@stratum-hq/lib 0.1.0

package/dist/services/event-service.js

@@ -0,0 +1,331 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listFailedDeliveries = exports.getDeliveryStats = exports.retryDelivery = exports.retryFailedDeliveries = exports.processDeliveries = exports.deliverWebhook = exports.emitEvent = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const promises_1 = __importDefault(require("node:dns/promises"));
+const pool_helpers_js_1 = require("../pool-helpers.js");
+const webhook_service_js_1 = require("./webhook-service.js");
+const MAX_ATTEMPTS = 5;
+/** Blocked IP ranges for SSRF protection */
+const BLOCKED_IP_PATTERNS = [
+    /^127\./, // loopback
+    /^10\./, // RFC 1918
+    /^172\.(1[6-9]|2\d|3[01])\./, // RFC 1918
+    /^192\.168\./, // RFC 1918
+    /^169\.254\./, // link-local
+    /^0\./, // current network
+    /^::1$/, // IPv6 loopback
+    /^fc00:/, // IPv6 unique local
+    /^fe80:/, // IPv6 link-local
+    /^fd00:ec2:/, // AWS IMDSv2 IPv6
+];
+const BLOCKED_HOSTNAMES = new Set([
+    "localhost",
+    "localhost.localdomain",
+    "metadata.google.internal", // GCP metadata
+    "metadata.goog", // GCP alternate
+    "169.254.169.254", // AWS/Azure metadata
+]);
+/** Check if an IP matches any blocked private/reserved range. */
+function isBlockedIp(ip) {
+    return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(ip));
+}
+/** Validates that a webhook URL does not target internal/private networks. */
+function validateWebhookUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid webhook URL: ${url}`);
+    }
+    // Only allow http/https
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`Webhook URL must use http or https: ${url}`);
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    // Block known internal hostnames
+    if (BLOCKED_HOSTNAMES.has(hostname)) {
+        throw new Error(`Webhook URL targets a blocked host: ${hostname}`);
+    }
+    // Block private IP ranges
+    if (isBlockedIp(hostname)) {
+        throw new Error(`Webhook URL targets a private/reserved IP range: ${hostname}`);
+    }
+}
+/**
+ * DNS-rebinding-safe validation: resolve hostname and check all resolved IPs
+ * against blocked ranges. Call this at delivery time, not just registration.
+ */
+async function validateWebhookUrlWithDns(url) {
+    // First run the synchronous checks
+    validateWebhookUrl(url);
+    const parsed = new URL(url);
+    const hostname = parsed.hostname.toLowerCase();
+    // If hostname is already an IP literal, synchronous check is sufficient
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(hostname) || hostname.startsWith("[")) {
+        return;
+    }
+    // Resolve DNS (both A and AAAA records) and validate all returned IPs
+    let addresses;
+    try {
+        const [v4Result, v6Result] = await Promise.allSettled([
+            promises_1.default.resolve4(hostname),
+            promises_1.default.resolve6(hostname),
+        ]);
+        addresses = [
+            ...(v4Result.status === "fulfilled" ? v4Result.value : []),
+            ...(v6Result.status === "fulfilled" ? v6Result.value : []),
+        ];
+        if (addresses.length === 0) {
+            throw new Error("No DNS records found");
+        }
+    }
+    catch {
+        // DNS resolution failed — fail closed to prevent SSRF via DNS rebinding
+        throw new Error(`DNS resolution failed for webhook host: ${hostname}`);
+    }
+    for (const ip of addresses) {
+        if (isBlockedIp(ip)) {
+            throw new Error(`Webhook URL hostname ${hostname} resolves to blocked IP ${ip}`);
+        }
+    }
+}
+function signPayload(secret, payload) {
+    return ("sha256=" +
+        node_crypto_1.default.createHmac("sha256", secret).update(payload).digest("hex"));
+}
+function retryDelayMs(attempts) {
+    // attempts^2 * 5000ms: 5s, 20s, 45s, 80s, 125s
+    return Math.pow(attempts, 2) * 5000;
+}
+async function emitEvent(pool, type, tenantId, data) {
+    // Insert event record
+    const eventRow = await (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        const res = await client.query(`INSERT INTO webhook_events (type, tenant_id, data)
+       VALUES ($1, $2, $3)
+       RETURNING *`, [type, tenantId, JSON.stringify(data)]);
