vesper-memory 0.5.4 → 0.6.0

package/dist/config/rate-limits.d.ts

@@ -1,76 +0,0 @@
-/**
- * Rate Limiting Configuration
- *
- * Defines tier-based rate limits for MCP tools.
- * Configurable via environment variables.
- *
- * Security: Implements SEC-HIGH-001 from security audit
- */
-import { RateLimitConfig } from "../utils/rate-limiter.js";
-/**
- * Available rate limit tiers
- *
- * Note: "unlimited" is the highest tier (not "enterprise")
- * This matches the tier naming in auth.ts and postgres-auth-schema.sql
- */
-export type TierName = "standard" | "premium" | "unlimited";
-/**
- * Tier-based rate limits for all MCP operations
- *
- * Limits are per-minute unless otherwise specified.
- *
- * | Tier | store_memory | retrieve_memory | list_recent | get_stats |
- * |------|-------------|-----------------|-------------|-----------|
- * | standard | 100/min | 300/min | 60/min | 30/min |
- * | premium | 500/min | 1000/min | 200/min | 100/min |
- * | unlimited | no limit | no limit | no limit | no limit |
- */
-export declare const TIER_LIMITS: Record<TierName, Record<string, RateLimitConfig>>;
-/**
- * Legacy export for backwards compatibility
- */
-export declare const RATE_LIMIT_TIERS: Record<TierName, Record<string, RateLimitConfig>>;
-/**
- * Get rate limits for a specific tier
- *
- * @param tier - The tier name
- * @returns Rate limit configuration for all operations
- */
-export declare function getTierLimits(tier: TierName): Record<string, RateLimitConfig>;
-/**
- * Configuration from environment variables
- */
-export interface RateLimitEnvConfig {
-    /** Default tier for users without explicit tier assignment */
-    defaultTier: TierName;
-    /** Whether to allow requests when Redis is unavailable (default: false - fail closed) */
-    failOpen: boolean;
-    /** Custom limits that override tier defaults */
-    customLimits?: Record<string, number>;
-    /** Emergency fallback limit when Redis is down (only used with failOpen: false) */
-    emergencyLimit: number;
-}
-/**
- * Read rate limit configuration from environment variables
- *
- * Environment variables:
- * - RATE_LIMIT_DEFAULT_TIER: Default tier (standard|premium|unlimited)
- * - RATE_LIMIT_FAIL_OPEN: Whether to allow requests when Redis is down (true|false)
- * - RATE_LIMIT_STORE_MEMORY: Override store_memory limit
- * - RATE_LIMIT_RETRIEVE_MEMORY: Override retrieve_memory limit
- * - RATE_LIMIT_LIST_RECENT: Override list_recent limit
- * - RATE_LIMIT_GET_STATS: Override get_stats limit
- * - RATE_LIMIT_EMERGENCY: Emergency in-memory limit when Redis is down
- *
- * @returns Rate limit configuration
- */
-export declare function getRateLimitConfigFromEnv(): RateLimitEnvConfig;
-/**
- * Build rate limit configuration by merging tier defaults with custom limits
- *
- * @param tier - Base tier
- * @param customLimits - Custom limit overrides
- * @returns Merged rate limit configuration
- */
-export declare function buildRateLimitConfig(tier: TierName, customLimits?: Record<string, number>): Record<string, RateLimitConfig>;
-//# sourceMappingURL=rate-limits.d.ts.map

package/dist/config/rate-limits.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limits.d.ts","sourceRoot":"","sources":["../../src/config/rate-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAyDzE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,mDAAc,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAE7E;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,WAAW,EAAE,QAAQ,CAAC;IAEtB,yFAAyF;IACzF,QAAQ,EAAE,OAAO,CAAC;IAElB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEtC,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,IAAI,kBAAkB,CA0C9D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,EACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAoBjC"}

package/dist/config/rate-limits.js

@@ -1,161 +0,0 @@
-/**
- * Rate Limiting Configuration
- *
- * Defines tier-based rate limits for MCP tools.
