@bajustone/fortress 1.0.0-rc.1

package/dist/plugins/audit-log.js

@@ -0,0 +1,468 @@
+// src/plugins/audit-log/index.ts
+async function sha256Hex(input) {
+  const data = new TextEncoder().encode(input);
+  const buffer = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+var auditWriteChains = /* @__PURE__ */ new WeakMap();
+function withAuditChainLock(db, fn) {
+  const run = () => db.transaction(async (tx) => {
+    if (tx.dialect === "pg") {
+      if (!tx.rawQuery)
+        throw new Error("PostgreSQL audit hash chains require rawQuery advisory-lock support");
+      await tx.rawQuery("SELECT pg_advisory_xact_lock(117993, 1)");
+    }
+    return fn(tx);
+  });
+  if (db.dialect === "pg")
+    return run();
+  const previous = auditWriteChains.get(db) ?? Promise.resolve();
+  const result = previous.then(run, run);
+  auditWriteChains.set(db, result.then(() => void 0, () => void 0));
+  return result;
+}
+var AUDIT_EXPORT_COLUMNS = [
+  "id",
+  "timestamp",
+  "eventType",
+  "actorId",
+  "actorType",
+  "targetId",
+  "targetType",
+  "ipAddress",
+  "userAgent",
+  "outcome",
+  "metadata",
+  "previousHash",
+  "createdAt"
+];
+var CSV_SPECIAL_RE = /[",\n\r]/;
+var CSV_FORMULA_PREFIX_RE = /^[=+\-@\t\r]/;
+function toCsvCell(value) {
+  if (value == null)
+    return "";
+  const raw = value instanceof Date ? value.toISOString() : String(value);
+  const str = CSV_FORMULA_PREFIX_RE.test(raw) ? `'${raw}` : raw;
+  if (CSV_SPECIAL_RE.test(str))
+    return `"${str.replace(/"/g, '""')}"`;
+  return str;
+}
+function entriesToCsv(entries) {
+  const header = AUDIT_EXPORT_COLUMNS.join(",");
+  const rows = entries.map((entry) => {
+    const record = entry;
+    return AUDIT_EXPORT_COLUMNS.map((column) => toCsvCell(record[column])).join(",");
+  });
+  return [header, ...rows].join("\n");
+}
+async function computeEntryHash(entry) {
+  const values = AUDIT_EXPORT_COLUMNS.map((column) => {
+    const value = entry[column];
+    return value instanceof Date ? value.toISOString() : value;
+  });
+  return sha256Hex(JSON.stringify(values));
+}
+async function inspectChain(entries, anchor) {
+  if (entries.length === 0) {
+    const brokenLinks2 = [];
+    if (!anchor) {
+      brokenLinks2.push({
+        entryId: "anchor",
+        expected: "persistent zero-entry audit-chain anchor",
+        actual: null
+      });
+    } else if (anchor.entryCount !== 0 || anchor.lastHash !== null) {
+      brokenLinks2.push({
+        entryId: "anchor",
+        expected: "entry_count=0 and last_hash=null",
+        actual: `${anchor.entryCount}:${anchor.lastHash ?? "null"}`
+      });
+    }
+    return { tail: null, brokenLinks: brokenLinks2 };
+  }
+  const hashes = /* @__PURE__ */ new Map();
+  const duplicateHashes = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    const hash = await computeEntryHash(entry);
+    if (hashes.has(hash))
+      duplicateHashes.add(hash);
+    hashes.set(hash, entry);
+  }
+  const brokenLinks = [];
+  const roots = entries.filter((entry) => entry.previousHash == null);
+  for (const entry of entries) {
+    if (entry.previousHash != null && !hashes.has(entry.previousHash)) {
+      brokenLinks.push({
+        entryId: entry.id,
+        expected: "hash of an existing predecessor",
+        actual: entry.previousHash
+      });
+    }
+  }
+  for (const hash of duplicateHashes) {
+    brokenLinks.push({
+      entryId: hashes.get(hash).id,
+      expected: "unique entry hash",
+      actual: hash
+    });
+  }
+  if (roots.length !== 1) {
+    for (const root of roots.slice(1)) {
+      brokenLinks.push({
+        entryId: root.id,
+        expected: "exactly one chain root",
+        actual: null
+      });
+    }
+    if (roots.length === 0) {
+      brokenLinks.push({
+        entryId: entries[0].id,
+        expected: "one entry with previousHash=null",
+        actual: entries[0].previousHash
+      });
+    }
+  }
+  const byPreviousHash = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (entry.previousHash == null)
+      continue;
+    const successors = byPreviousHash.get(entry.previousHash) ?? [];
+    successors.push(entry);
+    byPreviousHash.set(entry.previousHash, successors);
+  }
+  const visited = /* @__PURE__ */ new Set();
+  let current = roots.length === 1 ? roots[0] : null;
+  let tail = null;
+  while (current && !visited.has(current)) {
+    visited.add(current);
+    tail = current;
+    const hash = await computeEntryHash(current);
+    const successors = byPreviousHash.get(hash) ?? [];
+    if (successors.length > 1) {
+      for (const successor of successors.slice(1)) {
+        brokenLinks.push({
+          entryId: successor.id,
+          expected: "a predecessor with only one successor",
+          actual: successor.previousHash
+        });
+      }
+    }
+    current = successors.length === 1 ? successors[0] : null;
+  }
+  for (const entry of entries) {
+    if (!visited.has(entry)) {
+      brokenLinks.push({
+        entryId: entry.id,
+        expected: "entry reachable from the chain root",
+        actual: entry.previousHash
+      });
+    }
+  }
+  if (!anchor) {
+    brokenLinks.push({
+      entryId: tail?.id ?? entries[0].id,
+      expected: "persisted terminal audit-chain anchor",
+      actual: null
+    });
+  } else {
+    if (anchor.entryCount !== entries.length) {
+      brokenLinks.push({
+        entryId: tail?.id ?? entries[0].id,
