@stratum-hq/lib 0.2.0 → 0.2.3

package/dist/crypto.d.ts

@@ -1,6 +1,8 @@
 /** Encrypts a value. Returns versioned format: v1:iv:authTag:ciphertext (all hex) */
 export declare function encrypt(plaintext: string): string;
-/** Decrypts a versioned encrypted value. Supports v1 format and legacy (no version prefix). */
+/** Decrypts a versioned encrypted value. Supports v1 format and legacy (no version prefix).
+ * Falls back to STRATUM_ENCRYPTION_KEY_PREVIOUS if primary key decryption fails,
+ * enabling dual-key reads during rolling deployments. */
 export declare function decrypt(encrypted: string): string;
 /** Re-encrypts a value with a new key. Used for key rotation. Safe under concurrency — does not mutate process.env. */
 export declare function reEncrypt(encrypted: string, oldKeyMaterial: string, newKeyMaterial: string): string;

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AA0DA,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,+FAA+F;AAC/F,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,uHAAuH;AACvH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAGnG"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AA6DA,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;yDAEyD;AACzD,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAcjD;AAED,uHAAuH;AACvH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAGnG"}

package/dist/crypto.js

@@ -11,9 +11,11 @@ const ALGORITHM = "aes-256-gcm";
 const IV_LENGTH = 12;
 const AUTH_TAG_LENGTH = 16;
 const CURRENT_KEY_VERSION = "v1";
+const HKDF_SALT = process.env.STRATUM_HKDF_SALT
+    ? Buffer.from(process.env.STRATUM_HKDF_SALT, "hex")
+    : Buffer.alloc(32, 0);
 function hkdfDeriveKey(keyMaterial, info = "stratum-aes-key") {
-    const salt = Buffer.alloc(32, 0);
-    return Buffer.from(node_crypto_1.default.hkdfSync("sha256", Buffer.from(keyMaterial, "utf8"), salt, info, 32));
+    return Buffer.from(node_crypto_1.default.hkdfSync("sha256", Buffer.from(keyMaterial, "utf8"), HKDF_SALT, info, 32));
 }
 function getEncryptionKey() {
     const envKey = process.env.STRATUM_ENCRYPTION_KEY ?? process.env.WEBHOOK_ENCRYPTION_KEY;
@@ -27,7 +29,7 @@ function getEncryptionKey() {
     return hkdfDeriveKey("stratum-dev-key");
 }
 function deriveKey(keyMaterial) {
-    return hkdfDeriveKey(keyMaterial, "stratum-rotation-key");
+    return hkdfDeriveKey(keyMaterial, "stratum-aes-key");
 }
 function encryptWithKey(plaintext, key) {
     const iv = node_crypto_1.default.randomBytes(IV_LENGTH);
@@ -61,9 +63,25 @@ function decryptWithKey(encrypted, key) {
 function encrypt(plaintext) {
     return encryptWithKey(plaintext, getEncryptionKey());
 }
-/** Decrypts a versioned encrypted value. Supports v1 format and legacy (no version prefix). */
+/** Decrypts a versioned encrypted value. Supports v1 format and legacy (no version prefix).
+ * Falls back to STRATUM_ENCRYPTION_KEY_PREVIOUS if primary key decryption fails,
+ * enabling dual-key reads during rolling deployments. */
 function decrypt(encrypted) {
-    return decryptWithKey(encrypted, getEncryptionKey());
+    try {
+        return decryptWithKey(encrypted, getEncryptionKey());
+    }
+    catch (err) {
+        const previousKey = process.env.STRATUM_ENCRYPTION_KEY_PREVIOUS;
+        if (previousKey) {
+            try {
+                return decryptWithKey(encrypted, hkdfDeriveKey(previousKey));
+            }
+            catch {
+                // Both keys failed — throw the original error
+            }
+        }
+        throw err;
+    }
 }
 /** Re-encrypts a value with a new key. Used for key rotation. Safe under concurrency — does not mutate process.env. */
 function reEncrypt(encrypted, oldKeyMaterial, newKeyMaterial) {

