@reaatech/prompt-version-control-server 0.1.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;AAEvB,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;AAC/D,MAAM,UAAU,GAAwE,CAAC,GAAG,EAAE;IAC5F,IAAI,CAAC,aAAa;QAAE,OAAO,EAAc,CAAC;IAC1C,IAAI,aAAa,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC,CAAC,EAAE,CAAC;AAEL,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAC7B,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AACtC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AACnD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAE3B,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;AACzF,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACtD,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC9B,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAC3C,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;AACnD,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAC3C,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;AACnD,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAC7C,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AACnC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;AACtC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAEtC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAE1B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,CAAC,IAAI,CACX;QACE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,YAAY,EAAE;QACrE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;QAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,EACD,GAAG,CACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;IAC1E,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;AACvF,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;IAC1E,MAAM,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AAE9C,MAAM,CAAC,IAAI,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;AAE/C,MAAM,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,IAAI;CACL,CAAW,CAAC;AAEb,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;IAClC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;QAChB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAE/C,OAAO,EAAE,GAAG,EAAE,CAAC"}

package/dist/middleware/audit.d.ts

@@ -0,0 +1,3 @@
+import type { MiddlewareHandler } from 'hono';
+export declare function auditMiddleware(resourceType: string, action: 'create' | 'update' | 'delete' | 'promote' | 'rollback'): MiddlewareHandler;
+//# sourceMappingURL=audit.d.ts.map

package/dist/middleware/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/middleware/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAK9C,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAC9D,iBAAiB,CAoCnB"}

package/dist/middleware/audit.js

@@ -0,0 +1,39 @@
+import { auditService } from '../services/audit.service.js';
+import { getProjectId } from '../utils/context.js';
+import { logger } from '../utils/logger.js';
+export function auditMiddleware(resourceType, action) {
+    return async (c, next) => {
+        await next();
+        let projectId;
+        try {
+            projectId = getProjectId(c);
+        }
+        catch {
+            return;
+        }
+        const apiKey = c.get('apiKey');
+        const requestId = c.get('requestId');
+        if (!apiKey)
+            return;
+        const resourceId = c.req.param('id') || 'unknown';
+        try {
+            await auditService.log({
+                actorId: apiKey.id,
+                action,
+                resourceType,
+                resourceId,
+                projectId,
+                ipAddress: c.req.header('x-forwarded-for') || 'unknown',
+                requestId: requestId ?? null,
+                before: null,
+                after: null,
+            });
+        }
+        catch (err) {
+            // Audit logging must never fail the request or crash the process.
+            // Log the failure so operators can detect a misconfigured audit store.
+            logger.error({ err }, 'audit log failed');
+        }
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/middleware/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/middleware/audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,UAAU,eAAe,CAC7B,YAAoB,EACpB,MAA+D;IAE/D,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAA+B,CAAC;QAC7D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAuB,CAAC;QAE3D,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,GAAG,CAAC;gBACrB,OAAO,EAAE,MAAM,CAAC,EAAE;gBAClB,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,SAAS;gBACT,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,SAAS;gBACvD,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,uEAAuE;YACvE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,3 @@
+import type { MiddlewareHandler } from 'hono';
+export declare const authMiddleware: MiddlewareHandler;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAO9C,eAAO,MAAM,cAAc,EAAE,iBAiD5B,CAAC"}

