aweshare 0.2.0

package/apps/agent/dist/doctor.js

@@ -0,0 +1,125 @@
+import { ConfigError, loadAgentConfig } from './config.js';
+import { probeBody, probeTarget } from './connection.js';
+import { classifyStatus } from './health.js';
+/**
+ * Pre-flight diagnostics, in fasten's order of "find the first failing link":
+ * direct backend replay first, hub last. Never guess past a failure.
+ */
+export async function runDoctor(dir) {
+    const checks = [];
+    let config;
+    let secrets;
+    try {
+        ;
+        ({ config, secrets } = loadAgentConfig(dir));
+        checks.push({
+            name: 'config',
+            ok: true,
+            detail: `${config.backends.length} backends, ${config.offerings.length} offerings`,
+        });
+    }
+    catch (err) {
+        const detail = err instanceof ConfigError ? err.message : String(err);
+        checks.push({ name: 'config', ok: false, detail });
+        return { ok: false, checks };
+    }
+    // 1. direct backend replay — same URL/protocol/model/key the agent would use
+    for (const backend of config.backends) {
+        checks.push(...(await checkBackend(backend, config.offerings, secrets[backend.keyRef ?? ''])));
+    }
+    // 2. hub connectivity last
+    try {
+        const started = Date.now();
+        const res = await fetch(`${config.hubUrl}/healthz`, { signal: AbortSignal.timeout(10_000) });
+        checks.push({
+            name: `hub ${config.hubUrl}`,
+            ok: res.ok,
+            detail: `healthz -> ${res.status} (${Date.now() - started}ms)`,
+        });
+    }
+    catch (err) {
+        checks.push({
+            name: `hub ${config.hubUrl}`,
+            ok: false,
+            detail: `unreachable: ${err instanceof Error ? err.message : err}`,
+        });
+    }
+    return { ok: checks.every((c) => c.ok), checks };
+}
+async function checkBackend(backend, offerings, apiKey) {
+    const checks = [];
+    const label = `backend '${backend.id}' (${backend.protocol})`;
+    // URL shape hints before spending a roundtrip (fasten's /v1-v1 class of errors)
+    const path = new URL(backend.baseUrl).pathname.replace(/\/+$/, '');
+    if (backend.protocol !== 'anthropic' && !/\/v\d+$/.test(path)) {
+        checks.push({
+            name: `${label} baseUrl`,
+            ok: false,
+            detail: `openai-style baseUrl usually ends with /v1 (SDK convention), got ${backend.baseUrl}; ignore only if the upstream truly has no version prefix`,
+        });
+    }
+    // GLM-style bases legitimately end in another version segment (e.g. /v4 with
+    // the real route /v4/v1/messages); only a trailing /v1 conflicts with the
+    // adapter-appended one.
+    if (backend.protocol === 'anthropic' && /\/v1$/.test(path)) {
+        checks.push({
+            name: `${label} baseUrl`,
+            ok: false,
+            detail: `anthropic-style baseUrl must not include /v1 (the agent appends it), got ${backend.baseUrl}`,
+        });
+    }
+    const offering = offerings.find((o) => o.backend === backend.id);
+    if (!offering) {
+        checks.push({ name: label, ok: true, detail: 'no offerings — probe skipped' });
+        return checks;
+    }
+    if (backend.keyRef && !apiKey) {
+        checks.push({
+            name: `${label} key`,
+            ok: false,
+            detail: `keyRef '${backend.keyRef}' has empty value in secrets.json`,
+        });
+        return checks;
+    }
+    const resolved = { ...backend, apiKey };
+    const { url, headers } = probeTarget(resolved);
+    try {
+        const started = Date.now();
+        const res = await fetch(url, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify(probeBody(offering.upstreamModel, backend.protocol)),
+            signal: AbortSignal.timeout(30_000),
+        });
+        const reason = classifyStatus(res.status);
+        if (reason === null) {
+            checks.push({
+                name: `${label} probe`,
+                ok: true,
+                detail: `model '${offering.upstreamModel}' -> ${res.status} (${Date.now() - started}ms)`,
+            });
+        }
+        else {
+            const hint = reason === 'AUTH'
+                ? 'check key permissions/balance (stray whitespace counts too)'
+                : reason === 'QUOTA'
+                    ? 'upstream balance or rate limit exhausted'
+                    : 'check that upstreamModel is a real backend id (full `ollama list` tag)';
+            checks.push({
+                name: `${label} probe`,
+                ok: false,
+                detail: `model '${offering.upstreamModel}' -> ${res.status} (${reason}): ${hint}`,
+            });
+        }
+        await res.arrayBuffer().catch(() => undefined);
+    }
+    catch (err) {
+        checks.push({
+            name: `${label} probe`,
+            ok: false,
+            detail: `direct probe to ${url} failed: ${err instanceof Error ? err.message : err}. Check local network and whether the service is running (inside Docker, 127.0.0.1 is the container itself)`,
+        });
+    }
+    return checks;
+}
+//# sourceMappingURL=doctor.js.map

