@de-otio/trellis 0.7.0 → 0.9.0

package/dist/lib/routes/admin.js

@@ -1,69 +1,32 @@
-"use strict";
 /**
  * Admin Routes
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.adminRoutes = void 0;
-const zod_1 = require("zod");
-const db_1 = require("../../db");
-const worker_1 = require("../../worker");
-const data_router_1 = require("../data-router");
-const database_connection_manager_1 = require("../database-connection-manager");
-const db_query_helper_1 = require("../db-query-helper");
-const domain_reputation_service_1 = require("../domain-reputation-service");
-const feature_toggle_service_1 = require("../feature-toggle-service");
-const logger_1 = require("../logger");
-const middleware_1 = require("../middleware");
-const feature_toggle_rate_limit_1 = require("../middleware/feature-toggle-rate-limit");
-const region_detection_1 = require("../region-detection");
-const secret_resolver_1 = require("../secret-resolver");
-const security_headers_1 = require("../security-headers");
-const session_manager_1 = require("../session-manager");
-const feature_toggle_schemas_1 = require("../validation/feature-toggle-schemas");
-const validate_request_1 = require("../validation/validate-request");
-const version_1 = require("../version");
-exports.adminRoutes = [
+import { z } from "zod";
+import { createPrisma } from "../../db.js";
+import { addCorsHeaders } from "../../worker.js";
+import { DataRouter } from "../data-router.js";
+import { sharedDatabaseConnectionManager } from "../database-connection-manager.js";
+import { QueryTimeoutPresets, withQueryTimeoutAndRetry, } from "../db-query-helper.js";
+import { DomainReputationService } from "../domain-reputation-service.js";
+import { FeatureToggleService } from "../feature-toggle-service.js";
+import { getLogger } from "../logger.js";
+import { corsMiddleware, csrfMiddleware } from "../middleware.js";
+import { rateLimitAdminFeatureToggleAPI, rateLimitFeatureToggleAPI, } from "../middleware/feature-toggle-rate-limit.js";
+import { detectRegionSync } from "../region-detection.js";
+import { SecurityHeaders } from "../security-headers.js";
+import { SessionManager } from "../session-cookie.js";
+import { FeatureToggleKeySchema, PublicAPIQuerySchema, } from "../validation/feature-toggle-schemas.js";
+import { validateBody, validatePathParam, validateQuery, ValidationError, } from "../validation/validate-request.js";
+import { getAppVersion } from "../version.js";
+export const adminRoutes = [
     // Test-only endpoints (must be before wildcard routes)
     // Test-only endpoint: Create test user (dev environment only, no auth required for tests)
     {
         path: "/api/admin/test/users",
         method: "POST",
         handler: async (request, env) => {
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
             // SECURITY: Only allow in dev/test environments
             // Note: env.ENVIRONMENT falls back to NODE_ENV (which is "production" in Docker),
             // so prefer env.STAGE which is explicitly set by CDK to the deployment stage.
@@ -74,7 +37,7 @@ exports.adminRoutes = [
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                     error: "Forbidden: Test endpoints not available in production",
                 }), { status: 403, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             try {
                 const body = (await request.json());
@@ -97,19 +60,19 @@ exports.adminRoutes = [
                 // 2. Test users are identified by email pattern
                 // 3. Tests need fast user creation without authentication overhead
                 if (!isTestUser && !isCI) {
-                    const sessionManager = new session_manager_1.SessionManager();
-                    const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+                    const sessionManager = new SessionManager();
+                    const sessionSecret = env.SESSION_SECRET;
                     const session = await sessionManager.getSession(request, sessionSecret, env);
                     if (session) {
                         // Use fast query with timeout for role check (non-blocking for test user creation)
-                        const detectedRegion = (0, region_detection_1.detectRegionSync)(request, env);
-                        const user = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(database_connection_manager_1.sharedDatabaseConnectionManager, detectedRegion, env, async (db) => {
+                        const detectedRegion = detectRegionSync(request, env);
+                        const user = await withQueryTimeoutAndRetry(sharedDatabaseConnectionManager, detectedRegion, env, async (db) => {
                             return await db.user.findUnique({
                                 where: { id: session.userId },
                                 select: { role: true },
                             });
                         }, {
-                            ...db_query_helper_1.QueryTimeoutPresets.USER_FACING, // Fast timeout (1s + 1s retry)
+                            ...QueryTimeoutPresets.USER_FACING, // Fast timeout (1s + 1s retry)
                             defaultValue: null, // Return null on timeout (allow test user creation)
                             context: {
                                 operation: "checkUserRoleForTestEndpoint",
@@ -123,7 +86,7 @@ exports.adminRoutes = [
                                 status: 403,
                                 headers: { "content-type": "application/json" },
                             });
-                            return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                            return addCorsHeaders(errorResponse, request, env);
                         }
                     }
                 }
@@ -143,10 +106,18 @@ exports.adminRoutes = [
                 const maxExpectedDbTime = dbTimeoutMs + dbRetryTimeoutMs * dbMaxRetries;
                 const safetyBufferMs = Math.ceil(maxExpectedDbTime * 0.5); // 50% buffer
                 const TEST_USER_CREATION_TIMEOUT_MS = maxExpectedDbTime + safetyBufferMs;
-                const userCreationPromise = data_router_1.DataRouter.createUser({
+                // Signup-metadata (P3): this dev/test-only seam creates users with no
+                // real request context. It gets a `signupMethod` (COGNITO) via the
+                // choke-point helper but NO fabricated IP/UA and no SecurityEvent —
+                // synthetic test accounts must not pollute the signup-cohort signal.
