hanna/fabrica

feat(store): add schema, migrations, and portable SQLite/Postgres store

9458665 · hanna committed on 2026-07-25

Implements phase 3. The store runs over a single `sqlx::Any` pool with every
statement written once in the portable SQL subset; the three dialect
differences are mediated explicitly — `$1,$2` placeholders (both backends
accept them), booleans bound as `bool` and read back through `get_bool`
(SQLite INTEGER vs Postgres BOOLEAN), and BIGINT-ms / TEXT-ULID columns that
are already portable.

- model: single-source name validation (`validate_name`, reserved list) plus
  `User`/`Repo` domain types, with exhaustive validation tests.
- store: `Backend` detection, SQLite pragmas (WAL, foreign_keys, busy_timeout)
  applied per connection, embedded per-dialect migrators selected at runtime,
  `create_user`/`create_repo` with unique-violation → `Conflict` mapping, and
  lookups.
- migrations: full schema for both dialects (users, invites, sessions,
  api_tokens, keys, groups, repos, repo_collaborators, plus inert runs/jobs)
  and the indexes from the spec.
- tests: run against SQLite in-memory and file-backed; a hermetic
  schema-equivalence check across dialects; Postgres round-trips gated behind
  `postgres-tests` + FABRICA_TEST_POSTGRES_URL.
- build(nix): keep `.sql` files in the crane build source so `sqlx::migrate!`
  can embed them.

sqlx is built with no TLS backend for now (keeps `ring` out of the graph and
cargo-deny's license set clean); revisit for remote Postgres in phase 17.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +1041 −5

Cargo.toml +14 −0

crates/model/Cargo.toml +1 −0

crates/model/src/entity.rs +75 −0

crates/model/src/lib.rs +10 −0

crates/model/src/name.rs +201 −0

crates/store/Cargo.toml +12 −0

crates/store/src/lib.rs +267 −0

crates/store/src/repos.rs +127 −0

crates/store/src/tests.rs +424 −0

crates/store/src/users.rs +132 −0

flake.nix +12 −1

migrations/postgres/0001_init.sql +141 −0

migrations/sqlite/0001_init.sql +141 −0

@@ @@ -58,6 +58,20 @@ thiserror = "2" @@
 url = "2"
 clap = { version = "4", features = ["derive"] }
 anyhow = "1"
 # Database. `any` gives one code path over both backends; TLS is deliberately
 # omitted for now (Postgres-over-TLS is a phase-17 deployment concern) to keep
 # the dependency tree small and the license set clean — see docs/decisions.md.
 sqlx = { version = "0.9", default-features = false, features = [
     "runtime-tokio",
     "any",
     "sqlite",
     "postgres",
     "migrate",
     "macros",
 ] }
 ulid = "1"
 tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
 tempfile = "3"
 [workspace.lints.rust]
 unsafe_code = "forbid"

@@ @@ -10,6 +10,7 @@ repository.workspace = true @@
 publish.workspace = true
 [dependencies]
 thiserror = { workspace = true }
 [lints]
 workspace = true

@@ @@ -0,0 +1,75 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! In-memory representations of the persisted entities.
 //!
 //! These are plain data types with no behaviour and no I/O — [`crate::store`]
 //! (the `store` crate) is responsible for reading and writing them. Timestamps
 //! are Unix milliseconds UTC ([`Timestamp`]); identifiers are ULID strings.
 //!
 //! Storage-only columns (the normalized `*_lower` uniqueness keys) are
 //! deliberately absent: they are an implementation detail of the schema, not
 //! part of the domain.
 /// A Unix timestamp in **milliseconds** UTC, matching the `BIGINT` columns in
 /// the schema.
 pub type Timestamp = i64;
 /// A registered account.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct User {
     /// ULID primary key.
     pub id: String,
     /// The name as the user typed it (case preserved for display).
     pub username: String,
     /// The primary email address.
     pub email: String,
     /// Optional human-friendly display name.
     pub display_name: Option<String>,
     /// Argon2id PHC hash, or `None` until an invite is completed.
     pub password_hash: Option<String>,
     /// Whether the user must set a new password on next login.
     pub must_change_password: bool,
     /// Whether the user is a site administrator.
     pub is_admin: bool,
     /// When the account was disabled, if it is.
     pub disabled_at: Option<Timestamp>,
     /// Creation time.
     pub created_at: Timestamp,
     /// Last modification time.
     pub updated_at: Timestamp,
+}
 /// A git repository. On disk it lives at `{repo_dir}/{id[0..2]}/{id}.git`; the
 /// database is the sole authority mapping `(owner, path)` to this id.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Repo {
     /// ULID primary key, and the on-disk directory stem.
     pub id: String,
     /// Owning user.
     pub owner_id: String,
     /// Containing group, or `None` when the repo hangs directly off the owner.
     pub group_id: Option<String>,
     /// The repo's own name (the final path segment).
     pub name: String,
     /// Materialized full path within the owner, e.g. `group/sub/repo`; equal to
     /// `name` when ungrouped.
     pub path: String,
     /// Optional one-line description.
     pub description: Option<String>,
     /// Private repositories are invisible to non-collaborators.
     pub is_private: bool,
     /// The branch shown by default and used for HEAD.
     pub default_branch: String,
     /// When the repo was archived (read-only), if it is.
     pub archived_at: Option<Timestamp>,
     /// Approximate on-disk size in bytes, refreshed by maintenance.
     pub size_bytes: i64,
     /// Time of the last push, if any.
     pub pushed_at: Option<Timestamp>,
     /// Creation time.
     pub created_at: Timestamp,
     /// Last modification time.
     pub updated_at: Timestamp,
+}

@@ @@ -3,3 +3,13 @@ @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Shared domain types. This crate performs no I/O and depends on nothing else in-tree.
 //!
 //! It holds the in-memory shapes of persisted entities ([`entity`]) and the
 //! name-validation rules ([`name`]) that every entry point — CLI, API, web —
 //! shares so they cannot drift.
 pub mod entity;
 pub mod name;
 pub use entity::{Repo, Timestamp, User};
 pub use name::{MAX_NAME_LEN, NameError, RESERVED_NAMES, validate_name};

@@ @@ -10,6 +10,18 @@ repository.workspace = true @@
 publish.workspace = true
 [dependencies]
 model = { workspace = true }
 sqlx = { workspace = true }
 ulid = { workspace = true }
 thiserror = { workspace = true }
 [dev-dependencies]
 tokio = { workspace = true }
 tempfile = { workspace = true }
 [features]
 # Opt-in Postgres integration tests, driven by FABRICA_TEST_POSTGRES_URL.
 postgres-tests = []
 [lints]
 workspace = true

