@contextplusplus/core 1.1.0

package/dist/infrastructure/artifacts/filesystem-artifact-store.js

@@ -0,0 +1,146 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bab646d4-e088-5832-865f-fc2f3d77512b")}catch(e){}}();
+import { FileSystem, Path } from "@effect/platform";
+import { NodeFileSystem, NodePath } from "@effect/platform-node";
+import { Effect, Exit, Layer, Option, Redacted } from "effect";
+import { ArtifactStore } from "../../application/ports/artifact-store.js";
+import { ConfigService } from "../../application/ports/config-service.js";
+import { MetricsService } from "../../application/ports/metrics-service.js";
+import { ArtifactWriteError, sanitizeErrorCause, sanitizeErrorMessage } from "../../domain/errors.js";
+const ARTIFACT_NAMES = [
+    "request",
+    "response",
+    "markdown",
+    "metadata",
+    "error"
+];
+// Artifact keys are arbitrary JSON property names (snake_case, camelCase,
+// kebab-case), not HTTP headers — that's why this uses substring matching
+// instead of the dash-delimited isSecretHeaderName() from application/cache/key.ts.
+// Do NOT expand back into a chain of separate regex tests; one alternation
+// covers Authorization / Set-Cookie / *api[-_]?key* / *token* / *secret* /
+// *password* across all key-casing styles in a single test.
+const ARTIFACT_SECRET_KEY_PATTERN = /authorization|cookie|password|secret|token|api[-_]?key/i;
+export const FilesystemArtifactStoreLive = Layer.effect(ArtifactStore, Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const { config } = yield* ConfigService;
+    const metrics = yield* MetricsService;
+    const saveRunArtifact = Effect.fn("ArtifactStore.saveRunArtifact")((runId, name, body, options) => {
+        const now = new Date();
+        const directory = path.resolve(config.artifactRoot, "runs", now.toISOString().slice(0, 10), sanitizePathSegment(String(runId)));
+        const extension = options?.extension ?? defaultExtension(name);
+        const absolutePath = path.resolve(directory, `${sanitizePathSegment(name)}.${extension}`);
+        const shouldRedact = options?.redactSecrets !== false;
+        const tempPath = `${absolutePath}.${process.pid}.${Date.now()}.tmp`;
+        return serializeArtifactEffect(runId, absolutePath, body, extension, shouldRedact).pipe(Effect.flatMap((content) => fs.makeDirectory(directory, { recursive: true, mode: 0o700 }).pipe(Effect.zipRight(fs.writeFileString(tempPath, content, { mode: 0o600 })), Effect.zipRight(fs.rename(tempPath, absolutePath)), Effect.onExit((exit) => Exit.isSuccess(exit)
+            ? Effect.void
+            : fs.remove(tempPath).pipe(Effect.catchAll((cleanupError) => Effect.logWarning("artifact temp cleanup failed", {
+                path: redactPath(tempPath),
+                cause: String(cleanupError)
+            })))))), Effect.as({ absolutePath }), Effect.mapError((cause) => cause instanceof ArtifactWriteError
+            ? cause
+            : new ArtifactWriteError({
+                runId: String(runId),
+                path: absolutePath,
+                cause: sanitizeErrorCause(cause)
+            })));
+    });
+    const saveRunBundle = Effect.fn("ArtifactStore.saveRunBundle")((runId, files) => {
+        const writtenPaths = [];
+        return Effect.forEach(ARTIFACT_NAMES, (name) => {
+            const body = files[name];
+            return body === undefined
+                ? Effect.succeed(Option.none())
+                : saveRunArtifact(runId, name, body).pipe(Effect.tap(({ absolutePath }) => Effect.sync(() => {
+                    writtenPaths.push(absolutePath);
+                })), Effect.map(({ absolutePath }) => Option.some([name, absolutePath])));
+        }, { concurrency: 1 }).pipe(Effect.onExit((exit) => Exit.isSuccess(exit) || writtenPaths.length === 0
+            ? Effect.void
+            : Effect.forEach(writtenPaths, (absolutePath) => fs.remove(absolutePath).pipe(Effect.catchAll((cleanupError) => Effect.logWarning("artifact bundle rollback failed", {
+                path: redactPath(absolutePath),
+                cause: String(cleanupError)
+            }))), { concurrency: 4, discard: true })), Effect.map((entries) => {
+            const paths = {};
+            for (const entry of entries) {
+                if (Option.isSome(entry)) {
+                    const [name, absolutePath] = entry.value;
