@agilesyndrome/cf-genai-base 4.1.2 → 5.0.0

package/src/ui/react/admin-access.jsx

@@ -0,0 +1,29 @@
+import { useState } from "react";
+import { apiJson } from "../../api/client.js";
+import { ResourceState, useApiResource } from "./foundation.jsx";
+
+export function UserManagement() {
+  const users = useApiResource("/api/admin/users");
+  const scopes = useApiResource("/api/admin/scopes");
+  const tenants = useApiResource("/api/admin/tenants");
+  const reload = () => Promise.all([users.reload(), scopes.reload(), tenants.reload()]);
+  const options = { scopes: scopes.value?.scopes || [], tenants: tenants.value?.tenants || [] };
+  return <section className="cf-ui-card"><h1>User access</h1><ResourceState loading={users.loading || scopes.loading || tenants.loading} error={users.error || scopes.error || tenants.error} empty="No users registered.">{(users.value?.users || []).length ? <div className="cf-ui-table-wrap"><table><thead><tr><th>User</th><th>Tenants</th><th>Scopes</th><th>Save</th></tr></thead><tbody>{users.value.users.map((user) => <UserRow key={user.id} user={user} options={options} onSaved={reload} />)}</tbody></table></div> : null}</ResourceState></section>;
+}
+
+function UserRow({ user, options, onSaved }) {
+  const [selectedScopes, setSelectedScopes] = useStateSet(user.scopes);
+  const [selectedTenants, setSelectedTenants] = useStateSet((user.tenants || []).map((tenant) => tenant.id));
+  const [saving, setSaving] = useState(false);
+  const save = async () => { setSaving(true); try { await Promise.all([apiJson(`/api/admin/users/${encodeURIComponent(user.id)}/scopes`, { scopes: [...selectedScopes] }, { method: "PUT" }), apiJson(`/api/admin/users/${encodeURIComponent(user.id)}/tenants`, { tenants: [...selectedTenants] }, { method: "PUT" })]); await onSaved(); } finally { setSaving(false); } };
+  return <tr><th scope="row">{user.display_name || user.email || "Unnamed user"}<small>{user.email || "No email"}</small></th><td><CheckList items={options.tenants} selected={selectedTenants} onChange={setSelectedTenants} valueKey="id" labelKey="name" /></td><td><CheckList items={options.scopes} selected={selectedScopes} onChange={setSelectedScopes} valueKey="name" labelKey="label" /></td><td><button type="button" disabled={saving} onClick={save}>{saving ? "Saving…" : "Save"}</button></td></tr>;
+}
+
+function CheckList({ items, selected, onChange, valueKey, labelKey }) {
+  return <div className="cf-ui-check-list">{items.map((item) => { const value = item[valueKey]; return <label key={value}><input type="checkbox" checked={selected.has(value)} onChange={(event) => { const next = new Set(selected); if (event.target.checked) next.add(value); else next.delete(value); onChange(next); }} />{item[labelKey] || value}</label>; })}</div>;
+}
+
+function useStateSet(initial = []) {
+  const [value, setValue] = useState(() => new Set(initial || []));
+  return [value, setValue];
+}

