@hilbras/keystone 1.1.0

package/dist/services/emailVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailVerification.js","sourceRoot":"","sources":["../../src/services/emailVerification.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAa,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW;AAEnD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,SAAiB;IAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,uBAAuB,CAAC;SAC/B,MAAM,CAAC;QACN,MAAM;QACN,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,GAAG,IAAI,CAAC;KAC3D,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAa;IAC1D,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,CAAC,EAChD,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,CAAC,EAC1C,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CACvC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE/G,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SAC5C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;SAClC,SAAS,EAAE,CAAC;IAEf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACnE,OAAO,GAAG,IAAI,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAyD;IACnG,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,yBAAyB,EAAE,CAAC;IACzD,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAEjD,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,aAAa,CAAC,IAAI,CAAC;QACvB,EAAE,EAAE,IAAI,CAAC,KAAK;QACd,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,wEAAwE,GAAG,oCAAoC;QAC1J,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,iEAAiE,GAAG,sDAAsD;KACzK,CAAC,CAAC;AACL,CAAC"}

package/dist/services/enterpriseSso.d.ts

@@ -0,0 +1,34 @@
+import { type Organization } from "../db/schema.js";
+export interface EnterpriseUserClaims {
+    email: string;
+    name?: string;
+    username?: string;
+    externalId?: string;
+}
+export declare function provisionEnterpriseUser(orgId: string, claims: EnterpriseUserClaims, defaultRole?: "owner" | "admin" | "member"): Promise<{
+    id: string;
+    name: string | null;
+    plan: string;
+    createdAt: Date;
+    updatedAt: Date;
+    zitadelUserId: string | null;
+    email: string;
+    username: string;
+    avatarUrl: string | null;
+    emailVerified: boolean;
+    emailVerifiedToken: string | null;
+    provider: string;
+    role: string;
+    defaultOrgId: string | null;
+    phoneNumber: string | null;
+    phoneVerified: boolean;
+    metadata: unknown;
+    passwordHash: string | null;
+    totpSecret: string | null;
+    totpEnabled: boolean;
+    totpVerifiedAt: Date | null;
+    failedLoginAttempts: number;
+    lockedUntil: Date | null;
+}>;
+export declare function defaultRoleForOrg(_org: Organization): "owner" | "admin" | "member";
+//# sourceMappingURL=enterpriseSso.d.ts.map

package/dist/services/enterpriseSso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterpriseSso.d.ts","sourceRoot":"","sources":["../../src/services/enterpriseSso.ts"],"names":[],"mappings":"AAEA,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,oBAAoB,EAC5B,WAAW,GAAE,OAAO,GAAG,OAAO,GAAG,QAAmB;;;;;;;;;;;;;;;;;;;;;;;;GAqCrD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAGlF"}

package/dist/services/enterpriseSso.js

@@ -0,0 +1,40 @@
+import { eq } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { users, orgMemberships } from "../db/schema.js";
+import { slugifyUsername, ensureUniqueUsername } from "./users.js";
+export async function provisionEnterpriseUser(orgId, claims, defaultRole = "member") {
+    const email = claims.email.toLowerCase().trim();
+    let [user] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+    if (!user) {
+        const baseUsername = claims.username || claims.email.split("@")[0];
+        const username = await ensureUniqueUsername(slugifyUsername(baseUsername));
+        [user] = await db
+            .insert(users)
+            .values({
+            email,
+            username,
+            name: claims.name || username,
+            provider: "enterprise_sso",
+            emailVerified: true,
+        })
+            .returning();
+    }
+    const [existingMembership] = await db
+        .select()
+        .from(orgMemberships)
+        .where(eq(orgMemberships.userId, user.id))
+        .limit(1);
+    if (!existingMembership) {
+        await db.insert(orgMemberships).values({
+            orgId,
+            userId: user.id,
+            role: defaultRole,
+        });
+    }
+    return user;
+}
+export function defaultRoleForOrg(_org) {
+    // Future: allow org-level default SSO role configuration.
+    return "member";
+}
+//# sourceMappingURL=enterpriseSso.js.map

package/dist/services/enterpriseSso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterpriseSso.js","sourceRoot":"","sources":["../../src/services/enterpriseSso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAqB,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AASnE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,MAA4B,EAC5B,cAA4C,QAAQ;IAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAE3E,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACd,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC;YACN,KAAK;YACL,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;YAC7B,QAAQ,EAAE,gBAAgB;YAC1B,aAAa,EAAE,IAAI;SACpB,CAAC;aACD,SAAS,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAG,MAAM,EAAE;SAClC,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;SACzC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;YACrC,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,0DAA0D;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/services/events/bus.d.ts

