@agentlensai/server 0.10.0 → 0.11.0

package/dist/cloud/auth/api-key-middleware.d.ts

@@ -0,0 +1,66 @@
+/**
+ * API Key Authentication Middleware (S-2.4)
+ *
+ * Extracts `Authorization: Bearer al_...`, looks up key by prefix,
+ * verifies hash, attaches org_id to request context.
+ * Cache-friendly: in-memory Map with 60s TTL (Redis-replaceable).
+ * `last_used_at` updated non-blocking. Full key never logged.
+ */
+import { ApiKeyService } from './api-keys.js';
+export interface ApiKeyAuthContext {
+    orgId: string;
+    keyId: string;
+    scopes: string[];
+    rateLimitOverride: number | null;
+    environment: string;
+}
+export interface ApiKeyAuthRequest {
+    headers: {
+        authorization?: string;
+        [k: string]: string | undefined;
+    };
+}
+export interface CacheEntry {
+    orgId: string;
+    keyId: string;
+    keyHash: string;
+    scopes: string[];
+    rateLimitOverride: number | null;
+    environment: string;
+    revoked: boolean;
+    cachedAt: number;
+}
+export interface ApiKeyCache {
+    get(prefix: string): CacheEntry | undefined;
+    set(prefix: string, entry: CacheEntry): void;
+    delete(prefix: string): void;
+}
+export declare class InMemoryApiKeyCache implements ApiKeyCache {
+    private ttlMs;
+    private cache;
+    constructor(ttlMs?: number);
+    get(prefix: string): CacheEntry | undefined;
+    set(prefix: string, entry: CacheEntry): void;
+    delete(prefix: string): void;
+    /** For testing: get raw size */
+    get size(): number;
+}
+export declare class ApiKeyAuthMiddleware {
+    private keyService;
+    private cache;
+    constructor(keyService: ApiKeyService, cache?: ApiKeyCache);
+    /**
+     * Authenticate an API key from Authorization header.
+     * Returns auth context or throws.
+     */
+    authenticate(authHeader: string | undefined): Promise<ApiKeyAuthContext>;
+    /**
+     * Invalidate cache for a key prefix (called on revocation).
+     */
+    invalidateCache(prefix: string): void;
+}
+export declare class ApiKeyAuthError extends Error {
+    statusCode: number;
+    constructor(statusCode: number, message: string);
+}
+//# sourceMappingURL=api-key-middleware.d.ts.map

package/dist/cloud/auth/api-key-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-middleware.d.ts","sourceRoot":"","sources":["../../../src/cloud/auth/api-key-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAM9C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CACtE;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAMD,qBAAa,mBAAoB,YAAW,WAAW;IAGzC,OAAO,CAAC,KAAK;IAFzB,OAAO,CAAC,KAAK,CAAiC;gBAE1B,KAAK,GAAE,MAAe;IAE1C,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAU3C,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAI5C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI5B,gCAAgC;IAChC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAMD,qBAAa,oBAAoB;IAI7B,OAAO,CAAC,UAAU;IAHpB,OAAO,CAAC,KAAK,CAAc;gBAGjB,UAAU,EAAE,aAAa,EACjC,KAAK,CAAC,EAAE,WAAW;IAKrB;;;OAGG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA4F9E;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;CAGtC;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAE/B,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM,EACzB,OAAO,EAAE,MAAM;CAKlB"}

package/dist/cloud/auth/api-key-middleware.js

@@ -0,0 +1,147 @@
+/**
+ * API Key Authentication Middleware (S-2.4)
+ *
+ * Extracts `Authorization: Bearer al_...`, looks up key by prefix,
+ * verifies hash, attaches org_id to request context.
+ * Cache-friendly: in-memory Map with 60s TTL (Redis-replaceable).
+ * `last_used_at` updated non-blocking. Full key never logged.
