@airdraft/cloud 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+All notable changes to `@airdraft/cloud` will be documented here.
+
+See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

package/dist/billing.d.ts

@@ -0,0 +1,72 @@
+import type { CloudAuthAdapter } from '@airdraft/cloud-auth';
+import type { CloudDb, TokenCache } from './types.js';
+/**
+ * Minimal @untools/pay client interface used by billing handlers.
+ * The concrete implementation is provided by the cloud app via `lib/pay.ts`.
+ */
+export interface PayClient {
+    checkout: {
+        create(opts: {
+            amount: number;
+            currency: string;
+            provider: string;
+            metadata?: Record<string, unknown>;
+        }): Promise<{
+            url: string;
+            reference: string;
+        }>;
+    };
+    webhook: {
+        verify(req: Request, provider: string): Promise<{
+            verified: boolean;
+            data: Record<string, unknown>;
+        }>;
+    };
+}
+/**
+ * Resolves a team's plan (Redis-cached, 5-min TTL) and checks a named limit.
+ *
+ * Returns `{ allowed: boolean; current: number; max: number }`.
+ * `max: -1` means unlimited.
+ */
+export declare function checkLimit(db: CloudDb, teamId: string, key: string, current: number, cache?: TokenCache): Promise<{
+    allowed: boolean;
+    current: number;
+    max: number;
+}>;
+/**
+ * Resolves a team's plan and returns the value of a named feature flag.
+ * Returns `false` if the plan or feature is not found.
+ */
+export declare function checkFeature(db: CloudDb, teamId: string, key: string, cache?: TokenCache): Promise<boolean | number>;
+/**
+ * GET /v1/billing/plans
+ *
+ * Returns all active plan definitions. Public — no auth required.
+ */
+export declare function handleGetPlans(req: Request, db: CloudDb): Promise<Response>;
+/**
+ * POST /v1/billing/upgrade
+ *
+ * Body: `{ planSlug: string; provider: string }`
+ *
+ * Creates a @untools/pay checkout session for the requested plan upgrade.
+ * Returns `{ checkoutUrl, reference }`.
+ * Requires `owner` role.
+ */
+export declare function handleUpgradePlan(req: Request, db: CloudDb, auth: CloudAuthAdapter, pay: PayClient, teamSlug: string): Promise<Response>;
+/**
+ * POST /v1/billing/webhooks/:provider
+ *
+ * Verifies the provider webhook signature and fulfills plan upgrade.
+ * Updates `TeamDoc.planSlug` on successful payment.
+ */
+export declare function handleWebhookSettlement(req: Request, provider: 'paystack' | 'flutterwave' | '100pay', db: CloudDb, pay: PayClient): Promise<Response>;
+/**
+ * GET /v1/teams/:teamSlug/usage
+ *
+ * Returns current usage stats and plan limits for the team.
+ * Requires membership.
+ */
+export declare function handleGetUsage(req: Request, db: CloudDb, auth: CloudAuthAdapter, teamSlug: string): Promise<Response>;
+//# sourceMappingURL=billing.d.ts.map

package/dist/billing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAW,UAAU,EAAE,MAAM,YAAY,CAAA;AAM9D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE;QACR,MAAM,CAAC,IAAI,EAAE;YACX,MAAM,EAAE,MAAM,CAAA;YACd,QAAQ,EAAE,MAAM,CAAA;YAChB,QAAQ,EAAE,MAAM,CAAA;YAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SACnC,GAAG,OAAO,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAChD,CAAA;IACD,OAAO,EAAE;QACP,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,QAAQ,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KACtG,CAAA;CACF;AA2BD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,OAAO,EACX,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAK7D;AAMD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,OAAO,EACX,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,UAAU,GACjB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAG3B;AAuCD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,QAAQ,CAAC,CAInB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CA4CnB;AAMD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,UAAU,GAAG,aAAa,GAAG,QAAQ,EAC/C,EAAE,EAAE,OAAO,EACX,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAMD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CA8BnB"}

