purecontext-mcp 1.0.1

package/dist/config/workspaces-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaces-cli.d.ts","sourceRoot":"","sources":["../../src/config/workspaces-cli.ts"],"names":[],"mappings":"AAGA,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CA4BzD"}

package/dist/config/workspaces-cli.js

@@ -0,0 +1,84 @@
+import { openAuthDatabase } from '../core/db/api-keys.js';
+import { TenantStore } from '../core/db/tenants.js';
+export function runWorkspacesCommand(args) {
+    const sub = args[0];
+    if (!sub || sub === '--help' || sub === '-h') {
+        printWorkspacesHelp();
+        process.exit(0);
+    }
+    if (sub === 'list') {
+        cmdWorkspacesList();
+        process.exit(0);
+    }
+    if (sub === 'create') {
+        const nameIdx = args.indexOf('--name');
+        const name = nameIdx >= 0 && args[nameIdx + 1] ? args[nameIdx + 1] : null;
+        if (!name) {
+            process.stderr.write('Error: --name is required\n');
+            process.exit(1);
+        }
+        const planIdx = args.indexOf('--plan');
+        const plan = planIdx >= 0 && args[planIdx + 1]
+            ? args[planIdx + 1]
+            : 'team';
+        cmdWorkspacesCreate({ name, plan });
+        process.exit(0);
+    }
+    process.stderr.write(`Unknown workspaces subcommand: ${sub}\n`);
+    printWorkspacesHelp();
+    process.exit(1);
+}
+function printWorkspacesHelp() {
+    process.stdout.write(`
+purecontext-mcp workspaces — manage workspaces for team/cloud deployments
+
+Usage:
+  purecontext-mcp workspaces list
+  purecontext-mcp workspaces create --name <name> [--plan free|team|enterprise]
+
+Commands:
+  list                   List all workspaces with member and repo counts
+  create --name <name>   Create a new workspace
+
+Examples:
+  purecontext-mcp workspaces list
+  purecontext-mcp workspaces create --name "My Team"
+  purecontext-mcp workspaces create --name "Enterprise" --plan enterprise
+`.trimStart());
+}
+function cmdWorkspacesList() {
+    const db = openAuthDatabase();
+    try {
+        const store = new TenantStore(db);
+        const workspaces = store.list();
+        if (workspaces.length === 0) {
+            console.log('No workspaces found. Use "purecontext-mcp workspaces create" to add one.');
+            return;
+        }
+        console.log('\nWorkspaces:\n');
+        for (const ws of workspaces) {
+            const memberStr = ws.memberCount !== undefined ? `${ws.memberCount} member(s)` : '';
+            console.log(`  ${ws.id}  "${ws.name}"  plan: ${ws.plan}  ${memberStr}  created: ${ws.createdAt}`);
+        }
+        console.log();
+    }
+    finally {
+        db.close();
+    }
+}
+function cmdWorkspacesCreate(opts) {
+    const db = openAuthDatabase();
+    try {
+        const store = new TenantStore(db);
+        const ws = store.create(opts.name, { plan: opts.plan });
+        console.log('\nWorkspace created successfully.\n');
+        console.log(`  ID:    ${ws.id}`);
+        console.log(`  Name:  ${ws.name}`);
+        console.log(`  Plan:  ${ws.plan}`);
+        console.log();
+    }
+    finally {
+        db.close();
+    }
+}
+//# sourceMappingURL=workspaces-cli.js.map

package/dist/config/workspaces-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaces-cli.js","sourceRoot":"","sources":["../../src/config/workspaces-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,UAAU,oBAAoB,CAAC,IAAc;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7C,mBAAmB,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,iBAAiB,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YAC/B,CAAC,CAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAoC;YACvD,CAAC,CAAC,MAAM,CAAC;QACb,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,GAAG,IAAI,CAAC,CAAC;IAChE,mBAAmB,EAAE,CAAC;IACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;CAetB,CAAC,SAAS,EAAE,CAAC,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC,IAAI,KAAK,SAAS,cAAc,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA4D;IACvF,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/core/db/api-keys.d.ts

@@ -0,0 +1,95 @@
+import Database from 'better-sqlite3';
+export type Permission = 'read' | 'write' | 'admin';
+export interface ApiKeyRecord {
+    keyHash: string;
+    tenantId: string;
+    permissions: Permission[];
+    rateLimitTier: string;
+    label: string | null;
+    createdAt: string;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+}
+export interface TenantRecord {
+    id: string;
+    name: string;
+    createdAt: string;
+}
+/**
+ * DDL for the central auth database (~/.purecontext/auth.db).
