brains-mcp 1.61.2

package/dist/auth/tokenStore.js

@@ -0,0 +1,261 @@
+/**
+ * OAuth token persistence layer — local session sync.
+ *
+ * Provides a `TokenStore` interface with two implementations:
+ *
+ *   - `LocalSQLiteTokenStore`  — SQLite-backed, stored next to the search
+ *     index under `<storageLocation>/.cache/oauth-tokens.db`.  Zero extra
+ *     dependencies (uses the already-bundled `better-sqlite3`).  Suitable
+ *     for single-instance local and Railway deployments.
+ *
+ *   - `PostgresTokenStore`     — Supabase PostgREST-backed, stored in an
+ *     `oauth_tokens` table.  Enables multi-instance / stateless deployments
+ *     where the process may restart without losing active sessions.  See
+ *     `scripts/oauth-tokens.sql` for the required migration.
+ *
+ * `createTokenStore()` auto-selects the backend based on env vars:
+ *   - `SUPABASE_URL` + `SUPABASE_SERVICE_ROLE_KEY` → PostgresTokenStore
+ *   - otherwise                                    → LocalSQLiteTokenStore
+ */
+import fs from "fs";
+import path from "path";
+import Database from "better-sqlite3";
+// ─── LocalSQLiteTokenStore ────────────────────────────────────────────────────
+export class LocalSQLiteTokenStore {
+    db;
+    constructor(storageLocation) {
+        const cacheDir = path.join(storageLocation, ".cache");
+        fs.mkdirSync(cacheDir, { recursive: true });
+        const dbPath = path.join(cacheDir, "oauth-tokens.db");
+        this.db = new Database(dbPath);
+        this.db.pragma("journal_mode = WAL");
+        this.db.pragma("synchronous = NORMAL");
+        this.initSchema();
+    }
+    initSchema() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS oauth_tokens (
+        type                 TEXT    NOT NULL,
+        token                TEXT    NOT NULL,
+        client_id            TEXT    NOT NULL,
+        subject              TEXT    NOT NULL,
+        scope                TEXT    NOT NULL,
+        expires_at           INTEGER NOT NULL,
+        redirect_uri         TEXT,
+        code_challenge       TEXT,
+        code_challenge_method TEXT,
+        PRIMARY KEY (type, token)
+      );
+      CREATE INDEX IF NOT EXISTS idx_oauth_tokens_expires_at
+        ON oauth_tokens (expires_at);
+    `);
+    }
+    async save(record) {
+        this.db
+            .prepare(`INSERT INTO oauth_tokens
+           (type, token, client_id, subject, scope, expires_at,
+            redirect_uri, code_challenge, code_challenge_method)
+         VALUES
+           (@type, @token, @client_id, @subject, @scope, @expires_at,
+            @redirect_uri, @code_challenge, @code_challenge_method)
+         ON CONFLICT(type, token) DO UPDATE SET
+           client_id             = excluded.client_id,
+           subject               = excluded.subject,
+           scope                 = excluded.scope,
+           expires_at            = excluded.expires_at,
+           redirect_uri          = excluded.redirect_uri,
+           code_challenge        = excluded.code_challenge,
+           code_challenge_method = excluded.code_challenge_method`)
+            .run({
+            type: record.type,
+            token: record.token,
+            client_id: record.clientId,
+            subject: record.subject,
+            scope: JSON.stringify(record.scope),
+            expires_at: record.expiresAt,
+            redirect_uri: record.redirectUri ?? null,
+            code_challenge: record.codeChallenge ?? null,
+            code_challenge_method: record.codeChallengeMethod ?? null,
+        });
+    }
+    async find(type, token) {
+        const row = this.db
+            .prepare("SELECT * FROM oauth_tokens WHERE type = ? AND token = ? AND expires_at > ?")
+            .get(type, token, Date.now());
+        if (!row)
+            return null;
+        return rowToStoredToken(row);
+    }
+    async delete(type, token) {
+        this.db
+            .prepare("DELETE FROM oauth_tokens WHERE type = ? AND token = ?")
+            .run(type, token);
+    }
+    async deleteAllForSubject(subject, clientId, type) {
+        this.db
+            .prepare("DELETE FROM oauth_tokens WHERE subject = ? AND client_id = ? AND type = ?")
+            .run(subject, clientId, type);
+    }
+    async deleteAllTokensForSubject(subject) {
+        this.db
+            .prepare("DELETE FROM oauth_tokens WHERE subject = ?")
+            .run(subject);
+    }
+    async pruneExpired() {
+        this.db
+            .prepare("DELETE FROM oauth_tokens WHERE expires_at <= ?")
+            .run(Date.now());
+    }
+}
+export class PostgresTokenStore {
+    supabaseUrl;
+    serviceRoleKey;
+    constructor(supabaseUrl, serviceRoleKey) {
+        this.supabaseUrl = supabaseUrl.trim().replace(/\/$/, "");
+        this.serviceRoleKey = serviceRoleKey.trim();
+    }
+    authHeaders(extra) {
+        return {
+            apikey: this.serviceRoleKey,
+            authorization: `Bearer ${this.serviceRoleKey}`,
+            "content-type": "application/json",
+            prefer: "return=minimal",
+            ...extra,
+        };
+    }
