@sudobility/shapeshyft_service 1.0.0

package/dist/routes/entities.js

@@ -0,0 +1,332 @@
+/**
+ * @fileoverview Entity Routes
+ * @description API routes for entity/organization management
+ */
+import { Hono } from "hono";
+import { successResponse, errorResponse, } from "@sudobility/shapeshyft_engine/types";
+export function createEntitiesRouter(ctx) {
+    const helpers = ctx.entityAccess.entityHelpers;
+    const sendInvitationEmail = params => ctx.email.sendInvitationEmail(params);
+    const entitiesRouter = new Hono();
+    // =============================================================================
+    // Entity CRUD Routes
+    // =============================================================================
+    /**
+     * GET /entities - List all entities for the current user
+     */
+    entitiesRouter.get("/", async (c) => {
+        const userId = c.get("userId"); // firebase_uid
+        const userEmail = c.get("userEmail");
+        try {
+            const userEntities = await helpers.entity.getUserEntities(userId, userEmail ?? undefined);
+            return c.json(successResponse(userEntities));
+        }
+        catch (error) {
+            console.error("Error listing entities:", error);
+            return c.json(errorResponse(error.message || "Internal server error"), 500);
+        }
+    });
+    /**
+     * POST /entities - Create a new organization entity
+     */
+    entitiesRouter.post("/", async (c) => {
+        const userId = c.get("userId"); // firebase_uid
+        const body = await c.req.json();
+        const { displayName, entitySlug, description } = body;
+        if (!displayName) {
+            return c.json(errorResponse("displayName is required"), 400);
+        }
+        try {
+            const entity = await helpers.entity.createOrganizationEntity(userId, {
+                displayName,
+                entitySlug,
+                description,
+            });
+            return c.json(successResponse(entity), 201);
+        }
+        catch (error) {
+            console.error("Error creating entity:", error);
+            return c.json(errorResponse(error.message || "Bad request"), 400);
+        }
+    });
+    /**
+     * GET /entities/:entitySlug - Get entity by slug
+     */
+    entitiesRouter.get("/:entitySlug", async (c) => {
+        const userId = c.get("userId");
+        const entitySlug = c.req.param("entitySlug");
+        try {
+            const entity = await helpers.entity.getEntityBySlug(entitySlug);
+            if (!entity) {
+                return c.json(errorResponse("Entity not found"), 404);
+            }
+            // Check if user is a member
+            const isMember = await helpers.members.isMember(entity.id, userId);
+            if (!isMember) {
+                return c.json(errorResponse("Access denied"), 403);
+            }
+            const role = await helpers.members.getUserRole(entity.id, userId);
+            return c.json(successResponse({
+                ...entity,
+                userRole: role,
+            }));
+        }
+        catch (error) {
+            console.error("Error getting entity:", error);
+            return c.json(errorResponse(error.message || "Internal server error"), 500);
+        }
+    });
+    /**
+     * PUT /entities/:entitySlug - Update entity
+     */
+    entitiesRouter.put("/:entitySlug", async (c) => {
+        const userId = c.get("userId");
+        const entitySlug = c.req.param("entitySlug");
+        const body = await c.req.json();
+        try {
+            const entity = await helpers.entity.getEntityBySlug(entitySlug);
+            if (!entity) {
+                return c.json(errorResponse("Entity not found"), 404);
+            }
+            // Check if user can edit
+            const canEdit = await helpers.permissions.canEditEntity(entity.id, userId);
+            if (!canEdit) {
+                return c.json(errorResponse("Insufficient permissions"), 403);
+            }
+            const updated = await helpers.entity.updateEntity(entity.id, body);
+            return c.json(successResponse(updated));
+        }
+        catch (error) {
+            console.error("Error updating entity:", error);
+            return c.json(errorResponse(error.message || "Bad request"), 400);
+        }
+    });
+    /**
+     * DELETE /entities/:entitySlug - Delete entity (organizations only)
+     */
+    entitiesRouter.delete("/:entitySlug", async (c) => {
+        const userId = c.get("userId");
+        const entitySlug = c.req.param("entitySlug");
+        try {
+            const entity = await helpers.entity.getEntityBySlug(entitySlug);
+            if (!entity) {
+                return c.json(errorResponse("Entity not found"), 404);
+            }
+            // Check if user can delete
+            const canDelete = await helpers.permissions.canDeleteEntity(entity.id, userId);
