@hasna/tenants 0.1.0

package/dist/index.js

@@ -0,0 +1,2129 @@
+// @bun
+// src/generated/storage-kit/mode.ts
+var DEPRECATED_STORAGE_MODE_ALIASES = [
+  "remote",
+  "hybrid",
+  "self_hosted"
+];
+function normalizeStorageMode(value) {
+  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  if (normalized === "local")
+    return { mode: "local", deprecatedAlias: null };
+  if (normalized === "cloud")
+    return { mode: "cloud", deprecatedAlias: null };
+  if (DEPRECATED_STORAGE_MODE_ALIASES.includes(normalized)) {
+    return { mode: "cloud", deprecatedAlias: normalized };
+  }
+  throw new Error(`Unknown storage mode: ${value}. Use local or cloud.`);
+}
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function storageEnvKeys(name) {
+  const token = envToken(name);
+  return {
+    modeKeys: [`HASNA_${token}_STORAGE_MODE`, `${token}_STORAGE_MODE`],
+    databaseUrlKeys: [`HASNA_${token}_DATABASE_URL`, `${token}_DATABASE_URL`]
+  };
+}
+function firstEnv(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+function resolveStorageMode(name, env = process.env) {
+  const { modeKeys, databaseUrlKeys } = storageEnvKeys(name);
+  const dbHit = firstEnv(env, databaseUrlKeys);
+  const databaseUrlPresent = Boolean(dbHit);
+  const databaseUrlSource = dbHit ? dbHit.key : null;
+  const modeHit = firstEnv(env, modeKeys);
+  if (!modeHit) {
+    return {
+      mode: "local",
+      source: "default",
+      deprecatedAlias: null,
+      databaseUrlPresent,
+      databaseUrlSource,
+      warning: null
+    };
+  }
+  const { mode, deprecatedAlias } = normalizeStorageMode(modeHit.value);
+  const warnings = [];
+  if (deprecatedAlias) {
+    warnings.push(`Deprecated storage mode '${deprecatedAlias}' from ${modeHit.key} is treated as 'cloud'. Set ${modeKeys[0]}=cloud instead.`);
+  }
+  if (mode === "cloud" && !databaseUrlPresent) {
+    warnings.push(`cloud mode needs ${databaseUrlKeys[0]} (PURE REMOTE: reads and writes go to cloud Postgres).`);
+  }
+  if (modeHit.key !== modeKeys[0]) {
+    warnings.push(`Using alias env ${modeHit.key}; the canonical key is ${modeKeys[0]}.`);
+  }
+  return {
+    mode,
+    source: modeHit.key,
+    deprecatedAlias,
+    databaseUrlPresent,
+    databaseUrlSource,
+    warning: warnings.length > 0 ? warnings.join(" ") : null
+  };
+}
+function resolveDatabaseUrl(name, env = process.env) {
+  const { databaseUrlKeys } = storageEnvKeys(name);
+  const hit = firstEnv(env, databaseUrlKeys);
+  return hit ? hit.value : null;
+}
+// src/generated/storage-kit/tls.ts
+import { readFileSync } from "fs";
+function sslModeFromConnectionString(connectionString) {
+  const queryStart = connectionString.indexOf("?");
+  const params = new URLSearchParams(queryStart === -1 ? "" : connectionString.slice(queryStart + 1));
+  const sslmode = params.get("sslmode")?.trim().toLowerCase();
+  if (sslmode) {
+    switch (sslmode) {
+      case "disable":
+      case "prefer":
+      case "require":
+      case "verify-ca":
+      case "verify-full":
+        return sslmode;
+      case "allow":
+        return "prefer";
+      default:
+        throw new Error(`Unknown sslmode '${sslmode}' in connection string.`);
+    }
+  }
+  const ssl = params.get("ssl")?.trim().toLowerCase();
+  if (ssl && ["1", "true", "yes", "on", "require"].includes(ssl))
+    return "require";
+  return "disable";
+}
+function loadCaBundle(options) {
+  const env = options.env ?? process.env;
+  if (options.ca && options.ca.trim())
+    return options.ca;
+  const path = options.caCertPath ?? env.PGSSLROOTCERT ?? env.NODE_EXTRA_CA_CERTS;
+  if (path && path.trim())
+    return readFileSync(path.trim(), "utf8");
+  return null;
+}
+function resolveTlsConfig(connectionString, options = {}) {
+  const mode = sslModeFromConnectionString(connectionString);
+  if (mode === "disable" || mode === "prefer") {
+    return;
+  }
+  const ca = loadCaBundle(options);
+  if (mode === "require") {
+    return ca ? { rejectUnauthorized: false, ca } : { rejectUnauthorized: false };
+  }
+  if (!ca) {
+    throw new Error(`sslmode=${mode} requires a CA bundle. Set PGSSLROOTCERT (or pass caCertPath/ca) to the ` + `Amazon RDS global bundle: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`);
+  }
+  return { rejectUnauthorized: true, ca };
+}
+// src/generated/storage-kit/query.ts
+function wrapExecutor(executor) {
+  return {
+    async query(sql, params) {
+      const result = await executor.query(sql, params);
+      return { rows: result.rows, rowCount: result.rowCount ?? result.rows.length };
+    },
+    async many(sql, params) {
+      const result = await executor.query(sql, params);
+      return result.rows;
+    },
+    async get(sql, params) {
+      const result = await executor.query(sql, params);
+      return result.rows[0] ?? null;
+    },
+    async one(sql, params) {
+      const result = await executor.query(sql, params);
+      if (result.rows.length !== 1) {
+        throw new Error(`Expected exactly one row, got ${result.rows.length}.`);
+      }
+      return result.rows[0];
+    },
+    async execute(sql, params) {
+      await executor.query(sql, params);
+    }
+  };
+}
+function createQueryClient(pool) {
+  const base = wrapExecutor(pool);
+  return {
+    ...base,
+    pool,
+    async transaction(fn) {
+      const client = await pool.connect();
+      try {
+        await client.query("BEGIN");
+        const result = await fn(wrapExecutor(client));
+        await client.query("COMMIT");
+        return result;
+      } catch (error) {
+        try {
+          await client.query("ROLLBACK");
+        } catch {}
+        throw error;
+      } finally {
+        client.release();
+      }
+    },
+    async close() {
+      await pool.end();
+    }
+  };
+}
+// src/generated/storage-kit/pool.ts
+import pg from "pg";
+function createPgPool(options) {
+  const ssl = resolveTlsConfig(options.connectionString, {
+    ...options.ca !== undefined ? { ca: options.ca } : {},
+    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
+    ...options.env !== undefined ? { env: options.env } : {}
+  });
+  const config = { connectionString: options.connectionString };
+  if (ssl !== undefined)
+    config.ssl = ssl;
+  if (options.max !== undefined)
+    config.max = options.max;
+  if (options.idleTimeoutMillis !== undefined)
+    config.idleTimeoutMillis = options.idleTimeoutMillis;
+  if (options.connectionTimeoutMillis !== undefined)
+    config.connectionTimeoutMillis = options.connectionTimeoutMillis;
+  if (options.applicationName !== undefined)
+    config.application_name = options.applicationName;
+  return new pg.Pool(config);
+}
+function createCloudPoolFromEnv(appName, options = {}) {
+  const env = options.env ?? process.env;
+  const resolution = resolveStorageMode(appName, env);
+  if (resolution.mode !== "cloud") {
+    throw new Error(`createCloudPoolFromEnv requires ${appName} storage mode 'cloud', got '${resolution.mode}'. ` + `Set HASNA_${appName.toUpperCase().replace(/-/g, "_")}_STORAGE_MODE=cloud.`);
+  }
+  const connectionString = resolveDatabaseUrl(appName, env);
+  if (!connectionString) {
+    throw new Error(`cloud mode for ${appName} needs a database URL. Set ` + `HASNA_${appName.toUpperCase().replace(/-/g, "_")}_DATABASE_URL.`);
+  }
+  const pool = createPgPool({
+    connectionString,
+    ...options.ca !== undefined ? { ca: options.ca } : {},
+    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
+    env,
+    ...options.max !== undefined ? { max: options.max } : {},
+    ...options.idleTimeoutMillis !== undefined ? { idleTimeoutMillis: options.idleTimeoutMillis } : {},
+    ...options.connectionTimeoutMillis !== undefined ? { connectionTimeoutMillis: options.connectionTimeoutMillis } : {},
+    ...options.applicationName !== undefined ? { applicationName: options.applicationName } : {}
+  });
+  return {
+    client: createQueryClient(pool),
+    connectionSource: resolution.databaseUrlSource ?? "unknown"
+  };
+}
+// src/generated/storage-kit/migrations.ts
+import { createHash } from "crypto";
+var DEFAULT_MIGRATION_LEDGER_TABLE = "schema_migrations";
+function checksumSql(sql) {
+  const normalized = sql.trim().replace(/\r\n/g, `
+`);
+  return `sha256:${createHash("sha256").update(normalized).digest("hex")}`;
+}
+function defineMigration(id, sql) {
+  return Object.freeze({ id, sql: sql.trim(), checksum: checksumSql(sql) });
+}
+
+class MigrationLedger {
+  client;
+  migrations;
+  ledgerTable;
+  constructor(client, migrations, options = {}) {
+    this.client = client;
+    this.migrations = migrations;
+    this.ledgerTable = options.ledgerTable ?? DEFAULT_MIGRATION_LEDGER_TABLE;
+    const seen = new Set;
+    for (const migration of migrations) {
+      if (seen.has(migration.id))
+        throw new Error(`Duplicate migration id: ${migration.id}`);
+      seen.add(migration.id);
+    }
+  }
+  async ensureLedger() {
+    await this.client.execute(`CREATE TABLE IF NOT EXISTS ${this.ledgerTable} (
+         id TEXT PRIMARY KEY,
+         checksum TEXT NOT NULL,
+         applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+       )`);
+  }
+  async listApplied() {
+    await this.ensureLedger();
+    return this.readApplied();
+  }
+  async readApplied() {
+    const rows = await this.client.many(`SELECT id, checksum, applied_at FROM ${this.ledgerTable} ORDER BY id ASC`);
