@digimuza/saas-core 0.0.2

package/dist/api-keys/service.js

@@ -0,0 +1,210 @@
+import { and, desc, eq, isNull, or, sql } from "drizzle-orm";
+import { apiKeys } from "../db/schema/index.js";
+import { ForbiddenError, InvalidInputError, NotFoundError, UnauthorizedError } from "../errors.js";
+import { unsafeWorkspaceContext } from "../workspaces/context.js";
+import { DEFAULT_KEY_PREFIX, generateApiKey, maskApiKey, parseApiKey, secretMatchesHash, } from "./keys.js";
+const DEFAULT_LAST_USED_THROTTLE_MS = 60_000;
+const MAX_NAME_LENGTH = 120;
+const MAX_SCOPES = 64;
+function toSummary(row, prefix) {
+    return {
+        id: row.id,
+        name: row.name,
+        masked: maskApiKey(prefix, row.keyId),
+        scopes: row.scopes,
+        createdByUserId: row.createdByUserId,
+        createdAt: row.createdAt,
+        lastUsedAt: row.lastUsedAt,
+        expiresAt: row.expiresAt,
+        revokedAt: row.revokedAt,
+    };
+}
+export function createApiKeysService(deps) {
+    const now = deps.now ?? (() => new Date());
+    const throttleMs = deps.lastUsedThrottleMs ?? DEFAULT_LAST_USED_THROTTLE_MS;
+    /**
+     * A key's prefix is not stored — it is a property of the format, not the row.
+     * Reconstructing it for display means remembering which prefix was issued;
+     * the default is assumed unless a caller tracks its own.
+     */
+    const displayPrefix = DEFAULT_KEY_PREFIX;
+    const service = {
+        async create(context, input) {
+            if (input.name.trim().length === 0) {
+                throw new InvalidInputError("An API key name is required.");
+            }
+            if (input.name.length > MAX_NAME_LENGTH) {
+                throw new InvalidInputError(`An API key name may not exceed ${MAX_NAME_LENGTH} characters.`);
+            }
+            const scopes = [...new Set(input.scopes ?? [])];
+            if (scopes.length > MAX_SCOPES) {
+                throw new InvalidInputError(`An API key may not hold more than ${MAX_SCOPES} scopes.`);
+            }
+            if (scopes.some((scope) => scope.trim().length === 0)) {
+                throw new InvalidInputError("Scopes may not be blank.");
+            }
+            if (input.expiresAt != null && input.expiresAt.getTime() <= now().getTime()) {
+                throw new InvalidInputError("An API key cannot be created already expired.");
+            }
+            const generated = generateApiKey(input.prefix);
+            const [row] = await deps.db
+                .insert(apiKeys)
+                .values({
+                workspaceId: context.workspaceId,
+                name: input.name,
+                keyId: generated.keyId,
+                keyHash: generated.keyHash,
+                scopes,
+                createdByUserId: context.userId,
+                expiresAt: input.expiresAt ?? null,
+            })
+                .returning();
+            return {
+                key: toSummary(row, generated.prefix),
+                token: generated.token,
+            };
+        },
+        async list(context, options = {}) {
+            const clauses = [eq(apiKeys.workspaceId, context.workspaceId)];
+            if (options.includeRevoked !== true) {
+                clauses.push(isNull(apiKeys.revokedAt));
+            }
+            const rows = await deps.db
+                .select()
+                .from(apiKeys)
+                .where(and(...clauses))
+                .orderBy(desc(apiKeys.createdAt), desc(apiKeys.id));
+            return rows.map((row) => toSummary(row, displayPrefix));
+        },
+        async tryValidate(token) {
+            const parsed = parseApiKey(token);
+            if (parsed === undefined) {
+                return undefined;
+            }
+            const rows = await deps.db
+                .select()
+                .from(apiKeys)
+                .where(eq(apiKeys.keyId, parsed.keyId))
+                .limit(1);
+            const row = rows[0];
+            if (row === undefined) {
+                return undefined;
+            }
+            // Constant-time, so a near-miss cannot be distinguished by timing.
+            if (!secretMatchesHash(parsed.secret, row.keyHash)) {
+                return undefined;
+            }
+            if (row.revokedAt !== null) {
+                return undefined;
+            }
+            const at = now();
+            if (row.expiresAt !== null && row.expiresAt.getTime() <= at.getTime()) {
+                return undefined;
+            }
+            /**
+             * Recorded after the key is known good, and only when the stored value is
