@nxuss/lemma 1.43.0 → 1.45.0

package/dist/esm/cloud/v2/inputGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputGuard.d.ts","sourceRoot":"","sources":["../../../../src/cloud/v2/inputGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAa/E,6DAA6D;AAC7D,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE5C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,cAAc,CAkBjD;AAUD,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAKvG"}

package/dist/esm/cloud/v2/inputGuard.js

@@ -0,0 +1,63 @@
+import { LemmaApiError } from '../../contracts/errors.js';
+// Detecting control characters is the whole point of this file, so no-control-regex is switched off
+// for the two patterns below, and only for them.
+/** NUL, or a surrogate half with no partner (an invalid UTF-16 string). */
+// eslint-disable-next-line no-control-regex
+const UNSAFE_TEXT = /\u0000|[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+/** Control characters (C0, DEL) never appear in a real memory id or a key name. */
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+/** Longest id any store here generates is far below this. */
+export const MAX_ID_LENGTH = 200;
+export function isUnsafeText(s) {
+    return UNSAFE_TEXT.test(s);
+}
+export function hasControlChars(s) {
+    return CONTROL_CHARS.test(s);
+}
+export function isSafeId(id) {
+    return id.length > 0 && id.length <= MAX_ID_LENGTH && !CONTROL_CHARS.test(id) && !UNSAFE_TEXT.test(id);
+}
+/**
+ * Walks the parsed JSON body (keys and string values) and answers 400 on the first
+ * unsafe string. Iterative: a hostile deeply nested body must not overflow the stack.
+ */
+export function rejectUnsafeBody() {
+    return (req, _res, next) => {
+        const stack = [req.body];
+        while (stack.length > 0) {
+            const v = stack.pop();
+            if (typeof v === 'string') {
+                if (UNSAFE_TEXT.test(v))
+                    return next(unsafeBodyError());
+            }
+            else if (Array.isArray(v)) {
+                for (const item of v)
+                    stack.push(item);
+            }
+            else if (typeof v === 'object' && v !== null) {
+                for (const [k, item] of Object.entries(v)) {
+                    if (UNSAFE_TEXT.test(k))
+                        return next(unsafeBodyError());
+                    stack.push(item);
+                }
+            }
+        }
+        next();
+    };
+}
+function unsafeBodyError() {
+    return new LemmaApiError({
+        code: 'invalid_request',
+        status: 400,
+        message: 'request contains a NUL character or invalid Unicode',
+    });
+}
+/** app.param('id') handler: an id that cannot exist is the same 404 as one that does not. */
+export function rejectUnsafeIdParam(_req, _res, next, id) {
+    if (!isSafeId(id)) {
+        return next(new LemmaApiError({ code: 'not_found', status: 404, message: 'memory not found' }));
+    }
+    next();
+}
+//# sourceMappingURL=inputGuard.js.map

package/dist/esm/cloud/v2/inputGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputGuard.js","sourceRoot":"","sources":["../../../../src/cloud/v2/inputGuard.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,oGAAoG;AACpG,iDAAiD;AACjD,2EAA2E;AAC3E,4CAA4C;AAC5C,MAAM,WAAW,GAAG,+EAA+E,CAAC;AAEpG,mFAAmF;AACnF,4CAA4C;AAC5C,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAEjC,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,EAAU;IACjC,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC1D,MAAM,KAAK,GAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5B,KAAK,MAAM,IAAI,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;oBACxD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,aAAa,CAAC;QACvB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,qDAAqD;KAC/D,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,IAAa,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAU;IAC/F,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/esm/cloud/v2/routes/admin.d.ts

