@de-otio/trellis 0.6.0 → 0.7.0

package/dist/lib/tenant/tenant-handler.js

@@ -0,0 +1,377 @@
+"use strict";
+/**
+ * Tenant CRUD Handler
+ *
+ * Handlers for:
+ *  - POST /api/tenants          — create org tenant
+ *  - GET  /api/tenants/:id      — read tenant
+ *  - PATCH /api/tenants/:id     — update displayName
+ *  - GET  /api/users/me/tenants — list caller's memberships
+ *  - POST /api/auth/switch-tenant       — change active tenant + invalidate cache
+ *  - POST /api/tenants/:id/transfer-ownership — OWNER hand-off
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantHandler = void 0;
+const auth_middleware_1 = require("../auth/auth-middleware");
+const require_1 = require("../auth/require");
+const slug_validator_1 = require("./slug-validator");
+const claims_cache_1 = require("../auth/claims-cache");
+const transfer_ownership_1 = require("./transfer-ownership");
+const emit_1 = require("../audit/emit");
+const event_types_1 = require("../audit/event-types");
+const auditEmitter = new emit_1.AuditEventEmitter();
+class TenantHandler {
+    /**
+     * POST /api/tenants
+     * Creates an ORGANIZATION tenant. Caller becomes OWNER.
+     * If caller is END_USER their global role is bumped to B2B_PARTNER.
+     */
+    async handleCreate(request, auth, env) {
+        const { z } = await Promise.resolve().then(() => __importStar(require("zod")));
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return new Response(JSON.stringify({ error: "INVALID_JSON", message: "Request body must be valid JSON" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const schema = z.object({
+            slug: z.string(),
+            displayName: z.string().min(1).max(100),
+        });
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            return new Response(JSON.stringify({ error: "VALIDATION_ERROR", message: parsed.error.issues[0]?.message ?? "Invalid input" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const { slug, displayName } = parsed.data;
+        const slugResult = (0, slug_validator_1.validateTenantSlug)(slug);
+        if (!slugResult.ok) {
+            return new Response(JSON.stringify({ error: slugResult.code, message: slugResult.message }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        try {
+            const result = await db.$transaction(async (tx) => {
+                const tenant = await tx.tenant.create({
+                    data: {
+                        slug,
+                        displayName,
+                        type: "ORGANIZATION",
+                        status: "ACTIVE",
+                    },
+                });
+                await tx.tenantMember.create({
+                    data: {
+                        tenantId: tenant.id,
+                        userId: auth.userId,
+                        role: "OWNER",
+                        status: "ACTIVE",
+                        joinedAt: new Date(),
+                    },
+                });
+                // Idempotent role bump: END_USER → B2B_PARTNER.
+                await tx.user.updateMany({
+                    where: { id: auth.userId, role: "END_USER" },
+                    data: { role: "B2B_PARTNER" },
+                });
+                return tenant;
+            });
+            void auditEmitter.emit({
+                type: event_types_1.AuditEventType.TENANT_CREATED,
+                tenantId: result.id,
+                actorUserId: auth.userId,
+                payload: { tenantId: result.id, slug: result.slug, displayName: result.displayName, type: "ORGANIZATION" },
+            }, db);
+            return new Response(JSON.stringify({ id: result.id, slug: result.slug, displayName: result.displayName }), { status: 201, headers: { "content-type": "application/json" } });
+        }
+        catch (err) {
+            if (err instanceof Error &&
+                err.code === "P2002") {
+                return new Response(JSON.stringify({ error: "SLUG_TAKEN", message: "A tenant with this slug already exists" }), { status: 409, headers: { "content-type": "application/json" } });
+            }
+            throw err;
+        }
+    }
+    /**
+     * GET /api/tenants/:id
+     * Returns the tenant. Caller must be an active member.
+     */
+    async handleGet(tenantId, auth, env) {
+        // GET /api/tenants/:id is a data endpoint — leak nothing about tenants
+        // outside the caller's scope. requireOwnTenant returns the same 404 as a
+        // missing tenant, so the response does not distinguish the two cases.
+        const denied = (0, auth_middleware_1.requireOwnTenant)(auth, tenantId);
+        if (denied)
+            return denied;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const tenant = await db.tenant.findUnique({
+            where: { id: tenantId },
+            select: {
+                id: true,
+                slug: true,
+                displayName: true,
+                type: true,
