@airdraft/cloud 0.1.0

package/dist/db.js

@@ -0,0 +1,23 @@
+/**
+ * Creates a typed `CloudDb` handle from a connected `MongoClient`.
+ *
+ * ```ts
+ * const client = new MongoClient(process.env.MONGODB_URI!)
+ * await client.connect()
+ * export const db = createCloudDb(client)
+ * ```
+ */
+export function createCloudDb(client, dbName = 'airdraft') {
+    const db = client.db(dbName);
+    return {
+        projects: db.collection('projects'),
+        teams: db.collection('teams'),
+        memberships: db.collection('memberships'),
+        invites: db.collection('invites'),
+        plans: db.collection('plans'),
+        customDomains: db.collection('customDomains'),
+        embedTokens: db.collection('embedTokens'),
+        auditEvents: db.collection('auditEvents'),
+    };
+}
+//# sourceMappingURL=db.js.map

package/dist/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,MAAmB,EAAE,MAAM,GAAG,UAAU;IACpE,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;IAC5B,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAa,UAAU,CAAC;QAC/C,KAAK,EAAE,EAAE,CAAC,UAAU,CAAU,OAAO,CAAC;QACtC,WAAW,EAAE,EAAE,CAAC,UAAU,CAAgB,aAAa,CAAC;QACxD,OAAO,EAAE,EAAE,CAAC,UAAU,CAAY,SAAS,CAAC;QAC5C,KAAK,EAAE,EAAE,CAAC,UAAU,CAAU,OAAO,CAAC;QACtC,aAAa,EAAE,EAAE,CAAC,UAAU,CAAkB,eAAe,CAAC;QAC9D,WAAW,EAAE,EAAE,CAAC,UAAU,CAAgB,aAAa,CAAC;QACxD,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;KAC1C,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+export type { CloudDb, TokenCache, GitHubConnection, ProjectDoc, TeamDoc, MembershipDoc, InviteDoc, CustomDomainDoc, EmbedTokenDoc, PlanDoc, AuditEventDoc } from './types.js';
+export { createCloudDb } from './db.js';
+export { signGitHubAppJwt } from './jwt.js';
+export { signState, verifyState } from './state.js';
+export type { StatePayload, StateVerifyResult } from './state.js';
+export { handleTokenRelay } from './relay.js';
+export type { RelayOptions } from './relay.js';
+export { handleWebhook } from './webhook.js';
+export type { WebhookOptions } from './webhook.js';
+export { handleCallback } from './callback.js';
+export type { CallbackOptions } from './callback.js';
+export { handleListTeams, handleCreateTeam, handleGetTeam, handleUpdateTeam } from './team.js';
+export { handleListProjects, handleCreateProject, handleGetProject, handleGenerateApiKey } from './project.js';
+export { handleInviteMember, handleAcceptInvite, handleRevokeInvite } from './invite.js';
+export { handleGetPlans, handleUpgradePlan, handleWebhookSettlement, handleGetUsage, checkLimit, checkFeature } from './billing.js';
+export type { PayClient } from './billing.js';
+export { createCloudCmsHandler, bustEngineCache } from './runtime.js';
+export type { CloudCmsOptions, CloudCmsHandler } from './runtime.js';
+export { signCliToken, verifyCliToken } from './cli.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC9K,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACnD,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEpD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE9F,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAE9G,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAExF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACnI,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE7C,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AACrE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEpE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -0,0 +1,19 @@
+export { createCloudDb } from './db.js';
+export { signGitHubAppJwt } from './jwt.js';
+export { signState, verifyState } from './state.js';
+export { handleTokenRelay } from './relay.js';
+export { handleWebhook } from './webhook.js';
+export { handleCallback } from './callback.js';
+// Team management
+export { handleListTeams, handleCreateTeam, handleGetTeam, handleUpdateTeam } from './team.js';
+// Project management
+export { handleListProjects, handleCreateProject, handleGetProject, handleGenerateApiKey } from './project.js';
+// Invite management
+export { handleInviteMember, handleAcceptInvite, handleRevokeInvite } from './invite.js';
+// Billing
+export { handleGetPlans, handleUpgradePlan, handleWebhookSettlement, handleGetUsage, checkLimit, checkFeature } from './billing.js';
+// Cloud CMS runtime
+export { createCloudCmsHandler, bustEngineCache } from './runtime.js';
+// CLI tokens
+export { signCliToken, verifyCliToken } from './cli.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,kBAAkB;AAClB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC9F,qBAAqB;AACrB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAC9G,oBAAoB;AACpB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACxF,UAAU;AACV,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEnI,oBAAoB;AACpB,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAErE,aAAa;AACb,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA"}

