@de-otio/trellis 0.7.1 → 0.10.0

package/dist/lib/crypto/voting/post-quantum-encryption.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-quantum-encryption.js","sourceRoot":"","sources":["../../../../src/lib/crypto/voting/post-quantum-encryption.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AASH;;;;;;;;GAQG;AACH,MAAa,qBAAqB;IAChC;;OAEG;IACc,aAAa,GAAG,0BAA0B,CAAC;IAE5D;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,OAAgB,EAChB,SAAoB;QAEpB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,aAA4B,EAC5B,UAAsB;QAEtB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAClB,UAAyB,EACzB,UAAyB;QAEzB,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,CAAC;CACF;AApFD,sDAoFC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG"}
+{"version":3,"file":"post-quantum-encryption.js","sourceRoot":"","sources":["../../../../src/lib/crypto/voting/post-quantum-encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChC;;OAEG;IACc,aAAa,GAAG,0BAA0B,CAAC;IAE5D;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,OAAgB,EAChB,SAAoB;QAEpB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,aAA4B,EAC5B,UAAsB;QAEtB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAClB,UAAyB,EACzB,UAAyB;QAEzB,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG"}

package/dist/lib/csrf.d.ts

@@ -7,8 +7,8 @@
  *
  * Fallback: If KV is configured, can also validate against KV (for migration/transition period).
  */
-import type { Env } from "../env";
-import type { Session } from "./session-manager";
+import type { Env } from "../env.js";
+import type { Session } from "./session-cookie.js";
 /**
  * CSRF Protection utility class
  */

package/dist/lib/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/lib/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAC,CAAM;gBAEN,GAAG,CAAC,EAAE,GAAG;IAIrB;;;OAGG;IACH,aAAa,IAAI,MAAM;IAIvB;;;OAGG;IACH,MAAM,CAAC,aAAa,IAAI,MAAM;IAI9B;;;;;;;;;;OAUG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,OAAO,CAAC;IA0CnB;;;OAGG;WACU,aAAa,CACxB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,OAAO,CAAC;IAKnB;;;;;;;;;OASG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO;IAS7D;;;;;;;;OAQG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAa,GACjB,OAAO,CAAC,IAAI,CAAC;IAUhB;;;;;;OAMG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;IAKjD;;;;;;OAMG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAa3B,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO;WAIvD,cAAc,CACzB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,GAAG,EACR,GAAG,GAAE,MAAa,GACjB,OAAO,CAAC,IAAI,CAAC;IAIhB,MAAM,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;WAI3C,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3E"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/lib/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAC,CAAM;gBAEN,GAAG,CAAC,EAAE,GAAG;IAIrB;;;OAGG;IACH,aAAa,IAAI,MAAM;IAIvB;;;OAGG;IACH,MAAM,CAAC,aAAa,IAAI,MAAM;IAI9B;;;;;;;;;;OAUG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,OAAO,CAAC;IA0CnB;;;OAGG;WACU,aAAa,CACxB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,OAAO,CAAC;IAKnB;;;;;;;;;OASG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO;IAS7D;;;;;;;;OAQG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAa,GACjB,OAAO,CAAC,IAAI,CAAC;IAUhB;;;;;;OAMG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;IAKjD;;;;;;OAMG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAa3B,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO;WAIvD,cAAc,CACzB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,GAAG,EACR,GAAG,GAAE,MAAa,GACjB,OAAO,CAAC,IAAI,CAAC;IAIhB,MAAM,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;WAI3C,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3E"}

package/dist/lib/csrf.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * CSRF Protection
  *
@@ -8,12 +7,10 @@
  *
  * Fallback: If KV is configured, can also validate against KV (for migration/transition period).