+                    paths[name] = absolutePath;
+                }
+            }
+            return {
+                ...(paths.request !== undefined ? { request: paths.request } : {}),
+                ...(paths.response !== undefined ? { response: paths.response } : {}),
+                ...(paths.markdown !== undefined ? { markdown: paths.markdown } : {}),
+                ...(paths.metadata !== undefined ? { metadata: paths.metadata } : {}),
+                ...(paths.error !== undefined ? { error: paths.error } : {})
+            };
+        }));
+    });
+    return ArtifactStore.make({
+        saveRunArtifact: (runId, name, body, options) => saveRunArtifact(runId, name, body, options).pipe(Effect.withSpan("ArtifactStore.saveRunArtifact"), Effect.tap(({ absolutePath }) => Effect.logInfo("artifact write completed", {
+            runId: String(runId),
+            name,
+            path: redactPath(absolutePath)
+        })), Effect.tap(() => metrics.recordArtifactSave({ status: "success" })), Effect.tapError(() => metrics.recordArtifactSave({ status: "failed" }))),
+        saveRunBundle: (runId, files) => saveRunBundle(runId, files).pipe(Effect.withSpan("ArtifactStore.saveRunBundle"), Effect.tap(() => Effect.logInfo("artifact bundle completed", { runId: String(runId) })))
+    });
+})).pipe(Layer.provide(NodeFileSystem.layer), Layer.provide(NodePath.layer));
+function defaultExtension(name) {
+    return name === "markdown" ? "md" : "json";
+}
+function serializeArtifact(body, extension, redactSecrets) {
+    const value = redactSecrets ? redactSecretValues(body) : body;
+    if (extension === "md" || extension === "txt") {
+        return typeof value === "string" ? redactSecretText(value) : JSON.stringify(value, null, 2);
+    }
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function serializeArtifactEffect(runId, path, body, extension, redactSecrets) {
+    return Effect.try({
+        try: () => serializeArtifact(body, extension, redactSecrets),
+        catch: (cause) => new ArtifactWriteError({
+            runId: String(runId),
+            path,
+            cause: sanitizeErrorCause(cause)
+        })
+    });
+}
+function redactSecretText(value) {
+    return sanitizeErrorMessage(value)
+        .replace(/(authorization\s*[:=]\s*bearer\s+)[^\s"'`,}]+/gi, "$1[REDACTED]")
+        .replace(/(x-api-key\s*[:=]\s*)[^\s"'`,}]+/gi, "$1[REDACTED]")
+        .replace(/(set-cookie\s*[:=]\s*)[^\n]+/gi, "$1[REDACTED]")
+        .replace(/(cookie\s*[:=]\s*)[^\n]+/gi, "$1[REDACTED]");
+}
+function redactSecretValues(value) {
+    if (Redacted.isRedacted(value)) {
+        return "[REDACTED]";
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactSecretValues(item));
+    }
+    if (value === null || typeof value !== "object") {
+        return typeof value === "string" ? redactSecretText(value) : value;
+    }
+    const output = {};
+    for (const [key, child] of Object.entries(value)) {
+        output[key] = isSecretArtifactKey(key)
+            ? "[REDACTED]"
+            : redactSecretValues(child);
+    }
+    return output;
+}
+function isSecretArtifactKey(key) {
+    return ARTIFACT_SECRET_KEY_PATTERN.test(key);
+}
+function sanitizePathSegment(value) {
+    const sanitized = value.replace(/[^a-zA-Z0-9._-]/g, "_");
+    return sanitized.length === 0 ? "artifact" : sanitized;
+}
+function redactPath(value) {
+    const parts = value.split(/[\\/]/);
+    return parts.slice(-3).join("/");
+}
+//# sourceMappingURL=filesystem-artifact-store.js.map
+//# debugId=bab646d4-e088-5832-865f-fc2f3d77512b

package/dist/infrastructure/artifacts/filesystem-artifact-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-artifact-store.js","sources":["../../../src/infrastructure/artifacts/filesystem-artifact-store.ts"],"sourceRoot":"","names":[],"mappings":";;AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC/D,OAAO,EACL,aAAa,EAGd,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAC5E,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,wBAAwB,CAAC;AAIhC,MAAM,cAAc,GAAG;IACrB,SAAS;IACT,UAAU;IACV,UAAU;IACV,UAAU;IACV,OAAO;CACmC,CAAC;AAC7C,0EAA0E;AAC1E,0EAA0E;AAC1E,oFAAoF;AACpF,2EAA2E;AAC3E,2EAA2E;AAC3E,4DAA4D;AAC5D,MAAM,2BAA2B,GAC/B,yDAAyD,CAAC;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,MAAM,CACrD,aAAa,EACb,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IAEtC