@nxuss/lemma 1.16.1 → 1.18.0

package/dist/cjs/cloud/identity/ApiKey.d.ts

@@ -0,0 +1,32 @@
+import type { IdentityStore, NewKeyInput } from './identityStore';
+export type KeyPrefix = 'lk_live_' | 'lk_test_';
+export declare const KEY_PREFIX_LIVE: KeyPrefix;
+export declare const KEY_PREFIX_TEST: KeyPrefix;
+export declare const KEY_SHAPE: RegExp;
+export interface GeneratedApiKey {
+    /** Stable, NON-secret record id (`key_<hex>`). Safe for dashboards and logs. */
+    id: string;
+    /** PLAINTEXT key value. Returned exactly once, never stored, never logged. */
+    key: string;
+    /** sha256 of the full key value — the only thing the DB ever sees. */
+    hash: string;
+    prefix: KeyPrefix;
+}
+/** sha256 of the full bearer value, hex-encoded. Deterministic, one-way. */
+export declare function hashApiKey(key: string): string;
+/** Cheap shape check before hashing — rejects obvious junk without a store hit. */
+export declare function isWellFormedKey(token: string): boolean;
+/**
+ * Generate a fresh key. The plaintext `key` lives only in the returned object
+ * (and, transitively, in the HTTP response of the creation call).
+ */
+export declare function generateApiKey(prefix?: KeyPrefix): GeneratedApiKey;
+/**
+ * Issue a key end-to-end: generate the plaintext, persist ONLY its hash, return
+ * the plaintext to the caller a single time. The returned value must be sent to
+ * the client and discarded — it exists in no store.
+ */
+export declare function issueApiKey(store: IdentityStore, input: Omit<NewKeyInput, 'prefix' | 'hash'> & {
+    prefix?: KeyPrefix;
+}): Promise<GeneratedApiKey>;
+//# sourceMappingURL=ApiKey.d.ts.map

package/dist/cjs/cloud/identity/ApiKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKey.d.ts","sourceRoot":"","sources":["../../../../src/cloud/identity/ApiKey.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGlE,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAEhD,eAAO,MAAM,eAAe,EAAE,SAAsB,CAAC;AACrD,eAAO,MAAM,eAAe,EAAE,SAAsB,CAAC;AACrD,eAAO,MAAM,SAAS,QAAqC,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,GAAE,SAA2B,GAAG,eAAe,CAInF;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GACnE,OAAO,CAAC,eAAe,CAAC,CAW1B"}

package/dist/cjs/cloud/identity/ApiKey.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_SHAPE = exports.KEY_PREFIX_TEST = exports.KEY_PREFIX_LIVE = void 0;
+exports.hashApiKey = hashApiKey;
+exports.isWellFormedKey = isWellFormedKey;
+exports.generateApiKey = generateApiKey;
+exports.issueApiKey = issueApiKey;
+/**
+ * Lemma API v2 — API key generation & hashing (Lane D)
+ *
+ * SECURITY CONTRACT:
+ *   - The plaintext key value is produced EXACTLY ONCE, inside `generateApiKey`,
+ *     and returned to the caller of `issueApiKey`. It is never persisted and
+ *     never logged: the only derivation that survives is the SHA-256 hash.
+ *   - `identityStore.createKey()` receives only `{ hash }` — the plaintext never
+ *     enters the persistence layer, by construction, not by discipline.
+ */
+const crypto_1 = __importDefault(require("crypto"));
+exports.KEY_PREFIX_LIVE = 'lk_live_';
+exports.KEY_PREFIX_TEST = 'lk_test_';
+exports.KEY_SHAPE = /^lk_(live|test)_[0-9a-f]{32,64}$/;
+/** sha256 of the full bearer value, hex-encoded. Deterministic, one-way. */
+function hashApiKey(key) {
+    return crypto_1.default.createHash('sha256').update(key, 'utf8').digest('hex');
+}
+/** Cheap shape check before hashing — rejects obvious junk without a store hit. */
+function isWellFormedKey(token) {
+    return exports.KEY_SHAPE.test(token);
+}
+/**
+ * Generate a fresh key. The plaintext `key` lives only in the returned object
+ * (and, transitively, in the HTTP response of the creation call).
+ */
+function generateApiKey(prefix = exports.KEY_PREFIX_LIVE) {
+    const randomHex = crypto_1.default.randomBytes(16).toString('hex');
+    const key = `${prefix}${randomHex}`;
+    return { id: `key_${randomHex.slice(0, 12)}`, key, hash: hashApiKey(key), prefix };
+}
+/**
+ * Issue a key end-to-end: generate the plaintext, persist ONLY its hash, return
+ * the plaintext to the caller a single time. The returned value must be sent to
+ * the client and discarded — it exists in no store.
+ */
+async function issueApiKey(store, input) {
+    const prefix = input.prefix ?? exports.KEY_PREFIX_LIVE;
+    const generated = generateApiKey(prefix);
+    await store.createKey({
+        tenantId: input.tenantId,
+        name: input.name,
+        plan: input.plan,
+        prefix,
+        hash: generated.hash,
+    });
+    return generated;
+}
+//# sourceMappingURL=ApiKey.js.map