+            if (!canDelete) {
+                return c.json(errorResponse("Insufficient permissions"), 403);
+            }
+            await helpers.entity.deleteEntity(entity.id);
+            return c.json(successResponse(null));
+        }
+        catch (error) {
+            console.error("Error deleting entity:", error);
+            return c.json(errorResponse(error.message || "Bad request"), 400);
+        }
+    });
+    // =============================================================================
+    // Member Routes
+    // =============================================================================
+    /**
+     * GET /entities/:entitySlug/members - List members
+     */
+    entitiesRouter.get("/:entitySlug/members", async (c) => {
+        const userId = c.get("userId");
+        const entitySlug = c.req.param("entitySlug");
+        try {
+            const entity = await helpers.entity.getEntityBySlug(entitySlug);
+            if (!entity) {
+                return c.json(errorResponse("Entity not found"), 404);
+            }
+            // Check if user can view
+            const canView = await helpers.permissions.canViewEntity(entity.id, userId);
+            if (!canView) {
+                return c.json(errorResponse("Access denied"), 403);
+            }
+            const members = await helpers.members.getMembers(entity.id);
+            return c.json(successResponse(members));
+        }
+        catch (error) {
+            console.error("Error listing members:", error);
+            return c.json(errorResponse(error.message || "Internal server error"), 500);
+        }
+    });
+    /**
+     * PUT /entities/:entitySlug/members/:memberId - Update member role
+     */
+    entitiesRouter.put("/:entitySlug/members/:memberId", async (c) => {
+        const userId = c.get("userId");
+        const entitySlug = c.req.param("entitySlug");
+        const memberId = c.req.param("memberId");
+        const body = await c.req.json();
+        const { role } = body;
+        if (!role) {
+            return c.json(errorResponse("role is required"), 400);
+        }
+        try {
+            const entity = await helpers.entity.getEntityBySlug(entitySlug);
+            if (!entity) {
+                return c.json(errorResponse("Entity not found"), 404);
+            }
+            // Check if user can manage members
+            const canManage = await helpers.permissions.canManageMembers(entity.id, userId);
+            if (!canManage) {
+                return c.json(errorResponse("Insufficient permissions"), 403);
+            }
+            const updated = await helpers.members.updateMemberRole(entity.id, memberId, role);
+            return c.json(successResponse(updated));
+        }
+        catch (error) {
+            console.error("Error updating member role:", error);
+            return c.json(errorResponse(error.message || "Bad request"), 400);
+        }
+    });
+    /**
+     * DELETE /entities/:entitySlug/members/:memberId - Remove member
+     */
+    entitiesRouter.delete("/:entitySlug/members/:memberId", async (c) => {
+        const userId = c.get("userId");
+        const entitySlug = c.req.param("entitySlug");
+        const memberId = c.req.param("memberId");
+        try {
+            const entity = await helpers.entity.getEntityBySlug(entitySlug);
+            if (!entity) {
+                return c.json(errorResponse("Entity not found"), 404);
+            }
+            // Check if user can manage members
+            const canManage = await helpers.permissions.canManageMembers(entity.id, userId);
+            if (!canManage) {
+                return c.json(errorResponse("Insufficient permissions"), 403);
+            }
+            await helpers.members.removeMember(entity.id, memberId);
+            return c.json(successResponse(null));
+        }
+        catch (error) {
+            console.error("Error removing member:", error);
+            return c.json(errorResponse(error.message || "Bad request"), 400);
+        }
+    });
+    // =============================================================================
+    // Invitation Routes
+    // =============================================================================
+    /**
+     * GET /entities/:entitySlug/invitations - List pending invitations
+     */
+    entitiesRouter.get("/:entitySlug/invitations", async (c) => {
+        const userId = c.get("userId");
+        const entitySlug = c.req.param("entitySlug");
+        try {
+            const entity = await helpers.entity.getEntityBySlug(entitySlug);
+            if (!entity) {
+                return c.json(errorResponse("Entity not found"), 404);
+            }
+            // Check if user can manage members (required to see invitations)
