@stratum-hq/control-plane 0.1.0

package/dist/openapi.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerOpenApi = void 0;
+const swagger_1 = __importDefault(require("@fastify/swagger"));
+const swagger_ui_1 = __importDefault(require("@fastify/swagger-ui"));
+async function registerOpenApi(app) {
+    await app.register(swagger_1.default, {
+        openapi: {
+            info: {
+                title: "Stratum Control Plane API",
+                version: "0.1.0",
+                description: "Universal Tenant Context Engine - Control Plane",
+            },
+            components: {
+                securitySchemes: {
+                    apiKey: {
+                        type: "apiKey",
+                        in: "header",
+                        name: "X-API-Key",
+                    },
+                    bearerAuth: {
+                        type: "http",
+                        scheme: "bearer",
+                        bearerFormat: "JWT",
+                    },
+                },
+            },
+            security: [{ apiKey: [] }, { bearerAuth: [] }],
+        },
+    });
+    await app.register(swagger_ui_1.default, {
+        routePrefix: "/api/docs",
+        uiConfig: {
+            docExpansion: "list",
+            deepLinking: true,
+        },
+        staticCSP: false,
+    });
+}
+exports.registerOpenApi = registerOpenApi;
+//# sourceMappingURL=openapi.js.map

package/dist/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":";;;;;;AACA,+DAAuC;AACvC,qEAA4C;AAErC,KAAK,UAAU,eAAe,CAAC,GAAoB;IACxD,MAAM,GAAG,CAAC,QAAQ,CAAC,iBAAc,EAAE;QACjC,OAAO,EAAE;YACP,IAAI,EAAE;gBACJ,KAAK,EAAE,2BAA2B;gBAClC,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,iDAAiD;aAC/D;YACD,UAAU,EAAE;gBACV,eAAe,EAAE;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,QAAQ;wBACd,EAAE,EAAE,QAAQ;wBACZ,IAAI,EAAE,WAAW;qBAClB;oBACD,UAAU,EAAE;wBACV,IAAI,EAAE,MAAM;wBACZ,MAAM,EAAE,QAAQ;wBAChB,YAAY,EAAE,KAAK;qBACpB;iBACF;aACF;YACD,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;SAC/C;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAgB,EAAE;QACnC,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE;YACR,YAAY,EAAE,MAAM;YACpB,WAAW,EAAE,IAAI;SAClB;QACD,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAlCD,0CAkCC"}

package/dist/redis.d.ts

@@ -0,0 +1,16 @@
+import Redis from "ioredis";
+/**
+ * Create a Redis client from the REDIS_URL env var.
+ * Returns null if REDIS_URL is not configured.
+ * Connection errors are logged but never crash the process (fail-open).
+ */
+export declare function createRedisClient(): Redis | null;
+/**
+ * Get the current Redis client singleton (may be null).
+ */
+export declare function getRedisClient(): Redis | null;
+/**
+ * Health check: returns "connected", "disconnected", or "not_configured".
+ */
+export declare function checkRedisHealth(): Promise<"connected" | "disconnected" | "not_configured">;
+//# sourceMappingURL=redis.d.ts.map

package/dist/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../src/redis.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,SAAS,CAAC;AAK5B;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,KAAK,GAAG,IAAI,CAiChD;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,KAAK,GAAG,IAAI,CAE7C;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,GAAG,cAAc,GAAG,gBAAgB,CAAC,CAgBjG"}