+ * Separate from per-repo index databases.
+ *
+ * Tenant columns added in auth schema v1:
+ *   settings, storage_quota_bytes, storage_used_bytes
+ */
+export declare const AUTH_DDL = "\nPRAGMA journal_mode = WAL;\nPRAGMA foreign_keys = ON;\n\nCREATE TABLE IF NOT EXISTS tenants (\n  id                   TEXT    PRIMARY KEY,\n  name                 TEXT    NOT NULL,\n  created_at           TEXT    NOT NULL,\n  settings             TEXT,\n  storage_quota_bytes  INTEGER,\n  storage_used_bytes   INTEGER NOT NULL DEFAULT 0\n);\n\nCREATE TABLE IF NOT EXISTS api_keys (\n  key_hash        TEXT PRIMARY KEY,\n  tenant_id       TEXT NOT NULL,\n  permissions     TEXT NOT NULL,\n  rate_limit_tier TEXT NOT NULL,\n  label           TEXT,\n  created_at      TEXT NOT NULL,\n  last_used_at    TEXT,\n  revoked_at      TEXT,\n  FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE\n);\n\nCREATE INDEX IF NOT EXISTS idx_api_keys_tenant ON api_keys(tenant_id);\n";
+/** Override the auth DB path — for testing only. */
+export declare function _setAuthDbPathForTesting(path: string | null): void;
+export declare function getAuthDbPath(): string;
+/**
+ * Open (or create) the central auth SQLite database.
+ * Creates the auth directory if it does not exist.
+ */
+export declare function openAuthDatabase(): Database.Database;
+/**
+ * Open an in-memory auth database.
+ * Suitable for unit tests — no disk I/O.
+ */
+export declare function openInMemoryAuthDatabase(): Database.Database;
+/**
+ * Migrate the auth DB schema to add tenant quota columns if they are missing.
+ * Safe to call on any existing auth DB — checks for column existence before ALTER.
+ */
+export declare function runAuthMigrations(db: Database.Database): void;
+/** One-way SHA-256 hash of a raw API key — stored in DB, never the raw key. */
+export declare function hashApiKey(rawKey: string): string;
+export declare class ApiKeyStore {
+    private readonly db;
+    constructor(db: Database.Database);
+    insert(record: ApiKeyRecord): void;
+    findByHash(keyHash: string): ApiKeyRecord | null;
+    /** Mark the key as revoked (idempotent — only updates if not already revoked). */
+    revoke(keyHash: string): void;
+    /** Revoke all active keys whose hash starts with `hashPrefix`. */
+    revokeByHashPrefix(hashPrefix: string): number;
+    updateLastUsed(keyHash: string): void;
+    updateLabel(keyHash: string, label: string): void;
+    listByTenant(tenantId: string): ApiKeyRecord[];
+    delete(keyHash: string): void;
+}
+export declare function insertTenant(db: Database.Database, tenant: TenantRecord): void;
+export declare function getTenant(db: Database.Database, id: string): TenantRecord | null;
+export declare function listTenants(db: Database.Database): TenantRecord[];
+/**
+ * Create and store a new API key for the given tenant.
+ * Returns the plaintext key (`pctx_` + 32 random hex chars) — shown once only.
+ * Only the SHA-256 hash is stored in the database.
