@de-otio/trellis 0.6.1 → 0.7.0

package/dist/lib/oauth/refresh-detection.js

@@ -0,0 +1,248 @@
+"use strict";
+/**
+ * Refresh-token reuse detection (RFC 6819 §5.2.2.5, T9b-d).
+ *
+ * Each refresh-token JTI is recorded once. On refresh:
+ *   - load the row by jti
+ *   - if absent      → unknown token; treat as suspect, deny
+ *   - if `consumed`  → REPLAY; revoke all sessions for that user via
+ *                      AdminUserGlobalSignOut and emit `auth.refresh_replay`
+ *   - if `active`    → mark consumed, issue new refresh with new jti
+ *
+ * Storage: AGENT_REFRESH_TABLE in DynamoDB. Same table also holds the
+ * agent-session metadata listed by `/api/users/me/agent-sessions`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordAgentSession = recordAgentSession;
+exports.consumeRefreshJti = consumeRefreshJti;
+exports.handleRefreshReplay = handleRefreshReplay;
+exports.rotateRefreshJti = rotateRefreshJti;
+exports.listAgentSessions = listAgentSessions;
+exports.revokeAgentSession = revokeAgentSession;
+exports.getAgentSession = getAgentSession;
+exports._deleteAgentSessionForTest = _deleteAgentSessionForTest;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const util_dynamodb_1 = require("@aws-sdk/util-dynamodb");
+const ddb = new client_dynamodb_1.DynamoDBClient({
+    region: process.env.AWS_REGION || "us-east-1",
+    ...(process.env.DYNAMODB_ENDPOINT ? { endpoint: process.env.DYNAMODB_ENDPOINT } : {}),
+});
+function tableName() {
+    return (process.env.AGENT_REFRESH_TABLE ||
+        `${process.env.STAGE || "dev"}-trellis-agent-refresh`);
+}
+/** Initial record write at session creation (after approval). */
+async function recordAgentSession(input) {
+    const now = Math.floor(Date.now() / 1000);
+    await ddb.send(new client_dynamodb_1.PutItemCommand({
+        TableName: tableName(),
+        Item: (0, util_dynamodb_1.marshall)({
+            pk: `s#${input.session.sessionId}`,
+            sk: "rec",
+            ...input.session,
+            gsi1pk: `u#${input.session.userId}`,
+            gsi1sk: `s#${input.session.sessionId}`,
+        }, { removeUndefinedValues: true }),
+        ConditionExpression: "attribute_not_exists(pk)",
+    }));
+    await ddb.send(new client_dynamodb_1.PutItemCommand({
+        TableName: tableName(),
+        Item: (0, util_dynamodb_1.marshall)({
+            pk: `j#${input.initialJti}`,
+            sk: "rec",
+            jti: input.initialJti,
+            sessionId: input.session.sessionId,
+            userId: input.session.userId,
+            cognitoSub: input.session.cognitoSub,
+            status: "active",
+            issuedAt: now,
+        }),
+        ConditionExpression: "attribute_not_exists(pk)",
+    }));
+}
+/**
+ * Validate a refresh-token JTI. Three outcomes:
+ *   - "ok"      → the jti was active; row is now flipped to consumed.
+ *   - "replay"  → jti was already consumed → caller must revoke session globally.
+ *   - "unknown" → jti not present (foreign or expired); deny.
+ */
+async function consumeRefreshJti(jti) {
+    try {
+        const out = await ddb.send(new client_dynamodb_1.UpdateItemCommand({
+            TableName: tableName(),
+            Key: (0, util_dynamodb_1.marshall)({ pk: `j#${jti}`, sk: "rec" }),
+            UpdateExpression: "SET #status = :consumed, consumedAt = :now",
+            ConditionExpression: "attribute_exists(pk) AND #status = :active",
+            ExpressionAttributeNames: { "#status": "status" },
+            ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({
+                ":active": "active",
+                ":consumed": "consumed",
+                ":now": Math.floor(Date.now() / 1000),
+            }),
+            ReturnValues: "ALL_NEW",
+        }));
+        if (!out.Attributes)
+            return { outcome: "unknown" };
+        return { outcome: "ok", record: (0, util_dynamodb_1.unmarshall)(out.Attributes) };
+    }
+    catch (err) {
+        if (err instanceof client_dynamodb_1.ConditionalCheckFailedException) {
+            // Row exists but wasn't `active` — load to distinguish unknown vs replay.
