@stratum-hq/lib 0.2.3 → 0.2.4

package/dist/__tests__/migrate-schemas.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=migrate-schemas.test.d.ts.map

package/dist/__tests__/migrate-schemas.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-schemas.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/migrate-schemas.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/migrate-schemas.test.js

@@ -0,0 +1,225 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const migrate_schemas_js_1 = require("../migrate-schemas.js");
+// Mock fs and path so we don't need real migration files
+vitest_1.vi.mock("node:fs", () => ({
+    default: {
+        existsSync: vitest_1.vi.fn().mockReturnValue(true),
+        readdirSync: vitest_1.vi.fn().mockReturnValue(["001_init.sql", "002_schema.sql"]),
+        readFileSync: vitest_1.vi.fn().mockImplementation((_path) => {
+            if (_path.includes("001_init"))
+                return "CREATE TABLE test1 (id INT);";
+            return "CREATE TABLE test2 (id INT);";
+        }),
+    },
+}));
+function createMockClient() {
+    const applied = new Set();
+    return {
+        query: vitest_1.vi.fn().mockImplementation((sql, params) => {
+            // Track SET search_path calls
+            if (typeof sql === "string" && sql.includes("search_path")) {
+                return Promise.resolve({ rows: [] });
+            }
+            // Check if migration already applied
+            if (typeof sql === "string" &&
+                sql.includes("SELECT 1 FROM _migrations") &&
+                params) {
+                const name = params[0];
+                if (applied.has(name)) {
+                    return Promise.resolve({ rows: [{ "?column?": 1 }] });
+                }
+                return Promise.resolve({ rows: [] });
+            }
+            // Record applied migration
+            if (typeof sql === "string" &&
+                sql.includes("INSERT INTO _migrations") &&
+                params) {
+                applied.add(params[0]);
+                return Promise.resolve({ rows: [] });
+            }
+            return Promise.resolve({ rows: [] });
+        }),
+        release: vitest_1.vi.fn(),
+    };
+}
+function createMockPool(schemas, opts) {
+    const clients = [];
+    const pool = {
+        query: vitest_1.vi.fn().mockImplementation((sql) => {
+            if (sql.includes("SELECT slug FROM tenants")) {
+                return Promise.resolve({
+                    rows: schemas.map((s) => ({ slug: s })),
+                });
+            }
+            return Promise.resolve({ rows: [] });
+        }),
+        connect: vitest_1.vi.fn().mockImplementation(() => {
+            const client = createMockClient();
+            if (opts?.failSchema) {
+                const origQuery = client.query;
+                client.query = vitest_1.vi.fn().mockImplementation((sql, params) => {
+                    // Fail on the actual migration SQL for the target schema
+                    if (typeof sql === "string" &&
+                        sql.includes("search_path") &&
+                        sql.includes(`tenant_${opts.failSchema}`)) {
+                        // Let the search_path call succeed, but fail on the next migration SQL
+                        const innerQuery = vitest_1.vi.fn().mockImplementation((innerSql, innerParams) => {
+                            if (innerSql.startsWith("CREATE TABLE test")) {
+                                return Promise.reject(new Error(`Migration failed for schema tenant_${opts.failSchema}`));
+                            }
+                            return origQuery(innerSql, innerParams);
+                        });
+                        // Replace query for subsequent calls
+                        client.query = innerQuery;
+                        return Promise.resolve({ rows: [] });
+                    }
+                    return origQuery(sql, params);
+                });
+            }
+            clients.push(client);
+            return Promise.resolve(client);
+        }),
+        _clients: clients,
+    };
+    return pool;
+}
+(0, vitest_1.beforeEach)(() => {
+    vitest_1.vi.clearAllMocks();
+});
+(0, vitest_1.describe)("migrateAllSchemas", () => {
+    (0, vitest_1.it)("discovers schemas from tenants table", async () => {
+        const pool = createMockPool(["acme", "globex"]);
+        await (0, migrate_schemas_js_1.migrateAllSchemas)({ pool });
+        (0, vitest_1.expect)(pool.query).toHaveBeenCalledWith(vitest_1.expect.stringContaining("SELECT slug FROM tenants"));
+    });
+    (0, vitest_1.it)("runs migrations per schema with correct search_path", async () => {
+        const pool = createMockPool(["acme"]);
+        const result = await (0, migrate_schemas_js_1.migrateAllSchemas)({ pool });
+        (0, vitest_1.expect)(result.succeeded).toContain("tenant_acme");
+        (0, vitest_1.expect)(result.failed).toHaveLength(0);
+        // Verify search_path was set for the schema
+        const allCalls = pool._clients.flatMap((c) => c.query.mock.calls.map((call) => call[0]));
+        const searchPathCalls = allCalls.filter((s) => typeof s === "string" && s.includes("search_path"));
+        (0, vitest_1.expect)(searchPathCalls.some((s) => s.includes("tenant_acme"))).toBe(true);
+    });
+    (0, vitest_1.it)("continue-on-error: collects failures in result.failed[]", async () => {
+        // Create a pool where one schema will fail
+        const pool = createMockPool(["acme", "badco"]);
+        // Override connect to fail for badco's migration
+        let callCount = 0;
+        const origConnect = pool.connect;
+        pool.connect = vitest_1.vi.fn().mockImplementation(() => {
+            callCount++;
