@stratum-hq/lib 1.2.1 → 1.3.0

package/dist/services/retention-service.js

@@ -4,6 +4,7 @@ exports.purgeExpiredData = purgeExpiredData;
 exports.purgeTenant = purgeTenant;
 exports.exportTenantData = exportTenantData;
 const core_1 = require("@stratum-hq/core");
+const db_adapters_1 = require("@stratum-hq/db-adapters");
 const pool_helpers_js_1 = require("../pool-helpers.js");
 const DEFAULT_RETENTION_DAYS = 90;
 /**
@@ -28,18 +29,54 @@ async function purgeExpiredData(pool, retentionDays = DEFAULT_RETENTION_DAYS) {
         return { deleted_count: totalDeleted };
     });
 }
+// Guard: reject if tenant has children (FK RESTRICT would crash otherwise)
+async function assertNoChildren(client, tenantId) {
+    const childCheck = await client.query(`SELECT COUNT(*)::int AS count FROM tenants WHERE parent_id = $1`, [tenantId]);
+    const childCount = childCheck.rows[0].count;
+    if (childCount > 0) {
+        throw new core_1.StratumError(core_1.ErrorCode.TENANT_HAS_CHILDREN, `Cannot purge tenant ${tenantId}: has ${childCount} child tenant(s). Purge children first.`, 409, { tenant_id: tenantId, child_count: childCount });
+    }
+}
+/**
+ * Whether purge drops this tenant's schema or database. Only a tenant that was
+ * activated owns storage: a pending tenant's provisioning never completed, and
+ * may have failed because something else already held the name. The storage
+ * name is derived by the same db-adapters helpers provisioning uses.
+ */
+function ownsStorage(tenant, strategy) {
+    return tenant !== undefined && tenant.status !== "pending" && tenant.isolation_strategy === strategy;
+}
 /**
  * GDPR Article 17 — Right to Erasure.
- * Hard-delete ALL data belonging to a specific tenant, in correct FK order.
+ * Hard-delete ALL data belonging to a specific tenant, in correct FK order,
+ * including its own schema (SCHEMA_PER_TENANT) or database (DB_PER_TENANT).
+ *
+ * The schema is dropped in the same transaction as the rows, so both go or
+ * neither does. DROP DATABASE cannot run in a transaction, so the database is
+ * dropped first: if that fails nothing has changed, and if removing the rows
+ * then fails, purging again completes (the drop is IF EXISTS).
  */
 async function purgeTenant(pool, tenantId) {
-    await (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
-        // Guard: reject if tenant has children (FK RESTRICT would crash otherwise)
-        const childCheck = await client.query(`SELECT COUNT(*)::int AS count FROM tenants WHERE parent_id = $1`, [tenantId]);
-        const childCount = childCheck.rows[0].count;
-        if (childCount > 0) {
-            throw new core_1.StratumError(core_1.ErrorCode.TENANT_HAS_CHILDREN, `Cannot purge tenant ${tenantId}: has ${childCount} child tenant(s). Purge children first.`, 409, { tenant_id: tenantId, child_count: childCount });
+    const before = await (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        await assertNoChildren(client, tenantId);
+        const res = await client.query(`SELECT slug, isolation_strategy, status FROM tenants WHERE id = $1`, [tenantId]);
+        return res.rows[0];
+    });
+    if (ownsStorage(before, "DB_PER_TENANT")) {
+        const client = await pool.connect();
+        try {
+            await (0, db_adapters_1.dropDatabase)(client, before.slug);
+        }
+        finally {
+            client.release();
         }
+    }
+    await (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        // Lock the row first so a concurrent create under this tenant (which holds
+        // it FOR SHARE) finishes and is counted, rather than failing the delete.