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CSRFProtection = void 0;
 /**
  * CSRF Protection utility class
  */
-class CSRFProtection {
+export class CSRFProtection {
     env;
     constructor(env) {
         this.env = env;
@@ -170,5 +167,4 @@ class CSRFProtection {
         return new CSRFProtection(env).deleteTokenFromKV(sessionId);
     }
 }
-exports.CSRFProtection = CSRFProtection;
 //# sourceMappingURL=csrf.js.map

package/dist/lib/csrf.js.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/lib/csrf.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAKH;;GAEG;AACH,MAAa,cAAc;IACjB,GAAG,CAAO;IAElB,YAAY,GAAS;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,aAAa;QACX,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,aAAa;QAClB,OAAO,IAAI,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,OAAuB,EACvB,GAAS;QAET,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mCAAmC;QACnC,MAAM,YAAY,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAErC,kEAAkE;QAClE,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,yDAAyD;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAEnE,kEAAkE;YAClE,IAAI,OAAO,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC1C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;gBACjD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;oBACnE,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;gBACxC,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,yDAAyD;QACzD,IAAI,YAAY,EAAE,cAAc,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpD,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,GAAG,CACvD,QAAQ,OAAO,CAAC,MAAM,EAAE,EACxB,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,gCAAgC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,aAAa,CACxB,KAAa,EACb,OAAuB,EACvB,GAAS;QAET,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;OASG;IACH,mBAAmB,CAAC,KAAa,EAAE,OAAgB;QACjD,OAAO;YACL,GAAG,OAAO;YACV,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE;YAC9B,sBAAsB,EAAE,KAAK;SAC9B,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,SAAiB,EACjB,MAAc,IAAI;QAElB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC;YAC9B,OAAO,CAAC,oCAAoC;QAC9C,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,SAAS,EAAE,EAAE,KAAK,EAAE;YAC5D,aAAa,EAAE,GAAG;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB,CAAC,OAAgB;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,mBAAmB,EAAE,GAAG,OAAO,CAAC;QACtD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,CAAS,EAAE,CAAS;QAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,KAAa,EAAE,OAAgB;QACxD,OAAO,IAAI,cAAc,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,KAAa,EACb,SAAiB,EACjB,GAAQ,EACR,MAAc,IAAI;QAElB,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,sBAAsB,CAAC,OAAgB;QAC5C,OAAO,IAAI,cAAc,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,GAAQ;QACxD,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;CACF;AA1MD,wCA0MC"}
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/lib/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,GAAG,CAAO;IAElB,YAAY,GAAS;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,aAAa;QACX,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,aAAa;QAClB,OAAO,IAAI,cAAc,EAAE,CAAC,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,OAAuB,EACvB,GAAS;QAET,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mCAAmC;QACnC,MAAM,YAAY,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAErC,kEAAkE;QAClE,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,yDAAyD;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAEnE,kEAAkE;YAClE,IAAI,OAAO,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC1C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;gBACjD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;oBACnE,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;gBACxC,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,yDAAyD;QACzD,IAAI,YAAY,EAAE,cAAc,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpD,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,GAAG,CACvD,QAAQ,OAAO,CAAC,MAAM,EAAE,EACxB,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,gCAAgC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,aAAa,CACxB,KAAa,EACb,OAAuB,EACvB,GAAS;QAET,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;OASG;IACH,mBAAmB,CAAC,KAAa,EAAE,OAAgB;QACjD,OAAO;YACL,GAAG,OAAO;YACV,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE;YAC9B,sBAAsB,EAAE,KAAK;SAC9B,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,SAAiB,EACjB,MAAc,IAAI;QAElB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC;YAC9B,OAAO,CAAC,oCAAoC;QAC9C,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,SAAS,EAAE,EAAE,KAAK,EAAE;YAC5D,aAAa,EAAE,GAAG;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB,CAAC,OAAgB;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,mBAAmB,EAAE,GAAG,OAAO,CAAC;QACtD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,CAAS,EAAE,CAAS;QAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,KAAa,EAAE,OAAgB;QACxD,OAAO,IAAI,cAAc,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,KAAa,EACb,SAAiB,EACjB,GAAQ,EACR,MAAc,IAAI;QAElB,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,sBAAsB,CAAC,OAAgB;QAC5C,OAAO,IAAI,cAAc,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,GAAQ;QACxD,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/lib/data-router.d.ts

@@ -7,13 +7,13 @@
  *
  * Performance: Uses cached database connections (via createPrismaForRegion).
