@antasphere/chassis-server 1.0.0

package/dist/api/members.js

@@ -0,0 +1,522 @@
+import { randomBytes } from 'node:crypto';
+import { and, desc, eq, ne } from 'drizzle-orm';
+import { createEmailVerificationToken } from 'better-auth/api';
+import { memberChangeEmailLinkRoute, memberDeleteRoute, memberRemoveRoute, memberResetLinkRoute, memberUpdateRoute, membersListRoute } from '@antasphere/chassis-contract/routes';
+import { workspaceMembers, user as userTable } from '@antasphere/chassis-db';
+import { isLastOwnerDbError, LastOwnerError } from '../accounts/deletion.js';
+import { mintRefusal as sharedMintRefusal } from '../accounts/mint-refusal.js';
+import { cursorRowId, keysetBefore, pageOf } from '../pagination.js';
+import { requireAuth, requireNonGuest, requireRole } from '../middleware/auth-context.js';
+import { hubManagedMembershipGate } from '../middleware/hub-managed.js';
+import { deleteMembershipGrants, mergeRemovalCounts } from '../members/removal.js';
+const err = (code, message) => ({ error: { code, message } });
+const toWire = (m) => ({
+    id: m.id,
+    userId: m.userId,
+    email: m.email,
+    name: m.name,
+    role: m.role,
+    isActive: m.isActive,
+    createdAt: m.createdAt.toISOString(),
+    lastSeenAt: m.lastSeenAt?.toISOString() ?? null
+});
+export function registerMemberRoutes(api, deps) {
+    const { db, auth, publicBaseUrl, accountDeletion, hubManaged } = deps;
+    // P7 (cloud only): membership of a hub-origin workspace is the HUB's to
+    // manage — every local mutation shape under /members answers the
+    // `hub_managed` pointer. Registered BEFORE the role gates so any
+    // authenticated caller gets the truthful refusal (an anonymous caller
+    // passes through — no principal — and still 401s at requireRole below).
+    // GET /members is untouched: the gate is method-keyed and the projected
+    // roster is real. ONE wildcard mount covers the whole subtree — the
+    // collection root, `/members/:id`, the 3-segment link paths, and any
+    // FUTURE mutation registered under /members — so fail-closed holds by
+    // construction, never by remembering a per-path registration.
+    if (hubManaged) {
+        api.use('/members/*', hubManagedMembershipGate(hubManaged.manageUrl));
+    }
+    api.use('/members', requireAuth());
+    // Guest capability limit (D2, both editions): the member roster (names +
+    // emails of the whole team) is a workspace-level surface. A guest is an
+    // external party invited to ONE resource — the host tenant's directory is not
+    // theirs to read. Per-resource surfaces their grant opens are untouched.
+    api.use('/members', requireNonGuest());
+    api.openapi(membersListRoute, async (c) => {
+        const principal = c.get('principal');
+        const { cursor, limit } = c.req.valid('query');
+        const cursorId = cursorRowId(cursor);
+        const rows = await db
+            .select({
+            id: workspaceMembers.id,
+            userId: workspaceMembers.userId,
+            email: userTable.email,
+            name: userTable.name,
+            role: workspaceMembers.role,
+            isActive: workspaceMembers.isActive,
+            createdAt: workspaceMembers.createdAt,
+            lastSeenAt: workspaceMembers.lastSeenAt
+        })
+            .from(workspaceMembers)
+            .innerJoin(userTable, eq(workspaceMembers.userId, userTable.id))
+            .where(and(eq(workspaceMembers.workspaceId, principal.workspaceId), ...(cursorId
+            ? [
+                keysetBefore({
+                    table: workspaceMembers,
+                    id: workspaceMembers.id,
+                    createdAt: workspaceMembers.createdAt,
+                    workspaceId: workspaceMembers.workspaceId,
+                    cursorId,
+                    workspace: principal.workspaceId
+                })
+            ]
+            : [])))
+            .orderBy(desc(workspaceMembers.createdAt), desc(workspaceMembers.id))
+            .limit(limit + 1);
+        const { page, nextCursor } = pageOf(rows, limit);
+        return c.json({ members: page.map(toWire), nextCursor }, 200);
+    });
+    api.use('/members/:id', requireRole('admin'));
+    api.openapi(memberUpdateRoute, async (c) => {
+        const principal = c.get('principal');
+        const { id } = c.req.valid('param');
+        const patch = c.req.valid('json');
+        const [target] = await db
+            .select({
+            id: workspaceMembers.id,
+            userId: workspaceMembers.userId,
+            role: workspaceMembers.role,
+            origin: workspaceMembers.origin,
+            isActive: workspaceMembers.isActive
+        })
+            .from(workspaceMembers)
+            .where(and(eq(workspaceMembers.id, id), eq(workspaceMembers.workspaceId, principal.workspaceId)))
+            .limit(1);
+        if (!target)
+            return c.json(err('not_found', 'Member not found'), 404);
+        if (target.userId === principal.userId && patch.isActive === false) {
+            return c.json(err('cannot_deactivate_self', 'You cannot deactivate yourself'), 400);
+        }
+        // Guest role-lock (D2): a guest row is 'member' by construction and the
+        // guest capability limits key on origin, which no surface upgrades —
+        // promoting one would mint a workspace admin the guest gates still
+        // refuse resource creation to (an incoherent half-state), and on cloud an
+        // administrator the hub knows nothing about. To empower the person,
+        // invite them as a real member; the claim path preserves that row's
+        // origin. Deactivate/reactivate stays available — cutting a guest off
+        // entirely is a legitimate admin act.
