@de-otio/trellis 0.6.0 → 0.7.0

package/dist/lib/middleware/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../../src/lib/middleware/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAOL,KAAK,yBAAyB,EAG/B,MAAM,qBAAqB,CAAC;AA0F7B;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAKvF;AAMD,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAMD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,CAAC,EAAE,yBAAyB,GACxC,UAAU,CAiJZ"}

package/dist/lib/middleware/idempotency.js

@@ -0,0 +1,358 @@
+"use strict";
+/**
+ * Idempotency-Key Middleware (T9b-c)
+ *
+ * Deduplicates POST requests using an `Idempotency-Key` header backed by a
+ * 24-hour DynamoDB cache.
+ *
+ * Behaviour:
+ * - No header → pass-through (no caching, handler runs normally).
+ * - First request with key K + body B → execute handler, cache result,
+ *   respond with `Idempotency-Replay: false`.
+ * - Repeat with same key K + same body B → return cached response,
+ *   `Idempotency-Replay: true`. Handler NOT called.
+ * - Repeat with same key K + different body B' → 422 IDEMPOTENCY_KEY_REUSE.
+ * - Non-POST method with key present → pass-through (key is only honoured on POST).
+ * - Body > 1 MB → 413 IDEMPOTENCY_BODY_TOO_LARGE.
+ * - Key invalid (empty / non-ASCII-printable / > 255 chars) → 400 IDEMPOTENCY_KEY_INVALID.
+ * - Concurrent same-key claim (race): loser polls up to 3×100 ms for winner's
+ *   response, then returns 409 IDEMPOTENCY_KEY_IN_FLIGHT.
+ *
+ * Spec: plans/mvp/10-trellis-stages/09-agent-surface.md §T9b-c
+ *       doc/02-technical/identity-federation/10-agent-friendly-onboarding.md §MVP-4
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRequestHash = buildRequestHash;
+exports.sleep = sleep;
+exports.idempotencyMiddleware = idempotencyMiddleware;
+const crypto = __importStar(require("node:crypto"));
+const idempotency_store_1 = require("./idempotency-store");
+// ─────────────────────────────────────────────────────────────────────────────
+// Constants
+// ─────────────────────────────────────────────────────────────────────────────
+const MAX_KEY_LENGTH = 255;
+const PRINTABLE_ASCII_RE = /^[\x20-\x7e]+$/;
+/** Maximum body size we will buffer and hash: 1 MiB */
+const MAX_BODY_BYTES = 1 * 1024 * 1024;
+/** Polling config for in-flight race resolution */
+const IN_FLIGHT_POLL_ATTEMPTS = 3;
+const IN_FLIGHT_POLL_INTERVAL_MS = 100;
+// Headers replayed on cache hits (exclude security / hop-by-hop / CORS / auth
+// headers which either need to be re-emitted fresh by the security-headers
+// middleware on each call (HIGH-2 hardening), are session-scoped, or could
+// leak credentials when replayed across callers).
+const REPLAY_HEADER_DENYLIST = new Set([
+    "set-cookie",
+    "strict-transport-security",
+    "x-frame-options",
+    "x-content-type-options",
+    "referrer-policy",
+    "content-security-policy",
+    "permissions-policy",
+    "cross-origin-opener-policy",
+    "access-control-allow-origin",
+    "access-control-allow-credentials",
+    "access-control-allow-methods",
+    "access-control-allow-headers",
+    "transfer-encoding",
+    "connection",
+    // HIGH-2: never replay credential / authentication headers stored
+    // alongside a previous response. Each caller's auth context must be
+    // re-evaluated against their own credentials.
+    "authorization",
+    "www-authenticate",
+    "proxy-authenticate",
+    "x-csrf-token",
+]);
+/**
+ * Pull a tenant-scoped or user-scoped value out of the request context
+ * so the idempotency dedup key partitions cleanly across tenants
+ * (G4 HIGH-1). Federation POSTs all sit under `/api/tenants/{id}/...`,
+ * so the path-based extractor catches the common case; if an `auth`
+ * object was attached upstream we prefer its activeTenantId so callers
+ * acting through tenant-switch flows still partition correctly.