package/dist/middleware/auth.js

@@ -0,0 +1,49 @@
+import { hashApiKey } from '@reaatech/prompt-version-control-shared';
+import { prisma } from '../db/client.js';
+import { UnauthorizedError } from '../errors.js';
+const LAST_USED_THROTTLE_MS = 60_000;
+const lastUsedCache = new Map();
+export const authMiddleware = async (c, next) => {
+    const header = c.req.header('authorization');
+    if (!header?.startsWith('Bearer ')) {
+        throw new UnauthorizedError('Missing or invalid authorization header');
+    }
+    const key = header.slice(7);
+    if (key.length === 0) {
+        throw new UnauthorizedError('Invalid API key');
+    }
+    const keyHash = hashApiKey(key);
+    const apiKey = await prisma.apiKey.findUnique({
+        where: { keyHash },
+        include: { project: true },
+    });
+    if (!apiKey) {
+        throw new UnauthorizedError('Invalid API key');
+    }
+    if (apiKey.expiresAt && apiKey.expiresAt < new Date()) {
+        throw new UnauthorizedError('API key expired');
+    }
+    c.set('apiKey', apiKey);
+    c.set('project', apiKey.project);
+    c.set('projectId', apiKey.projectId);
+    // Throttle lastUsedAt updates so high-QPS workloads don't write on every
+    // request. Note: this cache is per-process — in a multi-instance deployment
+    // each instance writes independently, which is acceptable for a usage
+    // timestamp that does not need strict consistency.
+    const now = Date.now();
+    const last = lastUsedCache.get(apiKey.id) ?? 0;
+    if (now - last >= LAST_USED_THROTTLE_MS) {
+        lastUsedCache.set(apiKey.id, now);
+        try {
+            await prisma.apiKey.update({
+                where: { id: apiKey.id },
+                data: { lastUsedAt: new Date(now) },
+            });
+        }
+        catch {
+            // Best-effort — never fail the request because the bookkeeping write failed.
+        }
+    }
+    await next();
+};
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,yCAAyC,CAAC;AAErE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACjE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAC5C,KAAK,EAAE,EAAE,OAAO,EAAE;QAClB,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KAC3B,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAErC,yEAAyE;IACzE,4EAA4E;IAC5E,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,GAAG,GAAG,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACxC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBACzB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;gBACxB,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC"}

package/dist/middleware/error-handler.d.ts

@@ -0,0 +1,3 @@
+import type { ErrorHandler } from 'hono';
+export declare const errorHandler: ErrorHandler;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAKzC,eAAO,MAAM,YAAY,EAAE,YA8C1B,CAAC"}

package/dist/middleware/error-handler.js

@@ -0,0 +1,36 @@
+import { ZodError } from 'zod';
+import { AppError, ValidationError } from '../errors.js';
+import { logger } from '../utils/logger.js';
+export const errorHandler = (err, c) => {
+    const requestId = c.get('requestId');
+    if (err instanceof ZodError) {
+        const fields = {};
+        for (const issue of err.issues) {
+            const path = issue.path.join('.');
+            fields[path] = fields[path] ?? [];
+            fields[path].push(issue.message);
+        }
+        const appErr = new ValidationError(fields);
+        logger.warn({ requestId, code: appErr.code, fields }, 'validation error');
+        return c.json({
+            error: { code: appErr.code, message: appErr.message, details: appErr.details },
+            requestId,
+            timestamp: new Date().toISOString(),
+        }, appErr.status);
+    }
+    if (err instanceof AppError) {
+        logger.warn({ requestId, code: err.code, status: err.status, details: err.details }, err.message);
+        return c.json({
+            error: { code: err.code, message: err.message, details: err.details },
+            requestId,
+            timestamp: new Date().toISOString(),
+        }, err.status);
+    }
+    logger.error({ requestId, err }, 'unhandled error');
+    return c.json({
+        error: { code: 'INTERNAL_ERROR', message: 'Internal server error' },
+        requestId,
+        timestamp: new Date().toISOString(),
+    }, 500);
+};
+//# sourceMappingURL=error-handler.js.map

package/dist/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;IACnD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAuB,CAAC;IAE3D,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;YAC9E,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,EACD,MAAM,CAAC,MAAsC,CAC9C,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EACvE,GAAG,CAAC,OAAO,CACZ,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;YACrE,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,EACD,GAAG,CAAC,MAAsC,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC,IAAI,CACX;QACE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,uBAAuB,EAAE;QACnE,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,EACD,GAAG,CACJ,CAAC;AACJ,CAAC,CAAC"}

package/dist/middleware/metrics.d.ts

@@ -0,0 +1,3 @@
+import type { MiddlewareHandler } from 'hono';
+export declare const metricsMiddleware: MiddlewareHandler;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/middleware/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/middleware/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,eAAO,MAAM,iBAAiB,EAAE,iBAc/B,CAAC"}

package/dist/middleware/metrics.js

@@ -0,0 +1,13 @@
+import { httpRequestDuration } from '../services/prometheus.service.js';
+export const metricsMiddleware = async (c, next) => {
+    const start = performance.now();
+    await next();
+    const duration = (performance.now() - start) / 1000;
+    const route = c.req.routePath ?? 'unknown';
+    httpRequestDuration.observe({
+        method: c.req.method,
+        route,
+        status: String(c.res.status),
+    }, duration);
+};
+//# sourceMappingURL=metrics.js.map

