@nxuss/lemma 1.43.0 → 1.44.0

package/dist/cjs/cloud/billing/stripeWebhook.d.ts

@@ -0,0 +1,35 @@
+import { type Router } from 'express';
+import type { IdentityStore } from '../identity/identityStore';
+import type { PlanId } from '../identity/PlanPolicy';
+export interface StripeBillingConfig {
+    /** `whsec_...` of the webhook endpoint. */
+    webhookSecret: string;
+    /** Stripe price id -> the Cloud plan it buys. Prices not listed here are not ours. */
+    prices: Readonly<Record<string, PlanId>>;
+    /** Max age of a signed payload; Stripe's own libraries default to 5 minutes. */
+    toleranceSeconds?: number;
+}
+/** Verify `Stripe-Signature` (`t=<unix>,v1=<hex>[,v1=<hex>]`) over `${t}.${rawBody}`. */
+export declare function verifyStripeSignature(rawBody: Buffer, header: string | undefined, secret: string, toleranceSeconds?: number, nowMs?: number): boolean;
+interface StripeEvent {
+    id?: string;
+    type?: string;
+    created?: number;
+    data?: {
+        object?: Record<string, any>;
+    };
+}
+/** `unresolved`: the event is for one of OUR prices but no tenant is linked yet; Stripe must retry it. */
+export type BillingOutcome = 'applied' | 'ignored' | 'stale' | 'unresolved';
+/** Apply one event. Pure of HTTP, so tests drive it without a signature. */
+export declare function applyStripeEvent(event: StripeEvent, store: IdentityStore, config: Pick<StripeBillingConfig, 'prices'>): Promise<BillingOutcome>;
+/** POST /v2/billing/stripe/webhook. Mount BEFORE express.json(): the signature needs the raw bytes. */
+export declare function stripeWebhookRouter(store: IdentityStore, config: StripeBillingConfig): Router;
+/**
+ * Reads the Stripe settings from the environment; null when billing is not configured (the route is then not mounted).
+ * A plan can be sold through several Stripe prices (monthly, yearly), so each variable takes a comma-separated list:
+ * STRIPE_PRICES_VINEL=price_a,price_b
+ */
+export declare function stripeConfigFromEnv(env?: NodeJS.ProcessEnv): StripeBillingConfig | null;
+export {};
+//# sourceMappingURL=stripeWebhook.d.ts.map

package/dist/cjs/cloud/billing/stripeWebhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripeWebhook.d.ts","sourceRoot":"","sources":["../../../../src/cloud/billing/stripeWebhook.ts"],"names":[],"mappings":"AAiBA,OAAgB,EAAE,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAA+B,MAAM,2BAA2B,CAAC;AAC5F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,MAAM,WAAW,mBAAmB;IAClC,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzC,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAKD,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,SAAsB,EAAE,KAAK,SAAa,GAAG,OAAO,CAmBtK;AAED,UAAU,WAAW;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,CAAC;CACzC;AAED,0GAA0G;AAC1G,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;AAgB5E,4EAA4E;AAC5E,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAuDrJ;AAED,uGAAuG;AACvG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,GAAG,MAAM,CA4B7F;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,mBAAmB,GAAG,IAAI,CAUpG"}

package/dist/cjs/cloud/billing/stripeWebhook.js

@@ -0,0 +1,185 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyStripeSignature = verifyStripeSignature;
+exports.applyStripeEvent = applyStripeEvent;
+exports.stripeWebhookRouter = stripeWebhookRouter;
+exports.stripeConfigFromEnv = stripeConfigFromEnv;
+/**
+ * Lemma Cloud — Stripe webhook.
+ *
+ * Stripe owns the money; this turns its subscription events into the tenant's `plan` and the billing
+ * state the console shows. Authenticated by the Stripe signature alone (no API key), so it is
+ * mounted before the /v2 auth and the JSON parser: the signature covers the RAW body.
+ *
+ * Shape of the rules, each one a trap if wrong:
+ *  - The same Stripe account also sells the local Pro license, and every event of the account reaches
+ *    this endpoint. A subscription whose price is not one of ours, or whose tenant cannot be found,
+ *    is acknowledged (200) and ignored: a 4xx/5xx would make Stripe retry it for days.
+ *  - Delivery is unordered, so an event older than the last applied one is dropped (`billing.eventAt`).
+ *  - A late payment (`past_due`) keeps the plan: the tenant is downgraded when Stripe gives up on the
+ *    invoice and cancels the subscription (the retry window is set in the Stripe dashboard), not by
+ *    a timer here. `unpaid`, `canceled` and `incomplete_expired` drop the tenant to `free`.
