@de-otio/trellis 0.6.0 → 0.7.0

package/dist/lib/auth/auth-middleware.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Auth Middleware
+ *
+ * Resolves an authenticated request's Cognito JWT into a typed AuthContext.
+ * Returns null if the token is absent or invalid — callers treat null as 401.
+ *
+ * Requires COGNITO_USER_POOL_ID and COGNITO_APP_CLIENT_ID in env.
+ */
+import type { Env } from "../../env";
+import type { AuthContext } from "./auth-context";
+/**
+ * Extract and verify the Bearer token from the request, then assemble an
+ * AuthContext from the JWT claims written by the pre-token-generation Lambda.
+ *
+ * Returns null when:
+ * - No Authorization header is present.
+ * - The token fails verification (expired, bad signature, wrong pool/client).
+ * - Required claims are missing (userId, activeTenantId).
+ */
+export declare function authMiddleware(request: Request, env: Env): Promise<AuthContext | null>;
+/**
+ * Assert that the caller's active tenant matches the tenant referenced by
+ * the path parameter.
+ *
+ * Returns a 403 Response when the tenants don't match (unless the caller
+ * is a SUPER_ADMIN, who bypasses tenant scope by design).
+ * Returns null when the check passes.
+ *
+ * Use this for ADMIN endpoints (POST/PATCH/DELETE on /api/tenants/:id/...
+ * where the attacker already knows the ID and 403 is acceptable per
+ * security-and-isolation §"Privilege boundary at the API").
+ *
+ * G4 MEDIUM-4: this helper deliberately returns 403 (not 404) when the
+ * caller is authenticated but acting on a tenant other than their own.
+ * That makes the response distinguishable from "tenant does not exist"
+ * (which surfaces as 404). The federation onboarding flow depends on
+ * that distinction — a caller scripting setup needs to be able to tell
+ * whether their target id is unused vs out of reach. Data-side cross-
+ * tenant reads should use `requireOwnTenant` (404 for both conditions)
+ * instead.
+ */
+export declare function requireActiveTenant(auth: AuthContext, tenantIdFromPath: string): Response | null;
+/**
+ * Same as requireActiveTenant but returns 404 instead of 403, so the response
+ * does not distinguish "tenant exists but you can't see it" from "tenant
+ * does not exist". Use this for DATA endpoints (GET /api/tenants/:id and
+ * any cross-tenant resource lookup) where existence-leak is the concern.
+ */
+export declare function requireOwnTenant(auth: AuthContext, tenantIdFromPath: string): Response | null;
+//# sourceMappingURL=auth-middleware.d.ts.map

package/dist/lib/auth/auth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAOlD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAsD7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,gBAAgB,EAAE,MAAM,GACvB,QAAQ,GAAG,IAAI,CAOjB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,EACjB,gBAAgB,EAAE,MAAM,GACvB,QAAQ,GAAG,IAAI,CAOjB"}