+        if (target.origin === 'guest' && patch.role && patch.role !== target.role) {
+            return c.json(err('guest_role_locked', 'A guest membership cannot change role — invite them as a member instead'), 403);
+        }
+        // Only owners touch owners (grant or revoke).
+        if ((target.role === 'owner' || patch.role === 'owner') && principal.role !== 'owner') {
+            return c.json(err('forbidden', 'Only an owner can change owner roles'), 403);
+        }
+        // Never leave the workspace without an active owner (shared with the
+        // account-deletion guards in accounts/deletion.ts). Demotions run under
+        // the race-free guard: workspace advisory lock + re-check, with the
+        // migration-0009 trigger as the DB-level backstop — a concurrent-race
+        // loser gets this clean 400, never a 500.
+        const losesOwner = target.role === 'owner' && ((patch.role && patch.role !== 'owner') || patch.isActive === false);
+        const applyPatch = async () => {
+            await db
+                .update(workspaceMembers)
+                .set({
+                ...(patch.role ? { role: patch.role } : {}),
+                ...(patch.isActive !== undefined ? { isActive: patch.isActive } : {})
+            })
+                .where(eq(workspaceMembers.id, target.id));
+        };
+        try {
+            if (losesOwner) {
+                await accountDeletion.withLastOwnerGuard(principal.workspaceId, target.userId, applyPatch);
+            }
+            else {
+                await applyPatch();
+            }
+        }
+        catch (cause) {
+            // The guarded loser throws LastOwnerError; the unguarded branch (or a
+            // demotion racing invitation re-acceptance) can still trip the 0009
+            // trigger with P0409 — both mean the last active owner would be lost.
+            if (cause instanceof LastOwnerError || isLastOwnerDbError(cause)) {
+                const message = cause instanceof LastOwnerError
+                    ? cause.message
+                    : 'The workspace must keep at least one active owner';
+                return c.json(err('last_owner', message), 400);
+            }
+            throw cause;
+        }
+        const [updated] = await db
+            .select({
+            id: workspaceMembers.id,
+            userId: workspaceMembers.userId,
+            email: userTable.email,
+            name: userTable.name,
+            role: workspaceMembers.role,
+            isActive: workspaceMembers.isActive,
+            createdAt: workspaceMembers.createdAt,
+            lastSeenAt: workspaceMembers.lastSeenAt
+        })
+            .from(workspaceMembers)
+            .innerJoin(userTable, eq(workspaceMembers.userId, userTable.id))
+            .where(eq(workspaceMembers.id, target.id))
+            .limit(1);
+        c.set('audit', {
+            action: 'member.update',
+            resourceType: 'member',
+            resourceId: target.id,
+            metadata: { ...patch, targetUserId: target.userId }
+        });
+        return c.json(toWire(updated), 200);
+    });
+    // Admin account deletion (GDPR erasure, the second delete surface).
+    // Covered by the 2-segment `/members/:id` requireRole gate above; machines
+    // are excluded automatically because DELETE /members/{id} is deliberately
+    // unlisted in the fail-closed scope allowlist. Files the target uploaded
+    // stay with the workspace (created_by → NULL via FK); NO blob cleanup.
