@stratum-hq/control-plane 0.4.0 → 1.0.0

package/dist/__tests__/default-deny.test.js

@@ -1,92 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const fastify_1 = __importDefault(require("fastify"));
-const auth_js_1 = require("../middleware/auth.js");
-const authorize_js_1 = require("../middleware/authorize.js");
-const tenant_scope_js_1 = require("../middleware/tenant-scope.js");
-const error_handler_js_1 = require("../middleware/error-handler.js");
-const test_helpers_js_1 = require("./test-helpers.js");
-/**
- * Control-plane authorization must be default-deny: a route that does not
- * declare a tenant scope is refused, so a route added without a guard fails
- * closed instead of silently serving data.
- */
-const SCOPED_TENANT = "11111111-1111-4111-8111-111111111111";
-const OTHER_TENANT = "99999999-9999-4999-8999-999999999999";
-let stratum;
-(0, vitest_1.beforeEach)(() => {
-    stratum = (0, test_helpers_js_1.createMockStratum)();
-    stratum.validateApiKey.mockResolvedValue({
-        key_id: "scoped-key",
-        tenant_id: SCOPED_TENANT,
-        scopes: ["read", "write", "admin"],
-        rate_limit_max: null,
-        rate_limit_window: null,
-    });
-    // Both tenants are roots (empty ancestry), so neither is a descendant of the
-    // other: a scoped key may reach only its own.
-    stratum.getTenant.mockImplementation(async (id) => ({ id, ancestry_path: "", status: "active" }));
-});
-/**
- * Build an app wired exactly like the production control plane: authenticate,
- * authorize by scope, then enforce tenant scope. The caller registers routes.
- */
-async function buildApp(register) {
-    const app = (0, fastify_1.default)({ logger: false });
-    app.addHook("preHandler", (0, auth_js_1.createAuthMiddleware)(stratum));
-    app.addHook("preHandler", (0, authorize_js_1.createAuthorizeMiddleware)());
-    app.addHook("preHandler", (0, tenant_scope_js_1.createTenantScopeEnforcer)(stratum));
-    app.setErrorHandler(error_handler_js_1.errorHandler);
-    await register(app);
-    await app.ready();
-    return app;
-}
-(0, vitest_1.describe)("default-deny authorization", () => {
-    (0, vitest_1.it)("denies a route that declares no tenant scope", async () => {
-        const app = await buildApp((app) => {
-            // A control-plane route that ships without any tenant-scope declaration.
-            app.get("/api/v1/unguarded/:id", async (_req, reply) => reply.status(200).send({ reached: true }));
-        });
-        const res = await app.inject({
-            method: "GET",
-            url: `/api/v1/unguarded/${OTHER_TENANT}`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-    });
-    (0, vitest_1.it)("admits a route explicitly declared as global", async () => {
-        const app = await buildApp((app) => {
-            (0, tenant_scope_js_1.declareTenantScope)(app, "global");
-            app.get("/api/v1/ops", async (_req, reply) => reply.status(200).send({ ok: true }));
-        });
-        const res = await app.inject({
-            method: "GET",
-            url: "/api/v1/ops",
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-    });
-    (0, vitest_1.it)("enforces a declared extractor: own tenant allowed, others denied", async () => {
-        const app = await buildApp((app) => {
-            (0, tenant_scope_js_1.declareTenantScope)(app, tenant_scope_js_1.fromParamId);
-            app.get("/api/v1/tenants/:id/thing", async (_req, reply) => reply.status(200).send({ ok: true }));
-        });
-        const own = await app.inject({
-            method: "GET",
-            url: `/api/v1/tenants/${SCOPED_TENANT}/thing`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        const other = await app.inject({
-            method: "GET",
-            url: `/api/v1/tenants/${OTHER_TENANT}/thing`,
-            headers: (0, test_helpers_js_1.authHeaders)(),
-        });
-        (0, vitest_1.expect)(own.statusCode).toBe(200);
-        (0, vitest_1.expect)(other.statusCode).toBe(403);
-    });
-});
-//# sourceMappingURL=default-deny.test.js.map

package/dist/__tests__/default-deny.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"default-deny.test.js","sourceRoot":"","sources":["../../src/__tests__/default-deny.test.ts"],"names":[],"mappings":";;;;;AAAA,mCAA8D;AAC9D,sDAAmD;AAEnD,mDAA6D;AAC7D,6DAAuE;AACvE,mEAIuC;AACvC,qEAA8D;AAC9D,uDAAmE;AAEnE;;;;GAIG;AAEH,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAC7D,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D,IAAI,OAAgB,CAAC;AAErB,IAAA,mBAAU,EAAC,GAAG,EAAE;IACd,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;IAC7B,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IACH,6EAA6E;IAC7E,8CAA8C;IAC7C,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAChE,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACpE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,KAAK,UAAU,QAAQ,CACrB,QAAwD;IAExD,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,wCAAyB,GAAE,CAAC,CAAC;IACvD