@agent-native/core 0.5.0-dev.b51eaae → 0.7.1

package/dist/scripts/db/patch.js

@@ -0,0 +1,392 @@
+/**
+ * Core script: db-patch
+ *
+ * Surgical search-and-replace on a text column in any SQL table. Instead of
+ * re-sending the full column value (as `db-exec UPDATE` would require), the
+ * agent sends one or more `{find, replace}` pairs. The script reads the row,
+ * applies the edits in memory, and writes the result back in a single UPDATE.
+ *
+ * ## When to use which tool
+ *
+ *   Large text field, small slice to change       → db-patch (this)
+ *     e.g. fix one paragraph in a 50KB document, tweak one key in a dashboard
+ *     JSON blob, rename a label in a slide HTML string.
+ *
+ *   Short field, set outright                     → db-exec UPDATE
+ *     e.g. `UPDATE forms SET status = 'published' WHERE id = '...'`.
+ *
+ *   Multiple columns / computed values            → db-exec UPDATE
+ *     e.g. `UPDATE meals SET calories = calories + 50, ...`.
+ *
+ *   Domain-specific action exists                 → use that action
+ *     e.g. `edit-document` or `update-slide` — they also push live Yjs
+ *     updates to any open collaborative editor. db-patch is the generic
+ *     fallback for tables without a bespoke action.
+ *
+ * ## Why it's faster
+ *
+ *   The agent only has to transmit the diff (the `find` + `replace`
+ *   strings), not the full new value. For large text fields — multi-kilobyte
+ *   markdown documents, slide HTML, dashboard/form JSON — this dramatically
+ *   reduces tokens per edit and keeps concurrent edits composable.
+ *
+ * ## Security
+ *
+ *   In production mode, the same per-user / per-org temp view scoping that
+ *   `db-exec` uses applies here: the SELECT and UPDATE both go through the
+ *   scoped view, so you can never read or write rows outside the current
+ *   user's data. The WHERE clause is validated against a keyword denylist
+ *   (no ;, no chained statements, no DDL).
+ *
+ * ## Usage
+ *
+ *   pnpm action db-patch --table <t> --column <c> --where "<clause>" \
+ *     --find "old" --replace "new"
+ *
+ *   pnpm action db-patch --table decks --column data --where "id='d1'" \
+ *     --edits '[{"find":"Q3","replace":"Q4"},{"find":"$1M","replace":"$1.2M"}]'
+ */
+import path from "path";
+import { createClient } from "@libsql/client";
+import { getDatabaseUrl, getDatabaseAuthToken } from "../../db/client.js";
+import { parseArgs, fail } from "../utils.js";
+import { buildScopingPostgres, buildScopingSqlite } from "./scoping.js";
+function isPostgresUrl(url) {
+    return url.startsWith("postgres://") || url.startsWith("postgresql://");
+}
+/** Only unquoted [A-Za-z_][A-Za-z0-9_]* identifiers are allowed — no spaces,
+ *  no quoting, no dotted names. This is deliberately strict: it stops the
+ *  agent from sneaking SQL into the table/column slots. */
+function isValidIdentifier(s) {
+    return /^[A-Za-z_][A-Za-z0-9_]*$/.test(s);
+}
+/** Reject WHERE clauses that could chain statements or hide DDL. This isn't
+ *  a full SQL parser — just a keyword/character denylist to keep the surface
+ *  area equivalent to what db-exec already allows. */
+function validateWhere(where) {
+    if (where.includes(";")) {
+        fail("--where must not contain ';' (no statement chaining)");
+    }
+    // Strip inline strings before keyword scanning so "WHERE name = 'DROP TABLE'"
+    // doesn't trip the denylist.
