hanna/fabrica

feat(store): add schema, migrations, and portable SQLite/Postgres store

9458665 · hanna committed on 2026-07-25

Implements phase 3. The store runs over a single `sqlx::Any` pool with every
statement written once in the portable SQL subset; the three dialect
differences are mediated explicitly — `$1,$2` placeholders (both backends
accept them), booleans bound as `bool` and read back through `get_bool`
(SQLite INTEGER vs Postgres BOOLEAN), and BIGINT-ms / TEXT-ULID columns that
are already portable.

- model: single-source name validation (`validate_name`, reserved list) plus
  `User`/`Repo` domain types, with exhaustive validation tests.
- store: `Backend` detection, SQLite pragmas (WAL, foreign_keys, busy_timeout)
  applied per connection, embedded per-dialect migrators selected at runtime,
  `create_user`/`create_repo` with unique-violation → `Conflict` mapping, and
  lookups.
- migrations: full schema for both dialects (users, invites, sessions,
  api_tokens, keys, groups, repos, repo_collaborators, plus inert runs/jobs)
  and the indexes from the spec.
- tests: run against SQLite in-memory and file-backed; a hermetic
  schema-equivalence check across dialects; Postgres round-trips gated behind
  `postgres-tests` + FABRICA_TEST_POSTGRES_URL.
- build(nix): keep `.sql` files in the crane build source so `sqlx::migrate!`
  can embed them.

sqlx is built with no TLS backend for now (keeps `ring` out of the graph and
cargo-deny's license set clean); revisit for remote Postgres in phase 17.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +1041 −5

Cargo.toml +14 −0

crates/model/Cargo.toml +1 −0

crates/model/src/entity.rs +75 −0

crates/model/src/lib.rs +10 −0

crates/model/src/name.rs +201 −0

crates/store/Cargo.toml +12 −0

crates/store/src/lib.rs +267 −0

crates/store/src/repos.rs +127 −0

crates/store/src/tests.rs +424 −0

crates/store/src/users.rs +132 −0

flake.nix +12 −1

migrations/postgres/0001_init.sql +141 −0

migrations/sqlite/0001_init.sql +141 −0

 url = "2"
 clap = { version = "4", features = ["derive"] }
 anyhow = "1"
+# Database. `any` gives one code path over both backends; TLS is deliberately
+# omitted for now (Postgres-over-TLS is a phase-17 deployment concern) to keep
+# the dependency tree small and the license set clean — see docs/decisions.md.
+sqlx = { version = "0.9", default-features = false, features = [
+    "runtime-tokio",
+    "any",
+    "sqlite",
+    "postgres",
+    "migrate",
+    "macros",
+] }
+ulid = "1"
+tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+tempfile = "3"
 [workspace.lints.rust]
 unsafe_code = "forbid"

 publish.workspace = true
 [dependencies]
+thiserror = { workspace = true }
 [lints]
 workspace = true

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! In-memory representations of the persisted entities.
+//!
+//! These are plain data types with no behaviour and no I/O — [`crate::store`]
+//! (the `store` crate) is responsible for reading and writing them. Timestamps
+//! are Unix milliseconds UTC ([`Timestamp`]); identifiers are ULID strings.
+//!
+//! Storage-only columns (the normalized `*_lower` uniqueness keys) are
+//! deliberately absent: they are an implementation detail of the schema, not
+//! part of the domain.
+/// A Unix timestamp in **milliseconds** UTC, matching the `BIGINT` columns in
+/// the schema.
+pub type Timestamp = i64;
+/// A registered account.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct User {
+    /// ULID primary key.
+    pub id: String,
+    /// The name as the user typed it (case preserved for display).
+    pub username: String,
+    /// The primary email address.
+    pub email: String,
+    /// Optional human-friendly display name.
+    pub display_name: Option<String>,
+    /// Argon2id PHC hash, or `None` until an invite is completed.
+    pub password_hash: Option<String>,
+    /// Whether the user must set a new password on next login.
+    pub must_change_password: bool,
+    /// Whether the user is a site administrator.
+    pub is_admin: bool,
+    /// When the account was disabled, if it is.
+    pub disabled_at: Option<Timestamp>,
+    /// Creation time.
+    pub created_at: Timestamp,
+    /// Last modification time.
+    pub updated_at: Timestamp,
+}
+/// A git repository. On disk it lives at `{repo_dir}/{id[0..2]}/{id}.git`; the
+/// database is the sole authority mapping `(owner, path)` to this id.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Repo {
+    /// ULID primary key, and the on-disk directory stem.
+    pub id: String,
+    /// Owning user.
+    pub owner_id: String,
+    /// Containing group, or `None` when the repo hangs directly off the owner.
+    pub group_id: Option<String>,
+    /// The repo's own name (the final path segment).
+    pub name: String,
+    /// Materialized full path within the owner, e.g. `group/sub/repo`; equal to
+    /// `name` when ungrouped.
+    pub path: String,
+    /// Optional one-line description.
+    pub description: Option<String>,
+    /// Private repositories are invisible to non-collaborators.
+    pub is_private: bool,
+    /// The branch shown by default and used for HEAD.
+    pub default_branch: String,
+    /// When the repo was archived (read-only), if it is.
+    pub archived_at: Option<Timestamp>,
+    /// Approximate on-disk size in bytes, refreshed by maintenance.
+    pub size_bytes: i64,
+    /// Time of the last push, if any.
+    pub pushed_at: Option<Timestamp>,
+    /// Creation time.
+    pub created_at: Timestamp,
+    /// Last modification time.
+    pub updated_at: Timestamp,
+}

 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Shared domain types. This crate performs no I/O and depends on nothing else in-tree.
+//!
+//! It holds the in-memory shapes of persisted entities ([`entity`]) and the
+//! name-validation rules ([`name`]) that every entry point — CLI, API, web —
+//! shares so they cannot drift.
+pub mod entity;
+pub mod name;
+pub use entity::{Repo, Timestamp, User};
+pub use name::{MAX_NAME_LEN, NameError, RESERVED_NAMES, validate_name};

 publish.workspace = true
 [dependencies]
+model = { workspace = true }
+sqlx = { workspace = true }
+ulid = { workspace = true }
+thiserror = { workspace = true }
+[dev-dependencies]
+tokio = { workspace = true }
+tempfile = { workspace = true }
+[features]
+# Opt-in Postgres integration tests, driven by FABRICA_TEST_POSTGRES_URL.
+postgres-tests = []
 [lints]
 workspace = true