+        const res = await client.query(`SELECT slug, isolation_strategy, status FROM tenants WHERE id = $1 FOR UPDATE`, [tenantId]);
+        const tenant = res.rows[0];
+        await assertNoChildren(client, tenantId);
         // Delete in FK-safe order (children before parents)
         await client.query(`DELETE FROM config_entries WHERE tenant_id = $1`, [tenantId]);
         await client.query(`DELETE FROM permission_policies WHERE tenant_id = $1`, [tenantId]);
@@ -56,6 +93,9 @@ async function purgeTenant(pool, tenantId) {
         await client.query(`DELETE FROM audit_logs WHERE tenant_id = $1 OR (resource_type = 'tenant' AND resource_id = $1::text)`, [tenantId]);
         // Finally, the tenant itself
         await client.query(`DELETE FROM tenants WHERE id = $1`, [tenantId]);
+        if (ownsStorage(tenant, "SCHEMA_PER_TENANT")) {
+            await (0, db_adapters_1.dropSchema)(client, tenant.slug);
+        }
     });
 }
 /**

package/dist/services/retention-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-service.js","sourceRoot":"","sources":["../../src/services/retention-service.ts"],"names":[],"mappings":";;AAUA,4CAkCC;AAMD,kCA+CC;AAMD,4CA8BC;AApID,2CAA2D;AAC3D,wDAAiE;AAEjE,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,gBAAwB,sBAAsB;IAE9C,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAEvC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,qEAAqE;QACrE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,sDAAsD,EACtD,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC;QAEzC,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,kDAAkD,EAClD,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAErC,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,8CAA8C,EAC9C,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAErC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,QAAgB;IAEhB,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,2EAA2E;QAC3E,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,iEAAiE,EACjE,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,UAAU,GAAW,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAY,CACpB,gBAAS,CAAC,mBAAmB,EAC7B,uBAAuB,QAAQ,SAAS,UAAU,yCAAyC,EAC3F,GAAG,EACH,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CACjD,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,MAAM,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,MAAM,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEzE,iDAAiD;QACjD,MAAM,MAAM,CAAC,KAAK,CAChB,mGAAmG,EACnG,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAChB,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5E,kBAAkB;QAClB,MAAM,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnF,aAAa;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,sGAAsG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvI,6BAA6B;QAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1G,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,iHAAiH,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClK,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mHAAmH,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrK,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1G,MAAM,iBAAiB,GAAG,MAAM,MAAM,CAAC,KAAK,CAC1C,uGAAuG,EACvG,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClG,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5G,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;YAC9B,cAAc,EAAE,aAAa,CAAC,IAAI;YAClC,mBAAmB,EAAE,WAAW,CAAC,IAAI;YACrC,QAAQ,EAAE,OAAO,CAAC,IAAI;YACtB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,cAAc,EAAE,aAAa,CAAC,IAAI;YAClC,kBAAkB,EAAE,iBAAiB,CAAC,IAAI;YAC1C,UAAU,EAAE,SAAS,CAAC,IAAI;YAC1B,eAAe,EAAE,cAAc,CAAC,IAAI;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"retention-service.js","sourceRoot":"","sources":["../../src/services/retention-service.ts"],"names":[],"mappings":";;AAWA,4CAkCC;AAyCD,kCA+DC;AAMD,4CA8BC;AAxLD,2CAA4E;AAC5E,yDAAmE;AACnE,wDAAiE;AAEjE,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,gBAAwB,sBAAsB;IAE9C,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAEvC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,qEAAqE;QACrE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,sDAAsD,EACtD,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC;QAEzC,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,kDAAkD,EAClD,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAErC,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,8CAA8C,EAC9C,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAErC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAID,2EAA2E;AAC3E,KAAK,UAAU,gBAAgB,CAAC,MAAqB,EAAE,QAAgB;IACrE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,iEAAiE,EACjE,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,MAAM,UAAU,GAAW,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAY,CACpB,gBAAS,CAAC,mBAAmB,EAC7B,uBAAuB,QAAQ,SAAS,UAAU,yCAAyC,EAC3F,GAAG,EACH,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAiC,EAAE,QAA0C;IAChG,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC;AACvG,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACrD,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oEAAoE,EACpE,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,IAAI,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAA,0BAAY,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,+EAA+E,EAC/E,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzC,oDAAoD;QACpD,MAAM,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,MAAM,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEzE,iDAAiD;QACjD,MAAM,MAAM,CAAC,KAAK,CAChB,mGAAmG,EACnG,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAChB,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5E,kBAAkB;QAClB,MAAM,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnF,aAAa;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,sGAAsG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvI,6BAA6B;QAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEpE,IAAI,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAA,wBAAU,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1G,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,iHAAiH,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClK,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mHAAmH,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrK,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1G,MAAM,iBAAiB,GAAG,MAAM,MAAM,CAAC,KAAK,CAC1C,uGAAuG,EACvG,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClG,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5G,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;YAC9B,cAAc,EAAE,aAAa,CAAC,IAAI;YAClC,mBAAmB,EAAE,WAAW,CAAC,IAAI;YACrC,QAAQ,EAAE,OAAO,CAAC,IAAI;YACtB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,cAAc,EAAE,aAAa,CAAC,IAAI;YAClC,kBAAkB,EAAE,iBAAiB,CAAC,IAAI;YAC1C,UAAU,EAAE,SAAS,CAAC,IAAI;YAC1B,eAAe,EAAE,cAAc,CAAC,IAAI;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/role-service.d.ts

@@ -37,6 +37,11 @@ export declare function removeRoleFromKey(pool: pg.Pool, keyId: string): Promise
  * asks. Assigning a role therefore governs authorization everywhere.
  */
 export declare function resolveEffectiveScopes(pool: pg.Pool, keyId: string): Promise<string[]>;
+/**
+ * {@link resolveEffectiveScopes} on a client the caller already holds, so a
+ * caller inside withClient does not need a second pool connection.
+ */
+export declare function resolveEffectiveScopesOnClient(client: pg.PoolClient, keyId: string): Promise<string[]>;
 /**
  * Resolve effective scopes for an API key. Thin alias over
  * {@link resolveEffectiveScopes}, kept as the public facade name.
@@ -59,6 +64,8 @@ export declare function resolveKeyScopes(pool: pg.Pool, keyId: string): Promise<
  * authorizing the assignment.
