@stratum-hq/lib 0.2.0 → 0.2.3

package/dist/migrations/migrations/001_init.sql

@@ -0,0 +1,145 @@
+-- Extensions (require superuser or CREATE privilege; gracefully warn if unavailable)
+DO $$ BEGIN
+  CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+EXCEPTION WHEN insufficient_privilege THEN
+  RAISE WARNING 'Cannot create uuid-ossp extension — insufficient privileges. Ask a database administrator to run: CREATE EXTENSION IF NOT EXISTS "uuid-ossp";';
+END $$;
+
+DO $$ BEGIN
+  CREATE EXTENSION IF NOT EXISTS "ltree";
+EXCEPTION WHEN insufficient_privilege THEN
+  RAISE WARNING 'Cannot create ltree extension — insufficient privileges. Ask a database administrator to run: CREATE EXTENSION IF NOT EXISTS "ltree";';
+END $$;
+
+-- Warn if application role has BYPASSRLS privilege.
+-- In production, set stratum.enforce_rls = 'on' to make this a hard error.
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = current_user AND rolbypassrls) THEN
+    IF current_setting('stratum.enforce_rls', true) = 'on' THEN
+      RAISE EXCEPTION 'SECURITY: Application role "%" has BYPASSRLS privilege. Create a dedicated role without BYPASSRLS, or set stratum.enforce_rls=off for development.', current_user;
+    ELSE
+      RAISE WARNING 'Role "%" has BYPASSRLS privilege. This is fine for development, but production should use a role without BYPASSRLS. Set stratum.enforce_rls=on to enforce.', current_user;
+    END IF;
+  END IF;
+END $$;
+
+-- Tenant nodes table
+CREATE TABLE IF NOT EXISTS tenants (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  parent_id UUID REFERENCES tenants(id) ON DELETE RESTRICT,
+  ancestry_path TEXT NOT NULL,
+  ancestry_ltree ltree,
+  depth INTEGER NOT NULL DEFAULT 0,
+  name TEXT NOT NULL,
+  slug TEXT NOT NULL UNIQUE
+    CHECK (slug ~ '^[a-z][a-z0-9_]{0,62}$'),
+  config JSONB NOT NULL DEFAULT '{}',
+  metadata JSONB NOT NULL DEFAULT '{}',
+  isolation_strategy TEXT NOT NULL DEFAULT 'SHARED_RLS'
+    CHECK (isolation_strategy IN ('SHARED_RLS')),
+  status TEXT NOT NULL DEFAULT 'active'
+    CHECK (status IN ('active', 'archived')),
+  deleted_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Auto-update updated_at function
+CREATE OR REPLACE FUNCTION update_updated_at_column()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$ language 'plpgsql';
+
+DROP TRIGGER IF EXISTS update_tenants_updated_at ON tenants;
+CREATE TRIGGER update_tenants_updated_at
+  BEFORE UPDATE ON tenants
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Trigger to maintain ancestry_ltree from parent's ltree + own slug
+CREATE OR REPLACE FUNCTION maintain_ancestry_ltree()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.parent_id IS NULL THEN
+    NEW.ancestry_ltree = NEW.slug::ltree;
+  ELSE
+    SELECT ancestry_ltree || NEW.slug::ltree INTO NEW.ancestry_ltree
+    FROM tenants WHERE id = NEW.parent_id;
+  END IF;
+  RETURN NEW;
+END;
+$$ language 'plpgsql';
+
+DROP TRIGGER IF EXISTS maintain_tenant_ancestry_ltree ON tenants;
+CREATE TRIGGER maintain_tenant_ancestry_ltree
+  BEFORE INSERT OR UPDATE OF parent_id, slug ON tenants
+  FOR EACH ROW EXECUTE FUNCTION maintain_ancestry_ltree();
+
+-- Indexes for tree queries
+CREATE INDEX IF NOT EXISTS idx_tenant_parent ON tenants(parent_id);
+CREATE INDEX IF NOT EXISTS idx_tenant_ancestry ON tenants USING GIST (ancestry_ltree);
+CREATE INDEX IF NOT EXISTS idx_tenant_depth ON tenants(depth);
+CREATE INDEX IF NOT EXISTS idx_tenant_slug ON tenants(slug);
+CREATE INDEX IF NOT EXISTS idx_tenant_status ON tenants(status) WHERE status = 'active';
+
+-- Permission policies table
+CREATE TABLE IF NOT EXISTS permission_policies (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE RESTRICT,
+  key TEXT NOT NULL,
+  value JSONB NOT NULL DEFAULT 'true',
+  mode TEXT NOT NULL DEFAULT 'INHERITED'
+    CHECK (mode IN ('LOCKED', 'INHERITED', 'DELEGATED')),
+  revocation_mode TEXT NOT NULL DEFAULT 'CASCADE'
+    CHECK (revocation_mode IN ('CASCADE', 'SOFT', 'PERMANENT')),
+  source_tenant_id UUID NOT NULL REFERENCES tenants(id),
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE(tenant_id, key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_permission_source ON permission_policies(source_tenant_id);
+
+DROP TRIGGER IF EXISTS update_permission_policies_updated_at ON permission_policies;
+CREATE TRIGGER update_permission_policies_updated_at
+  BEFORE UPDATE ON permission_policies
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Config entries table
+CREATE TABLE IF NOT EXISTS config_entries (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  key TEXT NOT NULL,
+  value JSONB NOT NULL,
+  inherited BOOLEAN NOT NULL DEFAULT false,
+  source_tenant_id UUID NOT NULL REFERENCES tenants(id),
+  locked BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE(tenant_id, key)
+);
+
+DROP TRIGGER IF EXISTS update_config_entries_updated_at ON config_entries;
+CREATE TRIGGER update_config_entries_updated_at
+  BEFORE UPDATE ON config_entries
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Config entries uses ON DELETE CASCADE (unlike permission_policies which uses RESTRICT)
+-- because config values are safe to delete with a tenant — they carry no semantic guarantees
+-- like PERMANENT revocation mode. If soft-delete is used (v1 default), CASCADE never fires.
+
+-- API keys table (for control plane auth)
+CREATE TABLE IF NOT EXISTS api_keys (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  key_hash TEXT NOT NULL,
+  key_prefix VARCHAR(16),
+  name TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  last_used_at TIMESTAMPTZ,
+  revoked_at TIMESTAMPTZ
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_api_keys_key_hash ON api_keys (key_hash);

