@loom-framework/core 0.1.0-alpha.17 → 0.1.0-alpha.171

package/dist/backend/ai/session-manager.js

@@ -0,0 +1,304 @@
+/**
+ * Session Manager
+ *
+ * Manages AI sessions with lazy creation.
+ * Sessions are persisted to .loom/sessions/ as JSON files.
+ */
+import { promises as fs } from 'fs';
+import path from 'path';
+import { generateId } from '../../utils/id.js';
+export class SessionManager {
+    paths;
+    defaultUserId;
+    /** In-memory session index for fast listing */
+    sessionIndex = { sessions: [], lastUpdated: '' };
+    /** Per-session mutex locks to prevent read-modify-write race conditions */
+    locks = new Map();
+    constructor(paths, defaultUserId = 'admin') {
+        this.paths = paths;
+        this.defaultUserId = defaultUserId;
+    }
+    get sessionsDir() {
+        return this.paths.forUser(this.defaultUserId).sessions;
+    }
+    /**
+     * Acquire a per-key mutex lock. Prevents concurrent read-modify-write on the same session.
+     */
+    async withLock(key, fn) {
+        // Wait for any existing lock to release
+        while (this.locks.has(key)) {
+            await this.locks.get(key);
+        }
+        // Acquire lock
+        let resolve;
+        const promise = new Promise((r) => { resolve = r; });
+        this.locks.set(key, promise);
+        try {
+            return await fn();
+        }
+        finally {
+            this.locks.delete(key);
+            resolve();
+        }
+    }
+    /**
+     * Ensure sessions directory exists and load index
+     */
+    async initialize() {
+        await fs.mkdir(this.sessionsDir, { recursive: true });
+        // Try to load index from disk
+        const indexLoaded = await this.loadIndex();
+        if (!indexLoaded) {
+            // Fallback: rebuild index from session files
+            const sessions = await this.listSessionsFromFiles();
+            this.sessionIndex = {
+                sessions: sessions.map((s) => ({
+                    id: s.id,
+                    title: s.title,
+                    updatedAt: s.updatedAt,
+                    createdAt: s.createdAt,
+                })),
+                lastUpdated: new Date().toISOString(),
+            };
+            await this.saveIndex();
+        }
+    }
+    /**
+     * Create a new session on demand (lazy, no pre-allocation)
+     * Safe against race conditions: checks if session already exists before creating.
+     */
+    async createSession(id) {
+        const sessionId = id || generateSessionId();
+        return this.withLock(sessionId, async () => {
+            // Check if session already exists (handles getOrCreate race condition)
+            const existing = await this.readSession(sessionId);
+            if (existing)
+                return existing;
+            const now = new Date().toISOString();
+            const session = {
+                id: sessionId,
+                title: 'New Session',
+                createdAt: now,
+                updatedAt: now,
+                messages: [],
+            };
+            await this.writeSessionFile(session);
+            // Update index (avoid duplicates)
+            if (!this.sessionIndex.sessions.some(e => e.id === sessionId)) {
+                this.sessionIndex.sessions.push({
+                    id: sessionId,
+                    title: session.title,
+                    updatedAt: session.updatedAt,
+                    createdAt: session.createdAt,
+                });
+                this.sessionIndex.lastUpdated = new Date().toISOString();
+                await this.saveIndex();
+            }
+            return session;
+        });
+    }
+    /**
+     * Read a session by ID
+     */
+    async readSession(id) {
+        const filePath = this.getSessionPath(id);
+        try {
+            const content = await fs.readFile(filePath, 'utf-8');
+            return JSON.parse(content);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Add messages to a session and update claudeSessionId
+     */
+    async addMessages(id, messages, claudeSessionId, usage) {
+        return this.withLock(id, async () => {
+            const session = await this.readSession(id);
+            if (!session) {
+                throw new Error(`Session not found: ${id}`);
+            }
+            session.messages.push(...messages);
+            session.updatedAt = new Date().toISOString();
+            if (claudeSessionId) {
+                session.claudeSessionId = claudeSessionId;
+            }
+            if (usage) {
+                session.usage = usage;
+            }
+            // Auto-title from first user message
+            if (session.title === 'New Session' && session.messages.length > 0) {
+                const firstUser = session.messages.find((m) => m.role === 'user');
+                if (firstUser) {
+                    session.title = firstUser.content.slice(0, 80) + (firstUser.content.length > 80 ? '...' : '');
+                }
+            }
+            await this.writeSessionFile(session);
+            // Sync index entry (title may have changed)
+            const idxEntry = this.sessionIndex.sessions.find((e) => e.id === id);
+            if (idxEntry) {
+                idxEntry.title = session.title;
+                idxEntry.updatedAt = session.updatedAt;
+            }
+            this.sessionIndex.lastUpdated = new Date().toISOString();
+            await this.saveIndex();
+            return session;
+        });
+    }
+    /**
