@agilesyndrome/cf-genai-base 5.0.1 → 5.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agilesyndrome/cf-genai-base",
-  "version": "5.0.1",
+  "version": "5.0.2",
   "type": "module",
   "bin": {
     "cf-genai": "bin/cf-genai.js"

package/src/admin/routes.js

@@ -6,7 +6,7 @@ export async function adminBoundary(request, env, ctx, next, state, { provider,
   if (!isAdminPath(url.pathname)) return next(request);
   const strategy = String(env?.AUTH_STRATEGY || "http_basic").trim().toLowerCase();
   if (strategy === "http_basic") { const user = basicUser(request, env); if (!user) return adminUnauthorized(request); state.user = user; }
-  else if (strategy === "oauth") { const user = provider?.getUser ? await provider.getUser(request, env) : null; if (!user) return oauthUnauthorized(request, url); state.user = user; }
+  else if (strategy === "oauth") { const user = Object.hasOwn(state, "user") ? state.user : provider?.getUser ? await provider.getUser(request, env) : null; if (!user) return oauthUnauthorized(request, url); state.user = user; }
   else return new Response("Unsupported AUTH_STRATEGY", { status: 500, headers: { "Cache-Control": "no-store" } });
   if (["POST", "PUT", "PATCH", "DELETE"].includes(request.method) && url.pathname.startsWith("/api/")) { const origin = request.headers.get("Origin"); if (!origin || (() => { try { return new URL(origin).origin !== url.origin; } catch { return true; } })()) return Response.json({ error: "A same-origin request is required." }, { status: 403, headers: { "Cache-Control": "no-store" } }); }
   const who = state.user?.auth_strategy === "http_basic" ? "user:admin" : `user:${state.user?.sub || "unknown"}`;

package/src/auth/oauth-single.js

@@ -35,7 +35,7 @@ export function createAuth(options = {}) {
     name: "auth", displayName: options.displayName || "Authentication", packageName: PACKAGE_NAME, version: VERSION, strategy: OAUTH_SINGLE, repositories: options.repositories || authRepositoryDefinitions,
     dataResources: options.dataResources || [], routes: options.routes || [],
     healthchecks: options.healthchecks || [], circuitBreakers: options.circuitBreakers || [],
-    async handle(request, env) {
+    async handle(request, env, _ctx, state) {
       const url = new URL(request.url);
       if (url.pathname === "/auth/login") return login(request, env);
       if (url.pathname === "/auth/callback") return callback(request, env);
@@ -45,10 +45,10 @@ export function createAuth(options = {}) {
         if (originResponse) return originResponse;
         return logout(request, env, names.session, options);
       }
-      if (url.pathname === "/api/me") return secureJson({ user: publicUser(await resolveUser(request, env)) });
+      if (url.pathname === "/api/me") return secureJson({ user: publicUser(await resolveRequestUser(request, env, state)) });
       if (!protectedPath(url.pathname) || publicPaths.some((path) => path === "/" ? url.pathname === "/" : url.pathname.startsWith(path))) return null;
       if (isMutation(request)) { const originResponse = checkOrigin(request, options.allowedOrigins); if (originResponse) return originResponse; }
-      const user = await resolveUser(request, env);
+      const user = await resolveRequestUser(request, env, state);
       if (user && options.authorize && !(await options.authorize({ request, url, user, env }))) {
         return url.pathname.startsWith("/api/") ? Response.json({ error: "Administrator access is required." }, { status: 403, headers: { "Cache-Control": "no-store" } }) : authError("Administrator access is required.", 403);
       }
@@ -59,7 +59,7 @@ export function createAuth(options = {}) {
     getUser: (request, env) => resolveUser(request, env),
     healthcheck: async (env) => ({ feature: "auth", component: "configuration", displayName: "Authentication configuration", state: Boolean(env?.DB) && [envName("issuer", "OIDC_ISSUER"), envName("clientId", "OIDC_CLIENT_ID"), envName("clientSecret", "OIDC_CLIENT_SECRET"), envName("sessionSecret", "AUTH_SESSION_SECRET")].every((key) => env?.[key] && !String(env[key]).startsWith("replace-with-")) ? "green" : "red" }),
     middleware(request, env, ctx, next, state) {
-      return this.handle(request, env, ctx).then((response) => response || next(request, env, ctx, state));
+      return this.handle(request, env, ctx, state).then((response) => response || next(request, env, ctx, state));
     },
   };
 
