@stratum-hq/nestjs 0.2.2 → 0.2.3

package/dist/__tests__/stratum.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=stratum.test.d.ts.map

package/dist/__tests__/stratum.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/stratum.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/stratum.test.js

@@ -0,0 +1,301 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { resolveFromHeader, resolveFromJwt, setTenantContext } from "@stratum-hq/sdk";
+// ── Mock StratumClient ───────────────────────────────────────────────────────
+function makeMockClient(resolvedContext = null, shouldThrow) {
+    return {
+        resolveTenant: vi.fn(async (_tenantId) => {
+            if (shouldThrow)
+                throw shouldThrow;
+            if (!resolvedContext)
+                throw new Error("No context configured");
+            return resolvedContext;
+        }),
+    };
+}
+// ── makeContext helper ───────────────────────────────────────────────────────
+function makeExecutionContext(req) {
+    return {
+        switchToHttp: () => ({
+            getRequest: () => req,
+            getResponse: () => ({}),
+            getNext: () => ({}),
+        }),
+    };
+}
+// ── Stubs for NestJS exceptions ──────────────────────────────────────────────
+import { TenantNotFoundError } from "@stratum-hq/core";
+class UnauthorizedException extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnauthorizedException";
+    }
+}
+class ForbiddenException extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ForbiddenException";
+    }
+}
+// ── Guard logic (mirrors stratum.guard.ts) ───────────────────────────────────
+async function canActivate(client, context, options = {}) {
+    const req = context.switchToHttp().getRequest();
+    // 1. Resolve tenant ID: header → JWT (verified) → custom resolvers
+    let tenantId = null;
+    tenantId = resolveFromHeader(req);
+    if (!tenantId) {
+        tenantId = resolveFromJwt(req, options.jwtClaimPath, {
+            secret: options.jwtSecret,
+            verify: options.jwtVerify,
+        });
+    }
+    if (!tenantId && options.resolvers) {
+        for (const resolver of options.resolvers) {
+            const result = await resolver.resolve(req);
+            if (result) {
+                tenantId = result;
+                break;
+            }
+        }
+    }
+    if (!tenantId) {
+        throw new UnauthorizedException("Tenant ID could not be resolved from request");
+    }
+    // 2. Resolve caller tenant context
+    let callerContext;
+    try {
+        callerContext = await client.resolveTenant(tenantId);
+    }
+    catch (err) {
+        if (err instanceof TenantNotFoundError) {
+            throw new UnauthorizedException(`Tenant not found: ${tenantId}`);
+        }
+        throw err;
+    }
+    req["tenant"] = callerContext;
+    req["impersonating"] = false;
+    // 3. Impersonation
+    if (options.impersonation?.enabled) {
+        const impersonateHeader = options.impersonation.headerName ?? "X-Impersonate-Tenant";
+        const headers = req.headers;
+        const rawVal = headers?.[impersonateHeader.toLowerCase()];
+        const impersonateTenantId = Array.isArray(rawVal) ? rawVal[0] : rawVal;
+        if (impersonateTenantId && impersonateTenantId !== tenantId) {
+            const authorized = await options.impersonation.authorize(req, tenantId, impersonateTenantId);
+            if (!authorized) {
+                throw new ForbiddenException("Not authorized to impersonate this tenant");
+            }
+            let impersonatedContext;
+            try {
+                impersonatedContext = await client.resolveTenant(impersonateTenantId);
+            }
+            catch (err) {
+                if (err instanceof TenantNotFoundError) {
+                    throw new UnauthorizedException(`Impersonated tenant not found: ${impersonateTenantId}`);
+                }
+                throw err;
+            }
+            req["tenant"] = impersonatedContext;
+            req["impersonating"] = true;
+            req["originalTenantId"] = tenantId;
+            options.impersonation.onImpersonate?.(req, tenantId, impersonateTenantId);
+            setTenantContext(impersonatedContext);
+            return true;
+        }
+    }
+    // 4. Bind AsyncLocalStorage context
+    setTenantContext(callerContext);
+    return true;
+}
+// ── @Tenant() decorator extraction logic ─────────────────────────────────────
+function extractTenant(req) {
