@agentlensai/server 0.10.0 → 0.13.0

package/dist/cloud/storage/sqlite-adapter.js

@@ -0,0 +1,176 @@
+/**
+ * SQLite Storage Adapter (S-4.1, S-4.3, S-4.4)
+ *
+ * Wraps the existing SqliteEventStore to implement the StorageAdapter interface.
+ * orgId is mapped to tenantId for multi-tenant SQLite (self-hosted).
+ *
+ * S-4.3: Analytics use SQLite strftime for time bucketing.
+ * S-4.4: Full-text search uses LIKE (SQLite lacks tsvector; FTS5 optional).
+ */
+export class SqliteStorageAdapter {
+    store;
+    constructor(store) {
+        this.store = store;
+    }
+    async queryEvents(orgId, query) {
+        return this.store.queryEvents({ ...query, tenantId: orgId });
+    }
+    async getEventsBySession(orgId, sessionId) {
+        return this.store.getSessionTimeline(sessionId, orgId);
+    }
+    async getSessions(orgId, query) {
+        const result = await this.store.querySessions({ ...query, tenantId: orgId });
+        const limit = Math.min(query.limit ?? 50, 500);
+        const offset = query.offset ?? 0;
+        return {
+            items: result.sessions,
+            total: result.total,
+            hasMore: offset + result.sessions.length < result.total,
+        };
+    }
+    async getSession(orgId, sessionId) {
+        return this.store.getSession(sessionId, orgId);
+    }
+    async getAgents(orgId) {
+        return this.store.listAgents(orgId);
+    }
+    async getStats(orgId) {
+        return this.store.getStats(orgId);
+    }
+    // ═══════════════════════════════════════════════════════════
+    // S-4.3: Analytics Queries (SQLite)
+    // ═══════════════════════════════════════════════════════════
+    async getCostAnalytics(orgId, query) {
+        const analyticsResult = await this.store.getAnalytics({
+            from: query.from,
+            to: query.to,
+            agentId: query.agentId,
+            granularity: query.granularity,
+            tenantId: orgId,
+        });
+        const buckets = analyticsResult.buckets.map((b) => ({
+            timestamp: b.timestamp,
+            totalCostUsd: b.totalCostUsd,
+            eventCount: b.eventCount,
+        }));
+        return {
+            buckets,
+            totalCostUsd: analyticsResult.totals.totalCostUsd,
+            totalEvents: analyticsResult.totals.eventCount,
+        };
+    }
+    async getHealthAnalytics(_orgId, _query) {
+        // SQLite self-hosted: health_snapshots not yet implemented in the base store.
+        // Return empty results — feature parity is maintained by running the same
+        // test interface; the Postgres adapter provides the full implementation.
+        return { snapshots: [] };
+    }
+    async getTokenUsage(orgId, query) {
+        // Delegate to getAnalytics and extract token-relevant data
+        // The SQLite store tracks tokens via llm_response events in payload
+        const result = await this.store.getAnalytics({
+            from: query.from,
+            to: query.to,
+            agentId: query.agentId,
+            granularity: query.granularity,
+            tenantId: orgId,
+        });
+        // The standard analytics doesn't break out tokens, so we return
+        // what we can from the event counts. For full token data, the
+        // store would need a dedicated query.
+        const buckets = result.buckets.map((b) => ({
+            timestamp: b.timestamp,
+            inputTokens: 0,
+            outputTokens: 0,
+            totalTokens: 0,
+            llmCallCount: 0,
+        }));
+        return {
+            buckets,
+            totals: { inputTokens: 0, outputTokens: 0, totalTokens: 0, llmCallCount: 0 },
+        };
+    }
+    async getAnalytics(orgId, query) {
+        return this.store.getAnalytics({
+            from: query.from,
+            to: query.to,
+            agentId: query.agentId,
+            granularity: query.granularity,
+            tenantId: orgId,
+        });
+    }
+    // ═══════════════════════════════════════════════════════════
+    // S-4.4: Full-Text Search (SQLite — LIKE fallback)
+    // ═══════════════════════════════════════════════════════════
+    async search(orgId, query) {
+        const limit = Math.min(query.limit ?? 20, 100);
+        const offset = query.offset ?? 0;
+        const scope = query.scope ?? 'all';
+        const searchTerm = query.query.trim();
+        if (!searchTerm) {
+            return { items: [], total: 0, hasMore: false };
+        }
+        const items = [];
+        let total = 0;
+        // Search events via existing queryEvents with search parameter
+        if (scope === 'events' || scope === 'all') {
+            const eventResult = await this.store.queryEvents({
+                tenantId: orgId,
+                search: searchTerm,
+                from: query.from,
+                to: query.to,
+                limit,
+                offset,
+            });
+            for (const event of eventResult.events) {
+                const payloadStr = typeof event.payload === 'string'
+                    ? event.payload
+                    : JSON.stringify(event.payload);
+                // Create a simple headline: first 60 chars of payload containing match
+                const idx = payloadStr.toLowerCase().indexOf(searchTerm.toLowerCase());
+                const start = Math.max(0, idx - 20);
+                const headline = payloadStr.substring(start, start + 80);
+                items.push({
+                    type: 'event',
+                    id: event.id,
+                    score: 1.0, // SQLite LIKE doesn't give relevance scores
+                    headline,
+                    timestamp: event.timestamp,
+                    sessionId: event.sessionId,
+                });
+            }
+            total += eventResult.total;
+        }
+        // Search sessions via querySessions (by tags/agent name match)
+        if (scope === 'sessions' || scope === 'all') {
+            const sessionResult = await this.store.querySessions({
+                tenantId: orgId,
+                from: query.from,
+                to: query.to,
+                limit,
+                offset,
+            });
+            // Filter sessions that match the search term in agent name or tags
+            const matching = sessionResult.sessions.filter((s) => {
+                const text = `${s.agentName ?? ''} ${(s.tags ?? []).join(' ')}`.toLowerCase();
+                return text.includes(searchTerm.toLowerCase());
+            });
+            for (const session of matching) {
+                items.push({
+                    type: 'session',
+                    id: session.id,
+                    score: 1.0,
+                    headline: `${session.agentName ?? 'Unknown'} — ${(session.tags ?? []).join(', ')}`,
+                    timestamp: session.startedAt,
+                });
+            }
+            total += matching.length;
+        }
+        return {
+            items: items.slice(0, limit),
+            total,
+            hasMore: offset + Math.min(items.length, limit) < total,
+        };
+    }
+}
+//# sourceMappingURL=sqlite-adapter.js.map