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,CACjE,KAAqB,EACrB,IAAkB,EAClB,IAAa,EACb,OAAgC,EACsC,EAAE;QACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAC5B,MAAM,CAAC,YAAY,EACnB,MAAM,EACN,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAC9B,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACnC,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAC/B,SAAS,EACT,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAC5C,CAAC;QACF,MAAM,YAAY,GAAG,OAAO,EAAE,aAAa,KAAK,KAAK,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAEpE,OAAO,uBAAuB,CAC5B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,SAAS,EACT,YAAY,CACb,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzB,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EACvE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,EAClD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACrB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAClB,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtB,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,EAAE,EAAE,CAC/B,MAAM,CAAC,UAAU,CAAC,8BAA8B,EAAE;gBAChD,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC;gBAC1B,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;aAC5B,CAAC,CACH,CACF,CACN,CACF,CACF,EACD,MAAM,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAC3B,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,YAAY,kBAAkB;YACjC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,kBAAkB,CAAC;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBACpB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC;aACjC,CAAC,CACP,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAC7D,KAAqB,EACrB,KAA6C,EACK,EAAE;QACpD,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,OAAO,IAAI,KAAK,SAAS;gBACvB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAmC,CAAC;gBAChE,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CACrC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;oBACf,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAClC,CAAC,CAAC,CACH,EACD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,YAAY,CAAU,CAAC,CAC3C,CACF,CAAC;QACR,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CACzB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACrB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAC/C,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,MAAM,CAAC,OAAO,CACZ,YAAY,EACZ,CAAC,YAAY,EAAE,EAAE,CACf,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAC1B,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,EAAE,EAAE,CAC/B,MAAM,CAAC,UAAU,CAAC,iCAAiC,EAAE;gBACnD,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;gBAC9B,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;aAC5B,CAAC,CACH,CACF,EACH,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAClC,CACN,EACD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACrB,MAAM,KAAK,GAA0C,EAAE,CAAC;YACxD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;oBACzC,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,OAAO;gBACL,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,aAAa,CAAC,IAAI,CAAC;QACxB,eAAe,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAC9C,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAChD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAC9B,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;YACzC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YACpB,IAAI;YACJ,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;SAC/B,CAAC,CACH,EACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,EACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CACxE;QACH,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAC9B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAC9B,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,MAAM,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CACtE,CACF;KACJ,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAE3E,SAAS,gBAAgB,CAAC,IAAkB;IAC1C,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAa,EACb,SAAgC,EAChC,aAAsB;IAEtB,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAqB,EACrB,IAAY,EACZ,IAAa,EACb,SAAgC,EAChC,aAAsB;IAEtB,OAAO,MAAM,CAAC,GAAG,CAAC;QAChB,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC;QAC5D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,kBAAkB,CAAC;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YACpB,IAAI;YACJ,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC;SACjC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,oBAAoB,CAAC,KAAK,CAAC;SAC/B,OAAO,CAAC,iDAAiD,EAAE,cAAc,CAAC;SAC1E,OAAO,CAAC,oCAAoC,EAAE,cAAc,CAAC;SAC7D,OAAO,CAAC,gCAAgC,EAAE,cAAc,CAAC;SACzD,OAAO,CAAC,4BAA4B,EAAE,cAAc,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC","debugId":"bab646d4-e088-5832-865f-fc2f3d77512b"}

