@stratum-hq/lib 1.2.1 → 1.4.0

package/dist/services/key-rotation-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"key-rotation-service.js","sourceRoot":"","sources":["../../src/services/key-rotation-service.ts"],"names":[],"mappings":";;AAqBA,kDA6DC;AAjFD,wDAAqD;AACrD,4CAAyC;AAOzC,+EAA+E;AAC/E,MAAM,SAAS,GAAG,sCAAsC,CAAC;AAEzD;;;;;;;;GAQG;AACI,KAAK,UAAU,mBAAmB,CACvC,IAAa,EACb,cAAsB,EACtB,cAAsB,EACtB,YAAoB,GAAG;IAEvB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,sEAAsE;IACtE,IAAI,YAAY,GAAG,SAAS,CAAC;IAC7B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;;yCAEiC,EACjC,CAAC,YAAY,EAAE,SAAS,CAAC,CAC1B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC;gBAChC,MAAM,WAAW,GAAG,IAAA,qBAAS,EAAC,aAAa,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;gBAC7E,MAAM,MAAM,CAAC,KAAK,CAChB,wEAAwE,EACxE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CACtC,CAAC;YACJ,CAAC;YACD,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,WAAW,IAAI,KAAK,CAAC;QACrB,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM;IAC/B,CAAC;IAED,gEAAgE;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;;yCAEiC,EACjC,CAAC,aAAa,EAAE,SAAS,CAAC,CAC3B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,WAAW,GAAG,IAAA,qBAAS,EAAC,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;gBAC/E,MAAM,MAAM,CAAC,KAAK,CAChB,oDAAoD,EACpD,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CACtB,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,YAAY,IAAI,KAAK,CAAC;QACtB,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM;IAC/B,CAAC;IAED,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;AACjF,CAAC"}
+{"version":3,"file":"key-rotation-service.js","sourceRoot":"","sources":["../../src/services/key-rotation-service.ts"],"names":[],"mappings":";;AAsDA,kDAwFC;AA7ID,wDAAqD;AACrD,2CAAmD;AACnD,4CAA8E;AAiB9E,+EAA+E;AAC/E,MAAM,SAAS,GAAG,sCAAsC,CAAC;AAIzD,+EAA+E;AAC/E,4EAA4E;AAC5E,0CAA0C;AAC1C,SAAS,WAAW,CAAC,SAAiB,EAAE,cAAsB,EAAE,cAAsB;IACpF,MAAM,SAAS,GAAG,IAAA,kCAAsB,EAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACpE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAA,kCAAsB,EAAC,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,IAAA,kCAAsB,EAAC,SAAS,EAAE,cAAc,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACnG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,mBAAmB,CACvC,IAAa,EACb,cAAsB,EACtB,cAAsB,EACtB,YAAoB,GAAG;IAEvB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,UAAU,GAA+B,EAAE,CAAC;IAElD,sEAAsE;IACtE,IAAI,YAAY,GAAG,SAAS,CAAC;IAC7B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;;yCAEiC,EACjC,CAAC,YAAY,EAAE,SAAS,CAAC,CAC1B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;gBACvE,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACvC,cAAc,EAAE,CAAC;gBACnB,CAAC;qBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACzC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3D,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,CAAC,KAAK,CAChB,wEAAwE,EACxE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CACxC,CAAC;oBACF,WAAW,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM;IAC/B,CAAC;IAED,gEAAgE;IAChE,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;;yCAEiC,EACjC,CAAC,aAAa,EAAE,SAAS,CAAC,CAC3B,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;gBAC7E,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACvC,cAAc,EAAE,CAAC;gBACnB,CAAC;qBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACzC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,CAAC,KAAK,CAChB,oDAAoD,EACpD,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CACxB,CAAC;oBACF,YAAY,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM;IAC/B,CAAC;IAED,8EAA8E;IAC9E,qFAAqF;IACrF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,GAAG,YAAY,GAAG,cAAc,KAAK,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,sBAAe,CACvB,6HAA6H,EAC7H,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAClC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,sBAAsB,EAAE,WAAW;QACnC,gBAAgB,EAAE,YAAY;QAC9B,eAAe,EAAE,cAAc;QAC/B,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/services/permission-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-service.d.ts","sourceRoot":"","sources":["../../src/services/permission-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EAQxB,MAAM,kBAAkB,CAAC;AAE1B;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CA2F7C;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CA0C3B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAiE3B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA0Df"}
+{"version":3,"file":"permission-service.d.ts","sourceRoot":"","sources":["../../src/services/permission-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EAUxB,MAAM,kBAAkB,CAAC;AAE1B;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CA2F7C;AAuBD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CA2C3B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CA4E3B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAqEf"}