+ */
+function deriveScope(context) {
+    const ctxAuth = context.auth;
+    if (ctxAuth?.activeTenantId)
+        return `t:${ctxAuth.activeTenantId}`;
+    // Path-based fallback: /api/tenants/{tenantId}/...
+    const m = context.pathname.match(/^\/api\/tenants\/([^/]+)/);
+    if (m && m[1])
+        return `t:${m[1]}`;
+    if (ctxAuth?.userId)
+        return `u:${ctxAuth.userId}`;
+    return "anon";
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Error helpers
+// ─────────────────────────────────────────────────────────────────────────────
+function jsonError(status, error, message, remediation) {
+    return new Response(JSON.stringify({ error, message, remediation }), {
+        status,
+        headers: { "content-type": "application/json" },
+    });
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Hash helper
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Build a deterministic hash over method + path + raw body bytes.
+ * Headers are intentionally excluded so that retries with different
+ * Idempotency-Key values but same intent hash the same way.
+ */
+function buildRequestHash(method, path, body) {
+    const hash = crypto.createHash("sha256");
+    hash.update(`${method.toUpperCase()}:${path}:`);
+    hash.update(body);
+    return hash.digest("hex");
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Sleep helper (mockable in tests)
+// ─────────────────────────────────────────────────────────────────────────────
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Middleware factory
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * @param storeOverride - Inject a mock store for testing; production uses
+ *   DynamoIdempotencyStore built from `env.IDEMPOTENCY_TABLE`.
+ */
+function idempotencyMiddleware(storeOverride) {
+    return async (context, next) => {
+        const { request, env } = context;
+        const rawKey = request.headers.get("Idempotency-Key");
+        // ── No header → pass-through ──────────────────────────────────────────────
+        if (rawKey === null) {
+            return next();
+        }
+        // ── Only honour the header on POST ───────────────────────────────────────
+        if (request.method !== "POST") {
+            return next();
+        }
+        // ── Key validation ────────────────────────────────────────────────────────
+        if (rawKey.length === 0 || rawKey.length > MAX_KEY_LENGTH || !PRINTABLE_ASCII_RE.test(rawKey)) {
+            return jsonError(400, "IDEMPOTENCY_KEY_INVALID", `Idempotency-Key must be 1–${MAX_KEY_LENGTH} printable ASCII characters.`, "Generate a UUID v4 (e.g. crypto.randomUUID()) and use it as the Idempotency-Key.");
+        }
+        // ── Buffer + size-check the request body ──────────────────────────────────
+        let bodyBytes;
+        try {
+            bodyBytes = await readBodyWithLimit(request, MAX_BODY_BYTES);
+        }
+        catch {
+            return jsonError(413, "IDEMPOTENCY_BODY_TOO_LARGE", `Request body exceeds the ${MAX_BODY_BYTES / 1024 / 1024} MiB limit for idempotency processing.`, "Reduce the request body size or omit the Idempotency-Key header for large payloads.");
+        }
+        const requestHash = buildRequestHash(request.method, context.pathname, bodyBytes);
+        // ── Resolve the store ─────────────────────────────────────────────────────
+        const tableName = env.IDEMPOTENCY_TABLE;
+        const store = storeOverride ?? new idempotency_store_1.DynamoIdempotencyStore(tableName ?? `${env.STAGE ?? "dev"}-trellis-idempotency`);
+        // G4 HIGH-1: scope the dedup key by tenant (preferred) or user.
+        const scope = deriveScope(context);
+        const pk = (0, idempotency_store_1.buildPk)(rawKey, scope);
+        // ── Check existing record ─────────────────────────────────────────────────
+        const existing = await store.get(pk);
+        if (existing) {
+            // Hash mismatch → 422
+            if (existing.requestHash !== requestHash) {
+                return jsonError(422, "IDEMPOTENCY_KEY_REUSE", "This Idempotency-Key was used with a different request body.", "Use a fresh Idempotency-Key per logically distinct request.");
+            }
+            // In-flight: poll for the winner's response
+            if ((0, idempotency_store_1.isInFlight)(existing)) {
+                return await pollForResolution(store, pk, requestHash);
+            }
+            // Cached response → replay
+            return buildReplay(existing);
+        }
+        // ── Claim the key with a conditional write ────────────────────────────────
+        // G4 MEDIUM-5: write a SHORT-TTL sentinel here. If the worker dies
+        // between this claim and the resolve/delete step, the row evaporates
+        // on its own within ~60s and a retry can succeed. The full 24h TTL
+        // is only assigned after a successful resolve.