package/dist/cloud/storage/sqlite-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-adapter.js","sourceRoot":"","sources":["../../../src/cloud/storage/sqlite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAwBH,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,KAAuB;QAAvB,UAAK,GAAL,KAAK,CAAkB;IAAG,CAAC;IAExD,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,KAAiB;QAChD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,SAAiB;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,KAAmB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACjC,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,QAAQ;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK;SACxD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,SAAiB;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,8DAA8D;IAC9D,oCAAoC;IACpC,8DAA8D;IAE9D,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,KAAqB;QACzD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YACpD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClD,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,OAAO;YACP,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,YAAY;YACjD,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC,UAAU;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,MAAsB;QAC7D,8EAA8E;QAC9E,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,KAAqB;QACtD,2DAA2D;QAC3D,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,gEAAgE;QAChE,8DAA8D;QAC9D,sCAAsC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,OAAO;YACP,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;SAC7E,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,KAAqB;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,mDAAmD;IACnD,8DAA8D;IAE9D,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAkB;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAEtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACjD,CAAC;QAED,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,+DAA+D;QAC/D,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC/C,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK;gBACL,MAAM;aACP,CAAC,CAAC;YAEH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;gBACvC,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;oBAClD,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAClC,uEAAuE;gBACvE,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBACpC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;gBAEzD,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,KAAK,EAAE,GAAG,EAAE,4CAA4C;oBACxD,QAAQ;oBACR,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,+DAA+D;QAC/D,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBACnD,QAAQ,EAAE,KAAK;gBACf,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK;gBACL,MAAM;aACP,CAAC,CAAC;YAEH,mEAAmE;YACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACnD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC9E,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,CAAC;YAEH,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,SAAS;oBACf,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,KAAK,EAAE,GAAG;oBACV,QAAQ,EAAE,GAAG,OAAO,CAAC,SAAS,IAAI,SAAS,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAClF,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B,CAAC,CAAC;YACL,CAAC;YACD,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC3B,CAAC;QAED,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;YAC5B,KAAK;YACL,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK;SACxD,CAAC;IACJ,CAAC;CACF"}