- * Configurable via environment variables.
- *
- * Security: Implements SEC-HIGH-001 from security audit
- */
-/**
- * Tier-based rate limits for all MCP operations
- *
- * Limits are per-minute unless otherwise specified.
- *
- * | Tier | store_memory | retrieve_memory | list_recent | get_stats |
- * |------|-------------|-----------------|-------------|-----------|
- * | standard | 100/min | 300/min | 60/min | 30/min |
- * | premium | 500/min | 1000/min | 200/min | 100/min |
- * | unlimited | no limit | no limit | no limit | no limit |
- */
-export const TIER_LIMITS = {
-    standard: {
-        store_memory: {
-            maxRequests: 100,
-            windowSeconds: 60,
-        },
-        retrieve_memory: {
-            maxRequests: 300,
-            windowSeconds: 60,
-        },
-        list_recent: {
-            maxRequests: 60,
-            windowSeconds: 60,
-        },
-        get_stats: {
-            maxRequests: 30,
-            windowSeconds: 60,
-        },
-    },
-    premium: {
-        store_memory: {
-            maxRequests: 500,
-            windowSeconds: 60,
-        },
-        retrieve_memory: {
-            maxRequests: 1000,
-            windowSeconds: 60,
-        },
-        list_recent: {
-            maxRequests: 200,
-            windowSeconds: 60,
-        },
-        get_stats: {
-            maxRequests: 100,
-            windowSeconds: 60,
-        },
-    },
-    unlimited: {
-        // Use very high values (effectively no limit) for unlimited tier
-        // We avoid actual infinity to prevent edge cases in Redis
-        store_memory: {
-            maxRequests: 1000000,
-            windowSeconds: 60,
-        },
-        retrieve_memory: {
-            maxRequests: 1000000,
-            windowSeconds: 60,
-        },
-        list_recent: {
-            maxRequests: 1000000,
-            windowSeconds: 60,
-        },
-        get_stats: {
-            maxRequests: 1000000,
-            windowSeconds: 60,
-        },
-    },
-};
-/**
- * Legacy export for backwards compatibility
- */
-export const RATE_LIMIT_TIERS = TIER_LIMITS;
-/**
- * Get rate limits for a specific tier
- *
- * @param tier - The tier name
- * @returns Rate limit configuration for all operations
- */
-export function getTierLimits(tier) {
-    return TIER_LIMITS[tier] || TIER_LIMITS.standard;
-}
-/**
- * Read rate limit configuration from environment variables
- *
- * Environment variables:
- * - RATE_LIMIT_DEFAULT_TIER: Default tier (standard|premium|unlimited)
- * - RATE_LIMIT_FAIL_OPEN: Whether to allow requests when Redis is down (true|false)
- * - RATE_LIMIT_STORE_MEMORY: Override store_memory limit
- * - RATE_LIMIT_RETRIEVE_MEMORY: Override retrieve_memory limit
- * - RATE_LIMIT_LIST_RECENT: Override list_recent limit
- * - RATE_LIMIT_GET_STATS: Override get_stats limit
- * - RATE_LIMIT_EMERGENCY: Emergency in-memory limit when Redis is down
- *
- * @returns Rate limit configuration
- */
-export function getRateLimitConfigFromEnv() {
-    const defaultTier = (process.env.RATE_LIMIT_DEFAULT_TIER || "standard");
-    // Security: Default to fail closed (deny requests when Redis is unavailable)
-    const failOpenEnv = process.env.RATE_LIMIT_FAIL_OPEN;
-    const failOpen = failOpenEnv === "true";
-    // Parse custom limits from environment
-    const customLimits = {};
-    const storeMemoryLimit = process.env.RATE_LIMIT_STORE_MEMORY;
-    if (storeMemoryLimit) {
-        customLimits.store_memory = parseInt(storeMemoryLimit, 10);
-    }
-    const retrieveMemoryLimit = process.env.RATE_LIMIT_RETRIEVE_MEMORY;
-    if (retrieveMemoryLimit) {
-        customLimits.retrieve_memory = parseInt(retrieveMemoryLimit, 10);
-    }
-    const listRecentLimit = process.env.RATE_LIMIT_LIST_RECENT;
-    if (listRecentLimit) {
-        customLimits.list_recent = parseInt(listRecentLimit, 10);
-    }
