@de-otio/trellis 0.6.1 → 0.7.0

package/dist/lib/routes/tenant-idp.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tenantIdpRoutes = void 0;
+/**
+ * Tenant identity-provider routes (T5).
+ *
+ *   POST   /api/tenants/:id/identity-provider
+ *   GET    /api/tenants/:id/identity-provider
+ *   PATCH  /api/tenants/:id/identity-provider
+ *   DELETE /api/tenants/:id/identity-provider?confirm=true
+ *
+ * The PATCH route serves both config edits (clientSecret rotation,
+ * attribute mapping, defaultRole, scopes) and status toggle
+ * (`{status: ACTIVE|DISABLED}`); the handler picks based on body shape.
+ */
+const middleware_1 = require("../middleware");
+const idempotency_1 = require("../middleware/idempotency");
+const security_headers_1 = require("../security-headers");
+const auth_middleware_1 = require("../auth/auth-middleware");
+const idp_handler_1 = require("../tenant/idp-handler");
+const errors_1 = require("./errors");
+const IDP_RE = /^\/api\/tenants\/([^/]+)\/identity-provider$/;
+exports.tenantIdpRoutes = [
+    {
+        path: IDP_RE,
+        method: "POST",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const tenantId = pathname.match(IDP_RE)?.[1] ?? "";
+            const handler = new idp_handler_1.IdpHandler();
+            const response = await handler.handleCreate(tenantId, request, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)(), (0, idempotency_1.idempotencyMiddleware)()],
+        description: "Connect a tenant identity provider (OIDC)",
+    },
+    {
+        path: IDP_RE,
+        method: "GET",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const tenantId = pathname.match(IDP_RE)?.[1] ?? "";
+            const handler = new idp_handler_1.IdpHandler();
+            const response = await handler.handleGet(tenantId, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "Read a tenant identity provider",
+    },
+    {
+        path: IDP_RE,
+        method: "PATCH",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const tenantId = pathname.match(IDP_RE)?.[1] ?? "";
+            const handler = new idp_handler_1.IdpHandler();
+            const response = await handler.handlePatch(tenantId, request, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Update or toggle a tenant identity provider",
+    },
+    {
+        path: IDP_RE,
+        method: "DELETE",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const tenantId = pathname.match(IDP_RE)?.[1] ?? "";
+            const handler = new idp_handler_1.IdpHandler();
+            const response = await handler.handleDelete(tenantId, new URL(request.url), auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Disconnect a tenant identity provider",
+    },
+];
+//# sourceMappingURL=tenant-idp.js.map

package/dist/lib/routes/tenant-idp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-idp.js","sourceRoot":"","sources":["../../../src/lib/routes/tenant-idp.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,8CAA+D;AAC/D,2DAAkE;AAClE,0DAAsD;AACtD,6DAAyD;AACzD,uDAAmD;AACnD,qCAA6C;AAG7C,MAAM,MAAM,GAAG,8CAA8C,CAAC;AAEjD,QAAA,eAAe,GAAY;IACtC;QACE,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,IAAI,wBAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,EAAE,IAAA,mCAAqB,GAAE,CAAC;QACzE,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,IAAI,wBAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;QAC9B,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,IAAI,wBAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACzE,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,IAAI,wBAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACvF,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,uCAAuC;KACrD;CACF,CAAC"}

package/dist/lib/routes/tenant-members.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Tenant member routes.
+ *
+ *   GET    /api/tenants/:id/members
+ *   PATCH  /api/tenants/:id/members/:memberId
+ *   DELETE /api/tenants/:id/members/:memberId
+ *
+ * `POST /api/tenants/:id/transfer-ownership` is wired in routes/tenants.ts
+ * and now backed by MemberHandler.handleTransferOwnership.
+ */
+import type { Route } from "./types";
+export declare const tenantMemberRoutes: Route[];
+//# sourceMappingURL=tenant-members.d.ts.map

package/dist/lib/routes/tenant-members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-members.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/tenant-members.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAKrC,eAAO,MAAM,kBAAkB,EAAE,KAAK,EAuDrC,CAAC"}

