@agentlensai/server 0.10.0 → 0.13.0

package/dist/cloud/routes/billing-routes.js

@@ -0,0 +1,114 @@
+/**
+ * Billing Routes (S-7.5)
+ *
+ * Express-compatible route handlers for billing page data:
+ * - Current plan & trial status
+ * - Invoice history
+ * - Plan upgrade/downgrade
+ * - Payment method management (Stripe portal)
+ */
+import { TIER_CONFIG } from '../billing/stripe-client.js';
+export function createBillingRouteHandlers(deps) {
+    return {
+        /** GET /api/cloud/orgs/:orgId/billing — billing overview */
+        async getBillingOverview(orgId, userId) {
+            const orgResult = await deps.db.query(`SELECT id, plan, stripe_customer_id, stripe_subscription_id, event_quota, settings
+         FROM orgs WHERE id = $1`, [orgId]);
+            const org = orgResult.rows[0];
+            if (!org)
+                return { status: 404, body: { error: 'Org not found' } };
+            const trialStatus = await deps.trialService.getTrialStatus(orgId);
+            const plan = org.plan;
+            const tierConfig = TIER_CONFIG[plan] ?? TIER_CONFIG.free;
+            // Get current period usage
+            const now = new Date();
+            const monthStart = new Date(now.getUTCFullYear(), now.getUTCMonth(), 1);
+            const usageResult = await deps.db.query(`SELECT COALESCE(SUM(event_count), 0)::int as total
+         FROM usage_records WHERE org_id = $1 AND hour >= $2`, [orgId, monthStart.toISOString()]);
+            const currentUsage = usageResult.rows[0]?.total ?? 0;
+            return {
+                status: 200,
+                body: {
+                    plan,
+                    plan_name: tierConfig.name,
+                    base_price_cents: tierConfig.base_price_cents,
+                    event_quota: org.event_quota ?? tierConfig.event_quota,
+                    current_usage: currentUsage,
+                    has_payment_method: !!org.stripe_customer_id,
+                    stripe_subscription_id: org.stripe_subscription_id,
+                    trial: trialStatus,
+                    pending_downgrade: org.settings?.pending_downgrade ?? null,
+                    payment_status: org.settings?.payment_status ?? 'active',
+                },
+            };
+        },
+        /** GET /api/cloud/orgs/:orgId/billing/invoices — invoice history */
+        async getInvoices(orgId, limit = 20, offset = 0) {
+            const invoices = await deps.invoiceService.listInvoices(orgId, limit, offset);
+            return { status: 200, body: invoices };
+        },
+        /** POST /api/cloud/orgs/:orgId/billing/upgrade — upgrade plan */
+        async upgradePlan(orgId, userId, body) {
+            const newPlan = body.plan;
+            if (!TIER_CONFIG[newPlan] || newPlan === 'free') {
+                return { status: 400, body: { error: 'Invalid plan' } };
+            }
+            try {
+                await deps.billingService.upgradePlan(orgId, newPlan);
+                if (deps.auditLog) {
+                    await deps.auditLog.write({
+                        org_id: orgId,
+                        actor_type: 'user',
+                        actor_id: userId,
+                        action: 'billing.plan_changed',
+                        resource_type: 'org',
+                        resource_id: orgId,
+                        details: { new_plan: newPlan, direction: 'upgrade' },
+                        result: 'success',
+                    });
+                }
+                return { status: 200, body: { ok: true, plan: newPlan } };
+            }
+            catch (err) {
+                return { status: 400, body: { error: String(err) } };
+            }
+        },
+        /** POST /api/cloud/orgs/:orgId/billing/downgrade — downgrade to free */
+        async downgradePlan(orgId, userId) {
+            try {
+                await deps.billingService.downgradePlan(orgId);
+                if (deps.auditLog) {
+                    await deps.auditLog.write({
+                        org_id: orgId,
+                        actor_type: 'user',
+                        actor_id: userId,
+                        action: 'billing.plan_changed',
+                        resource_type: 'org',
+                        resource_id: orgId,
+                        details: { new_plan: 'free', direction: 'downgrade' },
+                        result: 'success',
+                    });
+                }
+                return { status: 200, body: { ok: true, scheduled: 'end_of_period' } };
+            }
+            catch (err) {
+                return { status: 400, body: { error: String(err) } };
+            }
+        },
+        /** POST /api/cloud/orgs/:orgId/billing/portal — create Stripe portal session URL */
+        async createPortalSession(orgId) {
+            const orgResult = await deps.db.query(`SELECT stripe_customer_id FROM orgs WHERE id = $1`, [orgId]);
+            const org = orgResult.rows[0];
+            if (!org?.stripe_customer_id) {
+                return { status: 400, body: { error: 'No payment method on file' } };
+            }
+            // In real impl, create Stripe Billing Portal session
+            // For now, return a placeholder URL
+            return {
+                status: 200,
+                body: { url: `https://billing.stripe.com/p/session/${org.stripe_customer_id}` },
+            };
+        },
+    };
+}
+//# sourceMappingURL=billing-routes.js.map