package/dist/lib/auth/auth-middleware.js

@@ -0,0 +1,153 @@
+"use strict";
+/**
+ * Auth Middleware
+ *
+ * Resolves an authenticated request's Cognito JWT into a typed AuthContext.
+ * Returns null if the token is absent or invalid — callers treat null as 401.
+ *
+ * Requires COGNITO_USER_POOL_ID and COGNITO_APP_CLIENT_ID in env.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authMiddleware = authMiddleware;
+exports.requireActiveTenant = requireActiveTenant;
+exports.requireOwnTenant = requireOwnTenant;
+const cognito_jwt_1 = require("./cognito-jwt");
+// cuid v1 is `c[a-z0-9]{24}`. Allow up to 40 chars to absorb future widening
+// and any cuid v2 / nanoid variants without re-issuing every JWT.
+const CUID_RE = /^c[a-z0-9]{24,40}$/;
+/**
+ * Extract and verify the Bearer token from the request, then assemble an
+ * AuthContext from the JWT claims written by the pre-token-generation Lambda.
+ *
+ * Returns null when:
+ * - No Authorization header is present.
+ * - The token fails verification (expired, bad signature, wrong pool/client).
+ * - Required claims are missing (userId, activeTenantId).
+ */
+async function authMiddleware(request, env) {
+    const token = (0, cognito_jwt_1.extractBearerToken)(request.headers.get("Authorization"));
+    if (!token)
+        return null;
+    let claims;
+    try {
+        claims = await (0, cognito_jwt_1.verifyCognitoJwt)(token);
+    }
+    catch {
+        return null;
+    }
+    const userId = claims["custom:userId"];
+    const activeTenantId = claims["custom:activeTenantId"];
+    // Both are non-negotiable — pre-token-gen Lambda always writes them.
+    if (!userId || !activeTenantId)
+        return null;
+    // Reject malformed claim values: cuid v1 is c[a-z0-9]{24}. We accept up
+    // to 40 chars to leave headroom for the slug-max widening done in T3.
+    if (!CUID_RE.test(userId) || !CUID_RE.test(activeTenantId))
+        return null;
+    // Support both the T2-era single "custom:role" and the T3+ "custom:globalRole".
+    const globalRole = (claims["custom:globalRole"] ?? claims["custom:role"] ?? "END_USER");
+    // Default to GUEST (least privilege) when the tenantRole claim is missing,
+    // so a malformed token never silently confers MEMBER capabilities.
+    const tenantRole = (claims["custom:tenantRole"] ?? "GUEST");
+    const tenantSlug = claims["custom:tenantSlug"] ?? "";
+    const handle = claims["custom:handle"] ?? "";
+    const cognitoSub = claims.sub;
+    // Memberships are loaded lazily — most requests don't need the full list.
+    let membershipsCache = null;
+    const membershipsLoader = async () => {
+        if (membershipsCache)
+            return membershipsCache;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        membershipsCache = await db.tenantMember.findMany({
+            where: { userId, status: "ACTIVE" },
+            include: { tenant: true },
+        });
+        return membershipsCache;
+    };
+    return {
+        cognitoSub,
+        userId,
+        globalRole,
+        activeTenantId,
+        tenantSlug,
+        tenantRole,
+        handle,
+        membershipsLoader,
+    };
+}
+/**
+ * Assert that the caller's active tenant matches the tenant referenced by
+ * the path parameter.
+ *
+ * Returns a 403 Response when the tenants don't match (unless the caller
+ * is a SUPER_ADMIN, who bypasses tenant scope by design).
+ * Returns null when the check passes.
+ *
+ * Use this for ADMIN endpoints (POST/PATCH/DELETE on /api/tenants/:id/...
+ * where the attacker already knows the ID and 403 is acceptable per
+ * security-and-isolation §"Privilege boundary at the API").
+ *
+ * G4 MEDIUM-4: this helper deliberately returns 403 (not 404) when the
+ * caller is authenticated but acting on a tenant other than their own.
+ * That makes the response distinguishable from "tenant does not exist"
+ * (which surfaces as 404). The federation onboarding flow depends on
+ * that distinction — a caller scripting setup needs to be able to tell
+ * whether their target id is unused vs out of reach. Data-side cross-
+ * tenant reads should use `requireOwnTenant` (404 for both conditions)
+ * instead.
+ */
+function requireActiveTenant(auth, tenantIdFromPath) {
+    if (auth.globalRole === "SUPER_ADMIN")
+        return null;
+    if (auth.activeTenantId === tenantIdFromPath)
+        return null;
+    return new Response(JSON.stringify({ error: "FORBIDDEN", message: "Active tenant does not match requested resource" }), { status: 403, headers: { "content-type": "application/json" } });
+}
+/**
+ * Same as requireActiveTenant but returns 404 instead of 403, so the response
+ * does not distinguish "tenant exists but you can't see it" from "tenant
+ * does not exist". Use this for DATA endpoints (GET /api/tenants/:id and
+ * any cross-tenant resource lookup) where existence-leak is the concern.
+ */
+function requireOwnTenant(auth, tenantIdFromPath) {
+    if (auth.globalRole === "SUPER_ADMIN")
+        return null;
+    if (auth.activeTenantId === tenantIdFromPath)
+        return null;
+    return new Response(JSON.stringify({ error: "NOT_FOUND", message: "Tenant not found" }), { status: 404, headers: { "content-type": "application/json" } });
+}
+//# sourceMappingURL=auth-middleware.js.map

