@nxuss/lemma 1.16.1 → 1.18.0

package/dist/cjs/cloud/identity/authenticateV2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticateV2.js","sourceRoot":"","sources":["../../../../src/cloud/identity/authenticateV2.ts"],"names":[],"mappings":";;;AA+DA,wCA0CC;AA1FD,mDAAuD;AACvD,6CAAgE;AA2FvD,qGA3FY,iCAAoB,OA2FZ;AAzF7B,+CAAmD;AA0BnD,SAAS,WAAW,CAAC,MAA0B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,IAAI,sBAAa,CAAC;QACvB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,4BAA4B;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,IAAwB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,uBAAU,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,iCAAoB,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAErD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;gBAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;gBAEnF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;oBAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;oBAC5D,GAAG;yBACA,MAAM,CAAC,GAAG,CAAC;yBACX,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;yBACtC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC;yBACjC,IAAI,CAAC,IAAA,gCAAkB,EAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;oBAC9D,OAAO;gBACT,CAAC;YACH,CAAC;YAEA,GAA4B,CAAC,MAAM,GAAG,MAAM,CAAC;YAC9C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAGD,kBAAe,cAAc,CAAC"}

package/dist/cjs/cloud/identity/identityStore.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Lemma API v2 — identity store (Lane D)
+ *
+ * Persistence behind TenantResolver. Keys are stored as SHA-256 hashes only:
+ * `key_hash` is the sole column that ever touches key material, and every write
+ * is a parameterized insert that receives the hash, never the plaintext value.
+ *
+ * `InMemoryIdentityStore` powers unit tests and local/dev defaults.
+ * `PostgresIdentityStore` is the production implementation over `pg`.
+ */
+import type { Pool } from 'pg';
+import type { KeyPrefix } from './ApiKey';
+import type { PlanId } from './PlanPolicy';
+export interface NewKeyInput {
+    tenantId: string;
+    name: string;
+    plan: PlanId;
+    /** The persisted key derivation — sha256 of the plaintext. NEVER the key itself. */
+    hash: string;
+    prefix: KeyPrefix;
+}
+export interface KeyRecord {
+    id: string;
+    tenantId: string;
+    name: string;
+    plan: PlanId;
+    prefix: KeyPrefix;
+    active: boolean;
+    createdAt: number;
+    expiresAt: number | null;
+    revokedAt: number | null;
+}
+export interface IdentityStore {
+    /** Look up a key by its hash. The ONLY read path — plaintext never enters a query. */
+    findKeyByHash(hash: string): Promise<KeyRecord | null>;
+    /** Persist a new key. Callers pass the hash; `key_hash` is the only secret column. */
+    createKey(input: NewKeyInput): Promise<KeyRecord>;
+    /** Soft-revoke: the key dies on the NEXT lookup. No 24h cache can survive this. */
+    revokeKey(keyId: string): Promise<boolean>;
+}
+/** In-memory store. Records carry the hash only — same invariant as Postgres. */
+export declare class InMemoryIdentityStore implements IdentityStore {
+    readonly records: Map<string, KeyRecord>;
+    findKeyByHash(hash: string): Promise<KeyRecord | null>;
+    createKey(input: NewKeyInput): Promise<KeyRecord>;
+    revokeKey(keyId: string): Promise<boolean>;
+}
+/** Production store. All queries parameterized; key material appears only as hashed params. */
+export declare class PostgresIdentityStore implements IdentityStore {
+    private readonly pool;
+    constructor(pool: Pool);
+    findKeyByHash(hash: string): Promise<KeyRecord | null>;
+    createKey(input: NewKeyInput): Promise<KeyRecord>;
+    revokeKey(keyId: string): Promise<boolean>;
+}
+//# sourceMappingURL=identityStore.d.ts.map

package/dist/cjs/cloud/identity/identityStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityStore.d.ts","sourceRoot":"","sources":["../../../../src/cloud/identity/identityStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACvD,sFAAsF;IACtF,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,mFAAmF;IACnF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AAED,iFAAiF;AACjF,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,OAAO,yBAAgC;IAE1C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAItD,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IAgBjD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAWjD;AAED,+FAA+F;AAC/F,qBAAa,qBAAsB,YAAW,aAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAwBtD,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IA6BjD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CASjD"}