  */
 export declare function assignRole(pool: pg.Pool, principalType: string, principalId: string, roleId: string, tenantId?: string): Promise<boolean>;
+/** The role currently assigned to a principal, or null when it has none. */
+export declare function getPrincipalRoleId(pool: pg.Pool, principalType: string, principalId: string): Promise<string | null>;
 /** Remove a principal's role assignment. Returns true if one was removed. */
 export declare function removeRole(pool: pg.Pool, principalType: string, principalId: string): Promise<boolean>;
 /**

package/dist/services/role-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-service.d.ts","sourceRoot":"","sources":["../../src/services/role-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAUrF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQ7E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAcjF;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAoCxG;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5E;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpG;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtF;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAc5F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEhF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,6EAA6E;AAC7E,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB"}
+{"version":3,"file":"role-service.d.ts","sourceRoot":"","sources":["../../src/services/role-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAUrF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQ7E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAcjF;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAoCxG;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5E;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpG;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtF;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE5F;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAY5G;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEhF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,4EAA4E;AAC5E,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED,6EAA6E;AAC7E,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB"}

package/dist/services/role-service.js

@@ -8,8 +8,10 @@ exports.deleteRole = deleteRole;
 exports.assignRoleToKey = assignRoleToKey;
 exports.removeRoleFromKey = removeRoleFromKey;
 exports.resolveEffectiveScopes = resolveEffectiveScopes;
+exports.resolveEffectiveScopesOnClient = resolveEffectiveScopesOnClient;
 exports.resolveKeyScopes = resolveKeyScopes;
 exports.assignRole = assignRole;
+exports.getPrincipalRoleId = getPrincipalRoleId;
 exports.removeRole = removeRole;
 exports.resolvePrincipalScopes = resolvePrincipalScopes;
 const pool_helpers_js_1 = require("../pool-helpers.js");
@@ -94,17 +96,22 @@ async function removeRoleFromKey(pool, keyId) {
  * asks. Assigning a role therefore governs authorization everywhere.
  */
 async function resolveEffectiveScopes(pool, keyId) {
-    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
-        const res = await client.query(`SELECT ak.scopes, r.scopes as role_scopes
-       FROM api_keys ak
-       LEFT JOIN roles r ON r.id = ak.role_id
-       WHERE ak.id = $1 AND ak.revoked_at IS NULL`, [keyId]);
-        if (res.rows.length === 0)
-            return ["read"];
-        const row = res.rows[0];
-        // Role scopes override key scopes when a role is assigned.
-        return row.role_scopes ?? row.scopes ?? ["read"];
-    });
+    return (0, pool_helpers_js_1.withClient)(pool, (client) => resolveEffectiveScopesOnClient(client, keyId));
+}
+/**
+ * {@link resolveEffectiveScopes} on a client the caller already holds, so a
+ * caller inside withClient does not need a second pool connection.
+ */
+async function resolveEffectiveScopesOnClient(client, keyId) {
+    const res = await client.query(`SELECT ak.scopes, r.scopes as role_scopes
+     FROM api_keys ak
+     LEFT JOIN roles r ON r.id = ak.role_id
+     WHERE ak.id = $1 AND ak.revoked_at IS NULL`, [keyId]);
+    if (res.rows.length === 0)
+        return ["read"];
+    const row = res.rows[0];
+    // Role scopes override key scopes when a role is assigned.
+    return row.role_scopes ?? row.scopes ?? ["read"];
 }
 /**
  * Resolve effective scopes for an API key. Thin alias over
@@ -144,6 +151,13 @@ async function assignRole(pool, principalType, principalId, roleId, tenantId) {
         return res.rows.length > 0;
     });
 }
+/** The role currently assigned to a principal, or null when it has none. */
+async function getPrincipalRoleId(pool, principalType, principalId) {
+    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        const res = await client.query(`SELECT role_id FROM principal_roles WHERE principal_type = $1 AND principal_id = $2`, [principalType, principalId]);
+        return res.rows[0]?.role_id ?? null;
+    });
+}
 /** Remove a principal's role assignment. Returns true if one was removed. */
 async function removeRole(pool, principalType, principalId) {
     return (0, pool_helpers_js_1.withClient)(pool, async (client) => {