+    const stripped = where
+        .replace(/'(?:''|[^'])*'/g, "''")
+        .replace(/"(?:""|[^"])*"/g, '""')
+        .toUpperCase();
+    const blocked = [
+        " INSERT ",
+        " UPDATE ",
+        " DELETE ",
+        " DROP ",
+        " ALTER ",
+        " CREATE ",
+        " ATTACH ",
+        " DETACH ",
+        " PRAGMA ",
+        " VACUUM ",
+        "--",
+        "/*",
+    ];
+    const padded = " " + stripped + " ";
+    for (const kw of blocked) {
+        if (padded.includes(kw)) {
+            fail(`--where must not contain "${kw.trim()}"`);
+        }
+    }
+}
+function parseEdits(parsed) {
+    let edits;
+    if (parsed.edits) {
+        let parsedJson;
+        try {
+            parsedJson = JSON.parse(parsed.edits);
+        }
+        catch (e) {
+            fail(`Invalid --edits JSON: ${e.message}`);
+        }
+        if (!Array.isArray(parsedJson) || parsedJson.length === 0) {
+            fail("--edits must be a non-empty JSON array of {find, replace} objects");
+        }
+        edits = parsedJson;
+    }
+    else if (parsed.find !== undefined) {
+        if (parsed.find === "")
+            fail("--find cannot be empty");
+        edits = [{ find: parsed.find, replace: parsed.replace ?? "" }];
+    }
+    else {
+        fail("Either --find/--replace or --edits is required");
+    }
+    for (const edit of edits) {
+        if (typeof edit.find !== "string" || edit.find === "") {
+            fail("Each edit must have a non-empty 'find' string");
+        }
+        if (edit.replace === undefined || edit.replace === null) {
+            edit.replace = "";
+        }
+        if (typeof edit.replace !== "string") {
+            fail("Each edit's 'replace' field must be a string");
+        }
+    }
+    return edits;
+}
+function preview(s) {
+    const max = 60;
+    const trimmed = s.replace(/\s+/g, " ");
+    return trimmed.length > max ? trimmed.slice(0, max) + "..." : trimmed;
+}
+function countOccurrences(haystack, needle) {
+    if (!needle)
+        return 0;
+    let count = 0;
+    let idx = 0;
+    while ((idx = haystack.indexOf(needle, idx)) !== -1) {
+        count++;
+        idx += needle.length;
+    }
+    return count;
+}
+/** Apply edits sequentially. By default replaces only the first occurrence
+ *  of each `find` (matching the behavior of the template-specific
+ *  `edit-document` action). `--all` switches to replace-every-occurrence. */
+function applyEdits(content, edits, replaceAll) {
+    let out = content;
+    const results = [];
+    let applied = 0;
+    for (let i = 0; i < edits.length; i++) {
+        const edit = edits[i];
+        const idx = out.indexOf(edit.find);
+        if (idx === -1) {
+            results.push({
+                index: i,
+                status: "not-found",
+                detail: `NOT FOUND: "${preview(edit.find)}"`,
+                occurrences: 0,
+            });
+            continue;
+        }
+        if (replaceAll) {
+            const occurrences = countOccurrences(out, edit.find);
+            // Literal replaceAll via split/join — no regex, no special chars.
+            out = out.split(edit.find).join(edit.replace);
+            applied++;
+            results.push({
+                index: i,
+                status: edit.replace === "" ? "deleted" : "replaced",
+                detail: `${edit.replace === "" ? "deleted" : "replaced"} ${occurrences}×: "${preview(edit.find)}"`,
+                occurrences,
+            });
+        }
+        else {
+            out =
+                out.slice(0, idx) + edit.replace + out.slice(idx + edit.find.length);
+            applied++;
+            results.push({
+                index: i,
+                status: edit.replace === "" ? "deleted" : "replaced",
+                detail: `${edit.replace === "" ? "deleted" : "replaced"}: "${preview(edit.find)}"`,
+                occurrences: 1,
+            });
+        }
+    }
+    return { content: out, results, applied };
+}
+function printResult(out, format) {
+    if (format === "json") {
+        console.log(JSON.stringify(out, null, 2));
+        return;
+    }
+    console.log(`db-patch: ${out.table}.${out.column}`);
+    console.log(`  Applied: ${out.applied}/${out.total}`);
+    console.log(`  Bytes:   ${out.bytesBefore} → ${out.bytesAfter}`);
+    for (const r of out.results) {
+        console.log(`  - ${r.detail}`);
+    }
+}
+// ─── Postgres path ──────────────────────────────────────────────────────────
+async function runPostgres(opts) {
+    const { default: pg } = await import("postgres");
+    const pgSql = pg(opts.url);
+    try {
+        // Same temp-view scoping db-exec uses — SELECT and UPDATE both go through
+        // the scoped view, so cross-user access is impossible even if --where is
+        // permissive.