package/dist/cloud/tenant-pool.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Tenant-Aware Connection Pool (S-1.5)
+ *
+ * Wraps a PostgreSQL pool to automatically set `app.current_org`
+ * via SET LOCAL within a transaction. SET LOCAL is scoped to the
+ * transaction and auto-resets on commit/rollback, making it safe
+ * for connection reuse and compatible with PgBouncer transaction mode.
+ */
+export interface PoolClient {
+    query(sql: string, params?: unknown[]): Promise<{
+        rows: unknown[];
+        rowCount: number;
+    }>;
+    release(): void;
+}
+export interface Pool {
+    connect(): Promise<PoolClient>;
+    query(sql: string, params?: unknown[]): Promise<{
+        rows: unknown[];
+        rowCount: number;
+    }>;
+    end(): Promise<void>;
+}
+export interface TenantQueryResult {
+    rows: unknown[];
+    rowCount: number;
+}
+/**
+ * Execute a function within a tenant-scoped transaction.
+ *
+ * 1. Acquires connection from pool
+ * 2. BEGIN transaction
+ * 3. SET LOCAL app.current_org = orgId (scoped to transaction)
+ * 4. Execute the callback
+ * 5. COMMIT (or ROLLBACK on error)
+ * 6. Return connection to pool (app.current_org is auto-cleared)
+ */
+export declare function withTenantTransaction<T>(pool: Pool, orgId: string, fn: (client: PoolClient) => Promise<T>): Promise<T>;
+/**
+ * Execute a single query within a tenant-scoped transaction.
+ * Convenience wrapper around withTenantTransaction for simple queries.
+ */
+export declare function tenantQuery(pool: Pool, orgId: string, sql: string, params?: unknown[]): Promise<TenantQueryResult>;
+/**
+ * Execute a query WITHOUT tenant context.
+ * Use only for cross-tenant operations (e.g., admin queries, migrations).
+ */
+export declare function adminQuery(pool: Pool, sql: string, params?: unknown[]): Promise<TenantQueryResult>;
+//# sourceMappingURL=tenant-pool.d.ts.map

package/dist/cloud/tenant-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-pool.d.ts","sourceRoot":"","sources":["../../src/cloud/tenant-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,IAAI;IACnB,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GACrC,OAAO,CAAC,CAAC,CAAC,CAyBZ;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAI5B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAE5B"}