+    return rows.map((row) => ({
+      id: row.id,
+      checksum: row.checksum,
+      appliedAt: row.applied_at instanceof Date ? row.applied_at.toISOString() : String(row.applied_at)
+    }));
+  }
+  buildPlan(applied) {
+    const known = new Set(this.migrations.map((m) => m.id));
+    for (const row of applied) {
+      if (!known.has(row.id)) {
+        throw new Error(`Applied migration '${row.id}' is not recognized by this build (downgrade?).`);
+      }
+    }
+    const appliedById = new Map(applied.map((row) => [row.id, row]));
+    for (const migration of this.migrations) {
+      const existing = appliedById.get(migration.id);
+      if (existing && existing.checksum !== migration.checksum) {
+        throw new Error(`Migration checksum mismatch for '${migration.id}': the SQL changed after it was applied.`);
+      }
+    }
+    return this.migrations.map((migration) => ({
+      migration,
+      state: appliedById.has(migration.id) ? "already_applied" : "pending"
+    }));
+  }
+  async migrate(opts = {}) {
+    const dryRun = opts.dryRun === true;
+    await this.ensureLedger();
+    const applied = await this.readApplied();
+    const plan = this.buildPlan(applied);
+    if (dryRun)
+      return { dryRun, applied, plan };
+    for (const item of plan) {
+      if (item.state === "already_applied")
+        continue;
+      await this.client.execute(item.migration.sql);
+      await this.client.execute(`INSERT INTO ${this.ledgerTable} (id, checksum, applied_at) VALUES ($1, $2, now())`, [item.migration.id, item.migration.checksum]);
+    }
+    return { dryRun, applied: await this.readApplied(), plan };
+  }
+}
+// src/generated/storage-kit/health.ts
+async function checkHealth(client) {
+  const start = Date.now();
+  try {
+    await client.get("SELECT 1 AS ok");
+    return { ok: true, latencyMs: Date.now() - start };
+  } catch (error) {
+    return {
+      ok: false,
+      latencyMs: Date.now() - start,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function checkReady(client, migrations, options = {}) {
+  const start = Date.now();
+  try {
+    const ledger = new MigrationLedger(client, migrations, options);
+    const result = await ledger.migrate({ dryRun: true });
+    const pending = result.plan.filter((item) => item.state === "pending").map((item) => item.migration.id);
+    return { ok: pending.length === 0, latencyMs: Date.now() - start, pendingMigrations: pending };
+  } catch (error) {
+    return {
+      ok: false,
+      latencyMs: Date.now() - start,
+      pendingMigrations: [],
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+// src/migrations.ts
+import { apiKeyMigrations } from "@hasna/contracts/auth";
+
+// src/idp/migrations.ts
+var TENANTS_TABLE = "tenants";
+var USERS_TABLE = "users";
+var SERVICE_PRINCIPALS_TABLE = "service_principals";
+var MEMBERSHIPS_TABLE = "memberships";
+var SESSIONS_TABLE = "sessions";
+var AUTH_CHALLENGES_TABLE = "auth_challenges";
+var JWT_SIGNING_KEYS_TABLE = "jwt_signing_keys";
+function idpMigrations(apiKeysTable) {
+  return [
+    defineMigration("tenants_0001_tenants", `CREATE TABLE IF NOT EXISTS ${TENANTS_TABLE} (
+         id          UUID PRIMARY KEY,
+         slug        TEXT UNIQUE NOT NULL,
+         name        TEXT NOT NULL,
+         kind        TEXT NOT NULL DEFAULT 'org',
+         parent_id   UUID REFERENCES ${TENANTS_TABLE}(id),
+         status      TEXT NOT NULL DEFAULT 'active',
+         identity_id TEXT,
+         metadata    JSONB NOT NULL DEFAULT '{}'::jsonb,
+         created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+         updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+       )`),
+    defineMigration("tenants_0002_users", `CREATE TABLE IF NOT EXISTS ${USERS_TABLE} (
+         id            UUID PRIMARY KEY,
+         kind          TEXT NOT NULL,
+         email         TEXT UNIQUE,
+         display_name  TEXT,
+         identity_id   TEXT,
+         home_tenant_id UUID REFERENCES ${TENANTS_TABLE}(id),
+         auth_method   TEXT,
+         password_hash TEXT,
+         status        TEXT NOT NULL DEFAULT 'active',
+         metadata      JSONB NOT NULL DEFAULT '{}'::jsonb,
+         created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+         updated_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+         email_verified_at TIMESTAMPTZ
+       )`),
+    defineMigration("tenants_0003_service_principals", `CREATE TABLE IF NOT EXISTS ${SERVICE_PRINCIPALS_TABLE} (
+         id            UUID PRIMARY KEY,
+         tenant_id     UUID NOT NULL REFERENCES ${TENANTS_TABLE}(id),
+         kind          TEXT NOT NULL DEFAULT 'machine',
+         display_name  TEXT,
+         identity_id   TEXT,
+         enrollment_secret_ref TEXT,
+         status        TEXT NOT NULL DEFAULT 'active',
+         metadata      JSONB NOT NULL DEFAULT '{}'::jsonb,
+         created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+         last_seen_at  TIMESTAMPTZ
+       )`),
+    defineMigration("tenants_0004_memberships", `CREATE TABLE IF NOT EXISTS ${MEMBERSHIPS_TABLE} (
+         id             BIGSERIAL PRIMARY KEY,
+         tenant_id      UUID NOT NULL REFERENCES ${TENANTS_TABLE}(id),
+         principal_id   UUID NOT NULL,
+         principal_type TEXT NOT NULL,
+         role           TEXT NOT NULL,
+         scopes         JSONB NOT NULL DEFAULT '[]'::jsonb,
+         status         TEXT NOT NULL DEFAULT 'active',
+         created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+         UNIQUE (tenant_id, principal_id, principal_type)
+       )`),
+    defineMigration("tenants_0005_sessions", `CREATE TABLE IF NOT EXISTS ${SESSIONS_TABLE} (
+         id         UUID PRIMARY KEY,
+         user_id    UUID REFERENCES ${USERS_TABLE}(id),
+         tenant_id  UUID REFERENCES ${TENANTS_TABLE}(id),
+         token_hash TEXT UNIQUE NOT NULL,
+         method     TEXT,
+         issued_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+         expires_at TIMESTAMPTZ,
+         revoked_at TIMESTAMPTZ,
+         ip         TEXT,
+         user_agent TEXT
+       )`),
+    defineMigration("tenants_0006_auth_challenges", `CREATE TABLE IF NOT EXISTS ${AUTH_CHALLENGES_TABLE} (
+         id          UUID PRIMARY KEY,
+         email       TEXT NOT NULL,
+         code_hash   TEXT NOT NULL,
+         purpose     TEXT NOT NULL,
+         expires_at  TIMESTAMPTZ NOT NULL,
+         consumed_at TIMESTAMPTZ,
+         attempts    INT NOT NULL DEFAULT 0,
+         created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+       )`),
+    defineMigration("tenants_0007_auth_challenges_email_idx", `CREATE INDEX IF NOT EXISTS ${AUTH_CHALLENGES_TABLE}_email_idx
+         ON ${AUTH_CHALLENGES_TABLE} (email, purpose, created_at DESC)`),
+    defineMigration("tenants_0008_jwt_signing_keys", `CREATE TABLE IF NOT EXISTS ${JWT_SIGNING_KEYS_TABLE} (
+         kid         TEXT PRIMARY KEY,
+         alg         TEXT NOT NULL DEFAULT 'EdDSA',
+         public_jwk  JSONB NOT NULL,
+         private_jwk JSONB NOT NULL,
+         status      TEXT NOT NULL DEFAULT 'active',
+         created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+         retired_at  TIMESTAMPTZ
+       )`),
+    defineMigration("tenants_0009_memberships_principal_idx", `CREATE INDEX IF NOT EXISTS ${MEMBERSHIPS_TABLE}_principal_idx
+         ON ${MEMBERSHIPS_TABLE} (principal_id, principal_type)`),
+    defineMigration("tenants_0010_api_keys_tenant", `ALTER TABLE ${apiKeysTable} ADD COLUMN IF NOT EXISTS tenant_id UUID;
+       ALTER TABLE ${apiKeysTable} ADD COLUMN IF NOT EXISTS user_id UUID;
+       ALTER TABLE ${apiKeysTable} ADD COLUMN IF NOT EXISTS principal_type TEXT;`),
+    defineMigration("tenants_0011_api_keys_tenant_idx", `CREATE INDEX IF NOT EXISTS ${apiKeysTable}_tenant_idx ON ${apiKeysTable} (tenant_id)`)
+  ];
+}
+
+// src/migrations.ts
+var API_KEYS_TABLE = "api_keys";
+function tenantsMigrations() {
+  return [
+    ...apiKeyMigrations(API_KEYS_TABLE).map((m) => defineMigration(m.id, m.sql)),
+    ...idpMigrations(API_KEYS_TABLE)
+  ];
+}
+
+// src/db.ts
+var TENANTS_APP_NAME = "tenants";
+function createCloudClient(options = {}) {
+  const { client, connectionSource } = createCloudPoolFromEnv(TENANTS_APP_NAME, {
+    applicationName: options.applicationName ?? "tenants-serve"
+  });
+  return {
+    client,
+    connectionSource,
+    close: async () => {
+      await client.close();
+    }
+  };
+}
+async function runTenantsMigrations(client, opts = {}) {
+  const ledger = new MigrationLedger(client, tenantsMigrations());
+  return ledger.migrate(opts);
+}
+async function cloudHealth(client) {
+  return checkHealth(client);
+}
+async function cloudReady(client) {
+  return checkReady(client, tenantsMigrations());
+}
+
+// src/idp/service.ts
+import { mintApiKey, hasScope } from "@hasna/contracts/auth";
+import { randomBytes as randomBytes2 } from "crypto";
+
+// src/idp/passwords.ts
+import { randomBytes, scryptSync, timingSafeEqual, createHash as createHash2 } from "crypto";
+var SCRYPT_COST = 16384;
+var KEY_LEN = 32;
+function hashPassword(password) {
+  const salt = randomBytes(16);
+  const derived = scryptSync(password, salt, KEY_LEN, { N: SCRYPT_COST });
+  return `scrypt$${SCRYPT_COST}$${salt.toString("base64url")}$${derived.toString("base64url")}`;
+}
+function verifyPassword(password, stored) {
+  const parts = stored.split("$");
+  if (parts.length !== 4 || parts[0] !== "scrypt")
+    return false;
+  const cost = Number(parts[1]);
+  if (!Number.isInteger(cost) || cost < 2)
+    return false;
+  let salt;
+  let expected;
+  try {
+    salt = Buffer.from(parts[2], "base64url");
+    expected = Buffer.from(parts[3], "base64url");
+  } catch {
+    return false;
+  }
+  const derived = scryptSync(password, salt, expected.length, { N: cost });
+  return derived.length === expected.length && timingSafeEqual(derived, expected);
+}
+function sha256(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+
+// src/idp/ids.ts
+import { createHash as createHash3, randomUUID } from "crypto";
+var DNS_NAMESPACE = Buffer.from("6ba7b8109dad11d180b400c04fd430c8", "hex");
+function uuidv5(name, namespace) {
+  const hash = createHash3("sha1");
+  hash.update(namespace);
+  hash.update(Buffer.from(name, "utf8"));
+  const bytes = hash.digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = Buffer.from(bytes).toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function parseUuid(uuid) {
+  return Buffer.from(uuid.replace(/-/g, ""), "hex");
+}
+var HASNA_TENANT_NAMESPACE = uuidv5("hasna.xyz", DNS_NAMESPACE);
+function deriveTenantId(slug, kind) {
+  return uuidv5(`tenant:${slug}:${kind}`, parseUuid(HASNA_TENANT_NAMESPACE));
+}
+var ROOT_TENANT_ID = "adfd95c7-ee8b-52cb-ae47-4ae65dae3313";
+var ROOT_TENANT_SLUG = "hasna";
+var SEED_TENANTS = [
+  { id: ROOT_TENANT_ID, slug: ROOT_TENANT_SLUG, name: "Hasna", kind: "root", parentId: null },
+  { id: deriveTenantId("hasnastudio", "brand"), slug: "hasnastudio", name: "Hasna Studio", kind: "brand", parentId: ROOT_TENANT_ID },
+  { id: deriveTenantId("hasnafamily", "brand"), slug: "hasnafamily", name: "Hasna Family", kind: "brand", parentId: ROOT_TENANT_ID },
+  { id: deriveTenantId("hasnatools", "brand"), slug: "hasnatools", name: "Hasna Tools", kind: "brand", parentId: ROOT_TENANT_ID }
+];
+function newId() {
+  return randomUUID();
+}
+
+// src/idp/tokens.ts
+import { createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from "crypto";
+var TOKEN_TYPE = "at+jwt";
+var TOKEN_ALG = "EdDSA";
+var TOKEN_ISSUER = "identities";
+var DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 24 * 60 * 60;
+function b64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function b64urlJson(value) {
+  return b64url(JSON.stringify(value));
+}
+function signingKeyFromPrivateJwk(kid, privateJwk) {
+  const privateKey = createPrivateKey({ key: privateJwk, format: "jwk" });
+  const publicKey = createPublicKey(privateKey);
+  const pub = publicKey.export({ format: "jwk" });
+  if (pub.crv !== "Ed25519" || !pub.x) {
+    throw new Error("Signing key must be an Ed25519 (OKP) key.");
+  }
+  return {
+    kid,
+    privateKey,
+    publicJwk: { kty: "OKP", crv: "Ed25519", x: pub.x, kid, use: "sig", alg: "EdDSA" }
+  };
+}
+function buildJwks(publicJwks) {
+  return { keys: publicJwks };
+}
+function signAccessToken(key, input) {
+  const nowSec = Math.floor((input.nowMs ?? Date.now()) / 1000);
+  const ttl = input.ttlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
+  const claims = {
+    iss: TOKEN_ISSUER,
+    aud: input.aud,
+    sub: input.sub,
+    tid: input.tid,
+    pt: input.pt,
+    scope: input.scope,
+    iat: nowSec,
+    exp: nowSec + ttl,
+    jti: input.jti
+  };
+  const header = { alg: TOKEN_ALG, kid: key.kid, typ: TOKEN_TYPE };
+  const signingInput = `${b64urlJson(header)}.${b64urlJson(claims)}`;
+  const signature = edSign(null, Buffer.from(signingInput), key.privateKey);
+  return { token: `${signingInput}.${b64url(signature)}`, claims };
+}
+function verifyAccessToken(token, options) {
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    return { ok: false, reason: "malformed" };
+  const [headerB64, payloadB64, sigB64] = parts;
+  let header;
+  let claims;
+  try {
+    header = JSON.parse(Buffer.from(headerB64, "base64url").toString("utf8"));
+    claims = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (header.alg !== TOKEN_ALG)
+    return { ok: false, reason: "unsupported_alg" };
+  if (!header.kid)
+    return { ok: false, reason: "missing_kid" };
+  const jwk = options.jwks.find((k) => k.kid === header.kid);
+  if (!jwk)
+    return { ok: false, reason: "unknown_kid" };
+  let verified = false;
+  try {
+    const publicKey = createPublicKey({ key: jwk, format: "jwk" });
+    verified = edVerify(null, Buffer.from(`${headerB64}.${payloadB64}`), publicKey, Buffer.from(sigB64, "base64url"));
+  } catch {
+    return { ok: false, reason: "bad_signature" };
+  }
+  if (!verified)
+    return { ok: false, reason: "bad_signature" };
+  if (claims.iss !== TOKEN_ISSUER)
+    return { ok: false, reason: "issuer_mismatch" };
+  if (options.expectedAudience && claims.aud !== options.expectedAudience) {
+    return { ok: false, reason: "audience_mismatch" };
+  }
+  const nowSec = Math.floor((options.nowMs ?? Date.now()) / 1000);
+  const leeway = options.leewaySeconds ?? 0;
+  if (typeof claims.exp === "number" && nowSec > claims.exp + leeway) {
+    return { ok: false, reason: "expired" };
+  }
+  if (typeof claims.iat === "number" && claims.iat - leeway > nowSec) {
+    return { ok: false, reason: "not_yet_valid" };
+  }
+  return { ok: true, claims, kid: header.kid };
+}
+function looksLikeAccessToken(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    return false;
+  try {
+    const header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+    return header?.typ === TOKEN_TYPE || header?.alg === TOKEN_ALG;
+  } catch {
+    return false;
+  }
+}
+
+// src/idp/policy.ts
+var DEFAULT_ALLOWED_EMAIL_DOMAINS = [
+  "hasna.academy",
+  "hasna.agency",
+  "hasna.ai",
+  "hasna.app",
+  "hasna.army",
+  "hasna.art",
+  "hasna.asia",
+  "hasna.autos",
+  "hasna.band",
+  "hasna.best",
+  "hasna.bio",
+  "hasna.blog",
+  "hasna.builders",
+  "hasna.business",
+  "hasna.cafe",
+  "hasna.camp",
+  "hasna.capital",
+  "hasna.care",
+  "hasna.career",
+  "hasna.careers",
+  "hasna.cash",
+  "hasna.cc",
+  "hasna.center",
+  "hasna.charity",
+  "hasna.chat",
+  "hasna.city",
+  "hasna.clinic",
+  "hasna.clothing",
+  "hasna.cloud",
+  "hasna.club",
+  "hasna.co.uk",
+  "hasna.coach",
+  "hasna.codes",
+  "hasna.coffee",
+  "hasna.com",
+  "hasna.community",
+  "hasna.company",
+  "hasna.computer",
+  "hasna.construction",
+  "hasna.consulting",
+  "hasna.contact",
+  "hasna.cool",
+  "hasna.day",
+  "hasna.deals",
+  "hasna.delivery",
+  "hasna.dev",
+  "hasna.digital",
+  "hasna.dog",
+  "hasna.domains",
+  "hasna.earth",
+  "hasna.eco",
+  "hasna.education",
+  "hasna.email",
+  "hasna.energy",
+  "hasna.engineering",
+  "hasna.enterprises",
+  "hasna.estate",
+  "hasna.events",
+  "hasna.exchange",
+  "hasna.expert",
+  "hasna.express",
+  "hasna.family",
+  "hasna.fan",
+  "hasna.fans",
+  "hasna.farm",
+  "hasna.finance",
+  "hasna.financial",
+  "hasna.fit",
+  "hasna.fitness",
+  "hasna.food",
+  "hasna.football",
+  "hasna.foundation",
+  "hasna.fund",
+  "hasna.gallery",
+  "hasna.games",
+  "hasna.global",
+  "hasna.gold",
+  "hasna.green",
+  "hasna.group",
+  "hasna.guide",
+  "hasna.guru",
+  "hasna.health",
+  "hasna.healthcare",
+  "hasna.holdings",
+  "hasna.homes",
+  "hasna.hospital",
+  "hasna.hosting",
+  "hasna.house",
+  "hasna.how",
+  "hasna.industries",
+  "hasna.info",
+  "hasna.ink",
+  "hasna.institute",
+  "hasna.international",
+  "hasna.investments",
+  "hasna.irish",
+  "hasna.land",
+  "hasna.legal",
+  "hasna.life",
+  "hasna.lifestyle",
+  "hasna.live",
+  "hasna.living",
+  "hasna.llc",
+  "hasna.loans",
+  "hasna.love",
+  "hasna.ltd",
+  "hasna.luxury",
+  "hasna.management",
+  "hasna.market",
+  "hasna.marketing",
+  "hasna.mba",
+  "hasna.md",
+  "hasna.media",
+  "hasna.mobi",
+  "hasna.money",
+  "hasna.net",
+  "hasna.network",
+  "hasna.news",
+  "hasna.ngo",
+  "hasna.ninja",
+  "hasna.one",
+  "hasna.ooo",
+  "hasna.page",
+  "hasna.partners",
+  "hasna.place",
+  "hasna.plus",
+  "hasna.pro",
+  "hasna.productions",
+  "hasna.properties",
+  "hasna.quest",
+  "hasna.red",
+  "hasna.rentals",
+  "hasna.review",
+  "hasna.reviews",
+  "hasna.rocks",
+  "hasna.run",
+  "hasna.sale",
+  "hasna.school",
+  "hasna.science",
+  "hasna.services",
+  "hasna.shopping",
+  "hasna.show",
+  "hasna.social",
+  "hasna.software",
+  "hasna.solar",
+  "hasna.solutions",
+  "hasna.space",
+  "hasna.store",
+  "hasna.studio",
+  "hasna.supply",
+  "hasna.support",
+  "hasna.systems",
+  "hasna.tax",
+  "hasna.team",
+  "hasna.tech",
+  "hasna.technology",
+  "hasna.today",
+  "hasna.tools",
+  "hasna.toys",
+  "hasna.trade",
+  "hasna.tv",
+  "hasna.university",
+  "hasna.us",
+  "hasna.vc",
+  "hasna.ventures",
+  "hasna.vip",
+  "hasna.vision",
+  "hasna.website",
+  "hasna.wiki",
+  "hasna.win",
+  "hasna.work",
+  "hasna.works",
+  "hasna.world",
+  "hasna.ws",
+  "hasna.wtf",
+  "hasna.xyz",
+  "hasna.zone"
+];
+var ALLOWED_EMAIL_DOMAINS_ENV = "HASNA_TENANTS_ALLOWED_EMAIL_DOMAINS";
+function emailDomain(email) {
+  const at = email.lastIndexOf("@");
+  if (at <= 0 || at === email.length - 1)
+    return null;
+  const domain = email.slice(at + 1).trim().toLowerCase();
+  if (!domain || domain.includes("@") || !domain.includes("."))
