@stratum-hq/lib 1.5.0 → 1.7.0

package/README.md

@@ -1,6 +1,8 @@
 # @stratum-hq/lib
 
-Framework-agnostic library for embedding [Stratum](https://github.com/stratum-hq/Stratum) directly in your Node.js app. Talks straight to PostgreSQL with no HTTP server in between — maximum performance for tenant operations.
+Multi-tenancy for Node.js and PostgreSQL: tenant hierarchy, config inheritance, row-level security, ABAC, audit log, and GDPR tooling. This is the framework-agnostic core of [Stratum](https://github.com/stratum-hq/Stratum). Embed it directly in your Node.js app. It talks straight to PostgreSQL with no HTTP server in between.
+
+Read the documentation at [docs.stratum-hq.org/packages/lib](https://docs.stratum-hq.org/packages/lib/).
 
 ## Installation
 
@@ -26,7 +28,7 @@ const customer = await stratum.createTenant({
   isolation_strategy: "SHARED_RLS",
 });
 
-// Config flows root → leaf — children inherit automatically
+// Config flows root → leaf; children inherit automatically
 await stratum.setConfig(msp.id, "max_seats", { value: 500, locked: true });
 const config = await stratum.resolveConfig(customer.id);
 // → { max_seats: { value: 500, inherited: true, locked: true } }
@@ -34,19 +36,19 @@ const config = await stratum.resolveConfig(customer.id);
 const permissions = await stratum.resolvePermissions(customer.id);
 ```
 
-The `pool` is **borrowed, not owned** — Stratum never creates or closes it. With `autoMigrate: true`, `initialize()` runs the schema migrations on first start; leave it off and manage migrations yourself via `migrate`.
+The `pool` is **borrowed, not owned**: Stratum never creates or closes it. With `autoMigrate: true`, `initialize()` runs the schema migrations on first start; leave it off and manage migrations yourself via `migrate`.
 
 ## API Summary
 
 The `Stratum` instance covers the full tenant lifecycle:
 
-- **Tenants** — `createTenant`, `getTenant`, `listTenants`, `updateTenant`, `moveTenant`, `getAncestors`, `getDescendants`, `batchCreateTenants`
-- **Config** — `resolveConfig`, `setConfig`, `deleteConfig`, `batchSetConfig`, `diffConfig`
-- **Permissions & ABAC** — `resolvePermissions`, `createPermission`, `createAbacPolicy`, `evaluateAbac`
-- **API keys & roles** — `createApiKey`, `validateApiKey`, `rotateApiKey`, `createRole`, `assignRoleToKey`
-- **Webhooks & audit** — `createWebhook`, `testWebhook`, `queryAuditLogs`, `listFailedDeliveries`
-- **GDPR & regions** — `exportTenantData`, `purgeTenant`, `grantConsent`, `createRegion`, `migrateRegion`
-- **Usage metering** — `recordUsage`, `aggregateUsage` (see [docs/usage-metering.md](../../docs/usage-metering.md))
+- **Tenants**: `createTenant`, `getTenant`, `listTenants`, `updateTenant`, `moveTenant`, `getAncestors`, `getDescendants`, `batchCreateTenants`
+- **Config**: `resolveConfig`, `setConfig`, `deleteConfig`, `batchSetConfig`, `diffConfig`
+- **Permissions & ABAC**: `resolvePermissions`, `createPermission`, `createAbacPolicy`, `evaluateAbac`
+- **API keys & roles**: `createApiKey`, `validateApiKey`, `rotateApiKey`, `createRole`, `assignRoleToKey`
+- **Webhooks & audit**: `createWebhook`, `testWebhook`, `queryAuditLogs`, `listFailedDeliveries`
+- **GDPR & regions**: `exportTenantData`, `purgeTenant`, `grantConsent`, `createRegion`, `migrateRegion`
+- **Usage metering**: `recordUsage`, `aggregateUsage` (see [docs/usage-metering.md](../../docs/usage-metering.md))
 
 Low-level pool helpers are also exported:
 
@@ -64,11 +66,11 @@ await withTransaction(pool, async (client) => {
 establishes the tenant context in two layers for the whole duration of the job
 and tears both down when the job settles:
 
-- **AsyncLocalStorage** — the tenant is placed in the SDK's ALS store, so code
+- **AsyncLocalStorage**: the tenant is placed in the SDK's ALS store, so code
   inside the job reads it through `Stratum.currentTenantId()` /
   `Stratum.currentTenantContext()` exactly as a request handler would. Each job
   gets its own store, so concurrent jobs cannot observe each other's tenant.
-- **Postgres row-level security** — the job runs through the data-plane
+- **Postgres row-level security**: the job runs through the data-plane
   `withTenantContext` (`@stratum-hq/db-adapters`), which opens a transaction and
   issues `SET LOCAL app.current_tenant_id`. Every query the job makes on the
   provided client is confined to that tenant by RLS, so it cannot read or write
@@ -82,7 +84,7 @@ import { runScopedJob } from "@stratum-hq/lib";
 // `pool` must connect as a NON-superuser, NON-BYPASSRLS role, or RLS is a no-op.
 await runScopedJob(pool, tenantId, async (client) => {
   Stratum.currentTenantId(); // === tenantId
-  // Confined to `tenantId` by RLS — no app-layer WHERE filter needed.
+  // Confined to `tenantId` by RLS; no app-layer WHERE filter needed.
   await client.query("SELECT * FROM invoices WHERE status = 'pending'");
 });
 ```
@@ -96,7 +98,7 @@ ADR 0001 (`docs/adr/0001-postgres-rls-defense-in-depth.md`).
 
