@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/src/pages/api/apps/admin/platform-adapters.ts

@@ -0,0 +1,85 @@
+/**
+ * POST /api/apps/admin/platform-adapters — the first-class native adapter
+ * surface (ext-admin-04). Two actions over the pure, edge-safe adapter core
+ * ({@link platformAdapterCatalog} / {@link buildPlatformAdapterDeclaration}):
+ *
+ *   - `catalog` — the first-class adapter cards (consent purposes + performance
+ *     budget + CSP origins + per-stage destination behavior), so a merchant sees the
+ *     material effects before configuring anything.
+ *   - `build` — turn a merchant's public destination ids (per environment) into a
+ *     tenant-scoped declaration + resolved effective plan + read-model card, or
+ *     refuse. Fail-closed: an unknown adapter, a missing/invalid live id, or a
+ *     non-live stage that reuses the live id blocks with violations.
+ *
+ * Auth mirrors the other `/api/apps/admin/*` routes: the tenant is `auth.tenantId`
+ * from the resolved operator session — NEVER the request body — so a build is only
+ * ever scoped to the caller's own tenant. The build environment is derived server-side
+ * as a `candidate` stage, so the browser can never forge a live-stage declaration.
+ * Configuring is a manage action ({@link requireManageRole}). The route does NOT
+ * persist — staging/publishing a produced candidate is ext-admin-07's lifecycle.
+ */
+import type { APIContext } from "astro";
+import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
+import { json, requireManageRole } from "@/lib/apps/adminService.js";
+import {
+  platformAdapterCatalog,
+  buildPlatformAdapterDeclaration,
+  resolveBrowserEnvironment,
+  INTEGRATION_SITE_SURFACES,
+  type IntegrationSiteSurface,
+} from "@tot/public-runtime";
+
+export const prerender = false;
+
+export async function POST(context: APIContext): Promise<Response> {
+  const url = new URL(context.request.url);
+  const requestedTenant = url.searchParams.get("tenant");
+  const auth = await resolveOperatorSession(context, requestedTenant);
+  if (!auth.ok) return json({ error: auth.message }, auth.status);
+  const roleDenied = requireManageRole(auth);
+  if (roleDenied) return roleDenied;
+
+  let body: unknown;
+  try {
+    body = await context.request.json();
+  } catch {
+    return json({ error: "request body must be JSON" }, 400);
+  }
+  if (typeof body !== "object" || body === null) {
+    return json({ error: "request body must be a JSON object" }, 400);
+  }
+  const action = (body as { action?: unknown }).action;
+
+  if (action === "catalog") {
+    return json({ catalog: platformAdapterCatalog() });
+  }
+
+  if (action === "build") {
+    const fields = (body as { fields?: unknown }).fields;
+    const base = typeof fields === "object" && fields !== null ? (fields as Record<string, unknown>) : {};
+    const surfaceParam = (base["siteSurface"] as IntegrationSiteSurface | undefined) ?? "storefront";
+    const siteSurface = INTEGRATION_SITE_SURFACES.includes(surfaceParam) ? surfaceParam : "storefront";
+    // A build always targets a candidate; the environment is server-derived, so a
+    // browser can never forge a live-stage declaration.
+    const environment = resolveBrowserEnvironment({
+      siteSurface,
+      canonicalHost: url.host,
+      revision: typeof base["revision"] === "string" ? (base["revision"] as string) : "adapter-candidate",
+      dev: false,
+      localHost: false,
+      candidate: true,
+      previewHost: false,
+      customizationEnv: "test",
+    });
+    const result = buildPlatformAdapterDeclaration({
+      adapterId: base["adapterId"],
+      ids: base["ids"],
+      tenantPublicId: auth.tenantId,
+      environment,
+    });
+    const status = result.ok ? 200 : result.reason === "unknown-adapter" ? 404 : 422;
+    return json({ result }, status);
+  }
+
+  return json({ error: 'action must be "catalog" or "build"' }, 400);
+}