package/dist/cloud/routes/billing-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing-routes.js","sourceRoot":"","sources":["../../../src/cloud/routes/billing-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAU1D,MAAM,UAAU,0BAA0B,CAAC,IAAuB;IAChE,OAAO;QACL,4DAA4D;QAC5D,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,MAAc;YAEd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACnC;iCACyB,EACzB,CAAC,KAAK,CAAC,CACR,CAAC;YACF,MAAM,GAAG,GAAI,SAAS,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC;YAEnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAgB,CAAC;YAClC,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC;YAEzD,2BAA2B;YAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YACxE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACrC;6DACqD,EACrD,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAClC,CAAC;YACF,MAAM,YAAY,GAAI,WAAW,CAAC,IAAc,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;YAEhE,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,IAAI;oBACJ,SAAS,EAAE,UAAU,CAAC,IAAI;oBAC1B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;oBAC7C,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW;oBACtD,aAAa,EAAE,YAAY;oBAC3B,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB;oBAC5C,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;oBAClD,KAAK,EAAE,WAAW;oBAClB,iBAAiB,EAAE,GAAG,CAAC,QAAQ,EAAE,iBAAiB,IAAI,IAAI;oBAC1D,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,IAAI,QAAQ;iBACzD;aACF,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,KAAK,CAAC,WAAW,CACf,KAAa,EACb,KAAK,GAAG,EAAE,EACV,MAAM,GAAG,CAAC;YAEV,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC9E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACzC,CAAC;QAED,iEAAiE;QACjE,KAAK,CAAC,WAAW,CACf,KAAa,EACb,MAAc,EACd,IAAsB;YAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAgB,CAAC;YACtC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAChD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;YAC1D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACtD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;wBACxB,MAAM,EAAE,KAAK;wBACb,UAAU,EAAE,MAAM;wBAClB,QAAQ,EAAE,MAAM;wBAChB,MAAM,EAAE,sBAAsB;wBAC9B,aAAa,EAAE,KAAK;wBACpB,WAAW,EAAE,KAAK;wBAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE;wBACpD,MAAM,EAAE,SAAS;qBAClB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,MAAc;YAEd,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC/C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;wBACxB,MAAM,EAAE,KAAK;wBACb,UAAU,EAAE,MAAM;wBAClB,QAAQ,EAAE,MAAM;wBAChB,MAAM,EAAE,sBAAsB;wBAC9B,aAAa,EAAE,KAAK;wBACpB,WAAW,EAAE,KAAK;wBAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE;wBACrD,MAAM,EAAE,SAAS;qBAClB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,CAAC;YACzE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QAED,oFAAoF;QACpF,KAAK,CAAC,mBAAmB,CACvB,KAAa;YAEb,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACnC,mDAAmD,EACnD,CAAC,KAAK,CAAC,CACR,CAAC;YACF,MAAM,GAAG,GAAI,SAAS,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC;gBAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,CAAC;YACvE,CAAC;YACD,qDAAqD;YACrD,oCAAoC;YACpC,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,GAAG,EAAE,wCAAwC,GAAG,CAAC,kBAAkB,EAAE,EAAE;aAChF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cloud/routes/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Cloud Routes — Hono adapter [F6-fix]
+ *
+ * Wraps framework-agnostic cloud route handlers into a Hono sub-app
+ * and applies validateOrgAccess() middleware on org-scoped routes.
+ */
+import { Hono } from 'hono';
+import type { AuthVariables } from '../../middleware/auth.js';
+import { type OrgRoutesDeps } from './org-routes.js';
+export declare function cloudOrgRoutes(deps: OrgRoutesDeps): Hono<{
+    Variables: AuthVariables;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=index.d.ts.map