package/src/ui/react/admin-catalogs.jsx

@@ -0,0 +1,39 @@
+import { apiJson } from "../../api/client.js";
+import { useLiveEvent } from "./live-events.jsx";
+import { ResourceState, StatusBadge, useApiResource, useMutation } from "./foundation.jsx";
+
+export function FeatureCatalog() {
+  const resource = useApiResource("/api/admin/features");
+  useLiveEvent((event) => ["healthcheck", "circuit"].some((word) => String(event.what || "").includes(word)), resource.reload);
+  const features = resource.value?.features || [];
+  return <section className="cf-ui-card"><header><h1>Installed features</h1><p>Runtime modules, package versions, healthchecks, and circuit breakers.</p></header><ResourceState {...resource} empty="No features registered.">{features.length ? <div className="cf-ui-table-wrap"><table><thead><tr><th>Feature</th><th>Package/version</th><th>Health</th><th>Roll-up</th><th>Healthchecks</th><th>Breakers</th></tr></thead><tbody>{features.map((item) => <tr key={item.feature}><th scope="row">{item.display_name || item.feature}<small>{item.feature}</small></th><td>{item.package_name || "Unknown package"}<br />{item.version || "Unknown version"}</td><td><StatusBadge state={item.health} /></td><td>{item.circuit_breaker ? <StatusBadge state={item.circuit_breaker.state} /> : "None"}</td><td><CatalogList items={item.healthchecks} /></td><td><CatalogList items={item.circuit_breakers} /></td></tr>)}</tbody></table></div> : null}</ResourceState></section>;
+}
+
+export function HealthcheckCatalog() {
+  const resource = useApiResource("/api/admin/healthchecks");
+  const items = resource.value?.healthchecks || [];
+  return <section className="cf-ui-card"><h1>Healthchecks</h1><ResourceState {...resource} empty="No healthchecks registered.">{items.length ? <div className="cf-ui-card-grid">{items.map((item) => <article className="cf-ui-card" key={item.id}><h2>{item.display_name}</h2><StatusBadge state={item.state} /><p>{item.feature} / {item.component}</p></article>)}</div> : null}</ResourceState></section>;
+}
+
+export function CircuitBreakerCatalog() {
+  const resource = useApiResource("/api/admin/circuit-breakers");
+  const items = resource.value?.circuit_breakers || [];
+  const update = async (item, state) => { await apiJson(`/api/admin/circuit-breakers/${encodeURIComponent(item.id)}`, { state }, { method: "PUT" }); await resource.reload(); };
+  return <section className="cf-ui-card"><h1>Circuit breakers</h1><ResourceState {...resource} empty="No circuit breakers registered.">{items.length ? <div className="cf-ui-list">{items.map((item) => <article className="cf-ui-breaker" key={item.id}><div><h2>{item.display_name}</h2><small>{item.feature}/{item.name}</small></div><StatusBadge state={item.state} /><div className="cf-ui-actions">{["off", "tripped", "on"].map((state) => <button type="button" key={state} disabled={item.state === state} onClick={() => update(item, state)}>{state}</button>)}</div></article>)}</div> : null}</ResourceState></section>;
+}
+
+export function ScopeCatalog() {
+  const resource = useApiResource("/api/admin/scopes");
+  const scopes = resource.value?.scopes || [];
+  return <section className="cf-ui-card"><h1>Scopes</h1><ResourceState {...resource} empty="No scopes registered.">{scopes.length ? <ul className="cf-ui-list">{scopes.map((scope) => <li key={scope.name}><strong>{scope.label || scope.name}</strong><small>{scope.name}</small><p>{scope.description}</p></li>)}</ul> : null}</ResourceState></section>;
+}
+
+export function GroupCatalog() {
+  const resource = useApiResource("/api/admin/groups");
+  const groups = resource.value?.groups || [];
+  return <section className="cf-ui-card"><h1>Groups</h1><ResourceState {...resource} empty="No groups registered.">{groups.length ? <ul className="cf-ui-list">{groups.map((group) => <li key={group.id || group.name}><strong>{group.display_name || group.name}</strong><small>{group.name}</small></li>)}</ul> : null}</ResourceState></section>;
+}
+
+function CatalogList({ items = [] }) {
+  return items.length ? <ul className="cf-ui-inline-list">{items.map((item) => <li key={item.id || item.name}><strong>{item.display_name || item.name}</strong>: <StatusBadge state={item.state} /></li>)}</ul> : <span>None registered</span>;
+}

package/src/ui/react/admin-shell.jsx

@@ -0,0 +1,17 @@
+const SYSTEM_LINKS = [
+  ["Overview", "/admin", "home"],
+  ["Users", "/admin/users", "users"],
+  ["Scopes", "/admin/scopes", "scopes"],
+  ["Groups", "/admin/groups", "groups"],
+  ["Features", "/admin/features", "features"],
+  ["Healthchecks", "/admin/healthchecks", "healthchecks"],
+  ["Circuit breakers", "/admin/circuit-breakers", "circuit-breakers"],
+];
+
+export function AdminShell({ children, active = "", applicationLinks = [], title = "Administration" }) {
+  return <div className="cf-ui-admin-shell"><aside className="cf-ui-admin-nav"><p className="cf-ui-admin-title">{title}</p><nav aria-label="Administration"><section><p className="cf-ui-nav-label">Application</p>{applicationLinks.map((link) => <AdminLink key={link.href} link={link} active={active} />)}</section><section><p className="cf-ui-nav-label">System</p>{SYSTEM_LINKS.map(([label, href, key]) => <AdminLink key={href} link={{ label, href, key }} active={active} />)}</section></nav></aside><main className="cf-ui-admin-content">{children}</main></div>;
+}
+
+export function AdminLink({ link, active }) {
+  return <a href={link.href} aria-current={link.key === active ? "page" : undefined}>{link.label}</a>;
+}

