alepha 0.20.1 → 0.20.3

package/dist/api/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/api/keys/schemas/adminApiKeyQuerySchema.ts","../../../src/api/keys/schemas/adminApiKeyResourceSchema.ts","../../../src/api/keys/entities/apiKeyEntity.ts","../../../src/api/keys/services/ApiKeyService.ts","../../../src/api/keys/controllers/AdminApiKeyController.ts","../../../src/api/keys/schemas/createApiKeyBodySchema.ts","../../../src/api/keys/schemas/createApiKeyResponseSchema.ts","../../../src/api/keys/schemas/listApiKeyResponseSchema.ts","../../../src/api/keys/schemas/revokeApiKeyParamsSchema.ts","../../../src/api/keys/schemas/revokeApiKeyResponseSchema.ts","../../../src/api/keys/controllers/ApiKeyController.ts","../../../src/api/keys/index.ts"],"sourcesContent":["import { t } from \"alepha\";\nimport { pageQuerySchema } from \"alepha/orm\";\n\nexport const adminApiKeyQuerySchema = t.extend(pageQuerySchema, {\n  userId: t.optional(t.uuid()),\n  includeRevoked: t.optional(t.boolean()),\n});\n","import { t } from \"alepha\";\n\nexport const adminApiKeyResourceSchema = t.object({\n  id: t.uuid(),\n  userId: t.uuid(),\n  name: t.string(),\n  description: t.optional(t.string()),\n  tokenPrefix: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  lastUsedAt: t.optional(t.datetime()),\n  lastUsedIp: t.optional(t.string()),\n  expiresAt: t.optional(t.datetime()),\n  revokedAt: t.optional(t.datetime()),\n  usageCount: t.integer(),\n});\n","import { type Static, t } from \"alepha\";\nimport { $entity, db } from \"alepha/orm\";\n\nexport const apiKeyEntity = $entity({\n  name: \"api_keys\",\n  schema: t.object({\n    id: db.primaryKey(t.uuid()),\n    createdAt: db.createdAt(),\n    updatedAt: db.updatedAt(),\n\n    // Owner\n    userId: t.uuid(),\n\n    // Key metadata\n    name: t.text({ maxLength: 100 }),\n    description: t.optional(t.text({ maxLength: 500 })),\n\n    // Token (hashed) - internal, not user input\n    tokenHash: t.string({ maxLength: 256 }),\n    tokenPrefix: t.string({ maxLength: 10 }),\n    tokenSuffix: t.string({ maxLength: 8 }),\n\n    // Roles (snapshot from user at creation)\n    roles: db.default(t.array(t.string()), []),\n\n    // Tracking\n    lastUsedAt: t.optional(t.datetime()),\n    lastUsedIp: t.optional(t.string({ maxLength: 45 })),\n    usageCount: db.default(t.integer(), 0),\n\n    // Lifecycle\n    expiresAt: t.optional(t.datetime()),\n    revokedAt: t.optional(t.datetime()),\n  }),\n  indexes: [\n    { columns: [\"userId\", \"name\"], unique: true },\n    { columns: [\"tokenHash\"], unique: true },\n  ],\n});\n\nexport type ApiKeyEntity = Static<typeof apiKeyEntity.schema>;\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { $inject, Alepha } from \"alepha\";\nimport { $cache } from \"alepha/cache\";\nimport { DateTimeProvider } from \"alepha/datetime\";\nimport { $logger } from \"alepha/logger\";\nimport { $repository, sql } from \"alepha/orm\";\nimport type { IssuerResolver, UserInfo } from \"alepha/security\";\nimport { ForbiddenError, type ServerRequest } from \"alepha/server\";\nimport { type ApiKeyEntity, apiKeyEntity } from \"../entities/apiKeyEntity.ts\";\n\nexport class ApiKeyService {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly dateTimeProvider = $inject(DateTimeProvider);\n  protected readonly log = $logger();\n  protected readonly repo = $repository(apiKeyEntity);\n\n  /**\n   * Cache validated API keys for 15 minutes.\n   */\n  protected readonly validationCache = $cache<ApiKeyEntity | null, [string]>({\n    name: \"api:keys:validation\",\n    ttl: [15, \"minutes\"],\n  });\n\n  // -------------------------------------------------------------------------\n  // Resolver\n  // -------------------------------------------------------------------------\n\n  /**\n   * Create an issuer resolver for API key authentication.\n   * Lower priority means it runs before JWT resolver.\n   *\n   * @param options.priority - Priority of this resolver (default: 50, JWT is 100)\n   * @param options.prefix - API key prefix to match in Bearer header (default: \"ak\")\n   */\n  public createResolver(\n    options: { priority?: number; prefix?: string } = {},\n  ): IssuerResolver {\n    const { priority = 50, prefix = \"ak\" } = options;\n    const prefixPattern = `${prefix}_`;\n\n    return {\n      priority,\n      onRequest: async (req: ServerRequest) => {\n        // Try query param first\n        const url = typeof req.url === \"string\" ? new URL(req.url) : req.url;\n        let token = url.searchParams.get(\"api_key\");\n\n        // Try Bearer header - only if token starts with expected prefix\n        if (!token) {\n          const auth = req.headers.authorization;\n          if (auth?.startsWith(\"Bearer \")) {\n            const bearerToken = auth.slice(7);\n            if (bearerToken.startsWith(prefixPattern)) {\n              token = bearerToken;\n            }\n          }\n        }\n\n        if (!token) {\n          return null;\n        }\n\n        return this.validate(token);\n      },\n    };\n  }\n\n  // -------------------------------------------------------------------------\n  // CRUD\n  // -------------------------------------------------------------------------\n\n  /**\n   * Create a new API key for a user.\n   * Returns both the API key entity and the plain token (which is only available once).\n   */\n  public async create(options: {\n    userId: string;\n    name: string;\n    roles: string[];\n    description?: string;\n    expiresAt?: Date;\n    prefix?: string;\n  }): Promise<{ apiKey: ApiKeyEntity; token: string }> {\n    const prefix = options.prefix ?? \"ak\";\n    const random = randomBytes(24).toString(\"base64url\");\n    const token = `${prefix}_${random}`;\n    const hash = this.hashToken(token);\n    const suffix = token.slice(-8);\n\n    const apiKey = await this.repo.create({\n      userId: options.userId,\n      name: options.name,\n      description: options.description,\n      tokenHash: hash,\n      tokenPrefix: prefix,\n      tokenSuffix: suffix,\n      roles: options.roles,\n      expiresAt: options.expiresAt?.toISOString(),\n    });\n\n    this.log.info(\"API key created\", {\n      apiKeyId: apiKey.id,\n      userId: options.userId,\n      name: options.name,\n    });\n\n    return { apiKey, token };\n  }\n\n  /**\n   * List all non-revoked API keys for a user.\n   */\n  public async list(userId: string): Promise<ApiKeyEntity[]> {\n    return this.repo.findMany({\n      where: {\n        userId: { eq: userId },\n        revokedAt: { isNull: true },\n      },\n      orderBy: { column: \"createdAt\", direction: \"desc\" },\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // Admin Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Find all API keys with optional filtering (admin only).\n   */\n  public async findAll(query: {\n    userId?: string;\n    includeRevoked?: boolean;\n    page?: number;\n    size?: number;\n    sort?: string;\n  }) {\n    query.sort ??= \"-createdAt\";\n\n    const where = this.repo.createQueryWhere();\n\n    if (query.userId) {\n      where.userId = { eq: query.userId };\n    }\n\n    if (!query.includeRevoked) {\n      where.revokedAt = { isNull: true };\n    }\n\n    return this.repo.paginate(query, { where }, { count: true });\n  }\n\n  /**\n   * Get an API key by ID (admin only).\n   */\n  public async getById(id: string): Promise<ApiKeyEntity> {\n    return await this.repo.getById(id);\n  }\n\n  /**\n   * Revoke any API key (admin only).\n   */\n  public async revokeByAdmin(id: string): Promise<void> {\n    const apiKey = await this.repo.getById(id);\n\n    if (apiKey.revokedAt) {\n      return; // Already revoked\n    }\n\n    // Invalidate cache\n    await this.validationCache.invalidate(apiKey.tokenHash);\n\n    await this.repo.updateById(id, {\n      revokedAt: this.dateTimeProvider.now().toISOString(),\n    });\n\n    this.log.info(\"API key revoked by admin\", {\n      apiKeyId: id,\n      userId: apiKey.userId,\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // User Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Revoke an API key. Only the owner can revoke their own keys.\n   */\n  public async revoke(id: string, userId: string): Promise<void> {\n    const apiKey = await this.repo.getById(id);\n\n    if (apiKey.userId !== userId) {\n      throw new ForbiddenError(\"Not your API key\");\n    }\n\n    await this.validationCache.invalidate(apiKey.tokenHash);\n\n    await this.repo.updateById(id, {\n      revokedAt: this.dateTimeProvider.now().toISOString(),\n    });\n\n    this.log.info(\"API key revoked\", {\n      apiKeyId: id,\n      userId,\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // Validation\n  // -------------------------------------------------------------------------\n\n  /**\n   * Validate an API key token and return user info if valid.\n   */\n  public async validate(token: string): Promise<UserInfo | null> {\n    // Quick check for API key format\n    if (!token.includes(\"_\")) {\n      return null;\n    }\n\n    const hash = this.hashToken(token);\n\n    // Try cache first\n    let apiKey = await this.validationCache.get(hash);\n\n    // If not in cache, look up in database\n    if (apiKey === undefined) {\n      apiKey =\n        (await this.repo.findOne({\n          where: { tokenHash: { eq: hash } },\n        })) ?? null;\n\n      // Store in cache (even if null, to prevent repeated lookups)\n      await this.validationCache.set(hash, apiKey);\n    }\n\n    if (!apiKey) {\n      return null;\n    }\n\n    // Check revocation\n    if (apiKey.revokedAt) {\n      return null;\n    }\n\n    // Check expiration\n    if (\n      apiKey.expiresAt &&\n      this.dateTimeProvider.now().isAfter(apiKey.expiresAt)\n    ) {\n      return null;\n    }\n\n    // Update usage stats (fire and forget)\n    this.updateUsage(apiKey.id).catch((error) => {\n      this.log.warn(\"Failed to update API key usage\", { error });\n    });\n\n    return {\n      id: apiKey.userId,\n      roles: apiKey.roles,\n    };\n  }\n\n  /**\n   * Update usage statistics for an API key.