+    api.openapi(memberDeleteRoute, async (c) => {
+        const principal = c.get('principal');
+        const { id } = c.req.valid('param');
+        const [target] = await db
+            .select({
+            id: workspaceMembers.id,
+            userId: workspaceMembers.userId,
+            role: workspaceMembers.role,
+            isActive: workspaceMembers.isActive
+        })
+            .from(workspaceMembers)
+            .where(and(eq(workspaceMembers.id, id), eq(workspaceMembers.workspaceId, principal.workspaceId)))
+            .limit(1);
+        if (!target)
+            return c.json(err('not_found', 'Member not found'), 404);
+        if (target.userId === principal.userId) {
+            return c.json(err('cannot_delete_self', 'Delete your own account from the account page'), 400);
+        }
+        if (target.role === 'owner' && principal.role !== 'owner') {
+            return c.json(err('forbidden', 'Only an owner can delete an owner'), 403);
+        }
+        // ADR 014: deleting the ACCOUNT erases the user from EVERY workspace, and
+        // an admin's authority ends at their own — refuse when the target belongs
+        // to any other workspace (remove the person from this one instead; the account
+        // holder can erase themselves). Single-workspace instances never hit this.
+        const [foreign] = await db
+            .select({ id: workspaceMembers.id })
+            .from(workspaceMembers)
+            .where(and(eq(workspaceMembers.userId, target.userId), ne(workspaceMembers.workspaceId, principal.workspaceId)))
+            .limit(1);
+        if (foreign) {
+            return c.json(err('member_of_other_workspaces', 'This account belongs to other workspaces — remove the person from this workspace instead of deleting the account'), 409);
+        }
+        // Snapshot the wire member BEFORE the cascade removes the joined user row.
+        const [snapshot] = await db
+            .select({
+            id: workspaceMembers.id,
+            userId: workspaceMembers.userId,
+            email: userTable.email,
+            name: userTable.name,
+            role: workspaceMembers.role,
+            isActive: workspaceMembers.isActive,
+            createdAt: workspaceMembers.createdAt,
+            lastSeenAt: workspaceMembers.lastSeenAt
+        })
+            .from(workspaceMembers)
+            .innerJoin(userTable, eq(workspaceMembers.userId, userTable.id))
+            .where(eq(workspaceMembers.id, target.id))
+            .limit(1);
+        // Better Auth's own deletion path (adapter hooks included) — NOT raw
+        // drizzle. Membership, api keys, invitations they issued, and sessions
+        // cascade; audit rows and file uploader anonymize via SET NULL.
+        // Deleting an ACTIVE OWNER runs under the race-free last-owner guard
+        // (workspace advisory lock + re-check; the migration-0009 trigger
+        // backstops) so a concurrent-race loser gets a clean 400 last_owner.
+        const cascade = async () => {
+            const authCtx = await auth.$context;
+            await authCtx.internalAdapter.deleteUser(target.userId);
+            await authCtx.internalAdapter.deleteUserSessions(target.userId);
+            // OPS-3 (PRDCT-1357): this path bypasses the deleteUser hooks, so the
+            // erasure tombstone is written here — a restore must not undo this.
+            await accountDeletion.recordErasure({ id: target.userId, email: snapshot.email });
+        };
+        try {
+            if (target.role === 'owner' && target.isActive) {
+                await accountDeletion.withLastOwnerGuard(principal.workspaceId, target.userId, cascade);
+            }
+            else {
+                await cascade();
+            }
+        }
+        catch (cause) {
+            // isLastOwnerDbError: the unguarded branch can still trip the trigger
+            // when the target is promoted to last owner mid-flight.
+            if (cause instanceof LastOwnerError || isLastOwnerDbError(cause)) {
+                return c.json(err('last_owner', 'The workspace must keep at least one active owner'), 400);
+            }
+            throw cause;
+        }
+        c.set('audit', {
+            action: 'member.delete',
+            resourceType: 'member',
+            resourceId: target.id,
+            metadata: { targetUserId: target.userId, email: snapshot.email }
+        });
+        return c.json(toWire(snapshot), 200);
+    });
+    // Removal (PRDCT-2816): the act between the pause and the account erasure,
+    // and the same one the hub's removal is on cloud. The membership row is
+    // switched off, never deleted (a new invitation reactivates the very same
+    // row), and the person's project grants, their team seats and what the
+    // tool hangs on them in this workspace go with it, in ONE transaction: a
+    // person brought back starts with none. The row is left at the role
+    // `member`: the role a person held is not kept in wait for them either, so
+    // whatever switches the row back on (an admin's Reactivate, an invitation,
+    // which names its own role) never hands an old admin or owner role back.
+    // The account, and the person's memberships of other workspaces, are untouched.
+    // An already paused member can be removed: that turns the pause into a
+    // removal. The 2-segment gate above does NOT cover this 3-segment path, so
+    // it is gated explicitly. Machines never reach it: the path is deliberately
+    // UNLISTED in the fail-closed scope allowlist, like the account deletion.
+    // A hub-origin workspace died at the subtree gate with `hub_managed`.
