@essentialai/cogent-server 3.4.2 → 3.4.3

package/dist/services/join-rate-limiter.js

@@ -0,0 +1,89 @@
+import { BridgeError, ErrorCode } from "@essentialai/cogent";
+/**
+ * In-memory, two-tier rate limiter for session-join attempts.
+ *
+ * Tier 1 (per source+channel, `${ip}::${sessionId}`): a low threshold for good
+ * UX — a single brute-forcing client trips it quickly.
+ *
+ * Tier 2 (per channel, `channel::${sessionId}`): a higher threshold that is the
+ * SECURITY backstop. The channel id comes from the URL path and cannot be
+ * spoofed, so it holds even when an attacker rotates `X-Forwarded-For` /
+ * `X-Real-IP` to evade tier 1. `check()` blocks if EITHER tier is locked.
+ *
+ * Single-node MVP: state is process-local. Multi-node (vNext) moves this to a
+ * shared store (Postgres / Redis), at which point tier 1 can key on the
+ * trusted-proxy-validated real client IP. The clock is injectable for tests.
+ *
+ * Tradeoff (accepted): tier 2 means an attacker who knows a sessionId can lock
+ * NEW joins on that channel for `lockoutMs` with `channelMaxFailures` bad
+ * attempts. Already-joined agents keep their bearer tokens (join issues, does
+ * not gate, existing sessions). The higher tier-2 threshold keeps this from
+ * tripping on the rare legitimate failure; per-org quotas (E5) bound it further.
+ */
+export class JoinRateLimiter {
+    perSourceMax;
+    channelMax;
+    windowMs;
+    lockoutMs;
+    now;
+    attempts = new Map();
+    constructor(perSourceMax, channelMax, windowMs, lockoutMs, now = () => Date.now()) {
+        this.perSourceMax = perSourceMax;
+        this.channelMax = channelMax;
+        this.windowMs = windowMs;
+        this.lockoutMs = lockoutMs;
+        this.now = now;
+    }
+    /** Tier-1 key: source IP + channel (best-effort; IP may be spoofable). */
+    static sourceKey(ip, sessionId) {
+        return `${ip}::${sessionId}`;
+    }
+    /** Tier-2 key: channel only (non-spoofable; the security backstop). */
+    static channelKey(sessionId) {
+        return `channel::${sessionId}`;
+    }
+    /**
+     * Throw RATE_LIMITED if EITHER the source tier or the channel tier is locked.
+     * Call BEFORE verifying credentials.
+     */
+    check(sourceKey, channelKey) {
+        const t = this.now();
+        const locked = (key) => {
+            const rec = this.attempts.get(key);
+            return rec && rec.lockedUntil > t ? rec.lockedUntil : 0;
+        };
+        const until = Math.max(locked(sourceKey), locked(channelKey));
+        if (until > 0) {
+            const retryAfterSec = Math.ceil((until - t) / 1000);
+            throw new BridgeError(ErrorCode.RATE_LIMITED, "Too many failed attempts", `Wait ${retryAfterSec}s before trying again`);
+        }
+    }
+    /** Record a failed attempt against both tiers. */
+    recordFailure(sourceKey, channelKey) {
+        this._fail(sourceKey, this.perSourceMax);
+        this._fail(channelKey, this.channelMax);
+    }
+    /**
+     * Clear the SOURCE tier after a successful join. The channel tier is left to
+     * decay with its window — a single success must not reset a channel-wide
+     * brute-force counter.
+     */
+    recordSuccess(sourceKey) {
+        this.attempts.delete(sourceKey);
+    }
+    /** Increment a key's failure count within its window; lock past `threshold`. */
+    _fail(key, threshold) {
+        const t = this.now();
+        let rec = this.attempts.get(key);
+        // Start a fresh window if none exists or the window has elapsed.
+        if (!rec || t - rec.windowStart > this.windowMs) {
+            rec = { failures: 0, windowStart: t, lockedUntil: 0 };
+        }
+        rec.failures += 1;
+        if (rec.failures >= threshold) {
+            rec.lockedUntil = t + this.lockoutMs;
+        }
+        this.attempts.set(key, rec);
+    }
+}
+//# sourceMappingURL=join-rate-limiter.js.map

