@tapflowio/relay 0.1.0-alpha.1

package/dist/api/passwordReset.d.ts

@@ -0,0 +1,6 @@
+import http from 'http';
+export declare function sendPasswordResetEmail(userId: number, origin: string): Promise<boolean>;
+export declare function handleVerifyReset(req: http.IncomingMessage, res: http.ServerResponse): void;
+export declare function handleDoReset(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
+export declare function handleSendMemberReset(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>): Promise<void>;
+//# sourceMappingURL=passwordReset.d.ts.map

package/dist/api/passwordReset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordReset.d.ts","sourceRoot":"","sources":["../../src/api/passwordReset.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAQvB,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgB7F;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAY3F;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtG;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/api/passwordReset.js

@@ -0,0 +1,64 @@
+import crypto from 'crypto';
+import { getDb } from '../db.js';
+import { requireRole } from '../middleware/auth.js';
+import { makePasswordHash } from './auth.js';
+import { sendMail } from '../lib/mailer.js';
+import { json, readJson } from '../router.js';
+export async function sendPasswordResetEmail(userId, origin) {
+    const db = getDb();
+    const user = db.prepare('SELECT id, email FROM users WHERE id = ?').get(userId);
+    if (!user)
+        return false;
+    const token = crypto.randomBytes(32).toString('hex');
+    const expiresAt = new Date(Date.now() + 2 * 60 * 60 * 1000).toISOString();
+    db.prepare('INSERT INTO password_reset_tokens (user_id, token, expires_at) VALUES (?, ?, ?)').run(userId, token, expiresAt);
+    const link = `${origin}/reset-password?token=${token}`;
+    const html = `<p>A password reset was requested for your tapflow account.</p>
+<p><a href="${link}">Reset your password</a></p>
+<p>This link expires in 2 hours. If you did not request this, ignore this email.</p>`;
+    return sendMail(user.email, 'Reset your tapflow password', html);
+}
+export function handleVerifyReset(req, res) {
+    const token = new URL(req.url ?? '/', 'http://x').searchParams.get('token');
+    if (!token)
+        return json(res, 400, { error: 'token required' });
+    const db = getDb();
+    const row = db.prepare(`
+    SELECT id FROM password_reset_tokens
+    WHERE token = ? AND used_at IS NULL AND expires_at > datetime('now')
+  `).get(token);
+    if (!row)
+        return json(res, 410, { error: 'Token expired or not found' });
+    json(res, 200, { ok: true });
+}
+export async function handleDoReset(req, res) {
+    const body = await readJson(req);
+    if (!body.token || !body.password)
+        return json(res, 400, { error: 'token and password required' });
+    if (body.password.length < 8)
+        return json(res, 400, { error: 'Password must be at least 8 characters' });
+    const db = getDb();
+    const row = db.prepare(`
+    SELECT id, user_id FROM password_reset_tokens
+    WHERE token = ? AND used_at IS NULL AND expires_at > datetime('now')
+  `).get(body.token);
+    if (!row)
+        return json(res, 410, { error: 'Token expired or not found' });
+    db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(makePasswordHash(body.password), row.user_id);
+    db.prepare("UPDATE password_reset_tokens SET used_at = datetime('now') WHERE id = ?").run(row.id);
+    json(res, 200, { ok: true });
+}
+export async function handleSendMemberReset(req, res, params) {
+    const auth = requireRole(req, res, ['Admin']);
+    if (!auth)
+        return;
+    const db = getDb();
+    const member = db.prepare('SELECT id FROM users WHERE id = ?').get(params.id);
+    if (!member)
+        return json(res, 404, { error: 'Member not found' });
+    const proto = req.headers['x-forwarded-proto'] ?? 'http';
+    const origin = `${proto}://${req.headers.host}`;
+    const emailSent = await sendPasswordResetEmail(member.id, origin);
+    json(res, 200, { ok: true, emailSent });
+}
+//# sourceMappingURL=passwordReset.js.map