+            const canManage = await helpers.permissions.canManageMembers(entity.id, userId);
+            if (!canManage) {
+                return c.json(errorResponse("Insufficient permissions"), 403);
+            }
+            const invitations = await helpers.invitations.getEntityInvitations(entity.id);
+            return c.json(successResponse(invitations));
+        }
+        catch (error) {
+            console.error("Error listing invitations:", error);
+            return c.json(errorResponse(error.message || "Internal server error"), 500);
+        }
+    });
+    /**
+     * POST /entities/:entitySlug/invitations - Create invitation
+     */
+    entitiesRouter.post("/:entitySlug/invitations", async (c) => {
+        const userId = c.get("userId");
+        const entitySlug = c.req.param("entitySlug");
+        const body = await c.req.json();
+        const { email, role } = body;
+        if (!email || !role) {
+            return c.json(errorResponse("email and role are required"), 400);
+        }
+        try {
+            const entity = await helpers.entity.getEntityBySlug(entitySlug);
+            if (!entity) {
+                return c.json(errorResponse("Entity not found"), 404);
+            }
+            // Check if user can invite members
+            const canInvite = await helpers.permissions.canInviteMembers(entity.id, userId);
+            if (!canInvite) {
+                return c.json(errorResponse("Insufficient permissions"), 403);
+            }
+            const invitation = await helpers.invitations.createInvitation(entity.id, userId, {
+                email,
+                role,
+            });
+            // Send invite email (non-blocking)
+            sendInvitationEmail({
+                recipientEmail: email,
+                entityName: entity.displayName,
+            }).catch(err => console.error("Failed to send invitation email:", err));
+            return c.json(successResponse(invitation), 201);
+        }
+        catch (error) {
+            console.error("Error creating invitation:", error);
+            return c.json(errorResponse(error.message || "Bad request"), 400);
+        }
+    });
+    /**
+     * PUT /entities/:entitySlug/invitations/:invitationId - Renew invitation
+     * Renews the invitation with a new 14-day expiration and optionally resends email
+     */
+    entitiesRouter.put("/:entitySlug/invitations/:invitationId", async (c) => {
+        const userId = c.get("userId");
+        const entitySlug = c.req.param("entitySlug");
+        const invitationId = c.req.param("invitationId");
+        try {
+            const entity = await helpers.entity.getEntityBySlug(entitySlug);
+            if (!entity) {
+                return c.json(errorResponse("Entity not found"), 404);
+            }
+            // Check if user can manage members (admin only)
+            const canManage = await helpers.permissions.canManageMembers(entity.id, userId);
+            if (!canManage) {
+                return c.json(errorResponse("Insufficient permissions"), 403);
+            }
+            const renewed = await helpers.invitations.renewInvitation(invitationId);
+            // Resend invite email (non-blocking)
+            sendInvitationEmail({
+                recipientEmail: renewed.email,
+                entityName: entity.displayName,
+            }).catch(err => console.error("Failed to resend invitation email:", err));
+            return c.json(successResponse(renewed));
+        }
+        catch (error) {
+            console.error("Error renewing invitation:", error);
+            return c.json(errorResponse(error.message || "Bad request"), 400);
+        }
+    });
+    /**
+     * DELETE /entities/:entitySlug/invitations/:invitationId - Cancel invitation
+     */
+    entitiesRouter.delete("/:entitySlug/invitations/:invitationId", async (c) => {
+        const userId = c.get("userId");
+        const entitySlug = c.req.param("entitySlug");
+        const invitationId = c.req.param("invitationId");
+        try {
+            const entity = await helpers.entity.getEntityBySlug(entitySlug);
+            if (!entity) {
+                return c.json(errorResponse("Entity not found"), 404);
+            }
+            // Check if user can manage members
+            const canManage = await helpers.permissions.canManageMembers(entity.id, userId);
+            if (!canManage) {
+                return c.json(errorResponse("Insufficient permissions"), 403);
+            }
+            await helpers.invitations.cancelInvitation(invitationId);
+            return c.json(successResponse(null));
+        }
+        catch (error) {
+            console.error("Error canceling invitation:", error);
+            return c.json(errorResponse(error.message || "Bad request"), 400);
+        }
+    });
+    return entitiesRouter;
+}
+//# sourceMappingURL=entities.js.map

