heyquilt 0.0.1 → 0.3.90

package/src/api/supabase-store.js

@@ -0,0 +1,765 @@
+// The accounts API's data in Supabase, using the service role (row-level security is
+// for the website; the API is trusted and writes the secrets).
+import { createClient } from '@supabase/supabase-js'
+
+const toCamel = (row) => row && Object.fromEntries(Object.entries(row).map(([k, v]) => [k.replace(/_([a-z])/g, (m, c) => c.toUpperCase()), v]))
+const toSnake = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined).map(([k, v]) => [k.replace(/[A-Z]/g, (c) => '_' + c.toLowerCase()), v]))
+// A PostgREST or= filter for "sent to this account or this address"; a value that could
+// break out of the filter (a comma, quote or bracket) is left out rather than escaped.
+const SAFE_OR = /^[^\s,()"\\]+$/
+const orFor = ({ account, email }) => [account && SAFE_OR.test(account) && `account.eq.${account}`, email && SAFE_OR.test(email) && `email.eq.${email}`].filter(Boolean).join(',')
+const ts = (v) => (v == null ? v : typeof v === 'number' ? new Date(v).toISOString() : v)
+const ms = (v) => (v == null ? v : Date.parse(v))
+// Postgres's foreign-key-violation code, for the same checks memory-store.js mirrors.
+const fkViolation = (what) => Object.assign(new Error(`${what} is still referenced`), { code: '23503' })
+// No secrets live on agents any more; the columns are still named, like every other table.
+const AGENT = 'id, name, provider, type, description, public_key, owner_user_id, org_id, invited_by, created_at, last_used_at, revoked_at'
+// Named columns for the org tables, so a select never picks up a secret by accident.
+const ORG = 'id, name, slug, owner_id, domain, domain_requests, created_at'
+const ROLE = 'id, org_id, name, builtin, grants, created_at'
+const MEMBER = 'id, org_id, user_id, agent_id, role_id, joined_at'
+const TEAM = 'id, org_id, name, created_at'
+const TEAM_MEMBER = 'team_id, member_id, access, scopes, added_at'
+const INVITE = 'id, org_id, email, role_id, token_hash, invited_by, expires_at, accepted_at, cancelled_at, created_at'
+const REQUEST = 'id, org_id, user_id, email, status, decided_by, decided_at, created_at'
+const AGENT_INVITE = 'id, token_hash, owner_user_id, org_id, created_by, role_id, teams, expires_at, used_at, used_by_agent_id, rejoined, cancelled_at, created_at, workspace_id, workspace_access, workspace_sessions, global'
+const AGENT_APP_KEY = 'id, agent_id, name, key_hash, created_at, last_used_at, revoked_at'
+const AGENT_KEY = 'id, agent_id, family_id, access_hash, refresh_hash, access_expires_at, refresh_expires_at, refreshed_at, revoked_at, created_at'
+const RELAY_SESSION = 'room, name, owner_account, created_at, last_active_at, renamed_at, workspace_id, workspace_linked_by'
+const ACCESS_TYPE = 'id, owner_account, name, files, folders, talk, created_at, updated_at'
+const GRANT = 'room, account, type_id, tighten, granted_by, created_at, updated_at'
+const SESSION_INVITE = 'id, room, email, account, account_name, type_id, invited_by, created_at, expires_at, used_at, used_by, cancelled_at'
+const WORKSPACE = 'id, owner_user_id, org_id, name, description, color, created_by, created_at, archived_at, quota_bytes, used_bytes, file_count'
+const WORKSPACE_MEMBER = 'workspace_id, account, access, sessions, added_by, added_at'
+const WORKSPACE_INVITE = 'id, workspace_id, email, account, account_name, access, invited_by, created_at, expires_at, accepted_at, accepted_by, declined_at, cancelled_at'
+const WORKSPACE_FILE = 'id, workspace_id, path, kind, size, mime, sha256, version, object_key, note, uploaded_by, uploaded_at, confirmed_at, deleted_at'
+const WORKSPACE_FILE_VERSION = 'file_id, version, size, sha256, object_key, note, uploaded_by, uploaded_at'
+const AGENT_PLACEMENT = 'agent_id, reach, workspace_ids, sessions, access, scopes, updated_by, updated_at'
+const WORKSPACE_AGENT_OVERRIDE = 'workspace_id, agent_id, sessions, excluded'
+const SESSION_AGENT_EXCLUSION = 'room, agent_id, excluded_by, created_at'
+const AGENT_WEBHOOK = 'agent_id, url, secret, created_at, updated_at'
+const AI_VM = 'user_id, tool, model, prompt, cap, agent_id, invite_id, machine_id, volume_id, region, state, error, signed_in, usage_today, last_report_at, created_at, updated_at'
+const RELAY_MACHINE = 'id, region, capacity, state, dedicated_room, load, hello_at, reported_at, created_at'
+const RELAY_ROOM = 'room, machine_id, state, stats, busy_minutes, heavy, placed_at, reported_at'
+const RELAY_JOB = 'key, state, detail, started_at, finished_at'
+// PostgREST hands back at most 1000 rows per request: longer lists are read a page at a time.
+const PAGE = 1000
+
+// One mapper for every table: camelCases the columns and turns every `*At` field
+// (createdAt, updatedAt, lastSeenAt, lastUsedAt, revokedAt, expiresAt, joinedAt,
+// lastActiveAt, ...) from a Postgres timestamp string into epoch milliseconds,
+// matching the memory store (the tested reference).
+export const rowFrom = (row) => row && Object.fromEntries(Object.entries(toCamel(row)).map(([k, v]) => [k, /At$/.test(k) ? ms(v) : v]))
+
+// `client` lets tests pass a stand-in for the supabase client.
+export function createSupabaseStore ({ url, serviceKey, client }) {
+  const db = client || createClient(url, serviceKey, { auth: { persistSession: false, autoRefreshToken: false } })
+  const one = async (q) => { const { data, error } = await q; if (error) throw error; return data }
+  const memberOf = async (orgId, userId) => rowFrom(await one(db.from('org_members').select(MEMBER).eq('org_id', orgId).eq('user_id', userId).maybeSingle()))
+  // Every row of a query, a page at a time. `build` makes a fresh query (with a stable order) per page.
+  const pages = async (build) => {
+    const out = []
+    for (let from = 0; ; from += PAGE) {
+      const rows = await one(build().range(from, from + PAGE - 1))
+      out.push(...rows)
+      if (rows.length < PAGE) return out
+    }
+  }
+
+  return {
+    async createLink (l) {
+      return rowFrom(await one(db.from('device_links').insert(toSnake({ ...l, expiresAt: ts(l.expiresAt) })).select().single()))
+    },
+    async linkByDeviceCode (h) { return rowFrom(await one(db.from('device_links').select().eq('device_code_hash', h).maybeSingle())) },
+    async linkByUserCode (c) { return rowFrom(await one(db.from('device_links').select().eq('user_code', c).maybeSingle())) },
+    async updateLink (id, patch) {
+      return rowFrom(await one(db.from('device_links').update(toSnake({ ...patch, expiresAt: ts(patch.expiresAt) })).eq('id', id).select().single()))
+    },
+    // Check-and-set: only flips status if it's still fromStatus, so two concurrent
+    // callers can't both win the same link (e.g. handing out a device token twice).
+    async claimLink (id, fromStatus, toStatus) {
+      const rows = await one(db.from('device_links').update({ status: toStatus }).eq('id', id).eq('status', fromStatus).select('id'))
+      return rows.length > 0
+    },
+    // One row per (account, key), so approving a link for someone else's key makes
+    // your own row instead of taking theirs. A relink retires the old token.
