@fidelios/server 0.0.1

package/dist/services/board-auth.js

@@ -0,0 +1,295 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { and, eq, isNull, sql } from "drizzle-orm";
+import { authUsers, boardApiKeys, cliAuthChallenges, companies, companyMemberships, instanceUserRoles, } from "@fidelios/db";
+import { conflict, forbidden, notFound } from "../errors.js";
+export const BOARD_API_KEY_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const CLI_AUTH_CHALLENGE_TTL_MS = 10 * 60 * 1000;
+export function hashBearerToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+export function tokenHashesMatch(left, right) {
+    const leftBytes = Buffer.from(left, "utf8");
+    const rightBytes = Buffer.from(right, "utf8");
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+export function createBoardApiToken() {
+    return `pcp_board_${randomBytes(24).toString("hex")}`;
+}
+export function createCliAuthSecret() {
+    return `pcp_cli_auth_${randomBytes(24).toString("hex")}`;
+}
+export function boardApiKeyExpiresAt(nowMs = Date.now()) {
+    return new Date(nowMs + BOARD_API_KEY_TTL_MS);
+}
+export function cliAuthChallengeExpiresAt(nowMs = Date.now()) {
+    return new Date(nowMs + CLI_AUTH_CHALLENGE_TTL_MS);
+}
+function challengeStatusForRow(row) {
+    if (row.cancelledAt)
+        return "cancelled";
+    if (row.expiresAt.getTime() <= Date.now())
+        return "expired";
+    if (row.approvedAt && row.boardApiKeyId)
+        return "approved";
+    return "pending";
+}
+export function boardAuthService(db) {
+    async function resolveBoardAccess(userId) {
+        const [user, memberships, adminRole] = await Promise.all([
+            db
+                .select({
+                id: authUsers.id,
+                name: authUsers.name,
+                email: authUsers.email,
+            })
+                .from(authUsers)
+                .where(eq(authUsers.id, userId))
+                .then((rows) => rows[0] ?? null),
+            db
+                .select({ companyId: companyMemberships.companyId })
+                .from(companyMemberships)
+                .where(and(eq(companyMemberships.principalType, "user"), eq(companyMemberships.principalId, userId), eq(companyMemberships.status, "active")))
+                .then((rows) => rows.map((row) => row.companyId)),
+            db
+                .select({ id: instanceUserRoles.id })
+                .from(instanceUserRoles)
+                .where(and(eq(instanceUserRoles.userId, userId), eq(instanceUserRoles.role, "instance_admin")))
+                .then((rows) => rows[0] ?? null),
+        ]);
+        return {
+            user,
+            companyIds: memberships,
+            isInstanceAdmin: Boolean(adminRole),
+        };
+    }
+    async function resolveBoardActivityCompanyIds(input) {
+        const access = await resolveBoardAccess(input.userId);
+        const companyIds = new Set(access.companyIds);
+        if (companyIds.size === 0 && input.requestedCompanyId?.trim()) {
+            companyIds.add(input.requestedCompanyId.trim());
+        }
+        if (companyIds.size === 0 && input.boardApiKeyId?.trim()) {
+            const challengeCompanyIds = await db
+                .select({ requestedCompanyId: cliAuthChallenges.requestedCompanyId })
+                .from(cliAuthChallenges)
+                .where(eq(cliAuthChallenges.boardApiKeyId, input.boardApiKeyId.trim()))
+                .then((rows) => rows
+                .map((row) => row.requestedCompanyId?.trim() ?? null)
+                .filter((value) => Boolean(value)));
+            for (const companyId of challengeCompanyIds) {
+                companyIds.add(companyId);
+            }
+        }
+        if (companyIds.size === 0 && access.isInstanceAdmin) {
+            const allCompanyIds = await db
+                .select({ id: companies.id })
+                .from(companies)
+                .then((rows) => rows.map((row) => row.id));
+            for (const companyId of allCompanyIds) {
+                companyIds.add(companyId);
+            }
+        }
+        return Array.from(companyIds);
+    }
+    async function findBoardApiKeyByToken(token) {
+        const tokenHash = hashBearerToken(token);
+        const now = new Date();
+        return db
+            .select()
+            .from(boardApiKeys)
+            .where(and(eq(boardApiKeys.keyHash, tokenHash), isNull(boardApiKeys.revokedAt)))
+            .then((rows) => rows.find((row) => !row.expiresAt || row.expiresAt.getTime() > now.getTime()) ?? null);
+    }
+    async function touchBoardApiKey(id) {