+    return null;
+  return domain;
+}
+function emailPolicyFromEnv(env = process.env) {
+  const disabled = env["HASNA_TENANTS_DISABLE_EMAIL_ALLOWLIST"] === "1";
+  const override = (env[ALLOWED_EMAIL_DOMAINS_ENV] ?? "").trim();
+  const domains = override ? override.split(",").map((d) => d.trim().toLowerCase()).filter(Boolean) : [...DEFAULT_ALLOWED_EMAIL_DOMAINS];
+  return {
+    allowedDomains: disabled ? null : new Set(domains),
+    requireConfirmation: env["HASNA_TENANTS_REQUIRE_EMAIL_CONFIRMATION"] !== "0"
+  };
+}
+function isEmailDomainAllowed(email, policy) {
+  if (!policy.allowedDomains)
+    return true;
+  const domain = emailDomain(email);
+  if (!domain)
+    return false;
+  return policy.allowedDomains.has(domain);
+}
+
+// src/idp/mailer.ts
+import { createHash as createHash4, createHmac } from "crypto";
+
+class NoopMailer {
+  async sendConfirmation(_input) {
+    return { skipped: true, reason: "email_disabled" };
+  }
+}
+function sha256Hex(data) {
+  return createHash4("sha256").update(data).digest("hex");
+}
+function hmac(key, data) {
+  return createHmac("sha256", key).update(data, "utf8").digest();
+}
+async function resolveAwsCredentials(env = process.env) {
+  const id = env["AWS_ACCESS_KEY_ID"];
+  const secret = env["AWS_SECRET_ACCESS_KEY"];
+  if (id && secret) {
+    return { accessKeyId: id, secretAccessKey: secret, ...env["AWS_SESSION_TOKEN"] ? { sessionToken: env["AWS_SESSION_TOKEN"] } : {} };
+  }
+  const relative = env["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"];
+  const full = env["AWS_CONTAINER_CREDENTIALS_FULL_URI"];
+  const url = relative ? `http://169.254.170.2${relative}` : full;
+  if (url) {
+    const headers = {};
+    const authToken = env["AWS_CONTAINER_AUTHORIZATION_TOKEN"];
+    if (authToken)
+      headers["Authorization"] = authToken;
+    const res = await fetch(url, { headers });
+    if (!res.ok)
+      throw new Error(`container credentials endpoint returned ${res.status}`);
+    const body = await res.json();
+    return { accessKeyId: body.AccessKeyId, secretAccessKey: body.SecretAccessKey, ...body.Token ? { sessionToken: body.Token } : {} };
+  }
+  throw new Error("No AWS credentials available (set AWS_ACCESS_KEY_ID/SECRET or run under an ECS task role).");
+}
+
+class SesMailer {
+  options;
+  constructor(options) {
+    this.options = options;
+  }
+  async sendConfirmation(input) {
+    const creds = this.options.credentials ?? await resolveAwsCredentials();
+    const region = this.options.region;
+    const host = `email.${region}.amazonaws.com`;
+    const path = "/v2/email/outbound-emails";
+    const endpoint = `https://${host}${path}`;
+    const login = input.purpose === "login";
+    const subject = login ? "Your Hasna login code" : "Confirm your Hasna account";
+    const bodyObj = {
+      FromEmailAddress: this.options.from,
+      Destination: { ToAddresses: [input.to] },
+      Content: {
+        Simple: {
+          Subject: { Data: subject, Charset: "UTF-8" },
+          Body: {
+            Text: { Data: confirmationText(input), Charset: "UTF-8" },
+            Html: { Data: confirmationHtml(input), Charset: "UTF-8" }
+          }
+        }
+      }
+    };
+    if (this.options.fromArn)
+      bodyObj["FromEmailAddressIdentityArn"] = this.options.fromArn;
+    const body = JSON.stringify(bodyObj);
+    const now = new Date;
+    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+    const dateStamp = amzDate.slice(0, 8);
+    const payloadHash = sha256Hex(body);
+    const canonicalHeaders = `content-type:application/json
+` + `host:${host}
+` + `x-amz-content-sha256:${payloadHash}
+` + `x-amz-date:${amzDate}
+` + (creds.sessionToken ? `x-amz-security-token:${creds.sessionToken}
+` : "");
+    const signedHeaders = creds.sessionToken ? "content-type;host;x-amz-content-sha256;x-amz-date;x-amz-security-token" : "content-type;host;x-amz-content-sha256;x-amz-date";
+    const canonicalRequest = ["POST", path, "", canonicalHeaders, signedHeaders, payloadHash].join(`
+`);
+    const scope = `${dateStamp}/${region}/ses/aws4_request`;
+    const stringToSign = ["AWS4-HMAC-SHA256", amzDate, scope, sha256Hex(canonicalRequest)].join(`
+`);
+    const kDate = hmac(`AWS4${creds.secretAccessKey}`, dateStamp);
+    const kRegion = hmac(kDate, region);
+    const kService = hmac(kRegion, "ses");
+    const kSigning = hmac(kService, "aws4_request");
+    const signature = createHmac("sha256", kSigning).update(stringToSign, "utf8").digest("hex");
+    const authorization = `AWS4-HMAC-SHA256 Credential=${creds.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+    const headers = {
+      "content-type": "application/json",
+      host,
+      "x-amz-content-sha256": payloadHash,
+      "x-amz-date": amzDate,
+      authorization
+    };
+    if (creds.sessionToken)
+      headers["x-amz-security-token"] = creds.sessionToken;
+    const res = await fetch(endpoint, { method: "POST", headers, body });
+    const text = await res.text();
+    if (!res.ok) {
+      let detail = text;
+      try {
+        const j = JSON.parse(text);
+        detail = j.message || j.Message || j.__type || text;
+      } catch {}
+      throw new Error(`SES send failed (${res.status}): ${detail}`);
+    }
+    let messageId;
+    try {
+      messageId = JSON.parse(text).MessageId;
+    } catch {}
+    return { ...messageId ? { messageId } : {} };
+  }
+}
+function confirmationText(i) {
+  const login = i.purpose === "login";
+  return [
+    login ? "Here is your Hasna login code." : "Welcome to Hasna.",
+    "",
+    `Your ${login ? "login" : "confirmation"} code is: ${i.code}`,
+    "",
+    `Or ${login ? "sign in" : "confirm"} in one click: ${i.link}`,
+    "",
+    `This code expires in ${i.expiresMinutes} minutes. If you did not request this, ignore this email.`
+  ].join(`
+`);
+}
+function confirmationHtml(i) {
+  const login = i.purpose === "login";
+  const safeLink = i.link.replace(/"/g, "&quot;");
+  return [
+    `<div style="font-family:system-ui,Segoe UI,Roboto,sans-serif;max-width:480px;margin:0 auto">`,
+    `<h2>${login ? "Your Hasna login code" : "Welcome to Hasna"}</h2>`,
+    `<p>Your ${login ? "login" : "confirmation"} code is:</p>`,
+    `<p style="font-size:28px;font-weight:700;letter-spacing:4px">${i.code}</p>`,
+    `<p>Or ${login ? "sign in" : "confirm"} in one click:</p>`,
+    `<p><a href="${safeLink}" style="background:#111;color:#fff;padding:10px 18px;border-radius:8px;text-decoration:none">${login ? "Sign in" : "Confirm my account"}</a></p>`,
+    `<p style="color:#666;font-size:13px">This code expires in ${i.expiresMinutes} minutes. If you did not request this, ignore this email.</p>`,
+    `</div>`
+  ].join("");
+}
+var MAIL_FROM_ENV = "HASNA_TENANTS_MAIL_FROM";
+var MAIL_ENABLED_ENV = "HASNA_TENANTS_EMAIL_ENABLED";
+var SES_REGION_ENV = "HASNA_TENANTS_SES_REGION";
+var SES_FROM_ARN_ENV = "HASNA_TENANTS_SES_FROM_ARN";
+var CONFIRM_URL_BASE_ENV = "HASNA_TENANTS_CONFIRM_URL_BASE";
+var DEFAULT_MAIL_FROM = "Hasna Tenants <auth@tenants.hasna.xyz>";
+var DEFAULT_CONFIRM_URL_BASE = "https://tenants.hasna.xyz";
+function confirmUrlBaseFromEnv(env = process.env) {
+  return (env[CONFIRM_URL_BASE_ENV] ?? DEFAULT_CONFIRM_URL_BASE).replace(/\/+$/, "");
+}
+function createMailerFromEnv(env = process.env) {
+  if (env[MAIL_ENABLED_ENV] !== "1")
+    return new NoopMailer;
+  const region = env[SES_REGION_ENV] || env["AWS_REGION"] || "us-east-1";
+  const from = env[MAIL_FROM_ENV] || DEFAULT_MAIL_FROM;
+  const fromArn = env[SES_FROM_ARN_ENV];
+  return new SesMailer({ region, from, ...fromArn ? { fromArn } : {} });
+}
+
+// src/idp/service.ts
+var SESSION_TTL_SECONDS = 24 * 60 * 60;
+var OTP_TTL_SECONDS = 10 * 60;
+var OTP_MAX_ATTEMPTS = 5;
+var FLEET_APPS = [
+  "tenants",
+  "identities",
+  "todos",
+  "skills",
+  "conversations",
+  "mementos",
+  "hooks",
+  "telephony",
+  "infinity",
+  "sandboxes",
+  "domains",
+  "accounts",
+  "files",
+  "sessions",
+  "secrets",
+  "projects",
+  "knowledge"
+];
+var SELF_APP = "tenants";
+
+class AuthError extends Error {
+  status;
+  code;
+  details;
+  constructor(status, message, code, details) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.name = "AuthError";
+  }
+}
+function roleScopes(app, role) {
+  switch (role) {
+    case "owner":
+    case "admin":
+      return [`${app}:*`];
+    case "member":
+    case "agent":
+    case "service":
+      return [`${app}:read`, `${app}:write`];
+    case "viewer":
+      return [`${app}:read`];
+    default:
+      return [`${app}:read`];
+  }
+}
+function generateOtp() {
+  return String(randomBytes2(4).readUInt32BE(0) % 1e6).padStart(6, "0");
+}
+function newSessionToken() {
+  return `hst_${randomBytes2(32).toString("base64url")}`;
+}
+
+class AuthService {
+  store;
+  signingSecret;
+  apiKeysTable;
+  apiKeys;
+  otpEcho;
+  emailPolicy;
+  mailer;
+  confirmUrlBase;
+  now;
+  constructor(options) {
+    this.store = options.store;
+    this.signingSecret = options.signingSecret;
+    this.apiKeysTable = options.apiKeysTable;
+    this.apiKeys = options.apiKeys;
+    this.otpEcho = options.otpEcho ?? false;
+    this.emailPolicy = options.emailPolicy ?? { allowedDomains: null, requireConfirmation: false };
+    this.mailer = options.mailer ?? new NoopMailer;
+    this.confirmUrlBase = (options.confirmUrlBase ?? "https://tenants.hasna.xyz").replace(/\/+$/, "");
+    this.now = options.nowMs ?? (() => Date.now());
+  }
+  assertEmailAllowed(email) {
+    if (!isEmailDomainAllowed(email, this.emailPolicy)) {
+      throw new AuthError(403, "Sign-up and login are restricted to Hasna email addresses (hasna.xyz and other hasna.<tld> domains).", "email_domain_not_allowed");
+    }
+  }
+  async jwks() {
+    return buildJwks(await this.store.listPublicJwks());
+  }
+  async signup(input) {
+    const email = (input.email ?? "").trim().toLowerCase();
+    if (!email || !email.includes("@"))
+      throw new AuthError(400, "A valid email is required.", "invalid_email");
+    this.assertEmailAllowed(email);
+    const kind = input.kind === "agent" ? "agent" : "human";
+    if (await this.store.getUserByEmail(email)) {
+      throw new AuthError(409, "An account with that email already exists.", "email_taken");
+    }
+    let homeTenantId = ROOT_TENANT_ID;
