@overlordai/server 1.0.1

package/dist/adapters/lark/lark.controller.js

@@ -0,0 +1,120 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var LarkController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LarkController = void 0;
+const common_1 = require("@nestjs/common");
+const lark_adapter_1 = require("./lark.adapter");
+const dispatcher_service_1 = require("../../dispatcher/dispatcher.service");
+const lark_card_builder_1 = require("./lark-card.builder");
+/**
+ * POST /webhook/lark
+ *
+ * Single endpoint for all Lark webhook events:
+ * - URL verification (challenge)
+ * - im.message.receive_v1 (messages)
+ * - card.action.trigger (button callbacks)
+ */
+let LarkController = LarkController_1 = class LarkController {
+    larkAdapter;
+    dispatcher;
+    cardBuilder;
+    logger = new common_1.Logger(LarkController_1.name);
+    constructor(larkAdapter, dispatcher, cardBuilder) {
+        this.larkAdapter = larkAdapter;
+        this.dispatcher = dispatcher;
+        this.cardBuilder = cardBuilder;
+    }
+    async handleWebhook(req, res) {
+        const body = req.body;
+        // 1. Handle URL verification challenge
+        if (body.type === 'url_verification' && typeof body.challenge === 'string') {
+            res.status(common_1.HttpStatus.OK).json({ challenge: body.challenge });
+            return;
+        }
+        // 2. Handle card action callback — return updated card JSON
+        const header = body.header;
+        if (header?.event_type === 'card.action.trigger') {
+            // handleWebhook processes the card action internally
+            await this.larkAdapter.handleWebhook(req);
+            // Card action callbacks expect a card JSON response to update the card
+            const event = body.event;
+            const action = event?.action;
+            const value = action?.value;
+            if (value?.taskId !== undefined && value?.result !== undefined) {
+                const updatedCard = this.cardBuilder.buildSelectedCard(value.taskId, String(value.result));
+                const cardJson = this.cardBuilder.toLarkCardJson(updatedCard);
+                res.status(common_1.HttpStatus.OK).json(JSON.parse(cardJson));
+                return;
+            }
+            res.status(common_1.HttpStatus.OK).json({});
+            return;
+        }
+        // 3. Handle regular message events
+        try {
+            const command = await this.larkAdapter.handleWebhook(req);
+            if (command) {
+                // Dispatch the command and handle the result
+                const result = await this.dispatcher.handleCommand(command);
+                // Send response back to chat
+                if (result.task) {
+                    const card = this.cardBuilder.buildTaskCard(result.task);
+                    await this.larkAdapter.sendMessage(command.chat.id, card);
+                }
+                else if (result.confirmRequired) {
+                    const card = this.cardBuilder.buildDedupConfirmCard(result.confirmRequired.taskId ?? 0, result.confirmRequired.message, result.confirmRequired.confirmKey);
+                    await this.larkAdapter.sendMessage(command.chat.id, card);
+                }
+                else if (result.tasks) {
+                    // List command — send a summary text
+                    const lines = result.tasks.map((t) => `#${t.id} [${t.status}] ${t.description.slice(0, 40)}`);
+                    const text = lines.length > 0
+                        ? `Active tasks:\n${lines.join('\n')}`
+                        : 'No active tasks.';
+                    await this.larkAdapter.sendMessage(command.chat.id, {
+                        type: 'text',
+                        text,
+                    });
+                }
+                else if (result.message) {
+                    await this.larkAdapter.sendMessage(command.chat.id, {
+                        type: 'text',
+                        text: result.message,
+                    });
+                }
+            }
+            res.status(common_1.HttpStatus.OK).json({});
+        }
+        catch (err) {
+            this.logger.error(`Webhook processing error: ${err instanceof Error ? err.message : String(err)}`);
+            res.status(common_1.HttpStatus.OK).json({});
+        }
+    }
+};
+exports.LarkController = LarkController;
+__decorate([
+    (0, common_1.Post)('lark'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], LarkController.prototype, "handleWebhook", null);
+exports.LarkController = LarkController = LarkController_1 = __decorate([
+    (0, common_1.Controller)('webhook'),
+    __metadata("design:paramtypes", [lark_adapter_1.LarkAdapter,
+        dispatcher_service_1.DispatcherService,
+        lark_card_builder_1.LarkCardBuilder])
+], LarkController);
+//# sourceMappingURL=lark.controller.js.map