+ */
+import { ApiKeyService } from './api-keys.js';
+// ═══════════════════════════════════════════
+// In-Memory Cache (Redis-replaceable)
+// ═══════════════════════════════════════════
+export class InMemoryApiKeyCache {
+    ttlMs;
+    cache = new Map();
+    constructor(ttlMs = 60_000) {
+        this.ttlMs = ttlMs;
+    }
+    get(prefix) {
+        const entry = this.cache.get(prefix);
+        if (!entry)
+            return undefined;
+        if (Date.now() - entry.cachedAt > this.ttlMs) {
+            this.cache.delete(prefix);
+            return undefined;
+        }
+        return entry;
+    }
+    set(prefix, entry) {
+        this.cache.set(prefix, entry);
+    }
+    delete(prefix) {
+        this.cache.delete(prefix);
+    }
+    /** For testing: get raw size */
+    get size() {
+        return this.cache.size;
+    }
+}
+// ═══════════════════════════════════════════
+// Middleware
+// ═══════════════════════════════════════════
+export class ApiKeyAuthMiddleware {
+    keyService;
+    cache;
+    constructor(keyService, cache) {
+        this.keyService = keyService;
+        this.cache = cache ?? new InMemoryApiKeyCache(60_000);
+    }
+    /**
+     * Authenticate an API key from Authorization header.
+     * Returns auth context or throws.
+     */
+    async authenticate(authHeader) {
+        // 1. Extract bearer token
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            throw new ApiKeyAuthError(401, 'Missing or invalid Authorization header');
+        }
+        const fullKey = authHeader.slice(7); // strip "Bearer "
+        // 2. Validate key format
+        if (!fullKey.startsWith('al_live_') && !fullKey.startsWith('al_test_')) {
+            throw new ApiKeyAuthError(401, 'Invalid API key format');
+        }
+        const prefix = fullKey.slice(0, 16);
+        // 3. Check cache
+        const cached = this.cache.get(prefix);
+        if (cached) {
+            if (cached.revoked) {
+                throw new ApiKeyAuthError(401, 'Invalid or revoked API key');
+            }
+            // Verify hash even on cache hit (the cache stores hash, we verify full key)
+            const valid = await this.keyService.verifyKey(fullKey, cached.keyHash);
+            if (!valid) {
+                throw new ApiKeyAuthError(401, 'Invalid or revoked API key');
+            }
+            // Update last_used_at non-blocking
+            this.keyService.updateLastUsed(cached.keyId);
+            return {
+                orgId: cached.orgId,
+                keyId: cached.keyId,
+                scopes: cached.scopes,
+                rateLimitOverride: cached.rateLimitOverride,
+                environment: cached.environment,
+            };
+        }
+        // 4. Cache miss → DB lookup
+        const keyRecord = await this.keyService.findByPrefix(prefix);
+        if (!keyRecord) {
+            throw new ApiKeyAuthError(401, 'Invalid or revoked API key');
+        }
+        // 5. Check revocation
+        if (keyRecord.revoked_at) {
+            // Cache the revoked state
+            this.cache.set(prefix, {
+                orgId: keyRecord.org_id,
+                keyId: keyRecord.id,
+                keyHash: keyRecord.key_hash,
+                scopes: keyRecord.scopes,
+                rateLimitOverride: keyRecord.rate_limit_override,
+                environment: keyRecord.environment,
+                revoked: true,
+                cachedAt: Date.now(),
+            });
+            throw new ApiKeyAuthError(401, 'Invalid or revoked API key');
+        }
+        // 6. Verify hash
+        const valid = await this.keyService.verifyKey(fullKey, keyRecord.key_hash);
+        if (!valid) {
+            throw new ApiKeyAuthError(401, 'Invalid or revoked API key');
+        }
+        // 7. Cache the result
+        this.cache.set(prefix, {
+            orgId: keyRecord.org_id,
+            keyId: keyRecord.id,
+            keyHash: keyRecord.key_hash,
+            scopes: keyRecord.scopes,
+            rateLimitOverride: keyRecord.rate_limit_override,
+            environment: keyRecord.environment,
+            revoked: false,
+            cachedAt: Date.now(),
+        });
+        // 8. Update last_used_at non-blocking
+        this.keyService.updateLastUsed(keyRecord.id);
+        return {
+            orgId: keyRecord.org_id,
+            keyId: keyRecord.id,
+            scopes: keyRecord.scopes,
+            rateLimitOverride: keyRecord.rate_limit_override,
+            environment: keyRecord.environment,
+        };
+    }
+    /**
+     * Invalidate cache for a key prefix (called on revocation).