package/dist/lib/auth/auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-middleware.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBH,wCAyDC;AAuBD,kDAUC;AAQD,4CAUC;AA3HD,+CAAqE;AAErE,6EAA6E;AAC7E,kEAAkE;AAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAErC;;;;;;;;GAQG;AACI,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,GAAQ;IAER,MAAM,KAAK,GAAG,IAAA,gCAAkB,EAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAA,8BAAgB,EAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAEvD,qEAAqE;IACrE,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAE5C,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAExE,gFAAgF;IAChF,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,UAAU,CAAa,CAAC;IACpG,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAe,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;IAE9B,0EAA0E;IAC1E,IAAI,gBAAgB,GAAiD,IAAI,CAAC;IAE1E,MAAM,iBAAiB,GAAG,KAAK,IAAoD,EAAE;QACnF,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QAC9C,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,gBAAgB,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;YAChD,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;YACnC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC1B,CAA0C,CAAC;QAC5C,OAAO,gBAAgB,CAAC;IAC1B,CAAC,CAAC;IAEF,OAAO;QACL,UAAU;QACV,MAAM;QACN,UAAU;QACV,cAAc;QACd,UAAU;QACV,UAAU;QACV,MAAM;QACN,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,mBAAmB,CACjC,IAAiB,EACjB,gBAAwB;IAExB,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,IAAI,CAAC,cAAc,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,EAClG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAC9B,IAAiB,EACjB,gBAAwB;IAExB,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,IAAI,CAAC,cAAc,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,EACnE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC"}

package/dist/lib/auth/capabilities.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Capability catalog — every action a tenant member can be authorized to do.
+ *
+ * Naming: `<resource>.<verb>`, lowercase, dot-separated, no abbreviations.
+ * Capabilities are tenant-scoped unless prefixed `platform.` (none in MVP).
+ *
+ * Source of truth: doc/02-technical/identity-federation/05-roles-and-permissions.md.
+ */
+export declare const Capability: {
+    readonly TenantUpdate: "tenant.update";
+    readonly TenantDelete: "tenant.delete";
+    readonly TenantSuspend: "tenant.suspend";
+    readonly MemberInvite: "member.invite";
+    readonly MemberRemove: "member.remove";
+    readonly MemberChangeRole: "member.change_role";
+    readonly MemberSuspend: "member.suspend";
+    readonly MemberView: "member.view";
+    readonly IdpConfigure: "idp.configure";
+    readonly IdpView: "idp.view";
+    readonly RoleMappingEdit: "role_mapping.edit";
+    readonly DomainAdd: "domain.add";
+    readonly DomainVerify: "domain.verify";
+    readonly DomainRemove: "domain.remove";
+    readonly DomainView: "domain.view";
+    readonly EntityCreate: "entity.create";
+    readonly EntityUpdate: "entity.update";
+    readonly EntityDelete: "entity.delete";
+    readonly EntityView: "entity.view";
+    readonly PostCreate: "post.create";
+    readonly PostUpdate: "post.update";
+    readonly PostDelete: "post.delete";
+    readonly PostModerate: "post.moderate";
+    readonly PostView: "post.view";
+    readonly AuditView: "audit.view";
+    readonly ManageAgentSessions: "manage:agent_sessions";
+};
+export type CapabilityValue = (typeof Capability)[keyof typeof Capability];
+/** All capabilities, used by tests + reflection helpers. */
+export declare const ALL_CAPABILITIES: ReadonlyArray<CapabilityValue>;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/lib/auth/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCb,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAE3E,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC,eAAe,CACC,CAAC"}

