collabmd 0.1.48 → 0.1.49

package/src/server/infrastructure/git/path-utils.js

@@ -34,22 +34,6 @@ export function normalizeRelativeGitPath(pathValue) {
   return normalized.join('/');
 }
 
-export function parseRenamePath(rawPath) {
-  const decodedPath = decodeQuotedPath(rawPath);
-  const separator = ' -> ';
-  const separatorIndex = decodedPath.indexOf(separator);
-  if (separatorIndex === -1) {
-    return {
-      oldPath: null,
-      path: decodedPath,
-    };
-  }
-
-  return {
-    oldPath: decodedPath.slice(0, separatorIndex),
-    path: decodedPath.slice(separatorIndex + separator.length),
-  };
-}
 
 export function stripDiffPrefix(pathValue) {
   const normalizedPath = String(pathValue ?? '').replace(/\s+$/u, '');

package/src/server/infrastructure/git/status-service.js

@@ -42,7 +42,7 @@ export class GitStatusService {
 
     const statusPromise = (async () => {
       const parsed = parseStatusOutput(
-        await this.commandRunner.execGit(['status', '--porcelain=v1', '--branch', '--untracked-files=all']),
+        await this.commandRunner.execGit(['status', '--porcelain=v1', '-z', '--branch', '--untracked-files=all']),
       );
       const sections = [
         { files: parsed.sections.staged, key: 'staged', label: 'Staged Changes' },

package/src/server/infrastructure/git/untracked-files.js

@@ -1,6 +1,7 @@
 import { createReadStream } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { createInterface } from 'node:readline';
 
 import { getVaultFileKind, isImageAttachmentFilePath } from '../../../domain/file-kind.js';
 import { mapWithConcurrency } from '../../shared/async-utils.js';
@@ -13,29 +14,19 @@ async function countFileLines(filePath) {
     return 0;
   }
 
-  return new Promise((resolve, reject) => {
-    const stream = createReadStream(filePath, { encoding: 'utf8' });
-    let lineCount = 0;
-    let sawData = false;
-    let lastCharacter = '\n';
+  const lines = createInterface({
+    crlfDelay: Infinity,
+    input: createReadStream(filePath, { encoding: 'utf8' }),
+  });
+  let lineCount = 0;
 
-    stream.on('data', (chunk) => {
-      if (!chunk) {
-        return;
-      }
+  for await (const line of lines) {
+    if (typeof line === 'string') {
+      lineCount += 1;
+    }
+  }
 
-      sawData = true;
-      lastCharacter = chunk[chunk.length - 1];
-      lineCount += chunk.match(/\n/gu)?.length ?? 0;
-    });
-    stream.on('error', reject);
-    stream.on('end', () => {
-      if (sawData && lastCharacter !== '\n') {
-        lineCount += 1;
-      }
-      resolve(lineCount);
-    });
-  });
+  return lineCount;
 }
 