+     */
+    invalidateCache(prefix) {
+        this.cache.delete(prefix);
+    }
+}
+export class ApiKeyAuthError extends Error {
+    statusCode;
+    constructor(statusCode, message) {
+        super(message);
+        this.statusCode = statusCode;
+        this.name = 'ApiKeyAuthError';
+    }
+}
+//# sourceMappingURL=api-key-middleware.js.map

package/dist/cloud/auth/api-key-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-middleware.js","sourceRoot":"","sources":["../../../src/cloud/auth/api-key-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAmC9C,8CAA8C;AAC9C,sCAAsC;AACtC,8CAA8C;AAE9C,MAAM,OAAO,mBAAmB;IAGV;IAFZ,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE9C,YAAoB,QAAgB,MAAM;QAAtB,UAAK,GAAL,KAAK,CAAiB;IAAG,CAAC;IAE9C,GAAG,CAAC,MAAc;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,GAAG,CAAC,MAAc,EAAE,KAAiB;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,gCAAgC;IAChC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AAED,8CAA8C;AAC9C,aAAa;AACb,8CAA8C;AAE9C,MAAM,OAAO,oBAAoB;IAIrB;IAHF,KAAK,CAAc;IAE3B,YACU,UAAyB,EACjC,KAAmB;QADX,eAAU,GAAV,UAAU,CAAe;QAGjC,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,UAA8B;QAC/C,0BAA0B;QAC1B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAEvD,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEpC,iBAAiB;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YAC/D,CAAC;YAED,4EAA4E;YAC5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YAC/D,CAAC;YAED,mCAAmC;YACnC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7C,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QAED,sBAAsB;QACtB,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACzB,0BAA0B;YAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;gBACrB,KAAK,EAAE,SAAS,CAAC,MAAM;gBACvB,KAAK,EAAE,SAAS,CAAC,EAAE;gBACnB,OAAO,EAAE,SAAS,CAAC,QAAQ;gBAC3B,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,iBAAiB,EAAE,SAAS,CAAC,mBAAmB;gBAChD,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;aACrB,CAAC,CAAC;YACH,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QAED,iBAAiB;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;YACrB,KAAK,EAAE,SAAS,CAAC,MAAM;YACvB,KAAK,EAAE,SAAS,CAAC,EAAE;YACnB,OAAO,EAAE,SAAS,CAAC,QAAQ;YAC3B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,iBAAiB,EAAE,SAAS,CAAC,mBAAmB;YAChD,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;QAEH,sCAAsC;QACtC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAE7C,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,MAAM;YACvB,KAAK,EAAE,SAAS,CAAC,EAAE;YACnB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,iBAAiB,EAAE,SAAS,CAAC,mBAAmB;YAChD,WAAW,EAAE,SAAS,CAAC,WAAW;SACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAAc;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE/B;IADT,YACS,UAAkB,EACzB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,eAAU,GAAV,UAAU,CAAQ;QAIzB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF"}

package/dist/cloud/auth/api-keys.d.ts

@@ -0,0 +1,90 @@
+/**
+ * API Key CRUD Service (S-2.3)
+ *
+ * Create/list/revoke API keys. Keys follow `al_live_<random32>` / `al_test_<random32>` format.
+ * Store scrypt hash only — show full key once at creation.
+ * Tier limits: Free=2, Pro=10, Team=50.