+            const client = createMockClient();
+            // Make every other set of clients fail for badco
+            const origQuery = client.query;
+            let currentSchema = "";
+            client.query = vitest_1.vi.fn().mockImplementation((sql, params) => {
+                if (typeof sql === "string" && sql.includes("search_path")) {
+                    if (sql.includes("tenant_badco")) {
+                        currentSchema = "badco";
+                    }
+                    else {
+                        currentSchema = "";
+                    }
+                }
+                if (currentSchema === "badco" &&
+                    typeof sql === "string" &&
+                    sql.startsWith("CREATE TABLE test")) {
+                    return Promise.reject(new Error("Schema migration failed"));
+                }
+                return origQuery(sql, params);
+            });
+            pool._clients.push(client);
+            return Promise.resolve(client);
+        });
+        const result = await (0, migrate_schemas_js_1.migrateAllSchemas)({ pool });
+        (0, vitest_1.expect)(result.succeeded).toContain("tenant_acme");
+        (0, vitest_1.expect)(result.failed.length).toBeGreaterThan(0);
+        (0, vitest_1.expect)(result.failed[0].schema).toBe("tenant_badco");
+        (0, vitest_1.expect)(result.failed[0].error).toBeInstanceOf(Error);
+    });
+    (0, vitest_1.it)("progress callback called with correct args", async () => {
+        const pool = createMockPool(["acme", "globex"]);
+        const progress = vitest_1.vi.fn();
+        await (0, migrate_schemas_js_1.migrateAllSchemas)({ pool, onProgress: progress });
+        (0, vitest_1.expect)(progress).toHaveBeenCalledTimes(2);
+        // Each call should have (schema, index, total)
+        const calls = progress.mock.calls;
+        for (const call of calls) {
+            (0, vitest_1.expect)(typeof call[0]).toBe("string");
+            (0, vitest_1.expect)(typeof call[1]).toBe("number");
+            (0, vitest_1.expect)(call[2]).toBe(2);
+        }
+        // Indices should be 1 and 2 (completed count)
+        const indices = calls.map((c) => c[1]).sort();
+        (0, vitest_1.expect)(indices).toEqual([1, 2]);
+    });
+    (0, vitest_1.it)("idempotent re-run: already-applied migrations skipped", async () => {
+        // Create pool with a client that reports migrations as already applied
+        const pool = createMockPool(["acme"]);
+        const origConnect = pool.connect;
+        pool.connect = vitest_1.vi.fn().mockImplementation(() => {
+            const client = createMockClient();
+            // Override: all migrations already applied
+            const origQuery = client.query;
+            client.query = vitest_1.vi.fn().mockImplementation((sql, params) => {
+                if (typeof sql === "string" &&
+                    sql.includes("SELECT 1 FROM _migrations") &&
+                    params) {
+                    return Promise.resolve({ rows: [{ "?column?": 1 }] });
+                }
+                return origQuery(sql, params);
+            });
+            pool._clients.push(client);
+            return Promise.resolve(client);
+        });
+        const result = await (0, migrate_schemas_js_1.migrateAllSchemas)({ pool });
+        (0, vitest_1.expect)(result.succeeded).toContain("tenant_acme");
+        (0, vitest_1.expect)(result.failed).toHaveLength(0);
+        // No INSERT should have been called (migrations skipped)
+        const allCalls = pool._clients.flatMap((c) => c.query.mock.calls.map((call) => call[0]));
+        const inserts = allCalls.filter((s) => typeof s === "string" && s.includes("INSERT INTO _migrations"));
+        (0, vitest_1.expect)(inserts).toHaveLength(0);
+    });
+    (0, vitest_1.it)("empty schema list returns empty result", async () => {
+        const pool = createMockPool([]);
+        const result = await (0, migrate_schemas_js_1.migrateAllSchemas)({ pool });
+        (0, vitest_1.expect)(result.succeeded).toEqual([]);
+        (0, vitest_1.expect)(result.failed).toEqual([]);
+    });
+    (0, vitest_1.it)("respects concurrency limit", async () => {
+        const schemas = Array.from({ length: 10 }, (_, i) => `tenant${i}`);
+        const pool = createMockPool(schemas);
+        let maxConcurrent = 0;
+        let currentConcurrent = 0;
+        const origConnect = pool.connect;
+        pool.connect = vitest_1.vi.fn().mockImplementation(async () => {
+            currentConcurrent++;
+            if (currentConcurrent > maxConcurrent) {
+                maxConcurrent = currentConcurrent;
+            }
+            const client = createMockClient();
+            // Add a small delay to simulate work
+            const origQuery = client.query;
+            client.query = vitest_1.vi.fn().mockImplementation(async (sql, params) => {
+                if (typeof sql === "string" && sql.includes("COMMIT")) {
+                    // Small delay on commit
+                    await new Promise((r) => setTimeout(r, 5));
+                    currentConcurrent--;
+                }
+                return origQuery(sql, params);
+            });
+            pool._clients.push(client);
+            return client;
+        });
+        await (0, migrate_schemas_js_1.migrateAllSchemas)({ pool, concurrency: 3 });
+        // maxConcurrent should not exceed concurrency * migrations_per_schema
+        // but the schema-level concurrency should be limited
+        // Due to the semaphore, we expect at most 3 schemas in flight
+        (0, vitest_1.expect)(maxConcurrent).toBeLessThanOrEqual(3 * 2); // 3 concurrent * 2 migration files
+    });
+});
+//# sourceMappingURL=migrate-schemas.test.js.map