package/dist/services/permission-service.js

@@ -5,6 +5,7 @@ exports.createPermission = createPermission;
 exports.updatePermission = updatePermission;
 exports.deletePermission = deletePermission;
 const pool_helpers_js_1 = require("../pool-helpers.js");
+const tenant_service_js_1 = require("./tenant-service.js");
 const core_1 = require("@stratum-hq/core");
 /**
  * Resolve effective permissions for a tenant by batch-loading all ancestor
@@ -85,6 +86,20 @@ async function resolvePermissions(pool, tenantId) {
         return Object.fromEntries(resolved);
     });
 }
+/**
+ * Enforce ancestor delegation modes on a descendant write. A LOCKED ancestor
+ * blocks the key entirely. An INHERITED ancestor lets descendants override the
+ * value only: they may not change the mode or re-delegate the key.
+ */
+function assertAncestorsAllowMode(ancestorPolicies, key, mode) {
+    const locker = ancestorPolicies.find((p) => p.mode === core_1.PermissionMode.LOCKED);
+    if (locker) {
+        throw new core_1.PermissionLockedError(key, locker.source_tenant_id);
+    }
+    if (ancestorPolicies.length > 0 && mode !== core_1.PermissionMode.INHERITED) {
+        throw new core_1.ForbiddenError(`Permission '${key}' is INHERITED from an ancestor; descendants may override its value but not change its mode or re-delegate it`);
+    }
+}
 /**
  * Create a new permission policy for a tenant.
  * Rejects if the key is already LOCKED by an ancestor.
@@ -99,14 +114,11 @@ async function createPermission(pool, tenantId, input) {
         const ancestorIds = (0, core_1.parseAncestryPath)(tenantRes.rows[0].ancestry_path);
         // Exclude self (ancestry_path does not include self)
         if (ancestorIds.length > 0) {
-            const lockedRes = await client.query(`SELECT * FROM permission_policies
+            const restrictingRes = await client.query(`SELECT * FROM permission_policies
          WHERE tenant_id = ANY($1)
            AND key = $2
-           AND mode = $3`, [ancestorIds, input.key, core_1.PermissionMode.LOCKED]);
-            if (lockedRes.rows.length > 0) {
-                const locker = lockedRes.rows[0];
-                throw new core_1.PermissionLockedError(input.key, locker.source_tenant_id);
-            }
+           AND mode = ANY($3)`, [ancestorIds, input.key, [core_1.PermissionMode.LOCKED, core_1.PermissionMode.INHERITED]]);
+            assertAncestorsAllowMode(restrictingRes.rows, input.key, input.mode ?? core_1.PermissionMode.INHERITED);
         }
         const res = await client.query(`INSERT INTO permission_policies (tenant_id, key, value, mode, revocation_mode, source_tenant_id)
        VALUES ($1, $2, $3, $4, $5, $1)
@@ -137,14 +149,18 @@ async function updatePermission(pool, tenantId, policyId, input) {
         }
         const ancestorIds = (0, core_1.parseAncestryPath)(tenantRes.rows[0].ancestry_path);
         if (ancestorIds.length > 0) {
-            const lockedRes = await client.query(`SELECT * FROM permission_policies
+            const restrictingRes = await client.query(`SELECT * FROM permission_policies
          WHERE tenant_id = ANY($1)
            AND key = $2
-           AND mode = $3`, [ancestorIds, current.key, core_1.PermissionMode.LOCKED]);
-            if (lockedRes.rows.length > 0) {
-                const locker = lockedRes.rows[0];
-                throw new core_1.PermissionLockedError(current.key, locker.source_tenant_id);
-            }
+           AND mode = ANY($3)`, [ancestorIds, current.key, [core_1.PermissionMode.LOCKED, core_1.PermissionMode.INHERITED]]);
+            assertAncestorsAllowMode(restrictingRes.rows, current.key, input.mode ?? current.mode);
+        }
+        // A PERMANENT policy cannot be deleted, so it must not be possible to
+        // switch it to a deletable revocation mode either.
+        if (current.revocation_mode === core_1.RevocationMode.PERMANENT &&
+            input.revocation_mode !== undefined &&
+            input.revocation_mode !== core_1.RevocationMode.PERMANENT) {
+            throw new core_1.PermissionRevocationDeniedError(current.key);
         }
         const sets = [];
         const values = [];
@@ -185,17 +201,25 @@ async function deletePermission(pool, tenantId, policyId) {
                 throw new core_1.PermissionRevocationDeniedError(policy.key);
             case core_1.RevocationMode.CASCADE: {
                 // Recursively delete from all descendants. Match descendants by the
-                // stable, ID-based ancestry_path (this tenant's id appears as a path
-                // segment of every descendant) so revocation reaches all current
+                // stable, ID-based ancestry_path so revocation reaches all current
                 // descendants regardless of any slug rename. ancestry_ltree is derived
-                // from slugs and must not scope revocation.
+                // from slugs and must not scope revocation. A prefix match lets
+                // idx_tenant_ancestry_path_prefix (028) serve the query.
+                await (0, tenant_service_js_1.lockTree)(client, "shared");
+                const tenantRes = await client.query(`SELECT ancestry_path FROM tenants WHERE id = $1`, [tenantId]);
+                // A concurrent purge can remove the tenant after the policy was read.
+                if (tenantRes.rows.length === 0) {
+                    throw new core_1.TenantNotFoundError(tenantId);
+                }
+                const subtreePath = (0, core_1.appendToPath)(tenantRes.rows[0].ancestry_path, tenantId);
                 const descendantsRes = await client.query(`SELECT id FROM tenants
-           WHERE id != $1
-             AND (ancestry_path LIKE '%/' || $1 || '/%' OR ancestry_path LIKE '%/' || $1)`, [tenantId]);
+           WHERE ancestry_path = $1 OR ancestry_path LIKE $2`, [subtreePath, `${subtreePath}/%`]);
                 const descendantIds = descendantsRes.rows.map((r) => r.id);
+                // A descendant's own PERMANENT policy on the same key is not
+                // revocable, so the cascade leaves it in place.
                 if (descendantIds.length > 0) {
                     await client.query(`DELETE FROM permission_policies
-             WHERE tenant_id = ANY($1) AND key = $2`, [descendantIds, policy.key]);
+             WHERE tenant_id = ANY($1) AND key = $2 AND revocation_mode != $3`, [descendantIds, policy.key, core_1.RevocationMode.PERMANENT]);
                 }
                 await client.query(`DELETE FROM permission_policies WHERE id = $1`, [policyId]);
                 break;