+ */
+import type { MigrationClient } from '../migrate.js';
+export type ApiKeyEnvironment = 'production' | 'staging' | 'development' | 'test';
+export interface CreateApiKeyInput {
+    orgId: string;
+    name: string;
+    environment: ApiKeyEnvironment;
+    createdBy: string;
+    scopes?: string[];
+    rateLimitOverride?: number | null;
+}
+export interface ApiKeyRecord {
+    id: string;
+    org_id: string;
+    key_prefix: string;
+    name: string;
+    environment: ApiKeyEnvironment;
+    scopes: string[];
+    rate_limit_override: number | null;
+    created_by: string;
+    last_used_at: string | null;
+    revoked_at: string | null;
+    created_at: string;
+}
+export interface CreateApiKeyResult {
+    /** Full key — shown ONCE at creation */
+    fullKey: string;
+    record: ApiKeyRecord;
+}
+/**
+ * Generate a full API key: `al_live_<random32>` or `al_test_<random32>`.
+ * The "prefix" stored for lookup is the first 12 chars (e.g. `al_live_abcd`).
+ */
+export declare function generateApiKey(environment: ApiKeyEnvironment): {
+    fullKey: string;
+    prefix: string;
+};
+export declare class ApiKeyService {
+    private db;
+    constructor(db: MigrationClient);
+    /**
+     * Create a new API key. Returns full key (show once) + record.
+     */
+    create(input: CreateApiKeyInput): Promise<CreateApiKeyResult>;
+    /**
+     * List API keys for an org. Returns prefix + metadata only (no hash, no full key).
+     */
+    list(orgId: string): Promise<ApiKeyRecord[]>;
+    /**
+     * List only active (non-revoked) keys for an org.
+     */
+    listActive(orgId: string): Promise<ApiKeyRecord[]>;
+    /**
+     * Revoke an API key. Sets revoked_at timestamp.
+     */
+    revoke(orgId: string, keyId: string): Promise<boolean>;
+    /**
+     * Look up a key by prefix. Used by auth middleware.
+     */
+    findByPrefix(prefix: string): Promise<(ApiKeyRecord & {
+        key_hash: string;
+    }) | null>;
+    /**
+     * Update last_used_at (non-blocking, fire-and-forget).
+     */
+    updateLastUsed(keyId: string): void;
+    /**
+     * Verify a full API key against a stored hash.
+     */
+    verifyKey(fullKey: string, storedHash: string): Promise<boolean>;
+    /**
+     * Count active keys for an org.
+     */
+    countActive(orgId: string): Promise<number>;
+    /**
+     * Enforce tier-based key limits.
+     */
+    private enforceTierLimit;
+}
+export declare class ApiKeyError extends Error {
+    code: string;
+    constructor(code: string, message: string);
+}
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/cloud/auth/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../src/cloud/auth/api-keys.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAMrD,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,CAAC;AAElF,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,iBAAiB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,iBAAiB,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;CACtB;AAqBD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,iBAAiB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAQlG;AAMD,qBAAa,aAAa;IACZ,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,eAAe;IAEvC;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgCnE;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAYlD;;OAEG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAYxD;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ5D;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,YAAY,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAYzF;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAMnC;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQjD;;OAEG;YACW,gBAAgB;CAgB/B;AAED,qBAAa,WAAY,SAAQ,KAAK;IAE3B,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM;CAKlB"}

package/dist/cloud/auth/api-keys.js

@@ -0,0 +1,162 @@
+/**
+ * API Key CRUD Service (S-2.3)
+ *
+ * Create/list/revoke API keys. Keys follow `al_live_<random32>` / `al_test_<random32>` format.
+ * Store scrypt hash only — show full key once at creation.
+ * Tier limits: Free=2, Pro=10, Team=50.
+ */
+import { randomBytes } from 'node:crypto';
+import { hashPassword, verifyPassword } from './passwords.js';
+// ═══════════════════════════════════════════
+// Constants
+// ═══════════════════════════════════════════
+const TIER_KEY_LIMITS = {
+    free: 2,
+    pro: 10,
+    team: 50,
+    enterprise: 200,
+};
+const KEY_PREFIX_LIVE = 'al_live_';
+const KEY_PREFIX_TEST = 'al_test_';
+const KEY_RANDOM_BYTES = 24; // 24 bytes → 32 base64url chars
+// ═══════════════════════════════════════════
+// Key Generation
+// ═══════════════════════════════════════════
+/**
+ * Generate a full API key: `al_live_<random32>` or `al_test_<random32>`.