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAA,2CAAyB,EAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,eAAe,CAAC,+BAAY,CAAC,CAAC;IAClC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAA,iBAAQ,EAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAA,WAAE,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,yEAAyE;YACzE,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,qBAAqB,YAAY,EAAE;YACxC,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAA,oCAAkB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CACrC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,aAAa;YAClB,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,IAAA,oCAAkB,EAAC,GAAG,EAAE,6BAAW,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CACL,2BAA2B,EAC3B,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,mBAAmB,aAAa,QAAQ;YAC7C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,mBAAmB,YAAY,QAAQ;YAC5C,OAAO,EAAE,IAAA,6BAAW,GAAE;SACvB,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/tenant-create-scope.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=tenant-create-scope.test.d.ts.map

package/dist/__tests__/tenant-create-scope.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenant-create-scope.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/tenant-create-scope.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/tenant-create-scope.test.js

@@ -1,129 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const test_helpers_js_1 = require("./test-helpers.js");
-/**
- * Tenant creation must respect the caller's key scope.
- *
- * A tenant-scoped key may only create tenants WITHIN its own subtree: the new
- * tenant's parent must be the key's own tenant or a descendant of it. A scoped
- * key may not create a new root (a tenant with no parent). Only global
- * (operator) keys may create roots or create anywhere in the tree.
- */
-const OWNER = "11111111-1111-4111-8111-111111111111";
-const OWNER_CHILD = "22222222-2222-4222-8222-222222222222";
-const OUTSIDER = "99999999-9999-4999-8999-999999999999";
-// ancestry_path holds a tenant's ANCESTORS and excludes self, so a root is "".
-const TENANTS = {
-    [OWNER]: { id: OWNER, ancestry_path: "", status: "active" },
-    [OWNER_CHILD]: { id: OWNER_CHILD, ancestry_path: OWNER, status: "active" },
-    [OUTSIDER]: { id: OUTSIDER, ancestry_path: "", status: "active" },
-};
-let app;
-let stratum;
-function useScopedKey() {
-    stratum.validateApiKey.mockResolvedValue({
-        key_id: "scoped-key",
-        tenant_id: OWNER,
-        scopes: ["read", "write", "admin"],
-        rate_limit_max: null,
-        rate_limit_window: null,
-    });
-}
-function useGlobalKey() {
-    stratum.validateApiKey.mockResolvedValue({
-        key_id: "global-key",
-        tenant_id: null,
-        scopes: ["read", "write", "admin"],
-        rate_limit_max: null,
-        rate_limit_window: null,
-    });
-}
-(0, vitest_1.beforeEach)(async () => {
-    stratum = (0, test_helpers_js_1.createMockStratum)();
-    stratum.getTenant.mockImplementation(async (id) => {
-        const row = TENANTS[id];
-        if (!row)
-            throw new Error(`Tenant ${id} not found`);
-        return row;
-    });
-    stratum.createTenant.mockResolvedValue({
-        id: "created-id",
-        slug: "newco",
-        isolation_strategy: "SHARED_RLS",
-    });
-    stratum.batchCreateTenants.mockResolvedValue({
-        created: [],
-    });
-    app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-});
-async function create(body) {
-    return app.inject({
-        method: "POST",
-        url: "/api/v1/tenants",
-        headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-        payload: body,
-    });
-}
-(0, vitest_1.describe)("scoped key create is confined to its own subtree", () => {
-    (0, vitest_1.beforeEach)(useScopedKey);
-    (0, vitest_1.it)("refuses creating a tenant under a parent outside the key subtree", async () => {
-        const res = await create({ slug: "newco", name: "New Co", parent_id: OUTSIDER });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.createTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses creating a new root tenant (no parent)", async () => {
-        const res = await create({ slug: "newco", name: "New Co" });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.createTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses an explicit null parent (root)", async () => {
-        const res = await create({ slug: "newco", name: "New Co", parent_id: null });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.createTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("allows creating directly under the key's own tenant", async () => {
-        const res = await create({ slug: "newco", name: "New Co", parent_id: OWNER });
-        (0, vitest_1.expect)(res.statusCode).toBe(201);
-        (0, vitest_1.expect)(stratum.createTenant).toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("allows creating under a descendant of the key's tenant", async () => {