+                status: true,
+                createdAt: true,
+            },
+        });
+        if (!tenant) {
+            return new Response(JSON.stringify({ error: "NOT_FOUND", message: "Tenant not found" }), { status: 404, headers: { "content-type": "application/json" } });
+        }
+        return new Response(JSON.stringify(tenant), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        });
+    }
+    /**
+     * PATCH /api/tenants/:id
+     * Updates displayName. Requires OWNER or ADMIN.
+     */
+    async handleUpdate(tenantId, request, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireRole)(auth, "ADMIN");
+        if (denied)
+            return denied;
+        const { z } = await Promise.resolve().then(() => __importStar(require("zod")));
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return new Response(JSON.stringify({ error: "INVALID_JSON", message: "Request body must be valid JSON" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const schema = z.object({
+            displayName: z.string().min(1).max(100),
+        });
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            return new Response(JSON.stringify({ error: "VALIDATION_ERROR", message: parsed.error.issues[0]?.message ?? "Invalid input" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const tenant = await db.tenant.findUnique({
+            where: { id: tenantId },
+            select: { id: true },
+        });
+        if (!tenant) {
+            return new Response(JSON.stringify({ error: "NOT_FOUND", message: "Tenant not found" }), { status: 404, headers: { "content-type": "application/json" } });
+        }
+        const updated = await db.tenant.update({
+            where: { id: tenantId },
+            data: { displayName: parsed.data.displayName },
+            select: { id: true, slug: true, displayName: true },
+        });
+        void auditEmitter.emit({
+            type: event_types_1.AuditEventType.TENANT_UPDATED,
+            tenantId,
+            actorUserId: auth.userId,
+            payload: { tenantId, displayName: parsed.data.displayName },
+        }, db);
+        return new Response(JSON.stringify(updated), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        });
+    }
+    /**
+     * GET /api/users/me/tenants
+     * Lists all active tenant memberships for the caller.
+     */
+    async handleListMyTenants(auth, env) {
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const memberships = await db.tenantMember.findMany({
+            where: { userId: auth.userId, status: "ACTIVE" },
+            include: {
+                tenant: {
+                    select: {
+                        id: true,
+                        slug: true,
+                        displayName: true,
+                        type: true,
+                        status: true,
+                    },
+                },
+            },
+            orderBy: { joinedAt: "asc" },
+        });
+        const result = memberships.map((m) => ({
+            tenantId: m.tenantId,
+            role: m.role,
+            tenant: m.tenant,
+        }));
+        return new Response(JSON.stringify({ memberships: result }), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        });
+    }
+    /**
+     * POST /api/auth/switch-tenant
+     * Changes the user's active tenant. Invalidates DynamoDB claim cache so
+     * the next token refresh picks up the new activeTenantId.
+     */
+    async handleSwitchTenant(request, auth, env) {
+        const { z } = await Promise.resolve().then(() => __importStar(require("zod")));
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return new Response(JSON.stringify({ error: "INVALID_JSON", message: "Request body must be valid JSON" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const schema = z.object({ tenantId: z.string().min(1) });
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            return new Response(JSON.stringify({ error: "VALIDATION_ERROR", message: "tenantId is required" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const { tenantId } = parsed.data;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const membership = await db.tenantMember.findUnique({
+            where: {
+                tenantId_userId: { tenantId, userId: auth.userId },
+            },
+            select: { status: true },
+        });
+        if (!membership) {
+            return new Response(JSON.stringify({ error: "FORBIDDEN", message: "You are not a member of this tenant" }), { status: 403, headers: { "content-type": "application/json" } });
+        }
+        if (membership.status !== "ACTIVE") {
+            return new Response(JSON.stringify({ error: "FORBIDDEN", message: "Your membership in this tenant is not active" }), { status: 403, headers: { "content-type": "application/json" } });
+        }
+        // Look up tenant slug + role for cache write so the next pre-token-gen
