@de-otio/trellis 0.7.0 → 0.9.0

package/dist/lib/routes/entities.js

@@ -1,44 +1,40 @@
-"use strict";
 /**
  * Entities Routes
  *
  * Replaces dogs routes for white-label support.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.entitiesRoutes = void 0;
-const cors_handler_1 = require("../cors-handler");
-const data_router_1 = require("../data-router");
-const database_wrapper_helper_1 = require("../database-wrapper-helper");
-const entity_handler_1 = require("../entity-handler");
-const logger_1 = require("../logger");
-const middleware_1 = require("../middleware");
-const rate_limit_1 = require("../rate-limit");
-const request_context_1 = require("../request-context");
-const secret_resolver_1 = require("../secret-resolver");
-const security_headers_1 = require("../security-headers");
-const session_manager_1 = require("../session-manager");
-const taxonomy_handler_1 = require("../taxonomy-handler");
-const taxonomy_handler_factory_1 = require("../taxonomy-handler-factory");
-const auth_middleware_1 = require("../auth/auth-middleware");
-const validation_1 = require("../validation");
-const validate_request_1 = require("../validation/validate-request");
-exports.entitiesRoutes = [
+import { CorsHandler } from "../cors-handler.js";
+import { DataRouter } from "../data-router.js";
+import { getWrappedDatabase } from "../database-wrapper-helper.js";
+import { EntityHandler } from "../entity-handler.js";
+import { getLogger } from "../logger.js";
+import { corsMiddleware, csrfMiddleware } from "../middleware.js";
+import { RateLimiter } from "../rate-limit.js";
+import { createRequestContext } from "../request-context.js";
+import { SecurityHeaders } from "../security-headers.js";
+import { SessionManager } from "../session-cookie.js";
+import { TaxonomyHandler } from "../taxonomy-handler.js";
+import { createTaxonomyHandler } from "../taxonomy-handler-factory.js";
+import { authMiddleware } from "../auth/auth-middleware.js";
+import { Validator } from "../validation.js";
+import { ValidationError } from "../validation/validate-request.js";
+export const entitiesRoutes = [
     {
         path: "/api/entities",
         method: "GET",
         handler: async (request, env) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
-            const validator = new validation_1.Validator();
-            const entityHandler = new entity_handler_1.EntityHandler();
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const validator = new Validator();
+            const entityHandler = new EntityHandler();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
             try {
-                const requestContext = await (0, request_context_1.createRequestContext)(request, env);
+                const requestContext = await createRequestContext(request, env);
                 const response = await entityHandler.listEntityProfiles(session, env, request, requestContext);
                 return securityHeaders.addSecurityHeaders(response);
             }
@@ -46,26 +42,26 @@ exports.entitiesRoutes = [
                 logger.error("Error listing entities:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
                 // Ensure CORS headers are added to error responses
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)()],
+        middleware: [corsMiddleware()],
         description: "List entity profiles",
     },
     {
         path: "/api/entities",
         method: "POST",
         handler: async (request, env) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
-            const rateLimiter = new rate_limit_1.RateLimiter();
-            const validator = new validation_1.Validator();
-            const entityHandler = new entity_handler_1.EntityHandler();
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const rateLimiter = new RateLimiter();
+            const validator = new Validator();
+            const entityHandler = new EntityHandler();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
             const rateLimitResponse = await rateLimiter.applyRateLimitKV(env, request, "/api/entities", 25, 60, session.userId);
             if (rateLimitResponse) {
@@ -85,35 +81,35 @@ exports.entitiesRoutes = [
             catch (error) {
                 logger.error("Error creating entity:", error);
                 // Handle validation errors with proper status code (400)
-                if (error instanceof validate_request_1.ValidationError) {
+                if (error instanceof ValidationError) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify(error.toResponse()), {
                         status: error.getStatusCode(),
                         headers: { "content-type": "application/json" },
                     });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 // For other errors, return 500
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
                 // Ensure CORS headers are added to error responses
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Create entity profile",
     },
     {
         path: /^\/api\/entities\/([^/]+)$/,
         method: "GET",
         handler: async (request, env, { pathname }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
-            const validator = new validation_1.Validator();
-            const entityHandler = new entity_handler_1.EntityHandler();
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const validator = new Validator();
+            const entityHandler = new EntityHandler();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
             const entityId = pathname.split("/api/entities/")[1];