-        const res = await create({ slug: "newco", name: "New Co", parent_id: OWNER_CHILD });
-        (0, vitest_1.expect)(res.statusCode).toBe(201);
-        (0, vitest_1.expect)(stratum.createTenant).toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses a batch create that targets a parent outside the subtree", async () => {
-        const res = await app.inject({
-            method: "POST",
-            url: "/api/v1/tenants/batch",
-            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-            payload: { tenants: [{ slug: "newco", name: "New Co", parent_id: OUTSIDER }] },
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.batchCreateTenants).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses a batch create that includes a new root", async () => {
-        const res = await app.inject({
-            method: "POST",
-            url: "/api/v1/tenants/batch",
-            headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-            payload: { tenants: [{ slug: "newco", name: "New Co", parent_id: OWNER }, { slug: "rootco", name: "Root Co" }] },
-        });
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.batchCreateTenants).not.toHaveBeenCalled();
-    });
-});
-(0, vitest_1.describe)("global key create is unrestricted", () => {
-    (0, vitest_1.beforeEach)(useGlobalKey);
-    (0, vitest_1.it)("allows creating a new root tenant", async () => {
-        const res = await create({ slug: "rootco", name: "Root Co" });
-        (0, vitest_1.expect)(res.statusCode).toBe(201);
-        (0, vitest_1.expect)(stratum.createTenant).toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("allows creating anywhere in the tree", async () => {
-        const res = await create({ slug: "newco", name: "New Co", parent_id: OUTSIDER });
-        (0, vitest_1.expect)(res.statusCode).toBe(201);
-        (0, vitest_1.expect)(stratum.createTenant).toHaveBeenCalled();
-    });
-});
-//# sourceMappingURL=tenant-create-scope.test.js.map

package/dist/__tests__/tenant-create-scope.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenant-create-scope.test.js","sourceRoot":"","sources":["../../src/__tests__/tenant-create-scope.test.ts"],"names":[],"mappings":";;AAAA,mCAA8D;AAG9D,uDAAiF;AAEjF;;;;;;;GAOG;AAEH,MAAM,KAAK,GAAG,sCAAsC,CAAC;AACrD,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAC3D,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAIxD,+EAA+E;AAC/E,MAAM,OAAO,GAAwB;IACnC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3D,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC1E,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;CAClE,CAAC;AAEF,IAAI,GAAoB,CAAC;AACzB,IAAI,OAAgB,CAAC;AAErB,SAAS,YAAY;IAClB,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY;IAClB,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;IACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;IAE7B,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAChE,KAAK,EAAE,EAAU,EAAE,EAAE;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC,CACF,CAAC;IAED,OAAO,CAAC,YAAyC,CAAC,iBAAiB,CAAC;QACnE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,OAAO;QACb,kBAAkB,EAAE,YAAY;KACjC,CAAC,CAAC;IACF,OAAO,CAAC,kBAA+C,CAAC,iBAAiB,CAAC;QACzE,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;IAEH,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,MAAM,CAAC,IAA6B;IACjD,OAAO,GAAG,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACjE,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC;AAED,IAAA,iBAAQ,EAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,IAAA,mBAAU,EAAC,YAAY,CAAC,CAAC;IAEzB,IAAA,WAAE,EAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEjF,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE5D,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7E,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAE9E,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAEpF,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,uBAAuB;YAC5B,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE;SAC/E,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,uBAAuB;YAC5B,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;SACjH,CAAC,CAAC;QAEH,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,IAAA,mBAAU,EAAC,YAAY,CAAC,CAAC;IAEzB,IAAA,WAAE,EAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAE9D,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEjF,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/tenant-move-scope.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=tenant-move-scope.test.d.ts.map

package/dist/__tests__/tenant-move-scope.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenant-move-scope.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/tenant-move-scope.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/tenant-move-scope.test.js

@@ -1,113 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const test_helpers_js_1 = require("./test-helpers.js");
-/**
- * Regression tests for a critical cross-tenant authorization flaw in the move route.