package/dist/lib/routes/tenant-members.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * Tenant member routes.
+ *
+ *   GET    /api/tenants/:id/members
+ *   PATCH  /api/tenants/:id/members/:memberId
+ *   DELETE /api/tenants/:id/members/:memberId
+ *
+ * `POST /api/tenants/:id/transfer-ownership` is wired in routes/tenants.ts
+ * and now backed by MemberHandler.handleTransferOwnership.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tenantMemberRoutes = void 0;
+const middleware_1 = require("../middleware");
+const security_headers_1 = require("../security-headers");
+const member_handler_1 = require("../tenant/member-handler");
+const auth_middleware_1 = require("../auth/auth-middleware");
+const errors_1 = require("./errors");
+const MEMBERS_LIST = /^\/api\/tenants\/([^/]+)\/members$/;
+const MEMBER_ITEM = /^\/api\/tenants\/([^/]+)\/members\/([^/]+)$/;
+exports.tenantMemberRoutes = [
+    {
+        path: MEMBERS_LIST,
+        method: "GET",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const tenantId = pathname.match(MEMBERS_LIST)?.[1] ?? "";
+            const handler = new member_handler_1.MemberHandler();
+            const response = await handler.handleList(tenantId, request, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "List tenant members (paginated)",
+    },
+    {
+        path: MEMBER_ITEM,
+        method: "PATCH",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const match = pathname.match(MEMBER_ITEM);
+            const tenantId = match?.[1] ?? "";
+            const memberId = match?.[2] ?? "";
+            const handler = new member_handler_1.MemberHandler();
+            const response = await handler.handlePatchRole(tenantId, memberId, request, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Change a member's role",
+    },
+    {
+        path: MEMBER_ITEM,
+        method: "DELETE",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const match = pathname.match(MEMBER_ITEM);
+            const tenantId = match?.[1] ?? "";
+            const memberId = match?.[2] ?? "";
+            const handler = new member_handler_1.MemberHandler();
+            const response = await handler.handleRemove(tenantId, memberId, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Remove a member (soft-delete + global sign-out)",
+    },
+];
+//# sourceMappingURL=tenant-members.js.map

package/dist/lib/routes/tenant-members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-members.js","sourceRoot":"","sources":["../../../src/lib/routes/tenant-members.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,8CAA+D;AAC/D,0DAAsD;AACtD,6DAAyD;AACzD,6DAAyD;AACzD,qCAA6C;AAG7C,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAC1D,MAAM,WAAW,GAAG,6CAA6C,CAAC;AAErD,QAAA,kBAAkB,GAAY;IACzC;QACE,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,8BAAa,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACxE,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;QAC9B,WAAW,EAAE,iCAAiC;KAC/C;IAED;QACE,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YAErD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,8BAAa,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACvF,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,wBAAwB;KACtC;IAED;QACE,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YAErD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,8BAAa,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3E,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,iDAAiD;KAC/D;CACF,CAAC"}

package/dist/lib/routes/tenant-role-mappings.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Tenant role-mapping routes.
+ *
+ *   GET    /api/tenants/:id/role-mappings
+ *   POST   /api/tenants/:id/role-mappings
+ *   PATCH  /api/tenants/:id/role-mappings/:mappingId
+ *   DELETE /api/tenants/:id/role-mappings/:mappingId
+ */
+import type { Route } from "./types";
+export declare const tenantRoleMappingRoutes: Route[];
+//# sourceMappingURL=tenant-role-mappings.d.ts.map

package/dist/lib/routes/tenant-role-mappings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-role-mappings.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/tenant-role-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAKrC,eAAO,MAAM,uBAAuB,EAAE,KAAK,EAwE1C,CAAC"}

package/dist/lib/routes/tenant-role-mappings.js

@@ -0,0 +1,90 @@
+"use strict";
+/**
+ * Tenant role-mapping routes.
+ *
+ *   GET    /api/tenants/:id/role-mappings
+ *   POST   /api/tenants/:id/role-mappings
+ *   PATCH  /api/tenants/:id/role-mappings/:mappingId
+ *   DELETE /api/tenants/:id/role-mappings/:mappingId
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tenantRoleMappingRoutes = void 0;
+const middleware_1 = require("../middleware");
+const idempotency_1 = require("../middleware/idempotency");
+const security_headers_1 = require("../security-headers");
+const role_mapping_handler_1 = require("../tenant/role-mapping-handler");
+const auth_middleware_1 = require("../auth/auth-middleware");
+const errors_1 = require("./errors");
+const MAPPINGS_LIST = /^\/api\/tenants\/([^/]+)\/role-mappings$/;
+const MAPPING_ITEM = /^\/api\/tenants\/([^/]+)\/role-mappings\/([^/]+)$/;
+exports.tenantRoleMappingRoutes = [
+    {
+        path: MAPPINGS_LIST,
+        method: "GET",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const tenantId = pathname.match(MAPPINGS_LIST)?.[1] ?? "";
+            const handler = new role_mapping_handler_1.RoleMappingHandler();
+            const response = await handler.handleList(tenantId, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "List tenant role mappings",
+    },
+    {
+        path: MAPPINGS_LIST,
+        method: "POST",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const tenantId = pathname.match(MAPPINGS_LIST)?.[1] ?? "";
+            const handler = new role_mapping_handler_1.RoleMappingHandler();
+            const response = await handler.handleCreate(tenantId, request, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)(), (0, idempotency_1.idempotencyMiddleware)()],
+        description: "Create a tenant role mapping",
+    },
+    {
+        path: MAPPING_ITEM,
+        method: "PATCH",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const match = pathname.match(MAPPING_ITEM);
+            const tenantId = match?.[1] ?? "";
+            const mappingId = match?.[2] ?? "";
+            const handler = new role_mapping_handler_1.RoleMappingHandler();
+            const response = await handler.handleUpdate(tenantId, mappingId, request, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Update a tenant role mapping",
+    },
+    {
+        path: MAPPING_ITEM,
+        method: "DELETE",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return (0, errors_1.unauthorizedError)(securityHeaders);
+            const match = pathname.match(MAPPING_ITEM);
+            const tenantId = match?.[1] ?? "";
+            const mappingId = match?.[2] ?? "";
+            const handler = new role_mapping_handler_1.RoleMappingHandler();
+            const response = await handler.handleDelete(tenantId, mappingId, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Delete a tenant role mapping",
+    },
+];
+//# sourceMappingURL=tenant-role-mappings.js.map

