@de-otio/trellis 0.7.1 → 0.10.0

package/dist/lib/auth/capabilities.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Capability catalog — every action a tenant member can be authorized to do.
  *
@@ -7,9 +6,7 @@
  *
  * Source of truth: doc/02-technical/identity-federation/05-roles-and-permissions.md.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ALL_CAPABILITIES = exports.Capability = void 0;
-exports.Capability = {
+export const Capability = {
     TenantUpdate: "tenant.update",
     TenantDelete: "tenant.delete",
     TenantSuspend: "tenant.suspend",
@@ -40,5 +37,5 @@ exports.Capability = {
     ManageAgentSessions: "manage:agent_sessions",
 };
 /** All capabilities, used by tests + reflection helpers. */
-exports.ALL_CAPABILITIES = Object.values(exports.Capability);
+export const ALL_CAPABILITIES = Object.values(Capability);
 //# sourceMappingURL=capabilities.js.map

package/dist/lib/auth/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../../src/lib/auth/capabilities.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEU,QAAA,UAAU,GAAG;IACxB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,gBAAgB;IAE/B,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,gBAAgB,EAAE,oBAAoB;IACtC,aAAa,EAAE,gBAAgB;IAC/B,UAAU,EAAE,aAAa;IAEzB,YAAY,EAAE,eAAe;IAC7B,OAAO,EAAE,UAAU;IACnB,eAAe,EAAE,mBAAmB;IAEpC,SAAS,EAAE,YAAY;IACvB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,aAAa;IAEzB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,aAAa;IAEzB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,YAAY,EAAE,eAAe;IAC7B,QAAQ,EAAE,WAAW;IAErB,SAAS,EAAE,YAAY;IAEvB,uEAAuE;IACvE,4DAA4D;IAC5D,mBAAmB,EAAE,uBAAuB;CACpC,CAAC;AAIX,4DAA4D;AAC/C,QAAA,gBAAgB,GAC3B,MAAM,CAAC,MAAM,CAAC,kBAAU,CAAmC,CAAC"}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../../src/lib/auth/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,gBAAgB;IAE/B,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,gBAAgB,EAAE,oBAAoB;IACtC,aAAa,EAAE,gBAAgB;IAC/B,UAAU,EAAE,aAAa;IAEzB,YAAY,EAAE,eAAe;IAC7B,OAAO,EAAE,UAAU;IACnB,eAAe,EAAE,mBAAmB;IAEpC,SAAS,EAAE,YAAY;IACvB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,aAAa;IAEzB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,aAAa;IAEzB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,YAAY,EAAE,eAAe;IAC7B,QAAQ,EAAE,WAAW;IAErB,SAAS,EAAE,YAAY;IAEvB,uEAAuE;IACvE,4DAA4D;IAC5D,mBAAmB,EAAE,uBAAuB;CACpC,CAAC;AAIX,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAC3B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAmC,CAAC"}

package/dist/lib/auth/claims-cache.d.ts

@@ -2,7 +2,7 @@
  * DynamoDB-backed claims cache for the pre-token-generation Lambda
  * (T2 — JIT provisioning).
  *
- * Storage layout (single-table on the existing `{stage}-skybber` table):
+ * Storage layout (single-table on the existing `{stage}-trellis` table):
  *   pk = `claims:{cognitoSub}`
  *   sk = `meta`
  *   ttl = epoch seconds; DynamoDB-managed expiry plus a manual check on read
@@ -16,7 +16,7 @@
  */
 import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
 export interface CachedClaims {
-    /** Skybber `User.id` (cuid). May be empty string for drift sentinel. */
+    /** Trellis `User.id` (cuid). May be empty string for drift sentinel. */
     userId: string;
     /** Global `UserRole` enum value. May be empty string for drift sentinel. */
     globalRole: string;

