mcpscraper-memory-db 1.0.0

package/README.md

@@ -0,0 +1,40 @@
+# mcpscraper-memory-db
+
+Shared data-access layer for the mcpscraper memory product: Postgres `db/*.ts` modules, the
+`lib/*.ts` utilities they depend on (auth, secret encryption, vault contracts, cost rates, the
+already-HTTP-only credit-debit client), and the `rag/*.ts` embedding/indexing layer (Jina
+embeddings over `@mastra/pg`'s `PgVector`).
+
+This package exists because `mcp-memory` and `mcp-scraper-scheduler` both need this exact logic —
+before this package, it was hand-copied between the two repos, which is exactly the kind of drift
+this package is meant to prevent. Each consumer's own `src/mastra/db/*.ts`, `lib/*.ts`, and
+`rag/*.ts` files are one-line re-export shims pointing here; the real implementation lives only in
+this package.
+
+## Usage
+
+```ts
+import { query, ensureSchema } from 'mcpscraper-memory-db/db/pool'
+import { resolveToolAuth } from 'mcpscraper-memory-db/lib/auth'
+```
+
+Every subpath under `db/`, `lib/`, and `rag/` is exported individually — there is no single barrel
+export, to keep tree-shaking simple and match how the original files were imported.
+
+## Requires
+
+`DATABASE_URL` (Postgres, used by `db/pool.ts`), `JINA_API_KEY`/`JINA_EMBED_MODEL`/`JINA_EMBED_DIM`
+(used by `rag/embedder.ts`), `SCHEDULE_SECRET_ENC_KEY` (used by `lib/secret-crypto.ts`),
+`MCP_SCRAPER_INTERNAL_URL`/`INTERNAL_MEMORY_DEBIT_SECRET` (used by `lib/credit-debit.ts`'s HTTP
+call into mcp-scraper's real ledger) — same env vars either consuming repo already needs.
+
+## Publishing
+
+```
+npm run build
+npm publish
+```
+
+Bump the version in `package.json` first. Both consumers pin an exact or caret version and need a
+`npm install mcpscraper-memory-db@latest` + redeploy to pick up a new release — there is no
+auto-sync.

package/dist/db/chat-link.d.ts

@@ -0,0 +1,7 @@
+declare function getOrCreateChatLinkSecret(identity: string): Promise<string>;
+declare class ChatLinkSecretNotRetrievable extends Error {
+    constructor();
+}
+declare function revokeChatLink(identity: string): Promise<boolean>;
+
+export { ChatLinkSecretNotRetrievable, getOrCreateChatLinkSecret, revokeChatLink };

package/dist/db/chat-link.js

@@ -0,0 +1,50 @@
+import { ensureSchema, query } from "./pool";
+import { issueKeyRow, revokeKeyRow, getKeyById } from "./keys";
+import { fullScope } from "../lib/auth";
+async function getChatLinkKeyId(identity) {
+  await ensureSchema();
+  const res = await query(
+    `SELECT chat_link_key_id FROM mem_settings WHERE identity = $1 LIMIT 1`,
+    [identity]
+  );
+  return res.rows[0]?.chat_link_key_id ?? null;
+}
+async function setChatLinkKeyId(identity, keyId) {
+  await ensureSchema();
+  await query(
+    `INSERT INTO mem_settings (identity, chat_link_key_id, updated_at)
+     VALUES ($1, $2, now())
+     ON CONFLICT (identity) DO UPDATE SET chat_link_key_id = EXCLUDED.chat_link_key_id, updated_at = now()`,
+    [identity, keyId]
+  );
+}
+async function getOrCreateChatLinkSecret(identity) {
+  const existingId = await getChatLinkKeyId(identity);
+  if (existingId) {
+    const existing = await getKeyById(existingId);
+    if (existing && !existing.revoked) {
+      throw new ChatLinkSecretNotRetrievable();
+    }
+  }
+  const issued = await issueKeyRow({ identity, vaults: [], scope: fullScope(), plan: "free", expiresAt: null });
+  await setChatLinkKeyId(identity, issued.keyId);
+  return issued.secret;
+}
+class ChatLinkSecretNotRetrievable extends Error {
+  constructor() {
+    super("A chat link already exists for this identity; its secret cannot be re-displayed (only revoked and reissued).");
+  }
+}
+async function revokeChatLink(identity) {
+  const existingId = await getChatLinkKeyId(identity);
+  if (!existingId) return false;
+  await revokeKeyRow(existingId);
+  await setChatLinkKeyId(identity, null);
+  return true;
+}
+export {
+  ChatLinkSecretNotRetrievable,
+  getOrCreateChatLinkSecret,
+  revokeChatLink
+};
+//# sourceMappingURL=chat-link.js.map

package/dist/db/chat-link.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/chat-link.ts"],"sourcesContent":["import { ensureSchema, query } from './pool'\nimport { issueKeyRow, revokeKeyRow, getKeyById } from './keys'\nimport { fullScope } from '../lib/auth'\n\nasync function getChatLinkKeyId(identity: string): Promise<string | null> {\n  await ensureSchema()\n  const res = await query<{ chat_link_key_id: string | null }>(\n    `SELECT chat_link_key_id FROM mem_settings WHERE identity = $1 LIMIT 1`,\n    [identity],\n  )\n  return res.rows[0]?.chat_link_key_id ?? null\n}\n\nasync function setChatLinkKeyId(identity: string, keyId: string | null): Promise<void> {\n  await ensureSchema()\n  await query(\n    `INSERT INTO mem_settings (identity, chat_link_key_id, updated_at)\n     VALUES ($1, $2, now())\n     ON CONFLICT (identity) DO UPDATE SET chat_link_key_id = EXCLUDED.chat_link_key_id, updated_at = now()`,\n    [identity, keyId],\n  )\n}\n\nexport async function getOrCreateChatLinkSecret(identity: string): Promise<string> {\n  const existingId = await getChatLinkKeyId(identity)\n  if (existingId) {\n    const existing = await getKeyById(existingId)\n    if (existing && !existing.revoked) {\n      throw new ChatLinkSecretNotRetrievable()\n    }\n  }\n  const issued = await issueKeyRow({ identity, vaults: [], scope: fullScope(), plan: 'free', expiresAt: null })\n  await setChatLinkKeyId(identity, issued.keyId)\n  return issued.secret\n}\n\nexport class ChatLinkSecretNotRetrievable extends Error {\n  constructor() {\n    super('A chat link already exists for this identity; its secret cannot be re-displayed (only revoked and reissued).')\n  }\n}\n\nexport async function revokeChatLink(identity: string): Promise<boolean> {\n  const existingId = await getChatLinkKeyId(identity)\n  if (!existingId) return false\n  await revokeKeyRow(existingId)\n  await setChatLinkKeyId(identity, null)\n  return true\n}\n"],"mappings":"AAAA,SAAS,cAAc,aAAa;AACpC,SAAS,aAAa,cAAc,kBAAkB;AACtD,SAAS,iBAAiB;AAE1B,eAAe,iBAAiB,UAA0C;AACxE,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,SAAO,IAAI,KAAK,CAAC,GAAG,oBAAoB;AAC1C;AAEA,eAAe,iBAAiB,UAAkB,OAAqC;AACrF,QAAM,aAAa;AACnB,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA,IAGA,CAAC,UAAU,KAAK;AAAA,EAClB;AACF;AAEA,eAAsB,0BAA0B,UAAmC;AACjF,QAAM,aAAa,MAAM,iBAAiB,QAAQ;AAClD,MAAI,YAAY;AACd,UAAM,WAAW,MAAM,WAAW,UAAU;AAC5C,QAAI,YAAY,CAAC,SAAS,SAAS;AACjC,YAAM,IAAI,6BAA6B;AAAA,IACzC;AAAA,EACF;AACA,QAAM,SAAS,MAAM,YAAY,EAAE,UAAU,QAAQ,CAAC,GAAG,OAAO,UAAU,GAAG,MAAM,QAAQ,WAAW,KAAK,CAAC;AAC5G,QAAM,iBAAiB,UAAU,OAAO,KAAK;AAC7C,SAAO,OAAO;AAChB;AAEO,MAAM,qCAAqC,MAAM;AAAA,EACtD,cAAc;AACZ,UAAM,8GAA8G;AAAA,EACtH;AACF;AAEA,eAAsB,eAAe,UAAoC;AACvE,QAAM,aAAa,MAAM,iBAAiB,QAAQ;AAClD,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,aAAa,UAAU;AAC7B,QAAM,iBAAiB,UAAU,IAAI;AACrC,SAAO;AACT;","names":[]}

