@stratum-hq/control-plane 0.1.0

package/dist/routes/permissions.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPermissionRoutes = void 0;
+const core_1 = require("@stratum-hq/core");
+const audit_logs_js_1 = require("./audit-logs.js");
+const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
+function createPermissionRoutes(stratum) {
+    return async function permissionRoutes(app) {
+        // Tenant-scoped keys can only access permissions for their own tenant subtree
+        app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeGuard)(stratum, tenant_scope_js_1.fromParamId));
+        // GET /api/v1/tenants/:id/permissions — Get resolved permissions
+        app.get("/", async (request, reply) => {
+            const resolved = await stratum.resolvePermissions(request.params.id);
+            reply.status(200).send(resolved);
+        });
+        // POST /api/v1/tenants/:id/permissions — Create permission policy
+        app.post("/", async (request, reply) => {
+            const input = core_1.CreatePermissionInputSchema.parse(request.body);
+            const policy = await stratum.createPermission(request.params.id, input, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(201).send(policy);
+        });
+        // PATCH /api/v1/tenants/:id/permissions/:policyId — Update permission policy
+        app.patch("/:policyId", async (request, reply) => {
+            const input = core_1.UpdatePermissionInputSchema.parse(request.body);
+            const policy = await stratum.updatePermission(request.params.id, request.params.policyId, input, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(200).send(policy);
+        });
+        // DELETE /api/v1/tenants/:id/permissions/:policyId — Delete/revoke permission policy
+        app.delete("/:policyId", async (request, reply) => {
+            await stratum.deletePermission(request.params.id, request.params.policyId, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(204).send();
+        });
+    };
+}
+exports.createPermissionRoutes = createPermissionRoutes;
+//# sourceMappingURL=permissions.js.map

package/dist/routes/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/routes/permissions.ts"],"names":[],"mappings":";;;AACA,2CAA4F;AAE5F,mDAAoD;AACpD,mEAAoF;AAEpF,SAAgB,sBAAsB,CAAC,OAAgB;IACrD,OAAO,KAAK,UAAU,gBAAgB,CAAC,GAAoB;QACzD,8EAA8E;QAC9E,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAsB,EAAC,OAAO,EAAE,6BAAW,CAAC,CAAC,CAAC;QACxE,iEAAiE;QACjE,GAAG,CAAC,GAAG,CAA6B,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,kEAAkE;QAClE,GAAG,CAAC,IAAI,CAA6B,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,kCAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YACpG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,GAAG,CAAC,KAAK,CAA+C,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC7F,MAAM,KAAK,GAAG,kCAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAC3C,OAAO,CAAC,MAAM,CAAC,EAAE,EACjB,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,KAAK,EACL,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAC3B,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,qFAAqF;QACrF,GAAG,CAAC,MAAM,CAA+C,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC9F,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YACvG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAnCD,wDAmCC"}

package/dist/routes/regions.d.ts

@@ -0,0 +1,4 @@
+import { FastifyInstance } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+export declare function createRegionRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=regions.d.ts.map

package/dist/routes/regions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.d.ts","sourceRoot":"","sources":["../../src/routes/regions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG1C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CAiCxE"}

package/dist/routes/regions.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRegionRoutes = void 0;
+const core_1 = require("@stratum-hq/core");
+const audit_logs_js_1 = require("./audit-logs.js");
+function createRegionRoutes(stratum) {
+    return async function regionRoutes(app) {
+        // POST /api/v1/regions — Create region
+        app.post("/", async (request, reply) => {
+            const input = core_1.CreateRegionInputSchema.parse(request.body);
+            const region = await stratum.createRegion(input, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(201).send(region);
+        });
+        // GET /api/v1/regions — List regions
+        app.get("/", async (_request, reply) => {
+            const regions = await stratum.listRegions();
+            reply.status(200).send(regions);
+        });
+        // GET /api/v1/regions/:id — Get region by ID
+        app.get("/:id", async (request, reply) => {
+            const region = await stratum.getRegion(request.params.id);
+            reply.status(200).send(region);
+        });
+        // PATCH /api/v1/regions/:id — Update region
+        app.patch("/:id", async (request, reply) => {
+            const input = core_1.UpdateRegionInputSchema.parse(request.body);
+            const region = await stratum.updateRegion(request.params.id, input, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(200).send(region);
+        });
+        // DELETE /api/v1/regions/:id — Delete region
+        app.delete("/:id", async (request, reply) => {
+            await stratum.deleteRegion(request.params.id, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(204).send();
+        });
+    };
+}
+exports.createRegionRoutes = createRegionRoutes;
+//# sourceMappingURL=regions.js.map