+     * List all sessions sorted by most recent first (from index, O(1))
+     */
+    async listSessions() {
+        // Use index for fast path: only return summary data
+        // For full records, callers should use readSession(id)
+        const entries = [...this.sessionIndex.sessions];
+        entries.sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
+        // Map index entries to minimal SessionRecord shape
+        return entries.map((e) => ({
+            id: e.id,
+            title: e.title,
+            createdAt: e.createdAt,
+            updatedAt: e.updatedAt,
+            messages: [],
+        }));
+    }
+    /**
+     * List full session records from files (fallback, used during initialization)
+     */
+    async listSessionsFromFiles() {
+        try {
+            const files = await fs.readdir(this.sessionsDir);
+            const sessions = [];
+            for (const file of files) {
+                if (file === 'index.json')
+                    continue;
+                if (!file.endsWith('.json'))
+                    continue;
+                const filePath = path.join(this.sessionsDir, file);
+                try {
+                    const content = await fs.readFile(filePath, 'utf-8');
+                    sessions.push(JSON.parse(content));
+                }
+                catch {
+                    // Skip malformed files
+                }
+            }
+            sessions.sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
+            return sessions;
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Delete a single message from a session
+     */
+    async deleteMessage(sessionId, messageId) {
+        return this.withLock(sessionId, async () => {
+            const session = await this.readSession(sessionId);
+            if (!session)
+                return null;
+            const originalLen = session.messages.length;
+            session.messages = session.messages.filter((m) => m.id !== messageId);
+            if (session.messages.length === originalLen)
+                return null; // message not found
+            session.updatedAt = new Date().toISOString();
+            await this.writeSessionFile(session);
+            // Sync index
+            const idxEntry = this.sessionIndex.sessions.find((e) => e.id === sessionId);
+            if (idxEntry) {
+                idxEntry.updatedAt = session.updatedAt;
+            }
+            this.sessionIndex.lastUpdated = new Date().toISOString();
+            await this.saveIndex();
+            return session;
+        });
+    }
+    /**
+     * Truncate all messages from a given message index onward (inclusive).
+     * Returns the updated session, or null if session not found.
+     */
+    async truncateMessagesFromIndex(sessionId, fromIndex) {
+        return this.withLock(sessionId, async () => {
+            const session = await this.readSession(sessionId);
+            if (!session)
+                return null;
+            if (fromIndex < 0 || fromIndex >= session.messages.length)
+                return null;
+            session.messages = session.messages.slice(0, fromIndex);
+            session.updatedAt = new Date().toISOString();
+            await this.writeSessionFile(session);
+            // Sync index
+            const idxEntry = this.sessionIndex.sessions.find((e) => e.id === sessionId);
+            if (idxEntry) {
+                idxEntry.updatedAt = session.updatedAt;
+            }
+            this.sessionIndex.lastUpdated = new Date().toISOString();
+            await this.saveIndex();
+            return session;
+        });
+    }
+    /**
+     * Delete a session
+     */
+    async deleteSession(id) {
+        return this.withLock(id, async () => {
+            const filePath = this.getSessionPath(id);
+            try {
+                await fs.unlink(filePath);
+                // Sync index
+                this.sessionIndex.sessions = this.sessionIndex.sessions.filter((e) => e.id !== id);
+                this.sessionIndex.lastUpdated = new Date().toISOString();
+                await this.saveIndex();
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    /**
+     * Get or create a session by ID
+     */
+    async getOrCreate(id) {
+        const existing = await this.readSession(id);
+        if (existing)
+            return existing;
+        return this.createSession(id);
+    }
+    getSessionPath(id) {
+        return path.join(this.sessionsDir, `${id}.json`);
+    }
+    async writeSessionFile(session) {
+        const filePath = this.getSessionPath(session.id);
+        await fs.mkdir(this.sessionsDir, { recursive: true });
+        await fs.writeFile(filePath, JSON.stringify(session, null, 2), 'utf-8');
+    }
+    getIndexFilePath() {
+        return path.join(this.sessionsDir, 'index.json');
+    }
+    async loadIndex() {
+        try {
+            const content = await fs.readFile(this.getIndexFilePath(), 'utf-8');
+            this.sessionIndex = JSON.parse(content);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async saveIndex() {
+        try {
+            await fs.mkdir(this.sessionsDir, { recursive: true });
+            await fs.writeFile(this.getIndexFilePath(), JSON.stringify(this.sessionIndex, null, 2), 'utf-8');
+        }
+        catch {
+            // Non-critical: index is in-memory, will rebuild on next init
+        }
+    }
+}
+function generateSessionId() {
+    return generateId('session');
+}
+//# sourceMappingURL=session-manager.js.map