+        const nowSec = Math.floor(Date.now() / 1000);
+        const inFlightRecord = {
+            pk,
+            requestHash,
+            responseStatus: 0,
+            responseBody: idempotency_store_1.IN_FLIGHT_SENTINEL,
+            responseHeaders: {},
+            expiresAt: nowSec + idempotency_store_1.IDEMPOTENCY_IN_FLIGHT_TTL_SECONDS,
+        };
+        const claimed = await store.putIfAbsent(inFlightRecord);
+        if (!claimed) {
+            // Lost the race — another worker claimed the key in the gap between
+            // our get() returning null and our putIfAbsent().
+            return await pollForResolution(store, pk, requestHash);
+        }
+        // ── We own the key: execute the handler ──────────────────────────────────
+        // We've consumed request.body. Patch context.request so downstream middleware
+        // and the route handler see a readable body again.
+        const freshRequest = new Request(request, { body: bodyBytes.length > 0 ? bodyBytes : null });
+        context.request = freshRequest;
+        let response;
+        try {
+            response = await next.call(undefined);
+        }
+        catch (err) {
+            // Handler threw — release the claim so retries aren't permanently blocked.
+            await store.delete(pk).catch(() => { });
+            throw err;
+        }
+        // ── Persist the response (only on success 2xx/3xx) ───────────────────────
+        if (response.status < 400) {
+            const responseBodyText = await response.clone().text();
+            const headersToStore = {};
+            response.headers.forEach((value, name) => {
+                if (!REPLAY_HEADER_DENYLIST.has(name.toLowerCase())) {
+                    headersToStore[name] = value;
+                }
+            });
+            const resolvedRecord = {
+                pk,
+                requestHash,
+                responseStatus: response.status,
+                responseBody: responseBodyText,
+                responseHeaders: headersToStore,
+                expiresAt: nowSec + idempotency_store_1.IDEMPOTENCY_TTL_SECONDS,
+            };
+            await store.resolve(resolvedRecord).catch(() => { });
+        }
+        else {
+            // Non-success: release the claim so the caller can retry with the same key.
+            await store.delete(pk).catch(() => { });
+        }
+        // ── Return original response with replay=false marker ────────────────────
+        const mutableResponse = new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: response.headers,
+        });
+        mutableResponse.headers.set("Idempotency-Replay", "false");
+        return mutableResponse;
+    };
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Helpers
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Strict Content-Length parser. Returns null when the header is absent,
+ * throws "body_too_large" when the value is malformed (G4 HIGH-3) or
+ * exceeds `maxBytes`. We reject anything that isn't a sequence of ASCII
+ * digits — `-1`, `1.0e10`, hex literals, etc. — because the looser
+ * parseInt(value, 10) silently absorbs them and the resulting limit
+ * check is bypassable.
+ */
+const STRICT_CONTENT_LENGTH_RE = /^[0-9]+$/;
+/**
+ * Read the request body into a Uint8Array.
+ * Throws if the body exceeds `maxBytes`.
+ */
+async function readBodyWithLimit(request, maxBytes) {
+    const contentLength = request.headers.get("content-length");
+    if (contentLength !== null) {
+        if (!STRICT_CONTENT_LENGTH_RE.test(contentLength)) {
+            throw new Error("body_too_large");
+        }
+        const len = Number(contentLength);
+        if (!Number.isFinite(len) || len > maxBytes) {
+            throw new Error("body_too_large");
+        }
+    }
+    const reader = request.body?.getReader();
+    if (!reader) {
+        return new Uint8Array(0);
+    }
+    const chunks = [];
+    let totalBytes = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        if (value) {
+            totalBytes += value.byteLength;
+            if (totalBytes > maxBytes) {
+                reader.cancel().catch(() => { });
+                throw new Error("body_too_large");
+            }
+            chunks.push(value);
+        }
+    }
+    // Concatenate chunks
+    const combined = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        combined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return combined;
+}
+/**
+ * Poll the store for up to IN_FLIGHT_POLL_ATTEMPTS × IN_FLIGHT_POLL_INTERVAL_MS,
+ * waiting for an in-flight record to be resolved by the primary worker.