+    async upsertDevice ({ userId, name, platform, publicKey }) {
+      return rowFrom(await one(db.from('devices')
+        .upsert({ user_id: userId, name, platform, public_key: publicKey, token_hash: null, revoked_at: null }, { onConflict: 'user_id,public_key' })
+        .select().single()))
+    },
+    async setDeviceToken (id, tokenHash) { await one(db.from('devices').update({ token_hash: tokenHash }).eq('id', id)) },
+    async deviceByToken (h) { return rowFrom(await one(db.from('devices').select().eq('token_hash', h).is('revoked_at', null).maybeSingle())) },
+    async deviceByPublicKey (publicKey) {
+      return rowFrom((await one(db.from('devices').select().eq('public_key', publicKey).is('revoked_at', null).order('last_seen_at', { ascending: false }).limit(1)))[0] || null)
+    },
+    async userHasDevice (userId, publicKey) {
+      return (await one(db.from('devices').select('id').eq('user_id', userId).eq('public_key', publicKey).limit(1))).length > 0
+    },
+    async touchDevice (id) { await one(db.from('devices').update({ last_seen_at: new Date().toISOString() }).eq('id', id)) },
+    async revokeDevice (id) { await one(db.from('devices').update({ revoked_at: new Date().toISOString(), token_hash: null }).eq('id', id)) },
+    async profile (userId) { return rowFrom(await one(db.from('profiles').select('id, name, color, tool').eq('id', userId).maybeSingle())) },
+    // 'personal' or 'org': set once at sign-up, and the only thing POST /v1/orgs checks.
+    async profileKind (userId) { return (await one(db.from('profiles').select('kind').eq('id', userId).maybeSingle()))?.kind || null },
+    async updateProfile (userId, { name, color, tool }) {
+      return rowFrom(await one(db.from('profiles').update(toSnake({ name, color, tool })).eq('id', userId).select('id, name, color, tool').single()))
+    },
+    async createAgent ({ name, provider, type, description = '', publicKey = null, resumeHash = null, ownerUserId = null, orgId = null, invitedBy = null }) {
+      return rowFrom(await one(db.from('agents')
+        .insert({ name, provider, type, description, public_key: publicKey, resume_hash: resumeHash, owner_user_id: ownerUserId, org_id: orgId, invited_by: invitedBy })
+        .select(AGENT).single()))
+    },
+    async agentById (id) { return rowFrom(await one(db.from('agents').select(AGENT).eq('id', id).maybeSingle())) },
+    // AGENT never selects resume_hash, so the hash only ever goes in, never out.
+    async agentByResume (hash) { return rowFrom(await one(db.from('agents').select(AGENT).eq('resume_hash', hash).maybeSingle())) },
+    async agentByPublicKey (publicKey) {
+      if (!publicKey) return null
+      return rowFrom(await one(db.from('agents').select(AGENT).eq('public_key', publicKey).maybeSingle()))
+    },
+    async listPersonalAgents (userId) {
+      return (await one(db.from('agents').select(AGENT).eq('owner_user_id', userId).is('revoked_at', null).order('created_at'))).map(rowFrom)
+    },
+    // The org's own agents, live ones only, by name (for placement pickers).
+    async listOrgAgents (orgId) {
+      return (await one(db.from('agents').select(AGENT).eq('org_id', orgId).is('revoked_at', null).order('name'))).map(rowFrom)
+    },
+    async touchAgent (id) { await one(db.from('agents').update({ last_used_at: new Date().toISOString() }).eq('id', id)) },
+    // Revoking an agent kills every key it holds at once.
+    async revokeAgent (id) {
+      const at = new Date().toISOString()
+      const rows = await one(db.from('agents').update({ revoked_at: at }).eq('id', id).is('revoked_at', null).select('id'))
+      await one(db.from('agent_keys').update({ revoked_at: at }).eq('agent_id', id).is('revoked_at', null))
+      await one(db.from('agent_app_keys').update({ revoked_at: at }).eq('agent_id', id).is('revoked_at', null))
+      return rows.length > 0
+    },
+    // An agent coming back with a new invite: its new profile and resume key, and back
+    // from revoked. A publicKey left out keeps the one it has.
+    async rejoinAgent (id, { name, provider, type, description = '', publicKey = null, resumeHash }) {
+      const patch = { name, provider, type, description, resume_hash: resumeHash, revoked_at: null }
+      if (publicKey) patch.public_key = publicKey
+      return rowFrom(await one(db.from('agents').update(patch).eq('id', id).select(AGENT).single()))
+    },
+    // Only for undoing a half-finished join; cascades to its keys and membership.
+    async deleteAgent (id) { await one(db.from('agents').delete().eq('id', id)) },
+    // Agent invites: only the token's hash is stored. A deleted role clears
+    // role_id by itself (on delete set null (role_id)).
+    async createAgentInvite (i) {
+      return rowFrom(await one(db.from('agent_invites').insert(toSnake({ ...i, expiresAt: ts(i.expiresAt) })).select(AGENT_INVITE).single()))
+    },
+    async agentInviteByToken (h) { return rowFrom(await one(db.from('agent_invites').select(AGENT_INVITE).eq('token_hash', h).maybeSingle())) },
+    async agentInviteById (id) { return rowFrom(await one(db.from('agent_invites').select(AGENT_INVITE).eq('id', id).maybeSingle())) },
+    async listAgentInvites ({ ownerUserId, orgId }) {
+      const q = db.from('agent_invites').select(AGENT_INVITE)
+      return (await one((orgId ? q.eq('org_id', orgId) : q.eq('owner_user_id', ownerUserId)).order('created_at', { ascending: false }).limit(50))).map(rowFrom)
+    },
+    // Check-and-set: an invite is used once, and only while it's open.
+    async claimAgentInvite (id) {
+      const at = new Date().toISOString()
+      const rows = await one(db.from('agent_invites').update({ used_at: at }).eq('id', id).is('used_at', null).is('cancelled_at', null).gt('expires_at', at).select('id'))
+      return rows.length > 0
+    },
+    // Undoes a claim when making the agent failed, so the link can be tried again.
+    async releaseAgentInvite (id) { await one(db.from('agent_invites').update({ used_at: null, used_by_agent_id: null, rejoined: false }).eq('id', id)) },
+    async setInviteAgent (id, agentId, rejoined = false) { await one(db.from('agent_invites').update({ used_by_agent_id: agentId, rejoined }).eq('id', id)) },
+    // Check-and-set: only a waiting invite is cancelled.
+    async cancelAgentInvite (id) {
+      const rows = await one(db.from('agent_invites').update({ cancelled_at: new Date().toISOString() }).eq('id', id).is('used_at', null).is('cancelled_at', null).gt('expires_at', new Date().toISOString()).select('id'))
+      return rows.length > 0
+    },
+
+    // App keys (qk_): hashes only, and they don't run out.
+    async createAgentAppKey ({ agentId, name, keyHash }) {
+      return rowFrom(await one(db.from('agent_app_keys').insert({ agent_id: agentId, name, key_hash: keyHash }).select(AGENT_APP_KEY).single()))
+    },
+    async agentAppKeyByHash (h) { return rowFrom(await one(db.from('agent_app_keys').select(AGENT_APP_KEY).eq('key_hash', h).maybeSingle())) },
+    async listAgentAppKeys (agentId) {
+      return (await one(db.from('agent_app_keys').select(AGENT_APP_KEY).eq('agent_id', agentId).is('revoked_at', null).order('created_at'))).map(rowFrom)
+    },
+    async touchAgentAppKey (id) { await one(db.from('agent_app_keys').update({ last_used_at: new Date().toISOString() }).eq('id', id)) },
+    // Only a key of this agent, and only once.
+    async revokeAgentAppKey (agentId, id) {
+      const rows = await one(db.from('agent_app_keys').update({ revoked_at: new Date().toISOString() }).eq('id', id).eq('agent_id', agentId).is('revoked_at', null).select('id'))
+      return rows.length > 0
+    },
+
+    // Agent keys: hashes only.