+    let createdNewOrg = false;
+    if (input.org_name && input.org_name.trim()) {
+      const slug = input.org_name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+      const existing = slug ? await this.store.getTenantBySlug(slug) : null;
+      if (existing) {
+        homeTenantId = existing.id;
+      } else {
+        homeTenantId = (await this.store.createTenant({ slug: slug || `org-${newId().slice(0, 8)}`, name: input.org_name.trim(), kind: "org", parentId: ROOT_TENANT_ID })).id;
+        createdNewOrg = true;
+      }
+    }
+    const role = createdNewOrg ? "owner" : "member";
+    const passwordHash = input.password ? hashPassword(input.password) : null;
+    const user = await this.store.createUser({
+      kind,
+      email,
+      displayName: input.name ?? null,
+      homeTenantId,
+      authMethod: passwordHash ? "password" : "otp",
+      passwordHash
+    });
+    await this.store.createMembership({ tenantId: homeTenantId, principalId: user.id, principalType: "user", role });
+    const base = {
+      user: this.principalSummary(user),
+      tenant: { tenant_id: homeTenantId },
+      memberships: [{ tenant_id: homeTenantId, role }]
+    };
+    if (this.emailPolicy.requireConfirmation) {
+      const challenge2 = await this.startChallenge(email, "signup");
+      return { ...base, ...challenge2, confirmation_required: true };
+    }
+    if (passwordHash) {
+      const session = await this.issueSession(user, homeTenantId, input.ip ?? null, input.userAgent ?? null, "password");
+      return { ...base, ...session };
+    }
+    const challenge = await this.startChallenge(email, "signup");
+    return { ...base, ...challenge };
+  }
+  async login(input) {
+    const email = (input.email ?? "").trim().toLowerCase();
+    if (!email)
+      throw new AuthError(400, "email is required.", "invalid_email");
+    this.assertEmailAllowed(email);
+    const user = await this.store.getUserByEmail(email);
+    if (input.password) {
+      if (!user || !user.password_hash || !verifyPassword(input.password, user.password_hash)) {
+        throw new AuthError(401, "Invalid email or password.", "invalid_credentials");
+      }
+      if (this.emailPolicy.requireConfirmation && !user.email_verified_at) {
+        const challenge2 = await this.startChallenge(email, "signup");
+        throw new AuthError(403, "Confirm your email before signing in. We just re-sent your confirmation code.", "email_not_confirmed", challenge2);
+      }
+      const session = await this.issueSession(user, user.home_tenant_id ?? ROOT_TENANT_ID, input.ip ?? null, input.userAgent ?? null, "password");
+      return session;
+    }
+    const challenge = await this.startChallenge(email, "login");
+    return challenge;
+  }
+  async resend(input) {
+    const email = (input.email ?? "").trim().toLowerCase();
+    if (!email || !email.includes("@"))
+      throw new AuthError(400, "A valid email is required.", "invalid_email");
+    this.assertEmailAllowed(email);
+    const user = await this.store.getUserByEmail(email);
+    if (user && !user.email_verified_at) {
+      return { ...await this.startChallenge(email, "signup"), confirmation_required: true };
+    }
+    return { challenge: true, purpose: "signup", expires_in: OTP_TTL_SECONDS };
+  }
+  async verify(input) {
+    const email = (input.email ?? "").trim().toLowerCase();
+    const code = (input.code ?? "").trim();
+    if (!email || !code)
+      throw new AuthError(400, "email and code are required.", "invalid_request");
+    for (const purpose of ["login", "signup"]) {
+      const challenge = await this.store.findActiveChallenge(email, purpose);
+      if (!challenge)
+        continue;
+      if (challenge.attempts >= OTP_MAX_ATTEMPTS)
+        throw new AuthError(429, "Too many attempts; request a new code.", "too_many_attempts");
+      if (sha256(code) !== challenge.code_hash) {
+        await this.store.bumpChallengeAttempts(challenge.id);
+        throw new AuthError(401, "Invalid code.", "invalid_code");
+      }
+      await this.store.consumeChallenge(challenge.id);
+      const user = await this.store.getUserByEmail(email);
+      if (!user)
+        throw new AuthError(404, "No account for that email.", "no_user");
+      if (!user.email_verified_at)
+        await this.store.markEmailVerified(user.id);
+      return this.issueSession(user, user.home_tenant_id ?? ROOT_TENANT_ID, input.ip ?? null, input.userAgent ?? null, "otp");
+    }
+    throw new AuthError(401, "No active challenge; request a new code.", "no_challenge");
+  }
+  async token(input) {
+    const { user } = await this.resolveSession(input.sessionToken);
+    const app = (input.app ?? "").trim();
+    if (!app)
+      throw new AuthError(400, "app is required.", "invalid_request");
+    if (!FLEET_APPS.includes(app))
+      throw new AuthError(400, `Unknown app: ${app}`, "unknown_app");
+    const memberships = await this.store.listMembershipsForPrincipal(user.id, "user");
+    let membership;
+    if (input.tenant_id) {
+      membership = memberships.find((m) => m.tenant_id === input.tenant_id);
+      if (!membership)
+        throw new AuthError(403, "No membership for the requested tenant.", "no_membership");
+    } else {
+      const home = user.home_tenant_id ?? ROOT_TENANT_ID;
+      membership = memberships.find((m) => m.tenant_id === home) ?? memberships[0];
+    }
+    if (!membership)
+      throw new AuthError(403, "No tenant membership for this principal.", "no_membership");
+    const granted = roleScopes(app, membership.role);
+    let scope;
+    if (input.scopes && input.scopes.length > 0) {
+      const overreach = input.scopes.filter((s) => !hasScope(granted, s));
+      if (overreach.length > 0) {
+        throw new AuthError(403, `Requested scopes exceed this membership's grants: ${overreach.join(", ")}`, "insufficient_scope");
+      }
+      scope = input.scopes;
+    } else {
+      scope = granted;
+    }
+    const jti = newId();
+    const signingKey = await this.store.getSigningKeyForMinting();
+    const { token, claims } = signAccessToken(signingKey, {
+      aud: app,
+      sub: user.id,
+      tid: membership.tenant_id,
+      pt: "user",
+      scope,
+      ...input.ttlSeconds ? { ttlSeconds: input.ttlSeconds } : {},
+      jti,
+      nowMs: this.now()
+    });
+    const response = {
+      access_token: token,
+      token_type: "Bearer",
+      alg: "EdDSA",
+      kid: signingKey.kid,
+      aud: app,
+      tid: membership.tenant_id,
+      uid: user.id,
+      pt: "user",
+      scope,
+      expires_in: claims.exp - claims.iat
+    };
+    if (app === SELF_APP && this.apiKeys) {
+      const minted = mintApiKey({ app: SELF_APP, scopes: scope, signingSecret: this.signingSecret, ...user.email ? { agent: user.email } : {} });
+      await this.apiKeys.insertMinted(minted, user.email ?? undefined);
+      await this.store.recordApiKeyBinding(this.apiKeysTable, {
+        kid: minted.kid,
+        tenantId: membership.tenant_id,
+        userId: user.id,
+        principalType: "user"
+      });
+      response["api_key"] = minted.token;
+      response["api_key_kid"] = minted.kid;
+      response["api_key_expires_at"] = minted.claims.exp ? new Date(minted.claims.exp * 1000).toISOString() : null;
+    }
+    return response;
+  }
+  async whoami(sessionToken) {
+    const { user, memberships } = await this.resolveSession(sessionToken);
+    return {
+      principal: this.principalSummary(user),
+      tenants: memberships.map((m) => ({ tenant_id: m.tenant_id, role: m.role })),
+      apps: FLEET_APPS
+    };
+  }
+  async introspect(kid) {
+    const binding = await this.store.lookupApiKeyBinding(this.apiKeysTable, kid);
+    if (!binding)
+      return { active: false, kid };
+    return {
+      active: true,
+      kid,
+      tenant_id: binding.tenant_id,
+      user_id: binding.user_id,
+      principal_type: binding.principal_type
+    };
+  }
+  principalSummary(user) {
+    return { user_id: user.id, kind: user.kind, email: user.email, display_name: user.display_name };
+  }
+  async startChallenge(email, purpose) {
+    const code = generateOtp();
+    await this.store.createChallenge({
+      email,
+      codeHash: sha256(code),
+      purpose,
+      expiresAt: new Date(this.now() + OTP_TTL_SECONDS * 1000)
+    });
+    const out = { challenge: true, purpose, expires_in: OTP_TTL_SECONDS };
+    const link = `${this.confirmUrlBase}/v1/auth/confirm?email=${encodeURIComponent(email)}&code=${code}`;
+    try {
+      const sent = await this.mailer.sendConfirmation({
+        to: email,
+        code,
+        link,
+        expiresMinutes: Math.round(OTP_TTL_SECONDS / 60),
+        purpose
+      });
+      if (sent.messageId)
+        out["email_message_id"] = sent.messageId;
+      out["email_sent"] = !sent.skipped;
+      if (sent.skipped)
+        out["email_skipped_reason"] = sent.reason ?? "disabled";
+    } catch (error) {
+      out["email_sent"] = false;
+      out["email_error"] = error instanceof Error ? error.message : String(error);
+    }
+    if (this.otpEcho)
+      out["dev_code"] = code;
+    return out;
+  }
+  async issueSession(user, tenantId, ip, userAgent, method) {
+    const token = newSessionToken();
+    await this.store.createSession({
+      userId: user.id,
+      tenantId,
+      tokenHash: sha256(token),
+      method,
+      expiresAt: new Date(this.now() + SESSION_TTL_SECONDS * 1000),
+      ip,
+      userAgent
+    });
+    const memberships = await this.store.listMembershipsForPrincipal(user.id, "user");
+    return {
+      session: token,
+      session_expires_in: SESSION_TTL_SECONDS,
+      principal: this.principalSummary(user),
+      tenants: memberships.map((m) => ({ tenant_id: m.tenant_id, role: m.role })),
+      apps: FLEET_APPS
+    };
+  }
+  async resolveSession(sessionToken) {
+    if (!sessionToken)
+      throw new AuthError(401, "Missing session token.", "missing_session");
+    const row = await this.store.getSessionByTokenHash(sha256(sessionToken));
+    if (!row)
+      throw new AuthError(401, "Invalid session.", "invalid_session");
+    if (row.revoked_at)
+      throw new AuthError(401, "Session revoked.", "revoked_session");
+    if (row.expires_at && new Date(row.expires_at).getTime() < this.now())