+    get baseUrl() {
+        return `${this.supabaseUrl}/rest/v1/oauth_tokens`;
+    }
+    async save(record) {
+        const body = JSON.stringify({
+            type: record.type,
+            token: record.token,
+            client_id: record.clientId,
+            subject: record.subject,
+            scope: JSON.stringify(record.scope),
+            expires_at: record.expiresAt,
+            redirect_uri: record.redirectUri ?? null,
+            code_challenge: record.codeChallenge ?? null,
+            code_challenge_method: record.codeChallengeMethod ?? null,
+        });
+        const response = await fetch(this.baseUrl, {
+            method: "POST",
+            headers: this.authHeaders({ prefer: "resolution=merge-duplicates,return=minimal" }),
+            body,
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => "");
+            throw new Error(`PostgresTokenStore.save failed (${response.status}): ${text}`);
+        }
+    }
+    async find(type, token) {
+        const url = `${this.baseUrl}?type=eq.${encodeURIComponent(type)}&token=eq.${encodeURIComponent(token)}&expires_at=gt.${Date.now()}&limit=1`;
+        const response = await fetch(url, {
+            method: "GET",
+            headers: this.authHeaders({ prefer: "return=representation" }),
+        }).catch(() => null);
+        if (!response || !response.ok)
+            return null;
+        const rows = (await response.json().catch(() => []));
+        const row = rows[0];
+        if (!row)
+            return null;
+        return postgresRowToStoredToken(row);
+    }
+    async delete(type, token) {
+        const url = `${this.baseUrl}?type=eq.${encodeURIComponent(type)}&token=eq.${encodeURIComponent(token)}`;
+        const response = await fetch(url, {
+            method: "DELETE",
+            headers: this.authHeaders(),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => "");
+            throw new Error(`PostgresTokenStore.delete failed (${response.status}): ${text}`);
+        }
+    }
+    async deleteAllForSubject(subject, clientId, type) {
+        const url = `${this.baseUrl}?subject=eq.${encodeURIComponent(subject)}&client_id=eq.${encodeURIComponent(clientId)}&type=eq.${encodeURIComponent(type)}`;
+        const response = await fetch(url, {
+            method: "DELETE",
+            headers: this.authHeaders(),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => "");
+            throw new Error(`PostgresTokenStore.deleteAllForSubject failed (${response.status}): ${text}`);
+        }
+    }
+    async deleteAllTokensForSubject(subject) {
+        const url = `${this.baseUrl}?subject=eq.${encodeURIComponent(subject)}`;
+        const response = await fetch(url, {
+            method: "DELETE",
+            headers: this.authHeaders(),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => "");
+            throw new Error(`PostgresTokenStore.deleteAllTokensForSubject failed (${response.status}): ${text}`);
+        }
+    }
+    async pruneExpired() {
+        const url = `${this.baseUrl}?expires_at=lte.${Date.now()}`;
+        await fetch(url, {
+            method: "DELETE",
+            headers: this.authHeaders(),
+        }).catch(() => null);
+    }
+}
+// ─── Factory ──────────────────────────────────────────────────────────────────
+/**
+ * Select and instantiate a token store based on the environment:
+ *   - SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY present → PostgresTokenStore
+ *   - otherwise → LocalSQLiteTokenStore (stored under `storageLocation/.cache/`)
+ */
+export function createTokenStore(storageLocation) {
+    const supabaseUrl = (process.env.SUPABASE_URL ?? "").trim();
+    const serviceRoleKey = (process.env.SUPABASE_SERVICE_ROLE_KEY ?? "").trim();
+    if (supabaseUrl && serviceRoleKey) {
+        return new PostgresTokenStore(supabaseUrl, serviceRoleKey);
+    }
+    return new LocalSQLiteTokenStore(storageLocation);
+}
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function rowToStoredToken(row) {
+    let scope = [];
+    try {
+        scope = JSON.parse(row.scope);
+    }
+    catch {
+        scope = [];
+    }
+    return {
+        type: row.type,
+        token: row.token,
+        clientId: row.client_id,
+        subject: row.subject,
+        scope,
+        expiresAt: row.expires_at,
+        redirectUri: row.redirect_uri ?? undefined,
+        codeChallenge: row.code_challenge ?? undefined,
+        codeChallengeMethod: row.code_challenge_method ?? undefined,
+    };
+}
+function postgresRowToStoredToken(row) {
+    let scope = [];
+    try {
+        scope = JSON.parse(row.scope);
+    }
+    catch {
+        scope = [];
+    }
+    return {
+        type: row.type,
+        token: row.token,
+        clientId: row.client_id,
+        subject: row.subject,
+        scope,
+        expiresAt: Number(row.expires_at),
+        redirectUri: row.redirect_uri ?? undefined,
+        codeChallenge: row.code_challenge ?? undefined,
+        codeChallengeMethod: row.code_challenge_method ?? undefined,
+    };
+}
+//# sourceMappingURL=tokenStore.js.map

