dkimkit 0.0.0-stage → 0.7.0

package/dist/src/hosted/cli.js

@@ -0,0 +1,318 @@
+#!/usr/bin/env node
+import { randomBytes } from 'node:crypto';
+import { mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { parseArgs } from 'node:util';
+// node:sqlite warns that it is experimental every time it loads; that's expected here.
+const emitWarning = process.emitWarning.bind(process);
+process.emitWarning = ((warning, ...rest) => {
+    if (String(warning).includes('SQLite is an experimental feature'))
+        return;
+    emitWarning(warning, ...rest);
+});
+const HELP = `dkimkit-api — hosted multi-tenant API
+
+Usage
+  dkimkit-api serve
+  dkimkit-api create-account --name "Acme Inc" [--with-sendgrid-key]
+  dkimkit-api set-domain-limit --account acct_… (--limit 25 | --unlimited)
+  dkimkit-api usage-report [--from 2026-10-01] [--to 2026-10-31] [--format csv|json]
+  dkimkit-api stripe-setup          Create the Stripe meter, price and webhook for pay-as-you-go
+  dkimkit-api generate-encryption-key
+
+Environment
+  ENCRYPTION_KEY          32 bytes, base64 or hex. Encrypts stored credentials. Required.
+  DATABASE_URL            postgres://user:pass@host/db — use Postgres (recommended for production)
+  DATABASE_PATH           Otherwise: SQLite file (default ./data/dkimkit.db)
+  PORT, HOST              Listen address (default 8080, 0.0.0.0)
+  WORKER_CONCURRENCY      Domains checked in parallel (default 4)
+  RUN_WORKERS             Set to "false" to serve the API without background jobs
+  ALLOW_PRIVATE_WEBHOOKS  "true" allows http:// and private-network webhook URLs (development only)
+  PUBLIC_URL              Public base URL (https://…). Required for sign-up and billing; used in widget links
+  SENDGRID_API_KEY        With create-account --with-sendgrid-key: the account's SendGrid key
+
+Self-serve sign-up and dashboard (on when PUBLIC_URL is set; SIGNUP_ENABLED=false to turn off)
+  EMAIL_FROM              Sender address for sign-in emails, e.g. login@yourapp.com
+  MAIL_RESEND_API_KEY     Resend key used to send them, or:
+  MAIL_SENDGRID_API_KEY   SendGrid key used to send them (without EMAIL_FROM and a key, links are logged instead)
+  APP_NAME                Product name on the website, dashboard and emails (default "DKIMkit")
+
+Website (served at / when PUBLIC_URL is set: landing, /pricing, /docs, /about, /contact, /feedback, /terms, /privacy, /refunds)
+  LEGAL_NAME              Who operates the service (your name or business), on About and legal pages
+  CONTACT_EMAIL           Support and legal contact; feedback form messages go here
+  LEGAL_COUNTRY           Country whose law governs the terms, e.g. India
+  LEGAL_EFFECTIVE_DATE    "Last updated" date on legal pages, YYYY-MM-DD
+
+Billing (pay as you go: first FREE_DOMAINS free, then PRICE_PER_DOMAIN_CENTS per active domain/month)
+  BILLING_PROVIDER        dodo or stripe; unset = no billing, no free-tier cap
+  FREE_DOMAINS            Default 3 (must match the provider's free threshold). Without billing,
+                          setting it caps free accounts and shows paid plans as coming soon
+  PRICE_PER_DOMAIN_CENTS  Default 200 (for display; the provider's price is what's charged)
+  CURRENCY                Default usd
+  Dodo Payments:  DODO_API_KEY, DODO_WEBHOOK_SECRET, DODO_PRODUCT_ID,
+                  DODO_MODE (test | live, default test), DODO_METER_EVENT (default active_domains)
+  Stripe:         STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_ID, STRIPE_METER_EVENT
+  Webhook endpoint for either: <PUBLIC_URL>/billing/webhook`;
+const log = (level, message, fields) => {
+    const line = JSON.stringify({ time: new Date().toISOString(), level, msg: message, ...fields });
+    (level === 'error' ? process.stderr : process.stdout).write(line + '\n');
+};
+/** Billing from BILLING_PROVIDER (dodo | stripe) and that provider's variables; undefined when unset. */
+async function billingFromEnv() {
+    const provider = process.env.BILLING_PROVIDER;
+    if (!provider)
+        return undefined;
+    const plan = {
+        freeDomains: intEnv('FREE_DOMAINS', 3),
+        unitAmount: intEnv('PRICE_PER_DOMAIN_CENTS', 200),
+        currency: process.env.CURRENCY,
+    };
+    if (provider === 'dodo') {
+        const mode = process.env.DODO_MODE ?? 'test';
+        if (mode !== 'test' && mode !== 'live')
+            throw new Error('DODO_MODE must be test or live.');
+        const { DodoBillingProvider } = await import('./billing-dodo.js');
+        return {
+            ...plan,
+            provider: new DodoBillingProvider({
+                apiKey: requireEnv('DODO_API_KEY'),
+                webhookSecret: requireEnv('DODO_WEBHOOK_SECRET'),
+                productId: requireEnv('DODO_PRODUCT_ID'),
+                meterEventName: process.env.DODO_METER_EVENT,