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;AA2DA,0BAEC;AAGD,0BAEC;AAGD,8BAGC;AAxED,8DAAiC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAI,GAAG,iBAAiB;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,IAAI,CAChB,qBAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACxF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,yDAAyD;IACzD,OAAO,aAAa,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,OAAO,aAAa,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,qBAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,qBAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,GAAG,mBAAmB,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAa,EAAE,UAAkB,EAAE,aAAqB,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,sCAAsC;QACtC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAyC,CAAC;IACnF,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,gCAAgC;QAChC,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,qFAAqF;AACrF,SAAgB,OAAO,CAAC,SAAiB;IACvC,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,+FAA+F;AAC/F,SAAgB,OAAO,CAAC,SAAiB;IACvC,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,uHAAuH;AACvH,SAAgB,SAAS,CAAC,SAAiB,EAAE,cAAsB,EAAE,cAAsB;IACzF,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IACvE,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;AA8DA,0BAEC;AAKD,0BAcC;AAGD,8BAGC;AAzFD,8DAAiC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,SAAS,GAAW,OAAO,CAAC,GAAG,CAAC,iBAAiB;IACrD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC;IACnD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAExB,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAI,GAAG,iBAAiB;IAClE,OAAO,MAAM,CAAC,IAAI,CAChB,qBAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACxF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,yDAAyD;IACzD,OAAO,aAAa,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,OAAO,aAAa,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,qBAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,qBAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,GAAG,mBAAmB,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAa,EAAE,UAAkB,EAAE,aAAqB,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,sCAAsC;QACtC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAyC,CAAC;IACnF,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,gCAAgC;QAChC,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,qFAAqF;AACrF,SAAgB,OAAO,CAAC,SAAiB;IACvC,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;yDAEyD;AACzD,SAAgB,OAAO,CAAC,SAAiB;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAChE,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,OAAO,cAAc,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uHAAuH;AACvH,SAAgB,SAAS,CAAC,SAAiB,EAAE,cAAsB,EAAE,cAAsB;IACzF,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IACvE,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { Stratum, type StratumOptions } from "./stratum.js";
+export { migrate, type MigrateOptions } from "./migrate.js";
 export { withClient, withTransaction } from "./pool-helpers.js";
 export { traced, getTracer, isTracingEnabled } from "./telemetry.js";
 export type { TenantNode, TenantContext, CreateTenantInput, UpdateTenantInput, MoveTenantInput, PaginationInput, PaginatedResult, ConfigEntry, SetConfigInput, ResolvedConfigEntry, ResolvedConfig, PermissionPolicy, CreatePermissionInput, UpdatePermissionInput, ResolvedPermission, } from "@stratum-hq/core";
@@ -8,4 +9,6 @@ export type { KeyRotationResult } from "./services/key-rotation-service.js";
 export type { DeliveryStats } from "./services/event-service.js";
 export type { Role, CreateRoleInput, UpdateRoleInput } from "./services/role-service.js";
 export type { AuditContext, AuditEntry, AuditLogQuery } from "@stratum-hq/core";
+export { defaultLogger, noopLogger } from "./logger.js";
+export type { StratumLogger } from "./logger.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGrE,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGzF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGrE,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGzF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTracingEnabled = exports.getTracer = exports.traced = exports.withTransaction = exports.withClient = exports.Stratum = void 0;
+exports.noopLogger = exports.defaultLogger = exports.isTracingEnabled = exports.getTracer = exports.traced = exports.withTransaction = exports.withClient = exports.migrate = exports.Stratum = void 0;
 var stratum_js_1 = require("./stratum.js");
 Object.defineProperty(exports, "Stratum", { enumerable: true, get: function () { return stratum_js_1.Stratum; } });
+var migrate_js_1 = require("./migrate.js");
+Object.defineProperty(exports, "migrate", { enumerable: true, get: function () { return migrate_js_1.migrate; } });
 var pool_helpers_js_1 = require("./pool-helpers.js");
 Object.defineProperty(exports, "withClient", { enumerable: true, get: function () { return pool_helpers_js_1.withClient; } });
 Object.defineProperty(exports, "withTransaction", { enumerable: true, get: function () { return pool_helpers_js_1.withTransaction; } });
@@ -10,4 +12,7 @@ var telemetry_js_1 = require("./telemetry.js");
 Object.defineProperty(exports, "traced", { enumerable: true, get: function () { return telemetry_js_1.traced; } });
 Object.defineProperty(exports, "getTracer", { enumerable: true, get: function () { return telemetry_js_1.getTracer; } });
 Object.defineProperty(exports, "isTracingEnabled", { enumerable: true, get: function () { return telemetry_js_1.isTracingEnabled; } });
+var logger_js_1 = require("./logger.js");
+Object.defineProperty(exports, "defaultLogger", { enumerable: true, get: function () { return logger_js_1.defaultLogger; } });
+Object.defineProperty(exports, "noopLogger", { enumerable: true, get: function () { return logger_js_1.noopLogger; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,qDAAgE;AAAvD,6GAAA,UAAU,OAAA;AAAE,kHAAA,eAAe,OAAA;AACpC,+CAAqE;AAA5D,sGAAA,MAAM,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,gHAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,qDAAgE;AAAvD,6GAAA,UAAU,OAAA;AAAE,kHAAA,eAAe,OAAA;AACpC,+CAAqE;AAA5D,sGAAA,MAAM,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AA8B5C,yCAAwD;AAA/C,0GAAA,aAAa,OAAA;AAAE,uGAAA,UAAU,OAAA"}