+ *
+ * Automatically creates the tenant record if it doesn't exist.
+ */
+export declare function createApiKey(db: Database.Database, tenantId: string, label: string | null, permissions: Permission[], opts?: {
+    rateLimitTier?: string;
+}): string;
+/**
+ * Validate a raw API key. Returns `{ tenantId, permissions }` when valid, or null.
+ * Updates `last_used_at` on success.
+ */
+export declare function validateApiKey(db: Database.Database, rawKey: string): {
+    tenantId: string;
+    permissions: Permission[];
+} | null;
+/**
+ * Revoke an API key by its plaintext value or hash prefix.
+ */
+export declare function revokeApiKey(db: Database.Database, keyOrHashPrefix: string): void;
+/**
+ * List all non-revoked API keys for a tenant, newest first.
+ * Never returns the raw key — only metadata.
+ */
+export declare function listApiKeys(db: Database.Database, tenantId: string): ApiKeyRecord[];
+/**
+ * Look up the workspace (tenant) ID for a non-revoked API key hash.
+ * Returns null when the key is not found or has been revoked.
+ */
+export declare function getWorkspaceForKey(db: Database.Database, keyHash: string): string | null;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/core/db/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/core/db/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAUtC,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEpD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAID;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,gxBA0BpB,CAAC;AAMF,oDAAoD;AACpD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAElE;AAED,wBAAgB,aAAa,IAAI,MAAM,CAKtC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,CAAC,QAAQ,CAQpD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,QAAQ,CAAC,QAAQ,CAM5D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAyC7D;AAID,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAID,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAElD,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAwBlC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAOhD,kFAAkF;IAClF,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAQ7B,kEAAkE;IAClE,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAS9C,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAMrC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAMjD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE;IAS9C,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAG9B;AAID,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAI9E;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAKhF;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,YAAY,EAAE,CAKjE;AAwCD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,WAAW,EAAE,UAAU,EAAE,EACzB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACpC,MAAM,CAuBR;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,MAAM,GACb;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GAAG,IAAI,CAMxD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAOjF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAInF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKxF"}

package/dist/core/db/api-keys.js

@@ -0,0 +1,293 @@
+import Database from 'better-sqlite3';
+import { createHash, randomBytes } from 'node:crypto';
+import { mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { StorageError } from '../errors.js';
+import { REQUEST_LOG_DDL } from './request-log.js';
+// ─── DDL ──────────────────────────────────────────────────────────────────────
+/**
+ * DDL for the central auth database (~/.purecontext/auth.db).
+ * Separate from per-repo index databases.
+ *
+ * Tenant columns added in auth schema v1:
+ *   settings, storage_quota_bytes, storage_used_bytes
+ */
+export const AUTH_DDL = `
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE IF NOT EXISTS tenants (
+  id                   TEXT    PRIMARY KEY,
+  name                 TEXT    NOT NULL,
+  created_at           TEXT    NOT NULL,
+  settings             TEXT,
+  storage_quota_bytes  INTEGER,
+  storage_used_bytes   INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS api_keys (
+  key_hash        TEXT PRIMARY KEY,
+  tenant_id       TEXT NOT NULL,
+  permissions     TEXT NOT NULL,
+  rate_limit_tier TEXT NOT NULL,
+  label           TEXT,
+  created_at      TEXT NOT NULL,
+  last_used_at    TEXT,
+  revoked_at      TEXT,
+  FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_api_keys_tenant ON api_keys(tenant_id);
+`;
+// ─── Database path + factory ──────────────────────────────────────────────────
+let _authDbPathOverride = null;
+/** Override the auth DB path — for testing only. */
+export function _setAuthDbPathForTesting(path) {
+    _authDbPathOverride = path;
+}
+export function getAuthDbPath() {
+    if (_authDbPathOverride !== null)
+        return _authDbPathOverride;
+    const dataDir = process.env['PCTX_DATA_DIR'];
+    if (dataDir)
+        return join(dataDir, 'auth.db');
+    return join(homedir(), '.purecontext', 'auth.db');
+}
+/**
+ * Open (or create) the central auth SQLite database.