+                const { signupUserData } = await import("../signup-metadata.js");
+                const signupFields = signupUserData({ method: "COGNITO" });
+                const userCreationPromise = DataRouter.createUser({
                     id: userId,
                     email,
                     role,
+                    signupMethod: signupFields.signupMethod,
+                    invitationId: signupFields.invitationId,
                 }, region, env, isTestUser ? undefined : request);
                 const timeoutPromise = new Promise((_, reject) => {
                     setTimeout(() => {
@@ -168,8 +139,8 @@ exports.adminRoutes = [
                     isTestUser,
                 });
                 // Create a session for the test user so tests don't need to know SESSION_SECRET
-                const sessionManager = new session_manager_1.SessionManager();
-                const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+                const sessionManager = new SessionManager();
+                const sessionSecret = env.SESSION_SECRET;
                 const testSession = {
                     userId: createdUser.id,
                     email: createdUser.email,
@@ -192,17 +163,17 @@ exports.adminRoutes = [
                 }), { status: 201, headers: { "content-type": "application/json" } });
                 // Set session cookie on the response
                 response = await sessionManager.setSession(response, testSession, sessionSecret, undefined, env);
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error("[Admin Test] Error creating test user:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                     error: error.message || "Failed to create test user",
                 }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)()], // No CSRF for test endpoints (unauthenticated in CI)
+        middleware: [corsMiddleware()], // No CSRF for test endpoints (unauthenticated in CI)
         description: "Create test user (dev environment only)",
     },
     // Test-only endpoint: Delete test user (dev environment only)
@@ -210,9 +181,9 @@ exports.adminRoutes = [
         path: "/api/admin/test/users/:userId",
         method: "DELETE",
         handler: async (request, env, { pathname }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
             // SECURITY: Only allow in dev/test environments
             // Note: env.ENVIRONMENT falls back to NODE_ENV (which is "production" in Docker),
             // so prefer env.STAGE which is explicitly set by CDK to the deployment stage.
@@ -223,16 +194,16 @@ exports.adminRoutes = [
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                     error: "Forbidden: Test endpoints not available in production",
                 }), { status: 403, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             // SECURITY: In test mode (CI), allow unauthenticated access for test user deletion
             const isCI = env.CI === "true" || env.GITHUB_ACTIONS === "true";
             // Optionally check for SUPER_ADMIN in local dev (but allow unauthenticated in CI)
             if (!isCI) {
-                const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+                const sessionSecret = env.SESSION_SECRET;
                 const session = await sessionManager.getSession(request, sessionSecret, env);
                 if (session) {
-                    const db = (0, db_1.createPrisma)(env);
+                    const db = createPrisma(env);
                     const user = await db.user.findUnique({
                         where: { id: session.userId },
                         select: { role: true },
@@ -241,7 +212,7 @@ exports.adminRoutes = [
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                             error: "Forbidden: Super-admin access required",
                         }), { status: 403, headers: { "content-type": "application/json" } });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
                 }
                 // If no session in local dev, still allow (for test convenience)
@@ -250,18 +221,18 @@ exports.adminRoutes = [
             const userIdMatch = pathname.match(/\/api\/admin\/test\/users\/([^/]+)/);
             if (!userIdMatch) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid user ID" }), { status: 400, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             const userId = userIdMatch[1];
             try {
                 // Delete user via DataRouter (uses API's database connection)
-                const region = (0, region_detection_1.detectRegionSync)(request, env);
-                const dbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
-                await (0, db_query_helper_1.withQueryTimeoutAndRetry)(dbManager, region, env, async (db) => {
-                    const { deleteUserData } = await Promise.resolve().then(() => __importStar(require("../services/user-data-deletion")));
+                const region = detectRegionSync(request, env);
+                const dbManager = sharedDatabaseConnectionManager;
+                await withQueryTimeoutAndRetry(dbManager, region, env, async (db) => {
+                    const { deleteUserData } = await import("../services/user-data-deletion.js");
                     await deleteUserData(db, userId);
                 }, {
-                    ...db_query_helper_1.QueryTimeoutPresets.STANDARD,
+                    ...QueryTimeoutPresets.STANDARD,
                     timeoutMs: 5000, // 5 seconds for cleanup (more time for multiple deletes)
                     retryTimeoutMs: 2000, // 2 seconds for retry
                     maxRetries: 1, // Allow 1 retry for cleanup operations
@@ -270,7 +241,7 @@ exports.adminRoutes = [
                     success: true,
                     message: "Test user deleted successfully",
                 }), { status: 200, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             catch (error) {
                 // Ignore "Record to delete does not exist" errors
@@ -279,7 +250,7 @@ exports.adminRoutes = [
                         success: true,
                         message: "User already deleted or does not exist",
                     }), { status: 200, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                    return addCorsHeaders(response, request, env);
                 }
                 // Ignore foreign key constraint violations - user may have already been deleted
                 // or related records may have been cleaned up by cascade deletes
@@ -287,16 +258,16 @@ exports.adminRoutes = [
                     error.message?.includes("foreign key constraint violated")) {
                     // Try to verify if user still exists
                     try {
-                        const verifyRegion = (0, region_detection_1.detectRegionSync)(request, env);
-                        const verifyDbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
-                        const userExists = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(verifyDbManager, verifyRegion, env, async (db) => {
+                        const verifyRegion = detectRegionSync(request, env);
+                        const verifyDbManager = sharedDatabaseConnectionManager;
+                        const userExists = await withQueryTimeoutAndRetry(verifyDbManager, verifyRegion, env, async (db) => {
                             const user = await db.user.findUnique({
                                 where: { id: userId },
                                 select: { id: true },
                             });
                             return !!user;
                         }, {
-                            ...db_query_helper_1.QueryTimeoutPresets.STANDARD,
+                            ...QueryTimeoutPresets.STANDARD,
                             defaultValue: false, // Assume deleted if query fails
                         });
                         if (!userExists) {
@@ -308,7 +279,7 @@ exports.adminRoutes = [
