@portaidentity/server 1.7.3 → 1.8.0

package/dist/routes/config.js

@@ -5,12 +5,13 @@
  * authorization with granular permissions.
  *
  * Route structure:
- *   GET    /                  — List all config entries
- *   GET    /:key              — Get a specific config value
- *   PUT    /:key              — Set (update) a config value
+ *   GET    /                  — List the closed public catalog
+ *   GET    /:key              — Read one authoritative catalog entry
+ *   PUT    /                  — Atomically update a non-empty catalog batch
+ *   PUT    /:key              — Update one native catalog value
  *
- * Sensitive values (is_sensitive=true) are masked in GET responses
- * with '***' to prevent accidental exposure in CLI output / logs.
+ * Internal rows and bootstrap secrets are never queried or projected. Public metadata comes
+ * from the application catalog, not editable database descriptions or sensitivity flags.
  *
  * @module routes/config
  */
@@ -19,17 +20,104 @@ import { z } from 'zod';
 import { requireAdminAuth } from '../middleware/admin-auth.js';
 import { requirePermission } from '../middleware/require-permission.js';
 import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
-import { getPool } from '../lib/database.js';
+import { afterDatabaseCommit, getDatabaseTransactionClient, getPool, runDatabaseTransaction, } from '../lib/database.js';
+import { writeAuditLogInTransaction } from '../lib/audit-log.js';
+import { clearSystemConfigCache } from '../lib/system-config.js';
+import { SYSTEM_CONFIG_CATALOG, findSystemConfigDefinition, validateSystemConfigValue, } from '../lib/system-config-catalog.js';
+/** Project authoritative rows in catalog order; missing, duplicate or corrupt rows fail closed. */
+function projectConfigEntries(definitions, rows) {
+    if (rows.length !== definitions.length)
+        throw new Error('Configuration rows are unavailable');
+    return definitions.map((definition) => {
+        const matches = rows.filter((row) => row.key === definition.key);
+        const row = matches[0];
+        if (matches.length !== 1 || !row)
+            throw new Error('Configuration row is unavailable');
+        const value = validateSystemConfigValue(definition, row.value);
+        const timestamp = row.updated_at instanceof Date ? row.updated_at : new Date(row.updated_at);
+        if (value === undefined)
+            throw new Error('Configuration value is invalid');
+        if (!Number.isFinite(timestamp.getTime()))
+            throw new Error('Configuration timestamp is invalid');
+        return { ...definition, value, updatedAt: timestamp.toISOString() };
+    });
+}
+/** Non-catalog names share one response without inspecting internal database existence. */
+function configNotFound(ctx) {
+    ctx.status = 404;
+    ctx.body = { error: 'Configuration entry not found', code: 'config_entry_not_found' };
+}
+/** Storage failures never expose stored values, infrastructure or database diagnostics. */
+function configUnavailable(ctx) {
+    ctx.status = 503;
+    ctx.body = {
+        error: 'Configuration store is unavailable',
+        code: 'config_store_unavailable',
+        requestId: ctx.state.requestId,
+    };
+}
 // ---------------------------------------------------------------------------
 // Validation schemas
 // ---------------------------------------------------------------------------
-/** Schema for updating a config value */
-export const updateConfigSchema = z.object({
-    value: z.string().min(1, 'Value must not be empty'),
-});
-/** Return the only public representation allowed for a stored configuration value. */
-export function publicConfigValue(value, isSensitive) {
-    return isSensitive ? '***' : value;
+/**
+ * Exact single-value envelope; the selected catalog definition validates the unknown scalar.
+ * @example
+ * updateConfigSchema.safeParse({ value: 1200 });
+ */
+export const updateConfigSchema = z.object({ value: z.unknown() }).strict();
+/** Exact batch envelope; native value and non-empty catalog validation follow before mutation. */
+const updateConfigBatchSchema = z.object({ values: z.record(z.string(), z.unknown()) }).strict();
+/** Fixed validation response independent of submitted content. */
+function configInvalid(ctx) {
+    ctx.status = 400;
+    ctx.body = { error: 'Configuration value is invalid', code: 'config_value_invalid' };
+}
+/**
+ * Commit values and one minimal audit record together, then invalidate only the local cache.