package/dist/migrations/migrations/002_schema_isolation.sql

@@ -0,0 +1,6 @@
+-- Migration 002: Allow SCHEMA_PER_TENANT in isolation_strategy check constraint
+-- Extends the tenants table to support schema-per-tenant isolation (v1.1).
+
+ALTER TABLE tenants DROP CONSTRAINT IF EXISTS tenants_isolation_strategy_check;
+ALTER TABLE tenants ADD CONSTRAINT tenants_isolation_strategy_check
+  CHECK (isolation_strategy IN ('SHARED_RLS', 'SCHEMA_PER_TENANT'));

package/dist/migrations/migrations/003_db_isolation.sql

@@ -0,0 +1,12 @@
+-- Migration 003: DB_PER_TENANT isolation support
+-- Expands the isolation_strategy constraint and adds connection_config column.
+
+-- Allow DB_PER_TENANT in addition to existing strategies.
+-- Drop the old constraint first (name from 001_init.sql), then re-add with all three values.
+ALTER TABLE tenants DROP CONSTRAINT IF EXISTS tenants_isolation_strategy_check;
+ALTER TABLE tenants ADD CONSTRAINT tenants_isolation_strategy_check
+  CHECK (isolation_strategy IN ('SHARED_RLS', 'SCHEMA_PER_TENANT', 'DB_PER_TENANT'));
+
+-- Optional JSONB column to store per-tenant database connection overrides
+-- (e.g. custom host/port for fully isolated DB_PER_TENANT deployments).
+ALTER TABLE tenants ADD COLUMN IF NOT EXISTS connection_config JSONB DEFAULT NULL;