package/apps/storefront/src/pages/api/apps/internal/order-forward.ts

@@ -23,18 +23,29 @@ import {
   receiveForwardedOrder,
   type OrderForwardInput,
 } from "@/lib/apps/orders/orderForwardReceiver.js";
+import { joinForwardedOrderConversion } from "@/lib/apps/orders/orderConversionD1.js";
+import { D1VerifiedProviderMeasurementStore } from "@/lib/apps/orders/verifiedProviderMeasurement.js";
 import type { OrderLineItem, OrderStatus } from "@/lib/apps/orders/ordersStore.js";
 import { recordActivity } from "@/lib/activity/recordActivity";
 
 export const prerender = false;
 
 const SIGNATURE_HEADER = "x-order-forward-signature";
-const ORDER_STATUSES: readonly OrderStatus[] = ["created", "fulfilled", "cancelled"];
+const ORDER_STATUSES: readonly OrderStatus[] = ["created", "fulfilled", "refunded", "cancelled"];
 
 function json(body: unknown, status: number): Response {
   return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
 }
 
+/** Coarse, non-PII conversion-join diagnostic (never the order id or correlation token). */
+function logConversionDiag(fields: Record<string, unknown>): void {
+  try {
+    console.warn("[diag:order-conversion]", JSON.stringify(fields));
+  } catch {
+    /* diagnostics must never break the caller */
+  }
+}
+
 // --- HMAC verification -----------------------------------------------------
 // Same shape as `@tot/private-controlplane`'s `verifyGiteaSignature` (hex
 // HMAC-SHA256 over the raw body, verified via `crypto.subtle.verify` so a
@@ -85,6 +96,10 @@ interface OrderForwardBody {
   lineItems?: unknown;
   rawCustomerId?: unknown;
   createdAt?: unknown;
+  providerFields?: unknown;
+  providerEventId?: unknown;
+  occurredAt?: unknown;
+  amountMinor?: unknown;
 }
 
 function parseLineItems(value: unknown): OrderLineItem[] | string {
@@ -128,7 +143,16 @@ function parseOrderForwardInput(body: OrderForwardBody): OrderForwardInput | str
     return "rawCustomerId must be a string";
   }
   if (body.createdAt !== undefined && typeof body.createdAt !== "string") return "createdAt must be a string";
+  if (
+    body.providerFields !== undefined &&
+    (typeof body.providerFields !== "object" || body.providerFields === null || Array.isArray(body.providerFields))
+  ) {
+    return "providerFields must be an object";
+  }
 
+  if (body.providerEventId !== undefined && (typeof body.providerEventId !== "string" || !body.providerEventId.trim())) return "providerEventId must be a non-empty string";
+  if (body.occurredAt !== undefined && typeof body.occurredAt !== "string") return "occurredAt must be a string";
+  if (body.amountMinor !== undefined && (typeof body.amountMinor !== "number" || !Number.isSafeInteger(body.amountMinor) || body.amountMinor < 0)) return "amountMinor must be a non-negative safe integer";
   return {
     tenantId: body.tenantId,
     externalOrderId: body.externalOrderId,
@@ -140,6 +164,10 @@ function parseOrderForwardInput(body: OrderForwardBody): OrderForwardInput | str
     lineItems,
     rawCustomerId: body.rawCustomerId as string | undefined,
     createdAt: body.createdAt as string | undefined,
+    providerEventId: body.providerEventId as string | undefined,
+    occurredAt: body.occurredAt as string | undefined,
+    amountMinor: body.amountMinor as number | undefined,
+    providerFields: body.providerFields as Record<string, unknown> | undefined,
   };
 }
 
@@ -168,7 +196,51 @@ export async function POST(context: APIContext): Promise<Response> {
   const d1 = await readD1("STOREFRONT_APPS_DB");
   if (!d1) return json({ error: "orders store not configured" }, 503);
 