+        // invocation reads the user's chosen tenant rather than re-running the
+        // first-org-then-personal heuristic.
+        const tenantWithRole = await db.tenantMember.findUnique({
+            where: { tenantId_userId: { tenantId, userId: auth.userId } },
+            select: {
+                role: true,
+                tenant: { select: { slug: true } },
+            },
+        });
+        // Persist the user's chosen tenant in the DDB claim cache so the next
+        // pre-token-generation invocation honors the choice rather than reverting
+        // to the first-org / personal-tenant heuristic.
+        try {
+            const cache = (0, claims_cache_1.createClaimsCacheFromEnv)();
+            if (tenantWithRole) {
+                await cache.invalidate(auth.cognitoSub);
+                await cache.put(auth.cognitoSub, {
+                    userId: auth.userId,
+                    globalRole: auth.globalRole,
+                    activeTenantId: tenantId,
+                    tenantSlug: tenantWithRole.tenant.slug,
+                    tenantRole: tenantWithRole.role,
+                    handle: auth.handle,
+                });
+            }
+            else {
+                await cache.invalidate(auth.cognitoSub);
+            }
+        }
+        catch {
+            // Cache write is best-effort: don't block the switch if DDB is
+            // unavailable. The TTL-based expiry will eventually correct stale data.
+        }
+        return new Response(JSON.stringify({ ok: true, tenantId }), { status: 200, headers: { "content-type": "application/json" } });
+    }
+    /**
+     * POST /api/tenants/:id/transfer-ownership
+     * Current OWNER hands off ownership to another active member.
+     * Both users' cache entries are invalidated.
+     */
+    async handleTransferOwnership(tenantId, request, auth, env) {
+        const activeTenantDenied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId);
+        if (activeTenantDenied)
+            return activeTenantDenied;
+        const roleDenied = (0, require_1.requireRole)(auth, "OWNER");
+        if (roleDenied)
+            return roleDenied;
+        const { z } = await Promise.resolve().then(() => __importStar(require("zod")));
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return new Response(JSON.stringify({ error: "INVALID_JSON", message: "Request body must be valid JSON" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const schema = z.object({ newOwnerUserId: z.string().min(1) });
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            return new Response(JSON.stringify({ error: "VALIDATION_ERROR", message: "newOwnerUserId is required" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const { newOwnerUserId } = parsed.data;
+        if (newOwnerUserId === auth.userId) {
+            return new Response(JSON.stringify({ error: "VALIDATION_ERROR", message: "New owner must be a different user" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const result = await (0, transfer_ownership_1.transferOwnership)({
+            db,
+            tenantId,
+            currentOwnerUserId: auth.userId,
+            newOwnerUserId,
+        });
+        if (!result.ok) {
+            if (result.code === "NOT_MEMBER" || result.code === "INACTIVE") {
+                return new Response(JSON.stringify({ error: "NOT_FOUND", message: "New owner must be an active member of this tenant" }), { status: 404, headers: { "content-type": "application/json" } });
+            }
+            if (result.code === "ALREADY_OWNER") {
+                return new Response(JSON.stringify({ error: "VALIDATION_ERROR", message: "New owner must be a different user" }), { status: 400, headers: { "content-type": "application/json" } });
+            }
+            return new Response(JSON.stringify({ error: "CONFLICT", message: "OWNER row not found" }), { status: 409, headers: { "content-type": "application/json" } });
+        }
+        void auditEmitter.emit({
+            type: event_types_1.AuditEventType.TENANT_OWNERSHIP_TRANSFERRED,
+            tenantId,
+            actorUserId: auth.userId,
+            payload: { tenantId, actorUserId: auth.userId, targetUserId: newOwnerUserId, oldRole: "OWNER", newRole: "ADMIN" },
+        }, db);
+        try {
+            const cache = (0, claims_cache_1.createClaimsCacheFromEnv)();
+            await Promise.all([
+                result.oldOwnerCognitoSub ? cache.invalidate(result.oldOwnerCognitoSub) : Promise.resolve(),
+                result.newOwnerCognitoSub ? cache.invalidate(result.newOwnerCognitoSub) : Promise.resolve(),
+            ]);
+        }
+        catch {
+            // Best-effort; don't block the transfer.
+        }
+        return new Response(JSON.stringify({ ok: true, newOwnerId: newOwnerUserId }), { status: 200, headers: { "content-type": "application/json" } });
+    }
+}
+exports.TenantHandler = TenantHandler;
+//# sourceMappingURL=tenant-handler.js.map