package/dist/routes/regions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.js","sourceRoot":"","sources":["../../src/routes/regions.ts"],"names":[],"mappings":";;;AACA,2CAAoF;AAEpF,mDAAoD;AAEpD,SAAgB,kBAAkB,CAAC,OAAgB;IACjD,OAAO,KAAK,UAAU,YAAY,CAAC,GAAoB;QACrD,uCAAuC;QACvC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,8BAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAC7E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;YAC5C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,6CAA6C;QAC7C,GAAG,CAAC,GAAG,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACnE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,4CAA4C;QAC5C,GAAG,CAAC,KAAK,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,8BAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAChG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,6CAA6C;QAC7C,GAAG,CAAC,MAAM,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACtE,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAlCD,gDAkCC"}

package/dist/routes/roles.d.ts

@@ -0,0 +1,4 @@
+import { FastifyInstance } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+export declare function createRoleRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=roles.d.ts.map

package/dist/routes/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/routes/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAqB1C,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CA8EtE"}

package/dist/routes/roles.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRoleRoutes = void 0;
+const zod_1 = require("zod");
+const audit_logs_js_1 = require("./audit-logs.js");
+const createRoleSchema = zod_1.z.object({
+    name: zod_1.z.string().min(1).max(100),
+    description: zod_1.z.string().max(500).optional(),
+    scopes: zod_1.z.array(zod_1.z.enum(["read", "write", "admin"])).min(1),
+    tenant_id: zod_1.z.string().uuid().optional().nullable(),
+});
+const updateRoleSchema = zod_1.z.object({
+    name: zod_1.z.string().min(1).max(100).optional(),
+    description: zod_1.z.string().max(500).optional(),
+    scopes: zod_1.z.array(zod_1.z.enum(["read", "write", "admin"])).min(1).optional(),
+});
+const assignRoleSchema = zod_1.z.object({
+    role_id: zod_1.z.string().uuid(),
+});
+function createRoleRoutes(stratum) {
+    return async function roleRoutes(app) {
+        // POST /api/v1/roles — Create a role
+        app.post("/", async (request, reply) => {
+            const parsed = createRoleSchema.safeParse(request.body);
+            if (!parsed.success) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "Invalid request body" }, details: parsed.error.issues });
+                return;
+            }
+            const role = await stratum.createRole(parsed.data, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(201).send(role);
+        });
+        // GET /api/v1/roles — List roles (optional ?tenant_id=)
+        app.get("/", async (request, reply) => {
+            const roles = await stratum.listRoles(request.query.tenant_id);
+            reply.status(200).send(roles);
+        });
+        // GET /api/v1/roles/:id — Get role
+        app.get("/:id", async (request, reply) => {
+            const role = await stratum.getRole(request.params.id);
+            if (!role) {
+                reply.status(404).send({ error: { code: "NOT_FOUND", message: "Role not found" } });
+                return;
+            }
+            reply.status(200).send(role);
+        });
+        // PATCH /api/v1/roles/:id — Update role
+        app.patch("/:id", async (request, reply) => {
+            const parsed = updateRoleSchema.safeParse(request.body);
+            if (!parsed.success) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "Invalid request body" }, details: parsed.error.issues });
+                return;
+            }
+            const role = await stratum.updateRole(request.params.id, parsed.data, (0, audit_logs_js_1.buildAuditContext)(request));
+            if (!role) {
+                reply.status(404).send({ error: { code: "NOT_FOUND", message: "Role not found" } });
+                return;
+            }
+            reply.status(200).send(role);
+        });
+        // DELETE /api/v1/roles/:id — Delete role
+        app.delete("/:id", async (request, reply) => {
+            const deleted = await stratum.deleteRole(request.params.id, (0, audit_logs_js_1.buildAuditContext)(request));
+            if (!deleted) {
+                reply.status(404).send({ error: { code: "NOT_FOUND", message: "Role not found" } });
+                return;
+            }
+            reply.status(204).send();
+        });
+        // POST /api/v1/roles/assign/:keyId — Assign role to API key
+        app.post("/assign/:keyId", async (request, reply) => {
+            const parsed = assignRoleSchema.safeParse(request.body);
+            if (!parsed.success) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "role_id is required" } });
+                return;
+            }
+            const success = await stratum.assignRoleToKey(request.params.keyId, parsed.data.role_id);
+            if (!success) {
+                reply.status(404).send({ error: { code: "NOT_FOUND", message: "API key not found or already revoked" } });
+                return;
+            }
+            reply.status(200).send({ success: true });
+        });
+        // DELETE /api/v1/roles/assign/:keyId — Remove role from API key
+        app.delete("/assign/:keyId", async (request, reply) => {
+            const success = await stratum.removeRoleFromKey(request.params.keyId);
+            if (!success) {
+                reply.status(404).send({ error: { code: "NOT_FOUND", message: "API key not found or already revoked" } });
+                return;
+            }
+            reply.status(200).send({ success: true });
+        });
+    };
+}
+exports.createRoleRoutes = createRoleRoutes;
+//# sourceMappingURL=roles.js.map

