@fidelios/server 0.0.1

package/dist/services/approvals.js

@@ -0,0 +1,212 @@
+import { and, asc, eq, inArray } from "drizzle-orm";
+import { approvalComments, approvals } from "@fidelios/db";
+import { notFound, unprocessable } from "../errors.js";
+import { redactCurrentUserText } from "../log-redaction.js";
+import { agentService } from "./agents.js";
+import { budgetService } from "./budgets.js";
+import { notifyHireApproved } from "./hire-hook.js";
+import { instanceSettingsService } from "./instance-settings.js";
+export function approvalService(db) {
+    const agentsSvc = agentService(db);
+    const budgets = budgetService(db);
+    const instanceSettings = instanceSettingsService(db);
+    const canResolveStatuses = new Set(["pending", "revision_requested"]);
+    const resolvableStatuses = Array.from(canResolveStatuses);
+    function redactApprovalComment(comment, censorUsernameInLogs) {
+        return {
+            ...comment,
+            body: redactCurrentUserText(comment.body, { enabled: censorUsernameInLogs }),
+        };
+    }
+    async function getExistingApproval(id) {
+        const existing = await db
+            .select()
+            .from(approvals)
+            .where(eq(approvals.id, id))
+            .then((rows) => rows[0] ?? null);
+        if (!existing)
+            throw notFound("Approval not found");
+        return existing;
+    }
+    async function resolveApproval(id, targetStatus, decidedByUserId, decisionNote) {
+        const existing = await getExistingApproval(id);
+        if (!canResolveStatuses.has(existing.status)) {
+            if (existing.status === targetStatus) {
+                return { approval: existing, applied: false };
+            }
+            throw unprocessable(`Only pending or revision requested approvals can be ${targetStatus === "approved" ? "approved" : "rejected"}`);
+        }
+        const now = new Date();
+        const updated = await db
+            .update(approvals)
+            .set({
+            status: targetStatus,
+            decidedByUserId,
+            decisionNote: decisionNote ?? null,
+            decidedAt: now,
+            updatedAt: now,
+        })
+            .where(and(eq(approvals.id, id), inArray(approvals.status, resolvableStatuses)))
+            .returning()
+            .then((rows) => rows[0] ?? null);
+        if (updated) {
+            return { approval: updated, applied: true };
+        }
+        const latest = await getExistingApproval(id);
+        if (latest.status === targetStatus) {
+            return { approval: latest, applied: false };
+        }
+        throw unprocessable(`Only pending or revision requested approvals can be ${targetStatus === "approved" ? "approved" : "rejected"}`);
+    }
+    return {
+        list: (companyId, status) => {
+            const conditions = [eq(approvals.companyId, companyId)];
+            if (status)
+                conditions.push(eq(approvals.status, status));
+            return db.select().from(approvals).where(and(...conditions));
+        },
+        getById: (id) => db
+            .select()
+            .from(approvals)
+            .where(eq(approvals.id, id))
+            .then((rows) => rows[0] ?? null),
+        create: (companyId, data) => db
+            .insert(approvals)
+            .values({ ...data, companyId })
+            .returning()
+            .then((rows) => rows[0]),
+        approve: async (id, decidedByUserId, decisionNote) => {
+            const { approval: updated, applied } = await resolveApproval(id, "approved", decidedByUserId, decisionNote);
+            let hireApprovedAgentId = null;
+            const now = new Date();
+            if (applied && updated.type === "hire_agent") {
+                const payload = updated.payload;
+                const payloadAgentId = typeof payload.agentId === "string" ? payload.agentId : null;
+                if (payloadAgentId) {
+                    await agentsSvc.activatePendingApproval(payloadAgentId);
+                    hireApprovedAgentId = payloadAgentId;
+                }
+                else {
+                    const created = await agentsSvc.create(updated.companyId, {
+                        name: String(payload.name ?? "New Agent"),
+                        role: String(payload.role ?? "general"),
+                        title: typeof payload.title === "string" ? payload.title : null,
+                        reportsTo: typeof payload.reportsTo === "string" ? payload.reportsTo : null,
+                        capabilities: typeof payload.capabilities === "string" ? payload.capabilities : null,
+                        adapterType: String(payload.adapterType ?? "process"),
+                        adapterConfig: typeof payload.adapterConfig === "object" && payload.adapterConfig !== null
+                            ? payload.adapterConfig
+                            : {},
+                        budgetMonthlyCents: typeof payload.budgetMonthlyCents === "number" ? payload.budgetMonthlyCents : 0,
