@hexis-ai/engram-server 0.12.0 → 0.13.0

package/dist/openapi.js

@@ -18,7 +18,7 @@
  * codes stay as-is.
  */
 import { z } from "zod";
-import { createWorkspaceSchema, eventBatchSchema, issueKeySchema, personCreateSchema, personUpdateSchema, searchRequestSchema, sessionInitSchema, } from "./schemas";
+import { addMemberSchema, createOrgSchema, createWorkspaceSchema, eventBatchSchema, issueKeySchema, orgPatchSchema, personCreateSchema, personUpdateSchema, searchRequestSchema, sessionInitSchema, sessionUpdateSchema, aliasUpsertSchema, identityUpsertSchema, workspacePatchSchema, } from "./schemas";
 /** Convert a Zod schema to a JSON Schema object for an OpenAPI component. */
 function toComponent(schema) {
     const js = z.toJSONSchema(schema);
@@ -37,7 +37,7 @@ const pathParam = (name, description) => ({
     schema: { type: "string" },
     description,
 });
-const queryParam = (name, description, schema = { type: "string" }) => ({ name, in: "query", required: false, schema, description });
+const queryParam = (name, description, schema = { type: "string" }, required = false) => ({ name, in: "query", required, schema, description });
 const res = (description) => ({ description });
 /** Default security: a workspace API key. `/admin/v1` paths override this. */
 const workspaceAuth = [{ workspaceKey: [] }];
@@ -54,14 +54,23 @@ const adminAuth = [{ adminToken: [] }];
 // ---------------------------------------------------------------------
 /** Every tag, in sidebar order, with a Japanese description. */
 const TAG_DEFS = [
-    { name: "Me", description: "識別プローブ" },
+    { name: "Me", description: "識別プローブ・閲覧可能な workspace/org 一覧" },
     { name: "Sessions", description: "セッションの作成・取得・イベント追加" },
     { name: "Search", description: "ワークスペースコーパスへのスコアリング検索" },
     { name: "Persons", description: "person の作成・更新・検索" },
+    { name: "Aliases", description: "ワークスペース横断の alias 解決" },
     {
         name: "Identities",
         description: "外部 ID（slack: / email: など）の resolve と upsert",
     },
+    {
+        name: "Orgs (self-serve)",
+        description: "engram-web からの cookie 認証 + org-member ロールでの org / workspace / API キー管理",
+    },
+    {
+        name: "Orgs (admin)",
+        description: "プラットフォーム管理者トークンでの org 管理",
+    },
     {
         name: "Workspaces (admin)",
         description: "ワークスペースの管理（管理者トークン必須）",
@@ -99,6 +108,24 @@ function buildPaths() {
                 },
             },
         }),
+        "/v1/me/workspaces": tagged("Me", {
+            get: {
+                summary: "サインイン中のユーザーが閲覧できる workspace 一覧。cookie 認証専用 — workspace 選択前にも到達できるよう workspace ゲートの前段に置かれている。",
+                responses: {
+                    "200": res("workspace 一覧"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/me/orgs": tagged("Me", {
+            get: {
+                summary: "サインイン中のユーザーが member として所属する org 一覧（自分の role 付き）。cookie 認証専用。",
+                responses: {
+                    "200": res("org 一覧"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
         "/v1/sessions": tagged("Sessions", {
             post: {
                 summary: "セッションを作成する。",
@@ -282,6 +309,16 @@ function buildPaths() {
                 },
             },
         }),
+        "/v1/aliases": tagged("Aliases", {
+            get: {
+                summary: "ワークスペース全体で alias 名を case-insensitive に逆引き。同名の alias を持つ複数の person を `last_used` desc で返す。`persons` map も同梱。",
+                parameters: [queryParam("name", "alias 名（URL-encoded）。", { type: "string" }, true)],
+                responses: {
+                    "200": res("alias 一覧 + persons map"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
         "/v1/identities/{ref}": tagged("Identities", {
             put: {
                 summary: "ref（例: `slack:U12345`、`email:foo@bar.com`）で identity を upsert する。",
@@ -304,6 +341,299 @@ function buildPaths() {
                 },
             },
         }),
+        // ------------------------------------------------------------------
+        // Self-service org surface (Wave G5). Cookie auth + org membership.