  */
-import { createPrismaForRegion, type EnvWithDb } from "../db";
-import { type AuditLoggerEnv } from "./audit-logger";
-import { type Region } from "./region-detection";
+import { createPrismaForRegion, type EnvWithDb } from "../db.js";
+import { type TrellisAuditLoggerEnv } from "./audit-composer.js";
+import { type Region } from "./region-detection.js";
 /**
  * Environment interface for data router
  */
-export interface DataRouterEnv extends EnvWithDb, AuditLoggerEnv {
+export interface DataRouterEnv extends EnvWithDb, TrellisAuditLoggerEnv {
     DEFAULT_REGION?: string;
     LOG_LEVEL?: string;
 }
@@ -167,6 +167,7 @@ export declare class DataRouter {
         authorId: string;
         text: string;
         visibility: string;
+        tenantId: string;
         entityRefs?: string[];
         geoData?: unknown;
         media?: Array<{

package/dist/lib/data-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-router.d.ts","sourceRoot":"","sources":["../../src/lib/data-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,qBAAqB,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAC9D,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKlE,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,SAAS,EAAE,cAAc;IAE9D,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAc;IAEzC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAY7B;;;;;;;;;;;;OAYG;IACH;;OAEG;WACU,uBAAuB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,OAAO,CAAC;IAuBnB,MAAM,CAAC,oBAAoB,CACzB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI;IAyFP;;;OAGG;WACU,+BAA+B,CAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAmEhB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,oBAAoB,CACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,UAAU,CAAC,OAAO,qBAAqB,CAAC;IAsB3C;;;;;;;;;;;;;;OAcG;WACU,UAAU,CACrB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IAoLF;;;;;;;;;;;;;;;OAeG;WACU,OAAO,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,GAAG,IAAI,CAAC;IAuFT;;;;;;;;;;;;;;;;OAgBG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IAwEF;;;;;;;;;;;;;;OAcG;WACU,UAAU,CACrB,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,EACD,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IA2MF;;;;;;;;;;;;;;;OAeG;WACU,OAAO,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,GAAG,IAAI,CAAC;CAyFV"}
+{"version":3,"file":"data-router.d.ts","sourceRoot":"","sources":["../../src/lib/data-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,qBAAqB,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,SAAS,EAAE,qBAAqB;IAErE,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAqB;IAEhD;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAY7B;;;;;;;;;;;;OAYG;IACH;;OAEG;WACU,uBAAuB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,OAAO,CAAC;IA2BnB,MAAM,CAAC,oBAAoB,CACzB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI;IAyFP;;;OAGG;WACU,+BAA+B,CAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAmEhB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,oBAAoB,CACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,UAAU,CAAC,OAAO,qBAAqB,CAAC;IAsB3C;;;;;;;;;;;;;;OAcG;WACU,UAAU,CACrB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IA2LF;;;;;;;;;;;;;;;OAeG;WACU,OAAO,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,GAAG,IAAI,CAAC;IAuFT;;;;;;;;;;;;;;;;OAgBG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IAwEF;;;;;;;;;;;;;;OAcG;WACU,UAAU,CACrB,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,EACD,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IA8MF;;;;;;;;;;;;;;;OAeG;WACU,OAAO,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,GAAG,IAAI,CAAC;CAyFV"}

package/dist/lib/data-router.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Data Router Module
  *
@@ -8,47 +7,13 @@
  *
  * Performance: Uses cached database connections (via createPrismaForRegion).
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DataRouter = void 0;
-const db_1 = require("../db");
-const audit_logger_1 = require("./audit-logger");
-const database_wrapper_helper_1 = require("./database-wrapper-helper");
-const ip_scrubber_1 = require("./ip-scrubber");
-const logger_1 = require("./logger");
-const region_detection_1 = require("./region-detection");
+import { createPrismaForRegion } from "../db.js";
+import { TrellisAuditLogger, } from "./audit-composer.js";
+import { getWrappedDatabase } from "./database-wrapper-helper.js";
+import { getIPAddress } from "./ip-scrubber.js";
+import { getLogger } from "./logger.js";
+import { deriveUniqueHandle } from "./user/derive-handle.js";
+import { isValidRegion } from "./region-detection.js";
 /**
  * Data Router class for region-aware data operations
  *
@@ -56,14 +21,14 @@ const region_detection_1 = require("./region-detection");
  *
  * Audit: All operations are logged for compliance and security monitoring.