-    const getStatsLimit = process.env.RATE_LIMIT_GET_STATS;
-    if (getStatsLimit) {
-        customLimits.get_stats = parseInt(getStatsLimit, 10);
-    }
-    // Emergency limit for in-memory fallback (very conservative)
-    const emergencyLimit = parseInt(process.env.RATE_LIMIT_EMERGENCY || "10", 10);
-    return {
-        defaultTier,
-        failOpen,
-        customLimits: Object.keys(customLimits).length > 0 ? customLimits : undefined,
-        emergencyLimit,
-    };
-}
-/**
- * Build rate limit configuration by merging tier defaults with custom limits
- *
- * @param tier - Base tier
- * @param customLimits - Custom limit overrides
- * @returns Merged rate limit configuration
- */
-export function buildRateLimitConfig(tier, customLimits) {
-    const tierLimits = getTierLimits(tier);
-    if (!customLimits) {
-        return tierLimits;
-    }
-    // Merge custom limits with tier defaults
-    const merged = { ...tierLimits };
-    for (const [operation, maxRequests] of Object.entries(customLimits)) {
-        if (merged[operation]) {
-            merged[operation] = {
-                ...merged[operation],
-                maxRequests,
-            };
-        }
-    }
-    return merged;
-}
-//# sourceMappingURL=rate-limits.js.map

package/dist/config/rate-limits.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limits.js","sourceRoot":"","sources":["../../src/config/rate-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAsD;IAC5E,QAAQ,EAAE;QACR,YAAY,EAAE;YACZ,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,EAAE;SAClB;QACD,eAAe,EAAE;YACf,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,EAAE;SAClB;QACD,WAAW,EAAE;YACX,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,EAAE;SAClB;QACD,SAAS,EAAE;YACT,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,EAAE;SAClB;KACF;IACD,OAAO,EAAE;QACP,YAAY,EAAE;YACZ,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,EAAE;SAClB;QACD,eAAe,EAAE;YACf,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,EAAE;SAClB;QACD,WAAW,EAAE;YACX,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,EAAE;SAClB;QACD,SAAS,EAAE;YACT,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,EAAE;SAClB;KACF;IACD,SAAS,EAAE;QACT,iEAAiE;QACjE,0DAA0D;QAC1D,YAAY,EAAE;YACZ,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,EAAE;SAClB;QACD,eAAe,EAAE;YACf,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,EAAE;SAClB;QACD,WAAW,EAAE;YACX,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,EAAE;SAClB;QACD,SAAS,EAAE;YACT,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,EAAE;SAClB;KACF;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC;AACnD,CAAC;AAmBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,UAAU,CAAa,CAAC;IAEpF,6EAA6E;IAC7E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACrD,MAAM,QAAQ,GAAG,WAAW,KAAK,MAAM,CAAC;IAExC,uCAAuC;IACvC,MAAM,YAAY,GAA2B,EAAE,CAAC;IAEhD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC7D,IAAI,gBAAgB,EAAE,CAAC;QACrB,YAAY,CAAC,YAAY,GAAG,QAAQ,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACnE,IAAI,mBAAmB,EAAE,CAAC;QACxB,YAAY,CAAC,eAAe,GAAG,QAAQ,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC3D,IAAI,eAAe,EAAE,CAAC;QACpB,YAAY,CAAC,WAAW,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACvD,IAAI,aAAa,EAAE,CAAC;QAClB,YAAY,CAAC,SAAS,GAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,6DAA6D;IAC7D,MAAM,cAAc,GAAG,QAAQ,CAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,EACxC,EAAE,CACH,CAAC;IAEF,OAAO;QACL,WAAW;QACX,QAAQ;QACR,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC7E,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,YAAqC;IAErC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEvC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,yCAAyC;IACzC,MAAM,MAAM,GAAoC,EAAE,GAAG,UAAU,EAAE,CAAC;IAElE,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,SAAS,CAAC,GAAG;gBAClB,GAAG,MAAM,CAAC,SAAS,CAAC;gBACpB,WAAW;aACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/middleware/auth.d.ts