package/dist/routes/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/routes/roles.ts"],"names":[],"mappings":";;;AAEA,6BAAwB;AACxB,mDAAoD;AAEpD,MAAM,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtE,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC3B,CAAC,CAAC;AAEH,SAAgB,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,KAAK,UAAU,UAAU,CAAC,GAAoB;QACnD,qCAAqC;QACrC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/H,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,wDAAwD;QACxD,GAAG,CAAC,GAAG,CAA0C,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC7E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,mCAAmC;QACnC,GAAG,CAAC,GAAG,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACnE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,wCAAwC;QACxC,GAAG,CAAC,KAAK,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrE,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/H,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,yCAAyC;QACzC,GAAG,CAAC,MAAM,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,4DAA4D;QAC5D,GAAG,CAAC,IAAI,CAAgC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACjF,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;gBAChG,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;gBAC1G,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,gEAAgE;QAChE,GAAG,CAAC,MAAM,CAAgC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACnF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;gBAC1G,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AA/ED,4CA+EC"}

package/dist/routes/tenants.d.ts

@@ -0,0 +1,4 @@
+import { FastifyInstance } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+export declare function createTenantRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=tenants.d.ts.map

package/dist/routes/tenants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../src/routes/tenants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAU1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAQ1C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CAqHxE"}