package/dist/cjs/cloud/identity/ApiKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKey.js","sourceRoot":"","sources":["../../../../src/cloud/identity/ApiKey.ts"],"names":[],"mappings":";;;;;;AA+BA,gCAEC;AAGD,0CAEC;AAMD,wCAIC;AAOD,kCAcC;AArED;;;;;;;;;GASG;AACH,oDAA4B;AAMf,QAAA,eAAe,GAAc,UAAU,CAAC;AACxC,QAAA,eAAe,GAAc,UAAU,CAAC;AACxC,QAAA,SAAS,GAAG,kCAAkC,CAAC;AAY5D,4EAA4E;AAC5E,SAAgB,UAAU,CAAC,GAAW;IACpC,OAAO,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,mFAAmF;AACnF,SAAgB,eAAe,CAAC,KAAa;IAC3C,OAAO,iBAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,SAAoB,uBAAe;IAChE,MAAM,SAAS,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,GAAG,MAAM,GAAG,SAAS,EAAE,CAAC;IACpC,OAAO,EAAE,EAAE,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,WAAW,CAC/B,KAAoB,EACpB,KAAoE;IAEpE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,uBAAe,CAAC;IAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAc;QAC1B,MAAM;QACN,IAAI,EAAE,SAAS,CAAC,IAAI;KACrB,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/cjs/cloud/identity/PlanPolicy.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Lemma API v2 — PlanPolicy (Lane D)
+ *
+ * Replaces `src/cloud/types.ts` PLAN_LIMITS. Quota is measured by ACTIVE-VERIFIED
+ * memories and by SEAT, not only by request count, and `Infinity` is gone —
+ * every plan has an explicit, positive ceiling. Exceeding a cap yields a 429
+ * with an actionable body: limit, current use, reset time and upgrade link.
+ *
+ * This module owns the plan table. The DB migration only stores tenancy; keeping
+ * a second copy of the limits in SQL would guarantee drift.
+ */
+export type PlanId = 'free' | 'pro' | 'scale';
+export interface PlanLimits {
+    /** Active AND verified memories the tenant may keep. */
+    activeMemories: number;
+    /** Concurrent seats (API keys / members) the tenant may hold. */
+    seats: number;
+    /** Requests allowed per rate-limit window. */
+    dailyRequests: number;
+    /** Requests allowed per calendar month. */
+    monthlyRequests: number;
+    /** Length of the rate-limit window (24h = UTC-day buckets). */
+    rateLimitWindowMs: number;
+    /** Where the client is pointed when a cap is hit. */
+    upgradeUrl: string;
+}
+export declare const RATE_LIMIT_WINDOW_MS: number;
+export declare const PLAN_UPGRADE_URL: Readonly<Record<PlanId, string>>;
+/** Single source of truth for plan ceilings. Every value finite and > 0. */
+export declare const PLAN_LIMITS: Readonly<Record<PlanId, PlanLimits>>;
+export declare const DEFAULT_PLAN: PlanId;
+/**
+ * The `Infinity` elimination check, exported so tests can prove it (and the
+ * policy constructor refuses any non-finite/zero ceiling at startup).
+ */
+export declare function validatePlanLimits(limits: Record<string, PlanLimits>): string[];
+export type QuotaKind = 'memories' | 'seats';
+export interface QuotaViolation {
+    kind: QuotaKind;
+    plan: PlanId;
+    limit: number;
+    current: number;
+    upgradeUrl: string;
+    message: string;
+}
+export type QuotaCheck = {
+    allowed: true;
+} | {
+    allowed: false;
+    violation: QuotaViolation;
+};
+/** The actionable 429 body for quota_exceeded (additive to the LemmaApiError envelope). */
+export interface QuotaErrorBody {
+    error: {
+        code: 'quota_exceeded';
+        status: 429;
+        message: string;
+        plan: PlanId;
+        kind: QuotaKind;
+        limit: number;
+        current: number;
+        /** When the counter resets, or null when there is no scheduled reset (memory quotas). */
+        resetsAt: number | null;
+        upgradeUrl: string;
+    };
+}
+export declare function quotaErrorBody(violation: QuotaViolation, resetsAt?: number | null): QuotaErrorBody;
+export declare class PlanPolicy {
+    private readonly limits;
+    constructor(limits?: Record<string, PlanLimits>);
+    /** Limits for a plan; unknown plans conservatively fall back to `free`. */
+    limitsFor(plan: string): PlanLimits;
+    /** Memory quota: number of ACTIVE-VERIFIED memories the plan allows. */
+    checkMemoryQuota(planId: string, activeVerifiedMemories: number): QuotaCheck;
+    /** Seat quota: number of seats (members/keys) the plan allows. */
+    checkSeatQuota(planId: string, seats: number): QuotaCheck;
+    private checkStatic;
+}
+//# sourceMappingURL=PlanPolicy.d.ts.map