package/dist/__tests__/migrate-schemas.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-schemas.test.js","sourceRoot":"","sources":["../../src/__tests__/migrate-schemas.test.ts"],"names":[],"mappings":";;AAAA,mCAA8D;AAC9D,8DAA0D;AAE1D,yDAAyD;AACzD,WAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACxB,OAAO,EAAE;QACP,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;QACzC,WAAW,EAAE,WAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACxE,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,KAAa,EAAE,EAAE;YACzD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,OAAO,8BAA8B,CAAC;YACtE,OAAO,8BAA8B,CAAC;QACxC,CAAC,CAAC;KACH;CACF,CAAC,CAAC,CAAC;AAEJ,SAAS,gBAAgB;IACvB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO;QACL,KAAK,EAAE,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,GAAW,EAAE,MAAkB,EAAE,EAAE;YACpE,8BAA8B;YAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,qCAAqC;YACrC,IACE,OAAO,GAAG,KAAK,QAAQ;gBACvB,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;gBACzC,MAAM,EACN,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;gBACjC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACxD,CAAC;gBACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,2BAA2B;YAC3B,IACE,OAAO,GAAG,KAAK,QAAQ;gBACvB,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC;gBACvC,MAAM,EACN,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAW,CAAC,CAAC;gBACjC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC;QACF,OAAO,EAAE,WAAE,CAAC,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,OAAiB,EAAE,IAA8B;IACvE,MAAM,OAAO,GAA0C,EAAE,CAAC;IAE1D,MAAM,IAAI,GAAG;QACX,KAAK,EAAE,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,GAAW,EAAE,EAAE;YAChD,IAAI,GAAG,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;gBAC7C,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;iBACxC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC;QACF,OAAO,EAAE,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAElC,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC;gBACrB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC/B,MAAM,CAAC,KAAK,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,GAAW,EAAE,MAAkB,EAAE,EAAE;oBAC5E,yDAAyD;oBACzD,IACE,OAAO,GAAG,KAAK,QAAQ;wBACvB,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;wBAC3B,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC,EACzC,CAAC;wBACD,uEAAuE;wBACvE,MAAM,UAAU,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,QAAgB,EAAE,WAAuB,EAAE,EAAE;4BAC1F,IAAI,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gCAC7C,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;4BAC5F,CAAC;4BACD,OAAO,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;wBAC1C,CAAC,CAAC,CAAC;wBACH,qCAAqC;wBACrC,MAAM,CAAC,KAAK,GAAG,UAAiB,CAAC;wBACjC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBACvC,CAAC;oBACD,OAAO,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAChC,CAAC,CAAQ,CAAC;YACZ,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC;QACF,QAAQ,EAAE,OAAO;KAClB,CAAC;IAEF,OAAO,IAAW,CAAC;AACrB,CAAC;AAED,IAAA,mBAAU,EAAC,GAAG,EAAE;IACd,WAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,IAAA,WAAE,EAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,MAAM,IAAA,sCAAiB,EAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,IAAA,eAAM,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,oBAAoB,CACrC,eAAM,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,CACpD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAiB,EAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,IAAA,eAAM,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAClD,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEtC,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CACpC,CAAC,CAAsC,EAAE,EAAE,CACzC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACvD,CAAC;QACF,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAClE,CAAC;QACF,IAAA,eAAM,EAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,2CAA2C;QAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,iDAAiD;QACjD,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAC7C,SAAS,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAElC,iDAAiD;YACjD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;YAC/B,IAAI,aAAa,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,GAAW,EAAE,MAAkB,EAAE,EAAE;gBAC5E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC3D,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;wBACjC,aAAa,GAAG,OAAO,CAAC;oBAC1B,CAAC;yBAAM,CAAC;wBACN,aAAa,GAAG,EAAE,CAAC;oBACrB,CAAC;gBACH,CAAC;gBACD,IACE,aAAa,KAAK,OAAO;oBACzB,OAAO,GAAG,KAAK,QAAQ;oBACvB,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,EACnC,CAAC;oBACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBAC9D,CAAC;gBACD,OAAO,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC,CAAQ,CAAC;YAEV,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAQ,CAAC;QAEV,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAiB,EAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,IAAA,eAAM,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAClD,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChD,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrD,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,IAAA,sCAAiB,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAExD,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,+CAA+C;QAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAA,eAAM,EAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,8CAA8C;QAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAA,eAAM,EAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,uEAAuE;QACvE,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAC7C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAClC,2CAA2C;YAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;YAC/B,MAAM,CAAC,KAAK,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,GAAW,EAAE,MAAkB,EAAE,EAAE;gBAC5E,IACE,OAAO,GAAG,KAAK,QAAQ;oBACvB,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;oBACzC,MAAM,EACN,CAAC;oBACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACxD,CAAC;gBACD,OAAO,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC,CAAQ,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAQ,CAAC;QAEV,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAiB,EAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAA,eAAM,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAClD,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEtC,yDAAyD;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CACpC,CAAC,CAAsC,EAAE,EAAE,CACzC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACvD,CAAC;QACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAC9E,CAAC;QACF,IAAA,eAAM,EAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAiB,EAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAA,eAAM,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;QAEjC,IAAI,CAAC,OAAO,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACnD,iBAAiB,EAAE,CAAC;YACpB,IAAI,iBAAiB,GAAG,aAAa,EAAE,CAAC;gBACtC,aAAa,GAAG,iBAAiB,CAAC;YACpC,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAClC,qCAAqC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;YAC/B,MAAM,CAAC,KAAK,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAW,EAAE,MAAkB,EAAE,EAAE;gBAClF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtD,wBAAwB;oBACxB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC3C,iBAAiB,EAAE,CAAC;gBACtB,CAAC;gBACD,OAAO,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC,CAAQ,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC;QAChB,CAAC,CAAQ,CAAC;QAEV,MAAM,IAAA,sCAAiB,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QAElD,sEAAsE;QACtE,qDAAqD;QACrD,8DAA8D;QAC9D,IAAA,eAAM,EAAC,aAAa,CAAC,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mCAAmC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/stratum-als.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=stratum-als.test.d.ts.map