+             * stale — otherwise every request would write.
+             */
+            if (row.lastUsedAt === null || at.getTime() - row.lastUsedAt.getTime() >= throttleMs) {
+                await deps.db
+                    .update(apiKeys)
+                    .set({ lastUsedAt: at })
+                    .where(and(eq(apiKeys.id, row.id), 
+                /**
+                 * Only if still stale. Two concurrent requests would otherwise both
+                 * write, and the second one gains nothing.
+                 */
+                or(isNull(apiKeys.lastUsedAt), sql `${apiKeys.lastUsedAt} <= ${new Date(at.getTime() - throttleMs)}`)));
+            }
+            return {
+                apiKeyId: row.id,
+                keyId: row.keyId,
+                workspaceId: row.workspaceId,
+                name: row.name,
+                scopes: row.scopes,
+                createdByUserId: row.createdByUserId,
+            };
+        },
+        async validate(token) {
+            const principal = await service.tryValidate(token);
+            if (principal === undefined) {
+                // One error for every failure mode, so a caller cannot probe.
+                throw new UnauthorizedError("Invalid API key.");
+            }
+            return principal;
+        },
+        async resolveContext(token) {
+            const principal = await service.validate(token);
+            if (deps.workspaces === undefined) {
+                throw new Error("resolveContext requires a workspaces service. Pass one to createApiKeysService.");
+            }
+            if (principal.createdByUserId === null) {
+                // The creator is gone, so there is no membership left to stand on.
+                throw new UnauthorizedError("Invalid API key.");
+            }
+            const context = await deps.workspaces.resolveContext({
+                userId: principal.createdByUserId,
+                workspaceId: principal.workspaceId,
+            });
+            if (context === undefined) {
+                /**
+                 * The creator has left the workspace. A machine credential must not
+                 * outlive the authority it was granted under — re-issue the key under a
+                 * current member instead.
+                 */
+                throw new UnauthorizedError("Invalid API key.");
+            }
+            return { context, principal };
+        },
+        async revoke(context, apiKeyId) {
+            const revoked = await deps.db
+                .update(apiKeys)
+                .set({ revokedAt: now(), updatedAt: now() })
+                .where(and(eq(apiKeys.id, apiKeyId), 
+            // Scoped to the caller's workspace, so another tenant's key id
+            // matches nothing rather than being revocable.
+            eq(apiKeys.workspaceId, context.workspaceId), isNull(apiKeys.revokedAt)))
+                .returning({ id: apiKeys.id });
+            if (revoked.length === 0) {
+                /**
+                 * Either it does not exist, belongs to another workspace, or was already
+                 * revoked. Already-revoked is idempotent, so confirm it rather than
+                 * failing.
+                 */
+                const existing = await deps.db
+                    .select({ id: apiKeys.id })
+                    .from(apiKeys)
+                    .where(and(eq(apiKeys.id, apiKeyId), eq(apiKeys.workspaceId, context.workspaceId)))
+                    .limit(1);
+                if (existing.length === 0) {
+                    throw new NotFoundError("API key not found.");
+                }
+            }
+        },
+        requireScope(principal, scope) {
+            if (!principal.scopes.includes(scope)) {
+                throw new ForbiddenError(`API key is missing the "${scope}" scope.`, {
+                    permission: scope,
+                });
+            }
+        },
+        hasScopes(principal, scopes) {
+            return scopes.every((scope) => principal.scopes.includes(scope));
+        },
+    };
+    return service;
+}
+/**
+ * Build a context from a principal without re-checking membership.
+ *
+ * Internal escape hatch, exported because a machine-to-machine integration may
+ * legitimately have no user behind it at all — in which case there is no
+ * membership to verify and the key itself is the authority. Prefer
+ * `resolveContext`, which does verify.
+ *
+ * @internal
+ */
+export function unsafeContextFromPrincipal(principal) {
+    return unsafeWorkspaceContext(principal.createdByUserId ?? principal.apiKeyId, principal.workspaceId);
+}
+//# sourceMappingURL=service.js.map