package/apps/agent/dist/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AACA,OAAO,EAAoC,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC5F,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAa5C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,MAAM,MAAM,GAAkB,EAAE,CAAA;IAEhC,IAAI,MAAoD,CAAA;IACxD,IAAI,OAAsD,CAAA;IAC1D,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;QAC7C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,cAAc,MAAM,CAAC,SAAS,CAAC,MAAM,YAAY;SACnF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACrE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;IAED,6EAA6E;IAC7E,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAChG,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,UAAU,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE;YAC5B,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,cAAc,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,KAAK;SAC/D,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE;YAC5B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE;SACnE,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,SAA0B,EAC1B,MAA0B;IAE1B,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,YAAY,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,GAAG,CAAA;IAE7D,gFAAgF;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,KAAK,UAAU;YACxB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oEAAoE,OAAO,CAAC,OAAO,2DAA2D;SACvJ,CAAC,CAAA;IACJ,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,wBAAwB;IACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,KAAK,UAAU;YACxB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4EAA4E,OAAO,CAAC,OAAO,EAAE;SACtG,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC9E,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,KAAK,MAAM;YACpB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW,OAAO,CAAC,MAAM,mCAAmC;SACrE,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,QAAQ,GAAoB,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAA;IACxD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,KAAK,QAAQ;gBACtB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,UAAU,QAAQ,CAAC,aAAa,QAAQ,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,KAAK;aACzF,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GACR,MAAM,KAAK,MAAM;gBACf,CAAC,CAAC,6DAA6D;gBAC/D,CAAC,CAAC,MAAM,KAAK,OAAO;oBAClB,CAAC,CAAC,0CAA0C;oBAC5C,CAAC,CAAC,wEAAwE,CAAA;YAChF,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,KAAK,QAAQ;gBACtB,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,UAAU,QAAQ,CAAC,aAAa,QAAQ,GAAG,CAAC,MAAM,KAAK,MAAM,MAAM,IAAI,EAAE;aAClF,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,KAAK,QAAQ;YACtB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mBAAmB,GAAG,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,6GAA6G;SAChM,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/apps/agent/dist/health.d.ts

@@ -0,0 +1,15 @@
+import type { BackendStatus } from 'aweshare-protocol';
+export type FailureReason = 'AUTH' | 'QUOTA' | 'HTTP' | 'NETWORK' | 'CANCELLED';
+/**
+ * Per-backend health state. Degraded backends are reported in heartbeats and
+ * the hub stops dispatching to their offerings until they recover.
+ */
+export declare class HealthGate {
+    private consecutive;
+    private degraded;
+    record(backendId: string, ok: boolean, reason?: FailureReason): void;
+    isDegraded(backendId: string): boolean;
+    statusMap(): Record<string, BackendStatus>;
+}
+/** Map an upstream HTTP status to a failure class (ok responses pass null). */
+export declare function classifyStatus(status: number): FailureReason | null;