+    async createAgentKeys (k) {
+      return rowFrom(await one(db.from('agent_keys')
+        .insert(toSnake({ ...k, accessExpiresAt: ts(k.accessExpiresAt), refreshExpiresAt: ts(k.refreshExpiresAt) }))
+        .select(AGENT_KEY).single()))
+    },
+    async agentKeyByAccess (h) { return rowFrom(await one(db.from('agent_keys').select(AGENT_KEY).eq('access_hash', h).maybeSingle())) },
+    async agentKeyByRefresh (h) { return rowFrom(await one(db.from('agent_keys').select(AGENT_KEY).eq('refresh_hash', h).maybeSingle())) },
+    async listAgentKeys (agentId) { return (await one(db.from('agent_keys').select(AGENT_KEY).eq('agent_id', agentId).order('created_at'))).map(rowFrom) },
+    // Check-and-set: a refresh key is spent once, and never after it was revoked.
+    async claimRefresh (id) {
+      const rows = await one(db.from('agent_keys').update({ refreshed_at: new Date().toISOString() }).eq('id', id).is('refreshed_at', null).is('revoked_at', null).select('id'))
+      return rows.length > 0
+    },
+    async revokeFamily (familyId) {
+      await one(db.from('agent_keys').update({ revoked_at: new Date().toISOString() }).eq('family_id', familyId).is('revoked_at', null))
+    },
+    // Undoes a claim when minting the new pair failed, so the same refresh key can retry.
+    async releaseRefresh (id) {
+      await one(db.from('agent_keys').update({ refreshed_at: null }).eq('id', id).is('revoked_at', null))
+    },
+    // Deleting the auth user cascades through profiles, devices, links and agents. Session
+    // activity is keyed by 'person:<id>' and 'agent:<id>', not foreign keys, so it goes first.
+    async deleteUser (userId) {
+      const agents = await one(db.from('agents').select('id').eq('owner_user_id', userId))
+      const accounts = [`person:${userId}`, ...agents.map((a) => `agent:${a.id}`)]
+      await one(db.rpc('delete_account_access', { p_accounts: accounts }))
+      await one(db.rpc('delete_account_activity', { p_accounts: accounts }))
+      const { error } = await db.auth.admin.deleteUser(userId)
+      if (error) throw error
+    },
+
+    // The GitHub account a person connected (routes/github.js): { githubId, login, linkedAt } or null.
+    async githubLink (userId) { return rowFrom(await one(db.from('github_links').select('github_id, login, linked_at').eq('user_id', userId).maybeSingle())) },
+    async setGithubLink (userId, { githubId, login }) {
+      await one(db.from('github_links').upsert({ user_id: userId, github_id: githubId, login, linked_at: new Date().toISOString() }, { onConflict: 'user_id' }))
+    },
+    async deleteGithubLink (userId) { await one(db.from('github_links').delete().eq('user_id', userId)) },
+    // GitHub connected for a scope (github_connections), newest first.
+    async githubConnections ({ scope, scopeId }) {
+      const rows = await one(db.from('github_connections').select('scope, scope_id, connected_by, installation_id, created_at').eq('scope', scope).eq('scope_id', scopeId).order('created_at', { ascending: false }))
+      return rows.map((r) => ({ scope: r.scope, scopeId: r.scope_id, connectedBy: r.connected_by, installationId: r.installation_id == null ? null : Number(r.installation_id), createdAt: Date.parse(r.created_at) }))
+    },
+    async addGithubConnection ({ scope, scopeId, connectedBy, installationId = null }) {
+      await one(db.from('github_connections').upsert({ scope, scope_id: scopeId, connected_by: connectedBy, installation_id: installationId, created_at: new Date().toISOString() }, { onConflict: 'scope,scope_id,connected_by' }))
+    },
+    async removeGithubConnection ({ scope, scopeId, connectedBy }) { await one(db.from('github_connections').delete().eq('scope', scope).eq('scope_id', scopeId).eq('connected_by', connectedBy)) },
+    async workspaceGithub (workspaceId) {
+      const r = await one(db.from('workspace_github').select('access, repos, agent_commits').eq('workspace_id', workspaceId).maybeSingle())
+      return r ? { access: r.access, repos: r.repos || [], agentCommits: r.agent_commits || '' } : { access: 'open', repos: [], agentCommits: '' }
+    },
+    // Only what is given changes: { access, repos } and/or { agentCommits } ('' for each session to decide).
+    async setWorkspaceGithub (workspaceId, { access, repos, agentCommits }) {
+      const row = { workspace_id: workspaceId, updated_at: new Date().toISOString() }
+      if (access !== undefined) { row.access = access; row.repos = repos || [] }
+      if (agentCommits !== undefined) row.agent_commits = agentCommits || null
+      await one(db.from('workspace_github').upsert(row, { onConflict: 'workspace_id' }))
+    },
+    async teamGithub (teamId) {
+      const r = await one(db.from('team_github').select('agent_commits').eq('team_id', teamId).maybeSingle())
+      return { agentCommits: (r && r.agent_commits) || '' }
+    },
+    async setTeamGithub (teamId, { agentCommits }) {
+      await one(db.from('team_github').upsert({ team_id: teamId, agent_commits: agentCommits || null, updated_at: new Date().toISOString() }, { onConflict: 'team_id' }))
+    },
+    // The rules of the teams `memberId` is on: [{ teamId, name, agentCommits }], only those that set one.
+    async teamGitRules (memberId) {
+      const rows = await one(db.from('team_members').select('team_id, teams (name, team_github (agent_commits))').eq('member_id', memberId))
+      return rows.map((r) => {
+        const g = r.teams && r.teams.team_github
+        const mode = Array.isArray(g) ? (g[0] && g[0].agent_commits) : (g && g.agent_commits)
+        return mode ? { teamId: r.team_id, name: (r.teams && r.teams.name) || '', agentCommits: mode } : null
+      }).filter(Boolean)
+    },
+    async orgGithub (orgId) {
+      const r = await one(db.from('org_github').select('require_github, agent_commits').eq('org_id', orgId).maybeSingle())
+      return { requireGithub: !!(r && r.require_github), agentCommits: (r && r.agent_commits) || '' }
+    },
+    async setOrgGithub (orgId, { requireGithub, agentCommits }) {
+      const row = { org_id: orgId, updated_at: new Date().toISOString() }
+      if (requireGithub !== undefined) row.require_github = !!requireGithub
+      if (agentCommits !== undefined) row.agent_commits = agentCommits || null
+      await one(db.from('org_github').upsert(row, { onConflict: 'org_id' }))
+    },
+    // The API's own settings (app_settings): a value it keeps across starts, such as the webhook secret it set on GitHub.
+    // One live session per repository and branch (git_sync_leases, through its locking functions).
+    async takeLease ({ repo, branch, room, holder = '', ttlMs }) { return await one(db.rpc('take_git_sync_lease', { p_repo: repo, p_branch: branch, p_room: room, p_holder: holder, p_ttl_ms: ttlMs })) },
+    async heartbeatLease ({ repo, branch, room, generation, ttlMs }) { return await one(db.rpc('heartbeat_git_sync_lease', { p_repo: repo, p_branch: branch, p_room: room, p_generation: generation, p_ttl_ms: ttlMs })) },
+    async releaseLease ({ repo, branch, room, generation }) { return await one(db.rpc('release_git_sync_lease', { p_repo: repo, p_branch: branch, p_room: room, p_generation: generation })) },
+    async getSetting (key) { const r = await one(db.from('app_settings').select('value').eq('key', key).maybeSingle()); return r ? r.value : null },
+    async setSetting (key, value) { await one(db.from('app_settings').upsert({ key, value: String(value), updated_at: new Date().toISOString() }, { onConflict: 'key' })) },
+    async setSettingIfAbsent (key, value) {
+      await one(db.from('app_settings').upsert({ key, value: String(value), updated_at: new Date().toISOString() }, { onConflict: 'key', ignoreDuplicates: true }))
+      const r = await one(db.from('app_settings').select('value').eq('key', key).maybeSingle())
+      return r ? r.value : String(value)
+    },
+
+    // Relay machines and where each room lives (20261017000000_relay_cluster.sql; src/api/relay-cluster.js).