+        return res.rows[0];
+    });
+    // Find matching webhooks
+    const webhooks = await (0, webhook_service_js_1.getWebhooksForEvent)(pool, type, tenantId);
+    if (webhooks.length === 0) {
+        return;
+    }
+    // Create delivery records for each matching webhook
+    await (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        for (const webhook of webhooks) {
+            await client.query(`INSERT INTO webhook_deliveries (webhook_id, event_id, status, attempts)
+         VALUES ($1, $2, 'pending', 0)`, [webhook.id, eventRow.id]);
+        }
+    });
+    // Fire-and-forget delivery — do not await
+    processDeliveries(pool).catch(() => {
+        // Non-critical: delivery failures are tracked in webhook_deliveries
+    });
+}
+exports.emitEvent = emitEvent;
+async function deliverWebhook(webhook, event, deliveryId) {
+    const payload = JSON.stringify({
+        id: event.id,
+        type: event.type,
+        tenant_id: event.tenant_id,
+        data: event.data,
+        created_at: event.created_at,
+    });
+    // SSRF protection: validate URL with DNS rebinding check before making request
+    await validateWebhookUrlWithDns(webhook.url);
+    const rawSecret = (0, webhook_service_js_1.decryptSecret)(webhook.secret_hash);
+    const signature = signPayload(rawSecret, payload);
+    const timestamp = new Date().toISOString();
+    try {
+        const response = await globalThis.fetch(webhook.url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "X-Stratum-Event": event.type,
+                "X-Stratum-Signature": signature,
+                "X-Stratum-Delivery-ID": deliveryId,
+                "X-Stratum-Timestamp": timestamp,
+            },
+            body: payload,
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (response.ok) {
+            return { success: true, responseCode: response.status, error: null };
+        }
+        return {
+            success: false,
+            responseCode: response.status,
+            error: `HTTP ${response.status}`,
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { success: false, responseCode: null, error: message };
+    }
+}
+exports.deliverWebhook = deliverWebhook;
+async function processDeliveries(pool) {
+    // Find pending deliveries due for delivery
+    const deliveries = await (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        const res = await client.query(`SELECT * FROM webhook_deliveries
+       WHERE status = 'pending'
+         AND (next_retry_at IS NULL OR next_retry_at <= now())
+       ORDER BY created_at ASC
+       LIMIT 100`);
+        return res.rows;
+    });
+    for (const delivery of deliveries) {
+        await (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+            // Re-fetch delivery with row lock
+            const lockRes = await client.query(`SELECT * FROM webhook_deliveries WHERE id = $1 AND status = 'pending' FOR UPDATE SKIP LOCKED`, [delivery.id]);
+            if (lockRes.rows.length === 0) {
+                return; // Already processed by another worker
+            }
+            const locked = lockRes.rows[0];
+            // Fetch the webhook and event
+            const webhookRes = await client.query(`SELECT * FROM webhooks WHERE id = $1`, [locked.webhook_id]);
+            const eventRes = await client.query(`SELECT * FROM webhook_events WHERE id = $1`, [locked.event_id]);
+            if (webhookRes.rows.length === 0 || eventRes.rows.length === 0) {
+                // Webhook or event was deleted; mark failed
+                await client.query(`UPDATE webhook_deliveries
+           SET status = 'failed', last_error = 'Webhook or event not found', completed_at = now()
+           WHERE id = $1`, [locked.id]);
+                return;
+            }
+            const webhook = webhookRes.rows[0];
+            const event = eventRes.rows[0];
+            const attempts = locked.attempts + 1;
+            const result = await deliverWebhook(webhook, event, locked.id);
+            if (result.success) {
+                await client.query(`UPDATE webhook_deliveries
+           SET status = 'success', attempts = $1, response_code = $2,
+               last_error = NULL, completed_at = now()