package/apps/agent/dist/health.js

@@ -0,0 +1,45 @@
+/** AUTH/QUOTA consecutive failures >= threshold -> degraded until a success. */
+const DEGRADE_THRESHOLD = 2;
+/**
+ * Per-backend health state. Degraded backends are reported in heartbeats and
+ * the hub stops dispatching to their offerings until they recover.
+ */
+export class HealthGate {
+    consecutive = new Map();
+    degraded = new Map();
+    record(backendId, ok, reason) {
+        if (ok) {
+            this.consecutive.delete(backendId);
+            this.degraded.delete(backendId);
+            return;
+        }
+        if (reason === undefined || reason === 'CANCELLED')
+            return;
+        const current = this.consecutive.get(backendId);
+        const count = current?.reason === reason ? current.count + 1 : 1;
+        this.consecutive.set(backendId, { reason, count });
+        if ((reason === 'AUTH' || reason === 'QUOTA') && count >= DEGRADE_THRESHOLD) {
+            this.degraded.set(backendId, { state: 'degraded', reason });
+        }
+    }
+    isDegraded(backendId) {
+        return this.degraded.has(backendId);
+    }
+    statusMap() {
+        const out = {};
+        for (const [id, status] of this.degraded)
+            out[id] = status;
+        return out;
+    }
+}
+/** Map an upstream HTTP status to a failure class (ok responses pass null). */
+export function classifyStatus(status) {
+    if (status < 400)
+        return null;
+    if (status === 401 || status === 403)
+        return 'AUTH';
+    if (status === 402 || status === 429)
+        return 'QUOTA';
+    return 'HTTP';
+}
+//# sourceMappingURL=health.js.map

package/apps/agent/dist/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAIA,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAE3B;;;GAGG;AACH,MAAM,OAAO,UAAU;IACb,WAAW,GAAG,IAAI,GAAG,EAAoD,CAAA;IACzE,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAA;IAEnD,MAAM,CAAC,SAAiB,EAAE,EAAW,EAAE,MAAsB;QAC3D,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC/B,OAAM;QACR,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,WAAW;YAAE,OAAM;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC5E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC;IAED,SAAS;QACP,MAAM,GAAG,GAAkC,EAAE,CAAA;QAC7C,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAA;QAC1D,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,MAAM,CAAA;IACnD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,OAAO,CAAA;IACpD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/apps/agent/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { buildUpstreamRequest, type ResolvedBackend, type UpstreamRequest } from './adapters.js';
+export { type AgentConfig, type AgentOffering, agentDir, type Backend, ConfigError, loadAgentConfig, writeFileAtomic, } from './config.js';
+export { AgentConnection, probeBody, probeTarget } from './connection.js';
+export { type DoctorCheck, type DoctorReport, runDoctor } from './doctor.js';
+export { classifyStatus, type FailureReason, HealthGate } from './health.js';

package/apps/agent/dist/index.js

@@ -0,0 +1,6 @@
+export { buildUpstreamRequest } from './adapters.js';
+export { agentDir, ConfigError, loadAgentConfig, writeFileAtomic, } from './config.js';
+export { AgentConnection, probeBody, probeTarget } from './connection.js';
+export { runDoctor } from './doctor.js';
+export { classifyStatus, HealthGate } from './health.js';
+//# sourceMappingURL=index.js.map

package/apps/agent/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAA8C,MAAM,eAAe,CAAA;AAChG,OAAO,EAGL,QAAQ,EAER,WAAW,EACX,eAAe,EACf,eAAe,GAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAuC,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAsB,UAAU,EAAE,MAAM,aAAa,CAAA"}

package/apps/agent/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@aweshare/agent",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "dependencies": {
+    "aweshare-protocol": "workspace:*",
+    "pino": "^9.7.0",
+    "smol-toml": "^1.4.2",
+    "ws": "^8.18.3"
+  },
+  "devDependencies": {
+    "@types/ws": "^8.18.1",
+    "typescript": "^5.8.3"
+  }
+}

package/apps/hub/dist/admin.d.ts

@@ -0,0 +1,10 @@
+import type Database from 'better-sqlite3';
+import type { Logger } from 'pino';
+import type { AuthContext } from './auth.js';
+import { type Router } from './http.js';
+export interface AdminDeps {
+    db: Database.Database;
+    auth: AuthContext;
+    log: Logger;
+}
+export declare function registerAdminRoutes(router: Router, deps: AdminDeps): void;