package/dist/services/join-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-rate-limiter.js","sourceRoot":"","sources":["../../src/services/join-rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAY7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,eAAe;IACT,YAAY,CAAS;IACrB,UAAU,CAAS;IACnB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAClB,GAAG,CAAe;IAClB,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE7D,YACE,YAAoB,EACpB,UAAkB,EAClB,QAAgB,EAChB,SAAiB,EACjB,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAEpC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,0EAA0E;IAC1E,MAAM,CAAC,SAAS,CAAC,EAAU,EAAE,SAAiB;QAC5C,OAAO,GAAG,EAAE,KAAK,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,UAAU,CAAC,SAAiB;QACjC,OAAO,YAAY,SAAS,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAiB,EAAE,UAAkB;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACpD,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,YAAY,EACtB,0BAA0B,EAC1B,QAAQ,aAAa,uBAAuB,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,aAAa,CAAC,SAAiB,EAAE,UAAkB;QACjD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,SAAiB;QAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,GAAW,EAAE,SAAiB;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjC,iEAAiE;QACjE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChD,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACxD,CAAC;QAED,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;CACF"}

package/dist/services/obs-log.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Per-org structured observability (Story 2.7).
+ *
+ * Emits one JSON line per event to stderr — the project's logging convention
+ * (console.error + JSON.stringify, as in middleware/request-logger.ts; vault:
+ * Error_Reporting.md §"Runtime Error Reporting" — runtime issues are surfaced
+ * via console output / logging mechanisms).
+ *
+ * Every event carries `org_id`: the session's **org_scope** (SHA-256 of the
+ * Org_ID) — a stable, non-reversible org tag, NOT the Org_ID itself. The scope
+ * is already stored in plaintext (sessions.org_scope) and a SHA-256 of a
+ * high-entropy Org_ID is not brute-forceable, so it is safe to log. Free/public
+ * channels have no org → `org_id: null`.
+ *
+ * SECURITY NOTE: org_scope is an UNSALTED SHA-256. It is safe to log only
+ * because the Org_ID is required to be high-entropy (the join credential is "a
+ * long Org_ID that is hard to brute-force"); a low-entropy/human-chosen Org_ID
+ * would let a logged scope confirm a guess offline. Enforce Org_ID entropy at
+ * the control plane (E3).
+ *
+ * Secrets NEVER reach the log: `redact()` strips any field whose key looks
+ * sensitive (secret/password/token/orgId/hash/authorization/bearer/credential),
+ * so a careless caller cannot leak credentials through the `detail` payload.
+ * This makes "no secret values in logs" structural, not by-convention.
+ */
+export type OrgEventName = "quota_check" | "auth_failure" | "message_relay";
+export interface OrgEvent {
+    event: OrgEventName;
+    /** org_scope (SHA-256). null/undefined → free/public channel (no org). */
+    orgScope?: string | null;
+    sessionId?: string;
+    /** e.g. "admitted" | "rejected" | "invalid_credentials" | "relayed". */
+    outcome?: string;
+    /** Extra non-secret context; sensitive keys are redacted defensively. */
+    detail?: Record<string, unknown>;
+}
+/**
+ * Return a copy of `obj` with sensitive values replaced by "[REDACTED]".
+ * Recurses into nested plain objects AND arrays; exotic objects (Error/Map/etc.)
+ * are collapsed to a safe tag — so "no secrets in logs" holds even if a future
+ * caller passes structured detail.
+ */
+export declare function redact(obj: Record<string, unknown>): Record<string, unknown>;
+/** Test seam: swap the output sink. Pass no arg to restore the default. */
+export declare function _setObsSink(fn?: (line: string) => void): void;
+/**
+ * Emit one structured org-tagged event. `org_id` is always present (null for
+ * free channels). The `detail` payload is redacted before serialization.
+ */
+export declare function logOrgEvent(e: OrgEvent): void;
+//# sourceMappingURL=obs-log.d.ts.map

