@hilbras/keystone 1.1.0

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+const program = new Command();
+program.name("keystone").description("Hilbras Keystone CLI").version("1.0.0");
+program
+    .command("init")
+    .description("Create a sample .env file for Keystone")
+    .action(async () => {
+    console.log("Keystone init: copy .env.example and configure DATABASE_URL, ZITADEL_DOMAIN, etc.");
+});
+program
+    .command("migrate")
+    .description("Run database migrations")
+    .action(async () => {
+    const { migrate } = await import("drizzle-orm/postgres-js/migrator");
+    const { db } = await import("./db/index.js");
+    const path = await import("node:path");
+    const { fileURLToPath } = await import("node:url");
+    const __dirname = path.dirname(fileURLToPath(import.meta.url));
+    await migrate(db, { migrationsFolder: path.resolve(__dirname, "./db/migrations") });
+    console.log("Migrations applied");
+});
+program
+    .command("keys:create")
+    .description("Generate a JWT signing key pair")
+    .action(async () => {
+    const { generateKeyPair, exportPKCS8, exportSPKI } = await import("jose");
+    const pair = await generateKeyPair("RS256", { extractable: true });
+    const privateKey = await exportPKCS8(pair.privateKey);
+    const publicKey = await exportSPKI(pair.publicKey);
+    console.log("JWT_PRIVATE_KEY=");
+    console.log(privateKey);
+    console.log("JWT_PUBLIC_KEY=");
+    console.log(publicKey);
+});
+program
+    .command("secrets:rotate")
+    .description("Rotate the active JWT signing key")
+    .action(async () => {
+    const { rotateSigningKeys } = await import("./services/secrets/index.js");
+    const pair = await rotateSigningKeys();
+    console.log(`Rotated signing key. New key id: ${pair.keyId}`);
+});
+program
+    .command("user:create")
+    .description("Create a local user account")
+    .requiredOption("--email <email>", "User email")
+    .requiredOption("--password <password>", "User password")
+    .option("--username <username>", "Username")
+    .option("--name <name>", "Display name")
+    .option("--role <role>", "Role (e.g. owner, admin, member)", "member")
+    .action(async (options) => {
+    const { initializeContainer } = await import("./di.js");
+    const { AuthenticationDomainService } = await import("./services/domain/index.js");
+    const { db } = await import("./db/index.js");
+    const { users } = await import("./db/schema.js");
+    const { eq } = await import("drizzle-orm");
+    const container = initializeContainer();
+    const authService = new AuthenticationDomainService(container.userRepository, container.applicationRepository);
+    const result = await authService.register({
+        email: options.email,
+        password: options.password,
+        username: options.username ||
+            options.email.split("@")[0].toLowerCase().replace(/[^a-z0-9_-]/g, "-").slice(0, 32),
+        name: options.name,
+    });
+    if (!result.success) {
+        console.error(`Failed to create user: ${result.error.message}`);
+        process.exit(1);
+    }
+    if (options.role !== "member") {
+        await db.update(users).set({ role: options.role }).where(eq(users.id, result.data.user.id));
+    }
+    console.log(`Created user ${result.data.user.id} (${result.data.user.email}) with role ${options.role}`);
+});
+program
+    .command("org:create")
+    .description("Create a new organization")
+    .requiredOption("--name <name>", "Organization name")
+    .option("--slug <slug>", "Organization slug")
+    .option("--plan <plan>", "Billing plan", "free")
+    .option("--owner-email <email>", "Owner email")
+    .action(async (options) => {
+    const { initializeContainer } = await import("./di.js");
+    const { OrganizationDomainService } = await import("./services/domain/index.js");
+    const { DrizzleUserRepository, DrizzleOrganizationRepository } = await import("./repositories/index.js");