@@ -0,0 +1,9 @@
+import type { KeystoneEvent, EventHandler, EventPayload } from "./types.js";
+export declare function subscribe(eventType: string, handler: EventHandler): () => void;
+export declare function subscribeAll(handler: EventHandler): () => void;
+export type EmittableEvent = Omit<KeystoneEvent, "timestamp" | "version"> & {
+    version?: number;
+};
+export declare function emit(event: EmittableEvent): Promise<void>;
+export declare function buildEvent(type: string, payload: EventPayload): EmittableEvent;
+//# sourceMappingURL=bus.d.ts.map

package/dist/services/events/bus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bus.d.ts","sourceRoot":"","sources":["../../../src/services/events/bus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM5E,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,MAAM,IAAI,CAQ9E;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,IAAI,CAM9D;AAED,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,SAAS,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,wBAAsB,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAY/D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,cAAc,CAE9E"}

package/dist/services/events/bus.js

@@ -0,0 +1,36 @@
+import { normalizeEvent } from "./validate.js";
+const subscribers = new Map();
+const allSubscribers = [];
+export function subscribe(eventType, handler) {
+    const list = subscribers.get(eventType) ?? [];
+    list.push(handler);
+    subscribers.set(eventType, list);
+    return () => {
+        const updated = subscribers.get(eventType)?.filter((h) => h !== handler) ?? [];
+        subscribers.set(eventType, updated);
+    };
+}
+export function subscribeAll(handler) {
+    allSubscribers.push(handler);
+    return () => {
+        const idx = allSubscribers.indexOf(handler);
+        if (idx >= 0)
+            allSubscribers.splice(idx, 1);
+    };
+}
+export async function emit(event) {
+    const fullEvent = normalizeEvent(event);
+    const handlers = [...allSubscribers, ...(subscribers.get(fullEvent.type) ?? [])];
+    await Promise.all(handlers.map(async (handler) => {
+        try {
+            await handler(fullEvent);
+        }
+        catch (err) {
+            console.error(`[event-bus] handler failed for ${fullEvent.type}:`, err);
+        }
+    }));
+}
+export function buildEvent(type, payload) {
+    return { type, payload };
+}
+//# sourceMappingURL=bus.js.map

package/dist/services/events/bus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bus.js","sourceRoot":"","sources":["../../../src/services/events/bus.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;AACtD,MAAM,cAAc,GAAmB,EAAE,CAAC;AAE1C,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,OAAqB;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACjC,OAAO,GAAG,EAAE;QACV,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/E,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAqB;IAChD,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,GAAG,EAAE;QACV,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,GAAG,IAAI,CAAC;YAAE,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,KAAqB;IAC9C,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,SAAS,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAqB;IAC5D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/services/events/subscribers/anomaly.d.ts

@@ -0,0 +1,3 @@
+import type { KeystoneEvent } from "../types.js";
+export declare function anomalySubscriber(event: KeystoneEvent): Promise<void>;
+//# sourceMappingURL=anomaly.d.ts.map

package/dist/services/events/subscribers/anomaly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomaly.d.ts","sourceRoot":"","sources":["../../../../src/services/events/subscribers/anomaly.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3E"}

package/dist/services/events/subscribers/anomaly.js

@@ -0,0 +1,13 @@
+import { recordFailedLogin, recordNewDevice } from "../../anomalyDetection.js";
+export async function anomalySubscriber(event) {
+    if (event.type === "user_login_failed") {
+        const identifier = event.payload.userId || event.payload.metadata?.email || event.payload.ip || "unknown";
+        await recordFailedLogin(String(identifier));
+    }
+    if (event.type === "new_device_detected") {
+        const userId = event.payload.userId;
+        if (userId)
+            await recordNewDevice(userId);
+    }
+}
+//# sourceMappingURL=anomaly.js.map