-  const result = await receiveForwardedOrder(fromD1(d1), input);
+  const db = fromD1(d1);
+  const result = await receiveForwardedOrder(db, input);
+
+
+  // This local-only outbox runs only after raw-body HMAC verification and the
+  // trusted order receiver. Its failure is fail-soft: commerce still ACKs.
+  try {
+    const measurement = await new D1VerifiedProviderMeasurementStore(db).record(input);
+    if (measurement.outcome === "recorded") {
+      logConversionDiag({ tenantId: input.tenantId, env: input.env, regulatedMeasurement: "recorded" });
+    }
+  } catch (cause) {
+    logConversionDiag({
+      tenantId: input.tenantId,
+      env: input.env,
+      regulatedMeasurement: "outbox-unavailable",
+      error: cause instanceof Error ? cause.name : "unknown",
+    });
+  }
+
+  // Join the verified order to its browser handoff correlation and produce the
+  // authoritative server conversion event(s) — ext-commerce-05 destinations fan
+  // these out. The join owns idempotency + single-use replay defense; a failure
+  // here must never fail the order ACK, so it is fail-soft (logged, swallowed).
+  try {
+    const conversion = await joinForwardedOrderConversion(db, input, result);
+    if (conversion.events.length > 0) {
+      // Coarse, non-PII diagnostic: attribution outcome + conversion count only —
+      // never the order id, correlation token, or any customer field.
+      logConversionDiag({
+        tenantId: input.tenantId,
+        env: input.env,
+        conversions: conversion.events.length,
+        attributed: conversion.attribution.attributed,
+        reason: conversion.attribution.attributed ? undefined : conversion.attribution.reason,
+      });
+    }
+  } catch (cause) {
+    logConversionDiag({
+      tenantId: input.tenantId,
+      env: input.env,
+      error: cause instanceof Error ? cause.name : "unknown",
+    });
+  }
+
   // D11: HIGH-VOLUME machine action (the tot-foxycart forwarder, HMAC-authed) → analytics
   // only, never timelined. Coarse dimensions only; customer/order ids never stored.
   recordActivity({

package/apps/storefront/src/pages/api/blog/[collection]/[slug]/react.ts

@@ -0,0 +1,104 @@
+/**
+ * E1.1 — public reaction endpoint. POST a reaction for the post addressed by the
+ * route (`/api/blog/<collection>/<slug>/react`); returns the post's full reaction
+ * tallies as JSON. Anonymous, no identity — the reader is never authenticated.
+ *
+ * Discipline (mirrors the other public POSTs, `newsletter.ts` / `rum/vitals.ts`):
+ *   - Tenant is resolved from `locals.tenant`, NEVER the request body.
+ *   - A soft per-IP KV rate limit stops trivial scripted inflation; over-cap
+ *     returns the current tallies (429) without counting — abuse blast-radius is
+ *     ~0 (a counter), so the cap is lenient.
+ *   - Never 500. Every path returns a clean JSON response; `recordReaction` is
+ *     itself best-effort and never throws.
+ */
+import type { APIRoute } from "astro";
+import { readKv } from "@/lib/env";
+import {
+  getReactionCounts,
+  isReaction,
+  recordReaction,
+  type Reaction,
+} from "@/lib/blog/reactions";
+import { checkRateLimit } from "@/lib/rate/kvWindow";
+
+export const prerender = false;
+
+const RATE_WINDOW_SECONDS = 60;
+const RATE_MAX_PER_WINDOW = 10;
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8" },
+  });
+}
+
+/** Best-effort client IP for rate-limit keying — Cloudflare's header, else XFF. */
+function clientIp(request: Request): string {
+  const cf = request.headers.get("cf-connecting-ip");
+  if (cf) return cf;
+  const xff = request.headers.get("x-forwarded-for");
+  if (xff) return xff.split(",")[0]!.trim();
+  return "unknown";
+}
+
+/** Pull the reaction from a JSON or form-encoded body. */
+async function readReaction(request: Request): Promise<string | null> {
+  try {
+    const type = request.headers.get("content-type") ?? "";
+    if (type.includes("application/json")) {
+      const body = (await request.json()) as { reaction?: unknown };
+      return typeof body.reaction === "string" ? body.reaction : null;
+    }
+    const form = await request.formData();
+    const value = form.get("reaction");
+    return typeof value === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+export const POST: APIRoute = async (context) => {
+  const tenantId = context.locals?.tenant?.tenant_id;
+  const collection = context.params.collection;
+  const slug = context.params.slug;
+  if (!tenantId || !collection || !slug) {
+    return json({ ok: false, error: "not_found", counts: {} as Record<Reaction, number> }, 404);
+  }
+
+  const reaction = await readReaction(context.request);
+  const kv = await readKv("TENANT_CACHE");
+
+  if (!isReaction(reaction)) {
+    return json(
+      {
+        ok: false,
+        error: "invalid_reaction",
+        counts: await getReactionCounts(kv, tenantId, collection, slug),
+      },
+      400,
+    );
+  }
+
+  const { allowed } = await checkRateLimit(kv, `react:${tenantId}:${clientIp(context.request)}`, {
+    windowSeconds: RATE_WINDOW_SECONDS,
+    maxRequests: RATE_MAX_PER_WINDOW,
+  });
+  if (!allowed) {
+    return json(
+      {
+        ok: false,
+        error: "rate_limited",
+        counts: await getReactionCounts(kv, tenantId, collection, slug),
+      },
+      429,
+    );
+  }
+
+  // Best-effort: no-ops for a non-live post; never throws. When there is no KV
+  // binding (local dev) the increment can't persist, but we still return the
+  // (all-zero) tallies so the client has a consistent shape.
+  if (kv) await recordReaction(kv, tenantId, collection, slug, reaction);
+
+  return json({ ok: true, counts: await getReactionCounts(kv, tenantId, collection, slug) });
+};