package/dist/db/facts.d.ts

@@ -0,0 +1,60 @@
+type FactStatus = 'active' | 'superseded';
+type PrecedencePolicy = 'recency' | 'source-priority' | 'intent-aware';
+interface Fact {
+    id: string;
+    vault: string;
+    subject: string;
+    value: string;
+    source: string;
+    confidence: number;
+    status: FactStatus;
+    supersededBy: string | null;
+    resolution: string | null;
+    precedence: string | null;
+    identity: string;
+    createdAt: string;
+    updatedAt: string;
+}
+declare function canonicalSubject(subject: string): string;
+declare function factId(vault: string, subject: string, createdAtIso: string): string;
+declare function sourceRank(source: string): number;
+interface PrecedenceResult {
+    winner: Fact;
+    losers: Fact[];
+    reason: string;
+    ambiguous: boolean;
+}
+declare function applyPrecedence(facts: Fact[], policy: PrecedencePolicy): PrecedenceResult;
+declare function vaultPrecedenceDefault(vault: string): Promise<PrecedencePolicy>;
+interface RecordFactArgs {
+    vault: string;
+    subject: string;
+    value: string;
+    source?: string;
+    confidence?: number;
+    identity: string;
+    reason?: string;
+    precedence?: PrecedencePolicy;
+}
+declare function recordFact(args: RecordFactArgs): Promise<{
+    fact: Fact;
+    superseded?: Fact;
+}>;
+declare function factHistory(vault: string, subject: string): Promise<{
+    current: Fact | null;
+    history: Fact[];
+}>;
+declare function activeFacts(vault: string): Promise<Fact[]>;
+declare function contradictions(vault: string): Promise<{
+    subject: string;
+    facts: Fact[];
+}[]>;
+declare function supersedeFact(args: {
+    loserId: string;
+    winnerId: string;
+    reason: string;
+    precedence: PrecedencePolicy;
+}): Promise<Fact | null>;
+declare function deleteFactsForVault(vault: string): Promise<number>;
+
+export { type Fact, type FactStatus, type PrecedencePolicy, type PrecedenceResult, type RecordFactArgs, activeFacts, applyPrecedence, canonicalSubject, contradictions, deleteFactsForVault, factHistory, factId, recordFact, sourceRank, supersedeFact, vaultPrecedenceDefault };

package/dist/db/facts.js

@@ -0,0 +1,186 @@
+import { createHash } from "node:crypto";
+import { ensureSchema, query } from "./pool";
+function mapFact(r) {
+  return {
+    id: r.id,
+    vault: r.vault,
+    subject: r.subject,
+    value: r.value,
+    source: r.source,
+    confidence: Number(r.confidence),
+    status: r.status,
+    supersededBy: r.superseded_by,
+    resolution: r.resolution,
+    precedence: r.precedence,
+    identity: r.identity,
+    createdAt: r.created_at,
+    updatedAt: r.updated_at
+  };
+}
+const FACT_COLS = "id, vault, subject, value, source, confidence, status, superseded_by, resolution, precedence, identity, created_at, updated_at";
+function canonicalSubject(subject) {
+  return subject.trim().toLowerCase().replace(/\s+/g, " ");
+}
+function factId(vault, subject, createdAtIso) {
+  return `fact_${createHash("sha256").update(`${vault}::${canonicalSubject(subject)}::${createdAtIso}`).digest("hex").slice(0, 24)}`;
+}
+function sourceRank(source) {
+  const s = (source || "").toLowerCase();
+  if (s.startsWith("user")) return 4;
+  if (s.startsWith("tool")) return 3;
+  if (s.startsWith("chat")) return 2;
+  if (s.startsWith("library")) return 1;
+  return 0;
+}
+function applyPrecedence(facts, policy) {
+  if (facts.length === 0) {
+    throw new Error("applyPrecedence requires at least one fact");
+  }
+  const byRecency = (a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt);
+  const sorted = [...facts];
+  let winner;
+  let reason;
+  let ambiguous = false;
+  if (policy === "source-priority") {
+    sorted.sort((a, b) => {
+      const r = sourceRank(b.source) - sourceRank(a.source);
+      return r !== 0 ? r : byRecency(a, b);
+    });
+    winner = sorted[0];
+    reason = `source-priority: kept "${winner.source || "unknown"}" (rank ${sourceRank(winner.source)}), most recent on tie`;
+    if (sorted.length > 1 && sourceRank(sorted[1].source) === sourceRank(winner.source) && Date.parse(sorted[1].createdAt) === Date.parse(winner.createdAt)) {
+      ambiguous = true;
+    }
+  } else {
+    sorted.sort(byRecency);
+    winner = sorted[0];
+    reason = policy === "intent-aware" ? "intent-aware: newest assertion kept (v2: recency; flagged for review when history may be referenced intentionally)" : "recency: newest assertion kept";
+    if (policy === "intent-aware" && sorted.length > 1) {
+      ambiguous = true;
+    }
+    if (sorted.length > 1 && Date.parse(sorted[1].createdAt) === Date.parse(winner.createdAt)) {
+      ambiguous = true;
+    }
+  }
+  const losers = sorted.filter((f) => f.id !== winner.id);
+  return { winner, losers, reason, ambiguous };
+}
+async function vaultPrecedenceDefault(vault) {
+  await ensureSchema();
+  const res = await query(
+    `SELECT precedence_default FROM mem_vault_registry WHERE vault = $1 AND precedence_default IS NOT NULL LIMIT 1`,
+    [vault]
+  );
+  const p = res.rows[0]?.precedence_default;
+  if (p === "recency" || p === "source-priority" || p === "intent-aware") return p;
+  return "recency";
+}
+async function recordFact(args) {
+  await ensureSchema();
+  const subject = canonicalSubject(args.subject);
+  const value = args.value;
+  const source = args.source ?? "";
+  const confidence = typeof args.confidence === "number" ? args.confidence : 0.5;
+  const precedence = args.precedence ?? "recency";
+  const existingRes = await query(
+    `SELECT ${FACT_COLS} FROM mem_facts
+     WHERE vault = $1 AND subject = $2 AND status = 'active' AND identity = $3
+     ORDER BY created_at DESC LIMIT 1`,
+    [args.vault, subject, args.identity]
+  );
+  const existing = existingRes.rows[0] ? mapFact(existingRes.rows[0]) : null;
+  if (existing && existing.value === value) {
+    const bumped = await query(
+      `UPDATE mem_facts SET updated_at = now(), confidence = $2 WHERE id = $1 RETURNING ${FACT_COLS}`,
+      [existing.id, confidence]
+    );
+    return { fact: mapFact(bumped.rows[0]) };
+  }
+  const createdAtIso = (/* @__PURE__ */ new Date()).toISOString();
+  let id = factId(args.vault, subject, createdAtIso);
+  const clash = await query(`SELECT 1 FROM mem_facts WHERE id = $1 LIMIT 1`, [id]);
+  if ((clash.rowCount ?? 0) > 0) {
+    id = `${id}_${Math.random().toString(36).slice(2, 8)}`;
+  }
+  let superseded;
+  if (existing) {
+    const sup = await query(
+      `UPDATE mem_facts
+       SET status = 'superseded', superseded_by = $2, resolution = $3, precedence = $4, updated_at = now()
+       WHERE id = $1 RETURNING ${FACT_COLS}`,
+      [existing.id, id, args.reason ?? "replaced by newer assertion", precedence]
+    );
+    superseded = mapFact(sup.rows[0]);
+  }
+  const inserted = await query(
+    `INSERT INTO mem_facts (id, vault, subject, value, source, confidence, status, identity, created_at, updated_at)
+     VALUES ($1, $2, $3, $4, $5, $6, 'active', $7, $8::timestamptz, $8::timestamptz)
+     RETURNING ${FACT_COLS}`,
+    [id, args.vault, subject, value, source, confidence, args.identity, createdAtIso]
+  );
+  return { fact: mapFact(inserted.rows[0]), superseded };
+}
+async function factHistory(vault, subject) {
+  await ensureSchema();
+  const subj = canonicalSubject(subject);
+  const res = await query(
+    `SELECT ${FACT_COLS} FROM mem_facts WHERE vault = $1 AND subject = $2 ORDER BY created_at DESC`,
+    [vault, subj]
+  );
+  const all = res.rows.map(mapFact);
+  const current = all.find((f) => f.status === "active") ?? null;
+  const history = all.filter((f) => f.status === "superseded");
+  return { current, history };
+}
+async function activeFacts(vault) {
+  await ensureSchema();
+  const res = await query(
+    `SELECT ${FACT_COLS} FROM mem_facts WHERE vault = $1 AND status = 'active' ORDER BY subject ASC, created_at DESC`,
+    [vault]
+  );
+  return res.rows.map(mapFact);
+}
+async function contradictions(vault) {
+  const active = await activeFacts(vault);
+  const bySubject = /* @__PURE__ */ new Map();
+  for (const f of active) {
+    const arr = bySubject.get(f.subject) ?? [];
+    arr.push(f);
+    bySubject.set(f.subject, arr);
+  }
+  const out = [];
+  for (const [subject, facts] of bySubject) {
+    if (facts.length > 1) out.push({ subject, facts });
+  }
+  return out;
+}
+async function supersedeFact(args) {
+  await ensureSchema();
+  const res = await query(
+    `UPDATE mem_facts
+     SET status = 'superseded', superseded_by = $2, resolution = $3, precedence = $4, updated_at = now()
+     WHERE id = $1 AND status = 'active'
+     RETURNING ${FACT_COLS}`,
+    [args.loserId, args.winnerId, args.reason, args.precedence]
+  );
+  return res.rows[0] ? mapFact(res.rows[0]) : null;
+}
+async function deleteFactsForVault(vault) {
+  await ensureSchema();
+  const res = await query(`DELETE FROM mem_facts WHERE vault = $1`, [vault]);
+  return res.rowCount ?? 0;
+}
+export {
+  activeFacts,
+  applyPrecedence,
+  canonicalSubject,
+  contradictions,
+  deleteFactsForVault,
+  factHistory,
+  factId,
+  recordFact,
+  sourceRank,
+  supersedeFact,
+  vaultPrecedenceDefault
+};
+//# sourceMappingURL=facts.js.map