+        // engram-web の settings UI から呼ばれる。/admin/v1/orgs/* と同じ
+        // 操作を「自分が所属する org に絞って」叩けるエンドポイント群。
+        // ------------------------------------------------------------------
+        "/v1/orgs/{id}": tagged("Orgs (self-serve)", {
+            get: {
+                summary: "自分が member の org を取得する（自分の role 付き）。",
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("org + role"),
+                    "403": res("この org の member ではない"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            patch: {
+                summary: "org の name / metadata を更新する（owner / admin のみ）。",
+                parameters: [pathParam("id", "org id。")],
+                requestBody: jsonBody("OrgPatch"),
+                responses: {
+                    "200": res("更新後の org"),
+                    "403": res("権限不足（owner / admin が必要）"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/members": tagged("Orgs (self-serve)", {
+            get: {
+                summary: "org の member 一覧。",
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("member 一覧"),
+                    "403": res("この org の member ではない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            post: {
+                summary: "member を追加する（owner / admin のみ）。`email` か `userId` のいずれかを必須で渡す。",
+                parameters: [pathParam("id", "org id。")],
+                requestBody: jsonBody("AddMember"),
+                responses: {
+                    "200": res("追加された membership"),
+                    "400": res("`userId` も `email` も無い、または body が不正"),
+                    "403": res("権限不足"),
+                    "404": res("email から user を解決できない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/members/{userId}": tagged("Orgs (self-serve)", {
+            delete: {
+                summary: "member を削除する（owner / admin のみ）。最後の owner は削除拒否（`cannot_remove_last_owner`）。",
+                parameters: [pathParam("id", "org id。"), pathParam("userId", "user id。")],
+                responses: {
+                    "204": res("削除完了"),
+                    "400": res("最後の owner は削除できない"),
+                    "403": res("権限不足"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/workspaces": tagged("Orgs (self-serve)", {
+            get: {
+                summary: "org の workspace 一覧。",
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("workspace 一覧"),
+                    "403": res("この org の member ではない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            post: {
+                summary: "workspace を作成し、（issueKey=false でなければ）初期 API キーも発行する。owner / admin のみ。",
+                parameters: [pathParam("id", "org id。")],
+                requestBody: jsonBody("CreateWorkspace"),
+                responses: {
+                    "200": res("workspace（issueKey=false でない限り key も含む）"),
+                    "400": res("body または workspace id が不正"),
+                    "403": res("権限不足"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/workspaces/{wsId}": tagged("Orgs (self-serve)", {
+            patch: {
+                summary: "workspace の name / metadata を更新する（owner / admin のみ）。",
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                requestBody: jsonBody("WorkspacePatch"),
+                responses: {
+                    "200": res("更新後の workspace"),
+                    "403": res("権限不足"),
+                    "404": res("workspace がこの org に属さない / 存在しない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            delete: {
+                summary: "workspace を削除する（セッション・persons・identities・API キーにカスケード）。owner / admin のみ。",
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                responses: {
+                    "204": res("削除完了"),
+                    "403": res("権限不足"),
+                    "404": res("workspace がこの org に属さない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/workspaces/{wsId}/keys": tagged("Orgs (self-serve)", {
+            get: {
+                summary: "workspace の API キー一覧（owner / admin のみ）。",
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                responses: {
+                    "200": res("キー一覧"),
+                    "403": res("権限不足"),
+                    "404": res("workspace がこの org に属さない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            post: {
+                summary: "新しい API キーを発行する（owner / admin のみ）。",
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                requestBody: jsonBody("IssueKey", false),
+                responses: {
+                    "200": res("発行されたキー（raw は一度のみ返却）"),
+                    "403": res("権限不足"),
+                    "404": res("workspace がこの org に属さない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/workspaces/{wsId}/keys/{keyId}": tagged("Orgs (self-serve)", {
+            delete: {
+                summary: "API キーを無効化する（owner / admin のみ）。",
+                parameters: [
+                    pathParam("id", "org id。"),
+                    pathParam("wsId", "workspace id。"),
+                    pathParam("keyId", "key id。"),
+                ],
+                responses: {
+                    "204": res("無効化完了"),
+                    "403": res("権限不足"),
+                    "404": res("workspace / key がこの org に属さない、または存在しない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        // ------------------------------------------------------------------
+        // Admin org surface (Wave G1). Platform admin token.