package/dist/migrations/migrations/004_webhooks.sql

@@ -0,0 +1,53 @@
+-- Webhook registrations
+CREATE TABLE IF NOT EXISTS webhooks (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  url TEXT NOT NULL,
+  secret_hash TEXT NOT NULL,
+  events TEXT[] NOT NULL DEFAULT '{}',
+  active BOOLEAN NOT NULL DEFAULT true,
+  description TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhooks_tenant ON webhooks(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_webhooks_active ON webhooks(active) WHERE active = true;
+
+DROP TRIGGER IF EXISTS update_webhooks_updated_at ON webhooks;
+CREATE TRIGGER update_webhooks_updated_at
+  BEFORE UPDATE ON webhooks
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Webhook events log
+CREATE TABLE IF NOT EXISTS webhook_events (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  type TEXT NOT NULL,
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  data JSONB NOT NULL DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhook_events_tenant ON webhook_events(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_webhook_events_type ON webhook_events(type);
+CREATE INDEX IF NOT EXISTS idx_webhook_events_created ON webhook_events(created_at);
+
+-- Webhook delivery tracking
+CREATE TABLE IF NOT EXISTS webhook_deliveries (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  webhook_id UUID NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,
+  event_id UUID NOT NULL REFERENCES webhook_events(id) ON DELETE CASCADE,
+  status TEXT NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending', 'success', 'failed')),
+  attempts INTEGER NOT NULL DEFAULT 0,
+  next_retry_at TIMESTAMPTZ,
+  last_error TEXT,
+  response_code INTEGER,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  completed_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_deliveries_webhook ON webhook_deliveries(webhook_id);
+CREATE INDEX IF NOT EXISTS idx_deliveries_event ON webhook_deliveries(event_id);
+CREATE INDEX IF NOT EXISTS idx_deliveries_status ON webhook_deliveries(status) WHERE status = 'pending';
+CREATE INDEX IF NOT EXISTS idx_deliveries_retry ON webhook_deliveries(next_retry_at) WHERE status = 'pending';

package/dist/migrations/migrations/005_audit_logs.sql

@@ -0,0 +1,21 @@
+CREATE TABLE IF NOT EXISTS audit_logs (
+  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  actor_id TEXT NOT NULL,
+  actor_type TEXT NOT NULL CHECK (actor_type IN ('api_key', 'jwt', 'system')),
+  action TEXT NOT NULL,
+  resource_type TEXT NOT NULL,
+  resource_id TEXT,
+  tenant_id UUID REFERENCES tenants(id) ON DELETE SET NULL,
+  source_ip INET,
+  request_id TEXT,
+  before_state JSONB,
+  after_state JSONB,
+  metadata JSONB NOT NULL DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_audit_tenant ON audit_logs(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_audit_action ON audit_logs(action);
+CREATE INDEX IF NOT EXISTS idx_audit_created ON audit_logs(created_at);
+CREATE INDEX IF NOT EXISTS idx_audit_actor ON audit_logs(actor_id);
+CREATE INDEX IF NOT EXISTS idx_audit_resource ON audit_logs(resource_type, resource_id);

package/dist/migrations/migrations/006_api_key_scopes.sql

@@ -0,0 +1,2 @@
+-- Add scopes column to api_keys with default read+write
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS scopes TEXT[] NOT NULL DEFAULT '{read,write}';

package/dist/migrations/migrations/007_sensitive_config.sql

@@ -0,0 +1 @@
+ALTER TABLE config_entries ADD COLUMN IF NOT EXISTS sensitive BOOLEAN NOT NULL DEFAULT false;

package/dist/migrations/migrations/008_api_key_management.sql

@@ -0,0 +1,7 @@
+-- Add expiration and rate limit columns to api_keys
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS expires_at TIMESTAMPTZ;
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS rate_limit_max INTEGER;
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS rate_limit_window TEXT;
+
+CREATE INDEX idx_api_keys_expires ON api_keys(expires_at) WHERE expires_at IS NOT NULL;
+CREATE INDEX idx_api_keys_last_used ON api_keys(last_used_at);