                                 status: 200,
                                 headers: { "content-type": "application/json" },
                             });
-                            return (0, worker_1.addCorsHeaders)(response, request, env);
+                            return addCorsHeaders(response, request, env);
                         }
                     }
                     catch (verifyError) {
@@ -320,52 +291,52 @@ exports.adminRoutes = [
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                     error: error.message || "Failed to delete test user",
                 }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)()], // No CSRF for test endpoints (unauthenticated in CI)
+        middleware: [corsMiddleware()], // No CSRF for test endpoints (unauthenticated in CI)
         description: "Delete test user (dev environment only)",
     },
     {
         path: "/api/admin/super-admin/*",
         method: "*",
         handler: async (request, env, { pathname }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
             // Get session secret with error handling
             let sessionSecret;
             try {
                 logger.debug("[Admin] Getting session secret...");
-                sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+                sessionSecret = env.SESSION_SECRET;
                 logger.debug(`[Admin] Session secret retrieved, type: ${typeof sessionSecret}, length: ${sessionSecret?.length ?? "N/A"}`);
                 if (!sessionSecret || typeof sessionSecret !== "string") {
-                    logger.error(`[Admin] Invalid session secret from Secrets.getSessionSecret: ${typeof sessionSecret}, ${sessionSecret ? "present but invalid" : "missing"}`);
+                    logger.error(`[Admin] Invalid session secret: ${typeof sessionSecret}, ${sessionSecret ? "present but invalid" : "missing"}`);
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Server configuration error" }), { status: 500, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
                 logger.debug("[Admin] Session secret is valid, length:", sessionSecret.length);
             }
             catch (error) {
                 logger.error("[Admin] Error getting session secret:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Server configuration error" }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             logger.debug("[Admin] Calling getSession with secret length:", sessionSecret.length);
             const session = await sessionManager.getSession(request, sessionSecret, env);
             logger.debug("[Admin] getSession returned:", session ? "session found" : "null (unauthorized)");
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
-            const db = (0, db_1.createPrisma)(env);
+            const db = createPrisma(env);
             const user = await db.user.findUnique({
                 where: { id: session.userId },
                 select: { role: true, email: true },
             });
             if (!user) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: User not found" }), { status: 403, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             const isSuperAdmin = user.role === "SUPER_ADMIN";
             if (pathname === "/api/admin/super-admin/check" &&
@@ -376,31 +347,31 @@ exports.adminRoutes = [
                     isSuperAdmin,
                 });
                 const response = securityHeaders.createSecureResponse(JSON.stringify({ isSuperAdmin }), { status: 200, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             if (!isSuperAdmin) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Super-admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
-            const toggleService = new feature_toggle_service_1.FeatureToggleService(db);
+            const toggleService = new FeatureToggleService(db);
             // Get all feature toggles
             if (pathname === "/api/admin/super-admin/feature-toggles" &&
                 request.method === "GET") {
                 try {
                     // Use standard timeout presets (consistent with other endpoints)
                     // DatabaseConnectionManager handles connection health and stale connection cleanup
-                    const dbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
-                    const region = (0, region_detection_1.detectRegionSync)(request, env);
+                    const dbManager = sharedDatabaseConnectionManager;
+                    const region = detectRegionSync(request, env);
                     // Use STANDARD preset (3s initial + 2s retry = 5s total)
                     // This is consistent with other user-facing endpoints and well below Worker limits
                     // Use defaultValue to return empty array on timeout/error (graceful degradation)
                     let toggles = [];
                     try {
-                        toggles = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(dbManager, region, env, async (client) => {
-                            const service = new feature_toggle_service_1.FeatureToggleService(client);
+                        toggles = await withQueryTimeoutAndRetry(dbManager, region, env, async (client) => {
+                            const service = new FeatureToggleService(client);
                             return await service.getAllToggles();
                         }, {
-                            ...db_query_helper_1.QueryTimeoutPresets.STANDARD, // 1s initial, 0.5s retry (optimized)
+                            ...QueryTimeoutPresets.STANDARD, // 1s initial, 0.5s retry (optimized)
                             defaultValue: [], // Return empty array on timeout/error (graceful degradation)
                             maxRetries: 1, // Only 1 retry to keep total time under 2s
                             context: {
@@ -438,7 +409,7 @@ exports.adminRoutes = [
                             description: toggle.description,
                         })),
                     }), { status: 200, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                    return addCorsHeaders(response, request, env);
                 }
                 catch (error) {
                     logger.error("[SuperAdmin] Error getting all feature toggles:", error);
@@ -525,7 +496,7 @@ exports.adminRoutes = [
                     const response = securityHeaders.createSecureResponse(JSON.stringify({
                         toggles: [],
                     }), { status: 200, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                    return addCorsHeaders(response, request, env);
                 }
             }
             // Create a new feature toggle
@@ -533,7 +504,7 @@ exports.adminRoutes = [
                 request.method === "POST") {
                 try {
                     // Rate limit admin API
-                    const rateLimitResult = await (0, feature_toggle_rate_limit_1.rateLimitAdminFeatureToggleAPI)(request, env, user.email);
+                    const rateLimitResult = await rateLimitAdminFeatureToggleAPI(request, env, user.email);
                     if (!rateLimitResult || !rateLimitResult.allowed) {
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                             error: {
@@ -550,23 +521,58 @@ exports.adminRoutes = [
                                 ...(rateLimitResult?.headers || {}),
                             },
                         });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
-                    // Validate request body
-                    const CreateToggleSchema = zod_1.z.object({
-                        key: feature_toggle_schemas_1.FeatureToggleKeySchema,
-                        enabled: zod_1.z.boolean().default(false),
-                        description: zod_1.z.string().max(1000).optional(),
+                    // Validate request body. P5: an optional `tenantId` makes this a
+                    // tenant-scoped OVERRIDE write instead of a global write.