+        // ------------------------------------------------------------------
+        "/admin/v1/orgs": tagged("Orgs (admin)", {
+            post: {
+                summary: "org を作成する。",
+                security: adminAuth,
+                requestBody: jsonBody("CreateOrg"),
+                responses: {
+                    "200": res("作成された org"),
+                    "400": res("body が不正"),
+                    "401": res("認証エラー"),
+                },
+            },
+            get: {
+                summary: "全 org を一覧取得する。",
+                security: adminAuth,
+                responses: {
+                    "200": res("org 一覧"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}": tagged("Orgs (admin)", {
+            get: {
+                summary: "単一の org を取得する。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("org"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            delete: {
+                summary: "org を削除する（member と workspace にカスケード）。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "204": res("削除完了"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}/members": tagged("Orgs (admin)", {
+            get: {
+                summary: "org の member 一覧。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("member 一覧"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            post: {
+                summary: "member を追加する（email または userId）。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                requestBody: jsonBody("AddMember"),
+                responses: {
+                    "200": res("追加された membership"),
+                    "400": res("`userId` も `email` も無い、または body が不正"),
+                    "404": res("org または email から user を解決できない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}/members/{userId}": tagged("Orgs (admin)", {
+            delete: {
+                summary: "member を削除する。最後の owner は削除拒否（`cannot_remove_last_owner`）。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。"), pathParam("userId", "user id。")],
+                responses: {
+                    "204": res("削除完了"),
+                    "400": res("最後の owner は削除できない"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}/workspaces": tagged("Orgs (admin)", {
+            post: {
+                summary: "org の下に workspace を作成し、（issueKey=false でなければ）初期 API キーも発行する。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                requestBody: jsonBody("CreateWorkspace"),
+                responses: {
+                    "200": res("workspace（issueKey=false でない限り key も含む）"),
+                    "400": res("body または workspace id が不正"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            get: {
+                summary: "org の workspace 一覧。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("workspace 一覧"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}/workspaces/{wsId}/keys": tagged("Orgs (admin)", {
+            get: {
+                summary: "org 配下の workspace の API キー一覧（ハッシュのみ）。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                responses: {
+                    "200": res("キー一覧"),
+                    "404": res("workspace がこの org に属さない / org が無い"),
+                    "401": res("認証エラー"),
+                },
+            },
+            post: {
+                summary: "org 配下の workspace に新しい API キーを発行する。`createWorkspaceUnderOrg` 後のキー rotation に使う。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                requestBody: jsonBody("IssueKey", false),
+                responses: {
+                    "200": res("発行されたキー（raw は一度のみ返却）"),
+                    "400": res("リクエストボディが不正"),
+                    "404": res("workspace がこの org に属さない / org が無い"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}/workspaces/{wsId}/keys/{keyId}": tagged("Orgs (admin)", {
+            delete: {
+                summary: "org 配下の workspace の API キーを無効化する。",
+                security: adminAuth,
+                parameters: [
+                    pathParam("id", "org id。"),
+                    pathParam("wsId", "workspace id。"),
+                    pathParam("keyId", "key id。"),
+                ],
+                responses: {
+                    "204": res("無効化完了"),
+                    "404": res("workspace / key がこの org に属さない、または存在しない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
         "/admin/v1/workspaces": tagged("Workspaces (admin)", {
             post: {
                 summary: "ワークスペースを作成する（デフォルトで初期キーも発行する）。",
@@ -425,15 +755,22 @@ export function buildOpenApiDocument() {
             },
             schemas: {
                 SessionInit: toComponent(sessionInitSchema),
+                SessionUpdate: toComponent(sessionUpdateSchema),
                 // `EventBatch` inlines the per-event shape. A standalone `SessionEvent`
                 // component (cross-`$ref`'d) is a planned follow-up alongside response
                 // schemas — zod's `toJSONSchema` inlines by default.
