palaryn 0.1.0

package/dist/tests/unit/postgres-storage.test.js

@@ -0,0 +1,614 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const postgres_1 = require("../../src/storage/postgres");
+// ---------------------------------------------------------------------------
+// Helper factories
+// ---------------------------------------------------------------------------
+function makeToolResult(overrides = {}) {
+    return {
+        tool_call_id: 'tc-001',
+        task_id: 'task-001',
+        status: 'ok',
+        policy: { decision: 'allow', reasons: [] },
+        dlp: { detected: [], redactions: [], severity: 'low' },
+        budget: { estimated_cost_usd: 0, spent_cost_usd_task: 0, remaining_cost_usd_task: 100 },
+        timing: { started_at: new Date().toISOString(), duration_ms: 10 },
+        ...overrides,
+    };
+}
+function makeApprovalRecord(overrides = {}) {
+    return {
+        approval_id: 'appr-001',
+        tool_call_id: 'tc-001',
+        task_id: 'task-001',
+        workspace_id: 'ws-001',
+        actor_id: 'actor-001',
+        tool_name: 'http.get',
+        tool_capability: 'read',
+        args_summary: '{}',
+        scope: 'global',
+        reason: 'test',
+        token_hash: 'hash-001',
+        status: 'pending',
+        created_at: new Date().toISOString(),
+        expires_at: new Date(Date.now() + 3600000).toISOString(),
+        ...overrides,
+    };
+}
+// ---------------------------------------------------------------------------
+// Mock pg Pool
+// ---------------------------------------------------------------------------
+const mockQuery = jest.fn().mockResolvedValue({ rows: [] });
+const mockPool = { query: mockQuery };
+beforeEach(() => {
+    jest.clearAllMocks();
+});
+// ===========================================================================
+// PostgresBudgetStore
+// ===========================================================================
+describe('PostgresBudgetStore', () => {
+    let store;
+    beforeEach(() => {
+        store = new postgres_1.PostgresBudgetStore(mockPool);
+    });
+    const makeBudgetState = (overrides = {}) => ({
+        task_id: 'task-1',
+        workspace_id: 'ws-1',
+        actor_id: 'actor-1',
+        spent_usd: 0,
+        steps: 0,
+        started_at: '2025-01-01T00:00:00.000Z',
+        ...overrides,
+    });
+    test('getTaskState returns undefined for missing tasks', () => {
+        expect(store.getTaskState('nonexistent')).toBeUndefined();
+    });
+    test('setTaskState saves and retrieves task state from cache', () => {
+        const state = makeBudgetState();
+        store.setTaskState('task-1', state);
+        const retrieved = store.getTaskState('task-1');
+        expect(retrieved).toEqual(state);
+    });
+    test('getCounter returns 0 for missing keys', () => {
+        expect(store.getCounter('missing-key')).toBe(0);
+    });
+    test('incrementCounter accumulates values', () => {
+        store.incrementCounter('spend:actor-1', 1.5);
+        expect(store.getCounter('spend:actor-1')).toBe(1.5);
+        store.incrementCounter('spend:actor-1', 2.5);
+        expect(store.getCounter('spend:actor-1')).toBe(4.0);
+        store.incrementCounter('spend:actor-1', 0.5);
+        expect(store.getCounter('spend:actor-1')).toBe(4.5);
+    });
+    test('getRetryCount returns 0 for missing tool call IDs', () => {
+        expect(store.getRetryCount('tc-unknown')).toBe(0);
+    });
+    test('incrementRetryCount increments and returns updated count', () => {
+        expect(store.incrementRetryCount('tc-1')).toBe(1);
+        expect(store.incrementRetryCount('tc-1')).toBe(2);
+        expect(store.incrementRetryCount('tc-1')).toBe(3);
+        expect(store.getRetryCount('tc-1')).toBe(3);
+    });
+    test('reset clears all state', () => {