package/dist/cjs/cloud/identity/PlanPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlanPolicy.d.ts","sourceRoot":"","sources":["../../../../src/cloud/identity/PlanPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;AAE9C,MAAM,WAAW,UAAU;IACzB,wDAAwD;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,eAAe,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,oBAAoB,QAAsB,CAAC;AAExD,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI5D,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAyB3D,CAAC;AAEH,eAAO,MAAM,YAAY,EAAE,MAAe,CAAC;AAU3C;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,EAAE,CAY/E;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3F,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE;QACL,IAAI,EAAE,gBAAgB,CAAC;QACvB,MAAM,EAAE,GAAG,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,SAAS,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,yFAAyF;QACzF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,GAAE,MAAM,GAAG,IAAW,GAAG,cAAc,CAcxG;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAExC,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAA6C;IAQ1F,2EAA2E;IAC3E,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU;IAInC,wEAAwE;IACxE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,GAAG,UAAU;IAiB5E,kEAAkE;IAClE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU;IAgBzD,OAAO,CAAC,WAAW;CAcpB"}

package/dist/cjs/cloud/identity/PlanPolicy.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PlanPolicy = exports.DEFAULT_PLAN = exports.PLAN_LIMITS = exports.PLAN_UPGRADE_URL = exports.RATE_LIMIT_WINDOW_MS = void 0;
+exports.validatePlanLimits = validatePlanLimits;
+exports.quotaErrorBody = quotaErrorBody;
+exports.RATE_LIMIT_WINDOW_MS = 24 * 60 * 60 * 1000;
+exports.PLAN_UPGRADE_URL = Object.freeze({
+    free: 'https://lemma.dev/pricing',
+    pro: 'https://lemma.dev/pricing',
+    scale: 'https://lemma.dev/contact',
+});
+/** Single source of truth for plan ceilings. Every value finite and > 0. */
+exports.PLAN_LIMITS = Object.freeze({
+    free: Object.freeze({
+        activeMemories: 1000,
+        seats: 1,
+        dailyRequests: 1000,
+        monthlyRequests: 10000,
+        rateLimitWindowMs: exports.RATE_LIMIT_WINDOW_MS,
+        upgradeUrl: exports.PLAN_UPGRADE_URL.free,
+    }),
+    pro: Object.freeze({
+        activeMemories: 10000,
+        seats: 10,
+        dailyRequests: 5000,
+        monthlyRequests: 60000,
+        rateLimitWindowMs: exports.RATE_LIMIT_WINDOW_MS,
+        upgradeUrl: exports.PLAN_UPGRADE_URL.pro,
+    }),
+    scale: Object.freeze({
+        activeMemories: 100000,
+        seats: 50,
+        dailyRequests: 20000,
+        monthlyRequests: 250000,
+        rateLimitWindowMs: exports.RATE_LIMIT_WINDOW_MS,
+        upgradeUrl: exports.PLAN_UPGRADE_URL.scale,
+    }),
+});
+exports.DEFAULT_PLAN = 'free';
+const NUMERIC_LIMIT_KEYS = [
+    'activeMemories',
+    'seats',
+    'dailyRequests',
+    'monthlyRequests',
+    'rateLimitWindowMs',
+];
+/**
+ * The `Infinity` elimination check, exported so tests can prove it (and the
+ * policy constructor refuses any non-finite/zero ceiling at startup).
+ */
+function validatePlanLimits(limits) {
+    const problems = [];
+    for (const [plan, l] of Object.entries(limits)) {