package/dist/lib/tenant/tenant-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-handler.js","sourceRoot":"","sources":["../../../src/lib/tenant/tenant-handler.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKH,6DAAgF;AAChF,6CAA8C;AAC9C,qDAAsD;AACtD,uDAAgE;AAChE,6DAAyD;AACzD,wCAAkD;AAClD,sDAAsD;AAEtD,MAAM,YAAY,GAAG,IAAI,wBAAiB,EAAE,CAAC;AAE7C,MAAa,aAAa;IACxB;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,OAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,EAAE,CAAC,EAAE,GAAG,wDAAa,KAAK,GAAC,CAAC;QAClC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,EACrF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE,CAAC,EAC1G,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAE1C,MAAM,UAAU,GAAG,IAAA,mCAAkB,EAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EACvE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,EAA4B,EAAE,EAAE;gBAC1E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;oBACpC,IAAI,EAAE;wBACJ,IAAI;wBACJ,WAAW;wBACX,IAAI,EAAE,cAAc;wBACpB,MAAM,EAAE,QAAQ;qBACjB;iBACF,CAAC,CAAC;gBAEH,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;oBAC3B,IAAI,EAAE;wBACJ,QAAQ,EAAE,MAAM,CAAC,EAAE;wBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,QAAQ;wBAChB,QAAQ,EAAE,IAAI,IAAI,EAAE;qBACrB;iBACF,CAAC,CAAC;gBAEH,gDAAgD;gBAChD,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;oBACvB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE;oBAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;iBAC9B,CAAC,CAAC;gBAEH,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,KAAK,YAAY,CAAC,IAAI,CACpB;gBACE,IAAI,EAAE,4BAAc,CAAC,cAAc;gBACnC,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,WAAW,EAAE,IAAI,CAAC,MAAM;gBACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE;aAC3G,EACD,EAAE,CACH,CAAC;YAEF,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,EACrF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IACE,GAAG,YAAY,KAAK;gBACnB,GAAyB,CAAC,IAAI,KAAK,OAAO,EAC3C,CAAC;gBACD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAC1F,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,MAAM,GAAG,IAAA,kCAAgB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACvB,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,IAAI;gBACjB,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI;aAChB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,EACnE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YAC1C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,OAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,MAAM,GACV,IAAA,qCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC;YACnC,IAAA,qBAAW,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,EAAE,CAAC,EAAE,GAAG,wDAAa,KAAK,GAAC,CAAC;QAClC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,EACrF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE,CAAC,EAC1G,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACvB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,EACnE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACvB,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE;YAC9C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;SACpD,CAAC,CAAC;QAEH,KAAK,YAAY,CAAC,IAAI,CACpB;YACE,IAAI,EAAE,4BAAc,CAAC,cAAc;YACnC,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE;SAC5D,EACD,EAAE,CACH,CAAC;QAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;YAC3C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACvB,IAAiB,EACjB,GAAQ;QAER,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;YACjD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;YAChD,OAAO,EAAE;gBACP,MAAM,EAAE;oBACN,MAAM,EAAE;wBACN,EAAE,EAAE,IAAI;wBACR,IAAI,EAAE,IAAI;wBACV,WAAW,EAAE,IAAI;wBACjB,IAAI,EAAE,IAAI;wBACV,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;YACD,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;SAC7B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAI/B,EAAE,EAAE,CAAC,CAAC;YACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;QAEJ,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE;YAC3D,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,EAAE,CAAC,EAAE,GAAG,wDAAa,KAAK,GAAC,CAAC;QAClC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,EACrF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,EAC9E,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAEjC,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YAClD,KAAK,EAAE;gBACL,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACnD;YACD,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,EACtF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,EAC/F,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,qCAAqC;QACrC,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YACtD,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YAC7D,MAAM,EAAE;gBACN,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;aACnC;SACF,CAAC,CAAC;QAEH,sEAAsE;QACtE,0EAA0E;QAC1E,gDAAgD;QAChD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAA,uCAAwB,GAAE,CAAC;YACzC,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE;oBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,cAAc,EAAE,QAAQ;oBACxB,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI;oBACtC,UAAU,EAAE,cAAc,CAAC,IAAI;oBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,wEAAwE;QAC1E,CAAC;QAED,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,uBAAuB,CAC3B,QAAgB,EAChB,OAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,kBAAkB,GAAG,IAAA,qCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/D,IAAI,kBAAkB;YAAE,OAAO,kBAAkB,CAAC;QAElD,MAAM,UAAU,GAAG,IAAA,qBAAW,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,MAAM,EAAE,CAAC,EAAE,GAAG,wDAAa,KAAK,GAAC,CAAC;QAClC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,EACrF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,EACpF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACvC,IAAI,cAAc,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,EAC5F,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAiB,EAAC;YACrC,EAAE;YACF,QAAQ;YACR,kBAAkB,EAAE,IAAI,CAAC,MAAM;YAC/B,cAAc;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,EACpG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACpC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,EAC5F,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,EACrE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,KAAK,YAAY,CAAC,IAAI,CACpB;YACE,IAAI,EAAE,4BAAc,CAAC,4BAA4B;YACjD,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;SAClH,EACD,EAAE,CACH,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAA,uCAAwB,GAAE,CAAC;YACzC,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;gBAC3F,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,EACxD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;CACF;AA7cD,sCA6cC"}