  */
-class DataRouter {
+export class DataRouter {
     static auditLogger;
     /**
      * Get or create audit logger instance
      */
     static getAuditLogger(env, requestId) {
         if (!this.auditLogger) {
-            this.auditLogger = new audit_logger_1.AuditLogger(env);
+            this.auditLogger = new TrellisAuditLogger(env);
         }
         if (requestId) {
             return this.auditLogger.withRequestId(requestId);
@@ -89,19 +54,23 @@ class DataRouter {
     static async checkCrossRegionConsent(userId, dataRegion, accessRegion, env) {
         try {
             const db = this.getDatabaseForRegion(accessRegion, env);
-            const consent = await db.crossRegionConsent.findUnique({
+            // Consent history is append-only: the CURRENT cross-region decision is
+            // the single `active` row for this (user, dataRegion, accessRegion).
+            // (The raw partial unique index `consent_cross_region_key` guarantees at
+            // most one active CROSS_REGION row per triple.)
+            const consent = await db.consent.findFirst({
                 where: {
-                    userId_dataRegion_accessRegion: {
-                        userId,
-                        dataRegion,
-                        accessRegion,
-                    },
+                    userId,
+                    purpose: "CROSS_REGION",
+                    dataRegion,
+                    accessRegion,
+                    active: true,
                 },
             });
             return consent?.consented === true && consent.withdrawnAt === null;
         }
         catch (error) {
-            logger_1.Logger.getInstance(env).warn("[DataRouter] Error checking cross-region consent:", error);
+            getLogger().warn("[DataRouter] Error checking cross-region consent:", error);
             return false;
         }
     }
@@ -117,7 +86,7 @@ class DataRouter {
                     resource: "unknown",
                     userId,
                     region: requestedRegion,
-                    ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                    ipAddress: request ? getIPAddress(request) : undefined,
                     userAgent: request?.headers.get("User-Agent") || undefined,
                     severity: "high",
                     success: false,
@@ -127,11 +96,11 @@ class DataRouter {
                     },
                 }, env)
                     .catch((err) => {
-                    logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed:", err);
+                    getLogger().warn("[DataRouter] Audit logging failed:", err);
                 });
             }
             catch (auditError) {
-                logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for missing dataRegion:", auditError);
+                getLogger().warn("[DataRouter] Audit logging failed for missing dataRegion:", auditError);
             }
             throw new Error("Data residency violation: dataRegion not set");
         }
@@ -147,7 +116,7 @@ class DataRouter {
                     userId,
                     region: requestedRegion,
                     dataRegion,
-                    ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                    ipAddress: request ? getIPAddress(request) : undefined,
                     userAgent: request?.headers.get("User-Agent") || undefined,
                     severity: "high",
                     success: false,
@@ -158,11 +127,11 @@ class DataRouter {
                     },
                 }, env)
                     .catch((err) => {
-                    logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed:", err);
+                    getLogger().warn("[DataRouter] Audit logging failed:", err);
                 });
             }
             catch (auditError) {
-                logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for cross-region access:", auditError);
+                getLogger().warn("[DataRouter] Audit logging failed for cross-region access:", auditError);
             }
             // Throw error with specific code that frontend can detect
             const error = new Error(`CROSS_REGION_ACCESS_REQUIRES_CONSENT: Cannot access ${dataRegion} data from ${requestedRegion} region`);
@@ -196,7 +165,7 @@ class DataRouter {
                             userId,
                             region: requestedRegion,
                             dataRegion,
-                            ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                            ipAddress: request ? getIPAddress(request) : undefined,
                             userAgent: request?.headers.get("User-Agent") || undefined,
                             severity: "medium",
                             success: true,
@@ -207,11 +176,11 @@ class DataRouter {
                             },
                         }, env)
                             .catch((err) => {
-                            logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed:", err);