package/dist/cloud/routes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cloud/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE7E,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa;eACd,aAAa;0CA6FhD"}

package/dist/cloud/routes/index.js

@@ -0,0 +1,98 @@
+/**
+ * Cloud Routes — Hono adapter [F6-fix]
+ *
+ * Wraps framework-agnostic cloud route handlers into a Hono sub-app
+ * and applies validateOrgAccess() middleware on org-scoped routes.
+ */
+import { Hono } from 'hono';
+import { validateOrgAccess } from '../middleware/validate-org-access.js';
+import { createOrgRouteHandlers } from './org-routes.js';
+export function cloudOrgRoutes(deps) {
+    const app = new Hono();
+    const handlers = createOrgRouteHandlers(deps);
+    // Apply org access validation on all org-scoped routes
+    app.use('/:orgId/*', validateOrgAccess());
+    // GET /api/cloud/orgs — list user's orgs
+    app.get('/', async (c) => {
+        const auth = c.get('auth');
+        if (!auth?.userId)
+            return c.json({ error: 'Authentication required' }, 401);
+        const result = await handlers.listOrgs(auth.userId);
+        return c.json(result.body, result.status);
+    });
+    // POST /api/cloud/orgs — create a new org
+    app.post('/', async (c) => {
+        const auth = c.get('auth');
+        if (!auth?.userId)
+            return c.json({ error: 'Authentication required' }, 401);
+        const body = await c.req.json();
+        const result = await handlers.createOrg(auth.userId, body);
+        return c.json(result.body, result.status);
+    });
+    // POST /api/cloud/orgs/switch — switch active org
+    app.post('/switch', async (c) => {
+        const auth = c.get('auth');
+        if (!auth?.userId)
+            return c.json({ error: 'Authentication required' }, 401);
+        const body = await c.req.json();
+        const result = await handlers.switchOrg(auth.userId, body);
+        return c.json(result.body, result.status);
+    });
+    // GET /api/cloud/orgs/:orgId/members
+    app.get('/:orgId/members', async (c) => {
+        const orgId = c.req.param('orgId');
+        const result = await handlers.listMembers(orgId);
+        return c.json(result.body, result.status);
+    });
+    // GET /api/cloud/orgs/:orgId/invitations
+    app.get('/:orgId/invitations', async (c) => {
+        const orgId = c.req.param('orgId');
+        const result = await handlers.listInvitations(orgId);
+        return c.json(result.body, result.status);
+    });
+    // POST /api/cloud/orgs/:orgId/invitations
+    app.post('/:orgId/invitations', async (c) => {
+        const auth = c.get('auth');
+        if (!auth?.userId)
+            return c.json({ error: 'Authentication required' }, 401);
+        const orgId = c.req.param('orgId');
+        const body = await c.req.json();
+        const result = await handlers.inviteMember(orgId, auth.userId, body);
+        return c.json(result.body, result.status);
+    });
+    // DELETE /api/cloud/orgs/:orgId/invitations/:invId
+    app.delete('/:orgId/invitations/:invId', async (c) => {
+        const orgId = c.req.param('orgId');
+        const invId = c.req.param('invId');
+        const result = await handlers.cancelInvitation(orgId, invId);
+        return c.json(result.body, result.status);
+    });
+    // PUT /api/cloud/orgs/:orgId/members/:userId/role
+    app.put('/:orgId/members/:userId/role', async (c) => {
+        const auth = c.get('auth');
+        const orgId = c.req.param('orgId');
+        const userId = c.req.param('userId');
+        const body = await c.req.json();
+        const result = await handlers.changeMemberRole(orgId, userId, auth?.role ?? 'member', body);
+        return c.json(result.body, result.status);
+    });
+    // DELETE /api/cloud/orgs/:orgId/members/:userId
+    app.delete('/:orgId/members/:userId', async (c) => {
+        const orgId = c.req.param('orgId');
+        const userId = c.req.param('userId');
+        const result = await handlers.removeMember(orgId, userId);
+        return c.json(result.body, result.status);
+    });
+    // POST /api/cloud/orgs/:orgId/transfer
+    app.post('/:orgId/transfer', async (c) => {
+        const auth = c.get('auth');
+        if (!auth?.userId)
+            return c.json({ error: 'Authentication required' }, 401);
+        const orgId = c.req.param('orgId');
+        const body = await c.req.json();
+        const result = await handlers.transferOwnership(orgId, auth.userId, body);
+        return c.json(result.body, result.status);
+    });
+    return app;
+}
+//# sourceMappingURL=index.js.map