package/dist/cloud/tenant-pool.js

@@ -0,0 +1,61 @@
+/**
+ * Tenant-Aware Connection Pool (S-1.5)
+ *
+ * Wraps a PostgreSQL pool to automatically set `app.current_org`
+ * via SET LOCAL within a transaction. SET LOCAL is scoped to the
+ * transaction and auto-resets on commit/rollback, making it safe
+ * for connection reuse and compatible with PgBouncer transaction mode.
+ */
+/**
+ * Execute a function within a tenant-scoped transaction.
+ *
+ * 1. Acquires connection from pool
+ * 2. BEGIN transaction
+ * 3. SET LOCAL app.current_org = orgId (scoped to transaction)
+ * 4. Execute the callback
+ * 5. COMMIT (or ROLLBACK on error)
+ * 6. Return connection to pool (app.current_org is auto-cleared)
+ */
+export async function withTenantTransaction(pool, orgId, fn) {
+    if (!orgId || typeof orgId !== 'string') {
+        throw new Error('orgId is required for tenant-scoped transactions');
+    }
+    // Basic UUID format validation
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(orgId)) {
+        throw new Error('orgId must be a valid UUID');
+    }
+    const client = await pool.connect();
+    try {
+        await client.query('BEGIN');
+        // SET LOCAL is transaction-scoped: auto-clears on COMMIT/ROLLBACK
+        // Safe for PgBouncer transaction mode
+        await client.query(`SET LOCAL app.current_org = $1`, [orgId]);
+        const result = await fn(client);
+        await client.query('COMMIT');
+        return result;
+    }
+    catch (err) {
+        await client.query('ROLLBACK');
+        throw err;
+    }
+    finally {
+        client.release();
+    }
+}
+/**
+ * Execute a single query within a tenant-scoped transaction.
+ * Convenience wrapper around withTenantTransaction for simple queries.
+ */
+export async function tenantQuery(pool, orgId, sql, params) {
+    return withTenantTransaction(pool, orgId, async (client) => {
+        return client.query(sql, params);
+    });
+}
+/**
+ * Execute a query WITHOUT tenant context.
+ * Use only for cross-tenant operations (e.g., admin queries, migrations).
+ */
+export async function adminQuery(pool, sql, params) {
+    return pool.query(sql, params);
+}
+//# sourceMappingURL=tenant-pool.js.map

package/dist/cloud/tenant-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-pool.js","sourceRoot":"","sources":["../../src/cloud/tenant-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAkBH;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAU,EACV,KAAa,EACb,EAAsC;IAEtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,kEAAkE;QAClE,sCAAsC;QACtC,MAAM,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAU,EACV,KAAa,EACb,GAAW,EACX,MAAkB;IAElB,OAAO,qBAAqB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACzD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAU,EACV,GAAW,EACX,MAAkB;IAElB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC"}

package/dist/config.d.ts

@@ -4,17 +4,49 @@
 export interface ServerConfig {
     /** Port to listen on (default: 3400) */
     port: number;
-    /** CORS allowed origin (default: '*') */
+    /** CORS allowed origin (default: '*') — legacy single origin */
     corsOrigin: string;
+    /** Comma-separated CORS allowed origins (takes precedence over corsOrigin) */
+    corsOrigins?: string;
     /** Whether auth is disabled — dev mode (default: false) */
     authDisabled: boolean;
     /** SQLite database path (default: './agentlens.db') */
     dbPath: string;
+    /** Storage backend: 'sqlite' (default) or 'postgres' */
+    storageBackend: 'sqlite' | 'postgres';
     /** Retention days (0 = keep forever, default: 90) */
     retentionDays: number;
+    /** Optional bearer token for OTLP ingestion auth */
+    otlpAuthToken?: string;
+    /** OTLP rate limit per IP per minute (default: 1000) */
+    otlpRateLimit: number;
+    /** Whether OTLP endpoints require full unified auth (default: false) */
+    otlpAuthRequired: boolean;
+    /** Enable mesh proxy (default: false) */
+    meshEnabled: boolean;
+    /** Mesh HTTP server URL (required when meshEnabled) */
+    meshUrl: string;
+    /** Enable Lore memory integration (default: false) */
+    loreEnabled: boolean;
+    /** Lore mode: 'local' uses lore-sdk directly, 'remote' proxies to Lore server (default: 'remote') */
+    loreMode: 'local' | 'remote';
+    /** Lore API URL (required when loreMode === 'remote' && loreEnabled) */
+    loreApiUrl?: string;
+    /** Lore API key (required when loreMode === 'remote' && loreEnabled) */
+    loreApiKey?: string;
+    /** Lore SQLite database path (optional, lore-sdk has defaults) */
+    loreDbPath?: string;
+    /** HMAC-SHA256 key for signing audit verification reports (optional) */
+    auditSigningKey?: string;
+    /** Enable strict multi-tenant mode — rejects unscoped ingestion (default: false) [F6-S13] */
+    multiTenantMode: boolean;
 }
 /**
  * Read configuration from environment variables.
  */
 export declare function getConfig(): ServerConfig;
+/**
+ * Validate config at startup. Logs warnings and throws on fatal misconfigurations.
+ */
+export declare function validateConfig(config: ServerConfig): void;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,YAAY,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,YAAY,CAYxC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,YAAY,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,cAAc,EAAE,QAAQ,GAAG,UAAU,CAAC;IACtC,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,gBAAgB,EAAE,OAAO,CAAC;IAG1B,yCAAyC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAGhB,sDAAsD;IACtD,WAAW,EAAE,OAAO,CAAC;IACrB,qGAAqG;IACrG,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC7B,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,6FAA6F;IAC7F,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,YAAY,CAiDxC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAwBzD"}