+    async relayMachine (id) { return rowFrom(await one(db.from('relay_machines').select(RELAY_MACHINE).eq('id', id).maybeSingle())) },
+    async relayMachines () { return (await one(db.from('relay_machines').select(RELAY_MACHINE).order('created_at').order('id'))).map(rowFrom) },
+    async putRelayMachine ({ id, helloAt, reportedAt, ...fields }) {
+      const row = toSnake({ id, ...fields, hello_at: ts(helloAt), reported_at: ts(reportedAt) })
+      return rowFrom(await one(db.from('relay_machines').upsert(row, { onConflict: 'id' }).select(RELAY_MACHINE).single()))
+    },
+    async relayRoom (room) { return rowFrom(await one(db.from('relay_rooms').select(RELAY_ROOM).eq('room', room).maybeSingle())) },
+    async relayRoomsOn (machineId) { return (await pages(() => db.from('relay_rooms').select(RELAY_ROOM).eq('machine_id', machineId).order('room'))).map(rowFrom) },
+    async relayRoomCounts () {
+      const out = {}
+      for (const r of await one(db.rpc('relay_room_counts'))) out[r.machine_id] = Number(r.rooms)
+      return out
+    },
+    async placeRelayRoom (room, machineId) { return rowFrom((await one(db.rpc('place_relay_room', { p_room: room, p_machine: machineId })))[0]) },
+    async setRelayRoom (room, { reportedAt, ...patch }) {
+      return rowFrom(await one(db.from('relay_rooms').update(toSnake({ ...patch, reported_at: ts(reportedAt) })).eq('room', room).select(RELAY_ROOM).maybeSingle()))
+    },
+    async forgetRelayRoom (room, machineId) {
+      let q = db.from('relay_rooms').delete().eq('room', room)
+      if (machineId) q = q.eq('machine_id', machineId)
+      await one(q)
+    },
+    async takeRelayJob (key, { detail = {}, staleMs, retryMs }) { return !!(await one(db.rpc('take_relay_job', { p_key: key, p_detail: detail, p_stale_ms: staleMs, p_retry_ms: retryMs }))) },
+    async finishRelayJob (key, { state, detail }) { await one(db.from('relay_jobs').update(toSnake({ state, detail, finished_at: new Date().toISOString() })).eq('key', key)) },
+    async relayJob (key) { return rowFrom(await one(db.from('relay_jobs').select(RELAY_JOB).eq('key', key).maybeSingle())) },
+    // Hosted agents across relay machines.
+    async hostedRoomsOf (account) { return (await one(db.from('relay_hosted_rooms').select('room').eq('account', account).order('added_at').order('room'))).map((r) => r.room) },
+    async addHostedRoom (account, room) { await one(db.from('relay_hosted_rooms').upsert({ account, room }, { onConflict: 'account,room', ignoreDuplicates: true })) },
+    async removeHostedRoom (account, room) { await one(db.from('relay_hosted_rooms').delete().eq('account', account).eq('room', room)) },
+    async hostedWebhookOf (account) { const r = await one(db.from('relay_hosted_webhooks').select('webhook').eq('account', account).maybeSingle()); return r ? r.webhook : null },
+    async putHostedWebhook (account, webhook) {
+      if (!webhook) return void await one(db.from('relay_hosted_webhooks').delete().eq('account', account))
+      await one(db.from('relay_hosted_webhooks').upsert({ account, webhook, updated_at: new Date().toISOString() }, { onConflict: 'account' }))
+    },
+    async roomHasAccount (room, account) {
+      const s = await one(db.from('relay_sessions').select('owner_account').eq('room', room).maybeSingle())
+      if (s && s.owner_account === account) return true
+      const v = await one(db.from('session_visits').select('id').eq('room', room).eq('account', account).limit(1))
+      return v.length > 0
+    },
+    async spendResumeSignature (hash, windowMs) {
+      const cutoff = new Date(Date.now() - windowMs).toISOString()
+      await one(db.from('seen_resume_signatures').delete().lt('seen_at', cutoff))
+      const { error } = await db.from('seen_resume_signatures').insert({ signature_hash: hash })
+      if (!error) return true
+      if (error.code === '23505') return false
+      throw error
+    },
+
+    // The address a person signs in with, and whether they've confirmed it.
+    async userEmail (userId) {
+      const { data, error } = await db.auth.admin.getUserById(userId)
+      if (error) { if (error.status === 404) return null; throw error }
+      const u = data?.user
+      return u ? { email: u.email || '', confirmed: !!u.email_confirmed_at } : null
+    },
+
+    // Session activity (see 20261002000000_session_activity.sql). Event times are epoch ms.
+    async ingestPresence (events, receivedAt) {
+      return await one(db.rpc('ingest_presence', { p_events: events, p_received_at: ts(receivedAt) }))
+    },
+    async accountSessions (account, { since, limit }) {
+      return (await pages(() => db.rpc('account_sessions', { p_account: account, p_since: ts(since), p_limit: limit }))).map(rowFrom)
+    },
+    async actionsInRoom (room, { from, to, limit }) {
+      // `at` isn't a `*At` column, so it's turned into epoch ms here.
+      return (await pages(() => db.rpc('actions_in_room', { p_room: room, p_from: ts(from), p_to: ts(to), p_limit: limit }))).map((r) => ({ ...rowFrom(r), at: ms(r.at) }))
+    },
+    async sessionByRoom (room) { return rowFrom(await one(db.from('relay_sessions').select(RELAY_SESSION).eq('room', room).maybeSingle())) },
+    async visitsInRooms (rooms) {
+      if (!rooms.length) return []
+      return (await pages(() => db.rpc('visits_in_rooms', { p_rooms: rooms }))).map(rowFrom)
+    },
+    async renameSession (room, name, at) {
+      return rowFrom(await one(db.from('relay_sessions').update({ name, renamed_at: ts(at) }).eq('room', room).select(RELAY_SESSION).maybeSingle()))
+    },
+
+    // Workspaces (see 20261004000000_workspaces.sql).
+    async createWorkspace ({ ownerUserId = null, orgId = null, name, description = '', color = '', createdBy }) {
+      return rowFrom(await one(db.from('workspaces').insert({ owner_user_id: ownerUserId, org_id: orgId, name, description, color, created_by: createdBy }).select(WORKSPACE).single()))
+    },
+    async workspaceById (id) { return rowFrom(await one(db.from('workspaces').select(WORKSPACE).eq('id', id).maybeSingle())) },
+    async listWorkspacesOwnedBy (userId) { return (await one(db.from('workspaces').select(WORKSPACE).eq('owner_user_id', userId).order('name'))).map(rowFrom) },
+    async listWorkspacesOfOrg (orgId) { return (await one(db.from('workspaces').select(WORKSPACE).eq('org_id', orgId).order('name'))).map(rowFrom) },
+    async listWorkspacesForMember (account) {
+      const rows = await one(db.from('workspace_members').select(`access, workspaces (${WORKSPACE})`).eq('account', account))
+      return rows.filter((r) => r.workspaces).map((r) => ({ ...rowFrom(r.workspaces), memberAccess: r.access })).sort((a, b) => a.name.localeCompare(b.name))
+    },
+    async updateWorkspace (id, { name, description, color, archivedAt }) {
+      return rowFrom(await one(db.from('workspaces').update(toSnake({ name, description, color, archivedAt: ts(archivedAt) })).eq('id', id).select(WORKSPACE).maybeSingle()))
+    },
+    async deleteWorkspace (id) { await one(db.rpc('delete_workspace', { p_id: id })) },
+    async workspaceMember (workspaceId, account) { return rowFrom(await one(db.from('workspace_members').select(WORKSPACE_MEMBER).eq('workspace_id', workspaceId).eq('account', account).maybeSingle())) },
+    async listWorkspaceMembers (workspaceId) { return (await one(db.from('workspace_members').select(WORKSPACE_MEMBER).eq('workspace_id', workspaceId).order('added_at'))).map(rowFrom) },
+    // Keep added_at on a change of access: the upsert only touches access and added_by.
+    // sessions is included only when given, so an upsert that omits it never resets an
+    // existing member's sessions back to the column default.