package/dist/services/role-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-service.js","sourceRoot":"","sources":["../../src/services/role-service.ts"],"names":[],"mappings":";;AA0BA,gCAUC;AAED,0BAQC;AAED,8BAcC;AAED,gCAoCC;AAED,gCAQC;AAED,0CAQC;AAED,8CAQC;AAYD,wDAcC;AAMD,4CAEC;AAkBD,gCAuBC;AAGD,gCAcC;AAaD,wDAkBC;AA5PD,wDAAiE;AAyB1D,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,KAAsB;IACpE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAC/E,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,OAAO,CAAC,IAAa,EAAE,EAAU;IACrD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,mCAAmC,EACnC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAa,EAAE,QAAiB;IAC9D,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,iFAAiF,EACjF,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uCAAuC,CACxC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,EAAU,EAAE,KAAsB;IAChF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,mCAAmC,EACnC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,kBAAkB,GAAG,EAAE,EAAE,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE/C,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oBAAoB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,cAAc,EACpE,MAAM,CACP,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,EAAU;IACxD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,8CAA8C,EAC9C,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,IAAa,EAAE,KAAa,EAAE,MAAc;IAChF,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oFAAoF,EACpF,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAa,EAAE,KAAa;IAClE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,sFAAsF,EACtF,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,sBAAsB,CAAC,IAAa,EAAE,KAAa;IACvE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;kDAG4C,EAC5C,CAAC,KAAK,CAAC,CACR,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,2DAA2D;QAC3D,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,IAAa,EAAE,KAAa;IAC3D,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,aAAqB,EACrB,WAAmB,EACnB,MAAc,EACd,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;;yBASmB,EACnB,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,CACvD,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,aAAqB,EACrB,WAAmB;IAEnB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;yBAEmB,EACnB,CAAC,aAAa,EAAE,WAAW,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,sBAAsB,CAC1C,IAAa,EACb,aAAqB,EACrB,WAAmB,EACnB,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;2EAIqE,EACrE,CAAC,aAAa,EAAE,WAAW,EAAE,QAAQ,IAAI,IAAI,CAAC,CAC/C,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"role-service.js","sourceRoot":"","sources":["../../src/services/role-service.ts"],"names":[],"mappings":";;AA0BA,gCAUC;AAED,0BAQC;AAED,8BAcC;AAED,gCAoCC;AAED,gCAQC;AAED,0CAQC;AAED,8CAQC;AAYD,wDAEC;AAMD,wEAYC;AAMD,4CAEC;AAkBD,gCAuBC;AAGD,gDAYC;AAGD,gCAcC;AAaD,wDAkBC;AAjRD,wDAAiE;AAyB1D,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,KAAsB;IACpE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAC/E,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,OAAO,CAAC,IAAa,EAAE,EAAU;IACrD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,mCAAmC,EACnC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAa,EAAE,QAAiB;IAC9D,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,iFAAiF,EACjF,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uCAAuC,CACxC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,EAAU,EAAE,KAAsB;IAChF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,mCAAmC,EACnC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,kBAAkB,GAAG,EAAE,EAAE,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE/C,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oBAAoB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,cAAc,EACpE,MAAM,CACP,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,EAAU;IACxD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,8CAA8C,EAC9C,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,IAAa,EAAE,KAAa,EAAE,MAAc;IAChF,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oFAAoF,EACpF,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAa,EAAE,KAAa;IAClE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,sFAAsF,EACtF,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,sBAAsB,CAAC,IAAa,EAAE,KAAa;IACvE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,8BAA8B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,8BAA8B,CAAC,MAAqB,EAAE,KAAa;IACvF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;gDAG4C,EAC5C,CAAC,KAAK,CAAC,CACR,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,2DAA2D;IAC3D,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,IAAa,EAAE,KAAa;IAC3D,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,aAAqB,EACrB,WAAmB,EACnB,MAAc,EACd,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;;yBASmB,EACnB,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,CACvD,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AACrE,KAAK,UAAU,kBAAkB,CACtC,IAAa,EACb,aAAqB,EACrB,WAAmB;IAEnB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,qFAAqF,EACrF,CAAC,aAAa,EAAE,WAAW,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,aAAqB,EACrB,WAAmB;IAEnB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;yBAEmB,EACnB,CAAC,aAAa,EAAE,WAAW,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,sBAAsB,CAC1C,IAAa,EACb,aAAqB,EACrB,WAAmB,EACnB,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;2EAIqE,EACrE,CAAC,aAAa,EAAE,WAAW,EAAE,QAAQ,IAAI,IAAI,CAAC,CAC/C,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/tenant-service.d.ts

@@ -1,5 +1,5 @@
 import pg from "pg";
-import { type TenantNode, type CreateTenantInput, type UpdateTenantInput, type PaginationInput, type PaginatedResult } from "@stratum-hq/core";
+import { type TenantNode, type CreateTenantInput, type UpdateTenantInput, type PaginationInput, type PaginatedResult, type TenantStatus } from "@stratum-hq/core";
 export declare function createTenant(pool: pg.Pool, input: CreateTenantInput): Promise<TenantNode>;
 export declare function getTenant(pool: pg.Pool, id: string, includeArchived?: boolean): Promise<TenantNode>;
 /**
@@ -10,11 +10,15 @@ export declare function getTenant(pool: pg.Pool, id: string, includeArchived?: b
  *
  * Mirrors getTenant's not-found and state contract: throws TenantNotFoundError
  * when no row matches, and — unless `includeArchived` is set — TenantArchivedError
- * / TenantSuspendedError for a non-active row. `includeArchived` is the "give me
+ * / TenantSuspendedError / TenantPendingError for a non-active row. `includeArchived` is the "give me
  * the row whatever its state" escape hatch and bypasses both non-active states.