package/src/ui/react/foundation.jsx

@@ -0,0 +1,40 @@
+import { useCallback, useEffect, useState } from "react";
+import { apiFetch, apiJson } from "../../api/client.js";
+
+export function useApiResource(path, { enabled = true, initialValue = null } = {}) {
+  const [value, setValue] = useState(initialValue);
+  const [loading, setLoading] = useState(Boolean(enabled));
+  const [error, setError] = useState(null);
+  const reload = useCallback(async () => {
+    if (!enabled) return null;
+    setLoading(true);
+    try { const next = await apiFetch(path); setValue(next); setError(null); return next; }
+    catch (cause) { setError(cause); throw cause; }
+    finally { setLoading(false); }
+  }, [enabled, path]);
+  useEffect(() => { reload().catch(() => {}); }, [reload]);
+  return { value, setValue, loading, error, reload };
+}
+
+export function useMutation(path, { method = "POST" } = {}) {
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState(null);
+  const mutate = useCallback(async (payload = {}) => {
+    setLoading(true);
+    try { const result = await apiJson(path, payload, { method }); setError(null); return result; }
+    catch (cause) { setError(cause); throw cause; }
+    finally { setLoading(false); }
+  }, [method, path]);
+  return { mutate, loading, error };
+}
+
+export function ResourceState({ loading, error, empty = "Nothing to show.", children }) {
+  if (loading) return <p className="cf-ui-status" role="status">Loading…</p>;
+  if (error) return <p className="cf-ui-error" role="alert">{error.message || "Unable to load data."}</p>;
+  return children || <p className="cf-ui-status">{empty}</p>;
+}
+
+export function StatusBadge({ state }) {
+  const value = String(state || "unknown").toLowerCase();
+  return <span className={`cf-ui-status-badge cf-ui-status-${value}`}>{value}</span>;
+}

package/src/ui/react/index.jsx

@@ -0,0 +1,6 @@
+export * from "./foundation.jsx";
+export * from "./live-events.jsx";
+export * from "./jobs.jsx";
+export * from "./admin-shell.jsx";
+export * from "./admin-catalogs.jsx";
+export * from "./admin-access.jsx";

package/src/ui/react/jobs.jsx

@@ -0,0 +1,63 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { apiFetch } from "../../api/client.js";
+import { useLiveEvent, useLiveEvents } from "./live-events.jsx";
+
+function jobQuery(filters) {
+  const query = new URLSearchParams();
+  for (const [key, value] of Object.entries(filters || {})) if (value !== undefined && value !== null && value !== "") query.set(key, value);
+  return query.toString() ? `/api/jobs?${query}` : "/api/jobs";
+}
+
+export function useJobs(filters = {}) {
+  const key = useMemo(() => JSON.stringify(filters), [filters]);
+  const path = useMemo(() => jobQuery(JSON.parse(key)), [key]);
+  const [jobs, setJobs] = useState([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState(null);
+  const { connection } = useLiveEvents();
+  const reload = useCallback(async () => {
+    setLoading(true);
+    try { const result = await apiFetch(path); setJobs(result.jobs || []); setError(null); }
+    catch (cause) { setError(cause); }
+    finally { setLoading(false); }
+  }, [path]);
+  useEffect(() => { reload(); }, [reload]);
+  useEffect(() => { if (connection === "open") reload(); }, [connection, reload]);
+  useLiveEvent((event) => String(event.what || "").startsWith("job."), reload);
+  return { jobs, loading, error, reload };
+}
+
+export function useJob(jobId) {
+  const [job, setJob] = useState(null);
+  const [loading, setLoading] = useState(Boolean(jobId));
+  const [error, setError] = useState(null);
+  const reload = useCallback(async () => {
+    if (!jobId) return null;
+    setLoading(true);
+    try { const result = await apiFetch(`/api/jobs/${encodeURIComponent(jobId)}`); setJob(result.job); setError(null); return result.job; }
+    catch (cause) { setError(cause); throw cause; }
+    finally { setLoading(false); }
+  }, [jobId]);
+  useEffect(() => { reload().catch(() => {}); }, [reload]);
+  useLiveEvent((event) => event.details?.jobId === jobId, () => { reload().catch(() => {}); });
+  return { job, loading, error, reload };
+}
+
+export function useJobNotifications({ limit = 20 } = {}) {
+  const { jobs, loading, error, reload } = useJobs({ limit });
+  const [dismissed, setDismissed] = useState(() => new Set());
+  const notifications = jobs.filter((job) => ["succeeded", "failed", "cancelled"].includes(job.status) && !dismissed.has(job.id));
+  const dismiss = useCallback((jobId) => setDismissed((current) => new Set([...current, jobId])), []);
+  return { notifications, loading, error, dismiss, reload };
+}
+
+export function JobNotificationBanner({ job, onDismiss }) {
+  const failed = job.status === "failed";
+  const cancelled = job.status === "cancelled";
+  const message = failed ? `${job.type} failed.` : cancelled ? `${job.type} was cancelled.` : `${job.type} finished.`;
+  return <aside className={`cf-ui-job-banner cf-ui-job-${job.status}`} role="status" aria-live="polite"><span>{message}</span><button type="button" onClick={() => onDismiss?.(job.id)} aria-label="Dismiss notification">Dismiss</button></aside>;
+}
+
+export function JobNotificationList({ notifications, onDismiss }) {
+  return <>{notifications.map((job) => <JobNotificationBanner key={job.id} job={job} onDismiss={onDismiss} />)}</>;
+}

