@sudobility/shapeshyft_service 1.0.0

package/dist/middleware/firebaseAuth.js

@@ -0,0 +1,133 @@
+/**
+ * @fileoverview Firebase authentication middleware
+ *
+ * Accepts a personal API key, an entity API key, or a Firebase ID token. Key
+ * prefixes, auth functions, and storage all come from the service context.
+ */
+import { errorResponse } from "@sudobility/shapeshyft_engine/types";
+import { eq } from "drizzle-orm";
+/**
+ * Path prefix an entity API key may reach.
+ *
+ * Entity keys are scoped to entity-owned resources: projects, endpoints,
+ * provider keys, storage, analytics. They must not reach `/users/...`, which
+ * would let a key read or mint credentials belonging to the person who created
+ * it -- an escalation from "acts as the entity" to "acts as its author".
+ */
+const ENTITY_API_KEY_PATH_PREFIX = "/entities/";
+export function createFirebaseAuthMiddleware(ctx) {
+    const { db, logger } = ctx;
+    const { users } = ctx.tables;
+    const { extractUserApiKeyFromHeaders } = ctx.userApiKeys;
+    const { resolveUserApiKey } = ctx.userApiKeyCache;
+    const { extractEntityApiKeyFromHeaders } = ctx.entityApiKeyFormat;
+    const { entityHelpers } = ctx.entityAccess;
+    const { verifyIdToken, isSiteAdmin, isAnonymousUser } = ctx.auth;
+    const userPrefix = ctx.userApiKeys.prefix;
+    const entityPrefix = ctx.entityApiKeyFormat.prefixWithSeparator;
+    /**
+     * Ensure user record exists in database.
+     * Uses firebase_uid as the primary key.
+     */
+    async function ensureUserExists(firebaseUid, email) {
+        const existing = await db
+            .select()
+            .from(users)
+            .where(eq(users.firebase_uid, firebaseUid));
+        if (existing.length === 0) {
+            await db.insert(users).values({
+                firebase_uid: firebaseUid,
+                email: email ?? null,
+            });
+        }
+    }
+    /**
+     * Firebase authentication middleware.
+     *
+     * Verifies Firebase token and sets context variables:
+     * - firebaseUser: The decoded Firebase token
+     * - userId: The Firebase UID
+     * - userEmail: The user's email (or null)
+     * - siteAdmin: Whether the user is a site admin
+     *
+     * Also ensures user record exists in database (fire-and-forget).
+     */
+    async function firebaseAuthMiddleware(c, next) {
+        // 1. Personal API key ("<user prefix>..."), from X-API-Key or Authorization: Bearer.
+        // A resolved key sets exactly the same context variables a token would, minus
+        // firebaseUser, so every downstream handler behaves identically.
+        const userApiKey = extractUserApiKeyFromHeaders(name => c.req.header(name));
+        if (userApiKey) {
+            const resolved = await resolveUserApiKey(userApiKey);
+            if (!resolved) {
+                return c.json(errorResponse("Invalid or inactive API key"), 401);
+            }
+            c.set("userId", resolved.userId);
+            c.set("userEmail", resolved.userEmail);
+            c.set("siteAdmin", isSiteAdmin(resolved.userEmail));
+            c.set("authMethod", "api_key");
+            c.set("apiKeyId", resolved.keyId);
+            await next();
+            return;
+        }
+        // 2. Entity API key ("<entity prefix>_..."). Authenticates as the entity itself: no
+        // user identity, so downstream permission checks match on the entity instead
+        // of a membership role. `userId` is still populated with the key's author so
+        // audit columns keep a value.
+        const entityApiKey = extractEntityApiKeyFromHeaders(name => c.req.header(name));
+        if (entityApiKey) {
+            if (!entityHelpers.apiKeys) {
+                return c.json(errorResponse("Entity API keys are not enabled"), 501);
+            }
+            const identity = await entityHelpers.apiKeys.verifyKey(entityApiKey);
+            if (!identity) {
+                return c.json(errorResponse("Invalid or inactive API key"), 401);
+            }
+            if (!c.req.path.includes(ENTITY_API_KEY_PATH_PREFIX)) {
+                return c.json(errorResponse("Entity API keys may only access entity-scoped routes. Use a Firebase token or personal API key for this request."), 403);
+            }
+            c.set("userId", identity.createdByUserId);
+            c.set("userEmail", null);
+            c.set("siteAdmin", false);
+            c.set("authMethod", "entity_api_key");
+            c.set("entityApiKeyId", identity.keyId);
+            c.set("entityApiKeyEntityId", identity.entityId);
+            // Best-effort usage bookkeeping; never blocks the request
+            entityHelpers.apiKeys
+                .touchLastUsed(identity.keyId)
+                .catch(err => logger.error("Failed to stamp API key usage:", err));
+            await next();
+            return;
+        }
+        // 3. Firebase ID token
+        const authHeader = c.req.header("Authorization");
+        if (!authHeader) {
+            return c.json(errorResponse(`Authorization required. Provide a Firebase ID token as 'Authorization: Bearer <token>', a personal API key as 'X-API-Key: ${userPrefix}...', or an entity API key as 'X-API-Key: ${entityPrefix}...'`), 401);
+        }
+        const [type, token] = authHeader.split(" ");
+        if (type !== "Bearer" || !token) {
+            return c.json(errorResponse("Invalid authorization format. Use: Bearer <token>"), 401);
+        }
+        try {
+            const decodedToken = await verifyIdToken(token);
+            if (isAnonymousUser(decodedToken)) {
+                return c.json(errorResponse("Anonymous users cannot access this resource"), 403);
+            }
+            const userId = decodedToken.uid;
+            const userEmail = decodedToken.email ?? null;
+            c.set("firebaseUser", decodedToken);
+            c.set("userId", userId);
+            c.set("userEmail", userEmail);
+            c.set("siteAdmin", isSiteAdmin(userEmail));
+            c.set("authMethod", "firebase");
+            // Ensure user exists in database (fire-and-forget)
+            ensureUserExists(userId, userEmail).catch(err => logger.error("Failed to ensure user exists:", err));
+            await next();
+        }
+        catch {
+            return c.json(errorResponse("Invalid or expired Firebase token"), 401);
+        }
+    }
+    return firebaseAuthMiddleware;
+}
+//# sourceMappingURL=firebaseAuth.js.map