+        const state = makeBudgetState();
+        store.setTaskState('task-1', state);
+        store.incrementCounter('key-1', 10);
+        store.incrementRetryCount('tc-1');
+        store.reset();
+        expect(store.getTaskState('task-1')).toBeUndefined();
+        expect(store.getCounter('key-1')).toBe(0);
+        expect(store.getRetryCount('tc-1')).toBe(0);
+    });
+    test('reset fires TRUNCATE query', () => {
+        store.reset();
+        expect(mockQuery).toHaveBeenCalledWith('TRUNCATE budget_task_states, budget_counters, budget_retry_counts', undefined);
+    });
+    test('setTaskState fires an async INSERT/UPDATE query', () => {
+        const state = makeBudgetState({ task_id: 'task-42', spent_usd: 3.14, steps: 7 });
+        store.setTaskState('task-42', state);
+        expect(mockQuery).toHaveBeenCalledTimes(1);
+        const [sql, params] = mockQuery.mock.calls[0];
+        expect(sql).toContain('INSERT INTO budget_task_states');
+        expect(sql).toContain('ON CONFLICT (task_id) DO UPDATE');
+        expect(params).toEqual([
+            state.task_id,
+            state.workspace_id,
+            state.actor_id,
+            state.spent_usd,
+            state.steps,
+            state.started_at,
+        ]);
+    });
+    test('incrementCounter fires an async INSERT/UPDATE query', () => {
+        store.incrementCounter('spend:actor-1', 2.0);
+        expect(mockQuery).toHaveBeenCalledTimes(1);
+        const [sql, params] = mockQuery.mock.calls[0];
+        expect(sql).toContain('INSERT INTO budget_counters');
+        expect(sql).toContain('ON CONFLICT (key) DO UPDATE');
+        expect(params).toEqual(['spend:actor-1', 2.0]);
+    });
+    test('incrementRetryCount fires an async INSERT/UPDATE query', () => {
+        store.incrementRetryCount('tc-99');
+        expect(mockQuery).toHaveBeenCalledTimes(1);
+        const [sql, params] = mockQuery.mock.calls[0];
+        expect(sql).toContain('INSERT INTO budget_retry_counts');
+        expect(sql).toContain('ON CONFLICT (tool_call_id) DO UPDATE');
+        expect(params).toEqual(['tc-99', 1]);
+    });
+});
+// ===========================================================================
+// PostgresAuditStore
+// ===========================================================================
+describe('PostgresAuditStore', () => {
+    let store;
+    beforeEach(() => {
+        store = new postgres_1.PostgresAuditStore(mockPool);
+    });
+    const makeEvent = (overrides = {}) => ({
+        event_id: 'evt-1',
+        event_type: 'TOOL_CALL_RECEIVED',
+        timestamp: '2025-01-01T00:00:00.000Z',
+        tool_call_id: 'tc-1',
+        task_id: 'task-1',
+        workspace_id: 'ws-1',
+        actor_id: 'actor-1',
+        tool_name: 'http.get',
+        metadata: {},
+        ...overrides,
+    });
+    test('append adds events to cache and fires async INSERT', () => {
+        const event = makeEvent();
+        store.append(event);
+        // Verify it's in the cache
+        expect(store.getAll()).toHaveLength(1);
+        expect(store.getAll()[0]).toEqual(event);
+        // Verify the INSERT was fired
+        expect(mockQuery).toHaveBeenCalledTimes(1);
+        const [sql, params] = mockQuery.mock.calls[0];
+        expect(sql).toContain('INSERT INTO audit_events');
+        expect(sql).toContain('ON CONFLICT (event_id) DO NOTHING');
+        expect(params).toEqual([
+            event.event_id,
+            event.event_type,
+            event.timestamp,
+            event.tool_call_id,
+            event.task_id,
+            event.workspace_id,
+            event.actor_id,
+            event.tool_name,
+            JSON.stringify(event.metadata),
+        ]);
+    });
+    test('getByTaskId filters correctly', () => {