@@ -105,6 +105,10 @@ export function createAuth(options = {}) {
     return user;
   }
 
+  function resolveRequestUser(request, env, state) {
+    return state && Object.hasOwn(state, "user") ? state.user : resolveUser(request, env);
+  }
+
   async function resolveLoginUser(user, env, request) {
     const hydrated = await hydrateUser(user, env);
     if (options.loginAuthorize && !(await options.loginAuthorize({ user: hydrated, request, env }))) throw authError("Authentication is not currently permitted.", 403);
@@ -131,19 +135,24 @@ async function getUser(request, env, secretName = "AUTH_SESSION_SECRET", session
 async function configuration(env, options = {}) {
   const discoveryName = envNameFor(options, "discoveryUrl", "OIDC_DISCOVERY_URL");
   const configuredDiscovery = env[discoveryName];
+  const configuredIssuer = env[envNameFor(options, "issuer", "OIDC_ISSUER")];
   const discoveryUrl = configuredDiscovery ? (String(configuredDiscovery).endsWith("/.well-known/openid-configuration") ? configuredDiscovery : String(configuredDiscovery).replace(/\/+$/, "") + "/.well-known/openid-configuration") : normalizeIssuer(required(env, envNameFor(options, "issuer", "OIDC_ISSUER"))).slice(0, -1) + "/.well-known/openid-configuration";
   if (new URL(discoveryUrl).protocol !== "https:") throw new Error("OIDC discovery URL must use HTTPS");
+  const expectedIssuer = configuredIssuer ? normalizeIssuer(configuredIssuer) : issuerFromDiscoveryUrl(discoveryUrl);
+  const cacheKey = `${discoveryUrl}\0${expectedIssuer}`;
 
-  const cached = configurationCache.get(discoveryUrl); if (cached && cached.exp > Date.now()) return cached.value;
-  const existing = configurationRequests.get(discoveryUrl); if (existing) return existing;
+  const cached = configurationCache.get(cacheKey); if (cached && cached.exp > Date.now()) return cached.value;
+  const existing = configurationRequests.get(cacheKey); if (existing) return existing;
   const request = fetchWithTimeout(discoveryUrl).then(async (response) => {
     if (!response.ok) throw new Error("Unable to load OIDC configuration");
     const value = await response.json();
-    if (!value.issuer || new URL(value.issuer).protocol !== "https:") throw new Error("OIDC configuration returned an invalid issuer");
-    if (!value.jwks_uri || new URL(value.jwks_uri).protocol !== "https:") throw new Error("OIDC configuration returned an invalid JWKS URL");
-    configurationCache.set(discoveryUrl, { value, exp: Date.now() + OIDC_CACHE_MS }); return value;
-  }).finally(() => configurationRequests.delete(discoveryUrl));
-  configurationRequests.set(discoveryUrl, request); return request;
+    if (!value.issuer || new URL(value.issuer).protocol !== "https:" || normalizeIssuer(value.issuer) !== expectedIssuer) throw new Error("OIDC configuration returned an unexpected issuer");
+    requireHttpsEndpoint(value.authorization_endpoint, "authorization");
+    requireHttpsEndpoint(value.token_endpoint, "token");
+    requireHttpsEndpoint(value.jwks_uri, "JWKS");
+    configurationCache.set(cacheKey, { value, exp: Date.now() + OIDC_CACHE_MS }); return value;
+  }).finally(() => configurationRequests.delete(cacheKey));
+  configurationRequests.set(cacheKey, request); return request;
 }
 async function verify(token, config, clientId, expectedNonce) {
   const [head, body, signature] = String(token || "").split("."); if (!head || !body || !signature) throw new Error("Malformed ID token");
@@ -161,6 +170,8 @@ async function getJwks(uri) {
 }
 async function fetchWithTimeout(input, init = {}) { return fetch(input, { ...init, signal: AbortSignal.timeout(OIDC_TIMEOUT_MS) }); }
 function normalizeIssuer(value) { return String(value).replace(/\/+$/, "") + "/"; }
+function issuerFromDiscoveryUrl(value) { const url = new URL(value); url.pathname = url.pathname.replace(/\/\.well-known\/openid-configuration$/, "").replace(/\/+$/, ""); url.search = ""; url.hash = ""; return normalizeIssuer(url.href); }
+function requireHttpsEndpoint(value, label) { if (!value || new URL(value).protocol !== "https:") throw new Error(`OIDC configuration returned an invalid ${label} endpoint`); }
 function isMutation(request) { return ["POST", "PUT", "PATCH", "DELETE"].includes(request.method); }
 function checkOrigin(request, allowedOrigins = []) {
   let requestOrigin;

package/src/auth/subscriptions.js

@@ -2,6 +2,8 @@ import { createD1 } from "../core/d1.js";
 import { deepEqual, parseJsonValue } from "./encoding.js";
 import { SubscriptionError } from "./constants.js";
 
