@hilbras/keystone 1.1.0

package/dist/services/application/identity.d.ts

@@ -0,0 +1,34 @@
+import type { IdentityDomainService } from "../domain/identity.js";
+import type { User } from "../../db/schema.js";
+import type { Result } from "../../lib/result.js";
+export declare class IdentityApplicationService {
+    private readonly domain;
+    constructor(domain: IdentityDomainService);
+    findUser(id: string): Promise<Result<User>>;
+    findUserByEmail(email: string): Promise<Result<User>>;
+    upsertInvitedUser(input: {
+        email: string;
+        name?: string;
+        username?: string;
+    }): Promise<Result<User>>;
+    updateUserProfile(userId: string, updates: Partial<{
+        name: string;
+        username: string;
+        role: string;
+        emailVerified: boolean;
+    }>): Promise<Result<User>>;
+    deactivate(userId: string): Promise<Result<void>>;
+    listOrganizationUsers(orgId: string): Promise<User[]>;
+    linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
+    getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{
+        url: string;
+    }>>;
+    completeFederationLogin(provider: string, code: string, redirectUri: string): Promise<Result<{
+        user: User;
+        tokens: {
+            accessToken: string;
+            refreshToken: string;
+        };
+    }>>;
+}
+//# sourceMappingURL=identity.d.ts.map

package/dist/services/application/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/services/application/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,qBAAa,0BAA0B;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,qBAAqB;IAEpD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAI3C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIrD,iBAAiB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIpG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,GACzF,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIlB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIjD,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAIrD,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIlB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAIjH,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CAG1F"}

package/dist/services/application/identity.js

@@ -0,0 +1,34 @@
+export class IdentityApplicationService {
+    domain;
+    constructor(domain) {
+        this.domain = domain;
+    }
+    async findUser(id) {
+        return this.domain.findUser(id);
+    }
+    async findUserByEmail(email) {
+        return this.domain.findUserByEmail(email);
+    }
+    async upsertInvitedUser(input) {
+        return this.domain.upsertInvitedUser(input);
+    }
+    async updateUserProfile(userId, updates) {
+        return this.domain.updateUserProfile(userId, updates);
+    }
+    async deactivate(userId) {
+        return this.domain.deactivate(userId);
+    }
+    async listOrganizationUsers(orgId) {
+        return this.domain.listOrganizationUsers(orgId);
+    }
+    async linkUserIdentity(userId, providerId, providerType, externalSub, email) {
+        return this.domain.linkUserIdentity(userId, providerId, providerType, externalSub, email);
+    }
+    async getFederationAuthorizeUrl(provider, state, redirectUri) {
+        return this.domain.getFederationAuthorizeUrl(provider, state, redirectUri);
+    }
+    async completeFederationLogin(provider, code, redirectUri) {
+        return this.domain.completeFederationLogin(provider, code, redirectUri);
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/services/application/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/services/application/identity.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,0BAA0B;IACR;IAA7B,YAA6B,MAA6B;QAA7B,WAAM,GAAN,MAAM,CAAuB;IAAG,CAAC;IAE9D,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAA0D;QAChF,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,MAAc,EACd,OAA0F;QAE1F,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAAa;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,UAAkB,EAClB,YAAoB,EACpB,WAAmB,EACnB,KAAc;QAEd,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB;QAClF,OAAO,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,QAAgB,EAChB,IAAY,EACZ,WAAmB;QAEnB,OAAO,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;CACF"}

package/dist/services/application/index.d.ts

@@ -0,0 +1,4 @@
+export { AuthenticationApplicationService } from "./authentication.js";
+export { IdentityApplicationService } from "./identity.js";
+export { OrganizationApplicationService } from "./organization.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/services/application/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/application/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/services/application/index.js

@@ -0,0 +1,4 @@
+export { AuthenticationApplicationService } from "./authentication.js";
+export { IdentityApplicationService } from "./identity.js";
+export { OrganizationApplicationService } from "./organization.js";
+//# sourceMappingURL=index.js.map

package/dist/services/application/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/application/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/services/application/organization.d.ts