package/dist/lib/auth/claims-cache.js

@@ -1,9 +1,8 @@
-"use strict";
 /**
  * DynamoDB-backed claims cache for the pre-token-generation Lambda
  * (T2 — JIT provisioning).
  *
- * Storage layout (single-table on the existing `{stage}-skybber` table):
+ * Storage layout (single-table on the existing `{stage}-trellis` table):
  *   pk = `claims:{cognitoSub}`
  *   sk = `meta`
  *   ttl = epoch seconds; DynamoDB-managed expiry plus a manual check on read
@@ -15,19 +14,16 @@
  * pre-token-gen invocations for the same user (rare, but possible during a
  * burst of token refreshes) cannot stale-overwrite a fresh entry.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ClaimsCache = exports.DEFAULT_CACHE_TTL_SECONDS = void 0;
-exports.createClaimsCacheFromEnv = createClaimsCacheFromEnv;
-const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
-const util_dynamodb_1 = require("@aws-sdk/util-dynamodb");
-exports.DEFAULT_CACHE_TTL_SECONDS = 3600;
+import { DynamoDBClient, GetItemCommand, PutItemCommand, DeleteItemCommand, } from "@aws-sdk/client-dynamodb";
+import { marshall, unmarshall } from "@aws-sdk/util-dynamodb";
+export const DEFAULT_CACHE_TTL_SECONDS = 3600;
 function pkFor(cognitoSub) {
     return `claims:${cognitoSub}`;
 }
 function nowSeconds() {
     return Math.floor(Date.now() / 1000);
 }
-class ClaimsCache {
+export class ClaimsCache {
     client;
     tableName;
     constructor(client, tableName) {
@@ -40,13 +36,13 @@ class ClaimsCache {
      * eventually delete them.
      */
     async get(cognitoSub) {
-        const result = await this.client.send(new client_dynamodb_1.GetItemCommand({
+        const result = await this.client.send(new GetItemCommand({
             TableName: this.tableName,
-            Key: (0, util_dynamodb_1.marshall)({ pk: pkFor(cognitoSub), sk: "meta" }),
+            Key: marshall({ pk: pkFor(cognitoSub), sk: "meta" }),
         }));
         if (!result.Item)
             return null;
-        const item = (0, util_dynamodb_1.unmarshall)(result.Item);
+        const item = unmarshall(result.Item);
         const ttl = typeof item.ttl === "number" ? item.ttl : 0;
         if (!ttl || ttl <= nowSeconds())
             return null;
@@ -66,13 +62,13 @@ class ClaimsCache {
      * first-org-tenant heuristic.
      */
     async getActiveTenantPreference(cognitoSub) {
-        const result = await this.client.send(new client_dynamodb_1.GetItemCommand({
+        const result = await this.client.send(new GetItemCommand({
             TableName: this.tableName,
-            Key: (0, util_dynamodb_1.marshall)({ pk: pkFor(cognitoSub), sk: "meta" }),
+            Key: marshall({ pk: pkFor(cognitoSub), sk: "meta" }),
         }));
         if (!result.Item)
             return null;
-        const item = (0, util_dynamodb_1.unmarshall)(result.Item);
+        const item = unmarshall(result.Item);
         const activeTenantId = item.activeTenantId ?? "";
         return activeTenantId || null;
     }
@@ -82,12 +78,12 @@ class ClaimsCache {
      * overwrite a fresher row. On collision we silently swallow the
      * conditional-check failure — the cache still holds an acceptable value.
      */
-    async put(cognitoSub, claims, ttlSeconds = exports.DEFAULT_CACHE_TTL_SECONDS) {
+    async put(cognitoSub, claims, ttlSeconds = DEFAULT_CACHE_TTL_SECONDS) {
         const expiresAt = nowSeconds() + ttlSeconds;
         try {
-            await this.client.send(new client_dynamodb_1.PutItemCommand({
+            await this.client.send(new PutItemCommand({
                 TableName: this.tableName,
-                Item: (0, util_dynamodb_1.marshall)({
+                Item: marshall({
                     pk: pkFor(cognitoSub),
                     sk: "meta",
                     userId: claims.userId,
@@ -100,7 +96,7 @@ class ClaimsCache {
                 }),
                 ConditionExpression: "attribute_not_exists(#ttl) OR #ttl < :incomingTtl",
                 ExpressionAttributeNames: { "#ttl": "ttl" },
-                ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":incomingTtl": expiresAt }),
+                ExpressionAttributeValues: marshall({ ":incomingTtl": expiresAt }),
             }));
         }
         catch (err) {
@@ -116,24 +112,23 @@ class ClaimsCache {
      * RDS rather than serving a stale role.
      */
     async invalidate(cognitoSub) {
-        await this.client.send(new client_dynamodb_1.DeleteItemCommand({
+        await this.client.send(new DeleteItemCommand({
             TableName: this.tableName,
-            Key: (0, util_dynamodb_1.marshall)({ pk: pkFor(cognitoSub), sk: "meta" }),
+            Key: marshall({ pk: pkFor(cognitoSub), sk: "meta" }),
         }));
     }
 }
-exports.ClaimsCache = ClaimsCache;
 /**
  * Convenience constructor used by the Lambda handler. Reads the table name
  * from `DYNAMODB_TABLE` and the region from `AWS_REGION`. Tests construct
  * a `ClaimsCache` directly with a mock client.
  */
-function createClaimsCacheFromEnv() {
+export function createClaimsCacheFromEnv() {
     const tableName = process.env.DYNAMODB_TABLE;
     if (!tableName) {
         throw new Error("DYNAMODB_TABLE env var is required for ClaimsCache");
     }
-    const client = new client_dynamodb_1.DynamoDBClient({ region: process.env.AWS_REGION });
+    const client = new DynamoDBClient({ region: process.env.AWS_REGION });
     return new ClaimsCache(client, tableName);
 }
 //# sourceMappingURL=claims-cache.js.map

