@mevdragon/vidfarm-devcli 0.5.3 → 0.6.0

package/dist/src/services/rate-limits.js

@@ -0,0 +1,262 @@
+import { DynamoDBClient, GetItemCommand, TransactWriteItemsCommand } from "@aws-sdk/client-dynamodb";
+import { config } from "../config.js";
+const dynamodb = new DynamoDBClient({});
+const OPERATIONS_TABLE_NAME = config.VIDFARM_RATE_LIMITS_TABLE_NAME?.trim() || "";
+const REST_LIMIT_SUMMARY = "General REST API limits: max 10 requests per second, 300 requests per minute, and 5000 requests per hour.";
+export class RateLimitExceededError extends Error {
+    type;
+    status;
+    constructor(message, type, status) {
+        super(message);
+        this.type = type;
+        this.status = status;
+    }
+}
+const OPERATION_LIMITS = {
+    client: {
+        month: 750,
+        week: 400,
+        five_hour: 200
+    },
+    standalone: {
+        month: 2500,
+        week: 1250,
+        five_hour: 500
+    },
+    agency: {
+        month: 10_000,
+        week: 5_000,
+        five_hour: 2_000
+    }
+};
+const REST_LIMITS = {
+    second: 10,
+    minute: 300,
+    hour: 5_000
+};
+// Composition writes (working-copy PUT/PATCH + version snapshots) are far more
+// expensive than a generic read — each is an S3 write, and snapshots also grow
+// the fork's namespace. They get a dedicated, much tighter bucket on top of the
+// general REST limiter so a single (possibly compromised) key can't hammer S3
+// or spam versions.
+const PUBLISH_LIMITS = {
+    minute: 20,
+    hour: 300
+};
+const WINDOW_DEFINITIONS = {
+    month: { durationMs: 30 * 24 * 60 * 60 * 1000, label: "30-day window" },
+    week: { durationMs: 7 * 24 * 60 * 60 * 1000, label: "7-day window" },
+    five_hour: { durationMs: 5 * 60 * 60 * 1000, label: "5-hour window" },
+    second: { durationMs: 1000, label: "1-second window" },
+    minute: { durationMs: 60 * 1000, label: "1-minute window" },
+    hour: { durationMs: 60 * 60 * 1000, label: "1-hour window" }
+};
+export class RateLimitService {
+    isConfigured() {
+        return Boolean(OPERATIONS_TABLE_NAME);
+    }
+    async consumeTemplateOperation(customer) {
+        if (!this.isConfigured()) {
+            return;
+        }
+        await this.consumeWindows({
+            scopePk: `customer#${customer.id}`,
+            scopeLabel: `customer:${customer.id}`,
+            anchorMs: new Date(customer.createdAt).getTime(),
+            limits: OPERATION_LIMITS[customer.planTier],
+            type: "operation_rate_limit_exceeded"
+        });
+    }
+    async consumeGeneralRest(scopeId) {
+        if (!this.isConfigured()) {
+            return;
+        }
+        const statuses = await this.consumeWindows({
+            scopePk: `rest#${scopeId}`,
+            scopeLabel: scopeId,
+            anchorMs: 0,
+            limits: REST_LIMITS,
+            type: "rest_rate_limit_exceeded"
+        });
+        const violations = statuses.filter((status) => status.used > status.limit);
+        if (violations.length > 0) {
+            throw new RateLimitExceededError(violations[0].message, "rest_rate_limit_exceeded", violations);
+        }
+    }
+    async consumePublish(scopeId) {
+        if (!this.isConfigured()) {
+            return;
+        }
+        const statuses = await this.consumeWindows({
+            scopePk: `publish#${scopeId}`,
+            scopeLabel: scopeId,
+            anchorMs: 0,
+            limits: PUBLISH_LIMITS,
+            type: "publish_rate_limit_exceeded"
+        });
+        const violations = statuses.filter((status) => status.used > status.limit);
+        if (violations.length > 0) {
+            throw new RateLimitExceededError(violations[0].message, "publish_rate_limit_exceeded", violations);
+        }
+    }
+    async getTemplateOperationStatus(customer) {
+        if (!this.isConfigured()) {
+            return {
+                monthly: this.buildDisabledStatus("month", "30-day window"),
+                weekly: this.buildDisabledStatus("week", "7-day window"),
+                five_hour: this.buildDisabledStatus("five_hour", "5-hour window")
+            };
+        }
+        const statuses = await this.readWindows({
+            scopePk: `customer#${customer.id}`,
+            scopeLabel: `customer:${customer.id}`,
+            anchorMs: new Date(customer.createdAt).getTime(),
+            limits: OPERATION_LIMITS[customer.planTier]
+        });
+        const mapped = this.buildOperationStatuses(statuses);
+        return {