+        store.append(makeEvent({ event_id: 'evt-1', task_id: 'task-A', timestamp: '2025-01-01T00:00:02Z' }));
+        store.append(makeEvent({ event_id: 'evt-2', task_id: 'task-B', timestamp: '2025-01-01T00:00:01Z' }));
+        store.append(makeEvent({ event_id: 'evt-3', task_id: 'task-A', timestamp: '2025-01-01T00:00:00Z' }));
+        const results = store.getByTaskId('task-A');
+        expect(results).toHaveLength(2);
+        // Should be sorted by timestamp ascending
+        expect(results[0].event_id).toBe('evt-3');
+        expect(results[1].event_id).toBe('evt-1');
+    });
+    test('getByToolCallId filters correctly', () => {
+        store.append(makeEvent({ event_id: 'evt-1', tool_call_id: 'tc-X' }));
+        store.append(makeEvent({ event_id: 'evt-2', tool_call_id: 'tc-Y' }));
+        store.append(makeEvent({ event_id: 'evt-3', tool_call_id: 'tc-X' }));
+        const results = store.getByToolCallId('tc-X');
+        expect(results).toHaveLength(2);
+        expect(results.every((e) => e.tool_call_id === 'tc-X')).toBe(true);
+    });
+    test('getByEventType filters correctly', () => {
+        store.append(makeEvent({ event_id: 'evt-1', event_type: 'TOOL_CALL_RECEIVED' }));
+        store.append(makeEvent({ event_id: 'evt-2', event_type: 'POLICY_DECIDED' }));
+        store.append(makeEvent({ event_id: 'evt-3', event_type: 'TOOL_CALL_RECEIVED' }));
+        const results = store.getByEventType('TOOL_CALL_RECEIVED');
+        expect(results).toHaveLength(2);
+        expect(results.every((e) => e.event_type === 'TOOL_CALL_RECEIVED')).toBe(true);
+    });
+    test('getAll returns all events', () => {
+        store.append(makeEvent({ event_id: 'evt-1' }));
+        store.append(makeEvent({ event_id: 'evt-2' }));
+        store.append(makeEvent({ event_id: 'evt-3' }));
+        const all = store.getAll();
+        expect(all).toHaveLength(3);
+    });
+    test('getAll returns a copy (not the internal array)', () => {
+        store.append(makeEvent({ event_id: 'evt-1' }));
+        const all = store.getAll();
+        all.push(makeEvent({ event_id: 'evt-pushed' }));
+        expect(store.getAll()).toHaveLength(1);
+    });
+    test('clear empties cache and truncates table', () => {
+        store.append(makeEvent({ event_id: 'evt-1' }));
+        store.append(makeEvent({ event_id: 'evt-2' }));
+        mockQuery.mockClear();
+        store.clear();
+        expect(store.getAll()).toHaveLength(0);
+        expect(mockQuery).toHaveBeenCalledWith('TRUNCATE audit_events', undefined);
+    });
+});
+// ===========================================================================
+// PostgresApprovalStore
+// ===========================================================================
+describe('PostgresApprovalStore', () => {
+    let store;
+    beforeEach(() => {
+        store = new postgres_1.PostgresApprovalStore(mockPool);
+    });
+    test('save and getById', () => {
+        const approval = makeApprovalRecord({ approval_id: 'apr-1', workspace_id: 'ws-1', tool_call_id: 'tc-1' });
+        store.save('apr-1', approval);
+        expect(store.getById('apr-1')).toEqual(approval);
+        expect(store.getById('apr-missing')).toBeUndefined();
+    });
+    test('save fires async INSERT/UPDATE query', () => {
+        const approval = makeApprovalRecord({ approval_id: 'apr-1', workspace_id: 'ws-1', tool_call_id: 'tc-1' });
+        store.save('apr-1', approval);
+        expect(mockQuery).toHaveBeenCalledTimes(1);
+        const [sql, params] = mockQuery.mock.calls[0];
+        expect(sql).toContain('INSERT INTO approvals');
+        expect(sql).toContain('ON CONFLICT (approval_id) DO UPDATE');
+        expect(params[0]).toBe('apr-1');
+        expect(params[1]).toBe(JSON.stringify(approval));
+        expect(params[2]).toBe('pending');