 ## Rate Limiting
 
-`RateLimiter` is a standalone, storage-agnostic per-tenant rate-limiting primitive. It is not part of the `Stratum` facade (which is bound to a single `pg.Pool`) — the point is that its storage is pluggable. It ships with a process-local in-memory store and a documented `RateLimitStore` contract you can implement over Redis, Postgres, or anything else.
+`RateLimiter` is a standalone, storage-agnostic per-tenant rate-limiting primitive. It is not part of the `Stratum` facade (which is bound to a single `pg.Pool`). The point is that its storage is pluggable. It ships with a process-local in-memory store and a documented `RateLimitStore` contract you can implement over Redis, Postgres, or anything else.
 
 > This is distinct from the HTTP-layer rate limiting in `@stratum-hq/control-plane`. Use this to embed per-tenant limits directly in an application.
 
@@ -115,7 +117,7 @@ const limiter = new RateLimiter({
 // one tenant's usage never affects another's.
 const res = await limiter.checkLimit(tenantId, "api");
 if (!res.allowed) {
-  throw new Error(`rate limited — retry in ${res.retryAfter}s`);
+  throw new Error(`rate limited, retry in ${res.retryAfter}s`);
 }
 // res: { allowed, limit, remaining, resetAt, retryAfter }
 ```
@@ -130,7 +132,7 @@ For each tenant the limit is resolved in order:
 2. the static `limits[tenantId]` override,
 3. `defaultLimit`.
 
-`resolveLimit` is the seam for **config inheritance** — back it with `stratum.resolveConfig` to drive limits from the tenant config tree:
+`resolveLimit` is the seam for **config inheritance**: back it with `stratum.resolveConfig` to drive limits from the tenant config tree:
 
 ```typescript
 const limiter = new RateLimiter({
@@ -162,9 +164,9 @@ interface RateLimitStore {
 
 Implementation notes:
 
-- **Redis** — `INCR key`, then on a reply of `1`, `PEXPIRE key windowMs`; derive `resetAt` from `now + PTTL`. A short Lua script keeps it atomic and returns count + TTL in one round trip.
-- **Postgres** — `INSERT ... ON CONFLICT (key) DO UPDATE` returning the new count, resetting the row when `reset_at` has passed.
-- **In-memory** — `MemoryRateLimitStore`; single-process only, holds one entry per distinct `tenantId:key` pair. For high key cardinality or multi-process deployments, use a store with native TTL eviction.
+- **Redis**: `INCR key`, then on a reply of `1`, `PEXPIRE key windowMs`; derive `resetAt` from `now + PTTL`. A short Lua script keeps it atomic and returns count + TTL in one round trip.
+- **Postgres**: `INSERT ... ON CONFLICT (key) DO UPDATE` returning the new count, resetting the row when `reset_at` has passed.
+- **In-memory**: `MemoryRateLimitStore`; single-process only, holds one entry per distinct `tenantId:key` pair. For high key cardinality or multi-process deployments, use a store with native TTL eviction.
 