package/src/ui/react/live-events.jsx

@@ -0,0 +1,55 @@
+import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
+
+const LiveEventsContext = createContext(null);
+
+export function LiveEventsProvider({ children, url = "/api/events", enabled = true }) {
+  const listeners = useRef(new Set());
+  const [connection, setConnection] = useState(enabled ? "connecting" : "disabled");
+  const subscribe = useCallback((listener) => { listeners.current.add(listener); return () => listeners.current.delete(listener); }, []);
+  useEffect(() => {
+    if (!enabled || typeof WebSocket === "undefined") { setConnection(enabled ? "unsupported" : "disabled"); return undefined; }
+    let socket;
+    let timer;
+    let stopped = false;
+    let attempts = 0;
+    const connect = () => {
+      if (stopped) return;
+      const target = new URL(url, window.location.href);
+      target.protocol = target.protocol === "https:" ? "wss:" : "ws:";
+      socket = new WebSocket(target);
+      socket.onopen = () => { attempts = 0; setConnection("open"); };
+      socket.onmessage = ({ data }) => {
+        try {
+          const payload = JSON.parse(data);
+          const event = payload.event || payload;
+          if (event?.id) for (const listener of listeners.current) listener(event);
+        } catch { /* Ignore malformed transport messages. */ }
+      };
+      socket.onerror = () => setConnection("error");
+      socket.onclose = () => {
+        if (stopped) return;
+        setConnection("reconnecting");
+        const delay = Math.min(30000, 500 * (2 ** attempts++));
+        timer = setTimeout(connect, delay);
+      };
+    };
+    connect();
+    return () => { stopped = true; clearTimeout(timer); socket?.close(); setConnection("closed"); };
+  }, [enabled, url]);
+  const value = useMemo(() => ({ connection, subscribe }), [connection, subscribe]);
+  return <LiveEventsContext.Provider value={value}>{children}</LiveEventsContext.Provider>;
+}
+
+export function useLiveEvents() {
+  const value = useContext(LiveEventsContext);
+  return value || { connection: "unavailable", subscribe: () => () => {} };
+}
+
+export function useLiveEvent(matcher, callback) {
+  const { subscribe } = useLiveEvents();
+  const matcherRef = useRef(matcher);
+  const callbackRef = useRef(callback);
+  matcherRef.current = matcher;
+  callbackRef.current = callback;
+  useEffect(() => subscribe((event) => { if (!matcherRef.current || matcherRef.current(event)) callbackRef.current(event); }), [subscribe]);
+}