  */
 export declare function getTenantBySlug(pool: pg.Pool, slug: string, includeArchived?: boolean): Promise<TenantNode>;
-export declare function listTenants(pool: pg.Pool, pagination: PaginationInput): Promise<PaginatedResult<TenantNode>>;
+/**
+ * List tenants in one status, `active` by default. Pending, suspended and
+ * archived tenants appear only when that status is asked for.
+ */
+export declare function listTenants(pool: pg.Pool, pagination: PaginationInput, status?: TenantStatus): Promise<PaginatedResult<TenantNode>>;
 export declare function updateTenant(pool: pg.Pool, id: string, patch: UpdateTenantInput): Promise<TenantNode>;
 /**
  * Suspend an active tenant: reversible block on access. Rejects if the tenant
@@ -32,6 +36,11 @@ export declare function archiveTenant(pool: pg.Pool, id: string): Promise<Tenant
  * its parent is not active. Resuming is top-down.
  */
 export declare function resumeTenant(pool: pg.Pool, id: string): Promise<TenantNode>;
+/**
+ * Activate a pending tenant once its schema or database has been provisioned.
+ * Rejects if the tenant is not pending, or if its parent is not active.
+ */
+export declare function activateTenant(pool: pg.Pool, id: string): Promise<TenantNode>;
 /**
  * Soft-delete a tenant.
  *

package/dist/services/tenant-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-service.d.ts","sourceRoot":"","sources":["../../src/services/tenant-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,eAAe,EAWrB,MAAM,kBAAkB,CAAC;AAE1B,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgF/F;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,CAAC,CAsBrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,IAAI,EAAE,MAAM,EACZ,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CA8BtC;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,UAAU,CAAC,CAsDrB;AAwDD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAalF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAalF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAyBjF;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CA+FrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,MAAM,EAAE,iBAAiB,EAAE,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA8F5B;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAsBnF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAyB5E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,EAAE,CAAC,CAwBvB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0CpG"}
+{"version":3,"file":"tenant-service.d.ts","sourceRoot":"","sources":["../../src/services/tenant-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,YAAY,EAalB,MAAM,kBAAkB,CAAC;AAsD1B,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CA4D/F;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,CAAC,CAyBrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,IAAI,EAAE,MAAM,EACZ,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,CAAC,CAsBrB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,UAAU,EAAE,eAAe,EAC3B,MAAM,GAAE,YAAuB,GAC9B,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CA8BtC;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,UAAU,CAAC,CAmErB;AA8DD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAalF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAalF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2BjF;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAenF;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CA+ErB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,MAAM,EAAE,iBAAiB,EAAE,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAmF5B;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAsBnF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAyB5E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,EAAE,CAAC,CAwBvB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0CpG"}

package/dist/services/tenant-service.js

@@ -8,6 +8,7 @@ exports.updateTenant = updateTenant;
 exports.suspendTenant = suspendTenant;
 exports.archiveTenant = archiveTenant;
 exports.resumeTenant = resumeTenant;
+exports.activateTenant = activateTenant;
 exports.deleteTenant = deleteTenant;
 exports.moveTenant = moveTenant;
 exports.batchCreateTenants = batchCreateTenants;
@@ -18,30 +19,62 @@ exports.getChildren = getChildren;
 exports.reorderTenant = reorderTenant;
 const pool_helpers_js_1 = require("../pool-helpers.js");
 const core_1 = require("@stratum-hq/core");
+/**
+ * Serialize changes to the tree's shape on one advisory key. A move takes it
+ * exclusively: it checks for cycles against the destination's ancestry and
+ * rewrites the paths of a whole subtree, so nothing else may read or write
+ * ancestry while it runs. Creates and lifecycle transitions take it shared, so
+ * they still run alongside each other (row locks order those) but never read a
+ * parent path that an in-flight move is about to rewrite. Take it before
+ * reading any row the change depends on.
+ */
+async function lockTree(client, mode) {
+    const fn = mode === "exclusive" ? "pg_advisory_xact_lock" : "pg_advisory_xact_lock_shared";
+    await client.query(`SELECT ${fn}(('x' || substr(md5('stratum.tenant_tree'), 1, 16))::bit(64)::bigint)`);
+}
+/**
+ * Load the parent for a tenant being created or moved, and require it to be
+ * active: a suspended or archived subtree must not grow, so an active tenant
+ * always has an active parent. FOR SHARE holds the parent row until commit, so
+ * a concurrent suspend or archive of the parent (which locks it FOR UPDATE)
+ * waits for this transaction and then sees the new child.