+ */
+const crypto_1 = __importDefault(require("crypto"));
+const express_1 = __importDefault(require("express"));
+const DEFAULT_TOLERANCE_S = 300;
+const MAX_BODY_BYTES = 256 * 1024;
+/** Verify `Stripe-Signature` (`t=<unix>,v1=<hex>[,v1=<hex>]`) over `${t}.${rawBody}`. */
+function verifyStripeSignature(rawBody, header, secret, toleranceSeconds = DEFAULT_TOLERANCE_S, nowMs = Date.now()) {
+    if (!header)
+        return false;
+    let t = '';
+    const sigs = [];
+    for (const part of header.split(',')) {
+        const i = part.indexOf('=');
+        if (i < 0)
+            continue;
+        const k = part.slice(0, i).trim();
+        const v = part.slice(i + 1).trim();
+        if (k === 't')
+            t = v;
+        else if (k === 'v1')
+            sigs.push(v);
+    }
+    if (!/^\d{1,12}$/.test(t) || sigs.length === 0)
+        return false;
+    if (Math.abs(nowMs / 1000 - Number(t)) > toleranceSeconds)
+        return false;
+    const expected = crypto_1.default.createHmac('sha256', secret).update(`${t}.`).update(rawBody).digest();
+    return sigs.some((s) => {
+        if (!/^[0-9a-f]{64}$/i.test(s))
+            return false;
+        return crypto_1.default.timingSafeEqual(expected, Buffer.from(s, 'hex'));
+    });
+}
+const asId = (v) => {
+    if (typeof v === 'string' && v)
+        return v;
+    if (v && typeof v === 'object' && typeof v.id === 'string')
+        return v.id;
+    return null;
+};
+/** Stripe moved `current_period_end` from the subscription to its items in newer API versions; accept both. */
+const periodEndMs = (sub) => {
+    const s = sub.current_period_end ?? sub.items?.data?.[0]?.current_period_end;
+    return typeof s === 'number' ? s * 1000 : null;
+};
+const DROPS_TO_FREE = new Set(['unpaid', 'canceled', 'incomplete_expired']);
+/** Apply one event. Pure of HTTP, so tests drive it without a signature. */
+async function applyStripeEvent(event, store, config) {
+    const obj = event.data?.object;
+    if (!obj || typeof event.created !== 'number')
+        return 'ignored';
+    const eventAt = event.created * 1000;
+    let tenant = null;
+    let next = null;
+    if (event.type === 'checkout.session.completed') {
+        // Links the Stripe customer to our tenant (client_reference_id is the tenant id the checkout was created for).
+        const tenantId = typeof obj.client_reference_id === 'string' ? obj.client_reference_id : null;
+        const customerId = asId(obj.customer);
+        if (!tenantId || !customerId || obj.mode !== 'subscription')
+            return 'ignored';
+        tenant = await store.getTenant(tenantId);
+        if (!tenant || tenant.plan === 'internal')
+            return 'ignored';
+        // One Stripe customer belongs to one tenant. A checkout naming a customer that is already
+        // linked elsewhere is refused, not re-pointed (the unique index would turn it into a 500).
+        const owner = await store.findTenantByStripeCustomer(customerId);
+        if (owner && owner.id !== tenant.id)
+            return 'ignored';
+        next = { plan: tenant.plan, billing: { ...tenant.billing, customerId, subscriptionId: asId(obj.subscription) ?? tenant.billing.subscriptionId, eventAt } };
+    }
+    else if (event.type === 'customer.subscription.created' || event.type === 'customer.subscription.updated' || event.type === 'customer.subscription.deleted') {
+        const priceId = asId(obj.items?.data?.[0]?.price);
+        const bought = priceId ? config.prices[priceId] : undefined;
+        if (!bought)
+            return 'ignored'; // not a Cloud price: the local Pro license, or something else of the account
+        const customerId = asId(obj.customer);
+        const metaTenant = typeof obj.metadata?.tenantId === 'string' ? obj.metadata.tenantId : null;
+        tenant = metaTenant ? await store.getTenant(metaTenant) : customerId ? await store.findTenantByStripeCustomer(customerId) : null;
+        // A price of ours with no tenant yet usually means this event overtook `checkout.session.completed`
+        // (Stripe does not order them): answering 200 would lose the plan for good, so ask for a retry.
+        if (!tenant)
+            return 'unresolved';
+        if (tenant.plan === 'internal')
+            return 'ignored'; // not sold through Stripe: nothing it says may change it
+        const status = typeof obj.status === 'string' ? obj.status : null;
+        const gone = event.type === 'customer.subscription.deleted' || (status !== null && DROPS_TO_FREE.has(status));
+        // `incomplete` (first payment pending) changes nothing yet; the next event carries the outcome.