@@ -1,287 +0,0 @@
-/**
- * MCP Authentication Middleware
- *
- * Implements API key authentication for MCP tools with:
- * - Bearer token authentication
- * - bcrypt password hashing
- * - Key expiration
- * - IP allowlisting
- * - Scope-based authorization
- * - Audit logging
- *
- * Security Features:
- * - Constant-time comparison via bcrypt
- * - No plaintext key storage
- * - Gradual rollout support (AUTH_ENABLED env var)
- * - Rate limit tier enforcement
- */
-/** API key format prefix */
-export declare const API_KEY_PREFIX = "mem_v1_";
-/** Number of random bytes for key generation (30 bytes = 40 chars base64url) */
-export declare const API_KEY_BYTES = 30;
-/** bcrypt work factor (12 = ~250ms on modern hardware) */
-export declare const BCRYPT_ROUNDS = 12;
-/** Default key expiration in days */
-export declare const DEFAULT_KEY_EXPIRATION_DAYS = 90;
-/** Maximum allowed key expiration in days */
-export declare const MAX_KEY_EXPIRATION_DAYS = 365;
-/** Maximum grace period for key rotation in hours */
-export declare const MAX_GRACE_PERIOD_HOURS = 168;
-/** Valid scopes for API keys */
-export declare const VALID_SCOPES: readonly ["store_memory", "retrieve_memory", "list_recent", "get_stats", "*"];
-export type ValidScope = (typeof VALID_SCOPES)[number];
-/** Result of API key generation */
-export interface GeneratedApiKey {
-    fullKey: string;
-    keyPrefix: string;
-    keyHash: string;
-}
-/** API key record from database */
-export interface ApiKeyRecord {
-    id: string;
-    userId: string;
-    keyHash: string;
-    scopes: string[];
-    tier: string;
-    expiresAt: Date | null;
-    ipAllowlist: string[] | null;
-    revokedAt: Date | null;
-    lastUsedAt: Date | null;
-}
-/** Authentication result */
-export interface AuthResult {
-    authenticated: boolean;
-    userId: string;
-    keyId: string;
-    tier: string;
-    scopes: string[];
-}
-/** Audit log actions */
-export declare enum AuditAction {
-    AUTHENTICATE = "authenticate",
-    RATE_LIMITED = "rate_limited",
-    REVOKED = "revoked",
-    ROTATED = "rotated",
-    CREATED = "created",
-    SCOPE_DENIED = "scope_denied",
-    IP_DENIED = "ip_denied",
-    EXPIRED = "expired"
-}
-/** Audit log entry */
-export interface AuditEntry {
-    apiKeyId: string | null;
-    action: AuditAction;
-    success: boolean;
-    ipAddress: string | null;
-    userAgent?: string;
-    requestPath?: string;
-    failureReason?: string;
-    metadata?: Record<string, unknown>;
-    createdAt: Date;
-}
-/** Key rotation result */
-export interface RotationResult {
-    newKey: GeneratedApiKey;
-    gracePeriodHours: number;
-    oldKeyValidUntil: Date;
-}
-/** Request context for authentication */
-export interface AuthRequest {
-    apiKey: string | undefined;
-    ip: string;
-    toolName: string;
-    userAgent?: string;
-}
-/** Database interface for auth operations */
-export interface AuthDatabase {
-    getApiKey(prefix: string): Promise<ApiKeyRecord | null>;
-    updateLastUsed(keyId: string): Promise<void>;
-    createAuditEntry(entry: AuditEntry): Promise<void>;
-}
-/** Rate limits per tier */
-export interface TierRateLimits {
-    store_memory: number;
-    retrieve_memory: number;
-    list_recent: number;
-    get_stats: number;
-}
-/**
- * Generate a new API key with cryptographically secure random bytes
- *
- * @returns Generated key with full key, prefix, and hash
- */
-export declare function generateApiKey(): Promise<GeneratedApiKey>;
-/**
- * Verify an API key against its stored hash
- *
- * Uses bcrypt.compare for constant-time comparison
- *
- * @param providedKey - The API key provided by the client
- * @param storedHash - The bcrypt hash stored in the database
- * @returns true if key is valid
- */