+                        metadata: typeof payload.metadata === "object" && payload.metadata !== null
+                            ? payload.metadata
+                            : null,
+                        status: "idle",
+                        spentMonthlyCents: 0,
+                        permissions: undefined,
+                        lastHeartbeatAt: null,
+                    });
+                    hireApprovedAgentId = created?.id ?? null;
+                }
+                if (hireApprovedAgentId) {
+                    const budgetMonthlyCents = typeof payload.budgetMonthlyCents === "number" ? payload.budgetMonthlyCents : 0;
+                    if (budgetMonthlyCents > 0) {
+                        await budgets.upsertPolicy(updated.companyId, {
+                            scopeType: "agent",
+                            scopeId: hireApprovedAgentId,
+                            amount: budgetMonthlyCents,
+                            windowKind: "calendar_month_utc",
+                        }, decidedByUserId);
+                    }
+                    void notifyHireApproved(db, {
+                        companyId: updated.companyId,
+                        agentId: hireApprovedAgentId,
+                        source: "approval",
+                        sourceId: id,
+                        approvedAt: now,
+                    }).catch(() => { });
+                }
+            }
+            return { approval: updated, applied };
+        },
+        reject: async (id, decidedByUserId, decisionNote) => {
+            const { approval: updated, applied } = await resolveApproval(id, "rejected", decidedByUserId, decisionNote);
+            if (applied && updated.type === "hire_agent") {
+                const payload = updated.payload;
+                const payloadAgentId = typeof payload.agentId === "string" ? payload.agentId : null;
+                if (payloadAgentId) {
+                    await agentsSvc.terminate(payloadAgentId);
+                }
+            }
+            return { approval: updated, applied };
+        },
+        requestRevision: async (id, decidedByUserId, decisionNote) => {
+            const existing = await getExistingApproval(id);
+            if (existing.status !== "pending") {
+                throw unprocessable("Only pending approvals can request revision");
+            }
+            const now = new Date();
+            return db
+                .update(approvals)
+                .set({
+                status: "revision_requested",
+                decidedByUserId,
+                decisionNote: decisionNote ?? null,
+                decidedAt: now,
+                updatedAt: now,
+            })
+                .where(eq(approvals.id, id))
+                .returning()
+                .then((rows) => rows[0]);
+        },
+        resubmit: async (id, payload) => {
+            const existing = await getExistingApproval(id);
+            if (existing.status !== "revision_requested") {
+                throw unprocessable("Only revision requested approvals can be resubmitted");
+            }
+            const now = new Date();
+            return db
+                .update(approvals)
+                .set({
+                status: "pending",
+                payload: payload ?? existing.payload,
+                decisionNote: null,
+                decidedByUserId: null,
+                decidedAt: null,
+                updatedAt: now,
+            })
+                .where(eq(approvals.id, id))
+                .returning()
+                .then((rows) => rows[0]);
+        },
+        listComments: async (approvalId) => {
+            const existing = await getExistingApproval(approvalId);
+            const { censorUsernameInLogs } = await instanceSettings.getGeneral();
+            return db
+                .select()
+                .from(approvalComments)
+                .where(and(eq(approvalComments.approvalId, approvalId), eq(approvalComments.companyId, existing.companyId)))
+                .orderBy(asc(approvalComments.createdAt))
+                .then((comments) => comments.map((comment) => redactApprovalComment(comment, censorUsernameInLogs)));
+        },
+        addComment: async (approvalId, body, actor) => {
+            const existing = await getExistingApproval(approvalId);
+            const currentUserRedactionOptions = {
+                enabled: (await instanceSettings.getGeneral()).censorUsernameInLogs,
+            };
+            const redactedBody = redactCurrentUserText(body, currentUserRedactionOptions);
+            return db
+                .insert(approvalComments)
+                .values({
+                companyId: existing.companyId,
+                approvalId,
+                authorAgentId: actor.agentId ?? null,
+                authorUserId: actor.userId ?? null,
+                body: redactedBody,
+            })
+                .returning()
+                .then((rows) => redactApprovalComment(rows[0], currentUserRedactionOptions.enabled));
+        },
+    };
+}
+//# sourceMappingURL=approvals.js.map