package/dist/infrastructure/auth/api-key-service-live.d.ts

@@ -0,0 +1,34 @@
+import { Layer, Option, Redacted } from "effect";
+import { ApiKeyService } from "../../application/ports/api-key-service.js";
+import { ProductConfigService, type ProductConfig } from "../../application/ports/config-service.js";
+interface ApiKeyRow {
+    readonly id: string;
+    readonly name: string | null;
+    readonly key_prefix: string;
+    readonly created_at: string;
+    readonly last_used_at: string | null;
+    readonly expires_at: string | null;
+    readonly revoked_at: string | null;
+    readonly scopes: readonly string[] | null;
+}
+export interface ApiKeyServiceDeps {
+    readonly insert: (row: {
+        readonly id: string;
+        readonly user_id: string;
+        readonly name: string;
+        readonly key_prefix: string;
+        readonly key_hash: string;
+        readonly expires_at: string | null;
+        readonly scopes: readonly string[];
+    }) => Promise<ApiKeyRow>;
+    readonly list: (userId: string) => Promise<readonly ApiKeyRow[]>;
+    readonly revoke: (userId: string, keyId: string) => Promise<ApiKeyRow | null>;
+    readonly rotate: (userId: string, keyId: string, keyPrefix: string, keyHash: string) => Promise<ApiKeyRow | null>;
+}
+export declare function generateApiKey(): string;
+export declare function apiKeyPrefix(rawKey: string): string;
+export declare function makeApiKeyService(deps: ApiKeyServiceDeps, apiKeyHashSecret?: Option.Option<Redacted.Redacted<string>>): import("../../application/ports/api-key-service.js").ApiKeyServiceApi;
+export declare function apiKeyServiceDeps(config: ProductConfig): ApiKeyServiceDeps;
+export declare const ApiKeyServiceLive: Layer.Layer<ApiKeyService, never, ProductConfigService>;
+export {};
+//# sourceMappingURL=api-key-service-live.d.ts.map

package/dist/infrastructure/auth/api-key-service-live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-service-live.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/auth/api-key-service-live.ts"],"names":[],"mappings":"AAGA,OAAO,EAAU,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EACL,aAAa,EAEd,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EACnB,MAAM,2CAA2C,CAAC;AAUnD,UAAU,SAAS;IACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC9E,QAAQ,CAAC,MAAM,EAAE,CACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CAChC;AAkED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,gBAAgB,GAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB,yEA+E3E;AA2FD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,iBAAiB,CAU1E;AAED,eAAO,MAAM,iBAAiB,yDAM7B,CAAC"}

package/dist/infrastructure/auth/api-key-service-live.js

@@ -0,0 +1,217 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="354c6bc0-5a45-58b5-b518-432b4c137c99")}catch(e){}}();
+import { randomBytes, randomUUID } from "node:crypto";
+import { createClient } from "@supabase/supabase-js";
+import { Effect, Layer, Option, Redacted } from "effect";
+import { ApiKeyService } from "../../application/ports/api-key-service.js";
+import { ProductConfigService } from "../../application/ports/config-service.js";
+import { BillingStateError, InputValidationError, NotFoundError, sanitizeErrorCause } from "../../domain/errors.js";
+import { FULL_SCOPES, isApiKeyScope } from "../../domain/scopes.js";
+import { hashApiKey } from "./supabase-auth-live.js";
+const KEY_PREFIX = "atmd";
+function toMetadata(row) {
+    // A null/absent scope set is a legacy key → full-scope.
+    const scopes = row.scopes === null ? FULL_SCOPES : row.scopes.filter(isApiKeyScope);
+    return {
+        id: row.id,
+        name: row.name ?? "",
+        keyPrefix: row.key_prefix,
+        createdAt: row.created_at,
+        lastUsedAt: row.last_used_at,
+        expiresAt: row.expires_at,
+        revokedAt: row.revoked_at,
+        scopes
+    };
+}
+/**
+ * Resolves the scope grant for a new key: an omitted or empty set defaults to
+ * full scope (back-compat), otherwise the de-duplicated requested set. The HTTP
+ * boundary already rejects unknown scope strings at decode time.