package/dist/redis.js

@@ -0,0 +1,71 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkRedisHealth = exports.getRedisClient = exports.createRedisClient = void 0;
+const ioredis_1 = __importDefault(require("ioredis"));
+const config_js_1 = require("./config.js");
+let redisClient = null;
+/**
+ * Create a Redis client from the REDIS_URL env var.
+ * Returns null if REDIS_URL is not configured.
+ * Connection errors are logged but never crash the process (fail-open).
+ */
+function createRedisClient() {
+    if (!config_js_1.config.redisUrl) {
+        return null;
+    }
+    const client = new ioredis_1.default(config_js_1.config.redisUrl, {
+        maxRetriesPerRequest: 1,
+        retryStrategy(times) {
+            if (times > 3) {
+                // Stop retrying after 3 attempts — the app can run without Redis
+                return null;
+            }
+            return Math.min(times * 200, 2000);
+        },
+        enableOfflineQueue: false,
+        lazyConnect: true,
+    });
+    client.on("error", (err) => {
+        console.warn("[stratum] Redis connection error (rate limiting will fall back to in-memory):", err.message);
+    });
+    client.on("connect", () => {
+        console.info("[stratum] Redis connected — using Redis-backed rate limiting.");
+    });
+    // Attempt to connect; failures are non-fatal
+    client.connect().catch((err) => {
+        console.warn("[stratum] Redis initial connection failed (continuing without Redis):", err.message);
+    });
+    redisClient = client;
+    return client;
+}
+exports.createRedisClient = createRedisClient;
+/**
+ * Get the current Redis client singleton (may be null).
+ */
+function getRedisClient() {
+    return redisClient;
+}
+exports.getRedisClient = getRedisClient;
+/**
+ * Health check: returns "connected", "disconnected", or "not_configured".
+ */
+async function checkRedisHealth() {
+    if (!redisClient) {
+        return "not_configured";
+    }
+    try {
+        const result = await Promise.race([
+            redisClient.ping(),
+            new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), 1000)),
+        ]);
+        return result === "PONG" ? "connected" : "disconnected";
+    }
+    catch {
+        return "disconnected";
+    }
+}
+exports.checkRedisHealth = checkRedisHealth;
+//# sourceMappingURL=redis.js.map

package/dist/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../src/redis.ts"],"names":[],"mappings":";;;;;;AAAA,sDAA4B;AAC5B,2CAAqC;AAErC,IAAI,WAAW,GAAiB,IAAI,CAAC;AAErC;;;;GAIG;AACH,SAAgB,iBAAiB;IAC/B,IAAI,CAAC,kBAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,iBAAK,CAAC,kBAAM,CAAC,QAAQ,EAAE;QACxC,oBAAoB,EAAE,CAAC;QACvB,aAAa,CAAC,KAAa;YACzB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,iEAAiE;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,kBAAkB,EAAE,KAAK;QACzB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,OAAO,CAAC,IAAI,CAAC,+EAA+E,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACxB,OAAO,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,OAAO,CAAC,IAAI,CAAC,uEAAuE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,WAAW,GAAG,MAAM,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC;AAjCD,8CAiCC;AAED;;GAEG;AACH,SAAgB,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAFD,wCAEC;AAED;;GAEG;AACI,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,WAAW,CAAC,IAAI,EAAE;YAClB,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CACrD;SACF,CAAC,CAAC;QACH,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAhBD,4CAgBC"}

package/dist/routes/api-keys.d.ts

@@ -0,0 +1,4 @@
+import { FastifyInstance } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+export declare function createApiKeyRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/routes/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/routes/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAW1C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CAuExE"}

package/dist/routes/api-keys.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApiKeyRoutes = void 0;
+const zod_1 = require("zod");
+const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
+const createApiKeySchema = zod_1.z.object({
+    tenant_id: zod_1.z.string().uuid(),
+    name: zod_1.z.string().optional(),
+    rate_limit_max: zod_1.z.number().int().min(1).max(100_000).optional(),
+    rate_limit_window: zod_1.z.string().regex(/^\d+\s+(second|minute|hour|day)s?$/i).optional(),
+});
+function createApiKeyRoutes(stratum) {
+    return async function apiKeyRoutes(app) {
+        // POST /api/v1/api-keys — Create a new API key (plaintext returned once)
+        app.post("/", { preHandler: (0, tenant_scope_js_1.createTenantScopeGuard)(stratum, tenant_scope_js_1.fromBodyTenantId) }, async (request, reply) => {
+            const parsed = createApiKeySchema.safeParse(request.body);
+            if (!parsed.success) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "Invalid request body" }, details: parsed.error.issues });
+                return;
+            }
+            const { tenant_id, name, rate_limit_max, rate_limit_window } = parsed.data;
+            const result = await stratum.createApiKey(tenant_id, {
+                name,
+                rateLimitMax: rate_limit_max,
+                rateLimitWindow: rate_limit_window,
+            });
+            reply.status(201).send(result);
+        });
+        // GET /api/v1/api-keys — List API keys (optional ?tenant_id=)
+        app.get("/", async (request, reply) => {
+            // Scoped keys can only list keys for their own tenant
+            const tenantId = request.apiKey?.tenant_id ?? request.query.tenant_id;
+            const keys = await stratum.listApiKeys(tenantId);
+            reply.status(200).send(keys);
+        });
+        // GET /api/v1/api-keys/dormant — List dormant API keys (must be before /:id)
+        app.get("/dormant", async (request, reply) => {
+            const raw = request.query.days ? parseInt(request.query.days, 10) : 90;
+            const days = Number.isNaN(raw) || raw < 1 ? 90 : Math.min(raw, 365);
+            const keys = await stratum.listDormantKeys(days);
+            reply.status(200).send(keys);
+        });
+        // POST /api/v1/api-keys/:id/rotate — Rotate an API key
+        app.post("/:id/rotate", async (request, reply) => {
+            // Verify caller has access to this key's tenant
+            if (request.apiKey?.tenant_id) {
+                const keys = await stratum.listApiKeys(request.apiKey.tenant_id);
+                if (!keys.some(k => k.id === request.params.id)) {
+                    reply.status(404).send({ error: { code: "NOT_FOUND", message: "API key not found or already revoked" } });
+                    return;
+                }
+            }
+            const rotateSchema = zod_1.z.object({ name: zod_1.z.string().max(255).optional() });
+            const parsed = rotateSchema.parse(request.body ?? {});
+            const result = await stratum.rotateApiKey(request.params.id, parsed.name);
+            reply.status(201).send(result);
+        });
+        // DELETE /api/v1/api-keys/:id — Revoke an API key
+        app.delete("/:id", async (request, reply) => {
+            // Verify caller has access to this key's tenant
+            if (request.apiKey?.tenant_id) {
+                const keys = await stratum.listApiKeys(request.apiKey.tenant_id);
+                if (!keys.some(k => k.id === request.params.id)) {
+                    reply.status(404).send({ error: { code: "NOT_FOUND", message: "API key not found or already revoked" } });
+                    return;
+                }
+            }
+            const revoked = await stratum.revokeApiKey(request.params.id);
+            if (!revoked) {
+                reply.status(404).send({ error: { code: "NOT_FOUND", message: "API key not found or already revoked" } });
+                return;
+            }
+            reply.status(204).send();
+        });
+    };
+}
+exports.createApiKeyRoutes = createApiKeyRoutes;
+//# sourceMappingURL=api-keys.js.map

package/dist/routes/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/routes/api-keys.ts"],"names":[],"mappings":";;;AAEA,6BAAwB;AACxB,mEAA4G;AAE5G,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAC/D,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;CACtF,CAAC,CAAC;AAEH,SAAgB,kBAAkB,CAAC,OAAgB;IACjD,OAAO,KAAK,UAAU,YAAY,CAAC,GAAoB;QACrD,yEAAyE;QACzE,GAAG,CAAC,IAAI,CACN,GAAG,EACH,EAAE,UAAU,EAAE,IAAA,wCAAsB,EAAC,OAAO,EAAE,kCAAgB,CAAC,EAAE,EACjE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/H,OAAO;YACT,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE;gBACnD,IAAI;gBACJ,YAAY,EAAE,cAAc;gBAC5B,eAAe,EAAE,iBAAiB;aACnC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CACF,CAAC;QAEF,8DAA8D;QAC9D,GAAG,CAAC,GAAG,CAA0C,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC7E,sDAAsD;YACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YACtE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACjD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,GAAG,CAAC,GAAG,CAAqC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACjD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,uDAAuD;QACvD,GAAG,CAAC,IAAI,CAA6B,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC3E,gDAAgD;YAChD,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;oBAChD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;oBAC1G,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,kDAAkD;QAClD,GAAG,CAAC,MAAM,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACtE,gDAAgD;YAChD,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;oBAChD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;oBAC1G,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;gBAC1G,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAxED,gDAwEC"}

package/dist/routes/audit-logs.d.ts

@@ -0,0 +1,6 @@
+import { FastifyInstance, FastifyRequest } from "fastify";
+import type { AuditContext } from "@stratum-hq/core";
+import { Stratum } from "@stratum-hq/lib";
+export declare function buildAuditContext(request: FastifyRequest): AuditContext;
+export declare function createAuditLogRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=audit-logs.d.ts.map

package/dist/routes/audit-logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logs.d.ts","sourceRoot":"","sources":["../../src/routes/audit-logs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,CAOvE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CA2B1E"}

package/dist/routes/audit-logs.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuditLogRoutes = exports.buildAuditContext = void 0;
+const core_1 = require("@stratum-hq/core");
+function buildAuditContext(request) {
+    return {
+        actor_id: request.apiKey?.id ?? "unknown",
+        actor_type: (request.authMethod || "api_key"),
+        source_ip: request.ip,
+        request_id: request.id,
+    };
+}
+exports.buildAuditContext = buildAuditContext;
+function createAuditLogRoutes(stratum) {
+    return async function auditLogRoutes(app) {
+        // GET /api/v1/audit-logs — List audit logs with filters
+        app.get("/", async (request, reply) => {
+            const query = core_1.AuditLogQuerySchema.parse(request.query);
+            // Scoped keys can only see logs for their own tenant
+            if (request.apiKey?.tenant_id) {
+                query.tenant_id = request.apiKey.tenant_id;
+            }
+            const entries = await stratum.queryAuditLogs(query);
+            reply.status(200).send(entries);
+        });
+        // GET /api/v1/audit-logs/:id — Get single audit entry
+        app.get("/:id", async (request, reply) => {
+            const entry = await stratum.getAuditEntry(request.params.id);
+            if (!entry) {
+                reply.status(404).send({ error: { code: "NOT_FOUND", message: "Audit entry not found" } });
+                return;
+            }
+            // Enforce tenant isolation for scoped keys
+            if (request.apiKey?.tenant_id && entry.tenant_id !== request.apiKey.tenant_id) {
+                reply.status(404).send({ error: { code: "NOT_FOUND", message: "Audit entry not found" } });
+                return;
+            }
+            reply.status(200).send(entry);
+        });
+    };
+}
+exports.createAuditLogRoutes = createAuditLogRoutes;
+//# sourceMappingURL=audit-logs.js.map

package/dist/routes/audit-logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logs.js","sourceRoot":"","sources":["../../src/routes/audit-logs.ts"],"names":[],"mappings":";;;AACA,2CAAuD;AAIvD,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,SAAS;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAsB;QAClE,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,UAAU,EAAE,OAAO,CAAC,EAAE;KACvB,CAAC;AACJ,CAAC;AAPD,8CAOC;AAED,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO,KAAK,UAAU,cAAc,CAAC,GAAoB;QACvD,wDAAwD;QACxD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,0BAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvD,qDAAqD;YACrD,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7C,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACpD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,sDAAsD;QACtD,GAAG,CAAC,GAAG,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACnE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;gBAC3F,OAAO;YACT,CAAC;YACD,2CAA2C;YAC3C,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC9E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;gBAC3F,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AA5BD,oDA4BC"}

package/dist/routes/config-diff.d.ts

@@ -0,0 +1,4 @@
+import { FastifyInstance } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+export declare function createConfigDiffRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=config-diff.d.ts.map

package/dist/routes/config-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-diff.d.ts","sourceRoot":"","sources":["../../src/routes/config-diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CAgC5E"}

package/dist/routes/config-diff.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createConfigDiffRoutes = void 0;
+function createConfigDiffRoutes(stratum) {
+    return async function configDiffRoutes(app) {
+        // GET /api/v1/config/diff?tenant_a=UUID&tenant_b=UUID — Compare resolved config between two tenants
+        app.get("/diff", async (request, reply) => {
+            const { tenant_a, tenant_b } = request.query;
+            if (!tenant_a || !tenant_b) {
+                reply.status(400).send({
+                    error: {
+                        code: "VALIDATION_ERROR",
+                        message: "Both tenant_a and tenant_b query parameters are required",
+                    },
+                });
+                return;
+            }
+            if (tenant_a === tenant_b) {
+                reply.status(400).send({
+                    error: {
+                        code: "VALIDATION_ERROR",
+                        message: "tenant_a and tenant_b must be different",
+                    },
+                });
+                return;
+            }
+            const diff = await stratum.diffConfig(tenant_a, tenant_b);
+            reply.status(200).send(diff);
+        });
+    };
+}
+exports.createConfigDiffRoutes = createConfigDiffRoutes;
+//# sourceMappingURL=config-diff.js.map

package/dist/routes/config-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-diff.js","sourceRoot":"","sources":["../../src/routes/config-diff.ts"],"names":[],"mappings":";;;AAGA,SAAgB,sBAAsB,CAAC,OAAgB;IACrD,OAAO,KAAK,UAAU,gBAAgB,CAAC,GAAoB;QACzD,oGAAoG;QACpG,GAAG,CAAC,GAAG,CACL,OAAO,EACP,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;YAE7C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,0DAA0D;qBACpE;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,yCAAyC;qBACnD;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAjCD,wDAiCC"}

package/dist/routes/config.d.ts

@@ -0,0 +1,4 @@
+import { FastifyInstance } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+export declare function createConfigRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=config.d.ts.map

package/dist/routes/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI1C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CAgDxE"}

package/dist/routes/config.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createConfigRoutes = void 0;
+const core_1 = require("@stratum-hq/core");
+const audit_logs_js_1 = require("./audit-logs.js");
+const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
+function createConfigRoutes(stratum) {
+    return async function configRoutes(app) {
+        // Tenant-scoped keys can only access config for their own tenant subtree
+        app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeGuard)(stratum, tenant_scope_js_1.fromParamId));
+        // GET /api/v1/tenants/:id/config — Get resolved config
+        app.get("/", async (request, reply) => {
+            const resolved = await stratum.resolveConfig(request.params.id);
+            reply.status(200).send(resolved);
+        });
+        // PUT /api/v1/tenants/:id/config/:key — Set config value
+        app.put("/:key", async (request, reply) => {
+            const input = core_1.SetConfigInputSchema.parse(request.body);
+            const entry = await stratum.setConfig(request.params.id, request.params.key, input, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(200).send(entry);
+        });
+        // DELETE /api/v1/tenants/:id/config/:key — Delete config override
+        app.delete("/:key", async (request, reply) => {
+            await stratum.deleteConfig(request.params.id, request.params.key, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(204).send();
+        });
+        // PUT /api/v1/tenants/:id/config/batch — Set multiple config keys atomically
+        app.put("/batch", async (request, reply) => {
+            const body = request.body;
+            if (!Array.isArray(body?.entries) || body.entries.length === 0) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "Body must contain a non-empty 'entries' array" } });
+                return;
+            }
+            if (body.entries.length > 200) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "Batch limited to 200 entries" } });
+                return;
+            }
+            const entries = body.entries.map((e) => {
+                const parsed = core_1.SetConfigInputSchema.parse(e);
+                const entry = e;
+                return { key: entry.key, value: parsed.value, locked: parsed.locked, sensitive: parsed.sensitive };
+            });
+            const batchResult = await stratum.batchSetConfig(request.params.id, entries, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(200).send(batchResult);
+        });
+        // GET /api/v1/tenants/:id/config/inheritance — Get full inheritance view
+        app.get("/inheritance", async (request, reply) => {
+            const inheritance = await stratum.getConfigWithInheritance(request.params.id);
+            reply.status(200).send(inheritance);
+        });
+    };
+}
+exports.createConfigRoutes = createConfigRoutes;
+//# sourceMappingURL=config.js.map

package/dist/routes/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":";;;AACA,2CAAwD;AAExD,mDAAoD;AACpD,mEAAoF;AAEpF,SAAgB,kBAAkB,CAAC,OAAgB;IACjD,OAAO,KAAK,UAAU,YAAY,CAAC,GAAoB;QACrD,yEAAyE;QACzE,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAsB,EAAC,OAAO,EAAE,6BAAW,CAAC,CAAC,CAAC;QACxE,uDAAuD;QACvD,GAAG,CAAC,GAAG,CAA6B,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,GAAG,CAAC,GAAG,CAA0C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACjF,MAAM,KAAK,GAAG,2BAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAChH,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,kEAAkE;QAClE,GAAG,CAAC,MAAM,CAA0C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACpF,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAC9F,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,GAAG,CAAC,GAAG,CAA6B,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrE,MAAM,IAAI,GAAG,OAAO,CAAC,IAA+B,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,+CAA+C,EAAE,EAAE,CAAC,CAAC;gBAC1H,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;gBACzG,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrC,MAAM,MAAM,GAAG,2BAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7C,MAAM,KAAK,GAAG,CAA4B,CAAC;gBAC3C,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YAC/G,CAAC,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YACzG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,GAAG,CAAC,GAAG,CAA6B,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC3E,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAjDD,gDAiDC"}