+           WHERE id = $3`, [attempts, result.responseCode, locked.id]);
+            }
+            else if (attempts >= MAX_ATTEMPTS) {
+                await client.query(`UPDATE webhook_deliveries
+           SET status = 'failed', attempts = $1, response_code = $2,
+               last_error = $3, completed_at = now()
+           WHERE id = $4`, [attempts, result.responseCode, result.error, locked.id]);
+            }
+            else {
+                const nextRetryMs = retryDelayMs(attempts);
+                await client.query(`UPDATE webhook_deliveries
+           SET attempts = $1, response_code = $2, last_error = $3,
+               next_retry_at = now() + ($4 || ' milliseconds')::interval
+           WHERE id = $5`, [attempts, result.responseCode, result.error, nextRetryMs, locked.id]);
+            }
+        }).catch(() => {
+            // Per-delivery failures are non-fatal; continue processing others
+        });
+    }
+}
+exports.processDeliveries = processDeliveries;
+async function retryFailedDeliveries(pool, tenantId) {
+    const result = await (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        let query;
+        const params = [];
+        if (tenantId) {
+            query = `WITH updated AS (
+        UPDATE webhook_deliveries
+        SET status = 'pending', next_retry_at = NULL, attempts = 0
+        WHERE status = 'failed' AND webhook_id IN (SELECT id FROM webhooks WHERE tenant_id = $1)
+        RETURNING id
+      ) SELECT COUNT(*) as count FROM updated`;
+            params.push(tenantId);
+        }
+        else {
+            query = `WITH updated AS (
+        UPDATE webhook_deliveries
+        SET status = 'pending', next_retry_at = NULL, attempts = 0
+        WHERE status = 'failed'
+        RETURNING id
+      ) SELECT COUNT(*) as count FROM updated`;
+        }
+        const res = await client.query(query, params);
+        return parseInt(res.rows[0].count, 10);
+    });
+    if (result > 0) {
+        processDeliveries(pool).catch(() => { });
+    }
+    return result;
+}
+exports.retryFailedDeliveries = retryFailedDeliveries;
+async function retryDelivery(pool, deliveryId) {
+    const updated = await (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        const res = await client.query(`UPDATE webhook_deliveries
+       SET status = 'pending', next_retry_at = NULL, attempts = 0
+       WHERE id = $1 AND status = 'failed'
+       RETURNING id`, [deliveryId]);
+        return res.rows.length > 0;
+    });
+    if (updated) {
+        processDeliveries(pool).catch(() => { });
+    }
+    return updated;
+}
+exports.retryDelivery = retryDelivery;
+async function getDeliveryStats(pool, tenantId) {
+    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        let query;
+        const params = [];
+        if (tenantId) {
+            query = `SELECT wd.status, COUNT(*) as count FROM webhook_deliveries wd
+               JOIN webhooks w ON w.id = wd.webhook_id
+               WHERE w.tenant_id = $1 GROUP BY wd.status`;
+            params.push(tenantId);
+        }
+        else {
+            query = `SELECT status, COUNT(*) as count FROM webhook_deliveries GROUP BY status`;
+        }
+        const res = await client.query(query, params);
+        const counts = {};
+        let total = 0;
+        for (const row of res.rows) {
+            counts[row.status] = parseInt(row.count, 10);
+            total += counts[row.status];
+        }
+        return {
+            total,
+            pending: counts["pending"] ?? 0,
+            success: counts["success"] ?? 0,
+            failed: counts["failed"] ?? 0,
+        };
+    });
+}
+exports.getDeliveryStats = getDeliveryStats;
+async function listFailedDeliveries(pool, limit = 100, tenantId) {
+    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        let query;
+        const params = [];
+        if (tenantId) {
+            query = `SELECT wd.*, we.type as event_type, we.tenant_id as event_tenant_id, w.url as webhook_url
+               FROM webhook_deliveries wd
+               JOIN webhook_events we ON we.id = wd.event_id
+               JOIN webhooks w ON w.id = wd.webhook_id
+               WHERE wd.status = 'failed' AND w.tenant_id = $1
+               ORDER BY wd.completed_at DESC