package/dist/logger.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Minimal structured logger for Stratum.
+ * Outputs JSON lines when NODE_ENV=production, human-readable otherwise.
+ * Can be replaced by passing a custom logger to Stratum constructor.
+ */
+export interface StratumLogger {
+    info(msg: string, ctx?: Record<string, unknown>): void;
+    warn(msg: string, ctx?: Record<string, unknown>): void;
+    error(msg: string, ctx?: Record<string, unknown>): void;
+}
+export declare const defaultLogger: StratumLogger;
+/** No-op logger for testing or when logging is disabled. */
+export declare const noopLogger: StratumLogger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzD;AAqBD,eAAO,MAAM,aAAa,EAAE,aAU3B,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,UAAU,EAAE,aAIxB,CAAC"}

package/dist/logger.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * Minimal structured logger for Stratum.
+ * Outputs JSON lines when NODE_ENV=production, human-readable otherwise.
+ * Can be replaced by passing a custom logger to Stratum constructor.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noopLogger = exports.defaultLogger = void 0;
+const isProduction = process.env.NODE_ENV === "production";
+function formatLog(level, msg, ctx) {
+    if (isProduction) {
+        return JSON.stringify({
+            ts: new Date().toISOString(),
+            level,
+            msg,
+            ...ctx,
+        });
+    }
+    const ctxStr = ctx ? ` ${JSON.stringify(ctx)}` : "";
+    return `[stratum:${level}] ${msg}${ctxStr}`;
+}
+exports.defaultLogger = {
+    info(msg, ctx) {
+        console.log(formatLog("info", msg, ctx));
+    },
+    warn(msg, ctx) {
+        console.warn(formatLog("warn", msg, ctx));
+    },
+    error(msg, ctx) {
+        console.error(formatLog("error", msg, ctx));
+    },
+};
+/** No-op logger for testing or when logging is disabled. */
+exports.noopLogger = {
+    info() { },
+    warn() { },
+    error() { },
+};
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAQH,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAE3D,SAAS,SAAS,CAChB,KAAa,EACb,GAAW,EACX,GAA6B;IAE7B,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK;YACL,GAAG;YACH,GAAG,GAAG;SACP,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,OAAO,YAAY,KAAK,KAAK,GAAG,GAAG,MAAM,EAAE,CAAC;AAC9C,CAAC;AAEY,QAAA,aAAa,GAAkB;IAC1C,IAAI,CAAC,GAAG,EAAE,GAAG;QACX,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,GAAG;QACX,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,GAAG,EAAE,GAAG;QACZ,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;CACF,CAAC;AAEF,4DAA4D;AAC/C,QAAA,UAAU,GAAkB;IACvC,IAAI,KAAI,CAAC;IACT,IAAI,KAAI,CAAC;IACT,KAAK,KAAI,CAAC;CACX,CAAC"}