+        for (const key of NUMERIC_LIMIT_KEYS) {
+            const value = l[key];
+            if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) {
+                problems.push(`${plan}.${key} = ${value}`);
+            }
+        }
+        if (!l.upgradeUrl)
+            problems.push(`${plan}.upgradeUrl missing`);
+    }
+    return problems;
+}
+function quotaErrorBody(violation, resetsAt = null) {
+    return {
+        error: {
+            code: 'quota_exceeded',
+            status: 429,
+            message: violation.message,
+            plan: violation.plan,
+            kind: violation.kind,
+            limit: violation.limit,
+            current: violation.current,
+            resetsAt,
+            upgradeUrl: violation.upgradeUrl,
+        },
+    };
+}
+class PlanPolicy {
+    constructor(limits = exports.PLAN_LIMITS) {
+        const problems = validatePlanLimits(limits);
+        if (problems.length > 0) {
+            throw new Error(`PlanPolicy: invalid plan limits (${problems.join(', ')})`);
+        }
+        this.limits = limits;
+    }
+    /** Limits for a plan; unknown plans conservatively fall back to `free`. */
+    limitsFor(plan) {
+        return this.limits[plan] ?? this.limits[exports.DEFAULT_PLAN];
+    }
+    /** Memory quota: number of ACTIVE-VERIFIED memories the plan allows. */
+    checkMemoryQuota(planId, activeVerifiedMemories) {
+        return this.checkStatic(planId, 'memories', activeVerifiedMemories, (limit, plan) => ({
+            allowed: false,
+            violation: {
+                kind: 'memories',
+                plan,
+                limit,
+                current: activeVerifiedMemories,
+                upgradeUrl: this.limitsFor(planId).upgradeUrl,
+                message: `${plan} plan allows ${limit} active verified memories; ` +
+                    `you currently have ${activeVerifiedMemories}. ` +
+                    `Upgrade at ${this.limitsFor(planId).upgradeUrl}`,
+            },
+        }));
+    }
+    /** Seat quota: number of seats (members/keys) the plan allows. */
+    checkSeatQuota(planId, seats) {
+        return this.checkStatic(planId, 'seats', seats, (limit, plan) => ({
+            allowed: false,
+            violation: {
+                kind: 'seats',
+                plan,
+                limit,
+                current: seats,
+                upgradeUrl: this.limitsFor(planId).upgradeUrl,
+                message: `${plan} plan allows ${limit} seat(s); you currently have ${seats}. ` +
+                    `Upgrade at ${this.limitsFor(planId).upgradeUrl}`,
+            },
+        }));
+    }
+    checkStatic(planId, kind, current, makeViolation) {
+        const plan = (planId in this.limits ? planId : exports.DEFAULT_PLAN);
+        const limitKey = kind === 'memories' ? 'activeMemories' : 'seats';
+        const limit = this.limitsFor(planId)[limitKey];
+        // El tope es exclusivo: en el límite (free con 1000 activas) la siguiente
+        // escritura ya está negada — "intenta crear la 1001 ⇒ 429".
+        if (current >= limit)
+            return makeViolation(limit, plan);
+        return { allowed: true };
+    }
+}
+exports.PlanPolicy = PlanPolicy;
+//# sourceMappingURL=PlanPolicy.js.map