+ * Returns the cached response on resolution, or 409 on exhaustion.
+ */
+async function pollForResolution(store, pk, requestHash) {
+    for (let attempt = 0; attempt < IN_FLIGHT_POLL_ATTEMPTS; attempt++) {
+        await sleep(IN_FLIGHT_POLL_INTERVAL_MS);
+        const record = await store.get(pk);
+        if (!record) {
+            // Primary failed and deleted the claim — treat as if no record exists.
+            // Caller will retry; for now return 409 to avoid re-running the handler.
+            break;
+        }
+        if (record.requestHash !== requestHash) {
+            return jsonError(422, "IDEMPOTENCY_KEY_REUSE", "This Idempotency-Key was used with a different request body.", "Use a fresh Idempotency-Key per logically distinct request.");
+        }
+        if (!(0, idempotency_store_1.isInFlight)(record)) {
+            return buildReplay(record);
+        }
+    }
+    return jsonError(409, "IDEMPOTENCY_KEY_IN_FLIGHT", "Another request with this Idempotency-Key is still being processed.", "Wait a moment and retry, or use a new Idempotency-Key.");
+}
+/**
+ * Reconstruct a Response from a cached IdempotencyRecord and add replay header.
+ */
+function buildReplay(record) {
+    const headers = new Headers(record.responseHeaders);
+    headers.set("Idempotency-Replay", "true");
+    headers.set("content-type", headers.get("content-type") ?? "application/json");
+    return new Response(record.responseBody, {
+        status: record.responseStatus,
+        headers,
+    });
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/lib/middleware/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../../src/lib/middleware/idempotency.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6GH,4CAKC;AAMD,sBAEC;AAUD,sDAmJC;AArRD,oDAAsC;AAEtC,2DAU6B;AAE7B,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C,uDAAuD;AACvD,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC,mDAAmD;AACnD,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,kDAAkD;AAClD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,YAAY;IACZ,2BAA2B;IAC3B,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,yBAAyB;IACzB,oBAAoB;IACpB,4BAA4B;IAC5B,6BAA6B;IAC7B,kCAAkC;IAClC,8BAA8B;IAC9B,8BAA8B;IAC9B,mBAAmB;IACnB,YAAY;IACZ,kEAAkE;IAClE,oEAAoE;IACpE,8CAA8C;IAC9C,eAAe;IACf,kBAAkB;IAClB,oBAAoB;IACpB,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,OAMpB;IACC,MAAM,OAAO,GAAI,OAAmE,CAAC,IAAI,CAAC;IAC1F,IAAI,OAAO,EAAE,cAAc;QAAE,OAAO,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;IAElE,mDAAmD;IACnD,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElC,IAAI,OAAO,EAAE,MAAM;QAAE,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,SAAS,SAAS,CAChB,MAAc,EACd,KAAa,EACb,OAAe,EACf,WAAmB;IAEnB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE;QACnE,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,MAAc,EAAE,IAAY,EAAE,IAAgB;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,mCAAmC;AACnC,gFAAgF;AAEhF,SAAgB,KAAK,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,aAAyC;IAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAEjC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAEtD,6EAA6E;QAC7E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,4EAA4E;QAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,6EAA6E;QAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,cAAc,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9F,OAAO,SAAS,CACd,GAAG,EACH,yBAAyB,EACzB,6BAA6B,cAAc,8BAA8B,EACzE,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,IAAI,SAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CACd,GAAG,EACH,4BAA4B,EAC5B,4BAA4B,cAAc,GAAG,IAAI,GAAG,IAAI,wCAAwC,EAChG,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAElF,6EAA6E;QAC7E,MAAM,SAAS,GAAI,GAAW,CAAC,iBAAuC,CAAC;QACvE,MAAM,KAAK,GACT,aAAa,IAAI,IAAI,0CAAsB,CAAC,SAAS,IAAI,GAAI,GAAW,CAAC,KAAK,IAAI,KAAK,sBAAsB,CAAC,CAAC;QAEjH,gEAAgE;QAChE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAA,2BAAO,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAElC,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAErC,IAAI,QAAQ,EAAE,CAAC;YACb,sBAAsB;YACtB,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBACzC,OAAO,SAAS,CACd,GAAG,EACH,uBAAuB,EACvB,8DAA8D,EAC9D,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