@wopr-network/platform-core 0.1.0

package/dist/security/tenant-keys/tenant-key-repository.test.js

@@ -0,0 +1,114 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { createTestDb, truncateAllTables } from "../../test/db.js";
+import { TenantKeyRepository } from "./tenant-key-repository.js";
+const fakeEncrypted = {
+    iv: "aabbccdd",
+    authTag: "11223344",
+    ciphertext: "deadbeef",
+};
+describe("TenantKeyRepository", () => {
+    let db;
+    let pool;
+    let store;
+    beforeAll(async () => {
+        ({ db, pool } = await createTestDb());
+    });
+    afterAll(async () => {
+        await pool.close();
+    });
+    beforeEach(async () => {
+        await truncateAllTables(pool);
+        store = new TenantKeyRepository(db);
+    });
+    describe("upsert", () => {
+        it("inserts a new key and returns the id", async () => {
+            const id = await store.upsert("t1", "anthropic", fakeEncrypted, "My Key");
+            expect(id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/);
+            const record = await store.get("t1", "anthropic");
+            expect(record).not.toBeNull();
+            expect(record?.label).toBe("My Key");
+            expect(record?.tenant_id).toBe("t1");
+            expect(record?.provider).toBe("anthropic");
+        });
+        it("updates an existing key for the same tenant+provider", async () => {
+            const id1 = await store.upsert("t1", "anthropic", fakeEncrypted, "Old");
+            const id2 = await store.upsert("t1", "anthropic", { ...fakeEncrypted, ciphertext: "newdata" }, "New");
+            // Same ID reused
+            expect(id2).toBe(id1);
+            const record = await store.get("t1", "anthropic");
+            expect(record?.label).toBe("New");
+            expect(JSON.parse(record?.encrypted_key ?? "{}").ciphertext).toBe("newdata");
+        });
+        it("sets created_at and updated_at timestamps", async () => {
+            await store.upsert("t1", "openai", fakeEncrypted);
+            const record = await store.get("t1", "openai");
+            expect(record?.created_at).toBeGreaterThan(0);
+            expect(record?.updated_at).toBeGreaterThan(0);
+        });
+    });
+    describe("get", () => {
+        it("returns undefined for non-existent key", async () => {
+            expect(await store.get("t1", "anthropic")).toBeUndefined();
+        });
+        it("returns the full record including encrypted_key", async () => {
+            await store.upsert("t1", "anthropic", fakeEncrypted);
+            const record = await store.get("t1", "anthropic");
+            expect(record?.encrypted_key).toBeTruthy();
+            const parsed = JSON.parse(record?.encrypted_key ?? "{}");
+            expect(parsed.iv).toBe(fakeEncrypted.iv);
+            expect(parsed.authTag).toBe(fakeEncrypted.authTag);
+            expect(parsed.ciphertext).toBe(fakeEncrypted.ciphertext);
+        });
+    });
+    describe("listForTenant", () => {
+        it("returns empty array when tenant has no keys", async () => {
+            expect(await store.listForTenant("t1")).toEqual([]);
+        });
+        it("returns metadata only (no encrypted_key)", async () => {
+            await store.upsert("t1", "anthropic", fakeEncrypted, "Ant Key");
+            await store.upsert("t1", "openai", fakeEncrypted, "OAI Key");
+            const keys = await store.listForTenant("t1");
+            expect(keys).toHaveLength(2);
+            for (const key of keys) {
+                expect(key).not.toHaveProperty("encrypted_key");
+                expect(key.tenant_id).toBe("t1");
+            }
+        });
+        it("does not return other tenants' keys", async () => {
+            await store.upsert("t1", "anthropic", fakeEncrypted);
+            await store.upsert("t2", "openai", fakeEncrypted);
+            const keys = await store.listForTenant("t1");
+            expect(keys).toHaveLength(1);
+            expect(keys[0].provider).toBe("anthropic");
+        });
+    });
+    describe("delete", () => {
+        it("returns false when no key exists", async () => {
+            expect(await store.delete("t1", "anthropic")).toBe(false);
+        });
+        it("deletes a key and returns true", async () => {
+            await store.upsert("t1", "anthropic", fakeEncrypted);
+            expect(await store.delete("t1", "anthropic")).toBe(true);
+            expect(await store.get("t1", "anthropic")).toBeUndefined();
+        });
+        it("does not delete other tenants' keys", async () => {
+            await store.upsert("t1", "anthropic", fakeEncrypted);
+            await store.upsert("t2", "anthropic", fakeEncrypted);
+            await store.delete("t1", "anthropic");
+            expect(await store.get("t2", "anthropic")).not.toBeNull();
+        });
+    });
+    describe("deleteAllForTenant", () => {
+        it("returns 0 when tenant has no keys", async () => {
+            expect(await store.deleteAllForTenant("t1")).toBe(0);
+        });
+        it("deletes all keys for a tenant", async () => {
+            await store.upsert("t1", "anthropic", fakeEncrypted);
+            await store.upsert("t1", "openai", fakeEncrypted);
+            await store.upsert("t2", "anthropic", fakeEncrypted);
+            expect(await store.deleteAllForTenant("t1")).toBe(2);
+            expect(await store.listForTenant("t1")).toHaveLength(0);
+            expect(await store.listForTenant("t2")).toHaveLength(1);
+        });
+    });
+});