@@ @@ -3,6 +3,12 @@ @@
 version = 4
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 [[package]]
 name = "anstream"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -63,6 +69,15 @@ name = "api" @@
 version = "0.1.0"
 [[package]]
 name = "atoi"
 version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
 dependencies = [
  "num-traits",
+]
 [[package]]
 name = "atomic"
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -76,10 +91,49 @@ name = "auth" @@
 version = "0.1.0"
 [[package]]
 name = "autocfg"
 version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 [[package]]
 name = "base64"
 version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 [[package]]
 name = "bitflags"
 version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 dependencies = [
  "serde_core",
+]
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
  "generic-array",
+]
 [[package]]
 name = "block-buffer"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
  "hybrid-array",
+]
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 [[package]]
 name = "bytemuck"
 checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
 [[package]]
 name = "byteorder"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 [[package]]
 name = "bytes"
 version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 [[package]]
 name = "cc"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
 dependencies = [
  "find-msvc-tools",
  "shlex",
+]
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 [[package]]
 name = "chacha20"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
  "rand_core 0.10.1",
+]
 [[package]]
 name = "clap"
 version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -144,12 +231,27 @@ dependencies = [ @@
+]
 [[package]]
 name = "cmov"
 version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
 dependencies = [
  "crossbeam-utils",
+]
 [[package]]
 name = "config"
 version = "0.1.0"
 dependencies = [
@@ @@ -161,6 +263,103 @@ dependencies = [ @@
+]
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
 dependencies = [
  "libc",
+]
 [[package]]
 name = "cpufeatures"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
 dependencies = [
  "libc",
+]
 [[package]]
 name = "crc"
 version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
 dependencies = [
  "crc-catalog",
+]
 [[package]]
 name = "crc-catalog"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
 [[package]]
 name = "crossbeam-queue"
 version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
 dependencies = [
  "crossbeam-utils",
+]
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 [[package]]
 name = "crypto-common"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
  "typenum",
+]
 [[package]]
 name = "crypto-common"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
  "hybrid-array",
+]
 [[package]]
 name = "ctutils"
 version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
 dependencies = [
  "cmov",
+]
 [[package]]
 name = "digest"
 version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
  "crypto-common 0.1.6",
+]
 [[package]]
 name = "digest"
 version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.1",
  "crypto-common 0.2.2",
  "ctutils",
+]
 [[package]]
 name = "displaydoc"
 version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -172,6 +371,21 @@ dependencies = [ @@
+]
 [[package]]
 name = "dotenvy"
 version = "0.15.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
 [[package]]
 name = "either"
 version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 dependencies = [
  "serde",
+]
 [[package]]
 name = "equivalent"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -188,6 +402,27 @@ dependencies = [ @@
+]
 [[package]]
 name = "etcetera"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de48cc4d1c1d97a20fd819def54b890cadde72ed3ad0c614822a0a433361be96"
 dependencies = [
  "cfg-if",
  "windows-sys",
+]
 [[package]]
 name = "event-listener"
 version = "5.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
 dependencies = [
  "concurrent-queue",
  "parking",
  "pin-project-lite",
+]
 [[package]]
 name = "fabrica"
 version = "0.1.0"
 dependencies = [
@@ @@ -217,6 +452,29 @@ dependencies = [ @@
+]
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 [[package]]
 name = "flume"
 version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e139bc46ca777eb5efaf62df0ab8cc5fd400866427e56c68b22e414e53bd3be"
 dependencies = [
  "futures-core",
  "futures-sink",
  "spin",
+]
 [[package]]
 name = "foldhash"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -226,6 +484,99 @@ dependencies = [ @@
+]
 [[package]]
 name = "futures-channel"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
 dependencies = [
  "futures-core",
  "futures-sink",
+]
 [[package]]
 name = "futures-core"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
 [[package]]
 name = "futures-executor"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
 dependencies = [
  "futures-core",
  "futures-task",
  "futures-util",
+]
 [[package]]
 name = "futures-intrusive"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
 dependencies = [
  "futures-core",
  "lock_api",
  "parking_lot",
+]
 [[package]]
 name = "futures-io"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
 [[package]]
 name = "futures-sink"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
 [[package]]
 name = "futures-task"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
 [[package]]
 name = "futures-util"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
 dependencies = [
  "futures-core",
  "futures-io",
  "futures-sink",
  "futures-task",
  "memchr",
  "pin-project-lite",
  "slab",
+]
 [[package]]
 name = "generic-array"
 version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
 dependencies = [
  "typenum",
  "version_check",
+]
 [[package]]
 name = "getrandom"
 version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
+]
 [[package]]
 name = "getrandom"
 version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 dependencies = [
  "cfg-if",
  "libc",
  "r-efi",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
+]
 [[package]]
@@ @@ -242,21 +594,74 @@ version = "0.1.0" @@
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash",
+]
 [[package]]
 name = "hashbrown"
 version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 [[package]]
 name = "hashlink"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "824e001ac4f3012dd16a264bec811403a67ca9deb6c102fc5049b32c4574b35f"
 dependencies = [
  "hashbrown 0.16.1",
+]
 [[package]]
 name = "heck"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 [[package]]
 name = "hex"
 version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 [[package]]
 name = "highlight"
 version = "0.1.0"
 [[package]]
 name = "hkdf"
 version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
 dependencies = [
  "hmac",
+]
 [[package]]
 name = "hmac"
 version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
  "digest 0.11.3",
+]
 [[package]]
 name = "hybrid-array"
 version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
 dependencies = [
  "typenum",
+]
 [[package]]
 name = "icu_collections"
 version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
  "hashbrown",
  "hashbrown 0.17.1",
+]
 [[package]]
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 [[package]]
 name = "js-sys"
 version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
 dependencies = [
  "cfg-if",
  "futures-util",
  "wasm-bindgen",
+]
 [[package]]
 name = "libc"
 version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 [[package]]
 name = "libsqlite3-sys"
 version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1f111c8c41e7c61a49cd34e44c7619462967221a6443b0ec299e0ac30cfb9b1"
 dependencies = [
  "cc",
  "pkg-config",
  "vcpkg",
+]
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -414,18 +841,57 @@ dependencies = [ @@
+]
 [[package]]
 name = "log"
 version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 [[package]]
 name = "mail"
 version = "0.1.0"
 [[package]]
 name = "md-5"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
 dependencies = [
  "cfg-if",
  "digest 0.11.3",
+]
 [[package]]
 name = "memchr"
 version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 [[package]]
 name = "model"
 version = "0.1.0"
 name = "mio"
 version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
  "libc",
  "wasi",
  "windows-sys",
+]
 [[package]]
 name = "model"
 version = "0.1.0"
 dependencies = [
  "thiserror",
+]
 [[package]]
 name = "num-traits"
 version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
+]
 [[package]]
 name = "once_cell"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 [[package]]
 name = "parking"
 version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 [[package]]
 name = "pkg-config"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -501,6 +985,15 @@ dependencies = [ @@
+]
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 dependencies = [
  "zerocopy",
+]
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -533,11 +1026,63 @@ dependencies = [ @@
 [[package]]
 name = "r-efi"
 version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 [[package]]
 name = "r-efi"
 version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 [[package]]
 name = "rand"
 version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha",
  "rand_core 0.9.5",
+]
 [[package]]
 name = "rand"
 version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
+]
 [[package]]
 name = "rand_chacha"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
  "rand_core 0.9.5",
+]
 [[package]]
 name = "rand_core"
 version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
 dependencies = [
  "getrandom 0.3.4",
+]
 [[package]]
 name = "rand_core"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -560,6 +1105,12 @@ dependencies = [ @@
+]
 [[package]]
 name = "rustversion"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -618,10 +1169,247 @@ dependencies = [ @@
+]
 [[package]]
 name = "sha1"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
  "digest 0.11.3",
+]
 [[package]]
 name = "sha2"
 version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
  "digest 0.10.7",
+]
 [[package]]
 name = "sha2"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
  "digest 0.11.3",
+]
 [[package]]
 name = "shlex"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 [[package]]
 name = "slab"
 version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 [[package]]
 name = "smallvec"
 version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 dependencies = [
  "serde",
+]
 [[package]]
 name = "socket2"
 version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
  "windows-sys",
+]
 [[package]]
 name = "spin"
 version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
 dependencies = [
  "lock_api",
+]
 [[package]]
 name = "sqlx"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "378620ccc25c62c89d8be1c819e76a88d59bdcc3304733330788948e619bfd71"
 dependencies = [
  "sqlx-core",
  "sqlx-macros",
  "sqlx-mysql",
  "sqlx-postgres",
  "sqlx-sqlite",
+]
 [[package]]
 name = "sqlx-core"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05b44e85bf579a8eeb4ceaa77a3a523baf2bf0e9bac7e40f405d537b5d2d5ccb"
 dependencies = [
  "base64",
  "bytes",
  "cfg-if",
  "crc",
  "crossbeam-queue",
  "either",
  "event-listener",
  "futures-core",
  "futures-intrusive",
  "futures-io",
  "futures-util",
  "hashbrown 0.16.1",
  "hashlink",
  "indexmap",
  "log",
  "memchr",
  "percent-encoding",
  "serde",
  "serde_json",
  "sha2 0.10.9",
  "smallvec",
  "thiserror",
  "tokio",
  "tokio-stream",
  "tracing",
  "url",
+]
 [[package]]
 name = "sqlx-macros"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd2b84f2bc39a5705ef27ec785a11c934a41bbd4a24941e257927cddc26b60bf"
 dependencies = [
  "proc-macro2",
  "quote",
  "sqlx-core",
  "sqlx-macros-core",
  "syn 2.0.119",
+]
 [[package]]
 name = "sqlx-macros-core"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fb8d96de5fdc85a5c4ec813432b523ec637e80ba98f046555f75f7908ddac7c3"
 dependencies = [
  "cfg-if",
  "dotenvy",
  "either",
  "heck",
  "hex",
  "proc-macro2",
  "quote",
  "serde",
  "serde_json",
  "sha2 0.10.9",
  "sqlx-core",
  "sqlx-postgres",
  "sqlx-sqlite",
  "syn 2.0.119",
  "thiserror",
  "tokio",
  "url",
+]
 [[package]]
 name = "sqlx-mysql"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90b8020fe17c5f2c245bfa2505d7ef59c5604839527c740266ad2214acebea27"
 dependencies = [
  "bitflags",
  "byteorder",
  "bytes",
  "crc",
  "digest 0.11.3",
  "dotenvy",
  "either",
  "futures-core",
  "futures-util",
  "generic-array",
  "log",
  "percent-encoding",
  "serde",
  "sha1",
  "sha2 0.11.0",
  "sqlx-core",
  "thiserror",
  "tracing",
+]
 [[package]]
 name = "sqlx-postgres"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "87a2bdd6e83f6b3ea525ca9fee568030508b58355a43d0b2c1674d5f79dcd65e"
 dependencies = [
  "atoi",
  "base64",
  "bitflags",
  "byteorder",
  "crc",
  "dotenvy",
  "etcetera",
  "futures-channel",
  "futures-core",
  "futures-util",
  "hex",
  "hkdf",
  "hmac",
  "itoa",
  "log",
  "md-5",
  "memchr",
  "rand 0.10.2",
  "serde",
  "serde_json",
  "sha2 0.11.0",
  "smallvec",
  "sqlx-core",
  "stringprep",
  "thiserror",
  "tracing",
  "whoami",
+]
 [[package]]
 name = "sqlx-sqlite"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "488e99c397a62007e4229aec669a179816339afc6d2620ca6fa420dbee2e982c"
 dependencies = [
  "atoi",
  "flume",
  "form_urlencoded",
  "futures-channel",
  "futures-core",
  "futures-executor",
  "futures-intrusive",
  "futures-util",
  "libsqlite3-sys",
  "log",
  "percent-encoding",
  "serde",
  "sqlx-core",
  "thiserror",
  "tracing",
  "url",
+]
 [[package]]
 name = "ssh"
 [[package]]
 name = "store"
 version = "0.1.0"
 dependencies = [
  "model",
  "sqlx",
  "tempfile",
  "thiserror",
  "tokio",
  "ulid",
+]
 [[package]]
 name = "stringprep"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
 dependencies = [
  "unicode-bidi",
  "unicode-normalization",
  "unicode-properties",
+]
 [[package]]
 name = "strsim"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
  "getrandom",
  "getrandom 0.4.3",
  "once_cell",
  "rustix",
  "windows-sys",
@@ @@ -720,6 +1527,58 @@ dependencies = [ @@
+]
 [[package]]
 name = "tinyvec"
 version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
 dependencies = [
  "tinyvec_macros",
+]
 [[package]]
 name = "tinyvec_macros"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 [[package]]
 name = "tokio"
 version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
  "libc",
  "mio",
  "pin-project-lite",
  "socket2",
  "tokio-macros",
  "windows-sys",
+]
 [[package]]
 name = "tokio-macros"
 version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.119",
+]
 [[package]]
 name = "tokio-stream"
 version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
 dependencies = [
  "futures-core",
  "pin-project-lite",
  "tokio",
+]
 [[package]]
 name = "toml"
 version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 [[package]]
 name = "tracing"
 version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
  "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
+]
 [[package]]
 name = "tracing-attributes"
 version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.119",
+]
 [[package]]
 name = "tracing-core"
 version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
+]
 [[package]]
 name = "typenum"
 version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 [[package]]
 name = "ulid"
 version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
 dependencies = [
  "rand 0.9.5",
  "web-time",
+]
 [[package]]
 name = "uncased"
 version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -770,12 +1677,33 @@ dependencies = [ @@
+]
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 [[package]]
 name = "unicode-normalization"
 version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
 dependencies = [
  "tinyvec",
+]
 [[package]]
 name = "unicode-properties"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 [[package]]
 name = "url"
 version = "2.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 [[package]]
 name = "version_check"
 version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 [[package]]
 name = "wasip2"
 version = "1.0.1+wasi-0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
 dependencies = [
  "wit-bindgen",
+]
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
 dependencies = [
  "cfg-if",
  "once_cell",
  "rustversion",
  "wasm-bindgen-macro",
  "wasm-bindgen-shared",
+]
 [[package]]
 name = "wasm-bindgen-macro"
 version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
+]
 [[package]]
 name = "wasm-bindgen-macro-support"
 version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
  "wasm-bindgen-shared",
+]
 [[package]]
 name = "wasm-bindgen-shared"
 version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
 dependencies = [
  "unicode-ident",
+]
 [[package]]
 name = "web"
 version = "0.1.0"
 [[package]]
 name = "web-time"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
+]
 [[package]]
 name = "whoami"
 version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "998767ef88740d1f5b0682a9c53c24431453923962269c2db68ee43788c5a40d"
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -834,6 +1844,12 @@ dependencies = [ @@
+]
 [[package]]
 name = "wit-bindgen"
 version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
 [[package]]
 name = "writeable"
 version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -869,6 +1885,26 @@ dependencies = [ @@
+]
 [[package]]
 name = "zerocopy"
 version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
 dependencies = [
  "zerocopy-derive",
+]
 [[package]]
 name = "zerocopy-derive"
 version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.119",
+]
 [[package]]
 name = "zerofrom"
 version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"