\n   */\n  protected async updateUsage(id: string): Promise<void> {\n    const request = this.alepha.store.get(\"alepha.http.request\");\n\n    await this.repo.updateById(id, {\n      lastUsedAt: this.dateTimeProvider.now().toISOString(),\n      lastUsedIp: request?.ip,\n      usageCount: sql`${this.repo.table.usageCount} + 1`,\n    });\n  }\n\n  /**\n   * Hash a token using SHA-256.\n   */\n  protected hashToken(token: string): string {\n    return createHash(\"sha256\").update(token).digest(\"hex\");\n  }\n}\n","import { $inject, t } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action, okSchema } from \"alepha/server\";\nimport { adminApiKeyQuerySchema } from \"../schemas/adminApiKeyQuerySchema.ts\";\nimport { adminApiKeyResourceSchema } from \"../schemas/adminApiKeyResourceSchema.ts\";\nimport { ApiKeyService } from \"../services/ApiKeyService.ts\";\n\n/**\n * REST API controller for admin API key management.\n * Admins can list, view, and revoke any API key.\n */\nexport class AdminApiKeyController {\n  protected readonly url = \"/admin/api-keys\";\n  protected readonly group = \"admin:api-keys\";\n  protected readonly apiKeyService = $inject(ApiKeyService);\n\n  /**\n   * Find all API keys with optional filtering.\n   */\n  public readonly findApiKeys = $action({\n    path: this.url,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:read\"] })],\n    description: \"Find API keys with pagination and filtering\",\n    schema: {\n      query: adminApiKeyQuerySchema,\n      response: t.page(adminApiKeyResourceSchema),\n    },\n    handler: ({ query }) => {\n      const { userId, includeRevoked, ...pagination } = query;\n      return this.apiKeyService.findAll({\n        userId,\n        includeRevoked,\n        ...pagination,\n      });\n    },\n  });\n\n  /**\n   * Get an API key by ID.\n   */\n  public readonly getApiKey = $action({\n    path: `${this.url}/:id`,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:read\"] })],\n    description: \"Get an API key by ID\",\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: adminApiKeyResourceSchema,\n    },\n    handler: ({ params }) => this.apiKeyService.getById(params.id),\n  });\n\n  /**\n   * Revoke any API key.\n   */\n  public readonly revokeApiKey = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:delete\"] })],\n    description: \"Revoke an API key\",\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: okSchema,\n    },\n    handler: async ({ params }) => {\n      await this.apiKeyService.revokeByAdmin(params.id);\n      return { ok: true, id: params.id };\n    },\n  });\n}\n","import { t } from \"alepha\";\n\nexport const createApiKeyBodySchema = t.object({\n  name: t.text({ minLength: 1, maxLength: 100 }),\n  description: t.optional(t.text({ maxLength: 500 })),\n  expiresAt: t.optional(t.datetime()),\n});\n","import { t } from \"alepha\";\n\nexport const createApiKeyResponseSchema = t.object({\n  id: t.uuid(),\n  name: t.string(),\n  token: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  expiresAt: t.optional(t.datetime()),\n});\n","import { t } from \"alepha\";\n\nexport const listApiKeyItemSchema = t.object({\n  id: t.uuid(),\n  name: t.string(),\n  tokenPrefix: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  lastUsedAt: t.optional(t.datetime()),\n  expiresAt: t.optional(t.datetime()),\n  usageCount: t.integer(),\n});\n\nexport const listApiKeyResponseSchema = t.array(listApiKeyItemSchema);\n","import { t } from \"alepha\";\n\nexport const revokeApiKeyParamsSchema = t.object({\n  id: t.uuid(),\n});\n","import { t } from \"alepha\";\n\nexport const revokeApiKeyResponseSchema = t.object({\n  ok: t.boolean(),\n});\n","import { $inject } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action } from \"alepha/server\";\nimport { createApiKeyBodySchema } from \"../schemas/createApiKeyBodySchema.ts\";\nimport { createApiKeyResponseSchema } from \"../schemas/createApiKeyResponseSchema.ts\";\nimport { listApiKeyResponseSchema } from \"../schemas/listApiKeyResponseSchema.ts\";\nimport { revokeApiKeyParamsSchema } from \"../schemas/revokeApiKeyParamsSchema.ts\";\nimport { revokeApiKeyResponseSchema } from \"../schemas/revokeApiKeyResponseSchema.ts\";\nimport { ApiKeyService } from \"../services/ApiKeyService.ts\";\n\n/**\n * REST API controller for user's own API key management.\n * Users can create, list, and revoke their own API keys.\n */\nexport class ApiKeyController {\n  protected readonly url = \"/api-keys\";\n  protected readonly group = \"api-keys\";\n  protected readonly apiKeyService = $inject(ApiKeyService);\n\n  /**\n   * Create a new API key for the authenticated user.\n   * The token is only returned once upon creation.\n   */\n  public readonly createApiKey = $action({\n    method: \"POST\",\n    path: this.url,\n    group: this.group,\n    description: \"Create a new API key\",\n    use: [$secure({ permissions: [\"api-key:create\"] })],\n    schema: {\n      body: createApiKeyBodySchema,\n      response: createApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      const { apiKey, token } = await this.apiKeyService.create({\n        userId: request.user.id,\n        name: request.body.name,\n        description: request.body.description,\n        roles: request.user.roles ?? [],\n        expiresAt: request.body.expiresAt\n          ? new Date(request.body.expiresAt)\n          : undefined,\n      });\n\n      return {\n        id: apiKey.id,\n        name: apiKey.name,\n        token,\n        tokenSuffix: apiKey.tokenSuffix,\n        roles: apiKey.roles,\n        createdAt: apiKey.createdAt,\n        expiresAt: apiKey.expiresAt,\n      };\n    },\n  });\n\n  /**\n   * List all active API keys for the authenticated user.\n   * Does not return the actual tokens.\n   */\n  public readonly listApiKeys = $action({\n    path: this.url,\n    group: this.group,\n    description: \"List your API keys\",\n    use: [$secure({ permissions: [\"api-key:read\"] })],\n    schema: {\n      response: listApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      const apiKeys = await this.apiKeyService.list(request.user.id);\n\n      return apiKeys.map((apiKey) => ({\n        id: apiKey.id,\n        name: apiKey.name,\n        tokenPrefix: apiKey.tokenPrefix,\n        tokenSuffix: apiKey.tokenSuffix,\n        roles: apiKey.roles,\n        createdAt: apiKey.createdAt,\n        lastUsedAt: apiKey.lastUsedAt,\n        expiresAt: apiKey.expiresAt,\n        usageCount: apiKey.usageCount,\n      }));\n    },\n  });\n\n  /**\n   * Revoke an API key. Only the owner can revoke their own keys.\n   */\n  public readonly revokeMyApiKey = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: this.group,\n    description: \"Revoke an API key\",\n    use: [$secure({ permissions: [\"api-key:delete\"] })],\n    schema: {\n      params: revokeApiKeyParamsSchema,\n      response: revokeApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      await this.apiKeyService.revoke(request.params.id, request.user.id);\n      return { ok: true };\n    },\n  });\n}\n","import { $module } from \"alepha\";\nimport { AdminApiKeyController } from \"./controllers/AdminApiKeyController.ts\";\nimport { ApiKeyController } from \"./controllers/ApiKeyController.ts\";\nimport { ApiKeyService } from \"./services/ApiKeyService.ts\";\n\nexport * from \"./controllers/AdminApiKeyController.ts\";\nexport * from \"./controllers/ApiKeyController.ts\";\nexport * from \"./entities/apiKeyEntity.ts\";\nexport * from \"./schemas/adminApiKeyQuerySchema.ts\";\nexport * from \"./schemas/adminApiKeyResourceSchema.ts\";\nexport * from \"./schemas/createApiKeyBodySchema.ts\";\nexport * from \"./schemas/createApiKeyResponseSchema.ts\";\nexport * from \"./schemas/listApiKeyResponseSchema.ts\";\nexport * from \"./schemas/revokeApiKeyParamsSchema.ts\";\nexport * from \"./schemas/revokeApiKeyResponseSchema.ts\";\nexport * from \"./services/ApiKeyService.ts\";\n\n/**\n * API key management module for programmatic access.