+const manifestPromises = new WeakMap();
+
 export async function listTenantSubscriptions(env, tenantId, { who = "system:read" } = {}) {
   const { results } = await createD1(env, { who }).prepare("SELECT s.id,s.name,s.created_at,s.updated_at FROM auth_subscriptions s JOIN auth_tenant_subscriptions ts ON ts.subscription_id=s.id WHERE ts.tenant_id=? ORDER BY s.name COLLATE NOCASE").bind(tenantId).all();
   return Promise.all((results || []).map(async (subscription) => ({ ...subscription, entitlements: await listSubscriptionEntitlements(env, subscription.id, { who }) })));
@@ -15,8 +17,23 @@ export async function listSubscriptionEntitlements(env, subscriptionId, { who =
 export function normalizeSubscriptionManifest(manifest = []) { return manifest.map((subscription) => ({ id: String(subscription?.id || "").trim(), name: String(subscription?.name || subscription?.id || "").trim(), entitlements: Object.fromEntries(Object.entries(subscription?.entitlements || {}).map(([key, value]) => [String(key), value])) })).filter((subscription) => /^[a-z0-9][a-z0-9_-]*$/.test(subscription.id) && subscription.name); }
 
 export async function ensureSubscriptionManifest(env, manifest = [], { who = "system:update" } = {}) {
-  if (!env?.DB) return; const db = createD1(env, { who });
-  for (const subscription of normalizeSubscriptionManifest(manifest)) { await db.prepare("INSERT INTO auth_subscriptions (id,name) VALUES (?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,updated_at=CURRENT_TIMESTAMP").bind(subscription.id, subscription.name).run(); for (const [entitlement, value] of Object.entries(subscription.entitlements)) await db.prepare("INSERT INTO auth_subscription_entitlements (subscription_id,entitlement,value_json) VALUES (?,?,?) ON CONFLICT(subscription_id,entitlement) DO UPDATE SET value_json=excluded.value_json,updated_at=CURRENT_TIMESTAMP").bind(subscription.id, entitlement, JSON.stringify(value)).run(); }
+  if (!env?.DB) return;
+  const normalized = normalizeSubscriptionManifest(manifest);
+  const key = JSON.stringify(normalized);
+  let registrations = manifestPromises.get(env.DB);
+  if (!registrations) { registrations = new Map(); manifestPromises.set(env.DB, registrations); }
+  let promise = registrations.get(key);
+  if (!promise) {
+    promise = writeSubscriptionManifest(env, normalized, who);
+    registrations.set(key, promise);
+    promise.catch(() => registrations.delete(key));
+  }
+  return promise;
+}
+
+async function writeSubscriptionManifest(env, manifest, who) {
+  const db = createD1(env, { who });
+  for (const subscription of manifest) { await db.prepare("INSERT INTO auth_subscriptions (id,name) VALUES (?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,updated_at=CURRENT_TIMESTAMP").bind(subscription.id, subscription.name).run(); for (const [entitlement, value] of Object.entries(subscription.entitlements)) await db.prepare("INSERT INTO auth_subscription_entitlements (subscription_id,entitlement,value_json) VALUES (?,?,?) ON CONFLICT(subscription_id,entitlement) DO UPDATE SET value_json=excluded.value_json,updated_at=CURRENT_TIMESTAMP").bind(subscription.id, entitlement, JSON.stringify(value)).run(); }
 }
 
 export async function hasSubscription(env, tenantId, subscriptionId, { who = "system:read" } = {}) { return Boolean(await createD1(env, { who }).prepare("SELECT 1 FROM auth_tenant_subscriptions WHERE tenant_id=? AND subscription_id=?").bind(tenantId, subscriptionId).first()); }