package/dist/routes/entities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entities.js","sourceRoot":"","sources":["../../src/routes/entities.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,aAAa,GACd,MAAM,qCAAqC,CAAC;AAe7C,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;IAC/C,MAAM,mBAAmB,GAAuC,MAAM,CAAC,EAAE,CACvE,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAExC,MAAM,cAAc,GAAG,IAAI,IAAI,EAA4B,CAAC;IAE5D,gFAAgF;IAChF,qBAAqB;IACrB,gFAAgF;IAEhF;;OAEG;IACH,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QAChC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CACvD,MAAM,EACN,SAAS,IAAI,SAAS,CACvB,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAmB,YAAY,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QAEtD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE;gBACnE,WAAW;gBACX,UAAU;gBACV,WAAW;aACZ,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAS,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,4BAA4B;YAC5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAClE,OAAO,CAAC,CAAC,IAAI,CACX,eAAe,CAAiB;gBAC9B,GAAG,MAAM;gBACT,QAAQ,EAAE,IAAI;aACG,CAAC,CACrB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,yBAAyB;YACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,aAAa,CACrD,MAAM,CAAC,EAAE,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAS,OAAO,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,cAAc,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,2BAA2B;YAC3B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,CACzD,MAAM,CAAC,EAAE,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAO,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,gBAAgB;IAChB,gFAAgF;IAEhF;;OAEG;IACH,cAAc,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QACnD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,yBAAyB;YACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,aAAa,CACrD,MAAM,CAAC,EAAE,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAiB,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,cAAc,CAAC,GAAG,CAAC,gCAAgC,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QAC7D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,mCAAmC;YACnC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAC1D,MAAM,CAAC,EAAE,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,CACpD,MAAM,CAAC,EAAE,EACT,QAAQ,EACR,IAAI,CACL,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAe,OAAO,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,cAAc,CAAC,MAAM,CAAC,gCAAgC,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QAChE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,mCAAmC;YACnC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAC1D,MAAM,CAAC,EAAE,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAO,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,oBAAoB;IACpB,gFAAgF;IAEhF;;OAEG;IACH,cAAc,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QACvD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,iEAAiE;YACjE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAC1D,MAAM,CAAC,EAAE,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAChE,MAAM,CAAC,EAAE,CACV,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAqB,WAAW,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,cAAc,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QACxD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,6BAA6B,CAAC,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,mCAAmC;YACnC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAC1D,MAAM,CAAC,EAAE,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAC3D,MAAM,CAAC,EAAE,EACT,MAAM,EACN;gBACE,KAAK;gBACL,IAAI;aACL,CACF,CAAC;YAEF,mCAAmC;YACnC,mBAAmB,CAAC;gBAClB,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,WAAW;aAC/B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC,CAAC;YAExE,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAmB,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,cAAc,CAAC,GAAG,CAAC,wCAAwC,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QACrE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,gDAAgD;YAChD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAC1D,MAAM,CAAC,EAAE,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAExE,qCAAqC;YACrC,mBAAmB,CAAC;gBAClB,cAAc,EAAE,OAAO,CAAC,KAAK;gBAC7B,UAAU,EAAE,MAAM,CAAC,WAAW;aAC/B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC,CAAC;YAE1E,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAmB,OAAO,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,cAAc,CAAC,MAAM,CAAC,wCAAwC,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QACxE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,mCAAmC;YACnC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAC1D,MAAM,CAAC,EAAE,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YACzD,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAO,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;AACxB,CAAC"}