+            monthly: mapped.find((status) => status.key === "month"),
+            weekly: mapped.find((status) => status.key === "week"),
+            five_hour: mapped.find((status) => status.key === "five_hour")
+        };
+    }
+    getRestSummary() {
+        return {
+            message: REST_LIMIT_SUMMARY,
+            limits: {
+                per_second: REST_LIMITS.second,
+                per_minute: REST_LIMITS.minute,
+                per_hour: REST_LIMITS.hour
+            }
+        };
+    }
+    async consumeWindows(input) {
+        const windowSpecs = this.buildWindowSpecs(input.anchorMs, input.limits);
+        let transactionCancelled = false;
+        try {
+            await dynamodb.send(new TransactWriteItemsCommand({
+                TransactItems: windowSpecs.map((spec) => ({
+                    Update: {
+                        TableName: OPERATIONS_TABLE_NAME,
+                        Key: {
+                            pk: { S: input.scopePk },
+                            sk: { S: spec.sk }
+                        },
+                        UpdateExpression: "SET usage_count = if_not_exists(usage_count, :zero) + :one, #scope = if_not_exists(#scope, :scope), window_key = if_not_exists(window_key, :windowKey), window_started_at = if_not_exists(window_started_at, :windowStartedAt), window_ends_at = if_not_exists(window_ends_at, :windowEndsAt), limit_value = if_not_exists(limit_value, :limitValue), created_at = if_not_exists(created_at, :createdAt), updated_at = :updatedAt, expires_at_epoch_seconds = if_not_exists(expires_at_epoch_seconds, :ttl)",
+                        ConditionExpression: "attribute_not_exists(usage_count) OR usage_count < :limitValue",
+                        ExpressionAttributeNames: {
+                            "#scope": "scope",
+                        },
+                        ExpressionAttributeValues: {
+                            ":zero": { N: "0" },
+                            ":one": { N: "1" },
+                            ":scope": { S: input.scopeLabel },
+                            ":windowKey": { S: spec.key },
+                            ":windowStartedAt": { S: spec.windowStartedAt },
+                            ":windowEndsAt": { S: spec.nextAvailableAt },
+                            ":limitValue": { N: String(spec.limit) },
+                            ":createdAt": { S: new Date().toISOString() },
+                            ":updatedAt": { S: new Date().toISOString() },
+                            ":ttl": { N: String(Math.floor((new Date(spec.nextAvailableAt).getTime() + (2 * 24 * 60 * 60 * 1000)) / 1000)) }
+                        }
+                    }
+                }))
+            }));
+        }
+        catch (error) {
+            if (!isTransactionCanceledError(error)) {
+                throw error;
+            }
+            transactionCancelled = true;
+        }
+        const statuses = await this.readWindows({
+            scopePk: input.scopePk,
+            scopeLabel: input.scopeLabel,
+            anchorMs: input.anchorMs,
+            limits: input.limits
+        });
+        const violations = statuses.filter((status) => transactionCancelled ? status.used >= status.limit : status.used > status.limit);
+        if (violations.length > 0) {
+            throw new RateLimitExceededError(violations[0].message, input.type, violations);
+        }
+        return statuses;
+    }
+    async readWindows(input) {
+        const windowSpecs = this.buildWindowSpecs(input.anchorMs, input.limits);
+        const items = await Promise.all(windowSpecs.map(async (spec) => {
+            const response = await dynamodb.send(new GetItemCommand({
+                TableName: OPERATIONS_TABLE_NAME,
+                Key: {
+                    pk: { S: input.scopePk },
+                    sk: { S: spec.sk }
+                },
+                ConsistentRead: true
+            }));
+            return this.toStatus(spec, response.Item);
+        }));
+        return items;
+    }
+    buildOperationStatuses(statuses) {
+        return statuses.map((status) => ({
+            ...status,
+            key: status.key === "month" ? "month" : status.key === "week" ? "week" : "five_hour"
+        }));
+    }
+    buildWindowSpecs(anchorMs, limits) {
+        return Object.keys(limits).map((typedKey) => {
+            const limit = limits[typedKey];
+            const definition = WINDOW_DEFINITIONS[typedKey];