- *
- * The bug: createTenantScopeGuard was registered with the `fromParamId` extractor,
- * which reads only `:id`, the tenant being MOVED. Nothing authorized
- * `body.new_parent_id`, the move DESTINATION.
- *
- * A key scoped to its own tenant therefore passed the guard on the fast path
- * (`apiKey.tenant_id === targetTenantId`) and could graft itself under any tenant
- * in the system. Because Stratum resolves config by walking UP the ancestry path,
- * the attacker's tenant then inherits the victim's config, including `sensitive`
- * values, which are decrypted on resolve, plus the victim's delegated permissions.
- *
- * The library's moveTenant is not at fault: it locks both rows, rejects archived
- * tenants and detects cycles. Authorization is the control plane's job.
- */
-const ATTACKER = "11111111-1111-4111-8111-111111111111";
-const ATTACKER_CHILD = "22222222-2222-4222-8222-222222222222";
-const ATTACKER_GRANDCHILD = "33333333-3333-4333-8333-333333333333";
-const VICTIM = "99999999-9999-4999-8999-999999999999";
-// ancestry_path holds a tenant's ANCESTORS and excludes self, so a root is "".
-const TENANTS = {
-    [ATTACKER]: { id: ATTACKER, ancestry_path: "", status: "active" },
-    [ATTACKER_CHILD]: {
-        id: ATTACKER_CHILD,
-        ancestry_path: ATTACKER,
-        status: "active",
-    },
-    [ATTACKER_GRANDCHILD]: {
-        id: ATTACKER_GRANDCHILD,
-        ancestry_path: `${ATTACKER}/${ATTACKER_CHILD}`,
-        status: "active",
-    },
-    [VICTIM]: { id: VICTIM, ancestry_path: "", status: "active" },
-};
-let app;
-let stratum;
-(0, vitest_1.beforeEach)(async () => {
-    stratum = (0, test_helpers_js_1.createMockStratum)();
-    // A key scoped to the attacker's own tenant. Not a global key.
-    stratum.validateApiKey.mockResolvedValue({
-        key_id: "attacker-key",
-        tenant_id: ATTACKER,
-        scopes: ["read", "write", "admin"],
-        rate_limit_max: null,
-        rate_limit_window: null,
-    });
-    stratum.getTenant.mockImplementation(async (id) => {
-        const row = TENANTS[id];
-        if (!row)
-            throw new Error(`Tenant ${id} not found`);
-        return row;
-    });
-    stratum.moveTenant.mockImplementation(async (id) => TENANTS[id]);
-    app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-});
-async function move(id, newParentId) {
-    return app.inject({
-        method: "POST",
-        url: `/api/v1/tenants/${id}/move`,
-        headers: { ...(0, test_helpers_js_1.authHeaders)(), "content-type": "application/json" },
-        payload: { new_parent_id: newParentId },
-    });
-}
-(0, vitest_1.describe)("move route authorizes the destination parent, not just the moved tenant", () => {
-    (0, vitest_1.it)("refuses grafting your own tenant under an unrelated tenant", async () => {
-        const res = await move(ATTACKER, VICTIM);
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.moveTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("refuses grafting a tenant you do own under a tenant you do not", async () => {
-        const res = await move(ATTACKER_CHILD, VICTIM);
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.moveTenant).not.toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("allows reorganizing entirely inside your own subtree", async () => {
-        const res = await move(ATTACKER_GRANDCHILD, ATTACKER_CHILD);
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(stratum.moveTenant).toHaveBeenCalledWith(ATTACKER_GRANDCHILD, ATTACKER_CHILD, vitest_1.expect.anything());
-    });
-    (0, vitest_1.it)("allows moving a descendant up to your own root", async () => {
-        const res = await move(ATTACKER_GRANDCHILD, ATTACKER);
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(stratum.moveTenant).toHaveBeenCalled();
-    });
-    (0, vitest_1.it)("fails closed when the destination tenant cannot be loaded", async () => {
-        const res = await move(ATTACKER, "44444444-4444-4444-8444-444444444444");
-        (0, vitest_1.expect)(res.statusCode).toBe(403);
-        (0, vitest_1.expect)(stratum.moveTenant).not.toHaveBeenCalled();
-    });
-});
-(0, vitest_1.describe)("global keys are unaffected", () => {
-    (0, vitest_1.beforeEach)(async () => {
-        stratum.validateApiKey.mockResolvedValue({
-            key_id: "global-key",
-            tenant_id: null,
-            scopes: ["read", "write", "admin"],
-            rate_limit_max: null,
-            rate_limit_window: null,
-        });