package/dist/auth/tokenStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenStore.js","sourceRoot":"","sources":["../../src/auth/tokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AA8CtC,iFAAiF;AAEjF,MAAM,OAAO,qBAAqB;IACf,EAAE,CAAoB;IAEvC,YAAY,eAAuB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;KAeZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAmB;QAC5B,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;;;;;;;;;;kEAa0D,CAC3D;aACA,GAAG,CAAC;YACH,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YACnC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,YAAY,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACxC,cAAc,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;YAC5C,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,IAAI,IAAI;SAC1D,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAe,EAAE,KAAa;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN,4EAA4E,CAC7E;aACA,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAyB,CAAC;QAExD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAe,EAAE,KAAa;QACzC,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAe;QAC1E,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,2EAA2E,CAAC;aACpF,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,OAAe;QAC7C,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,4CAA4C,CAAC;aACrD,GAAG,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,gDAAgD,CAAC;aACzD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrB,CAAC;CACF;AAgBD,MAAM,OAAO,kBAAkB;IACZ,WAAW,CAAS;IACpB,cAAc,CAAS;IAExC,YAAY,WAAmB,EAAE,cAAsB;QACrD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAEO,WAAW,CAAC,KAA8B;QAChD,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,aAAa,EAAE,UAAU,IAAI,CAAC,cAAc,EAAE;YAC9C,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,gBAAgB;YACxB,GAAG,KAAK;SACT,CAAC;IACJ,CAAC;IAED,IAAY,OAAO;QACjB,OAAO,GAAG,IAAI,CAAC,WAAW,uBAAuB,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAmB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YACnC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,YAAY,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACxC,cAAc,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;YAC5C,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,IAAI,IAAI;SAC1D,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;YACnF,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAe,EAAE,KAAa;QACvC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,YAAY,kBAAkB,CAAC,IAAI,CAAC,aAAa,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC;QAC5I,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;SAC/D,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAErB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE3C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAkB,CAAC;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAe,EAAE,KAAa;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,YAAY,kBAAkB,CAAC,IAAI,CAAC,aAAa,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACxG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAe;QAC1E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,eAAe,kBAAkB,CAAC,OAAO,CAAC,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QACzJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,OAAe;QAC7C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,eAAe,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,wDAAwD,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,mBAAmB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3D,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;SAC5B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;CACF;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,eAAuB;IACtD,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5E,IAAI,WAAW,IAAI,cAAc,EAAE,CAAC;QAClC,OAAO,IAAI,kBAAkB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAC;AACpD,CAAC;AAED,iFAAiF;AAEjF,SAAS,gBAAgB,CAAC,GAAa;IACrC,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAa,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IAED,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAiB;QAC3B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,SAAS;QAC1C,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;QAC9C,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,IAAI,SAAS;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAgB;IAChD,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAa,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IAED,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAiB;QAC3B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,SAAS;QAC1C,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;QAC9C,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,IAAI,SAAS;KAC5D,CAAC;AACJ,CAAC"}