 function buildSyntheticAddedFileDiff(pathValue, content) {

package/src/server/infrastructure/http/create-agent-api-handler.js

@@ -0,0 +1,171 @@
+import { fromJsonSchema } from '@modelcontextprotocol/server';
+
+import { getAgentToolDefinition } from '../../../domain/agent-tool-definitions.js';
+import { encodeAgentToolImage } from '../../shared/agent-tool-image.js';
+import { readRequestId } from './http-request-helpers.js';
+import { jsonResponse } from './http-response.js';
+import { parseJsonBody } from './request-body.js';
+
+const WEBMCP_TOOL_PATH = '/api/agent/tools/';
+const WEBMCP_INPUT_SCHEMAS = new Map();
+
+function createAgentError(code, message, statusCode) {
+  const error = new Error(message);
+  error.code = code;
+  error.statusCode = statusCode;
+  return error;
+}
+
+function sendAgentError(req, res, error) {
+  const statusCode = Number(error?.statusCode) || 500;
+  if (statusCode >= 500) console.error('[agent] Request failed:', error.message);
+  jsonResponse(req, res, statusCode, {
+    code: error?.code || 'AGENT_REQUEST_FAILED',
+    error: statusCode >= 500 ? 'Agent request failed' : error.message,
+    ...(Number.isFinite(error?.retryAfterMs) ? { retryAfterMs: error.retryAfterMs } : {}),
+  });
+}
+
+async function validateWebMcpInput(definition, input) {
+  let schema = WEBMCP_INPUT_SCHEMAS.get(definition.name);
+  if (!schema) {
+    schema = fromJsonSchema(definition.inputSchema);
+    WEBMCP_INPUT_SCHEMAS.set(definition.name, schema);
+  }
+  const validation = await schema['~standard'].validate(input);
+  if (validation.issues?.length) {
+    throw createAgentError('AGENT_INPUT_INVALID', 'WebMCP tool input does not match its schema', 400);
+  }
+}
+
+async function createWebMcpActor({ agentConnectionService, authService, config, req }) {
+  let subject;
+  if (config.auth.strategy === 'none') {
+    subject = {
+      collaborator: null,
+      subjectId: req.socket?.remoteAddress || 'unknown',
+      subjectType: 'anonymous',
+    };
+  } else {
+    const user = authService.getAuthenticatedUser?.(req) ?? null;
+    subject = await agentConnectionService.resolveManagementSubject(user);
+  }
+  const actorId = `webmcp:${subject.subjectType}:${subject.subjectId}`;
+  return {
+    collaborator: subject.collaborator,
+    connectionId: actorId,
+    origin: 'webmcp',
+    rateLimitKey: actorId,
+    requestId: readRequestId(req),
+    scopes: ['vault:edit', 'vault:read'],
+    sourceRef: 'webmcp',
+  };
+}
+
+async function mapWebMcpResult(definition, value) {
+  if (definition.resultKind === 'image' && value.svg) {
+    const { data, mimeType, structuredContent } = await encodeAgentToolImage(value);
+    return {
+      ...structuredContent,
+      image: { data, encoding: 'base64', mimeType },
+      scene: value.scene,
+    };
+  }
+  if (definition.resultKind === 'optional-image' && value.verification?.svg) {
+    const { verification, ...result } = value;
+    const { data, mimeType, structuredContent } = await encodeAgentToolImage(verification);
+    return {
+      ...result,
+      image: { data, encoding: 'base64', mimeType },
+      verification: {
+        ...structuredContent,
+        scene: verification.scene,
+      },
+    };
+  }
+  return value;
+}
+
+export function createAgentApiHandler({
+  agentConnectionService,
+  agentContentService,
+  authService,
+  config,
+  rateLimiter,
+}) {
+  return async function handleAgentApi(req, res, requestUrl) {
+    if (!requestUrl.pathname.startsWith('/api/agent')) return false;
+
+    try {
+      if (requestUrl.pathname.startsWith(WEBMCP_TOOL_PATH)) {
+        if (req.method !== 'POST') {
+          throw createAgentError('AGENT_METHOD_NOT_ALLOWED', 'WebMCP tools require POST', 405);
+        }
+        const name = decodeURIComponent(requestUrl.pathname.slice(WEBMCP_TOOL_PATH.length));
+        const definition = getAgentToolDefinition(name);
+        if (!definition?.webMcp) {
+          throw createAgentError('AGENT_TOOL_NOT_FOUND', 'WebMCP tool not found', 404);
+        }
+        const input = await parseJsonBody(req);
+        await validateWebMcpInput(definition, input);
+        const actor = await createWebMcpActor({
+          agentConnectionService,
+          authService,
+          config,
+          req,
+        });
+        rateLimiter(actor.rateLimitKey);
+        const cancellation = new AbortController();
+        const abort = () => cancellation.abort();
+        req.once('aborted', abort);
+        try {
+          const value = await agentContentService[definition.method](actor, {
+            ...input,
+            signal: cancellation.signal,
+          });
+          jsonResponse(req, res, 200, await mapWebMcpResult(definition, value));
+        } finally {
+          req.off('aborted', abort);
+        }
+        return true;
+      }
+
+      if (!config.agentAccess?.enabled) {
+        jsonResponse(req, res, 404, { error: 'Agent Access is not enabled' });
+        return true;
+      }
+      const user = authService.getAuthenticatedUser?.(req) ?? null;
+      if (requestUrl.pathname === '/api/agent/connections' && req.method === 'GET') {
+        jsonResponse(req, res, 200, {
+          connections: await agentConnectionService.listConnections(user),
+        });
+        return true;
+      }
+      if (requestUrl.pathname === '/api/agent/connections' && req.method === 'POST') {
+        const body = await parseJsonBody(req);
+        jsonResponse(req, res, 201, await agentConnectionService.createConnection({
+          clientKind: body?.clientKind,
+          label: body?.label,
+          scopes: body?.scopes,
+          user,
+        }));
+        return true;
+      }
+      if (requestUrl.pathname.startsWith('/api/agent/connections/') && req.method === 'DELETE') {
+        const connectionId = decodeURIComponent(
+          requestUrl.pathname.slice('/api/agent/connections/'.length).split('/')[0] || '',
+        );
+        jsonResponse(req, res, 200, await agentConnectionService.revokeConnection({
+          connectionId,
+          user,
+        }));
+        return true;
+      }
+      jsonResponse(req, res, 404, { error: 'Agent endpoint not found' });
+      return true;
+    } catch (error) {
+      sendAgentError(req, res, error);
+      return true;
+    }
+  };
+}