package/dist/lib/auth/capabilities.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * Capability catalog — every action a tenant member can be authorized to do.
+ *
+ * Naming: `<resource>.<verb>`, lowercase, dot-separated, no abbreviations.
+ * Capabilities are tenant-scoped unless prefixed `platform.` (none in MVP).
+ *
+ * Source of truth: doc/02-technical/identity-federation/05-roles-and-permissions.md.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_CAPABILITIES = exports.Capability = void 0;
+exports.Capability = {
+    TenantUpdate: "tenant.update",
+    TenantDelete: "tenant.delete",
+    TenantSuspend: "tenant.suspend",
+    MemberInvite: "member.invite",
+    MemberRemove: "member.remove",
+    MemberChangeRole: "member.change_role",
+    MemberSuspend: "member.suspend",
+    MemberView: "member.view",
+    IdpConfigure: "idp.configure",
+    IdpView: "idp.view",
+    RoleMappingEdit: "role_mapping.edit",
+    DomainAdd: "domain.add",
+    DomainVerify: "domain.verify",
+    DomainRemove: "domain.remove",
+    DomainView: "domain.view",
+    EntityCreate: "entity.create",
+    EntityUpdate: "entity.update",
+    EntityDelete: "entity.delete",
+    EntityView: "entity.view",
+    PostCreate: "post.create",
+    PostUpdate: "post.update",
+    PostDelete: "post.delete",
+    PostModerate: "post.moderate",
+    PostView: "post.view",
+    AuditView: "audit.view",
+    // Agent session management (T9b-d) — approve, list, revoke device-auth
+    // sessions on behalf of the tenant. Granted to ADMIN/OWNER.
+    ManageAgentSessions: "manage:agent_sessions",
+};
+/** All capabilities, used by tests + reflection helpers. */
+exports.ALL_CAPABILITIES = Object.values(exports.Capability);
+//# sourceMappingURL=capabilities.js.map

package/dist/lib/auth/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../../src/lib/auth/capabilities.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEU,QAAA,UAAU,GAAG;IACxB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,gBAAgB;IAE/B,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,gBAAgB,EAAE,oBAAoB;IACtC,aAAa,EAAE,gBAAgB;IAC/B,UAAU,EAAE,aAAa;IAEzB,YAAY,EAAE,eAAe;IAC7B,OAAO,EAAE,UAAU;IACnB,eAAe,EAAE,mBAAmB;IAEpC,SAAS,EAAE,YAAY;IACvB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,aAAa;IAEzB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,aAAa;IAEzB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,YAAY,EAAE,eAAe;IAC7B,QAAQ,EAAE,WAAW;IAErB,SAAS,EAAE,YAAY;IAEvB,uEAAuE;IACvE,4DAA4D;IAC5D,mBAAmB,EAAE,uBAAuB;CACpC,CAAC;AAIX,4DAA4D;AAC/C,QAAA,gBAAgB,GAC3B,MAAM,CAAC,MAAM,CAAC,kBAAU,CAAmC,CAAC"}

