@de-otio/trellis 0.6.1 → 0.7.1

package/dist/lib/tenant/setup-status.js

@@ -0,0 +1,201 @@
+"use strict";
+/**
+ * Setup-status: machine-friendly tenant onboarding progress.
+ *
+ * `computeSetupStatus` is a pure function — it does no I/O and can be tested
+ * without a database.  `loadSetupStatus` performs the Prisma query and calls
+ * `computeSetupStatus` with the results.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeSetupStatus = computeSetupStatus;
+exports.loadSetupStatus = loadSetupStatus;
+// ── Pure computation ────────────────────────────────────────────────────────
+/**
+ * Deterministically derive the setup-status object from snapshot data.
+ * No side effects; safe to call in unit tests without any database.
+ */
+function computeSetupStatus(input) {
+    const { tenantId, tenantExists, hasTestSignIn, domains, idp, roleMappings } = input;
+    // ── tenant section ────────────────────────────────────────────────────────
+    const tenantSection = {
+        status: tenantExists ? "ok" : "missing",
+        tenantId,
+    };
+    // ── domains section ───────────────────────────────────────────────────────
+    const domainItems = domains.map((d) => ({
+        domain: d.domain,
+        verifiedAt: d.verifiedAt ? d.verifiedAt.toISOString() : null,
+        status: d.verifiedAt ? "verified" : d.failedAt ? "failed" : "pending",
+    }));
+    // ── idp section ───────────────────────────────────────────────────────────
+    const idpSection = idp
+        ? {
+            kind: idp.kind,
+            status: idp.status,
+            issuerUrl: idp.issuerUrl,
+        }
+        : null;
+    // ── roleMappings section ──────────────────────────────────────────────────
+    const roleMappingItems = roleMappings.map((r) => ({
+        id: r.id,
+        externalGroup: r.externalGroup,
+        tenantRole: r.tenantRole,
+    }));
+    // ── nextStep computation ──────────────────────────────────────────────────
+    const verifiedDomains = domainItems.filter((d) => d.status === "verified");
+    const unverifiedDomains = domainItems.filter((d) => d.status !== "verified");
+    const idpActive = idpSection !== null && idpSection.status === "ACTIVE";
+    let nextStep;
+    if (domainItems.length === 0) {
+        nextStep = {
+            code: "DOMAIN_REQUIRED",
+            message: "Add a domain to verify ownership before connecting an identity provider.",
+            endpoint: `POST /api/tenants/${tenantId}/domains`,
+            remediation: "Call POST /api/tenants/{id}/domains with { \"domain\": \"yourdomain.com\" } to claim your domain.",
+        };
+    }
+    else if (verifiedDomains.length === 0 && unverifiedDomains.length > 0) {
+        // Has domains claimed but none verified (includes pending and failed states).
+        nextStep = {
+            code: "DOMAIN_VERIFICATION_PENDING",
+            message: "At least one domain is claimed but not yet verified. Add the DNS TXT record and verify.",
+            endpoint: `POST /api/tenants/${tenantId}/domains/{domainId}/verify`,
+            remediation: "Add the TXT record to your DNS provider then call POST /api/tenants/{id}/domains/{domainId}/verify.",
+        };
+    }
+    else if (idpSection === null) {
+        nextStep = {
+            code: "IDP_REQUIRED",
+            message: "No identity provider is connected. Connect an OIDC IdP to enable federated sign-in.",
+            endpoint: `POST /api/tenants/${tenantId}/identity-provider`,
+            remediation: "Call POST /api/tenants/{id}/identity-provider with { \"kind\": \"OIDC\", \"issuerUrl\": \"...\", ... }.",
+        };
+    }
+    else if (!idpActive) {
+        // IdP exists but is DISABLED or PENDING