+      throw new AuthError(401, "Session expired.", "expired_session");
+    const user = row.user_id ? await this.store.getUserById(row.user_id) : null;
+    if (!user)
+      throw new AuthError(401, "Session principal not found.", "invalid_session");
+    const memberships = await this.store.listMembershipsForPrincipal(user.id, "user");
+    return { user, memberships };
+  }
+}
+// src/idp/store.ts
+import { generateKeyPairSync } from "crypto";
+var JWT_SIGNING_KEY_ENV = "HASNA_TENANTS_JWT_SIGNING_KEY";
+var JWT_KID_ENV = "HASNA_TENANTS_JWT_KID";
+function asJwk(value) {
+  return typeof value === "string" ? JSON.parse(value) : value;
+}
+
+class IdpStore {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  loadEnvSigningKey(env = process.env) {
+    const raw = env[JWT_SIGNING_KEY_ENV]?.trim();
+    if (!raw)
+      return null;
+    let jwk;
+    try {
+      jwk = JSON.parse(raw);
+    } catch {
+      try {
+        jwk = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
+      } catch {
+        throw new Error(`${JWT_SIGNING_KEY_ENV} must be a private Ed25519 JWK (JSON or base64url JSON).`);
+      }
+    }
+    const kid = env[JWT_KID_ENV]?.trim() || String(jwk["kid"] ?? "env");
+    return signingKeyFromPrivateJwk(kid, jwk);
+  }
+  async getOrCreateActiveDbKey() {
+    const existing = await this.client.get(`SELECT kid, alg, public_jwk, private_jwk, status FROM ${JWT_SIGNING_KEYS_TABLE}
+         WHERE status = 'active' ORDER BY created_at ASC LIMIT 1`);
+    if (existing) {
+      return signingKeyFromPrivateJwk(existing.kid, asJwk(existing.private_jwk));
+    }
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    const kid = `ed25519_${newId().replace(/-/g, "").slice(0, 16)}`;
+    const publicJwk = publicKey.export({ format: "jwk" });
+    const privateJwk = privateKey.export({ format: "jwk" });
+    await this.client.execute(`INSERT INTO ${JWT_SIGNING_KEYS_TABLE} (kid, alg, public_jwk, private_jwk, status)
+         VALUES ($1, 'EdDSA', $2::jsonb, $3::jsonb, 'active')
+       ON CONFLICT (kid) DO NOTHING`, [kid, JSON.stringify(publicJwk), JSON.stringify(privateJwk)]);
+    const active = await this.client.get(`SELECT kid, alg, public_jwk, private_jwk, status FROM ${JWT_SIGNING_KEYS_TABLE}
+         WHERE status = 'active' ORDER BY created_at ASC LIMIT 1`);
+    if (!active)
+      throw new Error("Failed to persist an active signing key.");
+    return signingKeyFromPrivateJwk(active.kid, asJwk(active.private_jwk));
+  }
+  async getSigningKeyForMinting() {
+    return this.loadEnvSigningKey() ?? await this.getOrCreateActiveDbKey();
+  }
+  async listPublicJwks() {
+    const keys = [];
+    const env = this.loadEnvSigningKey();
+    if (env)
+      keys.push(env.publicJwk);
+    const rows = await this.client.many(`SELECT kid, alg, public_jwk, private_jwk, status FROM ${JWT_SIGNING_KEYS_TABLE}
+         WHERE status = 'active' ORDER BY created_at ASC`);
+    for (const row of rows) {
+      const jwk = asJwk(row.public_jwk);
+      keys.push({ kty: "OKP", crv: "Ed25519", x: String(jwk.x), kid: row.kid, use: "sig", alg: "EdDSA" });
+    }
+    return keys;
+  }
+  async seedTenants() {
+    for (const t of SEED_TENANTS) {
+      await this.client.execute(`INSERT INTO ${TENANTS_TABLE} (id, slug, name, kind, parent_id)
+           VALUES ($1, $2, $3, $4, $5)
+         ON CONFLICT (id) DO NOTHING`, [t.id, t.slug, t.name, t.kind, t.parentId]);
+    }
+  }
+  async getTenantById(id) {
+    return this.client.get(`SELECT id, slug, name, kind, parent_id, status, identity_id FROM ${TENANTS_TABLE} WHERE id = $1`, [id]);
+  }
+  async getTenantBySlug(slug) {
+    return this.client.get(`SELECT id, slug, name, kind, parent_id, status, identity_id FROM ${TENANTS_TABLE} WHERE slug = $1`, [slug]);
+  }
+  async createTenant(input) {
+    const id = newId();
+    await this.client.execute(`INSERT INTO ${TENANTS_TABLE} (id, slug, name, kind, parent_id)
+         VALUES ($1, $2, $3, $4, $5)`, [id, input.slug, input.name, input.kind ?? "org", input.parentId ?? ROOT_TENANT_ID]);
+    const row = await this.getTenantById(id);
+    if (!row)
+      throw new Error("Failed to create tenant.");
+    return row;
+  }
+  async getUserByEmail(email) {
+    return this.client.get(`SELECT id, kind, email, display_name, identity_id, home_tenant_id, auth_method, password_hash, status, email_verified_at
+         FROM ${USERS_TABLE} WHERE lower(email) = lower($1)`, [email]);
+  }
+  async getUserById(id) {
+    return this.client.get(`SELECT id, kind, email, display_name, identity_id, home_tenant_id, auth_method, password_hash, status, email_verified_at
+         FROM ${USERS_TABLE} WHERE id = $1`, [id]);
+  }
+  async markEmailVerified(userId) {
+    await this.client.execute(`UPDATE ${USERS_TABLE} SET email_verified_at = now(), updated_at = now()
+         WHERE id = $1 AND email_verified_at IS NULL`, [userId]);
+  }
+  async createUser(input) {
+    const id = newId();
+    await this.client.execute(`INSERT INTO ${USERS_TABLE} (id, kind, email, display_name, identity_id, home_tenant_id, auth_method, password_hash)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [
+      id,
+      input.kind,
+      input.email ?? null,
+      input.displayName ?? null,
+      input.identityId ?? null,
+      input.homeTenantId,
+      input.authMethod ?? null,
+      input.passwordHash ?? null
+    ]);
+    const row = await this.getUserById(id);
+    if (!row)
+      throw new Error("Failed to create user.");
+    return row;
+  }
+  async setUserPassword(id, passwordHash) {
+    await this.client.execute(`UPDATE ${USERS_TABLE} SET password_hash = $2, auth_method = 'password', updated_at = now() WHERE id = $1`, [id, passwordHash]);
+  }
+  async createMembership(input) {
+    await this.client.execute(`INSERT INTO ${MEMBERSHIPS_TABLE} (tenant_id, principal_id, principal_type, role, scopes)
+         VALUES ($1, $2, $3, $4, $5::jsonb)
+       ON CONFLICT (tenant_id, principal_id, principal_type) DO NOTHING`, [input.tenantId, input.principalId, input.principalType, input.role, JSON.stringify(input.scopes ?? [])]);
+  }
+  async listMembershipsForPrincipal(principalId, principalType) {
+    return this.client.many(`SELECT id, tenant_id, principal_id, principal_type, role, scopes, status
+         FROM ${MEMBERSHIPS_TABLE} WHERE principal_id = $1 AND principal_type = $2 AND status = 'active'`, [principalId, principalType]);
+  }
+  async createServicePrincipal(input) {
+    const id = input.id ?? newId();
+    await this.client.execute(`INSERT INTO ${SERVICE_PRINCIPALS_TABLE} (id, tenant_id, kind, display_name, identity_id)
+         VALUES ($1, $2, $3, $4, $5)
+       ON CONFLICT (id) DO NOTHING`, [id, input.tenantId, input.kind ?? "machine", input.displayName ?? null, input.identityId ?? null]);
+    return id;
+  }
+  async createSession(input) {
+    const id = newId();
+    await this.client.execute(`INSERT INTO ${SESSIONS_TABLE} (id, user_id, tenant_id, token_hash, method, expires_at, ip, user_agent)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [
+      id,
+      input.userId,
+      input.tenantId,
+      input.tokenHash,
+      input.method ?? "password",
+      input.expiresAt.toISOString(),
+      input.ip ?? null,
+      input.userAgent ?? null
+    ]);
+    return id;
+  }
+  async getSessionByTokenHash(tokenHash) {
+    return this.client.get(`SELECT id, user_id, tenant_id, token_hash, method, issued_at, expires_at, revoked_at
+         FROM ${SESSIONS_TABLE} WHERE token_hash = $1`, [tokenHash]);
+  }
+  async revokeSession(tokenHash) {
+    await this.client.execute(`UPDATE ${SESSIONS_TABLE} SET revoked_at = now() WHERE token_hash = $1 AND revoked_at IS NULL`, [tokenHash]);
+  }
+  async createChallenge(input) {
+    const id = newId();
+    await this.client.execute(`INSERT INTO ${AUTH_CHALLENGES_TABLE} (id, email, code_hash, purpose, expires_at)
+         VALUES ($1, $2, $3, $4, $5)`, [id, input.email, input.codeHash, input.purpose, input.expiresAt.toISOString()]);
+    return id;
+  }
+  async findActiveChallenge(email, purpose) {
+    return this.client.get(`SELECT id, code_hash, attempts FROM ${AUTH_CHALLENGES_TABLE}
+         WHERE lower(email) = lower($1) AND purpose = $2 AND consumed_at IS NULL AND expires_at > now()
+         ORDER BY created_at DESC LIMIT 1`, [email, purpose]);
+  }
+  async consumeChallenge(id) {
+    await this.client.execute(`UPDATE ${AUTH_CHALLENGES_TABLE} SET consumed_at = now() WHERE id = $1`, [id]);
+  }
+  async bumpChallengeAttempts(id) {
+    await this.client.execute(`UPDATE ${AUTH_CHALLENGES_TABLE} SET attempts = attempts + 1 WHERE id = $1`, [id]);
+  }
+  async recordApiKeyBinding(apiKeysTable, input) {
+    await this.client.execute(`UPDATE ${apiKeysTable} SET tenant_id = $2, user_id = $3, principal_type = $4 WHERE kid = $1`, [input.kid, input.tenantId, input.userId, input.principalType]);
+  }
+  async lookupApiKeyBinding(apiKeysTable, kid) {
+    return this.client.get(`SELECT tenant_id, user_id, principal_type FROM ${apiKeysTable} WHERE kid = $1`, [kid]);
+  }
+}
+// src/idp/backfill.ts
+async function seedAndBackfill(client, apiKeysTable) {
+  const store = new IdpStore(client);
+  await store.seedTenants();
+  await store.getOrCreateActiveDbKey();
+  await client.execute(`UPDATE ${apiKeysTable} SET tenant_id = $1 WHERE tenant_id IS NULL`, [ROOT_TENANT_ID]);
+  const counted = await client.get(`SELECT count(*)::text AS n FROM ${apiKeysTable} WHERE tenant_id = $1`, [ROOT_TENANT_ID]);
+  const grandfathered = await client.get(`WITH upd AS (
+       UPDATE ${USERS_TABLE} SET email_verified_at = now(), updated_at = now()
+         WHERE email_verified_at IS NULL AND auth_method = 'enrollment'
+       RETURNING 1
+     ) SELECT count(*)::text AS n FROM upd`);
+  return {
+    tenantsSeeded: 4,
+    apiKeysBackfilled: counted ? Number(counted.n) : 0,
+    usersGrandfatheredVerified: grandfathered ? Number(grandfathered.n) : 0
+  };
+}
+// src/server/openapi.ts
+function buildOpenApiDocument(version) {
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "Tenants API",
+      version,
+      description: "Hasna fleet tenant auth / IdP: tenants, users, memberships, service principals, sessions, and asymmetric (EdDSA) fleet token issuance with a published JWKS. Cloud mode is PURE REMOTE: all reads and writes hit the shared cloud Postgres directly."