+        expect(params[3]).toBe('ws-1');
+        expect(params[4]).toBe('tc-1');
+    });
+    test('indexToken and getByToken', () => {
+        const approval = makeApprovalRecord({ approval_id: 'apr-1', workspace_id: 'ws-1', tool_call_id: 'tc-1' });
+        store.save('apr-1', approval);
+        store.indexToken('tok-abc', 'apr-1');
+        expect(store.getByToken('tok-abc')).toEqual(approval);
+        expect(store.getByToken('tok-missing')).toBeUndefined();
+    });
+    test('indexToken fires async INSERT/UPDATE query', () => {
+        store.indexToken('tok-abc', 'apr-1');
+        // The last call should be for the token insert
+        const calls = mockQuery.mock.calls;
+        const lastCall = calls[calls.length - 1];
+        expect(lastCall[0]).toContain('INSERT INTO approval_tokens');
+        expect(lastCall[0]).toContain('ON CONFLICT (token) DO UPDATE');
+        expect(lastCall[1]).toEqual(['tok-abc', 'apr-1']);
+    });
+    test('getByToolCallId searches approvals', () => {
+        store.save('apr-1', makeApprovalRecord({ approval_id: 'apr-1', tool_call_id: 'tc-A', workspace_id: 'ws-1' }));
+        store.save('apr-2', makeApprovalRecord({ approval_id: 'apr-2', tool_call_id: 'tc-B', workspace_id: 'ws-1' }));
+        const found = store.getByToolCallId('tc-A');
+        expect(found).toBeDefined();
+        expect(found.tool_call_id).toBe('tc-A');
+        expect(found.workspace_id).toBe('ws-1');
+        expect(store.getByToolCallId('tc-C')).toBeUndefined();
+    });
+    test('findPending returns pending items only', () => {
+        store.save('apr-1', makeApprovalRecord({ approval_id: 'apr-1', status: 'pending', workspace_id: 'ws-1', tool_call_id: 'tc-1' }));
+        store.save('apr-2', makeApprovalRecord({ approval_id: 'apr-2', status: 'approved', workspace_id: 'ws-1', tool_call_id: 'tc-2' }));
+        store.save('apr-3', makeApprovalRecord({ approval_id: 'apr-3', status: 'pending', workspace_id: 'ws-2', tool_call_id: 'tc-3' }));
+        const pending = store.findPending();
+        expect(pending).toHaveLength(2);
+        expect(pending.every((a) => a.status === 'pending')).toBe(true);
+    });
+    test('findPending filters by workspace', () => {
+        store.save('apr-1', makeApprovalRecord({ approval_id: 'apr-1', status: 'pending', workspace_id: 'ws-1', tool_call_id: 'tc-1' }));
+        store.save('apr-2', makeApprovalRecord({ approval_id: 'apr-2', status: 'pending', workspace_id: 'ws-2', tool_call_id: 'tc-2' }));
+        store.save('apr-3', makeApprovalRecord({ approval_id: 'apr-3', status: 'pending', workspace_id: 'ws-1', tool_call_id: 'tc-3' }));
+        const ws1Pending = store.findPending('ws-1');
+        expect(ws1Pending).toHaveLength(2);
+        expect(ws1Pending.every((a) => a.workspace_id === 'ws-1')).toBe(true);
+        const ws2Pending = store.findPending('ws-2');
+        expect(ws2Pending).toHaveLength(1);
+        expect(ws2Pending[0].workspace_id).toBe('ws-2');
+    });
+    test('clear empties all data', () => {
+        store.save('apr-1', makeApprovalRecord({ approval_id: 'apr-1', status: 'pending', workspace_id: 'ws-1', tool_call_id: 'tc-1' }));
+        store.indexToken('tok-abc', 'apr-1');
+        mockQuery.mockClear();
+        store.clear();
+        expect(store.getById('apr-1')).toBeUndefined();
+        expect(store.getByToken('tok-abc')).toBeUndefined();
+        expect(store.findPending()).toHaveLength(0);
+        expect(mockQuery).toHaveBeenCalledWith('TRUNCATE approvals, approval_tokens', undefined);
+    });
+});
+// ===========================================================================
+// PostgresIdempotencyStore
+// ===========================================================================
+describe('PostgresIdempotencyStore', () => {