YAED,4CAA4C;YAC5C,IAAI,IAAA,8BAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;YACzD,CAAC;YAED,2BAA2B;YAC3B,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,6EAA6E;QAC7E,mEAAmE;QACnE,qEAAqE;QACrE,mEAAmE;QACnE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAiB;YACnC,EAAE;YACF,WAAW;YACX,cAAc,EAAE,CAAC;YACjB,YAAY,EAAE,sCAAkB;YAChC,eAAe,EAAE,EAAE;YACnB,SAAS,EAAE,MAAM,GAAG,qDAAiC;SACtD,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QAExD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,oEAAoE;YACpE,kDAAkD;YAClD,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QAED,4EAA4E;QAC5E,8EAA8E;QAC9E,mDAAmD;QACnD,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,SAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,OAAgC,CAAC,OAAO,GAAG,YAAY,CAAC;QAEzD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAqB,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,4EAA4E;QAC5E,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1B,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,cAAc,GAA2B,EAAE,CAAC;YAClD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACvC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACpD,cAAc,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBAC/B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAsB;gBACxC,EAAE;gBACF,WAAW;gBACX,cAAc,EAAE,QAAQ,CAAC,MAAM;gBAC/B,YAAY,EAAE,gBAAgB;gBAC9B,eAAe,EAAE,cAAc;gBAC/B,SAAS,EAAE,MAAM,GAAG,2CAAuB;aAC5C,CAAC;YAEF,MAAM,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAoD,CAAC,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,4EAA4E;YAC5E,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAqB,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,4EAA4E;QAC5E,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YAClD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAE5C;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,QAAgB;IACjE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAgB,CAAC,CAAC,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAAgC,EAChC,EAAU,EACV,WAAmB;IAEnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,EAAE,EAAE,CAAC;QACnE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,uEAAuE;YACvE,yEAAyE;YACzE,MAAM;QACR,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,OAAO,SAAS,CACd,GAAG,EACH,uBAAuB,EACvB,8DAA8D,EAC9D,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAA,8BAAU,EAAC,MAAM,CAAC,EAAE,CAAC;YACxB,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CACd,GAAG,EACH,2BAA2B,EAC3B,qEAAqE,EACrE,wDAAwD,CACzD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAAyB;IAC5C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,CAAC;IAC/E,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;QACvC,MAAM,EAAE,MAAM,CAAC,cAAc;QAC7B,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/net/trusted-client-ip.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Trusted client-IP derivation (G4 CRITICAL-3, LOW-1, LOW-3).
+ *
+ * The previous pattern — `X-Forwarded-For.split(",")[0]` plus
+ * `CF-Connecting-IP` — assumed a Cloudflare-class trusted edge sitting
+ * in front of trellis. Behind ALB the leftmost XFF entry is supplied
+ * by the immediate client and is therefore caller-supplied input. This
+ * helper centralises IP derivation behind an explicit `TRUSTED_PROXY`
+ * env flag so the rule is the same for every call site.
+ *
+ * Configuration:
+ *   TRUSTED_PROXY=none         — default. Do not honour XFF or CF
+ *                                headers. Returns the connection's
+ *                                remote address only (or "unknown" if
+ *                                the runtime does not expose one).
+ *   TRUSTED_PROXY=alb          — application is behind a trusted ALB.
+ *                                Parse XFF taking the right-most
+ *                                appended hop (the ALB's view of the
+ *                                client) rather than the leftmost.
+ *   TRUSTED_PROXY=cloudflare   — application is fronted by Cloudflare.
+ *                                Trust CF-Connecting-IP.
+ *
+ * The result is always validated against an IPv4/IPv6 shape regex.
+ * Anything that does not match returns the literal string "unknown" so
+ * downstream rate-limit keys cannot be poisoned with arbitrary content.