+ * Missing targets and invalid readback roll back instead of silently repairing catalog rows.
+ */
+async function commitConfigChanges(ctx, changes, single) {
+    try {
+        const restartRequired = changes.some(({ definition }) => definition.applicationMode === 'restart-required');
+        const data = await runDatabaseTransaction(async () => {
+            const rows = [];
+            for (const { definition, value } of changes) {
+                const updated = await getPool().query(`UPDATE system_config SET value = $1::jsonb, updated_at = NOW() WHERE key = $2
+           RETURNING key, value, updated_at`, [JSON.stringify(value), definition.key]);
+                if (updated.rowCount !== 1 || updated.rows.length !== 1)
+                    throw new Error('Configuration update is unavailable');
+                // Validate each returned row against its target before it enters the response or commits.
+                projectConfigEntries([definition], updated.rows);
+                rows.push(...updated.rows);
+            }
+            const definitions = SYSTEM_CONFIG_CATALOG.filter((definition) => changes.some((change) => change.definition.key === definition.key));
+            const entries = projectConfigEntries(definitions, rows);
+            const client = getDatabaseTransactionClient();
+            const actor = ctx.state.adminUser;
+            if (!client || !actor)
+                throw new Error('Configuration actor is unavailable');
+            const liveActor = await client.query('SELECT id, organization_id FROM users WHERE id = $1', [actor.id]);
+            const storedActor = liveActor.rows[0];
+            if (liveActor.rows.length !== 1 || !storedActor)
+                throw new Error('Configuration actor is unavailable');
+            await writeAuditLogInTransaction(client, {
+                organizationId: storedActor.organization_id,
+                actorId: storedActor.id,
+                eventType: 'admin.config.updated',
+                eventCategory: 'admin',
+                metadata: {
+                    keys: changes.map(({ definition }) => definition.key).sort(),
+                    restartRequired,
+                },
+            });
+            await afterDatabaseCommit(async () => clearSystemConfigCache());
+            return entries;
+        });
+        ctx.body = { data: single ? data[0] : data, restartRequired };
+    }
+    catch {
+        configUnavailable(ctx);
+    }
 }
 // ---------------------------------------------------------------------------
 // Router factory
@@ -38,10 +126,12 @@ export function publicConfigValue(value, isSensitive) {
  * Create the system config admin API router.
  *
  * All routes require admin authorization with granular permissions.
- * Provides read and write access to the `system_config` table via
- * a RESTful interface.
+ * Reads are authoritative; updates own the existing transaction, specialized audit and local
+ * post-commit cache boundary. Bootstrap settings and internal identifiers stay outside this API.
  *
  * @returns Koa router mounted at /api/admin/config
+ * @example
+ * app.use(createConfigRouter().routes());
  */
 export function createConfigRouter() {
     const router = new Router({ prefix: '/api/admin/config' });
@@ -49,66 +139,77 @@ export function createConfigRouter() {
     router.use(requireAdminAuth());
     // ── GET / — List all config entries ───────────────────────────────
     router.get('/', requirePermission(ADMIN_PERMISSIONS.CONFIG_READ), async (ctx) => {
-        const result = await getPool().query(`SELECT key, value, value_type, description, is_sensitive, updated_at
-       FROM system_config ORDER BY key`);
-        // Mask sensitive values to prevent accidental exposure
-        const data = result.rows.map((r) => ({
-            key: r.key,
-            value: publicConfigValue(r.value, r.is_sensitive),
-            valueType: r.value_type,
-            description: r.description,
-            isSensitive: r.is_sensitive,
-            updatedAt: r.updated_at,
-        }));
-        ctx.body = { data };
+        try {
+            const result = await getPool().query('SELECT key, value, updated_at FROM system_config WHERE key = ANY($1::text[])', [SYSTEM_CONFIG_CATALOG.map((definition) => definition.key)]);
+            ctx.body = { data: projectConfigEntries(SYSTEM_CONFIG_CATALOG, result.rows) };
+        }
+        catch {
+            configUnavailable(ctx);
+        }
     });
     // ── GET /:key — Get a specific config value ───────────────────────