package/dist/api/passwordReset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordReset.js","sourceRoot":"","sources":["../../src/api/passwordReset.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,MAAc;IACzE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,MAAM,CAA8C,CAAA;IAC5H,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAEzE,EAAE,CAAC,OAAO,CAAC,iFAAiF,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IAE3H,MAAM,IAAI,GAAG,GAAG,MAAM,yBAAyB,KAAK,EAAE,CAAA;IACtD,MAAM,IAAI,GAAG;cACD,IAAI;qFACmE,CAAA;IAEnF,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACnF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAE9D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAGtB,CAAC,CAAC,GAAG,CAAC,KAAK,CAA+B,CAAA;IAE3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAyB,EAAE,GAAwB;IACrF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAsC,GAAG,CAAC,CAAA;IACrE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;IAClG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAA;IAExG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAGtB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAgD,CAAA;IAEjE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;IAExE,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAC/G,EAAE,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEjG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAyB,EACzB,GAAwB,EACxB,MAA8B;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAA+B,CAAA;IAC3G,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAEjE,MAAM,KAAK,GAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB,IAAI,MAAM,CAAA;IAChF,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAEjE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;AACzC,CAAC"}

package/dist/api/profile.d.ts

@@ -0,0 +1,3 @@
+import http from 'http';
+export declare function handleUpdateProfile(req: http.IncomingMessage, res: http.ServerResponse, uploadsDir: string): void;
+//# sourceMappingURL=profile.d.ts.map

package/dist/api/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/api/profile.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAQvB,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,UAAU,EAAE,MAAM,GACjB,IAAI,CA8CN"}

package/dist/api/profile.js

@@ -0,0 +1,56 @@
+import fs from 'fs';
+import path from 'path';
+import busboy from 'busboy';
+import { getDb } from '../db.js';
+import { requireAuth } from '../middleware/auth.js';
+import { json } from '../router.js';
+export function handleUpdateProfile(req, res, uploadsDir) {
+    const auth = requireAuth(req, res);
+    if (!auth)
+        return;
+    const bb = busboy({ headers: req.headers, limits: { fileSize: 2 * 1024 * 1024 } });
+    const fields = {};
+    let avatarPath = '';
+    let sizeError = false;
+    bb.on('field', (name, val) => { fields[name] = val; });
+    bb.on('file', (_field, stream, info) => {
+        const allowed = ['image/png', 'image/jpeg'];
+        if (!allowed.includes(info.mimeType)) {
+            stream.resume();
+            return;
+        }
+        const ext = info.mimeType === 'image/png' ? '.png' : '.jpg';
+        avatarPath = path.join(uploadsDir, 'avatars', `user-${auth.userId}${ext}`);
+        fs.mkdirSync(path.dirname(avatarPath), { recursive: true });
+        let size = 0;
+        stream.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > 2 * 1024 * 1024)
+                sizeError = true;
+        });
+        stream.pipe(fs.createWriteStream(avatarPath));
+    });
+    bb.on('finish', () => {
+        if (sizeError)
+            return json(res, 400, { error: 'Max 2MB for avatar' });
+        const db = getDb();
+        const updates = [];
+        const params = [];
+        if (fields.display_name !== undefined) {
+            updates.push('display_name = ?');
+            params.push(fields.display_name || null);
+        }
+        if (avatarPath) {
+            updates.push('avatar_url = ?');
+            params.push(`/uploads/avatars/${path.basename(avatarPath)}`);
+        }
+        if (updates.length === 0)
+            return json(res, 400, { error: 'Nothing to update' });
+        params.push(auth.userId);
+        db.prepare(`UPDATE users SET ${updates.join(', ')} WHERE id = ?`).run(...params);
+        json(res, 200, { ok: true });
+    });
+    bb.on('error', () => json(res, 500, { error: 'Update failed' }));
+    req.pipe(bb);
+}
+//# sourceMappingURL=profile.js.map