package/dist/db/facts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/facts.ts"],"sourcesContent":["import { createHash } from 'node:crypto'\nimport { ensureSchema, query } from './pool'\n\nexport type FactStatus = 'active' | 'superseded'\nexport type PrecedencePolicy = 'recency' | 'source-priority' | 'intent-aware'\n\nexport interface Fact {\n  id: string\n  vault: string\n  subject: string\n  value: string\n  source: string\n  confidence: number\n  status: FactStatus\n  supersededBy: string | null\n  resolution: string | null\n  precedence: string | null\n  identity: string\n  createdAt: string\n  updatedAt: string\n}\n\ninterface RawFactRow {\n  id: string\n  vault: string\n  subject: string\n  value: string\n  source: string\n  confidence: number\n  status: string\n  superseded_by: string | null\n  resolution: string | null\n  precedence: string | null\n  identity: string\n  created_at: string\n  updated_at: string\n}\n\nfunction mapFact(r: RawFactRow): Fact {\n  return {\n    id: r.id,\n    vault: r.vault,\n    subject: r.subject,\n    value: r.value,\n    source: r.source,\n    confidence: Number(r.confidence),\n    status: r.status as FactStatus,\n    supersededBy: r.superseded_by,\n    resolution: r.resolution,\n    precedence: r.precedence,\n    identity: r.identity,\n    createdAt: r.created_at,\n    updatedAt: r.updated_at,\n  }\n}\n\nconst FACT_COLS =\n  'id, vault, subject, value, source, confidence, status, superseded_by, resolution, precedence, identity, created_at, updated_at'\n\nexport function canonicalSubject(subject: string): string {\n  return subject.trim().toLowerCase().replace(/\\s+/g, ' ')\n}\n\nexport function factId(vault: string, subject: string, createdAtIso: string): string {\n  return `fact_${createHash('sha256').update(`${vault}::${canonicalSubject(subject)}::${createdAtIso}`).digest('hex').slice(0, 24)}`\n}\n\nexport function sourceRank(source: string): number {\n  const s = (source || '').toLowerCase()\n  if (s.startsWith('user')) return 4\n  if (s.startsWith('tool')) return 3\n  if (s.startsWith('chat')) return 2\n  if (s.startsWith('library')) return 1\n  return 0\n}\n\nexport interface PrecedenceResult {\n  winner: Fact\n  losers: Fact[]\n  reason: string\n  ambiguous: boolean\n}\n\nexport function applyPrecedence(facts: Fact[], policy: PrecedencePolicy): PrecedenceResult {\n  if (facts.length === 0) {\n    throw new Error('applyPrecedence requires at least one fact')\n  }\n  const byRecency = (a: Fact, b: Fact): number => Date.parse(b.createdAt) - Date.parse(a.createdAt)\n  const sorted = [...facts]\n  let winner: Fact\n  let reason: string\n  let ambiguous = false\n\n  if (policy === 'source-priority') {\n    sorted.sort((a, b) => {\n      const r = sourceRank(b.source) - sourceRank(a.source)\n      return r !== 0 ? r : byRecency(a, b)\n    })\n    winner = sorted[0]\n    reason = `source-priority: kept \"${winner.source || 'unknown'}\" (rank ${sourceRank(winner.source)}), most recent on tie`\n    if (\n      sorted.length > 1 &&\n      sourceRank(sorted[1].source) === sourceRank(winner.source) &&\n      Date.parse(sorted[1].createdAt) === Date.parse(winner.createdAt)\n    ) {\n      ambiguous = true\n    }\n  } else {\n    sorted.sort(byRecency)\n    winner = sorted[0]\n    reason =\n      policy === 'intent-aware'\n        ? 'intent-aware: newest assertion kept (v2: recency; flagged for review when history may be referenced intentionally)'\n        : 'recency: newest assertion kept'\n    if (policy === 'intent-aware' && sorted.length > 1) {\n      ambiguous = true\n    }\n    if (sorted.length > 1 && Date.parse(sorted[1].createdAt) === Date.parse(winner.createdAt)) {\n      ambiguous = true\n    }\n  }\n\n  const losers = sorted.filter(f => f.id !== winner.id)\n  return { winner, losers, reason, ambiguous }\n}\n\nexport async function vaultPrecedenceDefault(vault: string): Promise<PrecedencePolicy> {\n  await ensureSchema()\n  const res = await query<{ precedence_default: string | null }>(\n    `SELECT precedence_default FROM mem_vault_registry WHERE vault = $1 AND precedence_default IS NOT NULL LIMIT 1`,\n    [vault],\n  )\n  const p = res.rows[0]?.precedence_default\n  if (p === 'recency' || p === 'source-priority' || p === 'intent-aware') return p\n  return 'recency'\n}\n\nexport interface RecordFactArgs {\n  vault: string\n  subject: string\n  value: string\n  source?: string\n  confidence?: number\n  identity: string\n  reason?: string\n  precedence?: PrecedencePolicy\n}\n\nexport async function recordFact(args: RecordFactArgs): Promise<{ fact: Fact; superseded?: Fact }> {\n  await ensureSchema()\n  const subject = canonicalSubject(args.subject)\n  const value = args.value\n  const source = args.source ?? ''\n  const confidence = typeof args.confidence === 'number' ? args.confidence : 0.5\n  const precedence = args.precedence ?? 'recency'\n\n  const existingRes = await query<RawFactRow>(\n    `SELECT ${FACT_COLS} FROM mem_facts\n     WHERE vault = $1 AND subject = $2 AND status = 'active' AND identity = $3\n     ORDER BY created_at DESC LIMIT 1`,\n    [args.vault, subject, args.identity],\n  )\n  const existing = existingRes.rows[0] ? mapFact(existingRes.rows[0]) : null\n\n  if (existing && existing.value === value) {\n    const bumped = await query<RawFactRow>(\n      `UPDATE mem_facts SET updated_at = now(), confidence = $2 WHERE id = $1 RETURNING ${FACT_COLS}`,\n      [existing.id, confidence],\n    )\n    return { fact: mapFact(bumped.rows[0]) }\n  }\n\n  const createdAtIso = new Date().toISOString()\n  let id = factId(args.vault, subject, createdAtIso)\n  const clash = await query(`SELECT 1 FROM mem_facts WHERE id = $1 LIMIT 1`, [id])\n  if ((clash.rowCount ?? 0) > 0) {\n    id = `${id}_${Math.random().toString(36).slice(2, 8)}`\n  }\n\n  let superseded: Fact | undefined\n  if (existing) {\n    const sup = await query<RawFactRow>(\n      `UPDATE mem_facts\n       SET status = 'superseded', superseded_by = $2, resolution = $3, precedence = $4, updated_at = now()\n       WHERE id = $1 RETURNING ${FACT_COLS}`,\n      [existing.id, id, args.reason ?? 