@keystrokehq/platform 0.1.165 → 0.1.167

package/dist/{with-project-scope-Qyn-vEQT.mjs → with-project-scope-fwIUr56U.mjs}

@@ -1,4 +1,4 @@
-import { Aa as PROJECT_SERVER_HEALTH, B as sha256Hex, F as projectSourceBlobKey, Fa as verifyOrgWorkerToken, Ht as ErrorResponseSchema, Ji as mapProjectArtifact, Li as isIgnoredProjectSourcePath, M as projectArtifactIndexKey, P as projectModuleBlobKey, Pr as StoredProjectSourceManifestSchema, ba as ACTIVE_ORG_HEADER, c as formatStorageErrorDetail, ca as projectFileId, qi as mapProject, s as extractRouteManifestFromArtifact, sa as parseStoredRouteManifest, v as isProjectArtifactIndexKey, x as isStorageNotFoundError, y as isProjectArtifactTarballKey, zi as isProbablyBinaryProjectSource } from "./project-draft-notifier-BSypKj9V.mjs";
+import { B as sha256Hex, Bi as isProbablyBinaryProjectSource, F as projectSourceBlobKey, Fr as StoredProjectSourceManifestSchema, Ia as verifyOrgWorkerToken, Ji as mapProject, M as projectArtifactIndexKey, P as projectModuleBlobKey, Ri as isIgnoredProjectSourcePath, Ut as ErrorResponseSchema, Yi as mapProjectArtifact, c as formatStorageErrorDetail, ca as parseStoredRouteManifest, ja as PROJECT_SERVER_HEALTH, la as projectFileId, s as extractRouteManifestFromArtifact, v as isProjectArtifactIndexKey, x as isStorageNotFoundError, xa as ACTIVE_ORG_HEADER, y as isProjectArtifactTarballKey } from "./project-draft-notifier-CWDmJI58.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { runWithProjectDatabase, runWithProjectScope, runWithTenantScope } from "@keystrokehq/database";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -44,6 +44,11 @@ function setTelemetryContext(patch) {
 	if (patch.organizationId !== void 0) current.organizationId = patch.organizationId;
 	if (patch.projectId !== void 0) current.projectId = patch.projectId;
 	if (patch.sessionId !== void 0) current.sessionId = patch.sessionId;
+	if (patch.requestId !== void 0) current.requestId = patch.requestId;
+	if (patch.runId !== void 0) current.runId = patch.runId;
+	if (patch.jobId !== void 0) current.jobId = patch.jobId;
+	if (patch.authMethod !== void 0) current.authMethod = patch.authMethod;
+	if (patch.credentialId !== void 0) current.credentialId = patch.credentialId;
 	if (patch.client !== void 0) current.client = patch.client;
 }
 /**
@@ -115,6 +120,11 @@ function contextAttributes(attributes) {
 		...context?.organizationId ? { organization_id: context.organizationId } : {},
 		...context?.projectId ? { project_id: context.projectId } : {},
 		...context?.sessionId ? { session_id: context.sessionId } : {},
+		...context?.requestId ? { request_id: context.requestId } : {},
+		...context?.runId ? { run_id: context.runId } : {},
+		...context?.jobId ? { job_id: context.jobId } : {},
+		...context?.authMethod ? { auth_method: context.authMethod } : {},
+		...context?.credentialId ? { credential_id: context.credentialId } : {},
 		...attributes
 	};
 	return Object.keys(merged).length > 0 ? merged : void 0;
@@ -315,7 +325,7 @@ function getProjectInvitePermission(c) {
 	return c.get("project").invitePermission;
 }
 //#endregion
-//#region ../../packages/http/dist/require-session-fERJkKuQ.mjs
+//#region ../../packages/http/dist/require-session-lwrkQrHa.mjs
 function resolveActiveOrganizationId(c) {
 	const header = c.req.header(ACTIVE_ORG_HEADER)?.trim();
 	if (header) return header;
@@ -437,7 +447,11 @@ function requireSession(jwtVerifier) {