package/dist/routes/tenants.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTenantRoutes = void 0;
+const core_1 = require("@stratum-hq/core");
+const isolation_service_js_1 = require("../services/isolation-service.js");
+const audit_logs_js_1 = require("./audit-logs.js");
+const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
+function createTenantRoutes(stratum) {
+    return async function tenantRoutes(app) {
+        // Tenant-scoped keys can only access their own tenant subtree
+        app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeGuard)(stratum, tenant_scope_js_1.fromParamId));
+        // GET /api/v1/tenants — List tenants (with cursor pagination)
+        app.get("/", async (request, reply) => {
+            const query = core_1.PaginationSchema.parse(request.query);
+            const result = await stratum.listTenants(query);
+            reply.status(200).send(result);
+        });
+        // POST /api/v1/tenants — Create tenant
+        app.post("/", async (request, reply) => {
+            const input = core_1.CreateTenantInputSchema.parse(request.body);
+            // Reject unsupported isolation strategies (SHARED_RLS and SCHEMA_PER_TENANT are supported)
+            if (input.isolation_strategy && !(0, core_1.isSupportedIsolationStrategy)(input.isolation_strategy)) {
+                throw new core_1.IsolationStrategyUnsupportedError(input.isolation_strategy);
+            }
+            const tenant = await stratum.createTenant(input, (0, audit_logs_js_1.buildAuditContext)(request));
+            // Provision isolation resources based on strategy
+            const strategy = tenant.isolation_strategy ?? "SHARED_RLS";
+            if (strategy === "SCHEMA_PER_TENANT") {
+                await (0, isolation_service_js_1.setupSchemaForTenant)(tenant.slug);
+            }
+            else if (strategy === "DB_PER_TENANT") {
+                await (0, isolation_service_js_1.setupDatabaseForTenant)(tenant.slug);
+            }
+            reply.status(201).send(tenant);
+        });
+        // POST /api/v1/tenants/batch — Create multiple tenants atomically
+        app.post("/batch", async (request, reply) => {
+            const body = request.body;
+            if (!Array.isArray(body?.tenants) || body.tenants.length === 0) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "Body must contain a non-empty 'tenants' array" } });
+                return;
+            }
+            if (body.tenants.length > 100) {
+                reply.status(400).send({ error: { code: "VALIDATION_ERROR", message: "Batch limited to 100 tenants" } });
+                return;
+            }
+            const inputs = body.tenants.map((t) => core_1.CreateTenantInputSchema.parse(t));
+            const result = await stratum.batchCreateTenants(inputs, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(201).send(result);
+        });
+        // GET /api/v1/tenants/:id — Get tenant
+        app.get("/:id", async (request, reply) => {
+            const tenant = await stratum.getTenant(request.params.id);
+            reply.status(200).send(tenant);
+        });
+        // PATCH /api/v1/tenants/:id — Update tenant
+        app.patch("/:id", async (request, reply) => {
+            const patch = core_1.UpdateTenantInputSchema.parse(request.body);
+            const tenant = await stratum.updateTenant(request.params.id, patch, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(200).send(tenant);
+        });
+        // DELETE /api/v1/tenants/:id — Soft-delete (archive) tenant
+        app.delete("/:id", async (request, reply) => {
+            await stratum.deleteTenant(request.params.id, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(204).send();
+        });
+        // POST /api/v1/tenants/:id/move — Move tenant
+        app.post("/:id/move", async (request, reply) => {
+            const input = core_1.MoveTenantInputSchema.parse(request.body);
+            const tenant = await stratum.moveTenant(request.params.id, input.new_parent_id, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(200).send(tenant);
+        });
+        // GET /api/v1/tenants/:id/ancestors — Get ancestors
+        app.get("/:id/ancestors", async (request, reply) => {
+            const ancestors = await stratum.getAncestors(request.params.id);
+            reply.status(200).send(ancestors);
+        });
+        // GET /api/v1/tenants/:id/descendants — Get descendants
+        app.get("/:id/descendants", async (request, reply) => {
+            const descendants = await stratum.getDescendants(request.params.id);
+            reply.status(200).send(descendants);
+        });
+        // GET /api/v1/tenants/:id/children — Get direct children
+        app.get("/:id/children", async (request, reply) => {
+            const children = await stratum.getChildren(request.params.id);
+            reply.status(200).send(children);
+        });
+        // POST /api/v1/tenants/:id/migrate-region — Migrate tenant to a new region
+        app.post("/:id/migrate-region", async (request, reply) => {
+            const { region_id } = core_1.MigrateRegionInputSchema.parse(request.body);
+            await stratum.migrateRegion(request.params.id, region_id, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(200).send({ success: true });
+        });
+        // POST /api/v1/tenants/:id/purge — GDPR Article 17: hard-delete all tenant data
+        app.post("/:id/purge", async (request, reply) => {
+            await stratum.purgeTenant(request.params.id, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(204).send();
+        });
+        // GET /api/v1/tenants/:id/export — GDPR Article 20: export all tenant data
+        app.get("/:id/export", async (request, reply) => {
+            const data = await stratum.exportTenantData(request.params.id);
+            reply.status(200).send(data);
+        });
+        // GET /api/v1/tenants/:id/context — Resolve full tenant impersonation context (admin scope)
+        app.get("/:id/context", async (request, reply) => {
+            const context = await stratum.getTenantContext(request.params.id);
+            reply.status(200).send(context);
+        });
+    };
+}
+exports.createTenantRoutes = createTenantRoutes;
+//# sourceMappingURL=tenants.js.map