package/dist/services/permission-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-service.js","sourceRoot":"","sources":["../../src/services/permission-service.ts"],"names":[],"mappings":";;AAoBA,gDA8FC;AAMD,4CA8CC;AAKD,4CAsEC;AAKD,4CA8DC;AAnTD,wDAAiE;AACjE,2CAY0B;AAE1B;;;GAGG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACrD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QACpD,eAAe;QACf,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE1C,sEAAsE;QACtE,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,6DAA6D,EAC7D,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,kDAAkD;QAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;QAEvD,KAAK,MAAM,eAAe,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAErD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAE1C,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;oBACrB,gEAAgE;oBAChE,SAAS;gBACX,CAAC;gBAED,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;oBACpB,KAAK,qBAAc,CAAC,MAAM;wBACxB,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;4BACvB,SAAS,EAAE,MAAM,CAAC,EAAE;4BACpB,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,gBAAgB,EAAE,eAAe;4BACjC,MAAM,EAAE,IAAI;4BACZ,SAAS,EAAE,KAAK;yBACjB,CAAC,CAAC;wBACH,MAAM;oBAER,KAAK,qBAAc,CAAC,SAAS;wBAC3B,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;4BACvB,SAAS,EAAE,MAAM,CAAC,EAAE;4BACpB,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,gBAAgB,EAAE,eAAe;4BACjC,MAAM,EAAE,KAAK;4BACb,SAAS,EAAE,IAAI;yBAChB,CAAC,CAAC;wBACH,MAAM;oBAER,KAAK,qBAAc,CAAC,SAAS,CAAC;oBAC9B;wBACE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;4BACvB,SAAS,EAAE,MAAM,CAAC,EAAE;4BACpB,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,gBAAgB,EAAE,eAAe;4BACjC,MAAM,EAAE,KAAK;4BACb,SAAS,EAAE,KAAK;yBACjB,CAAC,CAAC;wBACH,MAAM;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,KAA4B;IAE5B,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,yDAAyD;QACzD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,qDAAqD;QACrD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC;;;yBAGiB,EACjB,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,qBAAc,CAAC,MAAM,CAAC,CAChD,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,4BAAqB,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb;YACE,QAAQ;YACR,KAAK,CAAC,GAAG;YACT,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;YACnC,KAAK,CAAC,IAAI,IAAI,qBAAc,CAAC,SAAS;YACtC,KAAK,CAAC,eAAe,IAAI,qBAAc,CAAC,OAAO;SAChD,CACF,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,QAAgB,EAChB,KAA4B;IAE5B,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,oEAAoE,EACpE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACrB,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAuB,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjC,2CAA2C;QAC3C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC;;;yBAGiB,EACjB,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,qBAAc,CAAC,MAAM,CAAC,CAClD,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,4BAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,sBAAsB,GAAG,EAAE,EAAE,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEtB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,kCAAkC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,cAAc,EAClF,MAAM,CACP,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,QAAgB;IAEhB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,oEAAoE,EACpE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACrB,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAuB,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEhC,QAAQ,MAAM,CAAC,eAAe,EAAE,CAAC;YAC/B,KAAK,qBAAc,CAAC,SAAS;gBAC3B,MAAM,IAAI,sCAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAExD,KAAK,qBAAc,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5B,oEAAoE;gBACpE,qEAAqE;gBACrE,iEAAiE;gBACjE,uEAAuE;gBACvE,4CAA4C;gBAC5C,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;;0FAEgF,EAChF,CAAC,QAAQ,CAAC,CACX,CAAC;gBACF,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAE3D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC7B,MAAM,MAAM,CAAC,KAAK,CAChB;oDACwC,EACxC,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAC5B,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,CAAC,KAAK,CAChB,+CAA+C,EAC/C,CAAC,QAAQ,CAAC,CACX,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,qBAAc,CAAC,IAAI,CAAC;YACzB,OAAO,CAAC,CAAC,CAAC;gBACR,mEAAmE;gBACnE,qEAAqE;gBACrE,kEAAkE;gBAClE,4DAA4D;gBAC5D,MAAM,MAAM,CAAC,KAAK,CAChB,+CAA+C,EAC/C,CAAC,QAAQ,CAAC,CACX,CAAC;gBACF,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"permission-service.js","sourceRoot":"","sources":["../../src/services/permission-service.ts"],"names":[],"mappings":";;AAuBA,gDA8FC;AA2BD,4CA+CC;AAKD,4CAiFC;AAKD,4CAyEC;AAlWD,wDAAiE;AACjE,2DAA+C;AAC/C,2CAc0B;AAE1B;;;GAGG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACrD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QACpD,eAAe;QACf,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE1C,sEAAsE;QACtE,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,6DAA6D,EAC7D,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,kDAAkD;QAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;QAEvD,KAAK,MAAM,eAAe,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAErD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAE1C,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;oBACrB,gEAAgE;oBAChE,SAAS;gBACX,CAAC;gBAED,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;oBACpB,KAAK,qBAAc,CAAC,MAAM;wBACxB,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;4BACvB,SAAS,EAAE,MAAM,CAAC,EAAE;4BACpB,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,gBAAgB,EAAE,eAAe;4BACjC,MAAM,EAAE,IAAI;4BACZ,SAAS,EAAE,KAAK;yBACjB,CAAC,CAAC;wBACH,MAAM;oBAER,KAAK,qBAAc,CAAC,SAAS;wBAC3B,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;4BACvB,SAAS,EAAE,MAAM,CAAC,EAAE;4BACpB,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,gBAAgB,EAAE,eAAe;4BACjC,MAAM,EAAE,KAAK;4BACb,SAAS,EAAE,IAAI;yBAChB,CAAC,CAAC;wBACH,MAAM;oBAER,KAAK,qBAAc,CAAC,SAAS,CAAC;oBAC9B;wBACE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;4BACvB,SAAS,EAAE,MAAM,CAAC,EAAE;4BACpB,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,gBAAgB,EAAE,eAAe;4BACjC,MAAM,EAAE,KAAK;4BACb,SAAS,EAAE,KAAK;yBACjB,CAAC,CAAC;wBACH,MAAM;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAC/B,gBAAoC,EACpC,GAAW,EACX,IAAoB;IAEpB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAc,CAAC,MAAM,CAAC,CAAC;IAC9E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,4BAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,qBAAc,CAAC,SAAS,EAAE,CAAC;QACrE,MAAM,IAAI,qBAAc,CACtB,eAAe,GAAG,+GAA+G,CAClI,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,KAA4B;IAE5B,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,yDAAyD;QACzD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,qDAAqD;QACrD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;;;8BAGsB,EACtB,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,qBAAc,CAAC,MAAM,EAAE,qBAAc,CAAC,SAAS,CAAC,CAAC,CAC5E,CAAC;YACF,wBAAwB,CACtB,cAAc,CAAC,IAAI,EACnB,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,IAAI,IAAI,qBAAc,CAAC,SAAS,CACvC,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb;YACE,QAAQ;YACR,KAAK,CAAC,GAAG;YACT,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;YACnC,KAAK,CAAC,IAAI,IAAI,qBAAc,CAAC,SAAS;YACtC,KAAK,CAAC,eAAe,IAAI,qBAAc,CAAC,OAAO;SAChD,CACF,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,QAAgB,EAChB,KAA4B;IAE5B,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,oEAAoE,EACpE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACrB,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAuB,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjC,2CAA2C;QAC3C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;;;8BAGsB,EACtB,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,qBAAc,CAAC,MAAM,EAAE,qBAAc,CAAC,SAAS,CAAC,CAAC,CAC9E,CAAC;YACF,wBAAwB,CACtB,cAAc,CAAC,IAAI,EACnB,OAAO,CAAC,GAAG,EACX,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAC3B,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,mDAAmD;QACnD,IACE,OAAO,CAAC,eAAe,KAAK,qBAAc,CAAC,SAAS;YACpD,KAAK,CAAC,eAAe,KAAK,SAAS;YACnC,KAAK,CAAC,eAAe,KAAK,qBAAc,CAAC,SAAS,EAClD,CAAC;YACD,MAAM,IAAI,sCAA+B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,sBAAsB,GAAG,EAAE,EAAE,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEtB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,kCAAkC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,cAAc,EAClF,MAAM,CACP,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,QAAgB;IAEhB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,oEAAoE,EACpE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACrB,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAuB,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEhC,QAAQ,MAAM,CAAC,eAAe,EAAE,CAAC;YAC/B,KAAK,qBAAc,CAAC,SAAS;gBAC3B,MAAM,IAAI,sCAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAExD,KAAK,qBAAc,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5B,oEAAoE;gBACpE,mEAAmE;gBACnE,uEAAuE;gBACvE,gEAAgE;gBAChE,yDAAyD;gBACzD,MAAM,IAAA,4BAAQ,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;gBACF,sEAAsE;gBACtE,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;gBAC1C,CAAC;gBACD,MAAM,WAAW,GAAG,IAAA,mBAAY,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;gBAC5E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;6DACmD,EACnD,CAAC,WAAW,EAAE,GAAG,WAAW,IAAI,CAAC,CAClC,CAAC;gBACF,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAE3D,6DAA6D;gBAC7D,gDAAgD;gBAChD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC7B,MAAM,MAAM,CAAC,KAAK,CAChB;8EACkE,EAClE,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE,qBAAc,CAAC,SAAS,CAAC,CACtD,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,CAAC,KAAK,CAChB,+CAA+C,EAC/C,CAAC,QAAQ,CAAC,CACX,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,qBAAc,CAAC,IAAI,CAAC;YACzB,OAAO,CAAC,CAAC,CAAC;gBACR,mEAAmE;gBACnE,qEAAqE;gBACrE,kEAAkE;gBAClE,4DAA4D;gBAC5D,MAAM,MAAM,CAAC,KAAK,CAChB,+CAA+C,EAC/C,CAAC,QAAQ,CAAC,CACX,CAAC;gBACF,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/region-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"region-service.d.ts","sourceRoot":"","sources":["../../src/services/region-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErF,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAU3F;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY1E;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQlE;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiDvG;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB3E;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvG"}
+{"version":3,"file":"region-service.d.ts","sourceRoot":"","sources":["../../src/services/region-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAQpB,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErF,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAU3F;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY1E;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQlE;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiDvG;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB3E;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvG"}