package/dist/migrate.d.ts

@@ -0,0 +1,8 @@
+import pg from "pg";
+export interface MigrateOptions {
+    pool: pg.Pool;
+    /** When true, SET stratum.enforce_rls = 'on' before running migrations (hard-fail on BYPASSRLS). */
+    enforceRls?: boolean;
+}
+export declare function migrate(options: MigrateOptions): Promise<void>;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IACd,oGAAoG;IACpG,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2DpE"}

package/dist/migrate.js

@@ -0,0 +1,61 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrate = migrate;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+async function migrate(options) {
+    const { pool, enforceRls } = options;
+    // Create migrations tracking table
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS _migrations (
+      id SERIAL PRIMARY KEY,
+      name TEXT NOT NULL UNIQUE,
+      applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+  `);
+    // Get migration files
+    const migrationsDir = node_path_1.default.resolve(__dirname, "migrations");
+    if (!node_fs_1.default.existsSync(migrationsDir)) {
+        throw new Error(`Migration files not found at ${migrationsDir}. Ensure the package was built with 'npm run build'.`);
+    }
+    const files = node_fs_1.default
+        .readdirSync(migrationsDir)
+        .filter((f) => f.endsWith(".sql"))
+        .sort();
+    for (const file of files) {
+        const client = await pool.connect();
+        try {
+            await client.query("BEGIN");
+            // Acquire advisory lock to prevent concurrent migrations
+            await client.query("SELECT pg_advisory_xact_lock(8675309)");
+            // Re-check if already applied (after lock, to prevent TOCTOU race)
+            const { rows } = await client.query("SELECT 1 FROM _migrations WHERE name = $1", [file]);
+            if (rows.length > 0) {
+                await client.query("COMMIT");
+                continue;
+            }
+            // Set RLS enforcement mode if requested
+            if (enforceRls) {
+                await client.query("SET LOCAL stratum.enforce_rls = 'on'");
+            }
+            const sql = node_fs_1.default.readFileSync(node_path_1.default.join(migrationsDir, file), "utf-8");
+            await client.query(sql);
+            await client.query("INSERT INTO _migrations (name) VALUES ($1)", [file]);
+            await client.query("COMMIT");
+        }
+        catch (err) {
+            try {
+                await client.query("ROLLBACK");
+            }
+            catch { /* ignore rollback failure */ }
+            throw err;
+        }
+        finally {
+            client.release();
+        }
+    }
+}
+//# sourceMappingURL=migrate.js.map

package/dist/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":";;;;;AAUA,0BA2DC;AArED,sDAAyB;AACzB,0DAA6B;AAStB,KAAK,UAAU,OAAO,CAAC,OAAuB;IACnD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAErC,mCAAmC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;GAMhB,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,aAAa,GAAG,mBAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,iBAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,gCAAgC,aAAa,sDAAsD,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,iBAAE;SACb,WAAW,CAAC,aAAa,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACjC,IAAI,EAAE,CAAC;IAEV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAE5B,yDAAyD;YACzD,MAAM,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAE5D,mEAAmE;YACnE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,2CAA2C,EAC3C,CAAC,IAAI,CAAC,CACP,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,SAAS;YACX,CAAC;YAED,wCAAwC;YACxC,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,GAAG,GAAG,iBAAE,CAAC,YAAY,CAAC,mBAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACzE,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YAC/E,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/migrations/001_init.sql