+               LIMIT $2`;
+            params.push(tenantId, limit);
+        }
+        else {
+            query = `SELECT wd.*, we.type as event_type, we.tenant_id as event_tenant_id, w.url as webhook_url
+               FROM webhook_deliveries wd
+               JOIN webhook_events we ON we.id = wd.event_id
+               JOIN webhooks w ON w.id = wd.webhook_id
+               WHERE wd.status = 'failed'
+               ORDER BY wd.completed_at DESC
+               LIMIT $1`;
+            params.push(limit);
+        }
+        const res = await client.query(query, params);
+        return res.rows;
+    });
+}
+exports.listFailedDeliveries = listFailedDeliveries;
+//# sourceMappingURL=event-service.js.map

package/dist/services/event-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-service.js","sourceRoot":"","sources":["../../src/services/event-service.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AACjC,iEAAoC;AAEpC,wDAAiE;AAEjE,6DAA0E;AAE1E,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,WAAW;IACpB,4BAA4B,EAAE,WAAW;IACzC,aAAa,EAAE,WAAW;IAC1B,aAAa,EAAE,aAAa;IAC5B,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE,gBAAgB;IACzB,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,kBAAkB;IAC5B,YAAY,EAAE,kBAAkB;CACjC,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,uBAAuB;IACvB,0BAA0B,EAAE,eAAe;IAC3C,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,qBAAqB;CACzC,CAAC,CAAC;AAEH,iEAAiE;AACjE,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,iCAAiC;IACjC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,0BAA0B;IAC1B,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CAAC,GAAW;IAClD,mCAAmC;IACnC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,wEAAwE;IACxE,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACpD,kBAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,kBAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACvB,CAAC,CAAC;QACH,SAAS,GAAG;YACV,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,wBAAwB,QAAQ,2BAA2B,EAAE,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,OAAe;IAClD,OAAO,CACL,SAAS;QACT,qBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,+CAA+C;IAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACtC,CAAC;AAmCM,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,IAAiB,EACjB,QAAgB,EAChB,IAA6B;IAE7B,sBAAsB;IACtB,MAAM,QAAQ,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CACvC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAmB,EAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,oDAAoD;IACpD,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,KAAK,CAChB;uCAC+B,EAC/B,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAC1B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACjC,oEAAoE;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAvCD,8BAuCC;AAEM,KAAK,UAAU,cAAc,CAClC,OAAmB,EACnB,KAAsB,EACtB,UAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,IAAA,kCAAa,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,iBAAiB,EAAE,KAAK,CAAC,IAAI;gBAC7B,qBAAqB,EAAE,SAAS;gBAChC,uBAAuB,EAAE,UAAU;gBACnC,qBAAqB,EAAE,SAAS;aACjC;YACD,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE;SACjC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AA/CD,wCA+CC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAa;IACnD,2CAA2C;IAC3C,MAAM,UAAU,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;iBAIW,CACZ,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3C,kCAAkC;YAClC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,8FAA8F,EAC9F,CAAC,QAAQ,CAAC,EAAE,CAAC,CACd,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,sCAAsC;YAChD,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE/B,8BAA8B;YAC9B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,sCAAsC,EACtC,CAAC,MAAM,CAAC,UAAU,CAAC,CACpB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,4CAA4C,EAC5C,CAAC,MAAM,CAAC,QAAQ,CAAC,CAClB,CAAC;YAEF,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,4CAA4C;gBAC5C,MAAM,MAAM,CAAC,KAAK,CAChB;;yBAEe,EACf,CAAC,MAAM,CAAC,EAAE,CAAC,CACZ,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;YAErC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAE/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,MAAM,CAAC,KAAK,CAChB;;;yBAGe,EACf,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