     router.get('/:key', requirePermission(ADMIN_PERMISSIONS.CONFIG_READ), async (ctx) => {
-        const { key } = ctx.params;
-        const result = await getPool().query('SELECT key, value, value_type, description, is_sensitive, updated_at FROM system_config WHERE key = $1', [key]);
-        if (result.rows.length === 0) {
-            ctx.status = 404;
-            ctx.body = { error: 'Configuration entry not found' };
+        const definition = findSystemConfigDefinition(ctx.params.key);
+        if (!definition) {
+            configNotFound(ctx);
             return;
         }
-        const row = result.rows[0];
-        ctx.body = {
-            data: {
-                key: row.key,
-                value: publicConfigValue(row.value, row.is_sensitive),
-                valueType: row.value_type,
-                description: row.description,
-                isSensitive: row.is_sensitive,
-                updatedAt: row.updated_at,
-            },
-        };
+        try {
+            const result = await getPool().query('SELECT key, value, updated_at FROM system_config WHERE key = $1', [definition.key]);
+            ctx.body = { data: projectConfigEntries([definition], result.rows)[0] };
+        }
+        catch {
+            configUnavailable(ctx);
+        }
     });
-    // ── PUT /:key — Update a config value ─────────────────────────────
-    router.put('/:key', requirePermission(ADMIN_PERMISSIONS.CONFIG_UPDATE), async (ctx) => {
-        const { key } = ctx.params;
+    router.put('/', requirePermission(ADMIN_PERMISSIONS.CONFIG_UPDATE), async (ctx) => {
         const body = ctx.request.body;
-        // Validate request body with Zod
-        const parsed = updateConfigSchema.safeParse(body);
-        if (!parsed.success) {
-            ctx.status = 400;
-            ctx.body = { error: 'Configuration request is invalid' };
+        // Resolve names before validating values so internal and unknown names cannot be enumerated.
+        if (typeof body === 'object' && body !== null && 'values' in body) {
+            const values = body.values;
+            if (typeof values === 'object' && values !== null && !Array.isArray(values)) {
+                if (Object.keys(values).some((key) => !findSystemConfigDefinition(key))) {
+                    configNotFound(ctx);
+                    return;
+                }
+            }
+        }
+        const parsed = updateConfigBatchSchema.safeParse(body);
+        if (!parsed.success || Object.keys(parsed.data.values).length === 0) {
+            configInvalid(ctx);
+            return;
+        }
+        const changes = [];
+        for (const [key, candidate] of Object.entries(parsed.data.values)) {
+            const definition = findSystemConfigDefinition(key);
+            if (!definition) {
+                configNotFound(ctx);
+                return;
+            }
+            const value = validateSystemConfigValue(definition, candidate);
+            if (value === undefined) {
+                configInvalid(ctx);
+                return;
+            }
+            changes.push({ definition, value });
+        }
+        await commitConfigChanges(ctx, changes, false);
+    });
+    router.put('/:key', requirePermission(ADMIN_PERMISSIONS.CONFIG_UPDATE), async (ctx) => {
+        const definition = findSystemConfigDefinition(ctx.params.key);
+        if (!definition) {
+            configNotFound(ctx);
             return;
         }
-        const result = await getPool().query(`UPDATE system_config SET value = $1, updated_at = NOW() WHERE key = $2
-       RETURNING key, value, value_type, is_sensitive`, [parsed.data.value, key]);
-        if (result.rows.length === 0) {
-            ctx.status = 404;
-            ctx.body = { error: 'Configuration entry not found' };
+        const parsed = updateConfigSchema.safeParse(ctx.request.body);
+        const value = parsed.success
+            ? validateSystemConfigValue(definition, parsed.data.value)
+            : undefined;
+        if (value === undefined) {
+            configInvalid(ctx);
             return;
         }
-        const row = result.rows[0];
-        ctx.body = {
-            data: {
-                key: row.key,
-                value: publicConfigValue(row.value, row.is_sensitive),
-                valueType: row.value_type,
-            },
-        };
+        await commitConfigChanges(ctx, [{ definition, value }], true);
     });
     return router;
 }