@@ -0,0 +1,24 @@
+import { type Router } from 'express';
+import type { IdentityStore } from '../../identity/identityStore.js';
+import { PlanPolicy } from '../../identity/PlanPolicy.js';
+import type { UsageLedger } from '../../metering/index.js';
+import { type StripeApi } from '../../billing/stripeApi.js';
+import { type ConsoleStore } from '../../console/ConsoleStore.js';
+export declare const MIN_ADMIN_TOKEN_LENGTH = 32;
+export interface AdminDeps {
+    /** The operator secret. Absent or shorter than MIN_ADMIN_TOKEN_LENGTH => admin routes are not mounted. */
+    adminToken?: string;
+    identityStore?: IdentityStore;
+    policy?: PlanPolicy;
+    usageLedger?: Pick<UsageLedger, 'computeUsage' | 'computeKeyActivity'>;
+    /** Present only when STRIPE_SECRET_KEY is configured: enables the checkout and portal routes. */
+    stripeApi?: Pick<StripeApi, 'createCheckout' | 'createPortal'>;
+    /** Present when the console is enabled: turns on the member routes. */
+    consoleStore?: ConsoleStore;
+    /** Where the console is reachable, for the sign-in links this router hands out. */
+    publicBaseUrl?: string;
+}
+/** Returns null when the operator secret is missing or too weak: the caller must not mount anything. */
+export declare function adminRouter(deps: AdminDeps): Router | null;
+export default adminRouter;
+//# sourceMappingURL=admin.d.ts.map

package/dist/esm/cloud/v2/routes/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/admin.ts"],"names":[],"mappings":"AA8BA,OAAgB,EAAuE,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAIpH,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAY,UAAU,EAAe,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI7E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAIzC,MAAM,WAAW,SAAS;IACxB,0GAA0G;IAC1G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,oBAAoB,CAAC,CAAC;IACvE,iGAAiG;IACjG,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,cAAc,CAAC,CAAC;IAC/D,uEAAuE;IACvE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAoED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAgR1D;AAED,eAAe,WAAW,CAAC"}