+    },
+    servers: [{ url: "/" }],
+    components: {
+      securitySchemes: {
+        ApiKeyAuth: { type: "apiKey", in: "header", name: "x-api-key" }
+      },
+      schemas: {
+        ErrorResponse: {
+          type: "object",
+          properties: { error: { type: "string" }, reason: { type: "string" } },
+          required: ["error"]
+        },
+        SignupInput: {
+          type: "object",
+          additionalProperties: true,
+          properties: {
+            email: { type: "string" },
+            name: { type: "string" },
+            kind: { type: "string", enum: ["human", "agent"] },
+            org_name: { type: "string" },
+            password: { type: "string" }
+          },
+          required: ["email"]
+        },
+        LoginInput: {
+          type: "object",
+          additionalProperties: true,
+          properties: { email: { type: "string" }, password: { type: "string" } },
+          required: ["email"]
+        },
+        VerifyInput: {
+          type: "object",
+          properties: { email: { type: "string" }, code: { type: "string" } },
+          required: ["email", "code"]
+        },
+        ResendInput: {
+          type: "object",
+          properties: { email: { type: "string" } },
+          required: ["email"]
+        },
+        TokenInput: {
+          type: "object",
+          additionalProperties: true,
+          properties: {
+            app: { type: "string" },
+            scopes: { type: "array", items: { type: "string" } },
+            tenant_id: { type: "string" },
+            ttlSeconds: { type: "integer" }
+          },
+          required: ["app"]
+        },
+        AuthResponse: {
+          type: "object",
+          additionalProperties: true,
+          properties: {
+            session: { type: "string" },
+            session_expires_in: { type: "integer" },
+            challenge: { type: "boolean" },
+            purpose: { type: "string" },
+            expires_in: { type: "integer" },
+            confirmation_required: { type: "boolean" },
+            email_sent: { type: "boolean" },
+            email_message_id: { type: "string" },
+            principal: { type: "object", additionalProperties: true },
+            tenants: { type: "array", items: { type: "object", additionalProperties: true } },
+            apps: { type: "array", items: { type: "string" } }
+          }
+        },
+        TokenResponse: {
+          type: "object",
+          additionalProperties: true,
+          properties: {
+            access_token: { type: "string" },
+            token_type: { type: "string" },
+            alg: { type: "string" },
+            kid: { type: "string" },
+            aud: { type: "string" },
+            tid: { type: "string" },
+            uid: { type: "string" },
+            pt: { type: "string" },
+            scope: { type: "array", items: { type: "string" } },
+            expires_in: { type: "integer" },
+            api_key: { type: "string" }
+          }
+        },
+        WhoamiResponse: {
+          type: "object",
+          additionalProperties: true,
+          properties: {
+            principal: { type: "object", additionalProperties: true },
+            tenants: { type: "array", items: { type: "object", additionalProperties: true } },
+            apps: { type: "array", items: { type: "string" } }
+          }
+        },
+        IntrospectResponse: {
+          type: "object",
+          additionalProperties: true,
+          properties: {
+            active: { type: "boolean" },
+            kid: { type: "string" },
+            tenant_id: { type: "string" },
+            user_id: { type: "string" },
+            principal_type: { type: "string" }
+          }
+        },
+        Jwks: {
+          type: "object",
+          properties: { keys: { type: "array", items: { type: "object", additionalProperties: true } } },
+          required: ["keys"]
+        }
+      }
+    },
+    security: [{ ApiKeyAuth: [] }],
+    paths: {
+      "/v1/.well-known/jwks.json": {
+        get: {
+          operationId: "getJwks",
+          summary: "Public JWKS (EdDSA) for verifying tenants-issued fleet tokens",
+          security: [],
+          responses: {
+            "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/Jwks" } } } }
+          }
+        }
+      },
+      "/v1/auth/signup": {
+        post: {
+          operationId: "signup",
+          summary: "Create a tenant/user (hasna emails only) and send an email confirmation code",
+          security: [],
+          requestBody: jsonBody("SignupInput"),
+          responses: jsonResponse("AuthResponse", "201")
+        }
+      },
+      "/v1/auth/login": {
+        post: {
+          operationId: "login",
+          summary: "Log in with password (session) or request an OTP challenge",
+          security: [],
+          requestBody: jsonBody("LoginInput"),
+          responses: jsonResponse("AuthResponse")
+        }
+      },
+      "/v1/auth/verify": {
+        post: {
+          operationId: "verifyOtp",
+          summary: "Verify an OTP code and open a session",
+          security: [],
+          requestBody: jsonBody("VerifyInput"),
+          responses: jsonResponse("AuthResponse")
+        }
+      },
+      "/v1/auth/confirm": {
+        get: {
+          operationId: "confirm",
+          summary: "Confirm an email via the one-click link (email + code) and open a session",
+          security: [],
+          parameters: [
+            { name: "email", in: "query", required: true, schema: { type: "string" } },
+            { name: "code", in: "query", required: true, schema: { type: "string" } }
+          ],
+          responses: jsonResponse("AuthResponse")
+        }
+      },
+      "/v1/auth/resend": {
+        post: {
+          operationId: "resendConfirmation",
+          summary: "Re-send the email confirmation code for an unconfirmed account",
+          security: [],
+          requestBody: jsonBody("ResendInput"),
+          responses: jsonResponse("AuthResponse")
+        }
+      },
+      "/v1/auth/token": {
+        post: {
+          operationId: "issueToken",
+          summary: "Mint a per-app fleet access token from a session (Bearer session)",
+          requestBody: jsonBody("TokenInput"),
+          responses: jsonResponse("TokenResponse")
+        }
+      },
+      "/v1/auth/whoami": {
+        get: {
+          operationId: "whoami",
+          summary: "Resolve the session principal + tenant memberships",
+          responses: jsonResponse("WhoamiResponse")
+        }
+      },
+      "/v1/introspect": {
+        get: {
+          operationId: "introspect",
+          summary: "Introspect an issued key by kid (tenant/user binding + status)",
+          parameters: [{ name: "kid", in: "query", required: true, schema: { type: "string" } }],
+          responses: jsonResponse("IntrospectResponse")
+        }
+      }
+    }
+  };
+}
+function jsonBody(schema) {
+  return {
+    required: true,
+    content: { "application/json": { schema: { $ref: `#/components/schemas/${schema}` } } }
+  };
+}
+function jsonResponse(schema, status = "200") {
+  return {
+    [status]: {
+      description: "OK",
+      content: { "application/json": { schema: { $ref: `#/components/schemas/${schema}` } } }
+    },
+    "400": errorResponse(),
+    "401": errorResponse(),
+    "403": errorResponse(),
+    "404": errorResponse()
+  };
+}
+function errorResponse() {
+  return {
+    description: "Error",
+    content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
+  };
+}
+// src/server/serve.ts
+import { ApiKeyStore, extractToken, hasAllScopes, verifyApiKey } from "@hasna/contracts/auth";
+
+// src/version.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var FALLBACK_PACKAGE_VERSION = "0.0.0";
+function getPackageVersion() {
+  const currentDir = dirname(fileURLToPath(import.meta.url));
+  for (const relativePath of ["../package.json", "../../package.json", "../../../package.json"]) {
+    try {
+      const parsed = JSON.parse(readFileSync2(join(currentDir, relativePath), "utf8"));
+      if (parsed.version)
+        return parsed.version;
+    } catch {}
+  }
+  return FALLBACK_PACKAGE_VERSION;
+}
+
+// src/server/serve.ts
+var TENANTS_SERVE_APP = "tenants";
+var DEFAULT_PORT = 15460;
+var JWKS_CACHE_TTL_MS = 60000;
+function json(body, status = 200, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", ...headers }
+  });
+}
+function resolveSigningSecret(explicit) {
+  const secret = explicit || process.env["HASNA_TENANTS_API_SIGNING_KEY"] || process.env["HASNA_API_SIGNING_KEY"];
+  if (!secret) {
+    throw new Error("Missing API signing secret. Set HASNA_TENANTS_API_SIGNING_KEY (or HASNA_API_SIGNING_KEY).");
+  }
+  return secret;
+}
+async function readJsonBody(req) {
+  const text = await req.text();
+  if (!text)
+    return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new HttpError(400, "Invalid JSON body");
+  }
+}
+
+class HttpError extends Error {
+  status;
+  reason;
+  constructor(status, message, reason) {
+    super(message);
+    this.status = status;
+    this.reason = reason;
+  }
+}
+async function authenticate(h, req, requiredScopes) {
+  const url = new URL(req.url);
+  const raw = extractToken(req.headers);