+ */
+async function loadActiveParent(client, parentId) {
+    const res = await client.query(`SELECT * FROM tenants WHERE id = $1 FOR SHARE`, [parentId]);
+    if (res.rows.length === 0) {
+        throw new core_1.TenantNotFoundError(parentId);
+    }
+    const parent = res.rows[0];
+    if (parent.status === "archived") {
+        throw new core_1.TenantArchivedError(parentId);
+    }
+    if (parent.status === "suspended") {
+        throw new core_1.TenantSuspendedError(parentId);
+    }
+    if (parent.status === "pending") {
+        throw new core_1.TenantPendingError(parentId);
+    }
+    return parent;
+}
+/**
+ * A tenant with its own schema or database starts `pending` and is activated
+ * (activateTenant) once that storage has been provisioned, so it is never
+ * usable without it. SHARED_RLS tenants need no storage and start `active`.
+ */
+function initialStatus(input) {
+    const strategy = input.isolation_strategy ?? "SHARED_RLS";
+    return strategy === "SCHEMA_PER_TENANT" || strategy === "DB_PER_TENANT" ? "pending" : "active";
+}
 async function createTenant(pool, input) {
     return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
-        // Advisory lock on parent to serialize sibling inserts
         if (input.parent_id) {
-            await client.query(`SELECT pg_advisory_xact_lock(('x' || substr(md5($1::text), 1, 16))::bit(64)::bigint)`, [input.parent_id]);
-            // Verify parent exists and is active
-            const parentRes = await client.query(`SELECT * FROM tenants WHERE id = $1`, [input.parent_id]);
-            if (parentRes.rows.length === 0) {
-                throw new core_1.TenantNotFoundError(input.parent_id);
-            }
-            if (parentRes.rows[0].status === "archived") {
-                throw new core_1.TenantArchivedError(input.parent_id);
-            }
-            // A suspended or archived subtree must not grow: an active tenant always
-            // has an active parent. See suspendTenant/resumeTenant for the inverse.
-            if (parentRes.rows[0].status === "suspended") {
-                throw new core_1.TenantSuspendedError(input.parent_id);
-            }
-            const parent = parentRes.rows[0];
+            await lockTree(client, "shared");
+            const parent = await loadActiveParent(client, input.parent_id);
             const ancestry_path = (0, core_1.appendToPath)(parent.ancestry_path, parent.id);
             // Inherit region_id from parent if not explicitly provided
             const regionId = input.region_id ?? parent.region_id ?? null;
             const res = await client.query(`INSERT INTO tenants (parent_id, ancestry_path, depth, name, slug, config, metadata, isolation_strategy, status, region_id)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'active', $9)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
          RETURNING *`, [
                 input.parent_id,
                 ancestry_path,
@@ -51,6 +84,7 @@ async function createTenant(pool, input) {
                 JSON.stringify(input.config ?? {}),
                 JSON.stringify(input.metadata ?? {}),
                 input.isolation_strategy ?? "SHARED_RLS",
+                initialStatus(input),
                 regionId,
             ]);
             return res.rows[0];
@@ -59,13 +93,14 @@ async function createTenant(pool, input) {
             // Root tenant — no parent lock needed
             const rootRegionId = input.region_id ?? null;
             const res = await client.query(`INSERT INTO tenants (parent_id, ancestry_path, depth, name, slug, config, metadata, isolation_strategy, status, region_id)
-         VALUES (NULL, '/', 0, $1, $2, $3, $4, $5, 'active', $6)
+         VALUES (NULL, '/', 0, $1, $2, $3, $4, $5, $6, $7)
          RETURNING *`, [
                 input.name,
                 input.slug,
                 JSON.stringify(input.config ?? {}),
                 JSON.stringify(input.metadata ?? {}),
                 input.isolation_strategy ?? "SHARED_RLS",
+                initialStatus(input),
                 rootRegionId,
             ]);
             return res.rows[0];
@@ -90,12 +125,15 @@ async function getTenant(pool, id, includeArchived = false) {
         if (!includeArchived && tenant.status === "archived") {
             throw new core_1.TenantArchivedError(id);
         }
-        // Suspended tenants are blocked from normal access too. `includeArchived`
-        // is the "give me the row whatever its state" escape hatch and bypasses
-        // both non-active states.
+        // Suspended and pending tenants are blocked from normal access too.
+        // `includeArchived` is the "give me the row whatever its state" escape
+        // hatch and bypasses every non-active state.
         if (!includeArchived && tenant.status === "suspended") {
             throw new core_1.TenantSuspendedError(id);
         }
+        if (!includeArchived && tenant.status === "pending") {
+            throw new core_1.TenantPendingError(id);
+        }
         return tenant;
     });
 }
@@ -107,7 +145,7 @@ async function getTenant(pool, id, includeArchived = false) {
  *
  * Mirrors getTenant's not-found and state contract: throws TenantNotFoundError
  * when no row matches, and — unless `includeArchived` is set — TenantArchivedError
- * / TenantSuspendedError for a non-active row. `includeArchived` is the "give me
+ * / TenantSuspendedError / TenantPendingError for a non-active row. `includeArchived` is the "give me
  * the row whatever its state" escape hatch and bypasses both non-active states.