-export declare function verifyApiKey(providedKey: string, storedHash: string): Promise<boolean>;
-/**
- * Validate API key format without database lookup
- *
- * @param key - API key to validate
- * @returns true if format is valid
- */
-export declare function validateApiKeyFormat(key: string): boolean;
-/**
- * Extract the prefix from an API key for database lookup
- *
- * @param key - Full API key
- * @returns 8-character prefix or null if invalid
- */
-export declare function extractKeyPrefix(key: string): string | null;
-/**
- * Check if an API key is expired
- *
- * @param expiresAt - Expiration date (null means never expires)
- * @returns true if key is expired
- */
-export declare function isKeyExpired(expiresAt: Date | null): boolean;
-/**
- * Calculate default expiration date (90 days from now)
- *
- * @returns Expiration date
- */
-export declare function calculateDefaultExpiration(): Date;
-/**
- * Calculate expiration date with custom days (capped at max)
- *
- * @param days - Number of days until expiration
- * @returns Expiration date
- */
-export declare function calculateExpiration(days: number): Date;
-/**
- * Get expiration days from environment or default
- *
- * @returns Number of days for key expiration
- */
-export declare function getExpirationDays(): number;
-/**
- * Check if an IP address is in the allowlist
- *
- * Supports both individual IPs and CIDR notation
- *
- * @param ip - Client IP address
- * @param allowlist - Array of allowed IPs/CIDRs (empty or null allows all)
- * @returns true if IP is allowed
- */
-export declare function isIpAllowed(ip: string, allowlist: string[] | null | undefined): boolean;
-/**
- * Check if user has required scope
- *
- * @param userScopes - Scopes granted to user
- * @param requiredScope - Scope required for operation
- * @returns true if user has scope
- */
-export declare function hasScope(userScopes: string[] | null | undefined, requiredScope: string): boolean;
-/**
- * Rotate an API key with optional grace period
- *
- * @param oldKeyHash - Hash of the old key (unused, for signature compatibility)
- * @param gracePeriodHours - Hours to allow old key (0 = immediate revocation)
- * @returns New key and grace period info
- */
-export declare function rotateApiKey(_oldKeyHash: string, gracePeriodHours: number): Promise<RotationResult>;
-/**
- * Create an audit log entry
- *
- * @param params - Audit entry parameters
- * @returns Audit entry object
- */
-export declare function createAuditEntry(params: {
-    apiKeyId: string | null;
-    action: AuditAction;
-    success: boolean;
-    ipAddress: string | null;
-    userAgent?: string;
-    requestPath?: string;
-    failureReason?: string;
-    metadata?: Record<string, unknown>;
-}): AuditEntry;
-/**
- * Hash an API key for audit logging (never log full key)
- *
- * @param key - Full API key
- * @returns Truncated SHA-256 hash for identification
- */
-export declare function hashForAudit(key: string): string;
-/**
- * Authenticate an MCP request
- *
- * @param request - Request context
- * @param db - Database interface
- * @returns Authentication result
- * @throws Error if authentication fails
- */
-export declare function authenticateRequest(request: AuthRequest, db: AuthDatabase): Promise<AuthResult>;
-/**
- * Check if authentication is enabled
- *
- * @returns true if AUTH_ENABLED=true
- */
-export declare function isAuthEnabled(): boolean;
-/**
- * Get rate limits for a tier
- *
- * @param tier - Rate limit tier
- * @returns Rate limits for the tier
- */
-export declare function getRateLimitsForTier(tier: string): TierRateLimits;
-/**
- * Create an in-memory cache for auth results
- *
- * @param options - Cache configuration
- * @returns Cache object with get/set methods
- */
-export declare function createAuthCache(options: {
-    maxSize: number;
-    ttlSeconds: number;
-}): {
-    get(keyId: string): {
-        userId: string;