package/dist/cjs/cloud/identity/PlanPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlanPolicy.js","sourceRoot":"","sources":["../../../../src/cloud/identity/PlanPolicy.ts"],"names":[],"mappings":";;;AA8EA,gDAYC;AA+BD,wCAcC;AA3GY,QAAA,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C,QAAA,gBAAgB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC9E,IAAI,EAAE,2BAA2B;IACjC,GAAG,EAAE,2BAA2B;IAChC,KAAK,EAAE,2BAA2B;CACnC,CAAC,CAAC;AAEH,4EAA4E;AAC/D,QAAA,WAAW,GAAyC,MAAM,CAAC,MAAM,CAAC;IAC7E,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAClB,cAAc,EAAE,IAAK;QACrB,KAAK,EAAE,CAAC;QACR,aAAa,EAAE,IAAK;QACpB,eAAe,EAAE,KAAM;QACvB,iBAAiB,EAAE,4BAAoB;QACvC,UAAU,EAAE,wBAAgB,CAAC,IAAI;KAClC,CAAC;IACF,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;QACjB,cAAc,EAAE,KAAM;QACtB,KAAK,EAAE,EAAE;QACT,aAAa,EAAE,IAAK;QACpB,eAAe,EAAE,KAAM;QACvB,iBAAiB,EAAE,4BAAoB;QACvC,UAAU,EAAE,wBAAgB,CAAC,GAAG;KACjC,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,cAAc,EAAE,MAAO;QACvB,KAAK,EAAE,EAAE;QACT,aAAa,EAAE,KAAM;QACrB,eAAe,EAAE,MAAO;QACxB,iBAAiB,EAAE,4BAAoB;QACvC,UAAU,EAAE,wBAAgB,CAAC,KAAK;KACnC,CAAC;CACH,CAAC,CAAC;AAEU,QAAA,YAAY,GAAW,MAAM,CAAC;AAE3C,MAAM,kBAAkB,GAAwD;IAC9E,gBAAgB;IAChB,OAAO;IACP,eAAe;IACf,iBAAiB;IACjB,mBAAmB;CACpB,CAAC;AAEF;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,MAAkC;IACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAW,CAAC;YAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBACvE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,UAAU;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AA+BD,SAAgB,cAAc,CAAC,SAAyB,EAAE,WAA0B,IAAI;IACtF,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,QAAQ;YACR,UAAU,EAAE,SAAS,CAAC,UAAU;SACjC;KACF,CAAC;AACJ,CAAC;AAED,MAAa,UAAU;IAGrB,YAAY,SAAqC,mBAAyC;QACxF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,2EAA2E;IAC3E,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAY,CAAC,CAAC;IACxD,CAAC;IAED,wEAAwE;IACxE,gBAAgB,CAAC,MAAc,EAAE,sBAA8B;QAC7D,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACpF,OAAO,EAAE,KAAK;YACd,SAAS,EAAE;gBACT,IAAI,EAAE,UAAU;gBAChB,IAAI;gBACJ,KAAK;gBACL,OAAO,EAAE,sBAAsB;gBAC/B,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU;gBAC7C,OAAO,EACL,GAAG,IAAI,gBAAgB,KAAK,6BAA6B;oBACzD,sBAAsB,sBAAsB,IAAI;oBAChD,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE;aACpD;SACF,CAAC,CAAC,CAAC;IACN,CAAC;IAED,kEAAkE;IAClE,cAAc,CAAC,MAAc,EAAE,KAAa;QAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,KAAK;YACd,SAAS,EAAE;gBACT,IAAI,EAAE,OAAO;gBACb,IAAI;gBACJ,KAAK;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU;gBAC7C,OAAO,EACL,GAAG,IAAI,gBAAgB,KAAK,gCAAgC,KAAK,IAAI;oBACrE,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE;aACpD;SACF,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,WAAW,CACjB,MAAc,EACd,IAAe,EACf,OAAe,EACf,aAAuF;QAEvF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAY,CAAW,CAAC;QACvE,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/C,0EAA0E;QAC1E,4DAA4D;QAC5D,IAAI,OAAO,IAAI,KAAK;YAAE,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF;AAjED,gCAiEC"}

package/dist/cjs/cloud/identity/RateLimiter.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Lemma API v2 — per-tenant rate limiter (Lane D)
+ *
+ * Fixed-window counter keyed by `tenantId + windowBucket`. Exceeding the window
+ * limit yields a 429 with `Retry-After` (backoff until the bucket ends). The
+ * window is derived from `windowMs` and an injectable clock so tests are
+ * deterministic. Fixed window (not sliding) is a deliberate trade: it allows a
+ * brief 2x burst at the boundary in exchange for a cheap, exactly-computable
+ * `Retry-After` (until the next bucket start).
+ */
+import type { Pool } from 'pg';
+export interface RateLimitDecision {
+    allowed: boolean;
+    used: number;
+    limit: number;
+    remaining: number;
+    /** Epoch ms when the current window ends and the counter resets. */
+    resetAt: number;
+}
+export interface RateLimiter {
+    consume(tenantId: string, limit: number, windowMs: number, now?: number): Promise<RateLimitDecision>;
+}
+/** The 429 body for rate_limited (additive to the LemmaApiError envelope). */
+export interface RateLimitErrorBody {
+    error: {
+        code: 'rate_limited';
+        status: 429;
+        message: string;
+        limit: number;
+        used: number;
+        remaining: number;
+        retryAfter: number;
+        resetsAt: number;
+        upgradeUrl: string;
+    };
+}
+export declare function rateLimitErrorBody(decision: RateLimitDecision, retryAfterSeconds: number, upgradeUrl: string): RateLimitErrorBody;
+/** In-process fixed-window limiter. Suitable for single-instance dev and tests. */
+export declare class InMemoryRateLimiter implements RateLimiter {
+    private readonly buckets;
+    consume(tenantId: string, limit: number, windowMs: number, now?: number): Promise<RateLimitDecision>;
+}
+/** Postgres-backed fixed-window limiter, atomic via a single upsert. */
+export declare class PostgresRateLimiter implements RateLimiter {
+    private readonly pool;
+    constructor(pool: Pool);
+    consume(tenantId: string, limit: number, windowMs: number, now?: number): Promise<RateLimitDecision>;
+}
+//# sourceMappingURL=RateLimiter.d.ts.map

