qarpeo 0.0.0-alpha.10

package/dist/runtime/server/utils/config.d.ts

@@ -0,0 +1,27 @@
+import type { AuthOptions, BlobOptions, CMSOptions, PaymentsOptions, AppRateLimitOptions, RealtimeOptions, MailOptions, AnalyticsOptions, MultitenantOptions } from "../../../types";
+export interface QarpeoRuntimeConfig {
+    auth: AuthOptions;
+    blob: BlobOptions;
+    storage: BlobOptions;
+    cms: CMSOptions;
+    payments: PaymentsOptions;
+    ratelimit: AppRateLimitOptions;
+    realtime: RealtimeOptions;
+    mail: MailOptions;
+    analytics: AnalyticsOptions;
+    multitenant: MultitenantOptions;
+    agents: Record<string, any>;
+    jobs: Record<string, any>;
+    [key: string]: any;
+}
+/**
+ * Returns strongly-typed Qarpeo server runtime configuration without requiring manual `as any` casting.
+ */
+export declare function getQarpeoConfig(event?: any): QarpeoRuntimeConfig;
+/** Alias for getQarpeoConfig */
+export declare const useQarpeoConfig: typeof getQarpeoConfig;
+/**
+ * Returns the application secret (NUXT_APP_SECRET or legacy NUXT_SESSION_PASSWORD) from runtime config.
+ * Used for HMAC signing where we need a root secret key but not qarpeo-specific config.
+ */
+export declare function getSessionSecret(event?: any, fallback?: string): string;

package/dist/runtime/server/utils/config.mjs

@@ -0,0 +1,38 @@
+import { useRuntimeConfig } from "nuxt/server";
+export function getQarpeoConfig(event) {
+  let rc;
+  try {
+    rc = useRuntimeConfig(event);
+  } catch {
+    rc = void 0;
+  }
+  if (!rc) {
+    rc = globalThis.__NUXT_RUNTIME_CONFIG__ || {};
+  }
+  const q = rc?.qarpeo || {};
+  return {
+    auth: q.auth || {},
+    blob: q.blob || q.storage || {},
+    storage: q.storage || q.blob || {},
+    cms: q.cms || {},
+    payments: q.payments || {},
+    ratelimit: q.ratelimit || {},
+    realtime: q.realtime || {},
+    mail: q.mail || {},
+    analytics: q.analytics || {},
+    multitenant: q.multitenant || {},
+    agents: q.agents || {},
+    jobs: q.jobs || {},
+    ...q
+  };
+}
+export const useQarpeoConfig = getQarpeoConfig;
+export function getSessionSecret(event, fallback = "qarpeo-storage-secret-key-salt") {
+  let rc;
+  try {
+    rc = useRuntimeConfig(event);
+  } catch {
+    rc = void 0;
+  }
+  return rc?.appSecret || rc?.session?.password || globalThis.__NUXT_RUNTIME_CONFIG__?.appSecret || globalThis.__NUXT_RUNTIME_CONFIG__?.session?.password || globalThis.process?.env?.NUXT_APP_SECRET || globalThis.process?.env?.NUXT_SESSION_PASSWORD || fallback;
+}

package/dist/runtime/server/utils/context.d.ts

@@ -0,0 +1,13 @@
+import type { QarpeoSession, QarpeoAuthContext, RequireAuthOptions } from "../../types/auth";
+/** Returns the typed QarpeoSession for the current request, or null if unauthenticated. */
+export declare function getQarpeoSession(event: any): Promise<QarpeoSession | null>;
+/**
+ * Resolves the unified authentication context for the current request. Unifies Bearer PAT tokens
+ * (qp_live_...) and cookie sessions. Returns null if unauthenticated (never throws).
+ */
+export declare function getAuthContext(event: any): Promise<QarpeoAuthContext | null>;
+/**
+ * Enforces authentication on the current request. Supports cookie sessions, Bearer PAT tokens, role
+ * gates, and organization gates. Throws 401 or 403 on failure.
+ */
+export declare function requireAuth(event: any, options?: RequireAuthOptions): Promise<QarpeoAuthContext>;