package/dist/routes/entity-api-keys.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @fileoverview Entity API key routes
+ * @description CRUD for entity-scoped API keys ("<entity prefix>_...").
+ *
+ * A key authenticates a caller as the entity itself, so CI jobs, scripts, and
+ * MCP clients keep working when the member who created them leaves. Storage is
+ * hash-only: the plaintext appears once in the create response and is
+ * unrecoverable afterwards -- a lost key is rotated, not revealed.
+ *
+ * Writes require `canManageApiKeys` (Owner or Manager); reads require
+ * membership. Requests authenticated *with* an entity API key cannot reach
+ * these routes at all -- see `assertNotEntityKeyAuth`.
+ */
+import { Hono } from "hono";
+import type { ServiceContext } from "../context.js";
+export declare function createEntityApiKeysRouter(ctx: ServiceContext): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=entity-api-keys.d.ts.map

package/dist/routes/entity-api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-api-keys.d.ts","sourceRoot":"","sources":["../../src/routes/entity-api-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAY1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,cAAc,8EA2N5D"}

package/dist/routes/entity-api-keys.js

@@ -0,0 +1,142 @@
+/**
+ * @fileoverview Entity API key routes
+ * @description CRUD for entity-scoped API keys ("<entity prefix>_...").
+ *
+ * A key authenticates a caller as the entity itself, so CI jobs, scripts, and
+ * MCP clients keep working when the member who created them leaves. Storage is
+ * hash-only: the plaintext appears once in the create response and is
+ * unrecoverable afterwards -- a lost key is rotated, not revealed.
+ *
+ * Writes require `canManageApiKeys` (Owner or Manager); reads require
+ * membership. Requests authenticated *with* an entity API key cannot reach
+ * these routes at all -- see `assertNotEntityKeyAuth`.
+ */
+import { Hono } from "hono";
+import { zValidator } from "@hono/zod-validator";
+import { entityApiKeyCreateSchema, entityApiKeyUpdateSchema, entityApiKeyIdParamSchema, entitySlugParamSchema, } from "../schemas/index.js";
+import { successResponse, errorResponse, } from "@sudobility/shapeshyft_engine/types";
+export function createEntityApiKeysRouter(ctx) {
+    const { entityHelpers, getActor, getEntityWithPermission, getPermissionErrorStatus, } = ctx.entityAccess;
+    const entityApiKeysRouter = new Hono();
+    /**
+     * Refuse requests that authenticated with an entity API key.
+     *
+     * Letting a key mint or revoke keys would turn a single leaked credential into
+     * permanent, self-renewing access. Key lifecycle stays with a human identity:
+     * a Firebase token or a personal API key.
+     *
+     * @returns An error response to return, or null when the caller may proceed
+     */
+    function assertNotEntityKeyAuth(c) {
+        if (c.get("authMethod") === "entity_api_key") {
+            return c.json(errorResponse("Entity API keys cannot manage API keys. Sign in or use a personal API key."), 403);
+        }
+        return null;
+    }
+    /**
+     * Guard against a misconfigured deployment.
+     * `apiKeys` is present whenever `apiKeysTable` is configured, which it is here.
+     */
+    function requireApiKeyHelper(c) {
+        if (!entityHelpers.apiKeys) {
+            return c.json(errorResponse("Entity API keys are not enabled"), 501);
+        }
+        return null;
+    }
+    // GET all API keys for an entity
+    entityApiKeysRouter.get("/", zValidator("param", entitySlugParamSchema), async (c) => {
+        try {
+            const unavailable = requireApiKeyHelper(c);
+            if (unavailable)
+                return unavailable;
+            const { entitySlug } = c.req.valid("param");
+            const result = await getEntityWithPermission(entitySlug, getActor(c), "canViewApiKeys");
+            if (result.error !== undefined) {
+                return c.json(errorResponse(result.error), getPermissionErrorStatus(result.errorCode));
+            }
+            const keys = await entityHelpers.apiKeys.getKeys(result.entity.id);
+            return c.json(successResponse(keys));