+                mode,
+            }),
+        };
+    }
+    if (provider === 'stripe') {
+        const { StripeBillingProvider } = await import('./billing-stripe.js');
+        return {
+            ...plan,
+            provider: new StripeBillingProvider({
+                secretKey: requireEnv('STRIPE_SECRET_KEY'),
+                webhookSecret: requireEnv('STRIPE_WEBHOOK_SECRET'),
+                priceId: requireEnv('STRIPE_PRICE_ID'),
+                meterEventName: process.env.STRIPE_METER_EVENT,
+            }),
+        };
+    }
+    throw new Error('BILLING_PROVIDER must be dodo or stripe.');
+}
+function intEnv(name, fallback) {
+    const raw = process.env[name];
+    if (raw === undefined || raw === '')
+        return fallback;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 0)
+        throw new Error(`${name} must be a whole number.`);
+    return n;
+}
+function requireEnv(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`${name} is not set. See --help.`);
+    return value;
+}
+/** DATABASE_URL (Postgres) if set, else a SQLite file at DATABASE_PATH. */
+function database() {
+    if (process.env.DATABASE_URL)
+        return process.env.DATABASE_URL;
+    const path = resolve(process.env.DATABASE_PATH ?? './data/dkimkit.db');
+    mkdirSync(dirname(path), { recursive: true });
+    return path;
+}
+async function main() {
+    const { values, positionals } = parseArgs({
+        allowPositionals: true,
+        options: {
+            name: { type: 'string' },
+            'with-sendgrid-key': { type: 'boolean', default: false },
+            account: { type: 'string' },
+            limit: { type: 'string' },
+            unlimited: { type: 'boolean', default: false },
+            from: { type: 'string' },
+            to: { type: 'string' },
+            format: { type: 'string', default: 'csv' },
+            help: { type: 'boolean', short: 'h', default: false },
+        },
+    });
+    const command = positionals[0];
+    if (values.help || !command) {
+        process.stdout.write(HELP + '\n');
+        return;
+    }
+    switch (command) {
+        case 'generate-encryption-key':
+            process.stdout.write(randomBytes(32).toString('base64') + '\n');
+            return;
+        case 'create-account': {
+            if (!values.name)
+                throw new Error('Pass --name.');
+            const sendgridKey = values['with-sendgrid-key'] ? requireEnv('SENDGRID_API_KEY') : undefined;
+            const { openStore } = await import('./store.js');
+            const { DomainService } = await import('./service.js');
+            const { Vault } = await import('./crypto.js');
+            const vault = new Vault(requireEnv('ENCRYPTION_KEY'));
+            const store = await openStore(database());
+            try {
+                const service = new DomainService({ store, vault });
+                const { account, apiKey } = await service.createAccount(values.name, sendgridKey);
+                process.stdout.write(`Account:  ${account.id} (${account.name})\nAPI key:  ${apiKey}\n\n` +
+                    `Store the API key now; only its hash is kept.\n` +
+                    (sendgridKey ? '' : `Next: PATCH /v1/account with {"sendgrid_api_key": "SG..."}\n`));
+            }
+            finally {
+                await store.close();
+            }
+            return;
+        }
+        case 'serve': {
+            const { startHostedApi } = await import('./api.js');
+            const { ResendMailer, SendGridMailer } = await import('./auth.js');
+            const publicUrl = process.env.PUBLIC_URL;
+            const signupEnabled = Boolean(publicUrl) && process.env.SIGNUP_ENABLED !== 'false';
+            const from = process.env.EMAIL_FROM;
+            const resendKey = process.env.MAIL_RESEND_API_KEY;
+            const sendgridKey = process.env.MAIL_SENDGRID_API_KEY;
+            const fromName = process.env.APP_NAME;
+            const mailer = !from
+                ? undefined
+                : resendKey
+                    ? new ResendMailer({ apiKey: resendKey, from, fromName })
+                    : sendgridKey
+                        ? new SendGridMailer({ apiKey: sendgridKey, from, fromName })
+                        : undefined;
+            if (signupEnabled && !mailer)
+                log('warn', 'EMAIL_FROM and MAIL_RESEND_API_KEY or MAIL_SENDGRID_API_KEY not set: sign-in links will be logged, not emailed');
+            const billing = await billingFromEnv();
+            const api = await startHostedApi({
+                signup: signupEnabled ? { mailer, appName: process.env.APP_NAME } : undefined,
+                billing,
+                // Before payments launch, FREE_DOMAINS alone sets the free plan's cap.