package/dist/services/obs-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"obs-log.d.ts","sourceRoot":"","sources":["../../src/services/obs-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,cAAc,GAAG,eAAe,CAAC;AAE5E,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAkBD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAM5E;AAKD,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAE7D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAsB7C"}

package/dist/services/obs-log.js

@@ -0,0 +1,93 @@
+/**
+ * Per-org structured observability (Story 2.7).
+ *
+ * Emits one JSON line per event to stderr — the project's logging convention
+ * (console.error + JSON.stringify, as in middleware/request-logger.ts; vault:
+ * Error_Reporting.md §"Runtime Error Reporting" — runtime issues are surfaced
+ * via console output / logging mechanisms).
+ *
+ * Every event carries `org_id`: the session's **org_scope** (SHA-256 of the
+ * Org_ID) — a stable, non-reversible org tag, NOT the Org_ID itself. The scope
+ * is already stored in plaintext (sessions.org_scope) and a SHA-256 of a
+ * high-entropy Org_ID is not brute-forceable, so it is safe to log. Free/public
+ * channels have no org → `org_id: null`.
+ *
+ * SECURITY NOTE: org_scope is an UNSALTED SHA-256. It is safe to log only
+ * because the Org_ID is required to be high-entropy (the join credential is "a
+ * long Org_ID that is hard to brute-force"); a low-entropy/human-chosen Org_ID
+ * would let a logged scope confirm a guess offline. Enforce Org_ID entropy at
+ * the control plane (E3).
+ *
+ * Secrets NEVER reach the log: `redact()` strips any field whose key looks
+ * sensitive (secret/password/token/orgId/hash/authorization/bearer/credential),
+ * so a careless caller cannot leak credentials through the `detail` payload.
+ * This makes "no secret values in logs" structural, not by-convention.
+ */
+/** Keys whose VALUES must never be logged (substring, case-insensitive). */
+const SENSITIVE = /(secret|password|passwd|token|org[_-]?id|authorization|bearer|hash|credential)/i;
+/** Recursively neutralize a value so no secret can hide inside it. */
+function redactValue(v) {
+    if (v === null || typeof v !== "object")
+        return v; // scalars pass through
+    if (Array.isArray(v))
+        return v.map(redactValue); // scan array elements too
+    const proto = Object.getPrototypeOf(v);
+    // Exotic objects (Error, Map, Set, Date, class instances) can carry data in
+    // non-enumerable or non-string-keyed fields that key-scanning can't see —
+    // collapse them to a safe tag rather than risk a leak.
+    if (proto !== Object.prototype && proto !== null)
+        return "[REDACTED:object]";
+    return redact(v);
+}
+/**
+ * Return a copy of `obj` with sensitive values replaced by "[REDACTED]".
+ * Recurses into nested plain objects AND arrays; exotic objects (Error/Map/etc.)
+ * are collapsed to a safe tag — so "no secrets in logs" holds even if a future
+ * caller passes structured detail.
+ */
+export function redact(obj) {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        out[k] = SENSITIVE.test(k) ? "[REDACTED]" : redactValue(v);
+    }
+    return out;
+}
+/** Output sink — overridable for tests via {@link _setObsSink}. */
+let sink = (line) => console.error(line);
+/** Test seam: swap the output sink. Pass no arg to restore the default. */
+export function _setObsSink(fn) {
+    sink = fn ?? ((line) => console.error(line));
+}
+/**
+ * Emit one structured org-tagged event. `org_id` is always present (null for
+ * free channels). The `detail` payload is redacted before serialization.
+ */
+export function logOrgEvent(e) {
+    // Observability must NEVER break a request: a bad value in detail (BigInt,
+    // circular ref) would otherwise throw from JSON.stringify into a hot path or
+    // a committed relay. Swallow any serialization/sink error.
+    try {
+        const entry = {
+            timestamp: new Date().toISOString(),
+            level: e.event === "auth_failure" ? "warn" : "info",
+            message: e.event,
+            org_id: e.orgScope ?? null,
+        };
+        if (e.sessionId !== undefined)
+            entry.sessionId = e.sessionId;
+        if (e.outcome !== undefined)
+            entry.outcome = e.outcome;
+        if (e.detail)
+            entry.detail = redact(e.detail);
+        sink(JSON.stringify(entry));
+    }
+    catch {
+        try {
+            sink(JSON.stringify({ level: "error", message: "obs_log_failure", event: e?.event ?? null }));
+        }
+        catch {
+            /* give up — never propagate a logging error */
+        }
+    }
+}
+//# sourceMappingURL=obs-log.js.map