package/dist/services/region-service.js

@@ -7,6 +7,7 @@ exports.updateRegion = updateRegion;
 exports.deleteRegion = deleteRegion;
 exports.migrateRegion = migrateRegion;
 const pool_helpers_js_1 = require("../pool-helpers.js");
+const core_1 = require("@stratum-hq/core");
 async function createRegion(pool, input) {
     return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
         const res = await client.query(`INSERT INTO regions (display_name, slug, control_plane_url, is_primary, status, metadata)
@@ -20,7 +21,7 @@ async function getRegion(pool, id) {
         const res = await client.query(`SELECT id, display_name, slug, control_plane_url, NULL as database_url, is_primary, status, metadata, created_at::text, updated_at::text
        FROM regions WHERE id = $1`, [id]);
         if (res.rows.length === 0) {
-            throw new Error(`Region not found: ${id}`);
+            throw new core_1.RegionNotFoundError(id);
         }
         return res.rows[0];
     });
@@ -36,7 +37,7 @@ async function updateRegion(pool, id, input) {
     return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
         const existing = await client.query(`SELECT id FROM regions WHERE id = $1`, [id]);
         if (existing.rows.length === 0) {
-            throw new Error(`Region not found: ${id}`);
+            throw new core_1.RegionNotFoundError(id);
         }
         const sets = [];
         const values = [];
@@ -75,11 +76,11 @@ async function deleteRegion(pool, id) {
         // Ensure no tenants are assigned to this region
         const tenantCheck = await client.query(`SELECT COUNT(*) as count FROM tenants WHERE region_id = $1 AND status = 'active'`, [id]);
         if (parseInt(tenantCheck.rows[0].count, 10) > 0) {
-            throw new Error(`Cannot delete region ${id}: active tenants are still assigned to it`);
+            throw new core_1.RegionInUseError(id);
         }
         const res = await client.query(`DELETE FROM regions WHERE id = $1`, [id]);
         if (res.rowCount === 0) {
-            throw new Error(`Region not found: ${id}`);
+            throw new core_1.RegionNotFoundError(id);
         }
     });
 }
@@ -88,15 +89,15 @@ async function migrateRegion(pool, tenantId, newRegionId) {
         // Verify tenant exists
         const tenantRes = await client.query(`SELECT id FROM tenants WHERE id = $1 AND status != 'archived'`, [tenantId]);
         if (tenantRes.rows.length === 0) {
-            throw new Error(`Tenant not found: ${tenantId}`);
+            throw new core_1.TenantNotFoundError(tenantId);
         }
         // Verify target region exists and is active
         const regionRes = await client.query(`SELECT id, status FROM regions WHERE id = $1`, [newRegionId]);
         if (regionRes.rows.length === 0) {
-            throw new Error(`Region not found: ${newRegionId}`);
+            throw new core_1.RegionNotFoundError(newRegionId);
         }
         if (regionRes.rows[0].status !== "active") {
-            throw new Error(`Cannot migrate to region ${newRegionId}: region is not active`);
+            throw new core_1.RegionNotActiveError(newRegionId);
         }
         await client.query(`UPDATE tenants SET region_id = $2, updated_at = now() WHERE id = $1`, [tenantId, newRegionId]);
     });