package/apps/storefront/src/pages/api/commerce/checkout-handoff.ts

@@ -0,0 +1,77 @@
+/**
+ * POST /api/commerce/checkout-handoff — the checkout-correlation MINT seam
+ * (ext-commerce-10).
+ *
+ * The shopper's analytics consent is a CLIENT-side decision (CMP / native banner),
+ * but the correlation token is minted under the SERVER-only signing secret. So at the
+ * handoff the client posts its LIVE consent snapshot and the server mints the token,
+ * returning ONLY the opaque passthrough cart field to attach to the managed-cart form.
+ * The signing secret never leaves the server; the token carries no PII and no secret.
+ *
+ * Server-owned by construction:
+ *   - The tenant and the {@link IntegrationEnvironment} stage come from `context.locals`
+ *     (the renderer-owned `BrowserEnvironment`), NEVER from the request body — a client
+ *     cannot mint a cross-tenant or cross-stage token.
+ *   - The consent snapshot is parsed FAIL-CLOSED (`parseConsentSnapshot`): an absent,
+ *     forged, or tampered snapshot collapses to default-deny → unattributed.
+ *   - No store on this tenant, consent withheld, or no signing key → an explicit
+ *     unattributed response; the handoff proceeds, checkout is never blocked.
+ */
+import type { APIContext } from "astro";
+import { parseConsentSnapshot, defaultConsentSnapshot } from "@tot/public-runtime";
+import { resolveCheckoutHandoffCorrelation } from "@/lib/commerce/checkoutHandoffCorrelation";
+
+export const prerender = false;
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store",
+    },
+  });
+}
+
+interface HandoffBody {
+  /** The shopper's serialized consent snapshot (the `__TOT_INTEGRATION_CONSENT__` global). */
+  consent?: unknown;
+}
+
+export async function POST(context: APIContext): Promise<Response> {
+  const { tenant, browserEnvironment, commerce } = context.locals;
+
+  // No managed checkout on this tenant → nothing to attribute.
+  if (!commerce) {
+    return json({ attributed: false, reason: "no-store" });
+  }
+
+  let body: HandoffBody;
+  try {
+    body = (await context.request.json()) as HandoffBody;
+  } catch {
+    body = {};
+  }
+
+  // Fail-closed: an absent/forged/tampered snapshot is default-deny (essential only).
+  const consent = parseConsentSnapshot(body.consent) ?? defaultConsentSnapshot();
+
+  const result = await resolveCheckoutHandoffCorrelation({
+    tenant: tenant.tenant_id,
+    // Env-consistency: the request's own resolved stage, never a client value.
+    environment: browserEnvironment.environment,
+    consent,
+    // Opaque per-handoff logical id the order join threads back to.
+    eventId: crypto.randomUUID(),
+  });
+
+  if (result.attributed) {
+    // Return ONLY the opaque passthrough field; the signing secret never leaves here.
+    return json({ attributed: true, cartField: result.cartField });
+  }
+  return json({ attributed: false, reason: result.reason });
+}
+
+export async function GET(): Promise<Response> {
+  return json({ error: "method_not_allowed" }, 405);
+}