+                freePlan: !billing && process.env.FREE_DOMAINS ? { freeDomains: intEnv('FREE_DOMAINS', 3) } : undefined,
+                site: publicUrl
+                    ? {
+                        appName: process.env.APP_NAME,
+                        legalName: process.env.LEGAL_NAME,
+                        contactEmail: process.env.CONTACT_EMAIL,
+                        legalCountry: process.env.LEGAL_COUNTRY,
+                        effectiveDate: process.env.LEGAL_EFFECTIVE_DATE,
+                        mailProvider: mailer instanceof ResendMailer ? 'Resend' : mailer ? 'Twilio SendGrid' : undefined,
+                    }
+                    : undefined,
+                database: database(),
+                encryptionKey: requireEnv('ENCRYPTION_KEY'),
+                port: Number(process.env.PORT ?? 8080),
+                host: process.env.HOST ?? '0.0.0.0',
+                workers: process.env.RUN_WORKERS !== 'false',
+                runner: { concurrency: Number(process.env.WORKER_CONCURRENCY ?? 4) },
+                allowPrivateWebhooks: process.env.ALLOW_PRIVATE_WEBHOOKS === 'true',
+                publicUrl: process.env.PUBLIC_URL,
+                log,
+            });
+            const missing = api.site?.missingSettings() ?? [];
+            if (missing.length)
+                log('warn', `website shows placeholders until these are set: ${missing.join(', ')}`);
+            log('info', 'listening', {
+                url: api.url,
+                workers: process.env.RUN_WORKERS !== 'false',
+                database: process.env.DATABASE_URL ? 'postgres' : 'sqlite',
+                signup: signupEnabled,
+                billing: billing ? `${billing.provider.name}${process.env.DODO_MODE === 'live' || billing.provider.name !== 'dodo' ? '' : ' (test mode)'}` : false,
+            });
+            const shutdown = async (signal) => {
+                log('info', 'shutting down', { signal });
+                await api.close();
+                process.exit(0);
+            };
+            process.once('SIGTERM', () => void shutdown('SIGTERM'));
+            process.once('SIGINT', () => void shutdown('SIGINT'));
+            return;
+        }
+        case 'stripe-setup': {
+            const { StripeClient, setupStripe } = await import('./billing-stripe.js');
+            const publicUrl = process.env.PUBLIC_URL?.replace(/\/$/, '');
+            const result = await setupStripe(new StripeClient(requireEnv('STRIPE_SECRET_KEY')), {
+                freeDomains: intEnv('FREE_DOMAINS', 3),
+                unitAmount: intEnv('PRICE_PER_DOMAIN_CENTS', 200),
+                currency: process.env.CURRENCY ?? 'usd',
+                meterEventName: process.env.STRIPE_METER_EVENT ?? 'active_domains',
+                webhookUrl: publicUrl ? `${publicUrl}/billing/webhook` : undefined,
+            });
+            process.stdout.write(`Created meter ${result.meterId}, product ${result.productId} and price ${result.priceId}.\n\n` +
+                `Add to your environment:\n  STRIPE_PRICE_ID=${result.priceId}\n` +
+                (result.webhook
+                    ? `  STRIPE_WEBHOOK_SECRET=${result.webhook.secret}\n\nWebhook endpoint ${result.webhook.id} sends events to ${publicUrl}/billing/webhook.\n`
+                    : `\nSet PUBLIC_URL and run again to also create the webhook endpoint, or add ${'<PUBLIC_URL>'}/billing/webhook in the Stripe dashboard\n` +
+                        `with events checkout.session.completed and customer.subscription.{created,updated,deleted}.\n`) +
+                `Also turn on the Customer Portal in Stripe (Settings → Billing → Customer portal).\n`);
+            return;
+        }
+        case 'set-domain-limit': {
+            if (!values.account)
+                throw new Error('Pass --account.');
+            if (values.unlimited === Boolean(values.limit))
+                throw new Error('Pass either --limit <n> or --unlimited.');
+            const limit = values.unlimited ? null : Number(values.limit);
+            if (limit !== null && (!Number.isInteger(limit) || limit < 0))
+                throw new Error('--limit must be a whole number.');
+            await withService(async (service) => {
+                const account = await service.setDomainLimit(values.account, limit);
+                process.stdout.write(`${account.id} (${account.name}): domain limit ${account.domainLimit ?? 'unlimited'}\n`);
+            });
+            return;
+        }
+        case 'usage-report': {
+            if (values.format !== 'csv' && values.format !== 'json')
+                throw new Error('--format must be csv or json.');
+            const { parseUsagePeriod } = await import('./api.js');
+            const query = new URLSearchParams();
+            if (values.from)
+                query.set('from', values.from);
+            if (values.to)
+                query.set('to', values.to);
+            const { from, to } = parseUsagePeriod(query, Date.now());
+            await withService(async (service) => {
+                const rows = await service.usageReport(from, to);
+                if (values.format === 'json') {
+                    const accounts = rows.map((r) => ({