\n *\n * **Features:**\n * - Create API keys with role snapshots\n * - List and revoke API keys\n * - 15-minute validation caching\n * - Query param (?api_key=) and Bearer header support\n *\n * **Integration:**\n * To enable API key authentication for an issuer, register the resolver:\n *\n * ```ts\n * class MyApp {\n *   apiKeyService = $inject(ApiKeyService);\n *   issuer = $issuer({\n *     secret: env.APP_SECRET,\n *     resolvers: [this.apiKeyService.createResolver()],\n *   });\n * }\n * ```\n *\n * @module alepha.api.keys\n */\nexport const AlephaApiKeys = $module({\n  name: \"alepha.api.keys\",\n  services: [ApiKeyService, ApiKeyController, AdminApiKeyController],\n});\n"],"mappings":";;;;;;;;;AAGA,MAAa,yBAAyB,EAAE,OAAO,iBAAiB;CAC9D,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;CAC5B,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC;CACxC,CAAC;;;ACJF,MAAa,4BAA4B,EAAE,OAAO;CAChD,IAAI,EAAE,MAAM;CACZ,QAAQ,EAAE,MAAM;CAChB,MAAM,EAAE,QAAQ;CAChB,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;CACnC,aAAa,EAAE,QAAQ;CACvB,aAAa,EAAE,QAAQ;CACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1B,WAAW,EAAE,UAAU;CACvB,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;CAClC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACnC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACnC,YAAY,EAAE,SAAS;CACxB,CAAC;;;ACbF,MAAa,eAAe,QAAQ;CAClC,MAAM;CACN,QAAQ,EAAE,OAAO;EACf,IAAI,GAAG,WAAW,EAAE,MAAM,CAAC;EAC3B,WAAW,GAAG,WAAW;EACzB,WAAW,GAAG,WAAW;EAGzB,QAAQ,EAAE,MAAM;EAGhB,MAAM,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC;EAChC,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC,CAAC;EAGnD,WAAW,EAAE,OAAO,EAAE,WAAW,KAAK,CAAC;EACvC,aAAa,EAAE,OAAO,EAAE,WAAW,IAAI,CAAC;EACxC,aAAa,EAAE,OAAO,EAAE,WAAW,GAAG,CAAC;EAGvC,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;EAG1C,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;EACpC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,IAAI,CAAC,CAAC;EACnD,YAAY,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE;EAGtC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;EACnC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;EACpC,CAAC;CACF,SAAS,CACP;EAAE,SAAS,CAAC,UAAU,OAAO;EAAE,QAAQ;EAAM,EAC7C;EAAE,SAAS,CAAC,YAAY;EAAE,QAAQ;EAAM,CACzC;CACF,CAAC;;;AC5BF,IAAa,gBAAb,MAA2B;CACzB,SAA4B,QAAQ,OAAO;CAC3C,mBAAsC,QAAQ,iBAAiB;CAC/D,MAAyB,SAAS;CAClC,OAA0B,YAAY,aAAa;;;;CAKnD,kBAAqC,OAAsC;EACzE,MAAM;EACN,KAAK,CAAC,IAAI,UAAU;EACrB,CAAC;;;;;;;;CAaF,eACE,UAAkD,EAAE,EACpC;EAChB,MAAM,EAAE,WAAW,IAAI,SAAS,SAAS;EACzC,MAAM,gBAAgB,GAAG,OAAO;AAEhC,SAAO;GACL;GACA,WAAW,OAAO,QAAuB;IAGvC,IAAI,SADQ,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,KACjD,aAAa,IAAI,UAAU;AAG3C,QAAI,CAAC,OAAO;KACV,MAAM,OAAO,IAAI,QAAQ;AACzB,SAAI,MAAM,WAAW,UAAU,EAAE;MAC/B,MAAM,cAAc,KAAK,MAAM,EAAE;AACjC,UAAI,YAAY,WAAW,cAAc,CACvC,SAAQ;;;AAKd,QAAI,CAAC,MACH,QAAO;AAGT,WAAO,KAAK,SAAS,MAAM;;GAE9B;;;;;;CAWH,MAAa,OAAO,SAOiC;EACnD,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,QAAQ,GAAG,OAAO,GADT,YAAY,GAAG,CAAC,SAAS,YAAY;EAEpD,MAAM,OAAO,KAAK,UAAU,MAAM;EAClC,MAAM,SAAS,MAAM,MAAM,GAAG;EAE9B,MAAM,SAAS,MAAM,KAAK,KAAK,OAAO;GACpC,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,aAAa,QAAQ;GACrB,WAAW;GACX,aAAa;GACb,aAAa;GACb,OAAO,QAAQ;GACf,WAAW,QAAQ,WAAW,aAAa;GAC5C,CAAC;AAEF,OAAK,IAAI,KAAK,mBAAmB;GAC/B,UAAU,OAAO;GACjB,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACf,CAAC;AAEF,SAAO;GAAE;GAAQ;GAAO;;;;;CAM1B,MAAa,KAAK,QAAyC;AACzD,SAAO,KAAK,KAAK,SAAS;GACxB,OAAO;IACL,QAAQ,EAAE,IAAI,QAAQ;IACtB,WAAW,EAAE,QAAQ,MAAM;IAC5B;GACD,SAAS;IAAE,QAAQ;IAAa,WAAW;IAAQ;GACpD,CAAC;;;;;CAUJ,MAAa,QAAQ,OAMlB;AACD,QAAM,SAAS;EAEf,MAAM,QAAQ,KAAK,KAAK,kBAAkB;AAE1C,MAAI,MAAM,OACR,OAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;AAGrC,MAAI,CAAC,MAAM,eACT,OAAM,YAAY,EAAE,QAAQ,MAAM;AAGpC,SAAO,KAAK,KAAK,SAAS,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,MAAM,CAAC;;;;;CAM9D,MAAa,QAAQ,IAAmC;AACtD,SAAO,MAAM,KAAK,KAAK,QAAQ,GAAG;;;;;CAMpC,MAAa,cAAc,IAA2B;EACpD,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,GAAG;AAE1C,MAAI,OAAO,UACT;AAIF,QAAM,KAAK,gBAAgB,WAAW,OAAO,UAAU;AAEvD,QAAM,KAAK,KAAK,WAAW,IAAI,EAC7B,WAAW,KAAK,iBAAiB,KAAK,CAAC,aAAa,EACrD,CAAC;AAEF,OAAK,IAAI,KAAK,4BAA4B;GACxC,UAAU;GACV,QAAQ,OAAO;GAChB,CAAC;;;;;CAUJ,MAAa,OAAO,IAAY,QAA+B;EAC7D,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,GAAG;AAE1C,MAAI,OAAO,WAAW,OACpB,OAAM,IAAI,eAAe,mBAAmB;AAG9C,QAAM,KAAK,gBAAgB,WAAW,OAAO,UAAU;AAEvD,QAAM,KAAK,KAAK,WAAW,IAAI,EAC7B,WAAW,KAAK,iBAAiB,KAAK,CAAC,aAAa,EACrD,CAAC;AAEF,OAAK,IAAI,KAAK,mBAAmB;GAC/B,UAAU;GACV;GACD,CAAC;;;;;CAUJ,MAAa,SAAS,OAAyC;AAE7D,MAAI,CAAC,MAAM,SAAS,IAAI,CACtB,QAAO;EAGT,MAAM,OAAO,KAAK,UAAU,MAAM;EAGlC,IAAI,SAAS,MAAM,KAAK,gBAAgB,IAAI,KAAK;AAGjD,MAAI,WAAW,KAAA,GAAW;AACxB,YACG,MAAM,KAAK,KAAK,QAAQ,EACvB,OAAO,EAAE,WAAW,EAAE,IAAI,MAAM,EAAE,EACnC,CAAC,IAAK;AAGT,SAAM,KAAK,gBAAgB,IAAI,MAAM,OAAO;;AAG9C,MAAI,CAAC,OACH,QAAO;AAIT,MAAI,OAAO,UACT,QAAO;AAIT,MACE,OAAO,aACP,KAAK,iBAAiB,KAAK,CAAC,QAAQ,OAAO,UAAU,CAErD,QAAO;AAIT,OAAK,YAAY,OAAO,GAAG,CAAC,OAAO,UAAU;AAC3C,QAAK,IAAI,KAAK,kCAAkC,EAAE,OAAO,CAAC;IAC1D;AAEF,SAAO;GACL,IAAI,OAAO;GACX,OAAO,OAAO;GACf;;;;;CAMH,MAAgB,YAAY,IAA2B;EACrD,MAAM,UAAU,KAAK,OAAO,MAAM,IAAI,sBAAsB;AAE5D,QAAM,KAAK,KAAK,WAAW,IAAI;GAC7B,YAAY,KAAK,iBAAiB,KAAK,CAAC,aAAa;GACrD,YAAY,SAAS;GACrB,YAAY,GAAG,GAAG,KAAK,KAAK,MAAM,WAAW;GAC9C,CAAC;;;;;CAMJ,UAAoB,OAAuB;AACzC,SAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;;;AC/Q3D,IAAa,wBAAb,MAAmC;CACjC,MAAyB;CACzB,QAA2B;CAC3B,gBAAmC,QAAQ,cAAc;;;;CAKzD,cAA8B,QAAQ;EACpC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;EACvD,aAAa;EACb,QAAQ;GACN,OAAO;GACP,UAAU,EAAE,KAAK,0BAA0B;GAC5C;EACD,UAAU,EAAE,YAAY;GACtB,MAAM,EAAE,QAAQ,gBAAgB,GAAG,eAAe;AAClD,UAAO,KAAK,cAAc,QAAQ;IAChC;IACA;IACA,GAAG;IACJ,CAAC;;EAEL,CAAC;;;;CAKF,YAA4B,QAAQ;EAClC,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;EACvD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,EACb,CAAC;GACF,UAAU;GACX;EACD,UAAU,EAAE,aAAa,KAAK,cAAc,QAAQ,OAAO,GAAG;EAC/D,CAAC;;;;CAKF,eAA+B,QAAQ;EACrC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,uBAAuB,EAAE,CAAC,CAAC;EACzD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,EACb,CAAC;GACF,UAAU;GACX;EACD,SAAS,OAAO,EAAE,aAAa;AAC7B,SAAM,KAAK,cAAc,cAAc,OAAO,GAAG;AACjD,UAAO;IAAE,IAAI;IAAM,IAAI,OAAO;IAAI;;EAErC,CAAC;;;;ACxEJ,MAAa,yBAAyB,EAAE,OAAO;CAC7C,MAAM,EAAE,KAAK;EAAE,WAAW;EAAG,WAAW;EAAK,CAAC;CAC9C,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC,CAAC;CACnD,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,CAAC;;;ACJF,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,MAAM;CACZ,MAAM,EAAE,QAAQ;CAChB,OAAO,EAAE,QAAQ;CACjB,aAAa,EAAE,QAAQ;CACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1B,WAAW,EAAE,UAAU;CACvB,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,CAAC;;;ACRF,MAAa,uBAAuB,EAAE,OAAO;CAC3C,IAAI,EAAE,MAAM;CACZ,MAAM,EAAE,QAAQ;CAChB,aAAa,EAAE,QAAQ;CACvB,aAAa,EAAE,QAAQ;CACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1B,WAAW,EAAE,UAAU;CACvB,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACnC,YAAY,EAAE,SAAS;CACxB,CAAC;AAEF,MAAa,2BAA2B,EAAE,MAAM,qBAAqB;;;ACZrE,MAAa,2BAA2B,EAAE,OAAO,EAC/C,IAAI,EAAE,MAAM,EACb,CAAC;;;ACFF,MAAa,6BAA6B,EAAE,OAAO,EACjD,IAAI,EAAE,SAAS,EAChB,CAAC;;;;;;;ACUF,IAAa,mBAAb,MAA8B;CAC5B,MAAyB;CACzB,QAA2B;CAC3B,gBAAmC,QAAQ,cAAc;;;;;CAMzD,eAA+B,QAAQ;EACrC,QAAQ;EACR,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC;EACnD,QAAQ;GACN,MAAM;GACN,UAAU;GACX;EACD,SAAS,OAAO,YAAY;GAC1B,MAAM,EAAE,QAAQ,UAAU,MAAM,KAAK,cAAc,OAAO;IACxD,QAAQ,QAAQ,KAAK;IACrB,MAAM,QAAQ,KAAK;IACnB,aAAa,QAAQ,KAAK;IAC1B,OAAO,QAAQ,KAAK,SAAS,EAAE;IAC/B,WAAW,QAAQ,KAAK,YACpB,IAAI,KAAK,QAAQ,KAAK,UAAU,GAChC,KAAA;IACL,CAAC;AAEF,UAAO;IACL,IAAI,OAAO;IACX,MAAM,OAAO;IACb;IACA,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,WAAW,OAAO;IACnB;;EAEJ,CAAC;;;;;CAMF,cAA8B,QAAQ;EACpC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC;EACjD,QAAQ,EACN,UAAU,0BACX;EACD,SAAS,OAAO,YAAY;AAG1B,WAFgB,MAAM,KAAK,cAAc,KAAK,QAAQ,KAAK,GAAG,EAE/C,KAAK,YAAY;IAC9B,IAAI,OAAO;IACX,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,YAAY,OAAO;IACnB,WAAW,OAAO;IAClB,YAAY,OAAO;IACpB,EAAE;;EAEN,CAAC;;;;CAKF,iBAAiC,QAAQ;EACvC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC;EACnD,QAAQ;GACN,QAAQ;GACR,UAAU;GACX;EACD,SAAS,OAAO,YAAY;AAC1B,SAAM,KAAK,cAAc,OAAO,QAAQ,OAAO,IAAI,QAAQ,KAAK,GAAG;AACnE,UAAO,EAAE,IAAI,MAAM;;EAEtB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC7DJ,MAAa,gBAAgB,QAAQ;CACnC,MAAM;CACN,UAAU;EAAC;EAAe;EAAkB;EAAsB;CACnE,CAAC"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/api/keys/schemas/adminApiKeyQuerySchema.ts","../../../src/api/keys/schemas/adminApiKeyResourceSchema.ts","../../../src/api/keys/entities/apiKeyEntity.ts","../../../src/api/keys/services/ApiKeyService.ts","../../../src/api/keys/controllers/AdminApiKeyController.ts","../../../src/api/keys/schemas/createApiKeyBodySchema.ts","../../../src/api/keys/schemas/createApiKeyResponseSchema.ts","../../../src/api/keys/schemas/listApiKeyResponseSchema.ts","../../../src/api/keys/schemas/revokeApiKeyParamsSchema.ts","../../../src/api/keys/schemas/revokeApiKeyResponseSchema.ts","../../../src/api/keys/controllers/ApiKeyController.ts","../../../src/api/keys/index.ts"],"sourcesContent":["import { t } from \"alepha\";\nimport { pageQuerySchema } from \"alepha/orm\";\n\nexport const adminApiKeyQuerySchema = t.extend(pageQuerySchema, {\n  userId: t.optional(t.uuid()),\n  includeRevoked: t.optional(t.boolean()),\n});\n","import { t } from \"alepha\";\n\nexport const adminApiKeyResourceSchema = t.object({\n  id: t.uuid(),\n  userId: t.uuid(),\n  name: t.string(),\n  description: t.optional(t.string()),\n  tokenPrefix: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  lastUsedAt: t.optional(t.datetime()),\n  lastUsedIp: t.optional(t.string()),\n  expiresAt: t.optional(t.datetime()),\n  revokedAt: t.optional(t.datetime()),\n  usageCount: t.integer(),\n});\n","import { type Static, t } from \"alepha\";\nimport { $entity, db } from \"alepha/orm\";\n\nexport const apiKeyEntity = $entity({\n  name: \"api_keys\",\n  schema: t.object({\n    id: db.primaryKey(t.uuid()),\n    createdAt: db.createdAt(),\n    updatedAt: db.updatedAt(),\n\n    // Owner\n    userId: t.uuid(),\n\n    // Key metadata\n    name: t.text({ maxLength: 100 }),\n    description: t.optional(t.text({ maxLength: 500 })),\n\n    // Token (hashed) - internal, not user input\n    tokenHash: t.string({ maxLength: 256 }),\n    tokenPrefix: t.string({ maxLength: 10 }),\n    tokenSuffix: t.string({ maxLength: 8 }),\n\n    // Roles (snapshot from user at creation)\n    roles: db.default(t.array(t.string()), []),\n\n    // Tracking\n    lastUsedAt: t.optional(t.datetime()),\n    lastUsedIp: t.optional(t.string({ maxLength: 45 })),\n    usageCount: db.default(t.integer(), 0),\n\n    // Lifecycle\n    expiresAt: t.optional(t.datetime()),\n    revokedAt: t.optional(t.datetime()),\n  }),\n  indexes: [\n    { columns: [\"userId\", \"name\"], unique: true },\n    { columns: [\"tokenHash\"], unique: true },\n  ],\n});\n\nexport type ApiKeyEntity = Static<typeof apiKeyEntity.schema>;\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { $inject, Alepha } from \"alepha\";\nimport { $cache } from \"alepha/cache\";\nimport { DateTimeProvider } from \"alepha/datetime\";\nimport { $logger } from \"alepha/logger\";\nimport { $repository, sql } from \"alepha/orm\";\nimport type { IssuerResolver, UserInfo } from \"alepha/security\";\nimport { ForbiddenError, type ServerRequest } from \"alepha/server\";\nimport { type ApiKeyEntity, apiKeyEntity } from \"../entities/apiKeyEntity.ts\";\n\nexport class ApiKeyService {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly dateTimeProvider = $inject(DateTimeProvider);\n  protected readonly log = $logger();\n  protected readonly repo = $repository(apiKeyEntity);\n\n  /**\n   * Cache validated API keys for 15 minutes.