package/dist/lib/auth/claims-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"claims-cache.js","sourceRoot":"","sources":["../../../src/lib/auth/claims-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAiJH,4DAOC;AAtJD,8DAKkC;AAClC,0DAA8D;AAiBjD,QAAA,yBAAyB,GAAG,IAAI,CAAC;AAE9C,SAAS,KAAK,CAAC,UAAkB;IAC/B,OAAO,UAAU,UAAU,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAa,WAAW;IAEH;IACA;IAFnB,YACmB,MAAsB,EACtB,SAAiB;QADjB,WAAM,GAAN,MAAM,CAAgB;QACtB,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,UAAkB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,gCAAc,CAAC;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CACH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAA,0BAAU,EAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;QAChE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,UAAU,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO;YACL,MAAM,EAAG,IAAI,CAAC,MAA6B,IAAI,EAAE;YACjD,UAAU,EAAG,IAAI,CAAC,UAAiC,IAAI,EAAE;YACzD,cAAc,EAAG,IAAI,CAAC,cAAqC,IAAI,EAAE;YACjE,UAAU,EAAG,IAAI,CAAC,UAAiC,IAAI,EAAE;YACzD,UAAU,EAAG,IAAI,CAAC,UAAiC,IAAI,EAAE;YACzD,MAAM,EAAG,IAAI,CAAC,MAA6B,IAAI,EAAE;SAClD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,yBAAyB,CAAC,UAAkB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,gCAAc,CAAC;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CACH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAA,0BAAU,EAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;QAChE,MAAM,cAAc,GAAI,IAAI,CAAC,cAAqC,IAAI,EAAE,CAAC;QACzE,OAAO,cAAc,IAAI,IAAI,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CACP,UAAkB,EAClB,MAAoB,EACpB,aAAqB,iCAAyB;QAE9C,MAAM,SAAS,GAAG,UAAU,EAAE,GAAG,UAAU,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,gCAAc,CAAC;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,IAAA,wBAAQ,EAAC;oBACb,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC;oBACrB,EAAE,EAAE,MAAM;oBACV,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,GAAG,EAAE,SAAS;iBACf,CAAC;gBACF,mBAAmB,EAAE,mDAAmD;gBACxE,wBAAwB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC3C,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;aACnE,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,IAAI,IAAI,KAAK,iCAAiC;gBAAE,OAAO;YACvD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,mCAAiB,CAAC;YACpB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CACH,CAAC;IACJ,CAAC;CACF;AAvGD,kCAuGC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"claims-cache.js","sourceRoot":"","sources":["../../../src/lib/auth/claims-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAiB9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,SAAS,KAAK,CAAC,UAAkB;IAC/B,OAAO,UAAU,UAAU,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,MAAsB,EACtB,SAAiB;QADjB,WAAM,GAAN,MAAM,CAAgB;QACtB,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,UAAkB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,cAAc,CAAC;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CACH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;QAChE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,UAAU,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO;YACL,MAAM,EAAG,IAAI,CAAC,MAA6B,IAAI,EAAE;YACjD,UAAU,EAAG,IAAI,CAAC,UAAiC,IAAI,EAAE;YACzD,cAAc,EAAG,IAAI,CAAC,cAAqC,IAAI,EAAE;YACjE,UAAU,EAAG,IAAI,CAAC,UAAiC,IAAI,EAAE;YACzD,UAAU,EAAG,IAAI,CAAC,UAAiC,IAAI,EAAE;YACzD,MAAM,EAAG,IAAI,CAAC,MAA6B,IAAI,EAAE;SAClD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,yBAAyB,CAAC,UAAkB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,IAAI,cAAc,CAAC;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CACH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;QAChE,MAAM,cAAc,GAAI,IAAI,CAAC,cAAqC,IAAI,EAAE,CAAC;QACzE,OAAO,cAAc,IAAI,IAAI,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CACP,UAAkB,EAClB,MAAoB,EACpB,aAAqB,yBAAyB;QAE9C,MAAM,SAAS,GAAG,UAAU,EAAE,GAAG,UAAU,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,cAAc,CAAC;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,QAAQ,CAAC;oBACb,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC;oBACrB,EAAE,EAAE,MAAM;oBACV,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,GAAG,EAAE,SAAS;iBACf,CAAC;gBACF,mBAAmB,EAAE,mDAAmD;gBACxE,wBAAwB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC3C,yBAAyB,EAAE,QAAQ,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;aACnE,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,IAAI,IAAI,KAAK,iCAAiC;gBAAE,OAAO;YACvD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,IAAI,iBAAiB,CAAC;YACpB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CACH,CAAC;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC"}