+            const out = await ddb.send(new client_dynamodb_1.GetItemCommand({
+                TableName: tableName(),
+                Key: (0, util_dynamodb_1.marshall)({ pk: `j#${jti}`, sk: "rec" }),
+            }));
+            if (!out.Item)
+                return { outcome: "unknown" };
+            const row = (0, util_dynamodb_1.unmarshall)(out.Item);
+            return { outcome: "replay", record: row };
+        }
+        throw err;
+    }
+}
+/**
+ * On confirmed replay: revoke all sessions for the user, mark the session
+ * row revoked, emit `auth.refresh_replay`. The Cognito SDK call uses
+ * AdminUserGlobalSignOut to invalidate every refresh-derived token.
+ *
+ * Hardening (G4 CRITICAL-1, CRITICAL-2):
+ *   - The Cognito username used for revocation is read directly from
+ *     `jtiRecord.cognitoSub` (the value bound at session-creation time).
+ *     Callers may not supply an alternate identity; this prevents the
+ *     wrong account from being revoked if a caller forwards a request-
+ *     scoped value here.
+ *   - The audit event is emitted FIRST so a downstream Cognito or DDB
+ *     failure cannot suppress the `auth.refresh_replay` signal. The
+ *     mutation steps follow in order; each is wrapped so that audit
+ *     emit completes even when a later step throws.
+ */
+async function handleRefreshReplay(input) {
+    // Source the Cognito username from the stored jti record only.
+    const cognitoUsername = input.jtiRecord.cognitoSub;
+    // Step 1: emit the audit event before any mutation. This is the
+    // observability anchor — a replay must always produce a record even if
+    // the downstream revocation path fails part-way through.
+    await input.audit.emit({
+        type: "auth.refresh_replay",
+        tenantId: input.tenantId,
+        actorUserId: input.jtiRecord.userId,
+        payload: {
+            refreshJti: input.jtiRecord.jti,
+            cognitoUserId: cognitoUsername,
+        },
+        sourceIp: input.sourceIp,
+        agentSessionId: input.jtiRecord.sessionId,
+    });
+    // Step 2: tombstone the session row in DDB. We do this before the
+    // Cognito call so a Cognito failure still leaves the local record
+    // marked revoked.
+    await ddb.send(new client_dynamodb_1.UpdateItemCommand({
+        TableName: tableName(),
+        Key: (0, util_dynamodb_1.marshall)({ pk: `s#${input.jtiRecord.sessionId}`, sk: "rec" }),
+        UpdateExpression: "SET #status = :revoked, currentJti = :null, lastUsedAt = :now",
+        ExpressionAttributeNames: { "#status": "status" },
+        ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({
+            ":revoked": "revoked",
+            ":null": null,
+            ":now": Math.floor(Date.now() / 1000),
+        }),
+    }));
+    // Step 3: invalidate refresh-derived tokens at the IdP. If this throws
+    // the local state is already consistent (audit emitted, row revoked)
+    // and the caller can retry the global sign-out idempotently.
+    await input.cognito.globalSignOut({
+        userPoolId: input.userPoolId,
+        cognitoUsername,
+    });
+}
+/**
+ * Issue a new refresh JTI for a session. The old JTI must already be
+ * consumed (caller flips it before calling). Updates the session row.
+ */
+async function rotateRefreshJti(input) {
+    const now = Math.floor(Date.now() / 1000);
+    await ddb.send(new client_dynamodb_1.PutItemCommand({
+        TableName: tableName(),
+        Item: (0, util_dynamodb_1.marshall)({
+            pk: `j#${input.newJti}`,
+            sk: "rec",
+            jti: input.newJti,
+            sessionId: input.sessionId,
+            userId: input.userId,
+            cognitoSub: input.cognitoSub,
+            status: "active",
+            issuedAt: now,
+        }),
+        ConditionExpression: "attribute_not_exists(pk)",
+    }));
+    await ddb.send(new client_dynamodb_1.UpdateItemCommand({
+        TableName: tableName(),
+        Key: (0, util_dynamodb_1.marshall)({ pk: `s#${input.sessionId}`, sk: "rec" }),
+        UpdateExpression: "SET currentJti = :j, lastUsedAt = :n",
+        ConditionExpression: "attribute_exists(pk) AND #status = :active",
+        ExpressionAttributeNames: { "#status": "status" },
+        ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({
+            ":j": input.newJti,
+            ":n": now,
+            ":active": "active",
+        }),
+    }));
+}
+/** List all active sessions for a user. Used by `/api/users/me/agent-sessions`. */
+async function listAgentSessions(userId) {
+    const out = await ddb.send(new client_dynamodb_1.QueryCommand({
+        TableName: tableName(),