\n   */\n  protected readonly validationCache = $cache<ApiKeyEntity | null, [string]>({\n    name: \"api:keys:validation\",\n    ttl: [15, \"minutes\"],\n  });\n\n  // -------------------------------------------------------------------------\n  // Resolver\n  // -------------------------------------------------------------------------\n\n  /**\n   * Create an issuer resolver for API key authentication.\n   * Lower priority means it runs before JWT resolver.\n   *\n   * @param options.priority - Priority of this resolver (default: 50, JWT is 100)\n   * @param options.prefix - API key prefix to match in Bearer header (default: \"ak\")\n   */\n  public createResolver(\n    options: { priority?: number; prefix?: string } = {},\n  ): IssuerResolver {\n    const { priority = 50, prefix = \"ak\" } = options;\n    const prefixPattern = `${prefix}_`;\n\n    return {\n      priority,\n      onRequest: async (req: ServerRequest) => {\n        // Try query param first\n        const url = typeof req.url === \"string\" ? new URL(req.url) : req.url;\n        let token = url.searchParams.get(\"api_key\");\n\n        // Try Bearer header - only if token starts with expected prefix\n        if (!token) {\n          const auth = req.headers.authorization;\n          if (auth?.startsWith(\"Bearer \")) {\n            const bearerToken = auth.slice(7);\n            if (bearerToken.startsWith(prefixPattern)) {\n              token = bearerToken;\n            }\n          }\n        }\n\n        if (!token) {\n          return null;\n        }\n\n        return this.validate(token);\n      },\n    };\n  }\n\n  // -------------------------------------------------------------------------\n  // CRUD\n  // -------------------------------------------------------------------------\n\n  /**\n   * Create a new API key for a user.\n   * Returns both the API key entity and the plain token (which is only available once).\n   */\n  public async create(options: {\n    userId: string;\n    name: string;\n    roles: string[];\n    description?: string;\n    expiresAt?: Date;\n    prefix?: string;\n  }): Promise<{ apiKey: ApiKeyEntity; token: string }> {\n    const prefix = options.prefix ?? \"ak\";\n    const random = randomBytes(24).toString(\"base64url\");\n    const token = `${prefix}_${random}`;\n    const hash = this.hashToken(token);\n    const suffix = token.slice(-8);\n\n    const apiKey = await this.repo.create({\n      userId: options.userId,\n      name: options.name,\n      description: options.description,\n      tokenHash: hash,\n      tokenPrefix: prefix,\n      tokenSuffix: suffix,\n      roles: options.roles,\n      expiresAt: options.expiresAt?.toISOString(),\n    });\n\n    this.log.info(\"API key created\", {\n      apiKeyId: apiKey.id,\n      userId: options.userId,\n      name: options.name,\n    });\n\n    return { apiKey, token };\n  }\n\n  /**\n   * List all non-revoked API keys for a user.\n   */\n  public async list(userId: string): Promise<ApiKeyEntity[]> {\n    return this.repo.findMany({\n      where: {\n        userId: { eq: userId },\n        revokedAt: { isNull: true },\n      },\n      orderBy: { column: \"createdAt\", direction: \"desc\" },\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // Admin Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Find all API keys with optional filtering (admin only).\n   */\n  public async findAll(query: {\n    userId?: string;\n    includeRevoked?: boolean;\n    page?: number;\n    size?: number;\n    sort?: string;\n  }) {\n    query.sort ??= \"-createdAt\";\n\n    const where = this.repo.createQueryWhere();\n\n    if (query.userId) {\n      where.userId = { eq: query.userId };\n    }\n\n    if (!query.includeRevoked) {\n      where.revokedAt = { isNull: true };\n    }\n\n    return this.repo.paginate(query, { where }, { count: true });\n  }\n\n  /**\n   * Get an API key by ID (admin only).\n   */\n  public async getById(id: string): Promise<ApiKeyEntity> {\n    return await this.repo.getById(id);\n  }\n\n  /**\n   * Revoke any API key (admin only).\n   */\n  public async revokeByAdmin(id: string): Promise<void> {\n    const apiKey = await this.repo.getById(id);\n\n    if (apiKey.revokedAt) {\n      return; // Already revoked\n    }\n\n    // Invalidate cache\n    await this.validationCache.invalidate(apiKey.tokenHash);\n\n    await this.repo.updateById(id, {\n      revokedAt: this.dateTimeProvider.now().toISOString(),\n    });\n\n    this.log.info(\"API key revoked by admin\", {\n      apiKeyId: id,\n      userId: apiKey.userId,\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // User Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Revoke an API key. Only the owner can revoke their own keys.\n   */\n  public async revoke(id: string, userId: string): Promise<void> {\n    const apiKey = await this.repo.getById(id);\n\n    if (apiKey.userId !== userId) {\n      throw new ForbiddenError(\"Not your API key\");\n    }\n\n    await this.validationCache.invalidate(apiKey.tokenHash);\n\n    await this.repo.updateById(id, {\n      revokedAt: this.dateTimeProvider.now().toISOString(),\n    });\n\n    this.log.info(\"API key revoked\", {\n      apiKeyId: id,\n      userId,\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // Validation\n  // -------------------------------------------------------------------------\n\n  /**\n   * Validate an API key token and return user info if valid.\n   */\n  public async validate(token: string): Promise<UserInfo | null> {\n    // Quick check for API key format\n    if (!token.includes(\"_\")) {\n      return null;\n    }\n\n    const hash = this.hashToken(token);\n\n    // Try cache first\n    let apiKey = await this.validationCache.get(hash);\n\n    // If not in cache, look up in database\n    if (apiKey === undefined) {\n      apiKey =\n        (await this.repo.findOne({\n          where: { tokenHash: { eq: hash } },\n        })) ?? null;\n\n      // Store in cache (even if null, to prevent repeated lookups)\n      await this.validationCache.set(hash, apiKey);\n    }\n\n    if (!apiKey) {\n      return null;\n    }\n\n    // Check revocation\n    if (apiKey.revokedAt) {\n      return null;\n    }\n\n    // Check expiration\n    if (\n      apiKey.expiresAt &&\n      this.dateTimeProvider.now().isAfter(apiKey.expiresAt)\n    ) {\n      return null;\n    }\n\n    // Update usage stats (fire and forget)\n    this.updateUsage(apiKey.id).catch((error) => {\n      this.log.warn(\"Failed to update API key usage\", { error });\n    });\n\n    return {\n      id: apiKey.userId,\n      roles: apiKey.roles,\n    };\n  }\n\n  /**\n   * Update usage statistics for an API key.\n   */\n  protected async updateUsage(id: string): Promise<void> {\n    const request = this.alepha.store.get(\"alepha.http.request\");\n\n    await this.repo.updateById(id, {\n      lastUsedAt: this.dateTimeProvider.now().toISOString(),\n      lastUsedIp: request?.ip,\n      usageCount: sql`${this.repo.table.usageCount} + 1`,\n    });\n  }\n\n  /**\n   * Hash a token using SHA-256.\n   */\n  protected hashToken(token: string): string {\n    return createHash(\"sha256\").update(token).digest(\"hex\");\n  }\n}\n","import { $inject, t } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action, okSchema } from \"alepha/server\";\nimport { adminApiKeyQuerySchema } from \"../schemas/adminApiKeyQuerySchema.ts\";\nimport { adminApiKeyResourceSchema } from \"../schemas/adminApiKeyResourceSchema.ts\";\nimport { ApiKeyService } from \"../services/ApiKeyService.ts\";\n\n/**\n * REST API controller for admin API key management.\n * Admins can list, view, and revoke any API key.\n */\nexport class AdminApiKeyController {\n  protected readonly url = \"/admin/api-keys\";\n  protected readonly group = \"admin:api-keys\";\n  protected readonly apiKeyService = $inject(ApiKeyService);\n\n  /**\n   * Find all API keys with optional filtering.\n   */\n  public readonly findApiKeys = $action({\n    path: this.url,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:read\"] })],\n    description: \"Find API keys with pagination and filtering\",\n    schema: {\n      query: adminApiKeyQuerySchema,\n      response: t.page(adminApiKeyResourceSchema),\n    },\n    handler: ({ query }) => {\n      const { userId, includeRevoked, ...pagination } = query;\n      return this.apiKeyService.findAll({\n        userId,\n        includeRevoked,\n        ...pagination,\n      });\n    },\n  });\n\n  /**\n   * Get an API key by ID.\n   */\n  public readonly getApiKey = $action({\n    path: `${this.url}/:id`,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:read\"] })],\n    description: \"Get an API key by ID\",\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: adminApiKeyResourceSchema,\n    },\n    handler: ({ params }) => this.apiKeyService.getById(params.id),\n  });\n\n  /**\n   * Revoke any API key.