package/dist/cloud/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cloud/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAsB,MAAM,iBAAiB,CAAC;AAE7E,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAgC,CAAC;IACrD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE9C,uDAAuD;IACvD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAE1C,yCAAyC;IACzC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,GAAI,CAAS,CAAC,GAAG,CAAC,MAAM,CAAoC,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,IAAI,GAAI,CAAS,CAAC,GAAG,CAAC,MAAM,CAAoC,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAI,CAAS,CAAC,GAAG,CAAC,MAAM,CAAoC,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAI,CAAS,CAAC,GAAG,CAAC,MAAM,CAAoC,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,GAAG,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,IAAI,GAAI,CAAS,CAAC,GAAG,CAAC,MAAM,CAAkC,CAAC;QACrE,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5F,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,gDAAgD;IAChD,GAAG,CAAC,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,uCAAuC;IACvC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,IAAI,GAAI,CAAS,CAAC,GAAG,CAAC,MAAM,CAAoC,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cloud/routes/onboarding-routes.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Onboarding Routes (S-7.7)
+ *
+ * Server-side support for the onboarding wizard:
+ * - Check onboarding status (has org, has key, has events)
+ * - Verify first event received
+ */
+import type { MigrationClient } from '../migrate.js';
+export interface OnboardingRoutesDeps {
+    db: MigrationClient;
+}
+export interface OnboardingStatus {
+    has_org: boolean;
+    has_api_key: boolean;
+    has_first_event: boolean;
+    org_id: string | null;
+    api_key_prefix: string | null;
+}
+export declare function createOnboardingRouteHandlers(deps: OnboardingRoutesDeps): {
+    /** GET /api/cloud/onboarding/status — check onboarding progress */
+    getOnboardingStatus(userId: string): Promise<{
+        status: number;
+        body: OnboardingStatus;
+    }>;
+    /** POST /api/cloud/onboarding/verify — poll for first event */
+    verifyFirstEvent(orgId: string): Promise<{
+        status: number;
+        body: {
+            received: boolean;
+            event_count: number;
+        };
+    }>;
+};
+//# sourceMappingURL=onboarding-routes.d.ts.map

package/dist/cloud/routes/onboarding-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-routes.d.ts","sourceRoot":"","sources":["../../../src/cloud/routes/onboarding-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,eAAe,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,oBAAoB;IAEpE,mEAAmE;gCAEzD,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC;IAmDtD,+DAA+D;4BAEtD,MAAM,GACZ,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,QAAQ,EAAE,OAAO,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;EAYnF"}