@@ -0,0 +1,44 @@
+import type { OrganizationDomainService } from "../domain/organization.js";
+import type { AuthorizationDomainService, OrgRole } from "../domain/authorization.js";
+import type { IdentityDomainService } from "../domain/identity.js";
+import type { Organization, Application, OrgMembership } from "../../db/schema.js";
+import type { Result } from "../../lib/result.js";
+export declare class OrganizationApplicationService {
+    private readonly domain;
+    private readonly authorization;
+    private readonly identity;
+    constructor(domain: OrganizationDomainService, authorization: AuthorizationDomainService, identity: IdentityDomainService);
+    createOrganization(userId: string, input: {
+        name: string;
+        slug?: string;
+        plan?: string;
+    }): Promise<Result<Organization>>;
+    getOrganization(userId: string, orgId: string): Promise<Result<Organization>>;
+    listUserOrganizations(userId: string): Promise<Organization[]>;
+    inviteMember(actorId: string, orgId: string, input: {
+        email: string;
+        role: OrgRole;
+    }): Promise<Result<{
+        user: {
+            id: string;
+        };
+        membership: OrgMembership;
+    }>>;
+    createApplication(actorId: string, orgId: string, input: {
+        name: string;
+        redirectUris?: string[];
+        allowedOrigins?: string[];
+    }): Promise<Result<Application & {
+        clientSecret: string;
+    }>>;
+    listOrganizationApplications(actorId: string, orgId: string): Promise<Result<Application[]>>;
+    updateApplication(actorId: string, orgId: string, appId: string, updates: Partial<{
+        name: string;
+        redirectUris: string[];
+        allowedOrigins: string[];
+        allowedIps: string[];
+        blockedIps: string[];
+        isActive: boolean;
+    }>): Promise<Result<Application>>;
+}
+//# sourceMappingURL=organization.d.ts.map

package/dist/services/application/organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/services/application/organization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,qBAAa,8BAA8B;IAEvC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,MAAM,EAAE,yBAAyB,EACjC,aAAa,EAAE,0BAA0B,EACzC,QAAQ,EAAE,qBAAqB;IAG5C,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACpD,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAI1B,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAM7E,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI9D,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,UAAU,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;IAajE,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1E,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMpD,4BAA4B,CAChC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAM3B,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,GAClJ,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;CAKhC"}

package/dist/services/application/organization.js

@@ -0,0 +1,53 @@
+export class OrganizationApplicationService {
+    domain;
+    authorization;
+    identity;
+    constructor(domain, authorization, identity) {
+        this.domain = domain;
+        this.authorization = authorization;
+        this.identity = identity;
+    }
+    async createOrganization(userId, input) {
+        return this.domain.createOrganization(input, userId);
+    }
+    async getOrganization(userId, orgId) {
+        const membership = await this.authorization.isOrgMember(userId, orgId);
+        if (!membership)
+            return { success: false, error: { code: "NOT_MEMBER", message: "Not a member", statusCode: 403 } };
+        return this.domain.getOrganization(orgId);
+    }
+    async listUserOrganizations(userId) {
+        return this.domain.listUserOrganizations(userId);
+    }
+    async inviteMember(actorId, orgId, input) {
+        const roleCheck = await this.authorization.requireOrgRole(actorId, orgId, ["owner", "admin"]);
+        if (!roleCheck.success)
+            return roleCheck;
+        const userResult = await this.identity.upsertInvitedUser({ email: input.email });
+        if (!userResult.success)
+            return userResult;
+        const membershipResult = await this.domain.addOrgMembership({ orgId, userId: userResult.data.id, role: input.role });
+        if (!membershipResult.success)
+            return membershipResult;
+        return { success: true, data: { user: userResult.data, membership: membershipResult.data } };
+    }
+    async createApplication(actorId, orgId, input) {
+        const permCheck = await this.authorization.requireOrgRole(actorId, orgId, ["owner", "admin"]);
+        if (!permCheck.success)
+            return permCheck;
+        return this.domain.createApplication({ orgId, ...input });
+    }
+    async listOrganizationApplications(actorId, orgId) {
+        const roleCheck = await this.authorization.requireOrgRole(actorId, orgId, ["owner", "admin", "member"]);
+        if (!roleCheck.success)
+            return roleCheck;
+        return { success: true, data: await this.domain.listOrganizationApplications(orgId) };
+    }
+    async updateApplication(actorId, orgId, appId, updates) {
+        const permCheck = await this.authorization.requireOrgRole(actorId, orgId, ["owner", "admin"]);
+        if (!permCheck.success)
+            return permCheck;
+        return this.domain.updateApplication(appId, orgId, updates);
+    }
+}
+//# sourceMappingURL=organization.js.map