package/dist/adapters/lark/lark.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lark.controller.js","sourceRoot":"","sources":["../../../src/adapters/lark/lark.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAOwB;AAExB,iDAA6C;AAC7C,4EAAwE;AACxE,2DAAsD;AAEtD;;;;;;;GAOG;AAEI,IAAM,cAAc,sBAApB,MAAM,cAAc;IAIN;IACA;IACA;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAE1D,YACmB,WAAwB,EACxB,UAA6B,EAC7B,WAA4B;QAF5B,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAmB;QAC7B,gBAAW,GAAX,WAAW,CAAiB;IAC5C,CAAC;IAGE,AAAN,KAAK,CAAC,aAAa,CACV,GAAY,EACZ,GAAa;QAEpB,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;QAEjD,uCAAuC;QACvC,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,4DAA4D;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6C,CAAC;QAClE,IAAI,MAAM,EAAE,UAAU,KAAK,qBAAqB,EAAE,CAAC;YACjD,qDAAqD;YACrD,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAE1C,uEAAuE;YACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAA4C,CAAC;YAChE,MAAM,MAAM,GAAG,KAAK,EAAE,MAAyD,CAAC;YAChF,MAAM,KAAK,GAAG,MAAM,EAAE,KAGT,CAAC;YAEd,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CACpD,KAAK,CAAC,MAAM,EACZ,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CACrB,CAAC;gBACF,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;gBAC9D,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAE1D,IAAI,OAAO,EAAE,CAAC;gBACZ,6CAA6C;gBAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAE5D,6BAA6B;gBAC7B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAChB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACzD,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC5D,CAAC;qBAAM,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;oBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,qBAAqB,CACjD,MAAM,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,EAClC,MAAM,CAAC,eAAe,CAAC,OAAO,EAC9B,MAAM,CAAC,eAAe,CAAC,UAAU,CAClC,CAAC;oBACF,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC5D,CAAC;qBAAM,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACxB,qCAAqC;oBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAC9D,CAAC;oBACF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;wBAC3B,CAAC,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBACtC,CAAC,CAAC,kBAAkB,CAAC;oBACvB,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE;wBAClD,IAAI,EAAE,MAAM;wBACZ,IAAI;qBACL,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE;wBAClD,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,MAAM,CAAC,OAAO;qBACrB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChF,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;CACF,CAAA;AAjGY,wCAAc;AAUnB;IADL,IAAA,aAAI,EAAC,MAAM,CAAC;IAEV,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAoFP;yBAhGU,cAAc;IAD1B,IAAA,mBAAU,EAAC,SAAS,CAAC;qCAKY,0BAAW;QACZ,sCAAiB;QAChB,mCAAe;GANpC,cAAc,CAiG1B"}

package/dist/adapters/slack/slack.adapter.d.ts

@@ -0,0 +1,19 @@
+import type { Request } from 'express';
+import type { Command, DeveloperPublic } from '@overlordai/protocol';
+import { Platform } from '@overlordai/protocol';
+import type { IMessageAdapter, AdapterMessage } from '../adapter.interface';
+/**
+ * Slack Adapter — V2 placeholder (stub implementation).
+ *
+ * This adapter satisfies the IMessageAdapter interface but does not implement
+ * any real Slack integration. It logs warnings for all method calls.
+ */
+export declare class SlackAdapter implements IMessageAdapter {
+    readonly platform = Platform.SLACK;
+    private readonly logger;
+    handleWebhook(_req: Request): Promise<Command | null>;
+    sendMessage(_chatId: string, _content: AdapterMessage): Promise<string>;
+    updateMessage(_msgId: string, _content: AdapterMessage): Promise<void>;
+    resolveUser(_platformUid: string): Promise<DeveloperPublic | null>;
+}
+//# sourceMappingURL=slack.adapter.d.ts.map

package/dist/adapters/slack/slack.adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.adapter.d.ts","sourceRoot":"","sources":["../../../src/adapters/slack/slack.adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE5E;;;;;GAKG;AACH,qBACa,YAAa,YAAW,eAAe;IAClD,QAAQ,CAAC,QAAQ,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAElD,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAKrD,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAIzE"}