package/dist/routes/tenants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenants.js","sourceRoot":"","sources":["../../src/routes/tenants.ts"],"names":[],"mappings":";;;AACA,2CAQ0B;AAE1B,2EAG0C;AAC1C,mDAAoD;AACpD,mEAAoF;AAEpF,SAAgB,kBAAkB,CAAC,OAAgB;IACjD,OAAO,KAAK,UAAU,YAAY,CAAC,GAAoB;QACrD,8DAA8D;QAC9D,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAsB,EAAC,OAAO,EAAE,6BAAW,CAAC,CAAC,CAAC;QACxE,8DAA8D;QAC9D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,uBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAChD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,8BAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAE1D,2FAA2F;YAC3F,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,IAAA,mCAA4B,EAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,wCAAiC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAE7E,kDAAkD;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,IAAI,YAAY,CAAC;YAC3D,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;gBACrC,MAAM,IAAA,2CAAoB,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;iBAAM,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;gBACxC,MAAM,IAAA,6CAAsB,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;YAED,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,kEAAkE;QAClE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAA+B,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,+CAA+C,EAAE,EAAE,CAAC,CAAC;gBAC1H,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;gBACzG,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YACpF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,GAAG,CAAC,GAAG,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACnE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,4CAA4C;QAC5C,GAAG,CAAC,KAAK,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,8BAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAChG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,4DAA4D;QAC5D,GAAG,CAAC,MAAM,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACtE,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,8CAA8C;QAC9C,GAAG,CAAC,IAAI,CAA6B,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACzE,MAAM,KAAK,GAAG,4BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,aAAa,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAC5G,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,oDAAoD;QACpD,GAAG,CAAC,GAAG,CAA6B,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC7E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,wDAAwD;QACxD,GAAG,CAAC,GAAG,CAA6B,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC/E,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,yDAAyD;QACzD,GAAG,CAAC,GAAG,CAA6B,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC5E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,2EAA2E;QAC3E,GAAG,CAAC,IAAI,CAA6B,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACnF,MAAM,EAAE,SAAS,EAAE,GAAG,+BAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YACtF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,gFAAgF;QAChF,GAAG,CAAC,IAAI,CAA6B,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC1E,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YACzE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,2EAA2E;QAC3E,GAAG,CAAC,GAAG,CAA6B,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC1E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,GAAG,CAAC,GAAG,CAA6B,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC3E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAtHD,gDAsHC"}

package/dist/routes/webhooks.d.ts

@@ -0,0 +1,4 @@
+import { FastifyInstance } from "fastify";
+import { Stratum } from "@stratum-hq/lib";
+export declare function createWebhookRoutes(stratum: Stratum): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/routes/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/routes/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAiB1C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,SACT,eAAe,KAAG,QAAQ,IAAI,CAAC,CAwGzE"}