package/dist/lib/auth/claims-cache.d.ts

@@ -0,0 +1,70 @@
+/**
+ * DynamoDB-backed claims cache for the pre-token-generation Lambda
+ * (T2 — JIT provisioning).
+ *
+ * Storage layout (single-table on the existing `{stage}-skybber` table):
+ *   pk = `claims:{cognitoSub}`
+ *   sk = `meta`
+ *   ttl = epoch seconds; DynamoDB-managed expiry plus a manual check on read
+ *         (DDB TTL deletes lag by up to 48h, so we never trust the row's
+ *         existence alone)
+ *
+ * Concurrency: writes use a `ConditionExpression` that the existing row's
+ * `ttl` is missing or older than the incoming `ttl`. Two simultaneous
+ * pre-token-gen invocations for the same user (rare, but possible during a
+ * burst of token refreshes) cannot stale-overwrite a fresh entry.
+ */
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+export interface CachedClaims {
+    /** Skybber `User.id` (cuid). May be empty string for drift sentinel. */
+    userId: string;
+    /** Global `UserRole` enum value. May be empty string for drift sentinel. */
+    globalRole: string;
+    /** `Tenant.id` of the user's currently-active tenant. */
+    activeTenantId: string;
+    /** `Tenant.slug` of the active tenant. */
+    tenantSlug: string;
+    /** `TenantRole` enum value within the active tenant. May be empty. */
+    tenantRole: string;
+    /** ActivityPub-style handle. May be empty. */
+    handle: string;
+}
+export declare const DEFAULT_CACHE_TTL_SECONDS = 3600;
+export declare class ClaimsCache {
+    private readonly client;
+    private readonly tableName;
+    constructor(client: DynamoDBClient, tableName: string);
+    /**
+     * Returns cached claims if a fresh entry exists, else null. Stale rows
+     * (ttl in the past) are treated as a miss; we let DDB's own TTL sweep
+     * eventually delete them.
+     */
+    get(cognitoSub: string): Promise<CachedClaims | null>;
+    /**
+     * Returns the user's last-known activeTenantId, regardless of TTL. Used by
+     * the pre-token-generation Lambda on cache miss so a user's explicit
+     * tenant-switch survives cache expiry rather than reverting to the
+     * first-org-tenant heuristic.
+     */
+    getActiveTenantPreference(cognitoSub: string): Promise<string | null>;
+    /**
+     * Writes a cache entry. Uses a `ConditionExpression` so a stale write
+     * (e.g., one that started before a newer entry was written) cannot
+     * overwrite a fresher row. On collision we silently swallow the
+     * conditional-check failure — the cache still holds an acceptable value.
+     */
+    put(cognitoSub: string, claims: CachedClaims, ttlSeconds?: number): Promise<void>;
+    /**
+     * Forcibly remove a cache entry — used by admin paths (member-remove,
+     * role change, OWNER transfer) to make sure the next token refresh hits
+     * RDS rather than serving a stale role.
+     */
+    invalidate(cognitoSub: string): Promise<void>;
+}
+/**
+ * Convenience constructor used by the Lambda handler. Reads the table name
+ * from `DYNAMODB_TABLE` and the region from `AWS_REGION`. Tests construct
+ * a `ClaimsCache` directly with a mock client.
+ */
+export declare function createClaimsCacheFromEnv(): ClaimsCache;
+//# sourceMappingURL=claims-cache.d.ts.map

package/dist/lib/auth/claims-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims-cache.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/claims-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,cAAc,EAIf,MAAM,0BAA0B,CAAC;AAGlC,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAU9C,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM;IAGpC;;;;OAIG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAqB3D;;;;;OAKG;IACG,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAa3E;;;;;OAKG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,EACpB,UAAU,GAAE,MAAkC,GAC7C,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;OAIG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQpD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,WAAW,CAOtD"}