package/dist/cjs/cloud/identity/identityStore.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostgresIdentityStore = exports.InMemoryIdentityStore = void 0;
+/** In-memory store. Records carry the hash only — same invariant as Postgres. */
+class InMemoryIdentityStore {
+    constructor() {
+        this.records = new Map();
+    }
+    async findKeyByHash(hash) {
+        return this.records.get(hash) ?? null;
+    }
+    async createKey(input) {
+        const record = {
+            id: 'key_' + Math.random().toString(16).slice(2, 14),
+            tenantId: input.tenantId,
+            name: input.name,
+            plan: input.plan,
+            prefix: input.prefix,
+            active: true,
+            createdAt: Date.now(),
+            expiresAt: null,
+            revokedAt: null,
+        };
+        this.records.set(input.hash, record);
+        return record;
+    }
+    async revokeKey(keyId) {
+        let found = false;
+        for (const record of this.records.values()) {
+            if (record.id === keyId) {
+                record.active = false;
+                record.revokedAt = Date.now();
+                found = true;
+            }
+        }
+        return found;
+    }
+}
+exports.InMemoryIdentityStore = InMemoryIdentityStore;
+/** Production store. All queries parameterized; key material appears only as hashed params. */
+class PostgresIdentityStore {
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async findKeyByHash(hash) {
+        const { rows } = await this.pool.query(`SELECT k.id, k.tenant_id, t.plan, k.name, k.prefix, k.active,
+              k.created_at, k.expires_at, k.revoked_at
+         FROM api_keys k
+         JOIN tenants t ON t.id = k.tenant_id
+        WHERE k.key_hash = $1`, [hash]);
+        if (!rows.length)
+            return null;
+        const r = rows[0];
+        return {
+            id: r.id,
+            tenantId: r.tenant_id,
+            plan: r.plan,
+            name: r.name ?? '',
+            prefix: r.prefix,
+            active: r.active,
+            createdAt: new Date(r.created_at).getTime(),
+            expiresAt: r.expires_at ? new Date(r.expires_at).getTime() : null,
+            revokedAt: r.revoked_at ? new Date(r.revoked_at).getTime() : null,
+        };
+    }
+    async createKey(input) {
+        const { rows } = await this.pool.query(`INSERT INTO api_keys (id, tenant_id, name, key_hash, prefix, plan, active)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       RETURNING id, name, prefix, active, created_at, expires_at, revoked_at`, [
+            'key_' + input.hash.slice(0, 12),
+            input.tenantId,
+            input.name,
+            input.hash,
+            input.prefix,
+            input.plan,
+            true,
+        ]);
+        const r = rows[0];
+        return {
+            id: r.id,
+            tenantId: input.tenantId,
+            name: r.name ?? '',
+            plan: input.plan,
+            prefix: r.prefix,
+            active: r.active,
+            createdAt: new Date(r.created_at).getTime(),
+            expiresAt: r.expires_at ? new Date(r.expires_at).getTime() : null,
+            revokedAt: null,
+        };
+    }
+    async revokeKey(keyId) {
+        const { rowCount } = await this.pool.query(`UPDATE api_keys
+          SET active = FALSE, revoked_at = CURRENT_TIMESTAMP
+        WHERE id = $1 AND active = TRUE`, [keyId]);
+        return (rowCount ?? 0) > 0;
+    }
+}
+exports.PostgresIdentityStore = PostgresIdentityStore;
+//# sourceMappingURL=identityStore.js.map

package/dist/cjs/cloud/identity/identityStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityStore.js","sourceRoot":"","sources":["../../../../src/cloud/identity/identityStore.ts"],"names":[],"mappings":";;;AA4CA,iFAAiF;AACjF,MAAa,qBAAqB;IAAlC;QACW,YAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAiClD,CAAC;IA/BC,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAkB;QAChC,MAAM,MAAM,GAAc;YACxB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;SAChB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;gBACtB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC9B,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAlCD,sDAkCC;AAED,+FAA+F;AAC/F,MAAa,qBAAqB;IAChC,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;;;8BAIwB,EACxB,CAAC,IAAI,CAAC,CACP,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,IAAI,EAAE,CAAC,CAAC,IAAc;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,MAAM,EAAE,CAAC,CAAC,MAAmB;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;YAC3C,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YACjE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;SAClE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAkB;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;8EAEwE,EACxE;YACE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChC,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,IAAI;YACV,IAAI;SACL,CACF,CAAC;QACF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,CAAC,MAAmB;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;YAC3C,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YACjE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACxC;;wCAEkC,EAClC,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;CACF;AAjED,sDAiEC"}