+ * Creates the auth directory if it does not exist.
+ */
+export function openAuthDatabase() {
+    const path = getAuthDbPath();
+    mkdirSync(join(path, '..'), { recursive: true });
+    const db = new Database(path);
+    db.exec(AUTH_DDL);
+    db.exec(REQUEST_LOG_DDL);
+    runAuthMigrations(db);
+    return db;
+}
+/**
+ * Open an in-memory auth database.
+ * Suitable for unit tests — no disk I/O.
+ */
+export function openInMemoryAuthDatabase() {
+    const db = new Database(':memory:');
+    db.exec(AUTH_DDL);
+    db.exec(REQUEST_LOG_DDL);
+    runAuthMigrations(db);
+    return db;
+}
+/**
+ * Migrate the auth DB schema to add tenant quota columns if they are missing.
+ * Safe to call on any existing auth DB — checks for column existence before ALTER.
+ */
+export function runAuthMigrations(db) {
+    const cols = db
+        .prepare("PRAGMA table_info(tenants)")
+        .all();
+    const colNames = new Set(cols.map((c) => c.name));
+    if (!colNames.has('settings')) {
+        db.exec('ALTER TABLE tenants ADD COLUMN settings TEXT');
+    }
+    if (!colNames.has('storage_quota_bytes')) {
+        db.exec('ALTER TABLE tenants ADD COLUMN storage_quota_bytes INTEGER');
+    }
+    if (!colNames.has('storage_used_bytes')) {
+        db.exec('ALTER TABLE tenants ADD COLUMN storage_used_bytes INTEGER NOT NULL DEFAULT 0');
+    }
+    // plan column on tenants
+    if (!colNames.has('plan')) {
+        db.exec("ALTER TABLE tenants ADD COLUMN plan TEXT NOT NULL DEFAULT 'team'");
+    }
+    // workspace_members table
+    db.exec(`CREATE TABLE IF NOT EXISTS workspace_members (
+  workspace_id TEXT NOT NULL,
+  user_id      TEXT NOT NULL,
+  role         TEXT NOT NULL,
+  added_at     TEXT NOT NULL,
+  PRIMARY KEY (workspace_id, user_id),
+  FOREIGN KEY (workspace_id) REFERENCES tenants(id) ON DELETE CASCADE
+)`);
+    // api_keys migrations
+    const keyCols = db
+        .prepare("PRAGMA table_info(api_keys)")
+        .all();
+    const keyColNames = new Set(keyCols.map((c) => c.name));
+    if (!keyColNames.has('label')) {
+        db.exec('ALTER TABLE api_keys ADD COLUMN label TEXT');
+    }
+}
+// ─── Key hash ─────────────────────────────────────────────────────────────────
+/** One-way SHA-256 hash of a raw API key — stored in DB, never the raw key. */
+export function hashApiKey(rawKey) {
+    return createHash('sha256').update(rawKey).digest('hex');
+}
+// ─── ApiKeyStore ──────────────────────────────────────────────────────────────
+export class ApiKeyStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    insert(record) {
+        try {
+            this.db
+                .prepare(`INSERT INTO api_keys
+             (key_hash, tenant_id, permissions, rate_limit_tier, label, created_at, last_used_at, revoked_at)
+           VALUES
+             (@keyHash, @tenantId, @permissions, @rateLimitTier, @label, @createdAt, @lastUsedAt, @revokedAt)`)
+                .run({
+                keyHash: record.keyHash,
+                tenantId: record.tenantId,
+                permissions: JSON.stringify(record.permissions),
+                rateLimitTier: record.rateLimitTier,
+                label: record.label ?? null,
+                createdAt: record.createdAt,
+                lastUsedAt: record.lastUsedAt ?? null,
+                revokedAt: record.revokedAt ?? null,
+            });
+        }
+        catch (err) {
+            throw new StorageError('Failed to insert API key', 'insert', err);
+        }
+    }
+    findByHash(keyHash) {
+        const row = this.db
+            .prepare('SELECT * FROM api_keys WHERE key_hash = ?')