package/dist/middleware/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/middleware/metrics.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,MAAM,CAAC,MAAM,iBAAiB,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACpE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,IAAI,EAAE,CAAC;IACb,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IAEpD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC;IAC3C,mBAAmB,CAAC,OAAO,CACzB;QACE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;QACpB,KAAK;QACL,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;KAC7B,EACD,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC"}

package/dist/middleware/rate-limit.d.ts

@@ -0,0 +1,8 @@
+import type { MiddlewareHandler } from 'hono';
+interface RateLimitOpts {
+    windowMs: number;
+    max: number;
+}
+export declare function rateLimit(opts: RateLimitOpts): MiddlewareHandler;
+export {};
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/middleware/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAK9C,UAAU,aAAa;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AA2FD,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CAWhE"}

package/dist/middleware/rate-limit.js

@@ -0,0 +1,89 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { redis } from '../db/redis.js';
+import { RateLimitError } from '../errors.js';
+import { logger } from '../utils/logger.js';
+/**
+ * Derive a stable, non-sensitive identifier for rate limiting. We never put a
+ * raw API key into a Map key, Redis key, or log line.
+ */
+function rateLimitId(c) {
+    const auth = c.req.header('authorization');
+    if (auth?.startsWith('Bearer ')) {
+        const key = auth.slice(7);
+        if (key.length > 0) {
+            return `key:${createHash('sha256').update(key).digest('hex').slice(0, 32)}`;
+        }
+    }
+    const xff = c.req.header('x-forwarded-for');
+    if (xff) {
+        // Take only the first IP (the client) and hash it for symmetry with key path.
+        const client = xff.split(',')[0]?.trim();
+        return `ip:${createHash('sha256').update(client).digest('hex').slice(0, 32)}`;
+    }
+    return 'anonymous';
+}
+function inMemoryRateLimit(opts) {
+    const store = new Map();
+    const cleanupInterval = setInterval(() => {
+        const now = Date.now();
+        for (const [key, entry] of store.entries()) {
+            if (entry.resetAt < now) {
+                store.delete(key);
+            }
+        }
+    }, 60_000);
+    cleanupInterval.unref?.();
+    return async (c, next) => {
+        const key = rateLimitId(c);
+        const now = Date.now();
+        const entry = store.get(key);
+        if (!entry || entry.resetAt < now) {
+            store.set(key, { count: 1, resetAt: now + opts.windowMs });
+        }
+        else {
+            entry.count++;
+            if (entry.count > opts.max) {
+                const retryAfter = Math.ceil((entry.resetAt - now) / 1000);
+                throw new RateLimitError(retryAfter);
+            }
+        }
+        await next();
+    };
+}
+function redisRateLimit(opts) {
+    return async (c, next) => {
+        if (!redis)
+            return await next();
+        const key = rateLimitId(c);
+        const redisKey = `rate_limit:${key}`;
+        const now = Date.now();
+        const windowStart = now - opts.windowMs;
+        const member = `${now}-${randomBytes(8).toString('hex')}`;
+        const pipeline = redis.multi();
+        pipeline.zremrangebyscore(redisKey, 0, windowStart);
+        pipeline.zcard(redisKey);
+        pipeline.zadd(redisKey, now, member);
+        pipeline.pexpire(redisKey, opts.windowMs);
+        const results = await pipeline.exec();
+        const count = results?.[1]?.[1] ?? 0;
+        if (count >= opts.max) {
+            const ttl = await redis.pttl(redisKey);
+            const retryAfter = Math.ceil(Math.max(ttl, 0) / 1000);
+            throw new RateLimitError(retryAfter);
+        }
+        await next();
+    };
+}
+export function rateLimit(opts) {
+    if (redis) {
+        return redisRateLimit(opts);
+    }
+    if (process.env.NODE_ENV === 'production') {
+        // Redis-backed rate limiting is strongly recommended for multi-instance
+        // deployments. In-memory counters are per-process and won't coordinate
+        // across instances behind a load balancer.
+        logger.warn('REDIS_URL not set — using in-memory rate limiting (per-process, not shared)');
+    }
+    return inMemoryRateLimit(opts);
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/middleware/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAO5C;;;GAGG;AACH,SAAS,WAAW,CAAC,CAAwD;IAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,GAAG,EAAE,CAAC;QACR,8EAA8E;QAC9E,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACzC,OAAO,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAmB;IAM5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEhD,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;gBACxB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC;IAE1B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YAClC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC3D,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAmB;IACzC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,IAAI,EAAE,CAAC;QAEhC,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,cAAc,GAAG,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAExC,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAE1D,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QACpD,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC;QAEjD,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAmB;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,wEAAwE;QACxE,uEAAuE;QACvE,2CAA2C;QAC3C,MAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC"}