                 EventBatch: toComponent(eventBatchSchema),
                 PersonCreate: toComponent(personCreateSchema),
                 PersonUpdate: toComponent(personUpdateSchema),
+                AliasUpsert: toComponent(aliasUpsertSchema),
+                IdentityUpsert: toComponent(identityUpsertSchema),
                 SearchRequest: toComponent(searchRequestSchema),
                 CreateWorkspace: toComponent(createWorkspaceSchema),
                 IssueKey: toComponent(issueKeySchema),
+                CreateOrg: toComponent(createOrgSchema),
+                OrgPatch: toComponent(orgPatchSchema),
+                WorkspacePatch: toComponent(workspacePatchSchema),
+                AddMember: toComponent(addMemberSchema),
             },
         },
         paths: buildPaths(),

package/dist/org-store.d.ts

@@ -29,6 +29,10 @@ export interface OrgStore {
     }): Promise<OrgRow>;
     getOrg(id: string): Promise<OrgRow | null>;
     listOrgs(): Promise<OrgRow[]>;
+    updateOrg(id: string, patch: {
+        name?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<OrgRow>;
     deleteOrg(id: string): Promise<void>;
     listMembers(orgId: string): Promise<OrgMembershipRow[]>;
     upsertMember(input: {
@@ -63,4 +67,7 @@ export interface OrgStore {
     }[]>;
     /** Returns true if the user is an org-member of the workspace's org. */
     userCanAccessWorkspace(userId: string, workspaceId: string): Promise<boolean>;
+    /** Returns true if the workspace's `org_id` matches. Admin-side check
+     *  with no user context. */
+    workspaceInOrg(orgId: string, workspaceId: string): Promise<boolean>;
 }

package/dist/routes/orgs.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Cookie-auth org self-service routes (Wave G5).
+ *
+ * Auth gating only — the underlying logic lives in services/orgs.ts so
+ * the admin-token surface (`/admin/v1/orgs/*`) can call the same code
+ * without duplicating it.
+ *
+ * Mount BEFORE the workspace gate in src/server.ts; these endpoints
+ * have their own membership check and a chosen workspace would be
+ * irrelevant noise.
+ */
+import { Hono } from "hono";
+import type { EngramAuth } from "../auth";
+import type { KeyStore } from "../key-store";
+import type { OrgStore } from "../org-store";
+export interface OrgsRouteOptions {
+    authHandler: EngramAuth;
+    orgStore: OrgStore;
+    keyStore: KeyStore;
+}
+type Env = {
+    Variables: {
+        request_id: string;
+    };
+};
+export declare function orgsRoutes(opts: OrgsRouteOptions): Hono<Env>;
+export {};

package/dist/routes/orgs.js

@@ -0,0 +1,185 @@
+/**
+ * Cookie-auth org self-service routes (Wave G5).
+ *
+ * Auth gating only — the underlying logic lives in services/orgs.ts so
+ * the admin-token surface (`/admin/v1/orgs/*`) can call the same code
+ * without duplicating it.
+ *
+ * Mount BEFORE the workspace gate in src/server.ts; these endpoints
+ * have their own membership check and a chosen workspace would be
+ * irrelevant noise.