package/dist/lib/auth/cognito-jwt.d.ts

@@ -1,8 +1,14 @@
 /**
  * Cognito JWT Verification
  *
- * Validates Cognito-issued JWTs using the aws-jwt-verify library.
- * Caches the JWKS locally to avoid network calls per request.
+ * Validates Cognito-issued JWTs via `@de-otio/vestibulum`'s
+ * `createMultiPoolVerifier`. Trellis is single-pool, so the verifier is
+ * configured with a one-element pool array — the idiomatic single-pool
+ * shape. The underlying `aws-jwt-verify` JWKS cache lives inside the
+ * vestibulum verifier (transitive dependency).
+ *
+ * The verifier is lazily constructed and recreated if older than 24
+ * hours to refresh the pinned JWKS.
  */
 /** Reset the verifier to force JWKS refresh on next call */
 export declare function resetVerifier(): void;
@@ -21,6 +27,18 @@ export interface CognitoJwtClaims {
     "custom:handle"?: string;
     "custom:dataRegion"?: string;
 }
+/**
+ * Verify a Cognito JWT and return its narrowed claims.
+ *
+ * Throws on any verification failure (expired, bad signature, wrong
+ * client/issuer/token_use, malformed). This preserves the previous
+ * throw-on-invalid contract that callers rely on (auth-middleware and
+ * the session manager both treat a throw as "not authenticated").
+ *
+ * On a `MultiPoolVerifierError` (which can include JWKS-key-not-found
+ * surfaced as invalid_signature), we reset the verifier to refresh the
+ * JWKS and retry once — mirroring the previous S1.5 behaviour.
+ */
 export declare function verifyCognitoJwt(token: string): Promise<CognitoJwtClaims>;
 export declare function extractBearerToken(authHeader: string | null): string | null;
 //# sourceMappingURL=cognito-jwt.d.ts.map

package/dist/lib/auth/cognito-jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cognito-jwt.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/cognito-jwt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2BH,4DAA4D;AAC5D,wBAAgB,aAAa,SAG5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU/E;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG3E"}
+{"version":3,"file":"cognito-jwt.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/cognito-jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwCH,4DAA4D;AAC5D,wBAAgB,aAAa,SAG5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AA2CD;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAa/E;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG3E"}