package/dist/services/obs-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obs-log.js","sourceRoot":"","sources":["../../src/services/obs-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAeH,4EAA4E;AAC5E,MAAM,SAAS,GACb,iFAAiF,CAAC;AAEpF,sEAAsE;AACtE,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,CAAC,uBAAuB;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,0BAA0B;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACvC,4EAA4E;IAC5E,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,mBAAmB,CAAC;IAC7E,OAAO,MAAM,CAAC,CAA4B,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,GAA4B;IACjD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,IAAI,IAAI,GAA2B,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAEjE,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,EAA2B;IACrD,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,CAAW;IACrC,2EAA2E;IAC3E,6EAA6E;IAC7E,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAA4B;YACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACnD,OAAO,EAAE,CAAC,CAAC,KAAK;YAChB,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;SAC3B,CAAC;QACF,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QACvD,IAAI,CAAC,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/services/session-store-memory.d.ts

@@ -0,0 +1,60 @@
+import type { TokenEntry, SessionFileState } from "../types.js";
+import type { SessionStore, SessionOrg } from "./session-store.js";
+/**
+ * Dependency-free, in-memory implementation of {@link SessionStore}.
+ *
+ * Backs sessions with a `Map` instead of the filesystem, but preserves the
+ * file store's observable semantics exactly: a per-session promise-chain mutex,
+ * label uniqueness, message cap, token/label indexes, and the same BridgeError
+ * throw-contract. Used for fast, isolated tests and as the pre-Postgres business
+ * substrate that `PostgresSessionStore` (Story 2.4b) parallels.
+ *
+ * Stored state is deep-cloned on every read and write (via `structuredClone`)
+ * so callers cannot mutate the store by reference — matching the file store,
+ * which re-reads fresh objects from disk on each access.
+ */
+export declare class InMemorySessionStore implements SessionStore {
+    private readonly maxMessagesPerSession;
+    private readonly sessions;
+    private readonly locks;
+    private readonly tokenIndex;
+    private readonly labelIndex;
+    private globalMessageCount;
+    constructor(maxMessagesPerSession: number);
+    /** No persisted state to rebuild. */
+    init(): Promise<void>;
+    createSession(sessionId: string, label: string | undefined, secretHash: string, tokenEntry: TokenEntry, creatorIp?: string, org?: SessionOrg): Promise<SessionFileState>;
+    getSession(sessionId: string): Promise<SessionFileState | null>;
+    getSessionByTokenHash(tokenHash: string): Promise<{
+        sessionId: string;
+        state: SessionFileState;
+    } | null>;
+    updateSession(sessionId: string, updater: (state: SessionFileState) => SessionFileState): Promise<SessionFileState>;
+    addToken(sessionId: string, tokenEntry: TokenEntry): Promise<void>;
+    deleteSession(sessionId: string): Promise<void>;
+    listSessions(): Promise<string[]>;
+    countAgentsByOrgScope(orgScope: string): Promise<number>;
+    /** In-memory org quotas (Story 5.1). Held so the store faithfully implements the
+     *  interface; this store does not enforce caps (enforcement is PostgresSessionStore). */
+    private readonly orgQuotas;
+    setOrgQuota(orgScope: string, tier: string, maxChannels: number, maxAgents: number): Promise<void>;
+    /** Read back an org's in-memory quota (test/introspection; not on the interface). */
+    getOrgQuota(orgScope: string): {
+        tier: string;
+        maxChannels: number;
+        maxAgents: number;
+    } | undefined;
+    getTokenIndex(): ReadonlyMap<string, string>;
+    getSessionIdByLabel(label: string, orgScope?: string): string | null;
+    isLabelTaken(label: string, orgScope?: string): boolean;
+    getGlobalMessageCount(): Promise<number>;
+    incrementGlobalMessageCount(): Promise<void>;
+    /**
+     * Per-session promise-chain mutex. Serializes all operations on a given
+     * session to prevent lost updates from concurrent requests.
+     */
+    private _withLock;
+    private _rebuildTokenIndex;
+    private _rebuildLabelIndex;
+}
+//# sourceMappingURL=session-store-memory.d.ts.map