package/dist/services/application/organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/services/application/organization.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,8BAA8B;IAEtB;IACA;IACA;IAHnB,YACmB,MAAiC,EACjC,aAAyC,EACzC,QAA+B;QAF/B,WAAM,GAAN,MAAM,CAA2B;QACjC,kBAAa,GAAb,aAAa,CAA4B;QACzC,aAAQ,GAAR,QAAQ,CAAuB;IAC/C,CAAC;IAEJ,KAAK,CAAC,kBAAkB,CACtB,MAAc,EACd,KAAqD;QAErD,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,KAAa;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC;QACpH,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,OAAe,EACf,KAAa,EACb,KAAuC;QAEvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,SAAS,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAEzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,OAAO,UAAU,CAAC;QAE3C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrH,IAAI,CAAC,gBAAgB,CAAC,OAAO;YAAE,OAAO,gBAAgB,CAAC;QAEvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAAe,EACf,KAAa,EACb,KAA2E;QAE3E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,SAAS,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,4BAA4B,CAChC,OAAe,EACf,KAAa;QAEb,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,SAAS,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAAe,EACf,KAAa,EACb,KAAa,EACb,OAAmJ;QAEnJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,SAAS,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/services/applications.d.ts

@@ -0,0 +1,25 @@
+import { type Application } from "../db/schema.js";
+import { generateClientSecret, hashClientSecret } from "./secrets.js";
+export declare function generateClientId(): string;
+export { generateClientSecret, hashClientSecret };
+export declare function createApplication(input: {
+    orgId: string;
+    name: string;
+    redirectUris?: string[];
+    allowedOrigins?: string[];
+    clientId?: string;
+    clientSecret?: string;
+}): Promise<Application & {
+    clientSecret: string;
+}>;
+export declare function findApplicationByClientId(clientId: string): Promise<Application | undefined>;
+export declare function findApplicationsByOrgId(orgId: string): Promise<Application[]>;
+export declare function updateApplication(appId: string, orgId: string, updates: Partial<{
+    name: string;
+    redirectUris: string[];
+    allowedOrigins: string[];
+    isActive: boolean;
+    branding: Record<string, unknown>;
+}>): Promise<Application | undefined>;
+export declare function verifyClientSecret(clientId: string, secret: string): Promise<Application | undefined>;
+//# sourceMappingURL=applications.d.ts.map

package/dist/services/applications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applications.d.ts","sourceRoot":"","sources":["../../src/services/applications.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOtE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAGD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,CAAC;AAElD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,WAAW,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAclD;AAED,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAWlC;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAEnF;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC,GACD,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAQlC;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAKlC"}

package/dist/services/applications.js

@@ -0,0 +1,64 @@
+import crypto from "node:crypto";
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { applications } from "../db/schema.js";
+import { generateClientSecret, hashClientSecret } from "./secrets.js";
+import { cache } from "./cache.js";
+function appCacheKey(clientId) {
+    return `app:clientId:${clientId}`;
+}
+export function generateClientId() {
+    return `app_${crypto.randomBytes(16).toString("base64url")}`;
+}
+// Re-exported for callers that imported these helpers from this module.
+export { generateClientSecret, hashClientSecret };
+export async function createApplication(input) {
+    const clientSecret = input.clientSecret || generateClientSecret();
+    const [app] = await db
+        .insert(applications)
+        .values({
+        orgId: input.orgId,
+        clientId: input.clientId || generateClientId(),
+        clientSecretHash: hashClientSecret(clientSecret),
+        name: input.name,
+        redirectUris: input.redirectUris ?? [],
+        allowedOrigins: input.allowedOrigins ?? [],
+    })
+        .returning();
+    return { ...app, clientSecret };
+}
+export async function findApplicationByClientId(clientId) {
+    const cached = await cache.get(appCacheKey(clientId));
+    if (cached)
+        return cached;
+    const [app] = await db
+        .select()
+        .from(applications)
+        .where(eq(applications.clientId, clientId))
+        .limit(1);
+    if (app)
+        await cache.set(appCacheKey(clientId), app, 60);
+    return app;
+}
+export async function findApplicationsByOrgId(orgId) {
+    return db.select().from(applications).where(eq(applications.orgId, orgId));
+}
+export async function updateApplication(appId, orgId, updates) {
+    const [updated] = await db
+        .update(applications)
+        .set(updates)
+        .where(and(eq(applications.id, appId), eq(applications.orgId, orgId)))
+        .returning();
+    if (updated)
+        await cache.del(appCacheKey(updated.clientId));
+    return updated;
+}
+export async function verifyClientSecret(clientId, secret) {
+    const app = await findApplicationByClientId(clientId);
+    if (!app || !app.isActive)
+        return undefined;
+    if (app.clientSecretHash !== hashClientSecret(secret))
+        return undefined;
+    return app;
+}
+//# sourceMappingURL=applications.js.map