+    async putWorkspaceMember ({ workspaceId, account, access, addedBy, sessions }) {
+      const payload = { workspace_id: workspaceId, account, access, added_by: addedBy }
+      if (sessions !== undefined) payload.sessions = sessions
+      return rowFrom(await one(db.from('workspace_members').upsert(payload, { onConflict: 'workspace_id,account' }).select(WORKSPACE_MEMBER).single()))
+    },
+    async removeWorkspaceMember (workspaceId, account) {
+      const rows = await one(db.from('workspace_members').delete().eq('workspace_id', workspaceId).eq('account', account).select('account'))
+      return rows.length > 0
+    },
+    // Workspace invites (20261009000000_invite_inbox.sql): one open per address or account
+    // (a unique index; a second is a 23505), that key's expired ones deleted first.
+    async createWorkspaceInvite ({ workspaceId, email = null, account = null, accountName = '', access, invitedBy, expiresAt, at = Date.now() }) {
+      email = email && email.toLowerCase()
+      await one(db.from('workspace_invites').delete().eq('workspace_id', workspaceId).eq(email ? 'email' : 'account', email || account)
+        .is('accepted_at', null).is('declined_at', null).is('cancelled_at', null).lte('expires_at', ts(at)))
+      return rowFrom(await one(db.from('workspace_invites')
+        .insert({ workspace_id: workspaceId, email, account, account_name: accountName, access, invited_by: invitedBy, expires_at: ts(expiresAt) })
+        .select(WORKSPACE_INVITE).single()))
+    },
+    async listWorkspaceInvites (workspaceId) {
+      return (await one(db.from('workspace_invites').select(WORKSPACE_INVITE).eq('workspace_id', workspaceId).order('created_at', { ascending: false }).limit(50))).map(rowFrom)
+    },
+    async workspaceInviteById (id) { return rowFrom(await one(db.from('workspace_invites').select(WORKSPACE_INVITE).eq('id', id).maybeSingle())) },
+    async openWorkspaceInvite (workspaceId, { email = null, account = null }, at) {
+      const rows = await one(db.from('workspace_invites').select(WORKSPACE_INVITE).eq('workspace_id', workspaceId).eq(email ? 'email' : 'account', email || account)
+        .is('accepted_at', null).is('declined_at', null).is('cancelled_at', null).gt('expires_at', ts(at)).limit(1))
+      return rowFrom(rows[0] || null)
+    },
+    async workspaceInvitesFor ({ account = null, email = null }, at) {
+      const who = orFor({ account, email })
+      if (!who) return []
+      return (await one(db.from('workspace_invites').select(WORKSPACE_INVITE).or(who)
+        .is('accepted_at', null).is('declined_at', null).is('cancelled_at', null).gt('expires_at', ts(at)).order('created_at', { ascending: false }).limit(50))).map(rowFrom)
+    },
+    // Check-and-set: only a waiting invite is answered. `how` is accepted, declined or cancelled.
+    async answerWorkspaceInvite (id, how, by = null) {
+      if (!['accepted', 'declined', 'cancelled'].includes(how)) throw new Error('accepted, declined or cancelled')
+      const patch = { [`${how}_at`]: new Date().toISOString(), ...(how === 'accepted' ? { accepted_by: by } : {}) }
+      const rows = await one(db.from('workspace_invites').update(patch).eq('id', id).is('accepted_at', null).is('declined_at', null).is('cancelled_at', null).select('id'))
+      return rows.length > 0
+    },
+    async setSessionWorkspace (room, workspaceId, { linkedBy = null, at }) {
+      return rowFrom(await one(db.rpc('set_session_workspace', { p_room: room, p_workspace: workspaceId || null, p_linked_by: linkedBy || null, p_at: ts(at) })))
+    },
+    async listWorkspaceSessions (workspaceId) { return (await one(db.from('relay_sessions').select(RELAY_SESSION).eq('workspace_id', workspaceId).order('last_active_at', { ascending: false }))).map(rowFrom) },
+
+    // Workspace agents (see 20261007000001_workspace_agents.sql). Where an agent works,
+    // a workspace's say over one that reaches it, per-session keep-outs, and its webhook.
+    async agentPlacement (agentId) { return rowFrom(await one(db.from('agent_placements').select(AGENT_PLACEMENT).eq('agent_id', agentId).maybeSingle())) },
+    async putAgentPlacement ({ agentId, reach = 'manual', workspaceIds = [], sessions = 'invited', access = 'edit', scopes = [], updatedBy }) {
+      return rowFrom(await one(db.from('agent_placements')
+        .upsert({ agent_id: agentId, reach, workspace_ids: workspaceIds, sessions, access, scopes, updated_by: updatedBy, updated_at: new Date().toISOString() }, { onConflict: 'agent_id' })
+        .select(AGENT_PLACEMENT).single()))
+    },
+    async listAgentPlacements (agentIds) {
+      if (!agentIds.length) return []
+      return (await one(db.from('agent_placements').select(AGENT_PLACEMENT).in('agent_id', agentIds))).map(rowFrom)
+    },
+    async workspaceAgentOverride (workspaceId, agentId) {
+      return rowFrom(await one(db.from('workspace_agent_overrides').select(WORKSPACE_AGENT_OVERRIDE).eq('workspace_id', workspaceId).eq('agent_id', agentId).maybeSingle()))
+    },
+    async putWorkspaceAgentOverride ({ workspaceId, agentId, sessions = null, excluded = false }) {
+      return rowFrom(await one(db.from('workspace_agent_overrides')
+        .upsert({ workspace_id: workspaceId, agent_id: agentId, sessions, excluded }, { onConflict: 'workspace_id,agent_id' })
+        .select(WORKSPACE_AGENT_OVERRIDE).single()))
+    },
+    async deleteWorkspaceAgentOverride (workspaceId, agentId) {
+      return (await one(db.from('workspace_agent_overrides').delete().eq('workspace_id', workspaceId).eq('agent_id', agentId).select('agent_id'))).length > 0
+    },
+    async listWorkspaceAgentOverrides (workspaceId) {
+      return (await one(db.from('workspace_agent_overrides').select(WORKSPACE_AGENT_OVERRIDE).eq('workspace_id', workspaceId))).map(rowFrom)
+    },
+    async addSessionAgentExclusion ({ room, agentId, excludedBy }) {
+      return rowFrom(await one(db.from('session_agent_exclusions')
+        .upsert({ room, agent_id: agentId, excluded_by: excludedBy }, { onConflict: 'room,agent_id' })
+        .select(SESSION_AGENT_EXCLUSION).single()))
+    },
+    async removeSessionAgentExclusion (room, agentId) {
+      return (await one(db.from('session_agent_exclusions').delete().eq('room', room).eq('agent_id', agentId).select('agent_id'))).length > 0
+    },
+    async sessionAgentExcluded (room, agentId) {
+      return !!(await one(db.from('session_agent_exclusions').select('agent_id').eq('room', room).eq('agent_id', agentId).maybeSingle()))
+    },
+    async listSessionAgentExclusions (room) {
+      return (await one(db.from('session_agent_exclusions').select(SESSION_AGENT_EXCLUSION).eq('room', room))).map(rowFrom)
+    },
+    async agentWebhook (agentId) { return rowFrom(await one(db.from('agent_webhooks').select(AGENT_WEBHOOK).eq('agent_id', agentId).maybeSingle())) },
+    async putAgentWebhook ({ agentId, url, secret }) {
+      return rowFrom(await one(db.from('agent_webhooks')
+        .upsert({ agent_id: agentId, url, secret, updated_at: new Date().toISOString() }, { onConflict: 'agent_id' })
+        .select(AGENT_WEBHOOK).single()))
+    },
+    async deleteAgentWebhook (agentId) {
+      return (await one(db.from('agent_webhooks').delete().eq('agent_id', agentId).select('agent_id'))).length > 0
+    },
+
+    // A person's cloud AI machine (see 20261017000000_ai_vms.sql): one per person.