package/dist/esm/cloud/v2/routes/admin.js

@@ -0,0 +1,337 @@
+/**
+ * Lemma API v2 — operator routes: tenants, seats and keys.
+ *
+ * Not part of the public openapi.yaml contract (customers never call these; the
+ * operator does, from the CLI or a dashboard). Guarded by one operator secret,
+ * `LEMMA_ADMIN_TOKEN`, which is NOT an API key and resolves to no tenant. With the
+ * secret unset the router is simply not mounted, so there is nothing to probe.
+ *
+ *   POST   /v2/admin/tenants                 {id, name?, plan?, founder?}  create a company
+ *   GET    /v2/admin/tenants/:id                                  plan, seats used/limit, keys
+ *   PATCH  /v2/admin/tenants/:id             {plan}               change plan (never below seats in use)
+ *   POST   /v2/admin/tenants/:id/founder     {founder}            mark a founder team (keeps the founder limits)
+ *   POST   /v2/admin/tenants/:id/keys        {name}               issue a key (shown once)
+ *   DELETE /v2/admin/tenants/:id/keys/:keyId                      revoke (the dev left)
+ *   GET    /v2/admin/tenants/:id/usage?since=<epoch ms>           usage by operation and by dev
+ *   POST   /v2/admin/tenants/:id/checkout    {plan, interval, founder?, email?}  Stripe Checkout link to send the customer
+ *   POST   /v2/admin/tenants/:id/portal                           Stripe billing-portal link for a paying tenant
+ *
+ *   POST   /v2/admin/tenants/:id/members    {email, role?}        let a person sign in to the console (owner | admin | member)
+ *   GET    /v2/admin/tenants/:id/members                          who can sign in
+ *   DELETE /v2/admin/tenants/:id/members/:email                   remove them (their sessions end at once)
+ *   POST   /v2/admin/tenants/:id/members/:email/login-link        a one-time sign-in link, to hand over by hand
+ *
+ * The checkout and portal routes exist only when STRIPE_SECRET_KEY is set; the member routes only with a console store. The checkout link carries the tenant id, so paying
+ * is what links the Stripe customer to the tenant; the webhook then sets the plan.
+ *
+ * A seat is one active, unexpired key. Issuing past the plan's seat ceiling is a 429
+ * `quota_exceeded`; the check and the insert are atomic in the store.
+ */
+import crypto from 'crypto';
+import express from 'express';
+import { z } from 'zod';
+import { LemmaApiError } from '../../../contracts/errors.js';
+import { generateApiKey, KEY_PREFIX_LIVE } from '../../identity/ApiKey.js';
+import { PLAN_IDS, PlanPolicy } from '../../identity/PlanPolicy.js';
+import { hasControlChars, rejectUnsafeBody } from '../inputGuard.js';
+import { SELLABLE_PLANS } from '../../billing/stripeApi.js';
+import { MEMBER_ROLES } from '../../console/ConsoleStore.js';
+import { issueLoginLink, loginLink, publicBase } from '../../console/consoleRouter.js';
+import { zodToApiError } from './memories.js';
+export const MIN_ADMIN_TOKEN_LENGTH = 32;
+const TENANT_ID = /^[a-z0-9][a-z0-9_-]{1,62}$/;
+const KEY_ID = /^key_[0-9a-f]{12}$/;
+const PlanSchema = z.enum(PLAN_IDS);
+const CreateTenantSchema = z.object({
+    id: z.string().regex(TENANT_ID, 'id must be 2-63 chars: a-z, 0-9, "_" or "-", starting with a letter or digit'),
+    name: z.string().max(200).optional(),
+    plan: PlanSchema.optional(),
+    /** A founder team created by hand: it keeps the founder limits (PlanPolicy FOUNDER_LIMITS). */
+    founder: z.boolean().optional(),
+});
+const FounderSchema = z.object({ founder: z.boolean() }).strict();
+const PatchTenantSchema = z.object({ plan: PlanSchema });
+const AddMemberSchema = z.object({
+    email: z.string().trim().email().max(254),
+    role: z.enum(MEMBER_ROLES).optional(),
+});
+const CheckoutSchema = z.object({
+    plan: z.enum(SELLABLE_PLANS),
+    interval: z.enum(['month', 'year']),
+    /** The founder discount: first teams only, monthly billing only (a coupon on a yearly price would take 20 or 70 off once). */
+    founder: z.boolean().optional(),
+    email: z.string().trim().email().max(254).optional(),
+});
+const CreateKeySchema = z.object({
+    name: z
+        .string()
+        .trim()
+        .min(1)
+        .max(100)
+        .refine((n) => !hasControlChars(n), 'name must not contain control characters'),
+});
+const sha = (s) => crypto.createHash('sha256').update(s).digest();
+function bearer(req) {
+    const m = /^Bearer\s+(.+)$/i.exec((req.headers.authorization ?? '').trim());
+    return m ? m[1].trim() : null;
+}
+function requireAdmin(token) {
+    const expected = sha(token);
+    return (req, res, next) => {
+        const given = bearer(req);
+        // Hash both sides first so the compare is constant-time regardless of the given length.
+        if (given && crypto.timingSafeEqual(sha(given), expected))
+            return next();
+        res.status(401).set('WWW-Authenticate', 'Bearer').json(new LemmaApiError({ code: 'unauthenticated', status: 401, message: 'missing or invalid operator token' }).toJSON());
+    };
+}
+const notFound = (what) => new LemmaApiError({ code: 'not_found', status: 404, message: `${what} not found` });
+const publicKey = (k) => ({
+    id: k.id,
+    name: k.name,
+    prefix: k.prefix,
+    active: k.active,
+    createdAt: k.createdAt,
+    revokedAt: k.revokedAt,
+});
+const wrap = (fn) => (req, res, next) => {
+    fn(req, res).catch(next);
+};
+/** Returns null when the operator secret is missing or too weak: the caller must not mount anything. */
+export function adminRouter(deps) {
+    const { adminToken, identityStore: store } = deps;
+    if (!adminToken || adminToken.length < MIN_ADMIN_TOKEN_LENGTH || !store)
+        return null;
+    const policy = deps.policy ?? new PlanPolicy();
+    const r = express.Router();
+    r.use(requireAdmin(adminToken));
+    r.use(rejectUnsafeBody());
+    const tenantParam = (req) => {
