@llm-dev-ops/agentics-cli 1.4.27 → 1.4.29

package/dist/bundled-agents/analytics-hub-agents/dist/auth/audit.js

@@ -1,201 +0,0 @@
-"use strict";
-/**
- * Audit Logging System
- * Comprehensive audit trail for compliance (SOC 2, GDPR, HIPAA)
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.auditLogger = exports.AuditLogger = exports.AuditSeverity = exports.AuditAction = void 0;
-exports.auditLog = auditLog;
-var AuditAction;
-(function (AuditAction) {
-    // Authentication
-    AuditAction["USER_LOGIN"] = "user.login";
-    AuditAction["USER_LOGOUT"] = "user.logout";
-    AuditAction["USER_LOGIN_FAILED"] = "user.login.failed";
-    AuditAction["USER_MFA_ENABLED"] = "user.mfa.enabled";
-    AuditAction["USER_MFA_DISABLED"] = "user.mfa.disabled";
-    // Authorization
-    AuditAction["ACCESS_GRANTED"] = "access.granted";
-    AuditAction["ACCESS_DENIED"] = "access.denied";
-    // User management
-    AuditAction["USER_CREATED"] = "user.created";
-    AuditAction["USER_UPDATED"] = "user.updated";
-    AuditAction["USER_DELETED"] = "user.deleted";
-    AuditAction["USER_PASSWORD_CHANGED"] = "user.password.changed";
-    AuditAction["USER_ROLE_CHANGED"] = "user.role.changed";
-    // Data access
-    AuditAction["DATA_READ"] = "data.read";
-    AuditAction["DATA_CREATED"] = "data.created";
-    AuditAction["DATA_UPDATED"] = "data.updated";
-    AuditAction["DATA_DELETED"] = "data.deleted";
-    AuditAction["DATA_EXPORTED"] = "data.exported";
-    // API keys
-    AuditAction["API_KEY_CREATED"] = "api_key.created";
-    AuditAction["API_KEY_REVOKED"] = "api_key.revoked";
-    AuditAction["API_KEY_ROTATED"] = "api_key.rotated";
-    // System
-    AuditAction["CONFIG_CHANGED"] = "config.changed";
-    AuditAction["BACKUP_CREATED"] = "backup.created";
-    AuditAction["BACKUP_RESTORED"] = "backup.restored";
-    // GDPR
-    AuditAction["GDPR_DATA_EXPORT_REQUESTED"] = "gdpr.data_export.requested";
-    AuditAction["GDPR_DATA_EXPORTED"] = "gdpr.data_exported";
-    AuditAction["GDPR_DATA_DELETION_REQUESTED"] = "gdpr.data_deletion.requested";
-    AuditAction["GDPR_DATA_DELETED"] = "gdpr.data_deleted";
-    // Security
-    AuditAction["SECURITY_ANOMALY_DETECTED"] = "security.anomaly.detected";
-    AuditAction["RATE_LIMIT_EXCEEDED"] = "security.rate_limit.exceeded";
-    AuditAction["SUSPICIOUS_ACTIVITY"] = "security.suspicious_activity";
-})(AuditAction || (exports.AuditAction = AuditAction = {}));
-var AuditSeverity;
-(function (AuditSeverity) {
-    AuditSeverity["INFO"] = "info";
-    AuditSeverity["WARNING"] = "warning";
-    AuditSeverity["CRITICAL"] = "critical";
-})(AuditSeverity || (exports.AuditSeverity = AuditSeverity = {}));
-class AuditLogger {
-    /**
-     * Log audit event
-     */
-    async log(event) {
-        const auditLog = {
-            id: this.generateId(),
-            timestamp: new Date(),
-            ...event,
-        };
-        // In production, this would:
-        // 1. Write to database (TimescaleDB for time-series audit logs)
-        // 2. Write to secure audit log file
-        // 3. Send to SIEM system
-        // 4. Optionally send to compliance monitoring service
-        await this.persistAuditLog(auditLog);
-        await this.sendToSIEM(auditLog);
-        // Log critical events immediately
-        if (event.severity === AuditSeverity.CRITICAL) {
-            await this.alertSecurityTeam(auditLog);
-        }
-    }
-    /**
-     * Log from Fastify request
-     */
-    async logFromRequest(request, action, options) {
-        const authRequest = request;
-        await this.log({
-            action,
-            severity: options.severity || AuditSeverity.INFO,
-            userId: authRequest.user?.userId,
-            userEmail: authRequest.user?.email,
-            organizationId: authRequest.user?.organizationId,
-            resourceType: options.resourceType,
-            resourceId: options.resourceId,
-            ipAddress: this.getClientIP(request),
-            userAgent: request.headers['user-agent'],
-            sessionId: authRequest.user?.sessionId,
-            details: options.details,
-            result: options.result,
-            errorMessage: options.errorMessage,
-        });
-    }
-    /**
-     * Query audit logs (for compliance reports)
-     */
-    async queryLogs(_filters) {
-        // In production: Query TimescaleDB
-        // SELECT * FROM audit_logs WHERE ...