package/dist/backup/drive.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Optional Google Drive backup for the brains wiki.
+ *
+ * This module is only activated when DRIVE_BACKUP_ENABLED=true and all
+ * required Google OAuth2 credentials are set. When active, every write to
+ * local storage is also mirrored to a single Drive folder asynchronously.
+ * Failures are logged but never propagated — Drive is backup, not primary.
+ */
+export declare class DriveBackup {
+    private readonly drive;
+    private readonly folderId;
+    private constructor();
+    /**
+     * Return a DriveBackup instance if all required env vars are present,
+     * or null if backup is disabled or misconfigured.
+     */
+    static tryCreate(): DriveBackup | null;
+    /**
+     * Upsert a file to The Drive backup folder.
+     * Called fire-and-forget after every local write — errors are swallowed by the caller.
+     */
+    backup(name: string, content: string): Promise<void>;
+}
+//# sourceMappingURL=drive.d.ts.map

package/dist/backup/drive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drive.d.ts","sourceRoot":"","sources":["../../src/backup/drive.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,OAAO;IAYP;;;OAGG;IACH,MAAM,CAAC,SAAS,IAAI,WAAW,GAAG,IAAI;IAwBtC;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA8B3D"}

package/dist/backup/drive.js

@@ -0,0 +1,70 @@
+/**
+ * Optional Google Drive backup for the brains wiki.
+ *
+ * This module is only activated when DRIVE_BACKUP_ENABLED=true and all
+ * required Google OAuth2 credentials are set. When active, every write to
+ * local storage is also mirrored to a single Drive folder asynchronously.
+ * Failures are logged but never propagated — Drive is backup, not primary.
+ */
+import { google } from "googleapis";
+export class DriveBackup {
+    drive;
+    folderId;
+    constructor(clientId, clientSecret, refreshToken, folderId) {
+        const auth = new google.auth.OAuth2(clientId, clientSecret);
+        auth.setCredentials({ refresh_token: refreshToken });
+        this.drive = google.drive({ version: "v3", auth: auth });
+        this.folderId = folderId;
+    }
+    /**
+     * Return a DriveBackup instance if all required env vars are present,
+     * or null if backup is disabled or misconfigured.
+     */
+    static tryCreate() {
+        if (process.env.DRIVE_BACKUP_ENABLED !== "true")
+            return null;
+        const { GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN, DRIVE_FOLDER_ID } = process.env;
+        if (!GOOGLE_CLIENT_ID || !GOOGLE_CLIENT_SECRET || !GOOGLE_REFRESH_TOKEN || !DRIVE_FOLDER_ID) {
+            console.warn("[backup] DRIVE_BACKUP_ENABLED=true but one or more required env vars are missing " +
+                "(GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN, DRIVE_FOLDER_ID). " +
+                "Drive backup is disabled.");
+            return null;
+        }
+        console.info("[backup] Drive backup enabled. Folder:", DRIVE_FOLDER_ID);
+        return new DriveBackup(GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN, DRIVE_FOLDER_ID);
+    }
+    /**
+     * Upsert a file to The Drive backup folder.
+     * Called fire-and-forget after every local write — errors are swallowed by the caller.
+     */
+    async backup(name, content) {
+        // Check if file already exists in Drive
+        const listRes = await this.drive.files.list({
+            q: `'${this.folderId}' in parents and name='${name}' and trashed=false`,
+            fields: "files(id)",
+            pageSize: 1,
+        });
+        const existing = listRes.data.files?.[0];
+        if (existing?.id) {
+            // Update existing file
+            await this.drive.files.update({
+                fileId: existing.id,
+                media: { mimeType: "text/plain", body: content },
+                fields: "id",
+            });
+        }
+        else {
+            // Create new file
+            await this.drive.files.create({
+                requestBody: {
+                    name,
+                    parents: [this.folderId],
+                    mimeType: "text/plain",
+                },
+                media: { mimeType: "text/plain", body: content },
+                fields: "id",
+            });
+        }
+    }
+}
+//# sourceMappingURL=drive.js.map

