maestro-flow 0.1.4 → 0.2.0

package/dist/src/middleware/rate-limit.d.ts

@@ -0,0 +1,9 @@
+import type { Context, Next } from 'hono';
+export declare function createRateLimiter(options: {
+    windowMs: number;
+    maxRequests: number;
+}): (c: Context, next: Next) => Promise<void | (Response & import("hono").TypedResponse<{
+    error: string;
+    retryAfter: number;
+}, 429, "json">)>;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/src/middleware/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO1C,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,IAqBpE,GAAG,OAAO,EAAE,MAAM,IAAI;;;kBA+BrC"}

package/dist/src/middleware/rate-limit.js

@@ -0,0 +1,40 @@
+export function createRateLimiter(options) {
+    const store = new Map();
+    // Periodic cleanup of expired entries
+    const cleanupInterval = setInterval(() => {
+        const now = Date.now();
+        store.forEach((entry, key) => {
+            if (now > entry.resetAt) {
+                store.delete(key);
+            }
+        });
+    }, options.windowMs * 2);
+    // Prevent the timer from keeping the process alive
+    if (cleanupInterval.unref) {
+        cleanupInterval.unref();
+    }
+    return async (c, next) => {
+        const clientId = c.req.header('x-forwarded-for')?.split(',')[0]?.trim() ||
+            c.req.header('x-real-ip') ||
+            'unknown';
+        const now = Date.now();
+        const entry = store.get(clientId);
+        if (!entry || now > entry.resetAt) {
+            store.set(clientId, {
+                count: 1,
+                resetAt: now + options.windowMs,
+            });
+            return next();
+        }
+        if (entry.count >= options.maxRequests) {
+            const retryAfter = Math.ceil((entry.resetAt - now) / 1000);
+            return c.json({
+                error: 'Too many requests',
+                retryAfter,
+            }, 429);
+        }
+        entry.count++;
+        return next();
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/src/middleware/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,iBAAiB,CAAC,OAAkD;IAClF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEhD,sCAAsC;IACtC,MAAM,eAAe,GAAG,WAAW,CACjC,GAAG,EAAE;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBACxB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,EACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CACrB,CAAC;IAEF,mDAAmD;IACnD,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC1B,eAAe,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,QAAQ,GACZ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YACtD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YACzB,SAAS,CAAC;QAEZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;gBAClB,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ;aAChC,CAAC,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,mBAAmB;gBAC1B,UAAU;aACX,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/middleware/tenant.d.ts

@@ -0,0 +1,17 @@
+import type { Context, Next } from 'hono';
+import { TenantConnectionManager } from '../db/connection-pool.js';
+export interface TenantContext {
+    orgId: string;
+    slug: string;
+    role: string;
+}
+export declare function createTenantMiddleware(db: any, tenantManager: TenantConnectionManager): (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+}, 401, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 400, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 404, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 403, "json">) | undefined>;
+//# sourceMappingURL=tenant.d.ts.map

package/dist/src/middleware/tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/middleware/tenant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,GAAG,EACP,aAAa,EAAE,uBAAuB,IAExB,GAAG,OAAO,EAAE,MAAM,IAAI;;;;;;;;8BAmErC"}