package/dist/runtime/server/utils/context.mjs

@@ -0,0 +1,98 @@
+import { createError, getRequestHeader } from "nuxt/server";
+import { verifyApiToken, hasApiTokenScope } from "./impersonation.mjs";
+import { getAuthSession } from "./session.mjs";
+export async function getQarpeoSession(event) {
+  const session = await getAuthSession(event);
+  if (!session?.user?.id) {
+    return null;
+  }
+  return session;
+}
+export async function getAuthContext(event) {
+  const authHeader = getRequestHeader(event, "authorization") || "";
+  const bearerMatch = authHeader.match(/^Bearer\s+(qp_live_[a-zA-Z0-9_-]+)$/);
+  if (bearerMatch && bearerMatch[1]) {
+    try {
+      const tokenResult = await verifyApiToken(event, bearerMatch[1]);
+      if (tokenResult?.user?.id) {
+        const isAdmin = tokenResult.user.role === "admin" || tokenResult.user.role === "super_admin";
+        return {
+          user: tokenResult.user,
+          session: null,
+          organization: null,
+          role: null,
+          isImpersonating: false,
+          impersonator: null,
+          token: {
+            id: tokenResult.tokenId,
+            scopes: tokenResult.scopes
+          },
+          isAdmin,
+          hasScope: (scope) => hasApiTokenScope(tokenResult.scopes, scope)
+        };
+      }
+    } catch {
+      return null;
+    }
+  }
+  const session = await getQarpeoSession(event);
+  if (session?.user?.id) {
+    const isAdmin = session.user.role === "admin" || session.user.role === "super_admin";
+    return {
+      user: session.user,
+      session,
+      organization: session.currentOrganization || null,
+      role: session.currentRole || null,
+      isImpersonating: Boolean(session.impersonator),
+      impersonator: session.impersonator || null,
+      token: null,
+      isAdmin,
+      hasScope: () => true
+      // Browser/cookie user has full interactive scope
+    };
+  }
+  return null;
+}
+export async function requireAuth(event, options = {}) {
+  const context = await getAuthContext(event);
+  if (!context) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: "Unauthorized",
+      message: "Authentication required"
+    });
+  }
+  if (options.role) {
+    const allowed = Array.isArray(options.role) ? options.role : [options.role];
+    const userRole = context.user.role || "user";
+    if (!allowed.includes(userRole)) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Forbidden",
+        message: "Insufficient permissions"
+      });
+    }
+  }
+  if (options.organization) {
+    const hasOrg = Boolean(context.organization?.id || context.session?.currentOrganizationId);
+    if (!hasOrg) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Forbidden",
+        message: "Active organization required"
+      });
+    }
+  }
+  if (options.scope && context.token) {
+    const requiredScopes = Array.isArray(options.scope) ? options.scope : [options.scope];
+    const missing = requiredScopes.some((s) => !context.hasScope(s));
+    if (missing) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Forbidden",
+        message: `Token does not have required scope(s): ${requiredScopes.join(", ")}`
+      });
+    }
+  }
+  return context;
+}

package/dist/runtime/server/utils/crypto.d.ts

@@ -0,0 +1,16 @@
+/** Constant-time string equality check using byte-level XOR comparison to prevent timing attacks. */
+export declare function timingSafeEqualString(a: string, b: string): boolean;
+/** Alias for timingSafeEqualString */
+export declare const constantTimeEqual: typeof timingSafeEqualString;
+/**
+ * Encrypts a sensitive string (e.g. an OAuth access/refresh token) with AES-256-GCM. The returned
+ * value is prefixed with `enc:` followed by the hex-encoded `iv ‖ ciphertext` so legacy plaintext
+ * values can be distinguished on read.
+ */
+export declare function encryptToken(plaintext: string, event?: any): Promise<string>;
+/**
+ * Decrypts a value produced by {@link encryptToken}. Values that do not start with `enc:` are
+ * returned as-is — this preserves backward-compatibility with rows written as plaintext before
+ * token encryption was introduced. Decryption failures resolve to an empty string.
+ */
+export declare function decryptToken(ciphertext: string, event?: any): Promise<string>;

package/dist/runtime/server/utils/crypto.mjs

@@ -0,0 +1,56 @@
+export function timingSafeEqualString(a, b) {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  const encoder = new TextEncoder();
+  const bufA = encoder.encode(a);
+  const bufB = encoder.encode(b);
+  if (bufA.byteLength !== bufB.byteLength) return false;
+  let diff = 0;
+  for (let i = 0; i < bufA.byteLength; i++) {
+    diff |= bufA[i] ^ bufB[i];
+  }
+  return diff === 0;
+}
+export const constantTimeEqual = timingSafeEqualString;
+const ENC_PREFIX = "enc:";
+function resolveTokenSecret(event) {
+  return event?.context?.cloudflare?.env?.NUXT_APP_SECRET || globalThis.process?.env?.NUXT_APP_SECRET || event?.context?.cloudflare?.env?.NUXT_SESSION_PASSWORD || globalThis.process?.env?.NUXT_SESSION_PASSWORD || "qarpeo-auth-internal-salt-key-32b";
+}
+async function deriveAesGcmKey(password, usage) {
+  const encoder = new TextEncoder();
+  const keyMaterial = await crypto.subtle.digest("SHA-256", encoder.encode(password));
+  return crypto.subtle.importKey("raw", keyMaterial, { name: "AES-GCM" }, false, usage);
+}
+export async function encryptToken(plaintext, event) {
+  if (!plaintext) return "";
+  const password = resolveTokenSecret(event);
+  const encoder = new TextEncoder();
+  const key = await deriveAesGcmKey(password, ["encrypt"]);
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    key,
+    encoder.encode(plaintext)
+  );
+  const combined = new Uint8Array(iv.byteLength + ciphertext.byteLength);
+  combined.set(iv, 0);
+  combined.set(new Uint8Array(ciphertext), iv.byteLength);
+  const hex = Array.from(combined).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `${ENC_PREFIX}${hex}`;
+}
+export async function decryptToken(ciphertext, event) {
+  if (!ciphertext) return "";
+  if (!ciphertext.startsWith(ENC_PREFIX)) return ciphertext;
+  try {
+    const password = resolveTokenSecret(event);
+    const key = await deriveAesGcmKey(password, ["decrypt"]);
+    const hex = ciphertext.slice(ENC_PREFIX.length);
+    const bytes = new Uint8Array(hex.match(/.{1,2}/g)?.map((b) => parseInt(b, 16)) || []);
+    if (bytes.byteLength < 13) return "";
+    const iv = bytes.slice(0, 12);
+    const data = bytes.slice(12);
+    const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, data);
+    return new TextDecoder().decode(decrypted);
+  } catch {
+    return "";
+  }
+}