package/dist/services/applications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applications.js","sourceRoot":"","sources":["../../src/services/applications.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAoB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,gBAAgB,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,wEAAwE;AACxE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAOvC;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,oBAAoB,EAAE,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,gBAAgB,EAAE;QAC9C,gBAAgB,EAAE,gBAAgB,CAAC,YAAY,CAAC;QAChD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;KAC3C,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAc,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,GAAG;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAa;IACzD,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,KAAa,EACb,OAME;IAEF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,OAAO,CAAC;SACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;SACrE,SAAS,EAAE,CAAC;IACf,IAAI,OAAO;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,GAAG,CAAC,gBAAgB,KAAK,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/services/audit.d.ts

@@ -0,0 +1,16 @@
+import { auditLog } from "../db/schema.js";
+import type { AuditEventType, EventPayload } from "./events/types.js";
+export type AuditEvent = AuditEventType;
+export interface AuditInput extends EventPayload {
+    event: AuditEvent;
+}
+export declare function audit(input: AuditInput): Promise<void>;
+export declare function listAuditLogs(opts: {
+    orgId?: string;
+    appId?: string;
+    userId?: string;
+    event?: string;
+    limit?: number;
+    offset?: number;
+}): Promise<typeof auditLog.$inferSelect[]>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/services/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/services/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtE,MAAM,MAAM,UAAU,GAAG,cAAc,CAAC;AAExC,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,wBAAsB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5D;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,YAAY,EAAE,CAAC,CAiB1C"}

package/dist/services/audit.js

@@ -0,0 +1,28 @@
+import { eq, and, desc, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { auditLog } from "../db/schema.js";
+import { emit } from "./events/bus.js";
+export async function audit(input) {
+    await emit({ type: input.event, version: 1, payload: input });
+}
+export async function listAuditLogs(opts) {
+    const limit = opts.limit ?? 50;
+    const offset = opts.offset ?? 0;
+    const conditions = [];
+    if (opts.orgId)
+        conditions.push(eq(auditLog.orgId, opts.orgId));
+    if (opts.appId)
+        conditions.push(eq(auditLog.appId, opts.appId));
+    if (opts.userId)
+        conditions.push(eq(auditLog.userId, opts.userId));
+    if (opts.event)
+        conditions.push(eq(auditLog.event, opts.event));
+    return db
+        .select()
+        .from(auditLog)
+        .where(conditions.length ? and(...conditions) : sql `true`)
+        .orderBy(desc(auditLog.createdAt))
+        .limit(limit)
+        .offset(offset);
+}
+//# sourceMappingURL=audit.js.map

package/dist/services/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/services/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AASvC,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,KAAiB;IAC3C,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAOnC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAEhC,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,IAAI,IAAI,CAAC,KAAK;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,KAAK;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,KAAK;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAEhE,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM,CAAC;SACzD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;SACjC,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC"}

package/dist/services/auditExport.d.ts

@@ -0,0 +1,17 @@
+import type { AuditEvent } from "./audit.js";
+export interface AuditExportRecord {
+    event: AuditEvent;
+    userId?: string;
+    orgId?: string;
+    appId?: string;
+    ip?: string;
+    userAgent?: string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+}
+export interface AuditSink {
+    send(record: AuditExportRecord): Promise<void>;
+}
+export declare const auditSinks: AuditSink[];
+export declare function exportAuditRecord(record: AuditExportRecord): Promise<void>;
+//# sourceMappingURL=auditExport.d.ts.map