package/dist/__tests__/stratum-als.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum-als.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/stratum-als.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/stratum-als.test.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const stratum_js_1 = require("../stratum.js");
+const mockContext = {
+    tenant_id: "t_abc-123",
+    ancestry_path: "/t_abc-123",
+    depth: 0,
+    resolved_config: { feature_x: true },
+    resolved_permissions: {},
+    isolation_strategy: "SHARED_RLS",
+};
+(0, vitest_1.describe)("Stratum ALS convenience methods", () => {
+    (0, vitest_1.it)("currentTenantId() returns tenant ID inside runWithTenant", () => {
+        const result = stratum_js_1.Stratum.runWithTenant(mockContext, () => {
+            return stratum_js_1.Stratum.currentTenantId();
+        });
+        (0, vitest_1.expect)(result).toBe("t_abc-123");
+    });
+    (0, vitest_1.it)("currentTenantId() returns undefined outside any context", () => {
+        (0, vitest_1.expect)(stratum_js_1.Stratum.currentTenantId()).toBeUndefined();
+    });
+    (0, vitest_1.it)("currentTenantContext() returns full context object", () => {
+        const result = stratum_js_1.Stratum.runWithTenant(mockContext, () => {
+            return stratum_js_1.Stratum.currentTenantContext();
+        });
+        (0, vitest_1.expect)(result).toEqual(mockContext);
+    });
+    (0, vitest_1.it)("currentTenantContext() returns undefined outside any context", () => {
+        (0, vitest_1.expect)(stratum_js_1.Stratum.currentTenantContext()).toBeUndefined();
+    });
+    (0, vitest_1.it)("runWithTenant() executes the function and returns its value", () => {
+        const result = stratum_js_1.Stratum.runWithTenant(mockContext, () => 42);
+        (0, vitest_1.expect)(result).toBe(42);
+    });
+    (0, vitest_1.it)("nested runWithTenant() uses innermost context", () => {
+        const inner = {
+            ...mockContext,
+            tenant_id: "t_inner-456",
+        };
+        const result = stratum_js_1.Stratum.runWithTenant(mockContext, () => {
+            return stratum_js_1.Stratum.runWithTenant(inner, () => {
+                return stratum_js_1.Stratum.currentTenantId();
+            });
+        });
+        (0, vitest_1.expect)(result).toBe("t_inner-456");
+    });
+});
+//# sourceMappingURL=stratum-als.test.js.map