package/dist/api/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/api/profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAEnC,MAAM,UAAU,mBAAmB,CACjC,GAAyB,EACzB,GAAwB,EACxB,UAAkB;IAElB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAA;IAClF,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA,CAAC,CAAC,CAAC,CAAA;IAErD,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,OAAM;QAAC,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAC3D,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAA;QAC1E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAE3D,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;YACpB,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,SAAS,GAAG,IAAI,CAAA;QAC9C,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACnB,IAAI,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAErE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;QAClB,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,MAAM,MAAM,GAAc,EAAE,CAAA;QAE5B,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAA;QAAC,CAAC;QACrH,IAAI,UAAU,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;QAEhH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;QAE/E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxB,EAAE,CAAC,OAAO,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;QAEhF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;IAChE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACd,CAAC"}

package/dist/api/recordings.d.ts

@@ -0,0 +1,6 @@
+import http from 'http';
+export declare function handleUploadRecording(req: http.IncomingMessage, res: http.ServerResponse, recordingsDir: string): void;
+export declare function handleListRecordings(req: http.IncomingMessage, res: http.ServerResponse): void;
+export declare function handleDownloadRecording(req: http.IncomingMessage, res: http.ServerResponse, recordingsDir: string): void;
+export declare function purgeExpiredRecordings(recordingsDir: string): void;
+//# sourceMappingURL=recordings.d.ts.map

package/dist/api/recordings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordings.d.ts","sourceRoot":"","sources":["../../src/api/recordings.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAcvB,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,aAAa,EAAE,MAAM,GACpB,IAAI,CA6CN;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,IAAI,CA0CN;AAED,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,aAAa,EAAE,MAAM,GACpB,IAAI,CAmCN;AAED,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAgClE"}