+        IndexName: "gsi1",
+        KeyConditionExpression: "gsi1pk = :u",
+        ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":u": `u#${userId}` }),
+    }));
+    return (out.Items ?? [])
+        .map((it) => (0, util_dynamodb_1.unmarshall)(it))
+        .filter((r) => r.status === "active")
+        .map(({ ...rec }) => rec);
+}
+/** Revoke a session by id; caller must verify the session belongs to the user. */
+async function revokeAgentSession(input) {
+    await input.cognito.globalSignOut({
+        userPoolId: input.userPoolId,
+        cognitoUsername: input.cognitoUsername,
+    });
+    await ddb.send(new client_dynamodb_1.UpdateItemCommand({
+        TableName: tableName(),
+        Key: (0, util_dynamodb_1.marshall)({ pk: `s#${input.sessionId}`, sk: "rec" }),
+        UpdateExpression: "SET #status = :revoked, currentJti = :null, lastUsedAt = :now",
+        ConditionExpression: "attribute_exists(pk)",
+        ExpressionAttributeNames: { "#status": "status" },
+        ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({
+            ":revoked": "revoked",
+            ":null": null,
+            ":now": Math.floor(Date.now() / 1000),
+        }),
+    }));
+    await input.audit.emit({
+        type: "auth.agent_session.revoked",
+        tenantId: input.tenantId,
+        actorUserId: input.actorUserId,
+        payload: { cognitoUserId: input.cognitoUsername },
+        sourceIp: input.sourceIp,
+        agentSessionId: input.sessionId,
+    });
+}
+/** Look up a session by id (auth check helper). */
+async function getAgentSession(sessionId) {
+    const out = await ddb.send(new client_dynamodb_1.GetItemCommand({
+        TableName: tableName(),
+        Key: (0, util_dynamodb_1.marshall)({ pk: `s#${sessionId}`, sk: "rec" }),
+    }));
+    if (!out.Item)
+        return null;
+    return (0, util_dynamodb_1.unmarshall)(out.Item);
+}
+/** Test-only: helper to clear a session row directly. */
+async function _deleteAgentSessionForTest(sessionId) {
+    await ddb.send(new client_dynamodb_1.DeleteItemCommand({
+        TableName: tableName(),
+        Key: (0, util_dynamodb_1.marshall)({ pk: `s#${sessionId}`, sk: "rec" }),
+    }));
+}
+//# sourceMappingURL=refresh-detection.js.map

package/dist/lib/oauth/refresh-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-detection.js","sourceRoot":"","sources":["../../../src/lib/oauth/refresh-detection.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AA0EH,gDAsCC;AAQD,8CAqCC;AAkBD,kDAkDC;AAMD,4CAsCC;AAGD,8CAaC;AAGD,gDAsCC;AAGD,0CASC;AAGD,gEAOC;AA1VD,8DAQkC;AAClC,0DAA8D;AAkD9D,MAAM,GAAG,GAAG,IAAI,gCAAc,CAAC;IAC7B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;IAC7C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACtF,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,wBAAwB,CACtD,CAAC;AACJ,CAAC;AAED,iEAAiE;AAC1D,KAAK,UAAU,kBAAkB,CAAC,KAGxC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,IAAI,EAAE,IAAA,wBAAQ,EACZ;YACE,EAAE,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE;YAClC,EAAE,EAAE,KAAK;YACT,GAAG,KAAK,CAAC,OAAO;YAChB,MAAM,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE;YACnC,MAAM,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE;SACvC,EACD,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC;QACD,mBAAmB,EAAE,0BAA0B;KAChD,CAAC,CACH,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,IAAI,EAAE,IAAA,wBAAQ,EAAC;YACb,EAAE,EAAE,KAAK,KAAK,CAAC,UAAU,EAAE;YAC3B,EAAE,EAAE,KAAK;YACT,GAAG,EAAE,KAAK,CAAC,UAAU;YACrB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;YACpC,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,GAAG;SACd,CAAC;QACF,mBAAmB,EAAE,0BAA0B;KAChD,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAIjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,mCAAiB,CAAC;YACpB,SAAS,EAAE,SAAS,EAAE;YACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAC5C,gBAAgB,EAAE,4CAA4C;YAC9D,mBAAmB,EAAE,4CAA4C;YACjE,wBAAwB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;YACjD,yBAAyB,EAAE,IAAA,wBAAQ,EAAC;gBAClC,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,UAAU;gBACvB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aACtC,CAAC;YACF,YAAY,EAAE,SAAS;SACxB,CAAC,CACH,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAA,0BAAU,EAAC,GAAG,CAAC,UAAU,CAAqB,EAAE,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iDAA+B,EAAE,CAAC;YACnD,0EAA0E;YAC1E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,gCAAc,CAAC;gBACjB,SAAS,EAAE,SAAS,EAAE;gBACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;aAC7C,CAAC,CACH,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAA,0BAAU,EAAC,GAAG,CAAC,IAAI,CAAqB,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,mBAAmB,CAAC,KAOzC;IACC,+DAA+D;IAC/D,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;IAEnD,gEAAgE;IAChE,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACrB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;QACnC,OAAO,EAAE;YACP,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG;YAC/B,aAAa,EAAE,eAAe;SAC/B;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;KAC1C,CAAC,CAAC;IAEH,kEAAkE;IAClE,kEAAkE;IAClE,kBAAkB;IAClB,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mCAAiB,CAAC;QACpB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClE,gBAAgB,EAAE,+DAA+D;QACjF,wBAAwB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;QACjD,yBAAyB,EAAE,IAAA,wBAAQ,EAAC;YAClC,UAAU,EAAE,SAAS;YACrB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACtC,CAAC;KACH,CAAC,CACH,CAAC;IAEF,uEAAuE;IACvE,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,eAAe;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CAAC,KAKtC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,IAAI,EAAE,IAAA,wBAAQ,EAAC;YACb,EAAE,EAAE,KAAK,KAAK,CAAC,MAAM,EAAE;YACvB,EAAE,EAAE,KAAK;YACT,GAAG,EAAE,KAAK,CAAC,MAAM;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,GAAG;SACd,CAAC;QACF,mBAAmB,EAAE,0BAA0B;KAChD,CAAC,CACH,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mCAAiB,CAAC;QACpB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACxD,gBAAgB,EAAE,sCAAsC;QACxD,mBAAmB,EAAE,4CAA4C;QACjE,wBAAwB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;QACjD,yBAAyB,EAAE,IAAA,wBAAQ,EAAC;YAClC,IAAI,EAAE,KAAK,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG;YACT,SAAS,EAAE,QAAQ;SACpB,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,iBAAiB,CAAC,MAAc;IACpD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,8BAAY,CAAC;QACf,SAAS,EAAE,SAAS,EAAE;QACtB,SAAS,EAAE,MAAM;QACjB,sBAAsB,EAAE,aAAa;QACrC,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,IAAI,EAAE,KAAK,MAAM,EAAE,EAAE,CAAC;KAC7D,CAAC,CACH,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;SACrB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,0BAAU,EAAC,EAAE,CAA8D,CAAC;SACxF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;SACpC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,kBAAkB,CAAC,KASxC;IACC,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mCAAiB,CAAC;QACpB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACxD,gBAAgB,EAAE,+DAA+D;QACjF,mBAAmB,EAAE,sBAAsB;QAC3C,wBAAwB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;QACjD,yBAAyB,EAAE,IAAA,wBAAQ,EAAC;YAClC,UAAU,EAAE,SAAS;YACrB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACtC,CAAC;KACH,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACrB,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,eAAe,EAAE;QACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,SAAS;KAChC,CAAC,CAAC;AACL,CAAC;AAED,mDAAmD;AAC5C,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACnD,CAAC,CACH,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAA,0BAAU,EAAC,GAAG,CAAC,IAAI,CAAuB,CAAC;AACpD,CAAC;AAED,yDAAyD;AAClD,KAAK,UAAU,0BAA0B,CAAC,SAAiB;IAChE,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mCAAiB,CAAC;QACpB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACnD,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/lib/openapi/generator.d.ts

@@ -0,0 +1,78 @@
+/**
+ * OpenAPI 3.1 Document Generator
+ *
+ * Introspects the trellis route registry to emit a valid OpenAPI 3.1 document.
+ * Coverage priority: federation endpoints (T3–T8) plus the discovery surface.
+ * For routes whose Zod schemas aren't directly accessible, minimal `{}` schemas
+ * are emitted — validity over richness.
+ */
+import type { Route } from "../routes/types";
+export interface OpenApiDocument {
+    openapi: "3.1.0";
+    info: {
+        title: string;
+        version: string;
+        description?: string;
+    };
+    paths: Record<string, OpenApiPathItem>;
+    components?: {
+        schemas?: Record<string, unknown>;
+    };
+}
+interface OpenApiPathItem {
+    [method: string]: OpenApiOperation;
+}
+interface OpenApiOperation {
+    summary?: string;
+    description?: string;
+    operationId?: string;
+    parameters?: OpenApiParameter[];
+    requestBody?: {
+        required?: boolean;
+        content: Record<string, {
+            schema: unknown;
+        }>;
+    };
+    responses: Record<string, {
+        description: string;
+        content?: Record<string, {
+            schema: unknown;
+        }>;
+    }>;
+    tags?: string[];
+}
+interface OpenApiParameter {
+    name: string;
+    in: "path" | "query" | "header";
+    required: boolean;
+    schema: {
+        type: string;
+    };
+    description?: string;
+}
+/**
+ * Convert a route pattern to an OpenAPI path string.