+        const scoping = await buildScopingPostgres(pgSql);
+        for (const stmt of scoping.setup) {
+            await pgSql.unsafe(stmt);
+        }
+        const selectSql = `SELECT "${opts.column}" AS __val FROM "${opts.table}" WHERE ${opts.where}`;
+        const selected = Array.from(await pgSql.unsafe(selectSql));
+        if (selected.length === 0) {
+            fail(`No rows matched: ${opts.table} WHERE ${opts.where}. ` +
+                `(In production, data scoping filters results to the current user — the row may exist but be owned by someone else.)`);
+        }
+        if (selected.length > 1) {
+            fail(`WHERE matched ${selected.length} rows in ${opts.table}. db-patch expects exactly one row — narrow the WHERE clause (usually by primary key).`);
+        }
+        const original = (selected[0].__val ?? "");
+        if (typeof original !== "string") {
+            fail(`Column ${opts.table}.${opts.column} is not a text column (got ${typeof original}).`);
+        }
+        const { content, results, applied } = applyEdits(original, opts.edits, opts.replaceAll);
+        if (applied > 0) {
+            await pgSql.unsafe(`UPDATE "${opts.table}" SET "${opts.column}" = $1 WHERE ${opts.where}`, [content]);
+        }
+        printResult({
+            table: opts.table,
+            column: opts.column,
+            applied,
+            total: opts.edits.length,
+            bytesBefore: original.length,
+            bytesAfter: content.length,
+            results,
+        }, opts.format);
+        for (const stmt of scoping.teardown) {
+            await pgSql.unsafe(stmt).catch(() => { });
+        }
+    }
+    finally {
+        await pgSql.end();
+    }
+}
+// ─── SQLite / libSQL path ───────────────────────────────────────────────────
+async function runSqlite(opts) {
+    const client = createClient({
+        url: opts.url,
+        authToken: getDatabaseAuthToken(),
+    });
+    try {
+        const scoping = await buildScopingSqlite(client);
+        for (const stmt of scoping.setup) {
+            await client.execute(stmt);
+        }
+        const selectSql = `SELECT "${opts.column}" AS __val FROM "${opts.table}" WHERE ${opts.where}`;
+        const selectRes = await client.execute(selectSql);
+        if (selectRes.rows.length === 0) {
+            fail(`No rows matched: ${opts.table} WHERE ${opts.where}. ` +
+                `(In production, data scoping filters results to the current user — the row may exist but be owned by someone else.)`);
+        }
+        if (selectRes.rows.length > 1) {
+            fail(`WHERE matched ${selectRes.rows.length} rows in ${opts.table}. db-patch expects exactly one row — narrow the WHERE clause (usually by primary key).`);
+        }
+        const row = selectRes.rows[0];
+        const original = (row.__val ?? row[0] ?? "");
+        if (typeof original !== "string") {
+            fail(`Column ${opts.table}.${opts.column} is not a text column (got ${typeof original}).`);
+        }
+        const { content, results, applied } = applyEdits(original, opts.edits, opts.replaceAll);
+        if (applied > 0) {
+            await client.execute({
+                sql: `UPDATE "${opts.table}" SET "${opts.column}" = ? WHERE ${opts.where}`,
+                args: [content],
+            });
+        }
+        printResult({
+            table: opts.table,
+            column: opts.column,
+            applied,
+            total: opts.edits.length,
+            bytesBefore: original.length,
+            bytesAfter: content.length,
+            results,
+        }, opts.format);
+        for (const stmt of scoping.teardown) {
+            await client.execute(stmt).catch(() => { });
+        }
+    }
+    finally {
+        client.close();
+    }
+}
+// ─── Entry point ────────────────────────────────────────────────────────────
+export default async function dbPatch(args) {
+    const parsed = parseArgs(args);
+    if (parsed.help === "true") {
+        console.log(`Usage: pnpm action db-patch --table <t> --column <c> --where "<clause>" [edit flags]
+
+Surgical search-and-replace on a text column. Avoids re-sending the full
+column value — ideal for large strings (documents, slides, dashboards, JSON).