package/apps/storefront/src/pages/api/compliance/tamper.ts

@@ -0,0 +1,88 @@
+/**
+ * POST /api/compliance/tamper — the server receiver for protected-surface tamper
+ * beacons (D-R7, `integration-protected-tamper-recovery`).
+ *
+ * The browser sentinel restores safe state IN the document and posts a
+ * `TamperEvidenceBeacon` here. This route validates it fail-closed, records the
+ * durable evidence + operator alert, and — when the beacon is attributable to a
+ * single active install — SUSPENDS that install. It is a DETECTIVE control: the
+ * suspension is after-the-fact recovery, never prevention.
+ *
+ * TENANT SCOPE is server-owned: the install lookup and suspend are ALWAYS keyed on
+ * `locals.tenant` (middleware-resolved from the request host), never on the
+ * body-supplied `tenant` — a page cannot ask to suspend another tenant's app. The
+ * beacon body carries no secret (the contract rejects one), and the response is a
+ * write-path ack the emitter ignores, so a failed post never breaks the page.
+ */
+import type { APIContext } from "astro";
+import { getRegistryService, json } from "@/lib/apps/adminService.js";
+import type { AppInstall } from "@/lib/apps/registryService.js";
+import { RegistryError } from "@/lib/apps/registryService.js";
+import { planTamperRecovery, type AttributableInstall } from "@tot/public-runtime";
+
+export const prerender = false;
+
+const SYSTEM_ACTOR = "system:tamper-sentinel";
+
+function toAttributable(install: AppInstall): AttributableInstall {
+  return {
+    installId: install.installId,
+    appId: install.appId,
+    appVersion: install.appVersion,
+    status: install.status,
+  };
+}
+
+export async function POST(context: APIContext): Promise<Response> {
+  const tenantId = context.locals.tenant?.tenant_id;
+  // No resolved tenant ⇒ nothing third-party could be scoped to; accept-and-drop so
+  // the emitter never errors or retries.
+  if (!tenantId) return json({ ok: true, accepted: false }, 202);
+
+  let body: unknown;
+  try {
+    body = await context.request.json();
+  } catch {
+    return json({ ok: false, error: "invalid JSON body" }, 400);
+  }
+
+  // Resolve the tenant's installs (empty when the registry binding isn't configured
+  // in this runtime — the beacon is still validated + recorded, just not actioned).
+  const registry = await getRegistryService();
+  const installs: AttributableInstall[] =
+    registry instanceof Response
+      ? []
+      : (await registry.listByTenant(tenantId)).map(toAttributable);
+
+  const plan = planTamperRecovery(body, installs, {
+    recordId: crypto.randomUUID(),
+    receivedAt: new Date().toISOString(),
+  });
+  if (!plan.ok) return json({ ok: false, error: "invalid tamper beacon" }, 400);
+
+  const { record, suspend } = plan.plan;
+  // Durable, secret-free evidence line for operations. The beacon itself is the record.
+  // eslint-disable-next-line no-console
+  console.warn(
+    `[tamper] tenant=${tenantId} record=${record.recordId} surface=${record.beacon.surface} kind=${record.beacon.kind} recovered=${record.beacon.recovered} app=${record.beacon.attribution?.appId ?? "unattributable"}`,
+  );
+
+  let suspended = false;
+  if (suspend && !(registry instanceof Response)) {
+    try {
+      await registry.suspend(suspend.installId, SYSTEM_ACTOR);
+      suspended = true;
+    } catch (err) {
+      // An already-suspended/uninstalled install (invalid_state) is a benign
+      // no-op under rapid re-mutation; anything else is swallowed so the write
+      // path never errors the emitter. The audit row from a successful suspend is
+      // the durable trail.
+      if (!(err instanceof RegistryError)) {
+        // eslint-disable-next-line no-console
+        console.error(`[tamper] suspend failed for ${suspend.installId}`, err);
+      }
+    }
+  }
+
+  return json({ ok: true, accepted: true, recovered: record.beacon.recovered, suspended }, 202);
+}