+        await db.update(boardApiKeys).set({ lastUsedAt: new Date() }).where(eq(boardApiKeys.id, id));
+    }
+    async function revokeBoardApiKey(id) {
+        const now = new Date();
+        return db
+            .update(boardApiKeys)
+            .set({ revokedAt: now, lastUsedAt: now })
+            .where(and(eq(boardApiKeys.id, id), isNull(boardApiKeys.revokedAt)))
+            .returning()
+            .then((rows) => rows[0] ?? null);
+    }
+    async function createCliAuthChallenge(input) {
+        const challengeSecret = createCliAuthSecret();
+        const pendingBoardToken = createBoardApiToken();
+        const expiresAt = cliAuthChallengeExpiresAt();
+        const labelBase = input.clientName?.trim() || "fidelios cli";
+        const pendingKeyName = input.requestedAccess === "instance_admin_required"
+            ? `${labelBase} (instance admin)`
+            : `${labelBase} (board)`;
+        const created = await db
+            .insert(cliAuthChallenges)
+            .values({
+            secretHash: hashBearerToken(challengeSecret),
+            command: input.command.trim(),
+            clientName: input.clientName?.trim() || null,
+            requestedAccess: input.requestedAccess,
+            requestedCompanyId: input.requestedCompanyId?.trim() || null,
+            pendingKeyHash: hashBearerToken(pendingBoardToken),
+            pendingKeyName,
+            expiresAt,
+        })
+            .returning()
+            .then((rows) => rows[0]);
+        return {
+            challenge: created,
+            challengeSecret,
+            pendingBoardToken,
+        };
+    }
+    async function getCliAuthChallenge(id) {
+        return db
+            .select()
+            .from(cliAuthChallenges)
+            .where(eq(cliAuthChallenges.id, id))
+            .then((rows) => rows[0] ?? null);
+    }
+    async function getCliAuthChallengeBySecret(id, token) {
+        const challenge = await getCliAuthChallenge(id);
+        if (!challenge)
+            return null;
+        if (!tokenHashesMatch(challenge.secretHash, hashBearerToken(token)))
+            return null;
+        return challenge;
+    }
+    async function describeCliAuthChallenge(id, token) {
+        const challenge = await getCliAuthChallengeBySecret(id, token);
+        if (!challenge)
+            return null;
+        const [company, approvedBy] = await Promise.all([
+            challenge.requestedCompanyId
+                ? db
+                    .select({ id: companies.id, name: companies.name })
+                    .from(companies)
+                    .where(eq(companies.id, challenge.requestedCompanyId))
+                    .then((rows) => rows[0] ?? null)
+                : Promise.resolve(null),
+            challenge.approvedByUserId
+                ? db
+                    .select({ id: authUsers.id, name: authUsers.name, email: authUsers.email })
+                    .from(authUsers)
+                    .where(eq(authUsers.id, challenge.approvedByUserId))
+                    .then((rows) => rows[0] ?? null)
+                : Promise.resolve(null),
+        ]);
+        return {
+            id: challenge.id,
+            status: challengeStatusForRow(challenge),
+            command: challenge.command,
+            clientName: challenge.clientName ?? null,
+            requestedAccess: challenge.requestedAccess,
+            requestedCompanyId: challenge.requestedCompanyId ?? null,
+            requestedCompanyName: company?.name ?? null,
+            approvedAt: challenge.approvedAt?.toISOString() ?? null,
+            cancelledAt: challenge.cancelledAt?.toISOString() ?? null,
+            expiresAt: challenge.expiresAt.toISOString(),
+            approvedByUser: approvedBy
+                ? {
+                    id: approvedBy.id,
+                    name: approvedBy.name,
+                    email: approvedBy.email,
+                }
+                : null,
+        };
+    }
+    async function approveCliAuthChallenge(id, token, userId) {
+        const access = await resolveBoardAccess(userId);
+        return db.transaction(async (tx) => {
+            await tx.execute(sql `select ${cliAuthChallenges.id} from ${cliAuthChallenges} where ${cliAuthChallenges.id} = ${id} for update`);
+            const challenge = await tx
+                .select()
+                .from(cliAuthChallenges)
+                .where(eq(cliAuthChallenges.id, id))
+                .then((rows) => rows[0] ?? null);
+            if (!challenge || !tokenHashesMatch(challenge.secretHash, hashBearerToken(token))) {