package/src/ui/styles.css

@@ -7,3 +7,37 @@
   --cf-ui-primary: #2f6f52;
   --cf-ui-danger: #a33b32;
 }
+
+.cf-ui-admin-shell { display: grid; grid-template-columns: 220px minmax(0, 1fr); min-height: 100%; gap: 1.5rem; color: var(--cf-ui-text); font: 15px/1.45 system-ui, sans-serif; }
+.cf-ui-admin-nav { padding: 1rem; border-right: 1px solid var(--cf-ui-border); }
+.cf-ui-admin-nav nav, .cf-ui-admin-nav section { display: grid; gap: .2rem; }
+.cf-ui-admin-nav section + section { margin-top: 1.5rem; }
+.cf-ui-admin-nav a { padding: .5rem .65rem; border-radius: .45rem; color: inherit; text-decoration: none; }
+.cf-ui-admin-nav a:hover, .cf-ui-admin-nav a[aria-current="page"] { background: var(--cf-ui-surface); color: var(--cf-ui-primary); }
+.cf-ui-admin-title, .cf-ui-nav-label { margin: 0 0 .5rem; font-weight: 700; }
+.cf-ui-nav-label { color: var(--cf-ui-muted); font-size: .72rem; letter-spacing: .08em; text-transform: uppercase; }
+.cf-ui-admin-content { min-width: 0; padding: 2rem 1rem; }
+.cf-ui-card { padding: 1rem; border: 1px solid var(--cf-ui-border); border-radius: .65rem; background: var(--cf-ui-bg); }
+.cf-ui-card + .cf-ui-card { margin-top: 1rem; }
+.cf-ui-card-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 1rem; }
+.cf-ui-table-wrap { overflow-x: auto; }
+.cf-ui-card table { width: 100%; border-collapse: collapse; }
+.cf-ui-card th, .cf-ui-card td { padding: .7rem; border-bottom: 1px solid var(--cf-ui-border); text-align: left; vertical-align: top; }
+.cf-ui-card th small, .cf-ui-card td small, .cf-ui-list small { display: block; color: var(--cf-ui-muted); font-weight: 400; }
+.cf-ui-status, .cf-ui-card p { color: var(--cf-ui-muted); }
+.cf-ui-error { color: var(--cf-ui-danger); }
+.cf-ui-status-badge { font-weight: 700; text-transform: capitalize; }
+.cf-ui-status-green, .cf-ui-status-on, .cf-ui-job-succeeded { color: #26734d; }
+.cf-ui-status-yellow { color: #9a6b00; }
+.cf-ui-status-red, .cf-ui-status-tripped, .cf-ui-job-failed { color: var(--cf-ui-danger); }
+.cf-ui-status-off, .cf-ui-status-cancelled { color: var(--cf-ui-muted); }
+.cf-ui-list, .cf-ui-inline-list, .cf-ui-check-list { display: grid; gap: .5rem; margin: 0; padding: 0; list-style: none; }
+.cf-ui-inline-list { gap: .2rem; }
+.cf-ui-breaker { display: grid; grid-template-columns: minmax(0, 1fr) auto auto; align-items: center; gap: .75rem; padding: .75rem 0; border-bottom: 1px solid var(--cf-ui-border); }
+.cf-ui-actions { display: flex; flex-wrap: wrap; gap: .35rem; }
+.cf-ui-card button { padding: .45rem .65rem; border: 1px solid var(--cf-ui-border); border-radius: .4rem; background: var(--cf-ui-bg); color: inherit; cursor: pointer; }
+.cf-ui-card button:disabled { cursor: wait; opacity: .6; }
+.cf-ui-check-list label { display: flex; align-items: center; gap: .35rem; }
+.cf-ui-job-banner { display: flex; align-items: center; justify-content: space-between; gap: 1rem; position: fixed; right: 1rem; bottom: 1rem; z-index: 10; max-width: min(32rem, calc(100vw - 2rem)); padding: .8rem 1rem; border: 1px solid var(--cf-ui-border); border-radius: .6rem; background: var(--cf-ui-bg); box-shadow: 0 .5rem 2rem #0002; }
+.cf-ui-job-banner button { border: 0; background: transparent; color: inherit; cursor: pointer; text-decoration: underline; }
+@media (max-width: 720px) { .cf-ui-admin-shell { grid-template-columns: 1fr; } .cf-ui-admin-nav { border-right: 0; border-bottom: 1px solid var(--cf-ui-border); } .cf-ui-breaker { grid-template-columns: 1fr; } }