package/dist/src/middleware/tenant.js

@@ -0,0 +1,57 @@
+import { eq, and } from 'drizzle-orm';
+import { organizations, organizationMembers } from '../db/schema/core/organizations.js';
+export function createTenantMiddleware(db, tenantManager) {
+    return async (c, next) => {
+        const user = c.get('user');
+        if (!user) {
+            return c.json({ error: 'Authentication required' }, 401);
+        }
+        // Parse tenant identifier: Header first
+        let tenantSlug = c.req.header('X-Tenant-Id');
+        // Fallback: subdomain from Host header
+        if (!tenantSlug) {
+            const host = c.req.header('Host') || '';
+            const parts = host.split('.');
+            const subdomain = parts[0];
+            if (subdomain && subdomain !== 'www' && subdomain !== 'teamforge' && parts.length > 1) {
+                tenantSlug = subdomain;
+            }
+        }
+        if (!tenantSlug) {
+            return c.json({ error: 'Tenant not specified. Provide X-Tenant-Id header or use tenant subdomain.' }, 400);
+        }
+        // Validate slug format
+        if (!/^[a-z0-9][a-z0-9-]*[a-z0-9]$/.test(tenantSlug) && tenantSlug.length > 1) {
+            // Allow org- prefix slugs
+            if (!/^org-[a-z0-9]+$/.test(tenantSlug)) {
+                return c.json({ error: 'Invalid tenant identifier' }, 400);
+            }
+        }
+        // Query organization by slug
+        const org = await db.query.organizations.findFirst({
+            where: eq(organizations.slug, tenantSlug),
+        });
+        if (!org) {
+            return c.json({ error: 'Organization not found' }, 404);
+        }
+        // Verify membership
+        const membership = await db.query.organizationMembers.findFirst({
+            where: and(eq(organizationMembers.orgId, org.id), eq(organizationMembers.userId, user.id)),
+        });
+        if (!membership) {
+            return c.json({ error: 'Access denied: Not a member of this organization' }, 403);
+        }
+        // Set tenant database connection
+        const { db: tenantDb, client } = await tenantManager.getTenantDb(tenantSlug);
+        c.set('tenant', { orgId: org.id, slug: tenantSlug, role: membership.role });
+        c.set('tenantDb', tenantDb);
+        c.set('tenantClient', client);
+        try {
+            await next();
+        }
+        finally {
+            await tenantManager.releaseTenantConnection(client);
+        }
+    };
+}
+//# sourceMappingURL=tenant.js.map

package/dist/src/middleware/tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../../src/middleware/tenant.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AASxF,MAAM,UAAU,sBAAsB,CACpC,EAAO,EACP,aAAsC;IAEtC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,wCAAwC;QACxC,IAAI,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE7C,uCAAuC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtF,UAAU,GAAG,SAAS,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,2EAA2E,EAAE,EACtF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9E,0BAA0B;YAC1B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;YACjD,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,oBAAoB;QACpB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC;YAC9D,KAAK,EAAE,GAAG,CACR,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,EACrC,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CACxC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QAED,iCAAiC;QACjC,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC7E,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,MAAM,aAAa,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/middleware/validation.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+import type { Context, Next } from 'hono';
+export declare const registerSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+    displayName: z.ZodString;
+}, z.core.$strip>;
+export declare const loginSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>;
+export declare const refreshTokenSchema: z.ZodObject<{
+    refreshToken: z.ZodString;
+}, z.core.$strip>;
+export declare const createOrgSchema: z.ZodObject<{
+    name: z.ZodString;
+    slug: z.ZodString;
+}, z.core.$strip>;
+export declare const updateOrgSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const inviteMemberSchema: z.ZodObject<{
+    email: z.ZodString;
+    role: z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+        guest: "guest";
+    }>;
+}, z.core.$strip>;
+export declare const updateRoleSchema: z.ZodObject<{
+    role: z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+        guest: "guest";
+    }>;
+}, z.core.$strip>;
+export declare function validateBody<T extends z.ZodType>(schema: T): (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+}, 400, "json">) | undefined>;
+//# sourceMappingURL=validation.d.ts.map

package/dist/src/middleware/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/middleware/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AAEH,eAAO,MAAM,WAAW;;;iBAGtB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AAEH,eAAO,MAAM,eAAe;;;iBAO1B,CAAC;AAEH,eAAO,MAAM,eAAe;;iBAE1B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;iBAG7B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;iBAE3B,CAAC;AAEH,wBAAgB,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,IAC3C,GAAG,OAAO,EAAE,MAAM,IAAI;;8BAmBrC"}