+    let store;
+    beforeEach(() => {
+        jest.useFakeTimers();
+        jest.setSystemTime(new Date('2025-01-01T00:00:00.000Z'));
+        store = new postgres_1.PostgresIdempotencyStore(mockPool);
+    });
+    afterEach(() => {
+        jest.useRealTimers();
+    });
+    test('set and get', async () => {
+        const result = makeToolResult({ tool_call_id: 'tc-1' });
+        store.set('tc-1', result, 60000);
+        expect(await store.get('tc-1')).toEqual(result);
+    });
+    test('set fires async INSERT query', () => {
+        const result = makeToolResult({ tool_call_id: 'tc-1' });
+        store.set('tc-1', result, 60000);
+        expect(mockQuery).toHaveBeenCalledTimes(1);
+        const [sql, params] = mockQuery.mock.calls[0];
+        expect(sql).toContain('INSERT INTO idempotency_cache');
+        expect(sql).toContain('ON CONFLICT (tool_call_id) DO UPDATE');
+        expect(params[0]).toBe('tc-1');
+        expect(params[1]).toBe(JSON.stringify(result));
+        // Third param is the expiry ISO string
+        expect(typeof params[2]).toBe('string');
+    });
+    test('get returns undefined for missing entries', async () => {
+        expect(await store.get('nonexistent')).toBeUndefined();
+    });
+    test('get returns undefined for expired entries', async () => {
+        const result = makeToolResult({ tool_call_id: 'tc-1' });
+        store.set('tc-1', result, 5000); // 5 second TTL
+        // Still valid
+        jest.advanceTimersByTime(4999);
+        expect(await store.get('tc-1')).toEqual(result);
+        // Now expired
+        jest.advanceTimersByTime(2);
+        expect(await store.get('tc-1')).toBeUndefined();
+    });
+    test('expired entry triggers DELETE query', async () => {
+        store.set('tc-1', makeToolResult({ tool_call_id: 'tc-1' }), 5000);
+        mockQuery.mockClear();
+        jest.advanceTimersByTime(5001);
+        await store.get('tc-1');
+        // Should fire a DELETE for the expired entry
+        expect(mockQuery).toHaveBeenCalledTimes(1);
+        const [sql, params] = mockQuery.mock.calls[0];
+        expect(sql).toContain('DELETE FROM idempotency_cache');
+        expect(params).toEqual(['tc-1']);
+    });
+    test('has returns true for valid entries', async () => {
+        store.set('tc-1', makeToolResult({ tool_call_id: 'tc-1' }), 60000);
+        expect(await store.has('tc-1')).toBe(true);
+    });
+    test('has returns false for missing entries', async () => {
+        expect(await store.has('nonexistent')).toBe(false);
+    });
+    test('has returns false for expired entries', async () => {
+        store.set('tc-1', makeToolResult({ tool_call_id: 'tc-1' }), 5000);
+        jest.advanceTimersByTime(5001);
+        expect(await store.has('tc-1')).toBe(false);
+    });
+    test('clear empties cache and fires TRUNCATE', async () => {
+        store.set('tc-1', makeToolResult({ tool_call_id: 'tc-1' }), 60000);
+        store.set('tc-2', makeToolResult({ tool_call_id: 'tc-2' }), 60000);
+        mockQuery.mockClear();
+        store.clear();
+        expect(await store.get('tc-1')).toBeUndefined();
+        expect(await store.get('tc-2')).toBeUndefined();
+        expect(mockQuery).toHaveBeenCalledWith('TRUNCATE idempotency_cache', undefined);
+    });
+});
+// ===========================================================================
+// PostgresRateLimitStore
+// ===========================================================================
+describe('PostgresRateLimitStore', () => {
+    let store;
+    beforeEach(() => {
+        jest.useFakeTimers();
+        jest.setSystemTime(new Date('2025-01-01T00:00:00.000Z'));
+        store = new postgres_1.PostgresRateLimitStore(mockPool);
+    });
+    afterEach(() => {
+        jest.useRealTimers();
+    });