package/src/authorization.js

@@ -1,188 +0,0 @@
-import { createD1 } from "./core.js";
-
-export const AUTH_USER_TABLE = "auth_users";
-export const AUTH_SCOPE_TABLE = "auth_scopes";
-export const AUTH_GRANT_TABLE = "auth_user_scopes";
-export const DEFAULT_TENANT_ID = "easley-family";
-export const DEFAULT_TENANT_NAME = "Easley Family";
-
-export class SubscriptionError extends Error {
-  constructor(message) { super(message); this.name = "SubscriptionError"; }
-}
-
-export function normalizeScopes(scopes = []) {
-  return scopes.map((scope) => typeof scope === "string" ? { name: scope, label: scope, description: "", system: false } : scope)
-    .filter((scope) => scope && /^[a-z0-9]+(?::[a-z0-9-]+)+$/.test(String(scope.name || "")))
-    .map((scope) => ({ name: String(scope.name), label: String(scope.label || scope.name), description: String(scope.description || ""), system: Boolean(scope.system) }));
-}
-
-export async function ensureScopes(env, scopes = [], { who = "system:read" } = {}) {
-  if (!env?.DB) return;
-  const db = createD1(env, { who });
-  for (const scope of normalizeScopes(scopes)) {
-    await db.prepare(`INSERT INTO ${AUTH_SCOPE_TABLE} (name,label,description,system) VALUES (?,?,?,?) ON CONFLICT(name) DO UPDATE SET label=excluded.label,description=excluded.description,system=excluded.system`).bind(scope.name, scope.label, scope.description, scope.system ? 1 : 0).run();
-  }
-}
-
-export async function ensureUser(env, user, { who = "system:read" } = {}) {
-  if (!env?.DB || !user?.sub) return null;
-  const db = createD1(env, { who });
-  const provider = String(user.auth_strategy || "oauth");
-  const subject = String(user.sub);
-  const email = String(user.email || "").trim().toLowerCase();
-  const existing = await db.prepare(`SELECT * FROM ${AUTH_USER_TABLE} WHERE provider=? AND subject=?`).bind(provider, subject).first();
-  const bootstrap = new Set(String(env.AUTH_ADMIN_EMAILS || env.ADMIN_EMAILS || "").split(",").map((value) => value.trim().toLowerCase()).filter(Boolean));
-  const bootstrapAdmin = user.email_verified === true && bootstrap.has(email);
-  if (existing) {
-    await db.prepare(`UPDATE ${AUTH_USER_TABLE} SET email=?,display_name=?,is_admin=CASE WHEN is_admin=1 OR ? THEN 1 ELSE 0 END,updated_at=CURRENT_TIMESTAMP WHERE id=?`).bind(email, String(user.name || email || subject), bootstrapAdmin ? 1 : 0, existing.id).run();
-    await ensureDefaultTenantMembership(db, existing.id);
-    return { ...existing, email, display_name: String(user.name || email || subject), is_admin: Boolean(existing.is_admin || bootstrapAdmin) };
-  }
-  const id = await stableId(`${provider}:${subject}`);
-  await db.prepare(`INSERT INTO ${AUTH_USER_TABLE} (id,provider,subject,email,display_name,is_admin) VALUES (?,?,?,?,?,?) ON CONFLICT(provider,subject) DO NOTHING`).bind(id, provider, subject, email, String(user.name || email || subject), bootstrapAdmin ? 1 : 0).run();
-  await ensureDefaultTenantMembership(db, id);
-  return await db.prepare(`SELECT * FROM ${AUTH_USER_TABLE} WHERE id=?`).bind(id).first();
-}
-
-async function ensureDefaultTenantMembership(db, userId) {
-  await db.batch([
-    db.prepare("INSERT OR IGNORE INTO auth_tenants (id,name) VALUES (?,?)").bind(DEFAULT_TENANT_ID, DEFAULT_TENANT_NAME),
-    db.prepare("INSERT OR IGNORE INTO auth_user_tenants (user_id,tenant_id) VALUES (?,?)").bind(userId, DEFAULT_TENANT_ID)
-  ]);
-}
-
-export async function listUserTenants(env, userId, { who = "system:read" } = {}) {
-  const db = createD1(env, { who });
-  const { results } = await db.prepare(`SELECT t.id,t.name,t.created_at,t.updated_at FROM auth_tenants t JOIN auth_user_tenants ut ON ut.tenant_id=t.id WHERE ut.user_id=? ORDER BY t.name COLLATE NOCASE`).bind(userId).all();
-  return results || [];
-}
-
-export async function listTenantSubscriptions(env, tenantId, { who = "system:read" } = {}) {
-  const db = createD1(env, { who });
-  const { results } = await db.prepare(`SELECT s.id,s.name,s.created_at,s.updated_at FROM auth_subscriptions s JOIN auth_tenant_subscriptions ts ON ts.subscription_id=s.id WHERE ts.tenant_id=? ORDER BY s.name COLLATE NOCASE`).bind(tenantId).all();
-  return Promise.all((results || []).map(async (subscription) => ({ ...subscription, entitlements: await listSubscriptionEntitlements(env, subscription.id, { who }) })));
-}
-
-export async function listSubscriptionEntitlements(env, subscriptionId, { who = "system:read" } = {}) {
