@nxuss/lemma 1.43.0 → 1.45.0

package/dist/cjs/cloud/identity/authenticateV2.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticateV2.js","sourceRoot":"","sources":["../../../../src/cloud/identity/authenticateV2.ts"],"names":[],"mappings":";;;AA+DA,wCA0CC;AA1FD,mDAAuD;AACvD,6CAAgE;AA2FvD,qGA3FY,iCAAoB,OA2FZ;AAzF7B,+CAAmD;AA0BnD,SAAS,WAAW,CAAC,MAA0B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,IAAI,sBAAa,CAAC;QACvB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,4BAA4B;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,IAAwB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,uBAAU,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,iCAAoB,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAErD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;gBAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;gBAEnF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;oBAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;oBAC5D,GAAG;yBACA,MAAM,CAAC,GAAG,CAAC;yBACX,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;yBACtC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC;yBACjC,IAAI,CAAC,IAAA,gCAAkB,EAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;oBAC9D,OAAO;gBACT,CAAC;YACH,CAAC;YAEA,GAA4B,CAAC,MAAM,GAAG,MAAM,CAAC;YAC9C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAGD,kBAAe,cAAc,CAAC"}
+{"version":3,"file":"authenticateV2.js","sourceRoot":"","sources":["../../../../src/cloud/identity/authenticateV2.ts"],"names":[],"mappings":";;;AA+DA,wCA6CC;AA7FD,mDAAuD;AACvD,6CAAgE;AA8FvD,qGA9FY,iCAAoB,OA8FZ;AA5F7B,+CAAmD;AA0BnD,SAAS,WAAW,CAAC,MAA0B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,IAAI,sBAAa,CAAC;QACvB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,4BAA4B;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,IAAwB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,uBAAU,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,iCAAoB,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAErD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;gBACnF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC/F,wEAAwE;gBACxE,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc;oBACjE,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;gBAEpF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;oBAC7E,GAAG;yBACA,MAAM,CAAC,GAAG,CAAC;yBACX,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;yBACtC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC;yBACjC,IAAI,CAAC,IAAA,gCAAkB,EAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC3G,OAAO;gBACT,CAAC;YACH,CAAC;YAEA,GAA4B,CAAC,MAAM,GAAG,MAAM,CAAC;YAC9C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAGD,kBAAe,cAAc,CAAC"}

package/dist/cjs/cloud/identity/identityStore.d.ts

@@ -1,13 +1,3 @@
-/**
- * Lemma API v2 — identity store (Lane D)
- *
- * Persistence behind TenantResolver. Keys are stored as SHA-256 hashes only:
- * `key_hash` is the sole column that ever touches key material, and every write
- * is a parameterized insert that receives the hash, never the plaintext value.
- *
- * `InMemoryIdentityStore` powers unit tests and local/dev defaults.
- * `PostgresIdentityStore` is the production implementation over `pg`.
- */
 import type { Pool } from 'pg';
 import type { KeyPrefix } from './ApiKey';
 import type { PlanId } from './PlanPolicy';
@@ -29,7 +19,50 @@ export interface KeyRecord {
     createdAt: number;
     expiresAt: number | null;
     revokedAt: number | null;
+    /** The key's tenant is a founder (read with the key, like the plan; never stored on the key). */
+    founder?: boolean;
 }
+/** What Stripe last told us about the tenant's subscription. Display and webhook bookkeeping only: quota code reads `plan`. */
+export interface TenantBilling {
+    customerId: string | null;
+    subscriptionId: string | null;
+    /** Stripe's subscription status verbatim (active, past_due, canceled, ...). */
+    status: string | null;
+    /** Epoch ms of the end of the paid period: the next charge, or the last day of service when cancelling. */
+    currentPeriodEnd: number | null;
+    /** Epoch ms of the first failed payment of the current late streak; null while paid up. */
+    pastDueSince: number | null;
+    /** Epoch ms `created` of the last Stripe event applied; older events are dropped (delivery is unordered). */
+    eventAt: number | null;
+}
+export declare const NO_BILLING: Readonly<TenantBilling>;
+export interface TenantRecord {
+    id: string;
+    name: string;
+    plan: PlanId;
+    createdAt: number;
+    billing: TenantBilling;
+    /** Signed up as a founder: keeps the founder limits whatever the public plans become (migration 009). */
+    founder: boolean;
+}
+/** Outcome of applying a Stripe event to a tenant. */
+export type BillingApplyResult = {
+    ok: true;
+    tenant: TenantRecord;
+} | {
+    ok: false;
+    reason: 'no_tenant' | 'stale';
+};
+/** Outcome of an atomic "issue a key if the tenant still has a free seat". */
+export type SeatedKeyResult = {
+    ok: true;
+    key: KeyRecord;
+} | {
+    ok: false;
+    reason: 'no_tenant' | 'seats_full' | 'duplicate_name';
+    seats: number;
+    used: number;
+};
 export interface IdentityStore {
     /** Look up a key by its hash. The ONLY read path — plaintext never enters a query. */
     findKeyByHash(hash: string): Promise<KeyRecord | null>;
@@ -37,12 +70,52 @@ export interface IdentityStore {
     createKey(input: NewKeyInput): Promise<KeyRecord>;
     /** Soft-revoke: the key dies on the NEXT lookup. No 24h cache can survive this. */
     revokeKey(keyId: string): Promise<boolean>;
+    /** Create a tenant; resolves null when the id is already taken. */
+    createTenant(input: {
+        id: string;
+        name: string;
+        plan: PlanId;
+        founder?: boolean;
+    }): Promise<TenantRecord | null>;
+    getTenant(id: string): Promise<TenantRecord | null>;
+    setTenantPlan(id: string, plan: PlanId): Promise<TenantRecord | null>;
+    /** Mark or unmark a founder. Billing never calls this with false: cancelling drops the plan, not the status. */
+    setTenantFounder(id: string, founder: boolean): Promise<TenantRecord | null>;
+    findTenantByStripeCustomer(customerId: string): Promise<TenantRecord | null>;
+    /**
+     * Write the plan and the full billing state in one statement, unless a NEWER Stripe event was
+     * already applied (`billing.eventAt` older than the stored one): then nothing changes and the
+     * result says `stale`. The caller passes the complete state, so a field is cleared by sending null.