package/dist/routes/consent.d.ts

@@ -0,0 +1,4 @@
+import { FastifyInstance } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+export declare function createConsentRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=consent.d.ts.map

package/dist/routes/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../src/routes/consent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI1C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CA2CzE"}

package/dist/routes/consent.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createConsentRoutes = void 0;
+const core_1 = require("@stratum-hq/core");
+const audit_logs_js_1 = require("./audit-logs.js");
+const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
+function createConsentRoutes(stratum) {
+    return async function consentRoutes(app) {
+        // Tenant-scoped keys can only access consent for their own tenant subtree
+        app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeGuard)(stratum, tenant_scope_js_1.fromParamTenantId));
+        // POST /api/v1/tenants/:tenantId/consent — Grant consent
+        app.post("/", async (request, reply) => {
+            const { tenantId } = request.params;
+            const input = core_1.GrantConsentInputSchema.parse(request.body);
+            const audit = (0, audit_logs_js_1.buildAuditContext)(request);
+            const record = await stratum.grantConsent(tenantId, input, audit);
+            reply.status(201).send(record);
+        });
+        // GET /api/v1/tenants/:tenantId/consent — List consent records
+        app.get("/", async (request, reply) => {
+            const { tenantId } = request.params;
+            const subjectId = request.query.subject_id;
+            const records = await stratum.listConsent(tenantId, subjectId);
+            reply.status(200).send(records);
+        });
+        // DELETE /api/v1/tenants/:tenantId/consent/:purpose — Revoke consent
+        app.delete("/:purpose", async (request, reply) => {
+            const { tenantId, purpose } = request.params;
+            const subjectId = request.query.subject_id;
+            if (!subjectId) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "subject_id query parameter is required" } });
+                return;
+            }
+            const audit = (0, audit_logs_js_1.buildAuditContext)(request);
+            const revoked = await stratum.revokeConsent(tenantId, subjectId, purpose, audit);
+            if (!revoked) {
+                reply.status(404).send({ error: { code: "NOT_FOUND", message: "Consent record not found" } });
+                return;
+            }
+            reply.status(200).send({ success: true });
+        });
+    };
+}
+exports.createConsentRoutes = createConsentRoutes;
+//# sourceMappingURL=consent.js.map

package/dist/routes/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/routes/consent.ts"],"names":[],"mappings":";;;AACA,2CAA2D;AAE3D,mDAAoD;AACpD,mEAA0F;AAE1F,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,OAAO,KAAK,UAAU,aAAa,CAAC,GAAoB;QACtD,0EAA0E;QAC1E,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAsB,EAAC,OAAO,EAAE,mCAAiB,CAAC,CAAC,CAAC;QAC9E,yDAAyD;QACzD,GAAG,CAAC,IAAI,CAAmC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACpC,MAAM,KAAK,GAAG,8BAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAClE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,GAAG,CAAC,GAAG,CACL,GAAG,EACH,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACpC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC/D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CACF,CAAC;QAEF,qEAAqE;QACrE,GAAG,CAAC,MAAM,CACR,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAC;gBACnH,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACjF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AA5CD,kDA4CC"}

package/dist/routes/health.d.ts

@@ -0,0 +1,9 @@
+import { FastifyInstance } from "fastify";
+type RedisHealthChecker = () => Promise<"connected" | "disconnected" | "not_configured">;
+/**
+ * Health routes factory. Accepts an optional Redis health checker so the
+ * health endpoint can report Redis status without a hard dependency on it.
+ */
+export declare function healthRoutes(checkRedisHealth: RedisHealthChecker): (app: FastifyInstance) => Promise<void>;
+export {};
+//# sourceMappingURL=health.d.ts.map

package/dist/routes/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/routes/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAG1C,KAAK,kBAAkB,GAAG,MAAM,OAAO,CAAC,WAAW,GAAG,cAAc,GAAG,gBAAgB,CAAC,CAAC;AAEzF;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,gBAAgB,EAAE,kBAAkB,SAEU,eAAe,KAAG,QAAQ,IAAI,CAAC,CAsB9E"}

