@hilbras/keystone 1.5.0 → 1.9.0

package/dist/tests/smoke.test.js

@@ -1,124 +0,0 @@
-import { describe, it, before, after } from "node:test";
-import assert from "node:assert";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-process.env.DATABASE_URL = process.env.DATABASE_URL || "postgresql://hilbras:hilbras@localhost:5432/hilbras";
-process.env.ZITADEL_DOMAIN = process.env.ZITADEL_DOMAIN || "http://localhost:8080";
-process.env.ZITADEL_CLIENT_ID = process.env.ZITADEL_CLIENT_ID || "test-client";
-process.env.ZITADEL_CLIENT_SECRET = process.env.ZITADEL_CLIENT_SECRET || "test-secret";
-// Generate an ephemeral JWT key pair so JWKS and auth tests don't need the secrets table.
-const { generateKeyPair, exportPKCS8, exportSPKI } = await import("jose");
-const jwtPair = await generateKeyPair("RS256", { extractable: true });
-process.env.JWT_PRIVATE_KEY = await exportPKCS8(jwtPair.privateKey);
-process.env.JWT_PUBLIC_KEY = await exportSPKI(jwtPair.publicKey);
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-let dbAvailable = false;
-before(async () => {
-    try {
-        const { migrate } = await import("drizzle-orm/postgres-js/migrator");
-        const { db } = await import("../db/index.js");
-        await migrate(db, { migrationsFolder: path.resolve(__dirname, "../db/migrations") });
-        dbAvailable = true;
-    }
-    catch (err) {
-        console.warn("Postgres not available; skipping DB-dependent smoke tests:", err.message);
-    }
-});
-const { buildApp } = await import("../index.js");
-// The postgres pool (db/index.ts) and the shared lazy ioredis client
-// (services/redis.ts, used by the global rate limiter on every request) are
-// process-wide singletons that app.close() does not release. Without this,
-// open sockets keep the node:test process alive after all tests finish.
-after(async () => {
-    const { closeDb } = await import("../db/index.js");
-    const { redis } = await import("../services/redis.js");
-    await closeDb().catch(() => { });
-    try {
-        if (redis.status !== "end")
-            await redis.quit();
-    }
-    catch {
-        redis.disconnect();
-    }
-});
-describe("Hilbras Keystone smoke test", () => {
-    it("boots and responds to /health", async () => {
-        const app = await buildApp();
-        const res = await app.inject({ method: "GET", url: "/health" });
-        assert.strictEqual(res.statusCode, 200);
-        const body = JSON.parse(res.body);
-        assert.strictEqual(body.status, "ok");
-        await app.close();
-    });
-    it("serves OIDC discovery document", async () => {
-        const app = await buildApp();
-        const res = await app.inject({ method: "GET", url: "/.well-known/openid-configuration" });
-        assert.strictEqual(res.statusCode, 200);
-        const body = JSON.parse(res.body);
-        assert.strictEqual(body.response_types_supported[0], "code");
-        assert.ok(body.token_endpoint_auth_methods_supported.includes("client_secret_basic"));
-        await app.close();
-    });
-    it("serves JWKS", async () => {
-        const app = await buildApp();
-        const res = await app.inject({ method: "GET", url: "/.well-known/jwks.json" });
-        assert.strictEqual(res.statusCode, 200);
-        const body = JSON.parse(res.body);
-        assert.ok(Array.isArray(body.keys));
-        await app.close();
-    });
-    it("serves Prometheus metrics", async () => {
-        const app = await buildApp();
-        const res = await app.inject({ method: "GET", url: "/metrics" });
-        assert.strictEqual(res.statusCode, 200);
-        assert.ok(res.body.includes("keystone_http_requests_total"));
-        await app.close();
-    });
-    it("requires authentication for /v1/authz/check", async () => {
-        const app = await buildApp();
-        const res = await app.inject({
-            method: "POST",
-            url: "/v1/authz/check",
-            payload: { resource: "application", action: "read" },
-        });
-        assert.strictEqual(res.statusCode, 401);
-        await app.close();
-    });
-    it("lists federation providers", async () => {
-        const app = await buildApp();
-        const res = await app.inject({ method: "GET", url: "/federation/providers" });
-        assert.strictEqual(res.statusCode, 200);