package/dist/lib/auth/cognito-jwt.js

@@ -1,54 +1,114 @@
-"use strict";
 /**
  * Cognito JWT Verification
  *
- * Validates Cognito-issued JWTs using the aws-jwt-verify library.
- * Caches the JWKS locally to avoid network calls per request.
+ * Validates Cognito-issued JWTs via `@de-otio/vestibulum`'s
+ * `createMultiPoolVerifier`. Trellis is single-pool, so the verifier is
+ * configured with a one-element pool array — the idiomatic single-pool
+ * shape. The underlying `aws-jwt-verify` JWKS cache lives inside the
+ * vestibulum verifier (transitive dependency).
+ *
+ * The verifier is lazily constructed and recreated if older than 24
+ * hours to refresh the pinned JWKS.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resetVerifier = resetVerifier;
-exports.verifyCognitoJwt = verifyCognitoJwt;
-exports.extractBearerToken = extractBearerToken;
-const aws_jwt_verify_1 = require("aws-jwt-verify");
+import { createMultiPoolVerifier, MultiPoolVerifierError, } from "@de-otio/vestibulum";
 let verifier = null;
 let lastCreated = 0;
 const VERIFIER_MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours
 function getVerifier() {
     const now = Date.now();
     // S1.5 — Recreate verifier if older than 24 hours to refresh JWKS
-    if (!verifier || (now - lastCreated > VERIFIER_MAX_AGE_MS)) {
+    if (!verifier || now - lastCreated > VERIFIER_MAX_AGE_MS) {
         const userPoolId = process.env.COGNITO_USER_POOL_ID;
         const clientId = process.env.COGNITO_APP_CLIENT_ID;
         if (!userPoolId || !clientId) {
             throw new Error("COGNITO_USER_POOL_ID and COGNITO_APP_CLIENT_ID must be set");
         }
-        verifier = aws_jwt_verify_1.CognitoJwtVerifier.create({
-            userPoolId,
-            tokenUse: "id",
-            clientId,
-        });
+        const region = process.env.COGNITO_REGION ?? process.env.AWS_REGION ?? "us-east-1";
+        // Single-pool config: one PoolConfig is the correct, idiomatic shape
+        // for a single-pool consumer. tokenUse "id" preserves the previous
+        // CognitoJwtVerifier.create({ tokenUse: "id" }) contract.
+        verifier = createMultiPoolVerifier([
+            {
+                poolKey: "default",
+                userPoolId,
+                clientId,
+                region,
+                tokenUse: "id",
+            },
+        ]);
         lastCreated = now;
     }
     return verifier;
 }
 /** Reset the verifier to force JWKS refresh on next call */
-function resetVerifier() {
+export function resetVerifier() {
     verifier = null;
     lastCreated = 0;
 }
-async function verifyCognitoJwt(token) {
+/**
+ * Narrow vestibulum's `Record<string, unknown>` claims onto the trellis
+ * `CognitoJwtClaims` shape. The known fields (sub, username, email,
+ * custom:*) are read explicitly; everything else is dropped.
+ *
+ * `sub` is always present on a verified Cognito token; `username` is
+ * the Cognito `cognito:username` claim on ID tokens. We coerce missing
+ * string claims to "" defensively rather than throwing — callers that
+ * require a field already guard for it (e.g. auth-middleware checks
+ * custom:userId / custom:activeTenantId).
+ */
+function narrowClaims(claims) {
+    const asString = (v) => typeof v === "string" ? v : undefined;
+    const result = {
+        sub: asString(claims.sub) ?? "",
+        username: asString(claims["cognito:username"]) ?? asString(claims.username) ?? "",
+    };
+    const optional = [
+        "email",
+        "custom:userId",
+        "custom:role",
+        "custom:globalRole",
+        "custom:activeTenantId",
+        "custom:tenantSlug",
+        "custom:tenantRole",
+        "custom:handle",
+        "custom:dataRegion",
+    ];
+    for (const key of optional) {
+        const value = asString(claims[key]);
+        if (value !== undefined) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Verify a Cognito JWT and return its narrowed claims.
+ *
+ * Throws on any verification failure (expired, bad signature, wrong
+ * client/issuer/token_use, malformed). This preserves the previous
+ * throw-on-invalid contract that callers rely on (auth-middleware and
+ * the session manager both treat a throw as "not authenticated").
+ *
+ * On a `MultiPoolVerifierError` (which can include JWKS-key-not-found
+ * surfaced as invalid_signature), we reset the verifier to refresh the
+ * JWKS and retry once — mirroring the previous S1.5 behaviour.
+ */
+export async function verifyCognitoJwt(token) {
     try {
-        const payload = await getVerifier().verify(token);
-        return payload;
+        const verified = await getVerifier().verify(token);
+        return narrowClaims(verified.claims);
     }
     catch (err) {
-        // S1.5 — On verification failure, reset verifier to refresh JWKS and retry once
-        resetVerifier();
-        const payload = await getVerifier().verify(token);
-        return payload;
+        // S1.5 — On verification failure, reset verifier to refresh JWKS and retry once.
+        if (err instanceof MultiPoolVerifierError) {
+            resetVerifier();
+            const verified = await getVerifier().verify(token);
+            return narrowClaims(verified.claims);
+        }
+        throw err;
     }
 }
-function extractBearerToken(authHeader) {
+export function extractBearerToken(authHeader) {
     if (!authHeader?.startsWith("Bearer "))
         return null;
     return authHeader.slice(7);