+        const id = req.params.tenantId;
+        if (!TENANT_ID.test(id))
+            throw notFound('tenant');
+        return id;
+    };
+    const tenantView = async (id) => {
+        const tenant = await store.getTenant(id);
+        if (!tenant)
+            throw notFound('tenant');
+        const keys = await store.listKeys(id);
+        const now = Date.now();
+        const used = keys.filter((k) => k.active && (k.expiresAt === null || k.expiresAt > now)).length;
+        return {
+            id: tenant.id,
+            name: tenant.name,
+            plan: tenant.plan,
+            founder: tenant.founder,
+            createdAt: tenant.createdAt,
+            seats: { used, limit: policy.limitsFor(tenant.plan, { founder: tenant.founder }).seats },
+            keys: keys.map(publicKey),
+        };
+    };
+    r.post('/tenants', wrap(async (req, res) => {
+        const parsed = CreateTenantSchema.safeParse(req.body);
+        if (!parsed.success)
+            throw zodToApiError(parsed.error);
+        const { id, name, plan, founder } = parsed.data;
+        const created = await store.createTenant({ id, name: name ?? id, plan: (plan ?? 'free'), founder: founder === true });
+        if (!created)
+            throw new LemmaApiError({ code: 'invalid_request', status: 409, message: 'tenant already exists', field: 'id' });
+        res.status(201).json({ id: created.id, name: created.name, plan: created.plan, founder: created.founder });
+    }));
+    r.get('/tenants/:tenantId', wrap(async (req, res) => {
+        res.json(await tenantView(tenantParam(req)));
+    }));
+    r.patch('/tenants/:tenantId', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const parsed = PatchTenantSchema.safeParse(req.body);
+        if (!parsed.success)
+            throw zodToApiError(parsed.error);
+        const current = await tenantView(id);
+        const newSeats = policy.limitsFor(parsed.data.plan).seats;
+        if (current.seats.used > newSeats) {
+            throw new LemmaApiError({
+                code: 'invalid_request',
+                status: 409,
+                message: `plan "${parsed.data.plan}" allows ${newSeats} seats but ${current.seats.used} are in use: revoke keys first`,
+                field: 'plan',
+            });
+        }
+        await store.setTenantPlan(id, parsed.data.plan);
+        res.json(await tenantView(id));
+    }));
+    // Mark (or, to correct a mistake, unmark) a founder. Billing marks paid founder checkouts by itself.
+    r.post('/tenants/:tenantId/founder', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const parsed = FounderSchema.safeParse(req.body);
+        if (!parsed.success)
+            throw zodToApiError(parsed.error);
+        if (!(await store.setTenantFounder(id, parsed.data.founder)))
+            throw notFound('tenant');
+        res.json(await tenantView(id));
+    }));
+    r.post('/tenants/:tenantId/keys', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const parsed = CreateKeySchema.safeParse(req.body);
+        if (!parsed.success)
+            throw zodToApiError(parsed.error);
+        const tenant = await store.getTenant(id);
+        if (!tenant)
+            throw notFound('tenant');
+        const generated = generateApiKey(KEY_PREFIX_LIVE);
+        const result = await store.createKeyWithinSeats({ tenantId: id, name: parsed.data.name, plan: tenant.plan, prefix: KEY_PREFIX_LIVE, hash: generated.hash }, policy.limitsFor(tenant.plan).seats);
+        if (!result.ok) {
+            if (result.reason === 'no_tenant')
+                throw notFound('tenant');
+            if (result.reason === 'duplicate_name') {
+                throw new LemmaApiError({ code: 'invalid_request', status: 409, message: 'an active key with that name already exists', field: 'name' });
+            }
+            throw new LemmaApiError({
+                code: 'quota_exceeded',
+                status: 429,
+                message: `seat limit reached: ${result.used}/${result.seats} on plan "${tenant.plan}"`,
+            });
+        }
+        // The only response that ever carries the plaintext key.
+        res.status(201).json({ id: result.key.id, name: result.key.name, prefix: result.key.prefix, key: generated.key });
+    }));
+    r.delete('/tenants/:tenantId/keys/:keyId', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const keyId = req.params.keyId;
+        if (!KEY_ID.test(keyId))
+            throw notFound('key');
+        // The key must belong to THIS tenant: an id from another tenant is the same 404.
+        const keys = await store.listKeys(id);
+        if (!keys.some((k) => k.id === keyId))
+            throw notFound('key');
+        await store.revokeKey(keyId);
+        res.json({ revoked: [keyId] });
+    }));
+    r.get('/tenants/:tenantId/usage', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        if (!(await store.getTenant(id)))
+            throw notFound('tenant');
+        const ledger = deps.usageLedger;
+        if (!ledger || !ledger.computeKeyActivity)
+            throw new LemmaApiError({ code: 'not_implemented', status: 501, message: 'usage ledger unavailable' });
+        const rawSince = req.query.since;
+        let since;
+        if (rawSince !== undefined) {
+            // Digits only: Number('') is 0 and Number(' 5 ') is 5, neither of which is a timestamp anyone meant.
+            since = typeof rawSince === 'string' && /^\d{1,16}$/.test(rawSince) ? Number(rawSince) : NaN;
+            if (!Number.isSafeInteger(since)) {
+                throw new LemmaApiError({ code: 'invalid_request', status: 400, message: 'since must be a non-negative integer (epoch ms)', field: 'since' });
+            }
+        }
+        const [usage, activity, keys] = await Promise.all([