package/dist/__tests__/stratum-als.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum-als.test.js","sourceRoot":"","sources":["../../src/__tests__/stratum-als.test.ts"],"names":[],"mappings":";;AAAA,mCAA8C;AAC9C,8CAAwC;AAGxC,MAAM,WAAW,GAAwB;IACvC,SAAS,EAAE,WAAW;IACtB,aAAa,EAAE,YAAY;IAC3B,KAAK,EAAE,CAAC;IACR,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;IACpC,oBAAoB,EAAE,EAAE;IACxB,kBAAkB,EAAE,YAAY;CACjC,CAAC;AAEF,IAAA,iBAAQ,EAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,IAAA,WAAE,EAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,MAAM,GAAG,oBAAO,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE;YACrD,OAAO,oBAAO,CAAC,eAAe,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,IAAA,eAAM,EAAC,oBAAO,CAAC,eAAe,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,MAAM,GAAG,oBAAO,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE;YACrD,OAAO,oBAAO,CAAC,oBAAoB,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,IAAA,eAAM,EAAC,oBAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,oBAAO,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5D,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,KAAK,GAAwB;YACjC,GAAG,WAAW;YACd,SAAS,EAAE,aAAa;SACzB,CAAC;QACF,MAAM,MAAM,GAAG,oBAAO,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE;YACrD,OAAO,oBAAO,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE;gBACvC,OAAO,oBAAO,CAAC,eAAe,EAAE,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AA6DA,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;yDAEyD;AACzD,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAcjD;AAED,uHAAuH;AACvH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAGnG"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAmEA,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;yDAEyD;AACzD,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAcjD;AAED,uHAAuH;AACvH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAGnG"}

package/dist/crypto.js

@@ -11,9 +11,15 @@ const ALGORITHM = "aes-256-gcm";
 const IV_LENGTH = 12;
 const AUTH_TAG_LENGTH = 16;
 const CURRENT_KEY_VERSION = "v1";
-const HKDF_SALT = process.env.STRATUM_HKDF_SALT
-    ? Buffer.from(process.env.STRATUM_HKDF_SALT, "hex")
-    : Buffer.alloc(32, 0);
+const HKDF_SALT = (() => {
+    if (process.env.STRATUM_HKDF_SALT) {
+        return Buffer.from(process.env.STRATUM_HKDF_SALT, "hex");
+    }
+    if (process.env.NODE_ENV === "production") {
+        throw new Error("STRATUM_HKDF_SALT must be set in production");
+    }
+    return node_crypto_1.default.randomBytes(32);
+})();
 function hkdfDeriveKey(keyMaterial, info = "stratum-aes-key") {
     return Buffer.from(node_crypto_1.default.hkdfSync("sha256", Buffer.from(keyMaterial, "utf8"), HKDF_SALT, info, 32));
 }