package/apps/storefront/src/pages/api/integrations/v1/[operation].ts

@@ -0,0 +1,108 @@
+/** Published managed analytics v1 RPC transport: basePath + client method name. */
+import type { APIContext } from "astro";
+import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
+import { getManagedAnalyticsService, json, requireManageRole } from "@/lib/apps/adminService.js";
+import {
+  validateCreateIntegrationInstallRequest, validateCreateMigrationDraftRequest,
+  validateDeleteIntegrationInstallRequest, validateDeleteMigrationDraftRequest,
+  validateGetAdapterDefinitionRequest, validateGetIntegrationInstallRequest,
+  validateGetIntegrationRevisionRequest, validateGetMigrationDraftRequest,
+  validateListAdapterDefinitionsRequest, validateListIntegrationInstallsRequest,
+  validateListIntegrationRevisionsRequest, validateReviseIntegrationInstallRequest,
+  validateSetIntegrationInstallStatusRequest, validateUpdateMigrationDraftRequest,
+  type CreateIntegrationInstallRequest, type CreateMigrationDraftRequest,
+  type DeleteIntegrationInstallRequest, type DeleteMigrationDraftRequest,
+  type GetAdapterDefinitionRequest, type GetIntegrationInstallRequest,
+  type GetIntegrationRevisionRequest, type GetMigrationDraftRequest,
+  type ListAdapterDefinitionsRequest, type ListIntegrationInstallsRequest,
+  type ListIntegrationRevisionsRequest, type ReviseIntegrationInstallRequest,
+  type SetIntegrationInstallStatusRequest, type UpdateMigrationDraftRequest,
+} from "@tot/public-runtime";
+import { MANAGED_ANALYTICS_READ_OPERATIONS, managedAnalyticsOpaqueId, sanitizeManagedAnalyticsOutbound, type ManagedAnalyticsOperation } from "@/lib/apps/managedAnalyticsService.js";
+
+export const prerender = false;
+type Validator = (input: unknown) => { ok: true; value: unknown } | { ok: false; violations: Array<{ path: string; code: string; message: string }> };
+
+// Null-prototype + own-property lookup: `constructor`/prototype names can never
+// enter dispatch, even if a runtime supplies them as a dynamic path segment.
+const VALIDATORS: Readonly<Record<string, Validator>> = Object.assign(Object.create(null) as Record<string, Validator>, {
+  listAdapterDefinitions: validateListAdapterDefinitionsRequest,
+  getAdapterDefinition: validateGetAdapterDefinitionRequest,
+  listIntegrationInstalls: validateListIntegrationInstallsRequest,
+  getIntegrationInstall: validateGetIntegrationInstallRequest,
+  listIntegrationRevisions: validateListIntegrationRevisionsRequest,
+  getIntegrationRevision: validateGetIntegrationRevisionRequest,
+  getMigrationDraft: validateGetMigrationDraftRequest,
+  createMigrationDraft: validateCreateMigrationDraftRequest,
+  updateMigrationDraft: validateUpdateMigrationDraftRequest,
+  deleteMigrationDraft: validateDeleteMigrationDraftRequest,
+  createIntegrationInstall: validateCreateIntegrationInstallRequest,
+  reviseIntegrationInstall: validateReviseIntegrationInstallRequest,
+  setIntegrationInstallStatus: validateSetIntegrationInstallStatusRequest,
+  deleteIntegrationInstall: validateDeleteIntegrationInstallRequest,
+});
+
+const STATUS: Record<string, number> = {
+  invalid_request: 400, unauthorized: 401, forbidden: 403, not_found: 404,
+  validation_failed: 422, unsupported_version: 400, stale_revision: 409,
+  idempotency_conflict: 409, adapter_deprecated: 409, conflict: 409,
+  internal_error: 500,
+};
+function response(body: unknown): Response {
+  const code = body && typeof body === "object" && "error" in body
+    ? (body as { error?: { code?: string } }).error?.code : undefined;
+  return json(body, code ? STATUS[code] ?? 500 : 200);
+}
+function routeError(code: string, message: string, details?: Array<{ path: string; code: string; message: string }>): Response {
+  return response({ apiVersion: "v1", requestId: managedAnalyticsOpaqueId("req"), error: { code, message, ...(details?.length ? { details } : {}) } });
+}
+function operationResponse(operation: ManagedAnalyticsOperation, body: unknown): Response {
+  const safe = sanitizeManagedAnalyticsOutbound(operation, body);
+  return safe === null ? routeError("internal_error", "The integration service could not complete the request.") : response(safe);