package/dist/runtime/server/utils/dev-logs.d.ts

@@ -0,0 +1,21 @@
+export interface DevLogEntry {
+    id: string;
+    timestamp: string;
+    level: "info" | "warn" | "error";
+    source: string;
+    message: string;
+    durationMs?: number;
+    status?: number;
+    details?: Record<string, any>;
+}
+export declare function addDevLog(entry: Omit<DevLogEntry, "id" | "timestamp"> & {
+    id?: string;
+    timestamp?: string;
+}): DevLogEntry;
+export declare function getDevLogs(filter?: {
+    level?: string;
+    search?: string;
+    source?: string;
+    limit?: number;
+}): DevLogEntry[];
+export declare function clearDevLogs(): void;

package/dist/runtime/server/utils/dev-logs.mjs

@@ -0,0 +1,41 @@
+const MAX_DEV_LOGS = 500;
+const devLogsRingBuffer = [];
+export function addDevLog(entry) {
+  const fullEntry = {
+    id: entry.id || `log_${Date.now()}_${Math.random().toString(36).substring(2, 7)}`,
+    timestamp: entry.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+    level: entry.level || "info",
+    source: entry.source || "nitro",
+    message: entry.message,
+    durationMs: entry.durationMs,
+    status: entry.status,
+    details: entry.details
+  };
+  devLogsRingBuffer.push(fullEntry);
+  if (devLogsRingBuffer.length > MAX_DEV_LOGS) {
+    devLogsRingBuffer.shift();
+  }
+  return fullEntry;
+}
+export function getDevLogs(filter) {
+  let list = devLogsRingBuffer.slice();
+  if (filter?.level && filter.level !== "all") {
+    list = list.filter((l) => l.level === filter.level);
+  }
+  if (filter?.source && filter.source !== "all") {
+    list = list.filter((l) => l.source === filter.source);
+  }
+  if (filter?.search?.trim()) {
+    const q = filter.search.toLowerCase();
+    list = list.filter(
+      (l) => l.message.toLowerCase().includes(q) || l.source.toLowerCase().includes(q) || String(l.status || "").includes(q)
+    );
+  }
+  if (filter?.limit && filter.limit > 0) {
+    list = list.slice(-filter.limit);
+  }
+  return list;
+}
+export function clearDevLogs() {
+  devLogsRingBuffer.length = 0;
+}

package/dist/runtime/server/utils/dev-proxy.d.ts

@@ -0,0 +1 @@
+export declare function getOrInitDevProxy(): Promise<any>;