package/dist/lib/auth/claims-cache.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * DynamoDB-backed claims cache for the pre-token-generation Lambda
+ * (T2 — JIT provisioning).
+ *
+ * Storage layout (single-table on the existing `{stage}-skybber` table):
+ *   pk = `claims:{cognitoSub}`
+ *   sk = `meta`
+ *   ttl = epoch seconds; DynamoDB-managed expiry plus a manual check on read
+ *         (DDB TTL deletes lag by up to 48h, so we never trust the row's
+ *         existence alone)
+ *
+ * Concurrency: writes use a `ConditionExpression` that the existing row's
+ * `ttl` is missing or older than the incoming `ttl`. Two simultaneous
+ * pre-token-gen invocations for the same user (rare, but possible during a
+ * burst of token refreshes) cannot stale-overwrite a fresh entry.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClaimsCache = exports.DEFAULT_CACHE_TTL_SECONDS = void 0;
+exports.createClaimsCacheFromEnv = createClaimsCacheFromEnv;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const util_dynamodb_1 = require("@aws-sdk/util-dynamodb");
+exports.DEFAULT_CACHE_TTL_SECONDS = 3600;
+function pkFor(cognitoSub) {
+    return `claims:${cognitoSub}`;
+}
+function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+class ClaimsCache {
+    client;
+    tableName;
+    constructor(client, tableName) {
+        this.client = client;
+        this.tableName = tableName;
+    }
+    /**
+     * Returns cached claims if a fresh entry exists, else null. Stale rows
+     * (ttl in the past) are treated as a miss; we let DDB's own TTL sweep
+     * eventually delete them.
+     */
+    async get(cognitoSub) {
+        const result = await this.client.send(new client_dynamodb_1.GetItemCommand({
+            TableName: this.tableName,
+            Key: (0, util_dynamodb_1.marshall)({ pk: pkFor(cognitoSub), sk: "meta" }),
+        }));
+        if (!result.Item)
+            return null;
+        const item = (0, util_dynamodb_1.unmarshall)(result.Item);
+        const ttl = typeof item.ttl === "number" ? item.ttl : 0;
+        if (!ttl || ttl <= nowSeconds())
+            return null;
+        return {
+            userId: item.userId ?? "",
+            globalRole: item.globalRole ?? "",
+            activeTenantId: item.activeTenantId ?? "",
+            tenantSlug: item.tenantSlug ?? "",
+            tenantRole: item.tenantRole ?? "",
+            handle: item.handle ?? "",
+        };
+    }
+    /**
+     * Returns the user's last-known activeTenantId, regardless of TTL. Used by
+     * the pre-token-generation Lambda on cache miss so a user's explicit
+     * tenant-switch survives cache expiry rather than reverting to the
+     * first-org-tenant heuristic.
+     */
+    async getActiveTenantPreference(cognitoSub) {
+        const result = await this.client.send(new client_dynamodb_1.GetItemCommand({
+            TableName: this.tableName,
+            Key: (0, util_dynamodb_1.marshall)({ pk: pkFor(cognitoSub), sk: "meta" }),
+        }));
+        if (!result.Item)
+            return null;
+        const item = (0, util_dynamodb_1.unmarshall)(result.Item);
+        const activeTenantId = item.activeTenantId ?? "";
+        return activeTenantId || null;
+    }
+    /**
+     * Writes a cache entry. Uses a `ConditionExpression` so a stale write
+     * (e.g., one that started before a newer entry was written) cannot
+     * overwrite a fresher row. On collision we silently swallow the
+     * conditional-check failure — the cache still holds an acceptable value.
+     */
+    async put(cognitoSub, claims, ttlSeconds = exports.DEFAULT_CACHE_TTL_SECONDS) {
+        const expiresAt = nowSeconds() + ttlSeconds;
+        try {
+            await this.client.send(new client_dynamodb_1.PutItemCommand({
+                TableName: this.tableName,
+                Item: (0, util_dynamodb_1.marshall)({
+                    pk: pkFor(cognitoSub),
+                    sk: "meta",
+                    userId: claims.userId,
+                    globalRole: claims.globalRole,
+                    activeTenantId: claims.activeTenantId,
+                    tenantSlug: claims.tenantSlug,
+                    tenantRole: claims.tenantRole,
+                    handle: claims.handle,
+                    ttl: expiresAt,
+                }),
+                ConditionExpression: "attribute_not_exists(#ttl) OR #ttl < :incomingTtl",
+                ExpressionAttributeNames: { "#ttl": "ttl" },
+                ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":incomingTtl": expiresAt }),
+            }));
+        }
+        catch (err) {
+            const name = err.name;
+            if (name === "ConditionalCheckFailedException")
+                return;
+            throw err;
+        }
+    }
+    /**
+     * Forcibly remove a cache entry — used by admin paths (member-remove,
+     * role change, OWNER transfer) to make sure the next token refresh hits
+     * RDS rather than serving a stale role.
+     */
+    async invalidate(cognitoSub) {
+        await this.client.send(new client_dynamodb_1.DeleteItemCommand({
+            TableName: this.tableName,
+            Key: (0, util_dynamodb_1.marshall)({ pk: pkFor(cognitoSub), sk: "meta" }),
+        }));
+    }
+}
+exports.ClaimsCache = ClaimsCache;
+/**
+ * Convenience constructor used by the Lambda handler. Reads the table name
+ * from `DYNAMODB_TABLE` and the region from `AWS_REGION`. Tests construct
+ * a `ClaimsCache` directly with a mock client.
+ */
+function createClaimsCacheFromEnv() {
+    const tableName = process.env.DYNAMODB_TABLE;
+    if (!tableName) {
+        throw new Error("DYNAMODB_TABLE env var is required for ClaimsCache");
+    }
+    const client = new client_dynamodb_1.DynamoDBClient({ region: process.env.AWS_REGION });
+    return new ClaimsCache(client, tableName);
+}
+//# sourceMappingURL=claims-cache.js.map