-        const body = JSON.parse(res.body);
-        assert.ok(Array.isArray(body.providers));
-        assert.ok(body.providers.some((p) => p.type === "google"));
-        await app.close();
-    });
-    it("exposes admin permissions endpoint", async () => {
-        const app = await buildApp();
-        const res = await app.inject({ method: "GET", url: "/v1/admin/permissions" });
-        assert.strictEqual(res.statusCode, 401);
-        await app.close();
-    });
-    (dbAvailable ? it : it.skip)("registers and logs in a local password user without Zitadel", async () => {
-        const app = await buildApp();
-        const email = `smoke-${Date.now()}@example.com`;
-        const registerRes = await app.inject({
-            method: "POST",
-            url: "/auth/register",
-            payload: { username: `smoke${Date.now()}`, email, password: "SmokeTest123!" },
-        });
-        assert.strictEqual(registerRes.statusCode, 200);
-        const registerBody = JSON.parse(registerRes.body);
-        assert.strictEqual(registerBody.user.email, email);
-        const loginRes = await app.inject({
-            method: "POST",
-            url: "/auth/login",
-            payload: { email, password: "SmokeTest123!" },
-        });
-        assert.strictEqual(loginRes.statusCode, 200);
-        const loginBody = JSON.parse(loginRes.body);
-        assert.strictEqual(loginBody.user.email, email);
-        await app.close();
-    });
-});
-//# sourceMappingURL=smoke.test.js.map

package/dist/tests/smoke.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"smoke.test.js","sourceRoot":"","sources":["../../src/tests/smoke.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,qDAAqD,CAAC;AAC7G,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AACnF,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,aAAa,CAAC;AAC/E,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,aAAa,CAAC;AAEvF,0FAA0F;AAC1F,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1E,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AACtE,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACpE,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAEjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,MAAM,CAAC,KAAK,IAAI,EAAE;IAChB,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACrE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACrF,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,4DAA4D,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACrG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;AAEjD,qEAAqE;AACrE,4EAA4E;AAC5E,2EAA2E;AAC3E,wEAAwE;AACxE,KAAK,CAAC,KAAK,IAAI,EAAE;IACf,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACvD,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;YAAE,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,UAAU,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,qCAAqC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACtF,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAC7D,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YACnC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,gBAAgB;YACrB,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE;SAC9E,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/src/cli.ts

@@ -1,172 +0,0 @@
-#!/usr/bin/env node
-import { Command } from "commander";
-
-const program = new Command();
-
-program.name("keystone").description("Hilbras Keystone CLI").version("1.0.0");
-
-program
-  .command("init")
-  .description("Create a sample .env file for Keystone")
-  .action(async () => {
-    console.log("Keystone init: copy .env.example and configure DATABASE_URL, ZITADEL_DOMAIN, etc.");
-  });
-
-program
-  .command("migrate")
-  .description("Run database migrations")
-  .action(async () => {
-    const { migrate } = await import("drizzle-orm/postgres-js/migrator");
-    const { db } = await import("./db/index.js");
-    const path = await import("node:path");
-    const { fileURLToPath } = await import("node:url");
-    const __dirname = path.dirname(fileURLToPath(import.meta.url));
-    await migrate(db, { migrationsFolder: path.resolve(__dirname, "./db/migrations") });
-    console.log("Migrations applied");
-  });
-
-program
-  .command("keys:create")
-  .description("Generate a JWT signing key pair")