@@ @@ -0,0 +1,201 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Validation for user, repository, and group names.
 //!
 //! One implementation, used by the CLI, the API, and the web UI, so the rules
 //! can never drift between entry points. A valid name matches the regular
 //! expression
 //!
 //! ```text
 //! ^[A-Za-z0-9][A-Za-z0-9._-]{0,38}$
 //! ```
 //!
 //! and additionally must not be `.` or `..`, must not end in `.git` or `.`, and
 //! must not collide with a route-reserved word (see [`RESERVED_NAMES`]). The
 //! same rules apply to usernames, repository names, and group names — anywhere a
 //! name becomes part of a URL path.
 /// The maximum length of a name, in characters (the leading character plus up to
 /// 38 more, matching the `{0,38}` quantifier).
 pub const MAX_NAME_LEN: usize = 39;
 /// Names that would collide with a top-level route or a reserved path segment.
 ///
 /// Comparison is case-insensitive, so `Admin` is rejected just as `admin` is.
 pub const RESERVED_NAMES: &[&str] = &[
     "api", "assets", "login", "logout", "search", "settings", "admin", "static", "healthz",
     "invite", "-",
 ];
 /// Why a candidate name was rejected. Each variant maps to one actionable
 /// message; callers surface the `Display` form to the user.
 #[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
 pub enum NameError {
     /// The name was the empty string.
     #[error("name must not be empty")]
     Empty,
     /// The name exceeded [`MAX_NAME_LEN`] characters.
     #[error("name must be at most {MAX_NAME_LEN} characters")]
     TooLong,
     /// The first character was not an ASCII letter or digit.
     #[error("name must start with an ASCII letter or digit")]
     BadStart,
     /// A character after the first was outside `[A-Za-z0-9._-]`.
     #[error("name may only contain ASCII letters, digits, '.', '_', or '-' (found {0:?})")]
     BadChar(char),
     /// The name was `.` or `..`.
     #[error("name must not be \".\" or \"..\"")]
     DotName,
     /// The name ended in `.git`, which would be ambiguous with a bare repo path.
     #[error("name must not end in \".git\"")]
     GitSuffix,
     /// The name ended in `.`.
     #[error("name must not end in \".\"")]
     DotSuffix,
     /// The name matched a reserved word (case-insensitively).
     #[error("name {0:?} is reserved")]
     Reserved(String),
+}
 /// Validate a user, repository, or group name against every rule in this module.
 ///
 /// # Errors
 ///
 /// Returns the first [`NameError`] that applies. Checks run in a fixed order
 /// (emptiness, dot-names, length, character set, suffixes, reserved words) so a
 /// given input always yields the same error.
 pub fn validate_name(name: &str) -> Result<(), NameError> {
     if name.is_empty() {
         return Err(NameError::Empty);
+    }
     if name == "." || name == ".." {
         return Err(NameError::DotName);
+    }
     // ASCII-only past this point is guaranteed by the character checks below, so
     // counting chars is equivalent to counting bytes for any name that could
     // pass — but count chars so an over-long multibyte input reports TooLong
     // rather than a confusing character error.
     if name.chars().count() > MAX_NAME_LEN {
         return Err(NameError::TooLong);
+    }
     let mut chars = name.chars();
     // `name` is non-empty, so `next` yields.
     let first = chars.next().unwrap_or('\0');
     if !first.is_ascii_alphanumeric() {
         return Err(NameError::BadStart);
+    }
     for c in chars {
         if !(c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-')) {
             return Err(NameError::BadChar(c));
+        }
+    }
     // Suffix rules. The character checks above guarantee `name` is pure ASCII
     // here, so byte-slicing for the `.git` comparison lands on a char boundary.
     if name.ends_with('.') {
         return Err(NameError::DotSuffix);
+    }
     if name.len() >= 4 && name[name.len() - 4..].eq_ignore_ascii_case(".git") {
         return Err(NameError::GitSuffix);
+    }
     let lower = name.to_ascii_lowercase();
     if RESERVED_NAMES.contains(&lower.as_str()) {
         return Err(NameError::Reserved(name.to_string()));
+    }
     Ok(())
+}
 #[cfg(test)]
 mod tests {
     #![allow(clippy::unwrap_used, clippy::panic)]
     use super::*;
     #[test]
     fn accepts_ordinary_names() {
         for name in [
             "a", "A", "0", "hanna", "fabrica", "my-repo", "my_repo", "v1.2.3", "a.b_c-d", "Repo123",
         ] {
             assert_eq!(validate_name(name), Ok(()), "should accept {name:?}");
+        }
+    }
     #[test]
     fn rejects_empty() {
         assert_eq!(validate_name(""), Err(NameError::Empty));
+    }
     #[test]
     fn rejects_dot_names() {
         assert_eq!(validate_name("."), Err(NameError::DotName));
         assert_eq!(validate_name(".."), Err(NameError::DotName));
+    }
     #[test]
     fn enforces_length_boundary() {
         let ok = "a".repeat(MAX_NAME_LEN);
         assert_eq!(
             validate_name(&ok),
             Ok(()),
             "{MAX_NAME_LEN} chars is allowed"
         );
         let too_long = "a".repeat(MAX_NAME_LEN + 1);
         assert_eq!(validate_name(&too_long), Err(NameError::TooLong));
+    }
     #[test]
     fn rejects_bad_start() {
         for name in ["_foo", "-foo", ".foo", "!foo"] {
             assert_eq!(validate_name(name), Err(NameError::BadStart), "{name:?}");
+        }
+    }
     #[test]
     fn rejects_bad_chars() {
         assert_eq!(validate_name("a b"), Err(NameError::BadChar(' ')));
         assert_eq!(validate_name("a/b"), Err(NameError::BadChar('/')));
         assert_eq!(validate_name("a@b"), Err(NameError::BadChar('@')));
+    }
     #[test]
     fn rejects_non_ascii() {
         // A leading non-ASCII letter fails the start check; an interior one fails
         // the character check.
         assert_eq!(validate_name("café"), Err(NameError::BadChar('é')));
         assert!(matches!(
             validate_name("ünsen"),
             Err(NameError::BadStart | NameError::BadChar(_))
         ));
+    }
     #[test]
     fn rejects_git_suffix_case_insensitively() {
         for name in ["repo.git", "repo.GIT", "repo.Git", "x.git"] {
             assert_eq!(validate_name(name), Err(NameError::GitSuffix), "{name:?}");
+        }
         // `.git` embedded but not trailing is fine.
         assert_eq!(validate_name("repo.git.bak"), Ok(()));
+    }
     #[test]
     fn rejects_trailing_dot() {
         assert_eq!(validate_name("repo."), Err(NameError::DotSuffix));
+    }
     #[test]
     fn rejects_reserved_case_insensitively() {
         for name in ["admin", "Admin", "ADMIN", "api", "settings", "healthz"] {
             assert!(
                 matches!(validate_name(name), Err(NameError::Reserved(_))),
                 "{name:?} should be reserved"
             );
+        }
         // A reserved word as a substring is fine.
         assert_eq!(validate_name("administrator"), Ok(()));
+    }
+}