+ *
+ * Supports:
+ *  - Exact strings: "/health" → "/health"
+ *  - Express-style params: "/api/tenants/:id" → "/api/tenants/{id}"
+ *  - Simple named-group regex: /^\/api\/tenants\/([^/]+)\/domains$/ →
+ *    "/api/tenants/{param0}/domains"
+ *  - Wildcards and complex regex are skipped (returns null)
+ */
+export declare function routePatternToPath(pattern: Route["path"]): string | null;
+/**
+ * Generate an OpenAPI 3.1 document from the trellis route registry.
+ *
+ * Hardening (G4 MEDIUM-3): the generator emits ONLY routes flagged
+ * `publicSpec: true`. Routes without the flag (posts, comments, media,
+ * ActivityPub, extension-defined routes, etc.) are excluded so the
+ * public spec is a curated agent-integration surface rather than a
+ * reflection of every registered handler.
+ *
+ * Routes that cannot be represented as OpenAPI paths (wildcard handlers,
+ * complex regex) are silently skipped.
+ */
+export declare function generateOpenApiDoc(routes: Route[]): OpenApiDocument;
+export {};
+//# sourceMappingURL=generator.d.ts.map

package/dist/lib/openapi/generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../../src/lib/openapi/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAI7C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvC,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,CAAC;CACH;AAED,UAAU,eAAe;IACvB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC;CACpC;AAED,UAAU,gBAAgB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE;QACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KAC9C,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAClG,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAkCD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CA+DxE;AAwDD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,eAAe,CAmCnE"}

package/dist/lib/openapi/generator.js

@@ -0,0 +1,201 @@
+"use strict";
+/**
+ * OpenAPI 3.1 Document Generator
+ *
+ * Introspects the trellis route registry to emit a valid OpenAPI 3.1 document.
+ * Coverage priority: federation endpoints (T3–T8) plus the discovery surface.
+ * For routes whose Zod schemas aren't directly accessible, minimal `{}` schemas
+ * are emitted — validity over richness.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.routePatternToPath = routePatternToPath;
+exports.generateOpenApiDoc = generateOpenApiDoc;
+// ── Constants ─────────────────────────────────────────────────────────────────
+const API_TITLE = "Trellis API";
+const API_VERSION = "0.7.0";
+const API_DESCRIPTION = "Social-network core API. Discovery surfaces, federation management (T3–T8), and entity/social graph endpoints.";
+/** Methods that support a request body */
+const BODY_METHODS = new Set(["post", "put", "patch"]);
+// Tags derived from path prefix for grouping
+const FEDERATION_PREFIXES = [
+    [/^\/api\/tenants\/[^/]+\/domains/, "tenant-domains"],
+    [/^\/api\/tenants\/[^/]+\/identity-provider/, "tenant-idp"],
+    [/^\/api\/tenants\/[^/]+\/members/, "tenant-members"],
+    [/^\/api\/tenants\/[^/]+\/role-mappings/, "tenant-role-mappings"],
+    [/^\/api\/tenants\/[^/]+\/audit/, "tenant-audit"],
+    [/^\/api\/tenants/, "tenants"],
+    [/^\/api\/auth\/discover/, "auth-discover"],
+    [/^\/(llms\.txt|openapi\.json|security\.txt)/, "discovery"],
+    [/^\/health/, "health"],
+];
+function deriveTag(path) {
+    for (const [pattern, tag] of FEDERATION_PREFIXES) {
+        if (pattern.test(path))
+            return tag;
+    }
+    return "other";
+}
+// ── Path normalisation ─────────────────────────────────────────────────────────
+/**
+ * Convert a route pattern to an OpenAPI path string.
+ *
+ * Supports:
+ *  - Exact strings: "/health" → "/health"
+ *  - Express-style params: "/api/tenants/:id" → "/api/tenants/{id}"
+ *  - Simple named-group regex: /^\/api\/tenants\/([^/]+)\/domains$/ →
+ *    "/api/tenants/{param0}/domains"
+ *  - Wildcards and complex regex are skipped (returns null)
+ */
+function routePatternToPath(pattern) {
+    if (typeof pattern === "string") {
+        if (pattern === "*")
+            return null;
+        // Convert express :param style
+        return pattern.replace(/:([^/]+)/g, "{$1}");
+    }
+    if (pattern instanceof RegExp) {
+        const src = pattern.source;
+        // Skip wildcard-only patterns
+        if (src === ".*" || src === "^.*$")
+            return null;
+        // Strip anchors
+        let s = src.replace(/^\^/, "").replace(/\$$/, "");
+        // Unescape forward slashes
+        s = s.replace(/\\\//g, "/");
+        // Replace capture groups with positional placeholders.