package/dist/adapters/slack/slack.adapter.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var SlackAdapter_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SlackAdapter = void 0;
+const common_1 = require("@nestjs/common");
+const protocol_1 = require("@overlordai/protocol");
+/**
+ * Slack Adapter — V2 placeholder (stub implementation).
+ *
+ * This adapter satisfies the IMessageAdapter interface but does not implement
+ * any real Slack integration. It logs warnings for all method calls.
+ */
+let SlackAdapter = SlackAdapter_1 = class SlackAdapter {
+    platform = protocol_1.Platform.SLACK;
+    logger = new common_1.Logger(SlackAdapter_1.name);
+    async handleWebhook(_req) {
+        this.logger.warn('Slack adapter is a stub — handleWebhook not implemented');
+        return null;
+    }
+    async sendMessage(_chatId, _content) {
+        this.logger.warn('Slack adapter is a stub — sendMessage not implemented');
+        return '';
+    }
+    async updateMessage(_msgId, _content) {
+        this.logger.warn('Slack adapter is a stub — updateMessage not implemented');
+    }
+    async resolveUser(_platformUid) {
+        this.logger.warn('Slack adapter is a stub — resolveUser not implemented');
+        return null;
+    }
+};
+exports.SlackAdapter = SlackAdapter;
+exports.SlackAdapter = SlackAdapter = SlackAdapter_1 = __decorate([
+    (0, common_1.Injectable)()
+], SlackAdapter);
+//# sourceMappingURL=slack.adapter.js.map

package/dist/adapters/slack/slack.adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.adapter.js","sourceRoot":"","sources":["../../../src/adapters/slack/slack.adapter.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAoD;AAGpD,mDAAgD;AAGhD;;;;;GAKG;AAEI,IAAM,YAAY,oBAAlB,MAAM,YAAY;IACd,QAAQ,GAAG,mBAAQ,CAAC,KAAK,CAAC;IAClB,MAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAExD,KAAK,CAAC,aAAa,CAAC,IAAa;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,QAAwB;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAC1E,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,QAAwB;QAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,YAAoB;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAtBY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAsBxB"}

package/dist/app.module.d.ts

@@ -0,0 +1,5 @@
+import { MiddlewareConsumer, NestModule } from '@nestjs/common';
+export declare class AppModule implements NestModule {
+    configure(consumer: MiddlewareConsumer): void;
+}
+//# sourceMappingURL=app.module.d.ts.map

package/dist/app.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.module.d.ts","sourceRoot":"","sources":["../src/app.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,kBAAkB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAYxE,qBAiBa,SAAU,YAAW,UAAU;IAC1C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAK9C"}

package/dist/app.module.js

@@ -0,0 +1,48 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const database_module_1 = require("./database/database.module");
+const redis_module_1 = require("./redis/redis.module");
+const auth_module_1 = require("./auth/auth.module");
+const dispatcher_module_1 = require("./dispatcher/dispatcher.module");
+const web_module_1 = require("./web/web.module");
+const adapter_module_1 = require("./adapters/adapter.module");
+const notifier_module_1 = require("./notifier/notifier.module");
+const rate_limit_guard_1 = require("./common/rate-limit.guard");
+const extract_user_middleware_1 = require("./auth/extract-user.middleware");
+let AppModule = class AppModule {
+    configure(consumer) {
+        // ExtractUserMiddleware runs BEFORE guards, populating request.user
+        // from JWT so RateLimitGuard can do per-user rate limiting.
+        consumer.apply(extract_user_middleware_1.ExtractUserMiddleware).forRoutes('*');
+    }
+};
+exports.AppModule = AppModule;
+exports.AppModule = AppModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            database_module_1.DatabaseModule,
+            redis_module_1.RedisModule,
+            auth_module_1.AuthModule,
+            dispatcher_module_1.DispatcherModule,
+            web_module_1.WebModule,
+            adapter_module_1.AdapterModule,
+            notifier_module_1.NotifierModule,
+        ],
+        providers: [
+            {
+                provide: core_1.APP_GUARD,
+                useClass: rate_limit_guard_1.RateLimitGuard,
+            },
+        ],
+    })
+], AppModule);
+//# sourceMappingURL=app.module.js.map

package/dist/app.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.module.js","sourceRoot":"","sources":["../src/app.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwE;AACxE,uCAAyC;AACzC,gEAA4D;AAC5D,uDAAmD;AACnD,oDAAgD;AAChD,sEAAkE;AAClE,iDAA6C;AAC7C,8DAA0D;AAC1D,gEAA4D;AAC5D,gEAA2D;AAC3D,4EAAuE;AAmBhE,IAAM,SAAS,GAAf,MAAM,SAAS;IACpB,SAAS,CAAC,QAA4B;QACpC,oEAAoE;QACpE,4DAA4D;QAC5D,QAAQ,CAAC,KAAK,CAAC,+CAAqB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AANY,8BAAS;oBAAT,SAAS;IAjBrB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,gCAAc;YACd,0BAAW;YACX,wBAAU;YACV,oCAAgB;YAChB,sBAAS;YACT,8BAAa;YACb,gCAAc;SACf;QACD,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,iCAAc;aACzB;SACF;KACF,CAAC;GACW,SAAS,CAMrB"}