+    api.use('/members/:id/remove', requireRole('admin'));
+    api.openapi(memberRemoveRoute, async (c) => {
+        const principal = c.get('principal');
+        const { id } = c.req.valid('param');
+        const [target] = await db
+            .select({
+            id: workspaceMembers.id,
+            userId: workspaceMembers.userId,
+            role: workspaceMembers.role,
+            isActive: workspaceMembers.isActive
+        })
+            .from(workspaceMembers)
+            .where(and(eq(workspaceMembers.id, id), eq(workspaceMembers.workspaceId, principal.workspaceId)))
+            .limit(1);
+        if (!target)
+            return c.json(err('not_found', 'Member not found'), 404);
+        if (target.userId === principal.userId) {
+            return c.json(err('cannot_remove_self', 'You cannot remove yourself'), 400);
+        }
+        if (target.role === 'owner' && principal.role !== 'owner') {
+            return c.json(err('forbidden', 'Only an owner can remove an owner'), 403);
+        }
+        // The WHERE names the workspace again: the row is the one read above,
+        // and the statement could not reach another workspace's even if it were not.
+        // What the person held goes first, the row second: the same lock order
+        // as an invitation's accept, which locks the invitation and then the
+        // membership row (members/removal.ts, ORDER).
+        const remove = () => db.transaction(async (tx) => {
+            const removedRow = [
+                { memberId: target.id, workspaceId: principal.workspaceId, userId: target.userId }
+            ];
+            const counts = await deleteMembershipGrants(tx, removedRow, deps.onMembershipRemoval);
+            await tx
+                .update(workspaceMembers)
+                .set({ isActive: false, isDefault: false, role: 'member' })
+                .where(and(eq(workspaceMembers.id, target.id), eq(workspaceMembers.workspaceId, principal.workspaceId)));
+            // The second pass, after the row is off (the end-to-end verification,
+            // finding 5): an add that held the membership row FOR SHARE before the
+            // update (`holdLiveMembership`: a project grant, a team seat, a demo
+            // pass) made the update wait, and committed its right between the
+            // first pass and the update. This pass takes it. Any add after the
+            // update re-reads the row off and writes nothing, so two passes end it.
+            const late = await deleteMembershipGrants(tx, removedRow, deps.onMembershipRemoval);
+            return mergeRemovalCounts(counts, late);
+        });
+        let removed;
+        try {
+            // Removing an ACTIVE owner runs under the race-free last-owner guard,
+            // as the pause and the account deletion do.
+            removed =
+                target.role === 'owner' && target.isActive
+                    ? await accountDeletion.withLastOwnerGuard(principal.workspaceId, target.userId, remove)
+                    : await remove();
+        }
+        catch (cause) {
+            if (cause instanceof LastOwnerError || isLastOwnerDbError(cause)) {
+                return c.json(err('last_owner', 'The workspace must keep at least one active owner'), 400);
+            }
+            throw cause;
+        }
+        const [after] = await db
+            .select({
+            id: workspaceMembers.id,
+            userId: workspaceMembers.userId,
+            email: userTable.email,
+            name: userTable.name,
+            role: workspaceMembers.role,
+            isActive: workspaceMembers.isActive,
+            createdAt: workspaceMembers.createdAt,
+            lastSeenAt: workspaceMembers.lastSeenAt
+        })
+            .from(workspaceMembers)
+            .innerJoin(userTable, eq(workspaceMembers.userId, userTable.id))
+            .where(eq(workspaceMembers.id, target.id))
+            .limit(1);
+        c.set('audit', {
+            action: 'member.remove',
+            resourceType: 'member',
+            resourceId: target.id,
+            // The tool's counts first: a name the chassis writes is the chassis's.
+            metadata: {
+                ...removed.tool,
+                targetUserId: target.userId,
+                roleBefore: target.role,
+                projectGrants: removed.projectGrants,
+                teamSeats: removed.teamSeats,
+                invitations: removed.invitations,
+                demoPasses: removed.demoPasses
+            }
+        });
+        return c.json(toWire(after), 200);
+    });
+    // The shared refusal of every route that mints a sign-in-equivalent
+    // credential for another user (PRDCT-1354): guest targets and targets
+    // belonging to another workspace. Its own module (accounts/mint-refusal.ts),
+    // shared with the demo pass mint; bound here to this router's db and copy.
+    const mintRefusal = (principal, target) => sharedMintRefusal(db, deps.guestTargetMessage, principal, target);
+    // Owner-generated password reset link — the recovery path that works with
+    // no email driver (invitations' copyable-link pattern). The 2-segment gate
+    // above does NOT cover this 3-segment path, so gate it explicitly — and at
+    // OWNER, not admin (AUTH-8: see mintRefusal).