+        if (!gone && status === 'incomplete')
+            return 'ignored';
+        next = {
+            plan: gone ? 'free' : bought,
+            billing: {
+                customerId: customerId ?? tenant.billing.customerId,
+                subscriptionId: asId(obj.id) ?? tenant.billing.subscriptionId,
+                status: event.type === 'customer.subscription.deleted' ? 'canceled' : status,
+                currentPeriodEnd: periodEndMs(obj) ?? tenant.billing.currentPeriodEnd,
+                pastDueSince: status === 'past_due' ? tenant.billing.pastDueSince ?? eventAt : null,
+                eventAt,
+            },
+        };
+    }
+    else {
+        return 'ignored';
+    }
+    const result = await store.applyBilling(tenant.id, next.plan, next.billing);
+    if (result.ok)
+        return 'applied';
+    return result.reason === 'stale' ? 'stale' : 'ignored';
+}
+/** POST /v2/billing/stripe/webhook. Mount BEFORE express.json(): the signature needs the raw bytes. */
+function stripeWebhookRouter(store, config) {
+    const r = express_1.default.Router();
+    r.post('/', express_1.default.raw({ type: '*/*', limit: MAX_BODY_BYTES }), async (req, res, next) => {
+        try {
+            const raw = req.body;
+            if (!Buffer.isBuffer(raw) || !verifyStripeSignature(raw, req.header('stripe-signature'), config.webhookSecret, config.toleranceSeconds)) {
+                res.status(400).json({ error: { code: 'invalid_signature', status: 400, message: 'bad or missing Stripe signature' } });
+                return;
+            }
+            let event;
+            try {
+                event = JSON.parse(raw.toString('utf8'));
+            }
+            catch {
+                res.status(400).json({ error: { code: 'invalid_request', status: 400, message: 'body is not JSON' } });
+                return;
+            }
+            const outcome = await applyStripeEvent(event, store, config);
+            if (outcome === 'unresolved') {
+                // 409, not 2xx: Stripe retries with backoff for days, by which time the checkout event has linked the tenant.
+                res.status(409).json({ error: { code: 'tenant_not_linked', status: 409, message: 'no tenant linked to this customer yet, retry later' }, outcome });
+                return;
+            }
+            res.json({ received: true, outcome });
+        }
+        catch (err) {
+            next(err); // a store failure is a 500: Stripe retries, which is what we want
+        }
+    });
+    return r;
+}
+/**
+ * Reads the Stripe settings from the environment; null when billing is not configured (the route is then not mounted).
+ * A plan can be sold through several Stripe prices (monthly, yearly), so each variable takes a comma-separated list:
+ * STRIPE_PRICES_VINEL=price_a,price_b
+ */
+function stripeConfigFromEnv(env = process.env) {
+    const webhookSecret = env.STRIPE_WEBHOOK_SECRET;
+    if (!webhookSecret)
+        return null;
+    const prices = {};
+    const add = (list, plan) => {
+        for (const id of (list ?? '').split(','))
+            if (id.trim())
+                prices[id.trim()] = plan;
+    };
+    add(env.STRIPE_PRICES_VINEL, 'vinel');
+    add(env.STRIPE_PRICES_REGNUM, 'regnum');
+    return { webhookSecret, prices };
+}
+//# sourceMappingURL=stripeWebhook.js.map

package/dist/cjs/cloud/billing/stripeWebhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripeWebhook.js","sourceRoot":"","sources":["../../../../src/cloud/billing/stripeWebhook.ts"],"names":[],"mappings":";;;;;AAkCA,sDAmBC;AA2BD,4CAuDC;AAGD,kDA4BC;AAOD,kDAUC;AAvLD;;;;;;;;;;;;;;;GAeG;AACH,oDAA4B;AAC5B,sDAA+C;AAa/C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAElC,yFAAyF;AACzF,SAAgB,qBAAqB,CAAC,OAAe,EAAE,MAA0B,EAAE,MAAc,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3J,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG;YAAE,CAAC,GAAG,CAAC,CAAC;aAChB,IAAI,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACxE,MAAM,QAAQ,GAAG,gBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,OAAO,gBAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAYD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAiB,EAAE;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAsB,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAQ,CAAoB,CAAC,EAAE,CAAC;IAClH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,+GAA+G;AAC/G,MAAM,WAAW,GAAG,CAAC,GAAwB,EAAiB,EAAE;IAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC;IAC7E,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAE5E,4EAA4E;AACrE,KAAK,UAAU,gBAAgB,CAAC,KAAkB,EAAE,KAAoB,EAAE,MAA2C;IAC1H,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;IAErC,IAAI,MAAM,GAAwB,IAAI,CAAC;IACvC,IAAI,IAAI,GAAoD,IAAI,CAAC;IAEjE,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAChD,+GAA+G;QAC/G,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,SAAS,CAAC;QAC9E,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC;QAC5D,0FAA0F;QAC1F,2FAA2F;QAC3F,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QACtD,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC;IAC7J,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,EAAE,CAAC;QAC9J,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,CAAC,6EAA6E;QAC5G,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjI,oGAAoG;QACpG,gGAAgG;QAChG,IAAI,CAAC,MAAM;YAAE,OAAO,YAAY,CAAC;QACjC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC,CAAC,yDAAyD;QAE3G,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,+BAA+B,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9G,gGAAgG;QAChG,IAAI,CAAC,IAAI,IAAI,MAAM,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QAEvD,IAAI,GAAG;YACL,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC5B,OAAO,EAAE;gBACP,UAAU,EAAE,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU;gBACnD,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc;gBAC7D,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,+BAA+B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;gBAC5E,gBAAgB,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB;gBACrE,YAAY,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI;gBACnF,OAAO;aACR;SACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,uGAAuG;AACvG,SAAgB,mBAAmB,CAAC,KAAoB,EAAE,MAA2B;IACnF,MAAM,CAAC,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACxI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,CAAC,CAAC;gBACxH,OAAO;YACT,CAAC;YACD,IAAI,KAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;gBACvG,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,8GAA8G;gBAC9G,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oDAAoD,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBACpJ,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,kEAAkE;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,aAAa,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAChD,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,IAAwB,EAAE,IAAY,EAAQ,EAAE;QAC3D,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,IAAI,EAAE,CAAC,IAAI,EAAE;gBAAE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACpF,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IACxC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC"}

package/dist/cjs/cloud/console/ConsoleStore.d.ts

@@ -0,0 +1,111 @@
+import type { Pool } from 'pg';
+import type { IdentityStore } from '../identity/identityStore';
+export declare const MEMBER_ROLES: readonly ["owner", "admin", "member"];
+export type MemberRole = (typeof MEMBER_ROLES)[number];
+export interface Member {
+    id: string;
+    tenantId: string;
+    email: string;
+    role: MemberRole;
+    createdAt: number;
+}
+export type AddMemberResult = {
+    ok: true;
+    member: Member;
+} | {
+    ok: false;
+    reason: 'no_tenant' | 'exists' | 'other_tenant';
+};
+export interface SessionInfo {
+    tenantId: string;
+    email: string;
+    role: MemberRole;
+}
+export interface ConsoleStore {
+    addMember(tenantId: string, email: string, role: MemberRole): Promise<AddMemberResult>;
+    listMembers(tenantId: string): Promise<Member[]>;
+    /** Soft-removes the member and ends their sessions. */
+    removeMember(tenantId: string, email: string): Promise<boolean>;
+    /** The active member with this email, in any tenant. */
+    findMemberByEmail(email: string): Promise<Member | null>;
+    createLoginToken(input: {
+        tokenHash: string;
+        tenantId: string;
+        email: string;
+        expiresAt: number;
+    }): Promise<void>;
+    /** Atomic and single use: the first caller gets the member, everyone after (or after expiry) gets null. */
+    consumeLoginToken(tokenHash: string, now: number): Promise<{
+        tenantId: string;
+        email: string;
+    } | null>;
+    createSession(input: {
+        tokenHash: string;
+        tenantId: string;
+        email: string;
+        expiresAt: number;
+    }): Promise<void>;
+    /** The session if it is live AND its member is still active; the role is the member's current one. */
+    findSession(tokenHash: string, now: number): Promise<SessionInfo | null>;
+    deleteSession(tokenHash: string): Promise<void>;
+}
+export declare const normalizeEmail: (email: string) => string;
+export declare const hashToken: (token: string) => string;
+/** 256 bits, URL-safe. Only its hash is ever stored. */
+export declare const newToken: () => string;
+export declare class InMemoryConsoleStore implements ConsoleStore {
+    private readonly identity;
+    private readonly members;
+    private readonly loginTokens;
+    private readonly sessions;
+    constructor(identity: Pick<IdentityStore, 'getTenant'>);
+    addMember(tenantId: string, rawEmail: string, role: MemberRole): Promise<AddMemberResult>;
+    listMembers(tenantId: string): Promise<Member[]>;
+    removeMember(tenantId: string, rawEmail: string): Promise<boolean>;
+    findMemberByEmail(rawEmail: string): Promise<Member | null>;
+    createLoginToken(i: {
+        tokenHash: string;
+        tenantId: string;
+        email: string;
+        expiresAt: number;
+    }): Promise<void>;
+    consumeLoginToken(tokenHash: string, now: number): Promise<{
+        tenantId: string;
+        email: string;
+    } | null>;
+    createSession(i: {
+        tokenHash: string;
+        tenantId: string;
+        email: string;
+        expiresAt: number;
+    }): Promise<void>;
+    findSession(tokenHash: string, now: number): Promise<SessionInfo | null>;
+    deleteSession(tokenHash: string): Promise<void>;
+}
+export declare class PostgresConsoleStore implements ConsoleStore {
+    private readonly pool;
+    constructor(pool: Pool);