+    const container = initializeContainer();
+    const orgService = new OrganizationDomainService(container.organizationRepository, container.applicationRepository, container.userRepository);
+    const orgResult = await orgService.createOrganization({
+        name: options.name,
+        slug: options.slug,
+        plan: options.plan,
+    });
+    if (!orgResult.success) {
+        console.error(`Failed to create organization: ${orgResult.error.message}`);
+        process.exit(1);
+    }
+    const org = orgResult.data;
+    if (options.ownerEmail) {
+        const users = new DrizzleUserRepository();
+        const owner = await users.findByEmail(options.ownerEmail);
+        if (owner) {
+            const orgs = new DrizzleOrganizationRepository();
+            await orgs.addMembership({
+                orgId: org.id,
+                userId: owner.id,
+                role: "owner",
+            });
+        }
+        else {
+            console.warn(`Owner email ${options.ownerEmail} not found; organization created without owner`);
+        }
+    }
+    console.log(`Created organization ${org.id} (${org.slug})`);
+});
+program
+    .command("keys:list")
+    .description("List active JWT signing keys")
+    .action(async () => {
+    const { listActiveSigningKeys } = await import("./services/secrets/index.js");
+    const keys = await listActiveSigningKeys();
+    for (const key of keys) {
+        console.log(`${key.keyId}\tcreated=${key.createdAt.toISOString()}\texpires=${key.expiresAt?.toISOString() ?? "never"}`);
+    }
+});
+program
+    .command("config:validate")
+    .description("Validate required configuration and print status")
+    .action(async () => {
+    const { config } = await import("./config.js");
+    const required = ["DATABASE_URL"];
+    const missing = required.filter((name) => !process.env[name]);
+    if (missing.length > 0) {
+        console.error(`Missing required environment variables: ${missing.join(", ")}`);
+        process.exit(1);
+    }
+    console.log("Configuration OK");
+    console.log(`  DATABASE_URL: ${config.DATABASE_URL.replace(/\/\/.*@/, "//***@")}`);
+    console.log(`  REDIS_URL: ${config.REDIS_URL.replace(/\/\/.*@/, "//***@")}`);
+    console.log(`  Queue provider: ${config.KEYSTONE_QUEUE_PROVIDER || "auto"}`);
+    console.log(`  Secrets provider: ${config.KEYSTONE_SECRETS_PROVIDER}`);
+});
+program.parse();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9E,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wCAAwC,CAAC;KACrD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,yBAAyB,CAAC;KACtC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,iCAAiC,CAAC;KAC9C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,oCAAoC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,6BAA6B,CAAC;KAC1C,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC;KAC/C,cAAc,CAAC,uBAAuB,EAAE,eAAe,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,UAAU,CAAC;KAC3C,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC;KACvC,MAAM,CAAC,eAAe,EAAE,kCAAkC,EAAE,QAAQ,CAAC;KACrE,MAAM,CACL,KAAK,EAAE,OAMN,EAAE,EAAE;IACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACnF,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAE3C,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,2BAA2B,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EACN,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACrF,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,eAAe,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3G,CAAC,CACF,CAAC;AAEJ,OAAO;KACJ,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,2BAA2B,CAAC;KACxC,cAAc,CAAC,eAAe,EAAE,mBAAmB,CAAC;KACpD,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;KAC5C,MAAM,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC;KAC/C,MAAM,CAAC,uBAAuB,EAAE,aAAa,CAAC;KAC9C,MAAM,CAAC,KAAK,EAAE,OAA2E,EAAE,EAAE;IAC5F,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACjF,MAAM,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CAC3E,yBAAyB,CAC1B,CAAC;IACF,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAC9C,SAAS,CAAC,sBAAsB,EAChC,SAAS,CAAC,qBAAqB,EAC/B,SAAS,CAAC,cAAc,CACzB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC;QACpD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,kCAAkC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,IAAI,6BAA6B,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,aAAa,CAAC;gBACvB,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,MAAM,EAAE,KAAK,CAAC,EAAE;gBAChB,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,UAAU,gDAAgD,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,aAAa,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,aAAa,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;IAC1H,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,uBAAuB,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,68 @@
+export declare const config: {
+    readonly NODE_ENV: string;
+    readonly PORT: number;
+    readonly HOST: string;
+    readonly DATABASE_URL: string;
+    readonly REDIS_URL: string;
+    readonly ZITADEL_DOMAIN: string;
+    readonly ZITADEL_ORG_ID: string;
+    readonly ZITADEL_PROJECT_ID: string;
+    readonly ZITADEL_SERVICE_CLIENT_ID: string;
+    readonly ZITADEL_SERVICE_CLIENT_SECRET: string;
+    readonly ZITADEL_SERVICE_PAT: string;
+    readonly ZITADEL_CLIENT_ID: string;
+    readonly ZITADEL_CLIENT_SECRET: string;
+    readonly ZITADEL_GOOGLE_IDP_ID: string;
+    readonly ZITADEL_GITHUB_IDP_ID: string;
+    readonly COOKIE_NAME: string;
+    readonly COOKIE_DOMAIN: string;
+    readonly COOKIE_SECURE: boolean;
+    readonly COOKIE_SAME_SITE: "strict" | "lax" | "none";
+    readonly AUTH_API_PUBLIC_URL: string;
+    readonly ACCESS_TOKEN_TTL_SECONDS: number;
+    readonly REFRESH_TOKEN_TTL_SECONDS: number;
+    readonly JWT_PRIVATE_KEY: string;
+    readonly JWT_PUBLIC_KEY: string;
+    readonly KEYSTONE_ENCRYPTION_KEY: string;
+    readonly KEYSTONE_SECRETS_PROVIDER: string;
+    readonly KEYSTONE_QUEUE_PROVIDER: string;
+    readonly CACHE_KEY_PREFIX: string;
+    readonly KEYSTONE_PLUGINS: string;
+    readonly INTERNAL_API_KEY: string;
+    readonly SEED_OWNER_EMAIL: string;
+    readonly ALLOWED_ORIGINS: string[];
+    readonly RATE_LIMIT_ATTEMPTS: number;
+    readonly RATE_LIMIT_WINDOW_SECONDS: number;
+    readonly GLOBAL_RATE_LIMIT_MAX: number;
+    readonly GLOBAL_RATE_LIMIT_WINDOW: number;
+    readonly ACCOUNT_LOCKOUT_THRESHOLD: number;
+    readonly ACCOUNT_LOCKOUT_DURATION_SECONDS: number;
+    readonly HIBP_CHECK_ENABLED: boolean;
+    readonly EMAIL_VERIFICATION_REQUIRED: boolean;
+    readonly MAGIC_LINK_TTL_SECONDS: number;
+    readonly OAUTH_CODE_TTL_SECONDS: number;
+    readonly TOTP_ISSUER: string;
+    readonly TOTP_ENCRYPTION_KEY: string;
+    readonly EMAIL_PROVIDER: string;
+    readonly EMAIL_FROM: string;
+    readonly SMTP_HOST: string;
+    readonly SMTP_PORT: number;
+    readonly SMTP_USER: string;
+    readonly SMTP_PASS: string;
+    readonly SMTP_SECURE: boolean;
+    readonly SENDGRID_API_KEY: string;
+    readonly MAILGUN_API_KEY: string;
+    readonly MAILGUN_DOMAIN: string;
+    readonly SMS_PROVIDER: string;
+    readonly TWILIO_ACCOUNT_SID: string;
+    readonly TWILIO_AUTH_TOKEN: string;
+    readonly TWILIO_FROM_NUMBER: string;
+    readonly TWILIO_MESSAGING_SERVICE_SID: string;
+    readonly OTEL_EXPORTER_OTLP_ENDPOINT: string;
+    readonly AUDIT_WEBHOOK_URL: string;
+    readonly AUDIT_CONSOLE_EXPORT: string;
+    readonly WEBHOOK_SIGNING_SECRET: string;
+};
+export declare function zitadelBaseUrl(): string;
+export declare function isZitadelConfigured(): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkCA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;+BA6BsG,QAAQ,GAAG,KAAK,GAAG,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmExI,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}