+                        account_id: r.accountId,
+                        name: r.name,
+                        active_domains: r.activeDomains,
+                        active_domain_days: r.activeDomainDays,
+                        domains_created: r.domainsCreated,
+                        verifications: r.verifications,
+                        domain_limit: r.domainLimit,
+                    }));
+                    process.stdout.write(JSON.stringify({ from, to, accounts }, null, 2) + '\n');
+                    return;
+                }
+                const csv = (v) => (/[",\n]/.test(String(v)) ? `"${String(v).replace(/"/g, '""')}"` : String(v));
+                const header = ['from', 'to', 'account_id', 'name', 'active_domains', 'active_domain_days', 'domains_created', 'verifications', 'domain_limit'];
+                const lines = rows.map((r) => [from, to, r.accountId, r.name, r.activeDomains, r.activeDomainDays, r.domainsCreated, r.verifications, r.domainLimit ?? ''].map(csv).join(','));
+                process.stdout.write([header.join(','), ...lines].join('\n') + '\n');
+            });
+            return;
+        }
+        default:
+            throw new Error(`Unknown command "${command}". See --help.`);
+    }
+}
+/** Runs `fn` with a service on the configured database, closing it afterwards. */
+async function withService(fn) {
+    const { openStore } = await import('./store.js');
+    const { DomainService } = await import('./service.js');
+    const { Vault } = await import('./crypto.js');
+    const vault = new Vault(requireEnv('ENCRYPTION_KEY'));
+    const store = await openStore(database());
+    try {
+        await fn(new DomainService({ store, vault }));
+    }
+    finally {
+        await store.close();
+    }
+}
+main().catch((err) => {
+    process.stderr.write(`✘ ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/src/hosted/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/hosted/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,uFAAuF;AACvF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,OAAuB,EAAE,GAAG,IAAW,EAAE,EAAE;IACjE,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QAAE,OAAO;IAC1E,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAChC,CAAC,CAA+B,CAAC;AAEjC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4DA0C+C,CAAC;AAE7D,MAAM,GAAG,GAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAChG,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF,yGAAyG;AACzG,KAAK,UAAU,cAAc;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,IAAI,GAAG;QACX,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QACtC,UAAU,EAAE,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC;QACjD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;KAC/B,CAAC;IACF,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC3F,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAClE,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,IAAI,mBAAmB,CAAC;gBAChC,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC;gBAClC,aAAa,EAAE,UAAU,CAAC,qBAAqB,CAAC;gBAChD,SAAS,EAAE,UAAU,CAAC,iBAAiB,CAAC;gBACxC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;gBAC5C,IAAI;aACL,CAAC;SACH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtE,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,IAAI,qBAAqB,CAAC;gBAClC,SAAS,EAAE,UAAU,CAAC,mBAAmB,CAAC;gBAC1C,aAAa,EAAE,UAAU,CAAC,uBAAuB,CAAC;gBAClD,OAAO,EAAE,UAAU,CAAC,iBAAiB,CAAC;gBACtC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;aAC/C,CAAC;SACH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,SAAS,QAAQ;IACf,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAC;IACvE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YACxD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAC9C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACtB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;YAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;SACtD;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,yBAAyB;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YAChE,OAAO;QAET,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YACjD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,gBAAgB,MAAM,MAAM;oBAClE,iDAAiD;oBACjD,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,8DAA8D,CAAC,CACtF,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;YACD,OAAO;QACT,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YACpD,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YACzC,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,OAAO,CAAC;YACnF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YACpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAClD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,MAAM,MAAM,GAAG,CAAC,IAAI;gBAClB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,SAAS;oBACT,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;oBACzD,CAAC,CAAC,WAAW;wBACX,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;wBAC7D,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,aAAa,IAAI,CAAC,MAAM;gBAAE,GAAG,CAAC,MAAM,EAAE,gHAAgH,CAAC,CAAC;YAE5J,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;gBAC/B,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC7E,OAAO;gBACP,uEAAuE;gBACvE,QAAQ,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