+ */
+function resolveScopes(requested) {
+    if (requested === undefined || requested.length === 0) {
+        return FULL_SCOPES;
+    }
+    return [...new Set(requested.filter(isApiKeyScope))];
+}
+function validateKeyName(name) {
+    const trimmed = name.trim();
+    if (trimmed.length === 0 || trimmed.length > 80) {
+        return Effect.fail(new InputValidationError({
+            message: "API key name must be between 1 and 80 characters"
+        }));
+    }
+    return Effect.succeed(trimmed);
+}
+function validateExpiresAt(value) {
+    if (value === undefined || value.trim().length === 0) {
+        return Effect.succeed(null);
+    }
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed)) {
+        return Effect.fail(new InputValidationError({ message: "API key expiration must be an ISO date" }));
+    }
+    return Effect.succeed(new Date(parsed).toISOString());
+}
+function billingError(operation) {
+    return (cause) => new BillingStateError({ operation, cause: sanitizeErrorCause(cause) });
+}
+export function generateApiKey() {
+    return `${KEY_PREFIX}_${randomBytes(32).toString("base64url")}`;
+}
+export function apiKeyPrefix(rawKey) {
+    return rawKey.slice(0, 12);
+}
+export function makeApiKeyService(deps, apiKeyHashSecret = Option.none()) {
+    return ApiKeyService.make({
+        create: ({ userId, name, expiresAt, scopes }) => Effect.gen(function* () {
+            const normalizedName = yield* validateKeyName(name);
+            const normalizedExpiresAt = yield* validateExpiresAt(expiresAt);
+            const rawKey = generateApiKey();
+            const row = yield* Effect.tryPromise({
+                try: () => deps.insert({
+                    id: randomUUID(),
+                    user_id: String(userId),
+                    name: normalizedName,
+                    key_prefix: apiKeyPrefix(rawKey),
+                    key_hash: hashApiKey(rawKey, Option.getOrUndefined(apiKeyHashSecret)),
+                    expires_at: normalizedExpiresAt,
+                    scopes: resolveScopes(scopes)
+                }),
+                catch: billingError("api-key-create")
+            });
+            return { key: Redacted.make(rawKey), metadata: toMetadata(row) };
+        }).pipe(Effect.withSpan("ApiKeyService.create")),
+        list: (userId) => Effect.tryPromise({
+            try: () => deps.list(String(userId)),
+            catch: billingError("api-key-list")
+        }).pipe(Effect.map((rows) => rows.map(toMetadata)), Effect.withSpan("ApiKeyService.list")),
+        revoke: ({ userId, keyId }) => Effect.gen(function* () {
+            if (keyId.trim().length === 0) {
+                return yield* new InputValidationError({
+                    message: "API key id is required"
+                });
+            }
+            const row = yield* Effect.tryPromise({
+                try: () => deps.revoke(String(userId), keyId),
+                catch: billingError("api-key-revoke")
+            });
+            if (row === null) {
+                return yield* new NotFoundError({
+                    resource: "api-key",
+                    id: keyId,
+                    message: "API key was not found"
+                });
+            }
+            return toMetadata(row);
+        }).pipe(Effect.withSpan("ApiKeyService.revoke")),
+        rotate: ({ userId, keyId }) => Effect.gen(function* () {
+            if (keyId.trim().length === 0) {
+                return yield* new InputValidationError({
+                    message: "API key id is required"
+                });
+            }
+            const rawKey = generateApiKey();
+            const row = yield* Effect.tryPromise({
+                try: () => deps.rotate(String(userId), keyId, apiKeyPrefix(rawKey), hashApiKey(rawKey, Option.getOrUndefined(apiKeyHashSecret))),
+                catch: billingError("api-key-rotate")
+            });
+            if (row === null) {
+                return yield* new NotFoundError({
+                    resource: "api-key",
+                    id: keyId,
+                    message: "API key was not found"
+                });
+            }
+            return { key: Redacted.make(rawKey), metadata: toMetadata(row) };
+        }).pipe(Effect.withSpan("ApiKeyService.rotate"))
+    });
+}
+const rejectUnconfigured = (operation) => () => Promise.reject(new Error(`Supabase service role is not configured (${operation})`));
+function serviceRoleClient(config) {
+    return Option.flatMap(config.supabaseServiceRoleKey, (serviceRoleKey) => Option.map(config.supabaseUrl, (url) => createClient(url, Redacted.value(serviceRoleKey), {
+        auth: { persistSession: false, autoRefreshToken: false }
+    })));
+}
+function liveDeps(client) {
+    return {
+        insert: async (row) => {
+            const { data, error } = await client
+                .from("api_keys")
+                // Local insert DTO uses readonly fields/arrays; the generated Insert
+                // expects mutable. Identical column set — cast the payload; the typed
+                // handle still checks the table name and the returned projection.