+    addMember(tenantId: string, rawEmail: string, role: MemberRole): Promise<AddMemberResult>;
+    listMembers(tenantId: string): Promise<Member[]>;
+    removeMember(tenantId: string, rawEmail: string): Promise<boolean>;
+    findMemberByEmail(rawEmail: string): Promise<Member | null>;
+    createLoginToken(i: {
+        tokenHash: string;
+        tenantId: string;
+        email: string;
+        expiresAt: number;
+    }): Promise<void>;
+    consumeLoginToken(tokenHash: string, now: number): Promise<{
+        tenantId: string;
+        email: string;
+    } | null>;
+    createSession(i: {
+        tokenHash: string;
+        tenantId: string;
+        email: string;
+        expiresAt: number;
+    }): Promise<void>;
+    findSession(tokenHash: string, now: number): Promise<SessionInfo | null>;
+    deleteSession(tokenHash: string): Promise<void>;
+}
+//# sourceMappingURL=ConsoleStore.d.ts.map

package/dist/cjs/cloud/console/ConsoleStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConsoleStore.d.ts","sourceRoot":"","sources":["../../../../src/cloud/console/ConsoleStore.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,eAAO,MAAM,YAAY,uCAAwC,CAAC;AAClE,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,cAAc,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACvF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,uDAAuD;IACvD,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,wDAAwD;IACxD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzD,gBAAgB,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClH,2GAA2G;IAC3G,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEvG,aAAa,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/G,sGAAsG;IACtG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACzE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,MAAoC,CAAC;AACpF,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,KAAG,MAAiE,CAAC;AAC5G,wDAAwD;AACxD,eAAO,MAAM,QAAQ,QAAO,MAAsD,CAAC;AAOnF,qBAAa,oBAAqB,YAAW,YAAY;IAK3C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4F;IACxH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6E;gBAEzE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC;IAEjE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC;IAUzF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIhD,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASlE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAM3D,gBAAgB,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7G,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAOtG,aAAa,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1G,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAOxE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtD;AAID,qBAAa,oBAAqB,YAAW,YAAY;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC;IAyBzF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQhD,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOlE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQ3D,gBAAgB,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAS7G,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAatG,aAAa,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1G,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAWxE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtD"}

package/dist/cjs/cloud/console/ConsoleStore.js

@@ -0,0 +1,172 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostgresConsoleStore = exports.InMemoryConsoleStore = exports.newToken = exports.hashToken = exports.normalizeEmail = exports.MEMBER_ROLES = void 0;
+/**
+ * Lemma Cloud console — members, one-time login links and sessions.
+ *
+ * Members live in `tenant_seats`. An active email belongs to one tenant only (the login form takes
+ * an email and nothing else). Tokens are random and stored as sha256 hashes, never in the clear.
+ * A session does not carry the role: `findSession` joins the member row, so a removed member or a
+ * changed role is felt on the very next request.
+ *
+ * `InMemoryConsoleStore` serves tests and the no-database dev path; `PostgresConsoleStore` is production.
+ */
+const crypto_1 = __importDefault(require("crypto"));
+exports.MEMBER_ROLES = ['owner', 'admin', 'member'];
+const normalizeEmail = (email) => email.trim().toLowerCase();
+exports.normalizeEmail = normalizeEmail;
+const hashToken = (token) => crypto_1.default.createHash('sha256').update(token).digest('hex');
+exports.hashToken = hashToken;
+/** 256 bits, URL-safe. Only its hash is ever stored. */
+const newToken = () => crypto_1.default.randomBytes(32).toString('base64url');
+exports.newToken = newToken;
+const newMemberId = () => `mem_${crypto_1.default.randomBytes(6).toString('hex')}`;
+class InMemoryConsoleStore {
+    constructor(identity) {
+        this.identity = identity;
+        this.members = [];
+        this.loginTokens = new Map();
+        this.sessions = new Map();
+    }
+    async addMember(tenantId, rawEmail, role) {
+        const email = (0, exports.normalizeEmail)(rawEmail);
+        if (!(await this.identity.getTenant(tenantId)))
+            return { ok: false, reason: 'no_tenant' };
+        const active = this.members.find((m) => !m.removed && m.email === email);
+        if (active)
+            return { ok: false, reason: active.tenantId === tenantId ? 'exists' : 'other_tenant' };