\n   */\n  public readonly revokeApiKey = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:delete\"] })],\n    description: \"Revoke an API key\",\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: okSchema,\n    },\n    handler: async ({ params }) => {\n      await this.apiKeyService.revokeByAdmin(params.id);\n      return { ok: true, id: params.id };\n    },\n  });\n}\n","import { t } from \"alepha\";\n\nexport const createApiKeyBodySchema = t.object({\n  name: t.text({ minLength: 1, maxLength: 100 }),\n  description: t.optional(t.text({ maxLength: 500 })),\n  expiresAt: t.optional(t.datetime()),\n});\n","import { t } from \"alepha\";\n\nexport const createApiKeyResponseSchema = t.object({\n  id: t.uuid(),\n  name: t.string(),\n  token: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  expiresAt: t.optional(t.datetime()),\n});\n","import { t } from \"alepha\";\n\nexport const listApiKeyItemSchema = t.object({\n  id: t.uuid(),\n  name: t.string(),\n  tokenPrefix: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  lastUsedAt: t.optional(t.datetime()),\n  expiresAt: t.optional(t.datetime()),\n  usageCount: t.integer(),\n});\n\nexport const listApiKeyResponseSchema = t.array(listApiKeyItemSchema);\n","import { t } from \"alepha\";\n\nexport const revokeApiKeyParamsSchema = t.object({\n  id: t.uuid(),\n});\n","import { t } from \"alepha\";\n\nexport const revokeApiKeyResponseSchema = t.object({\n  ok: t.boolean(),\n});\n","import { $inject } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action } from \"alepha/server\";\nimport { createApiKeyBodySchema } from \"../schemas/createApiKeyBodySchema.ts\";\nimport { createApiKeyResponseSchema } from \"../schemas/createApiKeyResponseSchema.ts\";\nimport { listApiKeyResponseSchema } from \"../schemas/listApiKeyResponseSchema.ts\";\nimport { revokeApiKeyParamsSchema } from \"../schemas/revokeApiKeyParamsSchema.ts\";\nimport { revokeApiKeyResponseSchema } from \"../schemas/revokeApiKeyResponseSchema.ts\";\nimport { ApiKeyService } from \"../services/ApiKeyService.ts\";\n\n/**\n * REST API controller for user's own API key management.\n * Users can create, list, and revoke their own API keys.\n */\nexport class ApiKeyController {\n  protected readonly url = \"/api-keys\";\n  protected readonly group = \"api-keys\";\n  protected readonly apiKeyService = $inject(ApiKeyService);\n\n  /**\n   * Create a new API key for the authenticated user.\n   * The token is only returned once upon creation.\n   */\n  public readonly createApiKey = $action({\n    method: \"POST\",\n    path: this.url,\n    group: this.group,\n    description: \"Create a new API key\",\n    use: [$secure({ permissions: [\"api-key:create\"] })],\n    schema: {\n      body: createApiKeyBodySchema,\n      response: createApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      const { apiKey, token } = await this.apiKeyService.create({\n        userId: request.user.id,\n        name: request.body.name,\n        description: request.body.description,\n        roles: request.user.roles ?? [],\n        expiresAt: request.body.expiresAt\n          ? new Date(request.body.expiresAt)\n          : undefined,\n      });\n\n      return {\n        id: apiKey.id,\n        name: apiKey.name,\n        token,\n        tokenSuffix: apiKey.tokenSuffix,\n        roles: apiKey.roles,\n        createdAt: apiKey.createdAt,\n        expiresAt: apiKey.expiresAt,\n      };\n    },\n  });\n\n  /**\n   * List all active API keys for the authenticated user.\n   * Does not return the actual tokens.\n   */\n  public readonly listApiKeys = $action({\n    path: this.url,\n    group: this.group,\n    description: \"List your API keys\",\n    use: [$secure({ permissions: [\"api-key:read\"] })],\n    schema: {\n      response: listApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      const apiKeys = await this.apiKeyService.list(request.user.id);\n\n      return apiKeys.map((apiKey) => ({\n        id: apiKey.id,\n        name: apiKey.name,\n        tokenPrefix: apiKey.tokenPrefix,\n        tokenSuffix: apiKey.tokenSuffix,\n        roles: apiKey.roles,\n        createdAt: apiKey.createdAt,\n        lastUsedAt: apiKey.lastUsedAt,\n        expiresAt: apiKey.expiresAt,\n        usageCount: apiKey.usageCount,\n      }));\n    },\n  });\n\n  /**\n   * Revoke an API key. Only the owner can revoke their own keys.\n   */\n  public readonly revokeMyApiKey = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: this.group,\n    description: \"Revoke an API key\",\n    use: [$secure({ permissions: [\"api-key:delete\"] })],\n    schema: {\n      params: revokeApiKeyParamsSchema,\n      response: revokeApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      await this.apiKeyService.revoke(request.params.id, request.user.id);\n      return { ok: true };\n    },\n  });\n}\n","import { $module } from \"alepha\";\nimport { AdminApiKeyController } from \"./controllers/AdminApiKeyController.ts\";\nimport { ApiKeyController } from \"./controllers/ApiKeyController.ts\";\nimport { ApiKeyService } from \"./services/ApiKeyService.ts\";\n\nexport * from \"./controllers/AdminApiKeyController.ts\";\nexport * from \"./controllers/ApiKeyController.ts\";\nexport * from \"./entities/apiKeyEntity.ts\";\nexport * from \"./schemas/adminApiKeyQuerySchema.ts\";\nexport * from \"./schemas/adminApiKeyResourceSchema.ts\";\nexport * from \"./schemas/createApiKeyBodySchema.ts\";\nexport * from \"./schemas/createApiKeyResponseSchema.ts\";\nexport * from \"./schemas/listApiKeyResponseSchema.ts\";\nexport * from \"./schemas/revokeApiKeyParamsSchema.ts\";\nexport * from \"./schemas/revokeApiKeyResponseSchema.ts\";\nexport * from \"./services/ApiKeyService.ts\";\n\n/**\n * API key management module for programmatic access.\n *\n * **Features:**\n * - Create API keys with role snapshots\n * - List and revoke API keys\n * - 15-minute validation caching\n * - Query param (?api_key=) and Bearer header support\n *\n * **Integration:**\n * To enable API key authentication for an issuer, register the resolver:\n *\n * ```ts\n * class MyApp {\n *   apiKeyService = $inject(ApiKeyService);\n *   issuer = $issuer({\n *     secret: env.APP_SECRET,\n *     resolvers: [this.apiKeyService.createResolver()],\n *   });\n * }\n * ```\n *\n * @module alepha.api.keys\n */\nexport const AlephaApiKeys = $module({\n  name: \"alepha.api.keys\",\n  services: [ApiKeyService, ApiKeyController, AdminApiKeyController],\n});\n"],"mappings":";;;;;;;;;AAGA,MAAa,yBAAyB,EAAE,OAAO,iBAAiB;CAC9D,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;CAC5B,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC;CACxC,CAAC;;;ACJF,MAAa,4BAA4B,EAAE,OAAO;CAChD,IAAI,EAAE,MAAM;CACZ,QAAQ,EAAE,MAAM;CAChB,MAAM,EAAE,QAAQ;CAChB,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;CACnC,aAAa,EAAE,QAAQ;CACvB,aAAa,EAAE,QAAQ;CACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1B,WAAW,EAAE,UAAU;CACvB,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;CAClC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACnC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACnC,YAAY,EAAE,SAAS;CACxB,CAAC;;;ACbF,MAAa,eAAe,QAAQ;CAClC,MAAM;CACN,QAAQ,EAAE,OAAO;EACf,IAAI,GAAG,WAAW,EAAE,MAAM,CAAC;EAC3B,WAAW,GAAG,WAAW;EACzB,WAAW,GAAG,WAAW;EAGzB,QAAQ,EAAE,MAAM;EAGhB,MAAM,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC;EAChC,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC,CAAC;EAGnD,WAAW,EAAE,OAAO,EAAE,WAAW,KAAK,CAAC;EACvC,aAAa,EAAE,OAAO,EAAE,WAAW,IAAI,CAAC;EACxC,aAAa,EAAE,OAAO,EAAE,WAAW,GAAG,CAAC;EAGvC,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;EAG1C,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;EACpC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,IAAI,CAAC,CAAC;EACnD,YAAY,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE;EAGtC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;EACnC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;EACpC,CAAC;CACF,SAAS,CACP;EAAE,SAAS,CAAC,UAAU,OAAO;EAAE,QAAQ;EAAM,EAC7C;EAAE,SAAS,CAAC,YAAY;EAAE,QAAQ;EAAM,CACzC;CACF,CAAC;;;AC5BF,IAAa,gBAAb,MAA2B;CACzB,SAA4B,QAAQ,OAAO;CAC3C,mBAAsC,QAAQ,iBAAiB;CAC/D,MAAyB,SAAS;CAClC,OAA0B,YAAY,aAAa;;;;CAKnD,kBAAqC,OAAsC;EACzE,MAAM;EACN,KAAK,CAAC,IAAI,UAAU;EACrB,CAAC;;;;;;;;CAaF,eACE,UAAkD,EAAE,EACpC;EAChB,MAAM,EAAE,WAAW,IAAI,SAAS,SAAS;EACzC,MAAM,gBAAgB,GAAG,OAAO;AAEhC,SAAO;GACL;GACA,WAAW,OAAO,QAAuB;IAGvC,IAAI,SADQ,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,KACjD,aAAa,IAAI,UAAU;AAG3C,QAAI,CAAC,OAAO;KACV,MAAM,OAAO,IAAI,QAAQ;AACzB,SAAI,MAAM,WAAW,UAAU,EAAE;MAC/B,MAAM,cAAc,KAAK,MAAM,EAAE;AACjC,UAAI,YAAY,WAAW,cAAc,CACvC,SAAQ;;;AAKd,QAAI,CAAC,MACH,QAAO;AAGT,WAAO,KAAK,SAAS,MAAM;;GAE9B;;;;;;CAWH,MAAa,OAAO,SAOiC;EACnD,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,QAAQ,GAAG,OAAO,GADT,YAAY,GAAG,CAAC,SAAS,YACP;EACjC,MAAM,OAAO,KAAK,UAAU,MAAM;EAClC,MAAM,SAAS,MAAM,MAAM,GAAG;EAE9B,MAAM,SAAS,MAAM,KAAK,KAAK,OAAO;GACpC,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,aAAa,QAAQ;GACrB,WAAW;GACX,aAAa;GACb,aAAa;GACb,OAAO,QAAQ;GACf,WAAW,QAAQ,WAAW,aAAa;GAC5C,CAAC;AAEF,OAAK,IAAI,KAAK,mBAAmB;GAC/B,UAAU,OAAO;GACjB,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACf,CAAC;AAEF,SAAO;GAAE;GAAQ;GAAO;;;;;CAM1B,MAAa,KAAK,QAAyC;AACzD,SAAO,KAAK,KAAK,SAAS;GACxB,OAAO;IACL,QAAQ,EAAE,IAAI,QAAQ;IACtB,WAAW,EAAE,QAAQ,MAAM;IAC5B;GACD,SAAS;IAAE,QAAQ;IAAa,WAAW;IAAQ;GACpD,CAAC;;;;;CAUJ,MAAa,QAAQ,OAMlB;AACD,QAAM,SAAS;EAEf,MAAM,QAAQ,KAAK,KAAK,kBAAkB;AAE1C,MAAI,MAAM,OACR,OAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;AAGrC,MAAI,CAAC,MAAM,eACT,OAAM,YAAY,EAAE,QAAQ,MAAM;AAGpC,SAAO,KAAK,KAAK,SAAS,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,MAAM,CAAC;;;;;CAM9D,MAAa,QAAQ,IAAmC;AACtD,SAAO,MAAM,KAAK,KAAK,QAAQ,GAAG;;;;;CAMpC,MAAa,cAAc,IAA2B;EACpD,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,GAAG;AAE1C,MAAI,OAAO,UACT;AAIF,QAAM,KAAK,gBAAgB,WAAW,OAAO,UAAU;AAEvD,QAAM,KAAK,KAAK,WAAW,IAAI,EAC7B,WAAW,KAAK,iBAAiB,KAAK,CAAC,aAAa,EACrD,CAAC;AAEF,OAAK,IAAI,KAAK,4BAA4B;GACxC,UAAU;GACV,QAAQ,OAAO;GAChB,CAAC;;;;;CAUJ,MAAa,OAAO,IAAY,QAA+B;EAC7D,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,GAAG;AAE1C,MAAI,OAAO,WAAW,OACpB,OAAM,IAAI,eAAe,mBAAmB;AAG9C,QAAM,KAAK,gBAAgB,WAAW,OAAO,UAAU;AAEvD,QAAM,KAAK,KAAK,WAAW,IAAI,EAC7B,WAAW,KAAK,iBAAiB,KAAK,CAAC,aAAa,EACrD,CAAC;AAEF,OAAK,IAAI,KAAK,mBAAmB;GAC/B,UAAU;GACV;GACD,CAAC;;;;;CAUJ,MAAa,SAAS,OAAyC;AAE7D,MAAI,CAAC,MAAM,SAAS,IAAI,CACtB,QAAO;EAGT,MAAM,OAAO,KAAK,UAAU,MAAM;EAGlC,IAAI,SAAS,MAAM,KAAK,gBAAgB,IAAI,KAAK;AAGjD,MAAI,WAAW,KAAA,GAAW;AACxB,YACG,MAAM,KAAK,KAAK,QAAQ,EACvB,OAAO,EAAE,WAAW,EAAE,IAAI,MAAM,EAAE,EACnC,CAAC,IAAK;AAGT,SAAM,KAAK,gBAAgB,IAAI,MAAM,OAAO;;AAG9C,MAAI,CAAC,OACH,QAAO;AAIT,MAAI,OAAO,UACT,QAAO;AAIT,MACE,OAAO,aACP,KAAK,iBAAiB,KAAK,CAAC,QAAQ,OAAO,UAAU,CAErD,QAAO;AAIT,OAAK,YAAY,OAAO,GAAG,CAAC,OAAO,UAAU;AAC3C,QAAK,IAAI,KAAK,kCAAkC,EAAE,OAAO,CAAC;IAC1D;AAEF,SAAO;GACL,IAAI,OAAO;GACX,OAAO,OAAO;GACf;;;;;CAMH,MAAgB,YAAY,IAA2B;EACrD,MAAM,UAAU,KAAK,OAAO,MAAM,IAAI,sBAAsB;AAE5D,QAAM,KAAK,KAAK,WAAW,IAAI;GAC7B,YAAY,KAAK,iBAAiB,KAAK,CAAC,aAAa;GACrD,YAAY,SAAS;GACrB,YAAY,GAAG,GAAG,KAAK,KAAK,MAAM,WAAW;GAC9C,CAAC;;;;;CAMJ,UAAoB,OAAuB;AACzC,SAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;;;AC/Q3D,IAAa,wBAAb,MAAmC;CACjC,MAAyB;CACzB,QAA2B;CAC3B,gBAAmC,QAAQ,cAAc;;;;CAKzD,cAA8B,QAAQ;EACpC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;EACvD,aAAa;EACb,QAAQ;GACN,OAAO;GACP,UAAU,EAAE,KAAK,0BAA0B;GAC5C;EACD,UAAU,EAAE,YAAY;GACtB,MAAM,EAAE,QAAQ,gBAAgB,GAAG,eAAe;AAClD,UAAO,KAAK,cAAc,QAAQ;IAChC;IACA;IACA,GAAG;IACJ,CAAC;;EAEL,CAAC;;;;CAKF,YAA4B,QAAQ;EAClC,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;EACvD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,EACb,CAAC;GACF,UAAU;GACX;EACD,UAAU,EAAE,aAAa,KAAK,cAAc,QAAQ,OAAO,GAAG;EAC/D,CAAC;;;;CAKF,eAA+B,QAAQ;EACrC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,uBAAuB,EAAE,CAAC,CAAC;EACzD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,EACb,CAAC;GACF,UAAU;GACX;EACD,SAAS,OAAO,EAAE,aAAa;AAC7B,SAAM,KAAK,cAAc,cAAc,OAAO,GAAG;AACjD,UAAO;IAAE,IAAI;IAAM,IAAI,OAAO;IAAI;;EAErC,CAAC;;;;ACxEJ,MAAa,yBAAyB,EAAE,OAAO;CAC7C,MAAM,EAAE,KAAK;EAAE,WAAW;EAAG,WAAW;EAAK,CAAC;CAC9C,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC,CAAC;CACnD,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,CAAC;;;ACJF,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,MAAM;CACZ,MAAM,EAAE,QAAQ;CAChB,OAAO,EAAE,QAAQ;CACjB,aAAa,EAAE,QAAQ;CACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1B,WAAW,EAAE,UAAU;CACvB,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,CAAC;;;ACRF,MAAa,uBAAuB,EAAE,OAAO;CAC3C,IAAI,EAAE,MAAM;CACZ,MAAM,EAAE,QAAQ;CAChB,aAAa,EAAE,QAAQ;CACvB,aAAa,EAAE,QAAQ;CACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1B,WAAW,EAAE,UAAU;CACvB,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;CACpC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACnC,YAAY,EAAE,SAAS;CACxB,CAAC;AAEF,MAAa,2BAA2B,EAAE,MAAM,qBAAqB;;;ACZrE,MAAa,2BAA2B,EAAE,OAAO,EAC/C,IAAI,EAAE,MAAM,EACb,CAAC;;;ACFF,MAAa,6BAA6B,EAAE,OAAO,EACjD,IAAI,EAAE,SAAS,EAChB,CAAC;;;;;;;ACUF,IAAa,mBAAb,MAA8B;CAC5B,MAAyB;CACzB,QAA2B;CAC3B,gBAAmC,QAAQ,cAAc;;;;;CAMzD,eAA+B,QAAQ;EACrC,QAAQ;EACR,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC;EACnD,QAAQ;GACN,MAAM;GACN,UAAU;GACX;EACD,SAAS,OAAO,YAAY;GAC1B,MAAM,EAAE,QAAQ,UAAU,MAAM,KAAK,cAAc,OAAO;IACxD,QAAQ,QAAQ,KAAK;IACrB,MAAM,QAAQ,KAAK;IACnB,aAAa,QAAQ,KAAK;IAC1B,OAAO,QAAQ,KAAK,SAAS,EAAE;IAC/B,WAAW,QAAQ,KAAK,YACpB,IAAI,KAAK,QAAQ,KAAK,UAAU,GAChC,KAAA;IACL,CAAC;AAEF,UAAO;IACL,IAAI,OAAO;IACX,MAAM,OAAO;IACb;IACA,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,WAAW,OAAO;IACnB;;EAEJ,CAAC;;;;;CAMF,cAA8B,QAAQ;EACpC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC;EACjD,QAAQ,EACN,UAAU,0BACX;EACD,SAAS,OAAO,YAAY;AAG1B,WAAO,MAFe,KAAK,cAAc,KAAK,QAAQ,KAAK,GAAG,EAE/C,KAAK,YAAY;IAC9B,IAAI,OAAO;IACX,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,YAAY,OAAO;IACnB,WAAW,OAAO;IAClB,YAAY,OAAO;IACpB,EAAE;;EAEN,CAAC;;;;CAKF,iBAAiC,QAAQ;EACvC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC;EACnD,QAAQ;GACN,QAAQ;GACR,UAAU;GACX;EACD,SAAS,OAAO,YAAY;AAC1B,SAAM,KAAK,cAAc,OAAO,QAAQ,OAAO,IAAI,QAAQ,KAAK,GAAG;AACnE,UAAO,EAAE,IAAI,MAAM;;EAEtB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC7DJ,MAAa,gBAAgB,QAAQ;CACnC,MAAM;CACN,UAAU;EAAC;EAAe;EAAkB;EAAsB;CACnE,CAAC"}

package/dist/api/notifications/index.d.ts

@@ -1,13 +1,13 @@
 import * as _$alepha from "alepha";
 import { Alepha, KIND, Primitive, Static, StaticEncode, TObject } from "alepha";
 import * as _$alepha_api_jobs0 from "alepha/api/jobs";
-import { JobService } from "alepha/api/jobs";
-import * as _$alepha_server0 from "alepha/server";
+import * as _$alepha_api_parameters0 from "alepha/api/parameters";
 import * as _$alepha_orm0 from "alepha/orm";
-import { EmailProvider } from "alepha/email";
+import * as _$alepha_server0 from "alepha/server";
+import { DateTimeProvider } from "alepha/datetime";
 import * as _$alepha_logger0 from "alepha/logger";
+import { EmailProvider } from "alepha/email";
 import { SmsProvider } from "alepha/sms";
-import * as _$typebox from "typebox";
 
 //#region ../../src/api/notifications/primitives/$notification.d.ts
 /**
@@ -115,21 +115,32 @@ declare class NotificationSenderService {
   };
   protected load(payload: NotificationPayload): {
     template: NotificationPrimitive<_$alepha.TObject<_$alepha.TProperties>>;
-    variables: _$typebox.StaticRecord<[], "Decode", {}, {
-      type: _$alepha.TUnsafe<"email" | "sms">;
-      template: _$alepha.TString;
-      contact: _$alepha.TString;
-      variables: _$alepha.TOptional<_$alepha.TRecord<"^.*$", _$alepha.TAny>>;
-      category: _$alepha.TOptional<_$alepha.TString>;
-      critical: _$alepha.TOptional<_$alepha.TBoolean>;
-      sensitive: _$alepha.TOptional<_$alepha.TBoolean>;
-    }, "^.*$", _$alepha.TAny>;
+    variables: Record<string, any>;
     contact: string;
   };
 }
 //#endregion
 //#region ../../src/api/notifications/jobs/NotificationJobs.d.ts
+/**
+ * Notification jobs + runtime-editable retention.
+ *
+ * - `settings` — a `$parameter` exposing `retentionDays` that admins can
+ *   update at runtime. Changes propagate across instances via the parameter
+ *   pub/sub; the next purge run picks up the new value with no restart.
+ * - `sendNotification` — queue-mode, audit-oriented. Every execution is kept
+ *   (`record: "all"`, `keep: { ok: 0, error: 0 }` disables the ring-buffer
+ *   trim) so the audit trail survives even under heavy volume.
+ * - `purgeOldNotifications` — cron sweep that deletes notification execution
+ *   rows whose `completedAt` is older than the current `retentionDays`.
+ *
+ * Cron expression note: the purge cron is declared statically (`0 3 * * *`)
+ * because some runtimes (Cloudflare Workers) freeze cron triggers at deploy
+ * time. The *retention window* is fully runtime-editable — that's the knob
+ * that actually matters for operators.
+ */
 declare class NotificationJobs {
+  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly dt: DateTimeProvider;
   protected readonly notificationSenderService: NotificationSenderService;
   protected readonly executions: _$alepha_orm0.Repository<_$alepha.TObject<{
     id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
@@ -137,22 +148,34 @@ declare class NotificationJobs {
     updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
     jobName: _$alepha.TString;
     key: _$alepha.TOptional<_$alepha.TUnion<[_$alepha.TNull, _$alepha.TString]>>;
-    payload: _$alepha.TOptional<_$alepha.TRecord<"^.*$", _$alepha.TAny>>;
-    status: _$alepha_orm0.PgAttr<_$alepha.TUnsafe<"pending" | "scheduled" | "retrying" | "running" | "completed" | "dead" | "cancelled">, typeof _$alepha_orm0.PG_DEFAULT>;
+    status: _$alepha_orm0.PgAttr<_$alepha.TUnsafe<"pending" | "running" | "scheduled" | "ok" | "error" | "cancelled">, typeof _$alepha_orm0.PG_DEFAULT>;
     priority: _$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_DEFAULT>;
     attempt: _$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_DEFAULT>;
     maxAttempts: _$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_DEFAULT>;
+    payload: _$alepha.TOptional<_$alepha.TRecord<"^.*$", _$alepha.TAny>>;
     scheduledAt: _$alepha.TOptional<_$alepha.TString>;
     startedAt: _$alepha.TOptional<_$alepha.TString>;
     completedAt: _$alepha.TOptional<_$alepha.TString>;
-    result: _$alepha.TOptional<_$alepha.TRecord<"^.*$", _$alepha.TAny>>;
     error: _$alepha.TOptional<_$alepha.TString>;
-    workerId: _$alepha.TOptional<_$alepha.TString>;
+    logs: _$alepha.TOptional<_$alepha.TArray<_$alepha.TObject<{
+      level: _$alepha.TUnsafe<"SILENT" | "TRACE" | "DEBUG" | "INFO" | "WARN" | "ERROR">;
+      message: _$alepha.TString;
+      service: _$alepha.TString;
+      module: _$alepha.TString;
+      context: _$alepha.TOptional<_$alepha.TString>;
+      app: _$alepha.TOptional<_$alepha.TString>;
+      data: _$alepha.TOptional<_$alepha.TAny>;
+      timestamp: _$alepha.TNumber;
+    }>>>;
     triggeredBy: _$alepha.TOptional<_$alepha.TString>;
     triggeredByName: _$alepha.TOptional<_$alepha.TString>;
     cancelledBy: _$alepha.TOptional<_$alepha.TString>;
     cancelledByName: _$alepha.TOptional<_$alepha.TString>;
   }>>;
+  /** Runtime-editable config. Admins can change retentionDays without deploy. */
+  readonly settings: _$alepha_api_parameters0.ParameterPrimitive<_$alepha.TObject<{
+    retentionDays: _$alepha.TInteger;
+  }>>;
   readonly sendNotification: _$alepha_api_jobs0.JobPrimitive<_$alepha.TObject<{
     type: _$alepha.TUnsafe<"email" | "sms">;
     template: _$alepha.TString;