package/dist/middleware/firebaseAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebaseAuth.js","sourceRoot":"","sources":["../../src/middleware/firebaseAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AA2BjC;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAEhD,MAAM,UAAU,4BAA4B,CAC1C,GAAmB;IAEnB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,4BAA4B,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;IACzD,MAAM,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC,eAAe,CAAC;IAClD,MAAM,EAAE,8BAA8B,EAAE,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAClE,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC;IAC3C,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IACjE,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC;IAC1C,MAAM,YAAY,GAAG,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;IAEhE;;;OAGG;IACH,KAAK,UAAU,gBAAgB,CAC7B,WAAmB,EACnB,KAAqB;QAErB,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;QAE9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;gBAC5B,YAAY,EAAE,WAAW;gBACzB,KAAK,EAAE,KAAK,IAAI,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,UAAU,sBAAsB,CAAC,CAAU,EAAE,IAAU;QAC1D,qFAAqF;QACrF,8EAA8E;QAC9E,iEAAiE;QACjE,MAAM,UAAU,GAAG,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,6BAA6B,CAAC,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;YAED,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACpD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAC/B,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAElC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,oFAAoF;QACpF,6EAA6E;QAC7E,6EAA6E;QAC7E,8BAA8B;QAC9B,MAAM,YAAY,GAAG,8BAA8B,CAAC,IAAI,CAAC,EAAE,CACzD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CACnB,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,EAAE,GAAG,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,6BAA6B,CAAC,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;gBACrD,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CACX,kHAAkH,CACnH,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;YACtC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEjD,0DAA0D;YAC1D,aAAa,CAAC,OAAO;iBAClB,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;iBAC7B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC,CAAC;YAErE,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CACX,6HAA6H,UAAU,6CAA6C,YAAY,MAAM,CACvM,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE5C,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,mDAAmD,CAAC,EAClE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,6CAA6C,CAAC,EAC5D,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC;YAChC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,IAAI,IAAI,CAAC;YAE7C,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACxB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAEhC,mDAAmD;YACnD,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAC9C,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CACnD,CAAC;YAEF,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO,sBAAsB,CAAC;AAChC,CAAC"}

package/dist/middleware/rateLimit.d.ts

@@ -0,0 +1,29 @@
+import type { Context, Next } from "hono";
+import { RateLimitRouteHandler, type RateLimitsConfig } from "@sudobility/ratelimit_service";
+import type { ServiceDb } from "../contracts.js";
+import type { ServiceTables } from "../schema/tables.js";
+/**
+ * Default rate limit tiers
+ *
+ * - none: Free tier users (no subscription)
+ * - bandwidth_dev: Users with dev bandwidth entitlement
+ * - bandwidth_pro: Pro users with higher limits
+ * - bandwidth_ultra: Enterprise users with unlimited access
+ */
+export declare const DEFAULT_RATE_LIMITS_CONFIG: RateLimitsConfig;
+export declare const DEFAULT_ENTITLEMENT_DISPLAY_NAMES: Record<string, string>;
+export declare function createRateLimiting(opts: {
+    db: ServiceDb;
+    rateLimitCounters: ServiceTables["rateLimitCounters"];
+    revenueCatApiKey: string | undefined;
+    rateLimitsConfig: RateLimitsConfig;
+    entitlementDisplayNames: Record<string, string>;
+}): {
+    rateLimitsConfig: RateLimitsConfig;
+    entitlementDisplayNames: Record<string, string>;
+    getRateLimitRouteHandler: () => RateLimitRouteHandler;
+    rateLimitHandler: (c: Context, next: Next) => Promise<void>;
+    getTestMode: (c: Context) => boolean;
+};
+export type RateLimiting = ReturnType<typeof createRateLimiting>;
+//# sourceMappingURL=rateLimit.d.ts.map