+}
+
+export async function POST(context: APIContext): Promise<Response> {
+  try {
+    const operation = context.params.operation;
+    if (!operation || !Object.prototype.hasOwnProperty.call(VALIDATORS, operation)) {
+      return routeError("invalid_request", "Unknown managed analytics v1 operation.");
+    }
+    const op = operation as ManagedAnalyticsOperation;
+    const url = new URL(context.request.url);
+    const auth = await resolveOperatorSession(context, url.searchParams.get("tenant"));
+    if (!auth.ok) return routeError(auth.status === 401 ? "unauthorized" : "forbidden", "The request is not authorized.");
+    if (!MANAGED_ANALYTICS_READ_OPERATIONS.has(op) && requireManageRole(auth)) {
+      return routeError("forbidden", "The request is not authorized.");
+    }
+    let raw: unknown;
+    try { raw = await context.request.json(); }
+    catch { return routeError("invalid_request", "The request body must be valid JSON."); }
+    const parsed = VALIDATORS[operation]!(raw);
+    if (!parsed.ok) {
+      const unsupportedVersion = parsed.violations.some(({ path, code }) => path === "apiVersion" && code === "unsupported_value");
+      return routeError(unsupportedVersion ? "unsupported_version" : "invalid_request", unsupportedVersion ? "The API version is not supported." : "The request failed validation.", parsed.violations);
+    }
+    const service = await getManagedAnalyticsService();
+    if (service instanceof Response) return routeError("internal_error", "The integration service is unavailable.");
+    const ctx = { tenantId: auth.tenantId, actor: auth.actor };
+    const request = parsed.value;
+    switch (op) {
+      case "listAdapterDefinitions": return operationResponse(op, service.listAdapterDefinitions(request as ListAdapterDefinitionsRequest));
+      case "getAdapterDefinition": return operationResponse(op, service.getAdapterDefinition((request as GetAdapterDefinitionRequest).query.adapterId));
+      case "listIntegrationInstalls": return operationResponse(op, await service.listIntegrationInstalls(ctx, request as ListIntegrationInstallsRequest));
+      case "getIntegrationInstall": return operationResponse(op, await service.getIntegrationInstall(ctx, (request as GetIntegrationInstallRequest).query.installId));
+      case "listIntegrationRevisions": { const value = request as ListIntegrationRevisionsRequest; return operationResponse(op, await service.listIntegrationRevisions(ctx, value.query.installId, value.query)); }
+      case "getIntegrationRevision": { const value = request as GetIntegrationRevisionRequest; return operationResponse(op, await service.getIntegrationRevision(ctx, value.query.installId, value.query.revisionId)); }
+      case "getMigrationDraft": return operationResponse(op, await service.getMigrationDraft(ctx, (request as GetMigrationDraftRequest).query.draftId));
+      case "createMigrationDraft": return operationResponse(op, await service.createMigrationDraft(ctx, request as CreateMigrationDraftRequest));
+      case "updateMigrationDraft": return operationResponse(op, await service.updateMigrationDraft(ctx, request as UpdateMigrationDraftRequest));
+      case "deleteMigrationDraft": return operationResponse(op, await service.deleteMigrationDraft(ctx, request as DeleteMigrationDraftRequest));
+      case "createIntegrationInstall": return operationResponse(op, await service.createIntegrationInstall(ctx, request as CreateIntegrationInstallRequest));
+      case "reviseIntegrationInstall": return operationResponse(op, await service.reviseIntegrationInstall(ctx, request as ReviseIntegrationInstallRequest));
+      case "setIntegrationInstallStatus": return operationResponse(op, await service.setIntegrationInstallStatus(ctx, request as SetIntegrationInstallStatusRequest));
+      case "deleteIntegrationInstall": return operationResponse(op, await service.deleteIntegrationInstall(ctx, request as DeleteIntegrationInstallRequest));
+    }
+  } catch {
+    return routeError("internal_error", "The integration service could not complete the request.");
+  }
+}