package/dist/lib/auth/cognito-jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"cognito-jwt.js","sourceRoot":"","sources":["../../../src/lib/auth/cognito-jwt.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA4BH,sCAGC;AAkBD,4CAUC;AAED,gDAGC;AA9DD,mDAAoD;AAEpD,IAAI,QAAQ,GAAwD,IAAI,CAAC;AACzE,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAE5D,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,kEAAkE;IAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,GAAG,WAAW,GAAG,mBAAmB,CAAC,EAAE,CAAC;QAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,QAAQ,GAAG,mCAAkB,CAAC,MAAM,CAAC;YACnC,UAAU;YACV,QAAQ,EAAE,IAAI;YACd,QAAQ;SACT,CAAC,CAAC;QACH,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4DAA4D;AAC5D,SAAgB,aAAa;IAC3B,QAAQ,GAAG,IAAI,CAAC;IAChB,WAAW,GAAG,CAAC,CAAC;AAClB,CAAC;AAkBM,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,OAAsC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gFAAgF;QAChF,aAAa,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,OAAsC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,UAAyB;IAC1D,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"cognito-jwt.js","sourceRoot":"","sources":["../../../src/lib/auth/cognito-jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAE7B,IAAI,QAAQ,GAA6B,IAAI,CAAC;AAC9C,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAE5D,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,kEAAkE;IAClE,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,WAAW,GAAG,mBAAmB,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;QACtE,qEAAqE;QACrE,mEAAmE;QACnE,0DAA0D;QAC1D,QAAQ,GAAG,uBAAuB,CAAC;YACjC;gBACE,OAAO,EAAE,SAAS;gBAClB,UAAU;gBACV,QAAQ;gBACR,MAAM;gBACN,QAAQ,EAAE,IAAI;aACf;SACF,CAAC,CAAC;QACH,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa;IAC3B,QAAQ,GAAG,IAAI,CAAC;IAChB,WAAW,GAAG,CAAC,CAAC;AAClB,CAAC;AAkBD;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,MAAyC;IAC7D,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAsB,EAAE,CAClD,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExC,MAAM,MAAM,GAAqB;QAC/B,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE;QAC/B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;KAClF,CAAC;IAEF,MAAM,QAAQ,GAA+B;QAC3C,OAAO;QACP,eAAe;QACf,aAAa;QACb,mBAAmB;QACnB,uBAAuB;QACvB,mBAAmB;QACnB,mBAAmB;QACnB,eAAe;QACf,mBAAmB;KACpB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnD,OAAO,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iFAAiF;QACjF,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,aAAa,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAyB;IAC1D,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/lib/auth/idp-redirect-builder.d.ts

@@ -9,7 +9,7 @@
  * All URL parameters are server-derived; callers supply only the Prisma-loaded
  * cognitoIdpName — no arbitrary IdP names accepted from request input.
  */
-export { cognitoIdpName } from "../tenant/idp-name";
+export { cognitoIdpName } from "../tenant/idp-name.js";
 export interface IdpRedirectConfig {
     hostedUiDomain: string;
     clientId: string;

package/dist/lib/auth/idp-redirect-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idp-redirect-builder.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/idp-redirect-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,iBAAiB,GACxB,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,iBAAiB,CAMpB"}
+{"version":3,"file":"idp-redirect-builder.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/idp-redirect-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,iBAAiB,GACxB,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,iBAAiB,CAMpB"}

package/dist/lib/auth/idp-redirect-builder.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Builds the Cognito Hosted UI OAuth2 authorization URL for federated sign-in.
  *
@@ -10,19 +9,14 @@
  * All URL parameters are server-derived; callers supply only the Prisma-loaded
  * cognitoIdpName — no arbitrary IdP names accepted from request input.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.cognitoIdpName = void 0;
-exports.buildIdpRedirectUrl = buildIdpRedirectUrl;
-exports.getIdpRedirectConfig = getIdpRedirectConfig;
-var idp_name_1 = require("../tenant/idp-name");
-Object.defineProperty(exports, "cognitoIdpName", { enumerable: true, get: function () { return idp_name_1.cognitoIdpName; } });
+export { cognitoIdpName } from "../tenant/idp-name.js";
 /**
  * Builds the Cognito Hosted UI authorization URL.
  *
  * Scope is always `openid email profile` — no caller-supplied scope to prevent
  * privilege escalation via scope injection.
  */
-function buildIdpRedirectUrl(config, params) {
+export function buildIdpRedirectUrl(config, params) {
     const base = `https://${config.hostedUiDomain}/oauth2/authorize`;
     const qs = new URLSearchParams({
         identity_provider: params.cognitoIdpName,
@@ -38,9 +32,9 @@ function buildIdpRedirectUrl(config, params) {
  * Env vars read here are defined in src/env.ts and must come from there —
  * no direct process.env access outside buildEnv().
  */
-function getIdpRedirectConfig(env) {
+export function getIdpRedirectConfig(env) {
     return {
-        hostedUiDomain: env.COGNITO_HOSTED_UI_DOMAIN ?? "auth.skybber.com",
+        hostedUiDomain: env.COGNITO_HOSTED_UI_DOMAIN ?? "auth.example.com",
         clientId: env.COGNITO_APP_CLIENT_ID ?? "",
         redirectUri: env.COGNITO_REDIRECT_URI ?? "",
     };