+ * The "prefix" stored for lookup is the first 12 chars (e.g. `al_live_abcd`).
+ */
+export function generateApiKey(environment) {
+    const isTest = environment === 'test' || environment === 'development';
+    const base = isTest ? KEY_PREFIX_TEST : KEY_PREFIX_LIVE;
+    const random = randomBytes(KEY_RANDOM_BYTES).toString('base64url');
+    const fullKey = `${base}${random}`;
+    // Prefix = first 16 chars for uniqueness (e.g. `al_live_abcdefgh`)
+    const prefix = fullKey.slice(0, 16);
+    return { fullKey, prefix };
+}
+// ═══════════════════════════════════════════
+// API Key Service
+// ═══════════════════════════════════════════
+export class ApiKeyService {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * Create a new API key. Returns full key (show once) + record.
+     */
+    async create(input) {
+        // Check tier limit
+        await this.enforceTierLimit(input.orgId);
+        const { fullKey, prefix } = generateApiKey(input.environment);
+        const keyHash = await hashPassword(fullKey);
+        const result = await this.db.query(`INSERT INTO api_keys (org_id, key_prefix, key_hash, name, environment, scopes, rate_limit_override, created_by)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+       RETURNING id, org_id, key_prefix, name, environment, scopes, rate_limit_override, created_by, last_used_at, revoked_at, created_at`, [
+            input.orgId,
+            prefix,
+            keyHash,
+            input.name,
+            input.environment,
+            JSON.stringify(input.scopes ?? ['ingest', 'query']),
+            input.rateLimitOverride ?? null,
+            input.createdBy,
+        ]);
+        const record = result.rows[0];
+        // Parse scopes from JSONB string if needed
+        if (typeof record.scopes === 'string') {
+            record.scopes = JSON.parse(record.scopes);
+        }
+        return { fullKey, record };
+    }
+    /**
+     * List API keys for an org. Returns prefix + metadata only (no hash, no full key).
+     */
+    async list(orgId) {
+        const result = await this.db.query(`SELECT id, org_id, key_prefix, name, environment, scopes, rate_limit_override, created_by, last_used_at, revoked_at, created_at
+       FROM api_keys WHERE org_id = $1 ORDER BY created_at DESC`, [orgId]);
+        return result.rows.map((r) => {
+            if (typeof r.scopes === 'string')
+                r.scopes = JSON.parse(r.scopes);
+            return r;
+        });
+    }
+    /**
+     * List only active (non-revoked) keys for an org.
+     */
+    async listActive(orgId) {
+        const result = await this.db.query(`SELECT id, org_id, key_prefix, name, environment, scopes, rate_limit_override, created_by, last_used_at, revoked_at, created_at
+       FROM api_keys WHERE org_id = $1 AND revoked_at IS NULL ORDER BY created_at DESC`, [orgId]);
+        return result.rows.map((r) => {
+            if (typeof r.scopes === 'string')
+                r.scopes = JSON.parse(r.scopes);
+            return r;
+        });
+    }
+    /**
+     * Revoke an API key. Sets revoked_at timestamp.
+     */
+    async revoke(orgId, keyId) {
+        const result = await this.db.query(`UPDATE api_keys SET revoked_at = now() WHERE id = $1 AND org_id = $2 AND revoked_at IS NULL`, [keyId, orgId]);
+        return result.rowCount > 0;
+    }
+    /**
+     * Look up a key by prefix. Used by auth middleware.
+     */
+    async findByPrefix(prefix) {
+        const result = await this.db.query(`SELECT id, org_id, key_prefix, key_hash, name, environment, scopes, rate_limit_override, created_by, last_used_at, revoked_at, created_at
+       FROM api_keys WHERE key_prefix = $1`, [prefix]);
+        const row = result.rows[0];
+        if (!row)
+            return null;
+        if (typeof row.scopes === 'string')
+            row.scopes = JSON.parse(row.scopes);
+        return row;
+    }
+    /**
+     * Update last_used_at (non-blocking, fire-and-forget).