package/dist/services/region-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"region-service.js","sourceRoot":"","sources":["../../src/services/region-service.ts"],"names":[],"mappings":";;AAIA,oCAUC;AAED,8BAYC;AAED,kCAQC;AAED,oCAiDC;AAED,oCAgBC;AAED,sCAsBC;AAlID,wDAAiE;AAG1D,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,KAAwB;IACxE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mJAE6I,EAC7I,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAC7J,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAa,EAAE,EAAU;IACvD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;kCAC4B,EAC5B,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;4CACsC,CACvC,CAAC;QACF,OAAO,GAAG,CAAC,IAAgB,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,EAAU,EAAE,KAAwB;IACpF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,mBAAmB,GAAG,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,wBAAwB,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,+BAA+B;YAC/B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;oCAC4B,EAC5B,CAAC,EAAE,CAAC,CACL,CAAC;YACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,sBAAsB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG;mJACqF,EAC7I,MAAM,CACP,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,EAAU;IAC1D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,gDAAgD;QAChD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,kFAAkF,EAClF,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAe,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,2CAA2C,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,QAAgB,EAAE,WAAmB;IACtF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,uBAAuB;QACvB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,+DAA+D,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClH,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACpG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,qBAAqB,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAK,SAAS,CAAC,IAAI,CAAC,CAAC,CAAwB,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,wBAAwB,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,MAAM,CAAC,KAAK,CAChB,qEAAqE,EACrE,CAAC,QAAQ,EAAE,WAAW,CAAC,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"region-service.js","sourceRoot":"","sources":["../../src/services/region-service.ts"],"names":[],"mappings":";;AAUA,oCAUC;AAED,8BAYC;AAED,kCAQC;AAED,oCAiDC;AAED,oCAgBC;AAED,sCAsBC;AAxID,wDAAiE;AACjE,2CAK0B;AAGnB,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,KAAwB;IACxE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mJAE6I,EAC7I,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAC7J,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAa,EAAE,EAAU;IACvD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;kCAC4B,EAC5B,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;4CACsC,CACvC,CAAC;QACF,OAAO,GAAG,CAAC,IAAgB,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,EAAU,EAAE,KAAwB;IACpF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,mBAAmB,GAAG,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,wBAAwB,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,+BAA+B;YAC/B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;oCAC4B,EAC5B,CAAC,EAAE,CAAC,CACL,CAAC;YACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,sBAAsB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG;mJACqF,EAC7I,MAAM,CACP,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,EAAU;IAC1D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,gDAAgD;QAChD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,kFAAkF,EAClF,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAe,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,uBAAgB,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,QAAgB,EAAE,WAAmB;IACtF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,uBAAuB;QACvB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,+DAA+D,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClH,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACpG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QACD,IAAK,SAAS,CAAC,IAAI,CAAC,CAAC,CAAwB,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,IAAI,2BAAoB,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,CAAC,KAAK,CAChB,qEAAqE,EACrE,CAAC,QAAQ,EAAE,WAAW,CAAC,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/retention-service.d.ts

@@ -8,7 +8,13 @@ export declare function purgeExpiredData(pool: pg.Pool, retentionDays?: number):
 }>;
 /**
  * GDPR Article 17 — Right to Erasure.
- * Hard-delete ALL data belonging to a specific tenant, in correct FK order.
+ * Hard-delete ALL data belonging to a specific tenant, in correct FK order,
+ * including its own schema (SCHEMA_PER_TENANT) or database (DB_PER_TENANT).
+ *
+ * The schema is dropped in the same transaction as the rows, so both go or
+ * neither does. DROP DATABASE cannot run in a transaction, so the database is
+ * dropped first: if that fails nothing has changed, and if removing the rows
+ * then fails, purging again completes (the drop is IF EXISTS).
  */
 export declare function purgeTenant(pool: pg.Pool, tenantId: string): Promise<void>;
 /**

package/dist/services/retention-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-service.d.ts","sourceRoot":"","sources":["../../src/services/retention-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAMpB;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,GAAE,MAA+B,GAC7C,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BpC;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA2BlC"}
+{"version":3,"file":"retention-service.d.ts","sourceRoot":"","sources":["../../src/services/retention-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAOpB;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,GAAE,MAA+B,GAC7C,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BpC;AA+BD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Df;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA2BlC"}

package/dist/services/retention-service.js

@@ -4,6 +4,7 @@ exports.purgeExpiredData = purgeExpiredData;
 exports.purgeTenant = purgeTenant;
 exports.exportTenantData = exportTenantData;
 const core_1 = require("@stratum-hq/core");
+const db_adapters_1 = require("@stratum-hq/db-adapters");
 const pool_helpers_js_1 = require("../pool-helpers.js");
 const DEFAULT_RETENTION_DAYS = 90;
 /**
@@ -28,18 +29,54 @@ async function purgeExpiredData(pool, retentionDays = DEFAULT_RETENTION_DAYS) {
         return { deleted_count: totalDeleted };
     });
 }
+// Guard: reject if tenant has children (FK RESTRICT would crash otherwise)
+async function assertNoChildren(client, tenantId) {
+    const childCheck = await client.query(`SELECT COUNT(*)::int AS count FROM tenants WHERE parent_id = $1`, [tenantId]);
+    const childCount = childCheck.rows[0].count;
+    if (childCount > 0) {
+        throw new core_1.StratumError(core_1.ErrorCode.TENANT_HAS_CHILDREN, `Cannot purge tenant ${tenantId}: has ${childCount} child tenant(s). Purge children first.`, 409, { tenant_id: tenantId, child_count: childCount });
+    }
+}
+/**
+ * Whether purge drops this tenant's schema or database. Only a tenant that was
+ * activated owns storage: a pending tenant's provisioning never completed, and
+ * may have failed because something else already held the name. The storage
+ * name is derived by the same db-adapters helpers provisioning uses.
+ */
+function ownsStorage(tenant, strategy) {
+    return tenant !== undefined && tenant.status !== "pending" && tenant.isolation_strategy === strategy;
+}
 /**
  * GDPR Article 17 — Right to Erasure.
- * Hard-delete ALL data belonging to a specific tenant, in correct FK order.
+ * Hard-delete ALL data belonging to a specific tenant, in correct FK order,
+ * including its own schema (SCHEMA_PER_TENANT) or database (DB_PER_TENANT).
+ *
+ * The schema is dropped in the same transaction as the rows, so both go or
+ * neither does. DROP DATABASE cannot run in a transaction, so the database is
+ * dropped first: if that fails nothing has changed, and if removing the rows
+ * then fails, purging again completes (the drop is IF EXISTS).
  */
 async function purgeTenant(pool, tenantId) {
-    await (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
-        // Guard: reject if tenant has children (FK RESTRICT would crash otherwise)
-        const childCheck = await client.query(`SELECT COUNT(*)::int AS count FROM tenants WHERE parent_id = $1`, [tenantId]);
-        const childCount = childCheck.rows[0].count;
-        if (childCount > 0) {
-            throw new core_1.StratumError(core_1.ErrorCode.TENANT_HAS_CHILDREN, `Cannot purge tenant ${tenantId}: has ${childCount} child tenant(s). Purge children first.`, 409, { tenant_id: tenantId, child_count: childCount });
+    const before = await (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        await assertNoChildren(client, tenantId);
+        const res = await client.query(`SELECT slug, isolation_strategy, status FROM tenants WHERE id = $1`, [tenantId]);
+        return res.rows[0];
+    });
+    if (ownsStorage(before, "DB_PER_TENANT")) {
+        const client = await pool.connect();
+        try {
+            await (0, db_adapters_1.dropDatabase)(client, before.slug);
+        }
+        finally {
+            client.release();
         }
+    }
+    await (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        // Lock the row first so a concurrent create under this tenant (which holds
+        // it FOR SHARE) finishes and is counted, rather than failing the delete.
+        const res = await client.query(`SELECT slug, isolation_strategy, status FROM tenants WHERE id = $1 FOR UPDATE`, [tenantId]);
+        const tenant = res.rows[0];
+        await assertNoChildren(client, tenantId);
         // Delete in FK-safe order (children before parents)
         await client.query(`DELETE FROM config_entries WHERE tenant_id = $1`, [tenantId]);
         await client.query(`DELETE FROM permission_policies WHERE tenant_id = $1`, [tenantId]);
@@ -56,6 +93,9 @@ async function purgeTenant(pool, tenantId) {
         await client.query(`DELETE FROM audit_logs WHERE tenant_id = $1 OR (resource_type = 'tenant' AND resource_id = $1::text)`, [tenantId]);
         // Finally, the tenant itself
         await client.query(`DELETE FROM tenants WHERE id = $1`, [tenantId]);
+        if (ownsStorage(tenant, "SCHEMA_PER_TENANT")) {
+            await (0, db_adapters_1.dropSchema)(client, tenant.slug);
+        }
     });
 }
 /**