+            ledger.computeUsage({ tenantId: id, since }),
+            ledger.computeKeyActivity({ tenantId: id, since }),
+            store.listKeys(id),
+        ]);
+        const names = new Map(keys.map((k) => [k.id, k.name]));
+        res.json({
+            tenantId: id,
+            since: since ?? null,
+            metrics: usage.metrics,
+            excludedEvents: usage.excludedEvents,
+            // One row per key that made calls, with the dev's name and whether the key is still live.
+            keys: activity.map((a) => ({
+                keyId: a.keyId,
+                name: names.get(a.keyId) ?? null,
+                active: keys.find((k) => k.id === a.keyId)?.active ?? false,
+                requests: a.requests,
+                tokens: a.tokens,
+                byOperation: a.byOperation,
+            })),
+        });
+    }));
+    if (deps.stripeApi) {
+        const stripeApi = deps.stripeApi;
+        // A subscription in any of these states already pays for the tenant: a second one would bill twice.
+        const LIVE_SUBSCRIPTION = new Set(['active', 'trialing', 'past_due', 'unpaid', 'incomplete']);
+        r.post('/tenants/:tenantId/checkout', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const parsed = CheckoutSchema.safeParse(req.body);
+            if (!parsed.success)
+                throw zodToApiError(parsed.error);
+            const { plan, interval, founder = false, email } = parsed.data;
+            if (founder && interval !== 'month') {
+                throw new LemmaApiError({ code: 'invalid_request', status: 400, message: 'the founder price is for monthly billing only', field: 'founder' });
+            }
+            const tenant = await store.getTenant(id);
+            if (!tenant)
+                throw notFound('tenant');
+            if (tenant.plan === 'internal') {
+                throw new LemmaApiError({ code: 'invalid_request', status: 409, message: 'an internal tenant is not sold through Stripe' });
+            }
+            const status = tenant.billing.status;
+            if (tenant.billing.subscriptionId && status && LIVE_SUBSCRIPTION.has(status)) {
+                throw new LemmaApiError({
+                    code: 'invalid_request',
+                    status: 409,
+                    message: `this tenant already has a subscription (${status}): change it in the billing portal instead`,
+                });
+            }
+            const link = await stripeApi.createCheckout({ tenantId: id, plan, interval, founder, existingCustomerId: tenant.billing.customerId, email });
+            res.status(201).json({ tenantId: id, plan, interval, founder, trialDays: 14, url: link.url, expiresAt: link.expiresAt });
+        }));
+        r.post('/tenants/:tenantId/portal', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const tenant = await store.getTenant(id);
+            if (!tenant)
+                throw notFound('tenant');
+            if (!tenant.billing.customerId) {
+                throw new LemmaApiError({ code: 'invalid_request', status: 409, message: 'this tenant has no Stripe customer yet: send it a checkout link first' });
+            }
+            res.json({ tenantId: id, url: (await stripeApi.createPortal(tenant.billing.customerId)).url });
+        }));
+    }
+    if (deps.consoleStore) {
+        const consoleStore = deps.consoleStore;
+        r.post('/tenants/:tenantId/members', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const parsed = AddMemberSchema.safeParse(req.body);
+            if (!parsed.success)
+                throw zodToApiError(parsed.error);
+            const added = await consoleStore.addMember(id, parsed.data.email, parsed.data.role ?? 'member');
+            if (!added.ok) {
+                if (added.reason === 'no_tenant')
+                    throw notFound('tenant');
+                throw new LemmaApiError({
+                    code: 'invalid_request',
+                    status: 409,
+                    message: added.reason === 'exists' ? 'that person is already a member of this tenant' : 'that email already belongs to another tenant',
+                    field: 'email',
+                });
+            }
+            res.status(201).json({ id: added.member.id, email: added.member.email, role: added.member.role });
+        }));
+        r.get('/tenants/:tenantId/members', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            if (!(await store.getTenant(id)))
+                throw notFound('tenant');
+            res.json({ members: (await consoleStore.listMembers(id)).map((m) => ({ email: m.email, role: m.role })) });
+        }));
+        r.delete('/tenants/:tenantId/members/:email', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            if (!(await consoleStore.removeMember(id, req.params.email)))
+                throw notFound('member');
+            res.json({ removed: req.params.email.trim().toLowerCase() });
+        }));
+        r.post('/tenants/:tenantId/members/:email/login-link', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const member = await consoleStore.findMemberByEmail(req.params.email);
+            // Another tenant's member is the same 404 as a stranger: this route never confirms who belongs where.
+            if (!member || member.tenantId !== id)
+                throw notFound('member');
+            const issued = await issueLoginLink(consoleStore, member.email, Date.now());
+            if (!issued)
+                throw notFound('member');
+            res.status(201).json({ email: issued.email, url: loginLink(publicBase(req, deps.publicBaseUrl), issued.token), expiresAt: issued.expiresAt });
+        }));
+    }
+    r.use((_req, _res, next) => next(notFound('route')));
+    return r;
+}
+export default adminRouter;
+//# sourceMappingURL=admin.js.map