+            const nowMs = Date.now();
+            const effectiveAnchorMs = Number.isFinite(anchorMs) && anchorMs > 0 ? anchorMs : 0;
+            const elapsedMs = Math.max(0, nowMs - effectiveAnchorMs);
+            const windowIndex = Math.floor(elapsedMs / definition.durationMs);
+            const windowStartedAtMs = effectiveAnchorMs + (windowIndex * definition.durationMs);
+            const nextAvailableAtMs = windowStartedAtMs + definition.durationMs;
+            const windowStartedAt = new Date(windowStartedAtMs).toISOString();
+            const nextAvailableAt = new Date(nextAvailableAtMs).toISOString();
+            return {
+                key: typedKey,
+                label: definition.label,
+                limit,
+                sk: `${typedKey}#${windowStartedAt}`,
+                windowStartedAt,
+                nextAvailableAt
+            };
+        });
+    }
+    toStatus(spec, item) {
+        const used = Number(item?.usage_count?.N ?? "0");
+        const remaining = Math.max(0, spec.limit - used);
+        const consumedPercent = spec.limit > 0 ? Math.min(100, Number(((used / spec.limit) * 100).toFixed(2))) : 100;
+        return {
+            key: spec.key,
+            label: spec.label,
+            limit: spec.limit,
+            used,
+            remaining,
+            consumedPercent,
+            windowStartedAt: item?.window_started_at?.S ?? spec.windowStartedAt,
+            nextAvailableAt: item?.window_ends_at?.S ?? spec.nextAvailableAt,
+            message: used >= spec.limit
+                ? `Rate limit reached for the ${spec.label}. Usage resets at ${item?.window_ends_at?.S ?? spec.nextAvailableAt}.`
+                : `${used} of ${spec.limit} requests used in the ${spec.label}. Resets at ${item?.window_ends_at?.S ?? spec.nextAvailableAt}.`
+        };
+    }
+    buildDisabledStatus(key, label) {
+        return {
+            key,
+            label,
+            limit: 0,
+            used: 0,
+            remaining: 0,
+            consumedPercent: 0,
+            windowStartedAt: new Date(0).toISOString(),
+            nextAvailableAt: new Date(0).toISOString(),
+            message: "Rate limiting is not configured for this environment."
+        };
+    }
+}
+function isTransactionCanceledError(error) {
+    return error instanceof Error && error.name === "TransactionCanceledException";
+}
+//# sourceMappingURL=rate-limits.js.map

package/dist/src/services/serverless-auth.js

@@ -0,0 +1,382 @@
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, GetCommand, PutCommand, QueryCommand, UpdateCommand } from "@aws-sdk/lib-dynamodb";
+import { config } from "../config.js";
+import { hashSecret, safeEqualHash } from "../lib/crypto.js";
+import { devLog } from "../lib/dev-log.js";
+import { displayNameFromEmail } from "../lib/display-name.js";
+import { createId } from "../lib/ids.js";
+import { nowIso } from "../lib/time.js";
+import { createLocalDynamoClient } from "./local-dynamo.js";
+// See local-dynamo.ts: `vidfarm serve` swaps the DynamoDB client for a
+// disk-backed shim; deployed environments keep the real client.
+const dynamodb = config.RECORDS_DRIVER === "local"
+    ? createLocalDynamoClient()
+    : DynamoDBDocumentClient.from(new DynamoDBClient({}), {
+        marshallOptions: {
+            removeUndefinedValues: true
+        }
+    });
+export class ServerlessAuthService {
+    async insertOtpChallenge(record) {
+        const timestamp = nowIso();
+        const email = record.email.trim().toLowerCase();
+        await dynamodb.send(new PutCommand({
+            TableName: requireMainTableName(),
+            Item: {
+                pk: `EMAIL#${email}`,
+                sk: `OTP#${timestamp}#${record.id}`,
+                entity_type: "OtpChallenge",
+                id: record.id,
+                email,
+                code_hash: record.codeHash,
+                expires_at: record.expiresAt,
+                consumed_at: null,
+                created_at: timestamp
+            }
+        }));
+        devLog("auth.otp.inserted", {
+            otp_id: record.id,
+            email,
+            expires_at: record.expiresAt
+        });
+    }
+    async findLatestOtpChallenge(email) {
+        const response = await dynamodb.send(new QueryCommand({
+            TableName: requireMainTableName(),
+            KeyConditionExpression: "pk = :pk and begins_with(sk, :prefix)",
+            ExpressionAttributeValues: {