package/dist/api-keys/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/api-keys/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGhD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAyB,MAAM,0BAA0B,CAAC;AAEzF,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,WAAW,EACX,iBAAiB,GAClB,MAAM,WAAW,CAAC;AA4GnB,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAC7C,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,SAAS,SAAS,CAAC,GAAW,EAAE,MAAc;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;QACrC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,IAAI,6BAA6B,CAAC;IAE5E;;;;OAIG;IACH,MAAM,aAAa,GAAG,kBAAkB,CAAC;IAEzC,MAAM,OAAO,GAAmB;QAC9B,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK;YACzB,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;gBACxC,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,eAAe,cAAc,CAAC,CAAC;YAC/F,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;gBAC/B,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,UAAU,UAAU,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC5E,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,CAAC,CAAC;YAC/E,CAAC;YAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBACxB,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,CAAC;gBACN,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,MAAM;gBACN,eAAe,EAAE,OAAO,CAAC,MAAM;gBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;aACnC,CAAC;iBACD,SAAS,EAAE,CAAC;YAEf,OAAO;gBACL,GAAG,EAAE,SAAS,CAAC,GAAI,EAAE,SAAS,CAAC,MAAM,CAAC;gBACtC,KAAK,EAAE,SAAS,CAAC,KAAK;aACvB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,EAAE;YAC9B,MAAM,OAAO,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/D,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;iBACvB,MAAM,EAAE;iBACR,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;iBACtB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAEtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;iBACvB,MAAM,EAAE;iBACR,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;iBACtC,KAAK,CAAC,CAAC,CAAC,CAAC;YAEZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,mEAAmE;YACnE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnD,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;gBACtE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED;;;eAGG;YACH,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,UAAU,EAAE,CAAC;gBACrF,MAAM,IAAI,CAAC,EAAE;qBACV,MAAM,CAAC,OAAO,CAAC;qBACf,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;qBACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtB;;;mBAGG;gBACH,EAAE,CACA,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAC1B,GAAG,CAAA,GAAG,OAAO,CAAC,UAAU,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,EAAE,CACrE,CACF,CACF,CAAC;YACN,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,eAAe,EAAE,GAAG,CAAC,eAAe;aACrC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,KAAK;YAClB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,8DAA8D;gBAC9D,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;gBACvC,mEAAmE;gBACnE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;gBACnD,MAAM,EAAE,SAAS,CAAC,eAAe;gBACjC,WAAW,EAAE,SAAS,CAAC,WAAW;aACnC,CAAC,CAAC;YAEH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B;;;;mBAIG;gBACH,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;YAClD,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ;YAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC1B,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC3C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC;YACxB,+DAA+D;YAC/D,+CAA+C;YAC/C,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAC5C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF;iBACA,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB;;;;mBAIG;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;qBAC3B,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;qBAC1B,IAAI,CAAC,OAAO,CAAC;qBACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;qBAClF,KAAK,CAAC,CAAC,CAAC,CAAC;gBAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QAED,YAAY,CAAC,SAAS,EAAE,KAAK;YAC3B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,cAAc,CAAC,2BAA2B,KAAK,UAAU,EAAE;oBACnE,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,SAAS,CAAC,SAAS,EAAE,MAAM;YACzB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAA0B;IACnE,OAAO,sBAAsB,CAAC,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;AACxG,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,5 @@
+import { type AuditService } from "./service.ts";
+export { auditFromEvent, createAuditService, type AuditEntryInput, type AuditRequestContext, type AuditService, type AuditServiceDeps, type ListAuditOptions, } from "./service.ts";
+/** Default service, bound to the configuration-driven database handle. */
+export declare const audit: AuditService;
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AAEtB,0EAA0E;AAC1E,eAAO,MAAM,KAAK,EAAE,YAIlB,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,44 @@
+/**
+ * Public audit surface: `@digimuza/saas-core/audit`. Server-only.
+ *
+ * A durable, immutable record of consequential actions — who did what, to what,
+ * when. Distinct from `@digimuza/saas-core/events`, which is the application's
+ * reactive substrate: audit exists for a human reading it after the fact, during
+ * an incident or a compliance request.
+ *
+ * Two properties the spec demands, and how each is actually delivered:
+ *
+ * **Durable.** `audit.log()` writes synchronously to PostgreSQL. It never routes
+ * through realtime, an in-process handler, or a queue, because an entry that can
+ * be lost in transit is not an audit entry. Pass a transaction to make the record
+ * and the change it describes commit together.
+ *
+ * **Immutable.** There is no update or delete API — and a database trigger rejects
+ * both operations outright, so a migration or a stray `psql` session cannot
+ * quietly rewrite history either. Amending an entry means deliberately dropping
+ * the trigger, which is itself an auditable act.
+ *
+ * ```ts
+ * import { audit } from "@digimuza/saas-core/audit";
+ *
+ * await audit.log({
+ *   action: "member.role.updated",
+ *   actorId: user.id,
+ *   workspaceId: context.workspaceId,
+ *   targetType: "user",
+ *   targetId: member.id,
+ *   metadata: { from: "member", to: "admin" },
+ *   request: { requestId, ipAddress, userAgent },
+ * });
+ * ```
+ */
+import { getDatabase } from "../db/client.js";
+import { createAuditService } from "./service.js";
+export { auditFromEvent, createAuditService, } from "./service.js";
+/** Default service, bound to the configuration-driven database handle. */
+export const audit = createAuditService({
+    get db() {
+        return getDatabase();
+    },
+});
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAqB,MAAM,cAAc,CAAC;AAErE,OAAO,EACL,cAAc,EACd,kBAAkB,GAMnB,MAAM,cAAc,CAAC;AAEtB,0EAA0E;AAC1E,MAAM,CAAC,MAAM,KAAK,GAAiB,kBAAkB,CAAC;IACpD,IAAI,EAAE;QACJ,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;CACF,CAAC,CAAC"}