+        const row = { id: newMemberId(), tenantId, email, role, createdAt: Date.now(), removed: false };
+        this.members.push(row);
+        return { ok: true, member: toMember(row) };
+    }
+    async listMembers(tenantId) {
+        return this.members.filter((m) => !m.removed && m.tenantId === tenantId).map(toMember);
+    }
+    async removeMember(tenantId, rawEmail) {
+        const email = (0, exports.normalizeEmail)(rawEmail);
+        const row = this.members.find((m) => !m.removed && m.tenantId === tenantId && m.email === email);
+        if (!row)
+            return false;
+        row.removed = true;
+        for (const [hash, s] of this.sessions)
+            if (s.tenantId === tenantId && s.email === email)
+                this.sessions.delete(hash);
+        return true;
+    }
+    async findMemberByEmail(rawEmail) {
+        const email = (0, exports.normalizeEmail)(rawEmail);
+        const row = this.members.find((m) => !m.removed && m.email === email);
+        return row ? toMember(row) : null;
+    }
+    async createLoginToken(i) {
+        this.loginTokens.set(i.tokenHash, { tenantId: i.tenantId, email: (0, exports.normalizeEmail)(i.email), expiresAt: i.expiresAt, used: false });
+    }
+    async consumeLoginToken(tokenHash, now) {
+        const t = this.loginTokens.get(tokenHash);
+        if (!t || t.used || t.expiresAt <= now)
+            return null;
+        t.used = true; // synchronous between the check and the write: atomic on one event loop
+        return { tenantId: t.tenantId, email: t.email };
+    }
+    async createSession(i) {
+        this.sessions.set(i.tokenHash, { tenantId: i.tenantId, email: (0, exports.normalizeEmail)(i.email), expiresAt: i.expiresAt });
+    }
+    async findSession(tokenHash, now) {
+        const s = this.sessions.get(tokenHash);
+        if (!s || s.expiresAt <= now)
+            return null;
+        const member = this.members.find((m) => !m.removed && m.tenantId === s.tenantId && m.email === s.email);
+        return member ? { tenantId: s.tenantId, email: s.email, role: member.role } : null;
+    }
+    async deleteSession(tokenHash) {
+        this.sessions.delete(tokenHash);
+    }
+}
+exports.InMemoryConsoleStore = InMemoryConsoleStore;
+const toMember = (r) => ({ id: r.id, tenantId: r.tenantId, email: r.email, role: r.role, createdAt: r.createdAt });
+class PostgresConsoleStore {
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async addMember(tenantId, rawEmail, role) {
+        const email = (0, exports.normalizeEmail)(rawEmail);
+        const existing = await this.findMemberByEmail(email);
+        if (existing)
+            return { ok: false, reason: existing.tenantId === tenantId ? 'exists' : 'other_tenant' };
+        const id = newMemberId();
+        try {
+            // A removed member of this tenant is brought back instead of colliding with UNIQUE (tenant_id, email).
+            const { rows } = await this.pool.query(`INSERT INTO tenant_seats (id, tenant_id, email, role) VALUES ($1, $2, $3, $4)
+         ON CONFLICT (tenant_id, email) DO UPDATE SET removed = FALSE, role = EXCLUDED.role
+         RETURNING id, tenant_id, email, role, created_at`, [id, tenantId, email, role]);
+            return { ok: true, member: rowToMember(rows[0]) };
+        }
+        catch (err) {
+            if (err?.code === '23503')
+                return { ok: false, reason: 'no_tenant' };
+            if (err?.code === '23505') {
+                // Lost a race with another add of the same email.
+                const now = await this.findMemberByEmail(email);
+                return { ok: false, reason: now && now.tenantId === tenantId ? 'exists' : 'other_tenant' };
+            }
+            throw err;
+        }
+    }
+    async listMembers(tenantId) {
+        const { rows } = await this.pool.query('SELECT id, tenant_id, email, role, created_at FROM tenant_seats WHERE tenant_id = $1 AND NOT removed ORDER BY created_at, email', [tenantId]);
+        return rows.map(rowToMember);
+    }
+    async removeMember(tenantId, rawEmail) {
+        const email = (0, exports.normalizeEmail)(rawEmail);
+        const { rowCount } = await this.pool.query('UPDATE tenant_seats SET removed = TRUE WHERE tenant_id = $1 AND lower(email) = $2 AND NOT removed', [tenantId, email]);
+        await this.pool.query('DELETE FROM console_sessions WHERE tenant_id = $1 AND lower(email) = $2', [tenantId, email]);
+        return (rowCount ?? 0) > 0;
+    }
+    async findMemberByEmail(rawEmail) {
+        const { rows } = await this.pool.query('SELECT id, tenant_id, email, role, created_at FROM tenant_seats WHERE lower(email) = $1 AND NOT removed LIMIT 1', [(0, exports.normalizeEmail)(rawEmail)]);
+        return rows.length ? rowToMember(rows[0]) : null;
+    }
+    async createLoginToken(i) {
+        await this.pool.query('INSERT INTO console_login_tokens (token_hash, tenant_id, email, expires_at) VALUES ($1, $2, $3, $4)', [
+            i.tokenHash,
+            i.tenantId,
+            (0, exports.normalizeEmail)(i.email),
+            new Date(i.expiresAt),
+        ]);
+    }
+    async consumeLoginToken(tokenHash, now) {
+        // One statement: only the first caller flips used_at, so a link works once even under a race.