package/dist/config.js

@@ -1,6 +1,8 @@
 /**
  * Server configuration — reads from environment variables with sensible defaults.
  */
+import { createLogger } from './lib/logger.js';
+const log = createLogger('Config');
 /**
  * Read configuration from environment variables.
  */
@@ -8,13 +10,81 @@ export function getConfig() {
     const port = parseInt(process.env['PORT'] ?? '3400', 10);
     return {
         port: isNaN(port) ? 3400 : port,
-        corsOrigin: process.env['CORS_ORIGIN'] ?? '*',
+        corsOrigin: process.env['CORS_ORIGIN'] ?? 'http://localhost:3400',
+        corsOrigins: process.env['CORS_ORIGINS'] || undefined,
         authDisabled: process.env['AUTH_DISABLED'] === 'true',
         dbPath: process.env['DB_PATH'] ?? process.env['DATABASE_PATH'] ?? './agentlens.db',
+        storageBackend: (() => {
+            const raw = process.env['STORAGE_BACKEND'] ?? process.env['DB_DIALECT'];
+            if (!raw)
+                return 'sqlite';
+            // Log deprecation if DB_DIALECT used without STORAGE_BACKEND
+            if (!process.env['STORAGE_BACKEND'] && process.env['DB_DIALECT']) {
+                log.warn('⚠️  DB_DIALECT is deprecated. Use STORAGE_BACKEND instead.');
+            }
+            const normalized = raw === 'postgresql' ? 'postgres' : raw;
+            if (normalized !== 'postgres' && normalized !== 'sqlite') {
+                throw new Error(`Invalid STORAGE_BACKEND: '${raw}'. Expected 'postgres', 'postgresql', or 'sqlite'.`);
+            }
+            return normalized;
+        })(),
         retentionDays: (() => {
             const parsed = parseInt(process.env['RETENTION_DAYS'] ?? '90', 10);
             return isNaN(parsed) ? 90 : parsed;
         })(),
+        otlpAuthToken: process.env['OTLP_AUTH_TOKEN'] || undefined,
+        otlpAuthRequired: process.env['OTLP_AUTH_REQUIRED'] === 'true',
+        otlpRateLimit: (() => {
+            const parsed = parseInt(process.env['OTLP_RATE_LIMIT'] ?? '1000', 10);
+            return isNaN(parsed) ? 1000 : parsed;
+        })(),
+        // Mesh integration
+        meshEnabled: process.env['MESH_ENABLED'] === 'true',
+        meshUrl: process.env['MESH_URL'] ?? '',
+        // Lore integration
+        loreEnabled: process.env['LORE_ENABLED'] === 'true',
+        loreMode: (process.env['LORE_MODE'] === 'local' ? 'local' : 'remote'),
+        loreApiUrl: process.env['LORE_API_URL'] || undefined,
+        loreApiKey: process.env['LORE_API_KEY'] || undefined,
+        loreDbPath: process.env['LORE_DB_PATH'] || undefined,
+        // Audit verification signing
+        auditSigningKey: process.env['AGENTLENS_AUDIT_SIGNING_KEY'] || undefined,
+        // Multi-tenant mode [F6-S13]
+        multiTenantMode: process.env['MULTI_TENANT_MODE'] === 'true',
     };
 }
+/**
+ * Validate config at startup. Logs warnings and throws on fatal misconfigurations.
+ */
+export function validateConfig(config) {
+    if (config.authDisabled) {
+        log.warn('⚠️  Authentication is DISABLED. Do not use in production!');
+    }
+    if (config.corsOrigin === '*' && !config.authDisabled) {
+        throw new Error('FATAL: CORS_ORIGIN=* with authentication enabled is insecure. ' +
+            'Set a specific origin (e.g. http://localhost:3400) or set AUTH_DISABLED=true for development.');
+    }
+    // C-2 FIX: Warn when OTLP endpoints are exposed without auth in production mode
+    if (!config.authDisabled && !config.otlpAuthToken) {
+        log.warn('⚠️  OTLP endpoints (/v1/traces, /v1/metrics, /v1/logs) have NO authentication. Set OTLP_AUTH_TOKEN for production.');
+    }
+    // ─── Mesh config validation ─────────────────────────────
+    if (config.meshEnabled && !config.meshUrl) {
+        log.warn('⚠️  MESH_ENABLED=true but MESH_URL is not set — mesh proxy will not be registered.');
+    }
+    // ─── Lore config validation ────────────────────────────
+    validateLoreConfig(config);
+}
+function validateLoreConfig(config) {
+    if (!config.loreEnabled)
+        return;
+    if (config.loreMode === 'remote') {