@@ -0,0 +1,136 @@
+-- Extensions
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "ltree";
+
+-- Warn if application role has BYPASSRLS privilege.
+-- In production, set stratum.enforce_rls = 'on' to make this a hard error.
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = current_user AND rolbypassrls) THEN
+    IF current_setting('stratum.enforce_rls', true) = 'on' THEN
+      RAISE EXCEPTION 'SECURITY: Application role "%" has BYPASSRLS privilege. Create a dedicated role without BYPASSRLS, or set stratum.enforce_rls=off for development.', current_user;
+    ELSE
+      RAISE WARNING 'Role "%" has BYPASSRLS privilege. This is fine for development, but production should use a role without BYPASSRLS. Set stratum.enforce_rls=on to enforce.', current_user;
+    END IF;
+  END IF;
+END $$;
+
+-- Tenant nodes table
+CREATE TABLE IF NOT EXISTS tenants (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  parent_id UUID REFERENCES tenants(id) ON DELETE RESTRICT,
+  ancestry_path TEXT NOT NULL,
+  ancestry_ltree ltree,
+  depth INTEGER NOT NULL DEFAULT 0,
+  name TEXT NOT NULL,
+  slug TEXT NOT NULL UNIQUE
+    CHECK (slug ~ '^[a-z][a-z0-9_]{0,62}$'),
+  config JSONB NOT NULL DEFAULT '{}',
+  metadata JSONB NOT NULL DEFAULT '{}',
+  isolation_strategy TEXT NOT NULL DEFAULT 'SHARED_RLS'
+    CHECK (isolation_strategy IN ('SHARED_RLS')),
+  status TEXT NOT NULL DEFAULT 'active'
+    CHECK (status IN ('active', 'archived')),
+  deleted_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Auto-update updated_at function
+CREATE OR REPLACE FUNCTION update_updated_at_column()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$ language 'plpgsql';
+
+DROP TRIGGER IF EXISTS update_tenants_updated_at ON tenants;
+CREATE TRIGGER update_tenants_updated_at
+  BEFORE UPDATE ON tenants
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Trigger to maintain ancestry_ltree from parent's ltree + own slug
+CREATE OR REPLACE FUNCTION maintain_ancestry_ltree()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.parent_id IS NULL THEN
+    NEW.ancestry_ltree = NEW.slug::ltree;
+  ELSE
+    SELECT ancestry_ltree || NEW.slug::ltree INTO NEW.ancestry_ltree
+    FROM tenants WHERE id = NEW.parent_id;
+  END IF;
+  RETURN NEW;
+END;
+$$ language 'plpgsql';
+
+DROP TRIGGER IF EXISTS maintain_tenant_ancestry_ltree ON tenants;
+CREATE TRIGGER maintain_tenant_ancestry_ltree
+  BEFORE INSERT OR UPDATE OF parent_id, slug ON tenants
+  FOR EACH ROW EXECUTE FUNCTION maintain_ancestry_ltree();
+
+-- Indexes for tree queries
+CREATE INDEX IF NOT EXISTS idx_tenant_parent ON tenants(parent_id);
+CREATE INDEX IF NOT EXISTS idx_tenant_ancestry ON tenants USING GIST (ancestry_ltree);
+CREATE INDEX IF NOT EXISTS idx_tenant_depth ON tenants(depth);
+CREATE INDEX IF NOT EXISTS idx_tenant_slug ON tenants(slug);
+CREATE INDEX IF NOT EXISTS idx_tenant_status ON tenants(status) WHERE status = 'active';
+
+-- Permission policies table
+CREATE TABLE IF NOT EXISTS permission_policies (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE RESTRICT,
+  key TEXT NOT NULL,
+  value JSONB NOT NULL DEFAULT 'true',
+  mode TEXT NOT NULL DEFAULT 'INHERITED'
+    CHECK (mode IN ('LOCKED', 'INHERITED', 'DELEGATED')),
+  revocation_mode TEXT NOT NULL DEFAULT 'CASCADE'
+    CHECK (revocation_mode IN ('CASCADE', 'SOFT', 'PERMANENT')),
+  source_tenant_id UUID NOT NULL REFERENCES tenants(id),
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE(tenant_id, key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_permission_source ON permission_policies(source_tenant_id);
+
+DROP TRIGGER IF EXISTS update_permission_policies_updated_at ON permission_policies;
+CREATE TRIGGER update_permission_policies_updated_at
+  BEFORE UPDATE ON permission_policies
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Config entries table
+CREATE TABLE IF NOT EXISTS config_entries (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  key TEXT NOT NULL,
+  value JSONB NOT NULL,
+  inherited BOOLEAN NOT NULL DEFAULT false,
+  source_tenant_id UUID NOT NULL REFERENCES tenants(id),
+  locked BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE(tenant_id, key)
+);
+
+DROP TRIGGER IF EXISTS update_config_entries_updated_at ON config_entries;
+CREATE TRIGGER update_config_entries_updated_at
+  BEFORE UPDATE ON config_entries
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Config entries uses ON DELETE CASCADE (unlike permission_policies which uses RESTRICT)
+-- because config values are safe to delete with a tenant — they carry no semantic guarantees
+-- like PERMANENT revocation mode. If soft-delete is used (v1 default), CASCADE never fires.
+
+-- API keys table (for control plane auth)
+CREATE TABLE IF NOT EXISTS api_keys (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  key_hash TEXT NOT NULL,
+  key_prefix VARCHAR(16),
+  name TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  last_used_at TIMESTAMPTZ,
+  revoked_at TIMESTAMPTZ
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_api_keys_key_hash ON api_keys (key_hash);