 version = 4
 [[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+[[package]]
 name = "anstream"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 version = "0.1.0"
 [[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+[[package]]
 name = "atomic"
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 version = "0.1.0"
 [[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+[[package]]
 name = "bitflags"
 version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+dependencies = [
+ "serde_core",
+]
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 [[package]]
 name = "bytemuck"
 checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
 [[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+[[package]]
+name = "cc"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+[[package]]
 name = "cfg-if"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 [[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+[[package]]
 name = "clap"
 version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+[[package]]
 name = "colorchoice"
 version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 [[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+[[package]]
 name = "config"
 version = "0.1.0"
 dependencies = [
+]
 [[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
+dependencies = [
+ "crossbeam-utils",
+]
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.6",
+]
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+[[package]]
 name = "displaydoc"
 version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+[[package]]
+name = "either"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
+dependencies = [
+ "serde",
+]
+[[package]]
 name = "equivalent"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "etcetera"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de48cc4d1c1d97a20fd819def54b890cadde72ed3ad0c614822a0a433361be96"
+dependencies = [
+ "cfg-if",
+ "windows-sys",
+]
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+[[package]]
 name = "fabrica"
 version = "0.1.0"
 dependencies = [
+]
 [[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+[[package]]
+name = "flume"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e139bc46ca777eb5efaf62df0ab8cc5fd400866427e56c68b22e414e53bd3be"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin",
+]
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+[[package]]
 name = "form_urlencoded"
 version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "futures-channel"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+[[package]]
+name = "futures-core"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
+[[package]]
+name = "futures-executor"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+[[package]]
+name = "futures-io"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
+[[package]]
+name = "futures-sink"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
+[[package]]
+name = "futures-task"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+[[package]]
+name = "futures-util"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+[[package]]
+name = "generic-array"
+version = "0.14.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+[[package]]
 name = "getrandom"
 version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+]
 [[package]]
 [[package]]
 name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+[[package]]
+name = "hashbrown"
 version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 [[package]]
+name = "hashlink"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824e001ac4f3012dd16a264bec811403a67ca9deb6c102fc5049b32c4574b35f"
+dependencies = [
+ "hashbrown 0.16.1",
+]
+[[package]]
 name = "heck"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 [[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+[[package]]
 name = "highlight"
 version = "0.1.0"
 [[package]]
+name = "hkdf"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
+dependencies = [
+ "hmac",
+]
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
+]
+[[package]]
+name = "hybrid-array"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
+dependencies = [
+ "typenum",
+]
+[[package]]
 name = "icu_collections"
 version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown",
+ "hashbrown 0.17.1",
+]
 [[package]]
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 [[package]]
+name = "js-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+[[package]]
 name = "libc"
 version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 [[package]]
+name = "libsqlite3-sys"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f111c8c41e7c61a49cd34e44c7619462967221a6443b0ec299e0ac30cfb9b1"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+[[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+[[package]]
 name = "mail"
 version = "0.1.0"
 [[package]]
+name = "md-5"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
+dependencies = [
+ "cfg-if",
+ "digest 0.11.3",
+]
+[[package]]
 name = "memchr"
 version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 [[package]]
-name = "model"
+name = "mio"
-version = "0.1.0"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys",
+]
+[[package]]
+name = "model"
+version = "0.1.0"
+dependencies = [
+ "thiserror",
+]
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
 [[package]]
 name = "once_cell"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 [[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+[[package]]
 name = "parking_lot"
 version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 [[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+[[package]]
 name = "potential_utf"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+[[package]]
 name = "proc-macro2"
 version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 [[package]]
 name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+[[package]]
+name = "r-efi"
 version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 [[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha",
+ "rand_core 0.9.5",
+]
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+[[package]]
 name = "redox_syscall"
 version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+[[package]]
 name = "scopeguard"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+[[package]]
 name = "smallvec"
 version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+dependencies = [
+ "serde",
+]
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+dependencies = [
+ "lock_api",
+]
+[[package]]
+name = "sqlx"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "378620ccc25c62c89d8be1c819e76a88d59bdcc3304733330788948e619bfd71"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+[[package]]
+name = "sqlx-core"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05b44e85bf579a8eeb4ceaa77a3a523baf2bf0e9bac7e40f405d537b5d2d5ccb"
+dependencies = [
+ "base64",
+ "bytes",
+ "cfg-if",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashbrown 0.16.1",
+ "hashlink",
+ "indexmap",
+ "log",
+ "memchr",
+ "percent-encoding",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "smallvec",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+]
+[[package]]
+name = "sqlx-macros"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd2b84f2bc39a5705ef27ec785a11c934a41bbd4a24941e257927cddc26b60bf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn 2.0.119",
+]
+[[package]]
+name = "sqlx-macros-core"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb8d96de5fdc85a5c4ec813432b523ec637e80ba98f046555f75f7908ddac7c3"
+dependencies = [
+ "cfg-if",
+ "dotenvy",
+ "either",
+ "heck",
+ "hex",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "sqlx-core",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn 2.0.119",
+ "thiserror",
+ "tokio",
+ "url",
+]
+[[package]]
+name = "sqlx-mysql"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90b8020fe17c5f2c245bfa2505d7ef59c5604839527c740266ad2214acebea27"
+dependencies = [
+ "bitflags",
+ "byteorder",
+ "bytes",
+ "crc",
+ "digest 0.11.3",
+ "dotenvy",
+ "either",
+ "futures-core",
+ "futures-util",
+ "generic-array",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sha1",
+ "sha2 0.11.0",
+ "sqlx-core",
+ "thiserror",
+ "tracing",
+]
+[[package]]
+name = "sqlx-postgres"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87a2bdd6e83f6b3ea525ca9fee568030508b58355a43d0b2c1674d5f79dcd65e"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags",
+ "byteorder",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "rand 0.10.2",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "tracing",
+ "whoami",
+]
+[[package]]
+name = "sqlx-sqlite"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488e99c397a62007e4229aec669a179816339afc6d2620ca6fa420dbee2e982c"
+dependencies = [
+ "atoi",
+ "flume",
+ "form_urlencoded",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sqlx-core",
+ "thiserror",
+ "tracing",
+ "url",
+]
 [[package]]
 name = "ssh"
 [[package]]
 name = "store"
 version = "0.1.0"
+dependencies = [
+ "model",
+ "sqlx",
+ "tempfile",
+ "thiserror",
+ "tokio",
+ "ulid",
+]
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
 [[package]]
 name = "strsim"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