package/dist/src/middleware/validation.js

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+export const registerSchema = z.object({
+    email: z.string().email(),
+    password: z.string().min(8).max(128),
+    displayName: z.string().min(1).max(100),
+});
+export const loginSchema = z.object({
+    email: z.string().email(),
+    password: z.string().min(1),
+});
+export const refreshTokenSchema = z.object({
+    refreshToken: z.string().min(1),
+});
+export const createOrgSchema = z.object({
+    name: z.string().min(1).max(200),
+    slug: z
+        .string()
+        .min(1)
+        .max(100)
+        .regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
+});
+export const updateOrgSchema = z.object({
+    name: z.string().min(1).max(200).optional(),
+});
+export const inviteMemberSchema = z.object({
+    email: z.string().email(),
+    role: z.enum(['admin', 'member', 'guest']),
+});
+export const updateRoleSchema = z.object({
+    role: z.enum(['admin', 'member', 'guest']),
+});
+export function validateBody(schema) {
+    return async (c, next) => {
+        try {
+            const body = await c.req.json();
+            const result = schema.parse(body);
+            c.set('validatedBody', result);
+            await next();
+        }
+        catch (error) {
+            if (error instanceof z.ZodError) {
+                return c.json({
+                    error: 'Validation failed',
+                    details: error.issues,
+                }, 400);
+            }
+            return c.json({ error: 'Invalid request body' }, 400);
+        }
+    };
+}
+//# sourceMappingURL=validation.js.map

package/dist/src/middleware/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/middleware/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,8BAA8B,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY,CAAsB,MAAS;IACzD,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC/B,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAChC,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,KAAK,CAAC,MAAM;iBACtB,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/routes/auth.d.ts

@@ -0,0 +1,3 @@
+import { Hono } from 'hono';
+export declare function createAuthRoutes(db: any): Hono;
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/routes/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/routes/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAgB5B,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,GAAG,GAAG,IAAI,CA6F9C"}

package/dist/src/routes/auth.js

@@ -0,0 +1,77 @@
+import { Hono } from 'hono';
+import { createHash } from 'crypto';
+import { eq } from 'drizzle-orm';
+import { users } from '../db/schema/core/users.js';
+import { registerUser, ConflictError } from '../services/auth.service.js';
+import { generateTokenPair, verifyAccessToken, rotateRefreshToken, revokeRefreshToken, revokeAllUserTokens, } from '../services/token.service.js';
+import { createRateLimiter } from '../middleware/rate-limit.js';
+import { validateBody, registerSchema, loginSchema, refreshTokenSchema } from '../middleware/validation.js';
+import { verifyPassword } from '../services/password.service.js';
+export function createAuthRoutes(db) {
+    const authRoutes = new Hono();
+    // POST /register
+    authRoutes.post('/register', createRateLimiter({ windowMs: 15 * 60 * 1000, maxRequests: 5 }), validateBody(registerSchema), async (c) => {
+        const body = c.get('validatedBody');
+        const result = await registerUser(db, body);
+        const tokens = await generateTokenPair(result.user.id, result.user.email, db);
+        return c.json({ ...result, tokens }, 201);
+    });
+    // POST /login
+    authRoutes.post('/login', createRateLimiter({ windowMs: 15 * 60 * 1000, maxRequests: 10 }), validateBody(loginSchema), async (c) => {
+        const { email, password } = c.get('validatedBody');
+        const user = await db.query.users.findFirst({
+            where: eq(users.email, email),
+        });
+        if (!user) {
+            return c.json({ error: 'Invalid credentials' }, 401);
+        }
+        const valid = await verifyPassword(password, user.passwordHash);
+        if (!valid) {
+            return c.json({ error: 'Invalid credentials' }, 401);
+        }
+        const tokens = await generateTokenPair(user.id, user.email, db);
+        return c.json({
+            user: {
+                id: user.id,
+                email: user.email,
+                displayName: user.displayName,
+            },
+            tokens,
+        });
+    });
+    // POST /refresh
+    authRoutes.post('/refresh', validateBody(refreshTokenSchema), async (c) => {
+        const { refreshToken } = c.get('validatedBody');
+        const tokens = await rotateRefreshToken(refreshToken, db);
+        if (!tokens) {
+            return c.json({ error: 'Invalid or expired refresh token' }, 401);
+        }
+        return c.json({ tokens });
+    });
+    // POST /logout
+    authRoutes.post('/logout', async (c) => {
+        const authHeader = c.req.header('Authorization');
+        const token = authHeader?.replace('Bearer ', '');
+        if (token) {
+            const payload = await verifyAccessToken(token);
+            if (payload) {
+                await revokeAllUserTokens(payload.sub, db);
+            }
+        }
+        const body = await c.req.json().catch(() => ({}));
+        if (body.refreshToken) {
+            const hash = createHash('sha256').update(body.refreshToken).digest('hex');
+            await revokeRefreshToken(hash, db);
+        }
+        return c.json({ message: 'Logged out' });
+    });
+    // Error handler
+    authRoutes.onError((err, c) => {
+        if (err instanceof ConflictError) {
+            return c.json({ error: err.message }, 409);
+        }
+        return c.json({ error: 'Internal server error' }, 500);
+    });
+    return authRoutes;
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/routes/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC5G,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE,MAAM,UAAU,gBAAgB,CAAC,EAAO;IACtC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,iBAAiB;IACjB,UAAU,CAAC,IAAI,CACb,WAAW,EACX,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAC/D,YAAY,CAAC,cAAc,CAAC,EAC5B,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC,CACF,CAAC;IAEF,cAAc;IACd,UAAU,CAAC,IAAI,CACb,QAAQ,EACR,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAChE,YAAY,CAAC,WAAW,CAAC,EACzB,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC1C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B;YACD,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,gBAAgB;IAChB,UAAU,CAAC,IAAI,CACb,UAAU,EACV,YAAY,CAAC,kBAAkB,CAAC,EAChC,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC,CACF,CAAC;IAEF,eAAe;IACf,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAEjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1E,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAChB,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/src/routes/members.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import { TenantConnectionManager } from '../db/connection-pool.js';
+export declare function createMemberRoutes(db: any, tenantManager: TenantConnectionManager): Hono;
+//# sourceMappingURL=members.d.ts.map