package/dist/cloud/routes/onboarding-routes.js

@@ -0,0 +1,58 @@
+/**
+ * Onboarding Routes (S-7.7)
+ *
+ * Server-side support for the onboarding wizard:
+ * - Check onboarding status (has org, has key, has events)
+ * - Verify first event received
+ */
+export function createOnboardingRouteHandlers(deps) {
+    return {
+        /** GET /api/cloud/onboarding/status — check onboarding progress */
+        async getOnboardingStatus(userId) {
+            // Check if user has any orgs
+            const orgResult = await deps.db.query(`SELECT o.id FROM orgs o
+         JOIN org_members om ON om.org_id = o.id
+         WHERE om.user_id = $1
+         ORDER BY o.created_at ASC LIMIT 1`, [userId]);
+            const orgId = orgResult.rows[0]?.id ?? null;
+            if (!orgId) {
+                return {
+                    status: 200,
+                    body: { has_org: false, has_api_key: false, has_first_event: false, org_id: null, api_key_prefix: null },
+                };
+            }
+            // Check if org has API keys
+            const keyResult = await deps.db.query(`SELECT key_prefix FROM api_keys WHERE org_id = $1 AND revoked_at IS NULL LIMIT 1`, [orgId]);
+            const keyPrefix = keyResult.rows[0]?.key_prefix ?? null;
+            if (!keyPrefix) {
+                return {
+                    status: 200,
+                    body: { has_org: true, has_api_key: false, has_first_event: false, org_id: orgId, api_key_prefix: null },
+                };
+            }
+            // Check if org has received any events
+            const eventResult = await deps.db.query(`SELECT 1 FROM events WHERE org_id = $1 LIMIT 1`, [orgId]);
+            const hasEvent = eventResult.rows.length > 0;
+            return {
+                status: 200,
+                body: {
+                    has_org: true,
+                    has_api_key: true,
+                    has_first_event: hasEvent,
+                    org_id: orgId,
+                    api_key_prefix: keyPrefix,
+                },
+            };
+        },
+        /** POST /api/cloud/onboarding/verify — poll for first event */
+        async verifyFirstEvent(orgId) {
+            const result = await deps.db.query(`SELECT COUNT(*)::int as count FROM events WHERE org_id = $1`, [orgId]);
+            const count = result.rows[0]?.count ?? 0;
+            return {
+                status: 200,
+                body: { received: count > 0, event_count: count },
+            };
+        },
+    };
+}
+//# sourceMappingURL=onboarding-routes.js.map

package/dist/cloud/routes/onboarding-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-routes.js","sourceRoot":"","sources":["../../../src/cloud/routes/onboarding-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH,MAAM,UAAU,6BAA6B,CAAC,IAA0B;IACtE,OAAO;QACL,mEAAmE;QACnE,KAAK,CAAC,mBAAmB,CACvB,MAAc;YAEd,6BAA6B;YAC7B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACnC;;;2CAGmC,EACnC,CAAC,MAAM,CAAC,CACT,CAAC;YACF,MAAM,KAAK,GAAI,SAAS,CAAC,IAAc,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;YAEvD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;iBACzG,CAAC;YACJ,CAAC;YAED,4BAA4B;YAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACnC,kFAAkF,EAClF,CAAC,KAAK,CAAC,CACR,CAAC;YACF,MAAM,SAAS,GAAI,SAAS,CAAC,IAAc,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;YAEnE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;iBACzG,CAAC;YACJ,CAAC;YAED,uCAAuC;YACvC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACrC,gDAAgD,EAChD,CAAC,KAAK,CAAC,CACR,CAAC;YACF,MAAM,QAAQ,GAAI,WAAW,CAAC,IAAc,CAAC,MAAM,GAAG,CAAC,CAAC;YAExD,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,IAAI;oBACjB,eAAe,EAAE,QAAQ;oBACzB,MAAM,EAAE,KAAK;oBACb,cAAc,EAAE,SAAS;iBAC1B;aACF,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,KAAK,CAAC,gBAAgB,CACpB,KAAa;YAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAChC,6DAA6D,EAC7D,CAAC,KAAK,CAAC,CACR,CAAC;YACF,MAAM,KAAK,GAAI,MAAM,CAAC,IAAc,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;YACpD,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE;aAClD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cloud/routes/org-routes.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Org & Team Routes (S-7.1, S-7.2)
+ *
+ * Express-compatible route handlers for org management and team management.
+ * These are designed to be mounted at /api/cloud/orgs.
+ */
+import type { MigrationClient } from '../migrate.js';
+import type { AuditLogService } from '../auth/audit-log.js';
+export interface OrgRoutesDeps {
+    db: MigrationClient;
+    auditLog?: AuditLogService;
+}
+/**
+ * Creates a map of route handlers for org/team management.
+ * Can be wired into Express, Fastify, or any HTTP framework.
+ */
+export declare function createOrgRouteHandlers(deps: OrgRoutesDeps): {
+    /** GET /api/cloud/orgs — list user's orgs */
+    listOrgs(userId: string): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+    /** POST /api/cloud/orgs — create a new org */
+    createOrg(userId: string, body: {
+        name: string;
+    }): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+    /** POST /api/cloud/orgs/switch — switch active org (returns new JWT context) */
+    switchOrg(userId: string, body: {
+        orgId: string;
+    }): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+    /** GET /api/cloud/orgs/:orgId/members — list org members */
+    listMembers(orgId: string): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+    /** GET /api/cloud/orgs/:orgId/invitations — list pending invitations */
+    listInvitations(orgId: string): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+    /** POST /api/cloud/orgs/:orgId/invitations — invite a member */
+    inviteMember(orgId: string, invitedByUserId: string, body: {
+        email: string;
+        role: string;
+    }): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+    /** DELETE /api/cloud/orgs/:orgId/invitations/:invId — cancel invitation */
+    cancelInvitation(orgId: string, invitationId: string): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+    /** PUT /api/cloud/orgs/:orgId/members/:userId/role — change role */
+    changeMemberRole(orgId: string, targetUserId: string, actorRole: string, body: {
+        role: string;
+    }): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+    /** DELETE /api/cloud/orgs/:orgId/members/:userId — remove member */
+    removeMember(orgId: string, targetUserId: string): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+    /** POST /api/cloud/orgs/:orgId/transfer — transfer ownership */
+    transferOwnership(orgId: string, fromUserId: string, body: {
+        toUserId: string;
+    }): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+};
+//# sourceMappingURL=org-routes.d.ts.map