+                    const CreateToggleSchema = z.object({
+                        key: FeatureToggleKeySchema,
+                        enabled: z.boolean().default(false),
+                        description: z.string().max(1000).optional(),
+                        tenantId: z.string().min(1).max(64).optional(),
                     });
-                    const { key, enabled, description } = (0, validate_request_1.validateBody)(CreateToggleSchema, await request.json());
-                    // Check if toggle already exists
-                    const existing = await toggleService.getToggle(key);
+                    const { key, enabled, description, tenantId } = validateBody(CreateToggleSchema, await request.json());
+                    // P5 authz: tenant-scoped writes require SUPER_ADMIN or the caller's
+                    // own active tenant. This route is already SUPER_ADMIN-gated above;
+                    // the explicit check keeps the authorization boundary fail-closed and
+                    // future-proof if that gate is ever relaxed.
+                    if (tenantId !== undefined) {
+                        const { canWriteTenantToggle } = await import("../feature-toggle-service.js");
+                        const allowed = canWriteTenantToggle({
+                            role: user.role,
+                            callerTenantId: undefined, // cookie-session admins carry no tenant
+                            targetTenantId: tenantId,
+                        });
+                        if (!allowed) {
+                            const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                                error: "Forbidden: cross-tenant toggle write",
+                            }), {
+                                status: 403,
+                                headers: { "content-type": "application/json" },
+                            });
+                            return addCorsHeaders(errorResponse, request, env);
+                        }
+                    }
+                    // Check if toggle already exists (scoped to the same tenant target).
+                    // Keep the global call arity unchanged (no trailing `undefined`) so
+                    // the global path stays byte-identical to pre-P5.
+                    const existing = tenantId === undefined
+                        ? await toggleService.getToggle(key)
+                        : await toggleService.getToggle(key, tenantId);
                     if (existing) {
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Feature toggle already exists" }), { status: 409, headers: { "content-type": "application/json" } });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
-                    // Create the toggle
-                    const toggle = await toggleService.setToggle(key, enabled, user.email, description);
+                    // Create the toggle (global when tenantId is undefined). Preserve the
+                    // 5-arg global call shape; only the tenant path passes the 6th arg.
+                    const auditCtx = {
+                        userId: session.userId,
+                        env,
+                        region: detectRegionSync(request, env),
+                    };
+                    const toggle = tenantId === undefined
+                        ? await toggleService.setToggle(key, enabled, user.email, description, auditCtx)
+                        : await toggleService.setToggle(key, enabled, user.email, description, auditCtx, tenantId);
                     const responseHeaders = {
                         "content-type": "application/json",
                         ...rateLimitResult.headers,
@@ -581,16 +587,16 @@ exports.adminRoutes = [
                             description: description,
                         },
                     }), { status: 201, headers: responseHeaders });
-                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                    return addCorsHeaders(response, request, env);
                 }
                 catch (error) {
-                    if (error instanceof validate_request_1.ValidationError) {
+                    if (error instanceof ValidationError) {
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: error.message }), { status: 400, headers: { "content-type": "application/json" } });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
                     logger.error("[SuperAdmin] Error creating feature toggle:", error);
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to create feature toggle" }), { status: 500, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
             }
             if (pathname === "/api/admin/super-admin/settings" &&
@@ -626,17 +632,17 @@ exports.adminRoutes = [
                         },
                         systemInfo: {
                             environment: env.ENVIRONMENT || "unknown",
-                            version: (0, version_1.getAppVersion)(env),
+                            version: getAppVersion(env),
                             superAdminCount,
                         },
                     };
                     const response = securityHeaders.createSecureResponse(JSON.stringify(settings), { status: 200, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                    return addCorsHeaders(response, request, env);
                 }
                 catch (error) {
                     logger.error("[SuperAdmin] Error getting settings:", error);
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to get settings" }), { status: 500, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
             }
             const toggleUpdateMatch = pathname.match(/^\/api\/admin\/super-admin\/feature-toggles\/(.+)$/);
@@ -649,9 +655,9 @@ exports.adminRoutes = [
                     // Ensure user.email is defined and is a string for rate limiting
                     if (!user.email || typeof user.email !== "string") {
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "User email not found or invalid" }), { status: 500, headers: { "content-type": "application/json" } });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
-                    const rateLimitResult = await (0, feature_toggle_rate_limit_1.rateLimitAdminFeatureToggleAPI)(request, env, user.email);
+                    const rateLimitResult = await rateLimitAdminFeatureToggleAPI(request, env, user.email);
                     if (!rateLimitResult || !rateLimitResult.allowed) {
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                             error: {
@@ -668,7 +674,7 @@ exports.adminRoutes = [
                                 ...(rateLimitResult?.headers || {}),
                             },
                         });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
                     // Validate path parameter (toggle key)
                     const pathParam = toggleUpdateMatch?.[1];
@@ -676,19 +682,19 @@ exports.adminRoutes = [
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                             error: "Invalid path parameter: toggle key is required",
                         }), { status: 400, headers: { "content-type": "application/json" } });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
                     let toggleKey;