package/dist/src/routes/members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../../../src/routes/members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,GAAG,EACP,aAAa,EAAE,uBAAuB,GACrC,IAAI,CA4JN"}

package/dist/src/routes/members.js

@@ -0,0 +1,114 @@
+import { Hono } from 'hono';
+import { eq, and } from 'drizzle-orm';
+import { users } from '../db/schema/core/users.js';
+import { organizationMembers } from '../db/schema/core/organizations.js';
+import { requireAuth } from '../middleware/auth.js';
+import { createTenantMiddleware } from '../middleware/tenant.js';
+import { requirePermission } from '../middleware/permission.js';
+import { validateBody, inviteMemberSchema, updateRoleSchema } from '../middleware/validation.js';
+export function createMemberRoutes(db, tenantManager) {
+    const memberRoutes = new Hono();
+    const tenantMiddleware = createTenantMiddleware(db, tenantManager);
+    // POST /invite — Invite a member
+    memberRoutes.post('/invite', requireAuth(), tenantMiddleware, requirePermission('member', 'invite'), validateBody(inviteMemberSchema), async (c) => {
+        const tenant = c.get('tenant');
+        const { email, role } = c.get('validatedBody');
+        // Find user by email
+        const targetUser = await db.query.users.findFirst({
+            where: eq(users.email, email),
+        });
+        if (!targetUser) {
+            return c.json({ error: 'User not found' }, 404);
+        }
+        // Check if already a member
+        const existing = await db.query.organizationMembers.findFirst({
+            where: and(eq(organizationMembers.orgId, tenant.orgId), eq(organizationMembers.userId, targetUser.id)),
+        });
+        if (existing) {
+            return c.json({ error: 'User is already a member' }, 409);
+        }
+        // Add member
+        await db.insert(organizationMembers).values({
+            orgId: tenant.orgId,
+            userId: targetUser.id,
+            role,
+        });
+        return c.json({
+            member: {
+                userId: targetUser.id,
+                email: targetUser.email,
+                displayName: targetUser.displayName,
+                role,
+            },
+        }, 201);
+    });
+    // GET / — List members
+    memberRoutes.get('/', requireAuth(), tenantMiddleware, async (c) => {
+        const tenant = c.get('tenant');
+        const members = await db.query.organizationMembers.findMany({
+            where: eq(organizationMembers.orgId, tenant.orgId),
+            with: {
+                user: {
+                    columns: {
+                        id: true,
+                        email: true,
+                        displayName: true,
+                        avatarUrl: true,
+                    },
+                },
+            },
+        });
+        return c.json({ members });
+    });
+    // PATCH /:memberId/role — Update member role
+    memberRoutes.patch('/:memberId/role', requireAuth(), tenantMiddleware, requirePermission('member', 'role'), validateBody(updateRoleSchema), async (c) => {
+        const tenant = c.get('tenant');
+        const { role } = c.get('validatedBody');
+        const memberId = c.req.param('memberId') ?? '';
+        // Find target membership
+        const targetMembership = await db.query.organizationMembers.findFirst({
+            where: and(eq(organizationMembers.id, memberId), eq(organizationMembers.orgId, tenant.orgId)),
+        });
+        if (!targetMembership) {
+            return c.json({ error: 'Member not found' }, 404);
+        }
+        // Cannot modify owner role
+        if (targetMembership.role === 'owner') {
+            return c.json({ error: 'Cannot modify owner role' }, 403);
+        }
+        // Update role
+        await db
+            .update(organizationMembers)
+            .set({ role })
+            .where(eq(organizationMembers.id, memberId));
+        return c.json({
+            member: {
+                ...targetMembership,
+                role,
+            },
+        });
+    });
+    // DELETE /:memberId — Remove member