 ## Error Handling
 
@@ -177,7 +179,7 @@ try {
   await stratum.setConfig(childId, "max_seats", { value: 999 });
 } catch (err) {
   if (err instanceof ConfigLockedError) {
-    // A parent locked this key — child cannot override
+    // A parent locked this key, so the child cannot override
   }
 }
 ```

package/dist/crypto.d.ts

@@ -1,13 +1,16 @@
 /** Encrypts a value. Returns versioned format: v1:iv:authTag:ciphertext (all hex) */
 export declare function encrypt(plaintext: string): string;
 /** Decrypts a versioned encrypted value. Supports v1 format and legacy (no version prefix).
- * Falls back to STRATUM_ENCRYPTION_KEY_PREVIOUS if primary key decryption fails,
- * enabling dual-key reads during rolling deployments. */
+ * If the current key and salt fail, it tries the previous pair: STRATUM_ENCRYPTION_KEY_PREVIOUS
+ * and STRATUM_HKDF_SALT_PREVIOUS. A previous variable that is unset uses the current value.
+ * This keeps values readable during a rolling deployment and until a rotation finishes. */
 export declare function decrypt(encrypted: string): string;
-/** Encrypts a value with the key derived from `keyMaterial`.
+/** Encrypts a value with the key derived from `keyMaterial` and `saltHex`.
+ * If `saltHex` is not given, the configured salt applies.
  * Key rotation uses it because it must not read or change process.env. */
-export declare function encryptWithKeyMaterial(plaintext: string, keyMaterial: string): string;
-/** Returns the plaintext, or null when the value does not decrypt with the key derived from `keyMaterial`.
+export declare function encryptWithKeyMaterial(plaintext: string, keyMaterial: string, saltHex?: string): string;
+/** Returns the plaintext, or null when the value does not decrypt with the key derived from `keyMaterial` and `saltHex`.
+ * If `saltHex` is not given, the configured salt applies.
  * Key rotation uses the null result to try the next key instead of failing. */
-export declare function decryptWithKeyMaterial(encrypted: string, keyMaterial: string): string | null;
+export declare function decryptWithKeyMaterial(encrypted: string, keyMaterial: string, saltHex?: string): string | null;
 //# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAoFA,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;yDAEyD;AACzD,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAcjD;AAED;0EAC0E;AAC1E,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAErF;AAED;+EAC+E;AAC/E,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5F"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAyFA,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;2FAG2F;AAC3F,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAejD;AAED;;0EAE0E;AAC1E,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvG;AAED;;+EAE+E;AAC/E,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9G"}

package/dist/crypto.js

@@ -35,23 +35,27 @@ const HKDF_SALT = (() => {
     }
     return Buffer.from(NON_PRODUCTION_DEFAULT_SALT, "utf8");
 })();
-function hkdfDeriveKey(keyMaterial, info = "stratum-aes-key") {
-    return Buffer.from(node_crypto_1.default.hkdfSync("sha256", Buffer.from(keyMaterial, "utf8"), HKDF_SALT, info, 32));
+function hkdfDeriveKey(keyMaterial, salt = HKDF_SALT, info = "stratum-aes-key") {
+    return Buffer.from(node_crypto_1.default.hkdfSync("sha256", Buffer.from(keyMaterial, "utf8"), salt, info, 32));
 }
-function getEncryptionKey() {
+function getEncryptionKeyMaterial() {
     const envKey = process.env.STRATUM_ENCRYPTION_KEY ?? process.env.WEBHOOK_ENCRYPTION_KEY;
     if (envKey) {
-        return hkdfDeriveKey(envKey);
+        return envKey;
     }
     const strictEnv = nodeEnvRequiringKeyMaterial();
     if (strictEnv) {
         throw new Error(`STRATUM_ENCRYPTION_KEY must be set in ${strictEnv}`);
     }
     // Development and test only fallback
-    return hkdfDeriveKey("stratum-dev-key");
+    return "stratum-dev-key";
+}
+function getEncryptionKey() {
+    return hkdfDeriveKey(getEncryptionKeyMaterial());
 }
-function deriveKey(keyMaterial) {
-    return hkdfDeriveKey(keyMaterial, "stratum-aes-key");
+// A hex salt argument follows the STRATUM_HKDF_SALT format. No argument means the configured salt.
+function deriveKey(keyMaterial, saltHex) {
+    return hkdfDeriveKey(keyMaterial, saltHex ? Buffer.from(saltHex, "hex") : HKDF_SALT);
 }
 function encryptWithKey(plaintext, key) {
     const iv = node_crypto_1.default.randomBytes(IV_LENGTH);
@@ -86,35 +90,39 @@ function encrypt(plaintext) {
     return encryptWithKey(plaintext, getEncryptionKey());
 }
 /** Decrypts a versioned encrypted value. Supports v1 format and legacy (no version prefix).
- * Falls back to STRATUM_ENCRYPTION_KEY_PREVIOUS if primary key decryption fails,
- * enabling dual-key reads during rolling deployments. */
+ * If the current key and salt fail, it tries the previous pair: STRATUM_ENCRYPTION_KEY_PREVIOUS
+ * and STRATUM_HKDF_SALT_PREVIOUS. A previous variable that is unset uses the current value.
+ * This keeps values readable during a rolling deployment and until a rotation finishes. */
 function decrypt(encrypted) {
     try {
         return decryptWithKey(encrypted, getEncryptionKey());
     }
     catch (err) {
         const previousKey = process.env.STRATUM_ENCRYPTION_KEY_PREVIOUS;
-        if (previousKey) {
+        const previousSalt = process.env.STRATUM_HKDF_SALT_PREVIOUS;
+        if (previousKey || previousSalt) {
             try {
-                return decryptWithKey(encrypted, hkdfDeriveKey(previousKey));
+                return decryptWithKey(encrypted, deriveKey(previousKey || getEncryptionKeyMaterial(), previousSalt));
             }
             catch {
-                // Both keys failed — throw the original error
+                // Both pairs failed: throw the original error
             }
         }
         throw err;
     }
 }
-/** Encrypts a value with the key derived from `keyMaterial`.
+/** Encrypts a value with the key derived from `keyMaterial` and `saltHex`.
+ * If `saltHex` is not given, the configured salt applies.
  * Key rotation uses it because it must not read or change process.env. */
-function encryptWithKeyMaterial(plaintext, keyMaterial) {
-    return encryptWithKey(plaintext, deriveKey(keyMaterial));
+function encryptWithKeyMaterial(plaintext, keyMaterial, saltHex) {
+    return encryptWithKey(plaintext, deriveKey(keyMaterial, saltHex));
 }
-/** Returns the plaintext, or null when the value does not decrypt with the key derived from `keyMaterial`.
+/** Returns the plaintext, or null when the value does not decrypt with the key derived from `keyMaterial` and `saltHex`.
+ * If `saltHex` is not given, the configured salt applies.
  * Key rotation uses the null result to try the next key instead of failing. */
-function decryptWithKeyMaterial(encrypted, keyMaterial) {
+function decryptWithKeyMaterial(encrypted, keyMaterial, saltHex) {
     try {
-        return decryptWithKey(encrypted, deriveKey(keyMaterial));
+        return decryptWithKey(encrypted, deriveKey(keyMaterial, saltHex));
     }
     catch {
         return null;

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;AAqFA,0BAEC;AAKD,0BAcC;AAID,wDAEC;AAID,wDAMC;AA1HD,8DAAiC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,2EAA2E;AAC3E,8EAA8E;AAC9E,0EAA0E;AAC1E,SAAS,2BAA2B;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IACtD,OAAO,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,8BAA8B;AAC9B,MAAM,2BAA2B,GAAG,qCAAqC,CAAC;AAE1E,MAAM,SAAS,GAAW,CAAC,GAAG,EAAE;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAI,GAAG,iBAAiB;IAClE,OAAO,MAAM,CAAC,IAAI,CAChB,qBAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACxF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,qCAAqC;IACrC,OAAO,aAAa,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,OAAO,aAAa,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,qBAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,qBAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,GAAG,mBAAmB,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAa,EAAE,UAAkB,EAAE,aAAqB,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,sCAAsC;QACtC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAyC,CAAC;IACnF,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,gCAAgC;QAChC,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,qFAAqF;AACrF,SAAgB,OAAO,CAAC,SAAiB;IACvC,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;yDAEyD;AACzD,SAAgB,OAAO,CAAC,SAAiB;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAChE,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,OAAO,cAAc,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,WAAmB;IAC3E,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;+EAC+E;AAC/E,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,WAAmB;IAC3E,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;AA0FA,0BAEC;AAMD,0BAeC;AAKD,wDAEC;AAKD,wDAMC;AAnID,8DAAiC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,2EAA2E;AAC3E,8EAA8E;AAC9E,0EAA0E;AAC1E,SAAS,2BAA2B;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IACtD,OAAO,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,8BAA8B;AAC9B,MAAM,2BAA2B,GAAG,qCAAqC,CAAC;AAE1E,MAAM,SAAS,GAAW,CAAC,GAAG,EAAE;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,aAAa,CAAC,WAAmB,EAAE,OAAe,SAAS,EAAE,IAAI,GAAG,iBAAiB;IAC5F,OAAO,MAAM,CAAC,IAAI,CAChB,qBAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACxF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,qCAAqC;IACrC,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,aAAa,CAAC,wBAAwB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,mGAAmG;AACnG,SAAS,SAAS,CAAC,WAAmB,EAAE,OAAgB;IACtD,OAAO,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,qBAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,qBAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,GAAG,mBAAmB,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAa,EAAE,UAAkB,EAAE,aAAqB,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,sCAAsC;QACtC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAyC,CAAC;IACnF,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,gCAAgC;QAChC,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,qFAAqF;AACrF,SAAgB,OAAO,CAAC,SAAiB;IACvC,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;2FAG2F;AAC3F,SAAgB,OAAO,CAAC,SAAiB;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAChE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAC5D,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,wBAAwB,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;0EAE0E;AAC1E,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,WAAmB,EAAE,OAAgB;IAC7F,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;+EAE+E;AAC/E,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,WAAmB,EAAE,OAAgB;IAC7F,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export { RateLimiter, MemoryRateLimitStore } from "./services/rate-limit-service