package/src/server/infrastructure/http/create-git-api-command-handler.js

@@ -84,6 +84,38 @@ export function createGitApiCommandHandler({
       return true;
     }
 
+    if (requestUrl.pathname === '/api/git/stage-all' && req.method === 'POST') {
+      try {
+        jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
+          action: 'stage-all',
+          req,
+          responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
+            () => gitService.stageAll(),
+          ),
+          workspaceMutationCoordinator,
+        }));
+      } catch (error) {
+        handleApiError(req, res, error, '[api] Failed to stage all git changes:', 'Failed to stage all git changes');
+      }
+      return true;
+    }
+
+    if (requestUrl.pathname === '/api/git/unstage-all' && req.method === 'POST') {
+      try {
+        jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
+          action: 'unstage-all',
+          req,
+          responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
+            () => gitService.unstageAll(),
+          ),
+          workspaceMutationCoordinator,
+        }));
+      } catch (error) {
+        handleApiError(req, res, error, '[api] Failed to unstage all git changes:', 'Failed to unstage all git changes');
+      }
+      return true;
+    }
+
     if (requestUrl.pathname === '/api/git/commit' && req.method === 'POST') {
       try {
         const body = await parseRequiredBody(req, res, 'message');

package/src/server/infrastructure/http/create-request-handler.js

@@ -1,3 +1,6 @@
+import { createAgentApiHandler } from './create-agent-api-handler.js';
+import { createAgentMcpHandler } from '../mcp/create-agent-mcp-handler.js';
+import { createAgentToolRateLimiter } from '../../shared/agent-tool-rate-limiter.js';
 import { createAuthApiHandler } from './create-auth-api-handler.js';
 import { createGitApiCommandHandler } from './create-git-api-command-handler.js';
 import { createGitApiQueryHandler } from './create-git-api-query-handler.js';
@@ -38,6 +41,7 @@ export function createRequestHandler(
   hostedWorkspaceService = null,
   githubSetupFlow = null,
   structurizrWorkspaceService = null,
+  agentIntegration = null,
 ) {
   const handleStaticRequest = createStaticHandler(config, authService, searchService);
   const handleAuthApi = createAuthApiHandler({ authService });
@@ -73,6 +77,22 @@ export function createRequestHandler(
     basePath: config.basePath,
     service: structurizrWorkspaceService,
   });
+  const agentToolRateLimiter = createAgentToolRateLimiter(config.agentAccess.requestsPerMinute);
+  const handleAgentApi = createAgentApiHandler({
+    agentConnectionService: agentIntegration?.connectionService,
+    agentContentService: agentIntegration?.contentService,
+    authService,
+    config,
+    rateLimiter: agentToolRateLimiter,
+  });
+  const handleAgentMcp = config.agentAccess.enabled && agentIntegration
+    ? createAgentMcpHandler({
+        agentConnectionService: agentIntegration.connectionService,
+        agentContentService: agentIntegration.contentService,
+        config,
+        rateLimiter: agentToolRateLimiter,
+      })
+    : async () => false;
 
   function handleBasePathRedirect(req, res, originalRequestUrl) {
     if (
@@ -182,6 +202,10 @@ export function createRequestHandler(
       return;
     }
 