package/dist/migrations/migrations/009_consent.sql

@@ -0,0 +1,18 @@
+CREATE TABLE IF NOT EXISTS consent_records (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  subject_id TEXT NOT NULL,
+  purpose TEXT NOT NULL,
+  granted BOOLEAN NOT NULL DEFAULT true,
+  granted_at TIMESTAMPTZ DEFAULT now(),
+  revoked_at TIMESTAMPTZ,
+  expires_at TIMESTAMPTZ,
+  metadata JSONB DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE(tenant_id, subject_id, purpose)
+);
+
+CREATE INDEX IF NOT EXISTS idx_consent_tenant ON consent_records(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_consent_subject ON consent_records(subject_id);
+CREATE INDEX IF NOT EXISTS idx_consent_purpose ON consent_records(purpose);

package/dist/migrations/migrations/010_multi_region.sql

@@ -0,0 +1,19 @@
+CREATE TABLE IF NOT EXISTS regions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  display_name TEXT NOT NULL,
+  slug TEXT NOT NULL UNIQUE,
+  control_plane_url TEXT,
+  database_url TEXT,
+  is_primary BOOLEAN NOT NULL DEFAULT false,
+  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'draining', 'inactive')),
+  metadata JSONB DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_regions_slug ON regions(slug);
+CREATE INDEX IF NOT EXISTS idx_regions_status ON regions(status);
+
+-- Add region_id to tenants (nullable for backward compat)
+ALTER TABLE tenants ADD COLUMN IF NOT EXISTS region_id UUID REFERENCES regions(id);
+CREATE INDEX IF NOT EXISTS idx_tenants_region ON tenants(region_id);

package/dist/migrations/migrations/011_demo_bootstrap.sql

@@ -0,0 +1,5 @@
+-- Migration 011: Demo bootstrap
+-- REMOVED: Demo API key seeding moved to packages/demo/api/src/seed.ts
+-- The original migration inserted a hardcoded API key (sk_live_demo_key)
+-- with global admin access, which is a security risk in production.
+-- Demo data is now seeded via the demo seed script only.

package/dist/migrations/migrations/012_roles.sql

@@ -0,0 +1,18 @@
+-- 012: Role-Based Access Control (RBAC)
+-- Roles define named collections of scopes that can be assigned to API keys.
+
+CREATE TABLE IF NOT EXISTS roles (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL UNIQUE,
+  description TEXT,
+  scopes TEXT[] NOT NULL DEFAULT ARRAY['read'],
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Index for tenant-scoped role lookups
+CREATE INDEX IF NOT EXISTS idx_roles_tenant_id ON roles (tenant_id);
+
+-- Add role_id column to api_keys
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS role_id UUID REFERENCES roles(id) ON DELETE SET NULL;

package/dist/migrations/migrations/013_api_key_hmac.sql

@@ -0,0 +1,4 @@
+-- Add hash_version column to distinguish SHA-256 (legacy) from HMAC-SHA256 hashes.
+-- 1 = SHA-256 (legacy), 2 = HMAC-SHA256 (current).
+-- Existing keys default to version 1; new keys will be created with version 2.
+ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS hash_version SMALLINT NOT NULL DEFAULT 1;

package/dist/migrations/migrations/014_sort_order.sql

@@ -0,0 +1,5 @@
+-- Add sort_order column for sibling reordering
+ALTER TABLE tenants ADD COLUMN IF NOT EXISTS sort_order INTEGER NOT NULL DEFAULT 0;
+
+-- Index for efficient ordering queries
+CREATE INDEX IF NOT EXISTS idx_tenant_sort_order ON tenants(parent_id, sort_order);

package/dist/migrations/migrations/015_region_url_encryption.sql

@@ -0,0 +1,5 @@
+-- Encrypt database_url column in regions table
+-- Existing plaintext URLs will need to be migrated via the key rotation service
+ALTER TABLE regions RENAME COLUMN database_url TO database_url_encrypted;
+-- Add a comment to remind developers this column is encrypted
+COMMENT ON COLUMN regions.database_url_encrypted IS 'AES-256-GCM encrypted PostgreSQL connection string. Use encrypt()/decrypt() from @stratum-hq/lib.';