package/dist/config.js

@@ -0,0 +1,118 @@
+import dotenv from "dotenv";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+dotenv.config({ path: path.resolve(__dirname, "../.env") });
+dotenv.config();
+function getEnv(name, fallback = "") {
+    return process.env[name] ?? fallback;
+}
+function requireEnv(name) {
+    const value = process.env[name];
+    if (!value) {
+        throw new Error(`Missing required environment variable: ${name}`);
+    }
+    return value;
+}
+function requireEnvUnlessSetup(name) {
+    const value = process.env[name];
+    if (!value && process.env.KEYSTONE_SETUP_MODE !== "true") {
+        throw new Error(`Missing required environment variable: ${name}`);
+    }
+    return value || "";
+}
+function getList(name) {
+    const value = process.env[name];
+    if (!value)
+        return [];
+    return value.split(",").map((s) => s.trim()).filter(Boolean);
+}
+export const config = {
+    NODE_ENV: getEnv("NODE_ENV", "development"),
+    PORT: Number(getEnv("PORT", "4001")),
+    HOST: getEnv("HOST", "0.0.0.0"),
+    DATABASE_URL: requireEnvUnlessSetup("DATABASE_URL"),
+    REDIS_URL: getEnv("REDIS_URL", "redis://localhost:6379"),
+    // Zitadel is now an optional identity connector, not a hard dependency.
+    ZITADEL_DOMAIN: getEnv("ZITADEL_DOMAIN"),
+    ZITADEL_ORG_ID: getEnv("ZITADEL_ORG_ID"),
+    ZITADEL_PROJECT_ID: getEnv("ZITADEL_PROJECT_ID"),
+    // Service account used to call Zitadel management/user APIs.
+    ZITADEL_SERVICE_CLIENT_ID: getEnv("ZITADEL_SERVICE_CLIENT_ID"),
+    ZITADEL_SERVICE_CLIENT_SECRET: getEnv("ZITADEL_SERVICE_CLIENT_SECRET"),
+    ZITADEL_SERVICE_PAT: getEnv("ZITADEL_SERVICE_PAT"),
+    // Keystone OIDC app registered in Zitadel (for OAuth callbacks).
+    ZITADEL_CLIENT_ID: getEnv("ZITADEL_CLIENT_ID"),
+    ZITADEL_CLIENT_SECRET: getEnv("ZITADEL_CLIENT_SECRET"),
+    // Optional IdP IDs to skip the Zitadel login selector and go straight to Google/GitHub.
+    ZITADEL_GOOGLE_IDP_ID: getEnv("ZITADEL_GOOGLE_IDP_ID"),
+    ZITADEL_GITHUB_IDP_ID: getEnv("ZITADEL_GITHUB_IDP_ID"),
+    COOKIE_NAME: getEnv("COOKIE_NAME", "__Host-keystone-session"),
+    COOKIE_DOMAIN: getEnv("COOKIE_DOMAIN", ".local.hilbras.ai"),
+    COOKIE_SECURE: getEnv("COOKIE_SECURE", "false") === "true",
+    COOKIE_SAME_SITE: getEnv("COOKIE_SAME_SITE", getEnv("NODE_ENV", "development") === "production" ? "strict" : "lax"),
+    AUTH_API_PUBLIC_URL: getEnv("AUTH_API_PUBLIC_URL"),
+    ACCESS_TOKEN_TTL_SECONDS: Number(getEnv("JWT_ACCESS_TOKEN_TTL", "900")),
+    REFRESH_TOKEN_TTL_SECONDS: Number(getEnv("JWT_REFRESH_TOKEN_TTL", "604800")),
+    // RSA PEM keys. If not provided, a new key pair is generated at startup (dev only).
+    JWT_PRIVATE_KEY: getEnv("JWT_PRIVATE_KEY"),
+    JWT_PUBLIC_KEY: getEnv("JWT_PUBLIC_KEY"),
+    // Optional master encryption key. If omitted, a random key is stored in the secrets table (dev only).
+    KEYSTONE_ENCRYPTION_KEY: getEnv("KEYSTONE_ENCRYPTION_KEY"),
+    // Secrets provider: "database" (default) or "environment".
+    KEYSTONE_SECRETS_PROVIDER: getEnv("KEYSTONE_SECRETS_PROVIDER", "database"),
+    // Queue provider: "in-process" (default/fallback), "bullmq", or "" to auto-select bullmq when REDIS_URL is set.
+    KEYSTONE_QUEUE_PROVIDER: getEnv("KEYSTONE_QUEUE_PROVIDER", "in-process"),
+    // Cache key prefix for Redis/in-memory cache entries.
+    CACHE_KEY_PREFIX: getEnv("CACHE_KEY_PREFIX", "keystone:"),
+    // Comma-separated list of plugin module paths to load at startup.
+    KEYSTONE_PLUGINS: getEnv("KEYSTONE_PLUGINS"),
+    INTERNAL_API_KEY: getEnv("KEYSTONE_INTERNAL_API_KEY") || getEnv("HILBRAS_INTERNAL_API_KEY", ""),
+    SEED_OWNER_EMAIL: getEnv("KEYSTONE_SEED_OWNER_EMAIL"),
+    ALLOWED_ORIGINS: getList("ALLOWED_ORIGINS"),
+    RATE_LIMIT_ATTEMPTS: Number(getEnv("RATE_LIMIT_ATTEMPTS", "5")),
+    RATE_LIMIT_WINDOW_SECONDS: Number(getEnv("RATE_LIMIT_WINDOW_SECONDS", "900")),
+    GLOBAL_RATE_LIMIT_MAX: Number(getEnv("GLOBAL_RATE_LIMIT_MAX", "100")),
+    GLOBAL_RATE_LIMIT_WINDOW: Number(getEnv("GLOBAL_RATE_LIMIT_WINDOW", "60")),
+    ACCOUNT_LOCKOUT_THRESHOLD: Number(getEnv("ACCOUNT_LOCKOUT_THRESHOLD", "5")),
+    ACCOUNT_LOCKOUT_DURATION_SECONDS: Number(getEnv("ACCOUNT_LOCKOUT_DURATION_SECONDS", "1800")),
+    HIBP_CHECK_ENABLED: getEnv("HIBP_CHECK_ENABLED", "false") === "true",
+    // When true, new registrations start unverified and a verification email
+    // is sent automatically; login still works but emailVerified stays false
+    // until the user clicks the link.