-        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-    });
-    (0, vitest_1.it)("still permits an operator key to move a tenant anywhere", async () => {
-        const res = await move(ATTACKER, VICTIM);
-        (0, vitest_1.expect)(res.statusCode).toBe(200);
-        (0, vitest_1.expect)(stratum.moveTenant).toHaveBeenCalled();
-    });
-});
-//# sourceMappingURL=tenant-move-scope.test.js.map

package/dist/__tests__/tenant-move-scope.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenant-move-scope.test.js","sourceRoot":"","sources":["../../src/__tests__/tenant-move-scope.test.ts"],"names":[],"mappings":";;AAAA,mCAA8D;AAG9D,uDAAiF;AAEjF;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AACxD,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AACnE,MAAM,MAAM,GAAG,sCAAsC,CAAC;AAItD,+EAA+E;AAC/E,MAAM,OAAO,GAAwB;IACnC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjE,CAAC,cAAc,CAAC,EAAE;QAChB,EAAE,EAAE,cAAc;QAClB,aAAa,EAAE,QAAQ;QACvB,MAAM,EAAE,QAAQ;KACjB;IACD,CAAC,mBAAmB,CAAC,EAAE;QACrB,EAAE,EAAE,mBAAmB;QACvB,aAAa,EAAE,GAAG,QAAQ,IAAI,cAAc,EAAE;QAC9C,MAAM,EAAE,QAAQ;KACjB;IACD,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;CAC9D,CAAC;AAEF,IAAI,GAAoB,CAAC;AACzB,IAAI,OAAgB,CAAC;AAErB,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;IACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;IAE9B,+DAA+D;IAC9D,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;QACrE,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAClC,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IAEF,OAAO,CAAC,SAAsC,CAAC,kBAAkB,CAChE,KAAK,EAAE,EAAU,EAAE,EAAE;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC,CACF,CAAC;IAED,OAAO,CAAC,UAAuC,CAAC,kBAAkB,CACjE,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAClC,CAAC;IAEF,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI,CAAC,EAAU,EAAE,WAAmB;IACjD,OAAO,GAAG,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,mBAAmB,EAAE,OAAO;QACjC,OAAO,EAAE,EAAE,GAAG,IAAA,6BAAW,GAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACjE,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE;KACxC,CAAC,CAAC;AACL,CAAC;AAED,IAAA,iBAAQ,EAAC,yEAAyE,EAAE,GAAG,EAAE;IACvF,IAAA,WAAE,EAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEzC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAE/C,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;QAE5D,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAC7C,mBAAmB,EACnB,cAAc,EACd,eAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAEtD,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAC;QAEzE,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACnB,OAAO,CAAC,cAA2C,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAClC,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEzC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/tenants.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=tenants.test.d.ts.map

package/dist/__tests__/tenants.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenants.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/tenants.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/tenants.test.js

@@ -1,214 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const test_helpers_js_1 = require("./test-helpers.js");
-(0, vitest_1.describe)("Tenant Routes", () => {
-    let app;
-    let stratum;
-    (0, vitest_1.beforeEach)(async () => {
-        stratum = (0, test_helpers_js_1.createMockStratum)();
-        (0, test_helpers_js_1.setupAdminApiKey)(stratum);
-        app = await (0, test_helpers_js_1.buildTestApp)(stratum);
-    });
-    (0, vitest_1.afterEach)(async () => {
-        await app.close();
-    });
-    // ── POST /api/v1/tenants ────────────────────────────────────────────
-    (0, vitest_1.describe)("POST /api/v1/tenants", () => {
-        (0, vitest_1.it)("creates a tenant and returns 201", async () => {
-            const input = { slug: "acme_corp", name: "Acme Corp" };
-            stratum.createTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/tenants",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: input,
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(201);
-            const body = response.json();
-            (0, vitest_1.expect)(body.id).toBe(test_helpers_js_1.SAMPLE_TENANT.id);
-            (0, vitest_1.expect)(body.slug).toBe("acme_corp");
-            (0, vitest_1.expect)(stratum.createTenant).toHaveBeenCalledOnce();
-            (0, vitest_1.expect)(stratum.createTenant.mock.calls[0][0]).toMatchObject({ slug: "acme_corp" });