-  const db = createD1(env, { who });
-  const { results } = await db.prepare("SELECT entitlement,value_json FROM auth_subscription_entitlements WHERE subscription_id=? ORDER BY entitlement").bind(subscriptionId).all();
-  return (results || []).map((row) => ({ entitlement: row.entitlement, value: parseJsonValue(row.value_json) }));
-}
-
-export function normalizeSubscriptionManifest(manifest = []) {
-  return manifest.map((subscription) => ({
-    id: String(subscription?.id || "").trim(),
-    name: String(subscription?.name || subscription?.id || "").trim(),
-    entitlements: Object.fromEntries(Object.entries(subscription?.entitlements || {}).map(([key, value]) => [String(key), value])),
-  })).filter((subscription) => /^[a-z0-9][a-z0-9_-]*$/.test(subscription.id) && subscription.name);
-}
-
-export async function ensureSubscriptionManifest(env, manifest = [], { who = "system:update" } = {}) {
-  if (!env?.DB) return;
-  const db = createD1(env, { who });
-  for (const subscription of normalizeSubscriptionManifest(manifest)) {
-    await db.prepare("INSERT INTO auth_subscriptions (id,name) VALUES (?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,updated_at=CURRENT_TIMESTAMP").bind(subscription.id, subscription.name).run();
-    for (const [entitlement, value] of Object.entries(subscription.entitlements)) {
-      await db.prepare("INSERT INTO auth_subscription_entitlements (subscription_id,entitlement,value_json) VALUES (?,?,?) ON CONFLICT(subscription_id,entitlement) DO UPDATE SET value_json=excluded.value_json,updated_at=CURRENT_TIMESTAMP").bind(subscription.id, entitlement, JSON.stringify(value)).run();
-    }
-  }
-}
-
-export async function hasSubscription(env, tenantId, subscriptionId, { who = "system:read" } = {}) {
-  const db = createD1(env, { who });
-  return Boolean(await db.prepare("SELECT 1 FROM auth_tenant_subscriptions WHERE tenant_id=? AND subscription_id=?").bind(tenantId, subscriptionId).first());
-}
-
-export async function requireSubscription(env, tenantId, subscriptionId, { who = "system:read" } = {}) {
-  if (!await hasSubscription(env, tenantId, subscriptionId, { who })) throw new SubscriptionError("Required subscription is not active for this tenant.");
-  return true;
-}
-
-export async function hasEntitlement(env, tenantId, entitlement, expectedValue, { who = "system:read" } = {}) {
-  const db = createD1(env, { who });
-  const rows = await db.prepare("SELECT e.value_json FROM auth_subscription_entitlements e JOIN auth_tenant_subscriptions ts ON ts.subscription_id=e.subscription_id WHERE ts.tenant_id=? AND e.entitlement=?").bind(tenantId, entitlement).all();
-  return (rows.results || []).some((row) => expectedValue === undefined || deepEqual(parseJsonValue(row.value_json), expectedValue));
-}
-
-export async function requireEntitlement(env, tenantId, entitlement, expectedValue, { who = "system:read" } = {}) {
-  if (!await hasEntitlement(env, tenantId, entitlement, expectedValue, { who })) throw new SubscriptionError(`Required entitlement is not active: ${entitlement}.`);
-  return true;
-}
-
-export async function createImpersonationToken(env, adminUserId, targetUserId, { ttlSeconds = 900 } = {}) {
-  if (!env?.AUTH_SESSION_SECRET) throw new Error("AUTH_SESSION_SECRET is required for impersonation.");
-  const payload = { adminUserId: String(adminUserId || "admin"), targetUserId: String(targetUserId), exp: Math.floor(Date.now() / 1000) + Math.min(Math.max(Number(ttlSeconds) || 900, 60), 3600) };
-  const encoded = base64url(new TextEncoder().encode(JSON.stringify(payload)));
-  return `${encoded}.${await signValue(encoded, env?.AUTH_SESSION_SECRET || "")}`;
-}
-
-export async function verifyImpersonationToken(token, env) {
-  if (!env?.AUTH_SESSION_SECRET) return null;
-  const [encoded, signature] = String(token || "").split(".");
-  if (!encoded || !signature || !constantTimeEqual(signature, await signValue(encoded, env?.AUTH_SESSION_SECRET || ""))) return null;
-  try {
-    const payload = JSON.parse(new TextDecoder().decode(base64urlDecode(encoded)));
-    return payload.exp > Date.now() / 1000 && payload.targetUserId ? payload : null;
-  } catch { return null; }
-}
-
-export async function hasScope(env, user, scope, { who = "system:read" } = {}) {
-  const db = createD1(env, { who });
-  if (user?.auth_strategy === "http_basic") return true;