+    EMAIL_VERIFICATION_REQUIRED: getEnv("EMAIL_VERIFICATION_REQUIRED", "false") === "true",
+    MAGIC_LINK_TTL_SECONDS: Number(getEnv("MAGIC_LINK_TTL_SECONDS", "900")),
+    OAUTH_CODE_TTL_SECONDS: Number(getEnv("OAUTH_CODE_TTL_SECONDS", "60")),
+    TOTP_ISSUER: getEnv("TOTP_ISSUER", "Hilbras"),
+    TOTP_ENCRYPTION_KEY: getEnv("KEYSTONE_TOTP_ENCRYPTION_KEY"),
+    EMAIL_PROVIDER: getEnv("EMAIL_PROVIDER", "none"),
+    EMAIL_FROM: getEnv("EMAIL_FROM", "keystone@local.hilbras.ai"),
+    SMTP_HOST: getEnv("SMTP_HOST"),
+    SMTP_PORT: Number(getEnv("SMTP_PORT", "587")),
+    SMTP_USER: getEnv("SMTP_USER"),
+    SMTP_PASS: getEnv("SMTP_PASS"),
+    SMTP_SECURE: getEnv("SMTP_SECURE", "false") === "true",
+    SENDGRID_API_KEY: getEnv("SENDGRID_API_KEY"),
+    MAILGUN_API_KEY: getEnv("MAILGUN_API_KEY"),
+    MAILGUN_DOMAIN: getEnv("MAILGUN_DOMAIN"),
+    SMS_PROVIDER: getEnv("SMS_PROVIDER", "none"),
+    TWILIO_ACCOUNT_SID: getEnv("TWILIO_ACCOUNT_SID"),
+    TWILIO_AUTH_TOKEN: getEnv("TWILIO_AUTH_TOKEN"),
+    TWILIO_FROM_NUMBER: getEnv("TWILIO_FROM_NUMBER"),
+    TWILIO_MESSAGING_SERVICE_SID: getEnv("TWILIO_MESSAGING_SERVICE_SID"),
+    OTEL_EXPORTER_OTLP_ENDPOINT: getEnv("OTEL_EXPORTER_OTLP_ENDPOINT"),
+    AUDIT_WEBHOOK_URL: getEnv("AUDIT_WEBHOOK_URL"),
+    AUDIT_CONSOLE_EXPORT: getEnv("AUDIT_CONSOLE_EXPORT", "false"),
+    WEBHOOK_SIGNING_SECRET: getEnv("WEBHOOK_SIGNING_SECRET") || getEnv("KEYSTONE_WEBHOOK_SIGNING_SECRET"),
+};
+export function zitadelBaseUrl() {
+    if (!config.ZITADEL_DOMAIN) {
+        throw new Error("Zitadel is not configured");
+    }
+    const domain = config.ZITADEL_DOMAIN.replace(/\/$/, "");
+    return domain.startsWith("http") ? domain : `https://${domain}`;
+}
+export function isZitadelConfigured() {
+    return Boolean(config.ZITADEL_DOMAIN && config.ZITADEL_CLIENT_ID);
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,MAAM,CAAC,IAAY,EAAE,QAAQ,GAAG,EAAE;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACvC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;IAE/B,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAExD,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAEhD,6DAA6D;IAC7D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAC9D,6BAA6B,EAAE,MAAM,CAAC,+BAA+B,CAAC;IACtE,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAElD,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,wFAAwF;IACxF,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACtD,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,yBAAyB,CAAC;IAC7D,aAAa,EAAE,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC3D,aAAa,EAAE,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,MAAM;IAC1D,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAA8B;IAEhJ,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACvE,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IAE5E,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IAExC,sGAAsG;IACtG,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,CAAC;IAE1D,2DAA2D;IAC3D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,EAAE,UAAU,CAAC;IAE1E,gHAAgH;IAChH,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC;IAExE,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC;IAEzD,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAE5C,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,CAAC;IAE/F,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAErD,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAE3C,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC7E,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IACrE,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAE1E,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAC3E,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAE5F,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,MAAM;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IACtF,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IACvE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC;IAC7C,mBAAmB,EAAE,MAAM,CAAC,8BAA8B,CAAC;IAC3D,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;IAC7D,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,MAAM;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC;IAC5C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,4BAA4B,EAAE,MAAM,CAAC,8BAA8B,CAAC;IACpE,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,CAAC;IAClE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,oBAAoB,EAAE,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAC7D,sBAAsB,EAAE,MAAM,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,iCAAiC,CAAC;CAC7F,CAAC;AAEX,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACpE,CAAC"}