package/dist/cjs/cloud/identity/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Lemma API v2 — identity & tenancy (Lane D)
+ *
+ * Keys hashed at rest, resolution without cache (revocation is immediate),
+ * per-plan ceilings without Infinity, and per-tenant rate limiting with
+ * Retry-After.
+ */
+export * from './ApiKey';
+export * from './identityStore';
+export * from './PlanPolicy';
+export * from './RateLimiter';
+export * from './TenantResolver';
+export * from './authenticateV2';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/cloud/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/cloud/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC"}

package/dist/cjs/cloud/identity/index.js

@@ -0,0 +1,30 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Lemma API v2 — identity & tenancy (Lane D)
+ *
+ * Keys hashed at rest, resolution without cache (revocation is immediate),
+ * per-plan ceilings without Infinity, and per-tenant rate limiting with
+ * Retry-After.
+ */
+__exportStar(require("./ApiKey"), exports);
+__exportStar(require("./identityStore"), exports);
+__exportStar(require("./PlanPolicy"), exports);
+__exportStar(require("./RateLimiter"), exports);
+__exportStar(require("./TenantResolver"), exports);
+__exportStar(require("./authenticateV2"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/cloud/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/cloud/identity/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;GAMG;AACH,2CAAyB;AACzB,kDAAgC;AAChC,+CAA6B;AAC7B,gDAA8B;AAC9B,mDAAiC;AACjC,mDAAiC"}

package/dist/cjs/cloud/metering/TokenCounter.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Lemma API v2 — TokenCounter (Lane E)
+ *
+ * Real token counting of a payload. The count is determined by the actual content
+ * of the payload, never by an average-per-request constant. When a count cannot be
+ * produced reliably the method returns `null` and the caller omits the event from
+ * reports rather than estimating (the `excludedEvents` counter in UsageResponse).
+ *
+ * This is a best-effort, dependency-free tokenizer. It is deterministic and fully
+ * reproducible from the payload, which is what the product's auditability requires.
+ * No library is loaded here — `package.json` is frozen for this lane.
+ */
+export declare class TokenCounter {
+    readonly lane = "E";
+    /**
+     * Measure the token count of a payload.
+     *
+     * Returns:
+     *   - a `number` >= 0 when the payload is measurable (counted from its content).
+     *   - `null` when the payload cannot be reliably measured (missing, not a string,
+     *     or otherwise unmeasurable) — the caller must omit the event, not estimate.
+     */
+    count(payload: string): number | null;
+}
+export default TokenCounter;
+//# sourceMappingURL=TokenCounter.d.ts.map

package/dist/cjs/cloud/metering/TokenCounter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenCounter.d.ts","sourceRoot":"","sources":["../../../../src/cloud/metering/TokenCounter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,qBAAa,YAAY;IACvB,QAAQ,CAAC,IAAI,OAAO;IAEpB;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAkCtC;AAyBD,eAAe,YAAY,CAAC"}

