@keystrokehq/platform 0.0.0-staging-20260714181321

package/dist/with-project-scope-7t3SHNwz.mjs

@@ -0,0 +1,56 @@
+import { a as verifyOrgWorkerToken } from "./dist-BdxWQmKK.mjs";
+import { runWithProjectDatabase, runWithProjectScope, runWithTenantScope } from "@keystrokehq/database";
+import { resolveOrgProjectDatabaseOptions, runWithOrganizationScope, selectOrganizationById, selectProjectById } from "@keystrokehq/platform-database";
+//#region src/middleware/require-worker-token.ts
+/** Worker auth from Bearer or x-api-key (Anthropic SDK uses the latter). */
+function readWorkerTokenFromRequest(c) {
+	const authorization = c.req.header("authorization");
+	if (authorization?.startsWith("Bearer ")) return authorization.slice(7).trim();
+	const apiKey = c.req.header("x-api-key")?.trim();
+	if (apiKey) return apiKey;
+}
+/**
+* Verifies the per-org worker token (`{orgId}.{hmac}` signed with the shared
+* platform secret) and records which org the calling machine belongs to.
+*/
+function requireWorkerToken(secret) {
+	return async (c, next) => {
+		if (!secret) return c.json({
+			error: "worker_auth_unconfigured",
+			message: "Worker auth is not configured."
+		}, 503);
+		const verified = verifyOrgWorkerToken(secret, readWorkerTokenFromRequest(c));
+		if (!verified) return c.json({
+			error: "unauthorized",
+			message: "Invalid worker token."
+		}, 401);
+		c.set("workerOrganizationId", verified.organizationId);
+		return next();
+	};
+}
+/** Organization id bound to the verified worker token, if present. */
+function workerOrganizationIdFromContext(c) {
+	const value = c.get("workerOrganizationId");
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+//#endregion
+//#region src/routes/internal/with-project-scope.ts
+async function withProjectScope(projectId, fn) {
+	const project = await selectProjectById(projectId);
+	if (!project) return;
+	const organization = await selectOrganizationById(project.organizationId);
+	if (!organization) return;
+	const dbOptions = resolveOrgProjectDatabaseOptions(organization);
+	let result;
+	await runWithOrganizationScope(project.organizationId, () => runWithProjectDatabase(dbOptions, () => runWithProjectScope(project.id, () => runWithTenantScope(project.organizationId, async () => {
+		result = await fn({
+			organizationId: project.organizationId,
+			projectId: project.id
+		});
+	}))));
+	return result;
+}
+//#endregion
+export { workerOrganizationIdFromContext as i, readWorkerTokenFromRequest as n, requireWorkerToken as r, withProjectScope as t };
+
+//# sourceMappingURL=with-project-scope-7t3SHNwz.mjs.map

package/dist/with-project-scope-7t3SHNwz.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-project-scope-7t3SHNwz.mjs","names":[],"sources":["../src/middleware/require-worker-token.ts","../src/routes/internal/with-project-scope.ts"],"sourcesContent":["import type { Context, MiddlewareHandler } from \"hono\";\nimport { verifyOrgWorkerToken } from \"@keystrokehq/hosting\";\n\nexport type WorkerTokenVariables = {\n  workerOrganizationId: string;\n};\n\n/** Worker auth from Bearer or x-api-key (Anthropic SDK uses the latter). */\nexport function readWorkerTokenFromRequest(c: Context): string | undefined {\n  const authorization = c.req.header(\"authorization\");\n  if (authorization?.startsWith(\"Bearer \")) {\n    return authorization.slice(\"Bearer \".length).trim();\n  }\n\n  const apiKey = c.req.header(\"x-api-key\")?.trim();\n  if (apiKey) {\n    return apiKey;\n  }\n\n  return undefined;\n}\n\n/**\n * Verifies the per-org worker token (`{orgId}.{hmac}` signed with the shared\n * platform secret) and records which org the calling machine belongs to.