+     */
+    updateLastUsed(keyId) {
+        this.db.query(`UPDATE api_keys SET last_used_at = now() WHERE id = $1`, [keyId]).catch(() => {
+            // Fire and forget — don't block request
+        });
+    }
+    /**
+     * Verify a full API key against a stored hash.
+     */
+    async verifyKey(fullKey, storedHash) {
+        return verifyPassword(fullKey, storedHash);
+    }
+    /**
+     * Count active keys for an org.
+     */
+    async countActive(orgId) {
+        const result = await this.db.query(`SELECT COUNT(*)::int as count FROM api_keys WHERE org_id = $1 AND revoked_at IS NULL`, [orgId]);
+        return result.rows[0].count;
+    }
+    /**
+     * Enforce tier-based key limits.
+     */
+    async enforceTierLimit(orgId) {
+        // Get org plan
+        const orgResult = await this.db.query(`SELECT plan FROM orgs WHERE id = $1`, [orgId]);
+        const org = orgResult.rows[0];
+        if (!org)
+            throw new ApiKeyError('org_not_found', 'Organization not found');
+        const limit = TIER_KEY_LIMITS[org.plan] ?? TIER_KEY_LIMITS.free;
+        const count = await this.countActive(orgId);
+        if (count >= limit) {
+            throw new ApiKeyError('key_limit_reached', `API key limit reached for ${org.plan} plan (${limit} keys). Upgrade to create more.`);
+        }
+    }
+}
+export class ApiKeyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ApiKeyError';
+    }
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/cloud/auth/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../../src/cloud/auth/api-keys.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAsC9D,8CAA8C;AAC9C,YAAY;AACZ,8CAA8C;AAE9C,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,EAAE;IACP,IAAI,EAAE,EAAE;IACR,UAAU,EAAE,GAAG;CAChB,CAAC;AAEF,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,gBAAgB,GAAG,EAAE,CAAC,CAAC,gCAAgC;AAE7D,8CAA8C;AAC9C,iBAAiB;AACjB,8CAA8C;AAE9C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,WAA8B;IAC3D,MAAM,MAAM,GAAG,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,aAAa,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;IACnC,mEAAmE;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,8CAA8C;AAC9C,kBAAkB;AAClB,8CAA8C;AAE9C,MAAM,OAAO,aAAa;IACJ;IAApB,YAAoB,EAAmB;QAAnB,OAAE,GAAF,EAAE,CAAiB;IAAG,CAAC;IAE3C;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAwB;QACnC,mBAAmB;QACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEzC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC;;0IAEoI,EACpI;YACE,KAAK,CAAC,KAAK;YACX,MAAM;YACN,OAAO;YACP,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,WAAW;YACjB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAC/B,KAAK,CAAC,SAAS;SAChB,CACF,CAAC;QAEF,MAAM,MAAM,GAAI,MAAM,CAAC,IAAuB,CAAC,CAAC,CAAC,CAAC;QAClD,2CAA2C;QAC3C,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAA2B,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC;gEAC0D,EAC1D,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAQ,MAAM,CAAC,IAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAA2B,CAAC,CAAC;YACvF,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC;uFACiF,EACjF,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAQ,MAAM,CAAC,IAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAA2B,CAAC,CAAC;YACvF,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC,6FAA6F,EAC7F,CAAC,KAAK,EAAE,KAAK,CAAC,CACf,CAAC;QACF,OAAQ,MAAc,CAAC,QAAQ,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC;2CACqC,EACrC,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,GAAG,GAAI,MAAM,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAAa;QAC1B,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,wDAAwD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1F,wCAAwC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,UAAkB;QACjD,OAAO,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC,sFAAsF,EACtF,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAQ,MAAM,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAC1C,eAAe;QACf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,GAAG,GAAI,SAAS,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QAE3E,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAE5C,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,WAAW,CACnB,mBAAmB,EACnB,6BAA6B,GAAG,CAAC,IAAI,UAAU,KAAK,iCAAiC,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAE3B;IADT,YACS,IAAY,EACnB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,SAAI,GAAJ,IAAI,CAAQ;QAInB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF"}

package/dist/cloud/auth/audit-log.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Audit Log Service (S-2.6)
+ *
+ * Append-only, immutable audit log for security-relevant events.
