import.meta.url;
 //#region src/models/content-ref.ts
 /** Content refs for deduplicated Storybook assets. */
 var ContentRefModel = class {
-	db;
 	tables;
+	db;
 	constructor(db, tables) {
 		this.db = db;
 		this.tables = tables ?? { contentRefs: db.tables.contentRefs };

package/dist/models/content-ref.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"content-ref.mjs","names":[],"sources":["../../src/models/content-ref.ts"],"sourcesContent":["import type { Table } from \"drizzle-orm\";\nimport type { DatabaseAdapter } from \"../adapters/database.ts\";\nimport type { ContentRef } from \"../schema/content-ref.ts\";\n\n/** Content refs for deduplicated Storybook assets. */\nexport class ContentRefModel {\n  private readonly tables: { contentRefs: Table };\n  constructor(\n    private readonly db: DatabaseAdapter,\n    tables?: { contentRefs: Table },\n  ) {\n    this.tables = tables ?? { contentRefs: db.tables.contentRefs };\n  }\n\n  async get(hash: string): Promise<ContentRef | null> {\n    return (await this.db.get(this.tables.contentRefs, hash)) as unknown as ContentRef | null;\n  }\n\n  async upsert(hash: string): Promise<ContentRef> {\n    const now = new Date().toISOString();\n    const existing = await this.get(hash);\n    if (existing) {\n      return (await this.db.update(this.tables.contentRefs, hash, {\n        refCount: existing.refCount + 1,\n        lastSeenAt: now,\n      })) as unknown as ContentRef;\n    }\n    return (await this.db.insert(this.tables.contentRefs, {\n      hash,\n      refCount: 1,\n      lastSeenAt: now,\n      createdAt: now,\n    })) as unknown as ContentRef;\n  }\n\n  async decrement(hash: string): Promise<ContentRef | null> {\n    const existing = await this.get(hash);\n    if (!existing) return null;\n    if (existing.refCount <= 1) {\n      await this.db.remove(this.tables.contentRefs, hash);\n      return null;\n    }\n    return (await this.db.update(this.tables.contentRefs, hash, {\n      refCount: existing.refCount - 1,\n      lastSeenAt: new Date().toISOString(),\n    })) as unknown as ContentRef;\n  }\n\n  async listStale(cutoff: string): Promise<ContentRef[]> {\n    const all = (await this.db.list(this.tables.contentRefs)) as unknown as ContentRef[];\n    return all.filter((r) => r.refCount === 0 && r.lastSeenAt < cutoff);\n  }\n}\n"],"mappings":";;;;;AAKA,IAAa,kBAAb,MAA6B;CAGR;CAFnB;CACA,YACE,IACA,QACA;EAFiB,KAAA,KAAA;EAGjB,KAAK,SAAS,UAAU,EAAE,aAAa,GAAG,OAAO,YAAY;CAC/D;CAEA,MAAM,IAAI,MAA0C;EAClD,OAAQ,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,aAAa,IAAI;CACzD;CAEA,MAAM,OAAO,MAAmC;EAC9C,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EACnC,MAAM,WAAW,MAAM,KAAK,IAAI,IAAI;EACpC,IAAI,UACF,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,aAAa,MAAM;GAC1D,UAAU,SAAS,WAAW;GAC9B,YAAY;EACd,CAAC;EAEH,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,aAAa;GACpD;GACA,UAAU;GACV,YAAY;GACZ,WAAW;EACb,CAAC;CACH;CAEA,MAAM,UAAU,MAA0C;EACxD,MAAM,WAAW,MAAM,KAAK,IAAI,IAAI;EACpC,IAAI,CAAC,UAAU,OAAO;EACtB,IAAI,SAAS,YAAY,GAAG;GAC1B,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,aAAa,IAAI;GAClD,OAAO;EACT;EACA,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,aAAa,MAAM;GAC1D,UAAU,SAAS,WAAW;GAC9B,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;EACrC,CAAC;CACH;CAEA,MAAM,UAAU,QAAuC;EAErD,QAAO,MADY,KAAK,GAAG,KAAK,KAAK,OAAO,WAAW,EAAA,CAC5C,QAAQ,MAAM,EAAE,aAAa,KAAK,EAAE,aAAa,MAAM;CACpE;AACF"}