\n */\nexport function requireWorkerToken(secret: string | undefined): MiddlewareHandler {\n  return async (c, next) => {\n    if (!secret) {\n      return c.json(\n        { error: \"worker_auth_unconfigured\", message: \"Worker auth is not configured.\" },\n        503,\n      );\n    }\n\n    const token = readWorkerTokenFromRequest(c);\n    const verified = verifyOrgWorkerToken(secret, token);\n    if (!verified) {\n      return c.json({ error: \"unauthorized\", message: \"Invalid worker token.\" }, 401);\n    }\n\n    c.set(\"workerOrganizationId\", verified.organizationId);\n    return next();\n  };\n}\n\n/** Organization id bound to the verified worker token, if present. */\nexport function workerOrganizationIdFromContext(c: Context): string | undefined {\n  const value = c.get(\"workerOrganizationId\");\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n","import {\n  runWithProjectDatabase,\n  runWithProjectScope,\n  runWithTenantScope,\n} from \"@keystrokehq/database\";\nimport {\n  resolveOrgProjectDatabaseOptions,\n  runWithOrganizationScope,\n  selectOrganizationById,\n  selectProjectById,\n} from \"@keystrokehq/platform-database\";\n\nexport async function withProjectScope<T>(\n  projectId: string,\n  fn: (ctx: { organizationId: string; projectId: string }) => Promise<T>,\n): Promise<T | undefined> {\n  const project = await selectProjectById(projectId);\n  if (!project) {\n    return undefined;\n  }\n\n  const organization = await selectOrganizationById(project.organizationId);\n  if (!organization) {\n    return undefined;\n  }\n\n  const dbOptions = resolveOrgProjectDatabaseOptions(organization);\n  let result: T | undefined;\n\n  await runWithOrganizationScope(project.organizationId, () =>\n    runWithProjectDatabase(dbOptions, () =>\n      runWithProjectScope(project.id, () =>\n        runWithTenantScope(project.organizationId, async () => {\n          result = await fn({\n            organizationId: project.organizationId,\n            projectId: project.id,\n          });\n        }),\n      ),\n    ),\n  );\n\n  return result;\n}\n"],"mappings":";;;;;AAQA,SAAgB,2BAA2B,GAAgC;CACzE,MAAM,gBAAgB,EAAE,IAAI,OAAO,eAAe;CAClD,IAAI,eAAe,WAAW,SAAS,GACrC,OAAO,cAAc,MAAM,CAAgB,EAAE,KAAK;CAGpD,MAAM,SAAS,EAAE,IAAI,OAAO,WAAW,GAAG,KAAK;CAC/C,IAAI,QACF,OAAO;AAIX;;;;;AAMA,SAAgB,mBAAmB,QAA+C;CAChF,OAAO,OAAO,GAAG,SAAS;EACxB,IAAI,CAAC,QACH,OAAO,EAAE,KACP;GAAE,OAAO;GAA4B,SAAS;EAAiC,GAC/E,GACF;EAIF,MAAM,WAAW,qBAAqB,QADxB,2BAA2B,CACS,CAAC;EACnD,IAAI,CAAC,UACH,OAAO,EAAE,KAAK;GAAE,OAAO;GAAgB,SAAS;EAAwB,GAAG,GAAG;EAGhF,EAAE,IAAI,wBAAwB,SAAS,cAAc;EACrD,OAAO,KAAK;CACd;AACF;;AAGA,SAAgB,gCAAgC,GAAgC;CAC9E,MAAM,QAAQ,EAAE,IAAI,sBAAsB;CAC1C,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;;;ACtCA,eAAsB,iBACpB,WACA,IACwB;CACxB,MAAM,UAAU,MAAM,kBAAkB,SAAS;CACjD,IAAI,CAAC,SACH;CAGF,MAAM,eAAe,MAAM,uBAAuB,QAAQ,cAAc;CACxE,IAAI,CAAC,cACH;CAGF,MAAM,YAAY,iCAAiC,YAAY;CAC/D,IAAI;CAEJ,MAAM,yBAAyB,QAAQ,sBACrC,uBAAuB,iBACrB,oBAAoB,QAAQ,UAC1B,mBAAmB,QAAQ,gBAAgB,YAAY;EACrD,SAAS,MAAM,GAAG;GAChB,gBAAgB,QAAQ;GACxB,WAAW,QAAQ;EACrB,CAAC;CACH,CAAC,CACH,CACF,CACF;CAEA,OAAO;AACT"}

package/dist/with-project-scope-Drmz2h2Z.cjs

@@ -0,0 +1,79 @@
+const require_dist = require("./dist-QIg3f1DP.cjs");
+let _keystrokehq_database = require("@keystrokehq/database");
+let _keystrokehq_platform_database = require("@keystrokehq/platform-database");
+//#region src/middleware/require-worker-token.ts
+/** Worker auth from Bearer or x-api-key (Anthropic SDK uses the latter). */
+function readWorkerTokenFromRequest(c) {
+	const authorization = c.req.header("authorization");
+	if (authorization?.startsWith("Bearer ")) return authorization.slice(7).trim();
+	const apiKey = c.req.header("x-api-key")?.trim();
+	if (apiKey) return apiKey;
+}
+/**
+* Verifies the per-org worker token (`{orgId}.{hmac}` signed with the shared
+* platform secret) and records which org the calling machine belongs to.