package/dist/backup/drive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drive.js","sourceRoot":"","sources":["../../src/backup/drive.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAY,MAAM,YAAY,CAAC;AAG9C,MAAM,OAAO,WAAW;IACL,KAAK,CAAiB;IACtB,QAAQ,CAAS;IAElC,YACE,QAAgB,EAChB,YAAoB,EACpB,YAAoB,EACpB,QAAgB;QAEhB,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAA+B,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,SAAS;QACd,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAE7D,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,eAAe,EAAE,GACrF,OAAO,CAAC,GAAG,CAAC;QAEd,IAAI,CAAC,gBAAgB,IAAI,CAAC,oBAAoB,IAAI,CAAC,oBAAoB,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5F,OAAO,CAAC,IAAI,CACV,mFAAmF;gBACjF,mFAAmF;gBACnF,2BAA2B,CAC9B,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,wCAAwC,EAAE,eAAe,CAAC,CAAC;QACxE,OAAO,IAAI,WAAW,CACpB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,CAChB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAAe;QACxC,wCAAwC;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;YAC1C,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,0BAA0B,IAAI,qBAAqB;YACvE,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAEzC,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC;YACjB,uBAAuB;YACvB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC5B,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACnB,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE;gBAChD,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,kBAAkB;YAClB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC5B,WAAW,EAAE;oBACX,IAAI;oBACJ,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACxB,QAAQ,EAAE,YAAY;iBACvB;gBACD,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE;gBAChD,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/billing/tierStore.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Billing tier lookup (GH #473).
+ *
+ * The page limit used to be decided by two env vars and god-mode membership, so
+ * the "Upgrade to Solo for 2,000 pages" message pointed at a tier that raised
+ * nothing. This resolves a user's tier so `getPageLimit` can honour it.
+ *
+ * PostgREST-backed, mirroring PostgresPATStore. There is no SQLite backend on
+ * purpose: `assertPageLimit` returns early unless the Postgres index is
+ * configured, so a local run never reaches a tier lookup.
+ *
+ * Failure is non-fatal by design. A missing table, an unreachable database or a
+ * malformed row all resolve to `null` — "no tier assigned" — and the caller
+ * falls back to the env-var defaults.
+ *
+ * That matters because on production, code and schema move on different
+ * triggers. Railway redeploys production code when `main` moves, but
+ * `apply-migrations.mjs` runs there only inside `deploy-production.yml`, which
+ * is `workflow_dispatch` and fires only when a human asks. So production can be
+ * running code that reads this table days before anyone applies it. (Staging
+ * does not have the gap — `deploy-staging.yml` runs migrations on every push to
+ * `main`.) Refusing writes in that window would take production down for
+ * everyone in exchange for a limit that is merely stale.
+ */
+/** Tiers the pricing page sells, plus the two legacy names seedUsers already writes. */
+export type BillingTier = "free" | "solo" | "pro" | "unlimited" | "free_beta" | "launch_user";
+export declare const BILLING_TIERS: readonly BillingTier[];
+export declare function isBillingTier(value: string): value is BillingTier;
+export interface TierStore {
+    /** Resolve a subject's tier, or null when none is assigned or lookup fails. */
+    get(subject: string): Promise<BillingTier | null>;
+    /** Assign a tier. Returns false when the write fails. */
+    set(subject: string, tier: BillingTier, updatedBy: string): Promise<boolean>;
+    /** Drop cached lookups. */
+    invalidate(subject?: string): void;
+}
+export declare class PostgresTierStore implements TierStore {
+    private readonly supabaseUrl;
+    private readonly serviceRoleKey;
+    private readonly cache;
+    constructor(supabaseUrl: string, serviceRoleKey: string);
+    private get baseUrl();
+    private headers;
+    private cacheTtlMs;
+    private cacheSet;
+    invalidate(subject?: string): void;
+    get(subject: string): Promise<BillingTier | null>;
+    set(subject: string, tier: BillingTier, updatedBy: string): Promise<boolean>;
+}
+/** No-op store for deployments without Postgres — every lookup is "no tier". */
+export declare class NullTierStore implements TierStore {
+    get(): Promise<BillingTier | null>;
+    set(): Promise<boolean>;
+    invalidate(): void;
+}
+export declare function getTierStore(): TierStore;
+/** Test seam. */
+export declare function setTierStore(store: TierStore | null): void;
+//# sourceMappingURL=tierStore.d.ts.map

