@stratum-hq/lib 0.1.0

package/dist/services/config-service.js

@@ -0,0 +1,271 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getConfigWithInheritance = exports.deleteConfig = exports.batchSetConfig = exports.setConfig = exports.resolveConfig = void 0;
+const pool_helpers_js_1 = require("../pool-helpers.js");
+const core_1 = require("@stratum-hq/core");
+const crypto_js_1 = require("../crypto.js");
+/**
+ * Resolve the effective config for a tenant by batch-loading ancestor configs
+ * in a single query and walking root→leaf.
+ */
+async function resolveConfig(pool, tenantId) {
+    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        const tenantRes = await client.query(`SELECT ancestry_path FROM tenants WHERE id = $1 AND status != 'archived'`, [tenantId]);
+        if (tenantRes.rows.length === 0) {
+            // Distinguish archived vs truly missing
+            const archivedRes = await client.query(`SELECT id FROM tenants WHERE id = $1`, [tenantId]);
+            if (archivedRes.rows.length > 0) {
+                throw new core_1.TenantArchivedError(tenantId);
+            }
+            throw new core_1.TenantNotFoundError(tenantId);
+        }
+        const ancestryPath = tenantRes.rows[0].ancestry_path;
+        const ancestorIds = (0, core_1.parseAncestryPath)(ancestryPath);
+        const allIds = [...ancestorIds, tenantId];
+        // Single query: batch-load all config entries for the ancestor chain
+        // Only include non-archived tenants to prevent archived ancestors from participating in inheritance
+        const entriesRes = await client.query(`SELECT ce.* FROM config_entries ce
+       JOIN tenants t ON t.id = ce.tenant_id
+       WHERE ce.tenant_id = ANY($1) AND t.status != 'archived'`, [allIds]);
+        // Group by tenant_id preserving order
+        const byTenant = new Map();
+        for (const id of allIds) {
+            byTenant.set(id, []);
+        }
+        for (const entry of entriesRes.rows) {
+            const list = byTenant.get(entry.tenant_id);
+            if (list) {
+                list.push(entry);
+            }
+        }
+        // Walk root→leaf: locked parent values propagate and block overrides
+        const resolved = new Map();
+        for (const currentTenantId of allIds) {
+            const entries = byTenant.get(currentTenantId) ?? [];
+            for (const entry of entries) {
+                const existing = resolved.get(entry.key);
+                if (existing?.locked) {
+                    // Key is locked by an ancestor — skip child overrides
+                    continue;
+                }
+                const isCurrentTenant = currentTenantId === tenantId;
+                const resolvedValue = entry.sensitive
+                    ? JSON.parse((0, crypto_js_1.decrypt)(JSON.parse(entry.value)))
+                    : entry.value;
+                resolved.set(entry.key, {
+                    key: entry.key,
+                    value: resolvedValue,
+                    source_tenant_id: entry.source_tenant_id,
+                    inherited: !isCurrentTenant,
+                    locked: entry.locked,
+                });
+            }
+        }
+        return Object.fromEntries(resolved);
+    });
+}
+exports.resolveConfig = resolveConfig;
+/**
+ * Set (upsert) a config key for a tenant.
+ * Rejects if the key is locked by an ancestor.
+ */
+async function setConfig(pool, tenantId, key, input) {
+    return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        const tenantRes = await client.query(`SELECT ancestry_path FROM tenants WHERE id = $1`, [tenantId]);
+        if (tenantRes.rows.length === 0) {
+            throw new core_1.TenantNotFoundError(tenantId);
+        }
+        const ancestorIds = (0, core_1.parseAncestryPath)(tenantRes.rows[0].ancestry_path);
+        // Check ancestor locks (ancestry_path excludes self)
+        if (ancestorIds.length > 0) {
+            const lockedRes = await client.query(`SELECT * FROM config_entries
+         WHERE tenant_id = ANY($1)
+           AND key = $2
+           AND locked = true`, [ancestorIds, key]);