package/dist/api/recordings.js

@@ -0,0 +1,167 @@
+import fs from 'fs';
+import path from 'path';
+import { randomUUID } from 'crypto';
+import busboy from 'busboy';
+import { requireAuth, getAuth } from '../middleware/auth.js';
+import { getDb } from '../db.js';
+const TTL_MS = 72 * 60 * 60 * 1000;
+function expiresAt() {
+    return new Date(Date.now() + TTL_MS).toISOString().replace('T', ' ').slice(0, 19);
+}
+export function handleUploadRecording(req, res, recordingsDir) {
+    const auth = requireAuth(req, res);
+    if (!auth)
+        return;
+    const u = new URL(req.url ?? '/', 'http://x');
+    const sessionId = u.searchParams.get('sessionId') ?? null;
+    const buildId = u.searchParams.get('buildId') ? Number(u.searchParams.get('buildId')) : null;
+    fs.mkdirSync(recordingsDir, { recursive: true });
+    let filePath = '';
+    let filename = '';
+    let mime = 'video/webm';
+    let writeDone = null;
+    const bb = busboy({ headers: req.headers });
+    bb.on('file', (_field, fileStream, info) => {
+        const ext = path.extname(info.filename || '.webm') || '.webm';
+        mime = info.mimeType || mime;
+        filename = `${randomUUID()}-${Date.now()}${ext}`;
+        filePath = path.join(recordingsDir, filename);
+        const ws = fs.createWriteStream(filePath);
+        fileStream.pipe(ws);
+        writeDone = new Promise((resolve, reject) => {
+            ws.on('finish', resolve);
+            ws.on('error', reject);
+        });
+    });
+    bb.on('finish', () => {
+        if (!writeDone) {
+            res.writeHead(400);
+            res.end('No file');
+            return;
+        }
+        writeDone
+            .then(() => {
+            const stat = fs.statSync(filePath);
+            const db = getDb();
+            db.prepare(`
+          INSERT INTO recordings (filename, session_id, build_id, uploader_id, file_size, mime, expires_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?)
+        `).run(filename, sessionId, buildId, auth.userId, stat.size, mime, expiresAt());
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ url: `/api/v1/recordings/${filename}` }));
+        })
+            .catch(() => { res.writeHead(500); res.end('Write failed'); });
+    });
+    bb.on('error', () => { res.writeHead(500); res.end('Upload failed'); });
+    req.pipe(bb);
+}
+export function handleListRecordings(req, res) {
+    const auth = requireAuth(req, res);
+    if (!auth)
+        return;
+    const u = new URL(req.url ?? '/', 'http://x');
+    const buildId = u.searchParams.get('buildId');
+    const db = getDb();
+    const rows = buildId
+        ? db.prepare(`
+        SELECT id, filename, session_id, file_size, mime, created_at, expires_at
+        FROM recordings
+        WHERE expires_at > datetime('now') AND build_id = ?
+        ORDER BY created_at DESC
+      `).all(Number(buildId))
+        : db.prepare(`
+        SELECT id, filename, session_id, file_size, mime, created_at, expires_at
+        FROM recordings
+        WHERE expires_at > datetime('now')
+        ORDER BY created_at DESC
+      `).all();
+    const result = rows.map((r) => ({
+        id: r.id,
+        url: `/api/v1/recordings/${r.filename}`,
+        sessionId: r.session_id,
+        fileSize: r.file_size,
+        mime: r.mime,
+        createdAt: r.created_at,
+        expiresAt: r.expires_at,
+    }));
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(result));
+}
+export function handleDownloadRecording(req, res, recordingsDir) {
+    const auth = getAuth(req);
+    if (!auth) {
+        res.writeHead(401);
+        res.end('Unauthorized');
+        return;
+    }
+    const filename = (req.url ?? '/').split('/').pop() ?? '';
+    if (!filename || filename.includes('..') || filename.includes('/')) {
+        res.writeHead(400);
+        res.end('Invalid filename');
+        return;
+    }
+    const db = getDb();
+    const row = db.prepare(`
+    SELECT expires_at, mime FROM recordings WHERE filename = ?
+  `).get(filename);
+    if (!row) {
+        res.writeHead(404);
+        res.end('Not found');
+        return;
+    }
+    if (new Date(row.expires_at).getTime() < Date.now()) {
+        db.prepare(`DELETE FROM recordings WHERE filename = ?`).run(filename);
+        fs.unlink(path.join(recordingsDir, filename), () => { });
+        res.writeHead(404);
+        res.end('Expired');
+        return;
+    }
+    const filePath = path.join(recordingsDir, filename);
+    if (!fs.existsSync(filePath)) {
+        db.prepare(`DELETE FROM recordings WHERE filename = ?`).run(filename);
+        res.writeHead(404);
+        res.end('Not found');
+        return;
+    }
+    const stat = fs.statSync(filePath);
+    res.writeHead(200, {
+        'Content-Type': row.mime,
+        'Content-Length': stat.size,
+        'Content-Disposition': `attachment; filename="${filename}"`,
+    });
+    fs.createReadStream(filePath).pipe(res);
+}
+export function purgeExpiredRecordings(recordingsDir) {
+    if (!fs.existsSync(recordingsDir))
+        return;
+    try {
+        const db = getDb();
+        const expired = db.prepare(`
+      SELECT filename FROM recordings
+      WHERE expires_at < datetime('now')
+    `).all();
+        for (const { filename } of expired) {
+            fs.unlink(path.join(recordingsDir, filename), () => { });
+        }
+        if (expired.length > 0) {
+            const placeholders = expired.map(() => '?').join(',');
+            db.prepare(`DELETE FROM recordings WHERE filename IN (${placeholders})`).run(...expired.map((r) => r.filename));
+        }
+        // orphan 파일 정리 (DB row 없는 파일)
+        for (const file of fs.readdirSync(recordingsDir)) {
+            const row = db.prepare(`SELECT id FROM recordings WHERE filename = ?`).get(file);
+            if (!row)
+                fs.unlink(path.join(recordingsDir, file), () => { });
+        }
+    }
+    catch {
+        // DB 미초기화 시 (테스트 등) — 파일명 기반 TTL fallback
+        for (const file of fs.readdirSync(recordingsDir)) {
+            const match = file.match(/-(\d+)\.[^.]+$/);
+            if (match && Date.now() - Number(match[1]) > TTL_MS) {
+                fs.unlink(path.join(recordingsDir, file), () => { });
+            }
+        }
+    }
+}
+//# sourceMappingURL=recordings.js.map