+    api.use('/members/:id/reset-link', requireRole('owner'));
+    api.openapi(memberResetLinkRoute, async (c) => {
+        // Cloud edition (`hubManaged` is present iff EDITION=cloud): the token a
+        // mint would produce lands on POST /reset-password, which the D1 hub-only
+        // posture refuses there (identity/better-auth.ts isPasswordResetPath) —
+        // so minting would hand admins a dead link. Refuse at the source instead.
+        // Hub-origin workspaces already died at the subtree gate above with
+        // `hub_managed`; this covers cloud-LOCAL workspaces (the operator's,
+        // guest hosts). Recovery for local accounts there: hub SSO for
+        // humans, break-glass for the operator. oss is untouched.
+        if (hubManaged) {
+            return c.json(err('password_reset_disabled', 'Local password reset is disabled on this edition — credentials are managed at the Antasphere hub'), 403);
+        }
+        const principal = c.get('principal');
+        const { id } = c.req.valid('param');
+        const [target] = await db
+            .select({
+            id: workspaceMembers.id,
+            userId: workspaceMembers.userId,
+            role: workspaceMembers.role,
+            origin: workspaceMembers.origin
+        })
+            .from(workspaceMembers)
+            .where(and(eq(workspaceMembers.id, id), eq(workspaceMembers.workspaceId, principal.workspaceId)))
+            .limit(1);
+        if (!target)
+            return c.json(err('not_found', 'Member not found'), 404);
+        const refusal = await mintRefusal(principal, target);
+        if (refusal)
+            return c.json(err(refusal.code, refusal.message), 403);
+        // Mint a single-use token in Better Auth's own verification table, in the
+        // exact shape POST /reset-password consumes (`reset-password:<token>`).
+        const token = randomBytes(24).toString('base64url');
+        const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1h
+        const authCtx = await auth.$context;
+        await authCtx.internalAdapter.createVerificationValue({
+            identifier: `reset-password:${token}`,
+            value: target.userId,
+            expiresAt
+        });
+        c.set('audit', {
+            action: 'member.reset_link',
+            resourceType: 'member',
+            resourceId: target.id,
+            metadata: { targetUserId: target.userId }
+        });
+        return c.json({
+            resetUrl: `${publicBaseUrl.replace(/\/+$/, '')}/reset-password?token=${token}`,
+            expiresAt: expiresAt.toISOString()
+        }, 200);
+    });
+    // Owner-generated email change link — the email-change path that works
+    // with no email driver (same copyable-link pattern as the reset link).
+    // The 2-segment gate above does NOT cover this 3-segment path either, so
+    // gate it explicitly — at OWNER, like its sibling (AUTH-8).
+    api.use('/members/:id/change-email-link', requireRole('owner'));
+    api.openapi(memberChangeEmailLinkRoute, async (c) => {
+        // Cloud edition (`hubManaged` is present iff EDITION=cloud): the SAME
+        // closure the reset-link sibling carries, which this route was missing
+        // (AUTH-1). It is the stronger of the two — the minted JWT is
+        // sign-in-equivalent AND rewrites the address the hub identity is keyed
+        // on, while on cloud a user's email is the hub's to own (D10 re-syncs it
+        // on every login, so a local rewrite is either overwritten or a
+        // hijack). Hub-origin workspaces already died at the P7 subtree gate
+        // with `hub_managed`; this covers cloud-LOCAL workspaces (the
+        // operator's, guest hosts). oss is untouched.
+        if (hubManaged) {
+            return c.json(err('email_change_disabled', 'Local email changes are disabled on this edition — identities are managed at the Antasphere hub'), 403);
+        }
+        const principal = c.get('principal');
+        const { id } = c.req.valid('param');
+        const body = c.req.valid('json');
+        const [target] = await db
+            .select({
+            id: workspaceMembers.id,
+            userId: workspaceMembers.userId,
+            role: workspaceMembers.role,
+            origin: workspaceMembers.origin,
+            email: userTable.email
+        })
+            .from(workspaceMembers)
+            .innerJoin(userTable, eq(workspaceMembers.userId, userTable.id))
+            .where(and(eq(workspaceMembers.id, id), eq(workspaceMembers.workspaceId, principal.workspaceId)))
+            .limit(1);
+        if (!target)
+            return c.json(err('not_found', 'Member not found'), 404);
+        const refusal = await mintRefusal(principal, target);
+        if (refusal)
+            return c.json(err(refusal.code, refusal.message), 403);
+        // Better Auth stores emails lowercased — compare and mint in that form.