+    memberRoutes.delete('/:memberId', requireAuth(), tenantMiddleware, requirePermission('member', 'remove'), async (c) => {
+        const tenant = c.get('tenant');
+        const memberId = c.req.param('memberId') ?? '';
+        // Find target membership
+        const targetMembership = await db.query.organizationMembers.findFirst({
+            where: and(eq(organizationMembers.id, memberId), eq(organizationMembers.orgId, tenant.orgId)),
+        });
+        if (!targetMembership) {
+            return c.json({ error: 'Member not found' }, 404);
+        }
+        // Cannot remove owner
+        if (targetMembership.role === 'owner') {
+            return c.json({ error: 'Cannot remove owner' }, 403);
+        }
+        // Remove member
+        await db
+            .delete(organizationMembers)
+            .where(eq(organizationMembers.id, memberId));
+        return c.json({ message: 'Member removed' });
+    });
+    return memberRoutes;
+}
+//# sourceMappingURL=members.js.map

package/dist/src/routes/members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.js","sourceRoot":"","sources":["../../../src/routes/members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAiB,MAAM,oCAAoC,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAGjG,MAAM,UAAU,kBAAkB,CAChC,EAAO,EACP,aAAsC;IAEtC,MAAM,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;IAChC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAEnE,iCAAiC;IACjC,YAAY,CAAC,IAAI,CACf,SAAS,EACT,WAAW,EAAE,EACb,gBAAgB,EAChB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACrC,YAAY,CAAC,kBAAkB,CAAC,EAChC,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAE/C,qBAAqB;QACrB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAChD,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC;YAC5D,KAAK,EAAE,GAAG,CACR,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAC3C,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAC9C;SACF,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,aAAa;QACb,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;YAC1C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,UAAU,CAAC,EAAE;YACrB,IAAI;SACL,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CACX;YACE,MAAM,EAAE;gBACN,MAAM,EAAE,UAAU,CAAC,EAAE;gBACrB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,IAAI;aACL;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,uBAAuB;IACvB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YAC1D,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YAClD,IAAI,EAAE;gBACJ,IAAI,EAAE;oBACJ,OAAO,EAAE;wBACP,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,IAAI;wBACX,WAAW,EAAE,IAAI;wBACjB,SAAS,EAAE,IAAI;qBAChB;iBACF;aACF;SACF,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,YAAY,CAAC,KAAK,CAChB,iBAAiB,EACjB,WAAW,EAAE,EACb,gBAAgB,EAChB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EACnC,YAAY,CAAC,gBAAgB,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAE/C,yBAAyB;QACzB,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC;YACpE,KAAK,EAAE,GAAG,CACR,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAC5C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;QAED,2BAA2B;QAC3B,IAAI,gBAAgB,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,cAAc;QACd,MAAM,EAAE;aACL,MAAM,CAAC,mBAAmB,CAAC;aAC3B,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE/C,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE;gBACN,GAAG,gBAAgB;gBACnB,IAAI;aACL;SACF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,oCAAoC;IACpC,YAAY,CAAC,MAAM,CACjB,YAAY,EACZ,WAAW,EAAE,EACb,gBAAgB,EAChB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACrC,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAE/C,yBAAyB;QACzB,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC;YACpE,KAAK,EAAE,GAAG,CACR,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAC5C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;QAED,sBAAsB;QACtB,IAAI,gBAAgB,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,gBAAgB;QAChB,MAAM,EAAE;aACL,MAAM,CAAC,mBAAmB,CAAC;aAC3B,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE/C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC/C,CAAC,CACF,CAAC;IAEF,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/src/routes/organizations.d.ts

@@ -0,0 +1,5 @@
+import { Hono } from 'hono';
+import { TenantConnectionManager } from '../db/connection-pool.js';
+import { TenantMigrator } from '../db/tenant-migrator.js';
+export declare function createOrgRoutes(db: any, tenantManager: TenantConnectionManager, migrator: TenantMigrator): Hono;
+//# sourceMappingURL=organizations.d.ts.map

package/dist/src/routes/organizations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../src/routes/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,wBAAgB,eAAe,CAC7B,EAAE,EAAE,GAAG,EACP,aAAa,EAAE,uBAAuB,EACtC,QAAQ,EAAE,cAAc,GACvB,IAAI,CA2HN"}

package/dist/src/routes/organizations.js

@@ -0,0 +1,97 @@
+import { Hono } from 'hono';
+import { eq } from 'drizzle-orm';
+import { organizations, organizationMembers } from '../db/schema/core/organizations.js';
+import { requireAuth } from '../middleware/auth.js';
+import { createTenantMiddleware } from '../middleware/tenant.js';
+import { requirePermission } from '../middleware/permission.js';
+import { validateBody, createOrgSchema, updateOrgSchema } from '../middleware/validation.js';
+export function createOrgRoutes(db, tenantManager, migrator) {
+    const orgRoutes = new Hono();
+    const tenantMiddleware = createTenantMiddleware(db, tenantManager);
+    // POST / — Create organization
+    orgRoutes.post('/', requireAuth(), validateBody(createOrgSchema), async (c) => {
+        const user = c.get('user');
+        const { name, slug } = c.get('validatedBody');
+        // Check slug uniqueness
+        const existing = await db.query.organizations.findFirst({
+            where: eq(organizations.slug, slug),
+        });
+        if (existing) {
+            return c.json({ error: 'Organization slug already exists' }, 409);
+        }
+        // Create organization
+        const [org] = await db
+            .insert(organizations)
+            .values({ name, slug, ownerId: user.id })
+            .returning({
+            id: organizations.id,
+            name: organizations.name,
+            slug: organizations.slug,
+        });
+        // Add creator as owner
+        await db.insert(organizationMembers).values({
+            orgId: org.id,
+            userId: user.id,
+            role: 'owner',
+        });
+        // Trigger tenant schema creation
+        try {
+            await tenantManager.createNewTenant(slug, migrator);
+        }
+        catch {
+            // Schema creation may fail if DB not connected; log but don't block
+        }
+        return c.json({
+            organization: {
+                id: org.id,
+                name: org.name,
+                slug: org.slug,
+                role: 'owner',
+            },
+        }, 201);
+    });
+    // GET / — List user's organizations
+    orgRoutes.get('/', requireAuth(), async (c) => {
+        const user = c.get('user');
+        const memberships = await db.query.organizationMembers.findMany({
+            where: eq(organizationMembers.userId, user.id),
+            with: { organization: true },
+        });
+        return c.json({
+            organizations: memberships.map((m) => ({
+                ...m.organization,
+                role: m.role,
+            })),
+        });
+    });
+    // GET /:slug — Get organization details
+    orgRoutes.get('/:slug', requireAuth(), tenantMiddleware, async (c) => {
+        const tenant = c.get('tenant');
+        return c.json({ organization: tenant });
+    });
+    // PATCH /:slug — Update organization
+    orgRoutes.patch('/:slug', requireAuth(), tenantMiddleware, requirePermission('org', 'update'), validateBody(updateOrgSchema), async (c) => {
+        const tenant = c.get('tenant');
+        const { name } = c.get('validatedBody');
+        if (name) {
+            await db
+                .update(organizations)
+                .set({ name, updatedAt: new Date() })
+                .where(eq(organizations.id, tenant.orgId));
+        }
+        return c.json({
+            organization: { ...tenant, name: name || tenant.slug },
+        });
+    });
+    // DELETE /:slug — Soft delete organization
+    orgRoutes.delete('/:slug', requireAuth(), tenantMiddleware, requirePermission('org', 'delete'), async (c) => {
+        const tenant = c.get('tenant');
+        await db
+            .update(organizations)
+            .set({ deletedAt: new Date() })
+            .where(eq(organizations.id, tenant.orgId));
+        return c.json({ message: 'Organization deleted' });
+    });
+    return orgRoutes;
+}
+//# sourceMappingURL=organizations.js.map