 export type { RateLimit, RateLimitResult, RateLimitState, RateLimitStore, RateLimitResolver, RateLimiterOptions, } from "./services/rate-limit-service.js";
 export type { ApiKeyRecord, CreatedApiKey, ValidatedApiKey, CreateApiKeyOptions } from "./services/api-key-service.js";
 export type { BatchCreateResult } from "./services/tenant-service.js";
-export type { KeyRotationResult, KeyRotationUnreadableRow } from "./services/key-rotation-service.js";
+export type { KeyRotationResult, KeyRotationSalts, KeyRotationUnreadableRow } from "./services/key-rotation-service.js";
 export type { DeliveryStats } from "./services/event-service.js";
 export type { Role, CreateRoleInput, UpdateRoleInput } from "./services/role-service.js";
 export type { AuditContext, AuditEntry, AuditLogQuery, RecordAuditEventInput } from "@stratum-hq/core";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iCAAiC,EACjC,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKrE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,iCAAiC,EACjC,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACrF,YAAY,EACV,SAAS,EACT,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACtG,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGzF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAGvG,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iCAAiC,EACjC,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKrE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,iCAAiC,EACjC,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACrF,YAAY,EACV,SAAS,EACT,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACxH,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGzF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAGvG,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/migrate-schemas.js

@@ -126,7 +126,7 @@ function hashSchemaLock(schema) {
     return (hash ^ 0x5354524d) | 0; // XOR with "STRM"
 }
 function quoteIdent(name) {
-    // Simple identifier quoting — disallow anything that could break out
+    // Simple identifier quoting: disallow anything that could break out
     if (!/^[a-z_][a-z0-9_]*$/i.test(name)) {
         throw new Error(`Invalid schema name: ${name}`);
     }

package/dist/migrate-schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-schemas.js","sourceRoot":"","sources":["../src/migrate-schemas.ts"],"names":[],"mappings":";;;;;AAuBA,8CAgEC;AAvFD,sDAAyB;AACzB,0DAA6B;AAE7B,uDAA+C;AAc/C;;;;;GAKG;AACI,KAAK,UAAU,iBAAiB,CACrC,OAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAElE,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACjD,MAAM,CAAC,KAAK,CACV,gHAAgH,CACjH,CACF,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAyB,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4BAA4B;IAC5B,MAAM,aAAa,GAAG,mBAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,iBAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,gCAAgC,aAAa,sDAAsD,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,iBAAE;SACb,WAAW,CAAC,aAAa,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACjC,IAAI,EAAE,CAAC;IAEV,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAE,CAAC,YAAY,CAAC,mBAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC;KAC9D,CAAC,CAAC,CAAC;IAEJ,kDAAkD;IAClD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAC7E,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACnC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;iBAC3D,CAAC,CAAC;YACL,CAAC;YACD,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAa,EACb,MAAc,EACd,UAA2C,EAC3C,UAAoB;IAEpB,0EAA0E;IAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAElC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAE5B,sCAAsC;YACtC,MAAM,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAElE,yEAAyE;YACzE,uEAAuE;YACvE,6BAA6B;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,UAAU,CAAC,CAAC;YAEhE,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,MAAM,MAAM,CAAC,KAAK,CAAC;qCACY,MAAM;;;;;OAKpC,CAAC,CAAC;YAEH,2BAA2B;YAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,iBAAiB,MAAM,8BAA8B,EACrD,CAAC,SAAS,CAAC,IAAI,CAAC,CACjB,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,SAAS;YACX,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,iCAAiC,EAAE;gBACzE,SAAS,CAAC,IAAI;aACf,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,iEAAiE;IACjE,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,qEAAqE;IACrE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,4EAA4E;IAC5E,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,IAAI,GAAG,CAAC;AACrB,CAAC"}