+  if (raw && looksLikeAccessToken(raw)) {
+    const jwks = await h.getJwks();
+    const result = verifyAccessToken(raw, { jwks, expectedAudience: TENANTS_SERVE_APP });
+    if (!result.ok)
+      return json({ error: `access token ${result.reason}`, reason: result.reason }, 401);
+    if (requiredScopes.length > 0 && !hasAllScopes(result.claims.scope ?? [], requiredScopes)) {
+      return json({ error: "insufficient_scope", reason: "insufficient_scope" }, 403);
+    }
+    return null;
+  }
+  const decision = await h.verifier.authenticate(req.headers, {
+    method: req.method,
+    path: url.pathname,
+    requiredScopes
+  });
+  if (decision.ok)
+    return null;
+  return json({ error: decision.message, reason: decision.reason }, decision.status);
+}
+async function handleV1(h, req, url) {
+  const method = req.method.toUpperCase();
+  const segments = url.pathname.split("/").filter(Boolean);
+  const resource = segments[1];
+  const scope = method === "GET" ? "tenants:read" : "tenants:write";
+  const authFailure = await authenticate(h, req, [scope]);
+  if (authFailure)
+    return authFailure;
+  try {
+    if (resource === "introspect" && segments.length === 2 && method === "GET") {
+      const kid = url.searchParams.get("kid");
+      if (!kid)
+        throw new HttpError(400, "kid query parameter is required", "invalid_request");
+      return json(await h.auth.introspect(kid));
+    }
+    throw new HttpError(404, `No route for ${method} ${url.pathname}`, "not_found");
+  } catch (error) {
+    if (error instanceof HttpError) {
+      return json({ error: error.message, reason: error.reason }, error.status);
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return json({ error: message }, 400);
+  }
+}
+function sessionTokenFrom(req, body) {
+  const authz = req.headers.get("authorization");
+  if (authz && /^Bearer\s+/i.test(authz)) {
+    const token = authz.replace(/^Bearer\s+/i, "").trim();
+    if (token.startsWith("hst_"))
+      return token;
+  }
+  if (body && typeof body.session === "string")
+    return body.session;
+  return "";
+}
+async function handleAuth(h, req, url) {
+  const path = url.pathname;
+  const method = req.method.toUpperCase();
+  if (method === "GET" && (path === "/jwks" || path === "/.well-known/jwks.json" || path === "/v1/.well-known/jwks.json")) {
+    const jwks = await h.auth.jwks();
+    return json(jwks, 200, { "cache-control": "public, max-age=600" });
+  }
+  const isAuthRoute = path === "/signup" || path === "/login" || path.startsWith("/v1/auth/");
+  if (!isAuthRoute)
+    return null;
+  try {
+    if (method === "POST" && (path === "/signup" || path === "/v1/auth/signup")) {
+      const body = await readJsonBody(req);
+      return json(await h.auth.signup({ ...body, ip: null, userAgent: req.headers.get("user-agent") }), 201);
+    }
+    if (method === "POST" && (path === "/login" || path === "/v1/auth/login")) {
+      const body = await readJsonBody(req);
+      return json(await h.auth.login({ ...body, ip: null, userAgent: req.headers.get("user-agent") }));
+    }
+    if (method === "POST" && path === "/v1/auth/verify") {
+      const body = await readJsonBody(req);
+      return json(await h.auth.verify({ ...body, ip: null, userAgent: req.headers.get("user-agent") }));
+    }
+    if (method === "GET" && path === "/v1/auth/confirm") {
+      const email = url.searchParams.get("email") ?? undefined;
+      const code = url.searchParams.get("code") ?? undefined;
+      return json(await h.auth.verify({ email, code, ip: null, userAgent: req.headers.get("user-agent") }));
+    }
+    if (method === "POST" && path === "/v1/auth/resend") {
+      const body = await readJsonBody(req);
+      return json(await h.auth.resend({ email: body.email }));
+    }
+    if (method === "POST" && path === "/v1/auth/token") {
+      const body = await readJsonBody(req);
+      return json(await h.auth.token({ ...body, sessionToken: sessionTokenFrom(req, body) }));
+    }
+    if (method === "GET" && path === "/v1/auth/whoami") {
+      return json(await h.auth.whoami(sessionTokenFrom(req, null)));
+    }
+    return json({ error: `No auth route for ${method} ${path}`, reason: "not_found" }, 404);
+  } catch (error) {
+    if (error instanceof AuthError) {
+      return json({ error: error.message, reason: error.code, ...error.details ?? {} }, error.status);
+    }
+    if (error instanceof HttpError) {
+      return json({ error: error.message, reason: error.reason }, error.status);
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return json({ error: message }, 400);
+  }
+}
+async function buildHandler(options = {}) {
+  let client;
+  let close;
+  if (options.client) {
+    client = options.client;
+    close = options.close ?? (async () => {
+      return;
+    });
+  } else {
+    const cloud = createCloudClient();
+    client = cloud.client;
+    close = cloud.close;
+  }
+  const signingSecret = resolveSigningSecret(options.signingSecret);
+  const keys = new ApiKeyStore(client);
+  const verifier = verifyApiKey({
+    app: TENANTS_SERVE_APP,
+    signingSecret,
+    isRevoked: keys.isRevoked,
+    ...options.audit ? { audit: options.audit } : {}
+  });
+  const idpStore = new IdpStore(client);
+  const auth = options.auth ?? new AuthService({
+    store: idpStore,
+    signingSecret,
+    apiKeysTable: API_KEYS_TABLE,
+    apiKeys: keys,
+    otpEcho: process.env["HASNA_TENANTS_OTP_ECHO"] === "1",
+    emailPolicy: emailPolicyFromEnv(),
+    mailer: createMailerFromEnv(),
+    confirmUrlBase: confirmUrlBaseFromEnv()
+  });
+  let cached = null;
+  const getJwks = async () => {
+    const now = Date.now();
+    if (cached && now - cached.at < JWKS_CACHE_TTL_MS)
+      return cached.keys;
+    const fresh = (await auth.jwks()).keys;
+    cached = { keys: fresh, at: now };
+    return fresh;
+  };
+  return { client, close, verifier, keys, auth, getJwks, version: getPackageVersion() };
+}
+async function createFetchHandler(options = {}) {
+  const handler = await buildHandler(options);
+  const openapi = buildOpenApiDocument(handler.version);
+  const fetch2 = async (req) => {
+    const url = new URL(req.url);
+    const path = url.pathname;
+    if (path === "/health") {
+      return json({ status: "ok", version: handler.version, mode: "cloud" });
+    }
+    if (path === "/version") {
+      return json({ status: "ok", version: handler.version, mode: "cloud" });
+    }
+    if (path === "/ready") {
+      const ready = await cloudReady(handler.client);
+      return json({
+        status: ready.ok ? "ok" : "degraded",
+        version: handler.version,
+        mode: "cloud",
+        latencyMs: ready.latencyMs,
+        pendingMigrations: ready.pendingMigrations,
+        ...ready.error ? { error: ready.error } : {}
+      }, ready.ok ? 200 : 503);
+    }
+    if (path === "/openapi.json") {
+      return json(openapi);
+    }
+    if (path === "/") {
+      return json({ name: "@hasna/tenants", status: "ok", version: handler.version, mode: "cloud" });
+    }
+    const authResponse = await handleAuth(handler, req, url);
+    if (authResponse)
+      return authResponse;
+    if (path.startsWith("/v1/") || path === "/v1") {
+      return handleV1(handler, req, url);
+    }
+    return json({ error: `Not found: ${path}` }, 404);
+  };
+  return { handler, fetch: fetch2 };
+}
+async function startServer(options = {}) {
+  const port = options.port ?? (Number(process.env["PORT"]) || DEFAULT_PORT);
+  const host = options.host ?? process.env["HOST"] ?? "0.0.0.0";
+  const { fetch: fetch2, handler } = await createFetchHandler(options);
+  const server = Bun.serve({ port, hostname: host, fetch: fetch2 });
+  cloudHealth(handler.client).catch(() => {
+    return;
+  });
+  return {
+    port: server.port ?? port,
+    hostname: host,
+    stop: async () => {
+      server.stop(true);
+      await handler.close().catch(() => {
+        return;
+      });
+    }
+  };
+}
+export {
+  verifyPassword,
+  verifyAccessToken,
+  uuidv5,
+  tenantsMigrations,
+  startServer,
+  signingKeyFromPrivateJwk,
+  signAccessToken,
+  sha256,
+  seedAndBackfill,
+  runTenantsMigrations,
+  newId,
+  looksLikeAccessToken,
+  isEmailDomainAllowed,
+  idpMigrations,
+  hashPassword,
+  getPackageVersion,
+  emailPolicyFromEnv,
+  emailDomain,
+  deriveTenantId,
+  createMailerFromEnv,
+  createFetchHandler,
+  createCloudClient,
+  confirmUrlBaseFromEnv,
+  cloudReady,
+  cloudHealth,
+  buildOpenApiDocument,
+  buildJwks,
+  buildHandler,
+  USERS_TABLE,
+  TOKEN_TYPE,
+  TOKEN_ISSUER,
+  TOKEN_ALG,
+  TENANTS_TABLE,
+  TENANTS_SERVE_APP,
+  TENANTS_APP_NAME,
+  SesMailer,
+  SES_REGION_ENV,
+  SES_FROM_ARN_ENV,
+  SESSION_TTL_SECONDS,
+  SESSIONS_TABLE,
+  SERVICE_PRINCIPALS_TABLE,
+  SELF_APP,
+  SEED_TENANTS,
+  ROOT_TENANT_SLUG,
+  ROOT_TENANT_ID,
+  OTP_TTL_SECONDS,
+  OTP_MAX_ATTEMPTS,
+  NoopMailer,
+  MEMBERSHIPS_TABLE,
+  MAIL_FROM_ENV,
+  MAIL_ENABLED_ENV,
+  JWT_SIGNING_KEY_ENV,
+  JWT_SIGNING_KEYS_TABLE,
+  JWT_KID_ENV,
+  IdpStore,
+  HASNA_TENANT_NAMESPACE,
+  FLEET_APPS,
+  DEFAULT_MAIL_FROM,
+  DEFAULT_CONFIRM_URL_BASE,
+  DEFAULT_ALLOWED_EMAIL_DOMAINS,
+  DEFAULT_ACCESS_TOKEN_TTL_SECONDS,
+  CONFIRM_URL_BASE_ENV,
+  AuthService,
+  AuthError,
+  AUTH_CHALLENGES_TABLE,
+  API_KEYS_TABLE,
+  ALLOWED_EMAIL_DOMAINS_ENV
+};