'replaced by newer assertion', precedence],\n    )\n    superseded = mapFact(sup.rows[0])\n  }\n\n  const inserted = await query<RawFactRow>(\n    `INSERT INTO mem_facts (id, vault, subject, value, source, confidence, status, identity, created_at, updated_at)\n     VALUES ($1, $2, $3, $4, $5, $6, 'active', $7, $8::timestamptz, $8::timestamptz)\n     RETURNING ${FACT_COLS}`,\n    [id, args.vault, subject, value, source, confidence, args.identity, createdAtIso],\n  )\n\n  return { fact: mapFact(inserted.rows[0]), superseded }\n}\n\nexport async function factHistory(\n  vault: string,\n  subject: string,\n): Promise<{ current: Fact | null; history: Fact[] }> {\n  await ensureSchema()\n  const subj = canonicalSubject(subject)\n  const res = await query<RawFactRow>(\n    `SELECT ${FACT_COLS} FROM mem_facts WHERE vault = $1 AND subject = $2 ORDER BY created_at DESC`,\n    [vault, subj],\n  )\n  const all = res.rows.map(mapFact)\n  const current = all.find(f => f.status === 'active') ?? null\n  const history = all.filter(f => f.status === 'superseded')\n  return { current, history }\n}\n\nexport async function activeFacts(vault: string): Promise<Fact[]> {\n  await ensureSchema()\n  const res = await query<RawFactRow>(\n    `SELECT ${FACT_COLS} FROM mem_facts WHERE vault = $1 AND status = 'active' ORDER BY subject ASC, created_at DESC`,\n    [vault],\n  )\n  return res.rows.map(mapFact)\n}\n\nexport async function contradictions(vault: string): Promise<{ subject: string; facts: Fact[] }[]> {\n  const active = await activeFacts(vault)\n  const bySubject = new Map<string, Fact[]>()\n  for (const f of active) {\n    const arr = bySubject.get(f.subject) ?? []\n    arr.push(f)\n    bySubject.set(f.subject, arr)\n  }\n  const out: { subject: string; facts: Fact[] }[] = []\n  for (const [subject, facts] of bySubject) {\n    if (facts.length > 1) out.push({ subject, facts })\n  }\n  return out\n}\n\nexport async function supersedeFact(args: {\n  loserId: string\n  winnerId: string\n  reason: string\n  precedence: PrecedencePolicy\n}): Promise<Fact | null> {\n  await ensureSchema()\n  const res = await query<RawFactRow>(\n    `UPDATE mem_facts\n     SET status = 'superseded', superseded_by = $2, resolution = $3, precedence = $4, updated_at = now()\n     WHERE id = $1 AND status = 'active'\n     RETURNING ${FACT_COLS}`,\n    [args.loserId, args.winnerId, args.reason, args.precedence],\n  )\n  return res.rows[0] ? mapFact(res.rows[0]) : null\n}\n\nexport async function deleteFactsForVault(vault: string): Promise<number> {\n  await ensureSchema()\n  const res = await query(`DELETE FROM mem_facts WHERE vault = $1`, [vault])\n  return res.rowCount ?? 0\n}\n"],"mappings":"AAAA,SAAS,kBAAkB;AAC3B,SAAS,cAAc,aAAa;AAqCpC,SAAS,QAAQ,GAAqB;AACpC,SAAO;AAAA,IACL,IAAI,EAAE;AAAA,IACN,OAAO,EAAE;AAAA,IACT,SAAS,EAAE;AAAA,IACX,OAAO,EAAE;AAAA,IACT,QAAQ,EAAE;AAAA,IACV,YAAY,OAAO,EAAE,UAAU;AAAA,IAC/B,QAAQ,EAAE;AAAA,IACV,cAAc,EAAE;AAAA,IAChB,YAAY,EAAE;AAAA,IACd,YAAY,EAAE;AAAA,IACd,UAAU,EAAE;AAAA,IACZ,WAAW,EAAE;AAAA,IACb,WAAW,EAAE;AAAA,EACf;AACF;AAEA,MAAM,YACJ;AAEK,SAAS,iBAAiB,SAAyB;AACxD,SAAO,QAAQ,KAAK,EAAE,YAAY,EAAE,QAAQ,QAAQ,GAAG;AACzD;AAEO,SAAS,OAAO,OAAe,SAAiB,cAA8B;AACnF,SAAO,QAAQ,WAAW,QAAQ,EAAE,OAAO,GAAG,KAAK,KAAK,iBAAiB,OAAO,CAAC,KAAK,YAAY,EAAE,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;AAClI;AAEO,SAAS,WAAW,QAAwB;AACjD,QAAM,KAAK,UAAU,IAAI,YAAY;AACrC,MAAI,EAAE,WAAW,MAAM,EAAG,QAAO;AACjC,MAAI,EAAE,WAAW,MAAM,EAAG,QAAO;AACjC,MAAI,EAAE,WAAW,MAAM,EAAG,QAAO;AACjC,MAAI,EAAE,WAAW,SAAS,EAAG,QAAO;AACpC,SAAO;AACT;AASO,SAAS,gBAAgB,OAAe,QAA4C;AACzF,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,QAAM,YAAY,CAAC,GAAS,MAAoB,KAAK,MAAM,EAAE,SAAS,IAAI,KAAK,MAAM,EAAE,SAAS;AAChG,QAAM,SAAS,CAAC,GAAG,KAAK;AACxB,MAAI;AACJ,MAAI;AACJ,MAAI,YAAY;AAEhB,MAAI,WAAW,mBAAmB;AAChC,WAAO,KAAK,CAAC,GAAG,MAAM;AACpB,YAAM,IAAI,WAAW,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM;AACpD,aAAO,MAAM,IAAI,IAAI,UAAU,GAAG,CAAC;AAAA,IACrC,CAAC;AACD,aAAS,OAAO,CAAC;AACjB,aAAS,0BAA0B,OAAO,UAAU,SAAS,WAAW,WAAW,OAAO,MAAM,CAAC;AACjG,QACE,OAAO,SAAS,KAChB,WAAW,OAAO,CAAC,EAAE,MAAM,MAAM,WAAW,OAAO,MAAM,KACzD,KAAK,MAAM,OAAO,CAAC,EAAE,SAAS,MAAM,KAAK,MAAM,OAAO,SAAS,GAC/D;AACA,kBAAY;AAAA,IACd;AAAA,EACF,OAAO;AACL,WAAO,KAAK,SAAS;AACrB,aAAS,OAAO,CAAC;AACjB,aACE,WAAW,iBACP,uHACA;AACN,QAAI,WAAW,kBAAkB,OAAO,SAAS,GAAG;AAClD,kBAAY;AAAA,IACd;AACA,QAAI,OAAO,SAAS,KAAK,KAAK,MAAM,OAAO,CAAC,EAAE,SAAS,MAAM,KAAK,MAAM,OAAO,SAAS,GAAG;AACzF,kBAAY;AAAA,IACd;AAAA,EACF;AAEA,QAAM,SAAS,OAAO,OAAO,OAAK,EAAE,OAAO,OAAO,EAAE;AACpD,SAAO,EAAE,QAAQ,QAAQ,QAAQ,UAAU;AAC7C;AAEA,eAAsB,uBAAuB,OAA0C;AACrF,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,CAAC,KAAK;AAAA,EACR;AACA,QAAM,IAAI,IAAI,KAAK,CAAC,GAAG;AACvB,MAAI,MAAM,aAAa,MAAM,qBAAqB,MAAM,eAAgB,QAAO;AAC/E,SAAO;AACT;AAaA,eAAsB,WAAW,MAAkE;AACjG,QAAM,aAAa;AACnB,QAAM,UAAU,iBAAiB,KAAK,OAAO;AAC7C,QAAM,QAAQ,KAAK;AACnB,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,QAAM,aAAa,KAAK,cAAc;AAEtC,QAAM,cAAc,MAAM;AAAA,IACxB,UAAU,SAAS;AAAA;AAAA;AAAA,IAGnB,CAAC,KAAK,OAAO,SAAS,KAAK,QAAQ;AAAA,EACrC;AACA,QAAM,WAAW,YAAY,KAAK,CAAC,IAAI,QAAQ,YAAY,KAAK,CAAC,CAAC,IAAI;AAEtE,MAAI,YAAY,SAAS,UAAU,OAAO;AACxC,UAAM,SAAS,MAAM;AAAA,MACnB,oFAAoF,SAAS;AAAA,MAC7F,CAAC,SAAS,IAAI,UAAU;AAAA,IAC1B;AACA,WAAO,EAAE,MAAM,QAAQ,OAAO,KAAK,CAAC,CAAC,EAAE;AAAA,EACzC;AAEA,QAAM,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAC5C,MAAI,KAAK,OAAO,KAAK,OAAO,SAAS,YAAY;AACjD,QAAM,QAAQ,MAAM,MAAM,iDAAiD,CAAC,EAAE,CAAC;AAC/E,OAAK,MAAM,YAAY,KAAK,GAAG;AAC7B,SAAK,GAAG,EAAE,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,EACtD;AAEA,MAAI;AACJ,MAAI,UAAU;AACZ,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA;AAAA,iCAE2B,SAAS;AAAA,MACpC,CAAC,SAAS,IAAI,IAAI,KAAK,UAAU,+BAA+B,UAAU;AAAA,IAC5E;AACA,iBAAa,QAAQ,IAAI,KAAK,CAAC,CAAC;AAAA,EAClC;AAEA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA;AAAA,iBAEa,SAAS;AAAA,IACtB,CAAC,IAAI,KAAK,OAAO,SAAS,OAAO,QAAQ,YAAY,KAAK,UAAU,YAAY;AAAA,EAClF;AAEA,SAAO,EAAE,MAAM,QAAQ,SAAS,KAAK,CAAC,CAAC,GAAG,WAAW;AACvD;AAEA,eAAsB,YACpB,OACA,SACoD;AACpD,QAAM,aAAa;AACnB,QAAM,OAAO,iBAAiB,OAAO;AACrC,QAAM,MAAM,MAAM;AAAA,IAChB,UAAU,SAAS;AAAA,IACnB,CAAC,OAAO,IAAI;AAAA,EACd;AACA,QAAM,MAAM,IAAI,KAAK,IAAI,OAAO;AAChC,QAAM,UAAU,IAAI,KAAK,OAAK,EAAE,WAAW,QAAQ,KAAK;AACxD,QAAM,UAAU,IAAI,OAAO,OAAK,EAAE,WAAW,YAAY;AACzD,SAAO,EAAE,SAAS,QAAQ;AAC5B;AAEA,eAAsB,YAAY,OAAgC;AAChE,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB,UAAU,SAAS;AAAA,IACnB,CAAC,KAAK;AAAA,EACR;AACA,SAAO,IAAI,KAAK,IAAI,OAAO;AAC7B;AAEA,eAAsB,eAAe,OAA8D;AACjG,QAAM,SAAS,MAAM,YAAY,KAAK;AACtC,QAAM,YAAY,oBAAI,IAAoB;AAC1C,aAAW,KAAK,QAAQ;AACtB,UAAM,MAAM,UAAU,IAAI,EAAE,OAAO,KAAK,CAAC;AACzC,QAAI,KAAK,CAAC;AACV,cAAU,IAAI,EAAE,SAAS,GAAG;AAAA,EAC9B;AACA,QAAM,MAA4C,CAAC;AACnD,aAAW,CAAC,SAAS,KAAK,KAAK,WAAW;AACxC,QAAI,MAAM,SAAS,EAAG,KAAI,KAAK,EAAE,SAAS,MAAM,CAAC;AAAA,EACnD;AACA,SAAO;AACT;AAEA,eAAsB,cAAc,MAKX;AACvB,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA;AAAA;AAAA,iBAGa,SAAS;AAAA,IACtB,CAAC,KAAK,SAAS,KAAK,UAAU,KAAK,QAAQ,KAAK,UAAU;AAAA,EAC5D;AACA,SAAO,IAAI,KAAK,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,CAAC,IAAI;AAC9C;AAEA,eAAsB,oBAAoB,OAAgC;AACxE,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM,MAAM,0CAA0C,CAAC,KAAK,CAAC;AACzE,SAAO,IAAI,YAAY;AACzB;","names":[]}