package/dist/services/auditExport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditExport.d.ts","sourceRoot":"","sources":["../../src/services/auditExport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAoCD,eAAO,MAAM,UAAU,aAAgB,CAAC;AAExC,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhF"}

package/dist/services/auditExport.js

@@ -0,0 +1,37 @@
+import { config } from "../config.js";
+class WebhookSink {
+    url;
+    constructor(url) {
+        this.url = url;
+    }
+    async send(record) {
+        await fetch(this.url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(record),
+        });
+    }
+}
+class ConsoleSink {
+    async send(record) {
+        console.log("[audit-export]", JSON.stringify(record));
+    }
+}
+function createSinks() {
+    const sinks = [];
+    const webhookUrl = config.AUDIT_WEBHOOK_URL || process.env.AUDIT_WEBHOOK_URL;
+    if (webhookUrl) {
+        sinks.push(new WebhookSink(webhookUrl));
+    }
+    if (config.AUDIT_CONSOLE_EXPORT === "true" || process.env.AUDIT_CONSOLE_EXPORT === "true") {
+        sinks.push(new ConsoleSink());
+    }
+    return sinks;
+}
+export const auditSinks = createSinks();
+export async function exportAuditRecord(record) {
+    await Promise.all(auditSinks.map((sink) => sink.send(record).catch((err) => {
+        console.error("[audit-export] sink failed:", err);
+    })));
+}
+//# sourceMappingURL=auditExport.js.map

package/dist/services/auditExport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditExport.js","sourceRoot":"","sources":["../../src/services/auditExport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAkBtC,MAAM,WAAW;IACP,GAAG,CAAS;IAEpB,YAAY,GAAW;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAyB;QAClC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,WAAW;IACf,KAAK,CAAC,IAAI,CAAC,MAAyB;QAClC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;CACF;AAED,SAAS,WAAW;IAClB,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;QAC1F,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,EAAE,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAyB;IAC/D,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAClF,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/services/billing.d.ts

@@ -0,0 +1,23 @@
+export declare function listPlans(): Array<{
+    id: string;
+    name: string;
+    description: string;
+}>;
+export declare function isValidPlan(plan: string): boolean;
+export interface BillingSummary {
+    plan: string;
+    provider?: string;
+    subscription?: Record<string, unknown>;
+    usage?: {
+        users: number;
+        applications: number;
+        logins30d: number;
+        signups30d: number;
+    };
+}
+export declare function getBillingSummary(orgId: string): Promise<BillingSummary>;
+export declare function setOrganizationPlan(orgId: string, plan: string): Promise<{
+    plan: string;
+}>;
+export declare function provisionBillingCustomer(orgId: string, email: string): Promise<Record<string, unknown>>;
+//# sourceMappingURL=billing.d.ts.map

package/dist/services/billing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../../src/services/billing.ts"],"names":[],"mappings":"AAOA,wBAAgB,SAAS,IAAI,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAOpF;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAkC9E;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAShG;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAO7G"}