package/dist/middleware/request-id.d.ts

@@ -0,0 +1,3 @@
+import type { MiddlewareHandler } from 'hono';
+export declare const requestIdMiddleware: MiddlewareHandler;
+//# sourceMappingURL=request-id.d.ts.map

package/dist/middleware/request-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.d.ts","sourceRoot":"","sources":["../../src/middleware/request-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI9C,eAAO,MAAM,mBAAmB,EAAE,iBAMjC,CAAC"}

package/dist/middleware/request-id.js

@@ -0,0 +1,10 @@
+import { randomUUID } from 'node:crypto';
+const REQUEST_ID_RE = /^[\w-]{1,128}$/;
+export const requestIdMiddleware = async (c, next) => {
+    const rawId = c.req.header('x-request-id');
+    const requestId = rawId && REQUEST_ID_RE.test(rawId) ? rawId : randomUUID();
+    c.set('requestId', requestId);
+    c.header('x-request-id', requestId);
+    await next();
+};
+//# sourceMappingURL=request-id.js.map

package/dist/middleware/request-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.js","sourceRoot":"","sources":["../../src/middleware/request-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,CAAC,MAAM,mBAAmB,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAC5E,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC9B,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACpC,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC"}

package/dist/services/audit.service.d.ts

@@ -0,0 +1,6 @@
+import type { AuditLog } from '@prisma/client';
+export declare class AuditService {
+    log(entry: Omit<AuditLog, 'id' | 'createdAt'>): Promise<void>;
+}
+export declare const auditService: AuditService;
+//# sourceMappingURL=audit.service.d.ts.map

package/dist/services/audit.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.service.d.ts","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAU,MAAM,gBAAgB,CAAC;AAIvD,qBAAa,YAAY;IACjB,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAmBpE;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/dist/services/audit.service.js

@@ -0,0 +1,26 @@
+import { prisma } from '../db/client.js';
+import { logger } from '../utils/logger.js';
+export class AuditService {
+    async log(entry) {
+        try {
+            await prisma.auditLog.create({
+                data: {
+                    actorId: entry.actorId,
+                    action: entry.action,
+                    resourceType: entry.resourceType,
+                    resourceId: entry.resourceId,
+                    projectId: entry.projectId,
+                    before: entry.before,
+                    after: entry.after,
+                    ipAddress: entry.ipAddress,
+                    requestId: entry.requestId,
+                },
+            });
+        }
+        catch (err) {
+            logger.error({ err, entry }, 'failed to write audit log');
+        }
+    }
+}
+export const auditService = new AuditService();
+//# sourceMappingURL=audit.service.js.map

package/dist/services/audit.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.service.js","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,OAAO,YAAY;IACvB,KAAK,CAAC,GAAG,CAAC,KAAyC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC3B,IAAI,EAAE;oBACJ,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAA+B;oBAC7C,KAAK,EAAE,KAAK,CAAC,KAA8B;oBAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC"}