package/dist/routes/webhooks.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWebhookRoutes = void 0;
+const core_1 = require("@stratum-hq/core");
+const audit_logs_js_1 = require("./audit-logs.js");
+/**
+ * Post-fetch tenant access check for webhook routes.
+ * Used after loading a webhook by ID to verify the caller's key
+ * has access to the webhook's tenant.
+ * Global keys (tenant_id = null) have unrestricted access.
+ */
+function assertTenantAccess(request, webhookTenantId) {
+    const apiKey = request.apiKey;
+    if (!apiKey || apiKey.tenant_id === null)
+        return;
+    if (webhookTenantId !== null && apiKey.tenant_id !== webhookTenantId) {
+        throw new core_1.ForbiddenError("API key does not have access to this webhook's tenant");
+    }
+}
+function createWebhookRoutes(stratum) {
+    return async function webhookRoutes(app) {
+        // POST /api/v1/webhooks — Create webhook
+        app.post("/", async (request, reply) => {
+            const input = core_1.CreateWebhookInputSchema.parse(request.body);
+            // Tenant-scoped keys can only create webhooks for their own tenant
+            if (request.apiKey?.tenant_id !== null && input.tenant_id !== null) {
+                assertTenantAccess(request, input.tenant_id);
+            }
+            const webhook = await stratum.createWebhook(input, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(201).send(webhook);
+        });
+        // GET /api/v1/webhooks — List webhooks (optional ?tenant_id=)
+        app.get("/", async (request, reply) => {
+            // Tenant-scoped keys can only list their own tenant's webhooks
+            const tenantId = request.apiKey?.tenant_id ?? request.query.tenant_id;
+            const webhooks = await stratum.listWebhooks(tenantId);
+            reply.status(200).send(webhooks);
+        });
+        // GET /api/v1/webhooks/:id — Get webhook
+        app.get("/:id", async (request, reply) => {
+            const webhook = await stratum.getWebhook(request.params.id);
+            assertTenantAccess(request, webhook.tenant_id);
+            reply.status(200).send(webhook);
+        });
+        // PATCH /api/v1/webhooks/:id — Update webhook
+        app.patch("/:id", async (request, reply) => {
+            const existing = await stratum.getWebhook(request.params.id);
+            assertTenantAccess(request, existing.tenant_id);
+            const input = core_1.UpdateWebhookInputSchema.parse(request.body);
+            const webhook = await stratum.updateWebhook(request.params.id, input, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(200).send(webhook);
+        });
+        // DELETE /api/v1/webhooks/:id — Delete webhook
+        app.delete("/:id", async (request, reply) => {
+            const existing = await stratum.getWebhook(request.params.id);
+            assertTenantAccess(request, existing.tenant_id);
+            await stratum.deleteWebhook(request.params.id, (0, audit_logs_js_1.buildAuditContext)(request));
+            reply.status(204).send();
+        });
+        // GET /api/v1/webhooks/:id/deliveries — List deliveries for a webhook
+        app.get("/:id/deliveries", async (request, reply) => {
+            const webhook = await stratum.getWebhook(request.params.id);
+            assertTenantAccess(request, webhook.tenant_id);
+            const deliveries = await stratum.listWebhookDeliveries(request.params.id);
+            reply.status(200).send(deliveries);
+        });
+        // POST /api/v1/webhooks/:id/test — Send test event
+        app.post("/:id/test", async (request, reply) => {
+            const webhook = await stratum.getWebhook(request.params.id);
+            assertTenantAccess(request, webhook.tenant_id);
+            const result = await stratum.testWebhook(request.params.id);
+            reply.status(200).send(result);
+        });
+        // --- Dead-Letter Queue / Delivery Dashboard ---
+        // GET /api/v1/webhooks/deliveries/stats — Delivery statistics
+        app.get("/deliveries/stats", async (request, reply) => {
+            // Scoped keys: restrict to their tenant's deliveries
+            const tenantId = request.apiKey?.tenant_id ?? undefined;
+            const stats = await stratum.getDeliveryStats(tenantId);
+            reply.status(200).send(stats);
+        });
+        // GET /api/v1/webhooks/deliveries/failed — List failed deliveries (DLQ)
+        app.get("/deliveries/failed", async (request, reply) => {
+            const rawLimit = request.query.limit ? parseInt(request.query.limit, 10) : 100;
+            const limit = Number.isNaN(rawLimit) || rawLimit < 1 ? 100 : Math.min(rawLimit, 500);
+            const tenantId = request.apiKey?.tenant_id ?? undefined;
+            const failed = await stratum.listFailedDeliveries(limit, tenantId);
+            reply.status(200).send(failed);
+        });
+        // POST /api/v1/webhooks/deliveries/retry-all — Retry all failed deliveries
+        app.post("/deliveries/retry-all", async (request, reply) => {
+            const tenantId = request.apiKey?.tenant_id ?? undefined;
+            const count = await stratum.retryFailedDeliveries(tenantId);
+            reply.status(200).send({ retried: count });
+        });
+        // POST /api/v1/webhooks/deliveries/:deliveryId/retry — Retry single delivery
+        app.post("/deliveries/:deliveryId/retry", async (request, reply) => {
+            // Verify tenant access for scoped keys
+            if (request.apiKey?.tenant_id) {
+                const failed = await stratum.listFailedDeliveries(1000, request.apiKey.tenant_id);
+                if (!failed.some((d) => d.id === request.params.deliveryId)) {
+                    reply.status(404).send({ error: { code: "NOT_FOUND", message: "Delivery not found or not in failed state" } });
+                    return;
+                }
+            }
+            const success = await stratum.retryDelivery(request.params.deliveryId);
+            if (!success) {
+                reply.status(404).send({ error: { code: "NOT_FOUND", message: "Delivery not found or not in failed state" } });
+                return;
+            }
+            reply.status(200).send({ success: true });
+        });
+    };
+}
+exports.createWebhookRoutes = createWebhookRoutes;
+//# sourceMappingURL=webhooks.js.map

package/dist/routes/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/routes/webhooks.ts"],"names":[],"mappings":";;;AACA,2CAAsG;AAEtG,mDAAoD;AAEpD;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAuB,EAAE,eAA8B;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO;IACjD,IAAI,eAAe,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACrE,MAAM,IAAI,qBAAc,CAAC,uDAAuD,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,OAAO,KAAK,UAAU,aAAa,CAAC,GAAoB;QACtD,yCAAyC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,+BAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3D,mEAAmE;YACnE,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBACnE,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,8DAA8D;QAC9D,GAAG,CAAC,GAAG,CAA0C,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC7E,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACtD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,yCAAyC;QACzC,GAAG,CAAC,GAAG,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5D,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,8CAA8C;QAC9C,GAAG,CAAC,KAAK,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,+BAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAClG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,+CAA+C;QAC/C,GAAG,CAAC,MAAM,CAA6B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACtE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChD,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,sEAAsE;QACtE,GAAG,CAAC,GAAG,CAA6B,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC9E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5D,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,mDAAmD;QACnD,GAAG,CAAC,IAAI,CAA6B,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACzE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5D,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,iDAAiD;QAEjD,8DAA8D;QAC9D,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACpD,qDAAqD;YACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACvD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,GAAG,CAAC,GAAG,CAAsC,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACnE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,2EAA2E;QAC3E,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,SAAS,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC5D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,GAAG,CAAC,IAAI,CAAqC,+BAA+B,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrG,uCAAuC;YACvC,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2CAA2C,EAAE,EAAE,CAAC,CAAC;oBAC/G,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2CAA2C,EAAE,EAAE,CAAC,CAAC;gBAC/G,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAzGD,kDAyGC"}