+            .get(keyHash);
+        return row ? rowToRecord(row) : null;
+    }
+    /** Mark the key as revoked (idempotent — only updates if not already revoked). */
+    revoke(keyHash) {
+        this.db
+            .prepare("UPDATE api_keys SET revoked_at = ? WHERE key_hash = ? AND revoked_at IS NULL")
+            .run(new Date().toISOString(), keyHash);
+    }
+    /** Revoke all active keys whose hash starts with `hashPrefix`. */
+    revokeByHashPrefix(hashPrefix) {
+        const result = this.db
+            .prepare("UPDATE api_keys SET revoked_at = ? WHERE key_hash LIKE ? AND revoked_at IS NULL")
+            .run(new Date().toISOString(), `${hashPrefix}%`);
+        return result.changes;
+    }
+    updateLastUsed(keyHash) {
+        this.db
+            .prepare('UPDATE api_keys SET last_used_at = ? WHERE key_hash = ?')
+            .run(new Date().toISOString(), keyHash);
+    }
+    updateLabel(keyHash, label) {
+        this.db
+            .prepare('UPDATE api_keys SET label = ? WHERE key_hash = ?')
+            .run(label, keyHash);
+    }
+    listByTenant(tenantId) {
+        return this.db
+            .prepare('SELECT * FROM api_keys WHERE tenant_id = ? ORDER BY created_at DESC')
+            .all(tenantId)
+            .map(rowToRecord);
+    }
+    delete(keyHash) {
+        this.db.prepare('DELETE FROM api_keys WHERE key_hash = ?').run(keyHash);
+    }
+}
+// ─── Tenant helpers ───────────────────────────────────────────────────────────
+export function insertTenant(db, tenant) {
+    db.prepare('INSERT OR IGNORE INTO tenants (id, name, created_at) VALUES (?, ?, ?)').run(tenant.id, tenant.name, tenant.createdAt);
+}
+export function getTenant(db, id) {
+    const row = db
+        .prepare('SELECT * FROM tenants WHERE id = ?')
+        .get(id);
+    return row ? tenantRowToRecord(row) : null;
+}
+export function listTenants(db) {
+    return db
+        .prepare('SELECT * FROM tenants ORDER BY created_at DESC')
+        .all()
+        .map(tenantRowToRecord);
+}
+function rowToRecord(row) {
+    return {
+        keyHash: row.key_hash,
+        tenantId: row.tenant_id,
+        permissions: JSON.parse(row.permissions),
+        rateLimitTier: row.rate_limit_tier,
+        label: row.label,
+        createdAt: row.created_at,
+        lastUsedAt: row.last_used_at,
+        revokedAt: row.revoked_at,
+    };
+}
+function tenantRowToRecord(row) {
+    return { id: row.id, name: row.name, createdAt: row.created_at };
+}
+// ─── Convenience helpers (Phase 18) ──────────────────────────────────────────
+/**
+ * Create and store a new API key for the given tenant.
+ * Returns the plaintext key (`pctx_` + 32 random hex chars) — shown once only.
+ * Only the SHA-256 hash is stored in the database.
+ *
+ * Automatically creates the tenant record if it doesn't exist.
+ */
+export function createApiKey(db, tenantId, label, permissions, opts = {}) {
+    const rateLimitTier = opts.rateLimitTier ?? 'default';
+    // pctx_ + 32 random hex chars (16 bytes → 32 hex)
+    const rawKey = `pctx_${randomBytes(16).toString('hex')}`;
+    const keyHash = hashApiKey(rawKey);
+    if (getTenant(db, tenantId) === null) {
+        insertTenant(db, { id: tenantId, name: tenantId, createdAt: new Date().toISOString() });
+    }
+    new ApiKeyStore(db).insert({
+        keyHash,
+        tenantId,
+        permissions,
+        rateLimitTier,
+        label,
+        createdAt: new Date().toISOString(),
+        lastUsedAt: null,
+        revokedAt: null,
+    });
+    return rawKey;
+}
+/**
+ * Validate a raw API key. Returns `{ tenantId, permissions }` when valid, or null.