package/dist/cjs/cloud/metering/TokenCounter.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * Lemma API v2 — TokenCounter (Lane E)
+ *
+ * Real token counting of a payload. The count is determined by the actual content
+ * of the payload, never by an average-per-request constant. When a count cannot be
+ * produced reliably the method returns `null` and the caller omits the event from
+ * reports rather than estimating (the `excludedEvents` counter in UsageResponse).
+ *
+ * This is a best-effort, dependency-free tokenizer. It is deterministic and fully
+ * reproducible from the payload, which is what the product's auditability requires.
+ * No library is loaded here — `package.json` is frozen for this lane.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenCounter = void 0;
+class TokenCounter {
+    constructor() {
+        this.lane = 'E';
+    }
+    /**
+     * Measure the token count of a payload.
+     *
+     * Returns:
+     *   - a `number` >= 0 when the payload is measurable (counted from its content).
+     *   - `null` when the payload cannot be reliably measured (missing, not a string,
+     *     or otherwise unmeasurable) — the caller must omit the event, not estimate.
+     */
+    count(payload) {
+        if (typeof payload !== 'string')
+            return null;
+        const trimmed = payload.trim();
+        if (trimmed.length === 0)
+            return 0;
+        let tokens = 0;
+        let i = 0;
+        const n = trimmed.length;
+        // Latin/CJK-aware scanning: a run of word characters is one token, a CJK
+        // character counts as a single token (the dominant case for dense scripts).
+        while (i < n) {
+            const code = trimmed.charCodeAt(i);
+            if (isCjk(code)) {
+                tokens += 1;
+                i += 1;
+                continue;
+            }
+            if (isWordChar(code)) {
+                while (i < n && isWordChar(trimmed.charCodeAt(i)))
+                    i += 1;
+                tokens += 1;
+                continue;
+            }
+            // Punctuation/symbol run collapses into a single token.
+            while (i < n && isPunct(trimmed.charCodeAt(i)))
+                i += 1;
+            tokens += 1;
+        }
+        return tokens;
+    }
+}
+exports.TokenCounter = TokenCounter;
+function isWordChar(code) {
+    return ((code >= 0x41 && code <= 0x5a) || // A-Z
+        (code >= 0x61 && code <= 0x7a) || // a-z
+        (code >= 0x30 && code <= 0x39) || // 0-9
+        code === 0x5f || // _
+        code >= 0x80 // non-ASCII word characters (accents, etc.)
+    );
+}
+function isCjk(code) {
+    return ((code >= 0x4e00 && code <= 0x9fff) || // CJK Unified Ideographs
+        (code >= 0x3040 && code <= 0x30ff) || // Hiragana + Katakana
+        (code >= 0xac00 && code <= 0xd7af) || // Hangul syllables
+        (code >= 0x3400 && code <= 0x4dbf) // CJK Extension A
+    );
+}
+function isPunct(code) {
+    return !isWordChar(code);
+}
+exports.default = TokenCounter;
+//# sourceMappingURL=TokenCounter.js.map

package/dist/cjs/cloud/metering/TokenCounter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenCounter.js","sourceRoot":"","sources":["../../../../src/cloud/metering/TokenCounter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAEH,MAAa,YAAY;IAAzB;QACW,SAAI,GAAG,GAAG,CAAC;IA4CtB,CAAC;IA1CC;;;;;;;OAOG;IACH,KAAK,CAAC,OAAe;QACnB,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEnC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QAEzB,yEAAyE;QACzE,4EAA4E;QAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAEnC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,IAAI,CAAC,CAAC;gBACZ,SAAS;YACX,CAAC;YAED,wDAAwD;YACxD,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AA7CD,oCA6CC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,CACL,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;QACxC,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;QACxC,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM;QACxC,IAAI,KAAK,IAAI,IAAI,IAAI;QACrB,IAAI,IAAI,IAAI,CAAC,4CAA4C;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,CACL,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,yBAAyB;QAC/D,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,sBAAsB;QAC5D,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,mBAAmB;QACzD,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,kBAAkB;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,kBAAe,YAAY,CAAC"}