+            if (lockedRes.rows.length > 0) {
+                const locker = lockedRes.rows[0];
+                throw new core_1.ConfigLockedError(key, locker.source_tenant_id);
+            }
+        }
+        const sensitive = input.sensitive ?? false;
+        const storedValue = sensitive
+            ? JSON.stringify((0, crypto_js_1.encrypt)(JSON.stringify(input.value)))
+            : JSON.stringify(input.value);
+        const res = await client.query(`INSERT INTO config_entries (tenant_id, key, value, locked, sensitive, source_tenant_id, inherited)
+       VALUES ($1, $2, $3, $4, $5, $1, false)
+       ON CONFLICT (tenant_id, key)
+       DO UPDATE SET
+         value = EXCLUDED.value,
+         locked = EXCLUDED.locked,
+         sensitive = EXCLUDED.sensitive,
+         updated_at = now()
+       RETURNING *`, [tenantId, key, storedValue, input.locked ?? false, sensitive]);
+        return res.rows[0];
+    });
+}
+exports.setConfig = setConfig;
+/**
+ * Set multiple config keys for a tenant in a single transaction.
+ * Partial success: locked keys are skipped and reported as errors,
+ * while unlocked keys are set successfully within the same transaction.
+ */
+async function batchSetConfig(pool, tenantId, entries) {
+    return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        const tenantRes = await client.query(`SELECT ancestry_path FROM tenants WHERE id = $1`, [tenantId]);
+        if (tenantRes.rows.length === 0) {
+            throw new core_1.TenantNotFoundError(tenantId);
+        }
+        const ancestorIds = (0, core_1.parseAncestryPath)(tenantRes.rows[0].ancestry_path);
+        const keys = entries.map((e) => e.key);
+        // Batch-load all ancestor locks in a single query
+        const lockedKeys = new Map();
+        if (ancestorIds.length > 0 && keys.length > 0) {
+            const lockedRes = await client.query(`SELECT * FROM config_entries
+         WHERE tenant_id = ANY($1)
+           AND key = ANY($2)
+           AND locked = true`, [ancestorIds, keys]);
+            for (const row of lockedRes.rows) {
+                lockedKeys.set(row.key, row.source_tenant_id);
+            }
+        }
+        const results = [];
+        let succeeded = 0;
+        let failed = 0;
+        for (const entry of entries) {
+            const lockerTenantId = lockedKeys.get(entry.key);
+            if (lockerTenantId) {
+                results.push({
+                    key: entry.key,
+                    status: "error",
+                    error: `Config '${entry.key}' is locked by tenant ${lockerTenantId} and cannot be overridden`,
+                });
+                failed++;
+                continue;
+            }
+            const sensitive = entry.sensitive ?? false;
+            const storedValue = sensitive
+                ? JSON.stringify((0, crypto_js_1.encrypt)(JSON.stringify(entry.value)))
+                : JSON.stringify(entry.value);
+            const res = await client.query(`INSERT INTO config_entries (tenant_id, key, value, locked, sensitive, source_tenant_id, inherited)
+         VALUES ($1, $2, $3, $4, $5, $1, false)
+         ON CONFLICT (tenant_id, key)
+         DO UPDATE SET
+           value = EXCLUDED.value,
+           locked = EXCLUDED.locked,
+           sensitive = EXCLUDED.sensitive,
+           updated_at = now()
+         RETURNING *`, [tenantId, entry.key, storedValue, entry.locked ?? false, sensitive]);
+            results.push({
+                key: entry.key,
+                status: "ok",
+                entry: res.rows[0],
+            });
+            succeeded++;
+        }
+        return { results, succeeded, failed };
+    });
+}
+exports.batchSetConfig = batchSetConfig;
+/**
+ * Delete a config override for a tenant, revealing the inherited parent value.
+ */
+async function deleteConfig(pool, tenantId, key) {
+    return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        const res = await client.query(`DELETE FROM config_entries WHERE tenant_id = $1 AND key = $2`, [tenantId, key]);
+        if (res.rowCount === 0) {