package/dist/cjs/cloud/identity/RateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../../../../src/cloud/identity/RateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACtG;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE;QACL,IAAI,EAAE,cAAc,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAgBjI;AAED,mFAAmF;AACnF,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwD;IAE1E,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAyBvH;AAED,wEAAwE;AACxE,qBAAa,mBAAoB,YAAW,WAAW;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAoBvH"}

package/dist/cjs/cloud/identity/RateLimiter.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostgresRateLimiter = exports.InMemoryRateLimiter = void 0;
+exports.rateLimitErrorBody = rateLimitErrorBody;
+function rateLimitErrorBody(decision, retryAfterSeconds, upgradeUrl) {
+    return {
+        error: {
+            code: 'rate_limited',
+            status: 429,
+            message: `rate limit exceeded: ${decision.used}/${decision.limit} requests in the current window. ` +
+                `Back off and retry after ${retryAfterSeconds}s, or upgrade at ${upgradeUrl}.`,
+            limit: decision.limit,
+            used: decision.used,
+            remaining: decision.remaining,
+            retryAfter: retryAfterSeconds,
+            resetsAt: decision.resetAt,
+            upgradeUrl,
+        },
+    };
+}
+/** In-process fixed-window limiter. Suitable for single-instance dev and tests. */
+class InMemoryRateLimiter {
+    constructor() {
+        this.buckets = new Map();
+    }
+    async consume(tenantId, limit, windowMs, now = Date.now()) {
+        const bucket = Math.floor(now / windowMs);
+        const key = `${tenantId}:${bucket}`;
+        // Prune expired windows (on this call path only — no background timers).
+        for (const [k, entry] of this.buckets) {
+            if (entry.bucket < bucket)
+                this.buckets.delete(k);
+        }
+        let entry = this.buckets.get(key);
+        if (!entry) {
+            entry = { bucket, count: 0 };
+            this.buckets.set(key, entry);
+        }
+        entry.count += 1;
+        const resetAt = (bucket + 1) * windowMs;
+        return {
+            allowed: entry.count <= limit,
+            used: entry.count,
+            limit,
+            remaining: Math.max(0, limit - entry.count),
+            resetAt,
+        };
+    }
+}
+exports.InMemoryRateLimiter = InMemoryRateLimiter;
+/** Postgres-backed fixed-window limiter, atomic via a single upsert. */
+class PostgresRateLimiter {
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async consume(tenantId, limit, windowMs, now = Date.now()) {
+        const bucket = Math.floor(now / windowMs);
+        const { rows } = await this.pool.query(`INSERT INTO tenant_rate_limits (tenant_id, bucket, request_count)
+       VALUES ($1, $2, 1)
+       ON CONFLICT (tenant_id, bucket) DO UPDATE
+         SET request_count = tenant_rate_limits.request_count + 1,
+             updated_at = CURRENT_TIMESTAMP
+       RETURNING request_count`, [tenantId, String(bucket)]);
+        const used = Number(rows[0]?.request_count ?? 1);
+        return {
+            allowed: used <= limit,
+            used,
+            limit,
+            remaining: Math.max(0, limit - used),
+            resetAt: (bucket + 1) * windowMs,
+        };
+    }
+}
+exports.PostgresRateLimiter = PostgresRateLimiter;
+//# sourceMappingURL=RateLimiter.js.map

package/dist/cjs/cloud/identity/RateLimiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.js","sourceRoot":"","sources":["../../../../src/cloud/identity/RateLimiter.ts"],"names":[],"mappings":";;;AAwCA,gDAgBC;AAhBD,SAAgB,kBAAkB,CAAC,QAA2B,EAAE,iBAAyB,EAAE,UAAkB;IAC3G,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,GAAG;YACX,OAAO,EACL,wBAAwB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,mCAAmC;gBAC1F,4BAA4B,iBAAiB,oBAAoB,UAAU,GAAG;YAChF,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,QAAQ,CAAC,OAAO;YAC1B,UAAU;SACX;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAa,mBAAmB;IAAhC;QACmB,YAAO,GAAG,IAAI,GAAG,EAA6C,CAAC;IA2BlF,CAAC;IAzBC,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,KAAa,EAAE,QAAgB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QACvF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;QAEpC,yEAAyE;QACzE,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAEjB,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK;YAC7B,IAAI,EAAE,KAAK,CAAC,KAAK;YACjB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC3C,OAAO;SACR,CAAC;IACJ,CAAC;CACF;AA5BD,kDA4BC;AAED,wEAAwE;AACxE,MAAa,mBAAmB;IAC9B,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,KAAa,EAAE,QAAgB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QACvF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC;QAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;;;;+BAKyB,EACzB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAC3B,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,IAAI,IAAI,KAAK;YACtB,IAAI;YACJ,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;YACpC,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,QAAQ;SACjC,CAAC;IACJ,CAAC;CACF;AAvBD,kDAuBC"}