package/dist/services/session-store-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store-memory.d.ts","sourceRoot":"","sources":["../../src/services/session-store-memory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGnE;;;;;;;;;;;;GAYG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAE/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuC;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,kBAAkB,CAAK;gBAEnB,qBAAqB,EAAE,MAAM;IAIzC,qCAAqC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,UAAU,EACtB,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,UAAU,GACf,OAAO,CAAC,gBAAgB,CAAC;IAsCtB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAK/D,qBAAqB,CACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE,GAAG,IAAI,CAAC;IAa3D,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,gBAAgB,GACrD,OAAO,CAAC,gBAAgB,CAAC;IAsBtB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAelE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB/C,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIjC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU9D;6FACyF;IACzF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+E;IAEnG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxG,qFAAqF;IACrF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAInG,aAAa,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAI5C,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIpE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAIjD,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxC,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAQlD;;;OAGG;YACW,SAAS;IAwBvB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,kBAAkB;CAO3B"}

package/dist/services/session-store-memory.js

@@ -0,0 +1,189 @@
+import { BridgeError, ErrorCode } from "@essentialai/cogent";
+import { labelIndexKey } from "./session-store.js";
+/**
+ * Dependency-free, in-memory implementation of {@link SessionStore}.
+ *
+ * Backs sessions with a `Map` instead of the filesystem, but preserves the
+ * file store's observable semantics exactly: a per-session promise-chain mutex,
+ * label uniqueness, message cap, token/label indexes, and the same BridgeError
+ * throw-contract. Used for fast, isolated tests and as the pre-Postgres business
+ * substrate that `PostgresSessionStore` (Story 2.4b) parallels.
+ *
+ * Stored state is deep-cloned on every read and write (via `structuredClone`)
+ * so callers cannot mutate the store by reference — matching the file store,
+ * which re-reads fresh objects from disk on each access.
+ */
+export class InMemorySessionStore {
+    maxMessagesPerSession;
+    sessions = new Map();
+    locks = new Map();
+    tokenIndex = new Map();
+    labelIndex = new Map();
+    globalMessageCount = 0;
+    constructor(maxMessagesPerSession) {
+        this.maxMessagesPerSession = maxMessagesPerSession;
+    }
+    /** No persisted state to rebuild. */
+    async init() {
+        // no-op
+    }
+    async createSession(sessionId, label, secretHash, tokenEntry, creatorIp, org) {
+        return this._withLock(sessionId, async () => {
+            if (this.sessions.has(sessionId)) {
+                throw new BridgeError(ErrorCode.INVALID_INPUT, `Session ${sessionId} already exists`, "Use a different session ID or join the existing session");
+            }
+            if (label !== undefined && this.isLabelTaken(label, org?.scope)) {
+                throw new BridgeError(ErrorCode.INVALID_INPUT, `Label "${label}" already in use`, "Choose a different label");
+            }
+            const state = {
+                sessionId,
+                ...(label !== undefined ? { label } : {}),
+                secretHash,
+                ...(org !== undefined ? { orgIdHash: org.idHash, orgScope: org.scope } : {}),
+                tokens: [tokenEntry],
+                createdAt: new Date().toISOString(),
+                ...(creatorIp ? { creatorIp } : {}),
+                peers: {},
+                messages: [],
+                peerEvents: [],
+            };
+            this.sessions.set(sessionId, structuredClone(state));
+            this._rebuildTokenIndex(state);
+            this._rebuildLabelIndex(state);
+            return structuredClone(state);
+        });
+    }
+    async getSession(sessionId) {
+        const state = this.sessions.get(sessionId);
+        return state ? structuredClone(state) : null;
+    }
+    async getSessionByTokenHash(tokenHash) {
+        const sessionId = this.tokenIndex.get(tokenHash);
+        if (!sessionId)
+            return null;
+        const state = await this.getSession(sessionId);
+        if (!state) {
+            this.tokenIndex.delete(tokenHash);
+            return null;
+        }
+        return { sessionId, state };
+    }
+    async updateSession(sessionId, updater) {