+        // We walk character-by-character to correctly handle character classes
+        // like `([^/]+)` which contain `]` that would fool a naive regex.
+        let paramIndex = 0;
+        let result = "";
+        let i = 0;
+        while (i < s.length) {
+            if (s[i] === "(") {
+                // Scan to the matching closing paren, skipping over [...] classes
+                let depth = 1;
+                i++;
+                while (i < s.length && depth > 0) {
+                    if (s[i] === "[") {
+                        // Skip character class entirely
+                        i++;
+                        while (i < s.length && s[i] !== "]")
+                            i++;
+                        i++; // skip ']'
+                    }
+                    else if (s[i] === "(") {
+                        depth++;
+                        i++;
+                    }
+                    else if (s[i] === ")") {
+                        depth--;
+                        i++;
+                    }
+                    else {
+                        i++;
+                    }
+                }
+                result += `{param${paramIndex++}}`;
+            }
+            else {
+                result += s[i];
+                i++;
+            }
+        }
+        s = result;
+        // Bail out if any remaining regex metacharacters.
+        // Note: {param0} placeholders are intentional OpenAPI path parameters, so
+        // we only reject metacharacters that appear outside of {...} placeholders.
+        const withoutPlaceholders = s.replace(/\{param\d+\}/g, "");
+        if (/[.*+?^${}()|[\]\\]/.test(withoutPlaceholders))
+            return null;
+        return s || null;
+    }
+    return null;
+}
+// ── Parameter extraction ───────────────────────────────────────────────────────
+function extractPathParams(openApiPath) {
+    const params = [];
+    const re = /\{([^}]+)\}/g;
+    let m;
+    while ((m = re.exec(openApiPath)) !== null) {
+        params.push({
+            name: m[1],
+            in: "path",
+            required: true,
+            schema: { type: "string" },
+        });
+    }
+    return params;
+}
+// ── Operation builder ─────────────────────────────────────────────────────────
+function buildOperation(route, method, openApiPath) {
+    const params = extractPathParams(openApiPath);
+    const tag = deriveTag(openApiPath);
+    const op = {
+        summary: route.description ?? `${method.toUpperCase()} ${openApiPath}`,
+        operationId: `${method}_${openApiPath.replace(/[^a-zA-Z0-9]/g, "_")}`,
+        tags: [tag],
+        parameters: params.length > 0 ? params : undefined,
+        responses: {
+            "200": { description: "Success" },
+            "400": { description: "Bad request" },
+            "401": { description: "Unauthorized" },
+            "500": { description: "Internal server error" },
+        },
+    };
+    if (BODY_METHODS.has(method)) {
+        op.requestBody = {
+            required: false,
+            content: {
+                "application/json": { schema: {} },
+            },
+        };
+    }
+    return op;
+}
+// ── Main generator ─────────────────────────────────────────────────────────────
+/**
+ * Generate an OpenAPI 3.1 document from the trellis route registry.
+ *
+ * Hardening (G4 MEDIUM-3): the generator emits ONLY routes flagged
+ * `publicSpec: true`. Routes without the flag (posts, comments, media,
+ * ActivityPub, extension-defined routes, etc.) are excluded so the
+ * public spec is a curated agent-integration surface rather than a
+ * reflection of every registered handler.
+ *
+ * Routes that cannot be represented as OpenAPI paths (wildcard handlers,
+ * complex regex) are silently skipped.