+ */
+import { Hono } from "hono";
+import { addMember, createWorkspaceUnderOrg, OrgServiceError, removeMember, revokeWorkspaceKey, updateOrg, updateOrgWorkspace, } from "../services/orgs";
+const WRITE_ROLES = new Set(["owner", "admin"]);
+export function orgsRoutes(opts) {
+    const app = new Hono();
+    const deps = { orgStore: opts.orgStore, keyStore: opts.keyStore };
+    const requireMember = async (req, orgId, minRole = "member") => {
+        const s = await opts.authHandler.api
+            .getSession({ headers: req.headers })
+            .catch(() => null);
+        if (!s?.user)
+            return jsonResponse(401, "unauthorized");
+        const memberships = await opts.orgStore.listOrgsForUser(s.user.id);
+        const here = memberships.find((m) => m.orgId === orgId);
+        if (!here)
+            return jsonResponse(403, "forbidden");
+        if (minRole !== "member" && !WRITE_ROLES.has(here.role)) {
+            return jsonResponse(403, "forbidden");
+        }
+        return { user: { id: s.user.id }, role: here.role };
+    };
+    // ---------- org ---------------------------------------------
+    app.get("/v1/orgs/:id", async (c) => {
+        const gate = await requireMember(c.req.raw, c.req.param("id"));
+        if (gate instanceof Response)
+            return gate;
+        const org = await opts.orgStore.getOrg(c.req.param("id"));
+        if (!org)
+            return c.json({ error: "org_not_found" }, 404);
+        return c.json({ org, role: gate.role });
+    });
+    app.patch("/v1/orgs/:id", async (c) => {
+        const id = c.req.param("id");
+        const gate = await requireMember(c.req.raw, id, "admin");
+        if (gate instanceof Response)
+            return gate;
+        return runService(c, async () => {
+            const body = (await c.req.json().catch(() => ({})));
+            const org = await updateOrg(deps, id, body);
+            return c.json({ org });
+        });
+    });
+    // ---------- members -----------------------------------------
+    app.get("/v1/orgs/:id/members", async (c) => {
+        const gate = await requireMember(c.req.raw, c.req.param("id"));
+        if (gate instanceof Response)
+            return gate;
+        return c.json({ members: await opts.orgStore.listMembers(c.req.param("id")) });
+    });
+    app.post("/v1/orgs/:id/members", async (c) => {
+        const orgId = c.req.param("id");
+        const gate = await requireMember(c.req.raw, orgId, "admin");
+        if (gate instanceof Response)
+            return gate;
+        return runService(c, async () => {
+            const body = (await c.req.json().catch(() => ({})));
+            const member = await addMember(deps, orgId, body);
+            return c.json({ member });
+        });
+    });
+    app.delete("/v1/orgs/:id/members/:userId", async (c) => {
+        const orgId = c.req.param("id");
+        const gate = await requireMember(c.req.raw, orgId, "admin");
+        if (gate instanceof Response)
+            return gate;
+        return runService(c, async () => {
+            await removeMember(deps, orgId, c.req.param("userId"));
+            return c.body(null, 204);
+        });
+    });
+    // ---------- workspaces -------------------------------------
+    app.get("/v1/orgs/:id/workspaces", async (c) => {
+        const gate = await requireMember(c.req.raw, c.req.param("id"));
+        if (gate instanceof Response)
+            return gate;
+        const workspaces = await opts.orgStore.listWorkspacesForOrg(c.req.param("id"));
+        return c.json({ workspaces });
+    });
+    app.patch("/v1/orgs/:id/workspaces/:wsId", async (c) => {
+        const orgId = c.req.param("id");
+        const gate = await requireMember(c.req.raw, orgId, "admin");
+        if (gate instanceof Response)
+            return gate;
+        const wsId = c.req.param("wsId");
+        const ok = await opts.orgStore.userCanAccessWorkspace(gate.user.id, wsId);
+        if (!ok)
+            return c.json({ error: "workspace_not_in_org" }, 404);
+        return runService(c, async () => {
+            const body = (await c.req.json().catch(() => ({})));
