@nlabs/reaktor 1.6.2 → 1.7.0

package/LICENSE

@@ -1,201 +1,74 @@
-Apache License
-Version 2.0, January 2004
-http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-"License" shall mean the terms and conditions for use, reproduction,
-and distribution as defined by Sections 1 through 9 of this document.
-
-"Licensor" shall mean the copyright owner or entity authorized by
-the copyright owner that is granting the License.
-
-"Legal Entity" shall mean the union of the acting entity and all
-other entities that control, are controlled by, or are under common
-control with that entity. For the purposes of this definition,
-"control" means (i) the power, direct or indirect, to cause the
-direction or management of such entity, whether by contract or
-otherwise, or (ii) ownership of fifty percent (50%) or more of the
-outstanding shares, or (iii) beneficial ownership of such entity.
-
-"You" (or "Your") shall mean an individual or Legal Entity
-exercising permissions granted by this License.
-
-"Source" form shall mean the preferred form for making modifications,
-including but not limited to software source code, documentation
-source, and configuration files.
-
-"Object" form shall mean any form resulting from mechanical
-transformation or translation of a Source form, including but
-not limited to compiled object code, generated documentation,
-and conversions to other media types.
-
-"Work" shall mean the work of authorship, whether in Source or
-Object form, made available under the License, as indicated by a
-copyright notice that is included in or attached to the work
-(an example is provided in the Appendix below).
-
-"Derivative Works" shall mean any work, whether in Source or Object
-form, that is based on (or derived from) the Work and for which the
-editorial revisions, annotations, elaborations, or other modifications
-represent, as a whole, an original work of authorship. For the purposes
-of this License, Derivative Works shall not include works that remain
-separable from, or merely link (or bind by name) to the interfaces of,
-the Work and Derivative Works thereof.
-
-"Contribution" shall mean any work of authorship, including
-the original version of the Work and any modifications or additions
-to that Work or Derivative Works thereof, that is intentionally
-submitted to Licensor for inclusion in the Work by the copyright owner
-or by an individual or Legal Entity authorized to submit on behalf of
-the copyright owner. For the purposes of this definition, "submitted"
-means any form of electronic, verbal, or written communication sent
-to the Licensor or its representatives, including but not limited to
-communication on electronic mailing lists, source code control systems,
-and issue tracking systems that are managed by, or on behalf of, the
-Licensor for the purpose of discussing and improving the Work, but
-excluding communication that is conspicuously marked or otherwise
-designated in writing by the copyright owner as "Not a Contribution."
-
-"Contributor" shall mean Licensor and any individual or Legal Entity
-on behalf of whom a Contribution has been received by Licensor and
-subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-this License, each Contributor hereby grants to You a perpetual,
-worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-copyright license to reproduce, prepare Derivative Works of,
-publicly display, publicly perform, sublicense, and distribute the
-Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-this License, each Contributor hereby grants to You a perpetual,
-worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-(except as stated in this section) patent license to make, have made,
-use, offer to sell, sell, import, and otherwise transfer the Work,
-where such license applies only to those patent claims licensable
-by such Contributor that are necessarily infringed by their
-Contribution(s) alone or by combination of their Contribution(s)
-with the Work to which such Contribution(s) was submitted. If You
-institute patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Work
-or a Contribution incorporated within the Work constitutes direct
-or contributory patent infringement, then any patent licenses
-granted to You under this License for that Work shall terminate
-as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-Work or Derivative Works thereof in any medium, with or without
-modifications, and in Source or Object form, provided that You
-meet the following conditions:
-
-(a) You must give any other recipients of the Work or
-    Derivative Works a copy of this License; and
-
-(b) You must cause any modified files to carry prominent notices
-    stating that You changed the files; and
-
-(c) You must retain, in the Source form of any Derivative Works
-    that You distribute, all copyright, patent, trademark, and
-    attribution notices from the Source form of the Work,
-    excluding those notices that do not pertain to any part of
-    the Derivative Works; and
-
-(d) If the Work includes a "NOTICE" text file as part of its
-    distribution, then any Derivative Works that You distribute must
-    include a readable copy of the attribution notices contained
-    within such NOTICE file, excluding those notices that do not
-    pertain to any part of the Derivative Works, in at least one
-    of the following places: within a NOTICE text file distributed
-    as part of the Derivative Works; within the Source form or
-    documentation, if provided along with the Derivative Works; or,
-    within a display generated by the Derivative Works, if and
-    wherever such third-party notices normally appear. The contents
-    of the NOTICE file are for informational purposes only and
-    do not modify the License. You may add Your own attribution
-    notices within Derivative Works that You distribute, alongside
-    or as an addendum to the NOTICE text from the Work, provided
-    that such additional attribution notices cannot be construed
-    as modifying the License.
-
-You may add Your own copyright statement to Your modifications and
-may provide additional or different license terms and conditions
-for use, reproduction, or distribution of Your modifications, or