package/dist/invite.d.ts

@@ -0,0 +1,28 @@
+import type { CloudAuthAdapter } from '@airdraft/cloud-auth';
+import type { CloudDb } from './types.js';
+/**
+ * POST /v1/teams/:teamSlug/invites
+ *
+ * Body: `{ email: string; role: 'admin' | 'editor' | 'viewer' }`
+ *
+ * Creates a pending invite. Requires `owner` or `admin` role.
+ * Caller is responsible for sending the invite email (email service wired at app level).
+ */
+export declare function handleInviteMember(req: Request, db: CloudDb, auth: CloudAuthAdapter, teamSlug: string): Promise<Response>;
+/**
+ * POST /v1/invites/:token/accept
+ *
+ * Accepts an invite. If the user doesn't exist, the cloud app layer
+ * should call `auth.createUser()` before calling this handler.
+ *
+ * Creates a `MembershipDoc` and deletes the invite.
+ * The request must include the authenticated session of the accepting user.
+ */
+export declare function handleAcceptInvite(req: Request, db: CloudDb, auth: CloudAuthAdapter, token: string): Promise<Response>;
+/**
+ * DELETE /v1/teams/:teamSlug/invites/:token
+ *
+ * Deletes a pending invite. Requires `owner` or `admin` role.
+ */
+export declare function handleRevokeInvite(req: Request, db: CloudDb, auth: CloudAuthAdapter, teamSlug: string, token: string): Promise<Response>;
+//# sourceMappingURL=invite.d.ts.map

package/dist/invite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.d.ts","sourceRoot":"","sources":["../src/invite.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AA2BzC;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CAmEnB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,QAAQ,CAAC,CA0BnB;AAMD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,QAAQ,CAAC,CAoBnB"}