package/dist/container.d.ts

@@ -0,0 +1,27 @@
+import type { ConfigurationService } from "./services/configuration.js";
+import type { FeatureFlagService } from "./services/features.js";
+import type { UserRepository, OrganizationRepository, ApplicationRepository, AuditRepository, IdentityRepository, PermissionRepository } from "./repositories/types.js";
+import type { ApiKeyRepository } from "./repositories/apiKey.js";
+import type { SamlConnectionRepository } from "./repositories/samlConnection.js";
+import type { OidcConnectionRepository } from "./repositories/oidcConnection.js";
+import type { SecretsProvider } from "./services/secrets/provider.js";
+import type { Queue } from "./services/queue/types.js";
+export interface Container {
+    config: ConfigurationService;
+    features: FeatureFlagService;
+    userRepository: UserRepository;
+    identityRepository: IdentityRepository;
+    organizationRepository: OrganizationRepository;
+    applicationRepository: ApplicationRepository;
+    auditRepository: AuditRepository;
+    permissionRepository: PermissionRepository;
+    apiKeyRepository: ApiKeyRepository;
+    samlConnectionRepository: SamlConnectionRepository;
+    oidcConnectionRepository: OidcConnectionRepository;
+    secretsProvider: SecretsProvider;
+    queue: Queue;
+}
+export declare function setContainer(container: Container): void;
+export declare function getContainer(): Container;
+export declare function resolve<K extends keyof Container>(key: K): Container[K];
+//# sourceMappingURL=container.d.ts.map

package/dist/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,eAAe,EAAE,eAAe,CAAC;IACjC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,wBAAwB,EAAE,wBAAwB,CAAC;IACnD,wBAAwB,EAAE,wBAAwB,CAAC;IACnD,eAAe,EAAE,eAAe,CAAC;IACjC,KAAK,EAAE,KAAK,CAAC;CACd;AAID,wBAAgB,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAEvD;AAED,wBAAgB,YAAY,IAAI,SAAS,CAKxC;AAED,wBAAgB,OAAO,CAAC,CAAC,SAAS,MAAM,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAEvE"}