package/dist/routes/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,yCAAyC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC;CACpD,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,WAAoB;IACnE,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE3D,wCAAwC;IACxC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;uCACiC,CAClC,CAAC;QAEF,uDAAuD;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAC1B,CAAC,CAOA,EAAE,EAAE,CAAC,CAAC;YACL,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC;YACjD,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,SAAS,EAAE,CAAC,CAAC,UAAU;SACxB,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClF,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC,wGAAwG,EACxG,CAAC,GAAG,CAAC,CACN,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAOxB,CAAC;QAEF,GAAG,CAAC,IAAI,GAAG;YACT,IAAI,EAAE;gBACJ,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC;gBACrD,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpF,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA+B,CAAC;QAEzD,iCAAiC;QACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;sDACgD,EAChD,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CACzB,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAKxB,CAAC;QACF,GAAG,CAAC,IAAI,GAAG;YACT,IAAI,EAAE;gBACJ,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC;gBACrD,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,OAAO,EACP,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AAazC,mGAAmG;AACnG,SAAS,oBAAoB,CAAC,WAA8C,EAAE,IAAiB;IAC7F,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC9F,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,yBAAyB,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7F,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACjG,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,GAAY;IAClC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,+BAA+B,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;AACxF,CAAC;AAED,2FAA2F;AAC3F,SAAS,iBAAiB,CAAC,GAAY;IACrC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG;QACT,KAAK,EAAE,oCAAoC;QAC3C,IAAI,EAAE,0BAA0B;QAChC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS;KAC/B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAE5E,kGAAkG;AAClG,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEjG,kEAAkE;AAClE,SAAS,aAAa,CAAC,GAAY;IACjC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,gCAAgC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;AACvF,CAAC;AAUD;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAY,EAAE,OAAuB,EAAE,MAAe;IACvF,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAClC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,KAAK,kBAAkB,CACtE,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,IAAI,EAAE;YACnD,MAAM,IAAI,GAAgB,EAAE,CAAC;YAC7B,KAAK,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CACnC;4CACkC,EAClC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CACxC,CAAC;gBACF,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBACzD,0FAA0F;gBAC1F,oBAAoB,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC,CACnE,CAAC;YACF,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,4BAA4B,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,qDAAqD,EACrD,CAAC,KAAK,CAAC,EAAE,CAAC,CACX,CAAC;YACF,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW;gBAC7C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,MAAM,0BAA0B,CAAC,MAAM,EAAE;gBACvC,cAAc,EAAE,WAAW,CAAC,eAAe;gBAC3C,OAAO,EAAE,WAAW,CAAC,EAAE;gBACvB,SAAS,EAAE,sBAAsB;gBACjC,aAAa,EAAE,OAAO;gBACtB,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;oBAC5D,eAAe;iBAChB;aACF,CAAC,CAAC;YACH,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE3D,wCAAwC;IACxC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC,8EAA8E,EAC9E,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAC5D,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClF,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,cAAc,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC,iEAAiE,EACjE,CAAC,UAAU,CAAC,GAAG,CAAC,CACjB,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,IAAI,GAAY,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,6FAA6F;QAC7F,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5E,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACxE,cAAc,CAAC,GAAG,CAAC,CAAC;oBACpB,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAClE,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,cAAc,CAAC,GAAG,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC/D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpF,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,cAAc,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO;YAC1B,CAAC,CAAC,yBAAyB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,MAAM,mBAAmB,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/custom-claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custom-claims.d.ts","sourceRoot":"","sources":["../../src/routes/custom-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAiEjC;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAyIhD"}
+{"version":3,"file":"custom-claims.d.ts","sourceRoot":"","sources":["../../src/routes/custom-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAuEjC;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA8IhD"}