package/dist/lib/tenant/transfer-ownership.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Atomic OWNER swap.
+ *
+ * Single-OWNER invariant: exactly one TenantMember row in a tenant has
+ * `role = OWNER`. Promotion to OWNER happens only here (and at tenant
+ * creation). Both updates run in one Prisma transaction so a mid-transaction
+ * failure cannot leave the tenant with zero or two owners.
+ *
+ * Cache invalidation for both members runs after the transaction commits and
+ * is best-effort: a DDB hiccup must not roll back the role swap.
+ */
+import type { PrismaClient, TenantMember } from "@prisma/client";
+export type TransferResult = {
+    ok: true;
+    oldOwnerCognitoSub: string | null;
+    newOwnerCognitoSub: string | null;
+} | {
+    ok: false;
+    code: "NOT_MEMBER" | "ALREADY_OWNER" | "INACTIVE" | "OWNER_NOT_FOUND";
+};
+interface TransferOwnershipInput {
+    db: PrismaClient;
+    tenantId: string;
+    currentOwnerUserId: string;
+    newOwnerUserId: string;
+}
+/**
+ * Validates the candidate, then swaps roles in one transaction.
+ *
+ * Validation runs inside the transaction so a concurrent `member-remove`
+ * cannot race with us — once we've SELECTed the candidate's status as ACTIVE,
+ * the subsequent UPDATE is part of the same TX and either both rows commit
+ * or neither does.
+ */
+export declare function transferOwnership(input: TransferOwnershipInput): Promise<TransferResult>;
+/** Convenience: find the OWNER row for a tenant. Used by self-demotion checks. */
+export declare function findTenantOwner(db: PrismaClient, tenantId: string): Promise<TenantMember | null>;
+export {};
+//# sourceMappingURL=transfer-ownership.d.ts.map