-        });
-        (0, vitest_1.it)("returns 400 for invalid input (missing slug)", async () => {
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/tenants",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { name: "No Slug" },
-            });
-            // Zod validation triggers 400
-            (0, vitest_1.expect)(response.statusCode).toBe(400);
-            const body = response.json();
-            (0, vitest_1.expect)(body.error.code).toBe("VALIDATION_ERROR");
-        });
-    });
-    // ── POST /api/v1/tenants/batch ──────────────────────────────────────
-    (0, vitest_1.describe)("POST /api/v1/tenants/batch", () => {
-        (0, vitest_1.it)("batch creates tenants and returns 201", async () => {
-            const batchResult = {
-                created: [test_helpers_js_1.SAMPLE_TENANT, test_helpers_js_1.SAMPLE_CHILD_TENANT],
-                errors: [],
-            };
-            stratum.batchCreateTenants.mockResolvedValue(batchResult);
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/tenants/batch",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: {
-                    tenants: [
-                        { slug: "acme_corp", name: "Acme Corp" },
-                        { slug: "acme_division", name: "Acme Division", parent_id: test_helpers_js_1.SAMPLE_TENANT.id },
-                    ],
-                },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(201);
-            const body = response.json();
-            (0, vitest_1.expect)(body.created).toHaveLength(2);
-            (0, vitest_1.expect)(stratum.batchCreateTenants).toHaveBeenCalledOnce();
-        });
-        (0, vitest_1.it)("returns 400 when tenants array is empty", async () => {
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/tenants/batch",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { tenants: [] },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(400);
-            (0, vitest_1.expect)(response.json().error.code).toBe("VALIDATION_ERROR");
-        });
-        (0, vitest_1.it)("returns 400 when tenants field is missing", async () => {
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/tenants/batch",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: {},
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(400);
-        });
-    });
-    // ── GET /api/v1/tenants/:id ─────────────────────────────────────────
-    (0, vitest_1.describe)("GET /api/v1/tenants/:id", () => {
-        (0, vitest_1.it)("returns the tenant", async () => {
-            stratum.getTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(200);
-            const body = response.json();
-            (0, vitest_1.expect)(body.id).toBe(test_helpers_js_1.SAMPLE_TENANT.id);
-            (0, vitest_1.expect)(body.slug).toBe("acme_corp");
-        });
-        (0, vitest_1.it)("returns 404 when tenant does not exist", async () => {
-            const { StratumError, ErrorCode } = await import("@stratum-hq/core");
-            stratum.getTenant.mockRejectedValue(new StratumError(ErrorCode.TENANT_NOT_FOUND, "Tenant not found", 404));
-            const response = await app.inject({
-                method: "GET",
-                url: "/api/v1/tenants/nonexistent-id",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(404);
-            const body = response.json();
-            (0, vitest_1.expect)(body.error.code).toBe("TENANT_NOT_FOUND");
-        });
-    });
-    // ── PATCH /api/v1/tenants/:id ───────────────────────────────────────
-    (0, vitest_1.describe)("PATCH /api/v1/tenants/:id", () => {
-        (0, vitest_1.it)("updates a tenant and returns 200", async () => {
-            const updatedTenant = { ...test_helpers_js_1.SAMPLE_TENANT, name: "Acme Corp Updated" };
-            stratum.updateTenant.mockResolvedValue(updatedTenant);
-            const response = await app.inject({
-                method: "PATCH",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { name: "Acme Corp Updated" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(200);
-            (0, vitest_1.expect)(response.json().name).toBe("Acme Corp Updated");
-            (0, vitest_1.expect)(stratum.updateTenant).toHaveBeenCalledOnce();
-        });
-    });
-    // ── DELETE /api/v1/tenants/:id ──────────────────────────────────────
-    (0, vitest_1.describe)("DELETE /api/v1/tenants/:id", () => {
-        (0, vitest_1.it)("soft deletes and returns 204", async () => {
-            stratum.deleteTenant.mockResolvedValue(undefined);