  "windows-sys",
+]
 [[package]]
+name = "tinyvec"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+dependencies = [
+ "tinyvec_macros",
+]
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "tokio-macros",
+ "windows-sys",
+]
+[[package]]
+name = "tokio-macros"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+[[package]]
+name = "tokio-stream"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+[[package]]
 name = "toml"
 version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 [[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+[[package]]
+name = "ulid"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
+dependencies = [
+ "rand 0.9.5",
+ "web-time",
+]
+[[package]]
 name = "uncased"
 version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+[[package]]
 name = "unicode-ident"
 version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 [[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+[[package]]
 name = "url"
 version = "2.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 [[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+[[package]]
 name = "version_check"
 version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 [[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+[[package]]
+name = "wasip2"
+version = "1.0.1+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+dependencies = [
+ "wit-bindgen",
+]
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+dependencies = [
+ "unicode-ident",
+]
+[[package]]
 name = "web"
 version = "0.1.0"
 [[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+[[package]]
+name = "whoami"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "998767ef88740d1f5b0682a9c53c24431453923962269c2db68ee43788c5a40d"
+[[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "wit-bindgen"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+[[package]]
 name = "writeable"
 version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "zerocopy"
+version = "0.8.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
+dependencies = [
+ "zerocopy-derive",
+]
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+[[package]]
 name = "zerofrom"
 version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Validation for user, repository, and group names.
+//!
+//! One implementation, used by the CLI, the API, and the web UI, so the rules
+//! can never drift between entry points. A valid name matches the regular
+//! expression
+//!
+//! ```text
+//! ^[A-Za-z0-9][A-Za-z0-9._-]{0,38}$
+//! ```
+//!
+//! and additionally must not be `.` or `..`, must not end in `.git` or `.`, and
+//! must not collide with a route-reserved word (see [`RESERVED_NAMES`]). The
+//! same rules apply to usernames, repository names, and group names — anywhere a
+//! name becomes part of a URL path.
+/// The maximum length of a name, in characters (the leading character plus up to
+/// 38 more, matching the `{0,38}` quantifier).
+pub const MAX_NAME_LEN: usize = 39;
+/// Names that would collide with a top-level route or a reserved path segment.
+///
+/// Comparison is case-insensitive, so `Admin` is rejected just as `admin` is.
+pub const RESERVED_NAMES: &[&str] = &[
+    "api", "assets", "login", "logout", "search", "settings", "admin", "static", "healthz",
+    "invite", "-",
+];
+/// Why a candidate name was rejected. Each variant maps to one actionable
+/// message; callers surface the `Display` form to the user.
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+pub enum NameError {
+    /// The name was the empty string.
+    #[error("name must not be empty")]
+    Empty,
+    /// The name exceeded [`MAX_NAME_LEN`] characters.
+    #[error("name must be at most {MAX_NAME_LEN} characters")]
+    TooLong,
+    /// The first character was not an ASCII letter or digit.
+    #[error("name must start with an ASCII letter or digit")]
+    BadStart,
+    /// A character after the first was outside `[A-Za-z0-9._-]`.
+    #[error("name may only contain ASCII letters, digits, '.', '_', or '-' (found {0:?})")]
+    BadChar(char),
+    /// The name was `.` or `..`.
+    #[error("name must not be \".\" or \"..\"")]
+    DotName,
+    /// The name ended in `.git`, which would be ambiguous with a bare repo path.
+    #[error("name must not end in \".git\"")]
+    GitSuffix,
+    /// The name ended in `.`.
+    #[error("name must not end in \".\"")]
+    DotSuffix,
+    /// The name matched a reserved word (case-insensitively).
+    #[error("name {0:?} is reserved")]
+    Reserved(String),
+}
+/// Validate a user, repository, or group name against every rule in this module.
+///
+/// # Errors
+///
+/// Returns the first [`NameError`] that applies. Checks run in a fixed order
+/// (emptiness, dot-names, length, character set, suffixes, reserved words) so a
+/// given input always yields the same error.
+pub fn validate_name(name: &str) -> Result<(), NameError> {
+    if name.is_empty() {
+        return Err(NameError::Empty);
+    }
+    if name == "." || name == ".." {
+        return Err(NameError::DotName);
+    }
+    // ASCII-only past this point is guaranteed by the character checks below, so
+    // counting chars is equivalent to counting bytes for any name that could
+    // pass — but count chars so an over-long multibyte input reports TooLong
+    // rather than a confusing character error.
+    if name.chars().count() > MAX_NAME_LEN {
+        return Err(NameError::TooLong);
+    }
+    let mut chars = name.chars();
+    // `name` is non-empty, so `next` yields.
+    let first = chars.next().unwrap_or('\0');
+    if !first.is_ascii_alphanumeric() {
+        return Err(NameError::BadStart);
+    }
+    for c in chars {
+        if !(c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-')) {
+            return Err(NameError::BadChar(c));
+        }
+    }
+    // Suffix rules. The character checks above guarantee `name` is pure ASCII
+    // here, so byte-slicing for the `.git` comparison lands on a char boundary.
+    if name.ends_with('.') {
+        return Err(NameError::DotSuffix);
+    }
+    if name.len() >= 4 && name[name.len() - 4..].eq_ignore_ascii_case(".git") {
+        return Err(NameError::GitSuffix);
+    }
+    let lower = name.to_ascii_lowercase();
+    if RESERVED_NAMES.contains(&lower.as_str()) {
+        return Err(NameError::Reserved(name.to_string()));
+    }
+    Ok(())
+}
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::panic)]
+    use super::*;
+    #[test]
+    fn accepts_ordinary_names() {
+        for name in [
+            "a", "A", "0", "hanna", "fabrica", "my-repo", "my_repo", "v1.2.3", "a.b_c-d", "Repo123",
+        ] {
+            assert_eq!(validate_name(name), Ok(()), "should accept {name:?}");
+        }
+    }
+    #[test]
+    fn rejects_empty() {
+        assert_eq!(validate_name(""), Err(NameError::Empty));
+    }
+    #[test]
+    fn rejects_dot_names() {
+        assert_eq!(validate_name("."), Err(NameError::DotName));
+        assert_eq!(validate_name(".."), Err(NameError::DotName));
+    }
+    #[test]
+    fn enforces_length_boundary() {
+        let ok = "a".repeat(MAX_NAME_LEN);
+        assert_eq!(
+            validate_name(&ok),
+            Ok(()),
+            "{MAX_NAME_LEN} chars is allowed"
+        );
+        let too_long = "a".repeat(MAX_NAME_LEN + 1);
+        assert_eq!(validate_name(&too_long), Err(NameError::TooLong));
+    }
+    #[test]
+    fn rejects_bad_start() {
+        for name in ["_foo", "-foo", ".foo", "!foo"] {
+            assert_eq!(validate_name(name), Err(NameError::BadStart), "{name:?}");
+        }
+    }
+    #[test]
+    fn rejects_bad_chars() {
+        assert_eq!(validate_name("a b"), Err(NameError::BadChar(' ')));
+        assert_eq!(validate_name("a/b"), Err(NameError::BadChar('/')));
+        assert_eq!(validate_name("a@b"), Err(NameError::BadChar('@')));
+    }
+    #[test]
+    fn rejects_non_ascii() {
+        // A leading non-ASCII letter fails the start check; an interior one fails
+        // the character check.
+        assert_eq!(validate_name("café"), Err(NameError::BadChar('é')));
+        assert!(matches!(
+            validate_name("ünsen"),
+            Err(NameError::BadStart | NameError::BadChar(_))
+        ));
+    }
+    #[test]
+    fn rejects_git_suffix_case_insensitively() {
+        for name in ["repo.git", "repo.GIT", "repo.Git", "x.git"] {
+            assert_eq!(validate_name(name), Err(NameError::GitSuffix), "{name:?}");
+        }
+        // `.git` embedded but not trailing is fine.
+        assert_eq!(validate_name("repo.git.bak"), Ok(()));
+    }
+    #[test]
+    fn rejects_trailing_dot() {
+        assert_eq!(validate_name("repo."), Err(NameError::DotSuffix));
+    }
+    #[test]
+    fn rejects_reserved_case_insensitively() {
+        for name in ["admin", "Admin", "ADMIN", "api", "settings", "healthz"] {
+            assert!(
+                matches!(validate_name(name), Err(NameError::Reserved(_))),
+                "{name:?} should be reserved"
+            );
+        }
+        // A reserved word as a substring is fine.
+        assert_eq!(validate_name("administrator"), Ok(()));
+    }
+}