package/dist/billing.js

@@ -0,0 +1,204 @@
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+function err(code, message, status) {
+    return json({ error: { code, message } }, status);
+}
+const PLAN_CACHE_TTL_S = 5 * 60; // 5 minutes
+function planCacheKey(teamId) {
+    return `plan:${teamId}`;
+}
+// ---------------------------------------------------------------------------
+// checkLimit
+// ---------------------------------------------------------------------------
+/**
+ * Resolves a team's plan (Redis-cached, 5-min TTL) and checks a named limit.
+ *
+ * Returns `{ allowed: boolean; current: number; max: number }`.
+ * `max: -1` means unlimited.
+ */
+export async function checkLimit(db, teamId, key, current, cache) {
+    const plan = await resolvePlan(db, teamId, cache);
+    const max = plan?.limits[key] ?? -1;
+    if (max === -1)
+        return { allowed: true, current, max };
+    return { allowed: current < max, current, max };
+}
+// ---------------------------------------------------------------------------
+// checkFeature
+// ---------------------------------------------------------------------------
+/**
+ * Resolves a team's plan and returns the value of a named feature flag.
+ * Returns `false` if the plan or feature is not found.
+ */
+export async function checkFeature(db, teamId, key, cache) {
+    const plan = await resolvePlan(db, teamId, cache);
+    return plan?.features[key] ?? false;
+}
+// ---------------------------------------------------------------------------
+// resolvePlan (internal)
+// ---------------------------------------------------------------------------
+async function resolvePlan(db, teamId, cache) {
+    if (cache) {
+        const cached = await cache.get(planCacheKey(teamId));
+        if (cached) {
+            try {
+                return JSON.parse(cached);
+            }
+            catch {
+                // invalid cache — fall through to DB
+            }
+        }
+    }
+    const { ObjectId } = await import('mongodb');
+    const team = await db.teams.findOne({ _id: new ObjectId(teamId) });
+    if (!team)
+        return null;
+    const plan = await db.plans.findOne({ slug: team.planSlug, isActive: true });
+    if (cache && plan) {
+        await cache.set(planCacheKey(teamId), JSON.stringify(plan), PLAN_CACHE_TTL_S);
+    }
+    return plan;
+}
+// ---------------------------------------------------------------------------
+// handleGetPlans
+// ---------------------------------------------------------------------------
+/**
+ * GET /v1/billing/plans
+ *
+ * Returns all active plan definitions. Public — no auth required.
+ */
+export async function handleGetPlans(req, db) {
+    void req;
+    const plans = await db.plans.find({ isActive: true }).toArray();
+    return json({ data: plans });
+}
+// ---------------------------------------------------------------------------
+// handleUpgradePlan
+// ---------------------------------------------------------------------------
+/**
+ * POST /v1/billing/upgrade
+ *
+ * Body: `{ planSlug: string; provider: string }`
+ *
+ * Creates a @untools/pay checkout session for the requested plan upgrade.
+ * Returns `{ checkoutUrl, reference }`.
+ * Requires `owner` role.
+ */
+export async function handleUpgradePlan(req, db, auth, pay, teamSlug) {
+    const identity = await auth.verifySession(req);
+    if (!identity)
+        return err('UNAUTHORIZED', 'Not authenticated', 401);
+    const team = await db.teams.findOne({ slug: teamSlug });
+    if (!team)
+        return err('TEAM_NOT_FOUND', 'Team not found', 404);
+    const membership = await db.memberships.findOne({
+        teamId: team._id.toString(),
+        userId: identity.userId,
+    });
+    if (!membership || membership.role !== 'owner') {
+        return err('FORBIDDEN', 'Requires owner role', 403);
+    }
+    let body;
+    try {
+        body = await req.json();
+    }
+    catch {
+        return err('INVALID_BODY', 'Request body must be JSON', 400);
+    }
+    const planSlug = typeof body.planSlug === 'string' ? body.planSlug : '';
+    if (!planSlug)
+        return err('INVALID_PLAN', 'planSlug is required', 400);
+    const provider = typeof body.provider === 'string' ? body.provider : '';
+    if (!provider)
+        return err('INVALID_PROVIDER', 'provider is required', 400);
+    const plan = await db.plans.findOne({ slug: planSlug, isActive: true });
+    if (!plan)
+        return err('PLAN_NOT_FOUND', 'Plan not found', 404);
+    const session = await pay.checkout.create({
+        amount: plan.priceMonthly,
+        currency: plan.currency,
+        provider,
+        metadata: {
+            teamId: team._id.toString(),
+            teamSlug: team.slug,
+            planSlug,
+            userId: identity.userId,
+        },
+    });
+    return json({ data: { checkoutUrl: session.url, reference: session.reference } });
+}
+// ---------------------------------------------------------------------------
+// handleWebhookSettlement
+// ---------------------------------------------------------------------------
+/**
+ * POST /v1/billing/webhooks/:provider
+ *
+ * Verifies the provider webhook signature and fulfills plan upgrade.
+ * Updates `TeamDoc.planSlug` on successful payment.
+ */
+export async function handleWebhookSettlement(req, provider, db, pay) {
+    const { verified, data } = await pay.webhook.verify(req, provider);
+    if (!verified)
+        return err('INVALID_SIGNATURE', 'Webhook signature verification failed', 400);
+    const status = data['status'];
+    if (status !== 'success' && status !== 'successful') {
+        // Non-success event — acknowledge without action
+        return new Response(null, { status: 200 });
+    }
+    const metadata = (data['metadata'] ?? {});
+    const teamId = typeof metadata['teamId'] === 'string' ? metadata['teamId'] : null;
+    const planSlug = typeof metadata['planSlug'] === 'string' ? metadata['planSlug'] : null;
+    if (!teamId || !planSlug) {
+        return err('MISSING_METADATA', 'Webhook payload missing teamId or planSlug', 400);
+    }
+    const { ObjectId } = await import('mongodb');
+    await db.teams.updateOne({ _id: new ObjectId(teamId) }, { $set: { planSlug } });
+    return new Response(null, { status: 200 });
+}
+// ---------------------------------------------------------------------------
+// handleGetUsage
+// ---------------------------------------------------------------------------
+/**
+ * GET /v1/teams/:teamSlug/usage
+ *
+ * Returns current usage stats and plan limits for the team.
+ * Requires membership.
+ */
+export async function handleGetUsage(req, db, auth, teamSlug) {
+    const identity = await auth.verifySession(req);
+    if (!identity)
+        return err('UNAUTHORIZED', 'Not authenticated', 401);
+    const team = await db.teams.findOne({ slug: teamSlug });
+    if (!team)
+        return err('TEAM_NOT_FOUND', 'Team not found', 404);
+    const membership = await db.memberships.findOne({
+        teamId: team._id.toString(),
+        userId: identity.userId,
+    });
+    if (!membership)
+        return err('FORBIDDEN', 'Not a member of this team', 403);
+    const teamId = team._id.toString();
+    const [projectCount, memberCount, plan] = await Promise.all([
+        db.projects.countDocuments({ teamId }),
+        db.memberships.countDocuments({ teamId }),
+        db.plans.findOne({ slug: team.planSlug, isActive: true }),
+    ]);
+    return json({
+        data: {
+            planSlug: team.planSlug,
+            plan: plan ?? null,
+            usage: {
+                projects: projectCount,
+                members: memberCount,
+            },
+        },
+    });
+}
+//# sourceMappingURL=billing.js.map