+        return this._withLock(sessionId, async () => {
+            const current = this.sessions.get(sessionId);
+            if (!current) {
+                throw new BridgeError(ErrorCode.SESSION_NOT_FOUND, `Session ${sessionId} not found`, "Check the session ID or create a new session");
+            }
+            const updated = updater(structuredClone(current));
+            if (updated.messages.length > this.maxMessagesPerSession) {
+                updated.messages = updated.messages.slice(-this.maxMessagesPerSession);
+            }
+            this.sessions.set(sessionId, structuredClone(updated));
+            return structuredClone(updated);
+        });
+    }
+    async addToken(sessionId, tokenEntry) {
+        await this._withLock(sessionId, async () => {
+            const current = this.sessions.get(sessionId);
+            if (!current) {
+                throw new BridgeError(ErrorCode.SESSION_NOT_FOUND, `Session ${sessionId} not found`, "Check the session ID or create a new session");
+            }
+            current.tokens.push(structuredClone(tokenEntry));
+            this.tokenIndex.set(tokenEntry.tokenHash, sessionId);
+        });
+    }
+    async deleteSession(sessionId) {
+        await this._withLock(sessionId, async () => {
+            const state = this.sessions.get(sessionId);
+            if (state) {
+                for (const token of state.tokens) {
+                    this.tokenIndex.delete(token.tokenHash);
+                }
+                if (state.label) {
+                    this.labelIndex.delete(labelIndexKey(state.label, state.orgScope));
+                }
+                this.sessions.delete(sessionId);
+            }
+        });
+        // Lock entry pruned inside _withLock (prune-if-mine), not out-of-band here.
+    }
+    async listSessions() {
+        return [...this.sessions.keys()];
+    }
+    async countAgentsByOrgScope(orgScope) {
+        let total = 0;
+        for (const state of this.sessions.values()) {
+            if (state.orgScope === orgScope) {
+                total += Object.keys(state.peers).length;
+            }
+        }
+        return total;
+    }
+    /** In-memory org quotas (Story 5.1). Held so the store faithfully implements the
+     *  interface; this store does not enforce caps (enforcement is PostgresSessionStore). */
+    orgQuotas = new Map();
+    async setOrgQuota(orgScope, tier, maxChannels, maxAgents) {
+        this.orgQuotas.set(orgScope, { tier, maxChannels, maxAgents });
+    }
+    /** Read back an org's in-memory quota (test/introspection; not on the interface). */
+    getOrgQuota(orgScope) {
+        return this.orgQuotas.get(orgScope);
+    }
+    getTokenIndex() {
+        return this.tokenIndex;
+    }
+    getSessionIdByLabel(label, orgScope) {
+        return this.labelIndex.get(labelIndexKey(label, orgScope)) ?? null;
+    }
+    isLabelTaken(label, orgScope) {
+        return this.labelIndex.has(labelIndexKey(label, orgScope));
+    }
+    async getGlobalMessageCount() {
+        return this.globalMessageCount;
+    }
+    async incrementGlobalMessageCount() {
+        await this._withLock("__global_stats__", async () => {
+            this.globalMessageCount += 1;
+        });
+    }
+    // --- Private methods ---
+    /**
+     * Per-session promise-chain mutex. Serializes all operations on a given
+     * session to prevent lost updates from concurrent requests.
+     */
+    async _withLock(sessionId, fn) {
+        const prev = this.locks.get(sessionId) ?? Promise.resolve();
+        let release;
+        const next = new Promise((resolve) => {
+            release = resolve;
+        });
+        this.locks.set(sessionId, next);
+        await prev;
+        try {
+            return await fn();
+        }
+        finally {
+            release();
+            // Prune only if still ours -- bounds map growth without evicting a queued
+            // waiter (see FileSessionStore._withLock for the rationale).
+            if (this.locks.get(sessionId) === next) {
+                this.locks.delete(sessionId);
+            }
+        }
+    }
+    _rebuildTokenIndex(state) {
+        for (const token of state.tokens) {
+            this.tokenIndex.set(token.tokenHash, state.sessionId);
+        }
+    }
+    _rebuildLabelIndex(state) {
+        if (!state.label)
+            return;
+        // Fail-closed: never index a legacy business session (orgIdHash, no orgScope)
+        // under the public bare key (see FileSessionStore._rebuildLabelIndex).
+        if (state.orgIdHash !== undefined && state.orgScope === undefined)
+            return;
+        this.labelIndex.set(labelIndexKey(state.label, state.orgScope), state.sessionId);
+    }
+}
+//# sourceMappingURL=session-store-memory.js.map