+            throw new core_1.ConfigNotFoundError(tenantId, key);
+        }
+    });
+}
+exports.deleteConfig = deleteConfig;
+/**
+ * Return all config entries for a tenant showing inheritance status:
+ * inherited (from ancestor), overridden (tenant has own value), or locked.
+ */
+async function getConfigWithInheritance(pool, tenantId) {
+    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        const tenantRes = await client.query(`SELECT ancestry_path FROM tenants WHERE id = $1`, [tenantId]);
+        if (tenantRes.rows.length === 0) {
+            throw new core_1.TenantNotFoundError(tenantId);
+        }
+        const ancestryPath = tenantRes.rows[0].ancestry_path;
+        const ancestorIds = (0, core_1.parseAncestryPath)(ancestryPath);
+        const allIds = [...ancestorIds, tenantId];
+        const entriesRes = await client.query(`SELECT * FROM config_entries WHERE tenant_id = ANY($1)`, [allIds]);
+        // Group entries by tenant_id for ordered traversal
+        const entriesByTenantId = new Map();
+        for (const entry of entriesRes.rows) {
+            const list = entriesByTenantId.get(entry.tenant_id) ?? [];
+            list.push(entry);
+            entriesByTenantId.set(entry.tenant_id, list);
+        }
+        // Walk allIds root→leaf to ensure correct ordering
+        const byKey = new Map();
+        for (const id of allIds) {
+            const entries = entriesByTenantId.get(id) ?? [];
+            for (const entry of entries) {
+                if (!byKey.has(entry.key)) {
+                    byKey.set(entry.key, {
+                        ancestorEntry: null,
+                        tenantEntry: null,
+                        lockedBy: null,
+                    });
+                }
+                const rec = byKey.get(entry.key);
+                if (id === tenantId) {
+                    rec.tenantEntry = entry;
+                }
+                else {
+                    // Walking root→leaf, so later entries are deeper ancestors (closer to tenant)
+                    rec.ancestorEntry = entry;
+                    if (entry.locked && !rec.lockedBy) {
+                        // First lock encountered (shallowest ancestor) takes precedence
+                        rec.lockedBy = entry;
+                    }
+                }
+            }
+        }
+        const decryptEntryValue = (entry) => entry.sensitive
+            ? JSON.parse((0, crypto_js_1.decrypt)(JSON.parse(entry.value)))
+            : entry.value;
+        const result = {};
+        for (const [key, rec] of byKey) {
+            const lockedEntry = rec.lockedBy;
+            const tenantEntry = rec.tenantEntry;
+            const ancestorEntry = rec.ancestorEntry;
+            if (lockedEntry) {
+                // Key is locked — show ancestor's locked value regardless of tenant override
+                result[key] = {
+                    key,
+                    value: decryptEntryValue(lockedEntry),
+                    source_tenant_id: lockedEntry.source_tenant_id,
+                    inherited: true,
+                    locked: true,
+                };
+            }
+            else if (tenantEntry) {
+                // Tenant has its own value (override or own entry)
+                result[key] = {
+                    key,
+                    value: decryptEntryValue(tenantEntry),
+                    source_tenant_id: tenantEntry.source_tenant_id,
+                    inherited: false,
+                    locked: tenantEntry.locked,
+                };
+            }
+            else if (ancestorEntry) {
+                // Inherited from ancestor
+                result[key] = {
+                    key,
+                    value: decryptEntryValue(ancestorEntry),
+                    source_tenant_id: ancestorEntry.source_tenant_id,
+                    inherited: true,
+                    locked: ancestorEntry.locked,
+                };
+            }
+        }
+        return result;
+    });
+}
+exports.getConfigWithInheritance = getConfigWithInheritance;
+//# sourceMappingURL=config-service.js.map