package/dist/api/recordings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordings.js","sourceRoot":"","sources":["../../src/api/recordings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAEhC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAElC,SAAS,SAAS;IAChB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACnF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAAyB,EACzB,GAAwB,EACxB,aAAqB;IAErB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAA;IAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAA;IACzD,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAE5F,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEhD,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,IAAI,GAAG,YAAY,CAAA;IACvB,IAAI,SAAS,GAAyB,IAAI,CAAA;IAE1C,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAA4C,EAAE,CAAC,CAAA;IAChF,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,OAAO,CAAA;QAC7D,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAA;QAC5B,QAAQ,GAAG,GAAG,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAA;QAChD,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QACzC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACnB,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YACxB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACxB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACnB,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QAClE,SAAS;aACN,IAAI,CAAC,GAAG,EAAE;YACT,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;YAClB,EAAE,CAAC,OAAO,CAAC;;;SAGV,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;YAC/E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,sBAAsB,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAA;QACpE,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACtE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAyB,EACzB,GAAwB;IAExB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAE7C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,IAAI,GAAG,OAAO;QAClB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;OAKV,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;OAKV,CAAC,CAAC,GAAG,EAAE,CAAA;IAEZ,MAAM,MAAM,GAAI,IAQZ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAAE;QACvC,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,GAAyB,EACzB,GAAwB,EACxB,aAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAAC,OAAM;IAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;IACxD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAAC,OAAM;IACzD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;GAEtB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAqD,CAAA;IAEpE,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAAC,OAAM;IAAC,CAAC;IAE9D,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpD,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACvD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAAC,OAAM;IAChD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAAC,OAAM;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,GAAG,CAAC,IAAI;QACxB,gBAAgB,EAAE,IAAI,CAAC,IAAI;QAC3B,qBAAqB,EAAE,yBAAyB,QAAQ,GAAG;KAC5D,CAAC,CAAA;IACF,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,aAAqB;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAM;IAEzC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;QAClB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;;;KAG1B,CAAC,CAAC,GAAG,EAA4B,CAAA;QAElC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;YACnC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACrD,EAAE,CAAC,OAAO,CAAC,6CAA6C,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;QACjH,CAAC;QAED,8BAA8B;QAC9B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAChF,IAAI,CAAC,GAAG;gBAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;QAC1C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;YAC1C,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC;gBACpD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/api/settings.d.ts

@@ -0,0 +1,4 @@
+import http from 'http';
+export declare function handleGetSettings(req: http.IncomingMessage, res: http.ServerResponse): void;
+export declare function handleUpdateSettings(req: http.IncomingMessage, res: http.ServerResponse, uploadsDir: string): void;
+//# sourceMappingURL=settings.d.ts.map

package/dist/api/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/api/settings.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAQvB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAY3F;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,UAAU,EAAE,MAAM,GACjB,IAAI,CA4CN"}