package/dist/billing/tierStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tierStore.d.ts","sourceRoot":"","sources":["../../src/billing/tierStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,wFAAwF;AACxF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa,CAAC;AAE9F,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAO/C,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAOD,MAAM,WAAW,SAAS;IACxB,+EAA+E;IAC/E,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAClD,yDAAyD;IACzD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,2BAA2B;IAC3B,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,qBAAa,iBAAkB,YAAW,SAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;gBAE3C,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;IAKvD,OAAO,KAAK,OAAO,GAElB;IAED,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,QAAQ;IAQhB,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAK5B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA4BjD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAoBnF;AAED,gFAAgF;AAChF,qBAAa,aAAc,YAAW,SAAS;IACvC,GAAG,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAGlC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;IAG7B,UAAU,IAAI,IAAI;CAGnB;AAID,wBAAgB,YAAY,IAAI,SAAS,CAMxC;AAED,iBAAiB;AACjB,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,GAAG,IAAI,CAE1D"}

package/dist/billing/tierStore.js

@@ -0,0 +1,152 @@
+/**
+ * Billing tier lookup (GH #473).
+ *
+ * The page limit used to be decided by two env vars and god-mode membership, so
+ * the "Upgrade to Solo for 2,000 pages" message pointed at a tier that raised
+ * nothing. This resolves a user's tier so `getPageLimit` can honour it.
+ *
+ * PostgREST-backed, mirroring PostgresPATStore. There is no SQLite backend on
+ * purpose: `assertPageLimit` returns early unless the Postgres index is
+ * configured, so a local run never reaches a tier lookup.
+ *
+ * Failure is non-fatal by design. A missing table, an unreachable database or a
+ * malformed row all resolve to `null` — "no tier assigned" — and the caller
+ * falls back to the env-var defaults.
+ *
+ * That matters because on production, code and schema move on different
+ * triggers. Railway redeploys production code when `main` moves, but
+ * `apply-migrations.mjs` runs there only inside `deploy-production.yml`, which
+ * is `workflow_dispatch` and fires only when a human asks. So production can be
+ * running code that reads this table days before anyone applies it. (Staging
+ * does not have the gap — `deploy-staging.yml` runs migrations on every push to
+ * `main`.) Refusing writes in that window would take production down for
+ * everyone in exchange for a limit that is merely stale.
+ */
+const TIER_CACHE_TTL_MS = 60_000;
+const TIER_CACHE_MAX_ENTRIES = 5_000;
+export const BILLING_TIERS = [
+    "free",
+    "solo",
+    "pro",
+    "unlimited",
+    "free_beta",
+    "launch_user",
+];
+export function isBillingTier(value) {
+    return BILLING_TIERS.includes(value);
+}
+export class PostgresTierStore {
+    supabaseUrl;
+    serviceRoleKey;
+    cache = new Map();
+    constructor(supabaseUrl, serviceRoleKey) {
+        this.supabaseUrl = supabaseUrl.trim().replace(/\/$/, "");
+        this.serviceRoleKey = serviceRoleKey.trim();
+    }
+    get baseUrl() {
+        return `${this.supabaseUrl}/rest/v1/user_tiers`;
+    }
+    headers(extra) {
+        return {
+            apikey: this.serviceRoleKey,