-        tier: string;
-    } | null;
-    set(keyId: string, value: {
-        userId: string;
-        tier: string;
-    }): void;
-    /**
-     * Invalidate a specific key from the cache
-     * HIGH-002: Used to immediately invalidate revoked/rotated keys
-     *
-     * @param keyId - The key ID (prefix) to invalidate
-     * @returns true if key was in cache, false otherwise
-     */
-    invalidate(keyId: string): boolean;
-    clear(): void;
-    size(): number;
-};
-/**
- * Type for cache invalidation callback
- */
-export type AuthCache = ReturnType<typeof createAuthCache>;
-/**
- * Revoke an API key and invalidate it from cache
- * HIGH-002: Ensures revoked keys cannot be used even if cached
- *
- * @param keyPrefix - The key prefix to revoke
- * @param cache - The auth cache instance
- * @param reason - Reason for revocation (for audit logging)
- * @returns true if key was invalidated from cache
- */
-export declare function revokeApiKey(keyPrefix: string, cache: AuthCache, reason?: string): boolean;
-/**
- * Invalidate a rotated API key from cache
- * HIGH-002: Ensures old keys cannot be used during rotation
- *
- * @param oldKeyPrefix - The old key prefix being rotated
- * @param cache - The auth cache instance
- * @returns true if old key was invalidated from cache
- */
-export declare function invalidateRotatedKey(oldKeyPrefix: string, cache: AuthCache): boolean;
-//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,4BAA4B;AAC5B,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,gFAAgF;AAChF,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,0DAA0D;AAC1D,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,qCAAqC;AACrC,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,6CAA6C;AAC7C,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,gCAAgC;AAChC,eAAO,MAAM,YAAY,+EAMf,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAMvD,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,4BAA4B;AAC5B,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAwB;AACxB,oBAAY,WAAW;IACrB,YAAY,iBAAiB;IAC7B,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED,sBAAsB;AACtB,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,0BAA0B;AAC1B,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,IAAI,CAAC;CACxB;AAED,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACxD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED,2BAA2B;AAC3B,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAaD;;;;GAIG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,CAgB/D;AAMD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAkBzD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM3D;AAMD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAM5D;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAIjD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAS1C;AAMD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GACrC,OAAO,CAgBT;AA+FD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CACtB,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EACvC,aAAa,EAAE,MAAM,GACpB,OAAO,CAWT;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,cAAc,CAAC,CAkBzB;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GAAG,UAAU,CAKb;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAMD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,EAAE,EAAE,YAAY,GACf,OAAO,CAAC,UAAU,CAAC,CAwIrB;AAMD;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AA4BD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAEjE;AAMD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;eAKjE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;eAehD,MAAM,SAAS;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAgBjE;;;;;;OAMG;sBACe,MAAM,GAAG,OAAO;aAIzB,IAAI;YAIL,MAAM;EAIjB;AAMD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,EAChB,MAAM,GAAE,MAA4B,GACnC,OAAO,CAcT;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,SAAS,GACf,OAAO,CAWT"}