package/dist/services/isolation-service.d.ts

@@ -0,0 +1,22 @@
+export declare function registerTable(tableName: string): void;
+export declare function setupRLSForTable(tableName: string): Promise<void>;
+export declare function teardownRLSForTable(tableName: string): Promise<void>;
+export declare function setupAllRLS(): Promise<void>;
+export declare function setupSchemaForTenant(tenantSlug: string, tables?: string[]): Promise<void>;
+export declare function teardownSchemaForTenant(tenantSlug: string): Promise<void>;
+/**
+ * Creates the dedicated database for a DB_PER_TENANT tenant.
+ *
+ * CREATE DATABASE cannot run inside a transaction, so this function uses a
+ * standalone client from the pool (no BEGIN/COMMIT wrapping).
+ */
+export declare function setupDatabaseForTenant(tenantSlug: string, templateDb?: string): Promise<void>;
+/**
+ * Tears down the DB_PER_TENANT isolation for a tenant.
+ *
+ * This closes any open connection pools for the tenant database but does NOT
+ * drop the database — data preservation is left to the operator.
+ * To actually drop the database, use dropDatabase() from @stratum-hq/db-adapters directly.
+ */
+export declare function teardownDatabaseForTenant(_tenantSlug: string): Promise<void>;
+//# sourceMappingURL=isolation-service.d.ts.map

package/dist/services/isolation-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation-service.d.ts","sourceRoot":"","sources":["../../src/services/isolation-service.ts"],"names":[],"mappings":"AAqBA,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAErD;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcvE;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU1E;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAIjD;AAED,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/E;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlF"}