package/dist/auth/auth.controller.d.ts

@@ -0,0 +1,15 @@
+import type { LoginRequest, LoginResponse, RefreshRequest, RefreshResponse } from '@overlordai/protocol';
+import { AuthService } from './auth.service';
+export declare class AuthController {
+    private readonly authService;
+    constructor(authService: AuthService);
+    login(body: LoginRequest): Promise<LoginResponse | {
+        accessToken: string;
+        totpSetup: true;
+    }>;
+    refresh(body: RefreshRequest): Promise<RefreshResponse>;
+    logout(body: {
+        refreshToken: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=auth.controller.d.ts.map

package/dist/auth/auth.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,WAAW;IAK/C,KAAK,CACD,IAAI,EAAE,YAAY,GACzB,OAAO,CAAC,aAAa,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IAM9D,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAO/D,MAAM,CAAS,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAKpE"}

package/dist/auth/auth.controller.js

@@ -0,0 +1,67 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthController = void 0;
+const common_1 = require("@nestjs/common");
+const auth_service_1 = require("./auth.service");
+const rate_limit_guard_1 = require("../common/rate-limit.guard");
+let AuthController = class AuthController {
+    authService;
+    constructor(authService) {
+        this.authService = authService;
+    }
+    async login(body) {
+        return this.authService.login(body.username, body.password, body.totpCode);
+    }
+    async refresh(body) {
+        return this.authService.refresh(body.refreshToken);
+    }
+    async logout(body) {
+        // No JwtAuthGuard — logout must work even when the access token is expired.
+        // The refresh token in the body is verified by authService.logout() itself.
+        await this.authService.logout(body.refreshToken);
+    }
+};
+exports.AuthController = AuthController;
+__decorate([
+    (0, common_1.Post)('login'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, rate_limit_guard_1.RateLimit)({ limit: 5, windowMs: 60_000, byIp: true }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "login", null);
+__decorate([
+    (0, common_1.Post)('refresh'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "refresh", null);
+__decorate([
+    (0, common_1.Post)('logout'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, rate_limit_guard_1.RateLimit)({ limit: 10, windowMs: 60_000, byIp: true }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "logout", null);
+exports.AuthController = AuthController = __decorate([
+    (0, common_1.Controller)('api/auth'),
+    __metadata("design:paramtypes", [auth_service_1.AuthService])
+], AuthController);
+//# sourceMappingURL=auth.controller.js.map

package/dist/auth/auth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAMwB;AAOxB,iDAA6C;AAC7C,iEAAuD;AAGhD,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAKnD,AAAN,KAAK,CAAC,KAAK,CACD,IAAkB;QAE1B,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAIK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAoB;QACxC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAS,IAA8B;QACjD,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AA1BY,wCAAc;AAMnB;IAHL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,4BAAS,EAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEnD,WAAA,IAAA,aAAI,GAAE,CAAA;;;;2CAGR;AAIK;IAFL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACT,WAAA,IAAA,aAAI,GAAE,CAAA;;;;6CAEpB;AAKK;IAHL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,4BAAS,EAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzC,WAAA,IAAA,aAAI,GAAE,CAAA;;;;4CAInB;yBAzBU,cAAc;IAD1B,IAAA,mBAAU,EAAC,UAAU,CAAC;qCAEqB,0BAAW;GAD1C,cAAc,CA0B1B"}

package/dist/auth/auth.module.d.ts

@@ -0,0 +1,3 @@
+export declare class AuthModule {
+}
+//# sourceMappingURL=auth.module.d.ts.map

package/dist/auth/auth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAYA,qBAoBa,UAAU;CAAG"}

package/dist/auth/auth.module.js

@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModule = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const passport_1 = require("@nestjs/passport");
+const developer_repository_1 = require("../database/repositories/developer.repository");
+const developer_token_repository_1 = require("../database/repositories/developer-token.repository");
+const auth_service_1 = require("./auth.service");
+const auth_controller_1 = require("./auth.controller");
+const jwt_strategy_1 = require("./jwt.strategy");
+const jwt_auth_guard_1 = require("./guards/jwt-auth.guard");
+const roles_guard_1 = require("./guards/roles.guard");
+const project_role_guard_1 = require("./guards/project-role.guard");
+let AuthModule = class AuthModule {
+};
+exports.AuthModule = AuthModule;
+exports.AuthModule = AuthModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            passport_1.PassportModule.register({ defaultStrategy: 'jwt' }),
+            jwt_1.JwtModule.register({
+                secret: process.env.JWT_SECRET || 'default-jwt-secret',
+                signOptions: { expiresIn: '15m' },
+            }),
+        ],
+        controllers: [auth_controller_1.AuthController],
+        providers: [
+            auth_service_1.AuthService,
+            jwt_strategy_1.JwtStrategy,
+            jwt_auth_guard_1.JwtAuthGuard,
+            roles_guard_1.RolesGuard,
+            project_role_guard_1.ProjectRoleGuard,
+            developer_repository_1.DeveloperRepository,
+            developer_token_repository_1.DeveloperTokenRepository,
+        ],
+        exports: [auth_service_1.AuthService, jwt_auth_guard_1.JwtAuthGuard, roles_guard_1.RolesGuard, project_role_guard_1.ProjectRoleGuard],
+    })
+], AuthModule);
+//# sourceMappingURL=auth.module.js.map

package/dist/auth/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,qCAAwC;AACxC,+CAAkD;AAClD,wFAAoF;AACpF,oGAA+F;AAC/F,iDAA6C;AAC7C,uDAAmD;AACnD,iDAA6C;AAC7C,4DAAuD;AACvD,sDAAkD;AAClD,oEAA+D;AAsBxD,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IApBtB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;YACnD,eAAS,CAAC,QAAQ,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB;gBACtD,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;aAClC,CAAC;SACH;QACD,WAAW,EAAE,CAAC,gCAAc,CAAC;QAC7B,SAAS,EAAE;YACT,0BAAW;YACX,0BAAW;YACX,6BAAY;YACZ,wBAAU;YACV,qCAAgB;YAChB,0CAAmB;YACnB,qDAAwB;SACzB;QACD,OAAO,EAAE,CAAC,0BAAW,EAAE,6BAAY,EAAE,wBAAU,EAAE,qCAAgB,CAAC;KACnE,CAAC;GACW,UAAU,CAAG"}

package/dist/auth/auth.service.d.ts

@@ -0,0 +1,62 @@
+import { OnModuleInit } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { DeveloperRepository } from '../database/repositories/developer.repository';
+import { RedisService } from '../redis/redis.service';
+interface UserJwtPayload {
+    sub: number;
+    name: string;
+    role: string;
+    jti: string;
+}
+interface WorkerJwtPayload {
+    sub: string;
+    tokenId: number;
+}
+interface ChannelTokenPayload {
+    taskId: number;
+    aud: 'worker' | 'web';
+    jti: string;
+}
+export declare class AuthService implements OnModuleInit {
+    private readonly jwtService;
+    private readonly developerRepo;
+    private readonly redis;
+    private readonly logger;
+    constructor(jwtService: JwtService, developerRepo: DeveloperRepository, redis: RedisService);
+    onModuleInit(): void;
+    login(username: string, password: string, totpCode?: string): Promise<{
+        accessToken: string;
+        refreshToken: string;
+    } | {
+        accessToken: string;
+        totpSetup: true;
+    }>;
+    refresh(refreshToken: string): Promise<{
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    logout(refreshToken: string): Promise<void>;
+    signUserJwt(developer: {
+        id: number;
+        name: string;
+        role: string;
+    }): string;
+    signRefreshToken(developer: {
+        id: number;
+    }): string;
+    signWorkerJwt(machineId: string, tokenId: number): string;
+    signChannelToken(taskId: number, aud: 'worker' | 'web'): string;
+    validateChannelToken(token: string, expectedAud: 'worker' | 'web'): Promise<ChannelTokenPayload>;
+    /**
+     * Verify a Worker JWT and return its payload.
+     * Throws UnauthorizedException on invalid/expired token.
+     */
+    verifyWorkerJwt(token: string): WorkerJwtPayload;
+    /**
+     * Verify a User JWT and return its payload.
+     * Throws UnauthorizedException on invalid/expired token.
+     */
+    verifyUserJwt(token: string): UserJwtPayload;
+}
+export {};
+//# sourceMappingURL=auth.service.d.ts.map

package/dist/auth/auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../src/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,YAAY,EAEb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAUD,UAAU,gBAAgB;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,mBAAmB;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,QAAQ,GAAG,KAAK,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBACa,WAAY,YAAW,YAAY;IAI5C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IALxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,mBAAmB,EAClC,KAAK,EAAE,YAAY;IAGtC,YAAY,IAAI,IAAI;IAmCd,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CACN;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAC7C;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAC3C;IAmEK,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IA+CrF,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCjD,WAAW,CAAC,SAAS,EAAE;QACrB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,MAAM;IAcV,gBAAgB,CAAC,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAanD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAYzD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM;IAazD,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,QAAQ,GAAG,KAAK,GAC5B,OAAO,CAAC,mBAAmB,CAAC;IAoC/B;;;OAGG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB;IAUhD;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc;CAS7C"}