package/dist/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAyBA,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;IACxD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,CAAA,CAAC,YAAY;AAE5C,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,QAAQ,MAAM,EAAE,CAAA;AACzB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAW,EACX,MAAc,EACd,GAAW,EACX,OAAe,EACf,KAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IACnC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;IACtD,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;AACjD,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAW,EACX,MAAc,EACd,GAAW,EACX,KAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACjD,OAAO,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAA;AACrC,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,KAAK,UAAU,WAAW,CACxB,EAAW,EACX,MAAc,EACd,KAAkB;IAElB,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;QACpD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAA;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAEtB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAE5E,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAY,EACZ,EAAW;IAEX,KAAK,GAAG,CAAA;IACR,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;IAC/D,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAY,EACZ,EAAW,EACX,IAAsB,EACtB,GAAc,EACd,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEnE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAA;IAE9D,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/C,OAAO,GAAG,CAAC,WAAW,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAA;IACrD,CAAC;IAED,IAAI,IAAgD,CAAA;IACpD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,cAAc,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;IAEtE,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;IAE1E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAA;IAE9D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxC,MAAM,EAAE,IAAI,CAAC,YAAY;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ;QACR,QAAQ,EAAE;YACR,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,QAAQ;YACR,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB;KACF,CAAC,CAAA;IAEF,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AACnF,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAY,EACZ,QAA+C,EAC/C,EAAW,EACX,GAAc;IAEd,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,mBAAmB,EAAE,uCAAuC,EAAE,GAAG,CAAC,CAAA;IAE5F,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QACpD,iDAAiD;QACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAA4B,CAAA;IACpE,MAAM,MAAM,GAAG,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACjF,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAEvF,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,kBAAkB,EAAE,4CAA4C,EAAE,GAAG,CAAC,CAAA;IACnF,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CACtB,EAAE,GAAG,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,EAC7B,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CACvB,CAAA;IAED,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAY,EACZ,EAAW,EACX,IAAsB,EACtB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEnE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAA;IAE9D,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAA;IACF,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAA;IAE1E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;IAClC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1D,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QACtC,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QACzC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KAC1D,CAAC,CAAA;IAEF,OAAO,IAAI,CAAC;QACV,IAAI,EAAE;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,IAAI,IAAI;YAClB,KAAK,EAAE;gBACL,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,WAAW;aACrB;SACF;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/callback.d.ts