package/dist/services/billing.js

@@ -0,0 +1,67 @@
+import { eq, and, gte, count } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { organizations, auditLog, orgMemberships, applications } from "../db/schema.js";
+import { getBillingProviderFactory } from "./plugins/registry.js";
+const DEFAULT_PLANS = ["free", "starter", "growth", "enterprise"];
+export function listPlans() {
+    return [
+        { id: "free", name: "Free", description: "Core authentication for small projects." },
+        { id: "starter", name: "Starter", description: "Email delivery, workflows, and API keys." },
+        { id: "growth", name: "Growth", description: "SSO, SCIM, and priority queue workers." },
+        { id: "enterprise", name: "Enterprise", description: "Custom SLAs, dedicated support, and advanced audit." },
+    ];
+}
+export function isValidPlan(plan) {
+    return DEFAULT_PLANS.includes(plan);
+}
+export async function getBillingSummary(orgId) {
+    const [org] = await db.select({ plan: organizations.plan }).from(organizations).where(eq(organizations.id, orgId)).limit(1);
+    if (!org) {
+        throw Object.assign(new Error("Organization not found"), { statusCode: 404 });
+    }
+    const since = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000);
+    const [[memberRow], [appRow], [loginRow], [signupRow]] = await Promise.all([
+        db.select({ total: count() }).from(orgMemberships).where(eq(orgMemberships.orgId, orgId)),
+        db.select({ total: count() }).from(applications).where(eq(applications.orgId, orgId)),
+        db
+            .select({ total: count() })
+            .from(auditLog)
+            .where(and(eq(auditLog.orgId, orgId), eq(auditLog.event, "user_login"), gte(auditLog.createdAt, since))),
+        db
+            .select({ total: count() })
+            .from(auditLog)
+            .where(and(eq(auditLog.orgId, orgId), eq(auditLog.event, "user_registered"), gte(auditLog.createdAt, since))),
+    ]);
+    const usage = {
+        users: memberRow?.total ?? 0,
+        applications: appRow?.total ?? 0,
+        logins30d: loginRow?.total ?? 0,
+        signups30d: signupRow?.total ?? 0,
+    };
+    const factory = getBillingProviderFactory(process.env.KEYSTONE_BILLING_PROVIDER || "none");
+    if (!factory) {
+        return { plan: org.plan, usage };
+    }
+    const provider = factory();
+    const subscription = await provider.getSubscription(orgId).catch(() => null);
+    return { plan: org.plan, provider: provider.name, subscription: subscription ?? undefined, usage };
+}
+export async function setOrganizationPlan(orgId, plan) {
+    if (!isValidPlan(plan)) {
+        throw Object.assign(new Error("Invalid plan"), { statusCode: 400 });
+    }
+    const [org] = await db.update(organizations).set({ plan, updatedAt: new Date() }).where(eq(organizations.id, orgId)).returning();
+    if (!org) {
+        throw Object.assign(new Error("Organization not found"), { statusCode: 404 });
+    }
+    return { plan: org.plan };
+}
+export async function provisionBillingCustomer(orgId, email) {
+    const factory = getBillingProviderFactory(process.env.KEYSTONE_BILLING_PROVIDER || "none");
+    if (!factory) {
+        return { ok: false, reason: "No billing provider configured" };
+    }
+    const provider = factory();
+    return provider.createCustomer(orgId, email);
+}
+//# sourceMappingURL=billing.js.map

package/dist/services/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../../src/services/billing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;AAElE,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,yCAAyC,EAAE;QACpF,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC3F,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE;QACvF,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,qDAAqD,EAAE;KAC7G,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa;IACnD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5H,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzF,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrF,EAAE;aACC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;aAC1B,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1G,EAAE;aACC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;aAC1B,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;KAChH,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,CAAC;QAC5B,YAAY,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;QAChC,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,CAAC;QAC/B,UAAU,EAAE,SAAS,EAAE,KAAK,IAAI,CAAC;KAClC,CAAC;IAEF,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,MAAM,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;IAC3B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;AACrG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,IAAY;IACnE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACjI,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAa,EAAE,KAAa;IACzE,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,MAAM,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;IAC3B,OAAO,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC"}

package/dist/services/cache.d.ts

@@ -0,0 +1,23 @@
+interface CacheMetrics {
+    hits: number;
+    misses: number;
+    sets: number;
+    deletes: number;
+}
+declare class CacheProvider {
+    private redis;
+    private memory;
+    private metrics;
+    private prefix;
+    constructor();
+    private key;
+    get<T>(key: string): Promise<T | null>;
+    set<T>(key: string, value: T, ttlSeconds?: number): Promise<void>;
+    del(key: string): Promise<void>;
+    invalidate(pattern: string): Promise<void>;
+    getMetrics(): CacheMetrics;
+    close(): Promise<void>;
+}
+export declare const cache: CacheProvider;
+export {};
+//# sourceMappingURL=cache.d.ts.map

package/dist/services/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/services/cache.ts"],"names":[],"mappings":"AASA,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,cAAM,aAAa;IACjB,OAAO,CAAC,KAAK,CAAsB;IACnC,OAAO,CAAC,MAAM,CAA0C;IACxD,OAAO,CAAC,OAAO,CAA6D;IAC5E,OAAO,CAAC,MAAM,CAAS;;IAYvB,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IA0BtC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB7D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/B,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBhD,UAAU,IAAI,YAAY;IAIpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAO7B;AAED,eAAO,MAAM,KAAK,eAAsB,CAAC"}