package/dist/services/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../src/services/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,MAAM,UAAU,eAAe,CAAC,EAAM;IACpC,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACrD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtE,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAI1D,SAAS,qBAAqB,CAA6B,OAAU,EAAE,oBAA6B;QAClG,OAAO;YACL,GAAG,OAAO;YACV,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;SAC7E,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,EAAU;QAC3C,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAC3B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ;YAAE,MAAM,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,EAAU,EACV,YAAqC,EACrC,eAAuB,EACvB,YAAuC;QAEvC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACrC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAChD,CAAC;YACD,MAAM,aAAa,CACjB,uDAAuD,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAC/G,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,SAAS,CAAC;aACjB,GAAG,CAAC;YACH,MAAM,EAAE,YAAY;YACpB,eAAe;YACf,YAAY,EAAE,YAAY,IAAI,IAAI;YAClC,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;aAC/E,SAAS,EAAE;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEnC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,aAAa,CACjB,uDAAuD,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAC/G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,CAAC,SAAiB,EAAE,MAAe,EAAE,EAAE;YAC3C,MAAM,UAAU,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,EAAE,CAAC,EAAU,EAAE,EAAE,CACtB,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAC3B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAEpC,MAAM,EAAE,CAAC,SAAiB,EAAE,IAAsD,EAAE,EAAE,CACpF,EAAE;aACC,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC;aAC9B,SAAS,EAAE;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE5B,OAAO,EAAE,KAAK,EAAE,EAAU,EAAE,eAAuB,EAAE,YAA4B,EAAE,EAAE;YACnF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAC1D,EAAE,EACF,UAAU,EACV,eAAe,EACf,YAAY,CACb,CAAC;YAEF,IAAI,mBAAmB,GAAkB,IAAI,CAAC;YAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAkC,CAAC;gBAC3D,MAAM,cAAc,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpF,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,SAAS,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAC;oBACxD,mBAAmB,GAAG,cAAc,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;wBACxD,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;wBACzC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;wBACvC,KAAK,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;wBAC/D,SAAS,EAAE,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;wBAC3E,YAAY,EAAE,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;wBACpF,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;wBACrD,aAAa,EACX,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI;4BACzE,CAAC,CAAE,OAAO,CAAC,aAAyC;4BACpD,CAAC,CAAC,EAAE;wBACR,kBAAkB,EAChB,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;wBACjF,QAAQ,EACN,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;4BAC/D,CAAC,CAAE,OAAO,CAAC,QAAoC;4BAC/C,CAAC,CAAC,IAAI;wBACV,MAAM,EAAE,MAAM;wBACd,iBAAiB,EAAE,CAAC;wBACpB,WAAW,EAAE,SAAS;wBACtB,eAAe,EAAE,IAAI;qBACtB,CAAC,CAAC;oBACH,mBAAmB,GAAG,OAAO,EAAE,EAAE,IAAI,IAAI,CAAC;gBAC5C,CAAC;gBACD,IAAI,mBAAmB,EAAE,CAAC;oBACxB,MAAM,kBAAkB,GACtB,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClF,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;wBAC3B,MAAM,OAAO,CAAC,YAAY,CACxB,OAAO,CAAC,SAAS,EACjB;4BACE,SAAS,EAAE,OAAO;4BAClB,OAAO,EAAE,mBAAmB;4BAC5B,MAAM,EAAE,kBAAkB;4BAC1B,UAAU,EAAE,oBAAoB;yBACjC,EACD,eAAe,CAChB,CAAC;oBACJ,CAAC;oBACD,KAAK,kBAAkB,CAAC,EAAE,EAAE;wBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,OAAO,EAAE,mBAAmB;wBAC5B,MAAM,EAAE,UAAU;wBAClB,QAAQ,EAAE,EAAE;wBACZ,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,EAAU,EAAE,eAAuB,EAAE,YAA4B,EAAE,EAAE;YAClF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAC1D,EAAE,EACF,UAAU,EACV,eAAe,EACf,YAAY,CACb,CAAC;YAEF,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAkC,CAAC;gBAC3D,MAAM,cAAc,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpF,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,SAAS,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACxC,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,EAAU,EAAE,eAAuB,EAAE,YAA4B,EAAE,EAAE;YAC3F,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,aAAa,CAAC,6CAA6C,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE;iBACN,MAAM,CAAC,SAAS,CAAC;iBACjB,GAAG,CAAC;gBACH,MAAM,EAAE,oBAAoB;gBAC5B,eAAe;gBACf,YAAY,EAAE,YAAY,IAAI,IAAI;gBAClC,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBAC3B,SAAS,EAAE;iBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,QAAQ,EAAE,KAAK,EAAE,EAAU,EAAE,OAAiC,EAAE,EAAE;YAChE,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;gBAC7C,MAAM,aAAa,CAAC,sDAAsD,CAAC,CAAC;YAC9E,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE;iBACN,MAAM,CAAC,SAAS,CAAC;iBACjB,GAAG,CAAC;gBACH,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO;gBACpC,YAAY,EAAE,IAAI;gBAClB,eAAe,EAAE,IAAI;gBACrB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBAC3B,SAAS,EAAE;iBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,YAAY,EAAE,KAAK,EAAE,UAAkB,EAAE,EAAE;YACzC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC;YACrE,OAAO,EAAE;iBACN,MAAM,EAAE;iBACR,IAAI,CAAC,gBAAgB,CAAC;iBACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,EAC3C,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CACnD,CACF;iBACA,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;iBACxC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACzG,CAAC;QAED,UAAU,EAAE,KAAK,EACf,UAAkB,EAClB,IAAY,EACZ,KAA4C,EAC5C,EAAE;YACF,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,2BAA2B,GAAG;gBAClC,OAAO,EAAE,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,oBAAoB;aACpE,CAAC;YACF,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YAC9E,OAAO,EAAE;iBACN,MAAM,CAAC,gBAAgB,CAAC;iBACxB,MAAM,CAAC;gBACN,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU;gBACV,aAAa,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;gBACpC,YAAY,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;gBAClC,IAAI,EAAE,YAAY;aACnB,CAAC;iBACD,SAAS,EAAE;iBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;QACzF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/services/assets.d.ts