package/dist/cjs/cloud/identity/TenantResolver.d.ts

@@ -0,0 +1,19 @@
+import type { IdentityStore } from './identityStore';
+export interface Tenant {
+    id: string;
+    plan: 'free' | 'pro' | 'scale';
+    keyId: string;
+}
+export declare class TenantResolver {
+    private readonly store;
+    readonly lane = "D";
+    constructor(store: IdentityStore);
+    /**
+     * Resolve a bearer token to a tenant. Returns `null` for malformed, unknown,
+     * revoked or expired keys. The store is queried on EVERY call; revocation is
+     * observed on the next request, never after a cached delay.
+     */
+    resolve(bearerToken: string): Promise<Tenant | null>;
+}
+export default TenantResolver;
+//# sourceMappingURL=TenantResolver.d.ts.map

package/dist/cjs/cloud/identity/TenantResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantResolver.d.ts","sourceRoot":"","sources":["../../../../src/cloud/identity/TenantResolver.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,cAAc;IAGb,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,QAAQ,CAAC,IAAI,OAAO;gBAES,KAAK,EAAE,aAAa;IAEjD;;;;OAIG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAY3D;AAED,eAAe,cAAc,CAAC"}

package/dist/cjs/cloud/identity/TenantResolver.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantResolver = void 0;
+/**
+ * Lemma API v2 — TenantResolver (Lane D)
+ *
+ * Resolves `Authorization: Bearer lk_live_...` → the owning tenant. Keys are
+ * stored as SHA-256 hashes; the plaintext is only ever returned once, at
+ * creation, and never logged. Resolution is deliberately cache-free: every
+ * request hashes the presented token and hits the store, so a revoked key fails
+ * on the very next request — there is no 24h (or any) positive cache.
+ */
+const ApiKey_1 = require("./ApiKey");
+class TenantResolver {
+    constructor(store) {
+        this.store = store;
+        this.lane = 'D';
+    }
+    /**
+     * Resolve a bearer token to a tenant. Returns `null` for malformed, unknown,
+     * revoked or expired keys. The store is queried on EVERY call; revocation is
+     * observed on the next request, never after a cached delay.
+     */
+    async resolve(bearerToken) {
+        if (!(0, ApiKey_1.isWellFormedKey)(bearerToken))
+            return null;
+        const hash = (0, ApiKey_1.hashApiKey)(bearerToken);
+        const record = await this.store.findKeyByHash(hash);
+        if (!record)
+            return null;
+        if (!record.active)
+            return null;
+        if (record.expiresAt !== null && Date.now() > record.expiresAt)
+            return null;
+        return { id: record.tenantId, plan: record.plan, keyId: record.id };
+    }
+}
+exports.TenantResolver = TenantResolver;
+exports.default = TenantResolver;
+//# sourceMappingURL=TenantResolver.js.map

package/dist/cjs/cloud/identity/TenantResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantResolver.js","sourceRoot":"","sources":["../../../../src/cloud/identity/TenantResolver.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACH,qCAAuD;AASvD,MAAa,cAAc;IAGzB,YAA6B,KAAoB;QAApB,UAAK,GAAL,KAAK,CAAe;QAFxC,SAAI,GAAG,GAAG,CAAC;IAEgC,CAAC;IAErD;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,IAAI,CAAC,IAAA,wBAAe,EAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/C,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAEpD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5E,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IACtE,CAAC;CACF;AAtBD,wCAsBC;AAED,kBAAe,cAAc,CAAC"}