 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Persistence layer: schema, migrations, and portable queries over SQLite and Postgres.
+//!
+//! # One code path, two backends
+//!
+//! Rather than duplicate every statement per dialect, the store runs over
+//! [`sqlx::Any`]. That is sound here only because we stay inside a deliberately
+//! narrow, portable slice of SQL and mediate the two places the backends
+//! genuinely differ:
+//!
+//! * **Placeholders.** Both SQLite and Postgres accept `$1, $2, …` positional
+//!   placeholders (only MySQL needs `?`), so every query is written once with
+//!   `$N`.
+//! * **Booleans.** Postgres has a real `BOOLEAN`; SQLite stores `INTEGER` 0/1.
+//!   Binding a Rust `bool` encodes correctly for both, but *reading* one back
+//!   differs — a SQLite boolean column decodes as an integer. [`Store::get_bool`]
+//!   is the single place that reconciles this.
+//! * **Timestamps** are `BIGINT` Unix milliseconds UTC everywhere; **ids** are
+//!   lowercase 26-char ULID `TEXT`, lexicographically sortable so they double as
+//!   the default ordering key.
+//!
+//! Migrations live in `migrations/{sqlite,postgres}/NNNN_name.sql`; the matching
+//! set is embedded at build time and selected at runtime by [`Store::migrate`].
+mod repos;
+mod users;
+use std::sync::Once;
+use std::time::{SystemTime, UNIX_EPOCH};
+use sqlx::AnyPool;
+use sqlx::Row;
+use sqlx::any::{AnyPoolOptions, AnyRow};
+use sqlx::migrate::Migrator;
+pub use crate::repos::NewRepo;
+pub use crate::users::NewUser;
+/// Migrations for the SQLite dialect, embedded at build time.
+static SQLITE_MIGRATOR: Migrator = sqlx::migrate!("../../migrations/sqlite");
+/// Migrations for the PostgreSQL dialect, embedded at build time.
+static POSTGRES_MIGRATOR: Migrator = sqlx::migrate!("../../migrations/postgres");
+/// Per-connection SQLite pragmas, applied on every fresh connection. WAL and a
+/// busy timeout let the CLI and a running server share the file; foreign keys
+/// must be turned on explicitly on each connection.
+const SQLITE_PRAGMAS: &[&str] = &[
+    "PRAGMA journal_mode = WAL",
+    "PRAGMA synchronous = NORMAL",
+    "PRAGMA foreign_keys = ON",
+    "PRAGMA busy_timeout = 5000",
+];
+/// Ensure the `Any` driver knows about the SQLite and Postgres backends. Safe to
+/// call repeatedly; the work happens exactly once.
+fn install_drivers() {
+    static ONCE: Once = Once::new();
+    ONCE.call_once(sqlx::any::install_default_drivers);
+}
+/// Which concrete database a [`Store`] is talking to. The value is fixed at
+/// connect time and drives the handful of dialect-dependent decisions.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Backend {
+    /// A SQLite database (file-backed or in-memory).
+    Sqlite,
+    /// A PostgreSQL database.
+    Postgres,
+}
+impl Backend {
+    /// Infer the backend from a connection URL's scheme.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::UnsupportedUrl`] for any scheme other than
+    /// `sqlite:` or `postgres:`/`postgresql:`.
+    pub fn detect(url: &str) -> Result<Self, StoreError> {
+        if url.starts_with("sqlite:") {
+            Ok(Self::Sqlite)
+        } else if url.starts_with("postgres:") || url.starts_with("postgresql:") {
+            Ok(Self::Postgres)
+        } else {
+            Err(StoreError::UnsupportedUrl {
+                url: url.to_string(),
+            })
+        }
+    }
+}
+/// An error from the persistence layer.
+#[derive(Debug, thiserror::Error)]
+pub enum StoreError {
+    /// The connection URL used an unrecognized scheme.
+    #[error("unsupported database URL {url:?}: expected a sqlite: or postgres: scheme")]
+    UnsupportedUrl {
+        /// The offending URL. Connection URLs can carry credentials, so callers
+        /// should avoid surfacing this verbatim to end users.
+        url: String,
+    },
+    /// A query or connection failed. Boxed to keep [`StoreError`] small.
+    #[error(transparent)]
+    Query(#[from] Box<sqlx::Error>),
+    /// A migration failed to apply.
+    #[error(transparent)]
+    Migrate(#[from] sqlx::migrate::MigrateError),
+    /// A name failed validation before it could be written.
+    #[error("invalid name: {0}")]
+    Name(#[from] model::NameError),
+    /// A uniqueness constraint was violated (e.g. a duplicate username).
+    #[error("{entity} already exists with that {field}")]
+    Conflict {
+        /// The kind of entity that collided (`"user"`, `"repo"`, …).
+        entity: &'static str,
+        /// The field whose uniqueness was violated.
+        field: &'static str,
+    },
+}
+impl From<sqlx::Error> for StoreError {
+    fn from(err: sqlx::Error) -> Self {
+        Self::Query(Box::new(err))
+    }
+}
+/// A handle to the database: a connection pool plus the backend it targets.
+///
+/// Cloneable and cheap to share — the underlying pool is reference-counted.
+#[derive(Debug, Clone)]
+pub struct Store {
+    pool: AnyPool,
+    backend: Backend,
+}
+impl Store {
+    /// Open a pool against `url`, applying SQLite pragmas when appropriate.
+    ///
+    /// File-backed SQLite URLs are created if missing. This does **not** run
+    /// migrations — call [`Store::migrate`] separately so `--no-migrate` can skip
+    /// it.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::UnsupportedUrl`] for an unknown scheme, or
+    /// [`StoreError::Query`] if the pool cannot be established.
+    pub async fn connect(url: &str, max_connections: u32) -> Result<Self, StoreError> {
+        install_drivers();
+        let backend = Backend::detect(url)?;
+        let url = normalize_url(url, backend);
+        let mut options = AnyPoolOptions::new().max_connections(max_connections.max(1));
+        if backend == Backend::Sqlite {
+            options = options.after_connect(|conn, _meta| {
+                Box::pin(async move {
+                    for pragma in SQLITE_PRAGMAS {
+                        sqlx::query(*pragma).execute(&mut *conn).await?;
+                    }
+                    Ok(())
+                })
+            });
+        }
+        let pool = options.connect(&url).await.map_err(Box::new)?;
+        Ok(Self { pool, backend })
+    }
+    /// Wrap an already-open pool. Primarily a test seam.
+    ///
+    /// The `backend` must match the pool's actual driver, or dialect-dependent
+    /// decoding (booleans) will misbehave.
+    #[must_use]
+    pub fn from_pool(pool: AnyPool, backend: Backend) -> Self {
+        Self { pool, backend }
+    }
+    /// The backend this store targets.
+    #[must_use]
+    pub fn backend(&self) -> Backend {
+        self.backend
+    }
+    /// The underlying connection pool, for callers that need raw access.
+    #[must_use]
+    pub fn pool(&self) -> &AnyPool {
+        &self.pool
+    }
+    /// Apply all pending migrations for this backend's dialect.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Migrate`] if a migration fails or the recorded
+    /// history is inconsistent with the embedded set.
+    pub async fn migrate(&self) -> Result<(), StoreError> {
+        let migrator = match self.backend {
+            Backend::Sqlite => &SQLITE_MIGRATOR,
+            Backend::Postgres => &POSTGRES_MIGRATOR,
+        };
+        migrator.run(&self.pool).await?;
+        Ok(())
+    }
+    /// Read a boolean column, bridging SQLite's integer storage and Postgres's
+    /// native `BOOLEAN`. This is the one place the two dialects' boolean
+    /// representations are reconciled on the read path.
+    fn get_bool(&self, row: &AnyRow, column: &str) -> Result<bool, sqlx::Error> {
+        match self.backend {
+            Backend::Sqlite => Ok(row.try_get::<i64, _>(column)? != 0),
+            Backend::Postgres => row.try_get::<bool, _>(column),
+        }
+    }
+}
+/// Generate a fresh identifier: a lowercase, 26-character ULID. ULIDs are
+/// lexicographically sortable by creation time, so they double as an ordering
+/// key and never need a separate sequence.
+fn new_id() -> String {
+    ulid::Ulid::new().to_string().to_lowercase()
+}
+/// The current time as Unix milliseconds UTC, matching the schema's `BIGINT`
+/// timestamp columns. Clamps rather than panicking on the impossible cases (a
+/// clock before the epoch, or a time past year 292-million).
+fn now_ms() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |d| i64::try_from(d.as_millis()).unwrap_or(i64::MAX))
+}
+/// Ensure a file-backed SQLite URL will create its database if absent. In-memory
+/// URLs and any URL that already specifies a `mode` are left untouched.
+fn normalize_url(url: &str, backend: Backend) -> String {
+    if backend == Backend::Sqlite && !url.contains(":memory:") && !url.contains("mode=") {
+        let separator = if url.contains('?') { '&' } else { '?' };
+        format!("{url}{separator}mode=rwc")
+    } else {
+        url.to_string()
+    }
+}
+/// Map a failed write to [`StoreError::Conflict`] when it was a uniqueness
+/// violation, attributing it to the first matching field. Any other error is
+/// passed through unchanged.
+///
+/// `needles` pairs a lowercase substring to look for in the violated
+/// constraint's name/message with the field label to report. The database's
+/// error text names the offending column (`users.email_lower`, or a Postgres
+/// constraint like `users_email_lower_key`), so a substring match reliably
+/// identifies the field across both dialects.
+fn map_conflict(
+    err: sqlx::Error,
+    entity: &'static str,
+    needles: &[(&str, &'static str)],
+) -> StoreError {
+    if let sqlx::Error::Database(db) = &err
+        && db.is_unique_violation()
+    {
+        let haystack = format!("{} {}", db.constraint().unwrap_or(""), db.message()).to_lowercase();
+        let field = needles
+            .iter()
+            .find(|(needle, _)| haystack.contains(needle))
+            .map_or("value", |(_, field)| *field);
+        return StoreError::Conflict { entity, field };
+    }
+    err.into()
+}
+#[cfg(test)]
+mod tests;