@@ -162,21 +185,51 @@ declare class NotificationJobs {
     critical: _$alepha.TOptional<_$alepha.TBoolean>;
     sensitive: _$alepha.TOptional<_$alepha.TBoolean>;
   }>>;
+  readonly purgeOldNotifications: _$alepha_api_jobs0.JobPrimitive<_$alepha.TSchema>;
 }
 //#endregion
 //#region ../../src/api/notifications/controllers/AdminNotificationController.d.ts
 declare class AdminNotificationController {
   protected readonly url: string;
   protected readonly group: string;
-  protected readonly jobService: JobService;
   protected readonly notificationJobs: NotificationJobs;
+  protected readonly executions: _$alepha_orm0.Repository<_$alepha.TObject<{
+    id: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_PRIMARY_KEY>, typeof _$alepha_orm0.PG_DEFAULT>;
+    createdAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_CREATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    updatedAt: _$alepha_orm0.PgAttr<_$alepha_orm0.PgAttr<_$alepha.TString, typeof _$alepha_orm0.PG_UPDATED_AT>, typeof _$alepha_orm0.PG_DEFAULT>;
+    jobName: _$alepha.TString;
+    key: _$alepha.TOptional<_$alepha.TUnion<[_$alepha.TNull, _$alepha.TString]>>;
+    status: _$alepha_orm0.PgAttr<_$alepha.TUnsafe<"pending" | "running" | "scheduled" | "ok" | "error" | "cancelled">, typeof _$alepha_orm0.PG_DEFAULT>;
+    priority: _$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_DEFAULT>;
+    attempt: _$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_DEFAULT>;
+    maxAttempts: _$alepha_orm0.PgAttr<_$alepha.TInteger, typeof _$alepha_orm0.PG_DEFAULT>;
+    payload: _$alepha.TOptional<_$alepha.TRecord<"^.*$", _$alepha.TAny>>;
+    scheduledAt: _$alepha.TOptional<_$alepha.TString>;
+    startedAt: _$alepha.TOptional<_$alepha.TString>;
+    completedAt: _$alepha.TOptional<_$alepha.TString>;
+    error: _$alepha.TOptional<_$alepha.TString>;
+    logs: _$alepha.TOptional<_$alepha.TArray<_$alepha.TObject<{
+      level: _$alepha.TUnsafe<"SILENT" | "TRACE" | "DEBUG" | "INFO" | "WARN" | "ERROR">;
+      message: _$alepha.TString;
+      service: _$alepha.TString;
+      module: _$alepha.TString;
+      context: _$alepha.TOptional<_$alepha.TString>;
+      app: _$alepha.TOptional<_$alepha.TString>;
+      data: _$alepha.TOptional<_$alepha.TAny>;
+      timestamp: _$alepha.TNumber;
+    }>>>;
+    triggeredBy: _$alepha.TOptional<_$alepha.TString>;
+    triggeredByName: _$alepha.TOptional<_$alepha.TString>;
+    cancelledBy: _$alepha.TOptional<_$alepha.TString>;
+    cancelledByName: _$alepha.TOptional<_$alepha.TString>;
+  }>>;
   protected get jobName(): string;
   readonly findNotifications: _$alepha_server0.ActionPrimitiveFn<{
     query: _$alepha.TObject<{
       page: _$alepha.TOptional<_$alepha.TInteger>;
       size: _$alepha.TOptional<_$alepha.TInteger>;
       sort: _$alepha.TOptional<_$alepha.TString>;
-      status: _$alepha.TOptional<_$alepha.TUnsafe<"pending" | "scheduled" | "retrying" | "running" | "completed" | "dead" | "cancelled">>;
+      status: _$alepha.TOptional<_$alepha.TUnsafe<"pending" | "running" | "scheduled" | "cancelled" | "retrying" | "completed" | "dead">>;
     }>;
     response: _$alepha.TPage<_$alepha.TObject<{
       id: _$alepha.TString;
@@ -213,7 +266,7 @@ declare class AdminNotificationController {
       variables: _$alepha.TOptional<_$alepha.TRecord<"^.*$", _$alepha.TAny>>;
       rendered: _$alepha.TOptional<_$alepha.TRecord<"^.*$", _$alepha.TAny>>;
       logs: _$alepha.TOptional<_$alepha.TArray<_$alepha.TObject<{
-        level: _$alepha.TUnsafe<"TRACE" | "SILENT" | "DEBUG" | "INFO" | "WARN" | "ERROR">;
+        level: _$alepha.TUnsafe<"SILENT" | "TRACE" | "DEBUG" | "INFO" | "WARN" | "ERROR">;
         message: _$alepha.TString;
         service: _$alepha.TString;
         module: _$alepha.TString;
@@ -240,7 +293,6 @@ declare class AdminNotificationController {
   };
   protected toDetailResource(exec: Record<string, unknown>): {
     variables: unknown;
-    rendered: unknown;
     logs: unknown;
     id: unknown;
     createdAt: unknown;
@@ -291,7 +343,7 @@ declare const notificationDetailResourceSchema: _$alepha.TObject<{
   variables: _$alepha.TOptional<_$alepha.TRecord<"^.*$", _$alepha.TAny>>;
   rendered: _$alepha.TOptional<_$alepha.TRecord<"^.*$", _$alepha.TAny>>;
   logs: _$alepha.TOptional<_$alepha.TArray<_$alepha.TObject<{
-    level: _$alepha.TUnsafe<"TRACE" | "SILENT" | "DEBUG" | "INFO" | "WARN" | "ERROR">;
+    level: _$alepha.TUnsafe<"SILENT" | "TRACE" | "DEBUG" | "INFO" | "WARN" | "ERROR">;
     message: _$alepha.TString;
     service: _$alepha.TString;
     module: _$alepha.TString;
@@ -308,7 +360,7 @@ declare const notificationQuerySchema: _$alepha.TObject<{
   page: _$alepha.TOptional<_$alepha.TInteger>;
   size: _$alepha.TOptional<_$alepha.TInteger>;
   sort: _$alepha.TOptional<_$alepha.TString>;
-  status: _$alepha.TOptional<_$alepha.TUnsafe<"pending" | "scheduled" | "retrying" | "running" | "completed" | "dead" | "cancelled">>;
+  status: _$alepha.TOptional<_$alepha.TUnsafe<"pending" | "running" | "scheduled" | "cancelled" | "retrying" | "completed" | "dead">>;
 }>;
 type NotificationQuery = Static<typeof notificationQuerySchema>;
 //#endregion
@@ -334,10 +386,10 @@ type NotificationResource = Static<typeof notificationResourceSchema>;
  * User notification management.
  *
  * **Features:**
- * - Notification definitions
- * - Email/SMS notification sending
- * - Job-based delivery with retry and tracking
- * - User preferences
+ * - Notification definitions (email/SMS templates)
+ * - Queue-based delivery with retry and audit trail (`record: "all"` + no ring buffer trim)
+ * - Runtime-editable retention window via `$parameter` — purge cron respects it live
+ * - Admin API for inspecting sent notifications
  *
  * @module alepha.api.notifications
  */

package/dist/api/notifications/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/api/notifications/primitives/$notification.ts","../../../src/api/notifications/schemas/notificationPayloadSchema.ts","../../../src/api/notifications/services/NotificationSenderService.ts","../../../src/api/notifications/jobs/NotificationJobs.ts","../../../src/api/notifications/controllers/AdminNotificationController.ts","../../../src/api/notifications/schemas/notificationContactPreferencesSchema.ts","../../../src/api/notifications/schemas/notificationContactSchema.ts","../../../src/api/notifications/schemas/notificationDetailResourceSchema.ts","../../../src/api/notifications/schemas/notificationQuerySchema.ts","../../../src/api/notifications/schemas/notificationResourceSchema.ts","../../../src/api/notifications/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuCA;;;;;;;;;;;;;;;;;;cAAa,aAAA;EAAA,WAA2B,OAAA,EAAO,OAAA,EACpC,4BAAA,CAA6B,CAAA,IAAE,qBAAA,CAAA,CAAA;EAAA;;UAKzB,4BAAA,WAAuC,OAAA,UAC9C,mBAAA,CAAoB,CAAA;EAC5B,IAAA;EACA,WAAA;EACA,QAAA;EACA,QAAA;EACA,SAAA;EACA,YAAA;IAAA,CAEG,IAAA,WAAe,mBAAA,CAAoB,CAAA;EAAA;EAEtC,MAAA,EAAQ,CAAA;AAAA;AAAA,cAKG,qBAAA,WAAgC,OAAA,UAAiB,SAAA,CAC5D,4BAAA,CAA6B,CAAA;EAAA,mBAEV,gBAAA,EAAgB,gBAAA;EAAA,IAExB,IAAA,CAAA;EAIE,IAAA,CAAK,OAAA,EAAS,uBAAA,CAAwB,CAAA,IAAE,OAAA;EAoC9C,SAAA,CAAU,OAAA,EAAS,OAAA,CAAQ,4BAAA,CAA6B,CAAA;AAAA;AAAA,UAShD,uBAAA,WAAkC,OAAA;EACjD,SAAA,EAAW,YAAA,CAAa,CAAA;EACxB,OAAA;AAAA;AAAA,UAGe,mBAAA,WAA8B,OAAA;EAC7C,KAAA;IACE,OAAA;IACA,IAAA,aAAiB,SAAA,EAAW,MAAA,CAAO,CAAA;EAAA;EAErC,GAAA;IACE,OAAA,aAAoB,SAAA,EAAW,MAAA,CAAO,CAAA;EAAA;AAAA;;;cC5H7B,yBAAA,WAAyB,OAAA;QAQpC,QAAA,CAAA,OAAA;;;;;;;;KAEU,mBAAA,GAAsB,MAAA,QAAc,yBAAA;;;cCLnC,yBAAA;EAAA,mBACQ,MAAA,EAAM,MAAA;EAAA,mBACN,GAAA,EADM,gBAAA,CACH,MAAA;EAAA,mBACH,aAAA,EAAa,aAAA;EAAA,mBACb,WAAA,EAAW,WAAA;EAEjB,IAAA,CAAK,OAAA,EAAS,mBAAA,GAAmB,OAAA;;;;;;;;;;;;;EAqCvC,SAAA,CAAU,OAAA,EAAS,mBAAA;;;;EAkBnB,WAAA,CAAY,OAAA,EAAS,mBAAA;;;;;YAmBlB,IAAA,CAAK,OAAA,EAAS,mBAAA;qDAAmB,QAAA,CAAA,WAAA;;;;;;;;;;;;;;;cCjFhC,gBAAA;EAAA,mBACQ,yBAAA,EAAyB,yBAAA;EAAA,mBAGzB,UAAA,EAAU,aAAA,CAAA,UAAA,UAAA,OAAA;kDAHe,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;WAK5B,gBAAA,EAAgB,kBAAA,CAAA,YAAA,UAAA,OAAA;UAFH,QAAA,CAAA,OAAA;;;;;;;;;;;cCDlB,2BAAA;EAAA,mBACQ,GAAA;EAAA,mBACA,KAAA;EAAA,mBACA,UAAA,EAAU,UAAA;EAAA,mBACV,gBAAA,EAAgB,gBAAA;EAAA,cAErB,OAAA,CAAA;EAAA,SAIE,iBAAA,mBAAiB,iBAAA;;+BANE,QAAA,CAAA,QAAA;;;;;;;;;;;;;;;;;;;;WA0BnB,eAAA,mBAAe,iBAAA;;UApBE,QAAA,CAAA,OAAA;IAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAoCvB,UAAA,CAAW,IAAA,EAAM,MAAA;;;;;;;;;;;;;;YAkBjB,gBAAA,CAAiB,IAAA,EAAM,MAAA;;;;;;;;;;;;;;;;;;;;cCvEtB,oCAAA,WAAoC,OAAA;+BAG/C,QAAA,CAAA,OAAA;;;KAEU,8BAAA,GAAiC,MAAA,QACpC,oCAAA;;;cCNI,yBAAA,WAAyB,OAAA;4BAMpC,QAAA,CAAA,OAAA;;;;;;KAEU,mBAAA,GAAsB,MAAA,QAAc,yBAAA;;;cCNnC,gCAAA,WAAgC,OAAA;MAW5C,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;KAEW,0BAAA,GAA6B,MAAA,QAChC,gCAAA;;;cCfI,uBAAA,WAAuB,OAAA;2BAYlC,QAAA,CAAA,QAAA;;;;;KAEU,iBAAA,GAAoB,MAAA,QAAc,uBAAA;;;cCfjC,0BAAA,WAA0B,OAAA;MAarC,QAAA,CAAA,OAAA;;;;;;;;;;;;;KAEU,oBAAA,GAAuB,MAAA,QAAc,0BAAA;;;;;ATsBjD;;;;;;;;;cUPa,sBAAA,EAAsB,QAAA,CAAA,OAAA,CAQjC,QAAA,CARiC,MAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/api/notifications/primitives/$notification.ts","../../../src/api/notifications/schemas/notificationPayloadSchema.ts","../../../src/api/notifications/services/NotificationSenderService.ts","../../../src/api/notifications/jobs/NotificationJobs.ts","../../../src/api/notifications/controllers/AdminNotificationController.ts","../../../src/api/notifications/schemas/notificationContactPreferencesSchema.ts","../../../src/api/notifications/schemas/notificationContactSchema.ts","../../../src/api/notifications/schemas/notificationDetailResourceSchema.ts","../../../src/api/notifications/schemas/notificationQuerySchema.ts","../../../src/api/notifications/schemas/notificationResourceSchema.ts","../../../src/api/notifications/