-        return { logs: [], total: 0 };
-    }
-    /**
-     * Generate compliance report
-     */
-    async generateComplianceReport(_startDate, _endDate, _reportType) {
-        // In production: Aggregate audit logs for compliance reporting
-        return {
-            totalEvents: 0,
-            criticalEvents: 0,
-            accessDenials: 0,
-            dataExports: 0,
-            dataDeletions: 0,
-            securityAnomalies: 0,
-        };
-    }
-    /**
-     * Get client IP address
-     */
-    getClientIP(request) {
-        return (request.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
-            request.headers['x-real-ip'] ||
-            request.ip ||
-            'unknown');
-    }
-    /**
-     * Generate unique audit log ID
-     */
-    generateId() {
-        return `audit_${Date.now()}_${Math.random().toString(36).substring(7)}`;
-    }
-    /**
-     * Persist audit log to database
-     */
-    async persistAuditLog(_log) {
-        // In production:
-        // await db.query(`
-        //   INSERT INTO audit_logs (id, timestamp, action, severity, user_id, ...)
-        //   VALUES ($1, $2, $3, $4, $5, ...)
-        // `, [...values]);
-        // console.log('Audit log:', JSON.stringify(log));
-    }
-    /**
-     * Send to SIEM system
-     */
-    async sendToSIEM(_log) {
-        // In production: Send to Splunk, ELK, or other SIEM
-    }
-    /**
-     * Alert security team for critical events
-     */
-    async alertSecurityTeam(_log) {
-        // In production: Send to PagerDuty, Slack, email
-        // console.warn('CRITICAL AUDIT EVENT:', log);
-    }
-}
-exports.AuditLogger = AuditLogger;
-exports.auditLogger = new AuditLogger();
-/**
- * Audit middleware decorator
- */
-function auditLog(action, options) {
-    return (_target, _propertyKey, descriptor) => {
-        const originalMethod = descriptor.value;
-        descriptor.value = async function (...args) {
-            const request = args[0];
-            let result = 'success';
-            let errorMessage;
-            let resourceId;
-            try {
-                const response = await originalMethod.apply(this, args);
-                // Try to extract resource ID from response
-                if (response?.data?.id) {
-                    resourceId = response.data.id;
-                }
-                return response;
-            }
-            catch (error) {
-                result = 'failure';
-                errorMessage = error instanceof Error ? error.message : 'Unknown error';
-                throw error;
-            }
-            finally {
-                // Log the audit event
-                await exports.auditLogger.logFromRequest(request, action, {
-                    severity: options?.severity || AuditSeverity.INFO,
-                    resourceType: options?.resourceType,
-                    resourceId,
-                    result,
-                    errorMessage,
-                });
-            }
-        };
-        return descriptor;
-    };
-}
-//# sourceMappingURL=audit.js.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/audit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/auth/audit.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AA0OH,4BAwCC;AA7QD,IAAY,WA8CX;AA9CD,WAAY,WAAW;IACrB,iBAAiB;IACjB,wCAAyB,CAAA;IACzB,0CAA2B,CAAA;IAC3B,sDAAuC,CAAA;IACvC,oDAAqC,CAAA;IACrC,sDAAuC,CAAA;IAEvC,gBAAgB;IAChB,gDAAiC,CAAA;IACjC,8CAA+B,CAAA;IAE/B,kBAAkB;IAClB,4CAA6B,CAAA;IAC7B,4CAA6B,CAAA;IAC7B,4CAA6B,CAAA;IAC7B,8DAA+C,CAAA;IAC/C,sDAAuC,CAAA;IAEvC,cAAc;IACd,sCAAuB,CAAA;IACvB,4CAA6B,CAAA;IAC7B,4CAA6B,CAAA;IAC7B,4CAA6B,CAAA;IAC7B,8CAA+B,CAAA;IAE/B,WAAW;IACX,kDAAmC,CAAA;IACnC,kDAAmC,CAAA;IACnC,kDAAmC,CAAA;IAEnC,SAAS;IACT,gDAAiC,CAAA;IACjC,gDAAiC,CAAA;IACjC,kDAAmC,CAAA;IAEnC,OAAO;IACP,wEAAyD,CAAA;IACzD,wDAAyC,CAAA;IACzC,4EAA6D,CAAA;IAC7D,