@@ -0,0 +1,39 @@
+import type { CloudDb } from './types.js';
+export interface CallbackOptions {
+    /** `AIRDRAFT_CALLBACK_SECRET` env var — used to verify the CSRF state token. */
+    callbackSecret: string;
+    /** GitHub App numeric ID — `GITHUB_APP_ID` env var. */
+    githubAppId: string;
+    /** GitHub App PEM private key — `GITHUB_APP_PRIVATE_KEY` env var. */
+    githubAppPrivateKey: string;
+    db: CloudDb;
+    /**
+     * Base URL for the cloud dashboard (e.g. `https://app.airdraft.space`).
+     * Used to build post-connection redirect URLs.
+     */
+    dashboardBaseUrl: string;
+}
+/**
+ * Handler for `GET /github/callback`.
+ *
+ * Processes the GitHub App installation callback after a user installs or
+ * updates the Airdraft GitHub App. Validates the CSRF state token, verifies
+ * the installation, writes the project connection, and issues a project API key.
+ *
+ * **Single repo granted:** auto-selects, completes connection immediately.
+ * **Multiple repos granted:** redirects to the dashboard repo picker step.
+ *
+ * ```ts
+ * export async function GET(req: Request) {
+ *   return handleCallback(req, {
+ *     callbackSecret: process.env.AIRDRAFT_CALLBACK_SECRET!,
+ *     githubAppId: process.env.GITHUB_APP_ID!,
+ *     githubAppPrivateKey: process.env.GITHUB_APP_PRIVATE_KEY!,
+ *     db,
+ *     dashboardBaseUrl: 'https://app.airdraft.space',
+ *   })
+ * }
+ * ```
+ */
+export declare function handleCallback(req: Request, opts: CallbackOptions): Promise<Response>;
+//# sourceMappingURL=callback.d.ts.map

package/dist/callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../src/callback.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAMzC,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAA;IACtB,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,mBAAmB,EAAE,MAAM,CAAA;IAC3B,EAAE,EAAE,OAAO,CAAA;IACX;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAyDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,QAAQ,CAAC,CA8InB"}