+     */
+    applyBilling(id: string, plan: PlanId, billing: TenantBilling): Promise<BillingApplyResult>;
+    /** Every key the tenant ever had, newest first (hashes are never returned). */
+    listKeys(tenantId: string): Promise<KeyRecord[]>;
+    /**
+     * Issue a key only if the tenant has a free seat (active, unexpired keys < `seats`) and
+     * no active key already carries `input.name`. The check and the insert are atomic: two
+     * concurrent calls can never take the last seat twice.
+     */
+    createKeyWithinSeats(input: NewKeyInput, seats: number): Promise<SeatedKeyResult>;
 }
 /** In-memory store. Records carry the hash only — same invariant as Postgres. */
 export declare class InMemoryIdentityStore implements IdentityStore {
     readonly records: Map<string, KeyRecord>;
     findKeyByHash(hash: string): Promise<KeyRecord | null>;
     createKey(input: NewKeyInput): Promise<KeyRecord>;
+    readonly tenants: Map<string, TenantRecord>;
+    createTenant(input: {
+        id: string;
+        name: string;
+        plan: PlanId;
+        founder?: boolean;
+    }): Promise<TenantRecord | null>;
+    getTenant(id: string): Promise<TenantRecord | null>;
+    setTenantPlan(id: string, plan: PlanId): Promise<TenantRecord | null>;
+    setTenantFounder(id: string, founder: boolean): Promise<TenantRecord | null>;
+    findTenantByStripeCustomer(customerId: string): Promise<TenantRecord | null>;
+    applyBilling(id: string, plan: PlanId, billing: TenantBilling): Promise<BillingApplyResult>;
+    listKeys(tenantId: string): Promise<KeyRecord[]>;
+    createKeyWithinSeats(input: NewKeyInput, seats: number): Promise<SeatedKeyResult>;
     revokeKey(keyId: string): Promise<boolean>;
 }
 /** Production store. All queries parameterized; key material appears only as hashed params. */
@@ -51,6 +124,19 @@ export declare class PostgresIdentityStore implements IdentityStore {
     constructor(pool: Pool);
     findKeyByHash(hash: string): Promise<KeyRecord | null>;
     createKey(input: NewKeyInput): Promise<KeyRecord>;
+    createTenant(input: {
+        id: string;
+        name: string;
+        plan: PlanId;
+        founder?: boolean;
+    }): Promise<TenantRecord | null>;
+    getTenant(id: string): Promise<TenantRecord | null>;
+    setTenantFounder(id: string, founder: boolean): Promise<TenantRecord | null>;
+    setTenantPlan(id: string, plan: PlanId): Promise<TenantRecord | null>;
+    findTenantByStripeCustomer(customerId: string): Promise<TenantRecord | null>;
+    applyBilling(id: string, plan: PlanId, b: TenantBilling): Promise<BillingApplyResult>;
+    listKeys(tenantId: string): Promise<KeyRecord[]>;
+    createKeyWithinSeats(input: NewKeyInput, seats: number): Promise<SeatedKeyResult>;
     revokeKey(keyId: string): Promise<boolean>;
 }
 //# sourceMappingURL=identityStore.d.ts.map

package/dist/cjs/cloud/identity/identityStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identityStore.d.ts","sourceRoot":"","sources":["../../../../src/cloud/identity/identityStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACvD,sFAAsF;IACtF,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,mFAAmF;IACnF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AAED,iFAAiF;AACjF,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,OAAO,yBAAgC;IAE1C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAItD,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IAgBjD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAWjD;AAED,+FAA+F;AAC/F,qBAAa,qBAAsB,YAAW,aAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAwBtD,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IA6BjD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CASjD"}
+{"version":3,"file":"identityStore.d.ts","sourceRoot":"","sources":["../../../../src/cloud/identity/identityStore.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iGAAiG;IACjG,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,+HAA+H;AAC/H,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2GAA2G;IAC3G,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,2FAA2F;IAC3F,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,6GAA6G;IAC7G,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,aAAa,CAO7C,CAAC;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,yGAAyG;IACzG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,sDAAsD;AACtD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAA;CAAE,CAAC;AAEnH,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,YAAY,GAAG,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtG,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACvD,sFAAsF;IACtF,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,mFAAmF;IACnF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3C,mEAAmE;IACnE,YAAY,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACjH,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACpD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACtE,gHAAgH;IAChH,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC7E,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC7E;;;;OAIG;IACH,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5F,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACjD;;;;OAIG;IACH,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACnF;AAID,iFAAiF;AACjF,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,OAAO,yBAAgC;IAE1C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAOtD,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IAkBvD,QAAQ,CAAC,OAAO,4BAAmC;IAE7C,YAAY,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAOhH,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAKnD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAOrE,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAO5E,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAK5E,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAS3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAIhD,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAWjF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAWjD;AAED,+FAA+F;AAC/F,qBAAa,qBAAsB,YAAW,aAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAyBtD,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IA6BjD,YAAY,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAUhH,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAUnD,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAQ5E,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAQrE,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAU5E,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAerF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAUhD,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAyCjF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CASjD"}

package/dist/cjs/cloud/identity/identityStore.js

@@ -1,17 +1,47 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PostgresIdentityStore = exports.InMemoryIdentityStore = void 0;
+exports.PostgresIdentityStore = exports.InMemoryIdentityStore = exports.NO_BILLING = void 0;
+/**
+ * Lemma API v2 — identity store (Lane D)
+ *
+ * Persistence behind TenantResolver. Keys are stored as SHA-256 hashes only:
+ * `key_hash` is the sole column that ever touches key material, and every write
+ * is a parameterized insert that receives the hash, never the plaintext value.
+ *
+ * `InMemoryIdentityStore` powers unit tests and local/dev defaults.
+ * `PostgresIdentityStore` is the production implementation over `pg`.
+ */
+const crypto_1 = __importDefault(require("crypto"));
+exports.NO_BILLING = Object.freeze({
+    customerId: null,
+    subscriptionId: null,
+    status: null,
+    currentPeriodEnd: null,
+    pastDueSince: null,
+    eventAt: null,
+});
+const isLive = (r, now) => r.active && (r.expiresAt === null || r.expiresAt > now);
 /** In-memory store. Records carry the hash only — same invariant as Postgres. */
 class InMemoryIdentityStore {
     constructor() {
         this.records = new Map();
+        this.tenants = new Map();
     }
     async findKeyByHash(hash) {
-        return this.records.get(hash) ?? null;
+        const r = this.records.get(hash);
+        if (!r)
+            return null;
+        // Read with the key, as the Postgres join does: a founder flag set later reaches the next request.
+        return this.tenants.get(r.tenantId)?.founder ? { ...r, founder: true } : r;
     }
     async createKey(input) {
         const record = {
-            id: 'key_' + Math.random().toString(16).slice(2, 14),
+            // Always 12 hex chars, like the Postgres ids. Math.random().toString(16) drops trailing zeros,
+            // so slicing it yielded an 11-char id now and then: a key that /v2/admin could not address.
+            id: 'key_' + crypto_1.default.randomBytes(6).toString('hex'),
             tenantId: input.tenantId,
             name: input.name,
             plan: input.plan,
@@ -24,6 +54,63 @@ class InMemoryIdentityStore {
         this.records.set(input.hash, record);
         return record;
     }
+    async createTenant(input) {
+        if (this.tenants.has(input.id))
+            return null;
+        const t = { id: input.id, name: input.name, plan: input.plan, createdAt: Date.now(), billing: { ...exports.NO_BILLING }, founder: input.founder === true };
+        this.tenants.set(input.id, t);
+        return { ...t };
+    }
+    async getTenant(id) {
+        const t = this.tenants.get(id);
+        return t ? { ...t } : null;
+    }
+    async setTenantPlan(id, plan) {
+        const t = this.tenants.get(id);
+        if (!t)
+            return null;
+        t.plan = plan;
+        return { ...t };
+    }
+    async setTenantFounder(id, founder) {
+        const t = this.tenants.get(id);
+        if (!t)
+            return null;
+        t.founder = founder;
+        return { ...t };
+    }
+    async findTenantByStripeCustomer(customerId) {
+        for (const t of this.tenants.values())
+            if (t.billing.customerId === customerId)
+                return { ...t, billing: { ...t.billing } };
+        return null;
+    }
+    async applyBilling(id, plan, billing) {
+        const t = this.tenants.get(id);
+        if (!t)
+            return { ok: false, reason: 'no_tenant' };
+        if (t.billing.eventAt !== null && billing.eventAt !== null && billing.eventAt < t.billing.eventAt)
+            return { ok: false, reason: 'stale' };
+        t.plan = plan;
+        t.billing = { ...billing };
+        return { ok: true, tenant: { ...t, billing: { ...t.billing } } };
+    }
+    async listKeys(tenantId) {
+        return [...this.records.values()].filter((r) => r.tenantId === tenantId).sort((a, b) => b.createdAt - a.createdAt).map((r) => ({ ...r }));
+    }
+    async createKeyWithinSeats(input, seats) {
+        // Synchronous between the check and the insert, so it is atomic on a single event loop.