CAC3C,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;gBACpC,MAAM,MAAM,CAAC,KAAK,CAChB;;;yBAGe,EACf,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CACzD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC3C,MAAM,MAAM,CAAC,KAAK,CAChB;;;yBAGe,EACf,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CACtE,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,kEAAkE;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAnFD,8CAmFC;AAEM,KAAK,UAAU,qBAAqB,CAAC,IAAa,EAAE,QAAiB;IAC1E,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACrD,IAAI,KAAa,CAAC;QAClB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG;;;;;8CAKgC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG;;;;;8CAKgC,CAAC;QAC3C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAoB,KAAK,EAAE,MAAM,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AA5BD,sDA4BC;AAEM,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,UAAkB;IACnE,MAAM,OAAO,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;oBAGc,EACd,CAAC,UAAU,CAAC,CACb,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,EAAE,CAAC;QACZ,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAhBD,sCAgBC;AASM,KAAK,UAAU,gBAAgB,CAAC,IAAa,EAAE,QAAiB;IACrE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,KAAa,CAAC;QAClB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG;;yDAE2C,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,0EAA0E,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAoC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjF,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AA1BD,4CA0BC;AAEM,KAAK,UAAU,oBAAoB,CACxC,IAAa,EACb,KAAK,GAAG,GAAG,EACX,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,KAAa,CAAC;QAClB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG;;;;;;wBAMU,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,KAAK,GAAG;;;;;;wBAMU,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAA0B,KAAK,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AA9BD,oDA8BC"}

package/dist/services/key-rotation-service.d.ts

@@ -0,0 +1,15 @@
+import pg from "pg";
+export interface KeyRotationResult {
+    config_entries_rotated: number;
+    webhooks_rotated: number;
+}
+/**
+ * Re-encrypts all sensitive data (config entries and webhook secrets)
+ * from oldKey to newKey in a single transaction.
+ *
+ * This is a zero-downtime operation: the transaction ensures either
+ * all values are rotated or none are. After rotation, update the
+ * STRATUM_ENCRYPTION_KEY environment variable to the new key.
+ */
+export declare function rotateEncryptionKey(pool: pg.Pool, oldKeyMaterial: string, newKeyMaterial: string): Promise<KeyRotationResult>;
+//# sourceMappingURL=key-rotation-service.d.ts.map

package/dist/services/key-rotation-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-rotation-service.d.ts","sourceRoot":"","sources":["../../src/services/key-rotation-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAwC5B"}

package/dist/services/key-rotation-service.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rotateEncryptionKey = void 0;
+const pool_helpers_js_1 = require("../pool-helpers.js");
+const crypto_js_1 = require("../crypto.js");
+/**
+ * Re-encrypts all sensitive data (config entries and webhook secrets)
+ * from oldKey to newKey in a single transaction.
+ *
+ * This is a zero-downtime operation: the transaction ensures either
+ * all values are rotated or none are. After rotation, update the
+ * STRATUM_ENCRYPTION_KEY environment variable to the new key.
+ */
+async function rotateEncryptionKey(pool, oldKeyMaterial, newKeyMaterial) {
+    return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        let configCount = 0;
+        let webhookCount = 0;
+        // 1. Re-encrypt sensitive config entries
+        const configRes = await client.query(`SELECT id, value FROM config_entries WHERE sensitive = true`);
+        for (const row of configRes.rows) {
+            // value is stored as JSON string containing the encrypted blob
+            const encryptedBlob = JSON.parse(row.value);
+            const reEncrypted = (0, crypto_js_1.reEncrypt)(encryptedBlob, oldKeyMaterial, newKeyMaterial);
+            await client.query(`UPDATE config_entries SET value = $1, updated_at = now() WHERE id = $2`, [JSON.stringify(reEncrypted), row.id]);