+                            getLogger().warn("[DataRouter] Audit logging failed:", err);
                         });
                     }
                     catch (auditError) {
-                        logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed:", auditError);
+                        getLogger().warn("[DataRouter] Audit logging failed:", auditError);
                     }
                     return; // Access allowed with consent
                 }
@@ -237,17 +206,17 @@ class DataRouter {
      */
     static getDatabaseForRegion(region, env, request, userId) {
         // CRITICAL: Validate region before routing
-        if (!(0, region_detection_1.isValidRegion)(region)) {
+        if (!isValidRegion(region)) {
             throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
         }
         // If request is provided, return wrapped client with monitoring
         if (request) {
-            return (0, database_wrapper_helper_1.getWrappedDatabase)(region, env, request, userId);
+            return getWrappedDatabase(region, env, request, userId);
         }
         // Otherwise, return unwrapped client (backward compatibility)
         // Get region-specific database connection
         // Uses existing createPrismaForRegion which handles connection string selection
-        return (0, db_1.createPrismaForRegion)(region, env);
+        return createPrismaForRegion(region, env);
     }
     /**
      * Create a user in the region-specific database
@@ -266,7 +235,7 @@ class DataRouter {
      */
     static async createUser(userData, region, env, request, requestId) {
         // CRITICAL: Validate region before routing
-        if (!(0, region_detection_1.isValidRegion)(region)) {
+        if (!isValidRegion(region)) {
             throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
         }
         // OPTIMIZATION: For test users, use executeWithRetry with appropriate timeout
@@ -288,10 +257,14 @@ class DataRouter {
         // Allow 1 retry in CI for transient connection issues, no retries locally for speed
         const testUserMaxRetries = isCI ? 1 : 0;
         // Use executeWithRetry for proper timeout protection (connection + query)
-        const { sharedDatabaseConnectionManager } = await Promise.resolve().then(() => __importStar(require("./database-connection-manager")));
-        const logger = logger_1.Logger.getInstance(env);
+        const { sharedDatabaseConnectionManager } = await import("./database-connection-manager.js");
+        const logger = getLogger();
         const dbWriteStartTime = Date.now();
         const user = await sharedDatabaseConnectionManager.executeWithRetry(region, env, async (db) => {
+            // S-CP2: handle is non-null + unique. Derive one unless the caller
+            // supplied it, so this provisioning path upholds the invariant too.
+            const handle = (typeof userData.handle === "string" && userData.handle) ||
+                (await deriveUniqueHandle(db, userData.email, userData.id));
             // OPTIMIZATION: For test users, try create first (faster than upsert)
             // If user already exists, fall back to upsert
             // This optimizes the common case where test users are new
@@ -300,6 +273,7 @@ class DataRouter {
                     return await db.user.create({
                         data: {
                             ...userData,
+                            handle,
                             region,
                             dataRegion: region, // CRITICAL: Must match region
                         },
@@ -329,6 +303,7 @@ class DataRouter {
                 where: { id: userData.id },
                 create: {
                     ...userData,
+                    handle,
                     region,
                     dataRegion: region, // CRITICAL: Must match region
                 },
@@ -384,19 +359,19 @@ class DataRouter {
                     userId: user.id, // User creating themselves
                     region: region,
                     dataRegion: user.dataRegion || region,
-                    ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                    ipAddress: request ? getIPAddress(request) : undefined,
                     userAgent: request?.headers.get("User-Agent") || undefined,
                     success: true,
                 }, env)
                     .catch((auditError) => {
                     // Don't fail the operation if audit logging fails
                     // Error is already logged by AuditLogger
-                    logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for user creation:", auditError);
+                    getLogger().warn("[DataRouter] Audit logging failed for user creation:", auditError);
                 });
             }
             catch (auditError) {
                 // Don't fail the operation if audit logging fails
-                logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging setup failed for user creation:", auditError);