@@ @@ -3,3 +3,270 @@ @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Persistence layer: schema, migrations, and portable queries over SQLite and Postgres.
 //!
 //! # One code path, two backends
 //!
 //! Rather than duplicate every statement per dialect, the store runs over
 //! [`sqlx::Any`]. That is sound here only because we stay inside a deliberately
 //! narrow, portable slice of SQL and mediate the two places the backends
 //! genuinely differ:
 //!
 //! * **Placeholders.** Both SQLite and Postgres accept `$1, $2, …` positional
 //!   placeholders (only MySQL needs `?`), so every query is written once with
 //!   `$N`.
 //! * **Booleans.** Postgres has a real `BOOLEAN`; SQLite stores `INTEGER` 0/1.
 //!   Binding a Rust `bool` encodes correctly for both, but *reading* one back
 //!   differs — a SQLite boolean column decodes as an integer. [`Store::get_bool`]
 //!   is the single place that reconciles this.
 //! * **Timestamps** are `BIGINT` Unix milliseconds UTC everywhere; **ids** are
 //!   lowercase 26-char ULID `TEXT`, lexicographically sortable so they double as
 //!   the default ordering key.
 //!
 //! Migrations live in `migrations/{sqlite,postgres}/NNNN_name.sql`; the matching
 //! set is embedded at build time and selected at runtime by [`Store::migrate`].
 mod repos;
 mod users;
 use std::sync::Once;
 use std::time::{SystemTime, UNIX_EPOCH};
 use sqlx::AnyPool;
 use sqlx::Row;
 use sqlx::any::{AnyPoolOptions, AnyRow};
 use sqlx::migrate::Migrator;
 pub use crate::repos::NewRepo;
 pub use crate::users::NewUser;
 /// Migrations for the SQLite dialect, embedded at build time.
 static SQLITE_MIGRATOR: Migrator = sqlx::migrate!("../../migrations/sqlite");
 /// Migrations for the PostgreSQL dialect, embedded at build time.
 static POSTGRES_MIGRATOR: Migrator = sqlx::migrate!("../../migrations/postgres");
 /// Per-connection SQLite pragmas, applied on every fresh connection. WAL and a
 /// busy timeout let the CLI and a running server share the file; foreign keys
 /// must be turned on explicitly on each connection.
 const SQLITE_PRAGMAS: &[&str] = &[
     "PRAGMA journal_mode = WAL",
     "PRAGMA synchronous = NORMAL",
     "PRAGMA foreign_keys = ON",
     "PRAGMA busy_timeout = 5000",
 ];
 /// Ensure the `Any` driver knows about the SQLite and Postgres backends. Safe to
 /// call repeatedly; the work happens exactly once.
 fn install_drivers() {
     static ONCE: Once = Once::new();
     ONCE.call_once(sqlx::any::install_default_drivers);
+}
 /// Which concrete database a [`Store`] is talking to. The value is fixed at
 /// connect time and drives the handful of dialect-dependent decisions.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Backend {
     /// A SQLite database (file-backed or in-memory).
     Sqlite,
     /// A PostgreSQL database.
     Postgres,
+}
 impl Backend {
     /// Infer the backend from a connection URL's scheme.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::UnsupportedUrl`] for any scheme other than
     /// `sqlite:` or `postgres:`/`postgresql:`.
     pub fn detect(url: &str) -> Result<Self, StoreError> {
         if url.starts_with("sqlite:") {
             Ok(Self::Sqlite)
         } else if url.starts_with("postgres:") || url.starts_with("postgresql:") {
             Ok(Self::Postgres)
         } else {
             Err(StoreError::UnsupportedUrl {
                 url: url.to_string(),
             })
+        }
+    }
+}
 /// An error from the persistence layer.
 #[derive(Debug, thiserror::Error)]
 pub enum StoreError {
     /// The connection URL used an unrecognized scheme.
     #[error("unsupported database URL {url:?}: expected a sqlite: or postgres: scheme")]
     UnsupportedUrl {
         /// The offending URL. Connection URLs can carry credentials, so callers
         /// should avoid surfacing this verbatim to end users.
         url: String,
     },
     /// A query or connection failed. Boxed to keep [`StoreError`] small.
     #[error(transparent)]
     Query(#[from] Box<sqlx::Error>),
     /// A migration failed to apply.
     #[error(transparent)]
     Migrate(#[from] sqlx::migrate::MigrateError),
     /// A name failed validation before it could be written.
     #[error("invalid name: {0}")]
     Name(#[from] model::NameError),
     /// A uniqueness constraint was violated (e.g. a duplicate username).
     #[error("{entity} already exists with that {field}")]
     Conflict {
         /// The kind of entity that collided (`"user"`, `"repo"`, …).
         entity: &'static str,
         /// The field whose uniqueness was violated.
         field: &'static str,
     },
+}
 impl From<sqlx::Error> for StoreError {
     fn from(err: sqlx::Error) -> Self {
         Self::Query(Box::new(err))
+    }
+}
 /// A handle to the database: a connection pool plus the backend it targets.
 ///
 /// Cloneable and cheap to share — the underlying pool is reference-counted.
 #[derive(Debug, Clone)]
 pub struct Store {
     pool: AnyPool,
     backend: Backend,
+}
 impl Store {
     /// Open a pool against `url`, applying SQLite pragmas when appropriate.
     ///
     /// File-backed SQLite URLs are created if missing. This does **not** run
     /// migrations — call [`Store::migrate`] separately so `--no-migrate` can skip
     /// it.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::UnsupportedUrl`] for an unknown scheme, or
     /// [`StoreError::Query`] if the pool cannot be established.
     pub async fn connect(url: &str, max_connections: u32) -> Result<Self, StoreError> {
         install_drivers();
         let backend = Backend::detect(url)?;
         let url = normalize_url(url, backend);
         let mut options = AnyPoolOptions::new().max_connections(max_connections.max(1));
         if backend == Backend::Sqlite {
             options = options.after_connect(|conn, _meta| {
                 Box::pin(async move {
                     for pragma in SQLITE_PRAGMAS {
                         sqlx::query(*pragma).execute(&mut *conn).await?;
+                    }
                     Ok(())
                 })
             });
+        }
         let pool = options.connect(&url).await.map_err(Box::new)?;
         Ok(Self { pool, backend })
+    }
     /// Wrap an already-open pool. Primarily a test seam.
     ///
     /// The `backend` must match the pool's actual driver, or dialect-dependent
     /// decoding (booleans) will misbehave.
     #[must_use]
     pub fn from_pool(pool: AnyPool, backend: Backend) -> Self {
         Self { pool, backend }
+    }
     /// The backend this store targets.
     #[must_use]
     pub fn backend(&self) -> Backend {
         self.backend
+    }
     /// The underlying connection pool, for callers that need raw access.
     #[must_use]
     pub fn pool(&self) -> &AnyPool {
         &self.pool
+    }
     /// Apply all pending migrations for this backend's dialect.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Migrate`] if a migration fails or the recorded
     /// history is inconsistent with the embedded set.
     pub async fn migrate(&self) -> Result<(), StoreError> {
         let migrator = match self.backend {
             Backend::Sqlite => &SQLITE_MIGRATOR,
             Backend::Postgres => &POSTGRES_MIGRATOR,
         };
         migrator.run(&self.pool).await?;
         Ok(())
+    }
     /// Read a boolean column, bridging SQLite's integer storage and Postgres's
     /// native `BOOLEAN`. This is the one place the two dialects' boolean
     /// representations are reconciled on the read path.
     fn get_bool(&self, row: &AnyRow, column: &str) -> Result<bool, sqlx::Error> {
         match self.backend {
             Backend::Sqlite => Ok(row.try_get::<i64, _>(column)? != 0),
             Backend::Postgres => row.try_get::<bool, _>(column),
+        }
+    }
+}
 /// Generate a fresh identifier: a lowercase, 26-character ULID. ULIDs are
 /// lexicographically sortable by creation time, so they double as an ordering
 /// key and never need a separate sequence.
 fn new_id() -> String {
     ulid::Ulid::new().to_string().to_lowercase()
+}
 /// The current time as Unix milliseconds UTC, matching the schema's `BIGINT`
 /// timestamp columns. Clamps rather than panicking on the impossible cases (a
 /// clock before the epoch, or a time past year 292-million).
 fn now_ms() -> i64 {
     SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .map_or(0, |d| i64::try_from(d.as_millis()).unwrap_or(i64::MAX))
+}
 /// Ensure a file-backed SQLite URL will create its database if absent. In-memory
 /// URLs and any URL that already specifies a `mode` are left untouched.
 fn normalize_url(url: &str, backend: Backend) -> String {
     if backend == Backend::Sqlite && !url.contains(":memory:") && !url.contains("mode=") {
         let separator = if url.contains('?') { '&' } else { '?' };
         format!("{url}{separator}mode=rwc")
     } else {
         url.to_string()
+    }
+}
 /// Map a failed write to [`StoreError::Conflict`] when it was a uniqueness
 /// violation, attributing it to the first matching field. Any other error is
 /// passed through unchanged.
 ///
 /// `needles` pairs a lowercase substring to look for in the violated
 /// constraint's name/message with the field label to report. The database's
 /// error text names the offending column (`users.email_lower`, or a Postgres
 /// constraint like `users_email_lower_key`), so a substring match reliably
 /// identifies the field across both dialects.
 fn map_conflict(
     err: sqlx::Error,
     entity: &'static str,
     needles: &[(&str, &'static str)],
 ) -> StoreError {
     if let sqlx::Error::Database(db) = &err
         && db.is_unique_violation()
+    {
         let haystack = format!("{} {}", db.constraint().unwrap_or(""), db.message()).to_lowercase();
         let field = needles
             .iter()
             .find(|(needle, _)| haystack.contains(needle))
             .map_or("value", |(_, field)| *field);
         return StoreError::Conflict { entity, field };
+    }
     err.into()
+}
 #[cfg(test)]
 mod tests;