package/dist/cjs/cloud/metering/UsageLedger.d.ts

@@ -0,0 +1,68 @@
+import type { UsageResponse } from '../../contracts/api-v2.types';
+/** Append-only backing store. Implementations must expose reads over the rows and
+ *  have no mutating surface beyond `append` (no update/delete). */
+export interface AppendOnlyStore {
+    append(row: LedgerEvent): Promise<void> | void;
+    rows(): LedgerEvent[] | Promise<LedgerEvent[]>;
+}
+/** In-memory append-only store (the default backing). Only ever grows. */
+export declare class InMemoryLedgerStore implements AppendOnlyStore {
+    private readonly ledger;
+    append(row: LedgerEvent): void;
+    rows(): LedgerEvent[];
+    /** Test seam: reset the ledger. Never used by production paths. */
+    clear(): void;
+}
+export interface LedgerEvent {
+    id: string;
+    tenantId: string;
+    kind: string;
+    /** Measured token count, or `null` when no reliable count could be produced. */
+    tokens: number | null;
+    /** Milliseconds since epoch. */
+    at: number;
+}
+export interface AppendEvent {
+    tenantId: string;
+    kind: string;
+    /** Measured tokens, or `null` when the count was unreliable. */
+    tokens: number | null;
+    id?: string;
+    at?: number;
+}
+export interface UsageQuery {
+    /** Restrict the computation to one tenant (and the global total) — optional. */
+    tenantId?: string;
+    /** Only include rows appended at or after this timestamp (ms epoch). */
+    since?: number;
+}
+export interface UsageLedgerOptions {
+    backend?: AppendOnlyStore;
+    now?: () => number;
+    /** Test seam: deterministic id generator. Defaults to a random hex ulid-ish id. */
+    getId?: () => string;
+}
+export declare class UsageLedger {
+    readonly lane = "E";
+    private readonly backend;
+    private readonly now;
+    private readonly getId;
+    constructor(backing?: unknown, options?: UsageLedgerOptions);
+    /**
+     * Append one billable event to the ledger. Append-only by construction: the row
+     * is pushed and never mutated or removed.
+     */
+    append(event: AppendEvent): Promise<LedgerEvent>;
+    /**
+     * Compute the auditable usage report for GET /v2/usage.
+     *
+     * Every metric is derived by summing measured ledger rows and carries
+     * `measurement: "counted"`. A metric with nothing to measure is omitted from the
+     * response — it is never filled with an estimate. Rows whose token count was
+     * unreliable (`tokens: null`) are excluded from every sum and reported in
+     * `excludedEvents`.
+     */
+    computeUsage(query?: UsageQuery): Promise<UsageResponse>;
+}
+export default UsageLedger;
+//# sourceMappingURL=UsageLedger.d.ts.map

package/dist/cjs/cloud/metering/UsageLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UsageLedger.d.ts","sourceRoot":"","sources":["../../../../src/cloud/metering/UsageLedger.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE;mEACmE;AACnE,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/C,IAAI,IAAI,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAChD;AAED,0EAA0E;AAC1E,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAE5C,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI;IAI9B,IAAI,IAAI,WAAW,EAAE;IAIrB,mEAAmE;IACnE,KAAK,IAAI,IAAI;CAGd;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAID,qBAAa,WAAW;IACtB,QAAQ,CAAC,IAAI,OAAO;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAEzB,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,kBAAkB;IAS3D;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYtD;;;;;;;;OAQG;IACG,YAAY,CAAC,KAAK,GAAE,UAAe,GAAG,OAAO,CAAC,aAAa,CAAC;CAkCnE;AAED,eAAe,WAAW,CAAC"}