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuCA;;;;;;;;;;;;;;;;;;cAAa,aAAA;EAAA,WAA2B,OAAA,EAAO,OAAA,EACpC,4BAAA,CAA6B,CAAA,IAAE,qBAAA,CAAA,CAAA;EAAA;;UAKzB,4BAAA,WAAuC,OAAA,UAC9C,mBAAA,CAAoB,CAAA;EAC5B,IAAA;EACA,WAAA;EACA,QAAA;EACA,QAAA;EACA,SAAA;EACA,YAAA;IAAA,CAEG,IAAA,WAAe,mBAAA,CAAoB,CAAA;EAAA;EAEtC,MAAA,EAAQ,CAAA;AAAA;AAAA,cAKG,qBAAA,WAAgC,OAAA,UAAiB,SAAA,CAC5D,4BAAA,CAA6B,CAAA;EAAA,mBAEV,gBAAA,EAAgB,gBAAA;EAAA,IAExB,IAAA,CAAA;EAIE,IAAA,CAAK,OAAA,EAAS,uBAAA,CAAwB,CAAA,IAAE,OAAA;EAoC9C,SAAA,CAAU,OAAA,EAAS,OAAA,CAAQ,4BAAA,CAA6B,CAAA;AAAA;AAAA,UAShD,uBAAA,WAAkC,OAAA;EACjD,SAAA,EAAW,YAAA,CAAa,CAAA;EACxB,OAAA;AAAA;AAAA,UAGe,mBAAA,WAA8B,OAAA;EAC7C,KAAA;IACE,OAAA;IACA,IAAA,aAAiB,SAAA,EAAW,MAAA,CAAO,CAAA;EAAA;EAErC,GAAA;IACE,OAAA,aAAoB,SAAA,EAAW,MAAA,CAAO,CAAA;EAAA;AAAA;;;cC5H7B,yBAAA,WAAyB,OAAA;QAQpC,QAAA,CAAA,OAAA;;;;;;;;KAEU,mBAAA,GAAsB,MAAA,QAAc,yBAAA;;;cCLnC,yBAAA;EAAA,mBACQ,MAAA,EAAM,MAAA;EAAA,mBACN,GAAA,EADM,gBAAA,CACH,MAAA;EAAA,mBACH,aAAA,EAAa,aAAA;EAAA,mBACb,WAAA,EAAW,WAAA;EAEjB,IAAA,CAAK,OAAA,EAAS,mBAAA,GAAmB,OAAA;;;;;;;;;;;;;EAqCvC,SAAA,CAAU,OAAA,EAAS,mBAAA;;;;EAkBnB,WAAA,CAAY,OAAA,EAAS,mBAAA;;;;;YAmBlB,IAAA,CAAK,OAAA,EAAS,mBAAA;qDAAmB,QAAA,CAAA,WAAA;;;;;;;;;;;;;;;;;AFhD7C;;;;;;;cGba,gBAAA;EAAA,mBACQ,GAAA,EADQ,gBAAA,CACL,MAAA;EAAA,mBACH,EAAA,EAAE,gBAAA;EAAA,mBACF,yBAAA,EAAyB,yBAAA;EAAA,mBAGzB,UAAA,EAAU,aAAA,CAAA,UAAA,UAAA,OAAA;kDAHe,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EHqB5C;EAAA,SGfgB,QAAA,EAAQ,wBAAA,CAAA,kBAAA,UAAA,OAAA;mBAHK,QAAA,CAAA,QAAA;EAAA;EAAA,SAkBb,gBAAA,EAAgB,kBAAA,CAAA,YAAA,UAAA,OAAA;UAfR,QAAA,CAAA,OAAA;;;;;;;;WAqCR,qBAAA,EAAqB,kBAAA,CAAA,YAAA,CAtBL,QAAA,CAsBK,OAAA;AAAA;;;cC9D1B,2BAAA;EAAA,mBACQ,GAAA;EAAA,mBACA,KAAA;EAAA,mBACA,gBAAA,EAAgB,gBAAA;EAAA,mBAChB,UAAA,EAAU,aAAA,CAAA,UAAA,UAAA,OAAA;kDADM,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAGrB,OAAA,CAAA;EAAA,SAIE,iBAAA,mBAAiB,iBAAA;;+BANJ,QAAA,CAAA,QAAA;;;;;;;;;;;;;;;;;;;;WA8Bb,eAAA,mBAAe,iBAAA;;UAxBE,QAAA,CAAA,OAAA;IAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA2CvB,UAAA,CAAW,IAAA,EAAM,MAAA;;;;;;;;;;;;;;YAkBjB,gBAAA,CAAiB,IAAA,EAAM,MAAA;;;;;;;;;;;;;;;;;;;cC/EtB,oCAAA,WAAoC,OAAA;+BAG/C,QAAA,CAAA,OAAA;;;KAEU,8BAAA,GAAiC,MAAA,QACpC,oCAAA;;;cCNI,yBAAA,WAAyB,OAAA;4BAMpC,QAAA,CAAA,OAAA;;;;;;KAEU,mBAAA,GAAsB,MAAA,QAAc,yBAAA;;;cCNnC,gCAAA,WAAgC,OAAA;MAW5C,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;KAEW,0BAAA,GAA6B,MAAA,QAChC,gCAAA;;;cCfI,uBAAA,WAAuB,OAAA;2BAYlC,QAAA,CAAA,QAAA;;;;;KAEU,iBAAA,GAAoB,MAAA,QAAc,uBAAA;;;cCfjC,0BAAA,WAA0B,OAAA;MAarC,QAAA,CAAA,OAAA;;;;;;;;;;;;;KAEU,oBAAA,GAAuB,MAAA,QAAc,0BAAA;;;;;ATsBjD;;;;;;;;;cULa,sBAAA,EAAsB,QAAA,CAAA,OAAA,CASjC,QAAA,CATiC,MAAA"}

package/dist/api/notifications/index.js

@@ -1,10 +1,12 @@
 import { $inject, $module, Alepha, AlephaError, KIND, Primitive, createPrimitive, t } from "alepha";
-import { $job, JobService, jobExecutionEntity } from "alepha/api/jobs";
-import { $secure } from "alepha/security";
-import { $action } from "alepha/server";
+import { $job, AlephaApiJobsQueue, jobExecutionEntity } from "alepha/api/jobs";
+import { $parameter, AlephaApiParameters } from "alepha/api/parameters";
 import { $repository, pageQuerySchema } from "alepha/orm";
-import { EmailProvider } from "alepha/email";
+import { $secure } from "alepha/security";
+import { $action, NotFoundError } from "alepha/server";
+import { DateTimeProvider } from "alepha/datetime";
 import { $logger, logEntrySchema } from "alepha/logger";
+import { EmailProvider } from "alepha/email";
 import { SmsProvider } from "alepha/sms";
 //#region ../../src/api/notifications/schemas/notificationPayloadSchema.ts
 const notificationPayloadSchema = t.object({
@@ -152,10 +154,41 @@ var NotificationSenderService = class {
 };
 //#endregion
 //#region ../../src/api/notifications/jobs/NotificationJobs.ts
+/**
+* Notification jobs + runtime-editable retention.
+*
+* - `settings` — a `$parameter` exposing `retentionDays` that admins can
+*   update at runtime. Changes propagate across instances via the parameter
+*   pub/sub; the next purge run picks up the new value with no restart.
+* - `sendNotification` — queue-mode, audit-oriented. Every execution is kept
+*   (`record: "all"`, `keep: { ok: 0, error: 0 }` disables the ring-buffer
+*   trim) so the audit trail survives even under heavy volume.
+* - `purgeOldNotifications` — cron sweep that deletes notification execution
+*   rows whose `completedAt` is older than the current `retentionDays`.
+*
+* Cron expression note: the purge cron is declared statically (`0 3 * * *`)
+* because some runtimes (Cloudflare Workers) freeze cron triggers at deploy
+* time. The *retention window* is fully runtime-editable — that's the knob
+* that actually matters for operators.
+*/
 var NotificationJobs = class {
+	log = $logger();
+	dt = $inject(DateTimeProvider);
 	notificationSenderService = $inject(NotificationSenderService);
 	executions = $repository(jobExecutionEntity);
+	/** Runtime-editable config. Admins can change retentionDays without deploy. */
+	settings = $parameter({
+		name: "alepha.api.notifications",
+		description: "Notification delivery & retention settings.",
+		schema: t.object({ retentionDays: t.integer({
+			description: "Days to keep notification execution rows before the purge sweep removes them.",
+			minimum: 1
+		}) }),
+		default: { retentionDays: 7 }
+	});
 	sendNotification = $job({
+		name: "api:notifications:sendNotification",
+		description: "Sends a notification (email/SMS) and keeps every execution for audit.",
 		schema: notificationPayloadSchema,
 		retry: {
 			retries: 3,
@@ -167,12 +200,45 @@ var NotificationJobs = class {
 			}
 		},
 		timeout: [30, "seconds"],
-		concurrency: 5,
-		handler: async ({ items }) => {
-			for (const item of items) {
-				const rendered = await this.notificationSenderService.send(item.payload);
-				if (rendered) await this.executions.updateById(item.id, { result: rendered });
+		record: "all",
+		keep: {
+			ok: 0,
+			error: 0
+		},
+		handler: async ({ payload }) => {
+			await this.notificationSenderService.send(payload);
+		}
+	});
+	purgeOldNotifications = $job({
+		name: "api:notifications:purgeOldNotifications",
+		description: "Hourly sweep that deletes notification execution rows older than the configured retention window.",
+		cron: "0 * * * *",
+		handler: async ({ now }) => {
+			const { retentionDays } = this.settings.cachedCurrentContent;
+			const cutoff = now.subtract(retentionDays, "day").toISOString();
+			const jobName = this.sendNotification.name;
+			const expired = await this.executions.findMany({
+				where: {
+					jobName: { eq: jobName },
+					status: { inArray: [
+						"ok",
+						"error",
+						"cancelled"
+					] },
+					completedAt: { lt: cutoff }
+				},
+				columns: ["id"],
+				limit: 5e3
+			});
+			if (expired.length === 0) {
+				this.log.debug("Notification purge: nothing to delete", {
+					cutoff,
+					retentionDays
+				});
+				return;
 			}
+			await this.executions.deleteMany({ id: { inArray: expired.map((r) => r.id) } });
+			this.log.info(`Notification purge: deleted ${expired.length} row(s) older than ${retentionDays} days`, { cutoff });
 		}
 	});
 };
@@ -218,8 +284,8 @@ const notificationQuerySchema = t.extend(pageQuerySchema, { status: t.optional(t
 var AdminNotificationController = class {
 	url = "/notifications";
 	group = "admin:notifications";
-	jobService = $inject(JobService);
 	notificationJobs = $inject(NotificationJobs);
+	executions = $repository(jobExecutionEntity);
 	get jobName() {
 		return this.notificationJobs.sendNotification.name;
 	}
@@ -232,13 +298,13 @@ var AdminNotificationController = class {
 			response: t.page(notificationResourceSchema)
 		},
 		handler: async ({ query }) => {
-			const result = await this.jobService.findExecutions({
-				...query,
-				job: this.jobName
-			});
+			query.sort ??= "-createdAt";
+			const where = this.executions.createQueryWhere();
+			where.jobName = { eq: this.jobName };
+			const page = await this.executions.paginate(query, { where }, { count: true });
 			return {
-				...result,
-				content: result.content.map((exec) => this.toResource(exec))
+				...page,
+				content: page.content.map((exec) => this.toResource(exec))
 			};
 		}
 	});
@@ -251,8 +317,9 @@ var AdminNotificationController = class {
 			response: notificationDetailResourceSchema
 		},
 		handler: async ({ params }) => {
-			const detail = await this.jobService.getExecution(params.id);
-			return this.toDetailResource(detail);
+			const exec = await this.executions.findById(params.id);
+			if (!exec || exec.jobName !== this.jobName) throw new NotFoundError(`Notification not found: ${params.id}`);
+			return this.toDetailResource(exec);
 		}
 	});
 	toResource(exec) {
@@ -277,7 +344,6 @@ var AdminNotificationController = class {
 		return {
 			...this.toResource(exec),
 			variables: payload.variables,
-			rendered: exec.result,
 			logs: exec.logs
 		};
 	}
@@ -303,15 +369,16 @@ const notificationContactSchema = t.object({
 * User notification management.
 *
 * **Features:**
-* - Notification definitions
-* - Email/SMS notification sending
-* - Job-based delivery with retry and tracking
-* - User preferences
+* - Notification definitions (email/SMS templates)
+* - Queue-based delivery with retry and audit trail (`record: "all"` + no ring buffer trim)
+* - Runtime-editable retention window via `$parameter` — purge cron respects it live
+* - Admin API for inspecting sent notifications
 *
 * @module alepha.api.notifications
 */
 const AlephaApiNotifications = $module({
 	name: "alepha.api.notifications",
+	imports: [AlephaApiJobsQueue, AlephaApiParameters],
 	primitives: [$notification],
 	services: [
 		NotificationSenderService,