package/dist/services/events/subscribers/anomaly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomaly.js","sourceRoot":"","sources":["../../../../src/services/events/subscribers/anomaly.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAoB;IAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;QAC1G,MAAM,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,IAAI,MAAM;YAAE,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC"}

package/dist/services/events/subscribers/auditLog.d.ts

@@ -0,0 +1,3 @@
+import type { KeystoneEvent } from "../types.js";
+export declare function auditLogSubscriber(event: KeystoneEvent): Promise<void>;
+//# sourceMappingURL=auditLog.d.ts.map

package/dist/services/events/subscribers/auditLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditLog.d.ts","sourceRoot":"","sources":["../../../../src/services/events/subscribers/auditLog.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB5E"}

package/dist/services/events/subscribers/auditLog.js

@@ -0,0 +1,21 @@
+import { db } from "../../../db/index.js";
+import { auditLog } from "../../../db/schema.js";
+export async function auditLogSubscriber(event) {
+    try {
+        const { userId, orgId, appId, requestId, ip, userAgent, metadata } = event.payload;
+        await db.insert(auditLog).values({
+            userId: userId ?? null,
+            orgId: orgId ?? null,
+            appId: appId ?? null,
+            requestId: requestId ?? null,
+            event: `${event.type}:v${event.version}`,
+            ipAddress: ip ?? null,
+            userAgent: userAgent ?? null,
+            metadata: { ...(metadata ?? {}), eventVersion: event.version },
+        });
+    }
+    catch (err) {
+        console.error("[audit-log-subscriber] failed to write event:", err);
+    }
+}
+//# sourceMappingURL=auditLog.js.map

package/dist/services/events/subscribers/auditLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../../../src/services/events/subscribers/auditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAoB;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACnF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC/B,MAAM,EAAE,MAAM,IAAI,IAAI;YACtB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;YACxC,SAAS,EAAE,EAAE,IAAI,IAAI;YACrB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,QAAQ,EAAE,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/services/events/subscribers/webhook.d.ts

@@ -0,0 +1,3 @@
+import type { KeystoneEvent } from "../types.js";
+export declare function webhookSubscriber(event: KeystoneEvent): Promise<void>;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/services/events/subscribers/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../../../src/services/events/subscribers/webhook.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAMjD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B3E"}

package/dist/services/events/subscribers/webhook.js

@@ -0,0 +1,36 @@
+import { config } from "../../../config.js";
+import { queue } from "../../queue/index.js";
+import { signWebhookPayload } from "../../../lib/webhookSignature.js";
+function shouldEmit() {
+    return Boolean(config.AUDIT_WEBHOOK_URL || process.env.AUDIT_WEBHOOK_URL || config.AUDIT_CONSOLE_EXPORT === "true");
+}
+export async function webhookSubscriber(event) {
+    if (!shouldEmit())
+        return;
+    const record = {
+        event: event.type,
+        version: event.version,
+        userId: event.payload.userId,
+        orgId: event.payload.orgId,
+        appId: event.payload.appId,
+        ip: event.payload.ip,
+        userAgent: event.payload.userAgent,
+        metadata: event.payload.metadata,
+        createdAt: event.timestamp,
+    };
+    if (config.AUDIT_CONSOLE_EXPORT === "true") {
+        console.log("[audit-export]", JSON.stringify(record));
+    }
+    const webhookUrl = config.AUDIT_WEBHOOK_URL || process.env.AUDIT_WEBHOOK_URL;
+    if (webhookUrl) {
+        const headers = { "Content-Type": "application/json" };
+        if (config.WEBHOOK_SIGNING_SECRET) {
+            headers["X-Keystone-Signature"] = signWebhookPayload(config.WEBHOOK_SIGNING_SECRET, record);
+        }
+        await queue.enqueue({
+            type: "webhook",
+            payload: { url: webhookUrl, method: "POST", body: record, headers },
+        });
+    }
+}
+//# sourceMappingURL=webhook.js.map

package/dist/services/events/subscribers/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../../../src/services/events/subscribers/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAGtE,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,MAAM,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAoB;IAC1D,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO;IAC1B,MAAM,MAAM,GAAG;QACb,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;QAC1B,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;QAC1B,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;QACpB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IAEF,IAAI,MAAM,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QAC/E,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;YAClC,OAAO,CAAC,sBAAsB,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/services/events/subscribers/webhookDispatch.d.ts