+ */
+function generateOpenApiDoc(routes) {
+    const paths = {};
+    for (const route of routes) {
+        if (route.publicSpec !== true)
+            continue;
+        const openApiPath = routePatternToPath(route.path);
+        if (!openApiPath)
+            continue;
+        const rawMethods = route.method ?? "GET";
+        const methods = Array.isArray(rawMethods) ? rawMethods : [rawMethods];
+        for (const rawMethod of methods) {
+            if (rawMethod === "*")
+                continue;
+            const method = rawMethod.toLowerCase();
+            if (!paths[openApiPath]) {
+                paths[openApiPath] = {};
+            }
+            paths[openApiPath][method] = buildOperation(route, method, openApiPath);
+        }
+    }
+    return {
+        openapi: "3.1.0",
+        info: {
+            title: API_TITLE,
+            version: API_VERSION,
+            description: API_DESCRIPTION,
+        },
+        paths,
+        components: {
+            schemas: {},
+        },
+    };
+}
+//# sourceMappingURL=generator.js.map

package/dist/lib/openapi/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../src/lib/openapi/generator.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAsFH,gDA+DC;AAoED,gDAmCC;AAhND,iFAAiF;AAEjF,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,eAAe,GACnB,gHAAgH,CAAC;AAEnH,0CAA0C;AAC1C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvD,6CAA6C;AAC7C,MAAM,mBAAmB,GAAuB;IAC9C,CAAC,iCAAiC,EAAE,gBAAgB,CAAC;IACrD,CAAC,2CAA2C,EAAE,YAAY,CAAC;IAC3D,CAAC,iCAAiC,EAAE,gBAAgB,CAAC;IACrD,CAAC,uCAAuC,EAAE,sBAAsB,CAAC;IACjE,CAAC,+BAA+B,EAAE,cAAc,CAAC;IACjD,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,wBAAwB,EAAE,eAAe,CAAC;IAC3C,CAAC,4CAA4C,EAAE,WAAW,CAAC;IAC3D,CAAC,WAAW,EAAE,QAAQ,CAAC;CACxB,CAAC;AAEF,SAAS,SAAS,CAAC,IAAY;IAC7B,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,OAAsB;IACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjC,+BAA+B;QAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,YAAY,MAAM,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3B,8BAA8B;QAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAEhD,gBAAgB;QAChB,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAElD,2BAA2B;QAC3B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE5B,uDAAuD;QACvD,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,CAAC,EAAE,CAAC;gBACJ,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACjC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;wBACjB,gCAAgC;wBAChC,CAAC,EAAE,CAAC;wBACJ,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;4BAAE,CAAC,EAAE,CAAC;wBACzC,CAAC,EAAE,CAAC,CAAC,WAAW;oBAClB,CAAC;yBAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;wBACxB,KAAK,EAAE,CAAC;wBACR,CAAC,EAAE,CAAC;oBACN,CAAC;yBAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;wBACxB,KAAK,EAAE,CAAC;wBACR,CAAC,EAAE,CAAC;oBACN,CAAC;yBAAM,CAAC;wBACN,CAAC,EAAE,CAAC;oBACN,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,SAAS,UAAU,EAAE,GAAG,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACf,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;QACD,CAAC,GAAG,MAAM,CAAC;QAEX,kDAAkD;QAClD,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,mBAAmB,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC;YAAE,OAAO,IAAI,CAAC;QAEhE,OAAO,CAAC,IAAI,IAAI,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAElF,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,cAAc,CAAC;IAC1B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACV,EAAE,EAAE,MAAM;YACV,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF,SAAS,cAAc,CACrB,KAAY,EACZ,MAAc,EACd,WAAmB;IAEnB,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAEnC,MAAM,EAAE,GAAqB;QAC3B,OAAO,EAAE,KAAK,CAAC,WAAW,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,WAAW,EAAE;QACtE,WAAW,EAAE,GAAG,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,EAAE;QACrE,IAAI,EAAE,CAAC,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAClD,SAAS,EAAE;YACT,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;YACjC,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE;YACrC,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;YACtC,KAAK,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE;SAChD;KACF,CAAC;IAEF,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,WAAW,GAAG;YACf,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;aACnC;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;GAWG;AACH,SAAgB,kBAAkB,CAAC,MAAe;IAChD,MAAM,KAAK,GAAoC,EAAE,CAAC;IAElD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,SAAS;QACxC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW;YAAE,SAAS;QAE3B,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAEtE,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;YAChC,IAAI,SAAS,KAAK,GAAG;gBAAE,SAAS;YAChC,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YAEvC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,WAAW,CAAC,GAAG,EAAqB,CAAC;YAC7C,CAAC;YAED,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,WAAW;YACpB,WAAW,EAAE,eAAe;SAC7B;QACD,KAAK;QACL,UAAU,EAAE;YACV,OAAO,EAAE,EAAE;SACZ;KACF,CAAC;AACJ,CAAC"}

package/dist/lib/post-handler.d.ts

@@ -43,7 +43,7 @@ export declare class PostHandler {
      *
      * PREPARATORY: Uses DataRouter for region-aware post creation.