package/dist/lib/tenant/transfer-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer-ownership.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant/transfer-ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAClF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,YAAY,GAAG,eAAe,GAAG,UAAU,GAAG,iBAAiB,CAAA;CAAE,CAAC;AAEzF,UAAU,sBAAsB;IAC9B,EAAE,EAAE,YAAY,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,cAAc,CAAC,CAyCzB;AAED,kFAAkF;AAClF,wBAAsB,eAAe,CACnC,EAAE,EAAE,YAAY,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAI9B"}

package/dist/lib/tenant/transfer-ownership.js

@@ -0,0 +1,66 @@
+"use strict";
+/**
+ * Atomic OWNER swap.
+ *
+ * Single-OWNER invariant: exactly one TenantMember row in a tenant has
+ * `role = OWNER`. Promotion to OWNER happens only here (and at tenant
+ * creation). Both updates run in one Prisma transaction so a mid-transaction
+ * failure cannot leave the tenant with zero or two owners.
+ *
+ * Cache invalidation for both members runs after the transaction commits and
+ * is best-effort: a DDB hiccup must not roll back the role swap.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.transferOwnership = transferOwnership;
+exports.findTenantOwner = findTenantOwner;
+/**
+ * Validates the candidate, then swaps roles in one transaction.
+ *
+ * Validation runs inside the transaction so a concurrent `member-remove`
+ * cannot race with us — once we've SELECTed the candidate's status as ACTIVE,
+ * the subsequent UPDATE is part of the same TX and either both rows commit
+ * or neither does.
+ */
+async function transferOwnership(input) {
+    const { db, tenantId, currentOwnerUserId, newOwnerUserId } = input;
+    if (currentOwnerUserId === newOwnerUserId) {
+        return { ok: false, code: "ALREADY_OWNER" };
+    }
+    return db.$transaction(async (tx) => {
+        const candidate = await tx.tenantMember.findUnique({
+            where: { tenantId_userId: { tenantId, userId: newOwnerUserId } },
+            select: { status: true, user: { select: { cognitoSub: true } } },
+        });
+        if (!candidate)
+            return { ok: false, code: "NOT_MEMBER" };
+        if (candidate.status !== "ACTIVE")
+            return { ok: false, code: "INACTIVE" };
+        const currentOwner = await tx.tenantMember.findUnique({
+            where: { tenantId_userId: { tenantId, userId: currentOwnerUserId } },
+            select: { role: true, user: { select: { cognitoSub: true } } },
+        });
+        if (!currentOwner || currentOwner.role !== "OWNER") {
+            return { ok: false, code: "OWNER_NOT_FOUND" };
+        }
+        await tx.tenantMember.update({
+            where: { tenantId_userId: { tenantId, userId: currentOwnerUserId } },
+            data: { role: "ADMIN" },
+        });
+        await tx.tenantMember.update({
+            where: { tenantId_userId: { tenantId, userId: newOwnerUserId } },
+            data: { role: "OWNER" },
+        });
+        return {
+            ok: true,
+            oldOwnerCognitoSub: currentOwner.user.cognitoSub,
+            newOwnerCognitoSub: candidate.user.cognitoSub,
+        };
+    });
+}
+/** Convenience: find the OWNER row for a tenant. Used by self-demotion checks. */
+async function findTenantOwner(db, tenantId) {
+    return db.tenantMember.findFirst({
+        where: { tenantId, role: "OWNER", status: "ACTIVE" },
+    });
+}
+//# sourceMappingURL=transfer-ownership.js.map

package/dist/lib/tenant/transfer-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer-ownership.js","sourceRoot":"","sources":["../../../src/lib/tenant/transfer-ownership.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAuBH,8CA2CC;AAGD,0CAOC;AA7DD;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAA6B;IAE7B,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAEnE,IAAI,kBAAkB,KAAK,cAAc,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC9C,CAAC;IAED,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAA2B,EAAE;QAC3D,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YACjD,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE;YAChE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;SACjE,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACzD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAE1E,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YACpD,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE;YACpE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE;YACpE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACxB,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE;YAChE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACxB,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,IAAI;YACR,kBAAkB,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU;YAChD,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,UAAU;SAC9C,CAAC;IACJ,CAAC,CAA4B,CAAC;AAChC,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,eAAe,CACnC,EAAgB,EAChB,QAAgB;IAEhB,OAAO,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;QAC/B,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;KACrD,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/user/derive-handle.d.ts