sDAAuC,CAAA;IAEvC,WAAW;IACX,sEAAuD,CAAA;IACvD,mEAAoD,CAAA;IACpD,mEAAoD,CAAA;AACtD,CAAC,EA9CW,WAAW,2BAAX,WAAW,QA8CtB;AAED,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,oCAAmB,CAAA;IACnB,sCAAqB,CAAA;AACvB,CAAC,EAJW,aAAa,6BAAb,aAAa,QAIxB;AAoBD,MAAa,WAAW;IACtB;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,KAAyC;QACjD,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,GAAG,KAAK;SACT,CAAC;QAEF,6BAA6B;QAC7B,gEAAgE;QAChE,oCAAoC;QACpC,yBAAyB;QACzB,sDAAsD;QAEtD,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhC,kCAAkC;QAClC,IAAI,KAAK,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAuB,EACvB,MAAmB,EACnB,OAOC;QAED,MAAM,WAAW,GAAG,OAA+B,CAAC;QAEpD,MAAM,IAAI,CAAC,GAAG,CAAC;YACb,MAAM;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI;YAChD,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,MAAM;YAChC,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK;YAClC,cAAc,EAAE,WAAW,CAAC,IAAI,EAAE,cAAc;YAChD,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;YACxC,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,SAAS;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,QASf;QACC,mCAAmC;QACnC,qCAAqC;QACrC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,UAAgB,EAChB,QAAc,EACd,WAAsC;QAStC,+DAA+D;QAC/D,OAAO;YACL,WAAW,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;YACjB,aAAa,EAAE,CAAC;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,CAAC;YAChB,iBAAiB,EAAE,CAAC;SACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAAuB;QACzC,OAAO,CACJ,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YACpE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAY;YACxC,OAAO,CAAC,EAAE;YACV,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,UAAU;QAChB,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe,CAAC,IAAc;QAC1C,iBAAiB;QACjB,mBAAmB;QACnB,2EAA2E;QAC3E,qCAAqC;QACrC,mBAAmB;QAEnB,kDAAkD;IACpD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CAAC,IAAc;QACrC,oDAAoD;IACtD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAAC,IAAc;QAC5C,iDAAiD;QACjD,8CAA8C;IAChD,CAAC;CACF;AAtJD,kCAsJC;AAEY,QAAA,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAE7C;;GAEG;AACH,SAAgB,QAAQ,CAAC,MAAmB,EAAE,OAG7C;IACC,OAAO,CAAC,OAAY,EAAE,YAAoB,EAAE,UAA8B,EAAE,EAAE;QAC5E,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC;QAExC,UAAU,CAAC,KAAK,GAAG,KAAK,WAAW,GAAG,IAAW;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAmB,CAAC;YAC1C,IAAI,MAAM,GAA0B,SAAS,CAAC;YAC9C,IAAI,YAAgC,CAAC;YACrC,IAAI,UAA8B,CAAC;YAEnC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAExD,2CAA2C;gBAC3C,IAAI,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;oBACvB,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,CAAC;gBAED,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,SAAS,CAAC;gBACnB,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACxE,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,sBAAsB;gBACtB,MAAM,mBAAW,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE;oBAChD,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,aAAa,CAAC,IAAI;oBACjD,YAAY,EAAE,OAAO,EAAE,YAAY;oBACnC,UAAU;oBACV,MAAM;oBACN,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/jwt.d.ts

@@ -1,55 +0,0 @@
-/**
- * JWT Token Management
- * Handles JWT generation, validation, and refresh token management
- */
-export interface JWTPayload {
-    userId: string;
-    email: string;
-    roles: string[];
-    permissions: string[];
-    organizationId?: string;
-    sessionId: string;
-    mfaVerified: boolean;
-}
-export interface TokenPair {
-    accessToken: string;
-    refreshToken: string;
-    expiresIn: number;
-}
-export declare class JWTManager {
-    private accessTokenSecret;
-    private refreshTokenSecret;
-    private accessTokenExpiry;
-    private refreshTokenExpiry;
-    constructor();
-    private generateSecret;
-    /**
-     * Generate access and refresh token pair
-     */