+            authorization: `Bearer ${this.serviceRoleKey}`,
+            "content-type": "application/json",
+            ...extra,
+        };
+    }
+    cacheTtlMs() {
+        const raw = parseInt(process.env.BRAINS_TIER_CACHE_TTL_MS ?? "", 10);
+        return Number.isFinite(raw) && raw >= 0 ? raw : TIER_CACHE_TTL_MS;
+    }
+    cacheSet(subject, tier) {
+        if (this.cache.size >= TIER_CACHE_MAX_ENTRIES) {
+            const oldest = this.cache.keys().next().value;
+            if (oldest !== undefined)
+                this.cache.delete(oldest);
+        }
+        this.cache.set(subject, { tier, at: Date.now() });
+    }
+    invalidate(subject) {
+        if (subject === undefined)
+            this.cache.clear();
+        else
+            this.cache.delete(subject);
+    }
+    async get(subject) {
+        if (!subject)
+            return null;
+        const hit = this.cache.get(subject);
+        if (hit && Date.now() - hit.at < this.cacheTtlMs())
+            return hit.tier;
+        try {
+            const url = `${this.baseUrl}?user_id=eq.${encodeURIComponent(subject)}&select=tier&limit=1`;
+            const res = await fetch(url, { headers: this.headers() });
+            if (!res.ok) {
+                // 404 here means the migration has not been applied to this database.
+                // Cache the negative so a missing table does not add a round trip to
+                // every write until someone deploys it.
+                this.cacheSet(subject, null);
+                return null;
+            }
+            const rows = (await res.json());
+            const raw = Array.isArray(rows) && rows.length > 0 ? rows[0]?.tier : undefined;
+            const tier = typeof raw === "string" && isBillingTier(raw) ? raw : null;
+            this.cacheSet(subject, tier);
+            return tier;
+        }
+        catch {
+            // Network/DNS failure. Do not cache — the next write should retry rather
+            // than run on a stale negative for the full TTL.
+            return null;
+        }
+    }
+    async set(subject, tier, updatedBy) {
+        if (!subject)
+            return false;
+        try {
+            const res = await fetch(this.baseUrl, {
+                method: "POST",
+                headers: this.headers({ prefer: "resolution=merge-duplicates,return=minimal" }),
+                body: JSON.stringify({
+                    user_id: subject,
+                    tier,
+                    updated_by: updatedBy,
+                    updated_at: new Date().toISOString(),
+                }),
+            });
+            if (!res.ok)
+                return false;
+            this.cacheSet(subject, tier);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+/** No-op store for deployments without Postgres — every lookup is "no tier". */
+export class NullTierStore {
+    async get() {
+        return null;
+    }
+    async set() {
+        return false;
+    }
+    invalidate() {
+        /* nothing cached */
+    }
+}
+let cached = null;
+export function getTierStore() {
+    if (cached)
+        return cached;
+    const url = (process.env.SUPABASE_URL ?? "").trim();
+    const key = (process.env.SUPABASE_SERVICE_ROLE_KEY ?? "").trim();
+    cached = url && key ? new PostgresTierStore(url, key) : new NullTierStore();
+    return cached;
+}
+/** Test seam. */
+export function setTierStore(store) {
+    cached = store;
+}
+//# sourceMappingURL=tierStore.js.map