@@ -0,0 +1,29 @@
+/**
+ * User handle derivation from email local-part (T2 — JIT provisioning).
+ *
+ * Strategy:
+ *  1. Take the local-part (everything before `@`).
+ *  2. Lowercase, strip any character that isn't `[a-z0-9_-]`.
+ *  3. Truncate to {@link HANDLE_MAX_BASE_LENGTH} to leave room for collision
+ *     suffixes ("alice2" / "alice13") within the Cognito `custom:handle`
+ *     attribute ceiling of 32 chars.
+ *  4. If empty after stripping (e.g., handle was all punctuation, or the
+ *     email was malformed), fall back to {@link FALLBACK_HANDLE_PREFIX} +
+ *     a short random suffix.
+ *  5. On collision, append a numeric suffix and try again, up to
+ *     {@link MAX_COLLISION_ATTEMPTS}.
+ *
+ * The collision-check callback is injected so this module is pure and easy
+ * to test without Prisma. The lambda wires it to a `db.user.findFirst`.
+ */
+export type HandleExistsCheck = (handle: string) => Promise<boolean>;
+export declare function normalizeHandleBase(emailOrLocalPart: string | null | undefined): string;
+/**
+ * Derives a unique handle for a new user from their email address.
+ *
+ * @param email - the user's email address
+ * @param exists - async callback that returns true if `handle` is already in
+ *                 use by some other user. Inject the Prisma lookup here.
+ */
+export declare function deriveHandle(email: string | null | undefined, exists: HandleExistsCheck): Promise<string>;
+//# sourceMappingURL=derive-handle.d.ts.map

package/dist/lib/user/derive-handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-handle.d.ts","sourceRoot":"","sources":["../../../src/lib/user/derive-handle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAErE,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CASvF;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoBjB"}

package/dist/lib/user/derive-handle.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * User handle derivation from email local-part (T2 — JIT provisioning).
+ *
+ * Strategy:
+ *  1. Take the local-part (everything before `@`).
+ *  2. Lowercase, strip any character that isn't `[a-z0-9_-]`.
+ *  3. Truncate to {@link HANDLE_MAX_BASE_LENGTH} to leave room for collision
+ *     suffixes ("alice2" / "alice13") within the Cognito `custom:handle`
+ *     attribute ceiling of 32 chars.
+ *  4. If empty after stripping (e.g., handle was all punctuation, or the
+ *     email was malformed), fall back to {@link FALLBACK_HANDLE_PREFIX} +
+ *     a short random suffix.
+ *  5. On collision, append a numeric suffix and try again, up to
+ *     {@link MAX_COLLISION_ATTEMPTS}.
+ *
+ * The collision-check callback is injected so this module is pure and easy
+ * to test without Prisma. The lambda wires it to a `db.user.findFirst`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeHandleBase = normalizeHandleBase;
+exports.deriveHandle = deriveHandle;
+const HANDLE_MAX_BASE_LENGTH = 24;
+const HANDLE_TOTAL_MAX = 32;
+const MAX_COLLISION_ATTEMPTS = 100;
+const FALLBACK_HANDLE_PREFIX = "user";
+function normalizeHandleBase(emailOrLocalPart) {
+    if (!emailOrLocalPart)
+        return "";
+    const localPart = emailOrLocalPart.includes("@")
+        ? emailOrLocalPart.split("@")[0]
+        : emailOrLocalPart;
+    const cleaned = localPart
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]/g, "");
+    return cleaned.slice(0, HANDLE_MAX_BASE_LENGTH);
+}
+function randomSuffix() {
+    return Math.floor(Math.random() * 9000 + 1000).toString();
+}
+/**
+ * Derives a unique handle for a new user from their email address.
+ *
+ * @param email - the user's email address
+ * @param exists - async callback that returns true if `handle` is already in
+ *                 use by some other user. Inject the Prisma lookup here.
+ */
+async function deriveHandle(email, exists) {
+    let base = normalizeHandleBase(email);
+    if (!base) {
+        base = `${FALLBACK_HANDLE_PREFIX}${randomSuffix()}`.slice(0, HANDLE_MAX_BASE_LENGTH);
+    }
+    if (!(await exists(base)))
+        return base;
+    for (let suffix = 2; suffix <= MAX_COLLISION_ATTEMPTS; suffix++) {
+        const suffixStr = String(suffix);
+        const allowedBaseLen = HANDLE_TOTAL_MAX - suffixStr.length;
+        const truncatedBase = base.slice(0, allowedBaseLen);
+        const candidate = `${truncatedBase}${suffixStr}`;
+        if (!(await exists(candidate)))
+            return candidate;
+    }
+    return `${base.slice(0, HANDLE_TOTAL_MAX - 8)}${randomSuffix()}${randomSuffix().slice(0, 4)}`.slice(0, HANDLE_TOTAL_MAX);
+}
+//# sourceMappingURL=derive-handle.js.map