package/dist/backend/ai/session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../../../src/backend/ai/session-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAyD/C,MAAM,OAAO,cAAc;IACjB,KAAK,CAAY;IACjB,aAAa,CAAS;IAC9B,+CAA+C;IACvC,YAAY,GAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACvE,2EAA2E;IACnE,KAAK,GAA+B,IAAI,GAAG,EAAE,CAAC;IAEtD,YAAY,KAAgB,EAAE,aAAa,GAAG,OAAO;QACnD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC;IACzD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAQ,CAAI,GAAW,EAAE,EAAoB;QACzD,wCAAwC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,eAAe;QACf,IAAI,OAAmB,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,8BAA8B;QAC9B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACpD,IAAI,CAAC,YAAY,GAAG;gBAClB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC7B,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;iBACvB,CAAC,CAAC;gBACH,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACtC,CAAC;YACF,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,EAAW;QAC7B,MAAM,SAAS,GAAG,EAAE,IAAI,iBAAiB,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YACzC,uEAAuE;YACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAErC,MAAM,OAAO,GAAkB;gBAC7B,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,aAAa;gBACpB,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;gBACd,QAAQ,EAAE,EAAE;aACb,CAAC;YAEF,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAErC,kCAAkC;YAClC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC9B,EAAE,EAAE,SAAS;oBACb,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B,CAAC,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACzD,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACzB,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,EAAU,EACV,QAA0B,EAC1B,eAAwB,EACxB,KAAe;QAEf,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;YAC9C,CAAC;YAED,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YACnC,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAE7C,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,CAAC,eAAe,GAAG,eAAe,CAAC;YAC5C,CAAC;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;YACxB,CAAC;YAED,qCAAqC;YACrC,IAAI,OAAO,CAAC,KAAK,KAAK,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;gBAClE,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChG,CAAC;YACH,CAAC;YAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAErC,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC/B,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACzC,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAEvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,oDAAoD;QACpD,uDAAuD;QACvD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACpB,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAClE,CAAC;QACF,mDAAmD;QACnD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB;QACjC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAoB,EAAE,CAAC;YAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,YAAY;oBAAE,SAAS;gBACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBACrD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrB,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAClE,CAAC;YAEF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,SAAiB;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5C,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;YACtE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;YAE9E,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAErC,aAAa;YACb,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;YAC5E,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACzC,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAEvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,yBAAyB,CAAC,SAAiB,EAAE,SAAiB;QAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEvE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACxD,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAErC,aAAa;YACb,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;YAC5E,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACzC,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAEvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAE1B,aAAa;gBACb,IAAI,CAAC,YAAY,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnF,IAAI,CAAC,YAAY,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACzD,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAEvB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAEO,cAAc,CAAC,EAAU;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAAsB;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAEO,gBAAgB;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,gBAAgB,EAAE,EACvB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAC1C,OAAO,CACR,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;CACF;AAED,SAAS,iBAAiB;IACxB,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;AAC/B,CAAC"}