-for any such Derivative Works as a whole, provided Your use,
-reproduction, and distribution of the Work otherwise complies with
-the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-any Contribution intentionally submitted for inclusion in the Work
-by You to the Licensor shall be under the terms and conditions of
-this License, without any additional terms or conditions.
-Notwithstanding the above, nothing herein shall supersede or modify
-the terms of any separate license agreement you may have executed
-with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade
-names, trademarks, service marks, or product names of the Licensor,
-except as required for reasonable and customary use in describing the
-origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-agreed to in writing, Licensor provides the Work (and each
-Contributor provides its Contributions) on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-implied, including, without limitation, any warranties or conditions
-of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-PARTICULAR PURPOSE. You are solely responsible for determining the
-appropriateness of using or redistributing the Work and assume any
-risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-whether in tort (including negligence), contract, or otherwise,
-unless required by applicable law (such as deliberate and grossly
-negligent acts) or agreed to in writing, shall any Contributor be
-liable to You for damages, including any direct, indirect, special,
-incidental, or consequential damages of any character arising as a
-result of this License or out of the use or inability to use the
-Work (including but not limited to damages for loss of goodwill,
-work stoppage, computer failure or malfunction, or any and all
-other commercial damages or losses), even if such Contributor
-has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-the Work or Derivative Works thereof, You may choose to offer,
-and charge a fee for, acceptance of support, warranty, indemnity,
-or other liability obligations and/or rights consistent with this
-License. However, in accepting such obligations, You may act only
-on Your own behalf and on Your sole responsibility, not on behalf
-of any other Contributor, and only if You agree to indemnify,
-defend, and hold each Contributor harmless for any liability
-incurred by, or claims asserted against, such Contributor by reason
-of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-To apply the Apache License to your work, attach the following
-boilerplate notice, with the fields enclosed by brackets "[]"
-replaced with your own identifying information. (Don't include
-the brackets!) The text should be enclosed in the appropriate
-comment syntax for the file format. We also recommend that a
-file or class name and description of purpose be included on the
-same "printed page" as the copyright notice for easier
-identification within third-party archives.
-
-Copyright [yyyy] [name of copyright owner]
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
+REAKTOR COMMERCIAL LICENSE
+
+Copyright (c) 2019-Present Nitrogen Labs, Inc. All rights reserved.
+
+This software and its associated source code, object code, documentation, and
+other materials (collectively, the "Software") are proprietary to Nitrogen
+Labs, Inc. ("Nitrogen Labs").
+
+1. COMMERCIAL AGREEMENT REQUIRED
+
+Use of the Software requires a valid written commercial license, subscription,
+order form, or other agreement with Nitrogen Labs (the "Commercial
+Agreement"). Possession of or access to the Software does not itself grant any
+license or other rights.
+
+2. LICENSE GRANT
+
+Subject to payment of all applicable fees and continued compliance with the
+Commercial Agreement, Nitrogen Labs grants the licensee a limited,
+non-exclusive, non-transferable, non-sublicensable right, during the term of
+the Commercial Agreement, to install and use the Software internally only for
+the purposes and within the scope expressly authorized by that agreement.
+
+3. RESTRICTIONS
+
+Except where expressly authorized by the Commercial Agreement or required by
+applicable law, the licensee may not copy, modify, adapt, translate, publish,
+distribute, sublicense, sell, rent, lease, provide as a service, reverse
+engineer, decompile, disassemble, or otherwise attempt to derive the source or
+underlying ideas of the Software. The licensee may not remove or alter any
+copyright, trademark, or proprietary notice.
+
+4. OWNERSHIP
+
+Nitrogen Labs and its licensors retain all right, title, and interest in and to
+the Software, including all intellectual-property rights. No rights are granted
+except those expressly stated in the Commercial Agreement and this license.
+
+5. THIRD-PARTY SOFTWARE
+
+Third-party components included with or used by the Software remain subject to
+their respective license terms. Those terms apply only to the corresponding
+third-party components and do not license the Software as a whole.
+
+6. TERMINATION
+
+The license terminates automatically when the Commercial Agreement expires or
+terminates, or upon a material breach of these terms. Upon termination, the
+licensee must stop using and destroy all copies of the Software, except where
+retention is required by law.
+
+7. DISCLAIMER
+
+EXCEPT AS EXPRESSLY PROVIDED IN THE COMMERCIAL AGREEMENT, THE SOFTWARE IS
+PROVIDED "AS IS" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND
+NON-INFRINGEMENT.
+
+8. LIMITATION OF LIABILITY
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, NITROGEN LABS WILL NOT BE LIABLE FOR
+INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES,
+OR FOR LOST PROFITS, REVENUE, DATA, OR BUSINESS OPPORTUNITIES, ARISING FROM OR
+RELATED TO THE SOFTWARE. ANY ADDITIONAL LIMITATIONS OR REMEDIES ARE GOVERNED BY
+THE COMMERCIAL AGREEMENT.
+
+9. ORDER OF PRECEDENCE
+
+If these terms conflict with a signed Commercial Agreement, the signed
+Commercial Agreement controls. No purchase order or other unilateral terms
+modify this license unless expressly accepted in writing by Nitrogen Labs.
+
+Use without a valid Commercial Agreement is prohibited. Contact Nitrogen Labs
+through https://nitrogenlabs.com to obtain commercial licensing rights.