package/dist/esm/cloud/v2/routes/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,OAA6F,MAAM,SAAS,CAAC;AACpH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAe,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,cAAc,EAAkB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAqB,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAC/C,MAAM,MAAM,GAAG,oBAAoB,CAAC;AAgBpC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,8EAA8E,CAAC;IAC/G,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC3B,+FAA+F;IAC/F,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAClE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AACzD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,8HAA8H;IAC9H,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,0CAA0C,CAAC;CAClF,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAElF,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,wFAAwF;QACxF,IAAI,KAAK,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CACpD,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CACnH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC,CAAC;AAEvH,MAAM,SAAS,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,SAAS,EAAE,CAAC,CAAC,SAAS;CACvB,CAAC,CAAC;AAEH,MAAM,IAAI,GACR,CAAC,EAAkD,EAAkB,EAAE,CACvE,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAClD,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEJ,wGAAwG;AACxG,MAAM,UAAU,WAAW,CAAC,IAAe;IACzC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAClD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,sBAAsB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;IAE/C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE1B,MAAM,WAAW,GAAG,CAAC,GAAY,EAAU,EAAE;QAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,EAAU,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAChG,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE;YACxF,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;SAC1B,CAAC;IACJ,CAAC,CAAC;IAEF,CAAC,CAAC,IAAI,CACJ,UAAU,EACV,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,CAAW,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;QAChI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,GAAG,CACH,oBAAoB,EACpB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,KAAK,CACL,oBAAoB,EACpB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;QAC1D,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CAAC;gBACtB,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,QAAQ,cAAc,OAAO,CAAC,KAAK,CAAC,IAAI,gCAAgC;gBACtH,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;IAEF,qGAAqG;IACrG,CAAC,CAAC,IAAI,CACJ,4BAA4B,EAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvF,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,IAAI,CACJ,yBAAyB,EACzB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAC7C,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAC1G,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CACpC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBACvC,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,6CAA6C,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3I,CAAC;YACD,MAAM,IAAI,aAAa,CAAC;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,uBAAuB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,IAAI,GAAG;aACvF,CAAC,CAAC;QACL,CAAC;QACD,yDAAyD;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;IACpH,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,MAAM,CACN,gCAAgC,EAChC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,iFAAiF;QACjF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,GAAG,CACH,0BAA0B,EAC1B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAAE,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAClJ,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;QACjC,IAAI,KAAyB,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,qGAAqG;YACrG,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iDAAiD,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAChJ,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAC5C,MAAM,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAClD,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;SACnB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,0FAA0F;YAC1F,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI;gBAChC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,KAAK;gBAC3D,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,oGAAoG;QACpG,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QAE9F,CAAC,CAAC,IAAI,CACJ,6BAA6B,EAC7B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;YAC/D,IAAI,OAAO,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACpC,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,+CAA+C,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAChJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;YAC9H,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,aAAa,CAAC;oBACtB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,2CAA2C,MAAM,4CAA4C;iBACvG,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7I,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3H,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,IAAI,CACJ,2BAA2B,EAC3B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC/B,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC,CAAC;YACtJ,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAEvC,CAAC,CAAC,IAAI,CACJ,4BAA4B,EAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;YAChG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;oBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC3D,MAAM,IAAI,aAAa,CAAC;oBACtB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,8CAA8C;oBACtI,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,GAAG,CACH,4BAA4B,EAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,MAAM,CACN,mCAAmC,EACnC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvF,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,IAAI,CACJ,8CAA8C,EAC9C,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,sGAAsG;YACtG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAChJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,eAAe,WAAW,CAAC"}