package/dist/migrations/migrations/016_migration_alias.sql

@@ -0,0 +1,8 @@
+-- Handle migration renaming: 002_sort_order.sql → 014_sort_order.sql
+-- If an existing deployment already applied 002_sort_order.sql, record the
+-- new name so the migration runner doesn't try to re-apply it.
+INSERT INTO _migrations (name, applied_at)
+SELECT '014_sort_order.sql', applied_at
+FROM _migrations
+WHERE name = '002_sort_order.sql'
+ON CONFLICT DO NOTHING;

package/dist/migrations/migrations/017_abac_policies.sql

@@ -0,0 +1,16 @@
+CREATE TABLE IF NOT EXISTS abac_policies (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  resource_type TEXT NOT NULL,
+  action TEXT NOT NULL,
+  effect TEXT NOT NULL CHECK (effect IN ('allow', 'deny')),
+  conditions JSONB NOT NULL DEFAULT '[]',
+  priority INTEGER NOT NULL DEFAULT 0,
+  mode TEXT NOT NULL DEFAULT 'INHERITED' CHECK (mode IN ('LOCKED', 'INHERITED', 'DELEGATED')),
+  source_tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS idx_abac_policies_tenant_id ON abac_policies(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_abac_policies_resource_action ON abac_policies(resource_type, action);

package/dist/services/__tests__/abac-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=abac-service.test.d.ts.map

package/dist/services/__tests__/abac-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abac-service.test.d.ts","sourceRoot":"","sources":["../../../src/services/__tests__/abac-service.test.ts"],"names":[],"mappings":""}

package/dist/services/__tests__/abac-service.test.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const abac_service_js_1 = require("../abac-service.js");
+function makePolicy(overrides = {}) {
+    return {
+        id: "pol-1",
+        tenant_id: "t-1",
+        name: "test-policy",
+        resource_type: "document",
+        action: "read",
+        effect: "allow",
+        conditions: [],
+        priority: 0,
+        mode: "INHERITED",
+        source_tenant_id: "t-1",
+        created_at: new Date(),
+        updated_at: new Date(),
+        ...overrides,
+    };
+}
+// ---------------------------------------------------------------------------
+// evaluateCondition — operator tests
+// ---------------------------------------------------------------------------
+(0, vitest_1.describe)("evaluateCondition", () => {
+    (0, vitest_1.it)("eq: matches when values are equal", () => {
+        const c = { attribute: "role", operator: "eq", value: "admin" };
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { role: "admin" })).toBe(true);
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { role: "viewer" })).toBe(false);
+    });
+    (0, vitest_1.it)("neq: matches when values differ", () => {
+        const c = { attribute: "role", operator: "neq", value: "admin" };
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { role: "viewer" })).toBe(true);
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { role: "admin" })).toBe(false);
+    });
+    (0, vitest_1.it)("in: matches when value is in array", () => {
+        const c = { attribute: "dept", operator: "in", value: ["eng", "product"] };
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { dept: "eng" })).toBe(true);
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { dept: "sales" })).toBe(false);
+    });
+    (0, vitest_1.it)("not_in: matches when value is not in array", () => {
+        const c = { attribute: "dept", operator: "not_in", value: ["eng", "product"] };
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { dept: "sales" })).toBe(true);
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { dept: "eng" })).toBe(false);
+    });
+    (0, vitest_1.it)("contains: matches when array attribute contains value", () => {
+        const c = { attribute: "tags", operator: "contains", value: "urgent" };
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { tags: ["urgent", "important"] })).toBe(true);
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { tags: ["normal"] })).toBe(false);
+    });
+    (0, vitest_1.it)("gt: numeric greater than", () => {
+        const c = { attribute: "level", operator: "gt", value: 5 };
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { level: 10 })).toBe(true);
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { level: 5 })).toBe(false);
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { level: 3 })).toBe(false);
+    });
+    (0, vitest_1.it)("gte: numeric greater than or equal", () => {
+        const c = { attribute: "level", operator: "gte", value: 5 };
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { level: 5 })).toBe(true);
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { level: 4 })).toBe(false);
+    });
+    (0, vitest_1.it)("lt: numeric less than", () => {
+        const c = { attribute: "risk", operator: "lt", value: 3 };
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { risk: 1 })).toBe(true);
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { risk: 3 })).toBe(false);
+    });
+    (0, vitest_1.it)("lte: numeric less than or equal", () => {
+        const c = { attribute: "risk", operator: "lte", value: 3 };
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { risk: 3 })).toBe(true);
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { risk: 4 })).toBe(false);
+    });
+    (0, vitest_1.it)("returns false when attribute is missing from context", () => {
+        const c = { attribute: "missing", operator: "eq", value: "x" };
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluateCondition)(c, { other: "y" })).toBe(false);
+    });
+    (0, vitest_1.it)("throws for unknown operator", () => {
+        const c = { attribute: "x", operator: "nope", value: "y" };
+        (0, vitest_1.expect)(() => (0, abac_service_js_1.evaluateCondition)(c, { x: "y" })).toThrow();
+    });
+});
+// ---------------------------------------------------------------------------
+// evaluatePolicy
+// ---------------------------------------------------------------------------
+(0, vitest_1.describe)("evaluatePolicy", () => {
+    (0, vitest_1.it)("empty conditions → always matches", () => {
+        const policy = makePolicy({ conditions: [] });
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluatePolicy)(policy, {})).toBe(true);
+    });
+    (0, vitest_1.it)("all conditions true → matches", () => {
+        const policy = makePolicy({
+            conditions: [
+                { attribute: "role", operator: "eq", value: "admin" },
+                { attribute: "level", operator: "gte", value: 3 },
+            ],
+        });
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluatePolicy)(policy, { role: "admin", level: 5 })).toBe(true);
+    });
+    (0, vitest_1.it)("one condition false → does not match (AND semantics)", () => {
+        const policy = makePolicy({
+            conditions: [
+                { attribute: "role", operator: "eq", value: "admin" },
+                { attribute: "level", operator: "gte", value: 10 },
+            ],
+        });
+        (0, vitest_1.expect)((0, abac_service_js_1.evaluatePolicy)(policy, { role: "admin", level: 5 })).toBe(false);
+    });
+});
+//# sourceMappingURL=abac-service.test.js.map