             try {
@@ -124,25 +120,25 @@ exports.entitiesRoutes = [
                 logger.error("Error getting entity:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
                 // Ensure CORS headers are added to error responses
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)()],
+        middleware: [corsMiddleware()],
         description: "Get entity profile",
     },
     {
         path: /^\/api\/entities\/([^/]+)$/,
         method: "PUT",
         handler: async (request, env, { pathname }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
-            const validator = new validation_1.Validator();
-            const entityHandler = new entity_handler_1.EntityHandler();
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const validator = new Validator();
+            const entityHandler = new EntityHandler();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
             const entityId = pathname.split("/api/entities/")[1];
             try {
@@ -152,25 +148,25 @@ exports.entitiesRoutes = [
             catch (error) {
                 logger.error("Error updating entity:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Update entity profile",
     },
     {
         path: /^\/api\/entities\/([^/]+)$/,
         method: "PATCH",
         handler: async (request, env, { pathname }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
-            const validator = new validation_1.Validator();
-            const entityHandler = new entity_handler_1.EntityHandler();
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const validator = new Validator();
+            const entityHandler = new EntityHandler();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
             const entityId = pathname.split("/api/entities/")[1];
             try {
@@ -180,25 +176,25 @@ exports.entitiesRoutes = [
             catch (error) {
                 logger.error("Error updating entity:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Update entity profile (partial)",
     },
     {
         path: /^\/api\/entities\/([^/]+)$/,
         method: "DELETE",
         handler: async (request, env, { pathname }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
-            const validator = new validation_1.Validator();
-            const entityHandler = new entity_handler_1.EntityHandler();
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const validator = new Validator();
+            const entityHandler = new EntityHandler();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
             const entityId = pathname.split("/api/entities/")[1];
             try {
@@ -208,10 +204,10 @@ exports.entitiesRoutes = [
             catch (error) {
                 logger.error("Error deleting entity:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Delete entity profile",
     },
     // Entity Taxonomy Tags
@@ -219,15 +215,15 @@ exports.entitiesRoutes = [
         path: /^\/api\/entities\/([^/]+)\/taxonomy-tags$/,
         method: "POST",
         handler: async (request, env, { pathname }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
-            const rateLimiter = new rate_limit_1.RateLimiter();
-            const validator = new validation_1.Validator();
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const rateLimiter = new RateLimiter();
+            const validator = new Validator();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
             // Apply rate limiting: 100 tag operations per hour per user
             const rateLimitResponse = await rateLimiter.applyRateLimitKV(env, request, "/entities/:entityId/taxonomy-tags", 100, 3600, session.userId);
@@ -239,16 +235,16 @@ exports.entitiesRoutes = [
                     .split("/api/entities/")[1]
                     .split("/taxonomy-tags")[0];
                 // Get tenant ID from authenticated JWT
-                const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+                const auth = await authMiddleware(request, env);
                 if (!auth || !auth.activeTenantId) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 const tenantId = auth.activeTenantId;
                 // Get region and database
-                const requestContext = await (0, request_context_1.createRequestContext)(request, env);
+                const requestContext = await createRequestContext(request, env);
                 const region = requestContext.region || "US";
-                const db = data_router_1.DataRouter.getDatabaseForRegion(region, env, request, session.userId);
+                const db = DataRouter.getDatabaseForRegion(region, env, request, session.userId);
                 // Verify entity exists in caller's tenant and user owns it
                 const entity = await db.entity.findFirst({
                     where: { id: entityId, tenantId },
@@ -256,11 +252,11 @@ exports.entitiesRoutes = [
                 });
                 if (!entity) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Entity not found" }), { status: 404, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 if (!entity.owners?.some((o) => o.userId === session.userId)) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden" }), { status: 403, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 // Check request body size (max 10KB for tag operations)
                 const contentLength = request.headers.get("content-length");
@@ -269,13 +265,13 @@ exports.entitiesRoutes = [
                         error: "Request body too large",
                         message: "Maximum request body size is 10KB",