package/dist/middleware/rateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/middleware/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAEL,qBAAqB,EACrB,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,gBAKxC,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKpE,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,EAAE,EAAE,SAAS,CAAC;IACd,iBAAiB,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACtD,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjD;;;oCAuBsC,qBAAqB;0BAqCvB,OAAO,QAAQ,IAAI;qBA3C9B,OAAO,KAAG,OAAO;EAsD1C;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/middleware/rateLimit.js

@@ -0,0 +1,85 @@
+import { createRateLimitMiddleware, RateLimitRouteHandler, } from "@sudobility/ratelimit_service";
+/**
+ * Default rate limit tiers
+ *
+ * - none: Free tier users (no subscription)
+ * - bandwidth_dev: Users with dev bandwidth entitlement
+ * - bandwidth_pro: Pro users with higher limits
+ * - bandwidth_ultra: Enterprise users with unlimited access
+ */
+export const DEFAULT_RATE_LIMITS_CONFIG = {
+    none: { hourly: 10, daily: 120, monthly: 1800 },
+    bandwidth_dev: { hourly: 100, daily: 1200, monthly: 18000 },
+    bandwidth_pro: { hourly: 800, daily: 10000, monthly: 150000 },
+    bandwidth_ultra: { hourly: undefined, daily: undefined, monthly: undefined },
+};
+export const DEFAULT_ENTITLEMENT_DISPLAY_NAMES = {
+    none: "Free",
+    bandwidth_dev: "Developer",
+    bandwidth_pro: "Pro",
+    bandwidth_ultra: "Ultra",
+};
+export function createRateLimiting(opts) {
+    const { rateLimitsConfig, entitlementDisplayNames } = opts;
+    // Lazily initialized so a missing RevenueCat key fails on first use, not at boot
+    let routeHandler = null;
+    let middleware = null;
+    function requireRevenueCatKey() {
+        if (!opts.revenueCatApiKey) {
+            throw new Error("Required environment variable REVENUECAT_API_KEY is not set");
+        }
+        return opts.revenueCatApiKey;
+    }
+    /** Extract testMode from URL query parameter to filter sandbox purchases. */
+    function getTestMode(c) {
+        const url = new URL(c.req.url);
+        return url.searchParams.get("testMode") === "true";
+    }
+    /** The route handler for rate limit endpoints. */
+    function getRateLimitRouteHandler() {
+        if (!routeHandler) {
+            routeHandler = new RateLimitRouteHandler({
+                revenueCatApiKey: requireRevenueCatKey(),
+                rateLimitsConfig,
+                db: opts.db,
+                rateLimitsTable: opts.rateLimitCounters,
+                entitlementDisplayNames,
+            });
+        }
+        return routeHandler;
+    }
+    function getMiddleware() {
+        if (!middleware) {
+            middleware = createRateLimitMiddleware({
+                revenueCatApiKey: requireRevenueCatKey(),
+                rateLimitsConfig,
+                // Cast to any to avoid type conflicts between different drizzle-orm/hono
+                // instances when using bun link for local development
+                db: opts.db,
+                rateLimitsTable: opts.rateLimitCounters,
+                getUserId: (c) => {
+                    // Set by the auth middleware for every auth method
+                    const userId = c.get("userId");
+                    if (!userId) {
+                        throw new Error("Authenticated user not found in context");
+                    }
+                    return userId;
+                },
+                getTestMode: (c) => getTestMode(c),
+            });
+        }
+        return middleware;
+    }
+    /** Rate limit middleware for endpoints that need it. */
+    async function rateLimitHandler(c, next) {
+        await getMiddleware()(c, next);
+    }
+    return {
+        rateLimitsConfig,
+        entitlementDisplayNames,
+        getRateLimitRouteHandler,
+        rateLimitHandler,
+        getTestMode,
+    };
+}
+//# sourceMappingURL=rateLimit.js.map