package/dist/services/__tests__/abac-service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abac-service.test.js","sourceRoot":"","sources":["../../../src/services/__tests__/abac-service.test.ts"],"names":[],"mappings":";;AAAA,mCAA8C;AAC9C,wDAAuE;AAGvE,SAAS,UAAU,CAAC,YAAiC,EAAE;IACrD,OAAO;QACL,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,aAAa;QACnB,aAAa,EAAE,UAAU;QACzB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,WAAW;QACjB,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,IAAI,IAAI,EAAE;QACtB,UAAU,EAAE,IAAI,IAAI,EAAE;QACtB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAC9E,IAAA,iBAAQ,EAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,IAAA,WAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC/E,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,GAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAChF,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1F,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9F,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACtF,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,GAAkB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAkB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC3E,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,GAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzE,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,GAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,GAAkB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC9E,IAAA,eAAM,EAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAa,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAClE,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAiB,EAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAC9E,IAAA,iBAAQ,EAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAA,WAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAA,eAAM,EAAC,IAAA,gCAAc,EAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,UAAU,EAAE;gBACV,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;gBACrD,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;aAClD;SACF,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,IAAA,gCAAc,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,UAAU,EAAE;gBACV,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;gBACrD,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;aACnD;SACF,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,IAAA,gCAAc,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/__tests__/retention-service.test.js