package/dist/lib/routes/tenant-role-mappings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-role-mappings.js","sourceRoot":"","sources":["../../../src/lib/routes/tenant-role-mappings.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,8CAA+D;AAC/D,2DAAkE;AAClE,0DAAsD;AACtD,yEAAoE;AACpE,6DAAyD;AACzD,qCAA6C;AAG7C,MAAM,aAAa,GAAG,0CAA0C,CAAC;AACjE,MAAM,YAAY,GAAG,mDAAmD,CAAC;AAE5D,QAAA,uBAAuB,GAAY;IAC9C;QACE,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,yCAAkB,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;QAC9B,WAAW,EAAE,2BAA2B;KACzC;IAED;QACE,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,yCAAkB,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,EAAE,IAAA,mCAAqB,GAAE,CAAC;QACzE,WAAW,EAAE,8BAA8B;KAC5C;IAED;QACE,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YAErD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,yCAAkB,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACrF,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,8BAA8B;KAC5C;IAED;QACE,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC;YAErD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,yCAAkB,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5E,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,8BAA8B;KAC5C;CACF,CAAC"}

package/dist/lib/routes/tenants.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Tenant Routes
+ *
+ * - POST /api/tenants
+ * - GET  /api/tenants/:id
+ * - PATCH /api/tenants/:id
+ * - POST /api/tenants/:id/transfer-ownership
+ * - GET  /api/users/me/tenants
+ * - POST /api/auth/switch-tenant
+ */
+import type { Route } from "./types";
+export declare const tenantRoutes: Route[];
+//# sourceMappingURL=tenants.d.ts.map

package/dist/lib/routes/tenants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/tenants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,eAAO,MAAM,YAAY,EAAE,KAAK,EA0G/B,CAAC"}