+        if (!config.loreApiUrl) {
+            throw new Error('FATAL: LORE_ENABLED=true with LORE_MODE=remote requires LORE_API_URL to be set.');
+        }
+        if (!config.loreApiKey) {
+            throw new Error('FATAL: LORE_ENABLED=true with LORE_MODE=remote requires LORE_API_KEY to be set.');
+        }
+    }
+}
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAeH;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC/B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG;QAC7C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;QACrD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,gBAAgB;QAClF,aAAa,EAAE,CAAC,GAAG,EAAE;YACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,EAAE;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAiDnC;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC/B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,uBAAuB;QACjE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS;QACrD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;QACrD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,gBAAgB;QAClF,cAAc,EAAE,CAAC,GAAG,EAAE;YACpB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACxE,IAAI,CAAC,GAAG;gBAAE,OAAO,QAAiB,CAAC;YACnC,6DAA6D;YAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3D,IAAI,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,oDAAoD,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,EAAE;QACJ,aAAa,EAAE,CAAC,GAAG,EAAE;YACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,EAAE;QACJ,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS;QAC1D,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM;QAC9D,aAAa,EAAE,CAAC,GAAG,EAAE;YACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;YACtE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,EAAE;QAEJ,mBAAmB;QACnB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,MAAM;QACnD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;QAEtC,mBAAmB;QACnB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,MAAM;QACnD,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAuB;QAC3F,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS;QACpD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS;QACpD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS;QAEpD,6BAA6B;QAC7B,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,SAAS;QAExE,6BAA6B;QAC7B,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,MAAM;KAC7D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,gEAAgE;YAChE,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,oHAAoH,CAAC,CAAC;IACjI,CAAC;IAED,2DAA2D;IAC3D,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;IACjG,CAAC;IAED,0DAA0D;IAC1D,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO;IAEhC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/db/api-key-lookup.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Backend-agnostic API key lookup for auth middleware.
+ * Works with both SQLite (sync) and PostgreSQL (async).
+ */
+import type { SqliteDb } from './index.js';
+export interface ApiKeyRow {
+    id: string;
+    keyHash: string;
+    name: string;
+    scopes: string | string[];
+    tenantId: string;
+    revokedAt: number | null;
+    expiresAt: number | null;
+}
+export interface IApiKeyLookup {
+    findByHash(keyHash: string): Promise<ApiKeyRow | null>;
+    updateLastUsed(id: string): Promise<void>;
+}
+export declare class SqliteApiKeyLookup implements IApiKeyLookup {
+    private readonly db;
+    constructor(db: SqliteDb);
+    findByHash(keyHash: string): Promise<ApiKeyRow | null>;
+    updateLastUsed(id: string): Promise<void>;
+}
+//# sourceMappingURL=api-key-lookup.d.ts.map

package/dist/db/api-key-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-lookup.d.ts","sourceRoot":"","sources":["../../src/db/api-key-lookup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACvD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,qBAAa,kBAAmB,YAAW,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAEnC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAkBtD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMhD"}