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Repositories: creation and path lookup.
+use model::Repo;
+use sqlx::any::AnyRow;
+use sqlx::{AssertSqlSafe, Row};
+use crate::{Store, StoreError, map_conflict, new_id, now_ms};
+/// The columns of `repos` in a fixed order, shared by every `SELECT`.
+const REPO_COLUMNS: &str = "id, owner_id, group_id, name, path, description, is_private, \
+     default_branch, archived_at, size_bytes, pushed_at, created_at, updated_at";
+/// Fields needed to create a repository. The server fills in the id, timestamps,
+/// and the derived size/push bookkeeping.
+#[derive(Debug, Clone)]
+pub struct NewRepo {
+    /// Owning user id.
+    pub owner_id: String,
+    /// Containing group id, or `None` when the repo hangs directly off the owner.
+    pub group_id: Option<String>,
+    /// The repo's own name; validated with [`model::validate_name`].
+    pub name: String,
+    /// Materialized full path within the owner (`group/sub/repo`, or just `name`).
+    pub path: String,
+    /// Optional one-line description.
+    pub description: Option<String>,
+    /// Whether the repo is private (invisible to non-collaborators).
+    pub is_private: bool,
+    /// The repo's default branch.
+    pub default_branch: String,
+}
+impl Store {
+    /// Create a repository, returning the persisted row.
+    ///
+    /// # Errors
+    ///
+    /// * [`StoreError::Name`] if the repo name is invalid.
+    /// * [`StoreError::Conflict`] if the owner already has a repo at that path.
+    /// * [`StoreError::Query`] for any other database failure.
+    pub async fn create_repo(&self, new: NewRepo) -> Result<Repo, StoreError> {
+        model::validate_name(&new.name)?;
+        let now = now_ms();
+        let repo = Repo {
+            id: new_id(),
+            owner_id: new.owner_id,
+            group_id: new.group_id,
+            name: new.name,
+            path: new.path,
+            description: new.description,
+            is_private: new.is_private,
+            default_branch: new.default_branch,
+            archived_at: None,
+            size_bytes: 0,
+            pushed_at: None,
+            created_at: now,
+            updated_at: now,
+        };
+        let sql = "INSERT INTO repos \
+             (id, owner_id, group_id, name, path, description, is_private, default_branch, \
+              archived_at, size_bytes, pushed_at, created_at, updated_at) \
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)";
+        sqlx::query(sql)
+            .bind(repo.id.clone())
+            .bind(repo.owner_id.clone())
+            .bind(repo.group_id.clone())
+            .bind(repo.name.clone())
+            .bind(repo.path.clone())
+            .bind(repo.description.clone())
+            .bind(repo.is_private)
+            .bind(repo.default_branch.clone())
+            .bind(repo.archived_at)
+            .bind(repo.size_bytes)
+            .bind(repo.pushed_at)
+            .bind(repo.created_at)
+            .bind(repo.updated_at)
+            .execute(&self.pool)
+            .await
+            .map_err(|e| map_conflict(e, "repo", &[("path", "path")]))?;
+        Ok(repo)
+    }
+    /// Resolve a repository by `(owner_id, path)`, or `None` if absent. This is
+    /// the authoritative name→repo lookup; the on-disk tree is keyed by id.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn repo_by_owner_path(
+        &self,
+        owner_id: &str,
+        path: &str,
+    ) -> Result<Option<Repo>, StoreError> {
+        let sql = format!("SELECT {REPO_COLUMNS} FROM repos WHERE owner_id = $1 AND path = $2");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(owner_id)
+            .bind(path)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(|r| self.map_repo(r)).transpose()?)
+    }
+    /// Map a `repos` row (selected via [`REPO_COLUMNS`]) to a [`Repo`].
+    fn map_repo(&self, row: &AnyRow) -> Result<Repo, sqlx::Error> {
+        Ok(Repo {
+            id: row.try_get("id")?,
+            owner_id: row.try_get("owner_id")?,
+            group_id: row.try_get("group_id")?,
+            name: row.try_get("name")?,
+            path: row.try_get("path")?,
+            description: row.try_get("description")?,
+            is_private: self.get_bool(row, "is_private")?,
+            default_branch: row.try_get("default_branch")?,
+            archived_at: row.try_get("archived_at")?,
+            size_bytes: row.try_get("size_bytes")?,
+            pushed_at: row.try_get("pushed_at")?,
+            created_at: row.try_get("created_at")?,
+            updated_at: row.try_get("updated_at")?,
+        })
+    }
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Store tests. The portable behaviour runs against SQLite both in-memory and
+//! file-backed; the same round-trips run against Postgres when the
+//! `postgres-tests` feature is enabled and `FABRICA_TEST_POSTGRES_URL` is set.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+use tempfile::TempDir;
+use super::{Backend, NewRepo, NewUser, Store, StoreError};
+/// A migrated store plus any temp directory that must outlive it.
+struct Fixture {
+    store: Store,
+    _dir: Option<TempDir>,
+}
+/// A migrated in-memory SQLite store. A single connection keeps the database
+/// alive for the life of the pool.
+async fn memory_store() -> Fixture {
+    let store = Store::connect("sqlite::memory:", 1).await.unwrap();
+    store.migrate().await.unwrap();
+    Fixture { store, _dir: None }
+}
+/// A migrated file-backed SQLite store in a fresh temp directory.
+async fn file_store() -> Fixture {
+    let dir = tempfile::tempdir().unwrap();
+    let url = format!("sqlite://{}", dir.path().join("fabrica.db").display());
+    let store = Store::connect(&url, 5).await.unwrap();
+    store.migrate().await.unwrap();
+    Fixture {
+        store,
+        _dir: Some(dir),
+    }
+}
+/// Both SQLite flavours the portable tests must pass against.
+async fn sqlite_fixtures() -> Vec<Fixture> {
+    vec![memory_store().await, file_store().await]
+}
+fn sample_user(username: &str, email: &str) -> NewUser {
+    NewUser {
+        username: username.to_string(),
+        email: email.to_string(),
+        display_name: Some("Sample".to_string()),
+        password_hash: None,
+        is_admin: false,
+        must_change_password: false,
+    }
+}
+#[tokio::test]
+async fn migrations_are_idempotent() {
+    for fx in sqlite_fixtures().await {
+        // A second run over the already-migrated database is a no-op.
+        fx.store.migrate().await.unwrap();
+    }
+}
+#[tokio::test]
+async fn create_and_fetch_user() {
+    for fx in sqlite_fixtures().await {
+        let created = fx
+            .store
+            .create_user(sample_user("hanna", "hanna@example.com"))
+            .await
+            .unwrap();
+        assert_eq!(created.id.len(), 26, "id should be a 26-char ULID");
+        assert_eq!(created.created_at, created.updated_at);
+        let by_id = fx.store.user_by_id(&created.id).await.unwrap().unwrap();
+        assert_eq!(by_id, created);
+        // Username lookup is case-insensitive.
+        let by_name = fx.store.user_by_username("HANNA").await.unwrap().unwrap();
+        assert_eq!(by_name, created);
+        assert!(fx.store.user_by_id("nope").await.unwrap().is_none());
+        assert!(fx.store.user_by_username("ghost").await.unwrap().is_none());
+    }
+}
+#[tokio::test]
+async fn duplicate_username_conflicts_case_insensitively() {
+    for fx in sqlite_fixtures().await {
+        fx.store
+            .create_user(sample_user("dup", "a@example.com"))
+            .await
+            .unwrap();
+        let err = fx