package/dist/migrations/002_schema_isolation.sql

@@ -0,0 +1,6 @@
+-- Migration 002: Allow SCHEMA_PER_TENANT in isolation_strategy check constraint
+-- Extends the tenants table to support schema-per-tenant isolation (v1.1).
+
+ALTER TABLE tenants DROP CONSTRAINT IF EXISTS tenants_isolation_strategy_check;
+ALTER TABLE tenants ADD CONSTRAINT tenants_isolation_strategy_check
+  CHECK (isolation_strategy IN ('SHARED_RLS', 'SCHEMA_PER_TENANT'));

package/dist/migrations/003_db_isolation.sql

@@ -0,0 +1,12 @@
+-- Migration 003: DB_PER_TENANT isolation support
+-- Expands the isolation_strategy constraint and adds connection_config column.
+
+-- Allow DB_PER_TENANT in addition to existing strategies.
+-- Drop the old constraint first (name from 001_init.sql), then re-add with all three values.
+ALTER TABLE tenants DROP CONSTRAINT IF EXISTS tenants_isolation_strategy_check;
+ALTER TABLE tenants ADD CONSTRAINT tenants_isolation_strategy_check
+  CHECK (isolation_strategy IN ('SHARED_RLS', 'SCHEMA_PER_TENANT', 'DB_PER_TENANT'));
+
+-- Optional JSONB column to store per-tenant database connection overrides
+-- (e.g. custom host/port for fully isolated DB_PER_TENANT deployments).
+ALTER TABLE tenants ADD COLUMN IF NOT EXISTS connection_config JSONB DEFAULT NULL;