package/dist/db/interlink-state.d.ts

@@ -0,0 +1,34 @@
+type InterlinkPhase = 'orphans' | 'springboard' | 'walkthrough';
+interface InterlinkCounts {
+    orphansFound: number;
+    orphansLinked: number;
+    springboardLinks: number;
+    contractLinks: number;
+    hubsCreated: number;
+    removals: number;
+    budgetRemaining: number;
+}
+interface InterlinkCursor {
+    phase: InterlinkPhase;
+    vaultIndex: number;
+    noteOffset: number;
+    edgeIndex?: number;
+    runDate: string;
+    counts?: InterlinkCounts;
+}
+interface InterlinkStateRecord {
+    identity: string;
+    cursor: InterlinkCursor | null;
+    lastRunAt: string | null;
+    lastSummary: string | null;
+}
+declare function getInterlinkState(identity: string): Promise<InterlinkStateRecord | null>;
+declare function upsertInterlinkState(args: {
+    identity: string;
+    cursor?: InterlinkCursor | null;
+    lastRunAt?: string;
+    lastSummary?: string;
+}): Promise<void>;
+declare function clearInterlinkCursor(identity: string): Promise<void>;
+
+export { type InterlinkCounts, type InterlinkCursor, type InterlinkPhase, type InterlinkStateRecord, clearInterlinkCursor, getInterlinkState, upsertInterlinkState };