-    generateTokenPair(payload: JWTPayload): Promise<TokenPair>;
-    /**
-     * Verify access token
-     */
-    verifyAccessToken(token: string): Promise<JWTPayload>;
-    /**
-     * Verify refresh token
-     */
-    verifyRefreshToken(token: string): Promise<{
-        userId: string;
-        sessionId: string;
-    }>;
-    /**
-     * Decode token without verification (for debugging)
-     */
-    decodeToken(token: string): any;
-    /**
-     * Parse expiry string to seconds
-     */
-    private parseExpiry;
-    /**
-     * Generate session ID
-     */
-    generateSessionId(): Promise<string>;
-}
-export declare const jwtManager: JWTManager;
-//# sourceMappingURL=jwt.d.ts.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/jwt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,kBAAkB,CAAS;;IASnC,OAAO,CAAC,cAAc;IAItB;;OAEG;IACG,iBAAiB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAmChE;;OAEG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB3D;;OAEG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAuBvF;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG;IAI/B;;OAEG;IACH,OAAO,CAAC,WAAW;IAkBnB;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;CAI3C;AAED,eAAO,MAAM,UAAU,YAAmB,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/jwt.js

@@ -1,139 +0,0 @@
-"use strict";
-/**
- * JWT Token Management
- * Handles JWT generation, validation, and refresh token management
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.jwtManager = exports.JWTManager = void 0;
-const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
-const crypto_1 = require("crypto");
-const util_1 = require("util");
-const randomBytesAsync = (0, util_1.promisify)(crypto_1.randomBytes);
-class JWTManager {
-    accessTokenSecret;
-    refreshTokenSecret;
-    accessTokenExpiry;
-    refreshTokenExpiry;
-    constructor() {
-        this.accessTokenSecret = process.env.JWT_ACCESS_SECRET || this.generateSecret();
-        this.refreshTokenSecret = process.env.JWT_REFRESH_SECRET || this.generateSecret();
-        this.accessTokenExpiry = process.env.JWT_ACCESS_EXPIRY || '15m';
-        this.refreshTokenExpiry = process.env.JWT_REFRESH_EXPIRY || '7d';
-    }
-    generateSecret() {
-        return (0, crypto_1.randomBytes)(64).toString('hex');
-    }
-    /**
-     * Generate access and refresh token pair
-     */
-    async generateTokenPair(payload) {
-        const accessToken = jsonwebtoken_1.default.sign({
-            ...payload,
-            type: 'access',
-        }, this.accessTokenSecret, {
-            expiresIn: this.accessTokenExpiry,
-            issuer: 'llm-analytics-hub',
-            audience: 'llm-analytics-api',
-        });
-        const refreshToken = jsonwebtoken_1.default.sign({
-            userId: payload.userId,
-            sessionId: payload.sessionId,
-            type: 'refresh',
-        }, this.refreshTokenSecret, {
-            expiresIn: this.refreshTokenExpiry,
-            issuer: 'llm-analytics-hub',
-            audience: 'llm-analytics-api',
-        });
-        return {
-            accessToken,
-            refreshToken,
-            expiresIn: this.parseExpiry(this.accessTokenExpiry),
-        };
-    }
-    /**
-     * Verify access token
-     */
-    async verifyAccessToken(token) {
-        try {
-            const decoded = jsonwebtoken_1.default.verify(token, this.accessTokenSecret, {
-                issuer: 'llm-analytics-hub',
-                audience: 'llm-analytics-api',
-            });
-            if (decoded.type !== 'access') {
-                throw new Error('Invalid token type');
-            }
-            return decoded;
-        }
-        catch (error) {
-            if (error instanceof jsonwebtoken_1.default.TokenExpiredError) {
-                throw new Error('Token expired');
-            }
-            if (error instanceof jsonwebtoken_1.default.JsonWebTokenError) {