package/dist/migrations/004_webhooks.sql

@@ -0,0 +1,53 @@
+-- Webhook registrations
+CREATE TABLE IF NOT EXISTS webhooks (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  url TEXT NOT NULL,
+  secret_hash TEXT NOT NULL,
+  events TEXT[] NOT NULL DEFAULT '{}',
+  active BOOLEAN NOT NULL DEFAULT true,
+  description TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhooks_tenant ON webhooks(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_webhooks_active ON webhooks(active) WHERE active = true;
+
+DROP TRIGGER IF EXISTS update_webhooks_updated_at ON webhooks;
+CREATE TRIGGER update_webhooks_updated_at
+  BEFORE UPDATE ON webhooks
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Webhook events log
+CREATE TABLE IF NOT EXISTS webhook_events (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  type TEXT NOT NULL,
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  data JSONB NOT NULL DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhook_events_tenant ON webhook_events(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_webhook_events_type ON webhook_events(type);
+CREATE INDEX IF NOT EXISTS idx_webhook_events_created ON webhook_events(created_at);
+
+-- Webhook delivery tracking
+CREATE TABLE IF NOT EXISTS webhook_deliveries (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  webhook_id UUID NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,
+  event_id UUID NOT NULL REFERENCES webhook_events(id) ON DELETE CASCADE,
+  status TEXT NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending', 'success', 'failed')),
+  attempts INTEGER NOT NULL DEFAULT 0,
+  next_retry_at TIMESTAMPTZ,
+  last_error TEXT,
+  response_code INTEGER,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  completed_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_deliveries_webhook ON webhook_deliveries(webhook_id);
+CREATE INDEX IF NOT EXISTS idx_deliveries_event ON webhook_deliveries(event_id);
+CREATE INDEX IF NOT EXISTS idx_deliveries_status ON webhook_deliveries(status) WHERE status = 'pending';
+CREATE INDEX IF NOT EXISTS idx_deliveries_retry ON webhook_deliveries(next_retry_at) WHERE status = 'pending';

package/dist/migrations/005_audit_logs.sql

@@ -0,0 +1,21 @@
+CREATE TABLE IF NOT EXISTS audit_logs (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  actor_id TEXT NOT NULL,
+  actor_type TEXT NOT NULL CHECK (actor_type IN ('api_key', 'jwt', 'system')),
+  action TEXT NOT NULL,
+  resource_type TEXT NOT NULL,
+  resource_id TEXT,
+  tenant_id UUID REFERENCES tenants(id) ON DELETE SET NULL,
+  source_ip INET,
+  request_id TEXT,
+  before_state JSONB,
+  after_state JSONB,
+  metadata JSONB NOT NULL DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_audit_tenant ON audit_logs(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_audit_action ON audit_logs(action);
+CREATE INDEX IF NOT EXISTS idx_audit_created ON audit_logs(created_at);
+CREATE INDEX IF NOT EXISTS idx_audit_actor ON audit_logs(actor_id);
+CREATE INDEX IF NOT EXISTS idx_audit_resource ON audit_logs(resource_type, resource_id);

package/dist/migrations/006_api_key_scopes.sql

@@ -0,0 +1,2 @@
+-- Add scopes column to api_keys with default read+write
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS scopes TEXT[] NOT NULL DEFAULT '{read,write}';

package/dist/migrations/007_sensitive_config.sql

@@ -0,0 +1 @@
+ALTER TABLE config_entries ADD COLUMN IF NOT EXISTS sensitive BOOLEAN NOT NULL DEFAULT false;

package/dist/migrations/008_api_key_management.sql

@@ -0,0 +1,7 @@
+-- Add expiration and rate limit columns to api_keys
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS expires_at TIMESTAMPTZ;
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS rate_limit_max INTEGER;
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS rate_limit_window TEXT;
+
+CREATE INDEX idx_api_keys_expires ON api_keys(expires_at) WHERE expires_at IS NOT NULL;
+CREATE INDEX idx_api_keys_last_used ON api_keys(last_used_at);

package/dist/migrations/009_consent.sql

@@ -0,0 +1,18 @@
+CREATE TABLE IF NOT EXISTS consent_records (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  subject_id TEXT NOT NULL,
+  purpose TEXT NOT NULL,
+  granted BOOLEAN NOT NULL DEFAULT true,
+  granted_at TIMESTAMPTZ DEFAULT now(),
+  revoked_at TIMESTAMPTZ,
+  expires_at TIMESTAMPTZ,
+  metadata JSONB DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE(tenant_id, subject_id, purpose)
+);
+
+CREATE INDEX IF NOT EXISTS idx_consent_tenant ON consent_records(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_consent_subject ON consent_records(subject_id);
+CREATE INDEX IF NOT EXISTS idx_consent_purpose ON consent_records(purpose);