package/dist/runtime/server/utils/dev-proxy.mjs

@@ -0,0 +1,69 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+let proxyPromise = null;
+export async function getOrInitDevProxy() {
+  if (!proxyPromise) {
+    let configPath = process.env.QARPEO_WRANGLER_CONFIG;
+    if (!configPath || !existsSync(configPath)) {
+      const candidate = resolve(process.cwd(), ".nuxt/wrangler.json");
+      if (existsSync(candidate)) {
+        configPath = candidate;
+      }
+    }
+    const isRemote = Boolean(process.env.QARPEO_CF_REMOTE);
+    const persistPath = process.env.QARPEO_PERSIST_PATH || resolve(process.cwd(), ".wrangler/state/v3");
+    if (!configPath || !existsSync(configPath)) {
+      return null;
+    }
+    try {
+      let wranglerUrl = process.env.QARPEO_WRANGLER_ENTRY;
+      if (!wranglerUrl) {
+        try {
+          wranglerUrl = import.meta.resolve("wrangler", import.meta.url);
+        } catch {
+        }
+      }
+      const dynamicImport = new Function("specifier", "return import(specifier)");
+      const wrangler = await dynamicImport(wranglerUrl || "wrangler");
+      const getPlatformProxy = wrangler.getPlatformProxy || wrangler.default?.getPlatformProxy;
+      if (!getPlatformProxy) {
+        console.warn("[qarpeo] getPlatformProxy function not found in wrangler export");
+        return null;
+      }
+      const launch = (cfg) => getPlatformProxy({
+        configPath: cfg,
+        persist: isRemote ? false : persistPath ? { path: persistPath } : true,
+        remoteBindings: isRemote ? true : void 0
+      });
+      proxyPromise = launch(configPath).catch(async (err) => {
+        if (!isRemote) {
+          try {
+            const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+            let modified = false;
+            if (raw.ai && !process.env.CLOUDFLARE_API_TOKEN) {
+              delete raw.ai;
+              modified = true;
+            }
+            if (raw.hyperdrive && !raw.hyperdrive[0]?.localConnectionString) {
+              delete raw.hyperdrive;
+              modified = true;
+            }
+            if (modified) {
+              const localCfgPath = resolve(configPath, "../wrangler.local.json");
+              writeFileSync(localCfgPath, JSON.stringify(raw, null, 2), "utf-8");
+              return await launch(localCfgPath);
+            }
+          } catch (retryErr) {
+            console.warn("[qarpeo] Fallback proxy launch failed:", retryErr);
+          }
+        }
+        console.warn("[qarpeo] Failed to initialize platform proxy:", err);
+        return null;
+      });
+    } catch (err) {
+      console.warn("[qarpeo] Failed to import wrangler:", err);
+      return null;
+    }
+  }
+  return proxyPromise;
+}

package/dist/runtime/server/utils/domains.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @file Domains.ts Tier 2 Multi-Tenancy & Custom Domains — Custom Hostname lifecycle and
+ *   verification. Backed by Cloudflare for SaaS (Custom Hostnames API) with zero-config local dev
+ *   mock. Provides:
+ *
+ *   - registerCustomDomain(tenantId, domain, options?, event?)
+ *   - verifyCustomDomain(domain, event?)
+ *   - getCustomDomain(domain, event?)
+ *   - listTenantDomains(tenantId, event?)
+ *   - deleteCustomDomain(domain, event?)
+ *   - getDomainCache(domain, event?) / setDomainCache(domain, tenantId, event?)
+ */
+import type { RequestEvent } from "nuxt/server";
+import type { CustomDomainRecord } from "../../../types";
+/** Normalizes a domain (lowercase, strip trailing dot, strip protocol/path). */
+export declare function normalizeDomain(input: string): string;
+/** Basic hostname validation (FQDN check). */
+export declare function isValidDomain(domain: string): boolean;
+/** Resolve multitenant runtime config. */
+export declare function getMultitenantConfig(event?: RequestEvent): Record<string, any>;
+/** High-speed domain-to-tenant lookup (memory fallback -> KV). */
+export declare function getDomainCache(domain: string, event?: RequestEvent): Promise<string | null>;
+/** Store domain-to-tenant mapping in KV and local cache. */
+export declare function setDomainCache(domain: string, tenantId: string, event?: RequestEvent, ttlSeconds?: number): Promise<void>;
+/** Remove domain-to-tenant mapping from KV and local cache. */
+export declare function removeDomainCache(domain: string, event?: RequestEvent): Promise<void>;
+export interface RegisterDomainOptions {
+    /** CNAME target override (e.g. "cname.qarpeo.com"). */
+    cnameTarget?: string;
+}
+/**
+ * Register a new custom domain for a tenant. Calls Cloudflare for SaaS Custom Hostnames API to
+ * provision hostname & SSL certificate. Falls back to simulation in dev without Cloudflare
+ * credentials.
+ */
+export declare function registerCustomDomain(tenantId: string, rawDomain: string, options?: RegisterDomainOptions, event?: RequestEvent): Promise<CustomDomainRecord>;
+/** Verify and refresh status of a custom domain with Cloudflare. */
+export declare function verifyCustomDomain(rawDomain: string, event?: RequestEvent): Promise<CustomDomainRecord>;
+/** Retrieve custom domain record by domain name. */
+export declare function getCustomDomain(rawDomain: string, event?: RequestEvent): Promise<CustomDomainRecord | null>;
+/** List all custom domains registered for a tenant. */
+export declare function listTenantDomains(tenantId: string, event?: RequestEvent): Promise<CustomDomainRecord[]>;
+/** Delete a custom domain from Cloudflare and edge cache. */
+export declare function deleteCustomDomain(rawDomain: string, event?: RequestEvent): Promise<{
+    success: boolean;
+}>;