package/dist/callback.js

@@ -0,0 +1,178 @@
+import { generateApiKey } from '@airdraft/auth';
+import { signGitHubAppJwt } from './jwt.js';
+import { verifyState } from './state.js';
+async function getInstallationToken(installationId, appId, privateKey) {
+    const jwt = await signGitHubAppJwt(appId, privateKey);
+    const res = await fetch(`https://api.github.com/app/installations/${installationId}/access_tokens`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${jwt}`,
+            Accept: 'application/vnd.github+json',
+            'X-GitHub-Api-Version': '2022-11-28',
+        },
+    });
+    if (!res.ok)
+        throw new Error(`GitHub token API returned ${res.status}`);
+    const body = await res.json();
+    return body.token;
+}
+async function listInstallationRepos(installationToken) {
+    const res = await fetch('https://api.github.com/installation/repositories?per_page=100', {
+        headers: {
+            Authorization: `Bearer ${installationToken}`,
+            Accept: 'application/vnd.github+json',
+            'X-GitHub-Api-Version': '2022-11-28',
+        },
+    });
+    if (!res.ok)
+        throw new Error(`GitHub repos API returned ${res.status}`);
+    const body = await res.json();
+    return body.repositories;
+}
+// ---------------------------------------------------------------------------
+// handleCallback
+// ---------------------------------------------------------------------------
+/**
+ * Handler for `GET /github/callback`.
+ *
+ * Processes the GitHub App installation callback after a user installs or
+ * updates the Airdraft GitHub App. Validates the CSRF state token, verifies
+ * the installation, writes the project connection, and issues a project API key.
+ *
+ * **Single repo granted:** auto-selects, completes connection immediately.
+ * **Multiple repos granted:** redirects to the dashboard repo picker step.
+ *
+ * ```ts
+ * export async function GET(req: Request) {
+ *   return handleCallback(req, {
+ *     callbackSecret: process.env.AIRDRAFT_CALLBACK_SECRET!,
+ *     githubAppId: process.env.GITHUB_APP_ID!,
+ *     githubAppPrivateKey: process.env.GITHUB_APP_PRIVATE_KEY!,
+ *     db,
+ *     dashboardBaseUrl: 'https://app.airdraft.space',
+ *   })
+ * }
+ * ```
+ */
+export async function handleCallback(req, opts) {
+    const url = new URL(req.url);
+    const installationIdStr = url.searchParams.get('installation_id');
+    const setupAction = url.searchParams.get('setup_action');
+    const stateToken = url.searchParams.get('state');
+    // -------------------------------------------------------------------------
+    // Unmatched installation — no state token (e.g. GitHub Marketplace)
+    // -------------------------------------------------------------------------
+    if (!stateToken) {
+        if (installationIdStr) {
+            const connectUrl = `${opts.dashboardBaseUrl}/connect?installation_id=${installationIdStr}`;
+            return Response.redirect(connectUrl, 302);
+        }
+        return new Response('Bad Request: missing state', { status: 400 });
+    }
+    // -------------------------------------------------------------------------
+    // 1. Verify CSRF state token
+    // -------------------------------------------------------------------------
+    const stateResult = verifyState(stateToken, opts.callbackSecret);
+    if (!stateResult.valid) {
+        const message = stateResult.reason === 'expired'
+            ? 'Link expired — please try connecting again.'
+            : 'Invalid state token.';
+        return new Response(message, { status: 400 });
+    }
+    const { projectId, userId, mode, port } = stateResult.payload;
+    const installationId = parseInt(installationIdStr ?? '', 10);
+    if (isNaN(installationId)) {
+        return new Response('Bad Request: missing installation_id', { status: 400 });
+    }
+    // -------------------------------------------------------------------------
+    // 2. Load and validate project
+    // -------------------------------------------------------------------------
+    const { ObjectId } = await import('mongodb');
+    let projectOid;
+    try {
+        projectOid = new ObjectId(projectId);
+    }
+    catch {