+    test('hit records and counts correctly', () => {
+        const r1 = store.hit('actor:agent-1', 60000, 10);
+        expect(r1.allowed).toBe(true);
+        expect(r1.current).toBe(1);
+        expect(r1.limit).toBe(10);
+        const r2 = store.hit('actor:agent-1', 60000, 10);
+        expect(r2.allowed).toBe(true);
+        expect(r2.current).toBe(2);
+    });
+    test('hit fires async INSERT to persist hit', () => {
+        store.hit('actor:agent-1', 60000, 10);
+        // First hit also triggers a DELETE for old entries (cleanup for first hit in window)
+        const insertCalls = mockQuery.mock.calls.filter(([sql]) => sql.includes('INSERT INTO rate_limit_hits'));
+        expect(insertCalls.length).toBeGreaterThanOrEqual(1);
+        expect(insertCalls[0][1][0]).toBe('actor:agent-1');
+    });
+    test('respects maxRequests limit', () => {
+        const windowMs = 60000;
+        const maxRequests = 3;
+        const r1 = store.hit('actor:agent-1', windowMs, maxRequests);
+        expect(r1.allowed).toBe(true);
+        expect(r1.current).toBe(1);
+        const r2 = store.hit('actor:agent-1', windowMs, maxRequests);
+        expect(r2.allowed).toBe(true);
+        expect(r2.current).toBe(2);
+        const r3 = store.hit('actor:agent-1', windowMs, maxRequests);
+        expect(r3.allowed).toBe(true);
+        expect(r3.current).toBe(3);
+        // 4th request exceeds limit
+        const r4 = store.hit('actor:agent-1', windowMs, maxRequests);
+        expect(r4.allowed).toBe(false);
+        expect(r4.current).toBe(4);
+        expect(r4.limit).toBe(maxRequests);
+    });
+    test('window expires and allows new requests', () => {
+        const windowMs = 10000;
+        const maxRequests = 2;
+        store.hit('actor:agent-1', windowMs, maxRequests);
+        store.hit('actor:agent-1', windowMs, maxRequests);
+        // At limit
+        const r3 = store.hit('actor:agent-1', windowMs, maxRequests);
+        expect(r3.allowed).toBe(false);
+        // Advance past the window
+        jest.advanceTimersByTime(10001);
+        // Now the old hits should be pruned
+        const r4 = store.hit('actor:agent-1', windowMs, maxRequests);
+        expect(r4.allowed).toBe(true);
+        expect(r4.current).toBe(1);
+    });
+    test('different keys are independent', () => {
+        store.hit('actor:agent-1', 60000, 1);
+        const r1 = store.hit('actor:agent-1', 60000, 1);
+        expect(r1.allowed).toBe(false);
+        // Different key should be allowed
+        const r2 = store.hit('actor:agent-2', 60000, 1);
+        expect(r2.allowed).toBe(true);
+    });
+    test('reset clears all state and fires TRUNCATE', () => {
+        store.hit('actor:agent-1', 60000, 10);
+        store.hit('actor:agent-2', 60000, 10);
+        mockQuery.mockClear();
+        store.reset();
+        // After reset, counters should start fresh
+        const result = store.hit('actor:agent-1', 60000, 10);
+        expect(result.current).toBe(1);
+        // Verify TRUNCATE was called (first call after mockClear)
+        const truncateCalls = mockQuery.mock.calls.filter(([sql]) => sql.includes('TRUNCATE rate_limit_hits'));
+        expect(truncateCalls).toHaveLength(1);
+    });
+    test('hit returns correct resetAt timestamp', () => {
+        const now = Date.now();
+        const windowMs = 60000;
+        const result = store.hit('actor:agent-1', windowMs, 10);
+        // resetAt should be the first timestamp in window + windowMs
+        expect(result.resetAt).toBe(now + windowMs);
+    });
+});
+// ===========================================================================
+// PostgresSubscriptionStore
+// ===========================================================================
+function makeSubscription(overrides = {}) {