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;AA8DA,0BAEC;AAKD,0BAcC;AAGD,8BAGC;AAzFD,8DAAiC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,SAAS,GAAW,OAAO,CAAC,GAAG,CAAC,iBAAiB;IACrD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC;IACnD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAExB,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAI,GAAG,iBAAiB;IAClE,OAAO,MAAM,CAAC,IAAI,CAChB,qBAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACxF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,yDAAyD;IACzD,OAAO,aAAa,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,OAAO,aAAa,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,qBAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,qBAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,GAAG,mBAAmB,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAa,EAAE,UAAkB,EAAE,aAAqB,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,sCAAsC;QACtC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAyC,CAAC;IACnF,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,gCAAgC;QAChC,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,qFAAqF;AACrF,SAAgB,OAAO,CAAC,SAAiB;IACvC,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;yDAEyD;AACzD,SAAgB,OAAO,CAAC,SAAiB;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAChE,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,OAAO,cAAc,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uHAAuH;AACvH,SAAgB,SAAS,CAAC,SAAiB,EAAE,cAAsB,EAAE,cAAsB;IACzF,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IACvE,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;AAoEA,0BAEC;AAKD,0BAcC;AAGD,8BAGC;AA/FD,8DAAiC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,SAAS,GAAW,CAAC,GAAG,EAAE;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAI,GAAG,iBAAiB;IAClE,OAAO,MAAM,CAAC,IAAI,CAChB,qBAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACxF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,yDAAyD;IACzD,OAAO,aAAa,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,OAAO,aAAa,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,qBAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,qBAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,GAAG,mBAAmB,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAa,EAAE,UAAkB,EAAE,aAAqB,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,sCAAsC;QACtC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAyC,CAAC;IACnF,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,gCAAgC;QAChC,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,qFAAqF;AACrF,SAAgB,OAAO,CAAC,SAAiB;IACvC,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;yDAEyD;AACzD,SAAgB,OAAO,CAAC,SAAiB;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAChE,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,OAAO,cAAc,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uHAAuH;AACvH,SAAgB,SAAS,CAAC,SAAiB,EAAE,cAAsB,EAAE,cAAsB;IACzF,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IACvE,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { Stratum, type StratumOptions } from "./stratum.js";
 export { migrate, type MigrateOptions } from "./migrate.js";
+export { migrateAllSchemas, type MigrateSchemasOptions, type MigrateSchemasResult, } from "./migrate-schemas.js";
 export { withClient, withTransaction } from "./pool-helpers.js";
 export { traced, getTracer, isTracingEnabled } from "./telemetry.js";
 export type { TenantNode, TenantContext, CreateTenantInput, UpdateTenantInput, MoveTenantInput, PaginationInput, PaginatedResult, ConfigEntry, SetConfigInput, ResolvedConfigEntry, ResolvedConfig, PermissionPolicy, CreatePermissionInput, UpdatePermissionInput, ResolvedPermission, } from "@stratum-hq/core";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGrE,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGzF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGrE,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGzF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.noopLogger = exports.defaultLogger = exports.isTracingEnabled = exports.getTracer = exports.traced = exports.withTransaction = exports.withClient = exports.migrate = exports.Stratum = void 0;
+exports.noopLogger = exports.defaultLogger = exports.isTracingEnabled = exports.getTracer = exports.traced = exports.withTransaction = exports.withClient = exports.migrateAllSchemas = exports.migrate = exports.Stratum = void 0;
 var stratum_js_1 = require("./stratum.js");
 Object.defineProperty(exports, "Stratum", { enumerable: true, get: function () { return stratum_js_1.Stratum; } });
 var migrate_js_1 = require("./migrate.js");
 Object.defineProperty(exports, "migrate", { enumerable: true, get: function () { return migrate_js_1.migrate; } });
+var migrate_schemas_js_1 = require("./migrate-schemas.js");
+Object.defineProperty(exports, "migrateAllSchemas", { enumerable: true, get: function () { return migrate_schemas_js_1.migrateAllSchemas; } });
 var pool_helpers_js_1 = require("./pool-helpers.js");
 Object.defineProperty(exports, "withClient", { enumerable: true, get: function () { return pool_helpers_js_1.withClient; } });
 Object.defineProperty(exports, "withTransaction", { enumerable: true, get: function () { return pool_helpers_js_1.withTransaction; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,qDAAgE;AAAvD,6GAAA,UAAU,OAAA;AAAE,kHAAA,eAAe,OAAA;AACpC,+CAAqE;AAA5D,sGAAA,MAAM,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AA8B5C,yCAAwD;AAA/C,0GAAA,aAAa,OAAA;AAAE,uGAAA,UAAU,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2DAI8B;AAH5B,uHAAA,iBAAiB,OAAA;AAInB,qDAAgE;AAAvD,6GAAA,UAAU,OAAA;AAAE,kHAAA,eAAe,OAAA;AACpC,+CAAqE;AAA5D,sGAAA,MAAM,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AA8B5C,yCAAwD;AAA/C,0GAAA,aAAa,OAAA;AAAE,uGAAA,UAAU,OAAA"}

package/dist/migrate-schemas.d.ts

@@ -0,0 +1,22 @@
+import pg from "pg";
+export interface MigrateSchemasOptions {
+    pool: pg.Pool;
+    concurrency?: number;
+    onProgress?: (schema: string, index: number, total: number) => void;
+    enforceRls?: boolean;
+}
+export interface MigrateSchemasResult {
+    succeeded: string[];
+    failed: {
+        schema: string;
+        error: Error;
+    }[];
+}
+/**
+ * Discover all tenant schemas (tenants with SCHEMA_PER_TENANT isolation)
+ * and run the standard migration set against each one.
+ *
+ * Continues on error: schemas that fail are collected in result.failed[].
+ */
+export declare function migrateAllSchemas(options: MigrateSchemasOptions): Promise<MigrateSchemasResult>;
+//# sourceMappingURL=migrate-schemas.d.ts.map