+            .store
+            .create_user(sample_user("DUP", "b@example.com"))
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(
+                err,
+                StoreError::Conflict {
+                    entity: "user",
+                    field: "username"
+                }
+            ),
+            "got {err:?}"
+        );
+    }
+}
+#[tokio::test]
+async fn duplicate_email_conflicts_case_insensitively() {
+    for fx in sqlite_fixtures().await {
+        fx.store
+            .create_user(sample_user("one", "same@example.com"))
+            .await
+            .unwrap();
+        let err = fx
+            .store
+            .create_user(sample_user("two", "SAME@example.com"))
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(
+                err,
+                StoreError::Conflict {
+                    entity: "user",
+                    field: "email"
+                }
+            ),
+            "got {err:?}"
+        );
+    }
+}
+#[tokio::test]
+async fn invalid_username_is_rejected_before_insert() {
+    for fx in sqlite_fixtures().await {
+        let err = fx
+            .store
+            .create_user(sample_user("bad name", "x@example.com"))
+            .await
+            .unwrap_err();
+        assert!(matches!(err, StoreError::Name(_)), "got {err:?}");
+    }
+}
+#[tokio::test]
+async fn booleans_round_trip() {
+    for fx in sqlite_fixtures().await {
+        let boss = fx
+            .store
+            .create_user(NewUser {
+                is_admin: true,
+                must_change_password: true,
+                ..sample_user("boss", "boss@example.com")
+            })
+            .await
+            .unwrap();
+        assert!(boss.is_admin);
+        assert!(boss.must_change_password);
+        let fetched = fx.store.user_by_id(&boss.id).await.unwrap().unwrap();
+        assert!(fetched.is_admin, "is_admin must survive the round-trip");
+        assert!(fetched.must_change_password);
+        // And the default-false path.
+        let plain = fx.store.user_by_username("boss").await.unwrap();
+        assert!(plain.is_some());
+        let normal = fx
+            .store
+            .create_user(sample_user("normal", "normal@example.com"))
+            .await
+            .unwrap();
+        let normal = fx.store.user_by_id(&normal.id).await.unwrap().unwrap();
+        assert!(!normal.is_admin);
+        assert!(!normal.must_change_password);
+    }
+}
+#[tokio::test]
+async fn create_and_fetch_repo() {
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("owner", "owner@example.com"))
+            .await
+            .unwrap();
+        let repo = fx
+            .store
+            .create_repo(NewRepo {
+                owner_id: owner.id.clone(),
+                group_id: None,
+                name: "project".to_string(),
+                path: "project".to_string(),
+                description: Some("a repo".to_string()),
+                is_private: false,
+                default_branch: "main".to_string(),
+            })
+            .await
+            .unwrap();
+        assert_eq!(repo.size_bytes, 0);
+        assert!(repo.pushed_at.is_none());
+        assert!(!repo.is_private);
+        let fetched = fx
+            .store
+            .repo_by_owner_path(&owner.id, "project")
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(fetched, repo);
+        // Same owner, same path collides.
+        let err = fx
+            .store
+            .create_repo(NewRepo {
+                owner_id: owner.id.clone(),
+                group_id: None,
+                name: "project".to_string(),
+                path: "project".to_string(),
+                description: None,
+                is_private: true,
+                default_branch: "main".to_string(),
+            })
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(
+                err,
+                StoreError::Conflict {
+                    entity: "repo",
+                    field: "path"
+                }
+            ),
+            "got {err:?}"
+        );
+    }
+}
+#[tokio::test]
+async fn foreign_keys_are_enforced() {
+    // A repo whose owner does not exist must be rejected — proof the SQLite
+    // `foreign_keys` pragma took effect on the pooled connection.
+    for fx in sqlite_fixtures().await {
+        let err = fx
+            .store
+            .create_repo(NewRepo {
+                owner_id: "no-such-owner".to_string(),
+                group_id: None,
+                name: "orphan".to_string(),
+                path: "orphan".to_string(),
+                description: None,
+                is_private: true,
+                default_branch: "main".to_string(),
+            })
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(err, StoreError::Query(_)),
+            "expected a database (FK) error, got {err:?}"
+        );
+    }
+}
+#[test]
+fn unsupported_url_is_rejected() {
+    let err = Backend::detect("mysql://localhost/db").unwrap_err();
+    assert!(
+        matches!(err, StoreError::UnsupportedUrl { .. }),
+        "got {err:?}"
+    );
+    assert_eq!(Backend::detect("sqlite::memory:").unwrap(), Backend::Sqlite);
+    assert_eq!(
+        Backend::detect("postgres://localhost/db").unwrap(),
+        Backend::Postgres
+    );
+    assert_eq!(
+        Backend::detect("postgresql://localhost/db").unwrap(),
+        Backend::Postgres
+    );
+}
+/// The two dialects' initial migrations must define the same tables with the
+/// same columns in the same order — a hermetic check that needs no database.
+/// The only sanctioned differences are the boolean column type and dialect
+/// punctuation.
+#[test]
+fn schema_files_are_equivalent() {
+    let sqlite = include_str!("../../../migrations/sqlite/0001_init.sql");
+    let postgres = include_str!("../../../migrations/postgres/0001_init.sql");
+    assert_eq!(
+        columns_by_table(sqlite),
+        columns_by_table(postgres),
+        "SQLite and Postgres schemas must define identical tables and columns"
+    );
+    // The boolean columns must use the dialect-appropriate storage type.
+    for column in ["must_change_password", "is_admin", "is_private"] {
+        assert!(
+            column_line(sqlite, column).contains("INTEGER"),
+            "SQLite {column} should be INTEGER"
+        );
+        assert!(
+            column_line(postgres, column).contains("BOOLEAN"),
+            "Postgres {column} should be BOOLEAN"
+        );
+    }
+}
+/// Extract, per table, the ordered list of column names from a migration file.
+/// Relies on the house style: each column on its own line beginning with the
+/// column name, table-level constraints beginning with an uppercase keyword.
+fn columns_by_table(sql: &str) -> std::collections::BTreeMap<String, Vec<String>> {
+    const CONSTRAINT_KEYWORDS: &[&str] = &["UNIQUE", "PRIMARY", "FOREIGN", "CHECK", "CONSTRAINT"];
+    let mut tables = std::collections::BTreeMap::new();
+    let mut current: Option<(String, Vec<String>)> = None;
+    for raw in sql.lines() {
+        let line = raw.trim();
+        if let Some(rest) = line.strip_prefix("CREATE TABLE ") {
+            let name = rest.trim_end_matches(" (").trim_end_matches('(').trim();
+            current = Some((name.to_string(), Vec::new()));
+            continue;
+        }
+        let Some((name, cols)) = current.as_mut() else {
+            continue;
+        };
+        if line.starts_with(')') {
+            let (name, cols) = current.take().expect("current table");
+            tables.insert(name, cols);
+            continue;
+        }
+        // A column line starts with an identifier; skip blanks, comments, and