+ * Updates `last_used_at` on success.
+ */
+export function validateApiKey(db, rawKey) {
+    const store = new ApiKeyStore(db);
+    const record = store.findByHash(hashApiKey(rawKey));
+    if (record === null || record.revokedAt !== null)
+        return null;
+    store.updateLastUsed(hashApiKey(rawKey));
+    return { tenantId: record.tenantId, permissions: record.permissions };
+}
+/**
+ * Revoke an API key by its plaintext value or hash prefix.
+ */
+export function revokeApiKey(db, keyOrHashPrefix) {
+    const store = new ApiKeyStore(db);
+    if (keyOrHashPrefix.startsWith('pctx_')) {
+        store.revoke(hashApiKey(keyOrHashPrefix));
+    }
+    else {
+        store.revokeByHashPrefix(keyOrHashPrefix);
+    }
+}
+/**
+ * List all non-revoked API keys for a tenant, newest first.
+ * Never returns the raw key — only metadata.
+ */
+export function listApiKeys(db, tenantId) {
+    return new ApiKeyStore(db)
+        .listByTenant(tenantId)
+        .filter((k) => k.revokedAt === null);
+}
+/**
+ * Look up the workspace (tenant) ID for a non-revoked API key hash.
+ * Returns null when the key is not found or has been revoked.
+ */
+export function getWorkspaceForKey(db, keyHash) {
+    const row = db.prepare('SELECT tenant_id FROM api_keys WHERE key_hash = ? AND revoked_at IS NULL').get(keyHash);
+    return row?.tenant_id ?? null;
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/core/db/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../../src/core/db/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAuBnD,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BvB,CAAC;AAEF,iFAAiF;AAEjF,IAAI,mBAAmB,GAAkB,IAAI,CAAC;AAE9C,oDAAoD;AACpD,MAAM,UAAU,wBAAwB,CAAC,IAAmB;IAC1D,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,mBAAmB,KAAK,IAAI;QAAE,OAAO,mBAAmB,CAAC;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClB,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACzB,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;IACpC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClB,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACzB,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAqB;IACrD,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,4BAA4B,CAAC;SACrC,GAAG,EAA6B,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAElD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzC,EAAE,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxC,EAAE,CAAC,IAAI,CACL,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,EAAE,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC9E,CAAC;IAED,0BAA0B;IAC1B,EAAE,CAAC,IAAI,CAAC;;;;;;;EAOR,CAAC,CAAC;IAEF,sBAAsB;IACtB,MAAM,OAAO,GAAG,EAAE;SACf,OAAO,CAAC,6BAA6B,CAAC;SACtC,GAAG,EAA6B,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,iFAAiF;AAEjF,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,EAAqB;QAArB,OAAE,GAAF,EAAE,CAAmB;IAAG,CAAC;IAEtD,MAAM,CAAC,MAAoB;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;;8GAGoG,CACrG;iBACA,GAAG,CAAC;gBACH,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC/C,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;gBACrC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;aACpC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CAAC,0BAA0B,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAwB,2CAA2C,CAAC;aAC3E,GAAG,CAAC,OAAO,CAAC,CAAC;QAChB,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,kFAAkF;IAClF,MAAM,CAAC,OAAe;QACpB,IAAI,CAAC,EAAE;aACJ,OAAO,CACN,8EAA8E,CAC/E;aACA,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,kEAAkE;IAClE,kBAAkB,CAAC,UAAkB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN,iFAAiF,CAClF;aACA,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,GAAG,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,yDAAyD,CAAC;aAClE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,KAAa;QACxC,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,kDAAkD,CAAC;aAC3D,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CACN,qEAAqE,CACtE;aACA,GAAG,CAAC,QAAQ,CAAC;aACb,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