@@ -88,17 +88,20 @@ function makeMockPool() {
             return fn(client);
         });
         await retentionService.purgeTenant(pool, "tenant-123");
-        // 1 child check + 9 deletes (config, permissions, api_keys, webhook_deliveries,
+        // 1 child check + 11 deletes (config, permissions by tenant_id,
+        // permissions by source_tenant_id, api_keys, roles, webhook_deliveries,
         // webhook_events, webhooks, consent_records, audit_logs, tenants)
-        (0, vitest_1.expect)(mockQuery).toHaveBeenCalledTimes(10);
+        (0, vitest_1.expect)(mockQuery).toHaveBeenCalledTimes(12);
         // First query is the child count check
         (0, vitest_1.expect)(mockQuery.mock.calls[0][0]).toContain("COUNT");
         // Then FK-ordered deletes
         (0, vitest_1.expect)(mockQuery.mock.calls[1][0]).toContain("config_entries");
         (0, vitest_1.expect)(mockQuery.mock.calls[2][0]).toContain("permission_policies");
-        (0, vitest_1.expect)(mockQuery.mock.calls[3][0]).toContain("api_keys");
+        (0, vitest_1.expect)(mockQuery.mock.calls[3][0]).toContain("permission_policies");
+        (0, vitest_1.expect)(mockQuery.mock.calls[4][0]).toContain("api_keys");
+        (0, vitest_1.expect)(mockQuery.mock.calls[5][0]).toContain("roles");
         // Last delete is the tenant itself
-        (0, vitest_1.expect)(mockQuery.mock.calls[9][0]).toContain("tenants");
+        (0, vitest_1.expect)(mockQuery.mock.calls[11][0]).toContain("tenants");
         // Verify tenant_id parameter
         (0, vitest_1.expect)(mockQuery.mock.calls[1][1]).toEqual(["tenant-123"]);
     });

package/dist/services/__tests__/retention-service.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-service.test.js","sourceRoot":"","sources":["../../../src/services/__tests__/retention-service.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mCAA8D;AAE9D,WAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;IACnB,eAAe,EAAE,WAAE,CAAC,EAAE,EAAE;CACzB,CAAC,CAAC,CAAC;AAEJ,mEAAqD;AACrD,0EAA4D;AAE5D,SAAS,YAAY;IACnB,OAAO,EAAuB,CAAC;AACjC,CAAC;AAED,IAAA,mBAAU,EAAC,GAAG,EAAE;IACd,WAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAA,WAAE,EAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE;aACtB,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAE,qBAAqB;aAC7D,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAE,iBAAiB;aACzD,qBAAqB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa;QAEzD,WAAE,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAwC,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEjE,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACnE,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC/D,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAE7D,WAAE,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAwC,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAA,WAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE;YACvB,6BAA6B;aAC5B,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAChD,oCAAoC;aACnC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAEtC,WAAE,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAwC,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,gBAAgB,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAEvD,gFAAgF;QAChF,kEAAkE;QAClE,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC5C,uCAAuC;QACvC,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtD,0BAA0B;QAC1B,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC/D,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACpE,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzD,mCAAmC;QACnC,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxD,6BAA6B;QAC7B,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAA,WAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE;aACtB,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAG,UAAU;aACzD,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,iBAAiB;aACjE,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,sBAAsB;aACtE,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,WAAW;aAC3D,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,WAAW;aAC3D,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,iBAAiB;aACjE,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,qBAAqB;aACrE,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,aAAa;aAC7D,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAY,kBAAkB;QAErE,WAAE,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACvE,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAwC,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAE3E,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAA,eAAM,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAA,eAAM,EAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAA,eAAM,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,IAAA,eAAM,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,IAAA,eAAM,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAA,eAAM,EAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAA,eAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,IAAA,eAAM,EAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAE1D,WAAE,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACvE,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAwC,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAE5E,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjC,8DAA8D;QAC9D,kEAAkE;QAClE,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"retention-service.test.js","sourceRoot":"","sources":["../../../src/services/__tests__/retention-service.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mCAA8D;AAE9D,WAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;IACnB,eAAe,EAAE,WAAE,CAAC,EAAE,EAAE;CACzB,CAAC,CAAC,CAAC;AAEJ,mEAAqD;AACrD,0EAA4D;AAE5D,SAAS,YAAY;IACnB,OAAO,EAAuB,CAAC;AACjC,CAAC;AAED,IAAA,mBAAU,EAAC,GAAG,EAAE;IACd,WAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAA,WAAE,EAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE;aACtB,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAE,qBAAqB;aAC7D,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAE,iBAAiB;aACzD,qBAAqB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa;QAEzD,WAAE,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAwC,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEjE,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACnE,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC/D,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAE7D,WAAE,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAwC,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAA,WAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE;YACvB,6BAA6B;aAC5B,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAChD,oCAAoC;aACnC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAEtC,WAAE,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAwC,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,gBAAgB,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAEvD,gEAAgE;QAChE,wEAAwE;QACxE,kEAAkE;QAClE,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC5C,uCAAuC;QACvC,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtD,0BAA0B;QAC1B,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC/D,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACpE,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACpE,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzD,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtD,mCAAmC;QACnC,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzD,6BAA6B;QAC7B,IAAA,eAAM,EAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAA,WAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE;aACtB,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAG,UAAU;aACzD,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,iBAAiB;aACjE,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,sBAAsB;aACtE,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,WAAW;aAC3D,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,WAAW;aAC3D,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,iBAAiB;aACjE,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,qBAAqB;aACrE,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAa,aAAa;aAC7D,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAY,kBAAkB;QAErE,WAAE,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACvE,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAwC,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAE3E,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAA,eAAM,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAA,eAAM,EAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAA,eAAM,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,IAAA,eAAM,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,IAAA,eAAM,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAA,eAAM,EAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAA,eAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,IAAA,eAAM,EAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAE1D,WAAE,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACvE,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAwC,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAE5E,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjC,8DAA8D;QAC9D,kEAAkE;QAClE,IAAA,eAAM,EAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/abac-service.d.ts