@@ -0,0 +1,7 @@
+import type { KeystoneEvent } from "../types.js";
+/**
+ * Fans every platform event out to registered webhook endpoints.
+ * Delivery itself happens asynchronously via the queue worker.
+ */
+export declare function webhookDispatchSubscriber(event: KeystoneEvent): Promise<void>;
+//# sourceMappingURL=webhookDispatch.d.ts.map

package/dist/services/events/subscribers/webhookDispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhookDispatch.d.ts","sourceRoot":"","sources":["../../../../src/services/events/subscribers/webhookDispatch.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAMnF"}

package/dist/services/events/subscribers/webhookDispatch.js

@@ -0,0 +1,14 @@
+import { dispatchEvent } from "../../webhooks.js";
+/**
+ * Fans every platform event out to registered webhook endpoints.
+ * Delivery itself happens asynchronously via the queue worker.
+ */
+export async function webhookDispatchSubscriber(event) {
+    try {
+        await dispatchEvent(event);
+    }
+    catch (err) {
+        console.error("[webhooks] dispatch failed:", err);
+    }
+}
+//# sourceMappingURL=webhookDispatch.js.map

package/dist/services/events/subscribers/webhookDispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhookDispatch.js","sourceRoot":"","sources":["../../../../src/services/events/subscribers/webhookDispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAAoB;IAClE,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/services/events/types.d.ts

@@ -0,0 +1,21 @@
+export interface EventPayload {
+    userId?: string;
+    orgId?: string;
+    appId?: string;
+    requestId?: string;
+    ip?: string;
+    userAgent?: string;
+    metadata?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export interface KeystoneEvent {
+    type: string;
+    version: number;
+    timestamp: Date;
+    payload: EventPayload;
+}
+export type EventHandler = (event: KeystoneEvent) => void | Promise<void>;
+export declare const EVENT_VERSIONS: Record<string, number>;
+export declare function eventVersion(type: string): number;
+export type AuditEventType = "user_registered" | "user_login" | "user_login_failed" | "user_logout" | "token_refresh" | "token_refresh_failed" | "oauth_callback" | "oauth2_authorize" | "oauth2_token" | "oauth2_client_credentials" | "oauth2_revoke" | "oauth2_consent" | "password_reset_requested" | "password_reset_completed" | "api_key_created" | "api_key_revoked" | "api_key_used" | "service_account_created" | "service_account_updated" | "unauthorized_access" | "organization_created" | "organization_updated" | "organization_plan_updated" | "billing_customer_provisioned" | "organization_member_invited" | "organization_member_removed" | "organization_member_role_updated" | "permission_created" | "permission_deleted" | "application_created" | "application_updated" | "magic_link_sent" | "magic_link_verified" | "totp_enrolled" | "totp_verify_failed" | "totp_enabled" | "totp_disable_failed" | "totp_disabled" | "webauthn_registered" | "webauthn_authenticated" | "new_device_detected" | "sms_otp_sent" | "sms_otp_verify_failed" | "sms_otp_verified" | "authz_check" | "saml_sso_login" | "oidc_enterprise_login" | "saml_connection_created" | "saml_connection_deleted" | "oidc_connection_created" | "oidc_connection_deleted" | "scim_user_created" | "scim_user_updated" | "scim_user_deleted" | "federation_login" | "workflow_triggered" | "workflow_step_executed" | "workflow_created" | "workflow_deleted" | "platform_user_updated" | "platform_user_deactivated" | "platform_signing_key_rotated" | "platform_plugin_unregistered" | "platform_feature_flag_updated" | "platform_feature_flag_deleted" | "profile_updated" | "email_verification_sent" | "email_verified" | "platform_webhook_created" | "platform_webhook_updated" | "platform_webhook_deleted" | "platform_webhook_secret_rotated" | "federation_identity_linked" | "user_token_login" | "session_revoked" | "sessions_revoked_all";
+//# sourceMappingURL=types.d.ts.map