-  .action(async () => {
-    const { generateKeyPair, exportPKCS8, exportSPKI } = await import("jose");
-    const pair = await generateKeyPair("RS256", { extractable: true });
-    const privateKey = await exportPKCS8(pair.privateKey);
-    const publicKey = await exportSPKI(pair.publicKey);
-    console.log("JWT_PRIVATE_KEY=");
-    console.log(privateKey);
-    console.log("JWT_PUBLIC_KEY=");
-    console.log(publicKey);
-  });
-
-program
-  .command("secrets:rotate")
-  .description("Rotate the active JWT signing key")
-  .action(async () => {
-    const { rotateSigningKeys } = await import("./services/secrets/index.js");
-    const pair = await rotateSigningKeys();
-    console.log(`Rotated signing key. New key id: ${pair.keyId}`);
-  });
-
-program
-  .command("user:create")
-  .description("Create a local user account")
-  .requiredOption("--email <email>", "User email")
-  .requiredOption("--password <password>", "User password")
-  .option("--username <username>", "Username")
-  .option("--name <name>", "Display name")
-  .option("--role <role>", "Role (e.g. owner, admin, member)", "member")
-  .action(
-    async (options: {
-      email: string;
-      password: string;
-      username?: string;
-      name?: string;
-      role: string;
-    }) => {
-      const { initializeContainer } = await import("./di.js");
-      const { AuthenticationDomainService } = await import("./services/domain/index.js");
-      const { db } = await import("./db/index.js");
-      const { users } = await import("./db/schema.js");
-      const { eq } = await import("drizzle-orm");
-
-      const container = initializeContainer();
-      const authService = new AuthenticationDomainService(container.userRepository, container.applicationRepository);
-      const result = await authService.register({
-        email: options.email,
-        password: options.password,
-        username:
-          options.username ||
-          options.email.split("@")[0].toLowerCase().replace(/[^a-z0-9_-]/g, "-").slice(0, 32),
-        name: options.name,
-      });
-
-      if (!result.success) {
-        console.error(`Failed to create user: ${result.error.message}`);
-        process.exit(1);
-      }
-
-      if (options.role !== "member") {
-        await db.update(users).set({ role: options.role }).where(eq(users.id, result.data.user.id));
-      }
-
-      console.log(`Created user ${result.data.user.id} (${result.data.user.email}) with role ${options.role}`);
-    }
-  );
-
-program
-  .command("org:create")
-  .description("Create a new organization")
-  .requiredOption("--name <name>", "Organization name")
-  .option("--slug <slug>", "Organization slug")
-  .option("--plan <plan>", "Billing plan", "free")
-  .option("--owner-email <email>", "Owner email")
-  .action(async (options: { name: string; slug?: string; plan: string; ownerEmail?: string }) => {
-    const { initializeContainer } = await import("./di.js");
-    const { OrganizationDomainService } = await import("./services/domain/index.js");
-    const { DrizzleUserRepository, DrizzleOrganizationRepository } = await import(
-      "./repositories/index.js"
-    );
-    const container = initializeContainer();
-    const orgService = new OrganizationDomainService(
-      container.organizationRepository,
-      container.applicationRepository,
-      container.userRepository
-    );
-    const orgResult = await orgService.createOrganization({
-      name: options.name,
-      slug: options.slug,
-      plan: options.plan,
-    });
-    if (!orgResult.success) {
-      console.error(`Failed to create organization: ${orgResult.error.message}`);
-      process.exit(1);
-    }
-    const org = orgResult.data;
-    if (options.ownerEmail) {
-      const users = new DrizzleUserRepository();
-      const owner = await users.findByEmail(options.ownerEmail);
-      if (owner) {
-        const orgs = new DrizzleOrganizationRepository();
-        await orgs.addMembership({
-          orgId: org.id,
-          userId: owner.id,
-          role: "owner",
-        });
-      } else {
-        console.warn(`Owner email ${options.ownerEmail} not found; organization created without owner`);
-      }
-    }
-    console.log(`Created organization ${org.id} (${org.slug})`);
-  });
-
-program
-  .command("keys:list")