                     try {
-                        toggleKey = (0, validate_request_1.validatePathParam)(feature_toggle_schemas_1.FeatureToggleKeySchema, pathParam);
+                        toggleKey = validatePathParam(FeatureToggleKeySchema, pathParam);
                     }
                     catch (error) {
-                        if (error instanceof validate_request_1.ValidationError) {
+                        if (error instanceof ValidationError) {
                             const errorResponse = securityHeaders.createSecureResponse(JSON.stringify(error.toResponse()), {
                                 status: 400,
                                 headers: { "content-type": "application/json" },
                             });
-                            return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                            return addCorsHeaders(errorResponse, request, env);
                         }
                         throw error;
                     }
@@ -699,39 +705,40 @@ exports.adminRoutes = [
                     }
                     catch (error) {
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid JSON in request body" }), { status: 400, headers: { "content-type": "application/json" } });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
                     // Ensure body is an object
                     if (!body || typeof body !== "object" || Array.isArray(body)) {
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Request body must be an object" }), { status: 400, headers: { "content-type": "application/json" } });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
-                    const UpdateToggleEnabledSchema = zod_1.z.object({
-                        enabled: zod_1.z.boolean({
-                            required_error: "enabled is required",
-                            invalid_type_error: "enabled must be a boolean",
+                    const UpdateToggleEnabledSchema = z.object({
+                        enabled: z.boolean({
+                            error: (issue) => issue.input === undefined
+                                ? "enabled is required"
+                                : "enabled must be a boolean",
                         }),
                     });
                     let enabled;
                     try {
-                        const validated = (0, validate_request_1.validateBody)(UpdateToggleEnabledSchema, body);
+                        const validated = validateBody(UpdateToggleEnabledSchema, body);
                         enabled = validated.enabled;
                     }
                     catch (error) {
-                        if (error instanceof validate_request_1.ValidationError) {
+                        if (error instanceof ValidationError) {
                             const errorResponse = securityHeaders.createSecureResponse(JSON.stringify(error.toResponse()), {
                                 status: 400,
                                 headers: { "content-type": "application/json" },
                             });
-                            return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                            return addCorsHeaders(errorResponse, request, env);
                         }
                         // Log unexpected errors for debugging
                         logger.error("[Admin] Unexpected error in body validation:", error);
                         throw error;
                     }
                     // Use improved database connection manager with aggressive timeout handling
-                    const dbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
-                    const region = (0, region_detection_1.detectRegionSync)(request, env);
+                    const dbManager = sharedDatabaseConnectionManager;
+                    const region = detectRegionSync(request, env);
                     // Top-level timeout wrapper to ensure we never hang for more than 3 seconds
                     // This is well below Cloudflare's 30-second limit and ensures we always return a response
                     // Aggressive timeout to fail fast if database is slow
@@ -749,14 +756,18 @@ exports.adminRoutes = [
                             try {
                                 return await dbManager.executeWithRetry(region, env, async (client) => {
                                     // Create a temporary service instance with the client from timeout helper
-                                    const service = new feature_toggle_service_1.FeatureToggleService(client);
+                                    const service = new FeatureToggleService(client);
                                     // Ensure user.email is still defined (double-check before DB operation)
                                     if (!user.email || typeof user.email !== "string") {
                                         throw new Error("User email is required for toggle update");
                                     }
                                     return await service.setToggle(toggleKey, enabled, user.email, toggleKey === "global_public_posting_enabled"
                                         ? "Globally enable public posting for all users"
-                                        : undefined);
+                                        : undefined, {
+                                        userId: session.userId,
+                                        env,
+                                        region,
+                                    });
                                 }, {
                                     timeoutMs: 1000, // 1 second initial timeout - fail fast
                                     retryTimeoutMs: 500, // 0.5 seconds retry timeout - very fast retry
@@ -799,7 +810,7 @@ exports.adminRoutes = [
                             error: "Database operation timed out. Please try again in a moment.",
                             details: "The database connection is experiencing issues. This usually resolves quickly.",
                         }), { status: 503, headers: { "content-type": "application/json" } });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
                     // Add rate limit headers to successful response
                     const responseHeaders = {
@@ -815,20 +826,20 @@ exports.adminRoutes = [
                             changedBy: toggle.changedBy,
                         },
                     }), { status: 200, headers: responseHeaders });
-                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                    return addCorsHeaders(response, request, env);
                 }
                 catch (error) {
                     // Handle validation errors
-                    if (error instanceof validate_request_1.ValidationError) {
+                    if (error instanceof ValidationError) {
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify(error.toResponse()), {
                             status: error.getStatusCode(),
                             headers: { "content-type": "application/json" },
                         });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
                     logger.error("[SuperAdmin] Error updating feature toggle:", error);