+ */
+interface RemoteAddrEnv {
+    TRUSTED_PROXY?: string;
+}
+/** True when `s` parses as an IPv4 dotted-quad or an IPv6 shape. */
+export declare function isIpShape(s: string): boolean;
+/**
+ * Derive a client IP we are willing to use for rate-limit keys / audit
+ * payloads. Always returns a non-empty string; "unknown" when nothing
+ * trustworthy is available.
+ */
+export declare function trustedClientIp(request: Request, env: RemoteAddrEnv): string;
+export {};
+//# sourceMappingURL=trusted-client-ip.d.ts.map

package/dist/lib/net/trusted-client-ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-client-ip.d.ts","sourceRoot":"","sources":["../../../src/lib/net/trusted-client-ip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,UAAU,aAAa;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAiBD,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAM5C;AAcD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CA4B5E"}

package/dist/lib/net/trusted-client-ip.js

@@ -0,0 +1,100 @@
+"use strict";
+/**
+ * Trusted client-IP derivation (G4 CRITICAL-3, LOW-1, LOW-3).
+ *
+ * The previous pattern — `X-Forwarded-For.split(",")[0]` plus
+ * `CF-Connecting-IP` — assumed a Cloudflare-class trusted edge sitting
+ * in front of trellis. Behind ALB the leftmost XFF entry is supplied
+ * by the immediate client and is therefore caller-supplied input. This
+ * helper centralises IP derivation behind an explicit `TRUSTED_PROXY`
+ * env flag so the rule is the same for every call site.
+ *
+ * Configuration:
+ *   TRUSTED_PROXY=none         — default. Do not honour XFF or CF
+ *                                headers. Returns the connection's
+ *                                remote address only (or "unknown" if
+ *                                the runtime does not expose one).
+ *   TRUSTED_PROXY=alb          — application is behind a trusted ALB.
+ *                                Parse XFF taking the right-most
+ *                                appended hop (the ALB's view of the
+ *                                client) rather than the leftmost.
+ *   TRUSTED_PROXY=cloudflare   — application is fronted by Cloudflare.
+ *                                Trust CF-Connecting-IP.
+ *
+ * The result is always validated against an IPv4/IPv6 shape regex.
+ * Anything that does not match returns the literal string "unknown" so
+ * downstream rate-limit keys cannot be poisoned with arbitrary content.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isIpShape = isIpShape;
+exports.trustedClientIp = trustedClientIp;
+/**
+ * IPv4 dotted-quad: each octet 0-255. Permissive enough to pass any
+ * real-world value while rejecting obvious garbage (newlines, commas,
+ * SQL fragments, etc.).
+ */
+const IPV4_RE = /^(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
+/**
+ * IPv6 shape check. Intentionally loose — accepts compressed and
+ * uncompressed forms, IPv4-mapped, scope IDs — but rejects anything
+ * containing characters outside the IPv6 alphabet.
+ */
+const IPV6_RE = /^[0-9a-fA-F:.%]+$/;
+/** True when `s` parses as an IPv4 dotted-quad or an IPv6 shape. */
+function isIpShape(s) {
+    if (!s)
+        return false;
+    if (s.length > 64)
+        return false;
+    if (IPV4_RE.test(s))
+        return true;
+    if (s.includes(":") && IPV6_RE.test(s))
+        return true;
+    return false;
+}
+/** Read a remote-address hint from a `Request` if the runtime exposes one. */
+function remoteAddrFromRequest(request) {
+    // Node 22+ behind Express may attach the socket via this property.
+    // Web/Cloudflare runtimes do not. Treat anything else as absent.
+    const candidate = request
+        .socket?.remoteAddress;
+    if (typeof candidate === "string" && candidate.length > 0) {
+        return candidate;
+    }
+    return null;
+}
+/**
+ * Derive a client IP we are willing to use for rate-limit keys / audit
+ * payloads. Always returns a non-empty string; "unknown" when nothing
+ * trustworthy is available.