;gBACvG,IAAI,EAAE,SAAS;oBACb,CAAC,CAAC;wBACE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;wBAC7B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;wBACjC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;wBACvC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;wBACvC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;wBAC/C,YAAY,EAAE,MAAM,YAAY,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;qBACjG;oBACH,CAAC,CAAC,SAAS;gBACb,QAAQ,EAAE,QAAQ,EAAE;gBACpB,aAAa,EAAE,UAAU,CAAC,gBAAgB,CAAC;gBAC3C,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;gBACtC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS;gBACnC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,OAAO;gBAC5C,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,EAAE;gBACpE,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM;gBACnE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;gBACjC,GAAG;aACJ,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,MAAM;gBAAE,GAAG,CAAC,MAAM,EAAE,mDAAmD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzG,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE;gBACvB,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,OAAO;gBAC5C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;gBAC1D,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,KAAK;aACnJ,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;gBACxC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,EAAE;gBAClF,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;gBACtC,UAAU,EAAE,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC;gBACjD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK;gBACvC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,gBAAgB;gBAClE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,kBAAkB,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iBAAiB,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,SAAS,cAAc,MAAM,CAAC,OAAO,OAAO;gBAC7F,+CAA+C,MAAM,CAAC,OAAO,IAAI;gBACjE,CAAC,MAAM,CAAC,OAAO;oBACb,CAAC,CAAC,2BAA2B,MAAM,CAAC,OAAO,CAAC,MAAM,wBAAwB,MAAM,CAAC,OAAO,CAAC,EAAE,oBAAoB,SAAS,qBAAqB;oBAC7I,CAAC,CAAC,8EAA8E,cAAc,4CAA4C;wBACxI,+FAA+F,CAAC;gBACpG,sFAAsF,CACzF,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC3G,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAClH,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAClC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAQ,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,mBAAmB,OAAO,CAAC,WAAW,IAAI,WAAW,IAAI,CAAC,CAAC;YAChH,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC1G,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACzD,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAClC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACjD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAChC,UAAU,EAAE,CAAC,CAAC,SAAS;wBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,cAAc,EAAE,CAAC,CAAC,aAAa;wBAC/B,kBAAkB,EAAE,CAAC,CAAC,gBAAgB;wBACtC,eAAe,EAAE,CAAC,CAAC,cAAc;wBACjC,aAAa,EAAE,CAAC,CAAC,aAAa;wBAC9B,YAAY,EAAE,CAAC,CAAC,WAAW;qBAC5B,CAAC,CAAC,CAAC;oBACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC7E,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1G,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;gBAChJ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3B,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAChJ,CAAC;gBACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED;YACE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,gBAAgB,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,WAAW,CAAC,EAAoE;IAC7F,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/src/hosted/crypto.d.ts

@@ -0,0 +1,22 @@
+/** AES-256-GCM for secrets at rest. Ciphertexts are versioned so keys can be rotated later. */
+export declare class Vault {
+    private readonly key;
+    constructor(key: string);
+    encrypt(plaintext: string): string;
+    decrypt(token: string): string;
+    encryptJson(value: unknown): string;
+    decryptJson<T>(token: string): T;
+}
+export declare const newId: (prefix: string) => string;
+export declare const newApiKey: () => string;
+export declare const newWebhookSecret: () => string;
+/** API keys are high-entropy, so a plain SHA-256 is enough to store them safely. */
+export declare const hashApiKey: (key: string) => string;
+export declare const WEBHOOK_SIGNATURE_HEADER = "x-dkimkit-signature";
+/** `t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">` */
+export declare function signWebhook(secret: string, body: string, timestampSec: number): string;
+/** For webhook receivers: checks the signature and rejects stale timestamps (replays). */
+export declare function verifyWebhookSignature(secret: string, body: string, header: string | null | undefined, { toleranceSec, nowSec }?: {
+    toleranceSec?: number | undefined;
+    nowSec?: number | undefined;
+}): boolean;

package/dist/src/hosted/crypto.js

@@ -0,0 +1,55 @@
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { ConfigError } from '../errors.js';
+/** AES-256-GCM for secrets at rest. Ciphertexts are versioned so keys can be rotated later. */
+export class Vault {
+    key;
+    constructor(key) {
+        const decoded = /^[0-9a-f]{64}$/i.test(key) ? Buffer.from(key, 'hex') : Buffer.from(key, 'base64');