+                .insert(row)
+                .select("id, name, key_prefix, created_at, last_used_at, expires_at, revoked_at, scopes")
+                .single();
+            if (error !== null) {
+                throw error;
+            }
+            return data;
+        },
+        list: async (userId) => {
+            const { data, error } = await client
+                .from("api_keys")
+                .select("id, name, key_prefix, created_at, last_used_at, expires_at, revoked_at, scopes")
+                .eq("user_id", userId)
+                .order("created_at", { ascending: false });
+            if (error !== null) {
+                throw error;
+            }
+            return data ?? [];
+        },
+        revoke: async (userId, keyId) => {
+            const { data, error } = await client
+                .from("api_keys")
+                .update({ revoked_at: new Date().toISOString() })
+                .eq("user_id", userId)
+                .eq("id", keyId)
+                .is("revoked_at", null)
+                .select("id, name, key_prefix, created_at, last_used_at, expires_at, revoked_at, scopes")
+                .maybeSingle();
+            if (error !== null) {
+                throw error;
+            }
+            return data ?? null;
+        },
+        rotate: async (userId, keyId, keyPrefix, keyHash) => {
+            // Single-statement, owner-scoped UPDATE. The `user_id` predicate is the
+            // only defense against cross-user rotation; a foreign/missing/already-
+            // revoked key matches zero rows → null → 404. `last_used_at` resets to
+            // null because the freshly-minted secret has never been used.
+            const { data, error } = await client
+                .from("api_keys")
+                .update({
+                key_prefix: keyPrefix,
+                key_hash: keyHash,
+                last_used_at: null
+            })
+                .eq("user_id", userId)
+                .eq("id", keyId)
+                .is("revoked_at", null)
+                .select("id, name, key_prefix, created_at, last_used_at, expires_at, revoked_at, scopes")
+                .maybeSingle();
+            if (error !== null) {
+                throw error;
+            }
+            return data ?? null;
+        }
+    };
+}
+export function apiKeyServiceDeps(config) {
+    return Option.match(serviceRoleClient(config), {
+        onNone: () => ({
+            insert: rejectUnconfigured("api-key-create"),
+            list: rejectUnconfigured("api-key-list"),
+            revoke: rejectUnconfigured("api-key-revoke"),
+            rotate: rejectUnconfigured("api-key-rotate")
+        }),
+        onSome: (client) => liveDeps(client)
+    });
+}
+export const ApiKeyServiceLive = Layer.effect(ApiKeyService, Effect.gen(function* () {
+    const { config } = yield* ProductConfigService;
+    return makeApiKeyService(apiKeyServiceDeps(config), config.apiKeyHashSecret);
+}));
+//# sourceMappingURL=api-key-service-live.js.map
+//# debugId=354c6bc0-5a45-58b5-b518-432b4c137c99

package/dist/infrastructure/auth/api-key-service-live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-service-live.js","sources":["../../../src/infrastructure/auth/api-key-service-live.ts"],"sourceRoot":"","names":[],"mappings":";;AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EACL,aAAa,EAEd,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,oBAAoB,EAErB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAiCrD,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,SAAS,UAAU,CAAC,GAAc;IAChC,wDAAwD;IACxD,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACvE,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;QACpB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACpB,SAAwC;IAExC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,oBAAoB,CAAC;YACvB,OAAO,EAAE,kDAAkD;SAC5D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,CAAC,KAAc,EAAE,EAAE,CACxB,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,GAAG,UAAU,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAuB,EACvB,mBAA6D,MAAM,CAAC,IAAI,EAAE;IAE1E,OAAO,aAAa,CAAC,IAAI,CAAC;QACxB,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAC9C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACnC,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,CAAC,MAAM,CAAC;oBACV,EAAE,EAAE,UAAU,EAAE;oBAChB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACvB,IAAI,EAAE,cAAc;oBACpB,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC;oBAChC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;oBACrE,UAAU,EAAE,mBAAmB;oBAC/B,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;iBAC9B,CAAC;gBACJ,KAAK,EAAE,YAAY,CAAC,gBAAgB,