package/src/auth/users.js

@@ -1,15 +1,16 @@
 import { createD1 } from "../core/d1.js";
 import { AUTH_GRANT_TABLE, AUTH_USER_TABLE, DEFAULT_TENANT_ID, DEFAULT_TENANT_NAME } from "./constants.js";
-import { listUserGrants } from "./scopes.js";
-import { listUserTenants } from "./tenants.js";
 
 export async function ensureUser(env, user, { who = "system:read" } = {}) {
   if (!env?.DB || !user?.sub) return null;
-  const db = createD1(env, { who }); const provider = String(user.auth_strategy || "oauth"); const subject = String(user.sub); const email = String(user.email || "").trim().toLowerCase();
+  const db = createD1(env, { who }); const provider = String(user.auth_strategy || "oauth"); const subject = String(user.sub); const email = String(user.email || "").trim().toLowerCase(); const displayName = String(user.name || email || subject);
   const existing = await db.prepare(`SELECT * FROM ${AUTH_USER_TABLE} WHERE provider=? AND subject=?`).bind(provider, subject).first();
-  if (existing) { await db.prepare(`UPDATE ${AUTH_USER_TABLE} SET email=?,display_name=?,updated_at=CURRENT_TIMESTAMP WHERE id=?`).bind(email, String(user.name || email || subject), existing.id).run(); await ensureDefaultTenantMembership(db, existing.id); return { ...existing, email, display_name: String(user.name || email || subject), is_admin: Boolean(existing.is_admin) }; }
+  if (existing) {
+    if (existing.email !== email || existing.display_name !== displayName) await db.prepare(`UPDATE ${AUTH_USER_TABLE} SET email=?,display_name=?,updated_at=CURRENT_TIMESTAMP WHERE id=?`).bind(email, displayName, existing.id).run();
+    return { ...existing, email, display_name: displayName, is_admin: Boolean(existing.is_admin) };
+  }
   const id = await stableId(`${provider}:${subject}`);
-  await db.prepare(`INSERT INTO ${AUTH_USER_TABLE} (id,provider,subject,email,display_name,is_admin) VALUES (?,?,?,?,?,0) ON CONFLICT(provider,subject) DO NOTHING`).bind(id, provider, subject, email, String(user.name || email || subject)).run();
+  await db.prepare(`INSERT INTO ${AUTH_USER_TABLE} (id,provider,subject,email,display_name,is_admin) VALUES (?,?,?,?,?,0) ON CONFLICT(provider,subject) DO NOTHING`).bind(id, provider, subject, email, displayName).run();
   await ensureDefaultTenantMembership(db, id);
   return db.prepare(`SELECT * FROM ${AUTH_USER_TABLE} WHERE id=?`).bind(id).first();
 }
@@ -22,10 +23,18 @@ export async function hasScope(env, user, scope, { who = "system:read" } = {}) {
 }
 
 export async function listAuthorizationUsers(env, { who = "system:read" } = {}) {
-  const { results } = await createD1(env, { who }).prepare(`SELECT id,email,display_name,provider,subject,is_admin,created_at,updated_at FROM ${AUTH_USER_TABLE} ORDER BY email COLLATE NOCASE`).all();
-  return Promise.all(results.map(async (user) => ({ ...user, scopes: (await listUserGrants(env, user.id, { who })).map((grant) => grant.scope_name), tenants: await listUserTenants(env, user.id, { who }) })));
+  const db = createD1(env, { who });
+  const [{ results: users = [] }, { results: grants = [] }, { results: memberships = [] }] = await Promise.all([
+    db.prepare(`SELECT id,email,display_name,provider,subject,is_admin,created_at,updated_at FROM ${AUTH_USER_TABLE} ORDER BY email COLLATE NOCASE`).all(),
+    db.prepare(`SELECT user_id,scope_name FROM ${AUTH_GRANT_TABLE} ORDER BY user_id,scope_name`).all(),
+    db.prepare("SELECT ut.user_id,t.id,t.name,t.created_at,t.updated_at FROM auth_user_tenants ut JOIN auth_tenants t ON t.id=ut.tenant_id ORDER BY ut.user_id,t.name COLLATE NOCASE").all(),
+  ]);
+  const scopesByUser = groupRows(grants, "user_id", (grant) => grant.scope_name);
+  const tenantsByUser = groupRows(memberships, "user_id", ({ user_id: _userId, ...tenant }) => tenant);
+  return users.map((user) => ({ ...user, scopes: scopesByUser.get(user.id) || [], tenants: tenantsByUser.get(user.id) || [] }));
 }
 