  */
 async function getTenantBySlug(pool, slug, includeArchived = false) {
@@ -124,24 +162,31 @@ async function getTenantBySlug(pool, slug, includeArchived = false) {
         if (!includeArchived && tenant.status === "suspended") {
             throw new core_1.TenantSuspendedError(tenant.id);
         }
+        if (!includeArchived && tenant.status === "pending") {
+            throw new core_1.TenantPendingError(tenant.id);
+        }
         return tenant;
     });
 }
-async function listTenants(pool, pagination) {
+/**
+ * List tenants in one status, `active` by default. Pending, suspended and
+ * archived tenants appear only when that status is asked for.
+ */
+async function listTenants(pool, pagination, status = "active") {
     return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
         const limit = pagination.limit ?? 50;
         let res;
         if (pagination.cursor) {
             res = await client.query(`SELECT * FROM tenants
-         WHERE status = 'active' AND id > $1
+         WHERE status = $3 AND id > $1
          ORDER BY id ASC
-         LIMIT $2`, [pagination.cursor, limit + 1]);
+         LIMIT $2`, [pagination.cursor, limit + 1, status]);
         }
         else {
             res = await client.query(`SELECT * FROM tenants
-         WHERE status = 'active'
+         WHERE status = $2
          ORDER BY id ASC
-         LIMIT $1`, [limit + 1]);
+         LIMIT $1`, [limit + 1, status]);
         }
         const rows = res.rows;
         const has_more = rows.length > limit;
@@ -164,6 +209,14 @@ async function updateTenant(pool, id, patch) {
             values.push(patch.name);
         }
         if (patch.slug !== undefined) {
+            // Schema- and database-per-tenant storage is named from the slug, so
+            // changing it would detach the tenant from its storage and free the old
+            // name for another tenant.
+            const strategy = existing.rows[0].isolation_strategy;
+            if (patch.slug !== existing.rows[0].slug &&
+                (strategy === "SCHEMA_PER_TENANT" || strategy === "DB_PER_TENANT")) {
+                throw new core_1.ValidationError(`Slug cannot be changed for a ${strategy} tenant`, { tenant_id: id, isolation_strategy: strategy });
+            }
             sets.push(`slug = $${idx++}`);
             values.push(patch.slug);
         }
@@ -194,8 +247,10 @@ async function updateTenant(pool, id, patch) {
 // ---------------------------------------------------------------------------
 // Tenant lifecycle
 //
-// States: active -> {suspended, archived} -> (purged). Transitions:
-//   createTenant   (none)               -> active
+// States: [pending ->] active -> {suspended, archived} -> (purged). Transitions:
+//   createTenant   (none)               -> active, or pending for a tenant with
+//                                          its own schema or database
+//   activateTenant pending              -> active      (storage provisioned)
 //   suspendTenant  active               -> suspended  (reversible, blocks access)
 //   resumeTenant   suspended | archived -> active      (reverses suspend/archive)
 //   archiveTenant  active | suspended   -> archived    (soft delete, reversible)
@@ -208,8 +263,8 @@ async function updateTenant(pool, id, patch) {
 // Descendant rules, tested against real Postgres in packages/integration-tests:
 //   * suspend / archive block when the tenant has an ACTIVE child
 //     (TenantHasChildrenError). They act leaf-first and never cascade.
-//   * resume / create require the parent to be ACTIVE, so the invariant "an
-//     active tenant's parent is active" always holds.
+//   * resume / activate / create / move require the parent to be ACTIVE, so
+//     the invariant "an active tenant's parent is active" always holds.
 //   * purge requires an empty subtree (no children of ANY status).
 // ---------------------------------------------------------------------------
 /**
@@ -218,7 +273,11 @@ async function updateTenant(pool, id, patch) {
  * suspended rows, because lifecycle operations act on exactly those states.
  */
 async function loadForTransition(client, id) {
-    const res = await client.query(`SELECT * FROM tenants WHERE id = $1`, [id]);
+    // Transitions read the tree (children, parent) to keep "an active tenant's
+    // parent is active", so they must not interleave with a move. FOR UPDATE
+    // then orders them against creates and other transitions on this tenant.
+    await lockTree(client, "shared");
+    const res = await client.query(`SELECT * FROM tenants WHERE id = $1 FOR UPDATE`, [id]);
     if (res.rows.length === 0) {
         throw new core_1.TenantNotFoundError(id);
     }
@@ -278,7 +337,9 @@ async function resumeTenant(pool, id) {
             throw new core_1.InvalidTenantStateError(id, tenant.status, "resume", ["suspended", "archived"]);
         }
         if (tenant.parent_id) {
-            const parentRes = await client.query(`SELECT status FROM tenants WHERE id = $1`, [tenant.parent_id]);
+            // FOR SHARE: a concurrent suspend or archive of the parent waits for
+            // this resume and then sees an active child.
+            const parentRes = await client.query(`SELECT status FROM tenants WHERE id = $1 FOR SHARE`, [tenant.parent_id]);
             const parentStatus = parentRes.rows[0]?.status;
             if (parentStatus === "archived") {
                 throw new core_1.TenantArchivedError(tenant.parent_id);
@@ -291,6 +352,23 @@ async function resumeTenant(pool, id) {
         return res.rows[0];
     });
 }
+/**
+ * Activate a pending tenant once its schema or database has been provisioned.