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACf,MAAM,CAAC,UAAU,CAAC;YAChB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpC,KAAK,EAAE,YAAY,CAAC,cAAc,CAAC;SACpC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAC1C,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CACtC;QACH,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAC5B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;oBACrC,OAAO,EAAE,wBAAwB;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACnC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;gBAC7C,KAAK,EAAE,YAAY,CAAC,gBAAgB,CAAC;aACtC,CAAC,CAAC;YACH,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC;oBAC9B,QAAQ,EAAE,SAAS;oBACnB,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,uBAAuB;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAC5B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;oBACrC,OAAO,EAAE,wBAAwB;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACnC,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,CAAC,MAAM,CACT,MAAM,CAAC,MAAM,CAAC,EACd,KAAK,EACL,YAAY,CAAC,MAAM,CAAC,EACpB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAC5D;gBACH,KAAK,EAAE,YAAY,CAAC,gBAAgB,CAAC;aACtC,CAAC,CAAC;YACH,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC;oBAC9B,QAAQ,EAAE,SAAS;oBACnB,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,uBAAuB;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,GAAmB,EAAE,CACrE,OAAO,CAAC,MAAM,CACZ,IAAI,KAAK,CAAC,4CAA4C,SAAS,GAAG,CAAC,CACpE,CAAC;AAEJ,SAAS,iBAAiB,CAAC,MAAqB;IAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,cAAc,EAAE,EAAE,CACtE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CACrC,YAAY,CAAW,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;QAC1D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACzD,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,MAAgC;IAChD,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM;iBACjC,IAAI,CAAC,UAAU,CAAC;gBACjB,qEAAqE;gBACrE,sEAAsE;gBACtE,kEAAkE;iBACjE,MAAM,CAAC,GAAyD,CAAC;iBACjE,MAAM,CACL,gFAAgF,CACjF;iBACA,MAAM,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,IAAiB,CAAC;QAC3B,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM;iBACjC,IAAI,CAAC,UAAU,CAAC;iBAChB,MAAM,CACL,gFAAgF,CACjF;iBACA,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;iBACrB,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAQ,IAAoC,IAAI,EAAE,CAAC;QACrD,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM;iBACjC,IAAI,CAAC,UAAU,CAAC;iBAChB,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;iBAChD,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;iBACrB,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;iBACf,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC;iBACtB,MAAM,CACL,gFAAgF,CACjF;iBACA,WAAW,EAAE,CAAC;YACjB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAQ,IAAyB,IAAI,IAAI,CAAC;QAC5C,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;YAClD,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM;iBACjC,IAAI,CAAC,UAAU,CAAC;iBAChB,MAAM,CAAC;gBACN,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,YAAY,EAAE,IAAI;aACnB,CAAC;iBACD,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;iBACrB,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;iBACf,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC;iBACtB,MAAM,CACL,gFAAgF,CACjF;iBACA,WAAW,EAAE,CAAC;YACjB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAQ,IAAyB,IAAI,IAAI,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,OAAO,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;QAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACb,MAAM,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;YAC5C,IAAI,EAAE,kBAAkB,CAAC,cAAc,CAAC;YACxC,MAAM,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;YAC5C,MAAM,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;SAC7C,CAAC;QACF,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAC3C,aAAa,EACb,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC;IAC/C,OAAO,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC/E,CAAC,CAAC,CACH,CAAC","debugId":"354c6bc0-5a45-58b5-b518-432b4c137c99"}

package/dist/infrastructure/auth/supabase-auth-live.d.ts

@@ -0,0 +1,56 @@
+import { Layer, Option, Redacted } from "effect";
+import { AuthService } from "../../application/ports/auth-service.js";
+import { ProductConfigService, type ProductConfig } from "../../application/ports/config-service.js";
+export interface SupabaseJwtClaims {
+    readonly sub: string;
+    readonly email?: string;
+    readonly role?: string;
+}
+export interface ApiKeyOwnerRow {
+    readonly user_id: string;
+    readonly expires_at: string | null;
+    readonly revoked_at: string | null;
+    /**
+     * Granted capability scopes. `null` (a key with no explicit scope set, e.g.