package/dist/migrate-schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-schemas.d.ts","sourceRoot":"","sources":["../src/migrate-schemas.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACpE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAA;KAAE,EAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CA2D/B"}

package/dist/migrate-schemas.js

@@ -0,0 +1,128 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrateAllSchemas = migrateAllSchemas;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+/**
+ * Discover all tenant schemas (tenants with SCHEMA_PER_TENANT isolation)
+ * and run the standard migration set against each one.
+ *
+ * Continues on error: schemas that fail are collected in result.failed[].
+ */
+async function migrateAllSchemas(options) {
+    const { pool, concurrency = 5, onProgress, enforceRls } = options;
+    // Discover tenant schemas
+    const { rows } = await pool.query(`SELECT slug FROM tenants WHERE isolation_strategy = 'SCHEMA_PER_TENANT' AND (deleted_at IS NULL) ORDER BY slug`);
+    const schemas = rows.map((r) => `tenant_${r.slug}`);
+    const result = { succeeded: [], failed: [] };
+    if (schemas.length === 0) {
+        return result;
+    }
+    // Load migration files once
+    const migrationsDir = node_path_1.default.resolve(__dirname, "migrations");
+    if (!node_fs_1.default.existsSync(migrationsDir)) {
+        throw new Error(`Migration files not found at ${migrationsDir}. Ensure the package was built with 'npm run build'.`);
+    }
+    const files = node_fs_1.default
+        .readdirSync(migrationsDir)
+        .filter((f) => f.endsWith(".sql"))
+        .sort();
+    const migrationSql = files.map((file) => ({
+        name: file,
+        sql: node_fs_1.default.readFileSync(node_path_1.default.join(migrationsDir, file), "utf-8"),
+    }));
+    // Process schemas in chunks of `concurrency` size
+    let completed = 0;
+    for (let i = 0; i < schemas.length; i += concurrency) {
+        const chunk = schemas.slice(i, i + concurrency);
+        const results = await Promise.allSettled(chunk.map((schema) => migrateSchema(pool, schema, migrationSql, enforceRls)));
+        for (let j = 0; j < results.length; j++) {
+            const schema = chunk[j];
+            const outcome = results[j];
+            if (outcome.status === "fulfilled") {
+                result.succeeded.push(schema);
+            }
+            else {
+                const err = outcome.reason;
+                result.failed.push({
+                    schema,
+                    error: err instanceof Error ? err : new Error(String(err)),
+                });
+            }
+            completed++;
+            onProgress?.(schema, completed, schemas.length);
+        }
+    }
+    return result;
+}
+async function migrateSchema(pool, schema, migrations, enforceRls) {
+    // Use a hash of the schema name for a unique advisory lock key per schema
+    const lockKey = hashSchemaLock(schema);
+    for (const migration of migrations) {
+        const client = await pool.connect();
+        try {
+            await client.query("BEGIN");
+            // Advisory lock scoped to this schema
+            await client.query(`SELECT pg_advisory_xact_lock($1)`, [lockKey]);
+            // Set search_path to the tenant schema
+            await client.query(`SET LOCAL search_path = ${quoteIdent(schema)}, public`);
+            // Ensure _migrations table exists in this schema
+            await client.query(`
+        CREATE TABLE IF NOT EXISTS _migrations (
+          id SERIAL PRIMARY KEY,
+          name TEXT NOT NULL UNIQUE,
+          applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+        )
+      `);
+            // Check if already applied
+            const { rows } = await client.query("SELECT 1 FROM _migrations WHERE name = $1", [migration.name]);
+            if (rows.length > 0) {
+                await client.query("COMMIT");
+                continue;
+            }
+            if (enforceRls) {
+                await client.query("SET LOCAL stratum.enforce_rls = 'on'");
+            }
+            await client.query(migration.sql);
+            await client.query("INSERT INTO _migrations (name) VALUES ($1)", [
+                migration.name,
+            ]);
+            await client.query("COMMIT");
+        }
+        catch (err) {
+            try {
+                await client.query("ROLLBACK");
+            }
+            catch {
+                /* ignore rollback failure */
+            }
+            throw err;
+        }
+        finally {
+            client.release();
+        }
+    }
+}
+/**
+ * Produce a stable int32 advisory lock key from a schema name.
+ * Uses a simple djb2-style hash.
+ */
+function hashSchemaLock(schema) {
+    let hash = 5381;
+    for (let i = 0; i < schema.length; i++) {
+        hash = ((hash << 5) + hash + schema.charCodeAt(i)) | 0;
+    }
+    // Offset from the base migrate lock (8675309) to avoid collision
+    return (hash ^ 0x5354524d) | 0; // XOR with "STRM"
+}
+function quoteIdent(name) {
+    // Simple identifier quoting — disallow anything that could break out
+    if (!/^[a-z_][a-z0-9_]*$/i.test(name)) {
+        throw new Error(`Invalid schema name: ${name}`);
+    }
+    return `"${name}"`;
+}
+//# sourceMappingURL=migrate-schemas.js.map