+    return {
+        id: 'sub-001',
+        workspace_id: 'ws-001',
+        stripe_customer_id: 'cus_test123',
+        stripe_subscription_id: 'sub_test456',
+        plan: 'pro',
+        status: 'active',
+        current_period_start: '2026-01-01T00:00:00.000Z',
+        current_period_end: '2026-02-01T00:00:00.000Z',
+        cancel_at_period_end: false,
+        created_at: '2026-01-01T00:00:00.000Z',
+        updated_at: '2026-01-01T00:00:00.000Z',
+        ...overrides,
+    };
+}
+describe('PostgresSubscriptionStore', () => {
+    let store;
+    beforeEach(() => {
+        store = new postgres_1.PostgresSubscriptionStore(mockPool);
+    });
+    test('create stores in cache and fires async INSERT', () => {
+        const sub = makeSubscription();
+        store.create(sub);
+        expect(store.getById('sub-001')).toMatchObject({ id: 'sub-001', plan: 'pro' });
+        expect(mockQuery).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO subscriptions'), expect.arrayContaining(['sub-001', 'ws-001', 'cus_test123']));
+    });
+    test('getById returns undefined for missing entries', () => {
+        expect(store.getById('nonexistent')).toBeUndefined();
+    });
+    test('getByWorkspace returns subscription for workspace', () => {
+        store.create(makeSubscription());
+        expect(store.getByWorkspace('ws-001')).toMatchObject({ workspace_id: 'ws-001' });
+        expect(store.getByWorkspace('ws-other')).toBeUndefined();
+    });
+    test('getByStripeCustomerId returns subscription', () => {
+        store.create(makeSubscription());
+        expect(store.getByStripeCustomerId('cus_test123')).toMatchObject({ stripe_customer_id: 'cus_test123' });
+        expect(store.getByStripeCustomerId('cus_other')).toBeUndefined();
+    });
+    test('getByStripeSubscriptionId returns subscription', () => {
+        store.create(makeSubscription());
+        expect(store.getByStripeSubscriptionId('sub_test456')).toMatchObject({ stripe_subscription_id: 'sub_test456' });
+        expect(store.getByStripeSubscriptionId('sub_other')).toBeUndefined();
+    });
+    test('update modifies cache and fires async UPDATE', () => {
+        store.create(makeSubscription());
+        const result = store.update('sub-001', { plan: 'business', updated_at: '2026-02-01T00:00:00.000Z' });
+        expect(result?.plan).toBe('business');
+        expect(store.getById('sub-001')?.plan).toBe('business');
+        expect(mockQuery).toHaveBeenCalledWith(expect.stringContaining('UPDATE subscriptions SET'), expect.arrayContaining(['business']));
+    });
+    test('update returns undefined for missing entries', () => {
+        expect(store.update('nonexistent', { plan: 'free' })).toBeUndefined();
+    });
+    test('update rejects disallowed columns', () => {
+        store.create(makeSubscription());
+        // 'id' is not in ALLOWED_SUBSCRIPTION_COLUMNS — should be silently stripped
+        const result = store.update('sub-001', { id: 'hacked' });
+        expect(result?.id).toBe('sub-001'); // id unchanged
+    });
+    test('delete removes from cache and fires async DELETE', () => {
+        store.create(makeSubscription());
+        expect(store.delete('sub-001')).toBe(true);
+        expect(store.getById('sub-001')).toBeUndefined();
+        expect(mockQuery).toHaveBeenCalledWith(expect.stringContaining('DELETE FROM subscriptions'), ['sub-001']);
+    });
+    test('delete returns false for missing entries', () => {
+        expect(store.delete('nonexistent')).toBe(false);
+    });
+    test('list returns all subscriptions', () => {
+        store.create(makeSubscription({ id: 'sub-001' }));
+        store.create(makeSubscription({ id: 'sub-002', workspace_id: 'ws-002' }));
+        expect(store.list()).toHaveLength(2);
+    });
+    test('hydrate loads from database', async () => {
+        mockQuery.mockResolvedValueOnce({
+            rows: [
+                {
+                    id: 'sub-pg-001', workspace_id: 'ws-pg', stripe_customer_id: 'cus_pg',
+                    stripe_subscription_id: 'sub_pg', plan: 'business', status: 'active',
+                    current_period_start: '2026-01-01', current_period_end: '2026-02-01',
+                    cancel_at_period_end: false, created_at: '2026-01-01', updated_at: '2026-01-01',
+                },
+            ],
+        });
+        await store.hydrate();
+        expect(store.getById('sub-pg-001')).toMatchObject({ plan: 'business' });
+    });
+    test('createTables creates table and indexes', async () => {
+        await postgres_1.PostgresSubscriptionStore.createTables(mockPool);
+        const allSql = mockQuery.mock.calls.map((c) => c[0]);
+        expect(allSql.some(s => s.includes('CREATE TABLE IF NOT EXISTS subscriptions'))).toBe(true);
+        expect(allSql.some(s => s.includes('idx_subscriptions_workspace'))).toBe(true);
+        expect(allSql.some(s => s.includes('idx_subscriptions_stripe_customer'))).toBe(true);
+        expect(allSql.some(s => s.includes('idx_subscriptions_stripe_subscription'))).toBe(true);
+    });
+});
+// ===========================================================================
+// initPostgresStorage
+// ===========================================================================
+describe('initPostgresStorage', () => {
+    test('calls CREATE TABLE IF NOT EXISTS for all tables', async () => {
+        // Each store's createTables uses pool.query for DDL
+        await (0, postgres_1.initPostgresStorage)(mockPool);
+        const allSql = mockQuery.mock.calls.map(([sql]) => sql);
+        // PostgresBudgetStore creates 3 tables
+        expect(allSql.some((s) => s.includes('CREATE TABLE IF NOT EXISTS budget_task_states'))).toBe(true);
+        expect(allSql.some((s) => s.includes('CREATE TABLE IF NOT EXISTS budget_counters'))).toBe(true);
+        expect(allSql.some((s) => s.includes('CREATE TABLE IF NOT EXISTS budget_retry_counts'))).toBe(true);
+        // PostgresAuditStore creates 1 table
+        expect(allSql.some((s) => s.includes('CREATE TABLE IF NOT EXISTS audit_events'))).toBe(true);
+        // PostgresApprovalStore creates 2 tables
+        expect(allSql.some((s) => s.includes('CREATE TABLE IF NOT EXISTS approvals'))).toBe(true);
+        expect(allSql.some((s) => s.includes('CREATE TABLE IF NOT EXISTS approval_tokens'))).toBe(true);
+        // PostgresIdempotencyStore creates 1 table
+        expect(allSql.some((s) => s.includes('CREATE TABLE IF NOT EXISTS idempotency_cache'))).toBe(true);
+        // PostgresRateLimitStore creates 1 table + 1 index
+        expect(allSql.some((s) => s.includes('CREATE TABLE IF NOT EXISTS rate_limit_hits'))).toBe(true);
+        expect(allSql.some((s) => s.includes('CREATE INDEX IF NOT EXISTS idx_rate_limit_hits_key_ts'))).toBe(true);
+    });
+    test('calls pool.query the expected number of times', async () => {
+        await (0, postgres_1.initPostgresStorage)(mockPool);
+        // Budget: 3 tables, Audit: 1 table, Approval: 2 tables, Idempotency: 1 table,
+        // RateLimit: 1 table + 1 index = 9 core queries
+        // SaaS: Users: 1 + 1 migration, OAuthAccounts: 1, Workspaces: 1, WorkspaceMembers: 1,
+        //        Sessions: 1 + 1 index, UserApiKeys: 1 + 2 indexes + 1 migration (tags) = 11 SaaS queries
+        // Subscriptions: 1 table + 3 indexes = 4 queries
+        // Per-workspace config: RateLimitConfig: 1 table, BudgetConfig: 1 table, PolicyStore: 1 table = 3 queries
+        // Total: 27
+        expect(mockQuery).toHaveBeenCalledTimes(27);
+    });
+});
+//# sourceMappingURL=postgres-storage.test.js.map