+        // table-level constraints.
+        let first = line.split([' ', '\t']).next().unwrap_or("");
+        if first.is_empty()
+            || line.starts_with("--")
+            || CONSTRAINT_KEYWORDS.contains(&first.to_ascii_uppercase().as_str())
+        {
+            let _ = name;
+            continue;
+        }
+        cols.push(first.to_string());
+    }
+    tables
+}
+/// Return the first line defining `column` (for type assertions).
+fn column_line<'a>(sql: &'a str, column: &str) -> &'a str {
+    sql.lines()
+        .map(str::trim)
+        .find(|line| line.split([' ', '\t']).next() == Some(column))
+        .unwrap_or("")
+}
+/// Postgres round-trips, mirroring the SQLite ones. Ignored unless the
+/// `postgres-tests` feature is on and `FABRICA_TEST_POSTGRES_URL` points at a
+/// reachable database; the test cleans up the rows it creates so it can rerun.
+#[tokio::test]
+#[cfg_attr(
+    not(feature = "postgres-tests"),
+    ignore = "enable the postgres-tests feature and set FABRICA_TEST_POSTGRES_URL"
+)]
+async fn postgres_round_trip() {
+    let Ok(url) = std::env::var("FABRICA_TEST_POSTGRES_URL") else {
+        eprintln!("skipping postgres_round_trip: FABRICA_TEST_POSTGRES_URL not set");
+        return;
+    };
+    let store = Store::connect(&url, 5).await.unwrap();
+    assert_eq!(store.backend(), Backend::Postgres);
+    store.migrate().await.unwrap();
+    // Unique names so repeated runs against a shared database don't collide.
+    let suffix = super::new_id();
+    let username = format!("pg{suffix}");
+    let email = format!("{suffix}@example.com");
+    let admin = store
+        .create_user(NewUser {
+            is_admin: true,
+            must_change_password: true,
+            ..sample_user(&username, &email)
+        })
+        .await
+        .unwrap();
+    let fetched = store.user_by_id(&admin.id).await.unwrap().unwrap();
+    assert_eq!(fetched, admin);
+    assert!(fetched.is_admin, "native BOOLEAN must decode as true");
+    assert!(fetched.must_change_password);
+    let repo = store
+        .create_repo(NewRepo {
+            owner_id: admin.id.clone(),
+            group_id: None,
+            name: "pgproj".to_string(),
+            path: "pgproj".to_string(),
+            description: None,
+            is_private: false,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    let fetched_repo = store
+        .repo_by_owner_path(&admin.id, "pgproj")
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(fetched_repo, repo);
+    assert!(!fetched_repo.is_private);
+    // Clean up (repo cascades with the user).
+    sqlx::query("DELETE FROM users WHERE id = $1")
+        .bind(&admin.id)
+        .execute(store.pool())
+        .await
+        .unwrap();
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! User accounts: creation and lookup.
+use model::User;
+use sqlx::any::AnyRow;
+use sqlx::{AssertSqlSafe, Row};
+use crate::{Store, StoreError, map_conflict, new_id, now_ms};
+/// The columns of `users` in a fixed order, shared by every `SELECT` so the
+/// row-mapping in [`Store::map_user`] can rely on names.
+const USER_COLUMNS: &str = "id, username, email, display_name, password_hash, \
+     must_change_password, is_admin, disabled_at, created_at, updated_at";
+/// Fields needed to create a user. The server fills in the id, timestamps, and
+/// the normalized `*_lower` uniqueness keys.
+#[derive(Debug, Clone)]
+pub struct NewUser {
+    /// Login name; validated with [`model::validate_name`] before insert.
+    pub username: String,
+    /// Primary email address.
+    pub email: String,
+    /// Optional display name.
+    pub display_name: Option<String>,
+    /// Argon2id PHC hash, or `None` for an account awaiting invite completion.
+    pub password_hash: Option<String>,
+    /// Whether the account is a site administrator.
+    pub is_admin: bool,
+    /// Whether the user must change their password on next login.
+    pub must_change_password: bool,
+}
+impl Store {
+    /// Create a user, returning the persisted row.
+    ///
+    /// The username is validated and case-folded for uniqueness; the email is
+    /// likewise unique case-insensitively.
+    ///
+    /// # Errors
+    ///
+    /// * [`StoreError::Name`] if the username is invalid.
+    /// * [`StoreError::Conflict`] if the username or email is already taken.
+    /// * [`StoreError::Query`] for any other database failure.
+    pub async fn create_user(&self, new: NewUser) -> Result<User, StoreError> {
+        model::validate_name(&new.username)?;
+        let now = now_ms();
+        let user = User {
+            id: new_id(),
+            username: new.username,
+            email: new.email,
+            display_name: new.display_name,
+            password_hash: new.password_hash,
+            must_change_password: new.must_change_password,
+            is_admin: new.is_admin,
+            disabled_at: None,
+            created_at: now,
+            updated_at: now,
+        };
+        let sql = "INSERT INTO users \
+             (id, username, username_lower, email, email_lower, display_name, \
+              password_hash, must_change_password, is_admin, disabled_at, created_at, updated_at) \
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)";
+        sqlx::query(sql)
+            .bind(user.id.clone())
+            .bind(user.username.clone())
+            .bind(user.username.to_lowercase())
+            .bind(user.email.clone())
+            .bind(user.email.to_lowercase())
+            .bind(user.display_name.clone())
+            .bind(user.password_hash.clone())
+            .bind(user.must_change_password)
+            .bind(user.is_admin)
+            .bind(user.disabled_at)
+            .bind(user.created_at)
+            .bind(user.updated_at)
+            .execute(&self.pool)
+            .await
+            .map_err(|e| {
+                map_conflict(e, "user", &[("email", "email"), ("username", "username")])
+            })?;
+        Ok(user)
+    }
+    /// Fetch a user by id, or `None` if there is no such user.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn user_by_id(&self, id: &str) -> Result<Option<User>, StoreError> {
+        let sql = format!("SELECT {USER_COLUMNS} FROM users WHERE id = $1");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(id)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(|r| self.map_user(r)).transpose()?)
+    }
+    /// Fetch a user by username, case-insensitively, or `None` if absent.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn user_by_username(&self, username: &str) -> Result<Option<User>, StoreError> {
+        let sql = format!("SELECT {USER_COLUMNS} FROM users WHERE username_lower = $1");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(username.to_lowercase())
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(|r| self.map_user(r)).transpose()?)
+    }
+    /// Map a `users` row (selected via [`USER_COLUMNS`]) to a [`User`].
+    fn map_user(&self, row: &AnyRow) -> Result<User, sqlx::Error> {
+        Ok(User {
+            id: row.try_get("id")?,
+            username: row.try_get("username")?,
+            email: row.try_get("email")?,
+            display_name: row.try_get("display_name")?,
+            password_hash: row.try_get("password_hash")?,
+            must_change_password: self.get_bool(row, "must_change_password")?,
+            is_admin: self.get_bool(row, "is_admin")?,
+            disabled_at: row.try_get("disabled_at")?,
+            created_at: row.try_get("created_at")?,
+            updated_at: row.try_get("updated_at")?,
+        })
+    }
+}