package/dist/lib/auth/idp-redirect-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"idp-redirect-builder.js","sourceRoot":"","sources":["../../../src/lib/auth/idp-redirect-builder.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA0BH,kDAaC;AAOD,oDAUC;AAtDD,+CAAoD;AAA3C,0GAAA,cAAc,OAAA;AAkBvB;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,MAAyB,EACzB,MAAyB;IAEzB,MAAM,IAAI,GAAG,WAAW,MAAM,CAAC,cAAc,mBAAmB,CAAC;IACjE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC;QAC7B,iBAAiB,EAAE,MAAM,CAAC,cAAc;QACxC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,sBAAsB;KAC9B,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,GAIpC;IACC,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,wBAAwB,IAAI,kBAAkB;QAClE,QAAQ,EAAE,GAAG,CAAC,qBAAqB,IAAI,EAAE;QACzC,WAAW,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;KAC5C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"idp-redirect-builder.js","sourceRoot":"","sources":["../../../src/lib/auth/idp-redirect-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAkBvD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAyB,EACzB,MAAyB;IAEzB,MAAM,IAAI,GAAG,WAAW,MAAM,CAAC,cAAc,mBAAmB,CAAC;IACjE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC;QAC7B,iBAAiB,EAAE,MAAM,CAAC,cAAc;QACxC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,sBAAsB;KAC9B,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAIpC;IACC,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,wBAAwB,IAAI,kBAAkB;QAClE,QAAQ,EAAE,GAAG,CAAC,qBAAqB,IAAI,EAAE;QACzC,WAAW,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;KAC5C,CAAC;AACJ,CAAC"}

package/dist/lib/auth/require.d.ts

@@ -8,10 +8,10 @@
  * SUPER_ADMIN bypasses every check (platform-wide override).
  */
 import type { TenantRole } from "@prisma/client";
-import type { AuthContext } from "./auth-context";
-import { type CapabilityValue } from "./capabilities";
-export { Capability, type CapabilityValue } from "./capabilities";
-export { RoleGrants } from "./role-grants";
+import type { AuthContext } from "./auth-context.js";
+import { type CapabilityValue } from "./capabilities.js";
+export { Capability, type CapabilityValue } from "./capabilities.js";
+export { RoleGrants } from "./role-grants.js";
 /**
  * Returns a 403 Response if the caller's tenant role is below `minRole`,
  * or null if the check passes. SUPER_ADMIN bypasses.

package/dist/lib/auth/require.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/require.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAoB3C;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,UAAU,GAClB,QAAQ,GAAG,IAAI,CAIjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AA6BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,wBAA6B,GACrC,QAAQ,GAAG,IAAI,CAcjB"}
+{"version":3,"file":"require.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/require.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGrE,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAoB9C;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,UAAU,GAClB,QAAQ,GAAG,IAAI,CAIjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AA6BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,wBAA6B,GACrC,QAAQ,GAAG,IAAI,CAcjB"}

package/dist/lib/auth/require.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Authorization helpers — role and capability gating.
  *
@@ -8,16 +7,10 @@
  *
  * SUPER_ADMIN bypasses every check (platform-wide override).
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RoleGrants = exports.Capability = void 0;
-exports.requireRole = requireRole;
-exports.requireCapability = requireCapability;
-const capabilities_1 = require("./capabilities");
-const role_grants_1 = require("./role-grants");
-var capabilities_2 = require("./capabilities");
-Object.defineProperty(exports, "Capability", { enumerable: true, get: function () { return capabilities_2.Capability; } });
-var role_grants_2 = require("./role-grants");
-Object.defineProperty(exports, "RoleGrants", { enumerable: true, get: function () { return role_grants_2.RoleGrants; } });
+import { Capability } from "./capabilities.js";
+import { RoleGrants } from "./role-grants.js";
+export { Capability } from "./capabilities.js";
+export { RoleGrants } from "./role-grants.js";
 const ROLE_RANK = {
     OWNER: 4,
     ADMIN: 3,
@@ -34,7 +27,7 @@ function forbidden(message) {
  * Returns a 403 Response if the caller's tenant role is below `minRole`,
  * or null if the check passes. SUPER_ADMIN bypasses.
  */
-function requireRole(auth, minRole) {
+export function requireRole(auth, minRole) {
     if (isSuperAdmin(auth))
         return null;
     if (ROLE_RANK[auth.tenantRole] >= ROLE_RANK[minRole])
@@ -52,10 +45,10 @@ function requireRole(auth, minRole) {
  *    (cross-user takedown). MEMBER must own the entity.
  */
 const OWN_ONLY_FALLBACK = {
-    [capabilities_1.Capability.PostUpdate]: capabilities_1.Capability.PostModerate,
-    [capabilities_1.Capability.PostDelete]: capabilities_1.Capability.PostModerate,
-    [capabilities_1.Capability.EntityUpdate]: capabilities_1.Capability.PostModerate,
-    [capabilities_1.Capability.EntityDelete]: capabilities_1.Capability.PostModerate,
+    [Capability.PostUpdate]: Capability.PostModerate,
+    [Capability.PostDelete]: Capability.PostModerate,
+    [Capability.EntityUpdate]: Capability.PostModerate,
+    [Capability.EntityDelete]: Capability.PostModerate,
 };
 function isOwnedBy(resource, userId) {
     if (!resource)
@@ -79,10 +72,10 @@ function isOwnedBy(resource, userId) {
  * If `options.resource` is omitted for an own-only capability, the check is
  * lenient (caps-only) — callers that load the resource must pass it through.
  */
-function requireCapability(auth, cap, options = {}) {
+export function requireCapability(auth, cap, options = {}) {
     if (isSuperAdmin(auth))
         return null;
-    const grants = role_grants_1.RoleGrants[auth.tenantRole];
+    const grants = RoleGrants[auth.tenantRole];
     if (!grants.has(cap))
         return forbidden(`Requires capability ${cap}`);
     const moderationCap = OWN_ONLY_FALLBACK[cap];