package/dist/services/config-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-service.js","sourceRoot":"","sources":["../../src/services/config-service.ts"],"names":[],"mappings":";;;AACA,wDAAiE;AACjE,2CAY0B;AAC1B,4CAAgD;AAEhD;;;GAGG;AACI,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,QAAgB;IACjE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,0EAA0E,EAC1E,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,wCAAwC;YACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,sCAAsC,EACtC,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACrD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE1C,qEAAqE;QACrE,oGAAoG;QACpG,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC;;+DAEyD,EACzD,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,sCAAsC;QACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;QAClD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;QAExD,KAAK,MAAM,eAAe,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAEpD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAEzC,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;oBACrB,sDAAsD;oBACtD,SAAS;gBACX,CAAC;gBAED,MAAM,eAAe,GAAG,eAAe,KAAK,QAAQ,CAAC;gBACrD,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS;oBACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAe,CAAW,CAAC,CAAC;oBAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;gBAChB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;oBACtB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,aAAa;oBACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,SAAS,EAAE,CAAC,eAAe;oBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAzED,sCAyEC;AAED;;;GAGG;AACI,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,QAAgB,EAChB,GAAW,EACX,KAAqB;IAErB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,qDAAqD;QACrD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC;;;6BAGqB,EACrB,CAAC,WAAW,EAAE,GAAG,CAAC,CACnB,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,wBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;QAC3C,MAAM,WAAW,GAAG,SAAS;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;mBAQa,EACb,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,SAAS,CAAC,CAC/D,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAnDD,8BAmDC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,QAAgB,EAChB,OAAsF;IAEtF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAEvC,kDAAkD;QAClD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC;;;6BAGqB,EACrB,CAAC,WAAW,EAAE,IAAI,CAAC,CACpB,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC;oBACX,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,WAAW,KAAK,CAAC,GAAG,yBAAyB,cAAc,2BAA2B;iBAC9F,CAAC,CAAC;gBACH,MAAM,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;YAC3C,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAEhC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;qBAQa,EACb,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,SAAS,CAAC,CACrE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;aACnB,CAAC,CAAC;YACH,SAAS,EAAE,CAAC;QACd,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AA3ED,wCA2EC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,QAAgB,EAChB,GAAW;IAEX,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,8DAA8D,EAC9D,CAAC,QAAQ,EAAE,GAAG,CAAC,CAChB,CAAC;QACF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,0BAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAdD,oCAcC;AAED;;;GAGG;AACI,KAAK,UAAU,wBAAwB,CAC5C,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACrD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,wDAAwD,EACxD,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,mDAAmD;QACnD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC3D,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QAED,mDAAmD;QACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAOlB,CAAC;QAEJ,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;wBACnB,aAAa,EAAE,IAAI;wBACnB,WAAW,EAAE,IAAI;wBACjB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC;gBAElC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACpB,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,8EAA8E;oBAC9E,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;oBAC1B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;wBAClC,gEAAgE;wBAChE,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,CAAC,KAAkB,EAAW,EAAE,CACxD,KAAK,CAAC,SAAS;YACb,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAe,CAAW,CAAC,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAElB,MAAM,MAAM,GAAmB,EAAE,CAAC;QAElC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;YACjC,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;YACpC,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;YAExC,IAAI,WAAW,EAAE,CAAC;gBAChB,6EAA6E;gBAC7E,MAAM,CAAC,GAAG,CAAC,GAAG;oBACZ,GAAG;oBACH,KAAK,EAAE,iBAAiB,CAAC,WAAW,CAAC;oBACrC,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;oBAC9C,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,IAAI;iBACb,CAAC;YACJ,CAAC;iBAAM,IAAI,WAAW,EAAE,CAAC;gBACvB,mDAAmD;gBACnD,MAAM,CAAC,GAAG,CAAC,GAAG;oBACZ,GAAG;oBACH,KAAK,EAAE,iBAAiB,CAAC,WAAW,CAAC;oBACrC,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;oBAC9C,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC;YACJ,CAAC;iBAAM,IAAI,aAAa,EAAE,CAAC;gBACzB,0BAA0B;gBAC1B,MAAM,CAAC,GAAG,CAAC,GAAG;oBACZ,GAAG;oBACH,KAAK,EAAE,iBAAiB,CAAC,aAAa,CAAC;oBACvC,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;oBAChD,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,aAAa,CAAC,MAAM;iBAC7B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AA7GD,4DA6GC"}