package/dist/lib/auth/claims-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims-cache.js","sourceRoot":"","sources":["../../../src/lib/auth/claims-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAiJH,4DAOC;AAtJD,8DAKkC;AAClC,0DAA8D;AAiBjD,QAAA,yBAAyB,GAAG,IAAI,CAAC;AAE9C,SAAS,KAAK,CAAC,UAAkB;IAC/B,OAAO,UAAU,UAAU,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAa,WAAW;IAEH;IACA;IAFnB,YACmB,MAAsB,EACtB,SAAiB;QADjB,WAAM,GAAN,MAAM,CAAgB;QACtB,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,UAAkB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,gCAAc,CAAC;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CACH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAA,0BAAU,EAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;QAChE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,UAAU,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO;YACL,MAAM,EAAG,IAAI,CAAC,MAA6B,IAAI,EAAE;YACjD,UAAU,EAAG,IAAI,CAAC,UAAiC,IAAI,EAAE;YACzD,cAAc,EAAG,IAAI,CAAC,cAAqC,IAAI,EAAE;YACjE,UAAU,EAAG,IAAI,CAAC,UAAiC,IAAI,EAAE;YACzD,UAAU,EAAG,IAAI,CAAC,UAAiC,IAAI,EAAE;YACzD,MAAM,EAAG,IAAI,CAAC,MAA6B,IAAI,EAAE;SAClD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,yBAAyB,CAAC,UAAkB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,gCAAc,CAAC;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CACH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAA,0BAAU,EAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;QAChE,MAAM,cAAc,GAAI,IAAI,CAAC,cAAqC,IAAI,EAAE,CAAC;QACzE,OAAO,cAAc,IAAI,IAAI,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CACP,UAAkB,EAClB,MAAoB,EACpB,aAAqB,iCAAyB;QAE9C,MAAM,SAAS,GAAG,UAAU,EAAE,GAAG,UAAU,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gCAAc,CAAC;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,IAAA,wBAAQ,EAAC;oBACb,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC;oBACrB,EAAE,EAAE,MAAM;oBACV,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,GAAG,EAAE,SAAS;iBACf,CAAC;gBACF,mBAAmB,EAAE,mDAAmD;gBACxE,wBAAwB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC3C,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;aACnE,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,IAAI,IAAI,KAAK,iCAAiC;gBAAE,OAAO;YACvD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,mCAAiB,CAAC;YACpB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CACH,CAAC;IACJ,CAAC;CACF;AAvGD,kCAuGC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC"}

package/dist/lib/auth/cognito-jwt.d.ts

@@ -11,7 +11,13 @@ export interface CognitoJwtClaims {
     username: string;
     email?: string;
     "custom:userId"?: string;
+    /** Pre-T3 legacy claim — single global role. */
     "custom:role"?: string;
+    /** T3+ global UserRole claim. */
+    "custom:globalRole"?: string;
+    "custom:activeTenantId"?: string;
+    "custom:tenantSlug"?: string;
+    "custom:tenantRole"?: string;
     "custom:handle"?: string;
     "custom:dataRegion"?: string;
 }

package/dist/lib/auth/cognito-jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cognito-jwt.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/cognito-jwt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2BH,4DAA4D;AAC5D,wBAAgB,aAAa,SAG5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU/E;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG3E"}
+{"version":3,"file":"cognito-jwt.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/cognito-jwt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2BH,4DAA4D;AAC5D,wBAAgB,aAAa,SAG5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU/E;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG3E"}