+        const tenant = this.tenants.get(input.tenantId);
+        if (!tenant)
+            return { ok: false, reason: 'no_tenant', seats, used: 0 };
+        const now = Date.now();
+        const live = [...this.records.values()].filter((r) => r.tenantId === input.tenantId && isLive(r, now));
+        if (live.some((r) => r.name === input.name))
+            return { ok: false, reason: 'duplicate_name', seats, used: live.length };
+        if (live.length >= seats)
+            return { ok: false, reason: 'seats_full', seats, used: live.length };
+        return { ok: true, key: await this.createKey({ ...input, plan: tenant.plan }) };
+    }
     async revokeKey(keyId) {
         let found = false;
         for (const record of this.records.values()) {
@@ -43,7 +130,7 @@ class PostgresIdentityStore {
         this.pool = pool;
     }
     async findKeyByHash(hash) {
-        const { rows } = await this.pool.query(`SELECT k.id, k.tenant_id, t.plan, k.name, k.prefix, k.active,
+        const { rows } = await this.pool.query(`SELECT k.id, k.tenant_id, t.plan, t.founder, k.name, k.prefix, k.active,
               k.created_at, k.expires_at, k.revoked_at
          FROM api_keys k
          JOIN tenants t ON t.id = k.tenant_id
@@ -61,6 +148,7 @@ class PostgresIdentityStore {
             createdAt: new Date(r.created_at).getTime(),
             expiresAt: r.expires_at ? new Date(r.expires_at).getTime() : null,
             revokedAt: r.revoked_at ? new Date(r.revoked_at).getTime() : null,
+            ...(r.founder === true ? { founder: true } : {}),
         };
     }
     async createKey(input) {
@@ -88,6 +176,86 @@ class PostgresIdentityStore {
             revokedAt: null,
         };
     }
+    async createTenant(input) {
+        const { rows } = await this.pool.query(`INSERT INTO tenants (id, name, plan, founder) VALUES ($1, $2, $3, $4)
+       ON CONFLICT (id) DO NOTHING
+       RETURNING id, name, plan, created_at, stripe_customer_id, stripe_subscription_id, subscription_status, current_period_end, past_due_since, billing_event_at, founder`, [input.id, input.name, input.plan, input.founder === true]);
+        return rows.length ? toTenant(rows[0]) : null;
+    }
+    async getTenant(id) {
+        const { rows } = await this.pool.query(`SELECT id, name, plan, created_at, stripe_customer_id, stripe_subscription_id, subscription_status,
+              current_period_end, past_due_since, billing_event_at, founder
+         FROM tenants WHERE id = $1`, [id]);
+        return rows.length ? toTenant(rows[0]) : null;
+    }
+    async setTenantFounder(id, founder) {
+        const { rows } = await this.pool.query(`UPDATE tenants SET founder = $2, updated_at = now() WHERE id = $1 RETURNING id, name, plan, created_at, stripe_customer_id, stripe_subscription_id, subscription_status, current_period_end, past_due_since, billing_event_at, founder`, [id, founder]);
+        return rows.length ? toTenant(rows[0]) : null;
+    }
+    async setTenantPlan(id, plan) {
+        const { rows } = await this.pool.query(`UPDATE tenants SET plan = $2, updated_at = now() WHERE id = $1 RETURNING id, name, plan, created_at, stripe_customer_id, stripe_subscription_id, subscription_status, current_period_end, past_due_since, billing_event_at, founder`, [id, plan]);
+        return rows.length ? toTenant(rows[0]) : null;
+    }
+    async findTenantByStripeCustomer(customerId) {
+        const { rows } = await this.pool.query(`SELECT id, name, plan, created_at, stripe_customer_id, stripe_subscription_id, subscription_status,
+              current_period_end, past_due_since, billing_event_at, founder
+         FROM tenants WHERE stripe_customer_id = $1`, [customerId]);
+        return rows.length ? toTenant(rows[0]) : null;
+    }
+    async applyBilling(id, plan, b) {
+        const at = (ms) => (ms === null ? null : new Date(ms));
+        const { rows } = await this.pool.query(`UPDATE tenants
+          SET plan = $2, stripe_customer_id = $3, stripe_subscription_id = $4, subscription_status = $5,
+              current_period_end = $6, past_due_since = $7, billing_event_at = $8, updated_at = now()
+        WHERE id = $1 AND (billing_event_at IS NULL OR $8::timestamptz IS NULL OR billing_event_at <= $8::timestamptz)
+        RETURNING id, name, plan, created_at, stripe_customer_id, stripe_subscription_id, subscription_status, current_period_end, past_due_since, billing_event_at, founder`, [id, plan, b.customerId, b.subscriptionId, b.status, at(b.currentPeriodEnd), at(b.pastDueSince), at(b.eventAt)]);
+        if (rows.length)
+            return { ok: true, tenant: toTenant(rows[0]) };
+        // No row updated: either the tenant does not exist or a newer event already won.