                     }), { status: 413, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 // Parse request body
                 const body = (await request.json());
                 if (!body.taxonIds || !Array.isArray(body.taxonIds)) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "taxonIds array is required" }), { status: 400, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 // Validate taxon IDs format
                 const taxonIdPattern = /^[a-z-]+:[a-z-]+:[a-z-]+$/;
@@ -285,11 +281,11 @@ exports.entitiesRoutes = [
                         error: "Invalid taxon ID format",
                         invalidTaxonIds,
                     }), { status: 400, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 // Get database and taxonomy handler
-                const wrappedDb = (0, database_wrapper_helper_1.getWrappedDatabase)(region, env, request);
-                const taxonomyHandler = new taxonomy_handler_1.TaxonomyHandler(wrappedDb, tenantId, env.TAXONOMY_CACHE_KV);
+                const wrappedDb = getWrappedDatabase(region, env, request);
+                const taxonomyHandler = new TaxonomyHandler(wrappedDb, tenantId, env.TAXONOMY_CACHE_KV);
                 // Add taxonomy tags
                 await taxonomyHandler.addEntityTaxonomyTags(entityId, body.taxonIds);
                 // Get updated tags
@@ -301,30 +297,30 @@ exports.entitiesRoutes = [
                         description: t.description,
                     })),
                 }), { status: 200, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(response, request, env);
+                return await CorsHandler.addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error("Error adding taxonomy tags to entity:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Add taxonomy tags to entity",
     },
     {
         path: /^\/api\/entities\/([^/]+)\/taxonomy-tags$/,
         method: "DELETE",
         handler: async (request, env, { pathname }) => {
-            const sessionManager = new session_manager_1.SessionManager();
-            const securityHeaders = new security_headers_1.SecurityHeaders(env);
-            const logger = logger_1.Logger.getInstance(env);
-            const rateLimiter = new rate_limit_1.RateLimiter();
-            const validator = new validation_1.Validator();
-            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const rateLimiter = new RateLimiter();
+            const validator = new Validator();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
             if (!session) {
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
             // Apply rate limiting
             const rateLimitResponse = await rateLimiter.applyRateLimitKV(env, request, "/entities/:entityId/taxonomy-tags", 100, 3600, session.userId);
@@ -336,16 +332,16 @@ exports.entitiesRoutes = [
                     .split("/api/entities/")[1]
                     .split("/taxonomy-tags")[0];
                 // Get tenant ID from authenticated JWT
-                const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+                const auth = await authMiddleware(request, env);
                 if (!auth || !auth.activeTenantId) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 const tenantId = auth.activeTenantId;
                 // Get region and database
-                const requestContext = await (0, request_context_1.createRequestContext)(request, env);
+                const requestContext = await createRequestContext(request, env);
                 const region = requestContext.region || "US";
-                const db = data_router_1.DataRouter.getDatabaseForRegion(region, env, request, session.userId);
+                const db = DataRouter.getDatabaseForRegion(region, env, request, session.userId);
                 // Verify entity exists in caller's tenant and user owns it
                 const entity = await db.entity.findFirst({
                     where: { id: entityId, tenantId },
@@ -353,11 +349,11 @@ exports.entitiesRoutes = [
                 });
                 if (!entity) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Entity not found" }), { status: 404, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 if (!entity.owners?.some((o) => o.userId === session.userId)) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden" }), { status: 403, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 // Check request body size (max 10KB for tag operations)
                 const contentLength = request.headers.get("content-length");
@@ -366,29 +362,29 @@ exports.entitiesRoutes = [
                         error: "Request body too large",
                         message: "Maximum request body size is 10KB",
                     }), { status: 413, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 // Parse request body
                 const body = (await request.json());
                 if (!body.taxonIds || !Array.isArray(body.taxonIds)) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "taxonIds array is required" }), { status: 400, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 // Get database and taxonomy handler
-                const wrappedDb = (0, database_wrapper_helper_1.getWrappedDatabase)(region, env, request);
-                const taxonomyHandler = new taxonomy_handler_1.TaxonomyHandler(wrappedDb, tenantId, env.TAXONOMY_CACHE_KV);
+                const wrappedDb = getWrappedDatabase(region, env, request);
+                const taxonomyHandler = new TaxonomyHandler(wrappedDb, tenantId, env.TAXONOMY_CACHE_KV);
                 // Remove taxonomy tags