           craneLib = (inputs.crane.mkLib pkgs).overrideToolchain fenixToolchain;
+          # Keep `.sql` migration files in the build source: the `store` crate
+          # embeds them via `sqlx::migrate!` (and reads them in tests), and
+          # crane's default cargo-source filter would strip them.
+          src = pkgs.lib.cleanSourceWith {
+            src = ./.;
+            name = "source";
+            filter =
+              path: type:
+              (builtins.match ".*\\.sql$" path != null) || (craneLib.filterCargoSources path type);
+          };
           commonArgs = {
-            src = craneLib.cleanCargoSource ./.;
+            inherit src;
             strictDeps = true;
             nativeBuildInputs = [
               pkgs.pkg-config

+-- This Source Code Form is subject to the terms of the Mozilla Public
+-- License, v. 2.0. If a copy of the MPL was not distributed with this
+-- file, You can obtain one at https://mozilla.org/MPL/2.0/.
+-- Initial schema (PostgreSQL dialect).
+--
+-- This must stay structurally equivalent to migrations/sqlite/0001_init.sql;
+-- the only permitted differences are the boolean column type (BOOLEAN here,
+-- INTEGER 0/1 there) and dialect punctuation. Timestamps are BIGINT Unix
+-- milliseconds UTC; identifiers are 26-char ULID TEXT (lexicographically
+-- sortable — order by them). Case-insensitive uniqueness is enforced with a
+-- normalized `*_lower` column plus a unique index, never collation.
+CREATE TABLE users (
+    id                   TEXT PRIMARY KEY,
+    username             TEXT NOT NULL,
+    username_lower       TEXT NOT NULL UNIQUE,
+    email                TEXT NOT NULL,
+    email_lower          TEXT NOT NULL UNIQUE,
+    display_name         TEXT,
+    password_hash        TEXT,               -- NULL until an invite is completed
+    must_change_password BOOLEAN NOT NULL DEFAULT FALSE,
+    is_admin             BOOLEAN NOT NULL DEFAULT FALSE,
+    disabled_at          BIGINT,
+    created_at           BIGINT NOT NULL,
+    updated_at           BIGINT NOT NULL
+);
+CREATE TABLE invites (
+    id         TEXT PRIMARY KEY,
+    user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    token_hash TEXT NOT NULL UNIQUE,         -- SHA-256 of the emailed token
+    purpose    TEXT NOT NULL,                -- 'activate' | 'reset'
+    expires_at BIGINT NOT NULL,
+    used_at    BIGINT,
+    created_at BIGINT NOT NULL
+);
+CREATE TABLE sessions (
+    id           TEXT PRIMARY KEY,           -- SHA-256 of the cookie value
+    user_id      TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    user_agent   TEXT,
+    ip           TEXT,
+    created_at   BIGINT NOT NULL,
+    last_seen_at BIGINT NOT NULL,
+    expires_at   BIGINT NOT NULL
+);
+CREATE TABLE api_tokens (
+    id           TEXT PRIMARY KEY,           -- the JWT `jti`
+    user_id      TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    name         TEXT NOT NULL,
+    scopes       TEXT NOT NULL,              -- comma-separated
+    expires_at   BIGINT,
+    revoked_at   BIGINT,
+    last_used_at BIGINT,
+    created_at   BIGINT NOT NULL
+);
+CREATE TABLE keys (
+    id           TEXT PRIMARY KEY,
+    user_id      TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    kind         TEXT NOT NULL,              -- 'ssh' | 'gpg'
+    name         TEXT,
+    fingerprint  TEXT NOT NULL,              -- SHA256:… for ssh, full hex fp for gpg
+    public_key   TEXT NOT NULL,              -- authorized_keys line or armored pgp block
+    ordinal      INTEGER NOT NULL,           -- stable 1-based index per (user, kind)
+    last_used_at BIGINT,
+    created_at   BIGINT NOT NULL,
+    UNIQUE (kind, fingerprint),
+    UNIQUE (user_id, kind, ordinal)
+);
+CREATE TABLE groups (
+    id          TEXT PRIMARY KEY,
+    owner_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    parent_id   TEXT REFERENCES groups(id) ON DELETE CASCADE,
+    name        TEXT NOT NULL,
+    path        TEXT NOT NULL,               -- materialized 'group/sub/leaf'
+    description TEXT,
+    created_at  BIGINT NOT NULL,
+    UNIQUE (owner_id, path)
+);
+CREATE TABLE repos (
+    id             TEXT PRIMARY KEY,
+    owner_id       TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    group_id       TEXT REFERENCES groups(id) ON DELETE SET NULL,
+    name           TEXT NOT NULL,
+    path           TEXT NOT NULL,            -- materialized 'group/sub/repo' (== name when ungrouped)
+    description    TEXT,
+    is_private     BOOLEAN NOT NULL DEFAULT TRUE,
+    default_branch TEXT NOT NULL,
+    archived_at    BIGINT,
+    size_bytes     BIGINT NOT NULL DEFAULT 0,
+    pushed_at      BIGINT,
+    created_at     BIGINT NOT NULL,
+    updated_at     BIGINT NOT NULL,
+    UNIQUE (owner_id, path)
+);
+CREATE TABLE repo_collaborators (
+    repo_id    TEXT NOT NULL REFERENCES repos(id) ON DELETE CASCADE,
+    user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    permission TEXT NOT NULL,                -- 'read' | 'write' | 'admin'
+    created_at BIGINT NOT NULL,
+    PRIMARY KEY (repo_id, user_id)
+);
+-- Reserved and inert until the CI ships (phase 18+). No behaviour reads these
+-- yet; they exist so the seams are stable.
+CREATE TABLE runs (
+    id          TEXT PRIMARY KEY,
+    repo_id     TEXT NOT NULL,
+    ref         TEXT NOT NULL,
+    commit_sha  TEXT NOT NULL,
+    status      TEXT NOT NULL,
+    started_at  BIGINT,
+    finished_at BIGINT,
+    created_at  BIGINT NOT NULL
+);
+CREATE TABLE jobs (
+    id          TEXT PRIMARY KEY,
+    run_id      TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+    stage       TEXT NOT NULL,
+    name        TEXT NOT NULL,
+    status      TEXT NOT NULL,
+    log_path    TEXT,
+    started_at  BIGINT,
+    finished_at BIGINT
+);
+-- Indexes. The UNIQUE(owner_id, path) constraint on repos already provides the
+-- (owner_id, path) lookup index, so it is not repeated here.
+CREATE INDEX idx_repos_visibility_pushed ON repos (is_private, pushed_at DESC);
+CREATE INDEX idx_groups_owner_parent     ON groups (owner_id, parent_id);
+CREATE INDEX idx_keys_user_kind          ON keys (user_id, kind);
+CREATE INDEX idx_sessions_user           ON sessions (user_id);
+CREATE INDEX idx_sessions_expires        ON sessions (expires_at);
+CREATE INDEX idx_api_tokens_user         ON api_tokens (user_id);