package/dist/services/events/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,sBAAsB,GACtB,2BAA2B,GAC3B,8BAA8B,GAC9B,6BAA6B,GAC7B,6BAA6B,GAC7B,kCAAkC,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,GACd,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,uBAAuB,GACvB,2BAA2B,GAC3B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,+BAA+B,GAC/B,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,iCAAiC,GACjC,4BAA4B,GAC5B,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,CAAC"}

package/dist/services/events/types.js

@@ -0,0 +1,8 @@
+export const EVENT_VERSIONS = {
+    // Default version for all existing events.
+    default: 1,
+};
+export function eventVersion(type) {
+    return EVENT_VERSIONS[type] ?? EVENT_VERSIONS.default;
+}
+//# sourceMappingURL=types.js.map

package/dist/services/events/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,2CAA2C;IAC3C,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC;AACxD,CAAC"}

package/dist/services/events/validate.d.ts

@@ -0,0 +1,9 @@
+import type { KeystoneEvent } from "./types.js";
+import type { EmittableEvent } from "./bus.js";
+export interface EventValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+export declare function validateEvent(event: EmittableEvent): EventValidationResult;
+export declare function normalizeEvent(event: EmittableEvent): KeystoneEvent;
+//# sourceMappingURL=validate.d.ts.map

package/dist/services/events/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AA2ED,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,qBAAqB,CAqB1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAYnE"}

package/dist/services/events/validate.js

@@ -0,0 +1,103 @@
+import { eventVersion } from "./types.js";
+const VALID_EVENT_TYPES = new Set([
+    "user_registered",
+    "user_login",
+    "user_login_failed",
+    "user_logout",
+    "token_refresh",
+    "token_refresh_failed",
+    "oauth_callback",
+    "oauth2_authorize",
+    "oauth2_token",
+    "oauth2_client_credentials",
+    "oauth2_revoke",
+    "oauth2_consent",
+    "password_reset_requested",
+    "password_reset_completed",
+    "api_key_created",
+    "api_key_revoked",
+    "api_key_used",
+    "service_account_created",
+    "service_account_updated",
+    "unauthorized_access",
+    "organization_created",
+    "organization_updated",
+    "organization_plan_updated",
+    "billing_customer_provisioned",
+    "organization_member_invited",
+    "organization_member_removed",
+    "organization_member_role_updated",
+    "permission_created",
+    "permission_deleted",
+    "application_created",
+    "application_updated",
+    "magic_link_sent",
+    "magic_link_verified",
+    "totp_enrolled",
+    "totp_verify_failed",
+    "totp_enabled",
+    "totp_disable_failed",
+    "totp_disabled",
+    "webauthn_registered",
+    "webauthn_authenticated",
+    "new_device_detected",
+    "sms_otp_sent",
+    "sms_otp_verify_failed",
+    "sms_otp_verified",
+    "authz_check",
+    "saml_sso_login",
+    "saml_connection_created",
+    "saml_connection_deleted",
+    "oidc_enterprise_login",
+    "oidc_connection_created",
+    "oidc_connection_deleted",
+    "scim_user_created",
+    "scim_user_updated",
+    "scim_user_deleted",
+    "federation_login",
+    "workflow_triggered",
+    "workflow_step_executed",
+    "workflow_created",
+    "workflow_deleted",
+    "platform_user_updated",
+    "platform_user_deactivated",
+    "platform_signing_key_rotated",
+    "platform_plugin_unregistered",
+    "platform_feature_flag_updated",
+    "platform_feature_flag_deleted",
+    "profile_updated",
+    "email_verification_sent",
+    "email_verified",
+    "platform_webhook_created",
+    "platform_webhook_deleted",
+]);
+export function validateEvent(event) {
+    const errors = [];
+    if (!event.type || typeof event.type !== "string") {
+        errors.push("Event type is required and must be a string");
+        return { valid: false, errors };
+    }
+    if (!VALID_EVENT_TYPES.has(event.type)) {
+        errors.push(`Unknown event type: ${event.type}`);
+    }
+    if (event.version !== undefined && (typeof event.version !== "number" || event.version < 1)) {
+        errors.push("Event version must be a positive integer");
+    }
+    if (!event.payload || typeof event.payload !== "object" || Array.isArray(event.payload)) {
+        errors.push("Event payload must be an object");
+    }
+    return { valid: errors.length === 0, errors };
+}
+export function normalizeEvent(event) {
+    const validation = validateEvent(event);
+    if (!validation.valid) {
+        throw new Error(`Invalid event: ${validation.errors.join("; ")}`);
+    }
+    return {
+        type: event.type,
+        version: event.version ?? eventVersion(event.type),
+        timestamp: new Date(),
+        payload: event.payload,
+    };
+}
+//# sourceMappingURL=validate.js.map