package/dist/src/routes/organizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../../src/routes/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAI7F,MAAM,UAAU,eAAe,CAC7B,EAAO,EACP,aAAsC,EACtC,QAAwB;IAExB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAEnE,+BAA+B;IAC/B,SAAS,CAAC,IAAI,CACZ,GAAG,EACH,WAAW,EAAE,EACb,YAAY,CAAC,eAAe,CAAC,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAE9C,wBAAwB;QACxB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;YACtD,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,sBAAsB;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACxC,SAAS,CAAC;YACT,EAAE,EAAE,aAAa,CAAC,EAAE;YACpB,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,IAAI,EAAE,aAAa,CAAC,IAAI;SACzB,CAAC,CAAC;QAEL,uBAAuB;QACvB,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;YAC1C,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,iCAAiC;QACjC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CACX;YACE,YAAY,EAAE;gBACZ,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,OAAO;aACd;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,oCAAoC;IACpC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YAC9D,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,CAAC,YAAY;gBACjB,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,SAAS,CAAC,KAAK,CACb,QAAQ,EACR,WAAW,EAAE,EACb,gBAAgB,EAChB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAClC,YAAY,CAAC,eAAe,CAAC,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAExC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,EAAE;iBACL,MAAM,CAAC,aAAa,CAAC;iBACrB,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACpC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,YAAY,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;SACvD,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,2CAA2C;IAC3C,SAAS,CAAC,MAAM,CACd,QAAQ,EACR,WAAW,EAAE,EACb,gBAAgB,EAChB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAClC,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,EAAE;aACL,MAAM,CAAC,aAAa,CAAC;aACrB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAE7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACrD,CAAC,CACF,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/services/auth.service.d.ts

@@ -0,0 +1,24 @@
+export declare class ConflictError extends Error {
+    constructor(message: string);
+}
+interface RegisterInput {
+    email: string;
+    password: string;
+    displayName: string;
+}
+interface RegisterResult {
+    user: {
+        id: string;
+        email: string;
+        displayName: string;
+    };
+    organization: {
+        id: string;
+        name: string;
+        slug: string;
+        role: 'owner';
+    };
+}
+export declare function registerUser(db: any, input: RegisterInput): Promise<RegisterResult>;
+export {};
+//# sourceMappingURL=auth.service.d.ts.map

package/dist/src/services/auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/services/auth.service.ts"],"names":[],"mappings":"AAKA,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B;AAED,UAAU,aAAa;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,cAAc;IACtB,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,YAAY,EAAE;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,OAAO,CAAC;KACf,CAAC;CACH;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,GAAG,EACP,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,cAAc,CAAC,CAgEzB"}