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to update feature toggle" }), { status: 500, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
             }
             if (pathname === "/api/admin/super-admin/signup-settings" &&
@@ -841,11 +852,15 @@ exports.adminRoutes = [
                         const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                             error: 'Invalid request: mode must be "open", "invitation_only", or "disabled"',
                         }), { status: 400, headers: { "content-type": "application/json" } });
-                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        return addCorsHeaders(errorResponse, request, env);
                     }
                     const enabled = mode !== "disabled";
                     const description = `user_signup_mode:${mode}`;
-                    const toggle = await toggleService.setToggle("user_signup_mode", enabled, user.email, description);
+                    const toggle = await toggleService.setToggle("user_signup_mode", enabled, user.email, description, {
+                        userId: session.userId,
+                        env,
+                        region: detectRegionSync(request, env),
+                    });
                     const response = securityHeaders.createSecureResponse(JSON.stringify({
                         success: true,
                         signupSettings: {
@@ -854,34 +869,34 @@ exports.adminRoutes = [
                             changedBy: toggle.changedBy,
                         },
                     }), { status: 200, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                    return addCorsHeaders(response, request, env);
                 }
                 catch (error) {
                     logger.error("[SuperAdmin] Error updating sign-up settings:", error);
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to update sign-up settings" }), { status: 500, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
             }
             const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Not found" }), { status: 404, headers: { "content-type": "application/json" } });
-            return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            return addCorsHeaders(errorResponse, request, env);
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Super-admin routes",
     },
     {
         path: /^\/api\/feature-toggles\/(.+)$/,
         method: "GET",
         handler: async (request, env, { pathname }) => {
-            const logger = logger_1.Logger.getInstance(env);
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = getLogger();
+            const securityHeaders = new SecurityHeaders(env);
             const toggleKeyMatch = pathname.match(/^\/api\/feature-toggles\/(.+)$/);
             if (!toggleKeyMatch) {
                 const response = securityHeaders.createSecureResponse(JSON.stringify({ enabled: false }), { status: 200, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             try {
                 // Rate limit public API (100 requests/minute per IP)
-                const rateLimitResult = await (0, feature_toggle_rate_limit_1.rateLimitFeatureToggleAPI)(request, env);
+                const rateLimitResult = await rateLimitFeatureToggleAPI(request, env);
                 if (!rateLimitResult || !rateLimitResult.allowed) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                         error: {
@@ -898,19 +913,19 @@ exports.adminRoutes = [
                             ...(rateLimitResult?.headers || {}),
                         },
                     });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
                 // Validate path parameter (toggle key)
-                const toggleKey = (0, validate_request_1.validatePathParam)(feature_toggle_schemas_1.FeatureToggleKeySchema, toggleKeyMatch[1]);
+                const toggleKey = validatePathParam(FeatureToggleKeySchema, toggleKeyMatch[1]);
                 // Validate query parameters
                 const url = new URL(request.url);
                 const queryParams = {};
                 url.searchParams.forEach((value, key) => {
                     queryParams[key] = value;
                 });
-                const validatedQuery = (0, validate_request_1.validateQuery)(feature_toggle_schemas_1.PublicAPIQuerySchema, queryParams);
-                const db = (0, db_1.createPrisma)(env);
-                const toggleService = new feature_toggle_service_1.FeatureToggleService(db);
+                const validatedQuery = validateQuery(PublicAPIQuerySchema, queryParams);
+                const db = createPrisma(env);
+                const toggleService = new FeatureToggleService(db);
                 const toggle = await toggleService.getToggle(toggleKey);
                 if (!toggle) {
                     // Add rate limit headers even for not found responses
@@ -919,7 +934,7 @@ exports.adminRoutes = [
                         ...rateLimitResult.headers,
                     };
                     const response = securityHeaders.createSecureResponse(JSON.stringify({ key: toggleKey, enabled: false }), { status: 200, headers: responseHeaders });
-                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                    return addCorsHeaders(response, request, env);
                 }
                 // Add rate limit headers to successful response
                 const responseHeaders = {
@@ -932,7 +947,7 @@ exports.adminRoutes = [
                     lastChanged: toggle.lastChanged?.toISOString(),
                     changedBy: toggle.changedBy,
                 }), { status: 200, headers: responseHeaders });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error(`[Admin] GET handler error: ${error instanceof Error ? error.message : String(error)}`, {
@@ -940,46 +955,46 @@ exports.adminRoutes = [
                     stack: error instanceof Error ? error.stack : "No stack",
                 });
                 // Handle validation errors
-                if (error instanceof validate_request_1.ValidationError) {
+                if (error instanceof ValidationError) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify(error.toResponse()), {
                         status: error.getStatusCode(),
                         headers: { "content-type": "application/json" },
                     });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
                 // For other errors, return 500
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                     error: "Internal server error",
                     message: error instanceof Error ? error.message : "Unknown error",
                 }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)()],
+        middleware: [corsMiddleware()],
         description: "Get feature toggle status",
     },
     {
         path: "/api/roles/metadata",
         method: "GET",
         handler: async (request, env) => {
-            const logger = logger_1.Logger.getInstance(env);
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = getLogger();
+            const securityHeaders = new SecurityHeaders(env);
             try {
-                const db = (0, db_1.createPrisma)(env);
+                const db = createPrisma(env);