package/dist/services/deployment.service.d.ts

@@ -0,0 +1,101 @@
+import type { DeploymentStatus } from '@prisma/client';
+export interface DeploymentVariant {
+    versionId: string;
+    weight: number;
+    isControl: boolean;
+}
+export declare class DeploymentService {
+    createDeployment(projectId: string, promptId: string, name: string, variants: DeploymentVariant[]): Promise<{
+        variants: {
+            id: string;
+            weight: number;
+            isControl: boolean;
+            versionId: string;
+            deploymentId: string;
+        }[];
+    } & {
+        id: string;
+        projectId: string;
+        name: string;
+        createdAt: Date;
+        updatedAt: Date;
+        promptId: string;
+        status: import("@prisma/client").$Enums.DeploymentStatus;
+        config: import("@prisma/client/runtime/library").JsonValue;
+    }>;
+    listDeployments(projectId: string, promptId?: string): Promise<({
+        variants: ({
+            version: {
+                number: number;
+                id: string;
+                createdAt: Date;
+                template: string;
+                variables: import("@prisma/client/runtime/library").JsonValue;
+                metadata: import("@prisma/client/runtime/library").JsonValue | null;
+                promptId: string;
+                content: string;
+                checksum: string;
+            };
+        } & {
+            id: string;
+            weight: number;
+            isControl: boolean;
+            versionId: string;
+            deploymentId: string;
+        })[];
+    } & {
+        id: string;
+        projectId: string;
+        name: string;
+        createdAt: Date;
+        updatedAt: Date;
+        promptId: string;
+        status: import("@prisma/client").$Enums.DeploymentStatus;
+        config: import("@prisma/client/runtime/library").JsonValue;
+    })[]>;
+    getDeployment(projectId: string, id: string): Promise<{
+        variants: ({
+            version: {
+                number: number;
+                id: string;
+                createdAt: Date;
+                template: string;
+                variables: import("@prisma/client/runtime/library").JsonValue;
+                metadata: import("@prisma/client/runtime/library").JsonValue | null;
+                promptId: string;
+                content: string;
+                checksum: string;
+            };
+        } & {
+            id: string;
+            weight: number;
+            isControl: boolean;
+            versionId: string;
+            deploymentId: string;
+        })[];
+    } & {
+        id: string;
+        projectId: string;
+        name: string;
+        createdAt: Date;
+        updatedAt: Date;
+        promptId: string;
+        status: import("@prisma/client").$Enums.DeploymentStatus;
+        config: import("@prisma/client/runtime/library").JsonValue;
+    }>;
+    resolveVersion(projectId: string, deploymentId: string, sessionId?: string): Promise<string>;
+    updateStatus(projectId: string, id: string, status: DeploymentStatus): Promise<{
+        id: string;
+        projectId: string;
+        name: string;
+        createdAt: Date;
+        updatedAt: Date;
+        promptId: string;
+        status: import("@prisma/client").$Enums.DeploymentStatus;
+        config: import("@prisma/client/runtime/library").JsonValue;
+    }>;
+    private selectByWeight;
+    private selectByHash;
+}
+export declare const deploymentService: DeploymentService;
+//# sourceMappingURL=deployment.service.d.ts.map

package/dist/services/deployment.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.service.d.ts","sourceRoot":"","sources":["../../src/services/deployment.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKvD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,qBAAa,iBAAiB;IACtB,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;IA+CzB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQpD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAW3C,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;IA0B1E,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB;;;;;;;;;;IAc1E,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,YAAY;CAgBrB;AAED,eAAO,MAAM,iBAAiB,mBAA0B,CAAC"}