+        if (decoded.length !== 32) {
+            throw new ConfigError('ENCRYPTION_KEY must be 32 bytes, base64 or hex encoded (try: openssl rand -base64 32).');
+        }
+        this.key = decoded;
+    }
+    encrypt(plaintext) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.key, iv);
+        const data = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+        return ['v1', iv, cipher.getAuthTag(), data].map((p) => (typeof p === 'string' ? p : p.toString('base64url'))).join('.');
+    }
+    decrypt(token) {
+        const [version, iv, tag, data] = token.split('.');
+        if (version !== 'v1' || !iv || !tag || data === undefined)
+            throw new Error('Unrecognized ciphertext format');
+        const decipher = createDecipheriv('aes-256-gcm', this.key, Buffer.from(iv, 'base64url'));
+        decipher.setAuthTag(Buffer.from(tag, 'base64url'));
+        return Buffer.concat([decipher.update(Buffer.from(data, 'base64url')), decipher.final()]).toString('utf8');
+    }
+    encryptJson(value) {
+        return this.encrypt(JSON.stringify(value));
+    }
+    decryptJson(token) {
+        return JSON.parse(this.decrypt(token));
+    }
+}
+export const newId = (prefix) => `${prefix}_${randomBytes(12).toString('base64url')}`;
+export const newApiKey = () => `dk_live_${randomBytes(24).toString('base64url')}`;
+export const newWebhookSecret = () => `whsec_${randomBytes(24).toString('base64url')}`;
+/** API keys are high-entropy, so a plain SHA-256 is enough to store them safely. */
+export const hashApiKey = (key) => createHash('sha256').update(key, 'utf8').digest('hex');
+export const WEBHOOK_SIGNATURE_HEADER = 'x-dkimkit-signature';
+/** `t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">` */
+export function signWebhook(secret, body, timestampSec) {
+    const mac = createHmac('sha256', secret).update(`${timestampSec}.${body}`, 'utf8').digest('hex');
+    return `t=${timestampSec},v1=${mac}`;
+}
+/** For webhook receivers: checks the signature and rejects stale timestamps (replays). */
+export function verifyWebhookSignature(secret, body, header, { toleranceSec = 300, nowSec = Math.floor(Date.now() / 1000) } = {}) {
+    const parts = Object.fromEntries((header ?? '').split(',').map((p) => p.trim().split('=')));
+    const timestamp = Number(parts.t);
+    if (!Number.isInteger(timestamp) || !parts.v1 || Math.abs(nowSec - timestamp) > toleranceSec)
+        return false;
+    const expected = Buffer.from(signWebhook(secret, body, timestamp).split('v1=')[1], 'hex');
+    const given = Buffer.from(parts.v1, 'hex');
+    return expected.length === given.length && timingSafeEqual(expected, given);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/src/hosted/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/hosted/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACrH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,+FAA+F;AAC/F,MAAM,OAAO,KAAK;IACC,GAAG,CAAS;IAE7B,YAAY,GAAW;QACrB,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACnG,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CAAC,wFAAwF,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3H,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC7G,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7G,CAAC;IAED,WAAW,CAAC,KAAc;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,WAAW,CAAI,KAAa;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAM,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9F,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAAC,SAAS,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAEvF,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAElG,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,YAAoB;IAC5E,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,YAAY,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjG,OAAO,KAAK,YAAY,OAAO,GAAG,EAAE,CAAC;AACvC,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,IAAY,EACZ,MAAiC,EACjC,EAAE,YAAY,GAAG,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE;IAEnE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,YAAY;QAAE,OAAO,KAAK,CAAC;IAC3G,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/src/hosted/index.d.ts

@@ -0,0 +1,7 @@
+export { startHostedApi, createApiHandler, parseDomainInput, type HostedApi, type HostedApiOptions, type ApiOptions } from './api.js';
+export { DomainService, realProviders, type ProviderFactory, type ServiceOptions, type DnsCredentials, type Logger } from './service.js';
+export { BackgroundRunner, type RunnerOptions } from './worker.js';
+export { WidgetService, type WidgetContext } from './widget.js';
+export { openStore, type Store, type Account, type DomainRow, type DomainStatus, type DomainEvent, type WebhookDelivery, type WidgetSession } from './store.js';
+export { Vault, signWebhook, verifyWebhookSignature, WEBHOOK_SIGNATURE_HEADER } from './crypto.js';
+export { toPublicDomain, toPublicEvent, toPublicAccount } from './serialize.js';

package/dist/src/hosted/index.js

@@ -0,0 +1,11 @@
+// Hosted multi-tenant API. Store classes live at their own subpaths
+// (dkimkit/hosted/sqlite, /hosted/postgres) so that importing this
+// never loads node:sqlite or pg unless that backend is used; openStore() picks one by URL.