package/dist/services/retention-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-service.js","sourceRoot":"","sources":["../../src/services/retention-service.ts"],"names":[],"mappings":";;AAUA,4CAkCC;AAMD,kCA+CC;AAMD,4CA8BC;AApID,2CAA2D;AAC3D,wDAAiE;AAEjE,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,gBAAwB,sBAAsB;IAE9C,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAEvC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,qEAAqE;QACrE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,sDAAsD,EACtD,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC;QAEzC,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,kDAAkD,EAClD,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAErC,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,8CAA8C,EAC9C,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAErC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,QAAgB;IAEhB,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,2EAA2E;QAC3E,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,iEAAiE,EACjE,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,UAAU,GAAW,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAY,CACpB,gBAAS,CAAC,mBAAmB,EAC7B,uBAAuB,QAAQ,SAAS,UAAU,yCAAyC,EAC3F,GAAG,EACH,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CACjD,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,MAAM,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,MAAM,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEzE,iDAAiD;QACjD,MAAM,MAAM,CAAC,KAAK,CAChB,mGAAmG,EACnG,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAChB,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5E,kBAAkB;QAClB,MAAM,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnF,aAAa;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,sGAAsG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvI,6BAA6B;QAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1G,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,iHAAiH,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClK,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mHAAmH,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrK,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1G,MAAM,iBAAiB,GAAG,MAAM,MAAM,CAAC,KAAK,CAC1C,uGAAuG,EACvG,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClG,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5G,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;YAC9B,cAAc,EAAE,aAAa,CAAC,IAAI;YAClC,mBAAmB,EAAE,WAAW,CAAC,IAAI;YACrC,QAAQ,EAAE,OAAO,CAAC,IAAI;YACtB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,cAAc,EAAE,aAAa,CAAC,IAAI;YAClC,kBAAkB,EAAE,iBAAiB,CAAC,IAAI;YAC1C,UAAU,EAAE,SAAS,CAAC,IAAI;YAC1B,eAAe,EAAE,cAAc,CAAC,IAAI;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"retention-service.js","sourceRoot":"","sources":["../../src/services/retention-service.ts"],"names":[],"mappings":";;AAWA,4CAkCC;AAyCD,kCA+DC;AAMD,4CA8BC;AAxLD,2CAA4E;AAC5E,yDAAmE;AACnE,wDAAiE;AAEjE,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,gBAAwB,sBAAsB;IAE9C,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAEvC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,qEAAqE;QACrE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,sDAAsD,EACtD,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC;QAEzC,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,kDAAkD,EAClD,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAErC,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,8CAA8C,EAC9C,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,YAAY,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAErC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAID,2EAA2E;AAC3E,KAAK,UAAU,gBAAgB,CAAC,MAAqB,EAAE,QAAgB;IACrE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,iEAAiE,EACjE,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,MAAM,UAAU,GAAW,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAY,CACpB,gBAAS,CAAC,mBAAmB,EAC7B,uBAAuB,QAAQ,SAAS,UAAU,yCAAyC,EAC3F,GAAG,EACH,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAiC,EAAE,QAA0C;IAChG,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC;AACvG,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACrD,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oEAAoE,EACpE,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,IAAI,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAA,0BAAY,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,+EAA+E,EAC/E,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzC,oDAAoD;QACpD,MAAM,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,MAAM,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEzE,iDAAiD;QACjD,MAAM,MAAM,CAAC,KAAK,CAChB,mGAAmG,EACnG,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAChB,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5E,kBAAkB;QAClB,MAAM,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnF,aAAa;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,sGAAsG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvI,6BAA6B;QAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEpE,IAAI,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAA,wBAAU,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1G,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,iHAAiH,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClK,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mHAAmH,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrK,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1G,MAAM,iBAAiB,GAAG,MAAM,MAAM,CAAC,KAAK,CAC1C,uGAAuG,EACvG,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClG,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5G,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;YAC9B,cAAc,EAAE,aAAa,CAAC,IAAI;YAClC,mBAAmB,EAAE,WAAW,CAAC,IAAI;YACrC,QAAQ,EAAE,OAAO,CAAC,IAAI;YACtB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,cAAc,EAAE,aAAa,CAAC,IAAI;YAClC,kBAAkB,EAAE,iBAAiB,CAAC,IAAI;YAC1C,UAAU,EAAE,SAAS,CAAC,IAAI;YAC1B,eAAe,EAAE,cAAc,CAAC,IAAI;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/role-service.d.ts

@@ -37,6 +37,11 @@ export declare function removeRoleFromKey(pool: pg.Pool, keyId: string): Promise
  * asks. Assigning a role therefore governs authorization everywhere.
  */
 export declare function resolveEffectiveScopes(pool: pg.Pool, keyId: string): Promise<string[]>;
+/**
+ * {@link resolveEffectiveScopes} on a client the caller already holds, so a
+ * caller inside withClient does not need a second pool connection.
+ */
+export declare function resolveEffectiveScopesOnClient(client: pg.PoolClient, keyId: string): Promise<string[]>;
 /**
  * Resolve effective scopes for an API key. Thin alias over
  * {@link resolveEffectiveScopes}, kept as the public facade name.
@@ -59,6 +64,8 @@ export declare function resolveKeyScopes(pool: pg.Pool, keyId: string): Promise<
  * authorizing the assignment.
  */
 export declare function assignRole(pool: pg.Pool, principalType: string, principalId: string, roleId: string, tenantId?: string): Promise<boolean>;
+/** The role currently assigned to a principal, or null when it has none. */
+export declare function getPrincipalRoleId(pool: pg.Pool, principalType: string, principalId: string): Promise<string | null>;
 /** Remove a principal's role assignment. Returns true if one was removed. */
 export declare function removeRole(pool: pg.Pool, principalType: string, principalId: string): Promise<boolean>;
 /**