package/README.md

@@ -3,6 +3,11 @@ Reaktor
 
 A powerful GraphQL API framework built with TypeScript, ArangoDB, and AWS Lambda. Reaktor provides a complete backend solution for social platforms with user management, posts, messaging, reactions, and more.
 
+[![npm version](https://img.shields.io/npm/v/@nlabs/reaktor.svg?style=flat-square)](https://www.npmjs.com/package/@nlabs/reaktor)
+[![npm downloads](https://img.shields.io/npm/dm/@nlabs/reaktor.svg?style=flat-square)](https://www.npmjs.com/package/@nlabs/reaktor)
+[![Documentation](https://img.shields.io/badge/docs-reaktor.nitrogenx.co-6d28d9?style=flat-square)](https://reaktor.nitrogenx.co)
+[![Platform](https://img.shields.io/badge/platform-reaktor.io-080832?style=flat-square)](https://reaktor.io)
+
 ## Features
 
 - **GraphQL API** - Built with graphql-compose for type-safe schema composition
@@ -14,6 +19,8 @@ A powerful GraphQL API framework built with TypeScript, ArangoDB, and AWS Lambda
 - **AWS Lambda Ready** - Serverless deployment support
 - **Comprehensive Testing** - Jest-based testing with utilities
 - **Internationalization** - Database-driven i18n system
+- **Feature flags** - Code-owned boolean and fixed-choice flags with database overrides ([guide](./docs/FEATURE_FLAGS.md))
+- **Secure billing setup** - Stripe-hosted card collection without raw card data passing through Reaktor ([guide](./docs/BILLING.md))
 
 Peer Dependencies
 ----------------
@@ -177,6 +184,21 @@ export ARANGODB_PASSWORD="mypassword"
 
 The configuration is environment-aware and supports `local`, `development`, `test`, and `production` environments. The active environment is determined by the `NODE_ENV` or `stage` environment variable.
 