package/apps/hub/dist/admin.js

@@ -0,0 +1,208 @@
+import { parseAlias, roleForToken } from 'aweshare-protocol';
+import { requireAdmin, requireConsumer, requireProducer } from './auth.js';
+import { addGrant, getConsumerByName, getProducerByName, insertConsumer, insertProducer, listGrants, listTokens, queryUsage, removeGrant, revokeToken, setConsumerConfig, } from './db.js';
+import { HttpError, readJson, sendJson } from './http.js';
+import { parseLimits, safeParseLimits } from './limits.js';
+import { generateToken, hashToken } from './tokens.js';
+/** Grants are managed by the producer owning the alias namespace, or by admin. */
+function authorizeGrantChange(req, auth, alias) {
+    const token = req.headers.authorization?.startsWith('Bearer ')
+        ? req.headers.authorization.slice(7).trim()
+        : null;
+    if (!token)
+        throw new HttpError(401, 'INVALID_KEY', 'admin or producer token required');
+    if (roleForToken(token) === 'admin') {
+        requireAdmin(req, auth);
+        const parsed = parseAlias(alias);
+        if (!parsed)
+            throw new HttpError(400, 'PROTOCOL_MISMATCH', `invalid alias: ${alias}`);
+        const producer = getProducerByName(auth.db, parsed.namespace);
+        if (!producer)
+            throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown producer namespace: ${parsed.namespace}`);
+        return { producerId: producer.id };
+    }
+    if (roleForToken(token) === 'consumer') {
+        throw new HttpError(403, 'NOT_GRANTED', 'consumer keys cannot manage grants');
+    }
+    const { row } = requireProducer(req, auth);
+    const parsed = parseAlias(alias);
+    if (!parsed || parsed.namespace !== row.name) {
+        throw new HttpError(403, 'NOT_GRANTED', `alias ${alias} is outside your namespace (${row.name})`);
+    }
+    return { producerId: row.id };
+}
+export function registerAdminRoutes(router, deps) {
+    const { db, auth } = deps;
+    router.add('POST', '/admin/v1/tokens', async (ctx) => {
+        requireAdmin(ctx.req, auth);
+        const body = (await readJson(ctx.req, 64 * 1024));
+        if (body.role !== 'producer' && body.role !== 'consumer') {
+            throw new HttpError(400, 'INVALID_ROLE', "role must be 'producer' or 'consumer'");
+        }
+        if (typeof body.name !== 'string' || !/^[a-z0-9][a-z0-9-]{1,31}$/.test(body.name)) {
+            throw new HttpError(400, 'INVALID_NAME', 'name must match ^[a-z0-9][a-z0-9-]{1,31}$ (it becomes the alias namespace for producers)');
+        }
+        const token = generateToken(body.role);
+        const tokenHash = hashToken(token, auth.pepper);
+        const row = body.role === 'producer'
+            ? insertProducer(db, body.name, tokenHash)
+            : insertConsumer(db, body.name, tokenHash);
+        deps.log.info({ role: body.role, name: body.name }, 'token issued');
+        sendJson(ctx.res, 201, { id: row.id, role: body.role, name: row.name, token });
+    });
+    router.add('GET', '/admin/v1/tokens', (ctx) => {
+        requireAdmin(ctx.req, auth);
+        sendJson(ctx.res, 200, listTokens(db));
+    });
+    router.add('DELETE', '/admin/v1/tokens/:role/:id', (ctx) => {
+        requireAdmin(ctx.req, auth);
+        const role = ctx.params.role === 'producers'
+            ? 'producer'
+            : ctx.params.role === 'consumers'
+                ? 'consumer'
+                : null;
+        if (role !== 'producer' && role !== 'consumer') {
+            throw new HttpError(400, 'INVALID_ROLE', 'path must be /admin/v1/tokens/{producers|consumers}/{id}');
+        }
+        const id = Number(ctx.params.id);
+        if (!Number.isInteger(id))
+            throw new HttpError(400, 'INVALID_ID', 'token id must be an integer');
+        revokeToken(db, role, id);
+        deps.log.info({ role, id }, 'token revoked');
+        sendJson(ctx.res, 200, { revoked: true, role, id });
+    });
+    router.add('PUT', '/admin/v1/grants', async (ctx) => {
+        const body = (await readJson(ctx.req, 64 * 1024));
+        if (typeof body.alias !== 'string' || typeof body.consumer !== 'string') {
+            throw new HttpError(400, 'INVALID_REQUEST', 'body must be {alias, consumer[, expiresAt]}');
+        }
+        let expiresAt = null;
+        if (body.expiresAt !== undefined) {
+            const t = Date.parse(body.expiresAt);
+            if (Number.isNaN(t)) {
+                throw new HttpError(400, 'INVALID_REQUEST', 'expiresAt must be an ISO-8601 timestamp');
+            }
+            if (t <= Date.now()) {
+                throw new HttpError(400, 'INVALID_REQUEST', 'expiresAt must be in the future');
+            }
+            // canonical UTC form — lexicographically comparable with SQLite 'now'
+            expiresAt = new Date(t).toISOString();
+        }
+        const { producerId } = authorizeGrantChange(ctx.req, auth, body.alias);
+        const consumer = getConsumerByName(db, body.consumer);
+        if (!consumer)
+            throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown consumer: ${body.consumer}`);
+        addGrant(db, producerId, consumer.id, body.alias, expiresAt);
+        deps.log.info({ alias: body.alias, consumer: body.consumer, expiresAt }, 'grant added');
+        sendJson(ctx.res, 201, {