package/dist/services/role-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-service.d.ts","sourceRoot":"","sources":["../../src/services/role-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAUrF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQ7E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAcjF;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAoCxG;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5E;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpG;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtF;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAc5F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEhF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,6EAA6E;AAC7E,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB"}
+{"version":3,"file":"role-service.d.ts","sourceRoot":"","sources":["../../src/services/role-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAUrF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQ7E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAcjF;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAoCxG;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ5E;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpG;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtF;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE5F;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAY5G;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEhF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,4EAA4E;AAC5E,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED,6EAA6E;AAC7E,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB"}

package/dist/services/role-service.js

@@ -8,8 +8,10 @@ exports.deleteRole = deleteRole;
 exports.assignRoleToKey = assignRoleToKey;
 exports.removeRoleFromKey = removeRoleFromKey;
 exports.resolveEffectiveScopes = resolveEffectiveScopes;
+exports.resolveEffectiveScopesOnClient = resolveEffectiveScopesOnClient;
 exports.resolveKeyScopes = resolveKeyScopes;
 exports.assignRole = assignRole;
+exports.getPrincipalRoleId = getPrincipalRoleId;
 exports.removeRole = removeRole;
 exports.resolvePrincipalScopes = resolvePrincipalScopes;
 const pool_helpers_js_1 = require("../pool-helpers.js");
@@ -94,17 +96,22 @@ async function removeRoleFromKey(pool, keyId) {
  * asks. Assigning a role therefore governs authorization everywhere.
  */
 async function resolveEffectiveScopes(pool, keyId) {
-    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
-        const res = await client.query(`SELECT ak.scopes, r.scopes as role_scopes
-       FROM api_keys ak
-       LEFT JOIN roles r ON r.id = ak.role_id
-       WHERE ak.id = $1 AND ak.revoked_at IS NULL`, [keyId]);
-        if (res.rows.length === 0)
-            return ["read"];
-        const row = res.rows[0];
-        // Role scopes override key scopes when a role is assigned.
-        return row.role_scopes ?? row.scopes ?? ["read"];
-    });
+    return (0, pool_helpers_js_1.withClient)(pool, (client) => resolveEffectiveScopesOnClient(client, keyId));
+}
+/**
+ * {@link resolveEffectiveScopes} on a client the caller already holds, so a
+ * caller inside withClient does not need a second pool connection.
+ */
+async function resolveEffectiveScopesOnClient(client, keyId) {
+    const res = await client.query(`SELECT ak.scopes, r.scopes as role_scopes
+     FROM api_keys ak
+     LEFT JOIN roles r ON r.id = ak.role_id
+     WHERE ak.id = $1 AND ak.revoked_at IS NULL`, [keyId]);
+    if (res.rows.length === 0)
+        return ["read"];
+    const row = res.rows[0];
+    // Role scopes override key scopes when a role is assigned.
+    return row.role_scopes ?? row.scopes ?? ["read"];
 }
 /**
  * Resolve effective scopes for an API key. Thin alias over
@@ -144,6 +151,13 @@ async function assignRole(pool, principalType, principalId, roleId, tenantId) {
         return res.rows.length > 0;
     });
 }
+/** The role currently assigned to a principal, or null when it has none. */
+async function getPrincipalRoleId(pool, principalType, principalId) {
+    return (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        const res = await client.query(`SELECT role_id FROM principal_roles WHERE principal_type = $1 AND principal_id = $2`, [principalType, principalId]);
+        return res.rows[0]?.role_id ?? null;
+    });
+}
 /** Remove a principal's role assignment. Returns true if one was removed. */
 async function removeRole(pool, principalType, principalId) {
     return (0, pool_helpers_js_1.withClient)(pool, async (client) => {

package/dist/services/role-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-service.js","sourceRoot":"","sources":["../../src/services/role-service.ts"],"names":[],"mappings":";;AA0BA,gCAUC;AAED,0BAQC;AAED,8BAcC;AAED,gCAoCC;AAED,gCAQC;AAED,0CAQC;AAED,8CAQC;AAYD,wDAcC;AAMD,4CAEC;AAkBD,gCAuBC;AAGD,gCAcC;AAaD,wDAkBC;AA5PD,wDAAiE;AAyB1D,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,KAAsB;IACpE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAC/E,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,OAAO,CAAC,IAAa,EAAE,EAAU;IACrD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,mCAAmC,EACnC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAa,EAAE,QAAiB;IAC9D,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,iFAAiF,EACjF,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uCAAuC,CACxC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,EAAU,EAAE,KAAsB;IAChF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,mCAAmC,EACnC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,kBAAkB,GAAG,EAAE,EAAE,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE/C,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oBAAoB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,cAAc,EACpE,MAAM,CACP,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,EAAU;IACxD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,8CAA8C,EAC9C,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,IAAa,EAAE,KAAa,EAAE,MAAc;IAChF,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oFAAoF,EACpF,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAa,EAAE,KAAa;IAClE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,sFAAsF,EACtF,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,sBAAsB,CAAC,IAAa,EAAE,KAAa;IACvE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;kDAG4C,EAC5C,CAAC,KAAK,CAAC,CACR,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,2DAA2D;QAC3D,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,IAAa,EAAE,KAAa;IAC3D,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,aAAqB,EACrB,WAAmB,EACnB,MAAc,EACd,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;;yBASmB,EACnB,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,CACvD,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,aAAqB,EACrB,WAAmB;IAEnB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;yBAEmB,EACnB,CAAC,aAAa,EAAE,WAAW,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,sBAAsB,CAC1C,IAAa,EACb,aAAqB,EACrB,WAAmB,EACnB,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;2EAIqE,EACrE,CAAC,aAAa,EAAE,WAAW,EAAE,QAAQ,IAAI,IAAI,CAAC,CAC/C,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"role-service.js","sourceRoot":"","sources":["../../src/services/role-service.ts"],"names":[],"mappings":";;AA0BA,gCAUC;AAED,0BAQC;AAED,8BAcC;AAED,gCAoCC;AAED,gCAQC;AAED,0CAQC;AAED,8CAQC;AAYD,wDAEC;AAMD,wEAYC;AAMD,4CAEC;AAkBD,gCAuBC;AAGD,gDAYC;AAGD,gCAcC;AAaD,wDAkBC;AAjRD,wDAAiE;AAyB1D,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,KAAsB;IACpE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAC/E,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,OAAO,CAAC,IAAa,EAAE,EAAU;IACrD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,mCAAmC,EACnC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAa,EAAE,QAAiB;IAC9D,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,iFAAiF,EACjF,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uCAAuC,CACxC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,EAAU,EAAE,KAAsB;IAChF,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,mCAAmC,EACnC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,kBAAkB,GAAG,EAAE,EAAE,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE/C,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oBAAoB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,cAAc,EACpE,MAAM,CACP,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,EAAU;IACxD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,8CAA8C,EAC9C,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,IAAa,EAAE,KAAa,EAAE,MAAc;IAChF,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oFAAoF,EACpF,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAa,EAAE,KAAa;IAClE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,sFAAsF,EACtF,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,sBAAsB,CAAC,IAAa,EAAE,KAAa;IACvE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,8BAA8B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,8BAA8B,CAAC,MAAqB,EAAE,KAAa;IACvF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;gDAG4C,EAC5C,CAAC,KAAK,CAAC,CACR,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,2DAA2D;IAC3D,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,IAAa,EAAE,KAAa;IAC3D,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,aAAqB,EACrB,WAAmB,EACnB,MAAc,EACd,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;;yBASmB,EACnB,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,CACvD,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AACrE,KAAK,UAAU,kBAAkB,CACtC,IAAa,EACb,aAAqB,EACrB,WAAmB;IAEnB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,qFAAqF,EACrF,CAAC,aAAa,EAAE,WAAW,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,aAAqB,EACrB,WAAmB;IAEnB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;yBAEmB,EACnB,CAAC,aAAa,EAAE,WAAW,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,sBAAsB,CAC1C,IAAa,EACb,aAAqB,EACrB,WAAmB,EACnB,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;2EAIqE,EACrE,CAAC,aAAa,EAAE,WAAW,EAAE,QAAQ,IAAI,IAAI,CAAC,CAC/C,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/tenant-service.d.ts