package/dist/services/isolation-service.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.teardownDatabaseForTenant = exports.setupDatabaseForTenant = exports.teardownSchemaForTenant = exports.setupSchemaForTenant = exports.setupAllRLS = exports.teardownRLSForTable = exports.setupRLSForTable = exports.registerTable = void 0;
+const lib_1 = require("@stratum-hq/lib");
+const db_adapters_1 = require("@stratum-hq/db-adapters");
+const connection_js_1 = require("../db/connection.js");
+const registeredTables = new Set();
+// Validate table name to prevent SQL injection (only allows alphanumeric + underscores)
+function validateTableName(name) {
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+        throw new Error(`Invalid table name: ${name}`);
+    }
+    return name;
+}
+function registerTable(tableName) {
+    registeredTables.add(validateTableName(tableName));
+}
+exports.registerTable = registerTable;
+async function setupRLSForTable(tableName) {
+    const safe = validateTableName(tableName);
+    return (0, lib_1.withTransaction)((0, connection_js_1.getPool)(), async (client) => {
+        await client.query(`ALTER TABLE ${safe} ENABLE ROW LEVEL SECURITY`);
+        await client.query(`ALTER TABLE ${safe} FORCE ROW LEVEL SECURITY`);
+        await client.query(`CREATE POLICY tenant_isolation ON ${safe}
+       USING (tenant_id = current_setting('app.current_tenant_id')::uuid)`);
+    });
+}
+exports.setupRLSForTable = setupRLSForTable;
+async function teardownRLSForTable(tableName) {
+    const safe = validateTableName(tableName);
+    return (0, lib_1.withTransaction)((0, connection_js_1.getPool)(), async (client) => {
+        await client.query(`DROP POLICY IF EXISTS tenant_isolation ON ${safe}`);
+        await client.query(`ALTER TABLE ${safe} DISABLE ROW LEVEL SECURITY`);
+    });
+}
+exports.teardownRLSForTable = teardownRLSForTable;
+async function setupAllRLS() {
+    for (const tableName of registeredTables) {
+        await setupRLSForTable(tableName);
+    }
+}
+exports.setupAllRLS = setupAllRLS;
+async function setupSchemaForTenant(tenantSlug, tables) {
+    return (0, lib_1.withTransaction)((0, connection_js_1.getPool)(), async (client) => {
+        await (0, db_adapters_1.createSchema)(client, tenantSlug);
+        if (tables && tables.length > 0) {
+            const schemaName = (0, db_adapters_1.tenantSchemaName)(tenantSlug);
+            for (const tableName of tables) {
+                await (0, db_adapters_1.replicateTableToSchema)(client, validateTableName(tableName), schemaName);
+            }
+        }
+    });
+}
+exports.setupSchemaForTenant = setupSchemaForTenant;
+async function teardownSchemaForTenant(tenantSlug) {
+    return (0, lib_1.withTransaction)((0, connection_js_1.getPool)(), async (client) => {
+        await (0, db_adapters_1.dropSchema)(client, tenantSlug);
+    });
+}
+exports.teardownSchemaForTenant = teardownSchemaForTenant;
+/**
+ * Creates the dedicated database for a DB_PER_TENANT tenant.
+ *
+ * CREATE DATABASE cannot run inside a transaction, so this function uses a
+ * standalone client from the pool (no BEGIN/COMMIT wrapping).
+ */
+async function setupDatabaseForTenant(tenantSlug, templateDb) {
+    const pool = (0, connection_js_1.getPool)();
+    const client = await pool.connect();
+    try {
+        const exists = await (0, db_adapters_1.databaseExists)(client, tenantSlug);
+        if (!exists) {
+            await (0, db_adapters_1.createDatabase)(client, tenantSlug, templateDb);
+        }
+    }
+    finally {
+        client.release();
+    }
+}
+exports.setupDatabaseForTenant = setupDatabaseForTenant;
+/**
+ * Tears down the DB_PER_TENANT isolation for a tenant.
+ *
+ * This closes any open connection pools for the tenant database but does NOT
+ * drop the database — data preservation is left to the operator.
+ * To actually drop the database, use dropDatabase() from @stratum-hq/db-adapters directly.
+ */
+async function teardownDatabaseForTenant(_tenantSlug) {
+    // Pool cleanup is managed externally via DatabasePoolManager.closePool().
+    // This function is intentionally a no-op at the isolation-service level
+    // so that callers can decide whether to drop the database independently.
+}
+exports.teardownDatabaseForTenant = teardownDatabaseForTenant;
+//# sourceMappingURL=isolation-service.js.map

package/dist/services/isolation-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation-service.js","sourceRoot":"","sources":["../../src/services/isolation-service.ts"],"names":[],"mappings":";;;AAAA,yCAAkD;AAClD,yDAOiC;AACjC,uDAA8C;AAE9C,MAAM,gBAAgB,GAAgB,IAAI,GAAG,EAAE,CAAC;AAEhD,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,aAAa,CAAC,SAAiB;IAC7C,gBAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;AACrD,CAAC;AAFD,sCAEC;AAEM,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,IAAA,qBAAe,EAAC,IAAA,uBAAO,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,MAAM,CAAC,KAAK,CAChB,eAAe,IAAI,4BAA4B,CAChD,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAChB,eAAe,IAAI,2BAA2B,CAC/C,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAChB,qCAAqC,IAAI;0EAC2B,CACrE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAdD,4CAcC;AAEM,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,IAAA,qBAAe,EAAC,IAAA,uBAAO,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,MAAM,CAAC,KAAK,CAChB,6CAA6C,IAAI,EAAE,CACpD,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAChB,eAAe,IAAI,6BAA6B,CACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAVD,kDAUC;AAEM,KAAK,UAAU,WAAW;IAC/B,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACzC,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAJD,kCAIC;AAEM,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,MAAiB;IAEjB,OAAO,IAAA,qBAAe,EAAC,IAAA,uBAAO,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,IAAA,0BAAY,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACvC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,IAAA,8BAAgB,EAAC,UAAU,CAAC,CAAC;YAChD,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAA,oCAAsB,EAAC,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAbD,oDAaC;AAEM,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,OAAO,IAAA,qBAAe,EAAC,IAAA,uBAAO,GAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,IAAA,wBAAU,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAJD,0DAIC;AAED;;;;;GAKG;AACI,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,UAAmB;IAEnB,MAAM,IAAI,GAAG,IAAA,uBAAO,GAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAc,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAA,4BAAc,EAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAdD,wDAcC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,yBAAyB,CAAC,WAAmB;IACjE,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;AAC3E,CAAC;AAJD,8DAIC"}