+    return req["tenant"];
+}
+// ── Tests ─────────────────────────────────────────────────────────────────────
+const MOCK_CONTEXT = {
+    id: "tenant-123",
+    slug: "acme",
+    name: "Acme Corp",
+};
+const MOCK_CONTEXT_B = {
+    id: "tenant-456",
+    slug: "other",
+    name: "Other Corp",
+};
+describe("StratumGuard", () => {
+    let client;
+    beforeEach(() => {
+        client = makeMockClient(MOCK_CONTEXT);
+    });
+    describe("canActivate — x-tenant-id header", () => {
+        it("returns true and sets req.tenant when x-tenant-id header is present", async () => {
+            const req = {
+                headers: { "x-tenant-id": "tenant-123" },
+            };
+            const ctx = makeExecutionContext(req);
+            const result = await canActivate(client, ctx);
+            expect(result).toBe(true);
+            expect(req["tenant"]).toEqual(MOCK_CONTEXT);
+            expect(client.resolveTenant).toHaveBeenCalledWith("tenant-123");
+        });
+    });
+    describe("canActivate — JWT (unverified tokens rejected)", () => {
+        function makeJwt(payload) {
+            const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+            const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
+            return `${header}.${body}.fakesig`;
+        }
+        it("does NOT trust JWT claims when no jwtSecret or jwtVerify is configured", async () => {
+            // Without a secret, the guard must not extract tenant from JWT
+            const token = makeJwt({ tenant_id: "forged-tenant" });
+            const req = {
+                headers: { authorization: `Bearer ${token}` },
+            };
+            const ctx = makeExecutionContext(req);
+            // No options — should reject because JWT is unverified
+            await expect(canActivate(client, ctx, {})).rejects.toThrow(UnauthorizedException);
+            await expect(canActivate(client, ctx, {})).rejects.toThrow("Tenant ID could not be resolved from request");
+            expect(client.resolveTenant).not.toHaveBeenCalled();
+        });
+        it("resolves tenant from JWT when jwtVerify is provided", async () => {
+            const token = makeJwt({ tenant_id: "tenant-from-jwt" });
+            const req = {
+                headers: { authorization: `Bearer ${token}` },
+            };
+            const ctx = makeExecutionContext(req);
+            // Supply a verify function that trusts this token
+            const jwtVerify = (_t) => ({ tenant_id: "tenant-from-jwt" });
+            const result = await canActivate(client, ctx, { jwtVerify });
+            expect(result).toBe(true);
+            expect(client.resolveTenant).toHaveBeenCalledWith("tenant-from-jwt");
+        });
+        it("prefers x-tenant-id header over JWT claim", async () => {
+            const token = makeJwt({ tenant_id: "jwt-tenant" });
+            const req = {
+                headers: {
+                    "x-tenant-id": "header-tenant",
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const ctx = makeExecutionContext(req);
+            await canActivate(client, ctx, { jwtVerify: () => ({ tenant_id: "jwt-tenant" }) });
+            expect(client.resolveTenant).toHaveBeenCalledWith("header-tenant");
+        });
+    });
+    describe("canActivate — missing tenant", () => {
+        it("throws UnauthorizedException when no tenant identifier in request", async () => {
+            const req = { headers: {} };
+            const ctx = makeExecutionContext(req);
+            await expect(canActivate(client, ctx)).rejects.toThrow(UnauthorizedException);
+            await expect(canActivate(client, ctx)).rejects.toThrow("Tenant ID could not be resolved from request");
+        });
+        it("throws UnauthorizedException when tenant not found in control plane", async () => {
+            const notFoundClient = makeMockClient(null, new TenantNotFoundError("tenant-missing"));
+            const req = {
+                headers: { "x-tenant-id": "tenant-missing" },
+            };
+            const ctx = makeExecutionContext(req);
+            await expect(canActivate(notFoundClient, ctx)).rejects.toThrow(UnauthorizedException);
+            await expect(canActivate(notFoundClient, ctx)).rejects.toThrow("Tenant not found: tenant-missing");
+        });
+        it("re-throws unexpected errors", async () => {
+            const boom = new Error("Network failure");
+            const errorClient = makeMockClient(null, boom);
+            const req = {
+                headers: { "x-tenant-id": "tenant-123" },
+            };
+            const ctx = makeExecutionContext(req);
+            await expect(canActivate(errorClient, ctx)).rejects.toThrow("Network failure");
+        });
+    });
+    describe("canActivate — custom resolvers", () => {
+        it("uses custom resolver when header and JWT resolve nothing", async () => {
+            const req = { headers: {} };
+            const ctx = makeExecutionContext(req);
+            const customResolver = { resolve: vi.fn(async () => "tenant-from-resolver") };
+            const result = await canActivate(client, ctx, { resolvers: [customResolver] });
+            expect(result).toBe(true);
+            expect(customResolver.resolve).toHaveBeenCalledWith(req);
+            expect(client.resolveTenant).toHaveBeenCalledWith("tenant-from-resolver");
+        });
+        it("stops at first resolver that returns a value", async () => {
+            const req = { headers: {} };
+            const ctx = makeExecutionContext(req);
+            const r1 = { resolve: vi.fn(async () => "first-resolver-tenant") };
+            const r2 = { resolve: vi.fn(async () => "second-resolver-tenant") };
+            await canActivate(client, ctx, { resolvers: [r1, r2] });
+            expect(r1.resolve).toHaveBeenCalled();
+            expect(r2.resolve).not.toHaveBeenCalled();
+            expect(client.resolveTenant).toHaveBeenCalledWith("first-resolver-tenant");
+        });
+    });
+    describe("canActivate — impersonation", () => {
+        it("impersonates target tenant when authorized", async () => {
+            // client returns MOCK_CONTEXT for "tenant-123", MOCK_CONTEXT_B for "tenant-456"
+            const impClient = {
+                resolveTenant: vi.fn(async (id) => {
+                    if (id === "tenant-123")
+                        return MOCK_CONTEXT;
+                    if (id === "tenant-456")
+                        return MOCK_CONTEXT_B;
+                    throw new TenantNotFoundError(id);
+                }),
+            };
+            const req = {
+                headers: {
+                    "x-tenant-id": "tenant-123",
+                    "x-impersonate-tenant": "tenant-456",
+                },
+            };
+            const ctx = makeExecutionContext(req);
+            const onImpersonate = vi.fn();
+            const result = await canActivate(impClient, ctx, {
+                impersonation: {
+                    enabled: true,
+                    authorize: async () => true,
+                    onImpersonate,
+                },
+            });
+            expect(result).toBe(true);
+            expect(req["tenant"]).toEqual(MOCK_CONTEXT_B);
+            expect(req["impersonating"]).toBe(true);
+            expect(req["originalTenantId"]).toBe("tenant-123");
+            expect(onImpersonate).toHaveBeenCalledWith(req, "tenant-123", "tenant-456");
+        });
+        it("throws ForbiddenException when impersonation is denied", async () => {
+            const req = {
+                headers: {
+                    "x-tenant-id": "tenant-123",
+                    "x-impersonate-tenant": "tenant-456",
+                },
+            };
+            const ctx = makeExecutionContext(req);
+            await expect(canActivate(client, ctx, {
+                impersonation: {
+                    enabled: true,
+                    authorize: async () => false,
+                },
+            })).rejects.toThrow(ForbiddenException);
+        });
+    });
+});
+describe("@Tenant() decorator", () => {
+    it("extracts req.tenant from execution context", () => {
+        const req = { tenant: MOCK_CONTEXT };
+        const tenant = extractTenant(req);
+        expect(tenant).toEqual(MOCK_CONTEXT);
+    });
+    it("returns undefined when tenant not yet set (guard not applied)", () => {
+        const req = {};
+        const tenant = extractTenant(req);
+        expect(tenant).toBeUndefined();
+    });
+});
+describe("STRATUM_CLIENT / STRATUM_OPTIONS constants", () => {
+    it("exports distinct Symbol injection tokens", async () => {
+        const { STRATUM_CLIENT, STRATUM_OPTIONS } = await import("../constants.js");
+        expect(typeof STRATUM_CLIENT).toBe("symbol");
+        expect(typeof STRATUM_OPTIONS).toBe("symbol");
+        expect(STRATUM_CLIENT).not.toBe(STRATUM_OPTIONS);
+    });
+});
+//# sourceMappingURL=stratum.test.js.map

package/dist/__tests__/stratum.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum.test.js","sourceRoot":"","sources":["../../src/__tests__/stratum.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAoBtF,gFAAgF;AAChF,SAAS,cAAc,CAAC,kBAA4C,IAAI,EAAE,WAAmB;IAC3F,OAAO;QACL,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;YAC/C,IAAI,WAAW;gBAAE,MAAM,WAAW,CAAC;YACnC,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC/D,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,oBAAoB,CAAC,GAA4B;IACxD,OAAO;QACL,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YACnB,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG;YACrB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAQ;YAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAQ;SAC3B,CAAC;KACiB,CAAC;AACxB,CAAC;AAED,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,qBAAsB,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,kBAAmB,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAgBD,gFAAgF;AAChF,KAAK,UAAU,WAAW,CACxB,MAAyC,EACzC,OAAyB,EACzB,UAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAEzC,CAAC;IAEL,mEAAmE;IACnE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IAEnC,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE;YACnD,MAAM,EAAE,OAAO,CAAC,SAAS;YACzB,MAAM,EAAE,OAAO,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACnC,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACX,QAAQ,GAAG,MAAM,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,8CAA8C,CAAC,CAAC;IAClF,CAAC;IAED,mCAAmC;IACnC,IAAI,aAAa,CAAC;IAClB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC;IAC9B,GAAG,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;IAE7B,mBAAmB;IACnB,IAAI,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC;QACnC,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,IAAI,sBAAsB,CAAC;QACrF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAoE,CAAC;QACzF,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAEvE,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;YAC7F,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,kBAAkB,CAAC,2CAA2C,CAAC,CAAC;YAC5E,CAAC;YAED,IAAI,mBAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,mBAAmB,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;oBACvC,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,mBAAmB,EAAE,CAAC,CAAC;gBAC3F,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,GAAG,CAAC,QAAQ,CAAC,GAAG,mBAAmB,CAAC;YACpC,GAAG,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;YAC5B,GAAG,CAAC,kBAAkB,CAAC,GAAG,QAAQ,CAAC;YAEnC,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;YAE1E,gBAAgB,CAAC,mBAA0B,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,gBAAgB,CAAC,aAAoB,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,GAA4B;IACjD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,iFAAiF;AAEjF,MAAM,YAAY,GAAsB;IACtC,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,WAAW;CAClB,CAAC;AAEF,MAAM,cAAc,GAAsB;IACxC,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,YAAY;CACnB,CAAC;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAI,MAAyC,CAAC;IAE9C,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;YACnF,MAAM,GAAG,GAA4B;gBACnC,OAAO,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;aACzC,CAAC;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC5C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC9D,SAAS,OAAO,CAAC,OAAgC;YAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxE,OAAO,GAAG,MAAM,IAAI,IAAI,UAAU,CAAC;QACrC,CAAC;QAED,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;YACtF,+DAA+D;YAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;YACtD,MAAM,GAAG,GAA4B;gBACnC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,uDAAuD;YACvD,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YAClF,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACxD,8CAA8C,CAC/C,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,GAA4B;gBACnC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,kDAAkD;YAClD,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAErE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAE7D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;YACnD,MAAM,GAAG,GAA4B;gBACnC,OAAO,EAAE;oBACP,aAAa,EAAE,eAAe;oBAC9B,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;aACF,CAAC;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;YAEnF,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;QAC5C,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;YACjF,MAAM,GAAG,GAA4B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YAC9E,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpD,8CAA8C,CAC/C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;YACnF,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACvF,MAAM,GAAG,GAA4B;gBACnC,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE;aAC7C,CAAC;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YACtF,MAAM,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACrG,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/C,MAAM,GAAG,GAA4B;gBACnC,OAAO,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;aACzC,CAAC;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC9C,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,GAAG,GAA4B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,cAAc,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAE9E,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAE/E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,GAAG,GAA4B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACnE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAEpE,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAExD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACtC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;QAC3C,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,gFAAgF;YAChF,MAAM,SAAS,GAAG;gBAChB,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;oBACxC,IAAI,EAAE,KAAK,YAAY;wBAAE,OAAO,YAAY,CAAC;oBAC7C,IAAI,EAAE,KAAK,YAAY;wBAAE,OAAO,cAAc,CAAC;oBAC/C,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAC;gBACpC,CAAC,CAAC;aACH,CAAC;YAEF,MAAM,GAAG,GAA4B;gBACnC,OAAO,EAAE;oBACP,aAAa,EAAE,YAAY;oBAC3B,sBAAsB,EAAE,YAAY;iBACrC;aACF,CAAC;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE;gBAC/C,aAAa,EAAE;oBACb,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;oBAC3B,aAAa;iBACd;aACF,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACnD,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,GAAG,GAA4B;gBACnC,OAAO,EAAE;oBACP,aAAa,EAAE,YAAY;oBAC3B,sBAAsB,EAAE,YAAY;iBACrC;aACF,CAAC;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,MAAM,CACV,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE;gBACvB,aAAa,EAAE;oBACb,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;iBAC7B;aACF,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAA4B,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC5E,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/constants.d.ts

@@ -0,0 +1,3 @@
+export declare const STRATUM_CLIENT: unique symbol;
+export declare const STRATUM_OPTIONS: unique symbol;
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,eAA2B,CAAC;AACvD,eAAO,MAAM,eAAe,eAA4B,CAAC"}

package/dist/constants.js

@@ -0,0 +1,3 @@
+export const STRATUM_CLIENT = Symbol("STRATUM_CLIENT");
+export const STRATUM_OPTIONS = Symbol("STRATUM_OPTIONS");
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { STRATUM_CLIENT, STRATUM_OPTIONS } from "./constants.js";
+export { StratumGuard } from "./stratum.guard.js";
+export { Tenant } from "./stratum.decorator.js";
+export { StratumModule } from "./stratum.module.js";
+export type { StratumModuleOptions, StratumModuleAsyncOptions } from "./stratum.module.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { STRATUM_CLIENT, STRATUM_OPTIONS } from "./constants.js";
+export { StratumGuard } from "./stratum.guard.js";
+export { Tenant } from "./stratum.decorator.js";
+export { StratumModule } from "./stratum.module.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/stratum.decorator.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Parameter decorator that extracts the resolved tenant context from the request.
+ * Requires StratumGuard to have run before the route handler.
+ *
+ * @example
+ * ```ts
+ * @Get('me')
+ * @UseGuards(StratumGuard)
+ * getProfile(@Tenant() tenant: TenantContextLegacy) {
+ *   return tenant;
+ * }
+ * ```
+ */
+export declare const Tenant: (...dataOrPipes: unknown[]) => ParameterDecorator;
+//# sourceMappingURL=stratum.decorator.d.ts.map

package/dist/stratum.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum.decorator.d.ts","sourceRoot":"","sources":["../src/stratum.decorator.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,MAAM,mDAKlB,CAAC"}

package/dist/stratum.decorator.js

@@ -0,0 +1,19 @@
+import { createParamDecorator } from "@nestjs/common";
+/**
+ * Parameter decorator that extracts the resolved tenant context from the request.
+ * Requires StratumGuard to have run before the route handler.
+ *
+ * @example
+ * ```ts
+ * @Get('me')
+ * @UseGuards(StratumGuard)
+ * getProfile(@Tenant() tenant: TenantContextLegacy) {
+ *   return tenant;
+ * }
+ * ```
+ */
+export const Tenant = createParamDecorator((_data, ctx) => {
+    const req = ctx.switchToHttp().getRequest();
+    return req["tenant"];
+});
+//# sourceMappingURL=stratum.decorator.js.map

package/dist/stratum.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum.decorator.js","sourceRoot":"","sources":["../src/stratum.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGtD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,oBAAoB,CACxC,CAAC,KAAc,EAAE,GAAqB,EAAE,EAAE;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAA2B,CAAC;IACrE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;AACvB,CAAC,CACF,CAAC"}

package/dist/stratum.guard.d.ts

@@ -0,0 +1,10 @@
+import type { CanActivate, ExecutionContext } from "@nestjs/common";
+import type { StratumClient } from "@stratum-hq/sdk";
+import type { StratumModuleOptions } from "./stratum.module.js";
+export declare class StratumGuard implements CanActivate {
+    private readonly client;
+    private readonly options;
+    constructor(client: StratumClient, options: StratumModuleOptions);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+//# sourceMappingURL=stratum.guard.d.ts.map

package/dist/stratum.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum.guard.d.ts","sourceRoot":"","sources":["../src/stratum.guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,qBACa,YAAa,YAAW,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADR,MAAM,EAAE,aAAa,EACpB,OAAO,EAAE,oBAAoB;IAGnE,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAuF/D"}

package/dist/stratum.guard.js

@@ -0,0 +1,102 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable, UnauthorizedException, ForbiddenException } from "@nestjs/common";
+import { resolveFromHeader, resolveFromJwt, setTenantContext } from "@stratum-hq/sdk";
+import { TenantNotFoundError } from "@stratum-hq/core";
+import { STRATUM_CLIENT, STRATUM_OPTIONS } from "./constants.js";
+let StratumGuard = class StratumGuard {
+    client;
+    options;
+    constructor(client, options) {
+        this.client = client;
+        this.options = options;
+    }
+    async canActivate(context) {
+        const req = context.switchToHttp().getRequest();
+        // 1. Resolve tenant ID: header → JWT (verified) → custom resolvers
+        let tenantId = null;
+        tenantId = resolveFromHeader(req);
+        if (!tenantId) {
+            tenantId = resolveFromJwt(req, this.options.jwtClaimPath, {
+                secret: this.options.jwtSecret,
+                verify: this.options.jwtVerify,
+            });
+        }
+        if (!tenantId && this.options.resolvers) {
+            for (const resolver of this.options.resolvers) {
+                const result = await resolver.resolve(req);
+                if (result) {
+                    tenantId = result;
+                    break;
+                }
+            }
+        }
+        if (!tenantId) {
+            throw new UnauthorizedException("Tenant ID could not be resolved from request");
+        }
+        // 2. Resolve caller tenant context
+        let callerContext;
+        try {
+            callerContext = await this.client.resolveTenant(tenantId);
+        }
+        catch (err) {
+            if (err instanceof TenantNotFoundError) {
+                throw new UnauthorizedException(`Tenant not found: ${tenantId}`);
+            }
+            throw err;
+        }
+        req["tenant"] = callerContext;
+        req["impersonating"] = false;
+        // 3. Impersonation support — mirrors express.ts lines 52-81
+        if (this.options.impersonation?.enabled) {
+            const impersonateHeader = this.options.impersonation.headerName ?? "X-Impersonate-Tenant";
+            const headers = req.headers;
+            const rawVal = headers?.[impersonateHeader.toLowerCase()];
+            const impersonateTenantId = Array.isArray(rawVal) ? rawVal[0] : rawVal;
+            if (impersonateTenantId && impersonateTenantId !== tenantId) {
+                const authorized = await this.options.impersonation.authorize(req, tenantId, impersonateTenantId);
+                if (!authorized) {
+                    throw new ForbiddenException("Not authorized to impersonate this tenant");
+                }
+                let impersonatedContext;
+                try {
+                    impersonatedContext = await this.client.resolveTenant(impersonateTenantId);
+                }
+                catch (err) {
+                    if (err instanceof TenantNotFoundError) {
+                        throw new UnauthorizedException(`Impersonated tenant not found: ${impersonateTenantId}`);
+                    }
+                    throw err;
+                }
+                req["tenant"] = impersonatedContext;
+                req["impersonating"] = true;
+                req["originalTenantId"] = tenantId;
+                this.options.impersonation.onImpersonate?.(req, tenantId, impersonateTenantId);
+                // 4. Bind AsyncLocalStorage context for getTenantContext()
+                setTenantContext(impersonatedContext);
+                return true;
+            }
+        }
+        // 4. Bind AsyncLocalStorage context for getTenantContext()
+        setTenantContext(callerContext);
+        return true;
+    }
+};
+StratumGuard = __decorate([
+    Injectable(),
+    __param(0, Inject(STRATUM_CLIENT)),
+    __param(1, Inject(STRATUM_OPTIONS)),
+    __metadata("design:paramtypes", [Function, Object])
+], StratumGuard);
+export { StratumGuard };
+//# sourceMappingURL=stratum.guard.js.map

package/dist/stratum.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum.guard.js","sourceRoot":"","sources":["../src/stratum.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAG/F,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAI1D,IAAM,YAAY,GAAlB,MAAM,YAAY;IAEoB;IACC;IAF5C,YAC2C,MAAqB,EACpB,OAA6B;QAD9B,WAAM,GAAN,MAAM,CAAe;QACpB,YAAO,GAAP,OAAO,CAAsB;IACtE,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAKzC,CAAC;QAEL,mEAAmE;QACnE,IAAI,QAAQ,GAAkB,IAAI,CAAC;QAEnC,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;gBACxD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBAC9B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACxC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,MAAM,EAAE,CAAC;oBACX,QAAQ,GAAG,MAAM,CAAC;oBAClB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,8CAA8C,CAAC,CAAC;QAClF,CAAC;QAED,mCAAmC;QACnC,IAAI,aAAa,CAAC;QAClB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACvC,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,GAAG,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC;QAC9B,GAAG,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC;QAE7B,4DAA4D;QAC5D,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC;YACxC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,IAAI,sBAAsB,CAAC;YAC1F,MAAM,OAAO,GAAG,GAAG,CAAC,OAAoE,CAAC;YACzF,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1D,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEvE,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,QAAQ,EAAE,CAAC;gBAC5D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;gBAClG,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,kBAAkB,CAAC,2CAA2C,CAAC,CAAC;gBAC5E,CAAC;gBAED,IAAI,mBAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,mBAAmB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;gBAC7E,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;wBACvC,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,mBAAmB,EAAE,CAAC,CAAC;oBAC3F,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBAED,GAAG,CAAC,QAAQ,CAAC,GAAG,mBAAmB,CAAC;gBACpC,GAAG,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;gBAC5B,GAAG,CAAC,kBAAkB,CAAC,GAAG,QAAQ,CAAC;gBAEnC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;gBAE/E,2DAA2D;gBAC3D,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7FY,YAAY;IADxB,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,cAAc,CAAC,CAAA;IACtB,WAAA,MAAM,CAAC,eAAe,CAAC,CAAA;;GAHf,YAAY,CA6FxB"}

package/dist/stratum.module.d.ts

@@ -0,0 +1,37 @@
+import { DynamicModule } from "@nestjs/common";
+import type { FactoryProvider, ModuleMetadata } from "@nestjs/common";
+export interface StratumModuleOptions {
+    controlPlaneUrl: string;
+    apiKey: string;
+    /** JWT claim path for tenant resolution (e.g. "tenant_id" or "stratum.tenant_id"). Requires jwtSecret or jwtVerify. */
+    jwtClaimPath?: string;
+    /** HMAC secret used to verify JWT signatures before extracting tenant claims. */
+    jwtSecret?: string;
+    /** Custom JWT verify function — takes priority over jwtSecret. */
+    jwtVerify?: (token: string) => Record<string, unknown> | null;
+    /** Custom tenant resolvers evaluated after header and JWT resolution. */
+    resolvers?: import("@stratum-hq/sdk").TenantResolver[];
+    /** Enable tenant impersonation via X-Impersonate-Tenant header. */
+    impersonation?: {
+        enabled: boolean;
+        headerName?: string;
+        authorize: (req: unknown, callerTenantId: string, targetTenantId: string) => boolean | Promise<boolean>;
+        onImpersonate?: (req: unknown, callerTenantId: string, targetTenantId: string) => void;
+    };
+}
+export interface StratumModuleAsyncOptions extends Pick<ModuleMetadata, "imports"> {
+    useFactory: (...args: unknown[]) => StratumModuleOptions | Promise<StratumModuleOptions>;
+    inject?: FactoryProvider["inject"];
+}
+export declare class StratumModule {
+    /**
+     * Register StratumModule synchronously with static options.
+     */
+    static forRoot(options: StratumModuleOptions): DynamicModule;
+    /**
+     * Register StratumModule asynchronously using a factory function.
+     * Useful when options come from ConfigService or other async providers.
+     */
+    static forRootAsync(asyncOptions: StratumModuleAsyncOptions): DynamicModule;
+}
+//# sourceMappingURL=stratum.module.d.ts.map

package/dist/stratum.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum.module.d.ts","sourceRoot":"","sources":["../src/stratum.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,aAAa,EAAU,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKtE,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,uHAAuH;IACvH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9D,yEAAyE;IACzE,SAAS,CAAC,EAAE,OAAO,iBAAiB,EAAE,cAAc,EAAE,CAAC;IACvD,mEAAmE;IACnE,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxG,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;KACxF,CAAC;CACH;AAED,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAChF,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzF,MAAM,CAAC,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;CACpC;AAED,qBAEa,aAAa;IACxB;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa;IAqB5D;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,yBAAyB,GAAG,aAAa;CA0B5E"}

package/dist/stratum.module.js

@@ -0,0 +1,68 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var StratumModule_1;
+import { Module, Global } from "@nestjs/common";
+import { StratumClient } from "@stratum-hq/sdk";
+import { STRATUM_CLIENT, STRATUM_OPTIONS } from "./constants.js";
+import { StratumGuard } from "./stratum.guard.js";
+let StratumModule = StratumModule_1 = class StratumModule {
+    /**
+     * Register StratumModule synchronously with static options.
+     */
+    static forRoot(options) {
+        const clientProvider = {
+            provide: STRATUM_CLIENT,
+            useValue: new StratumClient({
+                controlPlaneUrl: options.controlPlaneUrl,
+                apiKey: options.apiKey,
+            }),
+        };
+        const optionsProvider = {
+            provide: STRATUM_OPTIONS,
+            useValue: options,
+        };
+        return {
+            module: StratumModule_1,
+            providers: [clientProvider, optionsProvider, StratumGuard],
+            exports: [STRATUM_CLIENT, StratumGuard],
+        };
+    }
+    /**
+     * Register StratumModule asynchronously using a factory function.
+     * Useful when options come from ConfigService or other async providers.
+     */
+    static forRootAsync(asyncOptions) {
+        const optionsProvider = {
+            provide: STRATUM_OPTIONS,
+            useFactory: asyncOptions.useFactory,
+            inject: asyncOptions.inject ?? [],
+        };
+        const clientProvider = {
+            provide: STRATUM_CLIENT,
+            useFactory: async (...args) => {
+                const options = await asyncOptions.useFactory(...args);
+                return new StratumClient({
+                    controlPlaneUrl: options.controlPlaneUrl,
+                    apiKey: options.apiKey,
+                });
+            },
+            inject: asyncOptions.inject ?? [],
+        };
+        return {
+            module: StratumModule_1,
+            imports: asyncOptions.imports ?? [],
+            providers: [optionsProvider, clientProvider, StratumGuard],
+            exports: [STRATUM_CLIENT, StratumGuard],
+        };
+    }
+};
+StratumModule = StratumModule_1 = __decorate([
+    Global(),
+    Module({})
+], StratumModule);
+export { StratumModule };
+//# sourceMappingURL=stratum.module.js.map

package/dist/stratum.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stratum.module.js","sourceRoot":"","sources":["../src/stratum.module.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,MAAM,EAAiB,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA6B3C,IAAM,aAAa,qBAAnB,MAAM,aAAa;IACxB;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,OAA6B;QAC1C,MAAM,cAAc,GAAG;YACrB,OAAO,EAAE,cAAc;YACvB,QAAQ,EAAE,IAAI,aAAa,CAAC;gBAC1B,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC;SACH,CAAC;QAEF,MAAM,eAAe,GAAG;YACtB,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,OAAO;SAClB,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,eAAa;YACrB,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,YAAY,CAAC;YAC1D,OAAO,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,YAAuC;QACzD,MAAM,eAAe,GAAoB;YACvC,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,EAAE;SAClC,CAAC;QAEF,MAAM,cAAc,GAAoB;YACtC,OAAO,EAAE,cAAc;YACvB,UAAU,EAAE,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;gBACvC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBACvD,OAAO,IAAI,aAAa,CAAC;oBACvB,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,EAAE;SAClC,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,eAAa;YACrB,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,EAAE;YACnC,SAAS,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,YAAY,CAAC;YAC1D,OAAO,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;SACxC,CAAC;IACJ,CAAC;CACF,CAAA;AAvDY,aAAa;IAFzB,MAAM,EAAE;IACR,MAAM,CAAC,EAAE,CAAC;GACE,aAAa,CAuDzB"}

package/package.json

@@ -1,7 +1,20 @@
 {
   "name": "@stratum-hq/nestjs",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Stratum NestJS integration — StratumGuard, @Tenant() decorator, and StratumModule",
+  "keywords": [
+    "multi-tenancy",
+    "multi-tenant",
+    "saas",
+    "tenant",
+    "nestjs",
+    "nest",
+    "guard",
+    "decorator",
+    "middleware",
+    "typescript",
+    "stratum"
+  ],
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",