+        return new Response('Bad Request: invalid projectId', { status: 400 });
+    }
+    const project = await opts.db.projects.findOne({ _id: projectOid });
+    if (!project)
+        return new Response('Not Found: project not found', { status: 404 });
+    const team = await opts.db.teams.findOne({ _id: new ObjectId(project.teamId) });
+    if (!team)
+        return new Response('Not Found: team not found', { status: 404 });
+    // -------------------------------------------------------------------------
+    // 3. Verify userId is still admin/owner of the project's team
+    // -------------------------------------------------------------------------
+    const membership = await opts.db.memberships.findOne({
+        teamId: project.teamId,
+        userId,
+        role: { $in: ['owner', 'admin'] },
+    });
+    if (!membership) {
+        return new Response('Forbidden: insufficient permissions', { status: 403 });
+    }
+    // -------------------------------------------------------------------------
+    // 4. Verify installation via GitHub API + get accessible repos
+    // -------------------------------------------------------------------------
+    let installationToken;
+    let repos;
+    try {
+        installationToken = await getInstallationToken(installationId, opts.githubAppId, opts.githubAppPrivateKey);
+        repos = await listInstallationRepos(installationToken);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return new Response(`GitHub App installation could not be verified: ${msg}`, { status: 502 });
+    }
+    if (repos.length === 0) {
+        return new Response('No repositories accessible. Please grant access to at least one repository.', {
+            status: 400,
+        });
+    }
+    // -------------------------------------------------------------------------
+    // 5. Repo selection
+    // -------------------------------------------------------------------------
+    if (repos.length > 1) {
+        // Redirect to dashboard repo picker — connection is not written yet
+        const pickerUrl = `${opts.dashboardBaseUrl}/${team.slug}/${project.slug}/settings/github?installation_id=${installationId}&step=pick-repo`;
+        return Response.redirect(pickerUrl, 302);
+    }
+    // Single repo — auto-select
+    const selectedRepo = repos[0];
+    // -------------------------------------------------------------------------
+    // 6. Write project.github + generate / rotate project API key
+    // -------------------------------------------------------------------------
+    const { key: apiKey, hash: apiKeyHash } = generateApiKey();
+    await opts.db.projects.updateOne({ _id: projectOid }, {
+        $set: {
+            github: {
+                installationId,
+                repo: selectedRepo.full_name,
+                branch: selectedRepo.default_branch,
+                connectedAt: new Date(),
+                connectedBy: userId,
+            },
+            apiKeyHash,
+            updatedAt: new Date(),
+        },
+    });
+    // -------------------------------------------------------------------------
+    // 7. Redirect
+    // -------------------------------------------------------------------------
+    if (mode === 'cli' && port !== undefined) {
+        // CLI mode — redirect to local server with credentials
+        const cliCallbackUrl = new URL(`http://localhost:${port}/callback`);
+        cliCallbackUrl.searchParams.set('project_key', apiKey);
+        cliCallbackUrl.searchParams.set('repo', selectedRepo.full_name);
+        cliCallbackUrl.searchParams.set('branch', selectedRepo.default_branch);
+        return Response.redirect(cliCallbackUrl.toString(), 302);
+    }
+    // Dashboard mode — redirect to project settings with one-time key in query param
+    // (Dashboard shows the key once and removes it from the URL on load)
+    const successUrl = new URL(`/${team.slug}/${project.slug}/settings/github`, opts.dashboardBaseUrl);
+    successUrl.searchParams.set('connected', '1');
+    successUrl.searchParams.set('project_key', apiKey); // shown once, then discarded
+    return Response.redirect(successUrl.toString(), 302);
+}
+//# sourceMappingURL=callback.js.map