@@ -1,5 +1,17 @@
 import pg from "pg";
-import { type TenantNode, type CreateTenantInput, type UpdateTenantInput, type PaginationInput, type PaginatedResult } from "@stratum-hq/core";
+import { type TenantNode, type CreateTenantInput, type UpdateTenantInput, type PaginationInput, type PaginatedResult, type TenantStatus } from "@stratum-hq/core";
+/**
+ * Serialize changes to the tree's shape on one advisory key. A move takes it
+ * exclusively: it checks for cycles against the destination's ancestry and
+ * rewrites the paths of a whole subtree, so nothing else may read or write
+ * ancestry while it runs. Creates and lifecycle transitions take it shared, so
+ * they still run alongside each other (row locks order those) but never read a
+ * parent path that an in-flight move is about to rewrite. A subtree query that
+ * reads a tenant's path and then selects by that prefix also takes it shared,
+ * so a move cannot commit between the two statements. Take it before reading
+ * any row the change depends on.
+ */
+export declare function lockTree(client: pg.PoolClient, mode: "shared" | "exclusive"): Promise<void>;
 export declare function createTenant(pool: pg.Pool, input: CreateTenantInput): Promise<TenantNode>;
 export declare function getTenant(pool: pg.Pool, id: string, includeArchived?: boolean): Promise<TenantNode>;
 /**
@@ -10,11 +22,15 @@ export declare function getTenant(pool: pg.Pool, id: string, includeArchived?: b
  *
  * Mirrors getTenant's not-found and state contract: throws TenantNotFoundError
  * when no row matches, and — unless `includeArchived` is set — TenantArchivedError
- * / TenantSuspendedError for a non-active row. `includeArchived` is the "give me
+ * / TenantSuspendedError / TenantPendingError for a non-active row. `includeArchived` is the "give me
  * the row whatever its state" escape hatch and bypasses both non-active states.
  */
 export declare function getTenantBySlug(pool: pg.Pool, slug: string, includeArchived?: boolean): Promise<TenantNode>;
-export declare function listTenants(pool: pg.Pool, pagination: PaginationInput): Promise<PaginatedResult<TenantNode>>;
+/**
+ * List tenants in one status, `active` by default. Pending, suspended and
+ * archived tenants appear only when that status is asked for.
+ */
+export declare function listTenants(pool: pg.Pool, pagination: PaginationInput, status?: TenantStatus): Promise<PaginatedResult<TenantNode>>;
 export declare function updateTenant(pool: pg.Pool, id: string, patch: UpdateTenantInput): Promise<TenantNode>;
 /**
  * Suspend an active tenant: reversible block on access. Rejects if the tenant
@@ -32,6 +48,11 @@ export declare function archiveTenant(pool: pg.Pool, id: string): Promise<Tenant
  * its parent is not active. Resuming is top-down.
  */
 export declare function resumeTenant(pool: pg.Pool, id: string): Promise<TenantNode>;
+/**
+ * Activate a pending tenant once its schema or database has been provisioned.
+ * Rejects if the tenant is not pending, or if its parent is not active.
+ */
+export declare function activateTenant(pool: pg.Pool, id: string): Promise<TenantNode>;
 /**
  * Soft-delete a tenant.
  *

package/dist/services/tenant-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-service.d.ts","sourceRoot":"","sources":["../../src/services/tenant-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,eAAe,EAWrB,MAAM,kBAAkB,CAAC;AAE1B,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgF/F;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,CAAC,CAsBrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,IAAI,EAAE,MAAM,EACZ,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CA8BtC;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,UAAU,CAAC,CAsDrB;AAwDD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAalF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAalF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAyBjF;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CA+FrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,MAAM,EAAE,iBAAiB,EAAE,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA8F5B;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAsBnF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAyB5E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,EAAE,CAAC,CAwBvB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0CpG"}
+{"version":3,"file":"tenant-service.d.ts","sourceRoot":"","sources":["../../src/services/tenant-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,YAAY,EAalB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjG;AAwCD,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CA4D/F;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,CAAC,CAyBrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,IAAI,EAAE,MAAM,EACZ,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,CAAC,CAsBrB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,UAAU,EAAE,eAAe,EAC3B,MAAM,GAAE,YAAuB,GAC9B,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CA8BtC;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,UAAU,CAAC,CAmErB;AA8DD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAalF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAalF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2BjF;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAenF;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CA+ErB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,MAAM,EAAE,iBAAiB,EAAE,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAmF5B;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAsBnF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAyB5E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,EACV,eAAe,UAAQ,GACtB,OAAO,CAAC,UAAU,EAAE,CAAC,CAyBvB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQlF;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA0CpG"}