+        nextStep = {
+            code: "IDP_REQUIRED",
+            message: `Identity provider is not active (status: ${idpSection.status}). Enable it to allow federated sign-in.`,
+            endpoint: `PATCH /api/tenants/${tenantId}/identity-provider`,
+            remediation: "Call PATCH /api/tenants/{id}/identity-provider with { \"status\": \"ACTIVE\" }.",
+        };
+    }
+    else if (roleMappingItems.length === 0) {
+        nextStep = {
+            code: "ROLE_MAPPING_REQUIRED",
+            message: "No role mappings are configured. Add at least one mapping to assign roles to IdP groups.",
+            endpoint: `POST /api/tenants/${tenantId}/role-mappings`,
+            remediation: "Call POST /api/tenants/{id}/role-mappings with { \"externalGroup\": \"...\", \"tenantRole\": \"MEMBER\" }.",
+        };
+    }
+    else if (!hasTestSignIn) {
+        nextStep = {
+            code: "TEST_SIGN_IN",
+            message: "Setup looks complete. Perform a test federated sign-in to confirm the flow works end-to-end.",
+            endpoint: `GET /api/auth/discover`,
+            remediation: "Use a test account in your IdP to sign in via POST /api/auth/discover and verify the redirect flow.",
+        };
+    }
+    else {
+        nextStep = {
+            code: "COMPLETE",
+            message: "Tenant setup is complete. Federated sign-in is operational.",
+            endpoint: `GET /api/tenants/${tenantId}/setup-status`,
+            remediation: "No action required.",
+        };
+    }
+    return {
+        tenant: tenantSection,
+        domains: domainItems,
+        idp: idpSection,
+        roleMappings: roleMappingItems,
+        nextStep,
+    };
+}
+// ── Loader (Prisma I/O) ─────────────────────────────────────────────────────
+/**
+ * Fetch all data needed to compute setup-status in a single read transaction,
+ * then return the computed status object.
+ */
+async function loadSetupStatus(tenantId, env) {
+    const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+    const db = createPrisma(env);
+    // Single transaction to get a consistent snapshot.
+    const [tenant, domains, idpRow, roleMappings, testSignInEvent] = await db.$transaction([
+        db.tenant.findUnique({
+            where: { id: tenantId },
+            select: { id: true },
+        }),
+        db.tenantDomain.findMany({
+            where: { tenantId },
+            select: { domain: true, verifiedAt: true },
+            orderBy: { domain: "asc" },
+        }),
+        db.tenantIdentityProvider.findUnique({
+            where: { tenantId },
+            select: { kind: true, status: true, issuerUrl: true },
+        }),
+        db.tenantRoleMapping.findMany({
+            where: { tenantId },
+            select: { id: true, idpGroupName: true, tenantRole: true },
+            orderBy: { idpGroupName: "asc" },
+        }),
+        db.securityEvent.findFirst({
+            where: {
+                tenantId,
+                type: "tenant.federated_login.success",
+            },
+            select: { id: true },
+        }),
+    ]);
+    if (!tenant)
+        return null;
+    return computeSetupStatus({
+        tenantId,
+        tenantExists: true,
+        hasTestSignIn: Boolean(testSignInEvent),
+        domains,
+        idp: idpRow
+            ? { kind: String(idpRow.kind), status: String(idpRow.status), issuerUrl: idpRow.issuerUrl }
+            : null,
+        roleMappings: roleMappings.map((r) => ({
+            id: r.id,
+            externalGroup: r.idpGroupName,
+            tenantRole: String(r.tenantRole),
+        })),
+    });
+}
+//# sourceMappingURL=setup-status.js.map