+    if (await handleAgentMcp(req, res, requestUrl)) {
+      return;
+    }
+
     if (requestUrl.pathname.startsWith('/api/') || handleStructurizrApi.requiresAuthorization(requestUrl)) {
       const authorization = authService.authorizeApiRequest(req);
       if (!authorization.ok) {
@@ -198,6 +222,10 @@ export function createRequestHandler(
       }
     }
 
+    if (await handleAgentApi(req, res, requestUrl)) {
+      return;
+    }
+
     if (await handleStructurizrApi(req, res, requestUrl)) {
       return;
     }

package/src/server/infrastructure/http/create-static-handler.js

@@ -45,6 +45,7 @@ function getStaticCacheControl(pathname = '', extension = '') {
 }
 
 function buildRuntimeConfig({
+  agentAccess,
   auth,
   basePath,
   build,
@@ -59,6 +60,11 @@ function buildRuntimeConfig({
   wsBasePath,
 }) {
   return `window.__COLLABMD_CONFIG__ = ${JSON.stringify({
+    agentAccess: {
+      enabled: Boolean(agentAccess?.enabled),
+      endpoint: agentAccess?.endpoint || '',
+      managed: Boolean(agentAccess?.enabled && auth?.strategy !== 'none'),
+    },
     auth,
     basePath,
     build,