+            configCount++;
+        }
+        // 2. Re-encrypt webhook secrets
+        const webhookRes = await client.query(`SELECT id, secret_hash FROM webhooks WHERE secret_hash IS NOT NULL`);
+        for (const row of webhookRes.rows) {
+            const reEncrypted = (0, crypto_js_1.reEncrypt)(row.secret_hash, oldKeyMaterial, newKeyMaterial);
+            await client.query(`UPDATE webhooks SET secret_hash = $1 WHERE id = $2`, [reEncrypted, row.id]);
+            webhookCount++;
+        }
+        return {
+            config_entries_rotated: configCount,
+            webhooks_rotated: webhookCount,
+        };
+    });
+}
+exports.rotateEncryptionKey = rotateEncryptionKey;
+//# sourceMappingURL=key-rotation-service.js.map

package/dist/services/key-rotation-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-rotation-service.js","sourceRoot":"","sources":["../../src/services/key-rotation-service.ts"],"names":[],"mappings":";;;AACA,wDAAqD;AACrD,4CAAyC;AAOzC;;;;;;;GAOG;AACI,KAAK,UAAU,mBAAmB,CACvC,IAAa,EACb,cAAsB,EACtB,cAAsB;IAEtB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,yCAAyC;QACzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,6DAA6D,CAC9D,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACjC,+DAA+D;YAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAW,CAAC;YACtD,MAAM,WAAW,GAAG,IAAA,qBAAS,EAAC,aAAa,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;YAC7E,MAAM,MAAM,CAAC,KAAK,CAChB,wEAAwE,EACxE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CACtC,CAAC;YACF,WAAW,EAAE,CAAC;QAChB,CAAC;QAED,gCAAgC;QAChC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,oEAAoE,CACrE,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,IAAA,qBAAS,EAAC,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;YAC/E,MAAM,MAAM,CAAC,KAAK,CAChB,oDAAoD,EACpD,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CACtB,CAAC;YACF,YAAY,EAAE,CAAC;QACjB,CAAC;QAED,OAAO;YACL,sBAAsB,EAAE,WAAW;YACnC,gBAAgB,EAAE,YAAY;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AA5CD,kDA4CC"}

package/dist/services/permission-service.d.ts

@@ -0,0 +1,21 @@
+import pg from "pg";
+import { type PermissionPolicy, type CreatePermissionInput, type UpdatePermissionInput, type ResolvedPermission } from "@stratum-hq/core";
+/**
+ * Resolve effective permissions for a tenant by batch-loading all ancestor
+ * permission policies in a single query and walking root→leaf.
+ */
+export declare function resolvePermissions(pool: pg.Pool, tenantId: string): Promise<Record<string, ResolvedPermission>>;
+/**
+ * Create a new permission policy for a tenant.
+ * Rejects if the key is already LOCKED by an ancestor.
+ */
+export declare function createPermission(pool: pg.Pool, tenantId: string, input: CreatePermissionInput): Promise<PermissionPolicy>;
+/**
+ * Update a permission policy, enforcing LOCKED constraints.
+ */
+export declare function updatePermission(pool: pg.Pool, tenantId: string, policyId: string, input: UpdatePermissionInput): Promise<PermissionPolicy>;
+/**
+ * Delete a permission policy, handling CASCADE / SOFT / PERMANENT revocation modes.
+ */
+export declare function deletePermission(pool: pg.Pool, tenantId: string, policyId: string): Promise<void>;
+//# sourceMappingURL=permission-service.d.ts.map

package/dist/services/permission-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-service.d.ts","sourceRoot":"","sources":["../../src/services/permission-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EAQxB,MAAM,kBAAkB,CAAC;AAE1B;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CA2F7C;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CA0C3B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAiE3B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAuDf"}

package/dist/services/permission-service.js

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deletePermission = exports.updatePermission = exports.createPermission = exports.resolvePermissions = void 0;
+const pool_helpers_js_1 = require("../pool-helpers.js");
+const core_1 = require("@stratum-hq/core");
+/**
+ * Resolve effective permissions for a tenant by batch-loading all ancestor
+ * permission policies in a single query and walking root→leaf.