-                throw new Error('Invalid token');
-            }
-            throw error;
-        }
-    }
-    /**
-     * Verify refresh token
-     */
-    async verifyRefreshToken(token) {
-        try {
-            const decoded = jsonwebtoken_1.default.verify(token, this.refreshTokenSecret, {
-                issuer: 'llm-analytics-hub',
-                audience: 'llm-analytics-api',
-            });
-            if (decoded.type !== 'refresh') {
-                throw new Error('Invalid token type');
-            }
-            return { userId: decoded.userId, sessionId: decoded.sessionId };
-        }
-        catch (error) {
-            if (error instanceof jsonwebtoken_1.default.TokenExpiredError) {
-                throw new Error('Refresh token expired');
-            }
-            if (error instanceof jsonwebtoken_1.default.JsonWebTokenError) {
-                throw new Error('Invalid refresh token');
-            }
-            throw error;
-        }
-    }
-    /**
-     * Decode token without verification (for debugging)
-     */
-    decodeToken(token) {
-        return jsonwebtoken_1.default.decode(token);
-    }
-    /**
-     * Parse expiry string to seconds
-     */
-    parseExpiry(expiry) {
-        const unit = expiry.slice(-1);
-        const value = parseInt(expiry.slice(0, -1));
-        switch (unit) {
-            case 's':
-                return value;
-            case 'm':
-                return value * 60;
-            case 'h':
-                return value * 3600;
-            case 'd':
-                return value * 86400;
-            default:
-                return 900; // 15 minutes default
-        }
-    }
-    /**
-     * Generate session ID
-     */
-    async generateSessionId() {
-        const buffer = await randomBytesAsync(32);
-        return buffer.toString('hex');
-    }
-}
-exports.JWTManager = JWTManager;
-exports.jwtManager = new JWTManager();
-//# sourceMappingURL=jwt.js.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/jwt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAEH,gEAA+B;AAC/B,mCAAqC;AACrC,+BAAiC;AAEjC,MAAM,gBAAgB,GAAG,IAAA,gBAAS,EAAC,oBAAW,CAAC,CAAC;AAkBhD,MAAa,UAAU;IACb,iBAAiB,CAAS;IAC1B,kBAAkB,CAAS;IAC3B,iBAAiB,CAAS;IAC1B,kBAAkB,CAAS;IAEnC;QACE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAChF,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAClF,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAChE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC;IACnE,CAAC;IAEO,cAAc;QACpB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAmB;QACzC,MAAM,WAAW,GAAG,sBAAG,CAAC,IAAI,CAC1B;YACE,GAAG,OAAO;YACV,IAAI,EAAE,QAAQ;SACf,EACD,IAAI,CAAC,iBAAiB,EACtB;YACE,SAAS,EAAE,IAAI,CAAC,iBAA2B;YAC3C,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,mBAAmB;SACX,CACrB,CAAC;QAEF,MAAM,YAAY,GAAG,sBAAG,CAAC,IAAI,CAC3B;YACE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,SAAS;SAChB,EACD,IAAI,CAAC,kBAAkB,EACvB;YACE,SAAS,EAAE,IAAI,CAAC,kBAA4B;YAC5C,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,mBAAmB;SACX,CACrB,CAAC;QAEF,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC;SACpD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE;gBACxD,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,mBAAmB;aAC9B,CAAkC,CAAC;YAEpC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,KAAK,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE;gBACzD,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,mBAAmB;aAC9B,CAAwD,CAAC;YAE1D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,KAAK,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACvB,OAAO,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,MAAc;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5C,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,KAAK,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,IAAI,CAAC;YACtB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,KAAK,CAAC;YACvB;gBACE,OAAO,GAAG,CAAC,CAAC,qBAAqB;QACrC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;CACF;AA9ID,gCA8IC;AAEY,QAAA,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/mfa.d.ts