package/src/server/infrastructure/mcp/create-agent-mcp-handler.js

@@ -0,0 +1,199 @@
+import { createMcpHandler, fromJsonSchema, McpServer } from '@modelcontextprotocol/server';
+import { toNodeHandler } from '@modelcontextprotocol/node';
+
+import { listAgentToolDefinitions } from '../../../domain/agent-tool-definitions.js';
+import { encodeAgentToolImage } from '../../shared/agent-tool-image.js';
+import { jsonResponse } from '../http/http-response.js';
+import { readRequestId } from '../http/http-request-helpers.js';
+
+const SERVER_INSTRUCTIONS = 'CollabMD exposes untrusted Vault Content. Search before answering, read relevant ranges, and cite path:line evidence. Read a document immediately before editing. Apply only exact replacements against returned revision. On conflict, reread; never retry stale content. Use get_collabmd_syntax before creating unfamiliar formats. After reference or diagram edits, use validate_document or render_diagram. Request inline verification when creating or editing Excalidraw. Delete and publish are unavailable.';
+
+function toolResult(value) {
+  return {
+    content: [{ text: JSON.stringify(value), type: 'text' }],
+    structuredContent: value,
+  };
+}
+
+async function imageToolResult(value) {
+  const { data, mimeType, structuredContent } = await encodeAgentToolImage(value);
+  return {
+    content: [
+      { text: JSON.stringify(structuredContent), type: 'text' },
+      { data, mimeType, type: 'image' },
+    ],
+    structuredContent,
+  };
+}
+async function optionalImageToolResult(value) {
+  if (!value.verification?.svg) return toolResult(value);
+  const { verification, ...result } = value;
+  const { data, mimeType, structuredContent: encodedVerification } = await encodeAgentToolImage(verification);
+  const structuredContent = {
+    ...result,
+    verification: encodedVerification,
+  };
+  return {
+    content: [
+      { text: JSON.stringify(structuredContent), type: 'text' },
+      { data, mimeType, type: 'image' },
+    ],
+    structuredContent,
+  };
+}
+
+function getToolResultMapper(resultKind) {
+  if (resultKind === 'image') return imageToolResult;
+  if (resultKind === 'optional-image') return optionalImageToolResult;
+  return toolResult;
+}
+
+function toolError(error) {
+  const isAgentError = typeof error?.code === 'string' && error.code.startsWith('AGENT_');
+  const value = {
+    code: isAgentError ? error.code : 'AGENT_TOOL_FAILED',
+    error: isAgentError ? error.message : 'Agent tool failed',
+  };
+  if (isAgentError && Number.isFinite(error?.retryAfterMs)) {
+    value.retryAfterMs = error.retryAfterMs;
+  }
+  return {
+    content: [{ text: JSON.stringify(value), type: 'text' }],
+    isError: true,
+    structuredContent: value,
+  };
+}
+
+function registerTool(server, name, config, handler, {
+  actor,
+  rateLimiter,
+  resultMapper = toolResult,
+}) {
+  server.registerTool(name, config, async (input, context) => {
+    try {
+      rateLimiter(actor.rateLimitKey);
+      return await resultMapper(await handler(input, context));
+    } catch (error) {
+      if (typeof error?.code !== 'string' || !error.code.startsWith('AGENT_')) {
+        console.error(`[mcp] ${name} failed (${actor.requestId}):`, error?.message || 'Unknown error');
+      }
+      return toolError(error);
+    }
+  });
+}
+
+function buildAgentServer({ actor, agentContentService, rateLimiter, version }) {
+  const server = new McpServer(
+    { name: 'collabmd', version },
+    { instructions: SERVER_INSTRUCTIONS },
+  );
+  for (const definition of listAgentToolDefinitions(actor.scopes)) {
+    registerTool(server, definition.name, {
+      annotations: definition.annotations,
+      description: definition.description,
+      inputSchema: fromJsonSchema(definition.inputSchema),
+      outputSchema: fromJsonSchema(definition.outputSchema),
+    }, (input, context) => agentContentService[definition.method](actor, {
+      ...input,
+      signal: context.signal,
+    }), {
+      actor,
+      rateLimiter,
+      resultMapper: getToolResultMapper(definition.resultKind),
+    });
+  }
+  return server;
+}
+
+function readHttpHostname(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return '';
+    return url.hostname.replace(/^\[|\]$/gu, '').toLowerCase();
+  } catch {
+    return '';
+  }
+}
+
+function readRequestHostname(req) {
+  return readHttpHostname(`http://${String(req.headers.host || '')}`);
+}
+
+export function createAgentMcpHandler({
+  agentConnectionService,
+  agentContentService,
+  config,
+  rateLimiter,
+}) {
+  const mcpHandler = createMcpHandler(({ authInfo }) => buildAgentServer({
+    actor: authInfo.extra.actor,
+    agentContentService,
+    rateLimiter,
+    version: config.build?.version || '0.1.0',
+  }));
+  const nodeHandler = toNodeHandler(mcpHandler, {
+    onerror: (error) => console.error('[mcp] Transport failed:', error.message),
+  });
+
+  return async function handleAgentMcp(req, res, requestUrl) {
+    if (requestUrl.pathname !== '/mcp') return false;
+    const authRequired = config.auth.strategy !== 'none';
+    const allowedHosts = config.agentAccess.allowedHosts;
+    const hostname = readRequestHostname(req);
+    const hasOrigin = Boolean(req.headers.origin);
+    const originHostname = hasOrigin ? readHttpHostname(String(req.headers.origin)) : '';
+    const browserOriginAllowed = hasOrigin
+      && hostname
+      && originHostname === hostname
+      && allowedHosts.includes(hostname);
+    if (
+      (authRequired && (!hostname || !allowedHosts.includes(hostname)))
+      || (hasOrigin && !browserOriginAllowed)
+    ) {
+      jsonResponse(req, res, 403, { error: 'MCP request origin or host is not allowed' });
+      return true;
+    }
+
+    let actor;
+    let token = '';
+    if (authRequired) {
+      const authorization = String(req.headers.authorization || '');
+      const match = authorization.match(/^Bearer\s+(.+)$/iu);
+      if (!match) {
+        res.setHeader('WWW-Authenticate', 'Bearer scope="vault:read"');
+        jsonResponse(req, res, 401, { error: 'Agent Connection token is required' });
+        return true;
+      }
+      token = match[1];
+      try {
+        actor = await agentConnectionService.authenticateToken(token);
+      } catch (error) {
+        res.setHeader('WWW-Authenticate', 'Bearer scope="vault:read"');
+        jsonResponse(req, res, Number(error?.statusCode) || 401, {
+          code: error?.code || 'AGENT_TOKEN_INVALID',
+          error: error?.message || 'Agent Connection token is invalid',
+        });
+        return true;
+      }
+    } else {
+      actor = {
+        collaborator: null,
+        connectionId: 'anonymous',
+        scopes: ['vault:edit', 'vault:read'],
+      };
+    }
+
+    actor.requestId = readRequestId(req);
+    actor.rateLimitKey = actor.connectionId === 'anonymous'
+      ? `anonymous:${req.socket?.remoteAddress || 'unknown'}`
+      : actor.connectionId;
+    req.auth = {
+      clientId: actor.connectionId,
+      extra: { actor },
+      scopes: actor.scopes,
+      token,
+    };
+    await nodeHandler(req, res);
+    return true;
+  };
+}