package/dist/invite.js

@@ -0,0 +1,155 @@
+import { randomBytes } from 'crypto';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+function err(code, message, status) {
+    return json({ error: { code, message } }, status);
+}
+const INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+function generateInviteToken() {
+    return randomBytes(24).toString('hex');
+}
+// ---------------------------------------------------------------------------
+// handleInviteMember
+// ---------------------------------------------------------------------------
+/**
+ * POST /v1/teams/:teamSlug/invites
+ *
+ * Body: `{ email: string; role: 'admin' | 'editor' | 'viewer' }`
+ *
+ * Creates a pending invite. Requires `owner` or `admin` role.
+ * Caller is responsible for sending the invite email (email service wired at app level).
+ */
+export async function handleInviteMember(req, db, auth, teamSlug) {
+    const identity = await auth.verifySession(req);
+    if (!identity)
+        return err('UNAUTHORIZED', 'Not authenticated', 401);
+    const team = await db.teams.findOne({ slug: teamSlug });
+    if (!team)
+        return err('TEAM_NOT_FOUND', 'Team not found', 404);
+    const membership = await db.memberships.findOne({
+        teamId: team._id.toString(),
+        userId: identity.userId,
+    });
+    if (!membership || !['owner', 'admin'].includes(membership.role)) {
+        return err('FORBIDDEN', 'Requires owner or admin role', 403);
+    }
+    let body;
+    try {
+        body = await req.json();
+    }
+    catch {
+        return err('INVALID_BODY', 'Request body must be JSON', 400);
+    }
+    const email = typeof body.email === 'string' ? body.email.trim().toLowerCase() : '';
+    if (!email || !email.includes('@'))
+        return err('INVALID_EMAIL', 'Valid email is required', 400);
+    const allowedRoles = ['admin', 'editor', 'viewer'];
+    const role = allowedRoles.includes(body.role)
+        ? body.role
+        : null;
+    if (!role)
+        return err('INVALID_ROLE', 'Role must be admin, editor, or viewer', 400);
+    // Check if already a member
+    const existingMember = await db.memberships.findOne({
+        teamId: team._id.toString(),
+        // We can't query by email directly — that's in the auth system. Skip for v1.
+    });
+    void existingMember; // suppress lint — full check requires auth user lookup, deferred to v1.x
+    // Check for existing pending invite
+    const existingInvite = await db.invites.findOne({
+        teamId: team._id.toString(),
+        email,
+        expiresAt: { $gt: new Date() },
+    });
+    if (existingInvite) {
+        return err('INVITE_EXISTS', 'A pending invite already exists for this email', 409);
+    }
+    const { ObjectId } = await import('mongodb');
+    const now = new Date();
+    const inviteId = new ObjectId();
+    const token = generateInviteToken();
+    await db.invites.insertOne({
+        _id: inviteId,
+        teamId: team._id.toString(),
+        email,
+        role,
+        invitedBy: identity.userId,
+        token,
+        expiresAt: new Date(now.getTime() + INVITE_TTL_MS),
+        createdAt: now,
+    });
+    const invite = await db.invites.findOne({ _id: inviteId });
+    return json({ data: invite }, 201);
+}
+// ---------------------------------------------------------------------------
+// handleAcceptInvite
+// ---------------------------------------------------------------------------
+/**
+ * POST /v1/invites/:token/accept
+ *
+ * Accepts an invite. If the user doesn't exist, the cloud app layer
+ * should call `auth.createUser()` before calling this handler.
+ *
+ * Creates a `MembershipDoc` and deletes the invite.
+ * The request must include the authenticated session of the accepting user.
+ */
+export async function handleAcceptInvite(req, db, auth, token) {
+    const identity = await auth.verifySession(req);
+    if (!identity)
+        return err('UNAUTHORIZED', 'Not authenticated', 401);
+    const invite = await db.invites.findOne({ token });
+    if (!invite)
+        return err('INVITE_NOT_FOUND', 'Invite not found or already used', 404);
+    if (invite.expiresAt < new Date())
+        return err('INVITE_EXPIRED', 'Invite has expired', 410);
+    // Verify the accepting user's email matches the invite
+    if (identity.email.toLowerCase() !== invite.email) {
+        return err('EMAIL_MISMATCH', 'Authenticated email does not match invite', 403);
+    }
+    const { ObjectId } = await import('mongodb');
+    await db.memberships.insertOne({
+        _id: new ObjectId(),
+        teamId: invite.teamId,
+        userId: identity.userId,
+        role: invite.role,
+        createdAt: new Date(),
+    });
+    await db.invites.deleteOne({ _id: invite._id });
+    return json({ data: { teamId: invite.teamId, role: invite.role } });
+}
+// ---------------------------------------------------------------------------
+// handleRevokeInvite
+// ---------------------------------------------------------------------------
+/**
+ * DELETE /v1/teams/:teamSlug/invites/:token
+ *
+ * Deletes a pending invite. Requires `owner` or `admin` role.
+ */
+export async function handleRevokeInvite(req, db, auth, teamSlug, token) {
+    const identity = await auth.verifySession(req);
+    if (!identity)
+        return err('UNAUTHORIZED', 'Not authenticated', 401);
+    const team = await db.teams.findOne({ slug: teamSlug });
+    if (!team)
+        return err('TEAM_NOT_FOUND', 'Team not found', 404);
+    const membership = await db.memberships.findOne({
+        teamId: team._id.toString(),
+        userId: identity.userId,
+    });
+    if (!membership || !['owner', 'admin'].includes(membership.role)) {
+        return err('FORBIDDEN', 'Requires owner or admin role', 403);
+    }
+    const invite = await db.invites.findOne({ token, teamId: team._id.toString() });
+    if (!invite)
+        return err('INVITE_NOT_FOUND', 'Invite not found', 404);
+    await db.invites.deleteOne({ _id: invite._id });
+    return new Response(null, { status: 204 });
+}
+//# sourceMappingURL=invite.js.map