+    async createAiVm ({ userId, tool, model = '', prompt = '', cap = 0, region = '' }) {
+      return rowFrom(await one(db.from('ai_vms').insert({ user_id: userId, tool, model, prompt, cap, region }).select(AI_VM).single()))
+    },
+    async aiVmOf (userId) { return rowFrom(await one(db.from('ai_vms').select(AI_VM).eq('user_id', userId).maybeSingle())) },
+    async aiVmByAgent (agentId) { return agentId ? rowFrom(await one(db.from('ai_vms').select(AI_VM).eq('agent_id', agentId).maybeSingle())) : null },
+    async updateAiVm (userId, patch) {
+      const set = toSnake({ ...patch, lastReportAt: ts(patch.lastReportAt) })
+      return rowFrom(await one(db.from('ai_vms').update({ ...set, updated_at: new Date().toISOString() }).eq('user_id', userId).select(AI_VM).maybeSingle()))
+    },
+    async deleteAiVm (userId) {
+      return (await one(db.from('ai_vms').delete().eq('user_id', userId).select('user_id'))).length > 0
+    },
+
+    // Workspace files (see 20261005000000_workspace_files.sql).
+    async createWorkspaceFile ({ workspaceId, path, kind, size = 0, mime = '', sha256 = '', objectKey = '', note = '', uploadedBy }) {
+      return rowFrom(await one(db.from('workspace_files').insert({ workspace_id: workspaceId, path, kind, size, mime, sha256, object_key: objectKey, note, uploaded_by: uploadedBy }).select(WORKSPACE_FILE).single()))
+    },
+    async workspaceFileById (id) { return rowFrom(await one(db.from('workspace_files').select(WORKSPACE_FILE).eq('id', id).maybeSingle())) },
+    async workspaceFileByPath (workspaceId, path) { return rowFrom(await one(db.from('workspace_files').select(WORKSPACE_FILE).eq('workspace_id', workspaceId).eq('path', path).is('deleted_at', null).maybeSingle())) },
+    async listWorkspaceFiles (workspaceId, { includeDeleted = false } = {}) {
+      const rows = await pages(() => { const q = db.from('workspace_files').select(WORKSPACE_FILE).eq('workspace_id', workspaceId).order('kind', { ascending: false }).order('path'); return includeDeleted ? q : q.is('deleted_at', null) })
+      return rows.map(rowFrom)
+    },
+    async newWorkspaceFileVersion (id, { size, mime, sha256, objectKey, note = '', uploadedBy, at, keep = 10 }) {
+      const r = await one(db.rpc('new_workspace_file_version', { p_id: id, p_size: size, p_mime: mime, p_sha256: sha256, p_object_key: objectKey, p_note: note, p_uploaded_by: uploadedBy, p_at: ts(at), p_keep: keep }))
+      return r ? { file: rowFrom(r.file), droppedKeys: r.dropped_keys || [] } : null
+    },
+    async listWorkspaceFileVersions (id) { return (await one(db.from('workspace_file_versions').select(WORKSPACE_FILE_VERSION).eq('file_id', id).order('version', { ascending: false }))).map(rowFrom) },
+    async confirmWorkspaceFile (id, { size, at }) { return rowFrom(await one(db.from('workspace_files').update({ size, confirmed_at: ts(at) }).eq('id', id).select(WORKSPACE_FILE).maybeSingle())) },
+    async updateWorkspaceFile (id, { path, note }) { return rowFrom(await one(db.from('workspace_files').update(toSnake({ path, note })).eq('id', id).select(WORKSPACE_FILE).maybeSingle())) },
+    async renameWorkspaceFolder (workspaceId, from, to, at) { return await one(db.rpc('rename_workspace_folder', { p_workspace: workspaceId, p_from: from, p_to: to })) },
+    async deleteWorkspaceFile (id, at) { return rowFrom(await one(db.rpc('delete_workspace_file', { p_id: id, p_at: ts(at) }))) },
+    async unconfirmedWorkspaceFiles (before) { return (await one(db.from('workspace_files').select(WORKSPACE_FILE).eq('kind', 'file').is('confirmed_at', null).lt('uploaded_at', ts(before)))).map(rowFrom) },
+    async removeWorkspaceFile (id) { await one(db.from('workspace_files').delete().eq('id', id)) },
+    async sweepDeletedWorkspaceFiles (before) { return (await one(db.rpc('sweep_deleted_workspace_files', { p_before: ts(before) }))) || [] },
+    async workspaceUsage (workspaceId) { const [r] = await one(db.rpc('workspace_usage', { p_workspace: workspaceId })); return { usedBytes: Number(r?.used_bytes || 0), fileCount: Number(r?.file_count || 0) } },
+    async setWorkspaceUsage (workspaceId, { usedBytes, fileCount }) { await one(db.from('workspaces').update({ used_bytes: usedBytes, file_count: fileCount }).eq('id', workspaceId)) },
+    async setWorkspaceFileObjectKey (id, objectKey) { return rowFrom(await one(db.from('workspace_files').update({ object_key: objectKey }).eq('id', id).select(WORKSPACE_FILE).maybeSingle())) },
+    async revertWorkspaceFileVersion (id) { return rowFrom(await one(db.rpc('revert_workspace_file_version', { p_id: id }))) },
+
+    async pruneActivity ({ before, seenBefore }) {
+      await one(db.rpc('prune_activity', { p_before: ts(before), p_seen_before: ts(seenBefore) }))
+    },
+
+    // Access types, grants and session invites (see 20261002010000_access_types_and_invites.sql).
+    async listAccessTypes (ownerAccount) {
+      return (await one(db.from('access_types').select(ACCESS_TYPE).eq('owner_account', ownerAccount).order('created_at'))).map(rowFrom)
+    },
+    async accessTypeById (id) { return rowFrom(await one(db.from('access_types').select(ACCESS_TYPE).eq('id', id).maybeSingle())) },
+    async createAccessType ({ ownerAccount, name, files, folders = [], talk = true }) {
+      return rowFrom(await one(db.from('access_types').insert({ owner_account: ownerAccount, name, files, folders, talk }).select(ACCESS_TYPE).single()))
+    },
+    async updateAccessType (id, { name, files, folders, talk }) {
+      return rowFrom(await one(db.from('access_types').update(toSnake({ name, files, folders, talk, updatedAt: new Date().toISOString() })).eq('id', id).select(ACCESS_TYPE).maybeSingle()))
+    },
+    // Its grants and invites fall back to View only, in the same transaction.
+    async deleteAccessType (id, ownerAccount) {
+      return await one(db.rpc('delete_access_type', { p_id: id, p_owner: ownerAccount }))
+    },
+    async grantFor (room, account) { return rowFrom(await one(db.from('session_grants').select(GRANT).eq('room', room).eq('account', account).maybeSingle())) },
+    async listGrants (room) { return (await one(db.from('session_grants').select(GRANT).eq('room', room).order('created_at'))).map(rowFrom) },
+    async putGrant ({ room, account, typeId, tighten = {}, grantedBy }) {
+      return rowFrom(await one(db.from('session_grants')
+        .upsert({ room, account, type_id: typeId, tighten, granted_by: grantedBy, updated_at: new Date().toISOString() }, { onConflict: 'room,account' })
+        .select(GRANT).single()))
+    },
+    async deleteGrant (room, account) {
+      return (await one(db.from('session_grants').delete().eq('room', room).eq('account', account).select('account'))).length > 0
+    },
+    // One open invite per address or account (a unique index; a second one is a 23505). That
+    // key's expired, unused invites go first, so they never block a new one.