+            granted: true,
+            alias: body.alias,
+            consumer: body.consumer,
+            expiresAt,
+        });
+    });
+    router.add('DELETE', '/admin/v1/grants', async (ctx) => {
+        const alias = ctx.query.get('alias');
+        const consumerName = ctx.query.get('consumer');
+        if (!alias || !consumerName) {
+            throw new HttpError(400, 'INVALID_REQUEST', 'query params alias and consumer are required');
+        }
+        const { producerId } = authorizeGrantChange(ctx.req, auth, alias);
+        const consumer = getConsumerByName(db, consumerName);
+        if (!consumer)
+            throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown consumer: ${consumerName}`);
+        const removed = removeGrant(db, producerId, consumer.id, alias);
+        sendJson(ctx.res, 200, { removed, alias, consumer: consumerName });
+    });
+    router.add('GET', '/admin/v1/grants', (ctx) => {
+        const token = ctx.req.headers.authorization?.startsWith('Bearer ')
+            ? ctx.req.headers.authorization.slice(7).trim()
+            : '';
+        if (roleForToken(token) === 'admin') {
+            requireAdmin(ctx.req, auth);
+            sendJson(ctx.res, 200, listGrants(db));
+            return;
+        }
+        const { row } = requireProducer(ctx.req, auth);
+        sendJson(ctx.res, 200, listGrants(db, row.id));
+    });
+    router.add('GET', '/admin/v1/usage', (ctx) => {
+        const token = ctx.req.headers.authorization?.startsWith('Bearer ')
+            ? ctx.req.headers.authorization.slice(7).trim()
+            : '';
+        const role = roleForToken(token);
+        const limitRaw = ctx.query.get('limit');
+        const limit = limitRaw === null ? 100 : Number(limitRaw);
+        if (!Number.isInteger(limit) || limit < 1 || limit > 1000) {
+            throw new HttpError(400, 'INVALID_LIMIT', 'limit must be an integer between 1 and 1000');
+        }
+        if (role === 'admin') {
+            requireAdmin(ctx.req, auth);
+            const consumerName = ctx.query.get('consumer');
+            const consumer = consumerName ? getConsumerByName(db, consumerName) : undefined;
+            if (consumerName && !consumer)
+                throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown consumer: ${consumerName}`);
+            sendJson(ctx.res, 200, queryUsage(db, {
+                alias: ctx.query.get('alias') ?? undefined,
+                consumerId: consumer?.id,
+                limit,
+            }));
+            return;
+        }
+        if (role === 'producer') {
+            const { row } = requireProducer(ctx.req, auth);
+            sendJson(ctx.res, 200, queryUsage(db, {
+                producerId: row.id,
+                alias: ctx.query.get('alias') ?? undefined,
+                limit,
+            }));
+            return;
+        }
+        // consumer key: own usage only (ignore filters that would broaden it)
+        const { row: consumerRow } = requireConsumer(ctx.req, auth);
+        sendJson(ctx.res, 200, queryUsage(db, {
+            consumerId: consumerRow.id,
+            alias: ctx.query.get('alias') ?? undefined,
+            limit,
+        }));
+    });
+    // Per-consumer limit overrides (admin only): sparse JSON, unset keys fall back
+    // to the hub-wide env defaults. PUT merges into what is already stored.
+    router.add('GET', '/admin/v1/consumers/:name/limits', (ctx) => {
+        requireAdmin(ctx.req, auth);
+        const consumer = getConsumerByName(db, ctx.params.name);
+        if (!consumer)
+            throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown consumer: ${ctx.params.name}`);
+        sendJson(ctx.res, 200, {
+            name: consumer.name,
+            overrides: safeParseLimits(consumer.config),
+        });
+    });
+    router.add('PUT', '/admin/v1/consumers/:name/limits', async (ctx) => {
+        requireAdmin(ctx.req, auth);
+        const consumer = getConsumerByName(db, ctx.params.name);
+        if (!consumer)
+            throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown consumer: ${ctx.params.name}`);
+        let incoming;
+        try {
+            incoming = parseLimits(await readJson(ctx.req, 64 * 1024));
+        }
+        catch (err) {
+            throw new HttpError(400, 'INVALID_REQUEST', err.message);
+        }
+        const merged = { ...safeParseLimits(consumer.config), ...incoming };
+        setConsumerConfig(db, consumer.id, JSON.stringify(merged));
+        deps.log.info({ consumer: consumer.name, limits: merged }, 'consumer limits updated');
+        sendJson(ctx.res, 200, { name: consumer.name, overrides: merged });
+    });
+    router.add('DELETE', '/admin/v1/consumers/:name/limits', (ctx) => {
+        requireAdmin(ctx.req, auth);
+        const consumer = getConsumerByName(db, ctx.params.name);
+        if (!consumer)
+            throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown consumer: ${ctx.params.name}`);
+        setConsumerConfig(db, consumer.id, null);
+        deps.log.info({ consumer: consumer.name }, 'consumer limits cleared');
+        sendJson(ctx.res, 200, { name: consumer.name, overrides: null });
+    });
+}
+//# sourceMappingURL=admin.js.map