package/dist/routes/health.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.healthRoutes = void 0;
+const connection_js_1 = require("../db/connection.js");
+/**
+ * Health routes factory. Accepts an optional Redis health checker so the
+ * health endpoint can report Redis status without a hard dependency on it.
+ */
+function healthRoutes(checkRedisHealth) {
+    return async function healthRoutesPlugin(app) {
+        app.get("/api/v1/health", async (_request, reply) => {
+            let dbStatus = "disconnected";
+            try {
+                const pool = (0, connection_js_1.getPool)();
+                await pool.query("SELECT 1");
+                dbStatus = "connected";
+            }
+            catch {
+                dbStatus = "disconnected";
+            }
+            const redisStatus = await checkRedisHealth();
+            reply.status(200).send({
+                status: "ok",
+                timestamp: new Date().toISOString(),
+                db: dbStatus,
+                redis: redisStatus,
+            });
+        });
+    };
+}
+exports.healthRoutes = healthRoutes;
+//# sourceMappingURL=health.js.map

package/dist/routes/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/routes/health.ts"],"names":[],"mappings":";;;AACA,uDAA8C;AAI9C;;;GAGG;AACH,SAAgB,YAAY,CAC1B,gBAAoC;IAEpC,OAAO,KAAK,UAAU,kBAAkB,CAAC,GAAoB;QAC3D,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAClD,IAAI,QAAQ,GAAiC,cAAc,CAAC;YAE5D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,uBAAO,GAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC7B,QAAQ,GAAG,WAAW,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,cAAc,CAAC;YAC5B,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,gBAAgB,EAAE,CAAC;YAE7C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,WAAW;aACnB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAzBD,oCAyBC"}

package/dist/routes/maintenance.d.ts

@@ -0,0 +1,4 @@
+import { FastifyInstance } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+export declare function createMaintenanceRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=maintenance.d.ts.map

package/dist/routes/maintenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/routes/maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG1C,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CA4B7E"}

package/dist/routes/maintenance.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMaintenanceRoutes = void 0;
+const audit_logs_js_1 = require("./audit-logs.js");
+function createMaintenanceRoutes(stratum) {
+    return async function maintenanceRoutes(app) {
+        // POST /api/v1/maintenance/purge-expired — Purge expired data
+        app.post("/purge-expired", async (request, reply) => {
+            const rawDays = request.query.retention_days
+                ? parseInt(request.query.retention_days, 10)
+                : undefined;
+            const retentionDays = rawDays !== undefined && (Number.isNaN(rawDays) || rawDays < 1)
+                ? undefined
+                : rawDays !== undefined ? Math.min(rawDays, 3650) : undefined;
+            const result = await stratum.purgeExpiredData(retentionDays);
+            reply.status(200).send(result);
+        });
+        // POST /api/v1/maintenance/rotate-encryption-key — Re-encrypt all sensitive data
+        app.post("/rotate-encryption-key", async (request, reply) => {
+            const body = request.body;
+            if (!body?.old_key || !body?.new_key) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "Both 'old_key' and 'new_key' are required" } });
+                return;
+            }
+            if (body.old_key === body.new_key) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "'new_key' must differ from 'old_key'" } });
+                return;
+            }
+            const result = await stratum.rotateEncryptionKey(body.old_key, body.new_key, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(200).send(result);
+        });
+    };
+}
+exports.createMaintenanceRoutes = createMaintenanceRoutes;
+//# sourceMappingURL=maintenance.js.map

package/dist/routes/maintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.js","sourceRoot":"","sources":["../../src/routes/maintenance.ts"],"names":[],"mappings":";;;AAEA,mDAAoD;AAEpD,SAAgB,uBAAuB,CAAC,OAAgB;IACtD,OAAO,KAAK,UAAU,iBAAiB,CAAC,GAAoB;QAC1D,8DAA8D;QAC9D,GAAG,CAAC,IAAI,CAA+C,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChG,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc;gBAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,aAAa,GAAG,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;gBACnF,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC7D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,iFAAiF;QACjF,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAqD,CAAC;YAC3E,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;gBACrC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,2CAA2C,EAAE,EAAE,CAAC,CAAC;gBACtH,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;gBACjH,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YACzG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AA7BD,0DA6BC"}

package/dist/routes/permissions.d.ts

@@ -0,0 +1,4 @@
+import { FastifyInstance } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+export declare function createPermissionRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/routes/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/routes/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAI1C,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CAkC5E"}