+        const { rows } = await this.pool.query(`UPDATE console_login_tokens SET used_at = now()
+        WHERE token_hash = $1 AND used_at IS NULL AND expires_at > $2
+        RETURNING tenant_id, email`, [tokenHash, new Date(now)]);
+        // Housekeeping on the way: expired rows are of no use to anyone.
+        this.pool.query('DELETE FROM console_login_tokens WHERE expires_at < $1', [new Date(now - 24 * 3600 * 1000)]).catch(() => undefined);
+        return rows.length ? { tenantId: rows[0].tenant_id, email: rows[0].email } : null;
+    }
+    async createSession(i) {
+        await this.pool.query('INSERT INTO console_sessions (token_hash, tenant_id, email, expires_at) VALUES ($1, $2, $3, $4)', [
+            i.tokenHash,
+            i.tenantId,
+            (0, exports.normalizeEmail)(i.email),
+            new Date(i.expiresAt),
+        ]);
+    }
+    async findSession(tokenHash, now) {
+        const { rows } = await this.pool.query(`SELECT s.tenant_id, s.email, m.role
+         FROM console_sessions s
+         JOIN tenant_seats m ON m.tenant_id = s.tenant_id AND lower(m.email) = s.email AND NOT m.removed
+        WHERE s.token_hash = $1 AND s.expires_at > $2`, [tokenHash, new Date(now)]);
+        return rows.length ? { tenantId: rows[0].tenant_id, email: rows[0].email, role: rows[0].role } : null;
+    }
+    async deleteSession(tokenHash) {
+        await this.pool.query('DELETE FROM console_sessions WHERE token_hash = $1', [tokenHash]);
+    }
+}
+exports.PostgresConsoleStore = PostgresConsoleStore;
+function rowToMember(r) {
+    return { id: r.id, tenantId: r.tenant_id, email: r.email, role: r.role, createdAt: new Date(r.created_at).getTime() };
+}
+//# sourceMappingURL=ConsoleStore.js.map

package/dist/cjs/cloud/console/ConsoleStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConsoleStore.js","sourceRoot":"","sources":["../../../../src/cloud/console/ConsoleStore.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;GASG;AACH,oDAA4B;AAIf,QAAA,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAuC3D,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAAvE,QAAA,cAAc,kBAAyD;AAC7E,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAA/F,QAAA,SAAS,aAAsF;AAC5G,wDAAwD;AACjD,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAAtE,QAAA,QAAQ,YAA8D;AACnF,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,OAAO,gBAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAMjF,MAAa,oBAAoB;IAK/B,YAA6B,QAA0C;QAA1C,aAAQ,GAAR,QAAQ,CAAkC;QAJtD,YAAO,GAAgB,EAAE,CAAC;QAC1B,gBAAW,GAAG,IAAI,GAAG,EAAiF,CAAC;QACvG,aAAQ,GAAG,IAAI,GAAG,EAAkE,CAAC;IAE5B,CAAC;IAE3E,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,QAAgB,EAAE,IAAgB;QAClE,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACzE,IAAI,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QACnG,MAAM,GAAG,GAAc,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3G,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,QAAgB;QACnD,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACjG,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QACtC,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,CAA4E;QACjG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAA,sBAAc,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnI,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,GAAW;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACpD,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,wEAAwE;QACvF,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,CAA4E;QAC9F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAA,sBAAc,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,GAAW;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QACxG,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;CACF;AA7DD,oDA6DC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;AAEnI,MAAa,oBAAoB;IAC/B,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,QAAgB,EAAE,IAAgB;QAClE,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QACvG,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,uGAAuG;YACvG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;0DAEkD,EAClD,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAC5B,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,EAAE,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACrE,IAAI,GAAG,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,kDAAkD;gBAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;YAC7F,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC,iIAAiI,EACjI,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,QAAgB;QACnD,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mGAAmG,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACnK,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yEAAyE,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACpH,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QACtC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC,iHAAiH,EACjH,CAAC,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC,CAC3B,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,CAA4E;QACjG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,qGAAqG,EAAE;YAC3H,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,QAAQ;YACV,IAAA,sBAAc,EAAC,CAAC,CAAC,KAAK,CAAC;YACvB,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;SACtB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,GAAW;QACpD,8FAA8F;QAC9F,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;mCAE6B,EAC7B,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAC3B,CAAC;QACF,iEAAiE;QACjE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wDAAwD,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrI,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,CAA4E;QAC9F,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iGAAiG,EAAE;YACvH,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,QAAQ;YACV,IAAA,sBAAc,EAAC,CAAC,CAAC,KAAK,CAAC;YACvB,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;SACtB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,GAAW;QAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;;sDAGgD,EAChD,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAC3B,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3F,CAAC;CACF;AAhGD,oDAgGC;AAED,SAAS,WAAW,CAAC,CAAsB;IACzC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAkB,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;AACtI,CAAC"}

package/dist/cjs/cloud/console/consoleRouter.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Lemma Cloud console — the web app's server side, mounted at /console.