package/dist/security/types.d.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+/**
+ * Provider identifier — any non-empty string.
+ * Consumers (e.g., wopr-platform) can narrow this with their own enum.
+ */
+export declare const providerSchema: z.ZodString;
+export type Provider = z.infer<typeof providerSchema>;
+/** Request body for the encrypted key validation proxy. */
+export declare const validateKeyRequestSchema: z.ZodObject<{
+    provider: z.ZodString;
+    encryptedKey: z.ZodString;
+}, z.core.$strip>;
+export type ValidateKeyRequest = z.infer<typeof validateKeyRequestSchema>;
+/** Response from key validation. */
+export interface ValidateKeyResponse {
+    valid: boolean;
+    error?: string;
+}
+/** Request body for writing secrets to a running instance. */
+export declare const writeSecretsRequestSchema: z.ZodRecord<z.ZodString, z.ZodString>;
+export type WriteSecretsRequest = z.infer<typeof writeSecretsRequestSchema>;
+/** Encrypted payload structure stored as secrets.enc. */
+export interface EncryptedPayload {
+    /** AES-256-GCM initialization vector (hex). */
+    iv: string;
+    /** AES-256-GCM auth tag (hex). */
+    authTag: string;
+    /** Encrypted ciphertext (hex). */
+    ciphertext: string;
+}
+/** Provider validation endpoint configuration. */
+export interface ProviderEndpoint {
+    url: string;
+    headers: (key: string) => Record<string, string>;
+}

package/dist/security/types.js

@@ -0,0 +1,15 @@
+import { z } from "zod";
+/**
+ * Provider identifier — any non-empty string.
+ * Consumers (e.g., wopr-platform) can narrow this with their own enum.
+ */
+export const providerSchema = z.string().min(1);
+/** Request body for the encrypted key validation proxy. */
+export const validateKeyRequestSchema = z.object({
+    provider: providerSchema,
+    encryptedKey: z.string().min(1, "Encrypted key payload is required"),
+});
+/** Request body for writing secrets to a running instance. */
+export const writeSecretsRequestSchema = z
+    .record(z.string().min(1), z.string().min(1))
+    .refine((obj) => Object.keys(obj).length > 0, { message: "At least one secret is required" });