package/dist/db/interlink-state.js

@@ -0,0 +1,42 @@
+import { ensureSchema, query } from "./pool";
+function mapRow(r) {
+  return {
+    identity: r.identity,
+    cursor: r.cursor && typeof r.cursor === "object" ? r.cursor : null,
+    lastRunAt: r.last_run_at,
+    lastSummary: r.last_summary
+  };
+}
+async function getInterlinkState(identity) {
+  await ensureSchema();
+  const res = await query(
+    `SELECT identity, cursor, last_run_at, last_summary FROM mem_interlink_state WHERE identity = $1 LIMIT 1`,
+    [identity]
+  );
+  return res.rows[0] ? mapRow(res.rows[0]) : null;
+}
+async function upsertInterlinkState(args) {
+  await ensureSchema();
+  const touchesCursor = "cursor" in args;
+  const cursorJson = touchesCursor && args.cursor ? JSON.stringify(args.cursor) : null;
+  await query(
+    `INSERT INTO mem_interlink_state (identity, cursor, last_run_at, last_summary, updated_at)
+     VALUES ($1, $2, $3, $4, now())
+     ON CONFLICT (identity) DO UPDATE SET
+       cursor = CASE WHEN $5 THEN $2::jsonb ELSE mem_interlink_state.cursor END,
+       last_run_at = COALESCE($3, mem_interlink_state.last_run_at),
+       last_summary = COALESCE($4, mem_interlink_state.last_summary),
+       updated_at = now()`,
+    [args.identity, cursorJson, args.lastRunAt ?? null, args.lastSummary ?? null, touchesCursor]
+  );
+}
+async function clearInterlinkCursor(identity) {
+  await ensureSchema();
+  await query(`UPDATE mem_interlink_state SET cursor = NULL, updated_at = now() WHERE identity = $1`, [identity]);
+}
+export {
+  clearInterlinkCursor,
+  getInterlinkState,
+  upsertInterlinkState
+};
+//# sourceMappingURL=interlink-state.js.map

package/dist/db/interlink-state.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/interlink-state.ts"],"sourcesContent":["import { ensureSchema, query } from './pool'\n\nexport type InterlinkPhase = 'orphans' | 'springboard' | 'walkthrough'\n\nexport interface InterlinkCounts {\n  orphansFound: number\n  orphansLinked: number\n  springboardLinks: number\n  contractLinks: number\n  hubsCreated: number\n  removals: number\n  budgetRemaining: number\n}\n\nexport interface InterlinkCursor {\n  phase: InterlinkPhase\n  vaultIndex: number\n  noteOffset: number\n  edgeIndex?: number\n  runDate: string\n  counts?: InterlinkCounts\n}\n\nexport interface InterlinkStateRecord {\n  identity: string\n  cursor: InterlinkCursor | null\n  lastRunAt: string | null\n  lastSummary: string | null\n}\n\ninterface RawRow {\n  identity: string\n  cursor: unknown\n  last_run_at: string | null\n  last_summary: string | null\n}\n\nfunction mapRow(r: RawRow): InterlinkStateRecord {\n  return {\n    identity: r.identity,\n    cursor: (r.cursor && typeof r.cursor === 'object' ? (r.cursor as InterlinkCursor) : null),\n    lastRunAt: r.last_run_at,\n    lastSummary: r.last_summary,\n  }\n}\n\nexport async function getInterlinkState(identity: string): Promise<InterlinkStateRecord | null> {\n  await ensureSchema()\n  const res = await query<RawRow>(\n    `SELECT identity, cursor, last_run_at, last_summary FROM mem_interlink_state WHERE identity = $1 LIMIT 1`,\n    [identity],\n  )\n  return res.rows[0] ? mapRow(res.rows[0]) : null\n}\n\nexport async function upsertInterlinkState(args: {\n  identity: string\n  cursor?: InterlinkCursor | null\n  lastRunAt?: string\n  lastSummary?: string\n}): Promise<void> {\n  await ensureSchema()\n  const touchesCursor = 'cursor' in args\n  const cursorJson = touchesCursor && args.cursor ? JSON.stringify(args.cursor) : null\n  await query(\n    `INSERT INTO mem_interlink_state (identity, cursor, last_run_at, last_summary, updated_at)\n     VALUES ($1, $2, $3, $4, now())\n     ON CONFLICT (identity) DO UPDATE SET\n       cursor = CASE WHEN $5 THEN $2::jsonb ELSE mem_interlink_state.cursor END,\n       last_run_at = COALESCE($3, mem_interlink_state.last_run_at),\n       last_summary = COALESCE($4, mem_interlink_state.last_summary),\n       updated_at = now()`,\n    [args.identity, cursorJson, args.lastRunAt ?? null, args.lastSummary ?? null, touchesCursor],\n  )\n}\n\nexport async function clearInterlinkCursor(identity: string): Promise<void> {\n  await ensureSchema()\n  await query(`UPDATE mem_interlink_state SET cursor = NULL, updated_at = now() WHERE identity = $1`, [identity])\n}\n"],"mappings":"AAAA,SAAS,cAAc,aAAa;AAqCpC,SAAS,OAAO,GAAiC;AAC/C,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,IACZ,QAAS,EAAE,UAAU,OAAO,EAAE,WAAW,WAAY,EAAE,SAA6B;AAAA,IACpF,WAAW,EAAE;AAAA,IACb,aAAa,EAAE;AAAA,EACjB;AACF;AAEA,eAAsB,kBAAkB,UAAwD;AAC9F,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,SAAO,IAAI,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI;AAC7C;AAEA,eAAsB,qBAAqB,MAKzB;AAChB,QAAM,aAAa;AACnB,QAAM,gBAAgB,YAAY;AAClC,QAAM,aAAa,iBAAiB,KAAK,SAAS,KAAK,UAAU,KAAK,MAAM,IAAI;AAChF,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,CAAC,KAAK,UAAU,YAAY,KAAK,aAAa,MAAM,KAAK,eAAe,MAAM,aAAa;AAAA,EAC7F;AACF;AAEA,eAAsB,qBAAqB,UAAiC;AAC1E,QAAM,aAAa;AACnB,QAAM,MAAM,wFAAwF,CAAC,QAAQ,CAAC;AAChH;","names":[]}

package/dist/db/keys.d.ts

@@ -0,0 +1,44 @@
+import { Scope } from '../lib/auth.js';
+
+declare const PLAN_QUOTA_BYTES: Record<string, number>;
+declare function planQuotaBytes(plan: string): number;
+declare function isUnlimitedPlan(plan: string): boolean;
+interface IssueKeyArgs {
+    identity: string;
+    vaults: string[];
+    scope: Scope;
+    plan: string;
+    expiresAt: string | null;
+}
+interface IssuedKey {
+    keyId: string;
+    secret: string;
+    identity: string;
+    vaults: string[];
+    scope: Scope;
+    plan: string;
+    expiresAt: string | null;
+}
+declare function issueKeyRow(args: IssueKeyArgs): Promise<IssuedKey>;
+interface KeySummary {
+    keyId: string;
+    identity: string;
+    vaults: string[];
+    scope: Scope;
+    plan: string;
+    expiresAt: string | null;
+    revoked: boolean;
+    usageCount: number;
+    lastUsedAt: string | null;
+}
+declare function listKeyRows(filter: {
+    identity?: string;
+    vault?: string;
+    plan?: string;
+}): Promise<KeySummary[]>;
+declare function revokeKeyRow(keyId: string): Promise<boolean>;
+declare function setScopeRow(keyId: string, scope: Scope | undefined, plan: string | undefined): Promise<boolean>;
+declare function planForIdentity(identity: string): Promise<string>;
+declare function getKeyById(keyId: string): Promise<KeySummary | null>;
+
+export { type IssueKeyArgs, type IssuedKey, type KeySummary, PLAN_QUOTA_BYTES, getKeyById, isUnlimitedPlan, issueKeyRow, listKeyRows, planForIdentity, planQuotaBytes, revokeKeyRow, setScopeRow };