package/dist/backend/auth/jwt.d.ts

@@ -0,0 +1,16 @@
+/**
+ * JWT token utilities
+ */
+import type { AuthConfig } from '../../types/auth.js';
+export interface TokenPayload {
+    userId: string;
+    username: string;
+    role: string;
+}
+export declare function signAccessToken(session: TokenPayload, config: AuthConfig): string;
+export declare function signRefreshToken(session: TokenPayload, config: AuthConfig): string;
+export declare function signServiceToken(session: TokenPayload, config: AuthConfig): string;
+export declare function verifyToken(token: string, config: AuthConfig): TokenPayload;
+export declare function refreshAccessToken(refreshToken: string, config: AuthConfig): string;
+export declare function isTokenExpired(token: string): boolean;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/backend/auth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/backend/auth/jwt.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAMtD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAcD,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAIjF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAIlF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAGlF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,YAAY,CAI3E;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAOnF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQrD"}

package/dist/backend/auth/jwt.js

@@ -0,0 +1,57 @@
+/**
+ * JWT token utilities
+ */
+import jwt from 'jsonwebtoken';
+const DEFAULT_ACCESS_TTL = 900;
+const DEFAULT_REFRESH_TTL = 604800;
+const DEFAULT_SERVICE_TTL = 2592000; // 30 days
+function resolveSecret(secret) {
+    if (secret.startsWith('env:')) {
+        const envVar = secret.slice(4);
+        const value = process.env[envVar];
+        if (!value) {
+            throw new Error(`JWT secret environment variable ${envVar} is not set`);
+        }
+        return value;
+    }
+    return secret;
+}
+export function signAccessToken(session, config) {
+    const secret = resolveSecret(config.secret);
+    const ttl = config.accessTokenTtl ?? DEFAULT_ACCESS_TTL;
+    return jwt.sign(session, secret, { expiresIn: ttl });
+}
+export function signRefreshToken(session, config) {
+    const secret = resolveSecret(config.secret);
+    const ttl = config.refreshTokenTtl ?? DEFAULT_REFRESH_TTL;
+    return jwt.sign({ ...session, type: 'refresh' }, secret, { expiresIn: ttl });
+}
+export function signServiceToken(session, config) {
+    const secret = resolveSecret(config.secret);
+    return jwt.sign({ ...session, type: 'service' }, secret, { expiresIn: DEFAULT_SERVICE_TTL });
+}
+export function verifyToken(token, config) {
+    const secret = resolveSecret(config.secret);
+    const decoded = jwt.verify(token, secret);
+    return decoded;
+}
+export function refreshAccessToken(refreshToken, config) {
+    const payload = verifyToken(refreshToken, config);
+    if (payload.type !== 'refresh') {
+        throw new Error('Not a refresh token');
+    }
+    const { type: _, exp: __, iat: ___, ...session } = payload;
+    return signAccessToken(session, config);
+}
+export function isTokenExpired(token) {
+    try {
+        const decoded = jwt.decode(token);
+        if (!decoded?.exp)
+            return true;
+        return decoded.exp * 1000 < Date.now();
+    }
+    catch {
+        return true;
+    }
+}
+//# sourceMappingURL=jwt.js.map