@@ @@ -0,0 +1,127 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Repositories: creation and path lookup.
 use model::Repo;
 use sqlx::any::AnyRow;
 use sqlx::{AssertSqlSafe, Row};
 use crate::{Store, StoreError, map_conflict, new_id, now_ms};
 /// The columns of `repos` in a fixed order, shared by every `SELECT`.
 const REPO_COLUMNS: &str = "id, owner_id, group_id, name, path, description, is_private, \
      default_branch, archived_at, size_bytes, pushed_at, created_at, updated_at";
 /// Fields needed to create a repository. The server fills in the id, timestamps,
 /// and the derived size/push bookkeeping.
 #[derive(Debug, Clone)]
 pub struct NewRepo {
     /// Owning user id.
     pub owner_id: String,
     /// Containing group id, or `None` when the repo hangs directly off the owner.
     pub group_id: Option<String>,
     /// The repo's own name; validated with [`model::validate_name`].
     pub name: String,
     /// Materialized full path within the owner (`group/sub/repo`, or just `name`).
     pub path: String,
     /// Optional one-line description.
     pub description: Option<String>,
     /// Whether the repo is private (invisible to non-collaborators).
     pub is_private: bool,
     /// The repo's default branch.
     pub default_branch: String,
+}
 impl Store {
     /// Create a repository, returning the persisted row.
     ///
     /// # Errors
     ///
     /// * [`StoreError::Name`] if the repo name is invalid.
     /// * [`StoreError::Conflict`] if the owner already has a repo at that path.
     /// * [`StoreError::Query`] for any other database failure.
     pub async fn create_repo(&self, new: NewRepo) -> Result<Repo, StoreError> {
         model::validate_name(&new.name)?;
         let now = now_ms();
         let repo = Repo {
             id: new_id(),
             owner_id: new.owner_id,
             group_id: new.group_id,
             name: new.name,
             path: new.path,
             description: new.description,
             is_private: new.is_private,
             default_branch: new.default_branch,
             archived_at: None,
             size_bytes: 0,
             pushed_at: None,
             created_at: now,
             updated_at: now,
         };
         let sql = "INSERT INTO repos \
              (id, owner_id, group_id, name, path, description, is_private, default_branch, \
               archived_at, size_bytes, pushed_at, created_at, updated_at) \
              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)";
         sqlx::query(sql)
             .bind(repo.id.clone())
             .bind(repo.owner_id.clone())
             .bind(repo.group_id.clone())
             .bind(repo.name.clone())
             .bind(repo.path.clone())
             .bind(repo.description.clone())
             .bind(repo.is_private)
             .bind(repo.default_branch.clone())
             .bind(repo.archived_at)
             .bind(repo.size_bytes)
             .bind(repo.pushed_at)
             .bind(repo.created_at)
             .bind(repo.updated_at)
             .execute(&self.pool)
             .await
             .map_err(|e| map_conflict(e, "repo", &[("path", "path")]))?;
         Ok(repo)
+    }
     /// Resolve a repository by `(owner_id, path)`, or `None` if absent. This is
     /// the authoritative name→repo lookup; the on-disk tree is keyed by id.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn repo_by_owner_path(
         &self,
         owner_id: &str,
         path: &str,
     ) -> Result<Option<Repo>, StoreError> {
         let sql = format!("SELECT {REPO_COLUMNS} FROM repos WHERE owner_id = $1 AND path = $2");
         let row = sqlx::query(AssertSqlSafe(sql))
             .bind(owner_id)
             .bind(path)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.as_ref().map(|r| self.map_repo(r)).transpose()?)
+    }
     /// Map a `repos` row (selected via [`REPO_COLUMNS`]) to a [`Repo`].
     fn map_repo(&self, row: &AnyRow) -> Result<Repo, sqlx::Error> {
         Ok(Repo {
             id: row.try_get("id")?,
             owner_id: row.try_get("owner_id")?,
             group_id: row.try_get("group_id")?,
             name: row.try_get("name")?,
             path: row.try_get("path")?,
             description: row.try_get("description")?,
             is_private: self.get_bool(row, "is_private")?,
             default_branch: row.try_get("default_branch")?,
             archived_at: row.try_get("archived_at")?,
             size_bytes: row.try_get("size_bytes")?,
             pushed_at: row.try_get("pushed_at")?,
             created_at: row.try_get("created_at")?,
             updated_at: row.try_get("updated_at")?,
         })
+    }
+}

@@ @@ -0,0 +1,424 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Store tests. The portable behaviour runs against SQLite both in-memory and
 //! file-backed; the same round-trips run against Postgres when the
 //! `postgres-tests` feature is enabled and `FABRICA_TEST_POSTGRES_URL` is set.
 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 use tempfile::TempDir;
 use super::{Backend, NewRepo, NewUser, Store, StoreError};
 /// A migrated store plus any temp directory that must outlive it.
 struct Fixture {
     store: Store,
     _dir: Option<TempDir>,
+}
 /// A migrated in-memory SQLite store. A single connection keeps the database
 /// alive for the life of the pool.
 async fn memory_store() -> Fixture {
     let store = Store::connect("sqlite::memory:", 1).await.unwrap();
     store.migrate().await.unwrap();
     Fixture { store, _dir: None }
+}
 /// A migrated file-backed SQLite store in a fresh temp directory.
 async fn file_store() -> Fixture {
     let dir = tempfile::tempdir().unwrap();
     let url = format!("sqlite://{}", dir.path().join("fabrica.db").display());
     let store = Store::connect(&url, 5).await.unwrap();
     store.migrate().await.unwrap();
     Fixture {
         store,
         _dir: Some(dir),
+    }
+}
 /// Both SQLite flavours the portable tests must pass against.
 async fn sqlite_fixtures() -> Vec<Fixture> {
     vec![memory_store().await, file_store().await]
+}
 fn sample_user(username: &str, email: &str) -> NewUser {
     NewUser {
         username: username.to_string(),
         email: email.to_string(),
         display_name: Some("Sample".to_string()),
         password_hash: None,
         is_admin: false,
         must_change_password: false,
+    }
+}
 #[tokio::test]
 async fn migrations_are_idempotent() {
     for fx in sqlite_fixtures().await {
         // A second run over the already-migrated database is a no-op.
         fx.store.migrate().await.unwrap();
+    }
+}
 #[tokio::test]
 async fn create_and_fetch_user() {
     for fx in sqlite_fixtures().await {
         let created = fx
             .store
             .create_user(sample_user("hanna", "hanna@example.com"))
             .await
             .unwrap();
         assert_eq!(created.id.len(), 26, "id should be a 26-char ULID");
         assert_eq!(created.created_at, created.updated_at);
         let by_id = fx.store.user_by_id(&created.id).await.unwrap().unwrap();
         assert_eq!(by_id, created);
         // Username lookup is case-insensitive.
         let by_name = fx.store.user_by_username("HANNA").await.unwrap().unwrap();
         assert_eq!(by_name, created);
         assert!(fx.store.user_by_id("nope").await.unwrap().is_none());
         assert!(fx.store.user_by_username("ghost").await.unwrap().is_none());
+    }
+}
 #[tokio::test]
 async fn duplicate_username_conflicts_case_insensitively() {
     for fx in sqlite_fixtures().await {
         fx.store
             .create_user(sample_user("dup", "a@example.com"))
             .await
             .unwrap();
         let err = fx
             .store
             .create_user(sample_user("DUP", "b@example.com"))
             .await
             .unwrap_err();
         assert!(
             matches!(
                 err,
                 StoreError::Conflict {
                     entity: "user",
                     field: "username"
+                }
             ),
             "got {err:?}"
         );
+    }
+}
 #[tokio::test]
 async fn duplicate_email_conflicts_case_insensitively() {
     for fx in sqlite_fixtures().await {
         fx.store
             .create_user(sample_user("one", "same@example.com"))
             .await
             .unwrap();
         let err = fx
             .store
             .create_user(sample_user("two", "SAME@example.com"))
             .await
             .unwrap_err();
         assert!(
             matches!(
                 err,
                 StoreError::Conflict {
                     entity: "user",
                     field: "email"
+                }
             ),
             "got {err:?}"
         );
+    }
+}
 #[tokio::test]
 async fn invalid_username_is_rejected_before_insert() {
     for fx in sqlite_fixtures().await {
         let err = fx
             .store
             .create_user(sample_user("bad name", "x@example.com"))
             .await
             .unwrap_err();
         assert!(matches!(err, StoreError::Name(_)), "got {err:?}");
+    }
+}
 #[tokio::test]
 async fn booleans_round_trip() {
     for fx in sqlite_fixtures().await {
         let boss = fx
             .store
             .create_user(NewUser {
                 is_admin: true,
                 must_change_password: true,
                 ..sample_user("boss", "boss@example.com")
             })
             .await
             .unwrap();
         assert!(boss.is_admin);
         assert!(boss.must_change_password);
         let fetched = fx.store.user_by_id(&boss.id).await.unwrap().unwrap();
         assert!(fetched.is_admin, "is_admin must survive the round-trip");
         assert!(fetched.must_change_password);
         // And the default-false path.
         let plain = fx.store.user_by_username("boss").await.unwrap();
         assert!(plain.is_some());
         let normal = fx
             .store
             .create_user(sample_user("normal", "normal@example.com"))
             .await
             .unwrap();
         let normal = fx.store.user_by_id(&normal.id).await.unwrap().unwrap();
         assert!(!normal.is_admin);
         assert!(!normal.must_change_password);
+    }
+}
 #[tokio::test]
 async fn create_and_fetch_repo() {
     for fx in sqlite_fixtures().await {
         let owner = fx
             .store
             .create_user(sample_user("owner", "owner@example.com"))
             .await
             .unwrap();
         let repo = fx
             .store
             .create_repo(NewRepo {
                 owner_id: owner.id.clone(),
                 group_id: None,
                 name: "project".to_string(),
                 path: "project".to_string(),
                 description: Some("a repo".to_string()),
                 is_private: false,
                 default_branch: "main".to_string(),
             })
             .await
             .unwrap();
         assert_eq!(repo.size_bytes, 0);
         assert!(repo.pushed_at.is_none());
         assert!(!repo.is_private);
         let fetched = fx
             .store
             .repo_by_owner_path(&owner.id, "project")
             .await
             .unwrap()
             .unwrap();
         assert_eq!(fetched, repo);
         // Same owner, same path collides.
         let err = fx
             .store
             .create_repo(NewRepo {
                 owner_id: owner.id.clone(),
                 group_id: None,
                 name: "project".to_string(),
                 path: "project".to_string(),
                 description: None,
                 is_private: true,
                 default_branch: "main".to_string(),
             })
             .await
             .unwrap_err();
         assert!(
             matches!(
                 err,
                 StoreError::Conflict {
                     entity: "repo",
                     field: "path"
+                }
             ),
             "got {err:?}"
         );
+    }
+}
 #[tokio::test]
 async fn foreign_keys_are_enforced() {
     // A repo whose owner does not exist must be rejected — proof the SQLite
     // `foreign_keys` pragma took effect on the pooled connection.
     for fx in sqlite_fixtures().await {
         let err = fx
             .store
             .create_repo(NewRepo {
                 owner_id: "no-such-owner".to_string(),
                 group_id: None,
                 name: "orphan".to_string(),
                 path: "orphan".to_string(),
                 description: None,
                 is_private: true,
                 default_branch: "main".to_string(),
             })
             .await
             .unwrap_err();
         assert!(
             matches!(err, StoreError::Query(_)),
             "expected a database (FK) error, got {err:?}"
         );
+    }
+}
 #[test]
 fn unsupported_url_is_rejected() {
     let err = Backend::detect("mysql://localhost/db").unwrap_err();
     assert!(
         matches!(err, StoreError::UnsupportedUrl { .. }),
         "got {err:?}"
     );
     assert_eq!(Backend::detect("sqlite::memory:").unwrap(), Backend::Sqlite);
     assert_eq!(
         Backend::detect("postgres://localhost/db").unwrap(),
         Backend::Postgres
     );
     assert_eq!(
         Backend::detect("postgresql://localhost/db").unwrap(),
         Backend::Postgres
     );
+}
 /// The two dialects' initial migrations must define the same tables with the
 /// same columns in the same order — a hermetic check that needs no database.
 /// The only sanctioned differences are the boolean column type and dialect
 /// punctuation.
 #[test]
 fn schema_files_are_equivalent() {
     let sqlite = include_str!("../../../migrations/sqlite/0001_init.sql");
     let postgres = include_str!("../../../migrations/postgres/0001_init.sql");
     assert_eq!(
         columns_by_table(sqlite),
         columns_by_table(postgres),
         "SQLite and Postgres schemas must define identical tables and columns"
     );
     // The boolean columns must use the dialect-appropriate storage type.
     for column in ["must_change_password", "is_admin", "is_private"] {
         assert!(
             column_line(sqlite, column).contains("INTEGER"),
             "SQLite {column} should be INTEGER"
         );
         assert!(
             column_line(postgres, column).contains("BOOLEAN"),
             "Postgres {column} should be BOOLEAN"
         );
+    }
+}
 /// Extract, per table, the ordered list of column names from a migration file.
 /// Relies on the house style: each column on its own line beginning with the
 /// column name, table-level constraints beginning with an uppercase keyword.
 fn columns_by_table(sql: &str) -> std::collections::BTreeMap<String, Vec<String>> {
     const CONSTRAINT_KEYWORDS: &[&str] = &["UNIQUE", "PRIMARY", "FOREIGN", "CHECK", "CONSTRAINT"];
     let mut tables = std::collections::BTreeMap::new();
     let mut current: Option<(String, Vec<String>)> = None;
     for raw in sql.lines() {
         let line = raw.trim();
         if let Some(rest) = line.strip_prefix("CREATE TABLE ") {
             let name = rest.trim_end_matches(" (").trim_end_matches('(').trim();
             current = Some((name.to_string(), Vec::new()));
             continue;
+        }
         let Some((name, cols)) = current.as_mut() else {
             continue;
         };
         if line.starts_with(')') {
             let (name, cols) = current.take().expect("current table");
             tables.insert(name, cols);
             continue;
+        }
         // A column line starts with an identifier; skip blanks, comments, and
         // table-level constraints.
         let first = line.split([' ', '\t']).next().unwrap_or("");
         if first.is_empty()
             || line.starts_with("--")
             || CONSTRAINT_KEYWORDS.contains(&first.to_ascii_uppercase().as_str())
+        {
             let _ = name;
             continue;
+        }
         cols.push(first.to_string());
+    }
     tables
+}
 /// Return the first line defining `column` (for type assertions).
 fn column_line<'a>(sql: &'a str, column: &str) -> &'a str {
     sql.lines()
         .map(str::trim)
         .find(|line| line.split([' ', '\t']).next() == Some(column))
         .unwrap_or("")
+}
 /// Postgres round-trips, mirroring the SQLite ones. Ignored unless the
 /// `postgres-tests` feature is on and `FABRICA_TEST_POSTGRES_URL` points at a
 /// reachable database; the test cleans up the rows it creates so it can rerun.
 #[tokio::test]
 #[cfg_attr(
     not(feature = "postgres-tests"),
     ignore = "enable the postgres-tests feature and set FABRICA_TEST_POSTGRES_URL"
 )]
 async fn postgres_round_trip() {
     let Ok(url) = std::env::var("FABRICA_TEST_POSTGRES_URL") else {
         eprintln!("skipping postgres_round_trip: FABRICA_TEST_POSTGRES_URL not set");
         return;
     };
     let store = Store::connect(&url, 5).await.unwrap();
     assert_eq!(store.backend(), Backend::Postgres);
     store.migrate().await.unwrap();
     // Unique names so repeated runs against a shared database don't collide.
     let suffix = super::new_id();
     let username = format!("pg{suffix}");
     let email = format!("{suffix}@example.com");
     let admin = store
         .create_user(NewUser {
             is_admin: true,
             must_change_password: true,
             ..sample_user(&username, &email)
         })
         .await
         .unwrap();
     let fetched = store.user_by_id(&admin.id).await.unwrap().unwrap();
     assert_eq!(fetched, admin);
     assert!(fetched.is_admin, "native BOOLEAN must decode as true");
     assert!(fetched.must_change_password);
     let repo = store
         .create_repo(NewRepo {
             owner_id: admin.id.clone(),
             group_id: None,
             name: "pgproj".to_string(),
             path: "pgproj".to_string(),
             description: None,
             is_private: false,
             default_branch: "main".to_string(),
         })
         .await
         .unwrap();
     let fetched_repo = store
         .repo_by_owner_path(&admin.id, "pgproj")
         .await
         .unwrap()
         .unwrap();
     assert_eq!(fetched_repo, repo);
     assert!(!fetched_repo.is_private);
     // Clean up (repo cascades with the user).
     sqlx::query("DELETE FROM users WHERE id = $1")
         .bind(&admin.id)
         .execute(store.pool())
         .await
         .unwrap();
+}

@@ @@ -0,0 +1,132 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! User accounts: creation and lookup.
 use model::User;
 use sqlx::any::AnyRow;
 use sqlx::{AssertSqlSafe, Row};
 use crate::{Store, StoreError, map_conflict, new_id, now_ms};
 /// The columns of `users` in a fixed order, shared by every `SELECT` so the
 /// row-mapping in [`Store::map_user`] can rely on names.
 const USER_COLUMNS: &str = "id, username, email, display_name, password_hash, \
      must_change_password, is_admin, disabled_at, created_at, updated_at";
 /// Fields needed to create a user. The server fills in the id, timestamps, and
 /// the normalized `*_lower` uniqueness keys.
 #[derive(Debug, Clone)]
 pub struct NewUser {
     /// Login name; validated with [`model::validate_name`] before insert.
     pub username: String,
     /// Primary email address.
     pub email: String,
     /// Optional display name.
     pub display_name: Option<String>,
     /// Argon2id PHC hash, or `None` for an account awaiting invite completion.
     pub password_hash: Option<String>,
     /// Whether the account is a site administrator.
     pub is_admin: bool,
     /// Whether the user must change their password on next login.
     pub must_change_password: bool,
+}
 impl Store {
     /// Create a user, returning the persisted row.
     ///
     /// The username is validated and case-folded for uniqueness; the email is
     /// likewise unique case-insensitively.
     ///
     /// # Errors
     ///
     /// * [`StoreError::Name`] if the username is invalid.
     /// * [`StoreError::Conflict`] if the username or email is already taken.
     /// * [`StoreError::Query`] for any other database failure.
     pub async fn create_user(&self, new: NewUser) -> Result<User, StoreError> {
         model::validate_name(&new.username)?;
         let now = now_ms();
         let user = User {
             id: new_id(),
             username: new.username,
             email: new.email,
             display_name: new.display_name,
             password_hash: new.password_hash,
             must_change_password: new.must_change_password,
             is_admin: new.is_admin,
             disabled_at: None,
             created_at: now,
             updated_at: now,
         };
         let sql = "INSERT INTO users \
              (id, username, username_lower, email, email_lower, display_name, \
               password_hash, must_change_password, is_admin, disabled_at, created_at, updated_at) \
              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)";
         sqlx::query(sql)
             .bind(user.id.clone())
             .bind(user.username.clone())
             .bind(user.username.to_lowercase())
             .bind(user.email.clone())
             .bind(user.email.to_lowercase())
             .bind(user.display_name.clone())
             .bind(user.password_hash.clone())
             .bind(user.must_change_password)
             .bind(user.is_admin)
             .bind(user.disabled_at)
             .bind(user.created_at)
             .bind(user.updated_at)
             .execute(&self.pool)
             .await
             .map_err(|e| {
                 map_conflict(e, "user", &[("email", "email"), ("username", "username")])
             })?;
         Ok(user)
+    }
     /// Fetch a user by id, or `None` if there is no such user.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn user_by_id(&self, id: &str) -> Result<Option<User>, StoreError> {
         let sql = format!("SELECT {USER_COLUMNS} FROM users WHERE id = $1");
         let row = sqlx::query(AssertSqlSafe(sql))
             .bind(id)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.as_ref().map(|r| self.map_user(r)).transpose()?)
+    }
     /// Fetch a user by username, case-insensitively, or `None` if absent.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn user_by_username(&self, username: &str) -> Result<Option<User>, StoreError> {
         let sql = format!("SELECT {USER_COLUMNS} FROM users WHERE username_lower = $1");
         let row = sqlx::query(AssertSqlSafe(sql))
             .bind(username.to_lowercase())
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.as_ref().map(|r| self.map_user(r)).transpose()?)
+    }
     /// Map a `users` row (selected via [`USER_COLUMNS`]) to a [`User`].
     fn map_user(&self, row: &AnyRow) -> Result<User, sqlx::Error> {
         Ok(User {
             id: row.try_get("id")?,
             username: row.try_get("username")?,
             email: row.try_get("email")?,
             display_name: row.try_get("display_name")?,
             password_hash: row.try_get("password_hash")?,
             must_change_password: self.get_bool(row, "must_change_password")?,
             is_admin: self.get_bool(row, "is_admin")?,
             disabled_at: row.try_get("disabled_at")?,
             created_at: row.try_get("created_at")?,
             updated_at: row.try_get("updated_at")?,
         })
+    }
+}