@@ -0,0 +1,41 @@
+import pg from "pg";
+import { type AbacCondition, type AbacPolicy, type CreateAbacPolicyInput, type AbacEvaluationRequest, type AbacEvaluationResult, type ResolvedAbacPolicy } from "@stratum-hq/core";
+/**
+ * Evaluate a single ABAC condition against an attribute context.
+ * Returns false when the attribute is missing from context.
+ * Throws InvalidAbacOperatorError for unknown operators.
+ */
+export declare function evaluateCondition(condition: AbacCondition, context: Record<string, unknown>): boolean;
+/**
+ * Evaluate all conditions for a policy against a context (AND semantics).
+ * Empty conditions array → true (open policy).
+ */
+export declare function evaluatePolicy(policy: AbacPolicy, context: Record<string, unknown>): boolean;
+/**
+ * Resolve effective ABAC policies for a tenant by batch-loading all ancestor
+ * policies in a single query and walking root→leaf (same pattern as resolvePermissions).
+ */
+export declare function resolveAbacPolicies(pool: pg.Pool, tenantId: string): Promise<ResolvedAbacPolicy[]>;
+/**
+ * Evaluate an ABAC request against the resolved policies for a tenant.
+ * - Deny overrides allow.
+ * - Policies sorted by priority (higher first).
+ * - Default deny if no policy matches.
+ * - Supports '*' wildcard for resource_type or action.
+ */
+export declare function evaluateAbac(pool: pg.Pool, tenantId: string, request: AbacEvaluationRequest): Promise<AbacEvaluationResult>;
+/**
+ * Create a new ABAC policy for a tenant.
+ * Rejects if an ancestor policy with the same composite key is LOCKED.
+ */
+export declare function createAbacPolicy(pool: pg.Pool, tenantId: string, input: CreateAbacPolicyInput): Promise<AbacPolicy>;
+/**
+ * Get all ABAC policies owned by a tenant (non-resolved, own policies only).
+ */
+export declare function getAbacPolicies(pool: pg.Pool, tenantId: string): Promise<AbacPolicy[]>;
+/**
+ * Delete an ABAC policy, with CASCADE: removes descendant policies sharing
+ * the same (resource_type, action, name) composite.
+ */
+export declare function deleteAbacPolicy(pool: pg.Pool, tenantId: string, policyId: string): Promise<void>;
+//# sourceMappingURL=abac-service.d.ts.map

package/dist/services/abac-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abac-service.d.ts","sourceRoot":"","sources":["../../src/services/abac-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EAMxB,MAAM,kBAAkB,CAAC;AAM1B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAsCT;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAKT;AAMD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAkF/B;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CA4D/B;AAMD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,UAAU,CAAC,CA8CrB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAoCf"}