+*/
+function requireWorkerToken(secret) {
+	return async (c, next) => {
+		if (!secret) return c.json({
+			error: "worker_auth_unconfigured",
+			message: "Worker auth is not configured."
+		}, 503);
+		const verified = require_dist.verifyOrgWorkerToken(secret, readWorkerTokenFromRequest(c));
+		if (!verified) return c.json({
+			error: "unauthorized",
+			message: "Invalid worker token."
+		}, 401);
+		c.set("workerOrganizationId", verified.organizationId);
+		return next();
+	};
+}
+/** Organization id bound to the verified worker token, if present. */
+function workerOrganizationIdFromContext(c) {
+	const value = c.get("workerOrganizationId");
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+//#endregion
+//#region src/routes/internal/with-project-scope.ts
+async function withProjectScope(projectId, fn) {
+	const project = await (0, _keystrokehq_platform_database.selectProjectById)(projectId);
+	if (!project) return;
+	const organization = await (0, _keystrokehq_platform_database.selectOrganizationById)(project.organizationId);
+	if (!organization) return;
+	const dbOptions = (0, _keystrokehq_platform_database.resolveOrgProjectDatabaseOptions)(organization);
+	let result;
+	await (0, _keystrokehq_platform_database.runWithOrganizationScope)(project.organizationId, () => (0, _keystrokehq_database.runWithProjectDatabase)(dbOptions, () => (0, _keystrokehq_database.runWithProjectScope)(project.id, () => (0, _keystrokehq_database.runWithTenantScope)(project.organizationId, async () => {
+		result = await fn({
+			organizationId: project.organizationId,
+			projectId: project.id
+		});
+	}))));
+	return result;
+}
+//#endregion
+Object.defineProperty(exports, "readWorkerTokenFromRequest", {
+	enumerable: true,
+	get: function() {
+		return readWorkerTokenFromRequest;
+	}
+});
+Object.defineProperty(exports, "requireWorkerToken", {
+	enumerable: true,
+	get: function() {
+		return requireWorkerToken;
+	}
+});
+Object.defineProperty(exports, "withProjectScope", {
+	enumerable: true,
+	get: function() {
+		return withProjectScope;
+	}
+});
+Object.defineProperty(exports, "workerOrganizationIdFromContext", {
+	enumerable: true,
+	get: function() {
+		return workerOrganizationIdFromContext;
+	}
+});
+
+//# sourceMappingURL=with-project-scope-Drmz2h2Z.cjs.map

package/dist/with-project-scope-Drmz2h2Z.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-project-scope-Drmz2h2Z.cjs","names":["verifyOrgWorkerToken"],"sources":["../src/middleware/require-worker-token.ts","../src/routes/internal/with-project-scope.ts"],"sourcesContent":["import type { Context, MiddlewareHandler } from \"hono\";\nimport { verifyOrgWorkerToken } from \"@keystrokehq/hosting\";\n\nexport type WorkerTokenVariables = {\n  workerOrganizationId: string;\n};\n\n/** Worker auth from Bearer or x-api-key (Anthropic SDK uses the latter). */\nexport function readWorkerTokenFromRequest(c: Context): string | undefined {\n  const authorization = c.req.header(\"authorization\");\n  if (authorization?.startsWith(\"Bearer \")) {\n    return authorization.slice(\"Bearer \".length).trim();\n  }\n\n  const apiKey = c.req.header(\"x-api-key\")?.trim();\n  if (apiKey) {\n    return apiKey;\n  }\n\n  return undefined;\n}\n\n/**\n * Verifies the per-org worker token (`{orgId}.