package/dist/esm/cloud/v2/routes/entitlement.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Lemma API v2 — GET /v2/entitlement
+ *
+ * What the presented key may do on the client, beyond the API itself: today, whether a seat on this
+ * plan also unlocks the local Pro tools. The answer comes from the tenant's plan (PLAN_INCLUDES_PRO),
+ * never from anything the caller sends. A revoked or expired key never gets here: authenticateV2
+ * answers it 401 first, which is how a client learns a seat was taken away.
+ */
+import type { RequestHandler } from 'express';
+/** GET /v2/entitlement */
+export declare function entitlementHandler(): RequestHandler;
+export default entitlementHandler;
+//# sourceMappingURL=entitlement.d.ts.map

package/dist/esm/cloud/v2/routes/entitlement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/entitlement.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAK9C,0BAA0B;AAC1B,wBAAgB,kBAAkB,IAAI,cAAc,CAenD;AAED,eAAe,kBAAkB,CAAC"}

package/dist/esm/cloud/v2/routes/entitlement.js

@@ -0,0 +1,21 @@
+import { PLAN_INCLUDES_PRO } from '../../identity/PlanPolicy.js';
+/** GET /v2/entitlement */
+export function entitlementHandler() {
+    return (req, res, next) => {
+        try {
+            const { tenant } = req;
+            const body = {
+                tenantId: tenant.id,
+                plan: tenant.plan,
+                includesPro: PLAN_INCLUDES_PRO[tenant.plan] === true,
+                ...(tenant.keyName ? { keyName: tenant.keyName } : {}),
+            };
+            res.json(body);
+        }
+        catch (err) {
+            next(err);
+        }
+    };
+}
+export default entitlementHandler;
+//# sourceMappingURL=entitlement.js.map

package/dist/esm/cloud/v2/routes/entitlement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.js","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/entitlement.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,0BAA0B;AAC1B,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,GAA2B,CAAC;YAC/C,MAAM,IAAI,GAAwB;gBAChC,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;gBACpD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,kBAAkB,CAAC"}

package/dist/esm/cloud/v2/routes/index.d.ts

@@ -18,7 +18,20 @@ import { type MemoriesDeps } from './memories.js';
 import { type RecallDeps } from './recall.js';
 import { type VerifyDeps } from './verify.js';
 import { type UsageDeps } from './usage.js';
-export type MountDeps = AuthenticateV2Deps & MemoriesDeps & RecallDeps & VerifyDeps & UsageDeps;
+import { type AdminDeps } from './admin.js';
+import type { StripeBillingConfig } from '../../billing/stripeWebhook.js';
+import type { ConsoleStore } from '../../console/ConsoleStore.js';
+import type { LoginMailer } from '../../console/mailer.js';
+export type MountDeps = AuthenticateV2Deps & MemoriesDeps & RecallDeps & VerifyDeps & UsageDeps & AdminDeps & {
+    billing?: StripeBillingConfig;
+    /** The web console: members, sign-in links and sessions. Absent => /console and the member routes are not mounted. */
+    consoleStore?: ConsoleStore;
+    loginMailer?: LoginMailer;
+    /** Where the console is reachable (CLOUD_PUBLIC_URL), for links in emails. */
+    publicBaseUrl?: string;
+    consoleDir?: string;
+    insecureCookies?: boolean;
+};
 export declare function mountRoutes(app: Express, deps: MountDeps): void;
 export default mountRoutes;
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/cloud/v2/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAIvD,MAAM,MAAM,SAAS,GAAG,kBAAkB,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAEhG,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAuB/D;AAED,eAAe,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAA8D,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAC3G,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAMvD,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,kBAAkB,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG;IAC1G,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,sHAAsH;IACtH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEJ,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAyD/D;AAED,eAAe,WAAW,CAAC"}