 		if (result) {
 			c.set("user", result.user);
 			c.set("session", result.session);
-			setTelemetryContext({ actorId: result.user.id });
+			setTelemetryContext({
+				actorId: result.user.id,
+				authMethod: "session",
+				credentialId: result.session.id
+			});
 			await next();
 			return;
 		}
@@ -456,13 +470,20 @@ function requireSession(jwtVerifier) {
 					});
 					setTelemetryContext({
 						actorId: session.user.id,
-						organizationId: verified.organizationId
+						organizationId: verified.organizationId,
+						authMethod: "api_key",
+						credentialId: verified.apiKeyId
 					});
 					await next();
 					return;
 				}
 			}
 		}
+		if (apiKeySecret) log.warn("security.auth_failed", {
+			auth_method: "api_key",
+			credential_fingerprint: createHash("sha256").update(apiKeySecret).digest("hex").slice(0, 16),
+			reason: "invalid_credential"
+		});
 		return c.json({ error: "Unauthorized" }, 401);
 	};
 }
@@ -2611,6 +2632,11 @@ function requireWorkerToken(secret) {
 			message: "Invalid worker token."
 		}, 401);
 		c.set("workerOrganizationId", verified.organizationId);
+		setTelemetryContext({
+			organizationId: verified.organizationId,
+			authMethod: "worker_token",
+			credentialId: `worker:${verified.organizationId}`
+		});
 		return next();
 	};
 }
@@ -2639,4 +2665,4 @@ async function withProjectScope(projectId, fn) {
 //#endregion
 export { canInviteToProject as $, toProjectGitRepository as A, requireSession as B, createProjectSourceServiceFactory as C, ProjectRepositoryNotReadyError as D, trackProductEvent as E, authorize as F, agentListScope as G, routeProject as H, forbidden as I, canAccessAgent as J, apiKeyListScope as K, requireOrganization as L, ProjectGitProviderError as M, assertRepositoryRelativePath as N, archiveProjectRepositoryInline as O, isProjectGitProviderError as P, canInviteRole as Q, requireProject as R, createOrgBoundProjectSourceService as S, identifyOrganizationGroup as T, accessContext as U, requireVerifiedOrganization as V, getProjectInvitePermission as W, canAccessSkill as X, canAccessHistoryRun as Y, canAccessWorkflow as Z, commitProjectDraftFromDiff as _, cancelManagedDeploy as a, credentialListScope as at, ProjectSourceHttpError as b, prepareManagedDeploy as c, organizationActions as ct, ManagedDeployError as d, skillListScope as dt, canReadApiKey as et, deleteManagedDeployCandidateBestEffort as f, userActions as ft, commitProjectDraft as g, pingProjectTarget as gt, DraftCommitValidationError as h, log as ht, workerOrganizationIdFromContext as i, checkPermission as it, MANAGED_DRAFT_BRANCH as j, provisionProjectRepositoryInline as k, publishManagedDeployCandidate as l, projectActions as lt, DraftCommitConflictError as m, event as mt, readWorkerTokenFromRequest as n, canRevokeApiKey as nt, completeManagedDeployArtifact as o, historyListScope as ot, promoteManagedDeployMain as p, workflowListScope as pt, apiKeysActions as q, requireWorkerToken as r, canViewCredential as rt, heartbeatManagedDeploy as s, managedServicesActions as st, withProjectScope as t, canReadProject as tt, renewManagedDeployUpload as u, projectListScope as ut, mapDraftCommitError as v, mapProjectSourceError as w, assertAvailable as x, ensureProjectRepositoryReady as y, requireProjectMembership as z };
 
-//# sourceMappingURL=with-project-scope-Qyn-vEQT.mjs.map
+//# sourceMappingURL=with-project-scope-fwIUr56U.mjs.map