package/dist/invite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.js","sourceRoot":"","sources":["../src/invite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAIpC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;IACxD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,SAAS;AAEvD,SAAS,mBAAmB;IAC1B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,EAAW,EACX,IAAsB,EACtB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEnE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAA;IAE9D,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,GAAG,CAAC,WAAW,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,IAAyC,CAAA;IAC7C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,cAAc,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACnF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,eAAe,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAA;IAE/F,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAA;IAE3D,MAAM,IAAI,GAAI,YAAkC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAc,CAAC;QAC5E,CAAC,CAAE,IAAI,CAAC,IAAmB;QAC3B,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,uCAAuC,EAAE,GAAG,CAAC,CAAA;IAEnF,4BAA4B;IAC5B,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;QAClD,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,6EAA6E;KAC9E,CAAC,CAAA;IACF,KAAK,cAAc,CAAA,CAAC,yEAAyE;IAE7F,oCAAoC;IACpC,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,KAAK;QACL,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;KAC/B,CAAC,CAAA;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,eAAe,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAA;IAEnC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACzB,GAAG,EAAE,QAAQ;QACb,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,KAAK;QACL,IAAI;QACJ,SAAS,EAAE,QAAQ,CAAC,MAAM;QAC1B,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC;QAClD,SAAS,EAAE,GAAG;KACf,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1D,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;AACpC,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,EAAW,EACX,IAAsB,EACtB,KAAa;IAEb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEnE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,kBAAkB,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACpF,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAA;IAE1F,uDAAuD;IACvD,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO,GAAG,CAAC,gBAAgB,EAAE,2CAA2C,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;IAE5C,MAAM,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;QAC7B,GAAG,EAAE,IAAI,QAAQ,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC,CAAA;IAEF,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IAE/C,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,EAAW,EACX,IAAsB,EACtB,QAAgB,EAChB,KAAa;IAEb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEnE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAA;IAE9D,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,GAAG,CAAC,WAAW,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAC/E,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAA;IAEpE,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAC5C,CAAC"}

package/dist/jwt.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Signs a GitHub App JWT (RS256, 10-minute lifetime) using the app's private key.
+ *
+ * @param appId         - GitHub App numeric ID (from app settings).
+ * @param privateKeyPem - PEM-encoded RSA private key (PKCS#1 or PKCS#8).
+ * @returns Signed JWT string for use as `Authorization: Bearer <jwt>`.
+ */
+export declare function signGitHubAppJwt(appId: string, privateKeyPem: string): Promise<string>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB5F"}