package/dist/backend/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/backend/auth/jwt.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,GAAG,MAAM,cAAc,CAAC;AAG/B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,mBAAmB,GAAG,OAAO,CAAC,CAAC,UAAU;AAQ/C,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,aAAa,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAqB,EAAE,MAAkB;IACvE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,IAAI,kBAAkB,CAAC;IACxD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAqB,EAAE,MAAkB;IACxE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,mBAAmB,CAAC;IAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAqB,EAAE,MAAkB;IACxE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAkB;IAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,OAAuB,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,YAAoB,EAAE,MAAkB;IACzE,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,EAAE,MAAM,CAAiE,CAAC;IAClH,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3D,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAA4B,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,GAAG;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/backend/auth/password.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Password hashing and verification utilities
+ */
+export declare function validatePasswordStrength(password: string): {
+    valid: boolean;
+    message?: string;
+};
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(password: string, hash: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/backend/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/backend/auth/password.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAK/F;AAED,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF"}

package/dist/backend/auth/password.js

@@ -0,0 +1,19 @@
+/**
+ * Password hashing and verification utilities
+ */
+import bcrypt from 'bcryptjs';
+const SALT_ROUNDS = 12;
+const MIN_PASSWORD_LENGTH = 8;
+export function validatePasswordStrength(password) {
+    if (!password || password.length < MIN_PASSWORD_LENGTH) {
+        return { valid: false, message: `Password must be at least ${MIN_PASSWORD_LENGTH} characters` };
+    }
+    return { valid: true };
+}
+export async function hashPassword(password) {
+    return bcrypt.hash(password, SALT_ROUNDS);
+}
+export async function verifyPassword(password, hash) {
+    return bcrypt.compare(password, hash);
+}
+//# sourceMappingURL=password.js.map

package/dist/backend/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../src/backend/auth/password.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,MAAM,MAAM,UAAU,CAAC;AAE9B,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,mBAAmB,aAAa,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAY;IACjE,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/backend/auth/rbac.d.ts

@@ -0,0 +1,36 @@
+/**
+ * RBAC Middleware
+ *
+ * Two-layer auth:
+ * 1. Routes with :model param → model-level permission check
+ * 2. Routes without :model param → binary authentication (just verify logged in)
+ *
+ * Exempt routes: login, register, refresh
+ */
+import type { FastifyRequest, FastifyReply } from 'fastify';
+import type { AuthConfig, AuthPermissionLevel } from '../../types/auth.js';
+/** Resolve required permission level for a method, respecting writeExcludesDelete config */
+export declare function getRequiredLevel(method: string, config: AuthConfig): AuthPermissionLevel;
+/** Resolve effective permission for a model given user role and config */
+export declare function resolvePermission(model: string, roleName: string, config: AuthConfig): AuthPermissionLevel;
+/** Check if user level meets required level */
+export declare function hasPermission(userLevel: AuthPermissionLevel, requiredLevel: AuthPermissionLevel): boolean;
+/** Check if a role has admin-level wildcard permission */
+export declare function isAdmin(role: string, config: AuthConfig): boolean;
+/** Extend FastifyRequest with user info */
+declare module 'fastify' {
+    interface FastifyRequest {
+        user?: {
+            userId: string;
+            username: string;
+            role: string;
+            /** Raw JWT token for passing to child processes (e.g. LOOM_TOKEN for AI engine) */
+            token?: string;
+        };
+    }
+}
+export interface AuthMiddlewareOptions {
+    config: AuthConfig;
+}
+export declare function createAuthMiddleware(options: AuthMiddlewareOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=rbac.d.ts.map