package/dist/cloud/routes/org-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-routes.d.ts","sourceRoot":"","sources":["../../../src/cloud/routes/org-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,eAAe,CAAC;IACpB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa;IAItD,6CAA6C;qBACtB,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAK1E,8CAA8C;sBAEpC,MAAM,QACR;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GACrB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAyB7C,gFAAgF;sBAEtE,MAAM,QACR;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GACtB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAY7C,4DAA4D;uBAEnD,MAAM,GACZ,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAK7C,wEAAwE;2BAE/D,MAAM,GACZ,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAK7C,gEAAgE;wBAEvD,MAAM,mBACI,MAAM,QACjB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IA8B7C,2EAA2E;4BAElE,MAAM,gBACC,MAAM,GACnB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAK7C,oEAAoE;4BAE3D,MAAM,gBACC,MAAM,aACT,MAAM,QACX;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GACrB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAY7C,oEAAoE;wBAE3D,MAAM,gBACC,MAAM,GACnB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAY7C,gEAAgE;6BAEvD,MAAM,cACD,MAAM,QACZ;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;EAyBhD"}

package/dist/cloud/routes/org-routes.js

@@ -0,0 +1,153 @@
+/**
+ * Org & Team Routes (S-7.1, S-7.2)
+ *
+ * Express-compatible route handlers for org management and team management.
+ * These are designed to be mounted at /api/cloud/orgs.
+ */
+import { OrgService, OrgServiceError } from '../org-service.js';
+/**
+ * Creates a map of route handlers for org/team management.
+ * Can be wired into Express, Fastify, or any HTTP framework.
+ */
+export function createOrgRouteHandlers(deps) {
+    const orgService = new OrgService(deps.db);
+    return {
+        /** GET /api/cloud/orgs — list user's orgs */
+        async listOrgs(userId) {
+            const orgs = await orgService.listUserOrgs(userId);
+            return { status: 200, body: orgs };
+        },
+        /** POST /api/cloud/orgs — create a new org */
+        async createOrg(userId, body) {
+            try {
+                const org = await orgService.createOrg(userId, body.name);
+                if (deps.auditLog) {
+                    await deps.auditLog.write({
+                        org_id: org.id,
+                        actor_type: 'user',
+                        actor_id: userId,
+                        action: 'org.created',
+                        resource_type: 'org',
+                        resource_id: org.id,
+                        details: { name: body.name },
+                        ip_address: null,
+                        result: 'success',
+                    });
+                }
+                return { status: 201, body: org };
+            }
+            catch (err) {
+                if (err instanceof OrgServiceError) {
+                    return { status: err.statusCode, body: { error: err.message } };
+                }
+                throw err;
+            }
+        },
+        /** POST /api/cloud/orgs/switch — switch active org (returns new JWT context) */
+        async switchOrg(userId, body) {
+            // Verify user belongs to this org
+            const orgs = await orgService.listUserOrgs(userId);
+            const target = orgs.find((o) => o.id === body.orgId);
+            if (!target) {
+                return { status: 403, body: { error: 'You are not a member of this organization' } };
+            }
+            // The actual JWT re-issuance would be done by the auth layer.
+            // This endpoint validates the switch is allowed.
+            return { status: 200, body: { token: 'refresh-required', orgId: body.orgId } };
+        },
+        /** GET /api/cloud/orgs/:orgId/members — list org members */
+        async listMembers(orgId) {
+            const members = await orgService.listMembers(orgId);
+            return { status: 200, body: members };