package/dist/esm/cloud/v2/routes/index.js

@@ -1,10 +1,16 @@
 import { authenticateV2 } from '../../identity/authenticateV2.js';
-import { createMemoryHandler, forgetMemoryHandler } from './memories.js';
+import { createMemoryHandler, forgetMemoryHandler, getMemoryHandler } from './memories.js';
 import { recallHandler } from './recall.js';
 import { verifyHandler } from './verify.js';
 import { usageHandler } from './usage.js';
+import { entitlementHandler } from './entitlement.js';
+import { tenantOverviewHandler } from './tenant.js';
 import { scrubRouter } from './scrub.js';
 import { LemmaApiError } from '../../../contracts/errors.js';
+import { rejectUnsafeBody, rejectUnsafeIdParam } from '../inputGuard.js';
+import { adminRouter } from './admin.js';
+import { usageRecorder } from '../usageRecorder.js';
+import { consoleRouter } from '../../console/consoleRouter.js';
 export function mountRoutes(app, deps) {
     // Public: no tenant, no auth (Lane F, stateless).
     const scrub = scrubRouter();
@@ -19,14 +25,44 @@ export function mountRoutes(app, deps) {
             next(err);
         }
     });
+    // Operator routes: their own secret, mounted only when LEMMA_ADMIN_TOKEN is strong enough.
+    const admin = adminRouter({ adminToken: deps.adminToken, identityStore: deps.identityStore, policy: deps.policy, usageLedger: deps.usageLedger, stripeApi: deps.stripeApi, consoleStore: deps.consoleStore, publicBaseUrl: deps.publicBaseUrl });
+    if (admin)
+        app.use('/v2/admin', admin);
+    // The web console has its own identity (a person's session, not an API key), so it sits outside the /v2 key auth.
+    if (deps.consoleStore && deps.identityStore) {
+        app.use('/console', consoleRouter({
+            consoleStore: deps.consoleStore,
+            identityStore: deps.identityStore,
+            policy: deps.policy,
+            store: deps.store,
+            rateLimiter: deps.rateLimiter,
+            rateLimitWindowMs: deps.rateLimitWindowMs,
+            usageLedger: deps.usageLedger,
+            stripeApi: deps.stripeApi,
+            mailer: deps.loginMailer,
+            publicBaseUrl: deps.publicBaseUrl,
+            consoleDir: deps.consoleDir,
+            insecureCookies: deps.insecureCookies,
+            now: deps.now,
+        }));
+    }
     // Everything below requires a valid tenant.
     const auth = authenticateV2(deps);
     app.use('/v2', auth);
+    // After auth, so an unauthenticated probe still gets 401. /v2/scrub is mounted above
+    // and stays untouched: it is stateless and never reaches a store.
+    app.use('/v2', rejectUnsafeBody());
+    app.use('/v2', usageRecorder(deps.usageLedger));
+    app.param('id', rejectUnsafeIdParam);
     app.post('/v2/memories', createMemoryHandler(deps));
+    app.get('/v2/memories/:id', getMemoryHandler(deps));
     app.delete('/v2/memories/:id', forgetMemoryHandler(deps));
     app.post('/v2/recall', recallHandler(deps));
     app.post('/v2/verify', verifyHandler(deps));
     app.get('/v2/usage', usageHandler(deps));
+    app.get('/v2/entitlement', entitlementHandler());
+    app.get('/v2/tenant', tenantOverviewHandler(deps));
 }
 export default mountRoutes;
 //# sourceMappingURL=index.js.map

package/dist/esm/cloud/v2/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/index.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,cAAc,EAA2B,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAqB,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,aAAa,EAAmB,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAmB,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAkB,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAI1D,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,IAAe;IACvD,kDAAkD;IAClD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4CAA4C;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAErB,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,eAAe,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/index.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,cAAc,EAA2B,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAqB,MAAM,YAAY,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAmB,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAmB,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAkB,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,WAAW,EAAkB,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAe5D,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,IAAe;IACvD,kDAAkD;IAClD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACjP,IAAI,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAEvC,kHAAkH;IAClH,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,GAAG,CAAC,GAAG,CACL,UAAU,EACV,aAAa,CAAC;YACZ,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrB,qFAAqF;IACrF,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAErC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,eAAe,WAAW,CAAC"}