-  .description("List active JWT signing keys")
-  .action(async () => {
-    const { listActiveSigningKeys } = await import("./services/secrets/index.js");
-    const keys = await listActiveSigningKeys();
-    for (const key of keys) {
-      console.log(`${key.keyId}\tcreated=${key.createdAt.toISOString()}\texpires=${key.expiresAt?.toISOString() ?? "never"}`);
-    }
-  });
-
-program
-  .command("config:validate")
-  .description("Validate required configuration and print status")
-  .action(async () => {
-    const { config } = await import("./config.js");
-    const required = ["DATABASE_URL"];
-    const missing = required.filter((name) => !process.env[name]);
-    if (missing.length > 0) {
-      console.error(`Missing required environment variables: ${missing.join(", ")}`);
-      process.exit(1);
-    }
-    console.log("Configuration OK");
-    console.log(`  DATABASE_URL: ${config.DATABASE_URL.replace(/\/\/.*@/, "//***@")}`);
-    console.log(`  REDIS_URL: ${config.REDIS_URL.replace(/\/\/.*@/, "//***@")}`);
-    console.log(`  Queue provider: ${config.KEYSTONE_QUEUE_PROVIDER || "auto"}`);
-    console.log(`  Secrets provider: ${config.KEYSTONE_SECRETS_PROVIDER}`);
-  });
-
-program.parse();

package/src/config.ts

@@ -1,143 +0,0 @@
-import dotenv from "dotenv";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-dotenv.config({ path: path.resolve(__dirname, "../.env") });
-dotenv.config();
-
-function getEnv(name: string, fallback = ""): string {
-  return process.env[name] ?? fallback;
-}
-
-function requireEnv(name: string): string {
-  const value = process.env[name];
-  if (!value) {
-    throw new Error(`Missing required environment variable: ${name}`);
-  }
-  return value;
-}
-
-function requireEnvUnlessSetup(name: string): string {
-  const value = process.env[name];
-  if (!value && process.env.KEYSTONE_SETUP_MODE !== "true") {
-    throw new Error(`Missing required environment variable: ${name}`);
-  }
-  return value || "";
-}
-
-function getList(name: string): string[] {
-  const value = process.env[name];
-  if (!value) return [];
-  return value.split(",").map((s) => s.trim()).filter(Boolean);
-}
-
-export const config = {
-  NODE_ENV: getEnv("NODE_ENV", "development"),
-  PORT: Number(getEnv("PORT", "4001")),
-  HOST: getEnv("HOST", "0.0.0.0"),
-
-  DATABASE_URL: requireEnvUnlessSetup("DATABASE_URL"),
-  REDIS_URL: getEnv("REDIS_URL", "redis://localhost:6379"),
-
-  // Zitadel is now an optional identity connector, not a hard dependency.
-  ZITADEL_DOMAIN: getEnv("ZITADEL_DOMAIN"),
-  ZITADEL_ORG_ID: getEnv("ZITADEL_ORG_ID"),
-  ZITADEL_PROJECT_ID: getEnv("ZITADEL_PROJECT_ID"),
-
-  // Service account used to call Zitadel management/user APIs.
-  ZITADEL_SERVICE_CLIENT_ID: getEnv("ZITADEL_SERVICE_CLIENT_ID"),
-  ZITADEL_SERVICE_CLIENT_SECRET: getEnv("ZITADEL_SERVICE_CLIENT_SECRET"),
-  ZITADEL_SERVICE_PAT: getEnv("ZITADEL_SERVICE_PAT"),
-
-  // Keystone OIDC app registered in Zitadel (for OAuth callbacks).
-  ZITADEL_CLIENT_ID: getEnv("ZITADEL_CLIENT_ID"),
-  ZITADEL_CLIENT_SECRET: getEnv("ZITADEL_CLIENT_SECRET"),
-
-  // Optional IdP IDs to skip the Zitadel login selector and go straight to Google/GitHub.
-  ZITADEL_GOOGLE_IDP_ID: getEnv("ZITADEL_GOOGLE_IDP_ID"),
-  ZITADEL_GITHUB_IDP_ID: getEnv("ZITADEL_GITHUB_IDP_ID"),
-
-  COOKIE_NAME: getEnv("COOKIE_NAME", "__Host-keystone-session"),
-  COOKIE_DOMAIN: getEnv("COOKIE_DOMAIN", ".local.hilbras.ai"),
-  COOKIE_SECURE: getEnv("COOKIE_SECURE", "false") === "true",
-  COOKIE_SAME_SITE: getEnv("COOKIE_SAME_SITE", getEnv("NODE_ENV", "development") === "production" ? "strict" : "lax") as "strict" | "lax" | "none",
-
-  AUTH_API_PUBLIC_URL: getEnv("AUTH_API_PUBLIC_URL"),
-  ACCESS_TOKEN_TTL_SECONDS: Number(getEnv("JWT_ACCESS_TOKEN_TTL", "900")),
-  REFRESH_TOKEN_TTL_SECONDS: Number(getEnv("JWT_REFRESH_TOKEN_TTL", "604800")),
-
-  // RSA PEM keys. If not provided, a new key pair is generated at startup (dev only).
-  JWT_PRIVATE_KEY: getEnv("JWT_PRIVATE_KEY"),
-  JWT_PUBLIC_KEY: getEnv("JWT_PUBLIC_KEY"),
-
-  // Optional master encryption key. If omitted, a random key is stored in the secrets table (dev only).
-  KEYSTONE_ENCRYPTION_KEY: getEnv("KEYSTONE_ENCRYPTION_KEY"),
-
-  // Secrets provider: "database" (default) or "environment".