+{"version":3,"file":"migrate-schemas.js","sourceRoot":"","sources":["../src/migrate-schemas.ts"],"names":[],"mappings":";;;;;AAuBA,8CAgEC;AAvFD,sDAAyB;AACzB,0DAA6B;AAE7B,uDAA+C;AAc/C;;;;;GAKG;AACI,KAAK,UAAU,iBAAiB,CACrC,OAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAElE,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACjD,MAAM,CAAC,KAAK,CACV,gHAAgH,CACjH,CACF,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAyB,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4BAA4B;IAC5B,MAAM,aAAa,GAAG,mBAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,iBAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,gCAAgC,aAAa,sDAAsD,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,iBAAE;SACb,WAAW,CAAC,aAAa,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACjC,IAAI,EAAE,CAAC;IAEV,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAE,CAAC,YAAY,CAAC,mBAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC;KAC9D,CAAC,CAAC,CAAC;IAEJ,kDAAkD;IAClD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAC7E,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACnC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;iBAC3D,CAAC,CAAC;YACL,CAAC;YACD,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAa,EACb,MAAc,EACd,UAA2C,EAC3C,UAAoB;IAEpB,0EAA0E;IAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAElC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAE5B,sCAAsC;YACtC,MAAM,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAElE,yEAAyE;YACzE,uEAAuE;YACvE,6BAA6B;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,UAAU,CAAC,CAAC;YAEhE,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,MAAM,MAAM,CAAC,KAAK,CAAC;qCACY,MAAM;;;;;OAKpC,CAAC,CAAC;YAEH,2BAA2B;YAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,iBAAiB,MAAM,8BAA8B,EACrD,CAAC,SAAS,CAAC,IAAI,CAAC,CACjB,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,SAAS;YACX,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,iCAAiC,EAAE;gBACzE,SAAS,CAAC,IAAI;aACf,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,iEAAiE;IACjE,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,oEAAoE;IACpE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,4EAA4E;IAC5E,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,IAAI,GAAG,CAAC;AACrB,CAAC"}

package/dist/migrations/001_init.sql

@@ -2,13 +2,13 @@
 DO $$ BEGIN
   CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
 EXCEPTION WHEN insufficient_privilege THEN
-  RAISE WARNING 'Cannot create uuid-ossp extension — insufficient privileges. Ask a database administrator to run: CREATE EXTENSION IF NOT EXISTS "uuid-ossp";';
+  RAISE WARNING 'Cannot create uuid-ossp extension: insufficient privileges. Ask a database administrator to run: CREATE EXTENSION IF NOT EXISTS "uuid-ossp";';
 END $$;
 
 DO $$ BEGIN
   CREATE EXTENSION IF NOT EXISTS "ltree";
 EXCEPTION WHEN insufficient_privilege THEN
-  RAISE WARNING 'Cannot create ltree extension — insufficient privileges. Ask a database administrator to run: CREATE EXTENSION IF NOT EXISTS "ltree";';
+  RAISE WARNING 'Cannot create ltree extension: insufficient privileges. Ask a database administrator to run: CREATE EXTENSION IF NOT EXISTS "ltree";';
 END $$;
 
 -- Warn if application role has BYPASSRLS privilege.
@@ -127,7 +127,7 @@ CREATE TRIGGER update_config_entries_updated_at
   FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
 
 -- Config entries uses ON DELETE CASCADE (unlike permission_policies which uses RESTRICT)
--- because config values are safe to delete with a tenant — they carry no semantic guarantees
+-- because config values are safe to delete with a tenant; they carry no semantic guarantees
 -- like PERMANENT revocation mode. If soft-delete is used (v1 default), CASCADE never fires.
 
 -- API keys table (for control plane auth)

package/dist/migrations/031_subtree_read_scope.sql

@@ -0,0 +1,307 @@
+-- Migration 031: Opt-in subtree read scope for row-level security.
+--
+-- A session scoped to tenant T can opt in to read the rows of T and of every
+-- descendant of T. The default stays exact-tenant isolation (019, 020).
+--
+-- Context model, in addition to 019:
+--   * Subtree scope: SET LOCAL app.tenant_scope = 'subtree' (transaction
+--     scoped). Only the exact value 'subtree' widens reads. The library sets it
+--     only through its context helpers (db-adapters setTenantContext and
+--     withTenantContext with { scope: 'subtree' }).
+--
+-- Reads only. Each table below gets a second permissive policy, tenant_subtree_read,
+-- FOR SELECT. PostgreSQL ORs it with tenant_isolation for reads. INSERT,
+-- UPDATE and DELETE must also pass the policies for their own command, and
+-- tenant_isolation is the only one. Writes therefore stay limited to the exact
+-- tenant: an insert for a descendant fails WITH CHECK, and UPDATE and DELETE
+-- do not reach a descendant's rows. SELECT ... FOR UPDATE and FOR SHARE also
+-- need the UPDATE policy, so in subtree scope they return the exact tenant's
+-- rows only. The 019 and 020 policies do not change.
+--
+-- Tables with a subtree read policy:
+--   tenants (on id), config_entries (rows with sensitive = false only),
+--   permission_policies, audit_logs, webhook_events, consent_records,
+--   abac_policies, roles, usage_events, and, through their parent row,
+--   webhook_deliveries (via webhook_events) and principal_roles (via roles).
+--
+-- Credential-bearing rows stay exact-tenant. api_keys and webhooks get no
+-- subtree policy, and the config_entries policy admits no row with
+-- sensitive = true. A key row holds a key hash, a webhook row holds a signing
+-- secret hash and a URL that can carry credentials, and a sensitive config
+-- row holds a secret value. Their 019 policies stay the only ones that admit
+-- a tenant session, so only the exact tenant reads them. webhook_deliveries
+-- is scoped through webhook_events, not webhooks, so it gives no subtree path
+-- to a webhook row.
+--