package/dist/services/session-store-memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store-memory.js","sourceRoot":"","sources":["../../src/services/session-store-memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,oBAAoB;IACd,qBAAqB,CAAS;IAE9B,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC/C,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IACzC,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,kBAAkB,GAAG,CAAC,CAAC;IAE/B,YAAY,qBAA6B;QACvC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;IACrD,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,IAAI;QACR,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,KAAyB,EACzB,UAAkB,EAClB,UAAsB,EACtB,SAAkB,EAClB,GAAgB;QAEhB,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,aAAa,EACvB,WAAW,SAAS,iBAAiB,EACrC,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,aAAa,EACvB,UAAU,KAAK,kBAAkB,EACjC,0BAA0B,CAC3B,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAqB;gBAC9B,SAAS;gBACT,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,UAAU;gBACV,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,MAAM,EAAE,CAAC,UAAU,CAAC;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,KAAK,EAAE,EAAE;gBACT,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,EAAE;aACf,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,SAAiB;QAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,OAAsD;QAEtD,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,iBAAiB,EAC3B,WAAW,SAAS,YAAY,EAChC,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;YAElD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACzD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;YACvD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,UAAsB;QACtD,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,iBAAiB,EAC3B,WAAW,SAAS,YAAY,EAChC,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACrE,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,4EAA4E;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;6FACyF;IACxE,SAAS,GAAG,IAAI,GAAG,EAAoE,CAAC;IAEzG,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,IAAY,EAAE,WAAmB,EAAE,SAAiB;QACtF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,qFAAqF;IACrF,WAAW,CAAC,QAAgB;QAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,QAAiB;QAClD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IACrE,CAAC;IAED,YAAY,CAAC,KAAa,EAAE,QAAiB;QAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,2BAA2B;QAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAClD,IAAI,CAAC,kBAAkB,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAE1B;;;OAGG;IACK,KAAK,CAAC,SAAS,CACrB,SAAiB,EACjB,EAAoB;QAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5D,IAAI,OAAmB,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACzC,OAAO,GAAG,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAEhC,MAAM,IAAI,CAAC;QACX,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,OAAQ,EAAE,CAAC;YACX,0EAA0E;YAC1E,6DAA6D;YAC7D,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,KAAuB;QAChD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,KAAuB;QAChD,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO;QACzB,8EAA8E;QAC9E,uEAAuE;QACvE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO;QAC1E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACnF,CAAC;CACF"}