package/dist/lib/auth/require.js.map

@@ -1 +1 @@
-{"version":3,"file":"require.js","sourceRoot":"","sources":["../../../src/lib/auth/require.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAgCH,kCAOC;AA6DD,8CAkBC;AAlHD,iDAAkE;AAClE,+CAA2C;AAE3C,+CAAkE;AAAzD,0GAAA,UAAU,OAAA;AACnB,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AAEnB,MAAM,SAAS,GAA+B;IAC5C,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,SAAS,YAAY,CAAC,IAAiB;IACrC,OAAO,IAAI,CAAC,UAAU,KAAM,aAA0B,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CACzB,IAAiB,EACjB,OAAmB;IAEnB,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,SAAS,CAAC,wBAAwB,OAAO,YAAY,CAAC,CAAC;AAChE,CAAC;AAqBD;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAsD;IAC3E,CAAC,yBAAU,CAAC,UAAU,CAAC,EAAE,yBAAU,CAAC,YAAY;IAChD,CAAC,yBAAU,CAAC,UAAU,CAAC,EAAE,yBAAU,CAAC,YAAY;IAChD,CAAC,yBAAU,CAAC,YAAY,CAAC,EAAE,yBAAU,CAAC,YAAY;IAClD,CAAC,yBAAU,CAAC,YAAY,CAAC,EAAE,yBAAU,CAAC,YAAY;CACnD,CAAC;AAEF,SAAS,SAAS,CAChB,QAAwC,EACxC,MAAc;IAEd,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,iBAAiB,CAC/B,IAAiB,EACjB,GAAoB,EACpB,UAAoC,EAAE;IAEtC,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,wBAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAErE,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,OAAO,SAAS,CAAC,yBAAyB,aAAa,EAAE,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"require.js","sourceRoot":"","sources":["../../../src/lib/auth/require.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,UAAU,EAAwB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAwB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,SAAS,GAA+B;IAC5C,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,SAAS,YAAY,CAAC,IAAiB;IACrC,OAAO,IAAI,CAAC,UAAU,KAAM,aAA0B,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,IAAiB,EACjB,OAAmB;IAEnB,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,SAAS,CAAC,wBAAwB,OAAO,YAAY,CAAC,CAAC;AAChE,CAAC;AAqBD;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAsD;IAC3E,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,YAAY;IAChD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,YAAY;IAChD,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,YAAY;IAClD,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,YAAY;CACnD,CAAC;AAEF,SAAS,SAAS,CAChB,QAAwC,EACxC,MAAc;IAEd,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAiB,EACjB,GAAoB,EACpB,UAAoC,EAAE;IAEtC,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAErE,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,OAAO,SAAS,CAAC,yBAAyB,aAAa,EAAE,CAAC,CAAC;AAC7D,CAAC"}

package/dist/lib/auth/role-grants.d.ts

@@ -13,6 +13,6 @@
  *   GUEST ⊂ MEMBER ⊂ ADMIN ⊂ OWNER.
  */
 import type { TenantRole } from "@prisma/client";
-import { type CapabilityValue } from "./capabilities";
+import { type CapabilityValue } from "./capabilities.js";
 export declare const RoleGrants: Record<TenantRole, ReadonlySet<CapabilityValue>>;
 //# sourceMappingURL=role-grants.d.ts.map

package/dist/lib/auth/role-grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-grants.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/role-grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA2ClE,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,eAAe,CAAC,CAKvE,CAAC"}
+{"version":3,"file":"role-grants.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/role-grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AA2CrE,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,eAAe,CAAC,CAKvE,CAAC"}