@@ -0,0 +1,33 @@
+import type { Db } from "@fidelios/db";
+import { assets } from "@fidelios/db";
+export declare function assetService(db: Db): {
+    create: (companyId: string, data: Omit<typeof assets.$inferInsert, "companyId">) => Promise<{
+        sha256: string;
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        companyId: string;
+        provider: string;
+        objectKey: string;
+        contentType: string;
+        byteSize: number;
+        originalFilename: string | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+    }>;
+    getById: (id: string) => Promise<{
+        sha256: string;
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        companyId: string;
+        provider: string;
+        objectKey: string;
+        contentType: string;
+        byteSize: number;
+        originalFilename: string | null;
+        createdByAgentId: string | null;
+        createdByUserId: string | null;
+    }>;
+};
+//# sourceMappingURL=assets.d.ts.map

package/dist/services/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/services/assets.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,wBAAgB,YAAY,CAAC,EAAE,EAAE,EAAE;wBAEX,MAAM,QAAQ,IAAI,CAAC,OAAO,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC;;;;;;;;;;;;;;kBAOjE,MAAM;;;;;;;;;;;;;;EAOvB"}

package/dist/services/assets.js

@@ -0,0 +1,17 @@
+import { eq } from "drizzle-orm";
+import { assets } from "@fidelios/db";
+export function assetService(db) {
+    return {
+        create: (companyId, data) => db
+            .insert(assets)
+            .values({ ...data, companyId })
+            .returning()
+            .then((rows) => rows[0]),
+        getById: (id) => db
+            .select()
+            .from(assets)
+            .where(eq(assets.id, id))
+            .then((rows) => rows[0] ?? null),
+    };
+}
+//# sourceMappingURL=assets.js.map

package/dist/services/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../src/services/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,UAAU,YAAY,CAAC,EAAM;IACjC,OAAO;QACL,MAAM,EAAE,CAAC,SAAiB,EAAE,IAAmD,EAAE,EAAE,CACjF,EAAE;aACC,MAAM,CAAC,MAAM,CAAC;aACd,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC;aAC9B,SAAS,EAAE;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE5B,OAAO,EAAE,CAAC,EAAU,EAAE,EAAE,CACtB,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACxB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;KACrC,CAAC;AACJ,CAAC"}