+                getLogger().warn("[DataRouter] Audit logging setup failed for user creation:", auditError);
             }
         }
         return user;
@@ -419,7 +394,7 @@ class DataRouter {
      */
     static async getUser(userId, region, env, request, requestId, requestingUserId) {
         // CRITICAL: Validate region before routing
-        if (!(0, region_detection_1.isValidRegion)(region)) {
+        if (!isValidRegion(region)) {
             throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
         }
         // Get region-specific database (with monitoring/rate limiting if request provided)
@@ -444,7 +419,7 @@ class DataRouter {
                     userId: requestingUserId,
                     region: region,
                     dataRegion: user.dataRegion,
-                    ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                    ipAddress: request ? getIPAddress(request) : undefined,
                     userAgent: request?.headers.get("User-Agent") || undefined,
                     severity: "high",
                     success: false,
@@ -455,7 +430,7 @@ class DataRouter {
                 }, env);
             }
             catch (auditError) {
-                logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for cross-region access:", auditError);
+                getLogger().warn("[DataRouter] Audit logging failed for cross-region access:", auditError);
             }
             // Return null instead of throwing (don't expose cross-region data)
             return null;
@@ -470,14 +445,14 @@ class DataRouter {
                 userId: requestingUserId,
                 region: region,
                 dataRegion: user?.dataRegion || region,
-                ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                ipAddress: request ? getIPAddress(request) : undefined,
                 userAgent: request?.headers.get("User-Agent") || undefined,
                 success: user !== null,
             }, env);
         }
         catch (auditError) {
             // Don't fail the operation if audit logging fails
-            logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for user access:", auditError);
+            getLogger().warn("[DataRouter] Audit logging failed for user access:", auditError);
         }
         return user;
     }
@@ -500,7 +475,7 @@ class DataRouter {
      */
     static async updateUser(userId, updateData, region, env, request, requestId, requestingUserId) {
         // CRITICAL: Validate region before routing
-        if (!(0, region_detection_1.isValidRegion)(region)) {
+        if (!isValidRegion(region)) {
             throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
         }
         // CRITICAL: Prevent dataRegion from being changed
@@ -529,7 +504,7 @@ class DataRouter {
                 userId: requestingUserId || userId,
                 region: region,
                 dataRegion: user.dataRegion || region,
-                ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                ipAddress: request ? getIPAddress(request) : undefined,
                 userAgent: request?.headers.get("User-Agent") || undefined,
                 metadata: {
                     updatedFields: Object.keys(updateData),
@@ -539,7 +514,7 @@ class DataRouter {
         }
         catch (auditError) {
             // Don't fail the operation if audit logging fails
-            logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for user update:", auditError);
+            getLogger().warn("[DataRouter] Audit logging failed for user update:", auditError);
         }
         return user;
     }
@@ -560,7 +535,7 @@ class DataRouter {
      */
     static async createPost(postData, region, env, request, requestId, session) {
         // CRITICAL: Validate region before routing
-        if (!(0, region_detection_1.isValidRegion)(region)) {
+        if (!isValidRegion(region)) {
             throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
         }
         // Get region-specific database (with monitoring/rate limiting if request provided)
@@ -568,7 +543,7 @@ class DataRouter {
         // Prisma's transaction timeout mechanism tries to serialize the callback, and Proxies contain Symbols
         const wrappedDb = this.getDatabaseForRegion(region, env, request, postData.authorId);
         // Get unwrapped Prisma client for transactions to avoid Proxy Symbol serialization
-        const { getUnwrappedDatabase } = await Promise.resolve().then(() => __importStar(require("./database-wrapper-helper")));
+        const { getUnwrappedDatabase } = await import("./database-wrapper-helper.js");
         const db = request ? getUnwrappedDatabase(region, env) : wrappedDb;
         // Extract entityRefs (will be handled separately in transaction)
         const entityRefs = postData.entityRefs || [];
@@ -590,7 +565,7 @@ class DataRouter {
                 sanitizedPostData.geoData = serialized;
             }
             catch (e) {
-                logger_1.Logger.getInstance(env).warn("[DataRouter] geoData is not serializable, skipping:", e);