package/dist/lib/user/derive-handle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-handle.js","sourceRoot":"","sources":["../../../src/lib/user/derive-handle.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AASH,kDASC;AAaD,oCAuBC;AApDD,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAItC,SAAgB,mBAAmB,CAAC,gBAA2C;IAC7E,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9C,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,gBAAgB,CAAC;IACrB,MAAM,OAAO,GAAG,SAAS;SACtB,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAChC,KAAgC,EAChC,MAAyB;IAEzB,IAAI,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,GAAG,sBAAsB,GAAG,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,sBAAsB,EAAE,MAAM,EAAE,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,GAAG,aAAa,GAAG,SAAS,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IACnD,CAAC;IAED,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CACjG,CAAC,EACD,gBAAgB,CACjB,CAAC;AACJ,CAAC"}

package/dist/lib/user-deprovisioning.d.ts

@@ -27,7 +27,17 @@ export declare class UserDeprovisioning {
      */
     suspendUser(userId: string, reason: DeprovisionReason, env: Env): Promise<void>;
     /**
-     * Check if user is suspended
+     * Check if user is suspended.
+     *
+     * Fail-open is intentional and required: this is a best-effort hint used by
+     * non-critical paths (e.g. surfacing a banner to operators). The
+     * authoritative gate is the pre-token-generation Lambda, which already
+     * blocks token issuance for suspended users on the next refresh
+     * (see lambda/pre-token-generation.ts — the cache TTL bounds the
+     * window). Failing closed here would convert a transient RDS hiccup
+     * into a denial-of-service against legitimate users; the security
+     * properties hold via the pre-token path. Do not change to fail-closed
+     * without first moving the authoritative check off the RDS critical path.
      */
     isUserSuspended(userId: string, env: Env, region?: string): Promise<boolean>;
     /**

package/dist/lib/user-deprovisioning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-deprovisioning.d.ts","sourceRoot":"","sources":["../../src/lib/user-deprovisioning.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAElD,MAAM,WAAW,GAAG;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,CAAC;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAS;gBAEX,GAAG,CAAC,EAAE,SAAS;IAK3B;;;OAGG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,iBAAiB,EACzB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IAwChB;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,EACR,MAAM,GAAE,MAAa,GACpB,OAAO,CAAC,OAAO,CAAC;IAqCnB;;OAEG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IAsChB;;;OAGG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,OAAO,CAAC;CAapB"}
+{"version":3,"file":"user-deprovisioning.d.ts","sourceRoot":"","sources":["../../src/lib/user-deprovisioning.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAGlD,MAAM,WAAW,GAAG;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,CAAC;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAS;gBAEX,GAAG,CAAC,EAAE,SAAS;IAK3B;;;OAGG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,iBAAiB,EACzB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IA0DhB;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,EACR,MAAM,GAAE,MAAa,GACpB,OAAO,CAAC,OAAO,CAAC;IAsCnB;;OAEG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IAsDhB;;;OAGG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,OAAO,CAAC;CAapB"}