package/dist/jwt.js

@@ -0,0 +1,32 @@
+// GitHub App JWT signing using node:crypto (RS256).
+// Produces a 10-minute JWT for authenticating as the GitHub App.
+// Uses node:crypto createSign which accepts both PKCS#1 and PKCS#8 PEM keys.
+import { createSign } from 'node:crypto';
+function base64url(input) {
+    const buf = Buffer.isBuffer(input) ? input : Buffer.from(input);
+    return buf.toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+/**
+ * Signs a GitHub App JWT (RS256, 10-minute lifetime) using the app's private key.
+ *
+ * @param appId         - GitHub App numeric ID (from app settings).
+ * @param privateKeyPem - PEM-encoded RSA private key (PKCS#1 or PKCS#8).
+ * @returns Signed JWT string for use as `Authorization: Bearer <jwt>`.
+ */
+export async function signGitHubAppJwt(appId, privateKeyPem) {
+    const now = Math.floor(Date.now() / 1000);
+    const header = base64url(Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })));
+    const payload = base64url(Buffer.from(JSON.stringify({ iat: now - 60, exp: now + 540, iss: appId })));
+    const signingInput = `${header}.${payload}`;
+    // Normalize literal \n sequences that survive .env parsing (dotenv quirk with some Next.js versions)
+    const normalizedKey = privateKeyPem.replace(/\\n/g, '\n');
+    // node:crypto createSign handles both PKCS#1 (RSA PRIVATE KEY) and PKCS#8 (PRIVATE KEY)
+    const sign = createSign('RSA-SHA256');
+    sign.update(signingInput);
+    const signature = sign.sign(normalizedKey);
+    return `${signingInput}.${base64url(signature)}`;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,iEAAiE;AACjE,6EAA6E;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,SAAS,SAAS,CAAC,KAA0B;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC1B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,aAAqB;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IACnF,MAAM,OAAO,GAAG,SAAS,CACvB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAC3E,CAAA;IACD,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAA;IAE3C,qGAAqG;IACrG,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAEzD,wFAAwF;IACxF,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAE1C,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;AAClD,CAAC"}

package/dist/project.d.ts

@@ -0,0 +1,30 @@
+import type { CloudAuthAdapter } from '@airdraft/cloud-auth';
+import type { CloudDb } from './types.js';
+/**
+ * GET /v1/teams/:teamSlug/projects
+ *
+ * Returns all projects belonging to a team. Requires membership.
+ */
+export declare function handleListProjects(req: Request, db: CloudDb, auth: CloudAuthAdapter, teamSlug: string): Promise<Response>;
+/**
+ * POST /v1/teams/:teamSlug/projects
+ *
+ * Body: `{ name: string }`
+ *
+ * Creates a new project. Requires `owner` or `admin` role.
+ */
+export declare function handleCreateProject(req: Request, db: CloudDb, auth: CloudAuthAdapter, teamSlug: string): Promise<Response>;
+/**
+ * GET /v1/projects/:projectSlug
+ *
+ * Returns project by slug. Resolves team membership from the project's teamId.
+ */
+export declare function handleGetProject(req: Request, db: CloudDb, auth: CloudAuthAdapter, projectSlug: string): Promise<Response>;
+/**
+ * POST /v1/projects/:projectSlug/api-key
+ *
+ * Rotates the project API key. Returns the plaintext key ONCE.
+ * Stores only the SHA-256 hash. Requires `owner` or `admin` role.
+ */
+export declare function handleGenerateApiKey(req: Request, db: CloudDb, auth: CloudAuthAdapter, projectSlug: string): Promise<Response>;
+//# sourceMappingURL=project.d.ts.map

package/dist/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAmCzC;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAMD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CA2CnB;AAMD;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,gBAAgB,EACtB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAcnB;AAMD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,gBAAgB,EACtB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAuBnB"}