package/dist/lib/routes/tenants.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Tenant Routes
+ *
+ * - POST /api/tenants
+ * - GET  /api/tenants/:id
+ * - PATCH /api/tenants/:id
+ * - POST /api/tenants/:id/transfer-ownership
+ * - GET  /api/users/me/tenants
+ * - POST /api/auth/switch-tenant
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tenantRoutes = void 0;
+const middleware_1 = require("../middleware");
+const idempotency_1 = require("../middleware/idempotency");
+const security_headers_1 = require("../security-headers");
+const tenant_handler_1 = require("../tenant/tenant-handler");
+const auth_middleware_1 = require("../auth/auth-middleware");
+const errors_1 = require("./errors");
+exports.tenantRoutes = [
+    // ── POST /api/tenants ─────────────────────────────────────────────────────
+    {
+        path: "/api/tenants",
+        method: "POST",
+        handler: async (request, env) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return securityHeaders.addSecurityHeaders((0, errors_1.unauthorizedError)(securityHeaders));
+            const handler = new tenant_handler_1.TenantHandler();
+            const response = await handler.handleCreate(request, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)(), (0, idempotency_1.idempotencyMiddleware)()],
+        description: "Create organization tenant",
+    },
+    // ── GET /api/tenants/:id ──────────────────────────────────────────────────
+    {
+        path: /^\/api\/tenants\/([^/]+)$/,
+        method: "GET",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return securityHeaders.addSecurityHeaders((0, errors_1.unauthorizedError)(securityHeaders));
+            const tenantId = pathname.match(/^\/api\/tenants\/([^/]+)$/)?.[1] ?? "";
+            const handler = new tenant_handler_1.TenantHandler();
+            const response = await handler.handleGet(tenantId, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "Get tenant by ID",
+    },
+    // ── PATCH /api/tenants/:id ────────────────────────────────────────────────
+    {
+        path: /^\/api\/tenants\/([^/]+)$/,
+        method: "PATCH",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return securityHeaders.addSecurityHeaders((0, errors_1.unauthorizedError)(securityHeaders));
+            const tenantId = pathname.match(/^\/api\/tenants\/([^/]+)$/)?.[1] ?? "";
+            const handler = new tenant_handler_1.TenantHandler();
+            const response = await handler.handleUpdate(tenantId, request, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Update tenant displayName",
+    },
+    // ── POST /api/tenants/:id/transfer-ownership ──────────────────────────────
+    {
+        path: /^\/api\/tenants\/([^/]+)\/transfer-ownership$/,
+        method: "POST",
+        handler: async (request, env, { pathname }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return securityHeaders.addSecurityHeaders((0, errors_1.unauthorizedError)(securityHeaders));
+            const tenantId = pathname.match(/^\/api\/tenants\/([^/]+)\/transfer-ownership$/)?.[1] ?? "";
+            const handler = new tenant_handler_1.TenantHandler();
+            const response = await handler.handleTransferOwnership(tenantId, request, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Transfer tenant ownership",
+    },
+    // ── GET /api/users/me/tenants ─────────────────────────────────────────────
+    {
+        path: "/api/users/me/tenants",
+        method: "GET",
+        handler: async (request, env) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return securityHeaders.addSecurityHeaders((0, errors_1.unauthorizedError)(securityHeaders));
+            const handler = new tenant_handler_1.TenantHandler();
+            const response = await handler.handleListMyTenants(auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "List caller's tenant memberships",
+    },
+    // ── POST /api/auth/switch-tenant ──────────────────────────────────────────
+    {
+        path: "/api/auth/switch-tenant",
+        method: "POST",
+        handler: async (request, env) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+            if (!auth)
+                return securityHeaders.addSecurityHeaders((0, errors_1.unauthorizedError)(securityHeaders));
+            const handler = new tenant_handler_1.TenantHandler();
+            const response = await handler.handleSwitchTenant(request, auth, env);
+            return securityHeaders.addSecurityHeaders(response);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Switch active tenant",
+    },
+];
+//# sourceMappingURL=tenants.js.map

package/dist/lib/routes/tenants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenants.js","sourceRoot":"","sources":["../../../src/lib/routes/tenants.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,8CAA+D;AAC/D,2DAAkE;AAClE,0DAAsD;AACtD,6DAAyD;AACzD,6DAAyD;AACzD,qCAA6C;AAGhC,QAAA,YAAY,GAAY;IACnC,6EAA6E;IAC7E;QACE,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,eAAe,CAAC,kBAAkB,CAAC,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC,CAAC;YAEzF,MAAM,OAAO,GAAG,IAAI,8BAAa,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAChE,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,EAAE,IAAA,mCAAqB,GAAE,CAAC;QACzE,WAAW,EAAE,4BAA4B;KAC1C;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,eAAe,CAAC,kBAAkB,CAAC,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC,CAAC;YAEzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxE,MAAM,OAAO,GAAG,IAAI,8BAAa,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;QAC9B,WAAW,EAAE,kBAAkB;KAChC;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,eAAe,CAAC,kBAAkB,CAAC,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC,CAAC;YAEzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxE,MAAM,OAAO,GAAG,IAAI,8BAAa,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,2BAA2B;KACzC;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,+CAA+C;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,eAAe,CAAC,kBAAkB,CAAC,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC,CAAC;YAEzF,MAAM,QAAQ,GACZ,QAAQ,CAAC,KAAK,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,MAAM,OAAO,GAAG,IAAI,8BAAa,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACrF,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,2BAA2B;KACzC;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,eAAe,CAAC,kBAAkB,CAAC,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC,CAAC;YAEzF,MAAM,OAAO,GAAG,IAAI,8BAAa,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,CAAC;QAC9B,WAAW,EAAE,kCAAkC;KAChD;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAc,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,eAAe,CAAC,kBAAkB,CAAC,IAAA,0BAAiB,EAAC,eAAe,CAAC,CAAC,CAAC;YAEzF,MAAM,OAAO,GAAG,IAAI,8BAAa,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACtE,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QAChD,WAAW,EAAE,sBAAsB;KACpC;CACF,CAAC"}