package/dist/tenancy/drizzle-org-repository.d.ts

@@ -0,0 +1,40 @@
+import type { PlatformDb } from "../db/index.js";
+export interface Tenant {
+    id: string;
+    name: string;
+    slug: string | null;
+    type: "personal" | "org";
+    ownerId: string;
+    billingEmail: string | null;
+    createdAt: number;
+}
+export interface IOrgRepository {
+    createOrg(ownerId: string, name: string, slug?: string): Promise<Tenant>;
+    ensurePersonalTenant(userId: string, displayName: string): Promise<Tenant>;
+    getById(id: string): Promise<Tenant | null>;
+    getBySlug(slug: string): Promise<Tenant | null>;
+    listOrgsByOwner(ownerId: string): Promise<Tenant[]>;
+    updateOrg(orgId: string, data: {
+        name?: string;
+        slug?: string;
+        billingEmail?: string | null;
+    }): Promise<Tenant>;
+    updateOwner(orgId: string, newOwnerId: string): Promise<void>;
+    deleteOrg(orgId: string): Promise<void>;
+}
+export declare class DrizzleOrgRepository implements IOrgRepository {
+    private readonly db;
+    constructor(db: PlatformDb);
+    createOrg(ownerId: string, name: string, slug?: string): Promise<Tenant>;
+    ensurePersonalTenant(userId: string, displayName: string): Promise<Tenant>;
+    getById(id: string): Promise<Tenant | null>;
+    getBySlug(slug: string): Promise<Tenant | null>;
+    listOrgsByOwner(ownerId: string): Promise<Tenant[]>;
+    updateOrg(orgId: string, data: {
+        name?: string;
+        slug?: string;
+        billingEmail?: string | null;
+    }): Promise<Tenant>;
+    updateOwner(orgId: string, newOwnerId: string): Promise<void>;
+    deleteOrg(orgId: string): Promise<void>;
+}

package/dist/tenancy/drizzle-org-repository.js

@@ -0,0 +1,126 @@
+import { TRPCError } from "@trpc/server";
+import { eq } from "drizzle-orm";
+import { tenants } from "../db/schema/index.js";
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+function isUniqueConstraintViolation(err) {
+    if (!(err instanceof Error))
+        return false;
+    const code = err.code;
+    const cause = err.cause;
+    const causeCode = cause && typeof cause === "object" ? cause.code : undefined;
+    const causeMsg = cause instanceof Error ? cause.message : "";
+    return (code === "23505" ||
+        causeCode === "23505" ||
+        err.message.includes("duplicate key") ||
+        err.message.includes("UNIQUE") ||
+        causeMsg.includes("duplicate key") ||
+        causeMsg.includes("UNIQUE"));
+}
+/** Slugify a name: lowercase, replace whitespace with hyphens, strip non-alphanumeric. */
+function slugify(name) {
+    return name
+        .toLowerCase()
+        .trim()
+        .replace(/\s+/g, "-")
+        .replace(/[^a-z0-9-]/g, "")
+        .replace(/-+/g, "-")
+        .replace(/^-|-$/g, "");
+}
+function toTenant(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        slug: row.slug,
+        type: row.type,
+        ownerId: row.ownerId,
+        billingEmail: row.billingEmail,
+        createdAt: row.createdAt,
+    };
+}
+export class DrizzleOrgRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async createOrg(ownerId, name, slug) {
+        const id = crypto.randomUUID();
+        const finalSlug = slug || slugify(name);
+        if (!finalSlug) {
+            throw Object.assign(new Error("Org name produces an empty slug; use only letters, numbers, or hyphens"), {
+                status: 400,
+            });
+        }
+        let row;
+        try {
+            row = (await this.db
+                .insert(tenants)
+                .values({
+                id,
+                name,
+                slug: finalSlug,
+                type: "org",
+                ownerId,
+                createdAt: Date.now(),
+            })
+                .returning())[0];
+        }
+        catch (err) {
+            if (isUniqueConstraintViolation(err)) {
+                throw new TRPCError({ code: "CONFLICT", message: "Organization slug already taken" });
+            }
+            throw err;
+        }
+        return toTenant(row);
+    }
+    async ensurePersonalTenant(userId, displayName) {
+        // Use userId as the tenant ID for backward compatibility
+        await this.db
+            .insert(tenants)
+            .values({
+            id: userId,
+            name: displayName,
+            slug: null,
+            type: "personal",
+            ownerId: userId,
+            createdAt: Date.now(),
+        })
+            .onConflictDoNothing({ target: tenants.id });
+        const tenant = await this.getById(userId);
+        if (!tenant)
+            throw new Error(`Personal tenant not found for user ${userId}`);
+        return tenant;
+    }
+    async getById(id) {
+        const row = (await this.db.select().from(tenants).where(eq(tenants.id, id)))[0];
+        return row ? toTenant(row) : null;
+    }
+    async getBySlug(slug) {
+        const row = (await this.db.select().from(tenants).where(eq(tenants.slug, slug)))[0];
+        return row ? toTenant(row) : null;
+    }
+    async listOrgsByOwner(ownerId) {
+        const rows = await this.db.select().from(tenants).where(eq(tenants.ownerId, ownerId));
+        return rows.filter((r) => r.type === "org").map(toTenant);
+    }
+    async updateOrg(orgId, data) {
+        const updates = {};
+        if (data.name !== undefined)
+            updates.name = data.name;
+        if (data.slug !== undefined)
+            updates.slug = data.slug;
+        if (data.billingEmail !== undefined)
+            updates.billingEmail = data.billingEmail;
+        const row = (await this.db.update(tenants).set(updates).where(eq(tenants.id, orgId)).returning())[0];
+        if (!row)
+            throw new Error(`Org not found: ${orgId}`);
+        return toTenant(row);
+    }
+    async updateOwner(orgId, newOwnerId) {
+        await this.db.update(tenants).set({ ownerId: newOwnerId }).where(eq(tenants.id, orgId));
+    }
+    async deleteOrg(orgId) {
+        await this.db.delete(tenants).where(eq(tenants.id, orgId));
+    }
+}

package/dist/tenancy/index.d.ts

@@ -0,0 +1,6 @@
+export type { Tenant, IOrgRepository } from "./drizzle-org-repository.js";
+export { DrizzleOrgRepository } from "./drizzle-org-repository.js";
+export type { OrgMemberRow, OrgInviteRow, IOrgMemberRepository } from "./org-member-repository.js";
+export { DrizzleOrgMemberRepository } from "./org-member-repository.js";
+export type { OrgWithMembers, OrgMemberWithUser, OrgInvitePublic, OrgServiceOptions } from "./org-service.js";
+export { OrgService } from "./org-service.js";

package/dist/tenancy/index.js

@@ -0,0 +1,3 @@
+export { DrizzleOrgRepository } from "./drizzle-org-repository.js";
+export { DrizzleOrgMemberRepository } from "./org-member-repository.js";
+export { OrgService } from "./org-service.js";

package/dist/tenancy/org-member-repository.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Repository for organization members and invites.
+ *
+ * Follows the mandatory repository pattern: IOrgMemberRepository interface +
+ * DrizzleOrgMemberRepository implementation in the same file.
+ * See: src/fleet/bot-instance-repository.ts
+ */
+import type { PlatformDb } from "../db/index.js";
+export interface OrgMemberRow {
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "member";
+    joinedAt: number;
+}
+export interface OrgInviteRow {
+    id: string;
+    orgId: string;
+    email: string;
+    role: "admin" | "member";
+    invitedBy: string;
+    token: string;
+    expiresAt: number;
+    createdAt: number;
+}
+export interface IOrgMemberRepository {
+    listMembers(orgId: string): Promise<OrgMemberRow[]>;
+    addMember(member: OrgMemberRow): Promise<void>;
+    updateMemberRole(orgId: string, userId: string, role: "owner" | "admin" | "member"): Promise<void>;
+    removeMember(orgId: string, userId: string): Promise<void>;
+    findMember(orgId: string, userId: string): Promise<OrgMemberRow | null>;
+    countAdminsAndOwners(orgId: string): Promise<number>;
+    listInvites(orgId: string): Promise<OrgInviteRow[]>;
+    createInvite(invite: OrgInviteRow): Promise<void>;
+    findInviteById(inviteId: string): Promise<OrgInviteRow | null>;
+    findInviteByToken(token: string): Promise<OrgInviteRow | null>;
+    deleteInvite(inviteId: string): Promise<void>;
+    deleteAllMembers(orgId: string): Promise<void>;
+    deleteAllInvites(orgId: string): Promise<void>;
+}
+export declare class DrizzleOrgMemberRepository implements IOrgMemberRepository {
+    private readonly db;
+    constructor(db: PlatformDb);
+    listMembers(orgId: string): Promise<OrgMemberRow[]>;
+    addMember(member: OrgMemberRow): Promise<void>;
+    updateMemberRole(orgId: string, userId: string, role: "owner" | "admin" | "member"): Promise<void>;
+    removeMember(orgId: string, userId: string): Promise<void>;
+    findMember(orgId: string, userId: string): Promise<OrgMemberRow | null>;
+    countAdminsAndOwners(orgId: string): Promise<number>;
+    listInvites(orgId: string): Promise<OrgInviteRow[]>;
+    createInvite(invite: OrgInviteRow): Promise<void>;
+    findInviteById(inviteId: string): Promise<OrgInviteRow | null>;
+    findInviteByToken(token: string): Promise<OrgInviteRow | null>;
+    deleteInvite(inviteId: string): Promise<void>;
+    deleteAllMembers(orgId: string): Promise<void>;
+    deleteAllInvites(orgId: string): Promise<void>;
+}

package/dist/tenancy/org-member-repository.js

@@ -0,0 +1,99 @@
+/**
+ * Repository for organization members and invites.
+ *
+ * Follows the mandatory repository pattern: IOrgMemberRepository interface +
+ * DrizzleOrgMemberRepository implementation in the same file.
+ * See: src/fleet/bot-instance-repository.ts
+ */
+import { and, eq, gt, inArray } from "drizzle-orm";
+import { organizationInvites, organizationMembers } from "../db/schema/organization-members.js";
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+function toMember(row) {
+    return {
+        id: row.id,
+        orgId: row.orgId,
+        userId: row.userId,
+        role: row.role,
+        joinedAt: row.joinedAt,
+    };
+}
+function toInvite(row) {
+    return {
+        id: row.id,
+        orgId: row.orgId,
+        email: row.email,
+        role: row.role,
+        invitedBy: row.invitedBy,
+        token: row.token,
+        expiresAt: row.expiresAt,
+        createdAt: row.createdAt,
+    };
+}
+export class DrizzleOrgMemberRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async listMembers(orgId) {
+        const rows = await this.db.select().from(organizationMembers).where(eq(organizationMembers.orgId, orgId));
+        return rows.map(toMember);
+    }
+    async addMember(member) {
+        await this.db.insert(organizationMembers).values(member).onConflictDoNothing();
+    }
+    async updateMemberRole(orgId, userId, role) {
+        await this.db
+            .update(organizationMembers)
+            .set({ role })
+            .where(and(eq(organizationMembers.orgId, orgId), eq(organizationMembers.userId, userId)));
+    }
+    async removeMember(orgId, userId) {
+        await this.db
+            .delete(organizationMembers)
+            .where(and(eq(organizationMembers.orgId, orgId), eq(organizationMembers.userId, userId)));
+    }
+    async findMember(orgId, userId) {
+        const rows = await this.db
+            .select()
+            .from(organizationMembers)
+            .where(and(eq(organizationMembers.orgId, orgId), eq(organizationMembers.userId, userId)));
+        return rows[0] ? toMember(rows[0]) : null;
+    }
+    async countAdminsAndOwners(orgId) {
+        const rows = await this.db
+            .select()
+            .from(organizationMembers)
+            .where(and(eq(organizationMembers.orgId, orgId), inArray(organizationMembers.role, ["admin", "owner"])));
+        return rows.length;
+    }
+    async listInvites(orgId) {
+        const now = Date.now();
+        const rows = await this.db
+            .select()
+            .from(organizationInvites)
+            .where(and(eq(organizationInvites.orgId, orgId), gt(organizationInvites.expiresAt, now)));
+        return rows.map(toInvite);
+    }
+    async createInvite(invite) {
+        await this.db.insert(organizationInvites).values(invite);
+    }
+    async findInviteById(inviteId) {
+        const rows = await this.db.select().from(organizationInvites).where(eq(organizationInvites.id, inviteId));
+        return rows[0] ? toInvite(rows[0]) : null;
+    }
+    async findInviteByToken(token) {
+        const rows = await this.db.select().from(organizationInvites).where(eq(organizationInvites.token, token));
+        return rows[0] ? toInvite(rows[0]) : null;
+    }
+    async deleteInvite(inviteId) {
+        await this.db.delete(organizationInvites).where(eq(organizationInvites.id, inviteId));
+    }
+    async deleteAllMembers(orgId) {
+        await this.db.delete(organizationMembers).where(eq(organizationMembers.orgId, orgId));
+    }
+    async deleteAllInvites(orgId) {
+        await this.db.delete(organizationInvites).where(eq(organizationInvites.orgId, orgId));
+    }
+}

package/dist/tenancy/org-repository.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tenancy/org-repository.test.js

@@ -0,0 +1,143 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { beginTestTransaction, createTestDb, endTestTransaction, rollbackTestTransaction } from "../test/db.js";
+import { DrizzleOrgRepository } from "./drizzle-org-repository.js";
+let db;
+let pool;
+beforeAll(async () => {
+    ({ db, pool } = await createTestDb());
+    await beginTestTransaction(pool);
+});
+afterAll(async () => {
+    await endTestTransaction(pool);
+    await pool.close();
+});
+describe("DrizzleOrgRepository", () => {
+    let repo;
+    beforeEach(async () => {
+        await rollbackTestTransaction(pool);
+        repo = new DrizzleOrgRepository(db);
+    });
+    describe("createOrg", () => {
+        it("creates an org tenant and returns it", async () => {
+            const org = await repo.createOrg("user-1", "My Org", "my-org");
+            expect(org.name).toBe("My Org");
+            expect(org.slug).toBe("my-org");
+            expect(org.type).toBe("org");
+            expect(org.ownerId).toBe("user-1");
+            expect(org.id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/);
+        });
+        it("throws on duplicate slug", async () => {
+            await repo.createOrg("user-1", "Org A", "same-slug");
+            await expect(repo.createOrg("user-2", "Org B", "same-slug")).rejects.toThrow();
+        });
+        it("auto-generates slug from name when slug is omitted", async () => {
+            const org = await repo.createOrg("user-1", "My Cool Org");
+            expect(org.slug).toBe("my-cool-org");
+        });
+    });
+    describe("ensurePersonalTenant", () => {
+        it("creates a personal tenant for a user", async () => {
+            const tenant = await repo.ensurePersonalTenant("user-1", "Alice");
+            expect(tenant.id).toBe("user-1");
+            expect(tenant.type).toBe("personal");
+            expect(tenant.name).toBe("Alice");
+        });
+        it("is idempotent — second call does not throw", async () => {
+            await repo.ensurePersonalTenant("user-1", "Alice");
+            const tenant = await repo.ensurePersonalTenant("user-1", "Alice");
+            expect(tenant.id).toBe("user-1");
+        });
+    });
+    describe("listByUser", () => {
+        it("returns orgs where user has a role (via userIds)", async () => {
+            const org = await repo.createOrg("user-1", "Org A", "org-a");
+            expect(await repo.getById(org.id)).toBeTruthy();
+        });
+    });
+    describe("getById", () => {
+        it("returns null for non-existent tenant", async () => {
+            expect(await repo.getById("nonexistent")).toBeNull();
+        });
+        it("returns a tenant by ID", async () => {
+            const org = await repo.createOrg("user-1", "Org A", "org-a");
+            const found = await repo.getById(org.id);
+            expect(found?.name).toBe("Org A");
+        });
+    });
+    describe("getBySlug", () => {
+        it("returns null for non-existent slug", async () => {
+            expect(await repo.getBySlug("nonexistent")).toBeNull();
+        });
+        it("finds a tenant by slug", async () => {
+            await repo.createOrg("user-1", "Org A", "org-a");
+            const found = await repo.getBySlug("org-a");
+            expect(found?.name).toBe("Org A");
+        });
+    });
+    describe("listOrgsByOwner", () => {
+        it("returns only org-type tenants for the owner", async () => {
+            await repo.ensurePersonalTenant("user-1", "Alice");
+            await repo.createOrg("user-1", "Org A", "org-a");
+            await repo.createOrg("user-1", "Org B", "org-b");
+            await repo.createOrg("user-2", "Other Org", "other");
+            const orgs = await repo.listOrgsByOwner("user-1");
+            expect(orgs).toHaveLength(2);
+            expect(orgs.map((o) => o.slug).sort()).toEqual(["org-a", "org-b"]);
+        });
+        it("returns empty array when owner has no orgs", async () => {
+            const orgs = await repo.listOrgsByOwner("nobody");
+            expect(orgs).toHaveLength(0);
+        });
+    });
+    describe("createOrg (edge cases)", () => {
+        it("throws when name produces an empty slug", async () => {
+            await expect(repo.createOrg("user-1", "---")).rejects.toThrow(/empty slug/);
+        });
+    });
+    describe("updateOrg", () => {
+        it("updates name and returns updated tenant", async () => {
+            const org = await repo.createOrg("user-1", "Original", "original");
+            const updated = await repo.updateOrg(org.id, { name: "Renamed" });
+            expect(updated.name).toBe("Renamed");
+            expect(updated.slug).toBe("original");
+        });
+        it("updates slug and returns updated tenant", async () => {
+            const org = await repo.createOrg("user-1", "Org", "old-slug");
+            const updated = await repo.updateOrg(org.id, { slug: "new-slug" });
+            expect(updated.slug).toBe("new-slug");
+        });
+        it("throws when org not found", async () => {
+            await expect(repo.updateOrg("nonexistent-id", { name: "X" })).rejects.toThrow(/not found/);
+        });
+        it("updates billingEmail and returns updated tenant", async () => {
+            const org = await repo.createOrg("user-1", "Org", "billing-test");
+            const updated = await repo.updateOrg(org.id, { billingEmail: "billing@example.com" });
+            expect(updated.billingEmail).toBe("billing@example.com");
+        });
+        it("clears billingEmail when set to null", async () => {
+            const org = await repo.createOrg("user-1", "Org", "billing-clear");
+            await repo.updateOrg(org.id, { billingEmail: "billing@example.com" });
+            const updated = await repo.updateOrg(org.id, { billingEmail: null });
+            expect(updated.billingEmail).toBeNull();
+        });
+    });
+    describe("updateOwner", () => {
+        it("persists the new ownerId", async () => {
+            const org = await repo.createOrg("user-1", "Org", "org-slug");
+            await repo.updateOwner(org.id, "user-2");
+            const updated = await repo.getById(org.id);
+            expect(updated?.ownerId).toBe("user-2");
+        });
+    });
+    describe("deleteOrg", () => {
+        it("deletes an existing org", async () => {
+            const org = await repo.createOrg("user-1", "Doomed Org", "doomed-org");
+            await repo.deleteOrg(org.id);
+            const found = await repo.getById(org.id);
+            expect(found).toBeNull();
+        });
+        it("silently succeeds when org does not exist", async () => {
+            await expect(repo.deleteOrg("nonexistent")).resolves.not.toThrow();
+        });
+    });
+});