+     * one predating scope support) is treated as full-scope downstream.
+     */
+    readonly scopes?: readonly string[] | null;
+}
+/**
+ * Injectable verification seam. The local stack uses symmetric HS256 with
+ * `SUPABASE_JWT_SECRET`; a hosted project swaps {@link SupabaseAuthDeps.verifyJwt}
+ * for a JWKS/`createRemoteJWKSet` verifier without touching the service.
+ */
+export interface SupabaseAuthDeps {
+    readonly verifyJwt: (token: string) => Promise<SupabaseJwtClaims>;
+    readonly lookupApiKeyOwner: (keyHashHex: string) => Promise<ApiKeyOwnerRow | null>;
+}
+/**
+ * Hex digest of an API key — the only representation we persist.
+ *
+ * With no secret: `sha256(rawKey)` (the legacy, byte-for-byte behaviour). With a
+ * secret (`API_KEY_HASH_SECRET`): keyed `HMAC-sha256(rawKey)`, so a stolen DB
+ * dump cannot be brute-forced offline without the secret. Verification accepts
+ * BOTH, so enabling the secret never invalidates an existing key.
+ */
+export declare function hashApiKey(rawKey: string, secret?: Redacted.Redacted<string>): string;
+/** Local/dev HS256 verifier. Hosted projects substitute a JWKS verifier. */
+export declare function hs256Verifier(secret: Redacted.Redacted<string>, audience: string, issuer?: string): (token: string) => Promise<SupabaseJwtClaims>;
+/**
+ * Asymmetric verifier for hosted Supabase projects, which sign user session
+ * JWTs with ES256 (and may rotate to RS256). Keys are fetched from the
+ * project's JWKS endpoint; jose caches and refreshes the key set internally,
+ * so the remote set is created once per verifier and reused across requests.
+ */
+export declare function jwksVerifier(supabaseUrl: string, audience: string): (token: string) => Promise<SupabaseJwtClaims>;
+export declare function makeSupabaseAuthService(deps: SupabaseAuthDeps, apiKeyHashSecret?: Option.Option<Redacted.Redacted<string>>): import("../../application/ports/auth-service.js").AuthServiceApi;
+/**
+ * Routes a presented token to the verifier matching its header `alg`: symmetric
+ * HS256 for the local/dev stack (needs `SUPABASE_JWT_SECRET`), asymmetric
+ * ES256/RS256 for hosted Supabase projects (needs `SUPABASE_URL` for JWKS).
+ * Unknown/none algorithms and unconfigured verifiers are rejected.
+ */
+export declare function makeRoutingVerifier(config: ProductConfig): (token: string) => Promise<SupabaseJwtClaims>;
+export declare function supabaseAuthDeps(config: ProductConfig): SupabaseAuthDeps;
+export declare const SupabaseAuthLive: Layer.Layer<AuthService, never, ProductConfigService>;
+//# sourceMappingURL=supabase-auth-live.d.ts.map

package/dist/infrastructure/auth/supabase-auth-live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-auth-live.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/auth/supabase-auth-live.ts"],"names":[],"mappings":"AASA,OAAO,EAAU,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAU,MAAM,QAAQ,CAAC;AACjE,OAAO,EACL,WAAW,EAGZ,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EACnB,MAAM,2CAA2C,CAAC;AAKnD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClE,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GACjC,MAAM,CAOR;AAcD,4EAA4E;AAC5E,wBAAgB,aAAa,CAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAa/C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAgB/C;AA+CD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,gBAAgB,EACtB,gBAAgB,GAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB,oEAoE3E;AAgCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,GACpB,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAmC/C;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CAWxE;AAED,eAAO,MAAM,gBAAgB,uDAuB5B,CAAC"}