+export { startHostedApi, createApiHandler, parseDomainInput } from './api.js';
+export { DomainService, realProviders } from './service.js';
+export { BackgroundRunner } from './worker.js';
+export { WidgetService } from './widget.js';
+export { openStore } from './store.js';
+export { Vault, signWebhook, verifyWebhookSignature, WEBHOOK_SIGNATURE_HEADER } from './crypto.js';
+export { toPublicDomain, toPublicEvent, toPublicAccount } from './serialize.js';
+//# sourceMappingURL=index.js.map

package/dist/src/hosted/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hosted/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,mEAAmE;AACnE,2FAA2F;AAC3F,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAA0D,MAAM,UAAU,CAAC;AACtI,OAAO,EAAE,aAAa,EAAE,aAAa,EAA+E,MAAM,cAAc,CAAC;AACzI,OAAO,EAAE,gBAAgB,EAAsB,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,aAAa,EAAsB,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,SAAS,EAA2H,MAAM,YAAY,CAAC;AAChK,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/src/hosted/markdown.d.ts

@@ -0,0 +1,16 @@
+export interface RenderedMarkdown {
+    html: string;
+    title: string;
+    /** h2/h3 headings for an on-page table of contents. */
+    headings: {
+        level: number;
+        text: string;
+        id: string;
+    }[];
+}
+export interface RenderOptions {
+    /** Maps a relative link (e.g. "billing.md#plans") to a URL, or null to render the text without a link. */
+    resolveLink?: (href: string) => string | null;
+}
+export declare function slugify(text: string): string;
+export declare function renderMarkdown(source: string, opts?: RenderOptions): RenderedMarkdown;

package/dist/src/hosted/markdown.js

@@ -0,0 +1,168 @@
+// A small Markdown renderer for our own docs: headings, paragraphs, nested lists
+// (with code blocks inside items), fenced code, tables, links, **bold**, *italic*
+// and `code`. Everything is escaped first, so docs can't inject markup.
+const escapeHtml = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+export function slugify(text) {
+    return text
+        .toLowerCase()
+        .replace(/<[^>]+>/g, '')
+        .replace(/[`*_]/g, '')
+        .replace(/[^\p{L}\p{N}\s-]/gu, '')
+        .trim()
+        .replace(/\s+/g, '-');
+}
+const SAFE_URL = /^(https?:\/\/|mailto:|\/|#)/i;
+function inline(text, opts) {
+    // Code spans first, so nothing inside them is formatted.
+    const codes = [];
+    let s = text.replace(/`([^`]+)`/g, (_, code) => `\u0000${codes.push(code) - 1}\u0000`);
+    s = escapeHtml(s);
+    // URLs may contain one level of balanced parentheses.
+    s = s.replace(/\[([^\]]+)\]\(((?:[^()\s]|\([^()\s]*\))+)\)/g, (_, label, rawHref) => {
+        const href = rawHref.replace(/&amp;/g, '&');
+        // Relative links, and links into /docs/, go through the resolver (which may drop unpublished pages).
+        const resolvable = !SAFE_URL.test(href) || href.startsWith('/docs/');
+        const resolved = resolvable ? (opts.resolveLink ? opts.resolveLink(href) : SAFE_URL.test(href) ? href : null) : href;
+        if (!resolved || !SAFE_URL.test(resolved))
+            return label;
+        const external = /^https?:\/\//i.test(resolved);
+        return `<a href="${escapeHtml(resolved)}"${external ? ' rel="noopener noreferrer"' : ''}>${label}</a>`;
+    });
+    s = s.replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>');
+    s = s.replace(/(^|[\s(])\*([^*\s][^*]*?)\*(?=[\s).,;:!?]|$)/g, '$1<em>$2</em>');
+    return s.replace(/\u0000(\d+)\u0000/g, (_, i) => `<code>${escapeHtml(codes[Number(i)])}</code>`);
+}
+const indentOf = (line) => line.length - line.trimStart().length;
+const LIST_ITEM = /^(\s*)([-*]|\d+\.)\s+(.*)$/;
+/** Splits a table row on unescaped pipes. */
+function cells(row) {
+    return row
+        .trim()
+        .replace(/^\|/, '')
+        .replace(/\|$/, '')
+        .split(/(?<!\\)\|/)
+        .map((c) => c.trim().replace(/\\\|/g, '|'));
+}
+function blocks(lines, opts, out, tight = false) {
+    const html = [];
+    let i = 0;
+    const paragraph = [];
+    const flush = () => {
+        if (paragraph.length === 0)
+            return;
+        const content = inline(paragraph.join(' '), opts);
+        html.push(tight ? content : `<p>${content}</p>`);
+        paragraph.length = 0;
+    };
+    while (i < lines.length) {
+        const line = lines[i];
+        const trimmed = line.trim();
+        if (trimmed === '') {
+            flush();
+            i++;
+            continue;
+        }
+        // Fenced code.