+                ":pk": `EMAIL#${email.trim().toLowerCase()}`,
+                ":prefix": "OTP#"
+            },
+            ScanIndexForward: false,
+            Limit: 1
+        }));
+        devLog("auth.otp.lookup", {
+            email: email.trim().toLowerCase(),
+            found: Boolean(response.Items?.[0])
+        });
+        return response.Items?.[0] ?? null;
+    }
+    async consumeOtpChallenge(email, id) {
+        const challenge = await this.findLatestOtpChallenge(email);
+        if (!challenge || String(challenge.id) !== id) {
+            return;
+        }
+        await dynamodb.send(new UpdateCommand({
+            TableName: requireMainTableName(),
+            Key: {
+                pk: String(challenge.pk),
+                sk: String(challenge.sk)
+            },
+            UpdateExpression: "set consumed_at = :now",
+            ExpressionAttributeValues: {
+                ":now": nowIso()
+            }
+        }));
+        devLog("auth.otp.consumed", {
+            otp_id: id,
+            email: email.trim().toLowerCase()
+        });
+    }
+    async upsertCustomer(input) {
+        const current = await this.getCustomer(requireMainTableName(), input.id);
+        const timestamp = nowIso();
+        const email = input.email.trim().toLowerCase();
+        const customer = {
+            id: input.id,
+            email,
+            name: input.name === undefined ? current?.name ?? displayNameFromEmail(email) : input.name,
+            defaultWebhookUrl: input.defaultWebhookUrl === undefined ? current?.defaultWebhookUrl ?? null : input.defaultWebhookUrl,
+            isDeveloper: input.isDeveloper === undefined ? current?.isDeveloper ?? false : input.isDeveloper,
+            isAgency: input.isAgency === undefined ? current?.isAgency ?? false : input.isAgency,
+            isPaidPlan: input.isPaidPlan === undefined ? current?.isPaidPlan ?? false : input.isPaidPlan,
+            planTier: input.planTier === undefined ? current?.planTier ?? "client" : input.planTier,
+            about: input.about === undefined ? current?.about ?? null : input.about,
+            groupchatUrl: input.groupchatUrl === undefined ? current?.groupchatUrl ?? null : input.groupchatUrl,
+            flockposterApiKey: input.flockposterApiKey === undefined ? current?.flockposterApiKey ?? null : input.flockposterApiKey,
+            createdAt: current?.createdAt ?? timestamp,
+            updatedAt: timestamp
+        };
+        await this.putCustomerItem(requireMainTableName(), customer, {
+            passwordHash: input.passwordHash === undefined ? undefined : input.passwordHash,
+            encryptedPassword: input.encryptedPassword === undefined ? undefined : input.encryptedPassword
+        });
+        devLog("auth.customer.upserted", {
+            customer_id: customer.id,
+            email: customer.email,
+            is_paid_plan: customer.isPaidPlan,
+            plan_tier: customer.planTier
+        });
+        return customer;
+    }
+    async getCustomerById(customerId) {
+        return this.getCustomer(requireMainTableName(), customerId);
+    }
+    async getCustomerByEmailPublic(email) {
+        return this.getCustomerByEmail(requireMainTableName(), email);
+    }
+    async getCustomerAuthByEmail(email) {
+        const response = await dynamodb.send(new QueryCommand({
+            TableName: requireMainTableName(),
+            IndexName: "gsi1",
+            KeyConditionExpression: "gsi1pk = :pk",
+            ExpressionAttributeValues: {
+                ":pk": `CUSTOMER_EMAIL#${email.trim().toLowerCase()}`
+            },
+            Limit: 1
+        }));
+        return response.Items?.[0] ?? null;
+    }
+    async updateCustomerPassword(customerId, passwordHash, encryptedPassword) {
+        await dynamodb.send(new UpdateCommand({
+            TableName: requireMainTableName(),
+            Key: {
+                pk: `CUSTOMER#${customerId}`,
+                sk: "META"
+            },
+            UpdateExpression: "set password_hash = :hash, encrypted_password = :encrypted, updated_at = :updated",
+            ExpressionAttributeValues: {
+                ":hash": passwordHash,
+                ":encrypted": encryptedPassword ?? null,
+                ":updated": nowIso()
+            }
+        }));
+    }
+    async insertApiKey(record) {
+        await this.putApiKey(requireMainTableName(), {
+            id: record.id,
+            keyHash: record.keyHash,