package/dist/services/events/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,sBAAsB;IACtB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,2BAA2B;IAC3B,eAAe;IACf,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,yBAAyB;IACzB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,8BAA8B;IAC9B,6BAA6B;IAC7B,6BAA6B;IAC7B,kCAAkC;IAClC,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,kBAAkB;IAClB,aAAa;IACb,gBAAgB;IAChB,yBAAyB;IACzB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,+BAA+B;IAC/B,+BAA+B;IAC/B,iBAAiB;IACjB,yBAAyB;IACzB,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;CAC3B,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}

package/dist/services/featureFlags.d.ts

@@ -0,0 +1,15 @@
+export declare function isFeatureEnabled(flag: string): Promise<boolean>;
+export declare function requireFeatureEnabled(flag: string): Promise<void>;
+export declare function listFeatureFlags(): Promise<Array<{
+    key: string;
+    enabled: boolean;
+    description: string | null;
+    source: "database" | "environment";
+}>>;
+export declare function setFeatureFlag(key: string, enabled: boolean, description?: string): Promise<{
+    key: string;
+    enabled: boolean;
+}>;
+export declare function deleteFeatureFlag(key: string): Promise<boolean>;
+export declare function clearFeatureFlagCache(): void;
+//# sourceMappingURL=featureFlags.d.ts.map

package/dist/services/featureFlags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"featureFlags.d.ts","sourceRoot":"","sources":["../../src/services/featureFlags.ts"],"names":[],"mappings":"AAiBA,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIrE;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAC/C,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAAA;CAAE,CAAC,CACzG,CAkBA;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,OAAO,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAkB5C;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMrE;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C"}

package/dist/services/featureFlags.js

@@ -0,0 +1,74 @@
+import { eq } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { featureFlags } from "../db/schema.js";
+import { configurationService } from "./configuration.js";
+const cache = new Map();
+let cacheLoaded = false;
+async function loadIntoCache() {
+    if (cacheLoaded)
+        return;
+    const rows = await db.select({ key: featureFlags.key, enabled: featureFlags.enabled }).from(featureFlags);
+    for (const row of rows) {
+        cache.set(row.key, row.enabled);
+    }
+    cacheLoaded = true;
+}
+export async function isFeatureEnabled(flag) {
+    await loadIntoCache();
+    if (cache.has(flag))
+        return cache.get(flag);
+    return configurationService.isEnabled(flag);
+}
+export async function requireFeatureEnabled(flag) {
+    const enabled = await isFeatureEnabled(flag);
+    if (!enabled) {
+        const error = new Error(`Feature '${flag}' is not enabled`);
+        error.statusCode = 403;
+        throw error;
+    }
+}
+export async function listFeatureFlags() {
+    await loadIntoCache();
+    const dbRows = await db.select().from(featureFlags).orderBy(featureFlags.key);
+    const envFlags = configurationService.get().featureFlags;
+    const merged = new Map();
+    for (const row of dbRows) {
+        merged.set(row.key, { key: row.key, enabled: row.enabled, description: row.description, source: "database" });
+    }
+    for (const [key, enabled] of Object.entries(envFlags)) {
+        if (!merged.has(key)) {
+            merged.set(key, { key, enabled, description: null, source: "environment" });
+        }
+    }
+    return Array.from(merged.values()).sort((a, b) => a.key.localeCompare(b.key));
+}
+export async function setFeatureFlag(key, enabled, description) {
+    const existing = await db.select().from(featureFlags).where(eq(featureFlags.key, key)).limit(1);
+    if (existing.length > 0) {
+        const [row] = await db
+            .update(featureFlags)
+            .set({ enabled, description: description ?? existing[0].description, updatedAt: new Date() })
+            .where(eq(featureFlags.key, key))
+            .returning();
+        cache.set(row.key, row.enabled);
+        return { key: row.key, enabled: row.enabled };
+    }
+    const [row] = await db
+        .insert(featureFlags)
+        .values({ key, enabled, description: description || null })
+        .returning();
+    cache.set(row.key, row.enabled);
+    return { key: row.key, enabled: row.enabled };
+}
+export async function deleteFeatureFlag(key) {
+    const [row] = await db.delete(featureFlags).where(eq(featureFlags.key, key)).returning();
+    if (row) {
+        cache.delete(row.key);
+    }
+    return !!row;
+}
+export function clearFeatureFlagCache() {
+    cache.clear();
+    cacheLoaded = false;
+}
+//# sourceMappingURL=featureFlags.js.map