-  const authUser = await ensureUser(env, user, { who });
-  if (!authUser) return false;
-  if (Boolean(authUser.is_admin)) return true;
-  return Boolean(await db.prepare(`SELECT 1 FROM ${AUTH_GRANT_TABLE} WHERE user_id=? AND scope_name=?`).bind(authUser.id, scope).first());
-}
-
-export async function listAuthorizationUsers(env, { who = "system:read" } = {}) {
-  const db = createD1(env, { who });
-  const { results } = await db.prepare(`SELECT id,email,display_name,provider,subject,is_admin,created_at,updated_at FROM ${AUTH_USER_TABLE} ORDER BY email COLLATE NOCASE`).all();
-  return Promise.all(results.map(async (user) => ({ ...user, scopes: (await listUserGrants(env, user.id, { who })).map((grant) => grant.scope_name) })));
-}
-
-export async function getAuthorizationUser(env, userId, { who = "system:read" } = {}) {
-  const db = createD1(env, { who });
-  return db.prepare(`SELECT id,email,display_name,provider,subject,is_admin,created_at,updated_at FROM ${AUTH_USER_TABLE} WHERE id=?`).bind(userId).first();
-}
-
-export async function listAuthorizationScopes(env, { who = "system:read" } = {}) {
-  const db = createD1(env, { who });
-  const { results } = await db.prepare(`SELECT name,label,description,system FROM ${AUTH_SCOPE_TABLE} ORDER BY name`).all();
-  return results;
-}
-
-export async function listGroups(env, { who = "system:read" } = {}) { const db = createD1(env, { who }); const result = await db.prepare("SELECT name,display_name,description,created_at,updated_at FROM auth_groups ORDER BY display_name COLLATE NOCASE").all(); return result.results || []; }
-
-export async function listUserGroups(env, userId, { who = "system:read" } = {}) { const db = createD1(env, { who }); const result = await db.prepare("SELECT group_name,granted_at FROM auth_user_groups WHERE user_id=? ORDER BY group_name").bind(userId).all(); return result.results || []; }
-
-export async function replaceUserGroups(env, userId, groups, grantedBy, { who = "system:read" } = {}) { const db = createD1(env, { who }); await db.batch([db.prepare("DELETE FROM auth_user_groups WHERE user_id=?").bind(userId), ...[...new Set(groups)].map((group) => db.prepare("INSERT INTO auth_user_groups (user_id,group_name,granted_by) VALUES (?,?,?)").bind(userId, group, grantedBy || null))]); return listUserGroups(env, userId, { who }); }
-
-export async function listUserGrants(env, userId, { who = "system:read" } = {}) {
-  const db = createD1(env, { who });
-  const { results } = await db.prepare(`SELECT scope_name,granted_at FROM ${AUTH_GRANT_TABLE} WHERE user_id=? ORDER BY scope_name`).bind(userId).all();
-  return results;
-}
-
-export async function replaceUserGrants(env, userId, scopes, grantedBy, { who = "system:read" } = {}) {
-  const valid = new Set((await listAuthorizationScopes(env, { who })).map((scope) => scope.name));
-  const db = createD1(env, { who });
-  const requested = [...new Set(scopes)].filter((scope) => valid.has(scope));
-  await db.batch([
-    db.prepare(`DELETE FROM ${AUTH_GRANT_TABLE} WHERE user_id=?`).bind(userId),
-    ...requested.map((scope) => db.prepare(`INSERT INTO ${AUTH_GRANT_TABLE} (user_id,scope_name,granted_by) VALUES (?,?,?)`).bind(userId, scope, grantedBy || null))
-  ]);
-  return requested;
-}
-
-async function stableId(value) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 32);
-}
-
-function parseJsonValue(value) { try { return JSON.parse(value); } catch { return value; } }
-function deepEqual(left, right) { return JSON.stringify(left) === JSON.stringify(right); }
-async function signValue(value, secret) { const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(String(secret)), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]); const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(value)); return base64url(new Uint8Array(signature)); }
-function base64url(bytes) { return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", ""); }
-function base64urlDecode(value) { const padded = value.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - value.length % 4) % 4); return Uint8Array.from(atob(padded), (char) => char.charCodeAt(0)); }
-function constantTimeEqual(left, right) { const a = new TextEncoder().encode(String(left)), b = new TextEncoder().encode(String(right)); let result = a.length ^ b.length; for (let index = 0; index < Math.max(a.length, b.length); index += 1) result |= (a[index] || 0) ^ (b[index] || 0); return result === 0; }