package/dist/db/keys.js

@@ -0,0 +1,118 @@
+import { randomBytes } from "node:crypto";
+import { ensureSchema, query } from "./pool";
+import { generateSecret, hashSecret, normalizeScope } from "../lib/auth";
+const PLAN_QUOTA_BYTES = {
+  free: 1e7,
+  pro: 5e9,
+  team: 5e10,
+  enterprise: 5e11,
+  unlimited: Number.MAX_SAFE_INTEGER
+};
+function planQuotaBytes(plan) {
+  return PLAN_QUOTA_BYTES[plan] ?? PLAN_QUOTA_BYTES.free;
+}
+function isUnlimitedPlan(plan) {
+  return plan === "unlimited";
+}
+async function issueKeyRow(args) {
+  await ensureSchema();
+  const keyId = `key_${randomBytes(8).toString("hex")}`;
+  const secret = generateSecret();
+  await query(
+    `INSERT INTO mem_keys (key_id, secret_hash, identity, vaults, scope, plan, expires_at)
+     VALUES ($1, $2, $3, $4::jsonb, $5::jsonb, $6, $7)`,
+    [keyId, hashSecret(secret), args.identity, JSON.stringify(args.vaults), JSON.stringify(args.scope), args.plan, args.expiresAt]
+  );
+  return { keyId, secret, identity: args.identity, vaults: args.vaults, scope: args.scope, plan: args.plan, expiresAt: args.expiresAt };
+}
+function toArr(v) {
+  return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+}
+function mapKey(row) {
+  return {
+    keyId: row.key_id,
+    identity: row.identity,
+    vaults: toArr(row.vaults),
+    scope: normalizeScope(row.scope),
+    plan: row.plan,
+    expiresAt: row.expires_at,
+    revoked: row.revoked,
+    usageCount: row.usage_count,
+    lastUsedAt: row.last_used_at
+  };
+}
+async function listKeyRows(filter) {
+  await ensureSchema();
+  const clauses = [];
+  const params = [];
+  if (filter.identity) {
+    params.push(filter.identity);
+    clauses.push(`identity = $${params.length}`);
+  }
+  if (filter.plan) {
+    params.push(filter.plan);
+    clauses.push(`plan = $${params.length}`);
+  }
+  if (filter.vault) {
+    params.push(JSON.stringify([filter.vault]));
+    clauses.push(`vaults @> $${params.length}::jsonb`);
+  }
+  const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
+  const res = await query(
+    `SELECT key_id, identity, vaults, scope, plan, expires_at, revoked, usage_count, last_used_at
+     FROM mem_keys ${where} ORDER BY created_at DESC`,
+    params
+  );
+  return res.rows.map(mapKey);
+}
+async function revokeKeyRow(keyId) {
+  await ensureSchema();
+  const res = await query("UPDATE mem_keys SET revoked = TRUE WHERE key_id = $1", [keyId]);
+  return (res.rowCount ?? 0) > 0;
+}
+async function setScopeRow(keyId, scope, plan) {
+  await ensureSchema();
+  const sets = [];
+  const params = [];
+  if (scope) {
+    params.push(JSON.stringify(scope));
+    sets.push(`scope = $${params.length}::jsonb`);
+  }
+  if (plan) {
+    params.push(plan);
+    sets.push(`plan = $${params.length}`);
+  }
+  if (!sets.length) return false;
+  params.push(keyId);
+  const res = await query(`UPDATE mem_keys SET ${sets.join(", ")} WHERE key_id = $${params.length}`, params);
+  return (res.rowCount ?? 0) > 0;
+}
+async function planForIdentity(identity) {
+  await ensureSchema();
+  const res = await query(
+    `SELECT plan FROM mem_keys WHERE identity = $1 ORDER BY created_at DESC LIMIT 1`,
+    [identity]
+  );
+  return res.rows[0]?.plan ?? "free";
+}
+async function getKeyById(keyId) {
+  await ensureSchema();
+  const res = await query(
+    `SELECT key_id, identity, vaults, scope, plan, expires_at, revoked, usage_count, last_used_at
+     FROM mem_keys WHERE key_id = $1 LIMIT 1`,
+    [keyId]
+  );
+  return res.rows[0] ? mapKey(res.rows[0]) : null;
+}
+export {
+  PLAN_QUOTA_BYTES,
+  getKeyById,
+  isUnlimitedPlan,
+  issueKeyRow,
+  listKeyRows,
+  planForIdentity,
+  planQuotaBytes,
+  revokeKeyRow,
+  setScopeRow
+};
+//# sourceMappingURL=keys.js.map