package/dist/cjs/cloud/metering/UsageLedger.js

@@ -0,0 +1,106 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsageLedger = exports.InMemoryLedgerStore = void 0;
+/**
+ * Lemma API v2 — UsageLedger (Lane E)
+ *
+ * Append-only ledger: exactly one row per billable event, holding the MEASURED
+ * token count of the real payload. There is no UPDATE and no DELETE over the
+ * ledger — rows are only ever appended. Every number exposed by /v2/usage is
+ * reproduced by summing these rows, so the reported usage is auditable end to end.
+ *
+ * An event whose token count could not be reliably measured is still recorded
+ * (with `tokens: null`) but is excluded from every metric sum and instead counted
+ * in `excludedEvents` on the response. A measurement is never estimated.
+ *
+ * Ownership: Lane E.
+ */
+const crypto_1 = __importDefault(require("crypto"));
+/** In-memory append-only store (the default backing). Only ever grows. */
+class InMemoryLedgerStore {
+    constructor() {
+        this.ledger = [];
+    }
+    append(row) {
+        this.ledger.push(row);
+    }
+    rows() {
+        return this.ledger;
+    }
+    /** Test seam: reset the ledger. Never used by production paths. */
+    clear() {
+        this.ledger.length = 0;
+    }
+}
+exports.InMemoryLedgerStore = InMemoryLedgerStore;
+const defaultId = () => crypto_1.default.randomBytes(16).toString('hex');
+class UsageLedger {
+    constructor(backing, options) {
+        this.lane = 'E';
+        const opts = backing && typeof backing === 'object' && 'rows' in backing
+            ? backing
+            : options ?? {};
+        this.backend = opts.backend ?? new InMemoryLedgerStore();
+        this.now = opts.now ?? Date.now;
+        this.getId = opts.getId ?? defaultId;
+    }
+    /**
+     * Append one billable event to the ledger. Append-only by construction: the row
+     * is pushed and never mutated or removed.
+     */
+    async append(event) {
+        const row = {
+            id: event.id ?? this.getId(),
+            tenantId: event.tenantId,
+            kind: event.kind,
+            tokens: typeof event.tokens === 'number' ? event.tokens : null,
+            at: event.at ?? this.now(),
+        };
+        await this.backend.append(row);
+        return row;
+    }
+    /**
+     * Compute the auditable usage report for GET /v2/usage.
+     *
+     * Every metric is derived by summing measured ledger rows and carries
+     * `measurement: "counted"`. A metric with nothing to measure is omitted from the
+     * response — it is never filled with an estimate. Rows whose token count was
+     * unreliable (`tokens: null`) are excluded from every sum and reported in
+     * `excludedEvents`.
+     */
+    async computeUsage(query = {}) {
+        const rows = await this.backend.rows();
+        const byKind = new Map();
+        let totalTokens = 0;
+        let excludedEvents = 0;
+        for (const row of rows) {
+            if (query.tenantId !== undefined && row.tenantId !== query.tenantId)
+                continue;
+            if (query.since !== undefined && row.at < query.since)
+                continue;
+            if (row.tokens === null) {
+                excludedEvents += 1;
+                continue;
+            }
+            totalTokens += row.tokens;
+            byKind.set(row.kind, (byKind.get(row.kind) ?? 0) + row.tokens);
+        }
+        const metrics = {};
+        // Total measured tokens across all billable events in scope.
+        metrics.tokensSaved = { measurement: 'counted', value: totalTokens };
+        // Per-kind measured token totals — each equally reproducible by summing rows.
+        for (const [kind, value] of byKind) {
+            metrics[`tokensSaved.${kind}`] = { measurement: 'counted', value };
+        }
+        return {
+            metrics,
+            excludedEvents,
+        };
+    }
+}
+exports.UsageLedger = UsageLedger;
+exports.default = UsageLedger;
+//# sourceMappingURL=UsageLedger.js.map

package/dist/cjs/cloud/metering/UsageLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UsageLedger.js","sourceRoot":"","sources":["../../../../src/cloud/metering/UsageLedger.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;;;;;GAaG;AACH,oDAA4B;AAU5B,0EAA0E;AAC1E,MAAa,mBAAmB;IAAhC;QACmB,WAAM,GAAkB,EAAE,CAAC;IAc9C,CAAC;IAZC,MAAM,CAAC,GAAgB;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,mEAAmE;IACnE,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;CACF;AAfD,kDAeC;AAmCD,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEvE,MAAa,WAAW;IAOtB,YAAY,OAAiB,EAAE,OAA4B;QANlD,SAAI,GAAG,GAAG,CAAC;QAOlB,MAAM,IAAI,GAAuB,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAK,OAA2B;YAC/G,CAAC,CAAE,OAA8B;YACjC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,MAAM,GAAG,GAAgB;YACvB,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC9D,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;SAC3B,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,QAAoB,EAAE;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAEvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,cAAc,GAAG,CAAC,CAAC;QAEvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBAAE,SAAS;YAC9E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK;gBAAE,SAAS;YAEhE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACxB,cAAc,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,WAAW,IAAI,GAAG,CAAC,MAAM,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,OAAO,GAA6B,EAAE,CAAC;QAE7C,6DAA6D;QAC7D,OAAO,CAAC,WAAW,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAErE,8EAA8E;QAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YACnC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACrE,CAAC;QAED,OAAO;YACL,OAAO;YACP,cAAc;SACf,CAAC;IACJ,CAAC;CACF;AA3ED,kCA2EC;AAED,kBAAe,WAAW,CAAC"}