package/dist/project.js

@@ -0,0 +1,145 @@
+import { generateApiKey } from '@airdraft/auth';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+function err(code, message, status) {
+    return json({ error: { code, message } }, status);
+}
+async function resolveMembership(db, userId, teamSlug) {
+    const team = await db.teams.findOne({ slug: teamSlug });
+    if (!team)
+        return { team: null, membership: null };
+    const membership = await db.memberships.findOne({
+        teamId: team._id.toString(),
+        userId,
+    });
+    return { team, membership };
+}
+// ---------------------------------------------------------------------------
+// handleListProjects
+// ---------------------------------------------------------------------------
+/**
+ * GET /v1/teams/:teamSlug/projects
+ *
+ * Returns all projects belonging to a team. Requires membership.
+ */
+export async function handleListProjects(req, db, auth, teamSlug) {
+    const identity = await auth.verifySession(req);
+    if (!identity)
+        return err('UNAUTHORIZED', 'Not authenticated', 401);
+    const { team, membership } = await resolveMembership(db, identity.userId, teamSlug);
+    if (!team)
+        return err('TEAM_NOT_FOUND', 'Team not found', 404);
+    if (!membership)
+        return err('FORBIDDEN', 'Not a member of this team', 403);
+    const projects = await db.projects.find({ teamId: team._id.toString() }).toArray();
+    return json({ data: projects });
+}
+// ---------------------------------------------------------------------------
+// handleCreateProject
+// ---------------------------------------------------------------------------
+/**
+ * POST /v1/teams/:teamSlug/projects
+ *
+ * Body: `{ name: string }`
+ *
+ * Creates a new project. Requires `owner` or `admin` role.
+ */
+export async function handleCreateProject(req, db, auth, teamSlug) {
+    const identity = await auth.verifySession(req);
+    if (!identity)
+        return err('UNAUTHORIZED', 'Not authenticated', 401);
+    const { team, membership } = await resolveMembership(db, identity.userId, teamSlug);
+    if (!team)
+        return err('TEAM_NOT_FOUND', 'Team not found', 404);
+    if (!membership || !['owner', 'admin'].includes(membership.role)) {
+        return err('FORBIDDEN', 'Requires owner or admin role', 403);
+    }
+    let body;
+    try {
+        body = await req.json();
+    }
+    catch {
+        return err('INVALID_BODY', 'Request body must be JSON', 400);
+    }
+    const name = typeof body.name === 'string' ? body.name.trim() : '';
+    if (!name)
+        return err('INVALID_NAME', 'Project name is required', 400);
+    const baseSlug = name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
+    if (!baseSlug)
+        return err('INVALID_NAME', 'Project name must contain alphanumeric characters', 400);
+    const existing = await db.projects.findOne({ teamId: team._id.toString(), slug: baseSlug });
+    const slug = existing ? `${baseSlug}-${Date.now().toString(36)}` : baseSlug;
+    const { ObjectId } = await import('mongodb');
+    const now = new Date();
+    const projectId = new ObjectId();
+    await db.projects.insertOne({
+        _id: projectId,
+        teamId: team._id.toString(),
+        name,
+        slug,
+        apiKeyHash: null,
+        github: null,
+        createdAt: now,
+        updatedAt: now,
+    });
+    const project = await db.projects.findOne({ _id: projectId });
+    return json({ data: project }, 201);
+}
+// ---------------------------------------------------------------------------
+// handleGetProject
+// ---------------------------------------------------------------------------
+/**
+ * GET /v1/projects/:projectSlug
+ *
+ * Returns project by slug. Resolves team membership from the project's teamId.
+ */
+export async function handleGetProject(req, db, auth, projectSlug) {
+    const identity = await auth.verifySession(req);
+    if (!identity)
+        return err('UNAUTHORIZED', 'Not authenticated', 401);
+    const project = await db.projects.findOne({ slug: projectSlug });
+    if (!project)
+        return err('PROJECT_NOT_FOUND', 'Project not found', 404);
+    const membership = await db.memberships.findOne({
+        teamId: project.teamId,
+        userId: identity.userId,
+    });
+    if (!membership)
+        return err('FORBIDDEN', 'Not a member of this project team', 403);
+    return json({ data: project });
+}
+// ---------------------------------------------------------------------------
+// handleGenerateApiKey
+// ---------------------------------------------------------------------------
+/**
+ * POST /v1/projects/:projectSlug/api-key
+ *
+ * Rotates the project API key. Returns the plaintext key ONCE.
+ * Stores only the SHA-256 hash. Requires `owner` or `admin` role.
+ */
+export async function handleGenerateApiKey(req, db, auth, projectSlug) {
+    const identity = await auth.verifySession(req);
+    if (!identity)
+        return err('UNAUTHORIZED', 'Not authenticated', 401);
+    const project = await db.projects.findOne({ slug: projectSlug });
+    if (!project)
+        return err('PROJECT_NOT_FOUND', 'Project not found', 404);
+    const membership = await db.memberships.findOne({
+        teamId: project.teamId,
+        userId: identity.userId,
+    });
+    if (!membership || !['owner', 'admin'].includes(membership.role)) {
+        return err('FORBIDDEN', 'Requires owner or admin role', 403);
+    }
+    const { key, hash } = generateApiKey();
+    await db.projects.updateOne({ _id: project._id }, { $set: { apiKeyHash: hash, updatedAt: new Date() } });
+    return json({ data: { key } });
+}
+//# sourceMappingURL=project.js.map