package/dist/services/consent-service.d.ts

@@ -0,0 +1,7 @@
+import pg from "pg";
+import type { ConsentRecord, GrantConsentInput } from "@stratum-hq/core";
+export declare function grantConsent(pool: pg.Pool, tenantId: string, input: GrantConsentInput): Promise<ConsentRecord>;
+export declare function revokeConsent(pool: pg.Pool, tenantId: string, subjectId: string, purpose: string): Promise<boolean>;
+export declare function listConsent(pool: pg.Pool, tenantId: string, subjectId?: string): Promise<ConsentRecord[]>;
+export declare function getActiveConsent(pool: pg.Pool, tenantId: string, subjectId: string, purpose: string): Promise<ConsentRecord | null>;
+//# sourceMappingURL=consent-service.d.ts.map

package/dist/services/consent-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-service.d.ts","sourceRoot":"","sources":["../../src/services/consent-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEzE,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,aAAa,CAAC,CAuBxB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC,CAuB1B;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAe/B"}

package/dist/services/consent-service.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getActiveConsent = exports.listConsent = exports.revokeConsent = exports.grantConsent = void 0;
+const pool_helpers_js_1 = require("../pool-helpers.js");
+async function grantConsent(pool, tenantId, input) {
+    return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        const res = await client.query(`INSERT INTO consent_records (tenant_id, subject_id, purpose, granted, granted_at, revoked_at, expires_at, metadata)
+       VALUES ($1, $2, $3, true, now(), NULL, $4, $5)
+       ON CONFLICT (tenant_id, subject_id, purpose)
+       DO UPDATE SET granted = true, granted_at = now(), revoked_at = NULL,
+                     expires_at = EXCLUDED.expires_at, metadata = EXCLUDED.metadata,
+                     updated_at = now()
+       RETURNING id, tenant_id, subject_id, purpose, granted,
+                 granted_at::text as granted_at, revoked_at::text as revoked_at,
+                 expires_at::text as expires_at, metadata,
+                 created_at::text as created_at, updated_at::text as updated_at`, [
+            tenantId,
+            input.subject_id,
+            input.purpose,
+            input.expires_at ?? null,
+            JSON.stringify(input.metadata ?? {}),
+        ]);
+        return res.rows[0];
+    });
+}
+exports.grantConsent = grantConsent;
+async function revokeConsent(pool, tenantId, subjectId, purpose) {
+    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        const res = await client.query(`UPDATE consent_records
+       SET granted = false, revoked_at = now(), updated_at = now()
+       WHERE tenant_id = $1 AND subject_id = $2 AND purpose = $3
+       RETURNING id`, [tenantId, subjectId, purpose]);
+        return res.rowCount !== null && res.rowCount > 0;
+    });
+}
+exports.revokeConsent = revokeConsent;
+async function listConsent(pool, tenantId, subjectId) {
+    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        const conditions = ["tenant_id = $1"];
+        const values = [tenantId];
+        if (subjectId !== undefined) {
+            conditions.push("subject_id = $2");
+            values.push(subjectId);
+        }
+        const where = conditions.join(" AND ");
+        const res = await client.query(`SELECT id, tenant_id, subject_id, purpose, granted,
+              granted_at::text as granted_at, revoked_at::text as revoked_at,
+              expires_at::text as expires_at, metadata,
+              created_at::text as created_at, updated_at::text as updated_at
+       FROM consent_records
+       WHERE ${where}
+       ORDER BY created_at DESC`, values);
+        return res.rows;
+    });
+}
+exports.listConsent = listConsent;
+async function getActiveConsent(pool, tenantId, subjectId, purpose) {
+    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        const res = await client.query(`SELECT id, tenant_id, subject_id, purpose, granted,
+              granted_at::text as granted_at, revoked_at::text as revoked_at,
+              expires_at::text as expires_at, metadata,
+              created_at::text as created_at, updated_at::text as updated_at
+       FROM consent_records
+       WHERE tenant_id = $1 AND subject_id = $2 AND purpose = $3
+             AND granted = true
+             AND (expires_at IS NULL OR expires_at > now())`, [tenantId, subjectId, purpose]);
+        return res.rows[0] ?? null;
+    });
+}
+exports.getActiveConsent = getActiveConsent;
+//# sourceMappingURL=consent-service.js.map