package/apps/hub/dist/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAI5D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,iBAAiB,GAClB,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,SAAS,EAAkC,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACzF,OAAO,EAAuB,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAQtD,kFAAkF;AAClF,SAAS,oBAAoB,CAC3B,GAAwB,EACxB,IAAiB,EACjB,KAAa;IAEb,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;QAC5D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC3C,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,kCAAkC,CAAC,CAAA;IACvF,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC;QACpC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACvB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,kBAAkB,KAAK,EAAE,CAAC,CAAA;QACrF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC7D,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,+BAA+B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;QAChG,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAA;IACpC,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,oCAAoC,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,aAAa,EACb,SAAS,KAAK,+BAA+B,GAAG,CAAC,IAAI,GAAG,CACzD,CAAA;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAAe;IACjE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;IAEzB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAqC,CAAA;QACrF,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,uCAAuC,CAAC,CAAA;QACnF,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,cAAc,EACd,0FAA0F,CAC3F,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/C,MAAM,GAAG,GACP,IAAI,CAAC,IAAI,KAAK,UAAU;YACtB,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;YAC1C,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC,CAAA;QACnE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5C,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,4BAA4B,EAAE,CAAC,GAAG,EAAE,EAAE;QACzD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW;YAC7B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW;gBAC/B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,IAAI,CAAA;QACZ,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/C,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,cAAc,EACd,0DAA0D,CAC3D,CAAA;QACH,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,6BAA6B,CAAC,CAAA;QAChG,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;QAC5C,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAI/C,CAAA;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,6CAA6C,CAAC,CAAA;QAC5F,CAAC;QACD,IAAI,SAAS,GAAkB,IAAI,CAAA;QACnC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACpC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAA;YACxF,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACpB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,iCAAiC,CAAC,CAAA;YAChF,CAAC;YACD,sEAAsE;YACtE,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QACvC,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACtE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChG,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAC5D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,aAAa,CAAC,CAAA;QACvF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;YACrB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS;SACV,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,8CAA8C,CAAC,CAAA;QAC7F,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;QACpD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,YAAY,EAAE,CAAC,CAAA;QAC/F,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC/D,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;YAChE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC;YACpC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;YACtC,OAAM;QACR,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC9C,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;YAChE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,6CAA6C,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC3B,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/E,IAAI,YAAY,IAAI,CAAC,QAAQ;gBAC3B,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,YAAY,EAAE,CAAC,CAAA;YAClF,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,UAAU,CAAC,EAAE,EAAE;gBACb,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;gBAC1C,UAAU,EAAE,QAAQ,EAAE,EAAE;gBACxB,KAAK;aACN,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC9C,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,UAAU,CAAC,EAAE,EAAE;gBACb,UAAU,EAAE,GAAG,CAAC,EAAE;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;gBAC1C,KAAK;aACN,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,sEAAsE;QACtE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3D,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,UAAU,CAAC,EAAE,EAAE;YACb,UAAU,EAAE,WAAW,CAAC,EAAE;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YAC1C,KAAK;SACN,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kCAAkC,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5D,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACrF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC5C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kCAAkC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACrF,IAAI,QAAwB,CAAA;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,WAAW,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAA;QACnE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAA;QACrF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,kCAAkC,EAAE,CAAC,GAAG,EAAE,EAAE;QAC/D,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACrF,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,yBAAyB,CAAC,CAAA;QACrE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/apps/hub/dist/auth.d.ts