package/dist/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAI/C,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;IACxD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAW,EACX,MAAc,EACd,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IAClD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,MAAM;KACP,CAAC,CAAA;IACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAC7B,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,EAAW,EACX,IAAsB,EACtB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEnE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACnF,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAA;IAE1E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;IAClF,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;AACjC,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAY,EACZ,EAAW,EACX,IAAsB,EACtB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEnE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACnF,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,GAAG,CAAC,WAAW,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,IAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,cAAc,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAA;IAEtE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IACrF,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,mDAAmD,EAAE,GAAG,CAAC,CAAA;IAEnG,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC3F,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IAE3E,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,QAAQ,EAAE,CAAA;IAEhC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC1B,GAAG,EAAE,SAAS;QACd,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,IAAI;QACJ,IAAI;QACJ,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;AACrC,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAY,EACZ,EAAW,EACX,IAAsB,EACtB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEnE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEvE,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAA;IACF,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;IAElF,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;AAChC,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAY,EACZ,EAAW,EACX,IAAsB,EACtB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEnE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;IAEvE,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,GAAG,CAAC,WAAW,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAA;IAEtC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CACzB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EACpB,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CACtD,CAAA;IAED,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC"}

package/dist/relay.d.ts

@@ -0,0 +1,35 @@
+import type { CloudDb, TokenCache } from './types.js';
+export interface RelayOptions {
+    /** GitHub App numeric ID — from `GITHUB_APP_ID` env var on the cloud server. */
+    githubAppId: string;
+    /** GitHub App PEM private key — from `GITHUB_APP_PRIVATE_KEY` env var. */
+    githubAppPrivateKey: string;
+    /** Optional L2 token cache (Upstash Redis in production). */
+    cache?: TokenCache;
+}
+/**
+ * Handler for `POST /v1/github/token`.
+ *
+ * Exchanges a project API key (`ntk_*`) for a GitHub installation access token.
+ * Used by mode 2 self-hosted runtimes that rely on Airdraft's shared GitHub App.
+ *
+ * Flow:
+ * 1. Extract and validate `ntk_*` key from `Authorization: Bearer` header
+ * 2. Hash → look up in `projects` collection
+ * 3. Apply per-installation rate limit (1 req/s, Redis counter)
+ * 4. Return cached token from Redis if still fresh
+ * 5. Mint fresh token via GitHub App JWT → cache → return
+ *
+ * ```ts
+ * // In a Next.js route handler:
+ * export async function POST(req: Request) {
+ *   return handleTokenRelay(req, db, {
+ *     githubAppId: process.env.GITHUB_APP_ID!,
+ *     githubAppPrivateKey: process.env.GITHUB_APP_PRIVATE_KEY!,
+ *     cache: redisCache,
+ *   })
+ * }
+ * ```
+ */
+export declare function handleTokenRelay(req: Request, db: CloudDb, opts: RelayOptions): Promise<Response>;
+//# sourceMappingURL=relay.d.ts.map

package/dist/relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.d.ts","sourceRoot":"","sources":["../src/relay.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAMrD,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,mBAAmB,EAAE,MAAM,CAAA;IAC3B,6DAA6D;IAC7D,KAAK,CAAC,EAAE,UAAU,CAAA;CACnB;AAsBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,QAAQ,CAAC,CAoEnB"}