+        return { ok: false, reason: (await this.getTenant(id)) ? 'stale' : 'no_tenant' };
+    }
+    async listKeys(tenantId) {
+        const { rows } = await this.pool.query(`SELECT k.id, k.tenant_id, t.plan, k.name, k.prefix, k.active, k.created_at, k.expires_at, k.revoked_at
+         FROM api_keys k JOIN tenants t ON t.id = k.tenant_id
+        WHERE k.tenant_id = $1 ORDER BY k.created_at DESC, k.id`, [tenantId]);
+        return rows.map(toKey);
+    }
+    async createKeyWithinSeats(input, seats) {
+        const client = await this.pool.connect();
+        try {
+            await client.query('BEGIN');
+            // The tenant row is the lock: concurrent issuers for one tenant queue here, so the
+            // count below cannot go stale before the insert.
+            const t = await client.query('SELECT plan FROM tenants WHERE id = $1 FOR UPDATE', [input.tenantId]);
+            if (!t.rows.length) {
+                await client.query('ROLLBACK');
+                return { ok: false, reason: 'no_tenant', seats, used: 0 };
+            }
+            const live = await client.query(`SELECT name FROM api_keys
+          WHERE tenant_id = $1 AND active = TRUE AND (expires_at IS NULL OR expires_at > now())`, [input.tenantId]);
+            if (live.rows.some((r) => r.name === input.name)) {
+                await client.query('ROLLBACK');
+                return { ok: false, reason: 'duplicate_name', seats, used: live.rows.length };
+            }
+            if (live.rows.length >= seats) {
+                await client.query('ROLLBACK');
+                return { ok: false, reason: 'seats_full', seats, used: live.rows.length };
+            }
+            const plan = t.rows[0].plan;
+            const ins = await client.query(`INSERT INTO api_keys (id, tenant_id, name, key_hash, prefix, plan, active)
+         VALUES ($1, $2, $3, $4, $5, $6, TRUE)
+         RETURNING id, tenant_id, name, prefix, active, created_at, expires_at, revoked_at`, ['key_' + input.hash.slice(0, 12), input.tenantId, input.name, input.hash, input.prefix, plan]);
+            await client.query('COMMIT');
+            return { ok: true, key: toKey({ ...ins.rows[0], plan }) };
+        }
+        catch (err) {
+            await client.query('ROLLBACK').catch(() => undefined);
+            throw err;
+        }
+        finally {
+            client.release();
+        }
+    }
     async revokeKey(keyId) {
         const { rowCount } = await this.pool.query(`UPDATE api_keys
           SET active = FALSE, revoked_at = CURRENT_TIMESTAMP
@@ -96,4 +264,35 @@ class PostgresIdentityStore {
     }
 }
 exports.PostgresIdentityStore = PostgresIdentityStore;
+function toTenant(r) {
+    const ms = (v) => (v ? new Date(v).getTime() : null);
+    return {
+        id: r.id,
+        name: r.name ?? '',
+        plan: r.plan,
+        createdAt: new Date(r.created_at).getTime(),
+        billing: {
+            customerId: r.stripe_customer_id ?? null,
+            subscriptionId: r.stripe_subscription_id ?? null,
+            status: r.subscription_status ?? null,
+            currentPeriodEnd: ms(r.current_period_end),
+            pastDueSince: ms(r.past_due_since),
+            eventAt: ms(r.billing_event_at),
+        },
+        founder: r.founder === true,
+    };
+}
+function toKey(r) {
+    return {
+        id: r.id,
+        tenantId: r.tenant_id,
+        plan: r.plan,
+        name: r.name ?? '',
+        prefix: r.prefix,
+        active: r.active,
+        createdAt: new Date(r.created_at).getTime(),
+        expiresAt: r.expires_at ? new Date(r.expires_at).getTime() : null,
+        revokedAt: r.revoked_at ? new Date(r.revoked_at).getTime() : null,
+    };
+}
 //# sourceMappingURL=identityStore.js.map

package/dist/cjs/cloud/identity/identityStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"identityStore.js","sourceRoot":"","sources":["../../../../src/cloud/identity/identityStore.ts"],"names":[],"mappings":";;;AA4CA,iFAAiF;AACjF,MAAa,qBAAqB;IAAlC;QACW,YAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAiClD,CAAC;IA/BC,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAkB;QAChC,MAAM,MAAM,GAAc;YACxB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;SAChB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;gBACtB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC9B,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAlCD,sDAkCC;AAED,+FAA+F;AAC/F,MAAa,qBAAqB;IAChC,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;;;8BAIwB,EACxB,CAAC,IAAI,CAAC,CACP,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,IAAI,EAAE,CAAC,CAAC,IAAc;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,MAAM,EAAE,CAAC,CAAC,MAAmB;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;YAC3C,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YACjE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;SAClE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAkB;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;8EAEwE,EACxE;YACE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChC,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,IAAI;YACV,IAAI;SACL,CACF,CAAC;QACF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,CAAC,MAAmB;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;YAC3C,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YACjE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACxC;;wCAEkC,EAClC,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;CACF;AAjED,sDAiEC"}