+            customerId: record.customerId,
+            rawValue: record.rawValue ?? null,
+            label: record.label
+        });
+        devLog("auth.api_key.inserted", {
+            api_key_id: record.id,
+            customer_id: record.customerId,
+            label: record.label
+        });
+    }
+    async findApiKeyByHash(keyHash) {
+        return this.getApiKeyItem(requireMainTableName(), keyHash);
+    }
+    async authenticate(apiKey) {
+        if (!apiKey) {
+            throw new Error("Missing vidfarm-api-key header.");
+        }
+        const tableName = requireMainTableName();
+        const keyHash = hashSecret(apiKey + config.API_KEY_SALT);
+        const apiKeyItem = await this.getApiKeyItem(tableName, keyHash);
+        if (apiKeyItem) {
+            const customer = await this.getCustomer(tableName, String(apiKeyItem.customer_id));
+            if (!customer) {
+                throw new Error("Invalid API credentials.");
+            }
+            if (!customer.isPaidPlan) {
+                throw new Error("Paid plan required.");
+            }
+            await this.touchApiKey(tableName, keyHash);
+            devLog("auth.api_key.authenticated", {
+                customer_id: customer.id,
+                email: customer.email
+            });
+            return customer;
+        }
+        const bootstrapped = await this.tryBootstrapFromEnv(tableName, apiKey, keyHash);
+        if (bootstrapped) {
+            devLog("auth.bootstrap.authenticated", {
+                customer_id: bootstrapped.id,
+                email: bootstrapped.email
+            });
+            return bootstrapped;
+        }
+        devLog("auth.api_key.rejected", {
+            reason: "not_found"
+        }, "warn");
+        throw new Error("Invalid API credentials.");
+    }
+    async getApiKeyItem(tableName, keyHash) {
+        const response = await dynamodb.send(new GetCommand({
+            TableName: tableName,
+            Key: {
+                pk: `APIKEY#${keyHash}`,
+                sk: "META"
+            }
+        }));
+        if (!response.Item || response.Item.status !== "active") {
+            return null;
+        }
+        return response.Item;
+    }
+    async getCustomer(tableName, customerId) {
+        const response = await dynamodb.send(new GetCommand({
+            TableName: tableName,
+            Key: {
+                pk: `CUSTOMER#${customerId}`,
+                sk: "META"
+            }
+        }));
+        return response.Item ? itemToCustomer(response.Item) : null;
+    }
+    async getCustomerByEmail(tableName, email) {
+        const response = await dynamodb.send(new QueryCommand({
+            TableName: tableName,
+            IndexName: "gsi1",
+            KeyConditionExpression: "gsi1pk = :pk",
+            ExpressionAttributeValues: {
+                ":pk": `CUSTOMER_EMAIL#${email.trim().toLowerCase()}`
+            },
+            Limit: 1
+        }));
+        const item = response.Items?.[0];
+        return item ? itemToCustomer(item) : null;
+    }
+    async tryBootstrapFromEnv(tableName, apiKey, keyHash) {
+        const bootstrapApiKey = process.env.VIDFARM_STAGING_BOOTSTRAP_API_KEY?.trim()
+            || process.env.VIDFARM_API_KEY?.trim()
+            || "";
+        if (!bootstrapApiKey || !safeEqualHash(apiKey, hashSecret(bootstrapApiKey))) {
+            return null;
+        }
+        const email = process.env.VIDFARM_STAGING_BOOTSTRAP_EMAIL?.trim()
+            || config.adminEmails[0]
+            || "staging@vidfarm.local";
+        const existing = await this.getCustomerByEmail(tableName, email);
+        const customer = existing ?? buildBootstrapCustomer(email);
+        await this.putCustomerItem(tableName, customer, {});
+        await this.putApiKey(tableName, {
+            keyHash,
+            customerId: customer.id,
+            rawValue: apiKey,
+            label: `Staging bootstrap ${nowIso()}`
+        });
+        return customer;
+    }
+    async putCustomerItem(tableName, customer, extra) {
+        const existing = await dynamodb.send(new GetCommand({
+            TableName: tableName,
+            Key: {
+                pk: `CUSTOMER#${customer.id}`,
+                sk: "META"
+            }
+        }));
+        await dynamodb.send(new PutCommand({
+            TableName: tableName,
+            Item: {
+                ...customerToItem(customer),