+ * Supports: auth events, API key ops, member management, settings changes,
+ * data exports, billing events.
+ */
+import type { MigrationClient } from '../migrate.js';
+export type AuditAction = 'auth.login' | 'auth.logout' | 'auth.login_failed' | 'auth.password_reset' | 'auth.email_verified' | 'api_key.created' | 'api_key.revoked' | 'member.invited' | 'member.removed' | 'member.role_changed' | 'settings.updated' | 'org.deleted' | 'org.ownership_transferred' | 'data.exported' | 'data.imported' | 'billing.plan_changed' | 'billing.payment_failed' | 'permission.denied';
+export type ActorType = 'user' | 'api_key' | 'system';
+export type AuditResult = 'success' | 'failure';
+export interface AuditEntry {
+    id: string;
+    org_id: string;
+    actor_type: ActorType;
+    actor_id: string;
+    action: AuditAction;
+    resource_type: string;
+    resource_id: string | null;
+    details: Record<string, unknown> | null;
+    ip_address: string | null;
+    result: AuditResult;
+    created_at: string;
+}
+export interface WriteAuditEntry {
+    org_id: string;
+    actor_type: ActorType;
+    actor_id: string;
+    action: AuditAction;
+    resource_type: string;
+    resource_id?: string | null;
+    details?: Record<string, unknown> | null;
+    ip_address?: string | null;
+    result: AuditResult;
+}
+export interface AuditQueryFilters {
+    org_id: string;
+    action?: AuditAction;
+    actor_id?: string;
+    resource_type?: string;
+    from?: Date;
+    to?: Date;
+    limit?: number;
+    offset?: number;
+}
+export declare class AuditLogService {
+    private db;
+    constructor(db: MigrationClient);
+    /**
+     * Write an audit log entry. Append-only — no updates or deletes.
+     */
+    write(entry: WriteAuditEntry): Promise<AuditEntry>;
+    /**
+     * Query audit log with filters. Results ordered by created_at DESC.
+     */
+    query(filters: AuditQueryFilters): Promise<{
+        entries: AuditEntry[];
+        total: number;
+    }>;
+    /**
+     * Export all audit log entries for an org within a time range.
+     * Returns JSON array (for download).
+     */
+    export(org_id: string, from?: Date, to?: Date): Promise<AuditEntry[]>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/cloud/auth/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/cloud/auth/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,WAAW,GAEnB,YAAY,GACZ,aAAa,GACb,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GAErB,iBAAiB,GACjB,iBAAiB,GAEjB,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GAErB,kBAAkB,GAClB,aAAa,GACb,2BAA2B,GAE3B,eAAe,GACf,eAAe,GAEf,sBAAsB,GACtB,wBAAwB,GAExB,mBAAmB,CAAC;AAExB,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AACtD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,EAAE,CAAC,EAAE,IAAI,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,eAAe;IACd,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,eAAe;IAEvC;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAoBxD;;OAEG;IACG,KAAK,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA+C1F;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CAqB5E"}

package/dist/cloud/auth/audit-log.js

@@ -0,0 +1,92 @@
+/**
+ * Audit Log Service (S-2.6)
+ *
+ * Append-only, immutable audit log for security-relevant events.
+ * Supports: auth events, API key ops, member management, settings changes,
+ * data exports, billing events.
+ */
+export class AuditLogService {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * Write an audit log entry. Append-only — no updates or deletes.
+     */
+    async write(entry) {
+        const result = await this.db.query(`INSERT INTO audit_log (org_id, actor_type, actor_id, action, resource_type, resource_id, details, ip_address, result)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8::inet, $9)
+       RETURNING *`, [
+            entry.org_id,
+            entry.actor_type,
+            entry.actor_id,
+            entry.action,
+            entry.resource_type,
+            entry.resource_id ?? null,
+            entry.details ? JSON.stringify(entry.details) : null,
+            entry.ip_address ?? null,
+            entry.result,
+        ]);
+        return result.rows[0];
+    }
+    /**
+     * Query audit log with filters. Results ordered by created_at DESC.