package/src/server/infrastructure/persistence/agent-connection-store.js

@@ -0,0 +1,120 @@
+import { mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+
+function parseScopes(value) {
+  try {
+    const scopes = JSON.parse(value || '[]');
+    return Array.isArray(scopes) ? scopes : [];
+  } catch {
+    return [];
+  }
+}
+
+function rowToConnection(row) {
+  if (!row) return null;
+  return {
+    clientKind: row.client_kind,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    id: row.id,
+    label: row.label,
+    revokedAt: row.revoked_at,
+    scopes: parseScopes(row.scopes_json),
+    subjectEmail: row.subject_email,
+    subjectId: row.subject_id,
+    subjectType: row.subject_type,
+    tokenHash: row.token_hash,
+  };
+}
+
+export class AgentConnectionStore {
+  constructor({ dbPath }) {
+    this.dbPath = dbPath;
+    this.db = null;
+    this.statements = new Map();
+  }
+
+  async initialize() {
+    if (this.db) return;
+    await mkdir(dirname(this.dbPath), { recursive: true });
+    const { DatabaseSync } = await import('node:sqlite');
+    this.db = new DatabaseSync(this.dbPath);
+    this.db.exec('PRAGMA journal_mode = WAL');
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS agent_connections (
+        id TEXT PRIMARY KEY,
+        subject_type TEXT NOT NULL,
+        subject_id TEXT NOT NULL,
+        subject_email TEXT NOT NULL DEFAULT '',
+        label TEXT NOT NULL,
+        client_kind TEXT NOT NULL,
+        scopes_json TEXT NOT NULL,
+        token_hash TEXT NOT NULL UNIQUE,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL,
+        revoked_at INTEGER
+      );
+      CREATE INDEX IF NOT EXISTS agent_connections_subject_idx
+        ON agent_connections(subject_type, subject_id, created_at DESC);
+    `);
+  }
+
+  prepare(key, sql) {
+    if (!this.statements.has(key)) this.statements.set(key, this.db.prepare(sql));
+    return this.statements.get(key);
+  }
+
+  async close() {
+    this.statements.clear();
+    this.db?.close();
+    this.db = null;
+  }
+
+  async create(connection) {
+    this.prepare(
+      'create',
+      `INSERT INTO agent_connections (
+        id, subject_type, subject_id, subject_email, label, client_kind,
+        scopes_json, token_hash, created_at, expires_at, revoked_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)`,
+    ).run(
+      connection.id,
+      connection.subjectType,
+      connection.subjectId,
+      connection.subjectEmail,
+      connection.label,
+      connection.clientKind,
+      JSON.stringify(connection.scopes),
+      connection.tokenHash,
+      connection.createdAt,
+      connection.expiresAt,
+    );
+    return connection;
+  }
+
+  async getByTokenHash(tokenHash) {
+    return rowToConnection(this.prepare(
+      'getByTokenHash',
+      'SELECT * FROM agent_connections WHERE token_hash = ? LIMIT 1',
+    ).get(tokenHash));
+  }
+
+  async listBySubject(subjectType, subjectId) {
+    return this.prepare(
+      'listBySubject',
+      `SELECT * FROM agent_connections
+       WHERE subject_type = ? AND subject_id = ? AND revoked_at IS NULL
+       ORDER BY created_at DESC`,
+    ).all(subjectType, subjectId).map(rowToConnection);
+  }
+
+  async revoke(id, subjectType, subjectId, revokedAt) {
+    const result = this.prepare(
+      'revoke',
+      `UPDATE agent_connections SET revoked_at = ?
+       WHERE id = ? AND subject_type = ? AND subject_id = ? AND revoked_at IS NULL`,
+    ).run(revokedAt, id, subjectType, subjectId);
+    return Number(result.changes) > 0;
+  }
+
+}