package/dist/lib/tenant/setup-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-status.js","sourceRoot":"","sources":["../../../src/lib/tenant/setup-status.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkGH,gDAmGC;AAQD,0CAoDC;AArKD,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,KAAuB;IACxD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAEpF,6EAA6E;IAC7E,MAAM,aAAa,GAAuB;QACxC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACvC,QAAQ;KACT,CAAC;IAEF,6EAA6E;IAC7E,MAAM,WAAW,GAAkB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC,CAAC,CAAC;IAEJ,6EAA6E;IAC7E,MAAM,UAAU,GAAoB,GAAG;QACrC,CAAC,CAAC;YACE,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAmB;YAC/B,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB;QACH,CAAC,CAAC,IAAI,CAAC;IAET,6EAA6E;IAC7E,MAAM,gBAAgB,GAAuB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAC,CAAC;IAEJ,6EAA6E;IAC7E,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC;IAExE,IAAI,QAAkB,CAAC;IAEvB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,QAAQ,GAAG;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,0EAA0E;YACnF,QAAQ,EAAE,qBAAqB,QAAQ,UAAU;YACjD,WAAW,EAAE,mGAAmG;SACjH,CAAC;IACJ,CAAC;SAAM,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,8EAA8E;QAC9E,QAAQ,GAAG;YACT,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,yFAAyF;YAClG,QAAQ,EAAE,qBAAqB,QAAQ,4BAA4B;YACnE,WAAW,EAAE,qGAAqG;SACnH,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC/B,QAAQ,GAAG;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,qFAAqF;YAC9F,QAAQ,EAAE,qBAAqB,QAAQ,oBAAoB;YAC3D,WAAW,EAAE,yGAAyG;SACvH,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtB,wCAAwC;QACxC,QAAQ,GAAG;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,4CAA4C,UAAU,CAAC,MAAM,0CAA0C;YAChH,QAAQ,EAAE,sBAAsB,QAAQ,oBAAoB;YAC5D,WAAW,EAAE,iFAAiF;SAC/F,CAAC;IACJ,CAAC;SAAM,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,QAAQ,GAAG;YACT,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,0FAA0F;YACnG,QAAQ,EAAE,qBAAqB,QAAQ,gBAAgB;YACvD,WAAW,EAAE,4GAA4G;SAC1H,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1B,QAAQ,GAAG;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,8FAA8F;YACvG,QAAQ,EAAE,wBAAwB;YAClC,WAAW,EAAE,qGAAqG;SACnH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG;YACT,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE,oBAAoB,QAAQ,eAAe;YACrD,WAAW,EAAE,qBAAqB;SACnC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,WAAW;QACpB,GAAG,EAAE,UAAU;QACf,YAAY,EAAE,gBAAgB;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACI,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,GAAQ;IAER,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;IAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAE7B,mDAAmD;IACnD,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC;QACrF,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;YACnB,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACvB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC;QACF,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;YACvB,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;YAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;SAC3B,CAAC;QACF,EAAE,CAAC,sBAAsB,CAAC,UAAU,CAAC;YACnC,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SACtD,CAAC;QACF,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YAC5B,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;YAC1D,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE;SACjC,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC;YACzB,KAAK,EAAE;gBACL,QAAQ;gBACR,IAAI,EAAE,gCAAgC;aACvC;YACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO,kBAAkB,CAAC;QACxB,QAAQ;QACR,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,eAAe,CAAC;QACvC,OAAO;QACP,GAAG,EAAE,MAAM;YACT,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;YAC3F,CAAC,CAAC,IAAI;QACR,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,aAAa,EAAE,CAAC,CAAC,YAAY;YAC7B,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;SACjC,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/tenant/slug-validator.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Slug Validator
+ *
+ * Wraps the T1 slug regex and reserved-list into a typed result that
+ * route handlers can pattern-match on.
+ */
+export type SlugValidationResult = {
+    ok: true;
+} | {
+    ok: false;
+    code: "INVALID_FORMAT";
+    message: string;
+} | {
+    ok: false;
+    code: "RESERVED";
+    message: string;
+};
+/**
+ * Full admission check for a tenant slug: format + reserved-list.
+ *
+ * Negative test cases (must never pass):
+ *   - Shell-escape attempts: "foo; rm -rf", "$(evil)", "`cmd`"  → INVALID_FORMAT (non-[a-z0-9-])
+ *   - URL-injection: "../admin", "//evil.com", "%2F"            → INVALID_FORMAT
+ *   - Leading/trailing hyphen: "-foo", "foo-"                   → INVALID_FORMAT
+ *   - Double-hyphen: "foo--bar"                                 → INVALID_FORMAT
+ *   - Too short: "ab" (2 chars)                                 → INVALID_FORMAT
+ *   - Too long: 41+ chars                                       → INVALID_FORMAT
+ *   - Reserved word: "admin", "system"                          → RESERVED
+ */
+export declare function validateTenantSlug(slug: string): SlugValidationResult;
+//# sourceMappingURL=slug-validator.d.ts.map