-  KEYSTONE_SECRETS_PROVIDER: getEnv("KEYSTONE_SECRETS_PROVIDER", "database"),
-
-  // Queue provider: "in-process" (default/fallback), "bullmq", or "" to auto-select bullmq when REDIS_URL is set.
-  KEYSTONE_QUEUE_PROVIDER: getEnv("KEYSTONE_QUEUE_PROVIDER", "in-process"),
-
-  // Cache key prefix for Redis/in-memory cache entries.
-  CACHE_KEY_PREFIX: getEnv("CACHE_KEY_PREFIX", "keystone:"),
-
-  // Comma-separated list of plugin module paths to load at startup.
-  KEYSTONE_PLUGINS: getEnv("KEYSTONE_PLUGINS"),
-
-  INTERNAL_API_KEY: getEnv("KEYSTONE_INTERNAL_API_KEY") || getEnv("HILBRAS_INTERNAL_API_KEY", ""),
-
-  SEED_OWNER_EMAIL: getEnv("KEYSTONE_SEED_OWNER_EMAIL"),
-
-  ALLOWED_ORIGINS: getList("ALLOWED_ORIGINS"),
-
-  RATE_LIMIT_ATTEMPTS: Number(getEnv("RATE_LIMIT_ATTEMPTS", "5")),
-  RATE_LIMIT_WINDOW_SECONDS: Number(getEnv("RATE_LIMIT_WINDOW_SECONDS", "900")),
-  GLOBAL_RATE_LIMIT_MAX: Number(getEnv("GLOBAL_RATE_LIMIT_MAX", "100")),
-  GLOBAL_RATE_LIMIT_WINDOW: Number(getEnv("GLOBAL_RATE_LIMIT_WINDOW", "60")),
-
-  ACCOUNT_LOCKOUT_THRESHOLD: Number(getEnv("ACCOUNT_LOCKOUT_THRESHOLD", "5")),
-  ACCOUNT_LOCKOUT_DURATION_SECONDS: Number(getEnv("ACCOUNT_LOCKOUT_DURATION_SECONDS", "1800")),
-
-  HIBP_CHECK_ENABLED: getEnv("HIBP_CHECK_ENABLED", "false") === "true",
-  // When true, new registrations start unverified and a verification email
-  // is sent automatically; login still works but emailVerified stays false
-  // until the user clicks the link.
-  EMAIL_VERIFICATION_REQUIRED: getEnv("EMAIL_VERIFICATION_REQUIRED", "false") === "true",
-  MAGIC_LINK_TTL_SECONDS: Number(getEnv("MAGIC_LINK_TTL_SECONDS", "900")),
-  OAUTH_CODE_TTL_SECONDS: Number(getEnv("OAUTH_CODE_TTL_SECONDS", "60")),
-  TOTP_ISSUER: getEnv("TOTP_ISSUER", "Hilbras"),
-  TOTP_ENCRYPTION_KEY: getEnv("KEYSTONE_TOTP_ENCRYPTION_KEY"),
-  EMAIL_PROVIDER: getEnv("EMAIL_PROVIDER", "none"),
-  EMAIL_FROM: getEnv("EMAIL_FROM", "keystone@local.hilbras.ai"),
-  SMTP_HOST: getEnv("SMTP_HOST"),
-  SMTP_PORT: Number(getEnv("SMTP_PORT", "587")),
-  SMTP_USER: getEnv("SMTP_USER"),
-  SMTP_PASS: getEnv("SMTP_PASS"),
-  SMTP_SECURE: getEnv("SMTP_SECURE", "false") === "true",
-  SENDGRID_API_KEY: getEnv("SENDGRID_API_KEY"),
-  MAILGUN_API_KEY: getEnv("MAILGUN_API_KEY"),
-  MAILGUN_DOMAIN: getEnv("MAILGUN_DOMAIN"),
-  SMS_PROVIDER: getEnv("SMS_PROVIDER", "none"),
-  TWILIO_ACCOUNT_SID: getEnv("TWILIO_ACCOUNT_SID"),
-  TWILIO_AUTH_TOKEN: getEnv("TWILIO_AUTH_TOKEN"),
-  TWILIO_FROM_NUMBER: getEnv("TWILIO_FROM_NUMBER"),
-  TWILIO_MESSAGING_SERVICE_SID: getEnv("TWILIO_MESSAGING_SERVICE_SID"),
-  OTEL_EXPORTER_OTLP_ENDPOINT: getEnv("OTEL_EXPORTER_OTLP_ENDPOINT"),
-  AUDIT_WEBHOOK_URL: getEnv("AUDIT_WEBHOOK_URL"),
-  AUDIT_CONSOLE_EXPORT: getEnv("AUDIT_CONSOLE_EXPORT", "false"),
-  WEBHOOK_SIGNING_SECRET: getEnv("WEBHOOK_SIGNING_SECRET") || getEnv("KEYSTONE_WEBHOOK_SIGNING_SECRET"),
-} as const;
-
-export function zitadelBaseUrl(): string {
-  if (!config.ZITADEL_DOMAIN) {
-    throw new Error("Zitadel is not configured");
-  }
-  const domain = config.ZITADEL_DOMAIN.replace(/\/$/, "");
-  return domain.startsWith("http") ? domain : `https://${domain}`;
-}
-
-export function isZitadelConfigured(): boolean {
-  return Boolean(config.ZITADEL_DOMAIN && config.ZITADEL_CLIENT_ID);
-}

package/src/container.ts