+
+Required:
+  --table <name>        Target table (identifier; no quoting)
+  --column <name>       Target text column (identifier; no quoting)
+  --where "<clause>"    SQL WHERE clause that matches exactly one row
+
+Edit mode (pick one):
+  --find <text>         Text to find (single edit; default replace = "")
+  --replace <text>      Replacement text (used with --find)
+  --edits <json>        Batch: JSON array of {find, replace} objects
+
+Options:
+  --all                 Replace every occurrence of each 'find' (default: first only)
+  --format json         Output as JSON
+  --help                Show this help
+
+Examples:
+  # Fix a typo in one document
+  pnpm action db-patch --table documents --column content \\
+    --where "id='abc'" --find "teh" --replace "the"
+
+  # Batch edits on a deck's JSON blob
+  pnpm action db-patch --table decks --column data --where "id='d1'" \\
+    --edits '[{"find":"\\"Q3\\"","replace":"\\"Q4\\""},{"find":"$1M","replace":"$1.2M"}]'
+
+When to use db-patch vs other tools:
+  Large text field, small edit                → db-patch (this)
+  Short field or multi-column set             → db-exec UPDATE
+  Domain action exists (edit-document, ...)   → use that action (syncs live
+                                                to open collaborative editors)
+`);
+        return;
+    }
+    const table = parsed.table;
+    const column = parsed.column;
+    const where = parsed.where;
+    if (!table)
+        fail("--table is required");
+    if (!column)
+        fail("--column is required");
+    if (!where)
+        fail("--where is required");
+    if (!isValidIdentifier(table))
+        fail(`Invalid --table: "${table}". Must be a plain identifier (letters, digits, underscore).`);
+    if (!isValidIdentifier(column))
+        fail(`Invalid --column: "${column}". Must be a plain identifier (letters, digits, underscore).`);
+    validateWhere(where);
+    const edits = parseEdits(parsed);
+    const replaceAll = parsed.all === "true";
+    // Resolve database URL: --db flag → DATABASE_URL env → default file path
+    let url;
+    if (parsed.db) {
+        url = "file:" + path.resolve(parsed.db);
+    }
+    else if (getDatabaseUrl()) {
+        url = getDatabaseUrl();
+    }
+    else {
+        url = "file:" + path.resolve(process.cwd(), "data", "app.db");
+    }
+    if (isPostgresUrl(url)) {
+        await runPostgres({
+            url,
+            table,
+            column,
+            where,
+            edits,
+            replaceAll,
+            format: parsed.format,
+        });
+    }
+    else {
+        await runSqlite({
+            url,
+            table,
+            column,
+            where,
+            edits,
+            replaceAll,
+            format: parsed.format,
+        });
+    }
+}
+//# sourceMappingURL=patch.js.map

package/dist/scripts/db/patch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch.js","sourceRoot":"","sources":["../../../src/scripts/db/patch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAwBxE,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAC1E,CAAC;AAED;;2DAE2D;AAC3D,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;sDAEsD;AACtD,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC/D,CAAC;IACD,8EAA8E;IAC9E,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,KAAK;SACnB,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC;SAChC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC;SAChC,WAAW,EAAE,CAAC;IAEjB,MAAM,OAAO,GAAG;QACd,UAAU;QACV,UAAU;QACV,UAAU;QACV,QAAQ;QACR,SAAS;QACT,UAAU;QACV,UAAU;QACV,UAAU;QACV,UAAU;QACV,UAAU;QACV,IAAI;QACJ,IAAI;KACL,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC;IACpC,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,6BAA6B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAA8B;IAChD,IAAI,KAAiB,CAAC;IAEtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,GAAG,UAAwB,CAAC;IACnC,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;YAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACvD,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAM,EAAE,CAAC;QAC1B,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACtD,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,KAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,GAAG,GAAG,EAAE,CAAC;IACf,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAc;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,CAAC,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpD,KAAK,EAAE,CAAC;QACR,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;6EAE6E;AAC7E,SAAS,UAAU,CACjB,OAAe,EACf,KAAiB,EACjB,UAAmB;IAEnB,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC5C,WAAW,EAAE,CAAC;aACf,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,kEAAkE;YAClE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;gBACpD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,WAAW,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAClG,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,GAAG;gBACD,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvE,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;gBACpD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAClF,WAAW,EAAE,CAAC;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,GAAgB,EAAE,MAAe;IACpD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,WAAW,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAYD,+EAA+E;AAE/E,KAAK,UAAU,WAAW,CAAC,IAAa;IACtC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,0EAA0E;QAC1E,yEAAyE;QACzE,cAAc;QACd,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,IAAI,CAAC,MAAM,oBAAoB,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9F,MAAM,QAAQ,GAAU,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CACF,oBAAoB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,IAAI;gBACpD,qHAAqH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CACF,iBAAiB,QAAQ,CAAC,MAAM,YAAY,IAAI,CAAC,KAAK,wFAAwF,CAC/I,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAW,CAAC;QACrD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CACF,UAAU,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,8BAA8B,OAAO,QAAQ,IAAI,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAC9C,QAAQ,EACR,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,MAAM,KAAK,CAAC,MAAM,CAChB,WAAW,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,KAAK,EAAE,EACtE,CAAC,OAAO,CAAC,CACV,CAAC;QACJ,CAAC;QAED,WAAW,CACT;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACxB,WAAW,EAAE,QAAQ,CAAC,MAAM;YAC5B,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,OAAO;SACR,EACD,IAAI,CAAC,MAAM,CACZ,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,SAAS,CAAC,IAAa;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,SAAS,EAAE,oBAAoB,EAAE;KAClC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,IAAI,CAAC,MAAM,oBAAoB,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9F,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAElD,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,CACF,oBAAoB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,IAAI;gBACpD,qHAAqH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CACF,iBAAiB,SAAS,CAAC,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,KAAK,wFAAwF,CACrJ,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAQ,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAW,CAAC;QACvD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CACF,UAAU,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,8BAA8B,OAAO,QAAQ,IAAI,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAC9C,QAAQ,EACR,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,MAAM,MAAM,CAAC,OAAO,CAAC;gBACnB,GAAG,EAAE,WAAW,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,MAAM,eAAe,IAAI,CAAC,KAAK,EAAE;gBAC1E,IAAI,EAAE,CAAC,OAAO,CAAC;aAChB,CAAC,CAAC;QACL,CAAC;QAED,WAAW,CACT;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACxB,WAAW,EAAE,QAAQ,CAAC,MAAM;YAC5B,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,OAAO;SACR,EACD,IAAI,CAAC,MAAM,CACZ,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCf,CAAC,CAAC;QACC,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAE3B,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACxC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAC3B,IAAI,CACF,qBAAqB,KAAK,8DAA8D,CACzF,CAAC;IACJ,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAC5B,IAAI,CACF,sBAAsB,MAAM,8DAA8D,CAC3F,CAAC;IACJ,aAAa,CAAC,KAAK,CAAC,CAAC;IAErB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC;IAEzC,yEAAyE;IACzE,IAAI,GAAW,CAAC;IAChB,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,cAAc,EAAE,EAAE,CAAC;QAC5B,GAAG,GAAG,cAAc,EAAE,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,WAAW,CAAC;YAChB,GAAG;YACH,KAAK;YACL,MAAM;YACN,KAAK;YACL,KAAK;YACL,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC;YACd,GAAG;YACH,KAAK;YACL,MAAM;YACN,KAAK;YACL,KAAK;YACL,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/scripts/db/scoping.d.ts

@@ -1,12 +1,14 @@
 /**
- * Per-user data scoping for db-query / db-exec.
+ * Per-user and per-org data scoping for db-query / db-exec.
  *
  * In production mode, creates temporary views that shadow real tables so
- * that raw SQL only sees the current user's data.
+ * that raw SQL only sees the current user's (and org's) data.
  *
  * Convention:
  *   - Template tables use an `owner_email` column for user scoping.
+ *   - Template tables use an `org_id` column for org scoping.
  *   - Core tables have their own scoping patterns (key prefix, session_id, etc.).
+ *   - When both columns are present, both WHERE clauses are applied (AND).
  *
  * Temp views take precedence over real tables in both SQLite and Postgres,
  * so the user's SQL runs unmodified against the filtered views.
@@ -20,8 +22,12 @@ export interface ScopingContext {
     active: boolean;
     /** The current user email (for INSERT injection in db-exec). */
     userEmail: string | null;
+    /** The current org ID (for INSERT injection in db-exec). */
+    orgId: string | null;
     /** Tables that have owner_email columns (for INSERT injection). */
     ownerEmailTables: Set<string>;
+    /** Tables that have org_id columns (for INSERT injection). */
+    orgIdTables: Set<string>;
 }
 /**
  * Build scoping context for a Postgres connection.