+-- Tenant status does not affect the scope. Suspended, archived and pending
+-- descendants are in the subtree, as exact-tenant RLS ignores status too.
+-- Applications filter by status when they need to.
+--
+-- The bypass (app.bypass_rls = 'on') does not change: it sees every row.
+--
+-- The scope follows the tree as it is when the statement runs: a move through
+-- moveTenant changes the subtree at once. The tree columns of tenants change
+-- only under the bypass (see guard_tenant_tree_columns below), so a tenant
+-- session cannot change its own position in the tree.
+--
+-- Cost: the function runs once per policy reference in a statement, and its
+-- result grows with the size of the subtree. Each table then matches tenant_id
+-- against that array, so it needs an index on tenant_id.
+
+-- ---------------------------------------------------------------------------
+-- stratum_subtree_tenant_ids(): the current tenant and all its descendants.
+--
+-- The subtree is selected by the ID-based ancestry_path, not by the
+-- slug-derived ancestry_ltree, for the reason getDescendants gives in
+-- tenant-service.ts: an isolation boundary must not follow slugs. A
+-- descendant's ancestry_path is the subtree path itself or starts with it
+-- plus '/'. The ~>=~ / ~<~ range lets idx_tenant_ancestry_path_prefix (028)
+-- serve the lookup with a value known only at run time ('0' is the character
+-- after '/'). The LIKE then drops what the range admits but is not a path
+-- segment boundary.
+--
+-- The policies call the function in a scalar subquery, so PostgreSQL runs it
+-- once per policy reference in a statement as an InitPlan and then matches
+-- tenant_id against the array with the table's own index on tenant_id.
+--
+-- The function must read the whole subtree while the caller sees only its own
+-- tenants row (019). It does what 029 does: SECURITY DEFINER would not help,
+-- because FORCE ROW LEVEL SECURITY applies to the owner too, so a SET clause
+-- turns on the 019 bypass for the function's own duration. A SET clause is
+-- restored when the function exits, on error too. The second SET clause clears
+-- app.tenant_scope inside the function, so the tenant_subtree_read policy on
+-- tenants cannot call the function again while it runs.
+--
+-- The function returns only ids in the subtree of app.current_tenant_id. A
+-- session that can call it can already set both settings, so it gives no new
+-- access. With no current tenant it returns an empty array.
+--
+-- search_path is pinned below to pg_catalog, the schema this migration runs
+-- in (where 001 created tenants), and pg_temp last, so that a table a session
+-- creates cannot stand in for tenants.
+-- ---------------------------------------------------------------------------
+CREATE OR REPLACE FUNCTION stratum_subtree_tenant_ids()
+RETURNS uuid[]
+LANGUAGE sql
+STABLE
+SET app.bypass_rls = 'on'
+SET app.tenant_scope = ''
+AS $$
+  WITH cur AS (
+    SELECT t.id, rtrim(t.ancestry_path, '/') || '/' || t.id::text AS sub
+    FROM tenants t
+    WHERE t.id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
+  )
+  SELECT coalesce(array_agg(s.id), '{}'::uuid[])
+  FROM (
+    SELECT cur.id FROM cur
+    UNION ALL
+    SELECT d.id
+    FROM cur
+    JOIN tenants d
+      ON d.ancestry_path ~>=~ cur.sub
+     AND d.ancestry_path ~<~ (cur.sub || '0')
+     AND (d.ancestry_path = cur.sub OR d.ancestry_path LIKE cur.sub || '/%')
+  ) s
+$$;
+
+DO $pin$ BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION stratum_subtree_tenant_ids() SET search_path = pg_catalog, %I, pg_temp',
+    current_schema()
+  );
+END $pin$;
+
+-- Reusable predicate (inlined per policy below, as in 019):
+--   current_setting('app.tenant_scope', true) = 'subtree'
+--   AND tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+-- The scope check comes first. With any other scope the AND stops there, so
+-- the default path never runs the function.
+
+-- ---------------------------------------------------------------------------
+-- Direct tenant_id tables.
+-- ---------------------------------------------------------------------------
+
+-- config_entries: non-sensitive rows only. A sensitive row holds a secret
+-- value, so only the exact tenant reads it (019).
+DROP POLICY IF EXISTS tenant_subtree_read ON config_entries;
+CREATE POLICY tenant_subtree_read ON config_entries FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+    AND NOT sensitive
+  );
+
+DROP POLICY IF EXISTS tenant_subtree_read ON permission_policies;
+CREATE POLICY tenant_subtree_read ON permission_policies FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+  );
+
+DROP POLICY IF EXISTS tenant_subtree_read ON audit_logs;
+CREATE POLICY tenant_subtree_read ON audit_logs FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+  );
+
+DROP POLICY IF EXISTS tenant_subtree_read ON webhook_events;
+CREATE POLICY tenant_subtree_read ON webhook_events FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+  );
+
+-- webhooks: no subtree policy. A webhook row holds credential material, so
+-- only the exact tenant reads it (019).
+DROP POLICY IF EXISTS tenant_subtree_read ON webhooks;
+
+DROP POLICY IF EXISTS tenant_subtree_read ON consent_records;
+CREATE POLICY tenant_subtree_read ON consent_records FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+  );