package/dist/api/settings.js

@@ -0,0 +1,65 @@
+import fs from 'fs';
+import path from 'path';
+import busboy from 'busboy';
+import { getDb } from '../db.js';
+import { requireRole, requireAuth } from '../middleware/auth.js';
+import { json } from '../router.js';
+export function handleGetSettings(req, res) {
+    const auth = requireAuth(req, res);
+    if (!auth)
+        return;
+    const db = getDb();
+    const settings = db.prepare('SELECT team_name, logo_path FROM team_settings WHERE id = 1').get();
+    json(res, 200, {
+        team_name: settings?.team_name ?? 'tapflow',
+        logo_url: settings?.logo_path ? `/uploads/team/${path.basename(settings.logo_path)}` : null,
+    });
+}
+export function handleUpdateSettings(req, res, uploadsDir) {
+    const auth = requireRole(req, res, ['Admin']);
+    if (!auth)
+        return;
+    const bb = busboy({ headers: req.headers, limits: { fileSize: 2 * 1024 * 1024 } });
+    const fields = {};
+    let logoPath = '';
+    let sizeError = false;
+    bb.on('field', (name, val) => { fields[name] = val; });
+    bb.on('file', (_field, stream, info) => {
+        const allowed = ['image/png', 'image/jpeg'];
+        if (!allowed.includes(info.mimeType)) {
+            stream.resume();
+            return;
+        }
+        const ext = info.mimeType === 'image/png' ? '.png' : '.jpg';
+        logoPath = path.join(uploadsDir, 'team', `logo${ext}`);
+        fs.mkdirSync(path.dirname(logoPath), { recursive: true });
+        let size = 0;
+        stream.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > 2 * 1024 * 1024)
+                sizeError = true;
+        });
+        stream.pipe(fs.createWriteStream(logoPath));
+    });
+    bb.on('finish', () => {
+        if (sizeError)
+            return json(res, 400, { error: 'Max 2MB for logo' });
+        const db = getDb();
+        const updates = ['updated_at = datetime(\'now\')'];
+        const params = [];
+        if (fields.team_name) {
+            updates.push('team_name = ?');
+            params.push(fields.team_name);
+        }
+        if (logoPath) {
+            updates.push('logo_path = ?');
+            params.push(logoPath);
+        }
+        params.push(1);
+        db.prepare(`UPDATE team_settings SET ${updates.join(', ')} WHERE id = ?`).run(...params);
+        json(res, 200, { ok: true });
+    });
+    bb.on('error', () => json(res, 500, { error: 'Update failed' }));
+    req.pipe(bb);
+}
+//# sourceMappingURL=settings.js.map

package/dist/api/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/api/settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAEnC,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,EACjC,CAAA;IAE7D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;QACb,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,SAAS;QAC3C,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KAC5F,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAyB,EACzB,GAAwB,EACxB,UAAkB;IAElB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAA;IAClF,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAA,CAAC,CAAC,CAAC,CAAA;IAErD,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,OAAM;QAAC,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAC3D,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE,CAAC,CAAA;QACtD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;YACpB,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,SAAS,GAAG,IAAI,CAAA;QAC9C,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACnB,IAAI,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAEnE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;QAClB,MAAM,OAAO,GAAa,CAAC,gCAAgC,CAAC,CAAA;QAC5D,MAAM,MAAM,GAAc,EAAE,CAAA;QAE5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;QACtF,IAAI,QAAQ,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAAC,CAAC;QAEtE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACd,EAAE,CAAC,OAAO,CAAC,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;QAExF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;IAChE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACd,CAAC"}

package/dist/api/team.d.ts

@@ -0,0 +1,6 @@
+import http from 'http';
+export declare function handleListMembers(req: http.IncomingMessage, res: http.ServerResponse): void;
+export declare function handleInvite(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
+export declare function handleUpdateMember(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>): Promise<void>;
+export declare function handleDeleteMember(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>): void;
+//# sourceMappingURL=team.d.ts.map

package/dist/api/team.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.d.ts","sourceRoot":"","sources":["../../src/api/team.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAOvB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAS3F;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BrG;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,IAAI,CAYN"}