package/dist/backend/auth/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/backend/auth/rbac.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAwB,MAAM,qBAAqB,CAAC;AAoBjG,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,mBAAmB,CAOxF;AAUD,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,GACjB,mBAAmB,CAcrB;AAED,+CAA+C;AAC/C,wBAAgB,aAAa,CAAC,SAAS,EAAE,mBAAmB,EAAE,aAAa,EAAE,mBAAmB,GAAG,OAAO,CAEzG;AAED,0DAA0D;AAC1D,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAEjE;AAED,2CAA2C;AAC3C,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,IAAI,CAAC,EAAE;YACL,MAAM,EAAE,MAAM,CAAC;YACf,QAAQ,EAAE,MAAM,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC;YACb,mFAAmF;YACnF,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC;KACH;CACF;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,IAGnD,SAAS,cAAc,EAAE,OAAO,YAAY,mBA8D3D"}

package/dist/backend/auth/rbac.js

@@ -0,0 +1,129 @@
+/**
+ * RBAC Middleware
+ *
+ * Two-layer auth:
+ * 1. Routes with :model param → model-level permission check
+ * 2. Routes without :model param → binary authentication (just verify logged in)
+ *
+ * Exempt routes: login, register, refresh
+ */
+import { verifyToken } from './jwt.js';
+/** Permission hierarchy: none < read < write < admin */
+const LEVEL_HIERARCHY = {
+    none: 0,
+    read: 1,
+    write: 2,
+    admin: 3,
+};
+/** HTTP method → minimum permission level for model routes (base, before writeExcludesDelete override) */
+const BASE_METHOD_LEVEL = {
+    GET: 'read',
+    POST: 'write',
+    PUT: 'write',
+    PATCH: 'write',
+    DELETE: 'admin',
+};
+/** Resolve required permission level for a method, respecting writeExcludesDelete config */
+export function getRequiredLevel(method, config) {
+    const base = BASE_METHOD_LEVEL[method] ?? 'read';
+    // writeExcludesDelete defaults to false: write level includes delete unless explicitly set to true
+    if (method === 'DELETE' && config.permissions.defaults.writeExcludesDelete !== true) {
+        return 'write';
+    }
+    return base;
+}
+/** Exempt paths (no auth required) */
+const EXEMPT_PATHS = [
+    '/api/v1/health',
+    '/api/v1/auth/login',
+    '/api/v1/auth/register',
+    '/api/v1/auth/refresh',
+];
+/** Resolve effective permission for a model given user role and config */
+export function resolvePermission(model, roleName, config) {
+    const role = config.roles.find(r => r.role === roleName);
+    if (!role)
+        return config.permissions.defaults.read;
+    // Check explicit model permission
+    const modelPerm = role.permissions.find(p => p.model === model);
+    if (modelPerm)
+        return modelPerm.level;
+    // Check wildcard permission
+    const wildcardPerm = role.permissions.find(p => p.model === '*');
+    if (wildcardPerm)
+        return wildcardPerm.level;
+    // Fall back to defaults based on method
+    return config.permissions.defaults.read;
+}
+/** Check if user level meets required level */
+export function hasPermission(userLevel, requiredLevel) {
+    return LEVEL_HIERARCHY[userLevel] >= LEVEL_HIERARCHY[requiredLevel];
+}
+/** Check if a role has admin-level wildcard permission */
+export function isAdmin(role, config) {
+    return hasPermission(resolvePermission('*', role, config), 'admin');
+}
+export function createAuthMiddleware(options) {
+    const { config } = options;
+    return async (request, reply) => {
+        // Skip exempt paths (exact match or path boundary)
+        if (EXEMPT_PATHS.some(p => {
+            if (request.url === p)
+                return true;
+            if (request.url.startsWith(p + '/') || request.url.startsWith(p + '?'))
+                return true;
+            return false;
+        })) {
+            return;
+        }
+        // Extract and verify token
+        const authHeader = request.headers.authorization;
+        if (!authHeader?.startsWith('Bearer ')) {
+            reply.code(401).send({ error: 'Authentication required' });
+            return;
+        }
+        const token = authHeader.slice(7);
+        try {
+            const payload = verifyToken(token, config);
+            // Reject refresh tokens used for API access
+            if (payload.type === 'refresh') {
+                reply.code(401).send({ error: 'Refresh tokens cannot be used for API access' });
+                return;
+            }
+            request.user = {
+                userId: payload.userId,
+                username: payload.username,
+                role: payload.role,
+                token,
+            };
+        }
+        catch {
+            reply.code(401).send({ error: 'Invalid or expired token' });
+            return;
+        }
+        // Model-level permission check (for routes with :model param)
+        const model = request.params?.model;
+        if (model) {
+            const method = request.method;
+            const requiredLevel = getRequiredLevel(method, config);
+            const userLevel = resolvePermission(model, request.user.role, config);
+            if (!hasPermission(userLevel, requiredLevel)) {
+                request.log.warn({
+                    userId: request.user?.userId,
+                    role: request.user?.role,
+                    model,
+                    method: request.method,
+                    required: requiredLevel,
+                    actual: userLevel,
+                }, 'Auth: permission denied');
+                reply.code(403).send({
+                    error: 'Insufficient permissions',
+                    required: requiredLevel,
+                    actual: userLevel,
+                });
+                return;
+            }
+        }
+    };
+}
+//# sourceMappingURL=rbac.js.map