+ */
+async function resolvePermissions(pool, tenantId) {
+    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        // Load the tenant's ancestry path
+        const tenantRes = await client.query(`SELECT ancestry_path FROM tenants WHERE id = $1`, [tenantId]);
+        if (tenantRes.rows.length === 0) {
+            throw new core_1.TenantNotFoundError(tenantId);
+        }
+        const ancestryPath = tenantRes.rows[0].ancestry_path;
+        const ancestorIds = (0, core_1.parseAncestryPath)(ancestryPath);
+        // Include self
+        const allIds = [...ancestorIds, tenantId];
+        // Single query: batch-load all policies for the entire ancestor chain
+        const policiesRes = await client.query(`SELECT * FROM permission_policies WHERE tenant_id = ANY($1)`, [allIds]);
+        // Group by tenant_id, maintaining insertion order
+        const byTenant = new Map();
+        for (const id of allIds) {
+            byTenant.set(id, []);
+        }
+        for (const policy of policiesRes.rows) {
+            const list = byTenant.get(policy.tenant_id);
+            if (list) {
+                list.push(policy);
+            }
+        }
+        // Walk root→leaf applying mode semantics
+        const resolved = new Map();
+        for (const currentTenantId of allIds) {
+            const policies = byTenant.get(currentTenantId) ?? [];
+            for (const policy of policies) {
+                const existing = resolved.get(policy.key);
+                if (existing?.locked) {
+                    // Key is LOCKED by an ancestor — descendants cannot override it
+                    continue;
+                }
+                switch (policy.mode) {
+                    case core_1.PermissionMode.LOCKED:
+                        resolved.set(policy.key, {
+                            policy_id: policy.id,
+                            key: policy.key,
+                            value: policy.value,
+                            mode: policy.mode,
+                            source_tenant_id: currentTenantId,
+                            locked: true,
+                            delegated: false,
+                        });
+                        break;
+                    case core_1.PermissionMode.DELEGATED:
+                        resolved.set(policy.key, {
+                            policy_id: policy.id,
+                            key: policy.key,
+                            value: policy.value,
+                            mode: policy.mode,
+                            source_tenant_id: currentTenantId,
+                            locked: false,
+                            delegated: true,
+                        });
+                        break;
+                    case core_1.PermissionMode.INHERITED:
+                    default:
+                        resolved.set(policy.key, {
+                            policy_id: policy.id,
+                            key: policy.key,
+                            value: policy.value,
+                            mode: policy.mode,
+                            source_tenant_id: currentTenantId,
+                            locked: false,
+                            delegated: false,
+                        });
+                        break;
+                }
+            }
+        }
+        return Object.fromEntries(resolved);
+    });
+}
+exports.resolvePermissions = resolvePermissions;
+/**
+ * Create a new permission policy for a tenant.
+ * Rejects if the key is already LOCKED by an ancestor.
+ */
+async function createPermission(pool, tenantId, input) {
+    return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        // Load ancestry to check for locked ancestor permissions
+        const tenantRes = await client.query(`SELECT ancestry_path FROM tenants WHERE id = $1`, [tenantId]);
+        if (tenantRes.rows.length === 0) {
+            throw new core_1.TenantNotFoundError(tenantId);
+        }
+        const ancestorIds = (0, core_1.parseAncestryPath)(tenantRes.rows[0].ancestry_path);
+        // Exclude self (ancestry_path does not include self)
+        if (ancestorIds.length > 0) {
+            const lockedRes = await client.query(`SELECT * FROM permission_policies
+         WHERE tenant_id = ANY($1)
+           AND key = $2
+           AND mode = $3`, [ancestorIds, input.key, core_1.PermissionMode.LOCKED]);
+            if (lockedRes.rows.length > 0) {
+                const locker = lockedRes.rows[0];
+                throw new core_1.PermissionLockedError(input.key, locker.source_tenant_id);
+            }
+        }
+        const res = await client.query(`INSERT INTO permission_policies (tenant_id, key, value, mode, revocation_mode, source_tenant_id)
+       VALUES ($1, $2, $3, $4, $5, $1)
+       RETURNING *`, [
+            tenantId,
+            input.key,
+            JSON.stringify(input.value ?? true),
+            input.mode ?? core_1.PermissionMode.INHERITED,
+            input.revocation_mode ?? core_1.RevocationMode.CASCADE,
+        ]);
+        return res.rows[0];
+    });
+}
+exports.createPermission = createPermission;
+/**
+ * Update a permission policy, enforcing LOCKED constraints.