+{"version":3,"file":"content-ref.mjs","names":[],"sources":["../../src/models/content-ref.ts"],"sourcesContent":["import type { Table } from \"drizzle-orm\";\nimport type { DatabaseAdapter } from \"../adapters/database.ts\";\nimport type { ContentRef } from \"../schema/content-ref.ts\";\n\n/** Content refs for deduplicated Storybook assets. */\nexport class ContentRefModel {\n  private readonly tables: { contentRefs: Table };\n  private readonly db: DatabaseAdapter;\n\n  constructor(db: DatabaseAdapter, tables?: { contentRefs: Table }) {\n    this.db = db;\n    this.tables = tables ?? { contentRefs: db.tables.contentRefs };\n  }\n\n  async get(hash: string): Promise<ContentRef | null> {\n    return (await this.db.get(this.tables.contentRefs, hash)) as unknown as ContentRef | null;\n  }\n\n  async upsert(hash: string): Promise<ContentRef> {\n    const now = new Date().toISOString();\n    const existing = await this.get(hash);\n    if (existing) {\n      return (await this.db.update(this.tables.contentRefs, hash, {\n        refCount: existing.refCount + 1,\n        lastSeenAt: now,\n      })) as unknown as ContentRef;\n    }\n    return (await this.db.insert(this.tables.contentRefs, {\n      hash,\n      refCount: 1,\n      lastSeenAt: now,\n      createdAt: now,\n    })) as unknown as ContentRef;\n  }\n\n  async decrement(hash: string): Promise<ContentRef | null> {\n    const existing = await this.get(hash);\n    if (!existing) return null;\n    if (existing.refCount <= 1) {\n      await this.db.remove(this.tables.contentRefs, hash);\n      return null;\n    }\n    return (await this.db.update(this.tables.contentRefs, hash, {\n      refCount: existing.refCount - 1,\n      lastSeenAt: new Date().toISOString(),\n    })) as unknown as ContentRef;\n  }\n\n  async listStale(cutoff: string): Promise<ContentRef[]> {\n    const all = (await this.db.list(this.tables.contentRefs)) as unknown as ContentRef[];\n    return all.filter((r) => r.refCount === 0 && r.lastSeenAt < cutoff);\n  }\n}\n"],"mappings":";;;;;AAKA,IAAa,kBAAb,MAA6B;CAC3B;CACA;CAEA,YAAY,IAAqB,QAAiC;EAChE,KAAK,KAAK;EACV,KAAK,SAAS,UAAU,EAAE,aAAa,GAAG,OAAO,YAAY;CAC/D;CAEA,MAAM,IAAI,MAA0C;EAClD,OAAQ,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,aAAa,IAAI;CACzD;CAEA,MAAM,OAAO,MAAmC;EAC9C,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EACnC,MAAM,WAAW,MAAM,KAAK,IAAI,IAAI;EACpC,IAAI,UACF,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,aAAa,MAAM;GAC1D,UAAU,SAAS,WAAW;GAC9B,YAAY;EACd,CAAC;EAEH,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,aAAa;GACpD;GACA,UAAU;GACV,YAAY;GACZ,WAAW;EACb,CAAC;CACH;CAEA,MAAM,UAAU,MAA0C;EACxD,MAAM,WAAW,MAAM,KAAK,IAAI,IAAI;EACpC,IAAI,CAAC,UAAU,OAAO;EACtB,IAAI,SAAS,YAAY,GAAG;GAC1B,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,aAAa,IAAI;GAClD,OAAO;EACT;EACA,OAAQ,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,aAAa,MAAM;GAC1D,UAAU,SAAS,WAAW;GAC9B,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;EACrC,CAAC;CACH;CAEA,MAAM,UAAU,QAAuC;EAErD,QAAO,MADY,KAAK,GAAG,KAAK,KAAK,OAAO,WAAW,EAAA,CAC5C,QAAQ,MAAM,EAAE,aAAa,KAAK,EAAE,aAAa,MAAM;CACpE;AACF"}

package/dist/models/credentials.mjs

@@ -11,10 +11,20 @@ const SOURCES = [
 		column: "secretEncrypted"
 	},
 	{
-		name: "git status tokens",
-		table: "projectStatusConfigs",
+		name: "design credentials",
+		table: "designCredentials",
 		column: "tokenEncrypted"
 	},
+	{
+		name: "user connections",
+		table: "userConnections",
+		column: "tokenEncrypted"
+	},
+	{
+		name: "user connection refresh tokens",
+		table: "userConnections",
+		column: "refreshTokenEncrypted"
+	},
 	{
 		name: "notification channels",
 		table: "notificationChannels",