package/dist/audit/service.d.ts

@@ -0,0 +1,88 @@
+import type { AuditLogEntry } from "../db/schema/index.ts";
+import type { CoreDatabase } from "../db/types.ts";
+import type { SaasEvent } from "../events/registry.ts";
+import type { WorkspaceContext } from "../workspaces/context.ts";
+/** Where the request came from, when a request is what caused the action. */
+export interface AuditRequestContext {
+    /** Correlates the entry with a trace. */
+    readonly requestId?: string;
+    readonly ipAddress?: string;
+    readonly userAgent?: string;
+}
+export interface AuditEntryInput {
+    /** What happened, e.g. `"member.role.updated"`. Past tense, dot-separated. */
+    readonly action: string;
+    /** Who did it. Null or omitted for the system. Resolve from the session. */
+    readonly actorId?: string | null;
+    readonly workspaceId?: string | null;
+    readonly targetType?: string;
+    readonly targetId?: string;
+    readonly metadata?: Record<string, unknown>;
+    readonly request?: AuditRequestContext;
+    /** When it happened, if that differs from now. */
+    readonly occurredAt?: Date;
+}
+export interface ListAuditOptions {
+    readonly actions?: readonly string[];
+    readonly actorId?: string;
+    readonly targetType?: string;
+    readonly targetId?: string;
+    readonly since?: Date;
+    /** Keyset pagination: entries strictly older than this. */
+    readonly before?: Date;
+    readonly limit?: number;
+}
+export interface AuditService {
+    /**
+     * Record an action. Durable the moment it returns.
+     *
+     * Written straight to PostgreSQL — never through realtime, an in-process
+     * handler, or a queue. An audit entry that can be lost in transit is not an
+     * audit entry.
+     */
+    log(input: AuditEntryInput, tx?: CoreDatabase): Promise<AuditLogEntry>;
+    /** Record several actions in one statement. */
+    logMany(inputs: readonly AuditEntryInput[], tx?: CoreDatabase): Promise<AuditLogEntry[]>;
+    /** A workspace's trail, newest first. Requires verified membership. */
+    list(context: WorkspaceContext, options?: ListAuditOptions): Promise<AuditLogEntry[]>;
+    /**
+     * Entries with no workspace — account-level actions, and anything belonging to
+     * a workspace that has since been deleted.
+     *
+     * Not tenant-scoped, so it must be gated on an operator-level permission of
+     * your own. The core cannot know who is allowed to read it.
+     */
+    listPlatform(options?: ListAuditOptions): Promise<AuditLogEntry[]>;
+}
+export interface AuditServiceDeps {
+    readonly db: CoreDatabase;
+    readonly now?: () => Date;
+}
+export declare function createAuditService(deps: AuditServiceDeps): AuditService;
+/**
+ * Translate an application event into an audit entry.
+ *
+ * Events and audit overlap but are not the same thing: events are the reactive
+ * substrate, audit is the human-readable trail. Recording every event would bury
+ * the consequential actions among the routine ones, so the mapping is explicit
+ * about what is worth keeping.
+ *
+ * ```ts
+ * events.onAny(async (event) => {
+ *   const entry = auditFromEvent(event, {
+ *     "workspace.member.removed": (e) => ({
+ *       action: "member.removed",
+ *       targetType: "user",
+ *       targetId: e.data.userId,
+ *     }),
+ *   });
+ *   if (entry !== undefined) await audit.log(entry);
+ * });
+ * ```
+ *
+ * Note the shape: audit is written from a *handler*, but a handler is not durable.
+ * For anything that must never be missed, call `audit.log` in the same transaction
+ * as the change — see `docs/audit.md`.
+ */
+export declare function auditFromEvent(event: SaasEvent, mapping: Record<string, (event: never) => Omit<AuditEntryInput, "actorId" | "workspaceId">>): AuditEntryInput | undefined;
+//# sourceMappingURL=service.d.ts.map