package/dist/migrations/010_multi_region.sql

@@ -0,0 +1,19 @@
+CREATE TABLE IF NOT EXISTS regions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  display_name TEXT NOT NULL,
+  slug TEXT NOT NULL UNIQUE,
+  control_plane_url TEXT,
+  database_url TEXT,
+  is_primary BOOLEAN NOT NULL DEFAULT false,
+  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'draining', 'inactive')),
+  metadata JSONB DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_regions_slug ON regions(slug);
+CREATE INDEX IF NOT EXISTS idx_regions_status ON regions(status);
+
+-- Add region_id to tenants (nullable for backward compat)
+ALTER TABLE tenants ADD COLUMN IF NOT EXISTS region_id UUID REFERENCES regions(id);
+CREATE INDEX IF NOT EXISTS idx_tenants_region ON tenants(region_id);

package/dist/migrations/011_demo_bootstrap.sql

@@ -0,0 +1,5 @@
+-- Migration 011: Demo bootstrap
+-- REMOVED: Demo API key seeding moved to packages/demo/api/src/seed.ts
+-- The original migration inserted a hardcoded API key (sk_live_demo_key)
+-- with global admin access, which is a security risk in production.
+-- Demo data is now seeded via the demo seed script only.

package/dist/migrations/012_roles.sql

@@ -0,0 +1,18 @@
+-- 012: Role-Based Access Control (RBAC)
+-- Roles define named collections of scopes that can be assigned to API keys.
+
+CREATE TABLE IF NOT EXISTS roles (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL UNIQUE,
+  description TEXT,
+  scopes TEXT[] NOT NULL DEFAULT ARRAY['read'],
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Index for tenant-scoped role lookups
+CREATE INDEX IF NOT EXISTS idx_roles_tenant_id ON roles (tenant_id);
+
+-- Add role_id column to api_keys
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS role_id UUID REFERENCES roles(id) ON DELETE SET NULL;

package/dist/migrations/013_api_key_hmac.sql

@@ -0,0 +1,4 @@
+-- Add hash_version column to distinguish SHA-256 (legacy) from HMAC-SHA256 hashes.
+-- 1 = SHA-256 (legacy), 2 = HMAC-SHA256 (current).
+-- Existing keys default to version 1; new keys will be created with version 2.
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS hash_version SMALLINT NOT NULL DEFAULT 1;

package/dist/migrations/014_sort_order.sql

@@ -0,0 +1,5 @@
+-- Add sort_order column for sibling reordering
+ALTER TABLE tenants ADD COLUMN IF NOT EXISTS sort_order INTEGER NOT NULL DEFAULT 0;
+
+-- Index for efficient ordering queries
+CREATE INDEX IF NOT EXISTS idx_tenant_sort_order ON tenants(parent_id, sort_order);

package/dist/migrations/015_region_url_encryption.sql

@@ -0,0 +1,5 @@
+-- Encrypt database_url column in regions table
+-- Existing plaintext URLs will need to be migrated via the key rotation service
+ALTER TABLE regions RENAME COLUMN database_url TO database_url_encrypted;
+-- Add a comment to remind developers this column is encrypted
+COMMENT ON COLUMN regions.database_url_encrypted IS 'AES-256-GCM encrypted PostgreSQL connection string. Use encrypt()/decrypt() from @stratum-hq/lib.';

package/dist/migrations/016_migration_alias.sql

@@ -0,0 +1,8 @@
+-- Handle migration renaming: 002_sort_order.sql → 014_sort_order.sql
+-- If an existing deployment already applied 002_sort_order.sql, record the
+-- new name so the migration runner doesn't try to re-apply it.
+INSERT INTO _migrations (name, applied_at)
+SELECT '014_sort_order.sql', applied_at
+FROM _migrations
+WHERE name = '002_sort_order.sql'
+ON CONFLICT DO NOTHING;