+{"version":3,"file":"identityStore.js","sourceRoot":"","sources":["../../../../src/cloud/identity/identityStore.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;GASG;AACH,oDAA4B;AA0Cf,QAAA,UAAU,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC/D,UAAU,EAAE,IAAI;IAChB,cAAc,EAAE,IAAI;IACpB,MAAM,EAAE,IAAI;IACZ,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,IAAI;IAClB,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAmDH,MAAM,MAAM,GAAG,CAAC,CAAY,EAAE,GAAW,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;AAE/G,iFAAiF;AACjF,MAAa,qBAAqB;IAAlC;QACW,YAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;QA2BvC,YAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAoErD,CAAC;IA7FC,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,mGAAmG;QACnG,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAkB;QAChC,MAAM,MAAM,GAAc;YACxB,+FAA+F;YAC/F,4FAA4F;YAC5F,EAAE,EAAE,MAAM,GAAG,gBAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;SAChB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAID,KAAK,CAAC,YAAY,CAAC,KAAoE;QACrF,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,CAAC,GAAiB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,kBAAU,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACjK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,IAAY;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;QACd,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,OAAgB;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;QACpB,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,UAAkB;QACjD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU;gBAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3H,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,IAAY,EAAE,OAAsB;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACzI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;QACd,CAAC,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5I,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAkB,EAAE,KAAa;QAC1D,wFAAwF;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACtH,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;gBACtB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC9B,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAhGD,sDAgGC;AAED,+FAA+F;AAC/F,MAAa,qBAAqB;IAChC,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;;;8BAIwB,EACxB,CAAC,IAAI,CAAC,CACP,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,IAAI,EAAE,CAAC,CAAC,IAAc;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,MAAM,EAAE,CAAC,CAAC,MAAmB;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;YAC3C,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YACjE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YACjE,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAkB;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;8EAEwE,EACxE;YACE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChC,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,IAAI;YACV,IAAI;SACL,CACF,CAAC;QACF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,CAAC,MAAmB;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;YAC3C,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YACjE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAoE;QACrF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;4KAEsK,EACtK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAC3D,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;oCAE8B,EAC9B,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,OAAgB;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC,wOAAwO,EACxO,CAAC,EAAE,EAAE,OAAO,CAAC,CACd,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,IAAY;QAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC,qOAAqO,EACrO,CAAC,EAAE,EAAE,IAAI,CAAC,CACX,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,UAAkB;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;oDAE8C,EAC9C,CAAC,UAAU,CAAC,CACb,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,IAAY,EAAE,CAAgB;QAC3D,MAAM,EAAE,GAAG,CAAC,EAAiB,EAAe,EAAE,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;;;6KAIuK,EACvK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAChH,CAAC;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,iFAAiF;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;gEAE0D,EAC1D,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAkB,EAAE,KAAa;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,mFAAmF;YACnF,iDAAiD;YACjD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7B;gGACwF,EACxF,CAAC,KAAK,CAAC,QAAQ,CAAC,CACjB,CAAC;YACF,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAChF,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC9B,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5E,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAc,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;2FAEmF,EACnF,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAC/F,CAAC;YACF,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACxC;;wCAEkC,EAClC,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;CACF;AAlLD,sDAkLC;AAED,SAAS,QAAQ,CAAC,CAAsB;IACtC,MAAM,EAAE,GAAG,CAAC,CAAmC,EAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtG,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,IAAI,EAAE,CAAC,CAAC,IAAc;QACtB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;QAC3C,OAAO,EAAE;YACP,UAAU,EAAE,CAAC,CAAC,kBAAkB,IAAI,IAAI;YACxC,cAAc,EAAE,CAAC,CAAC,sBAAsB,IAAI,IAAI;YAChD,MAAM,EAAE,CAAC,CAAC,mBAAmB,IAAI,IAAI;YACrC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;YAC1C,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;YAClC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;SAChC;QACD,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,CAAsB;IACnC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,IAAI,EAAE,CAAC,CAAC,IAAc;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,MAAmB;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;QAC3C,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QACjE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;KAClE,CAAC;AACJ,CAAC"}

package/dist/cjs/cloud/metering/PostgresLedgerStore.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Lemma API v2 — durable usage ledger on Postgres (migration 003_usage.sql).