+        }
+        catch (error) {
+            console.error("Error listing entity API keys:", error);
+            return c.json(errorResponse(error.message || "Internal server error"), 500);
+        }
+    });
+    // POST create an API key -- the only response carrying the plaintext secret
+    entityApiKeysRouter.post("/", zValidator("param", entitySlugParamSchema), zValidator("json", entityApiKeyCreateSchema), async (c) => {
+        try {
+            const unavailable = requireApiKeyHelper(c);
+            if (unavailable)
+                return unavailable;
+            const forbidden = assertNotEntityKeyAuth(c);
+            if (forbidden)
+                return forbidden;
+            const userId = c.get("userId");
+            const { entitySlug } = c.req.valid("param");
+            const body = c.req.valid("json");
+            const result = await getEntityWithPermission(entitySlug, getActor(c), "canManageApiKeys");
+            if (result.error !== undefined) {
+                return c.json(errorResponse(result.error), getPermissionErrorStatus(result.errorCode));
+            }
+            const created = await entityHelpers.apiKeys.createKey(result.entity.id, userId, body.key_name);
+            return c.json(successResponse(created), 201);
+        }
+        catch (error) {
+            console.error("Error creating entity API key:", error);
+            return c.json(errorResponse(error.message || "Internal server error"), 500);
+        }
+    });
+    // PUT rename a key or toggle whether it is active
+    entityApiKeysRouter.put("/:keyId", zValidator("param", entityApiKeyIdParamSchema), zValidator("json", entityApiKeyUpdateSchema), async (c) => {
+        try {
+            const unavailable = requireApiKeyHelper(c);
+            if (unavailable)
+                return unavailable;
+            const forbidden = assertNotEntityKeyAuth(c);
+            if (forbidden)
+                return forbidden;
+            const { entitySlug, keyId } = c.req.valid("param");
+            const body = c.req.valid("json");
+            const result = await getEntityWithPermission(entitySlug, getActor(c), "canManageApiKeys");
+            if (result.error !== undefined) {
+                return c.json(errorResponse(result.error), getPermissionErrorStatus(result.errorCode));
+            }
+            const updated = await entityHelpers.apiKeys.updateKey(result.entity.id, keyId, { keyName: body.key_name, isActive: body.is_active });
+            if (!updated) {
+                return c.json(errorResponse("API key not found"), 404);
+            }
+            return c.json(successResponse(updated));
+        }
+        catch (error) {
+            console.error("Error updating entity API key:", error);
+            return c.json(errorResponse(error.message || "Internal server error"), 500);
+        }
+    });
+    // DELETE revoke a key permanently
+    entityApiKeysRouter.delete("/:keyId", zValidator("param", entityApiKeyIdParamSchema), async (c) => {
+        try {
+            const unavailable = requireApiKeyHelper(c);
+            if (unavailable)
+                return unavailable;
+            const forbidden = assertNotEntityKeyAuth(c);
+            if (forbidden)
+                return forbidden;
+            const { entitySlug, keyId } = c.req.valid("param");
+            const result = await getEntityWithPermission(entitySlug, getActor(c), "canManageApiKeys");
+            if (result.error !== undefined) {
+                return c.json(errorResponse(result.error), getPermissionErrorStatus(result.errorCode));
+            }
+            const revoked = await entityHelpers.apiKeys.revokeKey(result.entity.id, keyId);
+            if (!revoked) {
+                return c.json(errorResponse("API key not found"), 404);
+            }
+            return c.json(successResponse({ revoked: true }));
+        }
+        catch (error) {
+            console.error("Error revoking entity API key:", error);
+            return c.json(errorResponse(error.message || "Internal server error"), 500);
+        }
+    });
+    return entityApiKeysRouter;
+}
+//# sourceMappingURL=entity-api-keys.js.map