+        },
+        /** GET /api/cloud/orgs/:orgId/invitations — list pending invitations */
+        async listInvitations(orgId) {
+            const invitations = await orgService.listInvitations(orgId);
+            return { status: 200, body: invitations };
+        },
+        /** POST /api/cloud/orgs/:orgId/invitations — invite a member */
+        async inviteMember(orgId, invitedByUserId, body) {
+            try {
+                const { invitation } = await orgService.inviteMember(orgId, invitedByUserId, body.email, body.role);
+                if (deps.auditLog) {
+                    await deps.auditLog.write({
+                        org_id: orgId,
+                        actor_type: 'user',
+                        actor_id: invitedByUserId,
+                        action: 'member.invited',
+                        resource_type: 'invitation',
+                        resource_id: invitation.id,
+                        details: { email: body.email, role: body.role },
+                        ip_address: null,
+                        result: 'success',
+                    });
+                }
+                return { status: 201, body: invitation };
+            }
+            catch (err) {
+                if (err instanceof OrgServiceError) {
+                    return { status: err.statusCode, body: { error: err.message } };
+                }
+                throw err;
+            }
+        },
+        /** DELETE /api/cloud/orgs/:orgId/invitations/:invId — cancel invitation */
+        async cancelInvitation(orgId, invitationId) {
+            const ok = await orgService.cancelInvitation(orgId, invitationId);
+            return { status: ok ? 200 : 404, body: { ok } };
+        },
+        /** PUT /api/cloud/orgs/:orgId/members/:userId/role — change role */
+        async changeMemberRole(orgId, targetUserId, actorRole, body) {
+            try {
+                await orgService.changeMemberRole(orgId, targetUserId, body.role, actorRole);
+                return { status: 200, body: { ok: true } };
+            }
+            catch (err) {
+                if (err instanceof OrgServiceError) {
+                    return { status: err.statusCode, body: { error: err.message } };
+                }
+                throw err;
+            }
+        },
+        /** DELETE /api/cloud/orgs/:orgId/members/:userId — remove member */
+        async removeMember(orgId, targetUserId) {
+            try {
+                await orgService.removeMember(orgId, targetUserId);
+                return { status: 200, body: { ok: true } };
+            }
+            catch (err) {
+                if (err instanceof OrgServiceError) {
+                    return { status: err.statusCode, body: { error: err.message } };
+                }
+                throw err;
+            }
+        },
+        /** POST /api/cloud/orgs/:orgId/transfer — transfer ownership */
+        async transferOwnership(orgId, fromUserId, body) {
+            try {
+                await orgService.transferOwnership(orgId, fromUserId, body.toUserId);
+                if (deps.auditLog) {
+                    await deps.auditLog.write({
+                        org_id: orgId,
+                        actor_type: 'user',
+                        actor_id: fromUserId,
+                        action: 'org.ownership_transferred',
+                        resource_type: 'org',
+                        resource_id: orgId,
+                        details: { from: fromUserId, to: body.toUserId },
+                        ip_address: null,
+                        result: 'success',
+                    });
+                }
+                return { status: 200, body: { ok: true } };
+            }
+            catch (err) {
+                if (err instanceof OrgServiceError) {
+                    return { status: err.statusCode, body: { error: err.message } };
+                }
+                throw err;
+            }
+        },
+    };
+}
+//# sourceMappingURL=org-routes.js.map