                 const roleMetadata = await db.roleMetadata.findMany({
                     where: { isActive: true },
                     orderBy: { role: "asc" },
                 });
                 const response = securityHeaders.createSecureResponse(JSON.stringify({ roles: roleMetadata }), { status: 200, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error("Error fetching role metadata:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to fetch role metadata" }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)()],
+        middleware: [corsMiddleware()],
         description: "Get role metadata",
     },
     // Domain Management Endpoints
@@ -987,25 +1002,25 @@ exports.adminRoutes = [
         path: "/api/admin/domains",
         method: "GET",
         handler: async (request, env, { url, requestContext }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
             // Check authentication and authorization
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             // Check if user is admin
             const region = requestContext?.region || env.DEFAULT_REGION || "EU";
-            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const db = DataRouter.getDatabaseForRegion(region, env);
             const user = await db.user.findUnique({
                 where: { id: session.userId },
                 select: { role: true },
             });
             if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             try {
                 // Parse query parameters
@@ -1060,142 +1075,142 @@ exports.adminRoutes = [
                     hasMore,
                     nextCursor,
                 }), { status: 200, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error("[Admin] Error fetching domains:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to fetch domains" }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)()],
+        middleware: [corsMiddleware()],
         description: "List domains with reputation",
     },
     {
         path: /^\/api\/admin\/domains\/([^/]+)\/block$/,
         method: "POST",
         handler: async (request, env, { pathname, requestContext }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
             // Check authentication and authorization
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             // Check if user is admin
             const region = requestContext?.region || env.DEFAULT_REGION || "EU";
-            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const db = DataRouter.getDatabaseForRegion(region, env);
             const user = await db.user.findUnique({
                 where: { id: session.userId },
                 select: { role: true },
             });
             if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             try {
                 // Extract domain from path
                 const match = pathname.match(/^\/api\/admin\/domains\/([^/]+)\/block$/);
                 if (!match) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid URL format" }), { status: 400, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
                 const domain = decodeURIComponent(match[1]);
                 // Block domain
-                const reputationService = new domain_reputation_service_1.DomainReputationService(env);
+                const reputationService = new DomainReputationService(env);
                 await reputationService.blockDomain(domain, region, env);
                 logger.info(`[Admin] Domain blocked: ${domain} by user ${session.userId}`);
                 const response = securityHeaders.createSecureResponse(JSON.stringify({
                     success: true,
                     message: `Domain ${domain} has been blocked`,
                 }), { status: 200, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error("[Admin] Error blocking domain:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to block domain" }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Block a domain",
     },
     {
         path: /^\/api\/admin\/domains\/([^/]+)\/unblock$/,
         method: "POST",
         handler: async (request, env, { pathname, requestContext }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
             // Check authentication and authorization
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             // Check if user is admin
             const region = requestContext?.region || env.DEFAULT_REGION || "EU";
-            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const db = DataRouter.getDatabaseForRegion(region, env);
             const user = await db.user.findUnique({
                 where: { id: session.userId },
                 select: { role: true },
             });
             if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             try {
                 // Extract domain from path
                 const match = pathname.match(/^\/api\/admin\/domains\/([^/]+)\/unblock$/);
                 if (!match) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid URL format" }), { status: 400, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
                 const domain = decodeURIComponent(match[1]);
                 // Unblock domain
-                const reputationService = new domain_reputation_service_1.DomainReputationService(env);
+                const reputationService = new DomainReputationService(env);
                 await reputationService.unblockDomain(domain, region, env);
                 logger.info(`[Admin] Domain unblocked: ${domain} by user ${session.userId}`);
                 const response = securityHeaders.createSecureResponse(JSON.stringify({
                     success: true,
                     message: `Domain ${domain} has been unblocked`,
                 }), { status: 200, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error("[Admin] Error unblocking domain:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to unblock domain" }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Unblock a domain",
     },
     {
         path: "/api/admin/reports",
         method: "GET",
         handler: async (request, env, { url, requestContext }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
             // Check authentication and authorization
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             // Check if user is admin
             const region = requestContext?.region || env.DEFAULT_REGION || "EU";
-            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const db = DataRouter.getDatabaseForRegion(region, env);
             const user = await db.user.findUnique({
                 where: { id: session.userId },
                 select: { role: true },
             });
             if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             try {
                 // Parse query parameters
@@ -1206,8 +1221,9 @@ exports.adminRoutes = [
                 const domain = queryParams.get("domain") || undefined;
                 const sortBy = queryParams.get("sortBy") || "createdAt";
                 const sortOrder = queryParams.get("sortOrder") || "desc";
-                // Build query
-                const where = {};
+                // Build query (P4: link reports now live in the generalized Report
+                // model — scope to reportType LINK so account reports never leak here).