package/dist/lib/routes/types.d.ts

@@ -42,5 +42,14 @@ export interface Route {
      * API version (for versioning support)
      */
     version?: string;
+    /**
+     * Opt-in flag for publication on the public OpenAPI spec
+     * (`/openapi.json`) (G4 MEDIUM-3). Default `false` — only routes
+     * explicitly marked `publicSpec: true` appear in the document. The
+     * agent-discovery surface and the federation management routes are
+     * expected to set this; non-federation routes (posts, comments,
+     * media, ActivityPub, etc.) are excluded from the public spec.
+     */
+    publicSpec?: boolean;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/lib/routes/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,WAAW,KAAK;IACpB;;;;;;;OAOG;IACH,IAAI,EAAE,YAAY,CAAC;IAEnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3B;;OAEG;IACH,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE;QACP,GAAG,EAAE,GAAG,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,KACE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IAE1B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,WAAW,KAAK;IACpB;;;;;;;OAOG;IACH,IAAI,EAAE,YAAY,CAAC;IAEnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3B;;OAEG;IACH,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE;QACP,GAAG,EAAE,GAAG,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,KACE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IAE1B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB"}

package/dist/lib/schemas.d.ts

@@ -275,16 +275,16 @@ export declare const feedQuerySchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     limit: number;
     cursor?: string | undefined;
-    entityRef?: string | undefined;
     taxonomyTags?: string[] | undefined;
+    entityRef?: string | undefined;
     entityRefs?: string[] | undefined;
     offset?: number | undefined;
     personalized?: boolean | undefined;
     personalizationEntityIds?: string[] | undefined;
 }, {
     cursor?: string | undefined;
-    entityRef?: string | undefined;
     taxonomyTags?: string[] | undefined;
+    entityRef?: string | undefined;
     limit?: number | undefined;
     entityRefs?: string[] | undefined;
     offset?: number | undefined;

package/dist/lib/secrets/idp-secrets.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Secrets Manager wrapper for IdP client secrets.
+ *
+ * Naming convention: `tenant/{tenantId}/idp-client-secret`. The IAM policy
+ * grants Skybber's task role only `secretsmanager:CreateSecret`,
+ * `PutSecretValue`, `DeleteSecret`, `DescribeSecret`, `GetSecretValue` on
+ * `arn:aws:secretsmanager:{region}:{account}:secret:tenant/*` so a leak in
+ * the IdP CRUD path can never read or rewrite secrets outside that prefix.
+ *
+ * The plaintext secret enters via `createOrUpdate` and is forwarded straight
+ * to Secrets Manager. It is never logged here. Callers must not log it
+ * either.
+ */
+import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+export declare const IDP_SECRET_PREFIX = "tenant/";
+export declare const IDP_SECRET_SUFFIX = "/idp-client-secret";
+export declare function idpSecretName(tenantId: string): string;
+export interface IdpSecretRecord {
+    arn: string;
+    versionId?: string;
+}
+export declare class IdpSecretsClient {
+    private readonly client;
+    constructor(client: SecretsManagerClient);
+    /**
+     * Create the secret on first IdP connect. Tagged with the tenantId so an
+     * audit (or per-tenant cleanup) can find the secret without a lookup table.
+     * Throws if a secret with the same name already exists — the route handler
+     * maps that into 409.
+     */
+    create(tenantId: string, plaintext: string): Promise<IdpSecretRecord>;
+    /**
+     * Rotate the secret in place. Returns the new version id so the caller
+     * can attach it to audit metadata.
+     */
+    rotate(tenantId: string, plaintext: string): Promise<IdpSecretRecord>;
+    /**
+     * Permanently delete with no recovery window. We never want to leave
+     * dangling client secrets in Secrets Manager, and the only call sites
+     * (rollback after Cognito create failure, IdP disconnect) are explicitly
+     * destructive. NotFound is silently swallowed for idempotency.
+     */
+    delete(tenantId: string): Promise<void>;
+    /**
+     * Existence + ARN lookup. Used at IdP create time to decide whether to
+     * call Create vs Put. Returns null if the secret does not exist.
+     */
+    describe(tenantId: string): Promise<IdpSecretRecord | null>;
+}
+export declare function createIdpSecretsClient(region?: string): IdpSecretsClient;
+//# sourceMappingURL=idp-secrets.d.ts.map

package/dist/lib/secrets/idp-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp-secrets.d.ts","sourceRoot":"","sources":["../../../src/lib/secrets/idp-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,oBAAoB,EAKrB,MAAM,iCAAiC,CAAC;AAEzC,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAC3C,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,oBAAoB;IAEzD;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAkB3E;;;OAGG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAc3E;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB7C;;;OAGG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAclE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAIxE"}