package/dist/callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../src/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAc,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAoCxC,KAAK,UAAU,oBAAoB,CACjC,cAAsB,EACtB,KAAa,EACb,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,4CAA4C,cAAc,gBAAgB,EAC1E;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,MAAM,EAAE,6BAA6B;YACrC,sBAAsB,EAAE,YAAY;SACrC;KACF,CACF,CAAA;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAuB,CAAA;IAClD,OAAO,IAAI,CAAC,KAAK,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,iBAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+DAA+D,EAAE;QACvF,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,iBAAiB,EAAE;YAC5C,MAAM,EAAE,6BAA6B;YACrC,sBAAsB,EAAE,YAAY;SACrC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAqC,CAAA;IAChE,OAAO,IAAI,CAAC,YAAY,CAAA;AAC1B,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAY,EACZ,IAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,iBAAiB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACjE,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAEhD,4EAA4E;IAC5E,oEAAoE;IACpE,4EAA4E;IAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,gBAAgB,4BAA4B,iBAAiB,EAAE,CAAA;YAC1F,OAAO,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAC3C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,4EAA4E;IAC5E,6BAA6B;IAC7B,4EAA4E;IAC5E,MAAM,WAAW,GAAG,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;IAChE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GACX,WAAW,CAAC,MAAM,KAAK,SAAS;YAC9B,CAAC,CAAC,6CAA6C;YAC/C,CAAC,CAAC,sBAAsB,CAAA;QAC5B,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,OAAO,CAAA;IAC7D,MAAM,cAAc,GAAG,QAAQ,CAAC,iBAAiB,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IAC5D,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,QAAQ,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAC5E,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,UAAyC,CAAA;IAC7C,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,QAAQ,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAElF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC/E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAE5E,4EAA4E;IAC5E,8DAA8D;IAC9D,4EAA4E;IAC5E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;QACnD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM;QACN,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;KAClC,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,QAAQ,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,IAAI,iBAAyB,CAAA;IAC7B,IAAI,KAA+B,CAAA;IACnC,IAAI,CAAC;QACH,iBAAiB,GAAG,MAAM,oBAAoB,CAC5C,cAAc,EACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,mBAAmB,CACzB,CAAA;QACD,KAAK,GAAG,MAAM,qBAAqB,CAAC,iBAAiB,CAAC,CAAA;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,OAAO,IAAI,QAAQ,CAAC,kDAAkD,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,QAAQ,CAAC,6EAA6E,EAAE;YACjG,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,CAAC;IAED,4EAA4E;IAC5E,oBAAoB;IACpB,4EAA4E;IAC5E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,oEAAoE;QACpE,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,oCAAoC,cAAc,iBAAiB,CAAA;QAC1I,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC1C,CAAC;IAED,4BAA4B;IAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;IAE9B,4EAA4E;IAC5E,8DAA8D;IAC9D,4EAA4E;IAC5E,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,cAAc,EAAE,CAAA;IAE1D,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAC9B,EAAE,GAAG,EAAE,UAAU,EAAE,EACnB;QACE,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,cAAc;gBACd,IAAI,EAAE,YAAY,CAAC,SAAS;gBAC5B,MAAM,EAAE,YAAY,CAAC,cAAc;gBACnC,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,WAAW,EAAE,MAAM;aACpB;YACD,UAAU;YACV,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB;KACF,CACF,CAAA;IAED,4EAA4E;IAC5E,cAAc;IACd,4EAA4E;IAC5E,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACzC,uDAAuD;QACvD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,oBAAoB,IAAI,WAAW,CAAC,CAAA;QACnE,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QACtD,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAA;QAC/D,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,CAAA;QACtE,OAAO,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IAC1D,CAAC;IAED,iFAAiF;IACjF,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,kBAAkB,EAC/C,IAAI,CAAC,gBAAgB,CACtB,CAAA;IACD,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAC7C,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA,CAAC,6BAA6B;IAChF,OAAO,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;AACtD,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Signs a short-lived CLI JWT for the given userId.
+ *
+ * ```ts
+ * const token = await signCliToken(identity.userId, process.env.AIRDRAFT_CLI_SECRET!)
+ * ```
+ */
+export declare function signCliToken(userId: string, secret: string): string;
+/**
+ * Verifies a CLI JWT and returns the userId, or `null` if invalid/expired.
+ *
+ * ```ts
+ * const userId = verifyCliToken(token, process.env.AIRDRAFT_CLI_SECRET!)
+ * if (!userId) return Response.json({ error: { code: 'UNAUTHORIZED', message: 'Invalid CLI token' } }, { status: 401 })
+ * ```
+ */
+export declare function verifyCliToken(token: string, secret: string): string | null;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAgBA;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQnE;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0B3E"}