package/dist/scripts/db/scoping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoping.d.ts","sourceRoot":"","sources":["../../../src/scripts/db/scoping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAmIH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,iCAAiC;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mEAAmE;IACnE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,GAAG,GACT,OAAO,CAAC,cAAc,CAAC,CA4CzB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,CA2C7E"}
+{"version":3,"file":"scoping.d.ts","sourceRoot":"","sources":["../../../src/scripts/db/scoping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA0JH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,iCAAiC;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,8DAA8D;IAC9D,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,GAAG,GACT,OAAO,CAAC,cAAc,CAAC,CA2CzB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C7E"}

package/dist/scripts/db/scoping.js

@@ -1,12 +1,14 @@
 /**
- * Per-user data scoping for db-query / db-exec.
+ * Per-user and per-org data scoping for db-query / db-exec.
  *
  * In production mode, creates temporary views that shadow real tables so
- * that raw SQL only sees the current user's data.
+ * that raw SQL only sees the current user's (and org's) data.
  *
  * Convention:
  *   - Template tables use an `owner_email` column for user scoping.
+ *   - Template tables use an `org_id` column for org scoping.
  *   - Core tables have their own scoping patterns (key prefix, session_id, etc.).
+ *   - When both columns are present, both WHERE clauses are applied (AND).
  *
  * Temp views take precedence over real tables in both SQLite and Postgres,
  * so the user's SQL runs unmodified against the filtered views.
@@ -19,13 +21,18 @@ const CORE_TABLE_SCOPING = {
     oauth_tokens: { column: "owner", mode: "exact" },
     sessions: { column: "email", mode: "exact" },
 };
-// The conventional column name for user ownership in template tables.
+// The conventional column names for user/org ownership in template tables.
+import { getRequestUserEmail, getRequestOrgId, } from "../../server/request-context.js";
 const OWNER_COLUMN = "owner_email";
+const ORG_COLUMN = "org_id";
 function isProd() {
     return process.env.NODE_ENV === "production";
 }
 function getUserEmail() {
-    return process.env.AGENT_USER_EMAIL || null;
+    return getRequestUserEmail() || null;
+}
+function getOrgId() {
+    return getRequestOrgId() || null;
 }
 async function discoverColumnsPostgres(pgSql) {
     const rows = await pgSql `
@@ -57,7 +64,7 @@ async function discoverColumnsSqlite(client) {
 function escapeSqlString(value) {
     return value.replace(/'/g, "''");
 }
-function buildScopedTables(allColumns, userEmail, isPostgres) {
+function buildScopedTables(allColumns, userEmail, orgId, isPostgres) {
     // Group columns by table
     const columnsByTable = new Map();
     for (const { table, column } of allColumns) {
@@ -68,6 +75,7 @@ function buildScopedTables(allColumns, userEmail, isPostgres) {
     const scoped = [];
     const qualifiedPrefix = isPostgres ? "public." : "main.";
     const safeEmail = escapeSqlString(userEmail);
+    const safeOrgId = orgId ? escapeSqlString(orgId) : null;
     for (const [table, columns] of columnsByTable) {
         // Check core table scoping
         const coreScoping = CORE_TABLE_SCOPING[table];
@@ -93,12 +101,21 @@ function buildScopedTables(allColumns, userEmail, isPostgres) {
             });
             continue;
         }
-        // Check for owner_email convention column
-        if (columns.includes(OWNER_COLUMN)) {
+        // Build WHERE clauses for owner_email and org_id
+        const clauses = [];
+        const hasOwner = columns.includes(OWNER_COLUMN);
+        const hasOrg = columns.includes(ORG_COLUMN);
+        if (hasOwner) {
+            clauses.push(`"${OWNER_COLUMN}" = '${safeEmail}'`);
+        }
+        if (hasOrg && safeOrgId) {
+            clauses.push(`"${ORG_COLUMN}" = '${safeOrgId}'`);
+        }
+        if (clauses.length > 0) {
             const realTable = `${qualifiedPrefix}"${table}"`;
             scoped.push({
                 name: table,
-                viewSql: `CREATE TEMPORARY VIEW "${table}" AS SELECT * FROM ${realTable} WHERE "${OWNER_COLUMN}" = '${safeEmail}'`,
+                viewSql: `CREATE TEMPORARY VIEW "${table}" AS SELECT * FROM ${realTable} WHERE ${clauses.join(" AND ")}`,
             });
         }
     }
@@ -109,28 +126,24 @@ function buildScopedTables(allColumns, userEmail, isPostgres) {
  * Returns setup/teardown SQL to run before/after the user's query.