+ *
+ * Append-only by construction: the only write is INSERT. Reads are aggregated in SQL so
+ * /v2/usage costs one grouped query however many events a tenant has accumulated.
+ */
+import type { Pool } from 'pg';
+import type { AggregateRow, AppendOnlyStore, DailyQuery, DailyRow, LedgerEvent, UsageQuery } from './UsageLedger';
+export declare class PostgresLedgerStore implements AppendOnlyStore {
+    private readonly pool;
+    constructor(pool: Pool);
+    append(row: LedgerEvent): Promise<void>;
+    rows(): Promise<LedgerEvent[]>;
+    /** One grouped query over idx_usage_events_tenant_at; the day is the UTC calendar day of `at`. */
+    daily(query: DailyQuery): Promise<DailyRow[]>;
+    aggregate(query: UsageQuery): Promise<AggregateRow[]>;
+}
+//# sourceMappingURL=PostgresLedgerStore.d.ts.map

package/dist/cjs/cloud/metering/PostgresLedgerStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresLedgerStore.d.ts","sourceRoot":"","sources":["../../../../src/cloud/metering/PostgresLedgerStore.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAElH,qBAAa,mBAAoB,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvC,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAKpC,kGAAkG;IAC5F,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAe7C,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;CAoB5D"}

package/dist/cjs/cloud/metering/PostgresLedgerStore.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostgresLedgerStore = void 0;
+class PostgresLedgerStore {
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async append(row) {
+        await this.pool.query('INSERT INTO usage_events (id, tenant_id, key_id, kind, tokens, at) VALUES ($1, $2, $3, $4, $5, $6)', [row.id, row.tenantId, row.keyId ?? null, row.kind, row.tokens, row.at]);
+    }
+    async rows() {
+        const { rows } = await this.pool.query('SELECT id, tenant_id, key_id, kind, tokens, at FROM usage_events ORDER BY at, id');
+        return rows.map(toEvent);
+    }
+    /** One grouped query over idx_usage_events_tenant_at; the day is the UTC calendar day of `at`. */
+    async daily(query) {
+        const { rows } = await this.pool.query(`SELECT to_char(to_timestamp(at / 1000.0) AT TIME ZONE 'UTC', 'YYYY-MM-DD') AS day,
+              key_id,
+              count(*)::int                    AS events,
+              COALESCE(sum(tokens), 0)::bigint AS tokens,
+              max(at)::bigint                  AS last_at
+         FROM usage_events
+        WHERE tenant_id = $1 AND at >= $2 AND ($3::bigint IS NULL OR at <= $3) AND kind LIKE 'api.%'
+        GROUP BY 1, 2`, [query.tenantId, query.since, query.until ?? null]);
+        return rows.map((r) => ({ day: r.day, keyId: r.key_id ?? null, events: Number(r.events), tokens: Number(r.tokens), lastAt: Number(r.last_at) }));
+    }
+    async aggregate(query) {
+        const { rows } = await this.pool.query(`SELECT kind, key_id,
+              count(*)::int                                   AS events,
+              COALESCE(sum(tokens), 0)::bigint                AS tokens,
+              count(*) FILTER (WHERE tokens IS NULL)::int     AS excluded
+         FROM usage_events
+        WHERE ($1::text IS NULL OR tenant_id = $1)
+          AND ($2::bigint IS NULL OR at >= $2)
+        GROUP BY kind, key_id`, [query.tenantId ?? null, query.since ?? null]);
+        return rows.map((r) => ({
+            kind: r.kind,
+            keyId: r.key_id ?? null,
+            events: Number(r.events),
+            tokens: Number(r.tokens),
+            excluded: Number(r.excluded),
+        }));
+    }
+}
+exports.PostgresLedgerStore = PostgresLedgerStore;
+function toEvent(r) {
+    return {
+        id: r.id,
+        tenantId: r.tenant_id,
+        keyId: r.key_id ?? null,
+        kind: r.kind,
+        tokens: r.tokens === null ? null : Number(r.tokens),
+        at: Number(r.at),
+    };
+}
+//# sourceMappingURL=PostgresLedgerStore.js.map

package/dist/cjs/cloud/metering/PostgresLedgerStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresLedgerStore.js","sourceRoot":"","sources":["../../../../src/cloud/metering/PostgresLedgerStore.ts"],"names":[],"mappings":";;;AASA,MAAa,mBAAmB;IAC9B,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,KAAK,CAAC,MAAM,CAAC,GAAgB;QAC3B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,oGAAoG,EACpG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CACxE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAC3H,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;;;;;;sBAOgB,EAChB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CACnD,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAa,EAAE,KAAK,EAAG,CAAC,CAAC,MAAwB,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAChL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAiB;QAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;;;;;;8BAOwB,EACxB,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAC9C,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,IAAI,EAAE,CAAC,CAAC,IAAc;YACtB,KAAK,EAAG,CAAC,CAAC,MAAwB,IAAI,IAAI;YAC1C,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YACxB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC;CACF;AAnDD,kDAmDC;AAED,SAAS,OAAO,CAAC,CAAsB;IACrC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QACvB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACjB,CAAC;AACJ,CAAC"}

package/dist/cjs/cloud/metering/UsageLedger.d.ts

@@ -4,18 +4,72 @@ import type { UsageResponse } from '../../contracts/api-v2.types';
 export interface AppendOnlyStore {
     append(row: LedgerEvent): Promise<void> | void;
     rows(): LedgerEvent[] | Promise<LedgerEvent[]>;
+    /**
+     * Optional pushdown of the usage math. A durable store that holds millions of rows
+     * should answer from the database instead of shipping every row to the process.