+        const fence = /^(\s*)```\s*([\w-]*)\s*$/.exec(line);
+        if (fence) {
+            flush();
+            const indent = fence[1].length;
+            const code = [];
+            i++;
+            while (i < lines.length && !/^\s*```\s*$/.test(lines[i])) {
+                code.push(lines[i].slice(Math.min(indent, indentOf(lines[i]))));
+                i++;
+            }
+            i++; // closing fence
+            const lang = fence[2] ? ` class="language-${escapeHtml(fence[2])}"` : '';
+            html.push(`<pre><code${lang}>${escapeHtml(code.join('\n'))}</code></pre>`);
+            continue;
+        }
+        // Headings.
+        const heading = /^(#{1,6})\s+(.*)$/.exec(trimmed);
+        if (heading) {
+            flush();
+            const level = heading[1].length;
+            const text = heading[2];
+            const id = slugify(text);
+            const rendered = inline(text, opts);
+            if (level === 1 && !out.title)
+                out.title = text.replace(/[`*]/g, '');
+            if (level === 2 || level === 3)
+                out.headings.push({ level, text: rendered, id });
+            html.push(`<h${level} id="${escapeHtml(id)}">${rendered}</h${level}>`);
+            i++;
+            continue;
+        }
+        // Tables: a pipe row followed by a separator row.
+        if (trimmed.startsWith('|') && i + 1 < lines.length && /^\s*\|?\s*:?-{2,}/.test(lines[i + 1])) {
+            flush();
+            const head = cells(line);
+            i += 2;
+            const rows = [];
+            while (i < lines.length && lines[i].trim().startsWith('|'))
+                rows.push(cells(lines[i++]));
+            html.push(`<div class="table"><table><thead><tr>${head.map((c) => `<th>${inline(c, opts)}</th>`).join('')}</tr></thead><tbody>` +
+                rows.map((r) => `<tr>${head.map((_, k) => `<td>${inline(r[k] ?? '', opts)}</td>`).join('')}</tr>`).join('') +
+                '</tbody></table></div>');
+            continue;
+        }
+        // Lists: items at this indent, each owning the more-indented lines after it.
+        const item = LIST_ITEM.exec(line);
+        if (item) {
+            flush();
+            const baseIndent = item[1].length;
+            const ordered = /\d/.test(item[2][0]);
+            const start = ordered ? Number.parseInt(item[2], 10) : 1;
+            const items = [];
+            while (i < lines.length) {
+                const m = LIST_ITEM.exec(lines[i]);
+                if (!m || m[1].length !== baseIndent || /\d/.test(m[2][0]) !== ordered)
+                    break;
+                const contentIndent = baseIndent + m[2].length + 1;
+                const body = [m[3]];
+                i++;
+                // Continuation: more-indented lines, and blank lines followed by more-indented lines.
+                while (i < lines.length) {
+                    const next = lines[i];
+                    if (next.trim() === '') {
+                        const following = lines.slice(i + 1).find((l) => l.trim() !== '');
+                        if (following === undefined || indentOf(following) <= baseIndent)
+                            break;
+                        body.push('');
+                        i++;
+                        continue;
+                    }
+                    if (indentOf(next) <= baseIndent)
+                        break;
+                    body.push(next.slice(Math.min(contentIndent, indentOf(next))));
+                    i++;
+                }
+                const loose = body.some((l) => l.trim() === '');
+                items.push(`<li>${blocks(body, opts, out, !loose)}</li>`);
+                // Blank line between items of the same list.
+                while (i < lines.length && lines[i].trim() === '') {
+                    const following = lines.slice(i + 1).find((l) => l.trim() !== '');
+                    const m2 = following && LIST_ITEM.exec(following);
+                    if (!m2 || m2[1].length !== baseIndent)
+                        break;
+                    i++;
+                }
+            }
+            const tag = ordered ? 'ol' : 'ul';
+            html.push(`<${tag}${ordered && start !== 1 ? ` start="${start}"` : ''}>${items.join('')}</${tag}>`);
+            continue;
+        }
+        // Paragraph text (a list or other block ends it).
+        paragraph.push(trimmed);
+        i++;
+    }
+    flush();
+    return html.join(tight ? ' ' : '\n');
+}
+export function renderMarkdown(source, opts = {}) {
+    const out = { html: '', title: '', headings: [] };
+    out.html = blocks(source.replace(/\r\n/g, '\n').split('\n'), opts, out);
+    return out;
+}
+//# sourceMappingURL=markdown.js.map