package/dist/services/board-auth.d.ts

@@ -0,0 +1,234 @@
+import type { Db } from "@fidelios/db";
+export declare const BOARD_API_KEY_TTL_MS: number;
+export declare const CLI_AUTH_CHALLENGE_TTL_MS: number;
+export type CliAuthChallengeStatus = "pending" | "approved" | "cancelled" | "expired";
+export declare function hashBearerToken(token: string): string;
+export declare function tokenHashesMatch(left: string, right: string): boolean;
+export declare function createBoardApiToken(): string;
+export declare function createCliAuthSecret(): string;
+export declare function boardApiKeyExpiresAt(nowMs?: number): Date;
+export declare function cliAuthChallengeExpiresAt(nowMs?: number): Date;
+export declare function boardAuthService(db: Db): {
+    resolveBoardAccess: (userId: string) => Promise<{
+        user: {
+            id: string;
+            name: string;
+            email: string;
+        };
+        companyIds: string[];
+        isInstanceAdmin: boolean;
+    }>;
+    findBoardApiKeyByToken: (token: string) => Promise<{
+        id: string;
+        name: string;
+        createdAt: Date;
+        expiresAt: Date | null;
+        userId: string;
+        keyHash: string;
+        lastUsedAt: Date | null;
+        revokedAt: Date | null;
+    } | null>;
+    touchBoardApiKey: (id: string) => Promise<void>;
+    revokeBoardApiKey: (id: string) => Promise<{
+        id: string;
+        userId: string;
+        name: string;
+        keyHash: string;
+        lastUsedAt: Date | null;
+        revokedAt: Date | null;
+        expiresAt: Date | null;
+        createdAt: Date;
+    }>;
+    createCliAuthChallenge: (input: {
+        command: string;
+        clientName?: string | null;
+        requestedAccess: "board" | "instance_admin_required";
+        requestedCompanyId?: string | null;
+    }) => Promise<{
+        challenge: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            expiresAt: Date;
+            secretHash: string;
+            command: string;
+            clientName: string | null;
+            requestedAccess: string;
+            requestedCompanyId: string | null;
+            pendingKeyHash: string;
+            pendingKeyName: string;
+            approvedByUserId: string | null;
+            boardApiKeyId: string | null;
+            approvedAt: Date | null;
+            cancelledAt: Date | null;
+        };
+        challengeSecret: string;
+        pendingBoardToken: string;
+    }>;
+    getCliAuthChallengeBySecret: (id: string, token: string) => Promise<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        expiresAt: Date;
+        secretHash: string;
+        command: string;
+        clientName: string | null;
+        requestedAccess: string;
+        requestedCompanyId: string | null;
+        pendingKeyHash: string;
+        pendingKeyName: string;
+        approvedByUserId: string | null;
+        boardApiKeyId: string | null;
+        approvedAt: Date | null;
+        cancelledAt: Date | null;
+    } | null>;
+    describeCliAuthChallenge: (id: string, token: string) => Promise<{
+        id: string;
+        status: CliAuthChallengeStatus;
+        command: string;
+        clientName: string | null;
+        requestedAccess: "board" | "instance_admin_required";
+        requestedCompanyId: string | null;
+        requestedCompanyName: string | null;
+        approvedAt: string | null;
+        cancelledAt: string | null;
+        expiresAt: string;
+        approvedByUser: {
+            id: string;
+            name: string;
+            email: string;
+        } | null;
+    } | null>;
+    approveCliAuthChallenge: (id: string, token: string, userId: string) => Promise<{
+        status: "expired";
+        challenge: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            expiresAt: Date;
+            secretHash: string;
+            command: string;
+            clientName: string | null;
+            requestedAccess: string;
+            requestedCompanyId: string | null;
+            pendingKeyHash: string;
+            pendingKeyName: string;
+            approvedByUserId: string | null;
+            boardApiKeyId: string | null;
+            approvedAt: Date | null;
+            cancelledAt: Date | null;
+        };
+    } | {
+        status: "cancelled";
+        challenge: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            expiresAt: Date;
+            secretHash: string;
+            command: string;
+            clientName: string | null;
+            requestedAccess: string;
+            requestedCompanyId: string | null;
+            pendingKeyHash: string;
+            pendingKeyName: string;
+            approvedByUserId: string | null;
+            boardApiKeyId: string | null;
+            approvedAt: Date | null;
+            cancelledAt: Date | null;
+        };
+    } | {
+        status: "approved";
+        challenge: {
+            id: string;
+            secretHash: string;
+            command: string;
+            clientName: string | null;
+            requestedAccess: string;
+            requestedCompanyId: string | null;
+            pendingKeyHash: string;
+            pendingKeyName: string;
+            approvedByUserId: string | null;
+            boardApiKeyId: string | null;
+            approvedAt: Date | null;
+            cancelledAt: Date | null;
+            expiresAt: Date;
+            createdAt: Date;
+            updatedAt: Date;
+        };
+    }>;
+    cancelCliAuthChallenge: (id: string, token: string) => Promise<{
+        status: "approved";
+        challenge: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            expiresAt: Date;
+            secretHash: string;
+            command: string;
+            clientName: string | null;
+            requestedAccess: string;
+            requestedCompanyId: string | null;
+            pendingKeyHash: string;
+            pendingKeyName: string;
+            approvedByUserId: string | null;
+            boardApiKeyId: string | null;
+            approvedAt: Date | null;
+            cancelledAt: Date | null;
+        };
+    } | {
+        status: "expired";
+        challenge: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            expiresAt: Date;
+            secretHash: string;
+            command: string;
+            clientName: string | null;
+            requestedAccess: string;
+            requestedCompanyId: string | null;
+            pendingKeyHash: string;
+            pendingKeyName: string;
+            approvedByUserId: string | null;
+            boardApiKeyId: string | null;
+            approvedAt: Date | null;
+            cancelledAt: Date | null;
+        };
+    } | {
+        status: "cancelled";
+        challenge: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            expiresAt: Date;
+            secretHash: string;
+            command: string;
+            clientName: string | null;
+            requestedAccess: string;
+            requestedCompanyId: string | null;
+            pendingKeyHash: string;
+            pendingKeyName: string;
+            approvedByUserId: string | null;
+            boardApiKeyId: string | null;
+            approvedAt: Date | null;
+            cancelledAt: Date | null;
+        };
+    }>;
+    assertCurrentBoardKey: (keyId: string | undefined, userId: string | undefined) => Promise<{
+        id: string;
+        name: string;
+        createdAt: Date;
+        expiresAt: Date | null;
+        userId: string;
+        keyHash: string;
+        lastUsedAt: Date | null;
+        revokedAt: Date | null;
+    }>;
+    resolveBoardActivityCompanyIds: (input: {
+        userId: string;
+        requestedCompanyId?: string | null;
+        boardApiKeyId?: string | null;
+    }) => Promise<string[]>;
+};
+//# sourceMappingURL=board-auth.d.ts.map