package/dist/routes/entity-api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-api-keys.js","sourceRoot":"","sources":["../../src/routes/entity-api-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,aAAa,GACd,MAAM,qCAAqC,CAAC;AAG7C,MAAM,UAAU,yBAAyB,CAAC,GAAmB;IAC3D,MAAM,EACJ,aAAa,EACb,QAAQ,EACR,uBAAuB,EACvB,wBAAwB,GACzB,GAAG,GAAG,CAAC,YAAY,CAAC;IAErB,MAAM,mBAAmB,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvC;;;;;;;;OAQG;IACH,SAAS,sBAAsB,CAAC,CAAU;QACxC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CACX,4EAA4E,CAC7E,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAAC,CAAU;QACrC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iCAAiC;IACjC,mBAAmB,CAAC,GAAG,CACrB,GAAG,EACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,EAC1C,KAAK,EAAC,CAAC,EAAC,EAAE;QACR,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YAEpC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,UAAU,EACV,QAAQ,CAAC,CAAC,CAAC,EACX,gBAAgB,CACjB,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAC3B,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,mBAAmB,CAAC,IAAI,CACtB,GAAG,EACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,EAC1C,UAAU,CAAC,MAAM,EAAE,wBAAwB,CAAC,EAC5C,KAAK,EAAC,CAAC,EAAC,EAAE;QACR,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YAEpC,MAAM,SAAS,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;YAEhC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAEjC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,UAAU,EACV,QAAQ,CAAC,CAAC,CAAC,EACX,kBAAkB,CACnB,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAC3B,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAQ,CAAC,SAAS,CACpD,MAAM,CAAC,MAAM,CAAC,EAAE,EAChB,MAAM,EACN,IAAI,CAAC,QAAQ,CACd,CAAC;YAEF,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,kDAAkD;IAClD,mBAAmB,CAAC,GAAG,CACrB,SAAS,EACT,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,EAC9C,UAAU,CAAC,MAAM,EAAE,wBAAwB,CAAC,EAC5C,KAAK,EAAC,CAAC,EAAC,EAAE;QACR,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YAEpC,MAAM,SAAS,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;YAEhC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAEjC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,UAAU,EACV,QAAQ,CAAC,CAAC,CAAC,EACX,kBAAkB,CACnB,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAC3B,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAQ,CAAC,SAAS,CACpD,MAAM,CAAC,MAAM,CAAC,EAAE,EAChB,KAAK,EACL,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CACrD,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,kCAAkC;IAClC,mBAAmB,CAAC,MAAM,CACxB,SAAS,EACT,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,EAC9C,KAAK,EAAC,CAAC,EAAC,EAAE;QACR,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YAEpC,MAAM,SAAS,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;YAEhC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEnD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,UAAU,EACV,QAAQ,CAAC,CAAC,CAAC,EACX,kBAAkB,CACnB,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAC3B,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAQ,CAAC,SAAS,CACpD,MAAM,CAAC,MAAM,CAAC,EAAE,EAChB,KAAK,CACN,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,mBAAmB,CAAC;AAC7B,CAAC"}