package/dist/services/session-store-postgres.d.ts

@@ -0,0 +1,60 @@
+import type { Pool } from "pg";
+import type { TokenEntry, SessionFileState } from "../types.js";
+import type { SessionStore, SessionOrg } from "./session-store.js";
+/**
+ * Postgres implementation of {@link SessionStore} (Business Edition, FR35),
+ * JSONB-hybrid: queryable/unique/auth scalars are columns; the rest of the
+ * session document lives in a `state jsonb` column — a 1:1 mirror of the file
+ * store's per-session JSON, so `updateSession` is a whole-document UPDATE.
+ *
+ * The synchronous index methods (`getSessionIdByLabel`, `isLabelTaken`,
+ * `getTokenIndex`) are served from in-memory caches rebuilt on `init()` and kept
+ * in sync on writes — exactly as `FileSessionStore` does. This is correct for
+ * the single-node MVP (all writes go through this instance); multi-node (vNext)
+ * will need cache invalidation or a shared lookup. `getSessionByTokenHash`
+ * queries the DB directly so bearer-token auth is always authoritative.
+ *
+ * The pool is injected (DI) and owned by the caller (index.ts closes it).
+ */
+export declare class PostgresSessionStore implements SessionStore {
+    private readonly pool;
+    private readonly maxMessagesPerSession;
+    /** label-scope key -> sessionId (mirrors FileSessionStore.labelIndex). */
+    private readonly labelIndex;
+    /** SHA-256 tokenHash -> sessionId. */
+    private readonly tokenIndex;
+    constructor(pool: Pool, maxMessagesPerSession: number);
+    init(): Promise<void>;
+    createSession(sessionId: string, label: string | undefined, secretHash: string, tokenEntry: TokenEntry, creatorIp?: string, org?: SessionOrg): Promise<SessionFileState>;
+    getSession(sessionId: string): Promise<SessionFileState | null>;
+    getSessionByTokenHash(tokenHash: string): Promise<{
+        sessionId: string;
+        state: SessionFileState;
+    } | null>;
+    updateSession(sessionId: string, updater: (state: SessionFileState) => SessionFileState): Promise<SessionFileState>;
+    addToken(sessionId: string, tokenEntry: TokenEntry): Promise<void>;
+    deleteSession(sessionId: string): Promise<void>;
+    listSessions(): Promise<string[]>;
+    countAgentsByOrgScope(orgScope: string): Promise<number>;
+    setOrgQuota(orgScope: string, tier: string, maxChannels: number, maxAgents: number): Promise<void>;
+    getTokenIndex(): ReadonlyMap<string, string>;
+    getSessionIdByLabel(label: string, orgScope?: string): string | null;
+    isLabelTaken(label: string, orgScope?: string): boolean;
+    getGlobalMessageCount(): Promise<number>;
+    incrementGlobalMessageCount(): Promise<void>;
+    /** Assemble a SessionFileState from a sessions row + its token rows. */
+    private _rowToState;
+    /** Extract the JSONB document (everything not in a scalar column or tokens). */
+    private _docFromState;
+    /**
+     * Map a row-lock contention failure to a clean, retryable BridgeError.
+     * 55P03 = lock_timeout fired (FOR UPDATE could not acquire within 3s);
+     * 40P01 = deadlock_detected. Both bound the critical section so a busy org
+     * can never hang a request indefinitely. Any other error is rethrown as-is
+     * (including the BridgeError SESSION_FULL raised inside the quota block).
+     */
+    private _mapLockError;
+    /** Map a pg INSERT error to the file store's BridgeError contract. */
+    private _mapCreateError;
+}
+//# sourceMappingURL=session-store-postgres.d.ts.map

package/dist/services/session-store-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store-postgres.d.ts","sourceRoot":"","sources":["../../src/services/session-store-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGhE,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAkCnE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAE/C,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,sCAAsC;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;gBAE5C,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM;IAK/C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BrB,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,UAAU,EACtB,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,UAAU,GACf,OAAO,CAAC,gBAAgB,CAAC;IAwGtB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAgB/D,qBAAqB,CACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE,GAAG,IAAI,CAAC;IAa3D,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,gBAAgB,GACrD,OAAO,CAAC,gBAAgB,CAAC;IAqItB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BlE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB/C,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKjC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxG,aAAa,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAI5C,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIpE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAIjD,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAOxC,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAOlD,wEAAwE;IACxE,OAAO,CAAC,WAAW;IAuBnB,gFAAgF;IAChF,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAYrB,sEAAsE;IACtE,OAAO,CAAC,eAAe;CAoBxB"}