package/dist/cloud/routes/org-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-routes.js","sourceRoot":"","sources":["../../../src/cloud/routes/org-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAShE;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAmB;IACxD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE3C,OAAO;QACL,6CAA6C;QAC7C,KAAK,CAAC,QAAQ,CAAC,MAAc;YAC3B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACnD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrC,CAAC;QAED,8CAA8C;QAC9C,KAAK,CAAC,SAAS,CACb,MAAc,EACd,IAAsB;YAEtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;wBACxB,MAAM,EAAE,GAAG,CAAC,EAAE;wBACd,UAAU,EAAE,MAAM;wBAClB,QAAQ,EAAE,MAAM;wBAChB,MAAM,EAAE,aAAoB;wBAC5B,aAAa,EAAE,KAAK;wBACpB,WAAW,EAAE,GAAG,CAAC,EAAE;wBACnB,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;wBAC5B,UAAU,EAAE,IAAI;wBAChB,MAAM,EAAE,SAAS;qBAClB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;oBACnC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,KAAK,CAAC,SAAS,CACb,MAAc,EACd,IAAuB;YAEvB,kCAAkC;YAClC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,CAAC;YACvF,CAAC;YACD,8DAA8D;YAC9D,iDAAiD;YACjD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACjF,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,WAAW,CACf,KAAa;YAEb,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACxC,CAAC;QAED,wEAAwE;QACxE,KAAK,CAAC,eAAe,CACnB,KAAa;YAEb,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC5C,CAAC;QAED,gEAAgE;QAChE,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,eAAuB,EACvB,IAAqC;YAErC,IAAI,CAAC;gBACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,YAAY,CAClD,KAAK,EACL,eAAe,EACf,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,IAAqC,CAC3C,CAAC;gBACF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;wBACxB,MAAM,EAAE,KAAK;wBACb,UAAU,EAAE,MAAM;wBAClB,QAAQ,EAAE,eAAe;wBACzB,MAAM,EAAE,gBAAgB;wBACxB,aAAa,EAAE,YAAY;wBAC3B,WAAW,EAAE,UAAU,CAAC,EAAE;wBAC1B,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;wBAC/C,UAAU,EAAE,IAAI;wBAChB,MAAM,EAAE,SAAS;qBAClB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;oBACnC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,KAAK,CAAC,gBAAgB,CACpB,KAAa,EACb,YAAoB;YAEpB,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAClE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAClD,CAAC;QAED,oEAAoE;QACpE,KAAK,CAAC,gBAAgB,CACpB,KAAa,EACb,YAAoB,EACpB,SAAiB,EACjB,IAAsB;YAEtB,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC7E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;oBACnC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,YAAoB;YAEpB,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;gBACnD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;oBACnC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,UAAkB,EAClB,IAA0B;YAE1B,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACrE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;wBACxB,MAAM,EAAE,KAAK;wBACb,UAAU,EAAE,MAAM;wBAClB,QAAQ,EAAE,UAAU;wBACpB,MAAM,EAAE,2BAA2B;wBACnC,aAAa,EAAE,KAAK;wBACpB,WAAW,EAAE,KAAK;wBAClB,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;wBAChD,UAAU,EAAE,IAAI;wBAChB,MAAM,EAAE,SAAS;qBAClB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;oBACnC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cloud/routes/usage-routes.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Usage Dashboard Routes (S-7.4)
+ *
+ * Express-compatible route handlers for usage data.
+ * Mounted at /api/cloud/orgs/:orgId/usage
+ */
+import type { MigrationClient } from '../migrate.js';
+export interface UsageRoutesDeps {
+    db: MigrationClient;
+}
+export declare function createUsageRouteHandlers(deps: UsageRoutesDeps): {
+    /** GET /api/cloud/orgs/:orgId/usage?range=30d */
+    getUsage(orgId: string, range?: string): Promise<{
+        status: number;
+        body: unknown;
+    }>;
+};
+//# sourceMappingURL=usage-routes.d.ts.map

package/dist/cloud/routes/usage-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-routes.d.ts","sourceRoot":"","sources":["../../../src/cloud/routes/usage-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,eAAe,CAAC;CACrB;AAiBD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe;IAE1D,iDAAiD;oBAExC,MAAM,UACN,MAAM,GACZ,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;EAwDhD"}