package/dist/audit/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,kDAAkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvE,+CAA+C;IAC/C,OAAO,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEzF,uEAAuE;IACvE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEtF;;;;;;OAMG;IACH,YAAY,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AA6BD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,YAAY,CA4EvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,aAAa,CAAC,CAAC,GAC1F,eAAe,GAAG,SAAS,CAY7B"}

package/dist/audit/service.js

@@ -0,0 +1,128 @@
+import { and, desc, eq, gte, inArray, lt } from "drizzle-orm";
+import { auditLogs } from "../db/schema/index.js";
+import { InvalidInputError } from "../errors.js";
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 500;
+/** Bounded so one oversized blob cannot make a page of the trail unreadable. */
+const MAX_ACTION_LENGTH = 120;
+function toRow(input, now) {
+    if (input.action.trim().length === 0) {
+        throw new InvalidInputError("An audit action is required.");
+    }
+    if (input.action.length > MAX_ACTION_LENGTH) {
+        throw new InvalidInputError(`An audit action may not exceed ${MAX_ACTION_LENGTH} characters.`);
+    }
+    return {
+        action: input.action,
+        actorUserId: input.actorId ?? null,
+        workspaceId: input.workspaceId ?? null,
+        targetType: input.targetType ?? null,
+        targetId: input.targetId ?? null,
+        metadata: (input.metadata ?? null),
+        requestId: input.request?.requestId ?? null,
+        ipAddress: input.request?.ipAddress ?? null,
+        userAgent: input.request?.userAgent ?? null,
+        createdAt: input.occurredAt ?? now(),
+    };
+}
+export function createAuditService(deps) {
+    const now = deps.now ?? (() => new Date());
+    function filters(options) {
+        const clauses = [];
+        if (options.actions !== undefined && options.actions.length > 0) {
+            clauses.push(inArray(auditLogs.action, [...options.actions]));
+        }
+        if (options.actorId !== undefined) {
+            clauses.push(eq(auditLogs.actorUserId, options.actorId));
+        }
+        if (options.targetType !== undefined) {
+            clauses.push(eq(auditLogs.targetType, options.targetType));
+        }
+        if (options.targetId !== undefined) {
+            clauses.push(eq(auditLogs.targetId, options.targetId));
+        }
+        if (options.since !== undefined) {
+            clauses.push(gte(auditLogs.createdAt, options.since));
+        }
+        if (options.before !== undefined) {
+            clauses.push(lt(auditLogs.createdAt, options.before));
+        }
+        return clauses;
+    }
+    return {
+        async log(input, tx) {
+            const [entry] = await (tx ?? deps.db)
+                .insert(auditLogs)
+                .values(toRow(input, now))
+                .returning();
+            return entry;
+        },
+        async logMany(inputs, tx) {
+            if (inputs.length === 0) {
+                return [];
+            }
+            return (tx ?? deps.db)
+                .insert(auditLogs)
+                .values(inputs.map((input) => toRow(input, now)))
+                .returning();
+        },
+        async list(context, options = {}) {
+            return deps.db
+                .select()
+                .from(auditLogs)
+                .where(and(
+            // Always scoped to the verified workspace; a trail is tenant data.
+            eq(auditLogs.workspaceId, context.workspaceId), ...filters(options)))
+                // Tie-broken on id so keyset pagination cannot loop on equal timestamps.
+                .orderBy(desc(auditLogs.createdAt), desc(auditLogs.id))
+                .limit(Math.min(options.limit ?? DEFAULT_LIMIT, MAX_LIMIT));
+        },
+        async listPlatform(options = {}) {
+            const clauses = filters(options);
+            return deps.db
+                .select()
+                .from(auditLogs)
+                .where(clauses.length > 0 ? and(...clauses) : undefined)
+                .orderBy(desc(auditLogs.createdAt), desc(auditLogs.id))
+                .limit(Math.min(options.limit ?? DEFAULT_LIMIT, MAX_LIMIT));
+        },
+    };
+}
+/**
+ * Translate an application event into an audit entry.
+ *
+ * Events and audit overlap but are not the same thing: events are the reactive
+ * substrate, audit is the human-readable trail. Recording every event would bury
+ * the consequential actions among the routine ones, so the mapping is explicit
+ * about what is worth keeping.
+ *
+ * ```ts
+ * events.onAny(async (event) => {
+ *   const entry = auditFromEvent(event, {
+ *     "workspace.member.removed": (e) => ({
+ *       action: "member.removed",
+ *       targetType: "user",
+ *       targetId: e.data.userId,
+ *     }),
+ *   });
+ *   if (entry !== undefined) await audit.log(entry);
+ * });
+ * ```
+ *
+ * Note the shape: audit is written from a *handler*, but a handler is not durable.
+ * For anything that must never be missed, call `audit.log` in the same transaction
+ * as the change — see `docs/audit.md`.
+ */
+export function auditFromEvent(event, mapping) {
+    const map = mapping[event.type];
+    if (map === undefined) {
+        return undefined;
+    }
+    return {
+        ...map(event),
+        actorId: event.actorId,
+        workspaceId: event.workspaceId,
+        occurredAt: event.occurredAt,
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/audit/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAoEjD,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,SAAS,KAAK,CAAC,KAAsB,EAAE,GAAe;IACpD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC5C,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,iBAAiB,cAAc,CAAC,CAAC;IACjG,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAU;QAC3C,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI;QAC3C,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI;QAC3C,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI;QAC3C,SAAS,EAAE,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE3C,SAAS,OAAO,CAAC,OAAyB;QACxC,MAAM,OAAO,GAAG,EAAE,CAAC;QAEnB,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE;YACjB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;iBAClC,MAAM,CAAC,SAAS,CAAC;iBACjB,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;iBACzB,SAAS,EAAE,CAAC;YAEf,OAAO,KAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE;YACtB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;iBACnB,MAAM,CAAC,SAAS,CAAC;iBACjB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;iBAChD,SAAS,EAAE,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,EAAE;YAC9B,OAAO,IAAI,CAAC,EAAE;iBACX,MAAM,EAAE;iBACR,IAAI,CAAC,SAAS,CAAC;iBACf,KAAK,CACJ,GAAG;YACD,mEAAmE;YACnE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAC9C,GAAG,OAAO,CAAC,OAAO,CAAC,CACpB,CACF;gBACD,yEAAyE;iBACxE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;iBACtD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAEjC,OAAO,IAAI,CAAC,EAAE;iBACX,MAAM,EAAE;iBACR,IAAI,CAAC,SAAS,CAAC;iBACf,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;iBACvD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;iBACtD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAgB,EAChB,OAA2F;IAE3F,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,GAAG,GAAG,CAAC,KAAc,CAAC;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC"}