package/dist/db/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/keys.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto'\nimport { ensureSchema, query } from './pool'\nimport { generateSecret, hashSecret, normalizeScope } from '../lib/auth'\nimport type { Scope } from '../lib/auth'\n\nexport const PLAN_QUOTA_BYTES: Record<string, number> = {\n  free: 10_000_000,\n  pro: 5_000_000_000,\n  team: 50_000_000_000,\n  enterprise: 500_000_000_000,\n  unlimited: Number.MAX_SAFE_INTEGER,\n}\n\nexport function planQuotaBytes(plan: string): number {\n  return PLAN_QUOTA_BYTES[plan] ?? PLAN_QUOTA_BYTES.free\n}\n\nexport function isUnlimitedPlan(plan: string): boolean {\n  return plan === 'unlimited'\n}\n\nexport interface IssueKeyArgs {\n  identity: string\n  vaults: string[]\n  scope: Scope\n  plan: string\n  expiresAt: string | null\n}\n\nexport interface IssuedKey {\n  keyId: string\n  secret: string\n  identity: string\n  vaults: string[]\n  scope: Scope\n  plan: string\n  expiresAt: string | null\n}\n\nexport async function issueKeyRow(args: IssueKeyArgs): Promise<IssuedKey> {\n  await ensureSchema()\n  const keyId = `key_${randomBytes(8).toString('hex')}`\n  const secret = generateSecret()\n  await query(\n    `INSERT INTO mem_keys (key_id, secret_hash, identity, vaults, scope, plan, expires_at)\n     VALUES ($1, $2, $3, $4::jsonb, $5::jsonb, $6, $7)`,\n    [keyId, hashSecret(secret), args.identity, JSON.stringify(args.vaults), JSON.stringify(args.scope), args.plan, args.expiresAt],\n  )\n  return { keyId, secret, identity: args.identity, vaults: args.vaults, scope: args.scope, plan: args.plan, expiresAt: args.expiresAt }\n}\n\nexport interface KeySummary {\n  keyId: string\n  identity: string\n  vaults: string[]\n  scope: Scope\n  plan: string\n  expiresAt: string | null\n  revoked: boolean\n  usageCount: number\n  lastUsedAt: string | null\n}\n\ninterface KeyRow {\n  key_id: string\n  identity: string\n  vaults: unknown\n  scope: unknown\n  plan: string\n  expires_at: string | null\n  revoked: boolean\n  usage_count: number\n  last_used_at: string | null\n}\n\nfunction toArr(v: unknown): string[] {\n  return Array.isArray(v) ? v.filter((x): x is string => typeof x === 'string') : []\n}\n\nfunction mapKey(row: KeyRow): KeySummary {\n  return {\n    keyId: row.key_id,\n    identity: row.identity,\n    vaults: toArr(row.vaults),\n    scope: normalizeScope(row.scope as Record<string, boolean>),\n    plan: row.plan,\n    expiresAt: row.expires_at,\n    revoked: row.revoked,\n    usageCount: row.usage_count,\n    lastUsedAt: row.last_used_at,\n  }\n}\n\nexport async function listKeyRows(filter: { identity?: string; vault?: string; plan?: string }): Promise<KeySummary[]> {\n  await ensureSchema()\n  const clauses: string[] = []\n  const params: unknown[] = []\n  if (filter.identity) {\n    params.push(filter.identity)\n    clauses.push(`identity = $${params.length}`)\n  }\n  if (filter.plan) {\n    params.push(filter.plan)\n    clauses.push(`plan = $${params.length}`)\n  }\n  if (filter.vault) {\n    params.push(JSON.stringify([filter.vault]))\n    clauses.push(`vaults @> $${params.length}::jsonb`)\n  }\n  const where = clauses.length ? `WHERE ${clauses.join(' AND ')}` : ''\n  const res = await query<KeyRow>(\n    `SELECT key_id, identity, vaults, scope, plan, expires_at, revoked, usage_count, last_used_at\n     FROM mem_keys ${where} ORDER BY created_at DESC`,\n    params,\n  )\n  return res.rows.map(mapKey)\n}\n\nexport async function revokeKeyRow(keyId: string): Promise<boolean> {\n  await ensureSchema()\n  const res = await query('UPDATE mem_keys SET revoked = TRUE WHERE key_id = $1', [keyId])\n  return (res.rowCount ?? 0) > 0\n}\n\nexport async function setScopeRow(keyId: string, scope: Scope | undefined, plan: string | undefined): Promise<boolean> {\n  await ensureSchema()\n  const sets: string[] = []\n  const params: unknown[] = []\n  if (scope) {\n    params.push(JSON.stringify(scope))\n    sets.push(`scope = $${params.length}::jsonb`)\n  }\n  if (plan) {\n    params.push(plan)\n    sets.push(`plan = $${params.length}`)\n  }\n  if (!sets.length) return false\n  params.push(keyId)\n  const res = await query(`UPDATE mem_keys SET ${sets.join(', ')} WHERE key_id = $${params.length}`, params)\n  return (res.rowCount ?? 0) > 0\n}\n\nexport async function planForIdentity(identity: string): Promise<string> {\n  await ensureSchema()\n  const res = await query<{ plan: string }>(\n    `SELECT plan FROM mem_keys WHERE identity = $1 ORDER BY created_at DESC LIMIT 1`,\n    [identity],\n  )\n  return res.rows[0]?.plan ?? 'free'\n}\n\nexport async function getKeyById(keyId: string): Promise<KeySummary | null> {\n  await ensureSchema()\n  const res = await query<KeyRow>(\n    `SELECT key_id, identity, vaults, scope, plan, expires_at, revoked, usage_count, last_used_at\n     FROM mem_keys WHERE key_id = $1 LIMIT 1`,\n    [keyId],\n  )\n  return res.rows[0] ? mapKey(res.rows[0]) : null\n}\n"],"mappings":"AAAA,SAAS,mBAAmB;AAC5B,SAAS,cAAc,aAAa;AACpC,SAAS,gBAAgB,YAAY,sBAAsB;AAGpD,MAAM,mBAA2C;AAAA,EACtD,MAAM;AAAA,EACN,KAAK;AAAA,EACL,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,WAAW,OAAO;AACpB;AAEO,SAAS,eAAe,MAAsB;AACnD,SAAO,iBAAiB,IAAI,KAAK,iBAAiB;AACpD;AAEO,SAAS,gBAAgB,MAAuB;AACrD,SAAO,SAAS;AAClB;AAoBA,eAAsB,YAAY,MAAwC;AACxE,QAAM,aAAa;AACnB,QAAM,QAAQ,OAAO,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AACnD,QAAM,SAAS,eAAe;AAC9B,QAAM;AAAA,IACJ;AAAA;AAAA,IAEA,CAAC,OAAO,WAAW,MAAM,GAAG,KAAK,UAAU,KAAK,UAAU,KAAK,MAAM,GAAG,KAAK,UAAU,KAAK,KAAK,GAAG,KAAK,MAAM,KAAK,SAAS;AAAA,EAC/H;AACA,SAAO,EAAE,OAAO,QAAQ,UAAU,KAAK,UAAU,QAAQ,KAAK,QAAQ,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,WAAW,KAAK,UAAU;AACtI;AA0BA,SAAS,MAAM,GAAsB;AACnC,SAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAAI,CAAC;AACnF;AAEA,SAAS,OAAO,KAAyB;AACvC,SAAO;AAAA,IACL,OAAO,IAAI;AAAA,IACX,UAAU,IAAI;AAAA,IACd,QAAQ,MAAM,IAAI,MAAM;AAAA,IACxB,OAAO,eAAe,IAAI,KAAgC;AAAA,IAC1D,MAAM,IAAI;AAAA,IACV,WAAW,IAAI;AAAA,IACf,SAAS,IAAI;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,YAAY,IAAI;AAAA,EAClB;AACF;AAEA,eAAsB,YAAY,QAAqF;AACrH,QAAM,aAAa;AACnB,QAAM,UAAoB,CAAC;AAC3B,QAAM,SAAoB,CAAC;AAC3B,MAAI,OAAO,UAAU;AACnB,WAAO,KAAK,OAAO,QAAQ;AAC3B,YAAQ,KAAK,eAAe,OAAO,MAAM,EAAE;AAAA,EAC7C;AACA,MAAI,OAAO,MAAM;AACf,WAAO,KAAK,OAAO,IAAI;AACvB,YAAQ,KAAK,WAAW,OAAO,MAAM,EAAE;AAAA,EACzC;AACA,MAAI,OAAO,OAAO;AAChB,WAAO,KAAK,KAAK,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAC1C,YAAQ,KAAK,cAAc,OAAO,MAAM,SAAS;AAAA,EACnD;AACA,QAAM,QAAQ,QAAQ,SAAS,SAAS,QAAQ,KAAK,OAAO,CAAC,KAAK;AAClE,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,qBACiB,KAAK;AAAA,IACtB;AAAA,EACF;AACA,SAAO,IAAI,KAAK,IAAI,MAAM;AAC5B;AAEA,eAAsB,aAAa,OAAiC;AAClE,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM,MAAM,wDAAwD,CAAC,KAAK,CAAC;AACvF,UAAQ,IAAI,YAAY,KAAK;AAC/B;AAEA,eAAsB,YAAY,OAAe,OAA0B,MAA4C;AACrH,QAAM,aAAa;AACnB,QAAM,OAAiB,CAAC;AACxB,QAAM,SAAoB,CAAC;AAC3B,MAAI,OAAO;AACT,WAAO,KAAK,KAAK,UAAU,KAAK,CAAC;AACjC,SAAK,KAAK,YAAY,OAAO,MAAM,SAAS;AAAA,EAC9C;AACA,MAAI,MAAM;AACR,WAAO,KAAK,IAAI;AAChB,SAAK,KAAK,WAAW,OAAO,MAAM,EAAE;AAAA,EACtC;AACA,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,SAAO,KAAK,KAAK;AACjB,QAAM,MAAM,MAAM,MAAM,uBAAuB,KAAK,KAAK,IAAI,CAAC,oBAAoB,OAAO,MAAM,IAAI,MAAM;AACzG,UAAQ,IAAI,YAAY,KAAK;AAC/B;AAEA,eAAsB,gBAAgB,UAAmC;AACvE,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,SAAO,IAAI,KAAK,CAAC,GAAG,QAAQ;AAC9B;AAEA,eAAsB,WAAW,OAA2C;AAC1E,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA;AAAA,IAEA,CAAC,KAAK;AAAA,EACR;AACA,SAAO,IAAI,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI;AAC7C;","names":[]}