package/dist/migrate-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-schemas.js","sourceRoot":"","sources":["../src/migrate-schemas.ts"],"names":[],"mappings":";;;;;AAsBA,8CA6DC;AAnFD,sDAAyB;AACzB,0DAA6B;AAe7B;;;;;GAKG;AACI,KAAK,UAAU,iBAAiB,CACrC,OAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAElE,0BAA0B;IAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,gHAAgH,CACjH,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAyB,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4BAA4B;IAC5B,MAAM,aAAa,GAAG,mBAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,iBAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,gCAAgC,aAAa,sDAAsD,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,iBAAE;SACb,WAAW,CAAC,aAAa,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACjC,IAAI,EAAE,CAAC;IAEV,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAE,CAAC,YAAY,CAAC,mBAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC;KAC9D,CAAC,CAAC,CAAC;IAEJ,kDAAkD;IAClD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAC7E,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACnC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;iBAC3D,CAAC,CAAC;YACL,CAAC;YACD,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAa,EACb,MAAc,EACd,UAA2C,EAC3C,UAAoB;IAEpB,0EAA0E;IAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAE5B,sCAAsC;YACtC,MAAM,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAElE,uCAAuC;YACvC,MAAM,MAAM,CAAC,KAAK,CAAC,2BAA2B,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAE5E,iDAAiD;YACjD,MAAM,MAAM,CAAC,KAAK,CAAC;;;;;;OAMlB,CAAC,CAAC;YAEH,2BAA2B;YAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,2CAA2C,EAC3C,CAAC,SAAS,CAAC,IAAI,CAAC,CACjB,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,SAAS;YACX,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBAC/D,SAAS,CAAC,IAAI;aACf,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,iEAAiE;IACjE,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,qEAAqE;IACrE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,IAAI,GAAG,CAAC;AACrB,CAAC"}

package/dist/migrations/001_init.sql

@@ -1,6 +1,15 @@
--- Extensions
-CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
-CREATE EXTENSION IF NOT EXISTS "ltree";
+-- Extensions (require superuser or CREATE privilege; gracefully warn if unavailable)
+DO $$ BEGIN
+  CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+EXCEPTION WHEN insufficient_privilege THEN
+  RAISE WARNING 'Cannot create uuid-ossp extension — insufficient privileges. Ask a database administrator to run: CREATE EXTENSION IF NOT EXISTS "uuid-ossp";';
+END $$;
+
+DO $$ BEGIN
+  CREATE EXTENSION IF NOT EXISTS "ltree";
+EXCEPTION WHEN insufficient_privilege THEN
+  RAISE WARNING 'Cannot create ltree extension — insufficient privileges. Ask a database administrator to run: CREATE EXTENSION IF NOT EXISTS "ltree";';
+END $$;
 
 -- Warn if application role has BYPASSRLS privilege.
 -- In production, set stratum.enforce_rls = 'on' to make this a hard error.

package/dist/services/event-service.d.ts

@@ -1,5 +1,12 @@
 import pg from "pg";
 import type { TenantEvent } from "@stratum-hq/core";
+/** Validates that a webhook URL does not target internal/private networks. */
+export declare function validateWebhookUrl(url: string): void;
+/**
+ * DNS-rebinding-safe validation: resolve hostname and check all resolved IPs
+ * against blocked ranges. Call this at delivery time, not just registration.
+ */
+export declare function validateWebhookUrlWithDns(url: string): Promise<void>;
 interface WebhookEventRow {
     id: string;
     type: string;

package/dist/services/event-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-service.d.ts","sourceRoot":"","sources":["../../src/services/event-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAgIpD,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA4ClF;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAmFpE;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4B7F;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBvF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA0B/F;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,KAAK,SAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CA0BpC"}
+{"version":3,"file":"event-service.d.ts","sourceRoot":"","sources":["../../src/services/event-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAgCpD,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAwBpD;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC1E;AA2BD,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA4ClF;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAmFpE;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4B7F;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBvF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA0B/F;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,KAAK,SAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CA0BpC"}

package/dist/services/event-service.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateWebhookUrl = validateWebhookUrl;
+exports.validateWebhookUrlWithDns = validateWebhookUrlWithDns;
 exports.emitEvent = emitEvent;
 exports.deliverWebhook = deliverWebhook;
 exports.processDeliveries = processDeliveries;