package/dist/auth/client.d.ts

@@ -0,0 +1,5 @@
+import { WorkOS } from "@workos-inc/node";
+export declare function getWorkos(): WorkOS;
+/** Drop the cached client. Test-only. */
+export declare function resetWorkos(): void;
+//# sourceMappingURL=client.d.ts.map

package/dist/auth/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAiB1C,wBAAgB,SAAS,IAAI,MAAM,CAYlC;AAED,yCAAyC;AACzC,wBAAgB,WAAW,IAAI,IAAI,CAElC"}

package/dist/auth/client.js

@@ -0,0 +1,26 @@
+import { WorkOS } from "@workos-inc/node";
+import { config } from "../config/index.js";
+/**
+ * Process-wide WorkOS client.
+ *
+ * Cached on `globalThis` for the same reason as the database handle: Next.js
+ * dev-mode hot reloading re-evaluates modules on every edit, and each new client
+ * would open its own JWKS cache and connection pool.
+ */
+const CLIENT_KEY = Symbol.for("@digimuza/saas-core.workos");
+export function getWorkos() {
+    const carrier = globalThis;
+    const existing = carrier[CLIENT_KEY];
+    if (existing !== undefined) {
+        return existing;
+    }
+    const { workosApiKey, workosClientId } = config.auth;
+    const client = new WorkOS(workosApiKey, { clientId: workosClientId });
+    carrier[CLIENT_KEY] = client;
+    return client;
+}
+/** Drop the cached client. Test-only. */
+export function resetWorkos() {
+    delete globalThis[CLIENT_KEY];
+}
+//# sourceMappingURL=client.js.map

package/dist/auth/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAM5D,MAAM,UAAU,SAAS;IACvB,MAAM,OAAO,GAAG,UAA2B,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IAEtE,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,WAAW;IACzB,OAAQ,UAA4B,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC"}

package/dist/auth/cookies.d.ts

@@ -0,0 +1,51 @@
+import type { CookieStore } from "./types.ts";
+/**
+ * The shape of the Next.js App Router cookie jar, described structurally.
+ *
+ * The core does not import `next/headers`. Next has no `exports` map, so that
+ * specifier only resolves through a bundler — importing it would make this
+ * package unloadable in plain Node, where migration scripts, Trigger.dev tasks
+ * and tests run. Describing the jar structurally keeps Next an application
+ * concern and leaves the transport replaceable.
+ */
+export interface RequestCookieJar {
+    get(name: string): {
+        value: string;
+    } | undefined;
+    set(name: string, value: string, options: NextCookieAttributes): unknown;
+    delete(name: string): unknown;
+}
+export interface NextCookieAttributes {
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: "lax" | "strict" | "none";
+    path?: string;
+    maxAge?: number;
+}
+/**
+ * Adapt a Next.js-style cookie jar to a {@link CookieStore}.
+ *
+ * Pass the accessor itself, not the jar: Next resolves `cookies()` per request,
+ * so calling it once at module scope would bind every request to the first one.
+ *
+ * ```ts
+ * // lib/auth.ts
+ * import { cookies } from "next/headers";
+ * import { createConfiguredAuthService, createCookieStore } from "@digimuza/saas-core/auth";
+ *
+ * export const auth = createConfiguredAuthService(createCookieStore(cookies));
+ * ```
+ *
+ * Writes only succeed in Server Actions, Route Handlers and middleware. Next
+ * throws on cookie writes from Server Components; session refresh tolerates
+ * that, but sign-in and sign-out must run somewhere writable.
+ */
+export declare function createCookieStore(getJar: () => RequestCookieJar | Promise<RequestCookieJar>): CookieStore;
+/**
+ * An in-memory cookie store. Useful for tests and for non-HTTP runtimes that
+ * still need to hold a session for the duration of a call.
+ */
+export declare function createMemoryCookieStore(initial?: Record<string, string>): CookieStore & {
+    readonly entries: Map<string, string>;
+};
+//# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAwB,MAAM,YAAY,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACjD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GACzD,WAAW,CAuBb;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,WAAW,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAazD"}