+                password_hash: extra.passwordHash === undefined ? existing.Item?.password_hash ?? null : extra.passwordHash,
+                encrypted_password: extra.encryptedPassword === undefined ? existing.Item?.encrypted_password ?? null : extra.encryptedPassword
+            }
+        }));
+    }
+    async putApiKey(tableName, input) {
+        const timestamp = nowIso();
+        await dynamodb.send(new PutCommand({
+            TableName: tableName,
+            Item: {
+                pk: `APIKEY#${input.keyHash}`,
+                sk: "META",
+                entity_type: "ApiKey",
+                gsi1pk: `CUSTOMER#${input.customerId}#APIKEYS`,
+                gsi1sk: `APIKEY#${timestamp}#${input.id ?? input.keyHash}`,
+                api_key_id: input.id ?? input.keyHash,
+                key_hash: input.keyHash,
+                customer_id: input.customerId,
+                raw_value: input.rawValue ?? null,
+                label: input.label ?? null,
+                status: "active",
+                created_at: timestamp,
+                updated_at: timestamp
+            }
+        }));
+    }
+    async touchApiKey(tableName, keyHash) {
+        const timestamp = nowIso();
+        await dynamodb.send(new UpdateCommand({
+            TableName: tableName,
+            Key: {
+                pk: `APIKEY#${keyHash}`,
+                sk: "META"
+            },
+            UpdateExpression: "set last_used_at = :now, updated_at = :now",
+            ExpressionAttributeValues: {
+                ":now": timestamp
+            }
+        }));
+    }
+}
+function requireMainTableName() {
+    if (config.RECORDS_DRIVER === "local") {
+        return config.VIDFARM_SERVERLESS_MAIN_TABLE_NAME || "vidfarm-local-main";
+    }
+    if (!config.VIDFARM_SERVERLESS_MAIN_TABLE_NAME) {
+        throw new Error("Serverless auth requires VIDFARM_SERVERLESS_MAIN_TABLE_NAME.");
+    }
+    return config.VIDFARM_SERVERLESS_MAIN_TABLE_NAME;
+}
+function buildBootstrapCustomer(email) {
+    const timestamp = nowIso();
+    const id = process.env.VIDFARM_STAGING_BOOTSTRAP_USER_ID?.trim()
+        || process.env.VIDFARM_USER_ID?.trim()
+        || createId("cus");
+    return {
+        id,
+        email: email.trim().toLowerCase(),
+        name: displayNameFromEmail(email),
+        defaultWebhookUrl: null,
+        isDeveloper: true,
+        isAgency: true,
+        isPaidPlan: true,
+        planTier: "agency",
+        about: null,
+        groupchatUrl: null,
+        flockposterApiKey: null,
+        createdAt: timestamp,
+        updatedAt: timestamp
+    };
+}
+function customerToItem(customer) {
+    return {
+        pk: `CUSTOMER#${customer.id}`,
+        sk: "META",
+        entity_type: "Customer",
+        gsi1pk: `CUSTOMER_EMAIL#${customer.email.trim().toLowerCase()}`,
+        gsi1sk: `CUSTOMER#${customer.id}`,
+        customer_id: customer.id,
+        email: customer.email,
+        name: customer.name,
+        default_webhook_url: customer.defaultWebhookUrl,
+        is_developer: customer.isDeveloper,
+        is_agency: customer.isAgency,
+        is_paid_plan: customer.isPaidPlan,
+        plan_tier: customer.planTier,
+        about: customer.about,
+        groupchat_url: customer.groupchatUrl,
+        flockposter_api_key: customer.flockposterApiKey,
+        created_at: customer.createdAt,
+        updated_at: customer.updatedAt
+    };
+}
+function itemToCustomer(item) {
+    return {
+        id: String(item.customer_id),
+        email: String(item.email),
+        name: typeof item.name === "string" ? item.name : null,
+        defaultWebhookUrl: typeof item.default_webhook_url === "string" ? item.default_webhook_url : null,
+        isDeveloper: Boolean(item.is_developer),
+        isAgency: Boolean(item.is_agency),
+        isPaidPlan: Boolean(item.is_paid_plan),
+        planTier: normalizePlanTier(item.plan_tier),
+        about: typeof item.about === "string" ? item.about : null,
+        groupchatUrl: typeof item.groupchat_url === "string" ? item.groupchat_url : null,
+        flockposterApiKey: typeof item.flockposter_api_key === "string" ? item.flockposter_api_key : null,
+        createdAt: String(item.created_at),
+        updatedAt: String(item.updated_at)
+    };
+}
+function normalizePlanTier(value) {
+    if (value === "client" || value === "standalone" || value === "agency") {
+        return value;
+    }
+    return "client";
+}
+//# sourceMappingURL=serverless-auth.js.map