package/dist/db/api-key-lookup.js

@@ -0,0 +1,38 @@
+/**
+ * Backend-agnostic API key lookup for auth middleware.
+ * Works with both SQLite (sync) and PostgreSQL (async).
+ */
+import { eq, and, isNull } from 'drizzle-orm';
+import { apiKeys as sqliteApiKeys } from './schema.sqlite.js';
+export class SqliteApiKeyLookup {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async findByHash(keyHash) {
+        const row = this.db
+            .select()
+            .from(sqliteApiKeys)
+            .where(and(eq(sqliteApiKeys.keyHash, keyHash), isNull(sqliteApiKeys.revokedAt)))
+            .get();
+        if (!row)
+            return null;
+        return {
+            id: row.id,
+            keyHash: row.keyHash,
+            name: row.name,
+            scopes: row.scopes,
+            tenantId: row.tenantId,
+            revokedAt: row.revokedAt,
+            expiresAt: row.expiresAt,
+        };
+    }
+    async updateLastUsed(id) {
+        const now = Math.floor(Date.now() / 1000);
+        try {
+            this.db.update(sqliteApiKeys).set({ lastUsedAt: now }).where(eq(sqliteApiKeys.id, id)).run();
+        }
+        catch { /* non-critical */ }
+    }
+}
+//# sourceMappingURL=api-key-lookup.js.map

package/dist/db/api-key-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-lookup.js","sourceRoot":"","sources":["../../src/db/api-key-lookup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAiB9D,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,EAAY;QAAZ,OAAE,GAAF,EAAE,CAAU;IAAG,CAAC;IAE7C,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,MAAM,EAAE;aACR,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;aAC/E,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/db/connection.postgres.d.ts

@@ -0,0 +1,44 @@
+/**
+ * PostgreSQL connection via postgres.js + Drizzle ORM.
+ *
+ * Production-grade pool configuration with env-driven tuning.
+ */
+import { type Sql } from 'postgres';
+import { type PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import * as schema from './schema.postgres.js';
+export type PostgresDb = PostgresJsDatabase<typeof schema>;
+export interface CreatePostgresDbOptions {
+    /** PostgreSQL connection string (defaults to DATABASE_URL env var) */
+    databaseUrl?: string;
+}
+export interface PostgresConnection {
+    /** Drizzle ORM instance */
+    db: PostgresDb;
+    /** Raw postgres.js client — needed for graceful shutdown (sql.end()) */
+    sql: Sql;
+}
+/**
+ * Create a Drizzle PostgreSQL instance backed by postgres.js.
+ *
+ * Returns both the Drizzle wrapper and the raw sql client so callers
+ * can drain the pool on shutdown.
+ */
+export declare function createPostgresConnection(options?: CreatePostgresDbOptions): PostgresConnection;
+/**
+ * Create a Drizzle PostgreSQL instance (legacy API — returns only the Drizzle wrapper).
+ * @deprecated Use createPostgresConnection() instead for shutdown support.
+ */
+export declare function createPostgresDb(options?: CreatePostgresDbOptions): PostgresDb;
+/**
+ * Verify Postgres connectivity. Throws with a clear message if unreachable.
+ * Called at startup to fail fast.
+ */
+export declare function verifyPostgresConnection(sql: Sql): Promise<void>;
+/**
+ * Run a health-check query. Returns latency in ms.
+ */
+export declare function postgresHealthCheck(sql: Sql): Promise<{
+    ok: boolean;
+    latencyMs: number;
+}>;
+//# sourceMappingURL=connection.postgres.d.ts.map

package/dist/db/connection.postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.postgres.d.ts","sourceRoot":"","sources":["../../src/db/connection.postgres.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAiB,EAAE,KAAK,GAAG,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAW,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAC;AAK/C,MAAM,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,MAAM,CAAC,CAAC;AAE3D,MAAM,WAAW,uBAAuB;IACtC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,EAAE,EAAE,UAAU,CAAC;IACf,wEAAwE;IACxE,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,uBAA4B,GAAG,kBAAkB,CA+BlG;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,UAAU,CAElF;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ/F"}