package/dist/backend/auth/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/backend/auth/rbac.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,WAAW,EAAqB,MAAM,UAAU,CAAC;AAE1D,wDAAwD;AACxD,MAAM,eAAe,GAAwC;IAC3D,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,0GAA0G;AAC1G,MAAM,iBAAiB,GAAwC;IAC7D,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,OAAO;IACb,GAAG,EAAE,OAAO;IACZ,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;CAChB,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAkB;IACjE,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IACjD,mGAAmG;IACnG,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACpF,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sCAAsC;AACtC,MAAM,YAAY,GAAG;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;CACvB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,QAAgB,EAChB,MAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;IAEnD,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAChE,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC;IAEtC,4BAA4B;IAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;IACjE,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC;IAE5C,wCAAwC;IACxC,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,aAAa,CAAC,SAA8B,EAAE,aAAkC;IAC9F,OAAO,eAAe,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC;AACtE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,MAAkB;IACtD,OAAO,aAAa,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAmBD,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3B,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC5D,mDAAmD;QACnD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YACxB,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;YACH,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3C,4CAA4C;YAC5C,IAAK,OAA4C,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YACD,OAAO,CAAC,IAAI,GAAG;gBACb,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,8DAA8D;QAC9D,MAAM,KAAK,GAAI,OAAO,CAAC,MAA6C,EAAE,KAAK,CAAC;QAC5E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAEtE,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM;oBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI;oBACxB,KAAK;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,aAAa;oBACvB,MAAM,EAAE,SAAS;iBAClB,EAAE,yBAAyB,CAAC,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,0BAA0B;oBACjC,QAAQ,EAAE,aAAa;oBACvB,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/auth/request-context.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Request-scoped context via AsyncLocalStorage
+ *
+ * Allows EventEmittingAdapter to access userId from the current
+ * HTTP request without coupling to the Fastify request object.
+ */
+interface RequestContext {
+    userId?: string;
+}
+/** Get the current request context (undefined if outside a request) */
+export declare function getRequestContext(): RequestContext | undefined;
+/** Set context for the current async execution path */
+export declare function setRequestContext(ctx: RequestContext): void;
+export {};
+//# sourceMappingURL=request-context.d.ts.map

package/dist/backend/auth/request-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../src/backend/auth/request-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,uEAAuE;AACvE,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAE9D;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAE3D"}