+        // ⚠️ RACE-7: this lookup is ADVISORY ONLY, never the boundary. It is a
+        // read outside any lock, and the mint writes nothing (the token is a
+        // stateless JWT — LESSONS.md M6), so two concurrent mints for the same
+        // `newEmail` both pass it. The REAL enforcement is the `user.email`
+        // UNIQUE constraint at CONSUMPTION time: whichever link is consumed
+        // first wins the address and the loser's link fails, leaving exactly one
+        // account on that email (asserted in test/integration/minted-credentials
+        // .test.ts). Never promote this pre-check to a uniqueness guarantee.
+        // RACE-7 scope choice: joined on THIS workspace's membership rows — an
+        // unscoped user lookup made the 409-vs-200 an instance-global account
+        // oracle; the owner already sees these emails on the roster.
+        // ⚠️ The constraint at consumption is OBSERVABLE, not a silent backstop
+        // (PRDCT-1437): a colliding consume used to answer a raw 500 against the
+        // free case's 302 — a mint-then-consume account oracle. The consume path
+        // now answers the SAME redirect + session on both branches (the
+        // collision rewrite at the /auth mount — rewriteChangeEmailCollision in
+        // api/index.ts re-signs the token as a no-op change so Better Auth runs
+        // its native success path), and the honest residual — the owner can always
+        // read back whether the change TOOK, because email uniqueness is
+        // instance-global — is documented in ADR 013's amendment.
+        const newEmail = body.newEmail.toLowerCase();
+        const [existing] = await db
+            .select({ id: userTable.id })
+            .from(userTable)
+            .innerJoin(workspaceMembers, eq(workspaceMembers.userId, userTable.id))
+            .where(and(eq(userTable.email, newEmail), eq(workspaceMembers.workspaceId, principal.workspaceId)))
+            .limit(1);
+        if (existing) {
+            return c.json(err('email_taken', 'That email is already in use'), 409);
+        }
+        // Mint the exact stateless JWT GET /verify-email consumes for an email
+        // change ({email: current, updateTo: new, requestType}), signed with the
+        // auth secret — Better Auth's own helper, never hand-rolled jose.
+        // ⚠️ Consuming this link updates the email AND signs the target in (a
+        // session is created when none exists) — it is sign-in-equivalent. Hand
+        // it to the target member only, never to anyone else.
+        const expiresIn = 3600; // 1h
+        const expiresAt = new Date(Date.now() + expiresIn * 1000);
+        const authCtx = await auth.$context;
+        const token = await createEmailVerificationToken(authCtx.secret, target.email, newEmail, expiresIn, {
+            requestType: 'change-email-verification'
+        });
+        const verifyUrl = `${publicBaseUrl.replace(/\/+$/, '')}/api/v1/auth/verify-email?token=${token}&callbackURL=%2Faccount`;
+        c.set('audit', {
+            action: 'member.change_email_link',
+            resourceType: 'member',
+            resourceId: target.id,
+            metadata: { targetUserId: target.userId, newEmail }
+        });
+        return c.json({ verifyUrl, newEmail, expiresAt: expiresAt.toISOString() }, 200);
+    });
+}
+//# sourceMappingURL=members.js.map

package/dist/api/members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.js","sourceRoot":"","sources":["../../src/api/members.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,IAAI,IAAI,SAAS,EAAW,MAAM,wBAAwB,CAAC;AAEtF,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA+B,MAAM,yBAAyB,CAAC;AAC1G,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAGnB,MAAM,uBAAuB,CAAC;AAmB/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAE9E,MAAM,MAAM,GAAG,CAAC,CASf,EAAE,EAAE,CAAC,CAAC;IACL,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;CAChD,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAAC,GAAgB,EAAE,IAAqB;IAC1E,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IACtE,wEAAwE;IACxE,iEAAiE;IACjE,iEAAiE;IACjE,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,sEAAsE;IACtE,8DAA8D;IAC9D,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;IACnC,yEAAyE;IACzE,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,UAAU,EAAE,gBAAgB,CAAC,UAAU;SACxC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC/D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACvD,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC;gBACE,YAAY,CAAC;oBACX,KAAK,EAAE,gBAAgB;oBACvB,EAAE,EAAE,gBAAgB,CAAC,EAAE;oBACvB,SAAS,EAAE,gBAAgB,CAAC,SAAS;oBACrC,WAAW,EAAE,gBAAgB,CAAC,WAAW;oBACzC,QAAQ;oBACR,SAAS,EAAE,SAAS,CAAC,WAAW;iBACjC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF;aACA,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;aACpE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpB,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAElC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;SACpC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;aAChG,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;QAEtE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YACnE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,gCAAgC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,wEAAwE;QACxE,qEAAqE;QACrE,mEAAmE;QACnE,0EAA0E;QAC1E,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1E,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,mBAAmB,EAAE,yEAAyE,CAAC,EACnG,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,8CAA8C;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtF,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,sCAAsC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,UAAU,GACd,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;QAClG,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;YAC5B,MAAM,EAAE;iBACL,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC;QACF,IAAI,CAAC;YACH,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC7F,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,KAAK,YAAY,cAAc,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,OAAO,GACX,KAAK,YAAY,cAAc;oBAC7B,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