+     */
+    async query(filters) {
+        const conditions = ['org_id = $1'];
+        const params = [filters.org_id];
+        let paramIdx = 2;
+        if (filters.action) {
+            conditions.push(`action = $${paramIdx++}`);
+            params.push(filters.action);
+        }
+        if (filters.actor_id) {
+            conditions.push(`actor_id = $${paramIdx++}`);
+            params.push(filters.actor_id);
+        }
+        if (filters.resource_type) {
+            conditions.push(`resource_type = $${paramIdx++}`);
+            params.push(filters.resource_type);
+        }
+        if (filters.from) {
+            conditions.push(`created_at >= $${paramIdx++}`);
+            params.push(filters.from.toISOString());
+        }
+        if (filters.to) {
+            conditions.push(`created_at <= $${paramIdx++}`);
+            params.push(filters.to.toISOString());
+        }
+        const where = conditions.join(' AND ');
+        const limit = filters.limit ?? 50;
+        const offset = filters.offset ?? 0;
+        const [dataResult, countResult] = await Promise.all([
+            this.db.query(`SELECT * FROM audit_log WHERE ${where} ORDER BY created_at DESC LIMIT $${paramIdx++} OFFSET $${paramIdx++}`, [...params, limit, offset]),
+            this.db.query(`SELECT COUNT(*)::int as total FROM audit_log WHERE ${where}`, params),
+        ]);
+        return {
+            entries: dataResult.rows,
+            total: countResult.rows[0].total,
+        };
+    }
+    /**
+     * Export all audit log entries for an org within a time range.
+     * Returns JSON array (for download).
+     */
+    async export(org_id, from, to) {
+        const conditions = ['org_id = $1'];
+        const params = [org_id];
+        let paramIdx = 2;
+        if (from) {
+            conditions.push(`created_at >= $${paramIdx++}`);
+            params.push(from.toISOString());
+        }
+        if (to) {
+            conditions.push(`created_at <= $${paramIdx++}`);
+            params.push(to.toISOString());
+        }
+        const where = conditions.join(' AND ');
+        const result = await this.db.query(`SELECT * FROM audit_log WHERE ${where} ORDER BY created_at ASC`, params);
+        return result.rows;
+    }
+}
+//# sourceMappingURL=audit-log.js.map

package/dist/cloud/auth/audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../../src/cloud/auth/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuEH,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,EAAmB;QAAnB,OAAE,GAAF,EAAE,CAAiB;IAAG,CAAC;IAE3C;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAsB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC;;mBAEa,EACb;YACE,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,WAAW,IAAI,IAAI;YACzB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YACpD,KAAK,CAAC,UAAU,IAAI,IAAI;YACxB,KAAK,CAAC,MAAM;SACb,CACF,CAAC;QACF,OAAQ,MAAM,CAAC,IAAqB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,OAA0B;QACpC,MAAM,UAAU,GAAa,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,aAAa,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,eAAe,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC,oBAAoB,QAAQ,EAAE,EAAE,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC,kBAAkB,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,kBAAkB,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAEnC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClD,IAAI,CAAC,EAAE,CAAC,KAAK,CACX,iCAAiC,KAAK,oCAAoC,QAAQ,EAAE,YAAY,QAAQ,EAAE,EAAE,EAC5G,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAC3B;YACD,IAAI,CAAC,EAAE,CAAC,KAAK,CACX,sDAAsD,KAAK,EAAE,EAC7D,MAAM,CACP;SACF,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,UAAU,CAAC,IAAoB;YACxC,KAAK,EAAG,WAAW,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC,KAAK;SAC5C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,IAAW,EAAE,EAAS;QACjD,MAAM,UAAU,GAAa,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAc,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,IAAI,IAAI,EAAE,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,kBAAkB,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,EAAE,EAAE,CAAC;YACP,UAAU,CAAC,IAAI,CAAC,kBAAkB,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC,iCAAiC,KAAK,0BAA0B,EAChE,MAAM,CACP,CAAC;QACF,OAAO,MAAM,CAAC,IAAoB,CAAC;IACrC,CAAC;CACF"}