+#### Anonymous RUM Configuration
+
+The public `rum.track` mutation sanitizes GothamJS journey events and sends them to Amazon CloudWatch RUM with `PutRumEvents`. Reaktor does not persist RUM events in ArangoDB.
+
+- `AWS_REGION` - AWS region containing the CloudWatch RUM app monitors.
+- `AWS_RUM_APP_MONITORS` - JSON object mapping each public application ID to its CloudWatch RUM app-monitor UUID. Values may also be objects with `id`, `name`, `version`, `domain`, and optional resource-policy `alias` fields.
+
+The Lambda or server role must allow `rum:PutRumEvents` for the configured app monitors. APIs that create tagged monitors must also allow `rum:CreateAppMonitor`, `rum:GetAppMonitor`, `rum:GetAppMonitorData`, and `rum:TagResource`. The same mapping can be supplied programmatically at `aws.rum.appMonitors` using `Config.set()`.
+
+Each event includes its sanitized public `appId` in the event details and as the `applicationId` metadata attribute so CloudWatch RUM filters, Logs Insights, and custom dashboards can filter shared-monitor data. Use a separate app monitor per application when AWS-native metrics and access boundaries must remain isolated.
+
+When supplied as event properties, Reaktor promotes `browserName`, `browserVersion`, `browserLanguage`, `pageId`/`pageID`, `parentPageId`/`parentPage`, `interaction`, `deviceType`, `osName`, and `osVersion` into canonical AWS RUM metadata fields.
+
+Reaktor does not send authentication state, cookies, IP addresses, user agents, referrers, form values, common identity fields, or client-supplied geolocation. AWS can enrich accepted RUM events with coarse location metadata such as country, subdivision, and locality. Journey IDs remain memory-only in the browser and reset when the application runtime restarts.
+
 #### Programmatic Configuration
 
 You can also override configuration programmatically using the `Config.set()` method:
@@ -445,13 +467,9 @@ export const addPost = async (context: ApiContext, input: PostInputType): Promis
 };
 ```
 
-## Migration Guide
-
-### From Old to New Structure
+## Query Guidelines
 
-The refactoring maintains backward compatibility while introducing better patterns and utilities.
-
-**Old way (manual query building):**
+**Avoid manual query building:**
 ```typescript
 // Manual string concatenation (avoid this)
 const aqlQry = `FOR p IN posts
@@ -459,7 +477,7 @@ const aqlQry = `FOR p IN posts
   RETURN p`;
 ```
 
-**New way (parameterized queries):**
+**Use parameterized queries:**
 ```typescript
 // Use AQL template literals for safety
 import {aql} from 'arangojs';
@@ -485,10 +503,6 @@ const results = await getPostsByLatest(context, {
 });
 ```
 
-### Breaking Changes
-
-**None!** All existing functions maintain backward compatibility. The refactoring improves internal structure without changing public APIs.
-
 ### Best Practices
 
 1. **Use parameterized queries**: Always use `aql` template literals
@@ -561,10 +575,36 @@ describe('User Actions', () => {
 
 See [Test Utilities Guide](./TEST_UTILITIES_GUIDE.md) for detailed documentation on test helpers.
 
+## Releases
+
+Releases are automated from Conventional Commit messages when files under
+`packages/reaktor` change on `main`:
+
+- `fix:` creates a patch release.
+- `feat:` creates a minor release.
+- `feat!:` or a `BREAKING CHANGE:` footer creates a major release.
+- Other commit types do not create a release by default.
+
+Release Please opens a version and changelog pull request. Merging that pull
+request creates the GitHub release and publishes `@nlabs/reaktor` to npm after
+the package test, lint, build, and declaration checks pass. The repository must
+provide an `NPM_TOKEN` Actions secret with publish access to the private package.
+
 ## Available Action Functions
 
 All action functions have been refactored for better modularity and maintainability. Common patterns are now extracted into shared utilities.
 
+### Secure billing
+
+Use Stripe Checkout to save a card without sending its number, expiration date, or security code through Reaktor. The signed-in user's flow is:
+
+1. Call `users.createBillingSetupSession(returnUrl)`.
+2. Redirect the browser to the returned Stripe Checkout URL.
+3. After Stripe returns with `billing=success`, call `users.completeBillingSetupSession(sessionId)` using the returned `session_id`.
+4. Use `users.deleteBillingCard` if the customer removes the saved card.
+
+Set `STRIPE_RETURN_URL_ORIGINS` to the comma-separated HTTPS origins allowed to receive Stripe redirects. See the [secure billing guide](./docs/BILLING.md) for complete GraphQL examples, local-development rules, errors, and migration instructions for the removed `addCreditCard` and `saveUserBillingCard` APIs.
+
 ### Posts
 