,mDAAmD,CAAC;gBAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,UAAU,EAAE,gBAAgB,CAAC,UAAU;SACxC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC/D,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE;SACpD,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;SACpC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;aAChG,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,+CAA+C,CAAC,EAAE,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,mCAAmC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,+EAA+E;QAC/E,2EAA2E;QAC3E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;aACnC,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAC1C,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CACxD,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CACD,4BAA4B,EAC5B,kHAAkH,CACnH,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,UAAU,EAAE,gBAAgB,CAAC,UAAU;SACxC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC/D,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,qEAAqE;QACrE,uEAAuE;QACvE,gEAAgE;QAChE,qEAAqE;QACrE,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YACpC,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxD,MAAM,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChE,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,eAAe,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,QAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC;QACF,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC/C,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1F,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,wDAAwD;YACxD,IAAI,KAAK,YAAY,cAAc,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,mDAAmD,CAAC,EAAE,GAAG,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,QAAS,CAAC,KAAK,EAAE;SAClE,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,gFAAgF;IAChF,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;SACpC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;aAChG,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,mCAAmC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,sEAAsE;QACtE,6EAA6E;QAC7E,uEAAuE;QACvE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1B,MAAM,UAAU,GAAG;gBACjB,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;aACnF,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACtF,MAAM,EAAE;iBACL,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;iBAC1D,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CACjG,CAAC;YACJ,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClE,mEAAmE;YACnE,wEAAwE;YACxE,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACpF,OAAO,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QACL,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,sEAAsE;YACtE,4CAA4C;YAC5C,OAAO;gBACL,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ;oBACxC,CAAC,CAAC,MAAM,eAAe,CAAC,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;oBACxF,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,mDAAmD,CAAC,EAAE,GAAG,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,UAAU,EAAE,gBAAgB,CAAC,UAAU;SACxC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC/D,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,uEAAuE;YACvE,QAAQ,EAAE;gBACR,GAAG,OAAO,CAAC,IAAI;gBACf,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B;SACF,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,sEAAsE;IACtE,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,CAAC,SAAkC,EAAE,MAA0C,EAAE,EAAE,CACrG,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAEpE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,qEAAqE;QACrE,+DAA+D;QAC/D,0DAA0D;QAC1D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CACD,yBAAyB,EACzB,kGAAkG,CACnG,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,MAAM,EAAE,gBAAgB,CAAC,MAAM;SAChC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;aAChG,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;QAEpE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QACpC,MAAM,OAAO,CAAC,eAAe,CAAC,uBAAuB,CAAC;YACpD,UAAU,EAAE,kBAAkB,KAAK,EAAE;YACrC,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,SAAS;SACV,CAAC,CAAC;QAEH,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,mBAAmB;YAC3B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE;SAC1C,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CACX;YACE,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,yBAAyB,KAAK,EAAE;YAC9E,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CAAC,gCAAgC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,GAAG,CAAC,OAAO,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,sEAAsE;QACtE,uEAAuE;QACvE,8DAA8D;QAC9D,wEAAwE;QACxE,yEAAyE;QACzE,gEAAgE;QAChE,qEAAqE;QACrE,8DAA8D;QAC9D,8CAA8C;QAC9C,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CACD,uBAAuB,EACvB,iGAAiG,CAClG,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC/D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;aAChG,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;QAEpE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,gEAAgE;QAChE,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,iEAAiE;QACjE,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;aAC5B,IAAI,CAAC,SAAS,CAAC;aACf,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aACtE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;aAClG,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,8BAA8B,CAAC,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,kEAAkE;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK;QAC7B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE;YAClG,WAAW,EAAE,2BAA2B;SACzC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,KAAK,yBAAyB,CAAC;QAExH,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,0BAA0B;YAClC,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE;SACpD,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/onboarding.d.ts

@@ -0,0 +1,26 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import { type Db } from '@antasphere/chassis-db';
+import type { Auth } from '../identity/better-auth.js';
+/**
+ * POST /me/onboarding/dismiss — the explicit act that hides the first-run
+ * welcome (SL-6, cloud edition ONLY; api/index.ts registers this module iff
+ * the instance boots EDITION=cloud, so oss answers the JSON 404 terminator).