package/dist/middleware/rateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/middleware/rateLimit.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,+BAA+B,CAAC;AAIvC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqB;IAC1D,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;IAC/C,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3D,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;IAC7D,eAAe,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;CAC7E,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAA2B;IACvE,IAAI,EAAE,MAAM;IACZ,aAAa,EAAE,WAAW;IAC1B,aAAa,EAAE,KAAK;IACpB,eAAe,EAAE,OAAO;CACzB,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAMlC;IACC,MAAM,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,GAAG,IAAI,CAAC;IAE3D,iFAAiF;IACjF,IAAI,YAAY,GAAiC,IAAI,CAAC;IACtD,IAAI,UAAU,GAAwD,IAAI,CAAC;IAE3E,SAAS,oBAAoB;QAC3B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,SAAS,WAAW,CAAC,CAAU;QAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;IACrD,CAAC;IAED,kDAAkD;IAClD,SAAS,wBAAwB;QAC/B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,IAAI,qBAAqB,CAAC;gBACvC,gBAAgB,EAAE,oBAAoB,EAAE;gBACxC,gBAAgB;gBAChB,EAAE,EAAE,IAAI,CAAC,EAAS;gBAClB,eAAe,EAAE,IAAI,CAAC,iBAAwB;gBAC9C,uBAAuB;aACxB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,SAAS,aAAa;QACpB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,yBAAyB,CAAC;gBACrC,gBAAgB,EAAE,oBAAoB,EAAE;gBACxC,gBAAgB;gBAChB,yEAAyE;gBACzE,sDAAsD;gBACtD,EAAE,EAAE,IAAI,CAAC,EAAS;gBAClB,eAAe,EAAE,IAAI,CAAC,iBAAwB;gBAC9C,SAAS,EAAE,CAAC,CAAM,EAAE,EAAE;oBACpB,mDAAmD;oBACnD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;oBAC7D,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,wDAAwD;IACxD,KAAK,UAAU,gBAAgB,CAAC,CAAU,EAAE,IAAU;QACpD,MAAM,aAAa,EAAE,CAAC,CAAQ,EAAE,IAAW,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,uBAAuB;QACvB,wBAAwB;QACxB,gBAAgB;QAChB,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/middleware/subscription.d.ts

@@ -0,0 +1,8 @@
+import type { Context } from "hono";
+import { SubscriptionHelper } from "@sudobility/subscription_service";
+export declare function createSubscriptionAccess(revenueCatApiKey: string | undefined): {
+    getSubscriptionHelper: () => SubscriptionHelper | null;
+    getTestMode: (c: Context) => boolean;
+};
+export type SubscriptionAccess = ReturnType<typeof createSubscriptionAccess>;
+//# sourceMappingURL=subscription.d.ts.map

package/dist/middleware/subscription.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription.d.ts","sourceRoot":"","sources":["../../src/middleware/subscription.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,wBAAgB,wBAAwB,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS;iCAIzC,kBAAkB,GAAG,IAAI;qBAQnC,OAAO,KAAG,OAAO;EAM1C;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/middleware/subscription.js

@@ -0,0 +1,19 @@
+import { SubscriptionHelper } from "@sudobility/subscription_service";
+export function createSubscriptionAccess(revenueCatApiKey) {
+    let subscriptionHelper = null;
+    /** Null when RevenueCat is not configured. */
+    function getSubscriptionHelper() {
+        if (!revenueCatApiKey)
+            return null;
+        if (!subscriptionHelper) {
+            subscriptionHelper = new SubscriptionHelper({ revenueCatApiKey });
+        }
+        return subscriptionHelper;
+    }
+    function getTestMode(c) {
+        const url = new URL(c.req.url);
+        return url.searchParams.get("testMode") === "true";
+    }
+    return { getSubscriptionHelper, getTestMode };
+}
+//# sourceMappingURL=subscription.js.map

package/dist/middleware/subscription.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription.js","sourceRoot":"","sources":["../../src/middleware/subscription.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,MAAM,UAAU,wBAAwB,CAAC,gBAAoC;IAC3E,IAAI,kBAAkB,GAA8B,IAAI,CAAC;IAEzD,8CAA8C;IAC9C,SAAS,qBAAqB;QAC5B,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,SAAS,WAAW,CAAC,CAAU;QAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC;AAChD,CAAC"}

package/dist/routes/ai.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Public AI inference routes
+ * @description Handles AI endpoint invocation and prompt generation.
+ * These routes use project API key authentication (not Firebase),
+ * with optional IP allowlisting and rate limiting per entity.
+ */
+import { Hono } from "hono";
+import type { ServiceContext } from "../context.js";
+export declare function createAiRouter(ctx: ServiceContext): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=ai.d.ts.map

package/dist/routes/ai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../src/routes/ai.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA6B5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AASpD,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,8EAm5BjD"}