+    async createSessionInvite ({ room, email = null, account = null, accountName = '', typeId, invitedBy, expiresAt, link = null, at = Date.now() }) {
+      email = email && email.toLowerCase()
+      await one(db.from('session_invites').delete().eq('room', room).eq(email ? 'email' : 'account', email || account)
+        .is('used_at', null).is('cancelled_at', null).lte('expires_at', ts(at)))
+      return rowFrom(await one(db.from('session_invites')
+        .insert({ room, email: email && email.toLowerCase(), account, account_name: accountName, type_id: typeId, invited_by: invitedBy, expires_at: ts(expiresAt), link })
+        .select(SESSION_INVITE).single()))
+    },
+    async listSessionInvites (room) {
+      return (await one(db.from('session_invites').select(SESSION_INVITE).eq('room', room).order('created_at', { ascending: false }).limit(50))).map(rowFrom)
+    },
+    async sessionInviteById (room, id) { return rowFrom(await one(db.from('session_invites').select(SESSION_INVITE).eq('room', room).eq('id', id).maybeSingle())) },
+    // The open session invites sent to an account or a (confirmed) address, with their links.
+    async sessionInvitesFor ({ account = null, email = null }, at) {
+      const who = orFor({ account, email })
+      if (!who) return []
+      const rows = await one(db.from('session_invites').select(`${SESSION_INVITE}, link, relay_sessions (name)`).or(who)
+        .is('used_at', null).is('cancelled_at', null).gt('expires_at', ts(at)).order('created_at', { ascending: false }).limit(50))
+      return rows.map(({ relay_sessions: s, ...r }) => ({ ...rowFrom(r), sessionName: s?.name || '' }))
+    },
+    // A session invite, only when it was sent to this account or address.
+    async sessionInviteForMe (id, { account = null, email = null }) {
+      const i = rowFrom(await one(db.from('session_invites').select(SESSION_INVITE).eq('id', id).maybeSingle()))
+      return i && ((account && i.account === account) || (email && i.email === email)) ? i : null
+    },
+    // The open (unused, not cancelled, not expired) invite for an address or account, but `exceptId`.
+    async openSessionInvite (room, { email = null, account = null }, at, exceptId = null) {
+      let q = db.from('session_invites').select(SESSION_INVITE).eq('room', room).eq(email ? 'email' : 'account', email || account)
+        .is('used_at', null).is('cancelled_at', null).gt('expires_at', ts(at))
+      if (exceptId) q = q.neq('id', exceptId)
+      return rowFrom((await one(q.limit(1)))[0] || null)
+    },
+    // Check-and-set: only a waiting invite is cancelled.
+    async cancelSessionInvite (id) {
+      const rows = await one(db.from('session_invites').update({ cancelled_at: new Date().toISOString() }).eq('id', id).is('used_at', null).is('cancelled_at', null).select('id'))
+      return rows.length > 0
+    },
+    // The grant goes unless an open invite for that address or account still needs it (one statement).
+    async deleteUnusedGrant (room, account, at) {
+      return await one(db.rpc('delete_unused_grant', { p_room: room, p_account: account, p_now: ts(at) }))
+    },
+    async claimEmailInvites (room, email, account) {
+      return await one(db.rpc('claim_email_invites', { p_room: room, p_email: email, p_account: account, p_now: new Date().toISOString() }))
+    },
+    async useAccountInvites (room, account) {
+      const at = new Date().toISOString()
+      await one(db.from('session_invites').update({ used_at: at, used_by: account }).eq('room', room).eq('account', account).is('used_at', null).is('cancelled_at', null).gt('expires_at', at))
+    },
+
+    // Orgs. create_org makes the org, its three built-in roles and its owner in one
+    // transaction. first: true is for "a team" sign-ups, where two tabs (or a double
+    // click) can both see no org yet; create_org locks on the owner and hands back
+    // whichever org they end up in rather than making a second one.
+    async createOrg ({ name, slug, ownerId, grants, first = false }) {
+      return rowFrom(await one(db.rpc('create_org', {
+        p_name: name, p_slug: slug, p_owner: ownerId, p_owner_grants: grants.owner, p_admin_grants: grants.admin, p_member_grants: grants.member, p_first: first
+      })))
+    },
+    async orgBySlug (slug) { return rowFrom(await one(db.from('orgs').select(ORG).eq('slug', slug).maybeSingle())) },
+    async orgById (id) { return rowFrom(await one(db.from('orgs').select(ORG).eq('id', id).maybeSingle())) },
+    async orgsForUser (userId) {
+      const rows = await one(db.from('org_members').select(`role_id, orgs (${ORG})`).eq('user_id', userId))
+      return rows.map((r) => ({ ...rowFrom(r.orgs), roleId: r.role_id })).sort((a, b) => a.name.localeCompare(b.name))
+    },
+    async orgsByDomain (domain) { return (await one(db.from('orgs').select(ORG).eq('domain', domain).eq('domain_requests', true))).map(rowFrom) },
+    async updateOrg (id, { name, domain, domainRequests }) {
+      return rowFrom(await one(db.from('orgs').update(toSnake({ name, domain, domainRequests })).eq('id', id).select(ORG).single()))
+    },
+    // Cascades to roles, members, teams, invites and requests.
+    async deleteOrg (id) { await one(db.from('orgs').delete().eq('id', id)) },
+    async transferOrg (orgId, fromUserId, toUserId) { await one(db.rpc('transfer_org', { p_org: orgId, p_from: fromUserId, p_to: toUserId })) },
+
+    // Roles.
+    async listRoles (orgId) { return (await one(db.from('roles').select(ROLE).eq('org_id', orgId))).map(rowFrom) },
+    async roleById (orgId, id) { return rowFrom(await one(db.from('roles').select(ROLE).eq('org_id', orgId).eq('id', id).maybeSingle())) },
+    async createRole ({ orgId, name, grants }) {
+      return rowFrom(await one(db.from('roles').insert({ org_id: orgId, name, grants }).select(ROLE).single()))
+    },
+    async updateRole (id, { name, grants }) {
+      return rowFrom(await one(db.from('roles').update(toSnake({ name, grants })).eq('id', id).select(ROLE).single()))
+    },
+    // Closed invites (accepted, cancelled or expired) are cleared first, since
+    // org_invites.role_id is NO ACTION, not cascade; an open invite still makes
+    // the role delete fail with Postgres's 23503, which `one` rethrows as-is.
+    async deleteRole (id) {
+      await one(db.from('org_invites').delete().eq('role_id', id)
+        .or(`accepted_at.not.is.null,cancelled_at.not.is.null,expires_at.lte.${new Date().toISOString()}`))
+      await one(db.from('roles').delete().eq('id', id))
+    },
+    // In use: someone holds it, or an open (not accepted, not cancelled, not
+    // expired) invite would hand it out — the same definition deleteRole uses.
+    async roleInUse (id) {
+      if ((await one(db.from('org_members').select('id').eq('role_id', id).limit(1))).length) return true
+      return (await one(db.from('org_invites').select('id').eq('role_id', id)
+        .is('accepted_at', null).is('cancelled_at', null).gt('expires_at', new Date().toISOString()).limit(1))).length > 0
+    },
+
+    // Members.
+    memberOf,
+    async memberById (orgId, id) { return rowFrom(await one(db.from('org_members').select(MEMBER).eq('org_id', orgId).eq('id', id).maybeSingle())) },
+    // A member is a person (profiles) or an agent (agents); each row embeds whichever it is.
+    async listMembers (orgId) {
+      const rows = await one(db.from('org_members').select(`${MEMBER}, profiles (name), agents (name, provider, type, public_key)`).eq('org_id', orgId).order('joined_at'))
+      return rows.map(({ profiles, agents, ...r }) => ({ ...rowFrom(r), name: profiles?.name || agents?.name || '', provider: agents?.provider ?? null, type: agents?.type ?? null, publicKey: agents?.public_key ?? null }))
+    },
+    // Already a member: the upsert does nothing and we return the existing row.
+    async addMember ({ orgId, userId, roleId }) {
+      const row = await one(db.from('org_members')
+        .upsert({ org_id: orgId, user_id: userId, role_id: roleId }, { onConflict: 'org_id,user_id', ignoreDuplicates: true })
+        .select(MEMBER).maybeSingle())
+      return row ? rowFrom(row) : memberOf(orgId, userId)
+    },
+    async setMemberRole (id, roleId) { return rowFrom(await one(db.from('org_members').update({ role_id: roleId }).eq('id', id).select(MEMBER).single())) },
+    // Cascades to the member's team memberships.