package/dist/billing/tierStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tierStore.js","sourceRoot":"","sources":["../../src/billing/tierStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAKrC,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,MAAM;IACN,MAAM;IACN,KAAK;IACL,WAAW;IACX,WAAW;IACX,aAAa;CACd,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAgBD,MAAM,OAAO,iBAAiB;IACX,WAAW,CAAS;IACpB,cAAc,CAAS;IACvB,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEvD,YAAY,WAAmB,EAAE,cAAsB;QACrD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,IAAY,OAAO;QACjB,OAAO,GAAG,IAAI,CAAC,WAAW,qBAAqB,CAAC;IAClD,CAAC;IAEO,OAAO,CAAC,KAA8B;QAC5C,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,aAAa,EAAE,UAAU,IAAI,CAAC,cAAc,EAAE;YAC9C,cAAc,EAAE,kBAAkB;YAClC,GAAG,KAAK;SACT,CAAC;IACJ,CAAC;IAEO,UAAU;QAChB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACpE,CAAC;IAEO,QAAQ,CAAC,OAAe,EAAE,IAAwB;QACxD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,UAAU,CAAC,OAAgB;QACzB,IAAI,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;;YACzC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAEpE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,eAAe,kBAAkB,CAAC,OAAO,CAAC,sBAAsB,CAAC;YAC5F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,sEAAsE;gBACtE,qEAAqE;gBACrE,wCAAwC;gBACxC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;YAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,iDAAiD;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,IAAiB,EAAE,SAAiB;QAC7D,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;gBACpC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;gBAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,OAAO;oBAChB,IAAI;oBACJ,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACrC,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,OAAO,aAAa;IACxB,KAAK,CAAC,GAAG;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,GAAG;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU;QACR,oBAAoB;IACtB,CAAC;CACF;AAED,IAAI,MAAM,GAAqB,IAAI,CAAC;AAEpC,MAAM,UAAU,YAAY;IAC1B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,aAAa,EAAE,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,YAAY,CAAC,KAAuB;IAClD,MAAM,GAAG,KAAK,CAAC;AACjB,CAAC"}

package/dist/digest/activityDigest.d.ts

@@ -0,0 +1,32 @@
+/**
+ * activityDigest.ts
+ *
+ * Gathers weekly activity signals from a user's wiki storage and generates
+ * the digest markdown content and email body.
+ *
+ * Signals collected:
+ *   - Pages created / modified (from log.md events + file listing)
+ *   - Decisions made (pages tagged "decision" modified this week)
+ *   - Open loops closed (pages tagged "open-loop" with status resolved)
+ *   - Active tags (tags appearing in recently modified pages)
+ */
+import type { StorageClient } from "../storage/client.js";
+export interface DigestSignals {
+    weekLabel: string;
+    weekRange: string;
+    pagesCreated: string[];
+    pagesModified: string[];
+    decisionsMade: string[];
+    loopsClosed: string[];
+    activeTags: Array<{
+        tag: string;
+        count: number;
+    }>;
+    totalEvents: number;
+}
+export declare function isoWeekLabel(date: Date): string;
+export declare function gatherDigestSignals(drive: StorageClient, now?: Date, userId?: string): Promise<DigestSignals>;
+export declare function buildDigestMarkdown(signals: DigestSignals, dateStr: string): string;
+export declare function buildDigestHtml(signals: DigestSignals): string;
+export declare function buildDigestText(signals: DigestSignals): string;
+//# sourceMappingURL=activityDigest.d.ts.map

package/dist/digest/activityDigest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activityDigest.d.ts","sourceRoot":"","sources":["../../src/digest/activityDigest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAK1D,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAW/C;AAyFD,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,aAAa,EACpB,GAAG,GAAE,IAAiB,EACtB,MAAM,SAAK,GACV,OAAO,CAAC,aAAa,CAAC,CAyGxB;AAID,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CA6CnF;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAyD9D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CA0B9D"}