 export async function getAuthorizationUser(env, userId, { who = "system:read" } = {}) { return createD1(env, { who }).prepare(`SELECT id,email,display_name,provider,subject,is_admin,created_at,updated_at FROM ${AUTH_USER_TABLE} WHERE id=?`).bind(userId).first(); }
 
 async function stableId(value) { const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)); return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 32); }
+function groupRows(rows, key, map) { const grouped = new Map(); for (const row of rows) { const values = grouped.get(row[key]) || []; values.push(map(row)); grouped.set(row[key], values); } return grouped; }

package/src/core/security.js

@@ -13,11 +13,11 @@ export async function readJsonClone(request, maxBytes = 64 * 1024) {
   const declared = Number(request.headers.get("Content-Length"));
   if (Number.isFinite(declared) && declared > maxBytes) return { error: secureJson({ error: "Request body is too large" }, 413) };
   try {
-    const value = await request.clone().json();
+    const value = await readBoundedJson(request, maxBytes);
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Object required");
-    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > maxBytes) return { error: secureJson({ error: "Request body is too large" }, 413) };
     return { value };
-  } catch {
+  } catch (error) {
+    if (error?.status === 413) return { error: secureJson({ error: "Request body is too large" }, 413) };
     return { error: secureJson({ error: "Invalid JSON object request" }, 400) };
   }
 }
@@ -28,9 +28,8 @@ export async function readJson(request, maxBytes = 64 * 1024) {
   if (Number.isFinite(declared) && declared > maxBytes) throw Object.assign(new Error("Request body is too large"), { status: 413 });
   if (!request.body) throw Object.assign(new Error("Request body required"), { status: 400 });
   try {
-    const value = await request.clone().json();
+    const value = await readBoundedJson(request, maxBytes);
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Object required");
-    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > maxBytes) throw Object.assign(new Error("Request body is too large"), { status: 413 });
     return value;
   } catch (error) {
     if (error?.status) throw error;
@@ -38,6 +37,24 @@ export async function readJson(request, maxBytes = 64 * 1024) {
   }
 }
 
+async function readBoundedJson(request, maxBytes) {
+  const reader = request.clone().body?.getReader();
+  if (!reader) throw new Error("Request body required");
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) { void reader.cancel(); throw Object.assign(new Error("Request body is too large"), { status: 413 }); }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) { body.set(chunk, offset); offset += chunk.byteLength; }
+  return JSON.parse(new TextDecoder().decode(body));
+}
+
 export function secureJson(payload, status = 200, headers = {}) {
   return secureResponse(Response.json(payload, { status, headers: { "Cache-Control": "no-store", ...headers } }));
 }

package/src/runtime/worker.js

@@ -1,4 +1,4 @@
-import { ensureSubscriptionManifest, SubscriptionError } from "../auth/index.js";
+import { ensureScopes, ensureSubscriptionManifest, SubscriptionError } from "../auth/index.js";
 import { auditedD1, createEventHandler, listFeatureHealth, requestActor, requestContext, secureResponse } from "../core/index.js";
 import { jobResponse, liveEventsResponse } from "../api/jobs.js";
 import { createRepositories } from "../repository.js";
@@ -11,21 +11,25 @@ import { adminBoundary } from "../admin/routes.js";
 import { ensureFeatureManifests } from "./features.js";
 import { healthResponse } from "./health.js";
 