package/dist/services/featureFlags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"featureFlags.js","sourceRoot":"","sources":["../../src/services/featureFlags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;AACzC,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,KAAK,UAAU,aAAa;IAC1B,IAAI,WAAW;QAAE,OAAO;IACxB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1G,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,aAAa,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;IAC7C,OAAO,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAmC,CAAC;QAC9F,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QACvB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAGpC,MAAM,aAAa,EAAE,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC;IAEzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6G,CAAC;IAEpI,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,OAAgB,EAChB,WAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5F,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;aAChC,SAAS,EAAE,CAAC;QACf,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,IAAI,IAAI,EAAE,CAAC;SAC1D,SAAS,EAAE,CAAC;IACf,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW;IACjD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACzF,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC"}

package/dist/services/features.d.ts

@@ -0,0 +1,12 @@
+import type { ConfigurationService } from "./configuration.js";
+export interface FeatureFlagService {
+    isEnabled(flag: string): boolean;
+    requireEnabled(flag: string): void;
+}
+export declare class DefaultFeatureFlagService implements FeatureFlagService {
+    private readonly config;
+    constructor(config: ConfigurationService);
+    isEnabled(flag: string): boolean;
+    requireEnabled(flag: string): void;
+}
+//# sourceMappingURL=features.d.ts.map

package/dist/services/features.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../src/services/features.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,qBAAa,yBAA0B,YAAW,kBAAkB;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,oBAAoB;IAEzD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIhC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;CAOnC"}

package/dist/services/features.js

@@ -0,0 +1,17 @@
+export class DefaultFeatureFlagService {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    isEnabled(flag) {
+        return this.config.isEnabled(flag);
+    }
+    requireEnabled(flag) {
+        if (!this.isEnabled(flag)) {
+            const error = new Error(`Feature '${flag}' is not enabled`);
+            error.statusCode = 403;
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=features.js.map

package/dist/services/features.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features.js","sourceRoot":"","sources":["../../src/services/features.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,MAA4B;QAA5B,WAAM,GAAN,MAAM,CAAsB;IAAG,CAAC;IAE7D,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAmC,CAAC;YAC9F,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;YACvB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/services/federation.d.ts

@@ -0,0 +1,12 @@
+import type { User } from "../db/schema.js";
+import type { IdentityConnector } from "./connectors/types.js";
+export declare function getFederationConnector(providerType: string): IdentityConnector;
+export declare function getFederationAuthorizeUrl(providerType: string, state: string, redirectUri: string): Promise<string>;
+export declare function completeFederationLogin(providerType: string, code: string, redirectUri: string): Promise<{
+    user: User;
+    tokens: {
+        accessToken: string;
+        refreshToken: string;
+    };
+}>;
+//# sourceMappingURL=federation.d.ts.map