-            const response = await app.inject({
-                method: "DELETE",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(204);
-            (0, vitest_1.expect)(response.body).toBe("");
-            (0, vitest_1.expect)(stratum.deleteTenant).toHaveBeenCalledOnce();
-            (0, vitest_1.expect)(stratum.deleteTenant.mock.calls[0][0]).toBe(test_helpers_js_1.SAMPLE_TENANT.id);
-        });
-    });
-    // ── GET /api/v1/tenants/:id/descendants ─────────────────────────────
-    (0, vitest_1.describe)("GET /api/v1/tenants/:id/descendants", () => {
-        (0, vitest_1.it)("returns the tenant subtree", async () => {
-            const descendants = [test_helpers_js_1.SAMPLE_CHILD_TENANT];
-            stratum.getDescendants.mockResolvedValue(descendants);
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}/descendants`,
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(200);
-            const body = response.json();
-            (0, vitest_1.expect)(body).toHaveLength(1);
-            (0, vitest_1.expect)(body[0].id).toBe(test_helpers_js_1.SAMPLE_CHILD_TENANT.id);
-            (0, vitest_1.expect)(stratum.getDescendants).toHaveBeenCalledWith(test_helpers_js_1.SAMPLE_TENANT.id);
-        });
-    });
-    // ── Authentication required ─────────────────────────────────────────
-    (0, vitest_1.describe)("Authentication required", () => {
-        (0, vitest_1.it)("returns 401 without an API key or Bearer token", async () => {
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                // No auth headers
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(401);
-            const body = response.json();
-            (0, vitest_1.expect)(body.error.code).toBe("UNAUTHORIZED");
-        });
-        (0, vitest_1.it)("returns 401 with an invalid API key", async () => {
-            stratum.validateApiKey.mockResolvedValue(null);
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: { "x-api-key": "sk_test_invalid" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(401);
-        });
-    });
-    // ── Authorization ───────────────────────────────────────────────────
-    (0, vitest_1.describe)("Authorization", () => {
-        (0, vitest_1.it)("read-scope key cannot POST (write endpoint)", async () => {
-            (0, test_helpers_js_1.setupReadOnlyApiKey)(stratum);
-            const response = await app.inject({
-                method: "POST",
-                url: "/api/v1/tenants",
-                headers: (0, test_helpers_js_1.authHeaders)(),
-                payload: { slug: "test_tenant", name: "Test" },
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(403);
-            const body = response.json();
-            (0, vitest_1.expect)(body.error.code).toBe("FORBIDDEN");
-        });
-        (0, vitest_1.it)("read-scope key can GET (read endpoint)", async () => {
-            (0, test_helpers_js_1.setupReadOnlyApiKey)(stratum);
-            stratum.getTenant.mockResolvedValue(test_helpers_js_1.SAMPLE_TENANT);
-            const response = await app.inject({
-                method: "GET",
-                url: `/api/v1/tenants/${test_helpers_js_1.SAMPLE_TENANT.id}`,
-                headers: (0, test_helpers_js_1.authHeaders)(),
-            });
-            (0, vitest_1.expect)(response.statusCode).toBe(200);
-        });
-    });
-});
-//# sourceMappingURL=tenants.test.js.map

package/dist/__tests__/tenants.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenants.test.js","sourceRoot":"","sources":["../../src/__tests__/tenants.test.ts"],"names":[],"mappings":";;AAAA,mCAAqE;AAErE,uDAQ2B;AAG3B,IAAA,iBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,IAAI,GAAoB,CAAC;IACzB,IAAI,OAAgB,CAAC;IAErB,IAAA,mBAAU,EAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,IAAA,mCAAiB,GAAE,CAAC;QAC9B,IAAA,kCAAgB,EAAC,OAAO,CAAC,CAAC;QAC1B,GAAG,GAAG,MAAM,IAAA,8BAAY,EAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,KAAK,IAAI,EAAE;QACnB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,IAAA,iBAAQ,EAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,IAAA,WAAE,EAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,OAAO,CAAC,YAAoB,CAAC,iBAAiB,CAAC,+BAAa,CAAC,CAAC;YAE/D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,+BAAa,CAAC,EAAE,CAAC,CAAC;YACvC,IAAA,eAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACpC,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,oBAAoB,EAAE,CAAC;YACpD,IAAA,eAAM,EAAE,OAAO,CAAC,YAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