+                throw notFound("CLI auth challenge not found");
+            }
+            const status = challengeStatusForRow(challenge);
+            if (status === "expired")
+                return { status, challenge };
+            if (status === "cancelled")
+                return { status, challenge };
+            if (challenge.requestedAccess === "instance_admin_required" && !access.isInstanceAdmin) {
+                throw forbidden("Instance admin required");
+            }
+            let boardKeyId = challenge.boardApiKeyId;
+            if (!boardKeyId) {
+                const createdKey = await tx
+                    .insert(boardApiKeys)
+                    .values({
+                    userId,
+                    name: challenge.pendingKeyName,
+                    keyHash: challenge.pendingKeyHash,
+                    expiresAt: boardApiKeyExpiresAt(),
+                })
+                    .returning()
+                    .then((rows) => rows[0]);
+                boardKeyId = createdKey.id;
+            }
+            const approvedAt = challenge.approvedAt ?? new Date();
+            const updated = await tx
+                .update(cliAuthChallenges)
+                .set({
+                approvedByUserId: userId,
+                boardApiKeyId: boardKeyId,
+                approvedAt,
+                updatedAt: new Date(),
+            })
+                .where(eq(cliAuthChallenges.id, challenge.id))
+                .returning()
+                .then((rows) => rows[0] ?? challenge);
+            return { status: "approved", challenge: updated };
+        });
+    }
+    async function cancelCliAuthChallenge(id, token) {
+        const challenge = await getCliAuthChallengeBySecret(id, token);
+        if (!challenge)
+            throw notFound("CLI auth challenge not found");
+        const status = challengeStatusForRow(challenge);
+        if (status === "approved")
+            return { status, challenge };
+        if (status === "expired")
+            return { status, challenge };
+        if (status === "cancelled")
+            return { status, challenge };
+        const updated = await db
+            .update(cliAuthChallenges)
+            .set({
+            cancelledAt: new Date(),
+            updatedAt: new Date(),
+        })
+            .where(eq(cliAuthChallenges.id, challenge.id))
+            .returning()
+            .then((rows) => rows[0] ?? challenge);
+        return { status: "cancelled", challenge: updated };
+    }
+    async function assertCurrentBoardKey(keyId, userId) {
+        if (!keyId || !userId)
+            throw conflict("Board API key context is required");
+        const key = await db
+            .select()
+            .from(boardApiKeys)
+            .where(and(eq(boardApiKeys.id, keyId), eq(boardApiKeys.userId, userId)))
+            .then((rows) => rows[0] ?? null);
+        if (!key || key.revokedAt)
+            throw notFound("Board API key not found");
+        return key;
+    }
+    return {
+        resolveBoardAccess,
+        findBoardApiKeyByToken,
+        touchBoardApiKey,
+        revokeBoardApiKey,
+        createCliAuthChallenge,
+        getCliAuthChallengeBySecret,
+        describeCliAuthChallenge,
+        approveCliAuthChallenge,
+        cancelCliAuthChallenge,
+        assertCurrentBoardKey,
+        resolveBoardActivityCompanyIds,
+    };
+}
+//# sourceMappingURL=board-auth.js.map

package/dist/services/board-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-auth.js","sourceRoot":"","sources":["../../src/services/board-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EACL,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAIxD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,aAAa,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAC7D,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,oBAAoB,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAClE,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,yBAAyB,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA0C;IACvE,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,WAAW,CAAC;IACxC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,UAAU,CAAC;IAC3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAM;IACrC,KAAK,UAAU,kBAAkB,CAAC,MAAc;QAC9C,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,EAAE;iBACC,MAAM,CAAC;gBACN,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,KAAK,EAAE,SAAS,CAAC,KAAK;aACvB,CAAC;iBACD,IAAI,CAAC,SAAS,CAAC;iBACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC/B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAClC,EAAE;iBACC,MAAM,CAAC,EAAE,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAC;iBACnD,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,EAC5C,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,EAC1C,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACxC,CACF;iBACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnD,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;iBACpC,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;iBAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;SACnC,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,UAAU,EAAE,WAAW;YACvB,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,8BAA8B,CAAC,KAI7C;QACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC;YAC9D,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;YACzD,MAAM,mBAAmB,GAAG,MAAM,EAAE;iBACjC,MAAM,CAAC,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;iBACpE,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;iBACtE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACb,IAAI;iBACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;iBACpD,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACtD,CAAC;YACJ,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;gBAC5C,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YACpD,MAAM,aAAa,GAAG,MAAM,EAAE;iBAC3B,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;iBAC5B,IAAI,CAAC,SAAS,CAAC;iBACf,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;gBACtC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,KAAa;QACjD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,EACnC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAC/B,CACF;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3G,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,EAAU;QACxC,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,EAAU;QACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE;aACN,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;aACxC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;aACnE,SAAS,EAAE;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,KAKrC;QACC,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAC;QAC9C,MAAM,iBAAiB,GAAG,mBAAmB,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,yBAAyB,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC;QAC7D,MAAM,cAAc,GAClB,KAAK,CAAC,eAAe,KAAK,yBAAyB;YACjD,CAAC,CAAC,GAAG,SAAS,mBAAmB;YACjC,CAAC,CAAC,GAAG,SAAS,UAAU,CAAC;QAE7B,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC;YACN,UAAU,EAAE,eAAe,CAAC,eAAe,CAAC;YAC5C,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;YAC7B,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,IAAI;YAC5D,cAAc,EAAE,eAAe,CAAC,iBAAiB,CAAC;YAClD,cAAc;YACd,SAAS;SACV,CAAC;aACD,SAAS,EAAE;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3B,OAAO;YACL,SAAS,EAAE,OAAO;YAClB,eAAe;YACf,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,EAAU;QAC3C,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACnC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,2BAA2B,CAAC,EAAU,EAAE,KAAa;QAClE,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,wBAAwB,CAAC,EAAU,EAAE,KAAa;QAC/D,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9C,SAAS,CAAC,kBAAkB;gBAC1B,CAAC,CAAC,EAAE;qBACC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;qBAClD,IAAI,CAAC,SAAS,CAAC;qBACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;qBACrD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBACpC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACzB,SAAS,CAAC,gBAAgB;gBACxB,CAAC,CAAC,EAAE;qBACC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;qBAC1E,IAAI,CAAC,SAAS,CAAC;qBACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;qBACnD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBACpC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC;YACxC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,IAAI;YACxC,eAAe,EAAE,SAAS,CAAC,eAAsD;YACjF,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,IAAI,IAAI;YACxD,oBAAoB,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;YAC3C,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;YACvD,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;YACzD,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE;YAC5C,cAAc,EAAE,UAAU;gBACxB,CAAC,CAAC;oBACE,EAAE,EAAE,UAAU,CAAC,EAAE;oBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,KAAK,EAAE,UAAU,CAAC,KAAK;iBACxB;gBACH,CAAC,CAAC,IAAI;SACT,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,uBAAuB,CAAC,EAAU,EAAE,KAAa,EAAE,MAAc;QAC9E,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,UAAU,iBAAiB,CAAC,EAAE,SAAS,iBAAiB,UAAU,iBAAiB,CAAC,EAAE,MAAM,EAAE,aAAa,CAC/G,CAAC;YAEF,MAAM,SAAS,GAAG,MAAM,EAAE;iBACvB,MAAM,EAAE;iBACR,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBACnC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAClF,MAAM,QAAQ,CAAC,8BAA8B,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAEzD,IAAI,SAAS,CAAC,eAAe,KAAK,yBAAyB,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBACvF,MAAM,SAAS,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,UAAU,GAAG,SAAS,CAAC,aAAa,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,UAAU,GAAG,MAAM,EAAE;qBACxB,MAAM,CAAC,YAAY,CAAC;qBACpB,MAAM,CAAC;oBACN,MAAM;oBACN,IAAI,EAAE,SAAS,CAAC,cAAc;oBAC9B,OAAO,EAAE,SAAS,CAAC,cAAc;oBACjC,SAAS,EAAE,oBAAoB,EAAE;iBAClC,CAAC;qBACD,SAAS,EAAE;qBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3B,UAAU,GAAG,UAAU,CAAC,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC;gBACH,gBAAgB,EAAE,MAAM;gBACxB,aAAa,EAAE,UAAU;gBACzB,UAAU;gBACV,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;iBAC7C,SAAS,EAAE;iBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;YAExC,OAAO,EAAE,MAAM,EAAE,UAAmB,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,EAAU,EAAE,KAAa;QAC7D,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS;YAAE,MAAM,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvD,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEzD,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,iBAAiB,CAAC;aACzB,GAAG,CAAC;YACH,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC7C,SAAS,EAAE;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;QAExC,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,UAAU,qBAAqB,CAAC,KAAyB,EAAE,MAA0B;QACxF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,mCAAmC,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aACvE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS;YAAE,MAAM,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QACrE,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,kBAAkB;QAClB,sBAAsB;QACtB,gBAAgB;QAChB,iBAAiB;QACjB,sBAAsB;QACtB,2BAA2B;QAC3B,wBAAwB;QACxB,uBAAuB;QACvB,sBAAsB;QACtB,qBAAqB;QACrB,8BAA8B;KAC/B,CAAC;AACJ,CAAC"}

package/dist/services/budgets.d.ts

@@ -0,0 +1,38 @@
+import type { Db } from "@fidelios/db";
+import { costEvents } from "@fidelios/db";
+import type { BudgetIncident, BudgetIncidentResolutionInput, BudgetOverview, BudgetPolicy, BudgetPolicySummary, BudgetPolicyUpsertInput, BudgetScopeType } from "@fidelios/shared";
+export type BudgetEnforcementScope = {
+    companyId: string;
+    scopeType: BudgetScopeType;
+    scopeId: string;
+};
+export type BudgetServiceHooks = {
+    cancelWorkForScope?: (scope: BudgetEnforcementScope) => Promise<void>;
+};
+export declare function budgetService(db: Db, hooks?: BudgetServiceHooks): {
+    listPolicies: (companyId: string) => Promise<BudgetPolicy[]>;
+    upsertPolicy: (companyId: string, input: BudgetPolicyUpsertInput, actorUserId: string | null) => Promise<BudgetPolicySummary>;
+    overview: (companyId: string) => Promise<BudgetOverview>;
+    evaluateCostEvent: (event: typeof costEvents.$inferSelect) => Promise<void>;
+    getInvocationBlock: (companyId: string, agentId: string, context?: {
+        issueId?: string | null;
+        projectId?: string | null;
+    }) => Promise<{
+        scopeType: "company";
+        scopeId: string;
+        scopeName: string;
+        reason: string;
+    } | {
+        scopeType: "agent";
+        scopeId: string;
+        scopeName: string;
+        reason: string;
+    } | {
+        scopeType: "project";
+        scopeId: string;
+        scopeName: string;
+        reason: string;
+    } | null>;
+    resolveIncident: (companyId: string, incidentId: string, input: BudgetIncidentResolutionInput, actorUserId: string) => Promise<BudgetIncident>;
+};
+//# sourceMappingURL=budgets.d.ts.map

package/dist/services/budgets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budgets.d.ts","sourceRoot":"","sources":["../../src/services/budgets.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAML,UAAU,EAEX,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EACV,cAAc,EACd,6BAA6B,EAE7B,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,eAAe,EAGhB,MAAM,kBAAkB,CAAC;AAc1B,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE,CAAC;AAuKF,wBAAgB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,GAAE,kBAAuB;8BA4RhC,MAAM,KAAG,OAAO,CAAC,YAAY,EAAE,CAAC;8BAWnD,MAAM,SACV,uBAAuB,eACjB,MAAM,GAAG,IAAI,KACzB,OAAO,CAAC,mBAAmB,CAAC;0BAsHH,MAAM,KAAG,OAAO,CAAC,cAAc,CAAC;+BAmB3B,OAAO,UAAU,CAAC,YAAY;oCAsElD,MAAM,WACR,MAAM,YACL;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;;;;;;;;;;;;;;iCAkJrD,MAAM,cACL,MAAM,SACX,6BAA6B,eACvB,MAAM,KAClB,OAAO,CAAC,cAAc,CAAC;EAyF7B"}