package/dist/api/team.js

@@ -0,0 +1,65 @@
+import crypto from 'crypto';
+import { getDb } from '../db.js';
+import { requireRole } from '../middleware/auth.js';
+import { json, readJson } from '../router.js';
+import { sendMail } from '../lib/mailer.js';
+export function handleListMembers(req, res) {
+    const auth = requireRole(req, res, ['Admin']);
+    if (!auth)
+        return;
+    const db = getDb();
+    const members = db.prepare('SELECT id, email, display_name, role, joined_at FROM users ORDER BY joined_at ASC').all();
+    json(res, 200, members);
+}
+export async function handleInvite(req, res) {
+    const auth = requireRole(req, res, ['Admin']);
+    if (!auth)
+        return;
+    const body = await readJson(req);
+    const role = ['Admin', 'Developer', 'QA', 'Viewer'].includes(body.role ?? '')
+        ? body.role
+        : 'QA';
+    const token = crypto.randomBytes(32).toString('hex');
+    const expiresAt = new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString();
+    const db = getDb();
+    db.prepare('INSERT INTO invitations (token, email, role, expires_at) VALUES (?, ?, ?, ?)')
+        .run(token, body.email ?? null, role, expiresAt);
+    let emailSent = false;
+    if (body.email) {
+        const proto = req.headers['x-forwarded-proto'] ?? 'http';
+        const inviteUrl = `${proto}://${req.headers.host}/invite?token=${token}`;
+        const html = `<p>You've been invited to join tapflow as <strong>${role}</strong>.</p>
+<p><a href="${inviteUrl}">Accept invitation</a></p>
+<p>This link expires in 7 days.</p>`;
+        emailSent = await sendMail(body.email, 'You have been invited to tapflow', html);
+    }
+    json(res, 201, { token, emailSent });
+}
+export async function handleUpdateMember(req, res, params) {
+    const auth = requireRole(req, res, ['Admin']);
+    if (!auth)
+        return;
+    const body = await readJson(req);
+    if (!body.role || !['Admin', 'Developer', 'QA', 'Viewer'].includes(body.role)) {
+        return json(res, 400, { error: 'Valid role required' });
+    }
+    const db = getDb();
+    const result = db.prepare('UPDATE users SET role = ? WHERE id = ?').run(body.role, params.id);
+    if (result.changes === 0)
+        return json(res, 404, { error: 'Member not found' });
+    json(res, 200, { ok: true });
+}
+export function handleDeleteMember(req, res, params) {
+    const auth = requireRole(req, res, ['Admin']);
+    if (!auth)
+        return;
+    if (String(auth.userId) === params.id) {
+        return json(res, 400, { error: 'Cannot remove yourself' });
+    }
+    const db = getDb();
+    const result = db.prepare('DELETE FROM users WHERE id = ?').run(params.id);
+    if (result.changes === 0)
+        return json(res, 404, { error: 'Member not found' });
+    json(res, 204, null);
+}
+//# sourceMappingURL=team.js.map

package/dist/api/team.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.js","sourceRoot":"","sources":["../../src/api/team.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CACxB,mFAAmF,CACpF,CAAC,GAAG,EAAE,CAAA;IACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAyB,EAAE,GAAwB;IACpF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoC,GAAG,CAAC,CAAA;IACnE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,IAAK;QACZ,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAE3E,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,EAAE,CAAC,OAAO,CAAC,8EAA8E,CAAC;SACvF,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAElD,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB,IAAI,MAAM,CAAA;QAChF,MAAM,SAAS,GAAG,GAAG,KAAK,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,iBAAiB,KAAK,EAAE,CAAA;QACxE,MAAM,IAAI,GAAG,qDAAqD,IAAI;cAC5D,SAAS;oCACa,CAAA;QAChC,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,kCAAkC,EAAE,IAAI,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAyB,EACzB,GAAwB,EACxB,MAA8B;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoB,GAAG,CAAC,CAAA;IACnD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IAC7F,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAyB,EACzB,GAAwB,EACxB,MAA8B;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtB,CAAC"}

package/dist/api/tokens.d.ts

@@ -0,0 +1,5 @@
+import http from 'http';
+export declare function handleListTokens(req: http.IncomingMessage, res: http.ServerResponse): void;
+export declare function handleCreateToken(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
+export declare function handleRevokeToken(req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>): void;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/api/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/api/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAMvB,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAS1F;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB1G;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,IAAI,CAWN"}