      */
-    createPost(request: Request, session: Session, env: Env, requestContext: RequestContext): Promise<Response>;
+    createPost(request: Request, session: Session, env: Env, requestContext: RequestContext, activeTenantId: string): Promise<Response>;
     /**
      * Delete a post (soft delete)
      *

package/dist/lib/post-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post-handler.d.ts","sourceRoot":"","sources":["../../src/lib/post-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,4BAA4B,CAAC;AAWzF,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAErE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,GAAG;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,iBAAiB,CAAC,EAAE,WAAW,CAAC;IAChC,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;CACJ;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,MAAM,CAAS;gBAEX,GAAG,CAAC,EAAE,SAAS;IAK3B;;;;OAIG;IACG,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IA6gCpB;;;;OAIG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IA8HpB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAuXpB;;OAEG;YACW,mBAAmB;IAkBjC;;;;OAIG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAwEpB;;;;OAIG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IA2EpB;;;;OAIG;YACW,mBAAmB;CAiBlC"}
+{"version":3,"file":"post-handler.d.ts","sourceRoot":"","sources":["../../src/lib/post-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,4BAA4B,CAAC;AAWzF,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAErE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,GAAG;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,iBAAiB,CAAC,EAAE,WAAW,CAAC;IAChC,gBAAgB,CAAC,EAAE,GAAG,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;CACJ;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,MAAM,CAAS;gBAEX,GAAG,CAAC,EAAE,SAAS;IAK3B;;;;OAIG;IACG,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,CAAC;IA0/BpB;;;;OAIG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IA8HpB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAuXpB;;OAEG;YACW,mBAAmB;IAkBjC;;;;OAIG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IAwEpB;;;;OAIG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,QAAQ,CAAC;IA2EpB;;;;OAIG;YACW,mBAAmB;CAiBlC"}

package/dist/lib/post-handler.js

@@ -56,7 +56,7 @@ class PostHandler {
      *
      * PREPARATORY: Uses DataRouter for region-aware post creation.
      */
-    async createPost(request, session, env, requestContext) {
+    async createPost(request, session, env, requestContext, activeTenantId) {
         try {
             // PREPARATORY: Check if post creation is enabled for this region
             // Note: Post creation is always enabled by default, but can be disabled via feature flags
@@ -367,16 +367,10 @@ class PostHandler {
             if (taxonomyTags.length > 0) {
                 try {
                     const { TaxonomyHandler } = await Promise.resolve().then(() => __importStar(require("./taxonomy-handler")));
-                    const { getRequestContext } = await Promise.resolve().then(() => __importStar(require("./tenant-context")));
-                    const { createRequestContext } = await Promise.resolve().then(() => __importStar(require("./request-context")));
                     const { getWrappedDatabase } = await Promise.resolve().then(() => __importStar(require("./database-wrapper-helper")));
-                    // Get tenant ID
-                    const ctx = await createRequestContext(request, env);
-                    const tenantCtx = await getRequestContext(request, ctx.session || null);
-                    const tenantId = tenantCtx.tenant?.id || "trellis";
-                    // Get database and taxonomy handler
+                    // Get database and taxonomy handler scoped to caller's active tenant
                     const db = getWrappedDatabase(region, env, request);
-                    const taxonomyHandler = new TaxonomyHandler(db, tenantId, env.TAXONOMY_CACHE_KV);
+                    const taxonomyHandler = new TaxonomyHandler(db, activeTenantId, env.TAXONOMY_CACHE_KV);
                     // Add taxonomy tags
                     await taxonomyHandler.addPostTaxonomyTags(post.id, taxonomyTags, session.userId);
                 }
@@ -624,14 +618,9 @@ class PostHandler {
             if (taxonomyTags.length > 0) {
                 try {
                     const { TaxonomyHandler } = await Promise.resolve().then(() => __importStar(require("./taxonomy-handler")));
-                    const { getRequestContext } = await Promise.resolve().then(() => __importStar(require("./tenant-context")));
-                    const { createRequestContext } = await Promise.resolve().then(() => __importStar(require("./request-context")));
                     const { getWrappedDatabase } = await Promise.resolve().then(() => __importStar(require("./database-wrapper-helper")));
-                    const ctx = await createRequestContext(request, env);
-                    const tenantCtx = await getRequestContext(request, ctx.session || null);
-                    const tenantId = tenantCtx.tenant?.id || "trellis";
                     const db = getWrappedDatabase(region, env, request);
-                    const taxonomyHandler = new TaxonomyHandler(db, tenantId, env.TAXONOMY_CACHE_KV);
+                    const taxonomyHandler = new TaxonomyHandler(db, activeTenantId, env.TAXONOMY_CACHE_KV);
                     const tags = await taxonomyHandler.getPostTaxonomyTags(post.id);
                     taxonomyTagsResponse = tags.map((t) => ({
                         taxonId: t.taxonId,