package/dist/lib/tenant/slug-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug-validator.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant/slug-validator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAmBrE"}

package/dist/lib/tenant/slug-validator.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Slug Validator
+ *
+ * Wraps the T1 slug regex and reserved-list into a typed result that
+ * route handlers can pattern-match on.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateTenantSlug = validateTenantSlug;
+const reserved_slugs_1 = require("./reserved-slugs");
+/**
+ * Full admission check for a tenant slug: format + reserved-list.
+ *
+ * Negative test cases (must never pass):
+ *   - Shell-escape attempts: "foo; rm -rf", "$(evil)", "`cmd`"  → INVALID_FORMAT (non-[a-z0-9-])
+ *   - URL-injection: "../admin", "//evil.com", "%2F"            → INVALID_FORMAT
+ *   - Leading/trailing hyphen: "-foo", "foo-"                   → INVALID_FORMAT
+ *   - Double-hyphen: "foo--bar"                                 → INVALID_FORMAT
+ *   - Too short: "ab" (2 chars)                                 → INVALID_FORMAT
+ *   - Too long: 41+ chars                                       → INVALID_FORMAT
+ *   - Reserved word: "admin", "system"                          → RESERVED
+ */
+function validateTenantSlug(slug) {
+    const code = (0, reserved_slugs_1.validateSlug)(slug);
+    if (code === "INVALID_FORMAT") {
+        return {
+            ok: false,
+            code: "INVALID_FORMAT",
+            message: "Slug must be 3–40 lowercase alphanumeric characters or hyphens, " +
+                "start and end with an alphanumeric character, and contain no consecutive hyphens.",
+        };
+    }
+    if (code === "RESERVED") {
+        return {
+            ok: false,
+            code: "RESERVED",
+            message: "This slug is reserved and cannot be used.",
+        };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=slug-validator.js.map

package/dist/lib/tenant/slug-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug-validator.js","sourceRoot":"","sources":["../../../src/lib/tenant/slug-validator.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAqBH,gDAmBC;AAtCD,qDAAgD;AAOhD;;;;;;;;;;;GAWG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,IAAA,6BAAY,EAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,gBAAgB;YACtB,OAAO,EACL,kEAAkE;gBAClE,mFAAmF;SACtF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,2CAA2C;SACrD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/lib/tenant/tenant-handler.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Tenant CRUD Handler
+ *
+ * Handlers for:
+ *  - POST /api/tenants          — create org tenant
+ *  - GET  /api/tenants/:id      — read tenant
+ *  - PATCH /api/tenants/:id     — update displayName
+ *  - GET  /api/users/me/tenants — list caller's memberships
+ *  - POST /api/auth/switch-tenant       — change active tenant + invalidate cache
+ *  - POST /api/tenants/:id/transfer-ownership — OWNER hand-off
+ */
+import type { Env } from "../../env";
+import type { AuthContext } from "../auth/auth-context";
+export declare class TenantHandler {
+    /**
+     * POST /api/tenants
+     * Creates an ORGANIZATION tenant. Caller becomes OWNER.
+     * If caller is END_USER their global role is bumped to B2B_PARTNER.
+     */
+    handleCreate(request: Request, auth: AuthContext, env: Env): Promise<Response>;
+    /**
+     * GET /api/tenants/:id
+     * Returns the tenant. Caller must be an active member.
+     */
+    handleGet(tenantId: string, auth: AuthContext, env: Env): Promise<Response>;
+    /**
+     * PATCH /api/tenants/:id
+     * Updates displayName. Requires OWNER or ADMIN.
+     */
+    handleUpdate(tenantId: string, request: Request, auth: AuthContext, env: Env): Promise<Response>;
+    /**
+     * GET /api/users/me/tenants
+     * Lists all active tenant memberships for the caller.
+     */
+    handleListMyTenants(auth: AuthContext, env: Env): Promise<Response>;
+    /**
+     * POST /api/auth/switch-tenant
+     * Changes the user's active tenant. Invalidates DynamoDB claim cache so
+     * the next token refresh picks up the new activeTenantId.
+     */
+    handleSwitchTenant(request: Request, auth: AuthContext, env: Env): Promise<Response>;
+    /**
+     * POST /api/tenants/:id/transfer-ownership
+     * Current OWNER hands off ownership to another active member.
+     * Both users' cache entries are invalidated.
+     */
+    handleTransferOwnership(tenantId: string, request: Request, auth: AuthContext, env: Env): Promise<Response>;
+}
+//# sourceMappingURL=tenant-handler.d.ts.map

package/dist/lib/tenant/tenant-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-handler.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant/tenant-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWxD,qBAAa,aAAa;IACxB;;;;OAIG;IACG,YAAY,CAChB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IAgGpB;;;OAGG;IACG,SAAS,CACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IAmCpB;;;OAGG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IAiEpB;;;OAGG;IACG,mBAAmB,CACvB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IAoCpB;;;;OAIG;IACG,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IAuFpB;;;;OAIG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;CAyFrB"}