package/dist/cli.js

@@ -0,0 +1,59 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+// ---------------------------------------------------------------------------
+// CLI JWT helpers — HS256 via Node.js crypto (no extra dependencies)
+// ---------------------------------------------------------------------------
+const CLI_TOKEN_TTL_S = 15 * 60; // 15 minutes
+function b64url(input) {
+    return Buffer.from(input, 'utf8').toString('base64url');
+}
+function hmacSign(data, secret) {
+    return createHmac('sha256', secret).update(data).digest('base64url');
+}
+/**
+ * Signs a short-lived CLI JWT for the given userId.
+ *
+ * ```ts
+ * const token = await signCliToken(identity.userId, process.env.AIRDRAFT_CLI_SECRET!)
+ * ```
+ */
+export function signCliToken(userId, secret) {
+    const now = Math.floor(Date.now() / 1000);
+    const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+    const payload = b64url(JSON.stringify({ sub: userId, type: 'cli', iat: now, exp: now + CLI_TOKEN_TTL_S }));
+    const sig = hmacSign(`${header}.${payload}`, secret);
+    return `${header}.${payload}.${sig}`;
+}
+/**
+ * Verifies a CLI JWT and returns the userId, or `null` if invalid/expired.
+ *
+ * ```ts
+ * const userId = verifyCliToken(token, process.env.AIRDRAFT_CLI_SECRET!)
+ * if (!userId) return Response.json({ error: { code: 'UNAUTHORIZED', message: 'Invalid CLI token' } }, { status: 401 })
+ * ```
+ */
+export function verifyCliToken(token, secret) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return null;
+    const [header, payload, sig] = parts;
+    const expected = hmacSign(`${header}.${payload}`, secret);
+    const expectedBuf = Buffer.from(expected, 'utf8');
+    const actualBuf = Buffer.from(sig, 'utf8');
+    if (expectedBuf.length !== actualBuf.length ||
+        !timingSafeEqual(expectedBuf, actualBuf)) {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (parsed.type !== 'cli' || typeof parsed.sub !== 'string')
+        return null;
+    if (typeof parsed.exp === 'number' && parsed.exp < Math.floor(Date.now() / 1000))
+        return null;
+    return parsed.sub;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEzD,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,CAAA,CAAC,aAAa;AAE7C,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,MAAc;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,MAAM,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC,CACnF,CAAA;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;IACpD,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,GAAG,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAA;IAEpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,IACE,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QACvC,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,EACxC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAwD,CAAA;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAE7F,OAAO,MAAM,CAAC,GAAG,CAAA;AACnB,CAAC"}

package/dist/db.d.ts

@@ -0,0 +1,13 @@
+import type { MongoClient } from 'mongodb';
+import type { CloudDb } from './types.js';
+/**
+ * Creates a typed `CloudDb` handle from a connected `MongoClient`.
+ *
+ * ```ts
+ * const client = new MongoClient(process.env.MONGODB_URI!)
+ * await client.connect()
+ * export const db = createCloudDb(client)
+ * ```
+ */
+export declare function createCloudDb(client: MongoClient, dbName?: string): CloudDb;
+//# sourceMappingURL=db.d.ts.map

package/dist/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAC1C,OAAO,KAAK,EAAE,OAAO,EAA0F,MAAM,YAAY,CAAA;AAEjI;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,SAAa,GAAG,OAAO,CAY/E"}