;aAC7B,CAAC,CAAC;YAEH,8BAA8B;YAC9B,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,IAAA,iBAAQ,EAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,IAAA,WAAE,EAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,CAAC,+BAAa,EAAE,qCAAmB,CAAC;gBAC7C,MAAM,EAAE,EAAE;aACX,CAAC;YACD,OAAO,CAAC,kBAA0B,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAEnE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,uBAAuB;gBAC5B,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE;oBACP,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE;wBACxC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,+BAAa,CAAC,EAAE,EAAE;qBAC9E;iBACF;aACF,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACrC,IAAA,eAAM,EAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,uBAAuB;gBAC5B,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;aACzB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,uBAAuB;gBAC5B,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,IAAA,iBAAQ,EAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,IAAA,WAAE,EAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YACjC,OAAO,CAAC,SAAiB,CAAC,iBAAiB,CAAC,+BAAa,CAAC,CAAC;YAE5D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,mBAAmB,+BAAa,CAAC,EAAE,EAAE;gBAC1C,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,+BAAa,CAAC,EAAE,CAAC,CAAC;YACvC,IAAA,eAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACpE,OAAO,CAAC,SAAiB,CAAC,iBAAiB,CAC1C,IAAI,YAAY,CAAC,SAAS,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CACtE,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,gCAAgC;gBACrC,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,IAAA,iBAAQ,EAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,IAAA,WAAE,EAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,aAAa,GAAG,EAAE,GAAG,+BAAa,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;YACrE,OAAO,CAAC,YAAoB,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YAE/D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,OAAO;gBACf,GAAG,EAAE,mBAAmB,+BAAa,CAAC,EAAE,EAAE;gBAC1C,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;aACvC,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACvD,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,IAAA,iBAAQ,EAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,IAAA,WAAE,EAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC3C,OAAO,CAAC,YAAoB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAE3D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,QAAQ;gBAChB,GAAG,EAAE,mBAAmB,+BAAa,CAAC,EAAE,EAAE;gBAC1C,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAA,eAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,oBAAoB,EAAE,CAAC;YACpD,IAAA,eAAM,EAAE,OAAO,CAAC,YAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,+BAAa,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,IAAA,iBAAQ,EAAC,qCAAqC,EAAE,GAAG,EAAE;QACnD,IAAA,WAAE,EAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,WAAW,GAAG,CAAC,qCAAmB,CAAC,CAAC;YACzC,OAAO,CAAC,cAAsB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAE/D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,mBAAmB,+BAAa,CAAC,EAAE,cAAc;gBACtD,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAmB,CAAC,EAAE,CAAC,CAAC;YAChD,IAAA,eAAM,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,+BAAa,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,IAAA,iBAAQ,EAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,IAAA,WAAE,EAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,mBAAmB,+BAAa,CAAC,EAAE,EAAE;gBAC1C,kBAAkB;aACnB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YAClD,OAAO,CAAC,cAAsB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAExD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,mBAAmB,+BAAa,CAAC,EAAE,EAAE;gBAC1C,OAAO,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE;aAC5C,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,IAAA,iBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,IAAA,WAAE,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,IAAA,qCAAmB,EAAC,OAAO,CAAC,CAAC;YAE7B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,IAAA,6BAAW,GAAE;gBACtB,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;aAC/C,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,IAAA,qCAAmB,EAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,CAAC,SAAiB,CAAC,iBAAiB,CAAC,+BAAa,CAAC,CAAC;YAE5D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,mBAAmB,+BAAa,CAAC,EAAE,EAAE;gBAC1C,OAAO,EAAE,IAAA,6BAAW,GAAE;aACvB,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}