+
+DROP POLICY IF EXISTS tenant_subtree_read ON abac_policies;
+CREATE POLICY tenant_subtree_read ON abac_policies FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+  );
+
+DROP POLICY IF EXISTS tenant_subtree_read ON roles;
+CREATE POLICY tenant_subtree_read ON roles FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+  );
+
+DROP POLICY IF EXISTS tenant_subtree_read ON usage_events;
+CREATE POLICY tenant_subtree_read ON usage_events FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+  );
+
+-- ---------------------------------------------------------------------------
+-- tenants registry: the subtree's own registry rows, on id.
+-- ---------------------------------------------------------------------------
+DROP POLICY IF EXISTS tenant_subtree_read ON tenants;
+CREATE POLICY tenant_subtree_read ON tenants FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+  );
+
+-- ---------------------------------------------------------------------------
+-- Indirect tables: scoped through their tenant-bearing parent, as in 019.
+-- ---------------------------------------------------------------------------
+
+DROP POLICY IF EXISTS tenant_subtree_read ON webhook_deliveries;
+CREATE POLICY tenant_subtree_read ON webhook_deliveries FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND EXISTS (
+      SELECT 1 FROM webhook_events we
+      WHERE we.id = webhook_deliveries.event_id
+        AND we.tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+    )
+  );
+
+DROP POLICY IF EXISTS tenant_subtree_read ON principal_roles;
+CREATE POLICY tenant_subtree_read ON principal_roles FOR SELECT
+  USING (
+    current_setting('app.tenant_scope', true) = 'subtree'
+    AND EXISTS (
+      SELECT 1 FROM roles r
+      WHERE r.id = principal_roles.role_id
+        AND r.tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])
+    )
+  );
+
+-- ---------------------------------------------------------------------------
+-- Tree columns change only under the bypass.
+--
+-- A tenant session may update its own tenants row (019), and the subtree read
+-- above follows parent_id and ancestry_path. This BEFORE trigger refuses any
+-- change to parent_id, ancestry_path, depth or ancestry_ltree unless
+-- app.bypass_rls = 'on'. The library changes these columns only in
+-- createTenant, moveTenant and the other tree operations, which all run under
+-- the bypass (pool-helpers.ts), and so do the migrations. A role that skips
+-- RLS must also set the bypass to change them.
+--
+-- A slug rename stays allowed: the trigger is named to run before
+-- maintain_tenant_ancestry_ltree (BEFORE triggers run in name order), so it
+-- compares the ancestry_ltree the statement wrote, not the one that trigger
+-- recomputes from the new slug.
+-- ---------------------------------------------------------------------------
+CREATE OR REPLACE FUNCTION refuse_tenant_tree_column_change()
+RETURNS TRIGGER
+AS $$
+BEGIN
+  IF current_setting('app.bypass_rls', true) IS DISTINCT FROM 'on' AND (
+       NEW.parent_id IS DISTINCT FROM OLD.parent_id
+    OR NEW.ancestry_path IS DISTINCT FROM OLD.ancestry_path
+    OR NEW.depth IS DISTINCT FROM OLD.depth
+    OR NEW.ancestry_ltree IS DISTINCT FROM OLD.ancestry_ltree
+  ) THEN
+    RAISE EXCEPTION 'tenant % tree columns (parent_id, ancestry_path, depth, ancestry_ltree) change only under app.bypass_rls', OLD.id
+      USING ERRCODE = 'insufficient_privilege';
+  END IF;
+  RETURN NEW;
+END;
+$$ language 'plpgsql';
+
+DO $pin$ BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION refuse_tenant_tree_column_change() SET search_path = pg_catalog, %I, pg_temp',
+    current_schema()
+  );
+END $pin$;
+
+DROP TRIGGER IF EXISTS guard_tenant_tree_columns ON tenants;
+CREATE TRIGGER guard_tenant_tree_columns
+  BEFORE UPDATE OF parent_id, ancestry_path, depth, ancestry_ltree ON tenants
+  FOR EACH ROW
+  EXECUTE FUNCTION refuse_tenant_tree_column_change();
+
+-- ---------------------------------------------------------------------------
+-- refuse_tenant_parent_cycle() (029), with pg_temp last on its search_path.
+--
+-- The body is the one 029 created, unchanged. 029 pinned search_path to
+-- pg_catalog and the migration schema; this adds pg_temp at the end, so the
+-- cycle walk always reads the tenants table of that schema.
+-- ---------------------------------------------------------------------------
+CREATE OR REPLACE FUNCTION refuse_tenant_parent_cycle()
+RETURNS TRIGGER
+SET app.bypass_rls = 'on'
+AS $$
+BEGIN
+  IF NEW.parent_id = NEW.id OR EXISTS (
+    WITH RECURSIVE up(id, parent_id, seen) AS (
+      SELECT t.id, t.parent_id, ARRAY[t.id]
+      FROM tenants t
+      WHERE t.id = NEW.parent_id
+      UNION ALL
+      SELECT t.id, t.parent_id, up.seen || t.id
+      FROM tenants t
+      JOIN up ON t.id = up.parent_id
+      WHERE t.id <> ALL (up.seen)
+    )
+    SELECT 1 FROM up WHERE up.id = NEW.id
+  ) THEN
+    RAISE EXCEPTION 'tenant % cannot be its own ancestor (parent_id cycle)', NEW.id
+      USING ERRCODE = 'check_violation';
+  END IF;
+  RETURN NEW;
+END;
+$$ language 'plpgsql';
+
+DO $pin$ BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION refuse_tenant_parent_cycle() SET search_path = pg_catalog, %I, pg_temp',
+    current_schema()
+  );
+END $pin$;