  */
 export async function buildScopingPostgres(pgSql) {
-    if (!isProd()) {
-        return {
-            setup: [],
-            teardown: [],
-            active: false,
-            userEmail: null,
-            ownerEmailTables: new Set(),
-        };
-    }
+    const inactive = {
+        setup: [],
+        teardown: [],
+        active: false,
+        userEmail: null,
+        orgId: null,
+        ownerEmailTables: new Set(),
+        orgIdTables: new Set(),
+    };
+    if (!isProd())
+        return inactive;
     const userEmail = getUserEmail();
-    if (!userEmail) {
-        return {
-            setup: [],
-            teardown: [],
-            active: false,
-            userEmail: null,
-            ownerEmailTables: new Set(),
-        };
-    }
+    if (!userEmail)
+        return inactive;
+    const orgId = getOrgId();
     const allColumns = await discoverColumnsPostgres(pgSql);
-    const scoped = buildScopedTables(allColumns, userEmail, true);
-    // Track which tables have owner_email for INSERT injection
+    const scoped = buildScopedTables(allColumns, userEmail, orgId, true);
+    // Track which tables have owner_email / org_id for INSERT injection
     const columnsByTable = new Map();
     for (const { table, column } of allColumns) {
         const cols = columnsByTable.get(table) || [];
@@ -138,16 +151,21 @@ export async function buildScopingPostgres(pgSql) {
         columnsByTable.set(table, cols);
     }
     const ownerEmailTables = new Set();
+    const orgIdTables = new Set();
     for (const [table, columns] of columnsByTable) {
         if (columns.includes(OWNER_COLUMN))
             ownerEmailTables.add(table);
+        if (columns.includes(ORG_COLUMN))
+            orgIdTables.add(table);
     }
     return {
         setup: scoped.map((s) => s.viewSql),
         teardown: scoped.map((s) => `DROP VIEW IF EXISTS "${s.name}"`),
         active: scoped.length > 0,
         userEmail,
+        orgId,
         ownerEmailTables,
+        orgIdTables,
     };
 }
 /**
@@ -155,27 +173,23 @@ export async function buildScopingPostgres(pgSql) {
  * Returns setup/teardown SQL to run before/after the user's query.
  */
 export async function buildScopingSqlite(client) {
-    if (!isProd()) {
-        return {
-            setup: [],
-            teardown: [],
-            active: false,
-            userEmail: null,
-            ownerEmailTables: new Set(),
-        };
-    }
+    const inactive = {
+        setup: [],
+        teardown: [],
+        active: false,
+        userEmail: null,
+        orgId: null,
+        ownerEmailTables: new Set(),
+        orgIdTables: new Set(),
+    };
+    if (!isProd())
+        return inactive;
     const userEmail = getUserEmail();
-    if (!userEmail) {
-        return {
-            setup: [],
-            teardown: [],
-            active: false,
-            userEmail: null,
-            ownerEmailTables: new Set(),
-        };
-    }
+    if (!userEmail)
+        return inactive;
+    const orgId = getOrgId();
     const allColumns = await discoverColumnsSqlite(client);
-    const scoped = buildScopedTables(allColumns, userEmail, false);
+    const scoped = buildScopedTables(allColumns, userEmail, orgId, false);
     const columnsByTable = new Map();
     for (const { table, column } of allColumns) {
         const cols = columnsByTable.get(table) || [];
@@ -183,16 +197,21 @@ export async function buildScopingSqlite(client) {
         columnsByTable.set(table, cols);
     }
     const ownerEmailTables = new Set();
+    const orgIdTables = new Set();
     for (const [table, columns] of columnsByTable) {
         if (columns.includes(OWNER_COLUMN))
             ownerEmailTables.add(table);
+        if (columns.includes(ORG_COLUMN))
+            orgIdTables.add(table);
     }
     return {
         setup: scoped.map((s) => s.viewSql),
         teardown: scoped.map((s) => `DROP VIEW IF EXISTS "${s.name}"`),
         active: scoped.length > 0,
         userEmail,
+        orgId,
         ownerEmailTables,
+        orgIdTables,
     };
 }
 //# sourceMappingURL=scoping.js.map