package/dist/api/tokens.js

@@ -0,0 +1,39 @@
+import crypto from 'crypto';
+import { getDb } from '../db.js';
+import { requireAuth, hashPat } from '../middleware/auth.js';
+import { json, readJson } from '../router.js';
+export function handleListTokens(req, res) {
+    const auth = requireAuth(req, res);
+    if (!auth)
+        return;
+    const db = getDb();
+    const tokens = db.prepare('SELECT id, name, scope, last_used_at, expires_at, created_at FROM personal_access_tokens WHERE user_id = ? ORDER BY created_at DESC').all(auth.userId);
+    json(res, 200, tokens);
+}
+export async function handleCreateToken(req, res) {
+    const auth = requireAuth(req, res);
+    if (!auth)
+        return;
+    const body = await readJson(req);
+    if (!body.name?.trim())
+        return json(res, 400, { error: 'name required' });
+    const rawToken = `tflw_pat_${crypto.randomBytes(32).toString('hex')}`;
+    const tokenHash = hashPat(rawToken);
+    const expiresAt = body.expires_in_days
+        ? new Date(Date.now() + body.expires_in_days * 24 * 3600 * 1000).toISOString()
+        : null;
+    const db = getDb();
+    db.prepare('INSERT INTO personal_access_tokens (user_id, name, token_hash, scope, expires_at) VALUES (?, ?, ?, ?, ?)').run(auth.userId, body.name.trim(), tokenHash, 'builds:write', expiresAt);
+    json(res, 201, { token: rawToken });
+}
+export function handleRevokeToken(req, res, params) {
+    const auth = requireAuth(req, res);
+    if (!auth)
+        return;
+    const db = getDb();
+    const result = db.prepare('DELETE FROM personal_access_tokens WHERE id = ? AND user_id = ?').run(params.id, auth.userId);
+    if (result.changes === 0)
+        return json(res, 404, { error: 'Token not found' });
+    json(res, 204, null);
+}
+//# sourceMappingURL=tokens.js.map

package/dist/api/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/api/tokens.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,UAAU,gBAAgB,CAAC,GAAyB,EAAE,GAAwB;IAClF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,qIAAqI,CACtI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACzF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA8C,GAAG,CAAC,CAAA;IAC7E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;IAEzE,MAAM,QAAQ,GAAG,YAAY,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe;QACpC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC9E,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,EAAE,CAAC,OAAO,CACR,0GAA0G,CAC3G,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,CAAA;IAE1E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAyB,EACzB,GAAwB,EACxB,MAA8B;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,iEAAiE,CAClE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAE7B,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtB,CAAC"}

package/dist/db.d.ts

@@ -0,0 +1,5 @@
+import Database from 'better-sqlite3';
+export declare function getDb(): Database.Database;
+export declare function closeDb(): void;
+export declare function initDb(dbPath: string): void;
+//# sourceMappingURL=db.d.ts.map

package/dist/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AAMrC,wBAAgB,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAGzC;AAED,wBAAgB,OAAO,IAAI,IAAI,CAG9B;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAM3C"}

package/dist/db.js

@@ -0,0 +1,43 @@
+import Database from 'better-sqlite3';
+import fs from 'fs';
+import path from 'path';
+let db = null;
+export function getDb() {
+    if (!db)
+        throw new Error('DB not initialized — call initDb() first');
+    return db;
+}
+export function closeDb() {
+    db?.close();
+    db = null;
+}
+export function initDb(dbPath) {
+    fs.mkdirSync(path.dirname(dbPath), { recursive: true });
+    db = new Database(dbPath);
+    db.pragma('journal_mode = WAL');
+    db.pragma('foreign_keys = ON');
+    runMigrations();
+}
+function runMigrations() {
+    const d = getDb();
+    d.exec(`
+    CREATE TABLE IF NOT EXISTS _migrations (
+      id      INTEGER PRIMARY KEY AUTOINCREMENT,
+      name    TEXT NOT NULL UNIQUE,
+      run_at  TEXT NOT NULL DEFAULT (datetime('now'))
+    )
+  `);
+    const migrationsDir = path.join(import.meta.dirname, 'migrations');
+    const files = fs.readdirSync(migrationsDir).filter((f) => f.endsWith('.sql')).sort();
+    const ran = new Set(d.prepare('SELECT name FROM _migrations').all().map((r) => r.name));
+    for (const file of files) {
+        if (ran.has(file))
+            continue;
+        const sql = fs.readFileSync(path.join(migrationsDir, file), 'utf-8');
+        d.transaction(() => {
+            d.exec(sql);
+            d.prepare('INSERT INTO _migrations (name) VALUES (?)').run(file);
+        })();
+    }
+}
+//# sourceMappingURL=db.js.map