@@ -1,37 +0,0 @@
-/**
- * Multi-Factor Authentication (MFA)
- * TOTP-based two-factor authentication
- */
-export interface MFASetup {
-    secret: string;
-    qrCodeUrl: string;
-    backupCodes: string[];
-}
-export declare class MFAManager {
-    /**
-     * Generate MFA secret and QR code
-     */
-    setupMFA(_userId: string, email: string): Promise<MFASetup>;
-    /**
-     * Verify TOTP token
-     */
-    verifyToken(secret: string, token: string): boolean;
-    /**
-     * Generate backup codes
-     */
-    private generateBackupCodes;
-    /**
-     * Generate random alphanumeric code
-     */
-    private generateRandomCode;
-    /**
-     * Verify backup code
-     */
-    verifyBackupCode(_userId: string, code: string, usedCodes: string[]): Promise<boolean>;
-    /**
-     * Generate current TOTP token (for testing)
-     */
-    generateToken(secret: string): string;
-}
-export declare const mfaManager: MFAManager;
-//# sourceMappingURL=mfa.d.ts.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/mfa.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../../src/auth/mfa.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,qBAAa,UAAU;IACrB;;OAEG;IACG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqBjE;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IASnD;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC;IAWnB;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAMtC;AAED,eAAO,MAAM,UAAU,YAAmB,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/mfa.js

@@ -1,123 +0,0 @@
-"use strict";
-/**
- * Multi-Factor Authentication (MFA)
- * TOTP-based two-factor authentication
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mfaManager = exports.MFAManager = void 0;
-const speakeasy = __importStar(require("speakeasy"));
-const QRCode = __importStar(require("qrcode"));
-class MFAManager {
-    /**
-     * Generate MFA secret and QR code
-     */
-    async setupMFA(_userId, email) {
-        // Generate secret
-        const secret = speakeasy.generateSecret({
-            name: `LLM Analytics Hub (${email})`,
-            issuer: 'LLM Analytics Hub',
-            length: 32,
-        });
-        // Generate QR code
-        const qrCodeUrl = await QRCode.toDataURL(secret.otpauth_url);
-        // Generate backup codes
-        const backupCodes = this.generateBackupCodes();
-        return {
-            secret: secret.base32,
-            qrCodeUrl,
-            backupCodes,
-        };
-    }
-    /**
-     * Verify TOTP token
-     */
-    verifyToken(secret, token) {
-        return speakeasy.totp.verify({
-            secret,
-            encoding: 'base32',
-            token,
-            window: 2, // Allow 2 time steps before/after for clock skew
-        });
-    }
-    /**
-     * Generate backup codes
-     */
-    generateBackupCodes(count = 10) {
-        const codes = [];
-        for (let i = 0; i < count; i++) {
-            // Generate 8-character alphanumeric code
-            const code = this.generateRandomCode(8);
-            codes.push(code);
-        }
-        return codes;
-    }
-    /**
-     * Generate random alphanumeric code
-     */
-    generateRandomCode(length) {
-        const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; // Removed confusing chars
-        let code = '';
-        for (let i = 0; i < length; i++) {
-            code += chars.charAt(Math.floor(Math.random() * chars.length));
-        }
-        // Format as XXXX-XXXX for readability
-        return code.match(/.{1,4}/g)?.join('-') || code;
-    }
-    /**
-     * Verify backup code
-     */
-    async verifyBackupCode(_userId, code, usedCodes) {