+ *
+ *   GET  /console/                      the static app (console/index.html, app.js, styles.css)
+ *   POST /console/api/login   {email}   asks for a sign-in link: ALWAYS 202, so it cannot tell who is a member
+ *   POST /console/api/verify  {token}   spends the link, starts a session (HttpOnly cookie)
+ *   POST /console/api/logout
+ *   GET  /console/api/me                who you are, your tenant's plan, limits, use and (owner/admin) billing
+ *   GET  /console/api/usage             owner/admin: requests and tokens by operation and by dev, this month
+ *   GET  /console/api/team              owner/admin: members, keys (never a secret), seats
+ *   POST /console/api/billing/portal    owner/admin: Stripe billing-portal link
+ *
+ * It is a separate identity from the API keys on purpose: a key belongs to a machine and a tenant, a
+ * session belongs to a person. Sessions live in the database, so removing a member ends their access at once.
+ *
+ * Defences, each cheap: the link travels in the URL FRAGMENT (never reaches a server log or a Referer) and is
+ * posted by the page; the cookie is HttpOnly + Secure + SameSite=Lax and scoped to /console; every POST needs
+ * a custom header and a same-origin Origin (so a cross-site form cannot act); the CSP allows only our own files.
+ */
+import { type Request, type Router } from 'express';
+import type { BrainStore } from '../../contracts/store';
+import type { IdentityStore } from '../identity/identityStore';
+import type { PlanPolicy } from '../identity/PlanPolicy';
+import type { RateLimiter } from '../identity/RateLimiter';
+import type { UsageLedger } from '../metering';
+import type { StripeApi } from '../billing/stripeApi';
+import { type ConsoleStore } from './ConsoleStore';
+import type { LoginMailer } from './mailer';
+export declare const LOGIN_LINK_MINUTES = 15;
+export declare const SESSION_DAYS = 7;
+export interface ConsoleDeps {
+    consoleStore: ConsoleStore;
+    identityStore: IdentityStore;
+    policy?: PlanPolicy;
+    rateLimiter?: RateLimiter;
+    rateLimitWindowMs?: number;
+    /** Counts the tenant's memories for the overview. */
+    store?: Pick<BrainStore, 'count'>;
+    usageLedger?: Pick<UsageLedger, 'computeUsage' | 'computeKeyActivity'>;
+    stripeApi?: Pick<StripeApi, 'createPortal'>;
+    mailer?: LoginMailer;
+    /** Where the app is reachable, for links in emails. Falls back to the request's own host. */
+    publicBaseUrl?: string;
+    /** Directory holding index.html, app.js, styles.css. */
+    consoleDir?: string;
+    /** Drop the Secure flag on the cookie: plain-http local development only. */
+    insecureCookies?: boolean;
+    now?: () => number;
+}
+/** Counts attempts per key inside a sliding window. Per instance: enough to blunt abuse, not a security boundary. */
+export declare class AttemptLimiter {
+    private readonly max;
+    private readonly windowMs;
+    private readonly hits;
+    constructor(max: number, windowMs: number);
+    allow(key: string, now: number): boolean;
+}
+/** The origin the app is served from: configured, else what the proxy in front of us says. */
+export declare function publicBase(req: Request, configured?: string): string;
+export declare const loginLink: (base: string, token: string) => string;
+/** Issues a one-time link for an ACTIVE member; null when the email is not one. Shared with the operator route. */
+export declare function issueLoginLink(store: ConsoleStore, email: string, now: number): Promise<{
+    token: string;
+    email: string;
+    expiresAt: number;
+} | null>;
+export declare function consoleRouter(deps: ConsoleDeps): Router;
+//# sourceMappingURL=consoleRouter.d.ts.map

package/dist/cjs/cloud/console/consoleRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consoleRouter.d.ts","sourceRoot":"","sources":["../../../../src/cloud/console/consoleRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAgB,EAAqB,KAAK,OAAO,EAAsC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAKpH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAuC,KAAK,YAAY,EAAoB,MAAM,gBAAgB,CAAC;AAC1G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,YAAY,IAAI,CAAC;AAI9B,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,KAAK,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,oBAAoB,CAAC,CAAC;IACvE,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC5C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qHAAqH;AACrH,qBAAa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAH3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;gBAEjC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM;IAEnC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;CAWzC;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAIpE;AAED,eAAO,MAAM,SAAS,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,MAA2C,CAAC;AAEpG,mHAAmH;AACnH,wBAAsB,cAAc,CAClC,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAOrE;AAkBD,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CA+MvD"}