+            return c.json(await updateOrgWorkspace(deps, orgId, wsId, body));
+        });
+    });
+    app.delete("/v1/orgs/:id/workspaces/:wsId", async (c) => {
+        const orgId = c.req.param("id");
+        const gate = await requireMember(c.req.raw, orgId, "admin");
+        if (gate instanceof Response)
+            return gate;
+        const wsId = c.req.param("wsId");
+        const ok = await opts.orgStore.userCanAccessWorkspace(gate.user.id, wsId);
+        if (!ok)
+            return c.json({ error: "workspace_not_in_org" }, 404);
+        await opts.keyStore.deleteWorkspace(wsId);
+        return c.body(null, 204);
+    });
+    app.post("/v1/orgs/:id/workspaces", async (c) => {
+        const orgId = c.req.param("id");
+        const gate = await requireMember(c.req.raw, orgId, "admin");
+        if (gate instanceof Response)
+            return gate;
+        return runService(c, async () => {
+            const body = (await c.req.json().catch(() => ({})));
+            return c.json(await createWorkspaceUnderOrg(deps, orgId, body));
+        });
+    });
+    // ---------- api keys (scoped to a workspace) ----------------
+    app.get("/v1/orgs/:id/workspaces/:wsId/keys", async (c) => {
+        const orgId = c.req.param("id");
+        const gate = await requireMember(c.req.raw, orgId, "admin");
+        if (gate instanceof Response)
+            return gate;
+        const wsId = c.req.param("wsId");
+        const ok = await opts.orgStore.userCanAccessWorkspace(gate.user.id, wsId);
+        if (!ok)
+            return c.json({ error: "workspace_not_in_org" }, 404);
+        return c.json({ keys: await opts.keyStore.listKeys(wsId) });
+    });
+    app.post("/v1/orgs/:id/workspaces/:wsId/keys", async (c) => {
+        const orgId = c.req.param("id");
+        const gate = await requireMember(c.req.raw, orgId, "admin");
+        if (gate instanceof Response)
+            return gate;
+        const wsId = c.req.param("wsId");
+        const ok = await opts.orgStore.userCanAccessWorkspace(gate.user.id, wsId);
+        if (!ok)
+            return c.json({ error: "workspace_not_in_org" }, 404);
+        const body = (await c.req.json().catch(() => ({})));
+        const key = await opts.keyStore.issueKey(wsId, {
+            ...(body.name !== undefined ? { name: body.name } : {}),
+        });
+        return c.json(key);
+    });
+    app.delete("/v1/orgs/:id/workspaces/:wsId/keys/:keyId", async (c) => {
+        const orgId = c.req.param("id");
+        const gate = await requireMember(c.req.raw, orgId, "admin");
+        if (gate instanceof Response)
+            return gate;
+        const wsId = c.req.param("wsId");
+        const ok = await opts.orgStore.userCanAccessWorkspace(gate.user.id, wsId);
+        if (!ok)
+            return c.json({ error: "workspace_not_in_org" }, 404);
+        return runService(c, async () => {
+            await revokeWorkspaceKey(deps, wsId, c.req.param("keyId"));
+            return c.body(null, 204);
+        });
+    });
+    return app;
+}
+function jsonResponse(status, error) {
+    return new Response(JSON.stringify({ error }), {
+        status,
+        headers: { "content-type": "application/json" },
+    });
+}
+/** Run a service call, mapping OrgServiceError to a JSON response. */
+async function runService(c, fn) {
+    try {
+        return await fn();
+    }
+    catch (e) {
+        if (e instanceof OrgServiceError)
+            return c.json({ error: e.code }, e.status);
+        throw e;
+    }
+}

package/dist/schemas.d.ts

@@ -161,6 +161,24 @@ export declare const createWorkspaceSchema: z.ZodObject<{
 export declare const issueKeySchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+export declare const createOrgSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export declare const orgPatchSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export declare const workspacePatchSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export declare const addMemberSchema: z.ZodObject<{
+    userId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 /**
  * Read and validate a JSON request body. Returns the parsed value, or a
  * `Response` (400) the caller should return as-is: