@stratum-hq/lib 1.6.0 → 1.8.0

package/dist/services/tenant-service.js

@@ -96,7 +96,7 @@ async function createTenant(pool, input) {
             return res.rows[0];
         }
         else {
-            // Root tenant — no parent lock needed
+            // Root tenant: no parent lock needed
             const rootRegionId = input.region_id ?? null;
             const res = await client.query(`INSERT INTO tenants (parent_id, ancestry_path, depth, name, slug, config, metadata, isolation_strategy, status, region_id)
          VALUES (NULL, '/', 0, $1, $2, $3, $4, $5, $6, $7)
@@ -150,7 +150,7 @@ async function getTenant(pool, id, includeArchived = false) {
  * pages. Slug is globally unique, so this returns exactly the one matching row.
  *
  * Mirrors getTenant's not-found and state contract: throws TenantNotFoundError
- * when no row matches, and — unless `includeArchived` is set — TenantArchivedError
+ * when no row matches, and (unless `includeArchived` is set) TenantArchivedError
  * / TenantSuspendedError / TenantPendingError for a non-active row. `includeArchived` is the "give me
  * the row whatever its state" escape hatch and bypasses both non-active states.
  */
@@ -295,10 +295,10 @@ async function loadForTransition(client, id) {
  * and forces a leaf-first walk so no active tenant is ever left under a
  * non-active parent.
  */
-async function assertNoActiveChildren(client, id) {
+async function assertNoActiveChildren(client, id, action) {
     const childrenRes = await client.query(`SELECT COUNT(*) as count FROM tenants WHERE parent_id = $1 AND status = 'active'`, [id]);
     if (parseInt(childrenRes.rows[0].count, 10) > 0) {
-        throw new core_1.TenantHasChildrenError(id);
+        throw new core_1.TenantHasChildrenError(id, action);
     }
 }
 /**
@@ -311,7 +311,7 @@ async function suspendTenant(pool, id) {
         if (tenant.status !== "active") {
             throw new core_1.InvalidTenantStateError(id, tenant.status, "suspend", ["active"]);
         }
-        await assertNoActiveChildren(client, id);
+        await assertNoActiveChildren(client, id, "suspend");
         const res = await client.query(`UPDATE tenants SET status = 'suspended', updated_at = now() WHERE id = $1 RETURNING *`, [id]);
         return res.rows[0];
     });
@@ -326,7 +326,7 @@ async function archiveTenant(pool, id) {
         if (tenant.status !== "active" && tenant.status !== "suspended") {
             throw new core_1.InvalidTenantStateError(id, tenant.status, "archive", ["active", "suspended"]);
         }
-        await assertNoActiveChildren(client, id);
+        await assertNoActiveChildren(client, id, "archive");
         const res = await client.query(`UPDATE tenants SET status = 'archived', deleted_at = now(), updated_at = now() WHERE id = $1 RETURNING *`, [id]);
         return res.rows[0];
     });
@@ -513,7 +513,7 @@ async function batchCreateTenants(pool, inputs) {
         // The batch runs in one transaction, so a mid-batch failure rolls the whole
         // thing back (see withTransaction). `created` was pushed to in-memory before
         // the throw, so it still lists rolled-back tenants. Clear it so the return
-        // reflects what actually persisted -- nothing -- and callers do not emit
+        // reflects what actually persisted (nothing) and callers do not emit
         // TENANT_CREATED events or audit entries for rows that never committed (#213).
         created.length = 0;
     }
@@ -538,7 +538,7 @@ async function getAncestors(pool, id) {
  * Get the root tenant for any tenant in the tree: the top-most ancestor, or the
  * tenant itself when it is already a root. Resolves in one row lookup for the
  * tenant plus one for its root (never fetches the whole ancestor chain), so it
- * is the efficient primitive for "which top-level org owns this tenant" — a
+ * is the efficient primitive for "which top-level org owns this tenant", a
  * common need in hierarchical multi-tenancy (billing scope, ownership checks,
  * root-level policy).
  */

package/dist/services/tenant-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-service.js","sourceRoot":"","sources":["../../src/services/tenant-service.ts"],"names":[],"mappings":";;AAkCA,4BAGC;AAWD,4CAmBC;AAYD,oCA4DC;AAED,8BA6BC;AAaD,0CA0BC;AAMD,kCAkCC;AAED,oCAuEC;AAkED,sCAaC;AAMD,sCAaC;AAOD,oCA2BC;AAMD,wCAeC;AAQD,oCAEC;AAED,gCAmFC;AAWD,gDAsFC;AAED,oCAsBC;AAUD,0BAyBC;AAsBD,wCA6BC;AAED,kCAQC;AAYD,sCAwDC;AAt1BD,wDAAiE;AACjE,2CAmB0B;AAE1B;;;;;;;;;;GAUG;AACI,KAAK,UAAU,QAAQ,CAAC,MAAqB,EAAE,IAA4B;IAChF,MAAM,EAAE,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,8BAA8B,CAAC;IAC3F,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,uEAAuE,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,gBAAgB,CAAC,MAAqB,EAAE,EAAU;IACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,+CAA+C,EAC/C,CAAC,EAAE,CAAC,CACL,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,2BAAoB,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAkB,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAwB;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,kBAAkB,IAAI,YAAY,CAAC;IAC1D,OAAO,QAAQ,KAAK,mBAAmB,IAAI,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjG,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,KAAwB;IACxE,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM,aAAa,GAAG,IAAA,mBAAY,EAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAEpE,2DAA2D;YAC3D,MAAM,QAAQ,GAAI,KAAiC,CAAC,SAAS,IAAK,MAAkC,CAAC,SAAS,IAAI,IAAI,CAAC;YAEvH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;qBAEa,EACb;gBACE,KAAK,CAAC,SAAS;gBACf,aAAa;gBACb,IAAA,wBAAiB,EAAC,aAAa,CAAC,CAAC,MAAM;gBACvC,KAAK,CAAC,IAAI;gBACV,KAAK,CAAC,IAAI;gBACV,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACpC,KAAK,CAAC,kBAAkB,IAAI,YAAY;gBACxC,aAAa,CAAC,KAAK,CAAC;gBACpB,QAAQ;aACT,CACF,CAAC;YAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,sCAAsC;YACtC,MAAM,YAAY,GAAI,KAAiC,CAAC,SAAS,IAAI,IAAI,CAAC;YAE1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;qBAEa,EACb;gBACE,KAAK,CAAC,IAAI;gBACV,KAAK,CAAC,IAAI;gBACV,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACpC,KAAK,CAAC,kBAAkB,IAAI,YAAY;gBACxC,aAAa,CAAC,KAAK,CAAC;gBACpB,YAAY;aACb,CACF,CAAC;YAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACxB,IACE,GAAG,YAAY,KAAK;YACpB,MAAM,IAAI,GAAG;YACZ,GAA6B,CAAC,IAAI,KAAK,OAAO,EAC/C,CAAC;YACD,MAAM,IAAI,+BAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,EAAU,EACV,eAAe,GAAG,KAAK;IAEvB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,kFAAkF;QAClF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACrD,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,IAAI,2BAAoB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,yBAAkB,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,IAAY,EACZ,eAAe,GAAG,KAAK;IAEvB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,6EAA6E;QAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uCAAuC,EACvC,CAAC,IAAI,CAAC,CACP,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAAmB,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACrD,MAAM,IAAI,0BAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,IAAI,2BAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,yBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,UAA2B,EAC3B,SAAuB,QAAQ;IAE/B,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAErC,IAAI,GAA+B,CAAC;QACpC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CACtB;;;kBAGU,EACV,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CACvC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CACtB;;;kBAGU,EACV,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAE/D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,EAAU,EACV,KAAwB;IAExB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8DAA8D,EAC9D,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,qEAAqE;YACrE,wEAAwE;YACxE,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACrD,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBACpC,CAAC,QAAQ,KAAK,mBAAmB,IAAI,QAAQ,KAAK,eAAe,CAAC,EAClE,CAAC;gBACD,MAAM,IAAI,sBAAe,CACvB,gCAAgC,QAAQ,SAAS,EACjD,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAChD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,sBAAsB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,cAAc,EACtE,MAAM,CACP,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACxB,IACE,GAAG,YAAY,KAAK;YACpB,MAAM,IAAI,GAAG;YACZ,GAA6B,CAAC,IAAI,KAAK,OAAO,EAC/C,CAAC;YACD,MAAM,IAAI,+BAAwB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,sEAAsE;AACtE,6EAA6E;AAC7E,kFAAkF;AAClF,kFAAkF;AAClF,iFAAiF;AACjF,4EAA4E;AAC5E,8EAA8E;AAC9E,EAAE;AACF,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,gFAAgF;AAChF,kEAAkE;AAClE,uEAAuE;AACvE,4EAA4E;AAC5E,wEAAwE;AACxE,mEAAmE;AACnE,8EAA8E;AAE9E;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAAC,MAAqB,EAAE,EAAU;IAChE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,gDAAgD,EAChD,CAAC,EAAE,CAAC,CACL,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,MAAqB,EAAE,EAAU;IACrE,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,kFAAkF,EAClF,CAAC,EAAE,CAAC,CACL,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,6BAAsB,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,EAAU;IAC3D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,sBAAsB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uFAAuF,EACvF,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,EAAU;IAC3D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChE,MAAM,IAAI,8BAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,sBAAsB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,0GAA0G,EAC1G,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,EAAU;IAC1D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClE,MAAM,IAAI,8BAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,qEAAqE;YACrE,6CAA6C;YAC7C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,oDAAoD,EACpD,CAAC,MAAM,CAAC,SAAS,CAAC,CACnB,CAAC;YACF,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;YAC/C,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,IAAI,0BAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,2BAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uGAAuG,EACvG,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,cAAc,CAAC,IAAa,EAAE,EAAU;IAC5D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,8BAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oFAAoF,EACpF,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,EAAU;IAC1D,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,EAAU,EACV,WAAmB;IAEnB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAEpC,0BAA0B;QAC1B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,8DAA8D,EAC9D,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAE9D,iEAAiE;QACjE,4EAA4E;QAC5E,0EAA0E;QAC1E,IACE,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE;YAC1B,IAAA,wBAAiB,EAAC,SAAS,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAC9D,CAAC;YACD,MAAM,IAAI,+BAAwB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7C,MAAM,eAAe,GAAG,IAAA,mBAAY,EAAC,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,IAAA,wBAAiB,EAAC,eAAe,CAAC,CAAC,MAAM,CAAC;QAE3D,0BAA0B;QAC1B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC;;;;;;mBAMa,EACb,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,CAAC,CAC7C,CAAC;QAEF,+CAA+C;QAC/C,2DAA2D;QAC3D,2EAA2E;QAC3E,MAAM,SAAS,GAAG,eAAe,KAAK,GAAG;YACvC,CAAC,CAAC,IAAI,EAAE,EAAE;YACV,CAAC,CAAC,GAAG,eAAe,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,eAAe,KAAK,GAAG;YACvC,CAAC,CAAC,IAAI,EAAE,EAAE;YACV,CAAC,CAAC,GAAG,eAAe,IAAI,EAAE,EAAE,CAAC;QAE/B,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,8BAA8B;QAC9B,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;;0BAEoB,EACpB,CAAC,SAAS,EAAE,GAAG,SAAS,IAAI,CAAC,CAC9B,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,gBAAgB,GAAG,IAAA,wBAAiB,EAAC,eAAe,CAAC,CAAC,MAAM,CAAC;YACnE,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;uBAKe,EACf,CAAC,eAAe,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAOD;;;GAGG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAa,EACb,MAA2B;IAE3B,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,MAAM,GAA0D,EAAE,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACjC,iEAAiE;YACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;YAE9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;gBACzC,IAAI,UAAU,GAAsB,IAAI,CAAC;gBAEzC,IAAI,QAAQ,EAAE,CAAC;oBACb,4DAA4D;oBAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;oBAC3D,IAAI,WAAW,EAAE,CAAC;wBAChB,UAAU,GAAG,WAAW,CAAC;oBAC3B,CAAC;yBAAM,CAAC;wBACN,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBACxD,CAAC;oBAED,MAAM,aAAa,GAAG,IAAA,mBAAY,EAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;oBAC5E,MAAM,QAAQ,GAAI,KAAiC,CAAC,SAAS,IAAK,UAAsC,CAAC,SAAS,IAAI,IAAI,CAAC;oBAE3H,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;yBAEa,EACb;wBACE,QAAQ;wBACR,aAAa;wBACb,IAAA,wBAAiB,EAAC,aAAa,CAAC,CAAC,MAAM;wBACvC,KAAK,CAAC,IAAI;wBACV,KAAK,CAAC,IAAI;wBACV,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;wBAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;wBACpC,KAAK,CAAC,kBAAkB,IAAI,YAAY;wBACxC,aAAa,CAAC,KAAK,CAAC;wBACpB,QAAQ;qBACT,CACF,CAAC;oBACF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,cAAc;oBACd,MAAM,YAAY,GAAI,KAAiC,CAAC,SAAS,IAAI,IAAI,CAAC;oBAC1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;yBAEa,EACb;wBACE,KAAK,CAAC,IAAI;wBACV,KAAK,CAAC,IAAI;wBACV,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;wBAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;wBACpC,KAAK,CAAC,kBAAkB,IAAI,YAAY;wBACxC,aAAa,CAAC,KAAK,CAAC;wBACpB,YAAY;qBACb,CACF,CAAC;oBACF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACxG,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,+EAA+E;QAC/E,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,EAAU;IAC1D,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,IAAA,qBAAc,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,6DAA6D,EAC7D,CAAC,WAAW,CAAC,CACd,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,OAAO,CAAC,IAAa,EAAE,EAAU;IACrD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,WAAW,GAAG,IAAA,qBAAc,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,qCAAqC,EACrC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CACjB,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,0BAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACI,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,EAAU,EACV,eAAe,GAAG,KAAK;IAEvB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,4EAA4E;QAC5E,iFAAiF;QACjF,MAAM,WAAW,GAAG,IAAA,mBAAY,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;4DACsD,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kCAAkC;0BAC3F,EACpB,CAAC,WAAW,EAAE,GAAG,WAAW,IAAI,CAAC,CAClC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,IAAa,EAAE,EAAU;IACzD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,0GAA0G,EAC1G,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,EAAU,EAAE,QAAgB;IAC7E,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,2EAA2E;QAC3E,+BAA+B;QAC/B,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjC,iBAAiB;QACjB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjC,4EAA4E;QAC5E,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,MAAM,CAAC,KAAK,CAChB,MAAM,CAAC,SAAS;YACd,CAAC,CAAC,oEAAoE;YACtE,CAAC,CAAC,uEAAuE,EAC3E,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;QAEF,yCAAyC;QACzC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,MAAM,CAAC,SAAS;YACd,CAAC,CAAC,0GAA0G;YAC5G,CAAC,CAAC,6GAA6G,EACjH,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;QAEF,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC;QAElC,+DAA+D;QAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAEnC,sDAAsD;QACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,CAAC,KAAK,CAChB,sEAAsE,EACtE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACnB,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"tenant-service.js","sourceRoot":"","sources":["../../src/services/tenant-service.ts"],"names":[],"mappings":";;AAkCA,4BAGC;AAWD,4CAmBC;AAYD,oCA4DC;AAED,8BA6BC;AAaD,0CA0BC;AAMD,kCAkCC;AAED,oCAuEC;AAsED,sCAaC;AAMD,sCAaC;AAOD,oCA2BC;AAMD,wCAeC;AAQD,oCAEC;AAED,gCAmFC;AAWD,gDAsFC;AAED,oCAsBC;AAUD,0BAyBC;AAsBD,wCA6BC;AAED,kCAQC;AAYD,sCAwDC;AA11BD,wDAAiE;AACjE,2CAmB0B;AAE1B;;;;;;;;;;GAUG;AACI,KAAK,UAAU,QAAQ,CAAC,MAAqB,EAAE,IAA4B;IAChF,MAAM,EAAE,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,8BAA8B,CAAC;IAC3F,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,uEAAuE,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,gBAAgB,CAAC,MAAqB,EAAE,EAAU;IACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,+CAA+C,EAC/C,CAAC,EAAE,CAAC,CACL,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,2BAAoB,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAkB,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAwB;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,kBAAkB,IAAI,YAAY,CAAC;IAC1D,OAAO,QAAQ,KAAK,mBAAmB,IAAI,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjG,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,KAAwB;IACxE,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM,aAAa,GAAG,IAAA,mBAAY,EAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAEpE,2DAA2D;YAC3D,MAAM,QAAQ,GAAI,KAAiC,CAAC,SAAS,IAAK,MAAkC,CAAC,SAAS,IAAI,IAAI,CAAC;YAEvH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;qBAEa,EACb;gBACE,KAAK,CAAC,SAAS;gBACf,aAAa;gBACb,IAAA,wBAAiB,EAAC,aAAa,CAAC,CAAC,MAAM;gBACvC,KAAK,CAAC,IAAI;gBACV,KAAK,CAAC,IAAI;gBACV,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACpC,KAAK,CAAC,kBAAkB,IAAI,YAAY;gBACxC,aAAa,CAAC,KAAK,CAAC;gBACpB,QAAQ;aACT,CACF,CAAC;YAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,qCAAqC;YACrC,MAAM,YAAY,GAAI,KAAiC,CAAC,SAAS,IAAI,IAAI,CAAC;YAE1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;qBAEa,EACb;gBACE,KAAK,CAAC,IAAI;gBACV,KAAK,CAAC,IAAI;gBACV,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACpC,KAAK,CAAC,kBAAkB,IAAI,YAAY;gBACxC,aAAa,CAAC,KAAK,CAAC;gBACpB,YAAY;aACb,CACF,CAAC;YAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACxB,IACE,GAAG,YAAY,KAAK;YACpB,MAAM,IAAI,GAAG;YACZ,GAA6B,CAAC,IAAI,KAAK,OAAO,EAC/C,CAAC;YACD,MAAM,IAAI,+BAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,EAAU,EACV,eAAe,GAAG,KAAK;IAEvB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,kFAAkF;QAClF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACrD,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,IAAI,2BAAoB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,yBAAkB,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,IAAY,EACZ,eAAe,GAAG,KAAK;IAEvB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,6EAA6E;QAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uCAAuC,EACvC,CAAC,IAAI,CAAC,CACP,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAAmB,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACrD,MAAM,IAAI,0BAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,IAAI,2BAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,yBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,UAA2B,EAC3B,SAAuB,QAAQ;IAE/B,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAErC,IAAI,GAA+B,CAAC;QACpC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CACtB;;;kBAGU,EACV,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CACvC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CACtB;;;kBAGU,EACV,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAE/D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,EAAU,EACV,KAAwB;IAExB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8DAA8D,EAC9D,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,qEAAqE;YACrE,wEAAwE;YACxE,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACrD,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBACpC,CAAC,QAAQ,KAAK,mBAAmB,IAAI,QAAQ,KAAK,eAAe,CAAC,EAClE,CAAC;gBACD,MAAM,IAAI,sBAAe,CACvB,gCAAgC,QAAQ,SAAS,EACjD,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAChD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,sBAAsB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,cAAc,EACtE,MAAM,CACP,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACxB,IACE,GAAG,YAAY,KAAK;YACpB,MAAM,IAAI,GAAG;YACZ,GAA6B,CAAC,IAAI,KAAK,OAAO,EAC/C,CAAC;YACD,MAAM,IAAI,+BAAwB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,sEAAsE;AACtE,6EAA6E;AAC7E,kFAAkF;AAClF,kFAAkF;AAClF,iFAAiF;AACjF,4EAA4E;AAC5E,8EAA8E;AAC9E,EAAE;AACF,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,gFAAgF;AAChF,kEAAkE;AAClE,uEAAuE;AACvE,4EAA4E;AAC5E,wEAAwE;AACxE,mEAAmE;AACnE,8EAA8E;AAE9E;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAAC,MAAqB,EAAE,EAAU;IAChE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,gDAAgD,EAChD,CAAC,EAAE,CAAC,CACL,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAqB,EACrB,EAAU,EACV,MAA6B;IAE7B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,kFAAkF,EAClF,CAAC,EAAE,CAAC,CACL,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,6BAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,EAAU;IAC3D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,sBAAsB,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uFAAuF,EACvF,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,EAAU;IAC3D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChE,MAAM,IAAI,8BAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,sBAAsB,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,0GAA0G,EAC1G,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,EAAU;IAC1D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClE,MAAM,IAAI,8BAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,qEAAqE;YACrE,6CAA6C;YAC7C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,oDAAoD,EACpD,CAAC,MAAM,CAAC,SAAS,CAAC,CACnB,CAAC;YACF,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;YAC/C,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,IAAI,0BAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,2BAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uGAAuG,EACvG,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,cAAc,CAAC,IAAa,EAAE,EAAU;IAC5D,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,8BAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,oFAAoF,EACpF,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,EAAU;IAC1D,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,EAAU,EACV,WAAmB;IAEnB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAEpC,0BAA0B;QAC1B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,8DAA8D,EAC9D,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAE9D,iEAAiE;QACjE,4EAA4E;QAC5E,0EAA0E;QAC1E,IACE,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE;YAC1B,IAAA,wBAAiB,EAAC,SAAS,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAC9D,CAAC;YACD,MAAM,IAAI,+BAAwB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7C,MAAM,eAAe,GAAG,IAAA,mBAAY,EAAC,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,IAAA,wBAAiB,EAAC,eAAe,CAAC,CAAC,MAAM,CAAC;QAE3D,0BAA0B;QAC1B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC;;;;;;mBAMa,EACb,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,CAAC,CAC7C,CAAC;QAEF,+CAA+C;QAC/C,2DAA2D;QAC3D,2EAA2E;QAC3E,MAAM,SAAS,GAAG,eAAe,KAAK,GAAG;YACvC,CAAC,CAAC,IAAI,EAAE,EAAE;YACV,CAAC,CAAC,GAAG,eAAe,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,eAAe,KAAK,GAAG;YACvC,CAAC,CAAC,IAAI,EAAE,EAAE;YACV,CAAC,CAAC,GAAG,eAAe,IAAI,EAAE,EAAE,CAAC;QAE/B,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,8BAA8B;QAC9B,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;;0BAEoB,EACpB,CAAC,SAAS,EAAE,GAAG,SAAS,IAAI,CAAC,CAC9B,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,gBAAgB,GAAG,IAAA,wBAAiB,EAAC,eAAe,CAAC,CAAC,MAAM,CAAC;YACnE,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;uBAKe,EACf,CAAC,eAAe,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAOD;;;GAGG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAa,EACb,MAA2B;IAE3B,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,MAAM,GAA0D,EAAE,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACjC,iEAAiE;YACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;YAE9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;gBACzC,IAAI,UAAU,GAAsB,IAAI,CAAC;gBAEzC,IAAI,QAAQ,EAAE,CAAC;oBACb,4DAA4D;oBAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;oBAC3D,IAAI,WAAW,EAAE,CAAC;wBAChB,UAAU,GAAG,WAAW,CAAC;oBAC3B,CAAC;yBAAM,CAAC;wBACN,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBACxD,CAAC;oBAED,MAAM,aAAa,GAAG,IAAA,mBAAY,EAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;oBAC5E,MAAM,QAAQ,GAAI,KAAiC,CAAC,SAAS,IAAK,UAAsC,CAAC,SAAS,IAAI,IAAI,CAAC;oBAE3H,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;yBAEa,EACb;wBACE,QAAQ;wBACR,aAAa;wBACb,IAAA,wBAAiB,EAAC,aAAa,CAAC,CAAC,MAAM;wBACvC,KAAK,CAAC,IAAI;wBACV,KAAK,CAAC,IAAI;wBACV,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;wBAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;wBACpC,KAAK,CAAC,kBAAkB,IAAI,YAAY;wBACxC,aAAa,CAAC,KAAK,CAAC;wBACpB,QAAQ;qBACT,CACF,CAAC;oBACF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,cAAc;oBACd,MAAM,YAAY,GAAI,KAAiC,CAAC,SAAS,IAAI,IAAI,CAAC;oBAC1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;yBAEa,EACb;wBACE,KAAK,CAAC,IAAI;wBACV,KAAK,CAAC,IAAI;wBACV,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;wBAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;wBACpC,KAAK,CAAC,kBAAkB,IAAI,YAAY;wBACxC,aAAa,CAAC,KAAK,CAAC;wBACpB,YAAY;qBACb,CACF,CAAC;oBACF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACxG,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,qEAAqE;QACrE,+EAA+E;QAC/E,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,EAAU;IAC1D,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,IAAA,qBAAc,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,6DAA6D,EAC7D,CAAC,WAAW,CAAC,CACd,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,OAAO,CAAC,IAAa,EAAE,EAAU;IACrD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,WAAW,GAAG,IAAA,qBAAc,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,qCAAqC,EACrC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CACjB,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,0BAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACI,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,EAAU,EACV,eAAe,GAAG,KAAK;IAEvB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,4EAA4E;QAC5E,iFAAiF;QACjF,MAAM,WAAW,GAAG,IAAA,mBAAY,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;4DACsD,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kCAAkC;0BAC3F,EACpB,CAAC,WAAW,EAAE,GAAG,WAAW,IAAI,CAAC,CAClC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,IAAa,EAAE,EAAU;IACzD,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,0GAA0G,EAC1G,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,EAAU,EAAE,QAAgB;IAC7E,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,2EAA2E;QAC3E,+BAA+B;QAC/B,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjC,iBAAiB;QACjB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjC,4EAA4E;QAC5E,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,MAAM,CAAC,KAAK,CAChB,MAAM,CAAC,SAAS;YACd,CAAC,CAAC,oEAAoE;YACtE,CAAC,CAAC,uEAAuE,EAC3E,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;QAEF,yCAAyC;QACzC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,MAAM,CAAC,SAAS;YACd,CAAC,CAAC,0GAA0G;YAC5G,CAAC,CAAC,6GAA6G,EACjH,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;QAEF,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC;QAElC,+DAA+D;QAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAEnC,sDAAsD;QACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,CAAC,KAAK,CAChB,sEAAsE,EACtE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACnB,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,qCAAqC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/stratum-policies.d.ts

@@ -0,0 +1,51 @@
+import type pg from "pg";
+/**
+ * The canonical row-level security of the Stratum tables: the tables that
+ * have it and every policy on them, as migrations 019, 020, 031 and 032
+ * leave them. stratum_apply_control_role() of migration 032 drops every
+ * policy on these tables and re-creates exactly this set (a unit test checks
+ * that the function's SQL is the one policiesPlpgsql() renders), and
+ * stratumPolicyDrift() compares a database with it.
+ */
+/** The Stratum tables with row-level security enabled and forced. */
+export declare const STRATUM_RLS_TABLES: readonly string[];
+export interface StratumPolicy {
+    table: string;
+    name: string;
+    cmd: "ALL" | "SELECT";
+    /** "control" for the control role, else PUBLIC. */
+    to: "control" | "public";
+    using: string;
+    check: string | null;
+}
+/** Every canonical policy, in a fixed order. */
+export declare function stratumPolicies(): StratumPolicy[];
+/**
+ * The PL/pgSQL statements of stratum_apply_control_role() that reset the
+ * row-level security of the Stratum tables: every policy on them is dropped,
+ * RLS is enabled and forced, and the canonical policies are created. They
+ * expect the variables v_schema, v_role, v_table and v_policy.
+ */
+export declare function policiesPlpgsql(): string;
+export interface PolicyDriftOptions {
+    /** The control role. Default: the role of the database's stratum_control_plane policies, else stratum_control. */
+    controlRole?: string;
+}
+/**
+ * The differences between the row-level security of the Stratum tables in
+ * the schema of `tenants` (on the search path of `pool`) and the canonical
+ * set: tables without RLS enabled and forced, and policies that are missing,
+ * extra, or differ in command, roles or expressions. Empty when they match.
+ * Before the control role is applied (no stratum_control_plane policy
+ * anywhere), the control policies, and FORCE on stratum_security, are not
+ * expected.
+ *
+ * The canonical expressions are deparsed by the same server: the check
+ * creates temporary tables with the same names and columns, puts the
+ * canonical policies on them, and compares pg_get_expr() of both, all in a
+ * transaction that it rolls back. It needs only the TEMP privilege. The
+ * transaction's search path is pg_catalog only (see pinned-query.ts), so
+ * both sides print the Stratum names with their schema.
+ */
+export declare function stratumPolicyDrift(pool: pg.Pool, options?: PolicyDriftOptions): Promise<string[]>;
+//# sourceMappingURL=stratum-policies.d.ts.map

package/dist/stratum-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum-policies.d.ts","sourceRoot":"","sources":["../src/stratum-policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAIzB;;;;;;;GAOG;AAEH,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAgB9C,CAAC;AAEH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,KAAK,GAAG,QAAQ,CAAC;IACtB,mDAAmD;IACnD,EAAE,EAAE,SAAS,GAAG,QAAQ,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AA8BD,gDAAgD;AAChD,wBAAgB,eAAe,IAAI,aAAa,EAAE,CAyBjD;AAuBD;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAiBxC;AAED,MAAM,WAAW,kBAAkB;IACjC,kHAAkH;IAClH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmF3G"}

package/dist/stratum-policies.js

@@ -0,0 +1,217 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STRATUM_RLS_TABLES = void 0;
+exports.stratumPolicies = stratumPolicies;
+exports.policiesPlpgsql = policiesPlpgsql;
+exports.stratumPolicyDrift = stratumPolicyDrift;
+const migration_sql_js_1 = require("./migration-sql.js");
+const pinned_query_js_1 = require("./pinned-query.js");
+/**
+ * The canonical row-level security of the Stratum tables: the tables that
+ * have it and every policy on them, as migrations 019, 020, 031 and 032
+ * leave them. stratum_apply_control_role() of migration 032 drops every
+ * policy on these tables and re-creates exactly this set (a unit test checks
+ * that the function's SQL is the one policiesPlpgsql() renders), and
+ * stratumPolicyDrift() compares a database with it.
+ */
+/** The Stratum tables with row-level security enabled and forced. */
+exports.STRATUM_RLS_TABLES = Object.freeze([
+    "tenants",
+    "config_entries",
+    "permission_policies",
+    "audit_logs",
+    "webhook_events",
+    "webhook_deliveries",
+    "webhooks",
+    "consent_records",
+    "abac_policies",
+    "api_keys",
+    "roles",
+    "principal_roles",
+    "usage_events",
+    "regions",
+    "stratum_security",
+]);
+const LEGACY = "(SELECT %1$I.stratum_legacy_bypass())";
+const CURRENT_TENANT = "NULLIF(current_setting('app.current_tenant_id', true), '')::uuid";
+const SUBTREE = "((SELECT %1$I.stratum_subtree_tenant_ids())::uuid[])";
+const SCOPE = "current_setting('app.tenant_scope', true) = 'subtree'";
+/** Tables whose rows carry tenant_id. */
+const TENANT_ID_TABLES = [
+    "config_entries",
+    "permission_policies",
+    "audit_logs",
+    "webhook_events",
+    "webhooks",
+    "consent_records",
+    "abac_policies",
+    "api_keys",
+    "roles",
+    "usage_events",
+];
+/** Tables with the subtree read of migration 031 (not webhooks or api_keys, which hold credentials). */
+const SUBTREE_TENANT_ID_TABLES = TENANT_ID_TABLES.filter((t) => t !== "webhooks" && t !== "api_keys");
+/** Rows scoped through a parent table: the scope of the parent's tenant_id. */
+const VIA_PARENT = {
+    webhook_deliveries: "SELECT 1 FROM %1$I.webhook_events we WHERE we.id = webhook_deliveries.event_id AND we.tenant_id",
+    principal_roles: "SELECT 1 FROM %1$I.roles r WHERE r.id = principal_roles.role_id AND r.tenant_id",
+};
+/** Every canonical policy, in a fixed order. */
+function stratumPolicies() {
+    const policies = [];
+    const isolation = (table, scope) => {
+        const expr = `${LEGACY} OR ${scope}`;
+        policies.push({ table, name: "tenant_isolation", cmd: "ALL", to: "public", using: expr, check: expr });
+    };
+    const subtree = (table, scope) => {
+        policies.push({ table, name: "tenant_subtree_read", cmd: "SELECT", to: "public", using: `${SCOPE} AND ${scope}`, check: null });
+    };
+    for (const table of TENANT_ID_TABLES)
+        isolation(table, `tenant_id = ${CURRENT_TENANT}`);
+    isolation("tenants", `id = ${CURRENT_TENANT}`);
+    for (const [table, join] of Object.entries(VIA_PARENT))
+        isolation(table, `EXISTS (${join} = ${CURRENT_TENANT})`);
+    for (const table of SUBTREE_TENANT_ID_TABLES) {
+        subtree(table, table === "config_entries" ? `tenant_id = ANY ${SUBTREE} AND NOT sensitive` : `tenant_id = ANY ${SUBTREE}`);
+    }
+    subtree("tenants", `id = ANY ${SUBTREE}`);
+    for (const [table, join] of Object.entries(VIA_PARENT))
+        subtree(table, `EXISTS (${join} = ANY ${SUBTREE})`);
+    policies.push({ table: "regions", name: "stratum_legacy_bypass", cmd: "ALL", to: "public", using: LEGACY, check: LEGACY });
+    for (const table of exports.STRATUM_RLS_TABLES) {
+        policies.push({ table, name: "stratum_control_plane", cmd: "ALL", to: "control", using: "true", check: "true" });
+    }
+    return policies;
+}
+/**
+ * The CREATE POLICY statement of `p`, with the format() placeholders %1$I for
+ * the schema and, for the control role, %2$I for the role. Every Stratum
+ * object the expressions name is qualified with the schema, because
+ * stratum_apply_control_role() runs with search_path = pg_catalog, pg_temp.
+ */
+function createPolicyTemplate(p) {
+    const to = p.to === "control" ? " AS PERMISSIVE FOR ALL TO %2$I" : ` FOR ${p.cmd}`;
+    const check = p.check === null ? "" : ` WITH CHECK (${p.check})`;
+    return `CREATE POLICY ${p.name} ON %1$I.${p.table}${to} USING (${p.using})${check}`;
+}
+/**
+ * `text` with the schema placeholder replaced by `schema`, for the canonical
+ * policies that stratumPolicyDrift() puts on temporary tables: the functions
+ * and tables they name are the live Stratum ones, as in the live policies.
+ */
+function inSchema(text, schema) {
+    return text.split("%1$I.").join(`${(0, pinned_query_js_1.quoteIdentifier)(schema)}.`);
+}
+/**
+ * The PL/pgSQL statements of stratum_apply_control_role() that reset the
+ * row-level security of the Stratum tables: every policy on them is dropped,
+ * RLS is enabled and forced, and the canonical policies are created. They
+ * expect the variables v_schema, v_role, v_table and v_policy.
+ */
+function policiesPlpgsql() {
+    const lines = [
+        "  FOREACH v_table IN ARRAY v_tables LOOP",
+        "    FOR v_policy IN",
+        "      SELECT p.polname FROM pg_policy p WHERE p.polrelid = format('%I.%I', v_schema, v_table)::regclass",
+        "    LOOP",
+        "      EXECUTE format('DROP POLICY %I ON %I.%I', v_policy, v_schema, v_table);",
+        "    END LOOP;",
+        "    EXECUTE format('ALTER TABLE %I.%I ENABLE ROW LEVEL SECURITY', v_schema, v_table);",
+        "    EXECUTE format('ALTER TABLE %I.%I FORCE ROW LEVEL SECURITY', v_schema, v_table);",
+        "  END LOOP;",
+    ];
+    for (const p of stratumPolicies()) {
+        const args = p.to === "control" ? "v_schema, v_role" : "v_schema";
+        lines.push(`  EXECUTE format($pol$${createPolicyTemplate(p)}$pol$, ${args});`);
+    }
+    return lines.join("\n");
+}
+/**
+ * The differences between the row-level security of the Stratum tables in
+ * the schema of `tenants` (on the search path of `pool`) and the canonical
+ * set: tables without RLS enabled and forced, and policies that are missing,
+ * extra, or differ in command, roles or expressions. Empty when they match.
+ * Before the control role is applied (no stratum_control_plane policy
+ * anywhere), the control policies, and FORCE on stratum_security, are not
+ * expected.
+ *
+ * The canonical expressions are deparsed by the same server: the check
+ * creates temporary tables with the same names and columns, puts the
+ * canonical policies on them, and compares pg_get_expr() of both, all in a
+ * transaction that it rolls back. It needs only the TEMP privilege. The
+ * transaction's search path is pg_catalog only (see pinned-query.ts), so
+ * both sides print the Stratum names with their schema.
+ */
+async function stratumPolicyDrift(pool, options = {}) {
+    const nsp = await (0, pinned_query_js_1.schemaOfTable)(pool);
+    if (!nsp)
+        return ["the tenants table was not found; run the Stratum migrations"];
+    const client = await pool.connect();
+    try {
+        await client.query("BEGIN");
+        await client.query(`SET LOCAL search_path = ${pinned_query_js_1.PINNED_SEARCH_PATH}`);
+        const ns = await client.query(`SELECT (SELECT min(r::text) FROM pg_policies p, unnest(p.roles) r WHERE p.policyname = 'stratum_control_plane') AS control`);
+        const applied = ns.rows[0].control !== null;
+        const control = options.controlRole ?? ns.rows[0].control ?? migration_sql_js_1.STRATUM_CONTROL_ROLE;
+        const expected = stratumPolicies().filter((p) => applied || p.to !== "control");
+        const policyQuery = (namespace) => client.query(`SELECT c.relname AS tbl, p.polname AS name, p.polpermissive AS permissive, p.polcmd::text AS cmd,
+                ARRAY(SELECT CASE WHEN r = 0 THEN 'public' ELSE pg_get_userbyid(r)::text END FROM unnest(p.polroles) r ORDER BY 1) AS roles,
+                pg_get_expr(p.polqual, p.polrelid) AS qual, pg_get_expr(p.polwithcheck, p.polrelid) AS chk
+           FROM pg_policy p JOIN pg_class c ON c.oid = p.polrelid
+          WHERE c.relnamespace = (SELECT n.oid FROM pg_namespace n WHERE n.nspname = $1::text) AND c.relname = ANY ($2::text[])`, [namespace, exports.STRATUM_RLS_TABLES]);
+        const issues = [];
+        const flags = await client.query(`SELECT c.relname, c.relrowsecurity AS on, c.relforcerowsecurity AS forced FROM pg_class c
+        WHERE c.relnamespace = (SELECT n.oid FROM pg_namespace n WHERE n.nspname = $1::text) AND c.relname = ANY ($2::text[])`, [nsp, exports.STRATUM_RLS_TABLES]);
+        for (const f of flags.rows) {
+            // Until the control role is applied, migration 032 leaves stratum_security
+            // without FORCE, so that its owner's definer function can read it.
+            const forceExpected = applied || f.relname !== "stratum_security";
+            if (!f.on || (forceExpected && !f.forced)) {
+                issues.push(`${f.relname}: row-level security is not enabled${forceExpected ? " and forced" : ""}`);
+            }
+        }
+        const live = (await policyQuery(nsp)).rows;
+        // The canonical policies, on temporary tables of the same names and columns.
+        const columns = await client.query(`SELECT c.relname, string_agg(format('%I %s', a.attname, format_type(a.atttypid, a.atttypmod)), ', ' ORDER BY a.attnum) AS cols
+         FROM pg_class c JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped
+        WHERE c.relnamespace = (SELECT n.oid FROM pg_namespace n WHERE n.nspname = $1::text) AND c.relname = ANY ($2::text[])
+        GROUP BY c.relname`, [nsp, exports.STRATUM_RLS_TABLES]);
+        for (const t of columns.rows) {
+            await client.query(`CREATE TEMP TABLE pg_temp."${t.relname}" (${t.cols}) ON COMMIT DROP`);
+        }
+        for (const p of expected) {
+            if (!columns.rows.some((t) => t.relname === p.table))
+                continue;
+            const to = p.to === "control" ? ` AS PERMISSIVE FOR ALL TO "${control}"` : ` FOR ${p.cmd}`;
+            const check = p.check === null ? "" : ` WITH CHECK (${inSchema(p.check, nsp)})`;
+            await client.query(`CREATE POLICY ${p.name} ON pg_temp."${p.table}"${to} USING (${inSchema(p.using, nsp)})${check}`);
+        }
+        const temp = await client.query("SELECT pg_my_temp_schema()::regnamespace::text AS nsp");
+        const canonical = (await policyQuery(temp.rows[0].nsp)).rows;
+        const key = (r) => `${r.tbl}.${r.name}`;
+        const liveByKey = new Map(live.map((r) => [key(r), r]));
+        for (const c of canonical) {
+            const l = liveByKey.get(key(c));
+            if (!l) {
+                issues.push(`${c.tbl}: policy ${c.name} is missing`);
+                continue;
+            }
+            liveByKey.delete(key(c));
+            const differs = l.permissive !== c.permissive ||
+                l.cmd !== c.cmd ||
+                l.roles.join(",") !== c.roles.join(",") ||
+                l.qual !== c.qual ||
+                l.chk !== c.chk;
+            if (differs)
+                issues.push(`${c.tbl}: policy ${c.name} differs from migration 032`);
+        }
+        for (const l of liveByKey.values())
+            issues.push(`${l.tbl}: policy ${l.name} is not a Stratum policy`);
+        return issues;
+    }
+    finally {
+        await client.query("ROLLBACK").catch(() => undefined);
+        client.release();
+    }
+}
+//# sourceMappingURL=stratum-policies.js.map

package/dist/stratum-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum-policies.js","sourceRoot":"","sources":["../src/stratum-policies.ts"],"names":[],"mappings":";;;AAuEA,0CAyBC;AA6BD,0CAiBC;AAuBD,gDAmFC;AAvPD,yDAA0D;AAC1D,uDAAuF;AAEvF;;;;;;;GAOG;AAEH,qEAAqE;AACxD,QAAA,kBAAkB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACjE,SAAS;IACT,gBAAgB;IAChB,qBAAqB;IACrB,YAAY;IACZ,gBAAgB;IAChB,oBAAoB;IACpB,UAAU;IACV,iBAAiB;IACjB,eAAe;IACf,UAAU;IACV,OAAO;IACP,iBAAiB;IACjB,cAAc;IACd,SAAS;IACT,kBAAkB;CACnB,CAAC,CAAC;AAYH,MAAM,MAAM,GAAG,uCAAuC,CAAC;AACvD,MAAM,cAAc,GAAG,kEAAkE,CAAC;AAC1F,MAAM,OAAO,GAAG,sDAAsD,CAAC;AACvE,MAAM,KAAK,GAAG,uDAAuD,CAAC;AAEtE,yCAAyC;AACzC,MAAM,gBAAgB,GAAG;IACvB,gBAAgB;IAChB,qBAAqB;IACrB,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,eAAe;IACf,UAAU;IACV,OAAO;IACP,cAAc;CACf,CAAC;AAEF,wGAAwG;AACxG,MAAM,wBAAwB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;AAEtG,+EAA+E;AAC/E,MAAM,UAAU,GAA2B;IACzC,kBAAkB,EAAE,iGAAiG;IACrH,eAAe,EAAE,iFAAiF;CACnG,CAAC;AAEF,gDAAgD;AAChD,SAAgB,eAAe;IAC7B,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,KAAa,EAAQ,EAAE;QACvD,MAAM,IAAI,GAAG,GAAG,MAAM,OAAO,KAAK,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzG,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,KAAa,EAAQ,EAAE;QACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,QAAQ,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClI,CAAC,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,gBAAgB;QAAE,SAAS,CAAC,KAAK,EAAE,eAAe,cAAc,EAAE,CAAC,CAAC;IACxF,SAAS,CAAC,SAAS,EAAE,QAAQ,cAAc,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,SAAS,CAAC,KAAK,EAAE,WAAW,IAAI,MAAM,cAAc,GAAG,CAAC,CAAC;IAEjH,KAAK,MAAM,KAAK,IAAI,wBAAwB,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,EAAE,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,OAAO,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,CAAC,SAAS,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,WAAW,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;IAE5G,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3H,KAAK,MAAM,KAAK,IAAI,0BAAkB,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,CAAgB;IAC5C,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;IACnF,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,KAAK,GAAG,CAAC;IACjE,OAAO,iBAAiB,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,KAAK,GAAG,EAAE,WAAW,CAAC,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAA,iCAAe,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe;IAC7B,MAAM,KAAK,GAAG;QACZ,0CAA0C;QAC1C,qBAAqB;QACrB,yGAAyG;QACzG,UAAU;QACV,+EAA+E;QAC/E,eAAe;QACf,uFAAuF;QACvF,sFAAsF;QACtF,aAAa;KACd,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,yBAAyB,oBAAoB,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAOD;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,kBAAkB,CAAC,IAAa,EAAE,UAA8B,EAAE;IACtF,MAAM,GAAG,GAAG,MAAM,IAAA,+BAAa,EAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,6DAA6D,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,2BAA2B,oCAAkB,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC3B,4HAA4H,CAC7H,CAAC;QACF,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,uCAAoB,CAAC;QAClF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAEhF,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,EAAE,CACxC,MAAM,CAAC,KAAK,CACV;;;;gIAIwH,EACxH,CAAC,SAAS,EAAE,0BAAkB,CAAC,CAChC,CAAC;QAEJ,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;8HACwH,EACxH,CAAC,GAAG,EAAE,0BAAkB,CAAC,CAC1B,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3B,2EAA2E;YAC3E,mEAAmE;YACnE,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC;YAClE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,sCAAsC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3C,6EAA6E;QAC7E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;;2BAGqB,EACrB,CAAC,GAAG,EAAE,0BAAkB,CAAC,CAC1B,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC;QAC5F,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/D,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3F,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;YAChF,MAAM,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,KAAK,IAAI,EAAE,WAAW,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAkB,uDAAuD,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAE7D,MAAM,GAAG,GAAG,CAAC,CAAgC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC;gBACrD,SAAS;YACX,CAAC;YACD,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,OAAO,GACX,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;gBAC7B,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG;gBACf,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;gBACvC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;gBACjB,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;YAClB,IAAI,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC;QACtG,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/stratum-tables.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stratum-tables.d.ts","sourceRoot":"","sources":["../src/stratum-tables.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAgB1C,CAAC"}
+{"version":3,"file":"stratum-tables.d.ts","sourceRoot":"","sources":["../src/stratum-tables.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAiB1C,CAAC"}

package/dist/stratum-tables.js

@@ -22,6 +22,7 @@ exports.STRATUM_TABLES = Object.freeze([
     "principal_roles",
     "regions",
     "roles",
+    "stratum_security",
     "tenants",
     "usage_events",
     "webhook_deliveries",

package/dist/stratum-tables.js.map

@@ -1 +1 @@
-{"version":3,"file":"stratum-tables.js","sourceRoot":"","sources":["../src/stratum-tables.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACU,QAAA,cAAc,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,aAAa;IACb,eAAe;IACf,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,iBAAiB;IACjB,SAAS;IACT,OAAO;IACP,SAAS;IACT,cAAc;IACd,oBAAoB;IACpB,gBAAgB;IAChB,UAAU;CACX,CAAC,CAAC"}
+{"version":3,"file":"stratum-tables.js","sourceRoot":"","sources":["../src/stratum-tables.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACU,QAAA,cAAc,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,aAAa;IACb,eAAe;IACf,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,iBAAiB;IACjB,SAAS;IACT,OAAO;IACP,kBAAkB;IAClB,SAAS;IACT,cAAc;IACd,oBAAoB;IACpB,gBAAgB;IAChB,UAAU;CACX,CAAC,CAAC"}

package/dist/stratum.d.ts

@@ -5,18 +5,53 @@ import * as eventService from "./services/event-service.js";
 import * as keyRotationService from "./services/key-rotation-service.js";
 import * as roleService from "./services/role-service.js";
 import { type StratumLogger } from "./logger.js";
-import type { TenantNode, CreateTenantInput, UpdateTenantInput, PaginationInput, PaginatedResult, ConfigEntry, SetConfigInput, BatchSetConfigEntry, ResolvedConfig, BatchSetConfigResult, PermissionPolicy, CreatePermissionInput, UpdatePermissionInput, ResolvedPermission, Webhook, CreateWebhookInput, UpdateWebhookInput, WebhookEvent, WebhookDelivery, ListWebhookEventsQuery, AuditContext, AuditEntry, AuditLogQuery, RecordAuditEventInput, ConsentRecord, GrantConsentInput, Region, CreateRegionInput, UpdateRegionInput, TenantContext, TenantStatus, ResolvedTenantContext, ConfigDiff, DriftResult, BatchDriftResult, AbacPolicy, CreateAbacPolicyInput, AbacEvaluationRequest, AbacEvaluationResult, ResolvedAbacPolicy, RecordUsageInput, UsageEvent, UsageAggregate, UsageAggregateQuery } from "@stratum-hq/core";
+import type { TenantNode, CreateTenantInput, UpdateTenantInput, PaginationInput, PaginatedResult, ConfigEntry, SetConfigInput, BatchSetConfigEntry, ResolvedConfig, ResolveConfigOptions, BatchSetConfigResult, PermissionPolicy, CreatePermissionInput, UpdatePermissionInput, ResolvedPermission, Webhook, CreateWebhookInput, UpdateWebhookInput, WebhookEvent, WebhookDelivery, ListWebhookEventsQuery, AuditContext, AuditEntry, AuditLogQuery, RecordAuditEventInput, ConsentRecord, GrantConsentInput, Region, CreateRegionInput, UpdateRegionInput, TenantContext, TenantStatus, ResolvedTenantContext, ConfigDiff, DriftResult, BatchDriftResult, AbacPolicy, CreateAbacPolicyInput, AbacEvaluationRequest, AbacEvaluationResult, ResolvedAbacPolicy, RecordUsageInput, UsageEvent, UsageAggregate, UsageAggregateQuery } from "@stratum-hq/core";
 export interface StratumOptions {
+    /**
+     * The application's pool. With `adminPool`, the library runs no query of
+     * its own on it; initialize() only checks its role. Without `adminPool`,
+     * the library runs every query on it through the legacy app.bypass_rls path.
+     */
     pool: pg.Pool;
+    /**
+     * The library's own pool: a login that is a member of the control role
+     * (migration 032). Every library query and autoMigrate run on it. Optional
+     * in 1.x, with a deprecation warning when absent; required in 2.0.
+     */
+    adminPool?: pg.Pool;
+    /**
+     * The control role. Default: the role the database's policies name, else
+     * `stratum_control`. autoMigrate passes it to migrate().
+     */
+    controlRole?: string;
+    /**
+     * Accept API keys stored with the legacy unkeyed SHA-256 hash (version 1)
+     * while STRATUM_API_KEY_HMAC_SECRET is set, and re-hash each one with HMAC
+     * when it authenticates (a warning is logged once per process when that
+     * happens). Default true in 1.x; the default becomes false in 2.0. Set it
+     * to false to accept only HMAC hashes once the secret is set. Without the
+     * secret, SHA-256 is the only hash and this option has no effect.
+     */
+    allowLegacyKeyHashes?: boolean;
     keyPrefix?: string;
     logger?: StratumLogger;
     /** Run migrations automatically on initialize(). Defaults to false. */
     autoMigrate?: boolean;
-    /** When true, migrations hard-fail if the PG role has BYPASSRLS. Use in production. */
+    /**
+     * When true, initialize() (and migrations) hard-fail if the PG role has
+     * BYPASSRLS. Checked on every initialize, whether or not a migration runs.
+     * With adminPool, initialize() also fails when the login of pool does not
+     * fit the role model, including when it can create objects in the schema
+     * of the Stratum tables. Use in production.
+     */
     enforceRls?: boolean;
 }
 export declare class Stratum {
     private readonly pool;
+    private readonly appPool;
+    private readonly hasAdminPool;
+    private readonly controlRole;
+    private readonly allowLegacyKeyHashes;
     private readonly keyPrefix;
     private readonly logger;
     private readonly autoMigrate;
@@ -24,9 +59,9 @@ export declare class Stratum {
     private initPromise;
     constructor(options: StratumOptions);
     /**
-     * Initialize Stratum — runs migrations if autoMigrate is enabled.
+     * Initialize Stratum: runs migrations if autoMigrate is enabled.
      * Call this once before using any other methods. Safe to call multiple
-     * times concurrently — subsequent calls return the same promise.
+     * times concurrently; subsequent calls return the same promise.
      */
     initialize(): Promise<void>;
     private _doInitialize;
@@ -44,7 +79,7 @@ export declare class Stratum {
     createTenant(input: CreateTenantInput, audit?: AuditContext): Promise<TenantNode>;
     getTenant(id: string, includeArchived?: boolean): Promise<TenantNode>;
     /**
-     * Resolve a tenant by its globally-unique slug in one indexed lookup — the
+     * Resolve a tenant by its globally-unique slug in one indexed lookup, the
      * slug-keyed counterpart to {@link getTenant}, mirroring its archived /
      * suspended handling. See {@link tenantService.getTenantBySlug}.
      */
@@ -101,19 +136,29 @@ export declare class Stratum {
     getDescendants(id: string, includeArchived?: boolean): Promise<TenantNode[]>;
     getChildren(id: string): Promise<TenantNode[]>;
     reorderTenant(id: string, position: number, audit?: AuditContext): Promise<TenantNode>;
-    getTenantContext(tenantId: string): Promise<TenantContext>;
-    resolveConfig(tenantId: string): Promise<ResolvedConfig>;
+    getTenantContext(tenantId: string, options?: ResolveConfigOptions): Promise<TenantContext>;
+    /**
+     * Resolve a tenant's effective config. Sensitive values inherited from an
+     * ancestor come back masked (`value: null`, `masked: true`) unless
+     * `options.revealSensitive` is set, or `options.viewerTenantId` is the
+     * tenant that set them.
+     */
+    resolveConfig(tenantId: string, options?: ResolveConfigOptions): Promise<ResolvedConfig>;
     setConfig(tenantId: string, key: string, input: SetConfigInput, audit?: AuditContext): Promise<ConfigEntry>;
     deleteConfig(tenantId: string, key: string, audit?: AuditContext): Promise<void>;
-    getConfigWithInheritance(tenantId: string): Promise<ResolvedConfig>;
-    diffConfig(tenantIdA: string, tenantIdB: string): Promise<ConfigDiff>;
+    getConfigWithInheritance(tenantId: string, options?: ResolveConfigOptions): Promise<ResolvedConfig>;
+    diffConfig(tenantIdA: string, tenantIdB: string, options?: ResolveConfigOptions): Promise<ConfigDiff>;
     computeDrift(parentId: string, childId: string): Promise<DriftResult>;
     batchComputeDrift(parentId: string, childIds: string[]): Promise<BatchDriftResult>;
     resolvePermissions(tenantId: string): Promise<Record<string, ResolvedPermission>>;
     createPermission(tenantId: string, input: CreatePermissionInput, audit?: AuditContext): Promise<PermissionPolicy>;
     updatePermission(tenantId: string, policyId: string, input: UpdatePermissionInput, audit?: AuditContext): Promise<PermissionPolicy>;
     deletePermission(tenantId: string, policyId: string, audit?: AuditContext): Promise<void>;
-    createApiKey(tenantId: string, nameOrOptions?: string | apiKeyService.CreateApiKeyOptions, expiresAt?: Date, audit?: AuditContext): Promise<apiKeyService.CreatedApiKey>;
+    /**
+     * Creates an API key and returns its plaintext once.
+     * Pass `null` as tenantId to create a global key, which is not limited to one tenant.
+     */
+    createApiKey(tenantId: string | null, nameOrOptions?: string | apiKeyService.CreateApiKeyOptions, expiresAt?: Date, audit?: AuditContext): Promise<apiKeyService.CreatedApiKey>;
     validateApiKey(key: string): Promise<apiKeyService.ValidatedApiKey | null>;
     revokeApiKey(keyId: string, audit?: AuditContext): Promise<boolean>;
     rotateApiKey(keyId: string, newName?: string, audit?: AuditContext): Promise<apiKeyService.CreatedApiKey>;
@@ -211,7 +256,7 @@ export declare class Stratum {
     deleteAbacPolicy(tenantId: string, policyId: string, audit?: AuditContext): Promise<void>;
     /**
      * Record a countable usage event for a tenant. Pass `idempotency_key` to make
-     * the write safe to retry — a duplicate key is a no-op that returns the
+     * the write safe to retry; a duplicate key is a no-op that returns the
      * original event. See {@link usageService.recordUsage}.
      */
     recordUsage(tenantId: string, input: RecordUsageInput): Promise<UsageEvent>;