package/dist/services/board-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-auth.d.ts","sourceRoot":"","sources":["../../src/services/board-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAWvC,eAAO,MAAM,oBAAoB,QAA2B,CAAC;AAC7D,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AAExD,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAEtF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,UAE5C;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,WAI3D;AAED,wBAAgB,mBAAmB,WAElC;AAED,wBAAgB,mBAAmB,WAElC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,GAAE,MAAmB,QAE9D;AAED,wBAAgB,yBAAyB,CAAC,KAAK,GAAE,MAAmB,QAEnE;AASD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE;iCACK,MAAM;;;;;;;;;oCA4EH,MAAM;;;;;;;;;;2BAef,MAAM;4BAIL,MAAM;;;;;;;;;;oCAUE;QAC3C,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,eAAe,EAAE,OAAO,GAAG,yBAAyB,CAAC;QACrD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACpC;;;;;;;;;;;;;;;;;;;;;sCAwC8C,MAAM,SAAS,MAAM;;;;;;;;;;;;;;;;;mCAOxB,MAAM,SAAS,MAAM;;;;;yBA0Bf,OAAO,GAAG,yBAAyB;;;;;;;;;;;;kCAgB1C,MAAM,SAAS,MAAM,UAAU,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAwDtC,MAAM,SAAS,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCAsBnB,MAAM,GAAG,SAAS,UAAU,MAAM,GAAG,SAAS;;;;;;;;;;4CAjPrC;QACnD,MAAM,EAAE,MAAM,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B;EAqQF"}