package/dist/lib/auth/cognito-jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"cognito-jwt.js","sourceRoot":"","sources":["../../../src/lib/auth/cognito-jwt.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA4BH,sCAGC;AAYD,4CAUC;AAED,gDAGC;AAxDD,mDAAoD;AAEpD,IAAI,QAAQ,GAAwD,IAAI,CAAC;AACzE,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAE5D,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,kEAAkE;IAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,GAAG,WAAW,GAAG,mBAAmB,CAAC,EAAE,CAAC;QAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,QAAQ,GAAG,mCAAkB,CAAC,MAAM,CAAC;YACnC,UAAU;YACV,QAAQ,EAAE,IAAI;YACd,QAAQ;SACT,CAAC,CAAC;QACH,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4DAA4D;AAC5D,SAAgB,aAAa;IAC3B,QAAQ,GAAG,IAAI,CAAC;IAChB,WAAW,GAAG,CAAC,CAAC;AAClB,CAAC;AAYM,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,OAAsC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gFAAgF;QAChF,aAAa,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,OAAsC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,UAAyB;IAC1D,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"cognito-jwt.js","sourceRoot":"","sources":["../../../src/lib/auth/cognito-jwt.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA4BH,sCAGC;AAkBD,4CAUC;AAED,gDAGC;AA9DD,mDAAoD;AAEpD,IAAI,QAAQ,GAAwD,IAAI,CAAC;AACzE,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAE5D,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,kEAAkE;IAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,GAAG,WAAW,GAAG,mBAAmB,CAAC,EAAE,CAAC;QAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,QAAQ,GAAG,mCAAkB,CAAC,MAAM,CAAC;YACnC,UAAU;YACV,QAAQ,EAAE,IAAI;YACd,QAAQ;SACT,CAAC,CAAC;QACH,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4DAA4D;AAC5D,SAAgB,aAAa;IAC3B,QAAQ,GAAG,IAAI,CAAC;IAChB,WAAW,GAAG,CAAC,CAAC;AAClB,CAAC;AAkBM,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,OAAsC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gFAAgF;QAChF,aAAa,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,OAAsC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,UAAyB;IAC1D,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/lib/auth/idp-redirect-builder.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Builds the Cognito Hosted UI OAuth2 authorization URL for federated sign-in.
+ *
+ * The IdP name in Cognito follows the convention `tenant-{cuid}` (using the
+ * full tenant cuid, truncated to 25 chars to fit Cognito's 32-char provider-
+ * name quota). Sign-in discovery routes by the same convention, so the value
+ * passed in is what T5 provisioned.
+ *
+ * All URL parameters are server-derived; callers supply only the Prisma-loaded
+ * cognitoIdpName — no arbitrary IdP names accepted from request input.
+ */
+export { cognitoIdpName } from "../tenant/idp-name";
+export interface IdpRedirectConfig {
+    hostedUiDomain: string;
+    clientId: string;
+    redirectUri: string;
+}
+export interface IdpRedirectParams {
+    cognitoIdpName: string;
+    tenantSlug: string;
+}
+export interface IdpRedirectResult {
+    idpRedirect: string;
+    tenantSlug: string;
+}
+/**
+ * Builds the Cognito Hosted UI authorization URL.
+ *
+ * Scope is always `openid email profile` — no caller-supplied scope to prevent
+ * privilege escalation via scope injection.
+ */
+export declare function buildIdpRedirectUrl(config: IdpRedirectConfig, params: IdpRedirectParams): string;
+/**
+ * Reads IdP redirect config from the environment.
+ * Env vars read here are defined in src/env.ts and must come from there —
+ * no direct process.env access outside buildEnv().
+ */
+export declare function getIdpRedirectConfig(env: {
+    COGNITO_HOSTED_UI_DOMAIN?: string;
+    COGNITO_APP_CLIENT_ID?: string;
+    COGNITO_REDIRECT_URI?: string;
+}): IdpRedirectConfig;
+//# sourceMappingURL=idp-redirect-builder.d.ts.map

package/dist/lib/auth/idp-redirect-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp-redirect-builder.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/idp-redirect-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,iBAAiB,GACxB,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,iBAAiB,CAMpB"}