package/dist/services/consent-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-service.js","sourceRoot":"","sources":["../../src/services/consent-service.ts"],"names":[],"mappings":";;;AACA,wDAAiE;AAG1D,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,QAAgB,EAChB,KAAwB;IAExB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;;gFAS0E,EAC1E;YACE,QAAQ;YACR,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,UAAU,IAAI,IAAI;YACxB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;SACrC,CACF,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AA3BD,oCA2BC;AAEM,KAAK,UAAU,aAAa,CACjC,IAAa,EACb,QAAgB,EAChB,SAAiB,EACjB,OAAe;IAEf,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;oBAGc,EACd,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAC/B,CAAC;QACF,OAAO,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAhBD,sCAgBC;AAEM,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,QAAgB,EAChB,SAAkB;IAElB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,UAAU,GAAa,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAc,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;eAKS,KAAK;gCACY,EAC1B,MAAM,CACP,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AA3BD,kCA2BC;AAEM,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,SAAiB,EACjB,OAAe;IAEf,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;4DAOsD,EACtD,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAC/B,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AApBD,4CAoBC"}

package/dist/services/event-service.d.ts

@@ -0,0 +1,39 @@
+import pg from "pg";
+import type { TenantEvent } from "@stratum-hq/core";
+interface WebhookEventRow {
+    id: string;
+    type: string;
+    tenant_id: string;
+    data: Record<string, unknown>;
+    created_at: string;
+}
+interface WebhookRow {
+    id: string;
+    tenant_id: string | null;
+    url: string;
+    secret_hash: string;
+    events: string[];
+    active: boolean;
+    description: string | null;
+    created_at: string;
+    updated_at: string;
+}
+export declare function emitEvent(pool: pg.Pool, type: TenantEvent, tenantId: string, data: Record<string, unknown>): Promise<void>;
+export declare function deliverWebhook(webhook: WebhookRow, event: WebhookEventRow, deliveryId: string): Promise<{
+    success: boolean;
+    responseCode: number | null;
+    error: string | null;
+}>;
+export declare function processDeliveries(pool: pg.Pool): Promise<void>;
+export declare function retryFailedDeliveries(pool: pg.Pool, tenantId?: string): Promise<number>;
+export declare function retryDelivery(pool: pg.Pool, deliveryId: string): Promise<boolean>;
+export interface DeliveryStats {
+    total: number;
+    pending: number;
+    success: number;
+    failed: number;
+}
+export declare function getDeliveryStats(pool: pg.Pool, tenantId?: string): Promise<DeliveryStats>;
+export declare function listFailedDeliveries(pool: pg.Pool, limit?: number, tenantId?: string): Promise<Record<string, unknown>[]>;
+export {};
+//# sourceMappingURL=event-service.d.ts.map

package/dist/services/event-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-service.d.ts","sourceRoot":"","sources":["../../src/services/event-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAgIpD,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA2ClF;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAmFpE;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4B7F;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBvF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA0B/F;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,KAAK,SAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CA0BpC"}