+     * Must produce exactly what `aggregateRows(await rows(), query)` would.
+     */
+    aggregate?(query: UsageQuery): Promise<AggregateRow[]>;
+    /**
+     * Optional pushdown of the daily API activity (api.* rows only), grouped by UTC day and key.
+     * Must produce exactly what `dailyRows(await rows(), query)` would.
+     */
+    daily?(query: DailyQuery): Promise<DailyRow[]>;
+}
+export interface DailyQuery {
+    tenantId: string;
+    since: number;
+    /** Last moment of the window (ms epoch); defaults to the ledger's clock. Days are listed through its UTC day. */
+    until?: number;
+}
+/** API activity of one key on one UTC day. */
+export interface DailyRow {
+    /** YYYY-MM-DD, UTC. */
+    day: string;
+    keyId: string | null;
+    events: number;
+    tokens: number;
+    /** Latest event of that key that day (ms epoch). */
+    lastAt: number;
+}
+export declare function dailyRows(rows: LedgerEvent[], query: DailyQuery): DailyRow[];
+/** Daily API activity of a tenant: every day of the window (zero-filled) and when each key was last seen. */
+export interface DailyActivity {
+    since: number;
+    days: Array<{
+        day: string;
+        requests: number;
+        tokens: number;
+    }>;
+    lastSeen: Record<string, number>;
 }
+/** One group of ledger rows: same kind, same key. */
+export interface AggregateRow {
+    kind: string;
+    keyId: string | null;
+    /** Rows in the group, measured or not. */
+    events: number;
+    /** Sum of the measured (non-null) token counts. */
+    tokens: number;
+    /** Rows whose count could not be measured. */
+    excluded: number;
+}
+/** Reference implementation of the grouping; the in-memory store and the tests use it. */
+export declare function aggregateRows(rows: LedgerEvent[], query?: UsageQuery): AggregateRow[];
 /** In-memory append-only store (the default backing). Only ever grows. */
 export declare class InMemoryLedgerStore implements AppendOnlyStore {
     private readonly ledger;
     append(row: LedgerEvent): void;
     rows(): LedgerEvent[];
+    aggregate(query: UsageQuery): Promise<AggregateRow[]>;
     /** Test seam: reset the ledger. Never used by production paths. */
     clear(): void;
 }
 export interface LedgerEvent {
     id: string;
     tenantId: string;
+    /** The API key (the dev) that made the call, when the event comes from an API request. */
+    keyId?: string | null;
     kind: string;
     /** Measured token count, or `null` when no reliable count could be produced. */
     tokens: number | null;
@@ -24,6 +78,7 @@ export interface LedgerEvent {
 }
 export interface AppendEvent {
     tenantId: string;
+    keyId?: string | null;
     kind: string;
     /** Measured tokens, or `null` when the count was unreliable. */
     tokens: number | null;
@@ -63,6 +118,25 @@ export declare class UsageLedger {
      * `excludedEvents`.
      */
     computeUsage(query?: UsageQuery): Promise<UsageResponse>;
+    /**
+     * Per-key breakdown of API activity (who made how many calls and moved how many tokens).
+     * Operator-facing: it is what billing per seat and a usage dashboard are built on.
+     */
+    computeKeyActivity(query?: UsageQuery): Promise<KeyActivity[]>;
+    /**
+     * Requests per UTC day over the window starting at `since` (the console's activity chart), every day
+     * present even when idle, plus the latest request of each key in that window.
+     */
+    computeDailyActivity(query: DailyQuery): Promise<DailyActivity>;
+    private groups;
+}
+/** Ledger kinds that start with this are API requests the server itself observed. */
+export declare const API_KIND_PREFIX = "api.";
+export interface KeyActivity {
+    keyId: string;
+    requests: number;
+    tokens: number;
+    byOperation: Record<string, number>;
 }
 export default UsageLedger;
 //# sourceMappingURL=UsageLedger.d.ts.map