 ```typescript
@@ -865,7 +905,7 @@ const handler = createGraphqlHandler({
   context: {}
 });
 
-// Use in an AWS Lambda or Express route
+// Use in an AWS Lambda connected to API Gateway HTTP API (payload v2)
 export const lambdaHandler = async (event) => {
   return await handler(event);
 };
@@ -899,8 +939,7 @@ const handler = createGraphqlHandler({
 - You can customize context by passing initial values with `createGraphqlHandler({context})`.
 
 #### Typical Integration
-- For AWS Lambda: export the handler and wire it to API Gateway events.
-- For Express: call the handler with the request event object.
+- Export the handler from AWS Lambda and wire it to API Gateway HTTP API payload v2 events.
 
 See [`src/handlers/graphqlHandler.ts`](./src/handlers/graphqlHandler.ts) for implementation details.
 
@@ -933,6 +972,12 @@ Below is a list of available functions for each main action group. These can be
 - getActiveUserCount
 - getUserByToken
 
+### Payments
+- completeBillingSetupSession
+- createBillingSetupSession
+- deleteUserBillingCard
+- upgradeUserToPlus
+
 ### Groups
 - getGroupList
 - getGroupListByUser
@@ -1403,4 +1448,6 @@ For comprehensive guides and detailed documentation, see:
 
 ## License
 
-See the LICENSE file for license rights and limitations (Apache-2.0).
+Reaktor is proprietary commercial software. A valid commercial agreement with
+Nitrogen Labs, Inc. is required to use, copy, modify, or distribute this
+package. See [LICENSE](./LICENSE) for the governing terms.

package/lib/actions/analytics.d.ts

@@ -0,0 +1,10 @@
+import type { AnalyticsConfigurationType, AnalyticsDashboardType, AnalyticsType, CreateAnalyticsMonitorInputType } from '../types/analytics.types.js';
+import type { ApiContext } from '../types/auth.types.js';
+export declare const getAnalyticsByAppId: (context: ApiContext, appIdInput: string) => Promise<AnalyticsType | null>;
+export declare const getAnalyticsConfiguration: (context: ApiContext, appIdInput: string) => Promise<AnalyticsConfigurationType | null>;
+export declare const getAnalyticsById: (context: ApiContext, analyticsIdInput: string) => Promise<AnalyticsType | null>;
+export declare const createAnalyticsMonitor: (context: ApiContext, input: CreateAnalyticsMonitorInputType) => Promise<AnalyticsType>;
+export declare const regenerateAnalyticsId: (context: ApiContext, analyticsIdInput: string) => Promise<AnalyticsType>;
+export declare const getAvailableAnalytics: (context: ApiContext) => Promise<AnalyticsType[]>;
+export declare const setAnalyticsAccess: (context: ApiContext, analyticsIdInput: string, userIdsInput: readonly string[]) => Promise<AnalyticsType>;
+export declare const getAnalyticsDashboard: (context: ApiContext, analyticsIdInput: string, rangeDaysInput: number) => Promise<AnalyticsDashboardType>;