+    async removeMember (id) { await one(db.from('org_members').delete().eq('id', id)) },
+    // The composite (agent_id, org_id) foreign key keeps other orgs' and personal agents out.
+    async addAgentMember ({ orgId, agentId, roleId = null }) {
+      return rowFrom(await one(db.from('org_members').insert({ org_id: orgId, agent_id: agentId, role_id: roleId }).select(MEMBER).single()))
+    },
+    async memberByAgent (orgId, agentId) { return rowFrom(await one(db.from('org_members').select(MEMBER).eq('org_id', orgId).eq('agent_id', agentId).maybeSingle())) },
+
+    // Teams.
+    async listTeams (orgId) { return (await one(db.from('teams').select(TEAM).eq('org_id', orgId).order('name'))).map(rowFrom) },
+    async teamById (orgId, id) { return rowFrom(await one(db.from('teams').select(TEAM).eq('org_id', orgId).eq('id', id).maybeSingle())) },
+    async createTeam ({ orgId, name }) { return rowFrom(await one(db.from('teams').insert({ org_id: orgId, name }).select(TEAM).single())) },
+    async renameTeam (id, name) { return rowFrom(await one(db.from('teams').update({ name }).eq('id', id).select(TEAM).single())) },
+    async deleteTeam (id) { await one(db.from('teams').delete().eq('id', id)) },
+    async listTeamMembers (teamId) {
+      const rows = await one(db.from('team_members').select(`${TEAM_MEMBER}, org_members (user_id, agent_id, profiles (name), agents (name))`).eq('team_id', teamId).order('added_at'))
+      return rows.map(({ org_members: m, ...r }) => ({ ...rowFrom(r), name: m?.profiles?.name || m?.agents?.name || '', kind: m?.agent_id ? 'agent' : 'person' }))
+    },
+    async teamsOfMember (memberId) {
+      return (await one(db.from('team_members').select('team_id, access, scopes').eq('member_id', memberId))).map((r) => ({ teamId: r.team_id, access: r.access, scopes: r.scopes || [] }))
+    },
+    // team_members.org_id is not null (composite FKs to teams(id, org_id) and
+    // org_members(id, org_id)), so look the team's org up first and stamp it
+    // on the upsert; a missing team fails the same way the real FK would.
+    async addTeamMember ({ teamId, memberId, access, scopes = [] }) {
+      const team = await one(db.from('teams').select('org_id').eq('id', teamId).maybeSingle())
+      if (!team) throw fkViolation('team')
+      return rowFrom(await one(db.from('team_members')
+        .upsert({ team_id: teamId, member_id: memberId, access, scopes, org_id: team.org_id }, { onConflict: 'team_id,member_id' })
+        .select(TEAM_MEMBER).single()))
+    },
+    // Folders only change when given, so an access-only change keeps them.
+    async setTeamAccess (teamId, memberId, access, scopes) {
+      return rowFrom(await one(db.from('team_members').update(scopes === undefined ? { access } : { access, scopes })
+        .eq('team_id', teamId).eq('member_id', memberId).select(TEAM_MEMBER).maybeSingle()))
+    },
+    async removeTeamMember (teamId, memberId) {
+      return (await one(db.from('team_members').delete().eq('team_id', teamId).eq('member_id', memberId).select('team_id'))).length > 0
+    },
+
+    // Invites: only the token's hash is stored. org_invites.email must be
+    // lowercase (a check constraint), matching the invite flow's
+    // case-insensitive match on the invitee's confirmed email.
+    async createInvite (i) {
+      return rowFrom(await one(db.from('org_invites').insert(toSnake({ ...i, email: i.email.toLowerCase(), expiresAt: ts(i.expiresAt) })).select(INVITE).single()))
+    },
+    async inviteByToken (h) { return rowFrom(await one(db.from('org_invites').select(INVITE).eq('token_hash', h).maybeSingle())) },
+    async inviteById (orgId, id) { return rowFrom(await one(db.from('org_invites').select(INVITE).eq('org_id', orgId).eq('id', id).maybeSingle())) },
+    async listInvites (orgId) {
+      return (await one(db.from('org_invites').select(INVITE).eq('org_id', orgId).is('accepted_at', null).is('cancelled_at', null).order('created_at'))).map(rowFrom)
+    },
+    async updateInvite (id, patch) {
+      return rowFrom(await one(db.from('org_invites').update(toSnake({ ...patch, expiresAt: ts(patch.expiresAt), cancelledAt: ts(patch.cancelledAt) })).eq('id', id).select(INVITE).single()))
+    },
+    // Check-and-set, so one invite can't be accepted twice, after it was
+    // cancelled, or once it's expired — mirrors roleInUse's open-invite definition.
+    async claimInvite (id) {
+      const rows = await one(db.from('org_invites').update({ accepted_at: new Date().toISOString() }).eq('id', id)
+        .is('accepted_at', null).is('cancelled_at', null).gt('expires_at', new Date().toISOString()).select('id'))
+      return rows.length > 0
+    },
+
+    // Domain join requests: the partial unique index (join_requests_one_pending)
+    // keeps one pending per person per org. The fast-path select below is only
+    // that — a fast path — since two concurrent calls can both pass it; the
+    // insert is what's race-safe: if it loses the race, its 23505 means someone
+    // else's row won, so re-select and hand that one back instead of throwing.
+    // join_requests.email must be lowercase (a check constraint).
+    async createJoinRequest ({ orgId, userId, email }) {
+      const pending = await one(db.from('join_requests').select(REQUEST).eq('org_id', orgId).eq('user_id', userId).eq('status', 'pending').maybeSingle())
+      if (pending) return rowFrom(pending)
+      try {
+        return rowFrom(await one(db.from('join_requests').insert({ org_id: orgId, user_id: userId, email: email.toLowerCase() }).select(REQUEST).single()))
+      } catch (err) {
+        if (err.code !== '23505') throw err
+        return rowFrom(await one(db.from('join_requests').select(REQUEST).eq('org_id', orgId).eq('user_id', userId).eq('status', 'pending').maybeSingle()))
+      }
+    },
+    async joinRequestById (orgId, id) { return rowFrom(await one(db.from('join_requests').select(REQUEST).eq('org_id', orgId).eq('id', id).maybeSingle())) },
+    async listJoinRequests (orgId) {
+      const rows = await one(db.from('join_requests').select(`${REQUEST}, profiles (name)`).eq('org_id', orgId).eq('status', 'pending').order('created_at'))
+      return rows.map(({ profiles, ...r }) => ({ ...rowFrom(r), name: profiles?.name || '' }))
+    },
+    async joinRequestsForUser (userId) { return (await one(db.from('join_requests').select(REQUEST).eq('user_id', userId))).map(rowFrom) },
+    // Check-and-set: a request is decided once.
+    async decideJoinRequest (id, { status, decidedBy }) {
+      const rows = await one(db.from('join_requests').update({ status, decided_by: decidedBy, decided_at: new Date().toISOString() }).eq('id', id).eq('status', 'pending').select('id'))
+      return rows.length > 0
+    },
+    // Issue reports: one rpc per batch (record_events opens or counts up issues itself).
+    async recordEvents (list) {
+      if (!list.length) return 0
+      const events = list.map((e) => ({ ...toSnake({ ...e, occurredAt: ts(e.occurredAt) }), fingerprint: e.fingerprint ?? null, status: e.status ?? null, duration_ms: e.durationMs ?? null, user_id: e.userId ?? null, device_id: e.deviceId ?? null }))
+      return (await one(db.rpc('record_events', { events }))) ?? list.length
+    },
+    async pruneEvents (before) {
+      await one(db.from('events').delete().lt('occurred_at', ts(before)))
+      return 0
+    },
+    async pruneIssues (before) {
+      await one(db.from('issues').delete().lt('last_seen_at', ts(before)))
+      return 0
+    }
+  }
+}