package/dist/routes/custom-claims.js

@@ -52,6 +52,11 @@ const updateDefinitionSchema = z.object({
 const setValueSchema = z.object({
     value: z.unknown(),
 });
+/** Parent-qualified parameters accepted by claim deletion. */
+const identifierSchema = z.object({
+    appId: z.string().uuid(),
+    claimId: z.string().uuid(),
+});
 // ---------------------------------------------------------------------------
 // Error handler helper
 // ---------------------------------------------------------------------------
@@ -159,9 +164,10 @@ export function createCustomClaimRouter() {
     // -------------------------------------------------------------------------
     // DELETE /:claimId — Delete claim definition
     // -------------------------------------------------------------------------
-    router.delete('/:claimId', requirePermission(ADMIN_PERMISSIONS.CLAIM_ARCHIVE), async (ctx) => {
+    router.delete('/:claimId', requirePermission(ADMIN_PERMISSIONS.CLAIM_DELETE), async (ctx) => {
         try {
-            await claimService.deleteDefinition(ctx.params.claimId);
+            identifierSchema.parse(ctx.params);
+            await claimService.deleteDefinition(ctx.params.appId, ctx.params.claimId, ctx.state.adminUser?.id);
             ctx.status = 204;
         }
         catch (err) {

package/dist/routes/custom-claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-claims.js","sourceRoot":"","sources":["../../src/routes/custom-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,YAAY,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEtF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,iDAAiD;AACjD,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QACjD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAE/E,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC;gBACrD,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/B,GAAG,IAAI;aACR,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iDAAiD;IACjD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uDAAuD;IACvD,kEAAkE;IAClE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0CAA0C;IAC1C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6DAA6D;IAC7D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,yBAAyB,EACzB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CACvC,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,GAAG,CAAC,MAAM,CAAC,OAAO,EAClB,IAAI,CAAC,KAAK,CACX,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,6DAA6D;IAC7D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,yBAAyB,EACzB,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAC/C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC1C,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,wDAAwD;IACxD,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,yBAAyB,EACzB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"custom-claims.js","sourceRoot":"","sources":["../../src/routes/custom-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,YAAY,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEtF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,iDAAiD;AACjD,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC3B,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QACjD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAE/E,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC;gBACrD,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/B,GAAG,IAAI;aACR,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iDAAiD;IACjD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uDAAuD;IACvD,kEAAkE;IAClE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0CAA0C;IAC1C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,YAAY,CAAC,gBAAgB,CACjC,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,OAAO,EAClB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6DAA6D;IAC7D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,yBAAyB,EACzB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CACvC,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,GAAG,CAAC,MAAM,CAAC,OAAO,EAClB,IAAI,CAAC,KAAK,CACX,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,6DAA6D;IAC7D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,yBAAyB,EACzB,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAC/C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC1C,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,wDAAwD;IACxD,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,yBAAyB,EACzB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/exports.d.ts

@@ -5,7 +5,8 @@
  * Exports exclude sensitive data (passwords, secrets, keys).
  *
  * Route structure:
- *   GET /api/admin/export/:entityType  — Export entity data
+ *   POST /api/admin/export/manifest    — Export a selective portability manifest
+ *   GET  /api/admin/export/:entityType — Export legacy report data
  *
  * Query parameters:
  *   format: 'json' | 'csv' (default: json)

package/dist/routes/exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../../src/routes/exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAoCjC,wBAAgB,kBAAkB,IAAI,MAAM,CAqD3C"}
+{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../../src/routes/exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAA8B,MAAM,aAAa,CAAC;AA6CzD,wBAAgB,kBAAkB,IAAI,MAAM,CAsE3C"}

package/dist/routes/exports.js

@@ -5,7 +5,8 @@
  * Exports exclude sensitive data (passwords, secrets, keys).
  *
  * Route structure:
- *   GET /api/admin/export/:entityType  — Export entity data
+ *   POST /api/admin/export/manifest    — Export a selective portability manifest
+ *   GET  /api/admin/export/:entityType — Export legacy report data
  *
  * Query parameters:
  *   format: 'json' | 'csv' (default: json)
@@ -22,6 +23,8 @@ import { requireAdminAuth } from '../middleware/admin-auth.js';
 import { requirePermission } from '../middleware/require-permission.js';
 import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
 import { exportData, ExportOperationError } from '../lib/data-export.js';
+import { logger } from '../lib/logger.js';
+import { exportManifestRequestSchema, exportPortabilityManifest, PortabilityError, requirePortabilityAuthorization, } from '../portability/index.js';
 // ---------------------------------------------------------------------------
 // Validation
 // ---------------------------------------------------------------------------
@@ -47,7 +50,22 @@ const ENTITY_PERMISSIONS = {
 // ---------------------------------------------------------------------------
 export function createExportRouter() {
     const router = new Router({ prefix: '/api/admin/export' });
+    router.use(async (ctx, next) => {
+        ctx.set('Cache-Control', 'no-store');
+        await next();
+    });
     router.use(requireAdminAuth());
+    router.post('/manifest', requirePermission(ADMIN_PERMISSIONS.EXPORT_READ), async (ctx) => {
+        const parsed = exportManifestRequestSchema.safeParse(ctx.request.body);
+        if (!parsed.success) {
+            ctx.status = 400;
+            ctx.body = { error: 'Invalid export request', code: 'export_request_invalid' };
+            return;
+        }
+        await requirePortabilityAuthorization('export', () => parsed.data.categories)(ctx, async () => {
+            await handleManifestExport(ctx, parsed.data);
+        });
+    });
     // -------------------------------------------------------------------------
     // GET /:entityType — Export data
     // -------------------------------------------------------------------------
@@ -95,4 +113,42 @@ export function createExportRouter() {
     });
     return router;
 }
+/** Export a validated manifest and map only fixed safe failures to HTTP. */
+async function handleManifestExport(ctx, request) {
+    try {
+        const actor = portabilityActor(ctx);
+        const result = await exportPortabilityManifest(request, actor);
+        ctx.set('Content-Disposition', `attachment; filename="${result.filename}"`);
+        ctx.type = 'application/json; charset=utf-8';
+        ctx.body = result.manifest;
+    }
+    catch (error) {
+        if (error instanceof PortabilityError) {
+            if (error.code === 'export_manifest_too_large') {
+                ctx.status = 413;
+                ctx.body = { error: 'Export manifest is too large', code: error.code };
+                return;
+            }
+            if (error.code === 'export_scope_rejected') {
+                ctx.status = 409;
+                ctx.body = { error: 'Export scope rejected', code: error.code };
+                return;
+            }
+        }
+        const requestId = ctx.state.requestId;
+        logger.error({ operation: 'export', code: 'export_failed', request_id: requestId }, 'Portability export failed');
+        ctx.status = 503;
+        ctx.body = { error: 'Export failed', code: 'export_failed', request_id: requestId };
+    }
+}
+/** Build the audit actor from the authenticated Admin identity. */
+function portabilityActor(ctx) {
+    const adminUser = ctx.state.adminUser;
+    if (!adminUser)
+        throw new Error('Admin identity is unavailable');
+    return {
+        userId: adminUser.id,
+        controlPlaneOrganizationId: adminUser.organizationId,
+    };
+}
 //# sourceMappingURL=exports.js.map