+const scopeManifestPromises = new WeakMap();
+
 export function createWorker({ fetch, scheduled, app = { name: "worker" }, auth, authorize, scopes = [], subscriptionManifest = [], scopeRoutes = [], apiRoutes = [], middleware = [], features = [], dataResources = [], repositories = [], publicTenantId = null, health, boot, security = true, eventHubBinding = "EVENT_HUB" }) {
   if (typeof fetch !== "function") throw new TypeError("createWorker requires a fetch handler");
   const application = defineApp(app); const provider = auth || features.find((feature) => typeof feature?.getUser === "function"); const eventHandler = createEventHandler(features, { eventHubBinding });
   const repositoryDefinitions = [...repositories, ...features.flatMap((feature) => Array.isArray(feature?.repositories) ? feature.repositories : [])];
   const registeredDataResources = normalizeDataResources([...dataResources, ...features.flatMap((feature) => Array.isArray(feature?.dataResources) ? feature.dataResources : []), ...repositoryDefinitions.filter((definition) => definition.resourceDefinition).map((definition) => definition.resourceDefinition)]);
   const featureRoutes = features.flatMap((feature) => Array.isArray(feature?.routes) ? [async (request, env, ctx, next, state) => { for (const route of feature.routes) { const matches = typeof route?.match === "function" ? await route.match(request, env, state) : route?.path === new URL(request.url).pathname; if (matches && typeof route.handle === "function") return route.handle({ request, env, ctx, state, next }); } return next(); }] : []);
-  const chain = [(request, env, ctx, next, state) => adminBoundary(request, env, ctx, next, state, { provider, authorize, scopes, scopeRoutes, features }), ...(apiRoutes.length ? [(request, env, ctx, next, state) => dispatchRoutes(request, env, ctx, state, apiRoutes).then((response) => response || next(request))] : []), ...features.flatMap((feature) => feature?.middleware ? [feature.middleware.bind(feature)] : []), ...featureRoutes, ...middleware, ...(auth ? [(request, env, ctx, next) => auth(request, env, ctx, next)] : [])].filter(Boolean);
+  const chain = [(request, env, ctx, next, state) => adminBoundary(request, env, ctx, next, state, { provider, authorize, scopes: [], scopeRoutes, features }), ...(apiRoutes.length ? [(request, env, ctx, next, state) => dispatchRoutes(request, env, ctx, state, apiRoutes).then((response) => response || next(request))] : []), ...features.flatMap((feature) => feature?.middleware ? [feature.middleware.bind(feature)] : []), ...featureRoutes, ...middleware, ...(auth ? [(request, env, ctx, next) => auth(request, env, ctx, next)] : [])].filter(Boolean);
   return {
     async fetch(request, env, ctx) {
       try {
         if (boot) await boot(env, { request, ctx });
         if (subscriptionManifest.length) await ensureSubscriptionManifest(env, subscriptionManifest, { who: "system:update" });
         const url = new URL(request.url); const state = Object.create(null); state.requestId = crypto.randomUUID();
+        if (env?.DB && scopes.length && isAdminPath(url.pathname)) await ensureScopeManifest(env, scopes);
         if (provider?.getUser) state.user = await provider.getUser(request, env).catch(() => null); if (state.user?.authUser) state.authUser = state.user.authUser;
-        state.data = createDataReader(env, { resources: registeredDataResources, context: () => requestDataContext(env, { state, request, publicTenantId }) });
+        let dataContext;
+        state.data = createDataReader(env, { resources: registeredDataResources, context: () => dataContext ||= requestDataContext(env, { state, request, publicTenantId }) });
         const requestEnv = Object.create(env || null);
         Object.assign(requestEnv, { app: application, DB: env?.DB ? auditedD1(env.DB, requestActor(state)) : env?.DB, data: state.data, repositories: createRepositories(requestEnv, repositoryDefinitions), user: state.user || null, authUser: state.authUser || null, userId: state.authUser?.id || null, eventHandler: (event, eventEnv, eventCtx) => eventHandler(event, eventEnv || requestEnv, eventCtx || ctx) });
         requestEnv.requestId = state.requestId; state.context = requestContext({ request, env: requestEnv, ctx, state, data: state.data }); requestEnv.context = state.context; requestEnv.event = state.context.event;
@@ -43,3 +47,12 @@ export function createWorker({ fetch, scheduled, app = { name: "worker" }, auth,
 }
 
 function withRequestId(response, requestId) { const headers = new Headers(response.headers); headers.set("X-Request-ID", String(requestId)); return new Response(response.body, { status: response.status, statusText: response.statusText, headers }); }
+function isAdminPath(pathname) { return pathname === "/admin" || pathname.startsWith("/admin/") || pathname === "/api/admin" || pathname.startsWith("/api/admin/"); }
+function ensureScopeManifest(env, scopes) {
+  let registrations = scopeManifestPromises.get(env.DB);
+  if (!registrations) { registrations = new Map(); scopeManifestPromises.set(env.DB, registrations); }
+  const key = JSON.stringify(scopes);
+  let promise = registrations.get(key);
+  if (!promise) { promise = ensureScopes(env, scopes, { who: "system:update" }); registrations.set(key, promise); promise.catch(() => registrations.delete(key)); }
+  return promise;
+}