+ *
+ * Session-only, same construction as /sso/logout: the path is deliberately
+ * UNLISTED in the fail-closed scope allowlist (middleware/scopes.ts) — every
+ * API key / OAuth bearer 403s in authContext before this runs — and the
+ * session resolves ROUTE-LOCALLY (the /me zero-state pattern) so a
+ * zero-membership session can dismiss too.
+ *
+ * The upsert is idempotent and preserves the FIRST dismissal timestamp: a
+ * second dismiss (double-click, replayed request) changes nothing. Only this
+ * route (and the deploy backfill) ever sets dismissed_at — the login path's
+ * lazy insert writes NULL — so `firstRunPending` flips exactly on the user's
+ * explicit act, retry-safe on every other path.
+ */
+export interface OnboardingRouteDeps {
+    db: Db;
+    auth: Auth;
+}
+export declare function registerOnboardingRoutes(api: OpenAPIHono, deps: OnboardingRouteDeps): void;
+//# sourceMappingURL=onboarding.d.ts.map

package/dist/api/onboarding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/api/onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAkB,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAIvD;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,EAAE,CAAC;IACP,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAkB1F"}

package/dist/api/onboarding.js

@@ -0,0 +1,23 @@
+import { sql } from 'drizzle-orm';
+import { onboardingDismissRoute } from '@antasphere/chassis-contract/routes';
+import { userOnboarding } from '@antasphere/chassis-db';
+const err = (code, message) => ({ error: { code, message } });
+export function registerOnboardingRoutes(api, deps) {
+    const { db, auth } = deps;
+    api.openapi(onboardingDismissRoute, async (c) => {
+        const session = await auth.api.getSession({ headers: c.req.raw.headers });
+        if (!session?.user) {
+            return c.json(err('unauthenticated', 'Authentication required'), 401);
+        }
+        await db
+            .insert(userOnboarding)
+            .values({ userId: session.user.id, dismissedAt: new Date() })
+            .onConflictDoUpdate({
+            target: userOnboarding.userId,
+            // Keep an earlier dismissal's timestamp; fill only a NULL.
+            set: { dismissedAt: sql `coalesce(${userOnboarding.dismissedAt}, excluded.dismissed_at)` }
+        });
+        return c.json({ dismissed: true }, 200);
+    });
+}
+//# sourceMappingURL=onboarding.js.map

package/dist/api/onboarding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../../src/api/onboarding.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAW,MAAM,wBAAwB,CAAC;AAGjE,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAyB9E,MAAM,UAAU,wBAAwB,CAAC,GAAgB,EAAE,IAAyB;IAClF,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAE1B,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,EAAE;aACL,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5D,kBAAkB,CAAC;YAClB,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,2DAA2D;YAC3D,GAAG,EAAE,EAAE,WAAW,EAAE,GAAG,CAAA,YAAY,cAAc,CAAC,WAAW,0BAA0B,EAAE;SAC1F,CAAC,CAAC;QACL,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/openapi-doc.d.ts

@@ -0,0 +1,21 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+type OpenApiObjectConfig = Parameters<OpenAPIHono['getOpenAPIDocument']>[0];
+/**
+ * Serve the OpenAPI document from a buffer generated ONCE, at registration.
+ *
+ * `OpenAPIHono.doc()` runs the whole generator inside the request handler:
+ * every route definition walked, every zod schema converted, the result
+ * re-serialized — synchronously, on the event loop, for every caller. The
+ * document is also unauthenticated by design (it is in `PUBLIC_API_PATHS`), so
+ * it never reaches the per-principal quota either. That combination is a
+ * one-line anonymous DoS: a few concurrent GETs stall the loop long enough to
+ * starve `/healthz` and fail the container health check.
+ *
+ * The document is a pure function of the route table, which is frozen once the
+ * app is built — so generating it at boot is not a cache with an invalidation
+ * problem, it is simply the right time to do the work. Call this AFTER every
+ * `api.openapi(...)` registration.
+ */
+export declare function registerOpenApiDoc(api: OpenAPIHono, config: OpenApiObjectConfig, path?: string): void;
+export {};
+//# sourceMappingURL=openapi-doc.d.ts.map

package/dist/api/openapi-doc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-doc.d.ts","sourceRoot":"","sources":["../../src/api/openapi-doc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,KAAK,mBAAmB,GAAG,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,mBAAmB,EAC3B,IAAI,SAAkB,GACrB,IAAI,CASN"}