+ * Rejects if the tenant is not pending, or if its parent is not active.
+ */
+async function activateTenant(pool, id) {
+    return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        const tenant = await loadForTransition(client, id);
+        if (tenant.status !== "pending") {
+            throw new core_1.InvalidTenantStateError(id, tenant.status, "activate", ["pending"]);
+        }
+        if (tenant.parent_id) {
+            await loadActiveParent(client, tenant.parent_id);
+        }
+        const res = await client.query(`UPDATE tenants SET status = 'active', updated_at = now() WHERE id = $1 RETURNING *`, [id]);
+        return res.rows[0];
+    });
+}
 /**
  * Soft-delete a tenant.
  *
@@ -302,21 +380,14 @@ async function deleteTenant(pool, id) {
 }
 async function moveTenant(pool, id, newParentId) {
     return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
-        // Lock both old and new parents to prevent concurrent moves
-        await client.query(`SELECT pg_advisory_xact_lock(('x' || substr(md5($1::text), 1, 16))::bit(64)::bigint)`, [id]);
-        await client.query(`SELECT pg_advisory_xact_lock(('x' || substr(md5($1::text), 1, 16))::bit(64)::bigint)`, [newParentId]);
+        await lockTree(client, "exclusive");
         // Load tenant being moved
         const tenantRes = await client.query(`SELECT * FROM tenants WHERE id = $1 AND status != 'archived'`, [id]);
         if (tenantRes.rows.length === 0) {
             throw new core_1.TenantNotFoundError(id);
         }
         const tenant = tenantRes.rows[0];
-        // Load new parent
-        const newParentRes = await client.query(`SELECT * FROM tenants WHERE id = $1 AND status != 'archived'`, [newParentId]);
-        if (newParentRes.rows.length === 0) {
-            throw new core_1.TenantNotFoundError(newParentId);
-        }
-        const newParent = newParentRes.rows[0];
+        const newParent = await loadActiveParent(client, newParentId);
         // Cycle detection: newParent must not be a descendant of tenant.
         // Check if the moving tenant's ID appears in the new parent's ancestry_path
         // (which would mean the new parent is a descendant of the moving tenant).
@@ -373,6 +444,7 @@ async function batchCreateTenants(pool, inputs) {
     const errors = [];
     try {
         await (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+            await lockTree(client, "shared");
             // Map of slug → created tenant for intra-batch parent references
             const slugMap = new Map();
             for (let i = 0; i < inputs.length; i++) {
@@ -386,19 +458,12 @@ async function batchCreateTenants(pool, inputs) {
                         parentNode = batchParent;
                     }
                     else {
-                        // Look up in DB
-                        const parentRes = await client.query(`SELECT * FROM tenants WHERE id = $1 AND status != 'archived'`, [parentId]);
-                        if (parentRes.rows.length === 0) {
-                            throw new core_1.TenantNotFoundError(parentId);
-                        }
-                        parentNode = parentRes.rows[0];
+                        parentNode = await loadActiveParent(client, parentId);
                     }
-                    // Advisory lock on parent
-                    await client.query(`SELECT pg_advisory_xact_lock(('x' || substr(md5($1::text), 1, 16))::bit(64)::bigint)`, [parentId]);
                     const ancestry_path = (0, core_1.appendToPath)(parentNode.ancestry_path, parentNode.id);
                     const regionId = input.region_id ?? parentNode.region_id ?? null;
                     const res = await client.query(`INSERT INTO tenants (parent_id, ancestry_path, depth, name, slug, config, metadata, isolation_strategy, status, region_id)
-             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'active', $9)
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
              RETURNING *`, [
                         parentId,
                         ancestry_path,
@@ -408,6 +473,7 @@ async function batchCreateTenants(pool, inputs) {
                         JSON.stringify(input.config ?? {}),
                         JSON.stringify(input.metadata ?? {}),
                         input.isolation_strategy ?? "SHARED_RLS",
+                        initialStatus(input),
                         regionId,
                     ]);
                     const tenant = res.rows[0];
@@ -418,13 +484,14 @@ async function batchCreateTenants(pool, inputs) {
                     // Root tenant
                     const rootRegionId = input.region_id ?? null;
                     const res = await client.query(`INSERT INTO tenants (parent_id, ancestry_path, depth, name, slug, config, metadata, isolation_strategy, status, region_id)
-             VALUES (NULL, '/', 0, $1, $2, $3, $4, $5, 'active', $6)
+             VALUES (NULL, '/', 0, $1, $2, $3, $4, $5, $6, $7)
              RETURNING *`, [
                         input.name,
                         input.slug,
                         JSON.stringify(input.config ?? {}),
                         JSON.stringify(input.metadata ?? {}),
                         input.isolation_strategy ?? "SHARED_RLS",
+                        initialStatus(input),
                         rootRegionId,
                     ]);
                     const tenant = res.rows[0];