package/dist/cjs/cloud/metering/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Lemma API v2 — real metering (Lane E)
+ *
+ * UsageLedger: the append-only, measured-only ledger powering /v2/usage.
+ * TokenCounter: real token counting of a payload; returns null (omit the event)
+ * when a count cannot be reliably measured. No estimates, ever.
+ *
+ * Ownership: Lane E.
+ */
+export * from './UsageLedger';
+export * from './TokenCounter';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/cloud/metering/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/cloud/metering/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}

package/dist/cjs/cloud/metering/index.js

@@ -0,0 +1,28 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Lemma API v2 — real metering (Lane E)
+ *
+ * UsageLedger: the append-only, measured-only ledger powering /v2/usage.
+ * TokenCounter: real token counting of a payload; returns null (omit the event)
+ * when a count cannot be reliably measured. No estimates, ever.
+ *
+ * Ownership: Lane E.
+ */
+__exportStar(require("./UsageLedger"), exports);
+__exportStar(require("./TokenCounter"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/cloud/metering/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/cloud/metering/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;GAQG;AACH,gDAA8B;AAC9B,iDAA+B"}

package/dist/cjs/cloud/scrub/StatelessScrubber.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Lemma API v2 — StatelessScrubber (Lane F)
+ *
+ * Stateless privacy firewall over raw text and serialized agent tool-call JSON.
+ *
+ * Contract (src/contracts/api-v2.types.ts):
+ *   scrubText(text, mode)                    -> { text, findings }   text input
+ *   scrubToolCallJson(raw, mode)             -> { toolCallJson, findings }
+ *
+ * Invariants:
+ *   - DETECTED VALUES ARE NEVER RETURNED. The response carries only the masked
+ *     text and an inventory of `{ type, offset, length }` findings. Nothing the
+ *     caller passed in is echoed back except by design.
+ *   - STATELESS: the constructor does NO I/O (unlike SemanticScrubber, whose
+ *     constructor reads lemma.config.json from cwd). Fresh RegExps are compiled
+ *     per call so `lastIndex` never leaks across concurrent requests. Nothing is
+ *     persisted.
+ *   - No `console.*` logging of the payload.
+ *
+ * This is the lane's adapted "wrap" of SemanticScrubber (which we cannot reuse
+ * verbatim: it exposes no per-finding offsets, has no DSN coverage, and loads
+ * config from cwd at construct time). See lane-notes/F.md ## decisions.
+ *
+ * Ownership: Lane F.
+ */
+import type { ScrubFinding } from "../../contracts/api-v2.types";
+export type ScrubMode = "mask" | "detect";
+export declare class StatelessScrubber {
+    readonly lane = "F";
+    /** Scrub a raw text string. Offsets in findings are relative to `text`. */
+    scrubText(text: string, mode?: ScrubMode): {
+        text: string;
+        findings: ScrubFinding[];
+    };
+    /**
+     * Scrub a serialized agent tool-call JSON string. The JSON structure is
+     * preserved (always valid JSON on output). Each string leaf's text content is
+     * scrubbed in-place; findings offsets are relative to the ORIGINAL `raw`
+     * string the client sent. In detect mode the original string is returned
+     * byte-for-byte untouched (findings only).
+     */
+    scrubToolCallJson(raw: string, mode?: ScrubMode): {
+        toolCallJson: string;
+        findings: ScrubFinding[];
+    };
+    /** Backwards-compatible alias: scrubText. */
+    scrub(text: string, mode?: ScrubMode): {
+        text: string;
+        findings: ScrubFinding[];
+    };
+}
+export default StatelessScrubber;
+//# sourceMappingURL=StatelessScrubber.d.ts.map

package/dist/cjs/cloud/scrub/StatelessScrubber.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StatelessScrubber.d.ts","sourceRoot":"","sources":["../../../../src/cloud/scrub/StatelessScrubber.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAwJ1C,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,IAAI,OAAO;IAEpB,2EAA2E;IAC3E,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,SAAkB,GACvB;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE;IAc7C;;;;;;OAMG;IACH,iBAAiB,CACf,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,SAAkB,GACvB;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE;IAqCrD,6CAA6C;IAC7C,KAAK,CACH,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,SAAkB,GACvB;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE;CAG9C;AAED,eAAe,iBAAiB,CAAC"}