@@ -0,0 +1,17 @@
+import type { IncomingMessage } from 'node:http';
+import type Database from 'better-sqlite3';
+import { type ConsumerRow, type ProducerRow } from './db.js';
+export interface AuthContext {
+    db: Database.Database;
+    pepper: string;
+    adminToken: string | null;
+}
+export declare function requireAdmin(req: IncomingMessage, auth: AuthContext): void;
+export declare function requireProducer(req: IncomingMessage, auth: AuthContext): {
+    row: ProducerRow;
+    token: string;
+};
+export declare function requireConsumer(req: IncomingMessage, auth: AuthContext): {
+    row: ConsumerRow;
+    token: string;
+};

package/apps/hub/dist/auth.js

@@ -0,0 +1,28 @@
+import { findConsumerByHash, findProducerByHash } from './db.js';
+import { extractCredential, HttpError } from './http.js';
+import { hashToken, safeEqual } from './tokens.js';
+export function requireAdmin(req, auth) {
+    const token = extractCredential(req);
+    if (!token || !auth.adminToken || !safeEqual(token, auth.adminToken)) {
+        throw new HttpError(401, 'INVALID_KEY', 'admin token required');
+    }
+}
+export function requireProducer(req, auth) {
+    const token = extractCredential(req);
+    if (!token)
+        throw new HttpError(401, 'INVALID_KEY', 'producer token required');
+    const row = findProducerByHash(auth.db, hashToken(token, auth.pepper));
+    if (!row || row.revoked_at)
+        throw new HttpError(401, 'INVALID_KEY', 'invalid producer token');
+    return { row, token };
+}
+export function requireConsumer(req, auth) {
+    const token = extractCredential(req);
+    if (!token)
+        throw new HttpError(401, 'INVALID_KEY', 'consumer key required');
+    const row = findConsumerByHash(auth.db, hashToken(token, auth.pepper));
+    if (!row || row.revoked_at)
+        throw new HttpError(401, 'INVALID_KEY', 'invalid consumer key');
+    return { row, token };
+}
+//# sourceMappingURL=auth.js.map

package/apps/hub/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,kBAAkB,EAAE,kBAAkB,EAAoB,MAAM,SAAS,CAAA;AACpG,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAQlD,MAAM,UAAU,YAAY,CAAC,GAAoB,EAAE,IAAiB;IAClE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,sBAAsB,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAoB,EACpB,IAAiB;IAEjB,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,yBAAyB,CAAC,CAAA;IAC9E,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACtE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,wBAAwB,CAAC,CAAA;IAC7F,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAoB,EACpB,IAAiB;IAEjB,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAA;IAC5E,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACtE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,sBAAsB,CAAC,CAAA;IAC3F,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;AACvB,CAAC"}

package/apps/hub/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};