+ */
+function trustedClientIp(request, env) {
+    const mode = (env.TRUSTED_PROXY ?? "none").toLowerCase();
+    if (mode === "cloudflare") {
+        const cf = request.headers.get("CF-Connecting-IP");
+        if (cf && isIpShape(cf.trim()))
+            return cf.trim();
+        return "unknown";
+    }
+    if (mode === "alb") {
+        // ALB appends the immediate client to XFF. The right-most entry is
+        // therefore the value the ALB itself observed, which is the closest
+        // we can get to the real source address while behind a single
+        // trusted proxy hop.
+        const xff = request.headers.get("X-Forwarded-For");
+        if (xff) {
+            const parts = xff.split(",").map((p) => p.trim()).filter(Boolean);
+            const candidate = parts[parts.length - 1];
+            if (candidate && isIpShape(candidate))
+                return candidate;
+        }
+        return "unknown";
+    }
+    // mode === "none" (default). Do not trust XFF or CF headers. Use the
+    // connection's remote address only when the runtime exposes one.
+    const remote = remoteAddrFromRequest(request);
+    if (remote && isIpShape(remote))
+        return remote;
+    return "unknown";
+}
+//# sourceMappingURL=trusted-client-ip.js.map

package/dist/lib/net/trusted-client-ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-client-ip.js","sourceRoot":"","sources":["../../../src/lib/net/trusted-client-ip.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;AAsBH,8BAMC;AAmBD,0CA4BC;AArED;;;;GAIG;AACH,MAAM,OAAO,GACX,6EAA6E,CAAC;AAEhF;;;;GAIG;AACH,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC,oEAAoE;AACpE,SAAgB,SAAS,CAAC,CAAS;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,qBAAqB,CAAC,OAAgB;IAC7C,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,SAAS,GAAI,OAA8D;SAC9E,MAAM,EAAE,aAAa,CAAC;IACzB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,OAAgB,EAAE,GAAkB;IAClE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAEzD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,mEAAmE;QACnE,oEAAoE;QACpE,8DAA8D;QAC9D,qBAAqB;QACrB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACnD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1C,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC1D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/notification-handler.d.ts

@@ -26,27 +26,27 @@ export declare class NotificationHandler {
      * Create a notification for a user.
      * Checks preferences (unless SAFETY_ALERT or PARENTAL_LINK) and quiet hours.
      */
-    createNotification(userId: string, type: NotificationType, title: string, body: string, data: any, env: Env): Promise<{
+    createNotification(userId: string, type: NotificationType, title: string, body: string, data: any, env: Env, tenantId: string): Promise<{
         id: string;
     }>;
     /**
      * Get paginated notifications for a user.
      */
-    getNotifications(userId: string, cursor: string | null, limit: number, env: Env): Promise<NotificationListResponse>;
+    getNotifications(userId: string, cursor: string | null, limit: number, env: Env, tenantId: string): Promise<NotificationListResponse>;
     /**
      * Mark a single notification as read. Verifies it belongs to the user.
      */
-    markRead(userId: string, notificationId: string, env: Env): Promise<void>;
+    markRead(userId: string, notificationId: string, env: Env, tenantId: string): Promise<void>;
     /**
      * Mark all unread notifications as read for a user.
      */
-    markAllRead(userId: string, env: Env): Promise<void>;
+    markAllRead(userId: string, env: Env, tenantId: string): Promise<void>;
     /**
      * Get unread notification count.
      * CHILD/TEEN: return { hasUnread: boolean } only (no exact count).
      * ADULT: return { hasUnread: boolean, count: number }.