+                getLogger().warn("[DataRouter] geoData is not serializable, skipping:", e);
             }
         }
         if (postData.contentWarnings !== undefined &&
@@ -609,8 +584,8 @@ class DataRouter {
         const result = await db.$transaction(async (tx) => {
             // Validate entity tagging permissions within transaction (if entities provided and session available)
             if (entityRefs.length > 0 && session) {
-                const { validateEntityTagging } = await Promise.resolve().then(() => __importStar(require("./entity-tagging-validator")));
-                const { FriendsHandler } = await Promise.resolve().then(() => __importStar(require("./friends-handler")));
+                const { validateEntityTagging } = await import("./entity-tagging-validator.js");
+                const { FriendsHandler } = await import("./friends-handler.js");
                 const friendsHandler = new FriendsHandler();
                 // Sanitize session object to avoid Symbol serialization issues
                 const sanitizedSession = {
@@ -629,6 +604,7 @@ class DataRouter {
                 authorId: sanitizedPostData.authorId,
                 text: sanitizedPostData.text,
                 visibility: sanitizedPostData.visibility,
+                tenantId: String(postData.tenantId), // Tenancy: stamp active tenant (NON-NULL)
                 dataRegion: region, // CRITICAL: Must match region
             };
             // Only add optional fields if they exist
@@ -659,6 +635,8 @@ class DataRouter {
             if (media.length > 0) {
                 await tx.postMedia.createMany({
                     data: media.map((m, index) => ({
+                        // PostMedia inherits the owning post's tenant.
+                        tenantId: post.tenantId,
                         postId: post.id,
                         mediaId: m.id,
                         alt: m.alt || "",
@@ -692,7 +670,7 @@ class DataRouter {
                 userId: postData.authorId,
                 region: region,
                 dataRegion: result.dataRegion || region,
-                ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                ipAddress: request ? getIPAddress(request) : undefined,
                 userAgent: request?.headers.get("User-Agent") || undefined,
                 metadata: {
                     visibility: postData.visibility,
@@ -704,7 +682,7 @@ class DataRouter {
         }
         catch (auditError) {
             // Don't fail the operation if audit logging fails
-            logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for post creation:", auditError);
+            getLogger().warn("[DataRouter] Audit logging failed for post creation:", auditError);
         }
         return result;
     }
@@ -726,7 +704,7 @@ class DataRouter {
      */
     static async getPost(postId, region, env, request, requestId, requestingUserId) {
         // CRITICAL: Validate region before routing
-        if (!(0, region_detection_1.isValidRegion)(region)) {
+        if (!isValidRegion(region)) {
             throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
         }
         // Get region-specific database (with monitoring if request provided)
@@ -750,7 +728,7 @@ class DataRouter {
                     userId: requestingUserId,
                     region: region,
                     dataRegion: post.dataRegion,
-                    ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                    ipAddress: request ? getIPAddress(request) : undefined,
                     userAgent: request?.headers.get("User-Agent") || undefined,
                     severity: "high",
                     success: false,
@@ -761,7 +739,7 @@ class DataRouter {
                 }, env);
             }
             catch (auditError) {
-                logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for cross-region access:", auditError);
+                getLogger().warn("[DataRouter] Audit logging failed for cross-region access:", auditError);
             }
             // Return null instead of throwing (don't expose cross-region data)
             return null;
@@ -776,17 +754,16 @@ class DataRouter {
                 userId: requestingUserId,
                 region: region,
                 dataRegion: post?.dataRegion || region,
-                ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                ipAddress: request ? getIPAddress(request) : undefined,
                 userAgent: request?.headers.get("User-Agent") || undefined,
                 success: post !== null,
             }, env);
         }
         catch (auditError) {
             // Don't fail the operation if audit logging fails
-            logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for post access:", auditError);
+            getLogger().warn("[DataRouter] Audit logging failed for post access:", auditError);
         }
         return post;
     }
 }
-exports.DataRouter = DataRouter;
 //# sourceMappingURL=data-router.js.map