-        // Check if code was already used
-        if (usedCodes.includes(code)) {
-            return false;
-        }
-        // Backup codes would be stored in database
-        // This is a placeholder for the verification logic
-        return true;
-    }
-    /**
-     * Generate current TOTP token (for testing)
-     */
-    generateToken(secret) {
-        return speakeasy.totp({
-            secret,
-            encoding: 'base32',
-        });
-    }
-}
-exports.MFAManager = MFAManager;
-exports.mfaManager = new MFAManager();
-//# sourceMappingURL=mfa.js.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/mfa.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../../src/auth/mfa.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,qDAAuC;AACvC,+CAAiC;AAQjC,MAAa,UAAU;IACrB;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,KAAa;QAC3C,kBAAkB;QAClB,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC;YACtC,IAAI,EAAE,sBAAsB,KAAK,GAAG;YACpC,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAY,CAAC,CAAC;QAE9D,wBAAwB;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE/C,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS;YACT,WAAW;SACZ,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc,EAAE,KAAa;QACvC,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;YAC3B,MAAM;YACN,QAAQ,EAAE,QAAQ;YAClB,KAAK;YACL,MAAM,EAAE,CAAC,EAAE,iDAAiD;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,QAAgB,EAAE;QAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,yCAAyC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,MAAc;QACvC,MAAM,KAAK,GAAG,kCAAkC,CAAC,CAAC,0BAA0B;QAC5E,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,sCAAsC;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,IAAY,EACZ,SAAmB;QAEnB,iCAAiC;QACjC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2CAA2C;QAC3C,mDAAmD;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAc;QAC1B,OAAO,SAAS,CAAC,IAAI,CAAC;YACpB,MAAM;YACN,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AA1FD,gCA0FC;AAEY,QAAA,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/middleware.d.ts

@@ -1,35 +0,0 @@
-/**
- * Authentication Middleware
- * Handles JWT validation, API key authentication, and request decoration
- */
-import { FastifyRequest, FastifyReply } from 'fastify';
-export interface AuthOptions {
-    required?: boolean;
-    allowApiKey?: boolean;
-    requireMFA?: boolean;
-}
-/**
- * Authentication middleware
- */
-export declare function authenticate(request: FastifyRequest, reply: FastifyReply, options?: AuthOptions): Promise<void>;
-/**
- * Require authentication (throws error if not authenticated)
- */
-export declare function requireAuth(request: FastifyRequest, reply: FastifyReply): Promise<void>;
-/**
- * Optional authentication (doesn't throw if not authenticated)
- */
-export declare function optionalAuth(request: FastifyRequest, reply: FastifyReply): Promise<void>;
-/**
- * Require MFA
- */
-export declare function requireMFA(request: FastifyRequest, reply: FastifyReply): Promise<void>;
-/**
- * CSRF Token Validation Middleware
- */
-export declare function validateCSRF(request: FastifyRequest, reply: FastifyReply): Promise<void>;
-/**
- * Rate limiting by user
- */
-export declare function createUserRateLimiter(max: number, timeWindow: number): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
-//# sourceMappingURL=middleware.d.ts.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/middleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,WAAgB,iBAqE1B;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,iBAGpB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,iBAGpB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,iBAGpB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,iBA6BpB;AAcD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,IAGrD,SAAS,cAAc,EAAE,OAAO,YAAY,mBA0C3D"}