@@ -1,48 +0,0 @@
-import type { ConfigurationService } from "./services/configuration.js";
-import type { FeatureFlagService } from "./services/features.js";
-import type {
-  UserRepository,
-  OrganizationRepository,
-  ApplicationRepository,
-  AuditRepository,
-  IdentityRepository,
-  PermissionRepository,
-} from "./repositories/types.js";
-import type { ApiKeyRepository } from "./repositories/apiKey.js";
-import type { SamlConnectionRepository } from "./repositories/samlConnection.js";
-import type { OidcConnectionRepository } from "./repositories/oidcConnection.js";
-import type { SecretsProvider } from "./services/secrets/provider.js";
-import type { Queue } from "./services/queue/types.js";
-
-export interface Container {
-  config: ConfigurationService;
-  features: FeatureFlagService;
-  userRepository: UserRepository;
-  identityRepository: IdentityRepository;
-  organizationRepository: OrganizationRepository;
-  applicationRepository: ApplicationRepository;
-  auditRepository: AuditRepository;
-  permissionRepository: PermissionRepository;
-  apiKeyRepository: ApiKeyRepository;
-  samlConnectionRepository: SamlConnectionRepository;
-  oidcConnectionRepository: OidcConnectionRepository;
-  secretsProvider: SecretsProvider;
-  queue: Queue;
-}
-
-let globalContainer: Container | null = null;
-
-export function setContainer(container: Container): void {
-  globalContainer = container;
-}
-
-export function getContainer(): Container {
-  if (!globalContainer) {
-    throw new Error("DI container has not been initialized");
-  }
-  return globalContainer;
-}
-
-export function resolve<K extends keyof Container>(key: K): Container[K] {
-  return getContainer()[key];
-}

package/src/db/index.ts

@@ -1,53 +0,0 @@
-import { drizzle } from "drizzle-orm/postgres-js";
-import postgres from "postgres";
-import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
-import { config } from "../config.js";
-import * as schema from "./schema.js";
-
-let dbClient: postgres.Sql | null = null;
-
-/**
- * Live binding for the Drizzle database client. Re-assigned by `initDb()` once
- * DATABASE_URL is known. ES module imports see the updated value, so existing
- * code that imports `db` continues to work after configuration changes.
- */
-export let db: PostgresJsDatabase<typeof schema>;
-
-export function initDb(): void {
-  const databaseUrl = config.DATABASE_URL;
-  if (!databaseUrl) {
-    throw new Error("DATABASE_URL is not configured");
-  }
-  if (dbClient) {
-    dbClient.end().catch(() => {});
-  }
-  dbClient = postgres(databaseUrl, { max: 10 });
-  db = drizzle(dbClient, { schema });
-}
-
-export function getDb(): PostgresJsDatabase<typeof schema> {
-  if (!db) {
-    initDb();
-  }
-  return db;
-}
-
-/**
- * Close the underlying connection pool. Used on graceful shutdown and in tests
- * so pooled sockets do not keep the Node process alive after work is done.
- */
-export async function closeDb(): Promise<void> {
-  if (dbClient) {
-    const client = dbClient;
-    dbClient = null;
-    await client.end({ timeout: 5 });
-  }
-}
-
-export { schema };
-
-// Initialize immediately when DATABASE_URL is available so existing code paths
-// keep working without an explicit initDb() call.
-if (config.DATABASE_URL) {
-  initDb();
-}