package/dist/services/deployment.service.js

@@ -0,0 +1,127 @@
+import { createHash } from 'node:crypto';
+import { prisma } from '../db/client.js';
+import { redis } from '../db/redis.js';
+import { AppError, NotFoundError } from '../errors.js';
+export class DeploymentService {
+    async createDeployment(projectId, promptId, name, variants) {
+        const totalWeight = variants.reduce((sum, v) => sum + v.weight, 0);
+        if (totalWeight !== 100) {
+            throw new AppError('INVALID_WEIGHTS', 400, `Variant weights must sum to 100, got ${totalWeight}`);
+        }
+        // Verify the prompt belongs to the caller's project.
+        const prompt = await prisma.prompt.findFirst({
+            where: { id: promptId, projectId },
+            select: { id: true },
+        });
+        if (!prompt) {
+            throw new NotFoundError('Prompt', promptId);
+        }
+        // Verify every versionId belongs to the prompt (and therefore the project).
+        const versionIds = variants.map((v) => v.versionId);
+        const versions = await prisma.version.findMany({
+            where: { id: { in: versionIds }, promptId },
+            select: { id: true },
+        });
+        if (versions.length !== versionIds.length) {
+            throw new NotFoundError('Version', 'one or more variant versionIds');
+        }
+        const deployment = await prisma.deployment.create({
+            data: {
+                projectId,
+                promptId,
+                name,
+                status: 'paused',
+                config: { stickySessions: true },
+                variants: {
+                    create: variants,
+                },
+            },
+            include: { variants: true },
+        });
+        return deployment;
+    }
+    async listDeployments(projectId, promptId) {
+        return prisma.deployment.findMany({
+            where: { projectId, promptId, status: { not: 'archived' } },
+            include: { variants: { include: { version: true } } },
+            orderBy: { createdAt: 'desc' },
+        });
+    }
+    async getDeployment(projectId, id) {
+        const deployment = await prisma.deployment.findFirst({
+            where: { id, projectId },
+            include: { variants: { include: { version: true } } },
+        });
+        if (!deployment) {
+            throw new NotFoundError('Deployment', id);
+        }
+        return deployment;
+    }
+    async resolveVersion(projectId, deploymentId, sessionId) {
+        const deployment = await this.getDeployment(projectId, deploymentId);
+        if (deployment.status !== 'active') {
+            throw new AppError('DEPLOYMENT_INACTIVE', 409, `Deployment is ${deployment.status}`);
+        }
+        if (sessionId && deployment.config?.stickySessions) {
+            if (redis) {
+                const stickyKey = `sticky:${deploymentId}:${sessionId}`;
+                const cached = await redis.get(stickyKey);
+                if (cached) {
+                    return cached;
+                }
+                const selected = this.selectByHash(sessionId, deployment.variants);
+                await redis.setex(stickyKey, 86400, selected); // 24h TTL
+                return selected;
+            }
+            const stickyVersion = this.selectByHash(sessionId, deployment.variants);
+            if (stickyVersion)
+                return stickyVersion;
+        }
+        return this.selectByWeight(deployment.variants);
+    }
+    async updateStatus(projectId, id, status) {
+        const deployment = await prisma.deployment.findFirst({
+            where: { id, projectId },
+            select: { id: true },
+        });
+        if (!deployment) {
+            throw new NotFoundError('Deployment', id);
+        }
+        return prisma.deployment.update({
+            where: { id },
+            data: { status },
+        });
+    }
+    selectByWeight(variants) {
+        if (variants.length === 0) {
+            throw new AppError('DEPLOYMENT_EMPTY', 500, 'No variants configured');
+        }
+        const rand = Math.random() * 100;
+        let cumulative = 0;
+        for (const variant of variants) {
+            cumulative += variant.weight;
+            if (rand <= cumulative) {
+                return variant.versionId;
+            }
+        }
+        return variants[variants.length - 1]?.versionId;
+    }
+    selectByHash(sessionId, variants) {
+        if (variants.length === 0) {
+            throw new AppError('DEPLOYMENT_EMPTY', 500, 'No variants configured');
+        }
+        const hash = createHash('sha256').update(sessionId).digest('hex');
+        const intValue = Number.parseInt(hash.slice(0, 8), 16);
+        const bucket = intValue % 100;
+        let cumulative = 0;
+        for (const variant of variants) {
+            cumulative += variant.weight;
+            if (bucket < cumulative) {
+                return variant.versionId;
+            }
+        }
+        return variants[variants.length - 1]?.versionId;
+    }
+}
+export const deploymentService = new DeploymentService();
+//# sourceMappingURL=deployment.service.js.map

package/dist/services/deployment.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.service.js","sourceRoot":"","sources":["../../src/services/deployment.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQvD,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,gBAAgB,CACpB,SAAiB,EACjB,QAAgB,EAChB,IAAY,EACZ,QAA6B;QAE7B,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACnE,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAChB,iBAAiB,EACjB,GAAG,EACH,wCAAwC,WAAW,EAAE,CACtD,CAAC;QACJ,CAAC;QAED,qDAAqD;QACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE;YAClC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,4EAA4E;QAC5E,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE;YAC3C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAChD,IAAI,EAAE;gBACJ,SAAS;gBACT,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;gBAChC,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ;iBACjB;aACF;YACD,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC5B,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,QAAiB;QACxD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YAChC,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;YAC3D,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;YACrD,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,EAAU;QAC/C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YACnD,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;YACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;SACtD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,YAAoB,EAAE,SAAkB;QAC9E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,iBAAiB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,SAAS,IAAK,UAAU,CAAC,MAAkC,EAAE,cAAc,EAAE,CAAC;YAChF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GAAG,UAAU,YAAY,IAAI,SAAS,EAAE,CAAC;gBACxD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAED,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACnE,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU;gBACzD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxE,IAAI,aAAa;gBAAE,OAAO,aAAa,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,EAAU,EAAE,MAAwB;QACxE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YACnD,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;YACxB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAC9B,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,QAAsD;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC;QACjC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;YAC7B,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC,SAAS,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC;IAClD,CAAC;IAEO,YAAY,CAAC,SAAiB,EAAE,QAAsD;QAC5F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,QAAQ,GAAG,GAAG,CAAC;QAC9B,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;YAC7B,IAAI,MAAM,GAAG,UAAU,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,SAAS,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC;IAClD,CAAC;CACF;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC"}