{hmac}` signed with the shared\n * platform secret) and records which org the calling machine belongs to.\n */\nexport function requireWorkerToken(secret: string | undefined): MiddlewareHandler {\n  return async (c, next) => {\n    if (!secret) {\n      return c.json(\n        { error: \"worker_auth_unconfigured\", message: \"Worker auth is not configured.\" },\n        503,\n      );\n    }\n\n    const token = readWorkerTokenFromRequest(c);\n    const verified = verifyOrgWorkerToken(secret, token);\n    if (!verified) {\n      return c.json({ error: \"unauthorized\", message: \"Invalid worker token.\" }, 401);\n    }\n\n    c.set(\"workerOrganizationId\", verified.organizationId);\n    return next();\n  };\n}\n\n/** Organization id bound to the verified worker token, if present. */\nexport function workerOrganizationIdFromContext(c: Context): string | undefined {\n  const value = c.get(\"workerOrganizationId\");\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n","import {\n  runWithProjectDatabase,\n  runWithProjectScope,\n  runWithTenantScope,\n} from \"@keystrokehq/database\";\nimport {\n  resolveOrgProjectDatabaseOptions,\n  runWithOrganizationScope,\n  selectOrganizationById,\n  selectProjectById,\n} from \"@keystrokehq/platform-database\";\n\nexport async function withProjectScope<T>(\n  projectId: string,\n  fn: (ctx: { organizationId: string; projectId: string }) => Promise<T>,\n): Promise<T | undefined> {\n  const project = await selectProjectById(projectId);\n  if (!project) {\n    return undefined;\n  }\n\n  const organization = await selectOrganizationById(project.organizationId);\n  if (!organization) {\n    return undefined;\n  }\n\n  const dbOptions = resolveOrgProjectDatabaseOptions(organization);\n  let result: T | undefined;\n\n  await runWithOrganizationScope(project.organizationId, () =>\n    runWithProjectDatabase(dbOptions, () =>\n      runWithProjectScope(project.id, () =>\n        runWithTenantScope(project.organizationId, async () => {\n          result = await fn({\n            organizationId: project.organizationId,\n            projectId: project.id,\n          });\n        }),\n      ),\n    ),\n  );\n\n  return result;\n}\n"],"mappings":";;;;;AAQA,SAAgB,2BAA2B,GAAgC;CACzE,MAAM,gBAAgB,EAAE,IAAI,OAAO,eAAe;CAClD,IAAI,eAAe,WAAW,SAAS,GACrC,OAAO,cAAc,MAAM,CAAgB,EAAE,KAAK;CAGpD,MAAM,SAAS,EAAE,IAAI,OAAO,WAAW,GAAG,KAAK;CAC/C,IAAI,QACF,OAAO;AAIX;;;;;AAMA,SAAgB,mBAAmB,QAA+C;CAChF,OAAO,OAAO,GAAG,SAAS;EACxB,IAAI,CAAC,QACH,OAAO,EAAE,KACP;GAAE,OAAO;GAA4B,SAAS;EAAiC,GAC/E,GACF;EAIF,MAAM,WAAWA,aAAAA,qBAAqB,QADxB,2BAA2B,CACS,CAAC;EACnD,IAAI,CAAC,UACH,OAAO,EAAE,KAAK;GAAE,OAAO;GAAgB,SAAS;EAAwB,GAAG,GAAG;EAGhF,EAAE,IAAI,wBAAwB,SAAS,cAAc;EACrD,OAAO,KAAK;CACd;AACF;;AAGA,SAAgB,gCAAgC,GAAgC;CAC9E,MAAM,QAAQ,EAAE,IAAI,sBAAsB;CAC1C,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;;;ACtCA,eAAsB,iBACpB,WACA,IACwB;CACxB,MAAM,UAAU,OAAA,GAAA,+BAAA,mBAAwB,SAAS;CACjD,IAAI,CAAC,SACH;CAGF,MAAM,eAAe,OAAA,GAAA,+BAAA,wBAA6B,QAAQ,cAAc;CACxE,IAAI,CAAC,cACH;CAGF,MAAM,aAAA,GAAA,+BAAA,kCAA6C,YAAY;CAC/D,IAAI;CAEJ,OAAA,GAAA,+BAAA,0BAA+B,QAAQ,uBAAA,GAAA,sBAAA,wBACd,kBAAA,GAAA,sBAAA,qBACD,QAAQ,WAAA,GAAA,sBAAA,oBACP,QAAQ,gBAAgB,YAAY;EACrD,SAAS,MAAM,GAAG;GAChB,gBAAgB,QAAQ;GACxB,WAAW,QAAQ;EACrB,CAAC;CACH,CAAC,CACH,CACF,CACF;CAEA,OAAO;AACT"}