                 await taxonomyHandler.removeEntityTaxonomyTags(entityId, body.taxonIds);
                 const response = securityHeaders.createSecureResponse(JSON.stringify({ success: true }), { status: 200, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(response, request, env);
+                return await CorsHandler.addCorsHeaders(response, request, env);
             }
             catch (error) {
                 logger.error("Error removing taxonomy tags from entity:", error);
                 const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                return await CorsHandler.addCorsHeaders(errorResponse, request, env);
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        middleware: [corsMiddleware(), csrfMiddleware()],
         description: "Remove taxonomy tags from entity",
     },
     {
@@ -396,26 +392,26 @@ exports.entitiesRoutes = [
         method: "GET",
         handler: async (request, env, { pathname }) => {
             try {
-                const sessionManager = new session_manager_1.SessionManager();
-                const securityHeaders = new security_headers_1.SecurityHeaders(env);
-                const logger = logger_1.Logger.getInstance(env);
-                const validator = new validation_1.Validator();
-                const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+                const sessionManager = new SessionManager();
+                const securityHeaders = new SecurityHeaders(env);
+                const logger = getLogger();
+                const validator = new Validator();
+                const sessionSecret = env.SESSION_SECRET;
                 const session = await sessionManager.getSession(request, sessionSecret, env);
                 // Tenant-scoped resource — require auth.
-                const auth = await (0, auth_middleware_1.authMiddleware)(request, env);
+                const auth = await authMiddleware(request, env);
                 if (!auth || !auth.activeTenantId) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 const tenantId = auth.activeTenantId;
                 const entityId = pathname
                     .split("/api/entities/")[1]
                     .split("/taxonomy-tags")[0];
                 // Get region and database
-                const requestContext = await (0, request_context_1.createRequestContext)(request, env);
+                const requestContext = await createRequestContext(request, env);
                 const region = requestContext.region || "US";
-                const db = data_router_1.DataRouter.getDatabaseForRegion(region, env, request, session?.userId);
+                const db = DataRouter.getDatabaseForRegion(region, env, request, session?.userId);
                 // Verify entity exists in caller's tenant
                 const entity = await db.entity.findFirst({
                     where: { id: entityId, tenantId },
@@ -423,13 +419,13 @@ exports.entitiesRoutes = [
                 });
                 if (!entity) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Entity not found" }), { status: 404, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 // Get taxonomy handler
-                const taxonomyHandler = await (0, taxonomy_handler_factory_1.createTaxonomyHandler)(request, env, region);
+                const taxonomyHandler = await createTaxonomyHandler(request, env, region);
                 if (!taxonomyHandler) {
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 // Get taxonomy tags
                 const tags = await taxonomyHandler.getEntityTaxonomyTags(entityId);
@@ -452,20 +448,20 @@ exports.entitiesRoutes = [
                             : null,
                     })),
                 }), { status: 200, headers: { "content-type": "application/json" } });
-                return await cors_handler_1.CorsHandler.addCorsHeaders(response, request, env);
+                return await CorsHandler.addCorsHeaders(response, request, env);
             }
             catch (error) {
                 try {
                     // Create instances in catch block in case they weren't created
-                    const logger = logger_1.Logger.getInstance(env);
-                    const securityHeaders = new security_headers_1.SecurityHeaders(env);
-                    const validator = new validation_1.Validator();
+                    const logger = getLogger();
+                    const securityHeaders = new SecurityHeaders(env);
+                    const validator = new Validator();
                     // Log the actual error for debugging
                     const errorMessage = error?.message || String(error);
                     console.error("[HANDLER ERROR]", errorMessage, error?.stack);
                     logger.error("Error getting taxonomy tags for entity:", error);
                     const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: errorMessage }), { status: 500, headers: { "content-type": "application/json" } });
-                    return await cors_handler_1.CorsHandler.addCorsHeaders(errorResponse, request, env);
+                    return await CorsHandler.addCorsHeaders(errorResponse, request, env);
                 }
                 catch (catchError) {
                     // If catch block fails, return a basic error response
@@ -476,7 +472,7 @@ exports.entitiesRoutes = [
                 }
             }
         },
-        middleware: [(0, middleware_1.corsMiddleware)()],
+        middleware: [corsMiddleware()],
         description: "Get taxonomy tags for entity",
     },
 ];