package/dist/cjs/cloud/identity/authenticateV2.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Lemma API v2 — authenticateV2 middleware (Lane D)
+ *
+ * Express factory. Usage:
+ *
+ *     import { authenticateV2 } from './cloud/identity';
+ *     app.use(authenticateV2({ resolver, rateLimiter, policy }));
+ *
+ * On success it attaches `req.tenant = { id, plan, keyId }` and calls `next()`.
+ * Missing or invalid keys → 401 `unauthenticated` (identical body for unknown
+ * vs. revoked, so the endpoint never leaks key state). Rate limiting is applied
+ * per tenant before the handler runs; exceeding it → 429 `rate_limited` with a
+ * `Retry-After` header and an actionable body.
+ */
+import type { Request, RequestHandler } from 'express';
+import { PlanPolicy, RATE_LIMIT_WINDOW_MS } from './PlanPolicy';
+import type { RateLimiter } from './RateLimiter';
+import type { Tenant, TenantResolver } from './TenantResolver';
+declare global {
+    namespace Express {
+        interface Request {
+            /** Set by authenticateV2 when a valid API key was presented. */
+            tenant?: Tenant;
+        }
+    }
+}
+export interface AuthenticateV2Deps {
+    resolver: Pick<TenantResolver, 'resolve'>;
+    policy?: PlanPolicy;
+    rateLimiter?: RateLimiter;
+    /** Length of the per-tenant rate-limit window; defaults to 24h (UTC-day buckets). */
+    rateLimitWindowMs?: number;
+    /** Clock override for deterministic tests. */
+    now?: () => number;
+}
+/** Convenience type for handlers that run behind authenticateV2. */
+export type AuthenticatedRequest = Request & {
+    tenant: Tenant;
+};
+/**
+ * Build the auth middleware. `deps.rateLimiter` is optional: when provided, each
+ * request consumes one slot from the tenant's window (limit from the tenant's
+ * plan); when the window is exhausted the middleware answers 429 with Retry-After.
+ */
+export declare function authenticateV2(deps: AuthenticateV2Deps): RequestHandler;
+export { RATE_LIMIT_WINDOW_MS };
+export default authenticateV2;
+//# sourceMappingURL=authenticateV2.d.ts.map

package/dist/cjs/cloud/identity/authenticateV2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticateV2.d.ts","sourceRoot":"","sources":["../../../../src/cloud/identity/authenticateV2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,gEAAgE;YAChE,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB;KACF;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAgBhE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc,CA0CvE;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAChC,eAAe,cAAc,CAAC"}

package/dist/cjs/cloud/identity/authenticateV2.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RATE_LIMIT_WINDOW_MS = void 0;
+exports.authenticateV2 = authenticateV2;
+const errors_1 = require("../../contracts/errors");
+const PlanPolicy_1 = require("./PlanPolicy");
+Object.defineProperty(exports, "RATE_LIMIT_WINDOW_MS", { enumerable: true, get: function () { return PlanPolicy_1.RATE_LIMIT_WINDOW_MS; } });
+const RateLimiter_1 = require("./RateLimiter");
+function parseBearer(header) {
+    if (!header)
+        return null;
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match ? match[1].trim() : null;
+}
+function unauthenticatedError() {
+    return new errors_1.LemmaApiError({
+        code: 'unauthenticated',
+        status: 401,
+        message: 'missing or invalid API key',
+    });
+}
+/**
+ * Build the auth middleware. `deps.rateLimiter` is optional: when provided, each
+ * request consumes one slot from the tenant's window (limit from the tenant's
+ * plan); when the window is exhausted the middleware answers 429 with Retry-After.
+ */
+function authenticateV2(deps) {
+    const policy = deps.policy ?? new PlanPolicy_1.PlanPolicy();
+    const windowMs = deps.rateLimitWindowMs ?? PlanPolicy_1.RATE_LIMIT_WINDOW_MS;
+    const now = deps.now ?? Date.now;
+    return async (req, res, next) => {
+        try {
+            const token = parseBearer(req.headers.authorization);
+            if (!token) {
+                res.status(401).set('WWW-Authenticate', 'Bearer').json(unauthenticatedError().toJSON());
+                return;
+            }
+            const tenant = await deps.resolver.resolve(token);
+            if (!tenant) {
+                res.status(401).set('WWW-Authenticate', 'Bearer').json(unauthenticatedError().toJSON());
+                return;
+            }
+            if (deps.rateLimiter) {
+                const limit = policy.limitsFor(tenant.plan).dailyRequests;
+                const decision = await deps.rateLimiter.consume(tenant.id, limit, windowMs, now());
+                if (!decision.allowed) {
+                    const retryAfter = Math.max(1, Math.ceil((decision.resetAt - now()) / 1000));
+                    const upgradeUrl = policy.limitsFor(tenant.plan).upgradeUrl;
+                    res
+                        .status(429)
+                        .set('Retry-After', String(retryAfter))
+                        .set('WWW-Authenticate', 'Bearer')
+                        .json((0, RateLimiter_1.rateLimitErrorBody)(decision, retryAfter, upgradeUrl));
+                    return;
+                }
+            }
+            req.tenant = tenant;
+            next();
+        }
+        catch (err) {
+            next(err);
+        }
+    };
+}
+exports.default = authenticateV2;
+//# sourceMappingURL=authenticateV2.js.map