package/dist/routes/invitations.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @fileoverview User Invitation Routes
+ * @description API routes for managing user's pending invitations
+ */
+import { Hono } from "hono";
+import type { ServiceContext } from "../context.js";
+type Variables = {
+    userId: string;
+    userEmail: string | null;
+};
+export declare function createInvitationsRouter(ctx: ServiceContext): Hono<{
+    Variables: Variables;
+}, import("hono/types").BlankSchema, "/">;
+export {};
+//# sourceMappingURL=invitations.d.ts.map

package/dist/routes/invitations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitations.d.ts","sourceRoot":"","sources":["../../src/routes/invitations.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,KAAK,SAAS,GAAG;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,cAAc;eAGT,SAAS;0CAyD1D"}

package/dist/routes/invitations.js

@@ -0,0 +1,58 @@
+/**
+ * @fileoverview User Invitation Routes
+ * @description API routes for managing user's pending invitations
+ */
+import { Hono } from "hono";
+import { successResponse, errorResponse, } from "@sudobility/shapeshyft_engine/types";
+export function createInvitationsRouter(ctx) {
+    const helpers = ctx.entityAccess.entityHelpers;
+    const invitationsRouter = new Hono();
+    /**
+     * GET /invitations - List pending invitations for the current user
+     */
+    invitationsRouter.get("/", async (c) => {
+        const userEmail = c.get("userEmail");
+        if (!userEmail) {
+            return c.json(successResponse([]));
+        }
+        try {
+            const invitations = await helpers.invitations.getUserPendingInvitations(userEmail);
+            return c.json(successResponse(invitations));
+        }
+        catch (error) {
+            console.error("Error listing user invitations:", error);
+            return c.json(errorResponse(error.message || "Internal server error"), 500);
+        }
+    });
+    /**
+     * POST /invitations/:token/accept - Accept an invitation
+     */
+    invitationsRouter.post("/:token/accept", async (c) => {
+        const userId = c.get("userId");
+        const token = c.req.param("token");
+        try {
+            await helpers.invitations.acceptInvitation(token, userId);
+            return c.json(successResponse(null));
+        }
+        catch (error) {
+            console.error("Error accepting invitation:", error);
+            return c.json(errorResponse(error.message || "Bad request"), 400);
+        }
+    });
+    /**
+     * POST /invitations/:token/decline - Decline an invitation
+     */
+    invitationsRouter.post("/:token/decline", async (c) => {
+        const token = c.req.param("token");
+        try {
+            await helpers.invitations.declineInvitation(token);
+            return c.json(successResponse(null));
+        }
+        catch (error) {
+            console.error("Error declining invitation:", error);
+            return c.json(errorResponse(error.message || "Bad request"), 400);
+        }
+    });
+    return invitationsRouter;
+}
+//# sourceMappingURL=invitations.js.map

package/dist/routes/invitations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitations.js","sourceRoot":"","sources":["../../src/routes/invitations.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,aAAa,GACd,MAAM,qCAAqC,CAAC;AAS7C,MAAM,UAAU,uBAAuB,CAAC,GAAmB;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;IAE/C,MAAM,iBAAiB,GAAG,IAAI,IAAI,EAA4B,CAAC;IAE/D;;OAEG;IACH,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QACnC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAErC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAqB,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GACf,MAAM,OAAO,CAAC,WAAW,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAqB,WAAW,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CACX,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QACjD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAO,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QAClD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAO,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,iBAAiB,CAAC;AAC3B,CAAC"}

package/dist/routes/projects.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview Project management routes
+ * @description CRUD operations for projects. Each project gets an auto-generated
+ * API key on creation. Includes API key retrieval and refresh endpoints.
+ */
+import { Hono } from "hono";
+import type { ServiceContext } from "../context.js";
+export declare function createProjectsRouter(ctx: ServiceContext): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=projects.d.ts.map

package/dist/routes/projects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/routes/projects.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAiB5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,8EAmZvD"}