+                const where = { reportType: "LINK" };
                 if (cursor) {
                     where.id = { gt: cursor };
                 }
@@ -1228,12 +1244,12 @@ exports.adminRoutes = [
                     orderBy.createdAt = "desc"; // Default
                 }
                 // Get reports with pagination
-                const reports = await db.linkReport.findMany({
+                const reports = await db.report.findMany({
                     where,
                     take: limit + 1,
                     orderBy,
                     include: {
-                        user: {
+                        reporter: {
                             select: {
                                 id: true,
                                 email: true,
@@ -1245,11 +1261,12 @@ exports.adminRoutes = [
                 const result = hasMore ? reports.slice(0, limit) : reports;
                 const nextCursor = hasMore ? result[result.length - 1].id : undefined;
                 const response = securityHeaders.createSecureResponse(JSON.stringify({
+                    // Response shape preserved (P4): resourceId is the reported url.
                     reports: result.map((r) => ({
                         id: r.id,
-                        userId: r.userId,
-                        userEmail: r.user.email,
-                        linkUrl: r.linkUrl,
+                        userId: r.reporterUserId,
+                        userEmail: r.reporter.email,
+                        linkUrl: r.resourceId,
                         domain: r.domain,
                         reason: r.reason,
                         status: r.status,
@@ -1258,47 +1275,47 @@ exports.adminRoutes = [
                     hasMore,
                     nextCursor,
                 }), { status: 200, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error("[Admin] Error fetching reports:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to fetch reports" }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)()],
+        middleware: [corsMiddleware()],
         description: "List link reports",
     },
     {
         path: /^\/api\/admin\/reports\/([^/]+)\/review$/,
         method: "POST",
         handler: async (request, env, { pathname, requestContext }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
             // Check authentication and authorization
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             // Check if user is admin
             const region = requestContext?.region || env.DEFAULT_REGION || "EU";
-            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const db = DataRouter.getDatabaseForRegion(region, env);
             const user = await db.user.findUnique({
                 where: { id: session.userId },
                 select: { role: true },
             });
             if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             try {
                 // Extract reportId from path
                 const match = pathname.match(/^\/api\/admin\/reports\/([^/]+)\/review$/);
                 if (!match) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid URL format" }), { status: 400, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
                 const reportId = match[1];
                 // Parse request body
@@ -1308,23 +1325,27 @@ exports.adminRoutes = [
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                         error: "Invalid action. Must be approve, reject, or dismiss",
                     }), { status: 400, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
-                // Get report
-                const report = await db.linkReport.findUnique({
-                    where: { id: reportId },
+                // Get report (P4: Report model, scoped to LINK so only link reports
+                // are reviewable via this moderator route).
+                const report = await db.report.findFirst({
+                    where: { id: reportId, reportType: "LINK" },
                 });
                 if (!report) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Report not found" }), { status: 404, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
                 // Update report status
                 let newStatus;
                 if (body.action === "approve") {
                     newStatus = "approved";
-                    // If approved, update domain reputation (negative signal)
-                    const reputationService = new domain_reputation_service_1.DomainReputationService(env);
-                    await reputationService.updateReputation(report.domain, "user_report", region, env);
+                    // If approved, update domain reputation (negative signal). domain is
+                    // nullable on Report; LINK reports always carry it, but guard anyway.
+                    if (report.domain) {
+                        const reputationService = new DomainReputationService(env);
+                        await reputationService.updateReputation(report.domain, "user_report", region, env);
+                    }
                 }
                 else if (body.action === "reject") {
                     newStatus = "rejected";
@@ -1332,7 +1353,7 @@ exports.adminRoutes = [
                 else {
                     newStatus = "dismissed";
                 }
-                const updatedReport = await db.linkReport.update({
+                const updatedReport = await db.report.update({
                     where: { id: reportId },
                     data: {
                         status: newStatus,
@@ -1346,40 +1367,40 @@ exports.adminRoutes = [
                         status: updatedReport.status,
                     },
                 }), { status: 200, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error("[Admin] Error reviewing report:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to review report" }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Review a link report",
     },
     {
         path: "/api/admin/domains/bulk",
         method: "POST",
         handler: async (request, env, { requestContext }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
             // Check authentication and authorization
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             // Check if user is admin
             const region = requestContext?.region || env.DEFAULT_REGION || "EU";
-            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const db = DataRouter.getDatabaseForRegion(region, env);
             const user = await db.user.findUnique({
                 where: { id: session.userId },
                 select: { role: true },
             });
             if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
             try {
                 // Parse request body
@@ -1389,18 +1410,18 @@ exports.adminRoutes = [
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
                         error: "Invalid action. Must be block, unblock, or allowlist",
                     }), { status: 400, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
                 if (!Array.isArray(body.domains) || body.domains.length === 0) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "domains must be a non-empty array" }), { status: 400, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
                 // Limit bulk operations to prevent abuse
                 if (body.domains.length > 100) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Maximum 100 domains per bulk operation" }), { status: 400, headers: { "content-type": "application/json" } });
-                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    return addCorsHeaders(errorResponse, request, env);
                 }
-                const reputationService = new domain_reputation_service_1.DomainReputationService(env);
+                const reputationService = new DomainReputationService(env);
                 const results = [];
                 // Process each domain
                 for (const domain of body.domains) {
@@ -1435,15 +1456,15 @@ exports.adminRoutes = [
                     failed: body.domains.length - successCount,
                     results,
                 }), { status: 200, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(response, request, env);
+                return addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error("[Admin] Error performing bulk operation:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to perform bulk operation" }), { status: 500, headers: { "content-type": "application/json" } });
-                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                return addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Bulk domain operations (block/unblock/allowlist)",
     },
 ];