,iFAAiF;AAEjF,MAAM,UAAU,YAAY,CAAC,EAAqB,EAAE,MAAoB;IACtE,EAAE,CAAC,OAAO,CACR,uEAAuE,CACxE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAqB,EAAE,EAAU;IACzD,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAwB,oCAAoC,CAAC;SACpE,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,OAAO,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAqB;IAC/C,OAAO,EAAE;SACN,OAAO,CAAkB,gDAAgD,CAAC;SAC1E,GAAG,EAAE;SACL,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC5B,CAAC;AAqBD,SAAS,WAAW,CAAC,GAAgB;IACnC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAiB;QACxD,aAAa,EAAE,GAAG,CAAC,eAAe;QAClC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAgB;IACzC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;AACnE,CAAC;AAED,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,EAAqB,EACrB,QAAgB,EAChB,KAAoB,EACpB,WAAyB,EACzB,OAAmC,EAAE;IAErC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC;IAEtD,kDAAkD;IAClD,MAAM,MAAM,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnC,IAAI,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QACzB,OAAO;QACP,QAAQ;QACR,WAAW;QACX,aAAa;QACb,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,EAAqB,EACrB,MAAc;IAEd,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9D,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,EAAqB,EAAE,eAAuB;IACzE,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,EAAqB,EAAE,QAAgB;IACjE,OAAO,IAAI,WAAW,CAAC,EAAE,CAAC;SACvB,YAAY,CAAC,QAAQ,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAqB,EAAE,OAAe;IACvE,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB,0EAA0E,CAC3E,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACf,OAAO,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;AAChC,CAAC"}

package/dist/core/db/dep-store.d.ts

@@ -0,0 +1,18 @@
+import type Database from 'better-sqlite3';
+import type { DepEdge, SymbolRecord } from '../types.js';
+export declare function insertEdges(db: Database.Database, edges: DepEdge[], tenantId?: string): void;
+export declare function deleteEdgesByFile(db: Database.Database, repoId: string, filePath: string): void;
+/** All dependency edges for a repo. */
+export declare function getAllDepEdges(db: Database.Database, repoId: string, tenantId?: string): DepEdge[];
+/** Files and symbols that `sourceFile` imports (forward walk, one hop). */
+export declare function getForwardDeps(db: Database.Database, repoId: string, sourceFile: string, tenantId?: string): DepEdge[];
+/** Files and symbols that import `targetFile` (reverse walk, one hop). */
+export declare function getReverseDeps(db: Database.Database, repoId: string, targetFile: string, tenantId?: string): DepEdge[];
+/** Distinct file paths that import `targetFile`. */
+export declare function getImportersOf(db: Database.Database, repoId: string, targetFile: string, tenantId?: string): string[];
+/**
+ * Returns exported symbols whose file is never imported by any other file in
+ * the repo. Phase 1: file-level dead code detection.
+ */
+export declare function findDeadExports(db: Database.Database, repoId: string, tenantId?: string): SymbolRecord[];
+//# sourceMappingURL=dep-store.d.ts.map

package/dist/core/db/dep-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-store.d.ts","sourceRoot":"","sources":["../../../src/core/db/dep-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AA4DrE,wBAAgB,WAAW,CACzB,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,KAAK,EAAE,OAAO,EAAE,EAChB,QAAQ,SAAU,GACjB,IAAI,CAkCN;AAED,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,IAAI,CAIN;AAED,uCAAuC;AACvC,wBAAgB,cAAc,CAC5B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,EAAE,CAaX;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,CAC5B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,EAAE,CAeX;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAC5B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,EAAE,CAeX;AAED,oDAAoD;AACpD,wBAAgB,cAAc,CAC5B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,EAAE,CAeV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,YAAY,EAAE,CAmChB"}