+ */
+async function updatePermission(pool, tenantId, policyId, input) {
+    return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        const existing = await client.query(`SELECT * FROM permission_policies WHERE id = $1 AND tenant_id = $2`, [policyId, tenantId]);
+        if (existing.rows.length === 0) {
+            throw new core_1.PermissionNotFoundError(policyId);
+        }
+        const current = existing.rows[0];
+        // Check if an ancestor has LOCKED this key
+        const tenantRes = await client.query(`SELECT ancestry_path FROM tenants WHERE id = $1`, [tenantId]);
+        if (tenantRes.rows.length === 0) {
+            throw new core_1.TenantNotFoundError(tenantId);
+        }
+        const ancestorIds = (0, core_1.parseAncestryPath)(tenantRes.rows[0].ancestry_path);
+        if (ancestorIds.length > 0) {
+            const lockedRes = await client.query(`SELECT * FROM permission_policies
+         WHERE tenant_id = ANY($1)
+           AND key = $2
+           AND mode = $3`, [ancestorIds, current.key, core_1.PermissionMode.LOCKED]);
+            if (lockedRes.rows.length > 0) {
+                const locker = lockedRes.rows[0];
+                throw new core_1.PermissionLockedError(current.key, locker.source_tenant_id);
+            }
+        }
+        const sets = [];
+        const values = [];
+        let idx = 1;
+        if (input.value !== undefined) {
+            sets.push(`value = $${idx++}`);
+            values.push(JSON.stringify(input.value));
+        }
+        if (input.mode !== undefined) {
+            sets.push(`mode = $${idx++}`);
+            values.push(input.mode);
+        }
+        if (input.revocation_mode !== undefined) {
+            sets.push(`revocation_mode = $${idx++}`);
+            values.push(input.revocation_mode);
+        }
+        if (sets.length === 0) {
+            return current;
+        }
+        sets.push(`updated_at = now()`);
+        values.push(policyId);
+        const res = await client.query(`UPDATE permission_policies SET ${sets.join(", ")} WHERE id = $${idx} RETURNING *`, values);
+        return res.rows[0];
+    });
+}
+exports.updatePermission = updatePermission;
+/**
+ * Delete a permission policy, handling CASCADE / SOFT / PERMANENT revocation modes.
+ */
+async function deletePermission(pool, tenantId, policyId) {
+    return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        const existing = await client.query(`SELECT * FROM permission_policies WHERE id = $1 AND tenant_id = $2`, [policyId, tenantId]);
+        if (existing.rows.length === 0) {
+            throw new core_1.PermissionNotFoundError(policyId);
+        }
+        const policy = existing.rows[0];
+        switch (policy.revocation_mode) {
+            case core_1.RevocationMode.PERMANENT:
+                throw new core_1.PermissionRevocationDeniedError(policy.key);
+            case core_1.RevocationMode.CASCADE: {
+                // Recursively delete from all descendants
+                // Find all descendants via ancestry_ltree
+                const descendantsRes = await client.query(`SELECT id FROM tenants
+           WHERE ancestry_ltree <@ (SELECT ancestry_ltree FROM tenants WHERE id = $1)
+             AND id != $1`, [tenantId]);
+                const descendantIds = descendantsRes.rows.map((r) => r.id);
+                if (descendantIds.length > 0) {
+                    await client.query(`DELETE FROM permission_policies
+             WHERE tenant_id = ANY($1) AND key = $2`, [descendantIds, policy.key]);
+                }
+                await client.query(`DELETE FROM permission_policies WHERE id = $1`, [policyId]);
+                break;
+            }
+            case core_1.RevocationMode.SOFT:
+            default: {
+                // Freeze current values: mark all descendant policies as no longer
+                // inheriting from this policy by converting them to LOCKED snapshots
+                // but keep their current values intact. Simply delete this policy
+                // so descendants inherit the next ancestor up (or nothing).
+                await client.query(`DELETE FROM permission_policies WHERE id = $1`, [policyId]);
+                break;
+            }
+        }
+    });
+}
+exports.deletePermission = deletePermission;
+//# sourceMappingURL=permission-service.js.map