@@ @@ -34,8 +34,19 @@ @@
           craneLib = (inputs.crane.mkLib pkgs).overrideToolchain fenixToolchain;
           # Keep `.sql` migration files in the build source: the `store` crate
           # embeds them via `sqlx::migrate!` (and reads them in tests), and
           # crane's default cargo-source filter would strip them.
           src = pkgs.lib.cleanSourceWith {
             src = ./.;
             name = "source";
             filter =
               path: type:
               (builtins.match ".*\\.sql$" path != null) || (craneLib.filterCargoSources path type);
           };
           commonArgs = {
             src = craneLib.cleanCargoSource ./.;
             inherit src;
             strictDeps = true;
             nativeBuildInputs = [
               pkgs.pkg-config

@@ @@ -0,0 +1,141 @@ @@
 -- This Source Code Form is subject to the terms of the Mozilla Public
 -- License, v. 2.0. If a copy of the MPL was not distributed with this
 -- file, You can obtain one at https://mozilla.org/MPL/2.0/.
 -- Initial schema (PostgreSQL dialect).
 --
 -- This must stay structurally equivalent to migrations/sqlite/0001_init.sql;
 -- the only permitted differences are the boolean column type (BOOLEAN here,
 -- INTEGER 0/1 there) and dialect punctuation. Timestamps are BIGINT Unix
 -- milliseconds UTC; identifiers are 26-char ULID TEXT (lexicographically
 -- sortable — order by them). Case-insensitive uniqueness is enforced with a
 -- normalized `*_lower` column plus a unique index, never collation.
 CREATE TABLE users (
     id                   TEXT PRIMARY KEY,
     username             TEXT NOT NULL,
     username_lower       TEXT NOT NULL UNIQUE,
     email                TEXT NOT NULL,
     email_lower          TEXT NOT NULL UNIQUE,
     display_name         TEXT,
     password_hash        TEXT,               -- NULL until an invite is completed
     must_change_password BOOLEAN NOT NULL DEFAULT FALSE,
     is_admin             BOOLEAN NOT NULL DEFAULT FALSE,
     disabled_at          BIGINT,
     created_at           BIGINT NOT NULL,
     updated_at           BIGINT NOT NULL
 );
 CREATE TABLE invites (
     id         TEXT PRIMARY KEY,
     user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     token_hash TEXT NOT NULL UNIQUE,         -- SHA-256 of the emailed token
     purpose    TEXT NOT NULL,                -- 'activate' | 'reset'
     expires_at BIGINT NOT NULL,
     used_at    BIGINT,
     created_at BIGINT NOT NULL
 );
 CREATE TABLE sessions (
     id           TEXT PRIMARY KEY,           -- SHA-256 of the cookie value
     user_id      TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     user_agent   TEXT,
     ip           TEXT,
     created_at   BIGINT NOT NULL,
     last_seen_at BIGINT NOT NULL,
     expires_at   BIGINT NOT NULL
 );
 CREATE TABLE api_tokens (
     id           TEXT PRIMARY KEY,           -- the JWT `jti`
     user_id      TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     name         TEXT NOT NULL,
     scopes       TEXT NOT NULL,              -- comma-separated
     expires_at   BIGINT,
     revoked_at   BIGINT,
     last_used_at BIGINT,
     created_at   BIGINT NOT NULL
 );
 CREATE TABLE keys (
     id           TEXT PRIMARY KEY,
     user_id      TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     kind         TEXT NOT NULL,              -- 'ssh' | 'gpg'
     name         TEXT,
     fingerprint  TEXT NOT NULL,              -- SHA256:… for ssh, full hex fp for gpg
     public_key   TEXT NOT NULL,              -- authorized_keys line or armored pgp block
     ordinal      INTEGER NOT NULL,           -- stable 1-based index per (user, kind)
     last_used_at BIGINT,
     created_at   BIGINT NOT NULL,
     UNIQUE (kind, fingerprint),
     UNIQUE (user_id, kind, ordinal)
 );
 CREATE TABLE groups (
     id          TEXT PRIMARY KEY,
     owner_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     parent_id   TEXT REFERENCES groups(id) ON DELETE CASCADE,
     name        TEXT NOT NULL,
     path        TEXT NOT NULL,               -- materialized 'group/sub/leaf'
     description TEXT,
     created_at  BIGINT NOT NULL,
     UNIQUE (owner_id, path)
 );
 CREATE TABLE repos (
     id             TEXT PRIMARY KEY,
     owner_id       TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     group_id       TEXT REFERENCES groups(id) ON DELETE SET NULL,
     name           TEXT NOT NULL,
     path           TEXT NOT NULL,            -- materialized 'group/sub/repo' (== name when ungrouped)
     description    TEXT,
     is_private     BOOLEAN NOT NULL DEFAULT TRUE,
     default_branch TEXT NOT NULL,
     archived_at    BIGINT,
     size_bytes     BIGINT NOT NULL DEFAULT 0,
     pushed_at      BIGINT,
     created_at     BIGINT NOT NULL,
     updated_at     BIGINT NOT NULL,
     UNIQUE (owner_id, path)
 );
 CREATE TABLE repo_collaborators (
     repo_id    TEXT NOT NULL REFERENCES repos(id) ON DELETE CASCADE,
     user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     permission TEXT NOT NULL,                -- 'read' | 'write' | 'admin'
     created_at BIGINT NOT NULL,
     PRIMARY KEY (repo_id, user_id)
 );
 -- Reserved and inert until the CI ships (phase 18+). No behaviour reads these
 -- yet; they exist so the seams are stable.
 CREATE TABLE runs (
     id          TEXT PRIMARY KEY,
     repo_id     TEXT NOT NULL,
     ref         TEXT NOT NULL,
     commit_sha  TEXT NOT NULL,
     status      TEXT NOT NULL,
     started_at  BIGINT,
     finished_at BIGINT,
     created_at  BIGINT NOT NULL
 );
 CREATE TABLE jobs (
     id          TEXT PRIMARY KEY,
     run_id      TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
     stage       TEXT NOT NULL,
     name        TEXT NOT NULL,
     status      TEXT NOT NULL,
     log_path    TEXT,
     started_at  BIGINT,
     finished_at BIGINT
 );
 -- Indexes. The UNIQUE(owner_id, path) constraint on repos already provides the
 -- (owner_id, path) lookup index, so it is not repeated here.
 CREATE INDEX idx_repos_visibility_pushed ON repos (is_private, pushed_at DESC);
 CREATE INDEX idx_groups_owner_parent     ON groups (owner_id, parent_id);
 CREATE INDEX idx_keys_user_kind          ON keys (user_id, kind);
 CREATE INDEX idx_sessions_user           ON sessions (user_id);
 CREATE INDEX idx_sessions_expires        ON sessions (expires_at);
 CREATE INDEX idx_api_tokens_user         ON api_tokens (user_id);