package/dist/container.js

@@ -0,0 +1,14 @@
+let globalContainer = null;
+export function setContainer(container) {
+    globalContainer = container;
+}
+export function getContainer() {
+    if (!globalContainer) {
+        throw new Error("DI container has not been initialized");
+    }
+    return globalContainer;
+}
+export function resolve(key) {
+    return getContainer()[key];
+}
+//# sourceMappingURL=container.js.map

package/dist/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAgCA,IAAI,eAAe,GAAqB,IAAI,CAAC;AAE7C,MAAM,UAAU,YAAY,CAAC,SAAoB;IAC/C,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,OAAO,CAA4B,GAAM;IACvD,OAAO,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/db/index.d.ts

@@ -0,0 +1,17 @@
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import * as schema from "./schema.js";
+/**
+ * Live binding for the Drizzle database client. Re-assigned by `initDb()` once
+ * DATABASE_URL is known. ES module imports see the updated value, so existing
+ * code that imports `db` continues to work after configuration changes.
+ */
+export declare let db: PostgresJsDatabase<typeof schema>;
+export declare function initDb(): void;
+export declare function getDb(): PostgresJsDatabase<typeof schema>;
+/**
+ * Close the underlying connection pool. Used on graceful shutdown and in tests
+ * so pooled sockets do not keep the Node process alive after work is done.
+ */
+export declare function closeDb(): Promise<void>;
+export { schema };
+//# sourceMappingURL=index.d.ts.map

package/dist/db/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAItC;;;;GAIG;AACH,eAAO,IAAI,EAAE,EAAE,kBAAkB,CAAC,OAAO,MAAM,CAAC,CAAC;AAEjD,wBAAgB,MAAM,IAAI,IAAI,CAU7B;AAED,wBAAgB,KAAK,IAAI,kBAAkB,CAAC,OAAO,MAAM,CAAC,CAKzD;AAED;;;GAGG;AACH,wBAAsB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAM7C;AAED,OAAO,EAAE,MAAM,EAAE,CAAC"}

package/dist/db/index.js

@@ -0,0 +1,46 @@
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+import { config } from "../config.js";
+import * as schema from "./schema.js";
+let dbClient = null;
+/**
+ * Live binding for the Drizzle database client. Re-assigned by `initDb()` once
+ * DATABASE_URL is known. ES module imports see the updated value, so existing
+ * code that imports `db` continues to work after configuration changes.
+ */
+export let db;
+export function initDb() {
+    const databaseUrl = config.DATABASE_URL;
+    if (!databaseUrl) {
+        throw new Error("DATABASE_URL is not configured");
+    }
+    if (dbClient) {
+        dbClient.end().catch(() => { });
+    }
+    dbClient = postgres(databaseUrl, { max: 10 });
+    db = drizzle(dbClient, { schema });
+}
+export function getDb() {
+    if (!db) {
+        initDb();
+    }
+    return db;
+}
+/**
+ * Close the underlying connection pool. Used on graceful shutdown and in tests
+ * so pooled sockets do not keep the Node process alive after work is done.
+ */
+export async function closeDb() {
+    if (dbClient) {
+        const client = dbClient;
+        dbClient = null;
+        await client.end({ timeout: 5 });
+    }
+}
+export { schema };
+// Initialize immediately when DATABASE_URL is available so existing code paths
+// keep working without an explicit initDb() call.
+if (config.DATABASE_URL) {
+    initDb();
+}
+//# sourceMappingURL=index.js.map

package/dist/db/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,IAAI,QAAQ,GAAwB,IAAI,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,IAAI,EAAqC,CAAC;AAEjD,MAAM,UAAU,MAAM;IACpB,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9C,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,KAAK;IACnB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,EAAE,CAAC;IACX,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC;QACxB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,OAAO,EAAE,MAAM,EAAE,CAAC;AAElB,+EAA+E;AAC/E,kDAAkD;AAClD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC;AACX,CAAC"}