      */
-    getUnreadCount(userId: string, ageTier: string, env: Env): Promise<{
+    getUnreadCount(userId: string, ageTier: string, env: Env, tenantId: string): Promise<{
         hasUnread: boolean;
         count?: number;
     }>;

package/dist/lib/notification-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification-handler.d.ts","sourceRoot":"","sources":["../../src/lib/notification-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIvD,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,KAAK,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,gBAAgB,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,GAAG,CAAC;QACV,IAAI,EAAE,OAAO,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAQD,qBAAa,mBAAmB;IAC9B;;;OAGG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,GAAG,EACT,GAAG,EAAE,GAAG,GACP,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAkE1B;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,wBAAwB,CAAC;IAsCpC;;OAEG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IAqBhB;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAa1D;;;;OAIG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,GAAG,GACP,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAwBlD;;OAEG;IACH,OAAO,CAAC,aAAa;IAgCrB;;OAEG;IACH,OAAO,CAAC,cAAc;CA0BvB;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,cAAc,EAAE,MAAM;CAInC"}
+{"version":3,"file":"notification-handler.d.ts","sourceRoot":"","sources":["../../src/lib/notification-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIvD,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,KAAK,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,gBAAgB,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,GAAG,CAAC;QACV,IAAI,EAAE,OAAO,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAQD,qBAAa,mBAAmB;IAC9B;;;OAGG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,GAAG,EACT,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAmE1B;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,wBAAwB,CAAC;IAuCpC;;OAEG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAqBhB;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa5E;;;;OAIG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAwBlD;;OAEG;IACH,OAAO,CAAC,aAAa;IAgCrB;;OAEG;IACH,OAAO,CAAC,cAAc;CA0BvB;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,cAAc,EAAE,MAAM;CAInC"}

package/dist/lib/notification-handler.js

@@ -21,7 +21,7 @@ class NotificationHandler {
      * Create a notification for a user.
      * Checks preferences (unless SAFETY_ALERT or PARENTAL_LINK) and quiet hours.
      */
-    async createNotification(userId, type, title, body, data, env) {
+    async createNotification(userId, type, title, body, data, env, tenantId) {
         const logger = logger_1.Logger.getInstance(env);
         const db = (0, db_1.createPrisma)(env);
         try {
@@ -68,6 +68,7 @@ class NotificationHandler {
                     body,
                     data: data ?? undefined,
                     deliveredAt,
+                    tenantId,
                 },
             });
             return { id: notification.id };
@@ -83,13 +84,14 @@ class NotificationHandler {
     /**
      * Get paginated notifications for a user.
      */
-    async getNotifications(userId, cursor, limit, env) {
+    async getNotifications(userId, cursor, limit, env, tenantId) {
         const db = (0, db_1.createPrisma)(env);
         try {
             const safeLimit = Math.min(Math.max(limit, 1), 50);
             const notifications = await db.notification.findMany({
                 where: {
                     userId,
+                    tenantId,
                     ...(cursor ? { createdAt: { lt: new Date(cursor) } } : {}),
                 },
                 orderBy: { createdAt: "desc" },
@@ -120,11 +122,11 @@ class NotificationHandler {
     /**
      * Mark a single notification as read. Verifies it belongs to the user.
      */
-    async markRead(userId, notificationId, env) {
+    async markRead(userId, notificationId, env, tenantId) {
         const db = (0, db_1.createPrisma)(env);
         try {
             const notification = await db.notification.findFirst({
-                where: { id: notificationId, userId },
+                where: { id: notificationId, userId, tenantId },
             });
             if (!notification) {
                 throw new NotificationNotFoundError(notificationId);
@@ -141,11 +143,11 @@ class NotificationHandler {
     /**
      * Mark all unread notifications as read for a user.
      */
-    async markAllRead(userId, env) {
+    async markAllRead(userId, env, tenantId) {
         const db = (0, db_1.createPrisma)(env);
         try {
             await db.notification.updateMany({
-                where: { userId, read: false },
+                where: { userId, tenantId, read: false },
                 data: { read: true },
             });
         }
@@ -158,20 +160,20 @@ class NotificationHandler {
      * CHILD/TEEN: return { hasUnread: boolean } only (no exact count).
      * ADULT: return { hasUnread: boolean, count: number }.
      */
-    async getUnreadCount(userId, ageTier, env) {
+    async getUnreadCount(userId, ageTier, env, tenantId) {
         const db = (0, db_1.createPrisma)(env);
         try {
             if (ageTier === "CHILD" || ageTier === "TEEN") {
                 // For minors, only check existence (no exact count)
                 const first = await db.notification.findFirst({
-                    where: { userId, read: false },
+                    where: { userId, tenantId, read: false },
                     select: { id: true },
                 });
                 return { hasUnread: !!first };
             }
             // ADULT: return exact count
             const count = await db.notification.count({
-                where: { userId, read: false },
+                where: { userId, tenantId, read: false },
             });
             return { hasUnread: count > 0, count };
         }