package/dist/routes/exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"exports.js","sourceRoot":"","sources":["../../src/routes/exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAGzE,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,kBAAkB,GAA2B;IACjD,KAAK,EAAE,iBAAiB,CAAC,SAAS;IAClC,aAAa,EAAE,iBAAiB,CAAC,QAAQ;IACzC,OAAO,EAAE,iBAAiB,CAAC,WAAW;IACtC,KAAK,EAAE,iBAAiB,CAAC,SAAS;IAClC,KAAK,EAAE,iBAAiB,CAAC,UAAU;CACpC,CAAC;AAEF,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE3D,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,YAAY,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;YACjF,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAqB,YAAY,CAAC,IAAI,CAAC;QACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAElD,MAAM,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;oBAC9B,UAAU;oBACV,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;oBAClE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC5D,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;iBACjC,CAAC,CAAC;gBAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,yBAAyB,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAC5E,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC9B,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;oBAChC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;oBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;oBAClF,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;oBAC1B,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;oBAChF,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YACvF,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"exports.js","sourceRoot":"","sources":["../../src/routes/exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAA8B,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAEzE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,gBAAgB,EAChB,+BAA+B,GAGhC,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,kBAAkB,GAA2B;IACjD,KAAK,EAAE,iBAAiB,CAAC,SAAS;IAClC,aAAa,EAAE,iBAAiB,CAAC,QAAQ;IACzC,OAAO,EAAE,iBAAiB,CAAC,WAAW;IACtC,KAAK,EAAE,iBAAiB,CAAC,SAAS;IAClC,KAAK,EAAE,iBAAiB,CAAC,UAAU;CACpC,CAAC;AAEF,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAE3D,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvF,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,MAAM,+BAA+B,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YAC5F,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,YAAY,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;YACjF,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAqB,YAAY,CAAC,IAAI,CAAC;QACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAElD,MAAM,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;oBAC9B,UAAU;oBACV,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;oBAClE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC5D,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;iBACjC,CAAC,CAAC;gBAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,yBAAyB,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAC5E,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC9B,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;oBAChC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;oBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;oBAClF,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;oBAC1B,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;oBAChF,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YACvF,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,oBAAoB,CACjC,GAAkB,EAClB,OAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,yBAAyB,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5E,GAAG,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;gBAC3C,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChE,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;QACtC,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,EACrE,2BAA2B,CAC5B,CAAC;QACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;IACtC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACjE,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,EAAE;QACpB,0BAA0B,EAAE,SAAS,CAAC,cAAc;KACrD,CAAC;AACJ,CAAC"}

package/dist/routes/imports.d.ts

@@ -1,8 +1,8 @@
 /**
  * Data import API routes.
  *
- * Provides admin endpoint for importing configuration from a JSON manifest.
- * Supports three modes: merge (skip existing), overwrite, and dry-run.
+ * Provides the Admin endpoint for previewing or atomically applying a strict portability manifest.
+ * Supports dry-run, keep-existing, and update-existing behavior.
  *
  * Route structure:
  *   POST /api/admin/import  — Import configuration manifest

package/dist/routes/imports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"imports.d.ts","sourceRoot":"","sources":["../../src/routes/imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAuBjC;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAwC3C"}
+{"version":3,"file":"imports.d.ts","sourceRoot":"","sources":["../../src/routes/imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAA8B,MAAM,aAAa,CAAC;AAwDzD;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAiC3C"}