+        expected: `anchor entry count ${anchor.entryCount}`,
+        actual: String(entries.length)
+      });
+    }
+    if (tail) {
+      const tailHash = await computeEntryHash(tail);
+      if (anchor.lastHash !== tailHash) {
+        brokenLinks.push({
+          entryId: tail.id,
+          expected: anchor.lastHash ?? "non-null terminal hash",
+          actual: tailHash
+        });
+      }
+    }
+  }
+  return { tail, brokenLinks };
+}
+async function queryAuditLog(db, options) {
+  const where = [];
+  if (options?.userId != null)
+    where.push({ field: "actorId", operator: "=", value: options.userId });
+  if (options?.eventType)
+    where.push({ field: "eventType", operator: "=", value: options.eventType });
+  if (options?.from)
+    where.push({ field: "timestamp", operator: ">=", value: options.from });
+  if (options?.to)
+    where.push({ field: "timestamp", operator: "<=", value: options.to });
+  return db.findMany({
+    model: "audit_log",
+    where: where.length > 0 ? where : void 0,
+    limit: options?.limit,
+    offset: options?.offset,
+    sortBy: { field: "timestamp", direction: "desc" }
+  });
+}
+function auditLog(config = {}) {
+  const allowedEvents = config.events ?? null;
+  const hashChain = config.hashChain ?? false;
+  function shouldLog(eventType) {
+    if (!allowedEvents)
+      return true;
+    return allowedEvents.includes(eventType);
+  }
+  async function readChainAnchor(db) {
+    return db.findOne({
+      model: "audit_chain_state",
+      where: [{ field: "id", operator: "=", value: "1" }]
+    });
+  }
+  async function writeEntry(db, entry) {
+    if (!hashChain) {
+      await db.create({ model: "audit_log", data: { ...entry, previousHash: null } });
+      return;
+    }
+    await withAuditChainLock(db, async (tx) => {
+      const anchor = await readChainAnchor(tx);
+      if (!anchor || !Number.isInteger(anchor.entryCount) || anchor.entryCount < 0 || anchor.entryCount === 0 !== (anchor.lastHash === null)) {
+        throw new Error("Cannot append without a valid audit hash-chain anchor");
+      }
+      if (anchor.entryCount === 0) {
+        const existing = await tx.findMany({
+          model: "audit_log",
+          limit: 1
+        });
+        if (existing.length > 0) {
+          throw new Error(
+            "Cannot append to an unchained legacy audit log; call rebaselineChain() first"
+          );
+        }
+      }
+      const created = await tx.create({
+        model: "audit_log",
+        data: { ...entry, previousHash: anchor.lastHash }
+      });
+      const lastHash = await computeEntryHash(created);
+      const updated = await tx.update({
+        model: "audit_chain_state",
+        where: [{ field: "id", operator: "=", value: anchor.id }],
+        data: { lastHash, entryCount: anchor.entryCount + 1, updatedAt: /* @__PURE__ */ new Date() }
+      });
+      if (!updated)
+        throw new Error("Audit hash-chain anchor disappeared during append");
+    });
+  }
+  async function writeAuthEntry(db, entry, logger) {
+    try {
+      await writeEntry(db, entry);
+    } catch (error) {
+      try {
+        logger?.error({ plugin: "audit-log", error }, "audit log write failed");
+      } catch {
+      }
+    }
+  }
+  return {
+    name: "audit-log",
+    models: [{
+      name: "audit_log",
+      fields: {
+        id: { type: "string", required: true },
+        timestamp: { type: "date", required: true },
+        eventType: { type: "string", required: true },
+        actorId: { type: "string" },
+        actorType: { type: "string", required: true },
+        targetId: { type: "string" },
+        targetType: { type: "string" },
+        ipAddress: { type: "string" },
+        userAgent: { type: "string" },
+        outcome: { type: "string", required: true },
+        metadata: { type: "string" },
+        previousHash: { type: "string" },
+        createdAt: { type: "date", required: true }
+      }
+    }, {
+      name: "audit_chain_state",
+      fields: {
+        id: { type: "string", required: true },
+        lastHash: { type: "string" },
+        entryCount: { type: "number", required: true },
+        updatedAt: { type: "date", required: true }
+      }
+    }],
+    hooks: {
+      async afterLogin(ctx, result) {
+        if (!shouldLog("LOGIN_SUCCESS"))
+          return result;
+        await writeAuthEntry(ctx.db, {
+          timestamp: /* @__PURE__ */ new Date(),
+          eventType: "LOGIN_SUCCESS",
+          actorId: result.user.id,
+          actorType: "user",
+          targetId: null,
+          targetType: null,
+          ipAddress: ctx.meta?.ipAddress ?? null,
+          userAgent: ctx.meta?.userAgent ?? null,
+          outcome: "success",
+          metadata: null
+        }, ctx.config.logger);
+        return result;
+      },
+      async onLoginFailure(ctx) {
+        if (!shouldLog("LOGIN_FAILURE"))
+          return;
+        await writeAuthEntry(ctx.db, {
+          timestamp: /* @__PURE__ */ new Date(),
+          eventType: "LOGIN_FAILURE",
+          actorId: null,
+          actorType: "anonymous",
+          targetId: null,
+          targetType: null,
+          ipAddress: null,
+          userAgent: null,
+          outcome: "failure",
+          metadata: JSON.stringify({ identifier: ctx.identifier, error: ctx.error.message })
+        }, ctx.config.logger);
+      },
+      async beforeLogout(ctx) {
+        if (!shouldLog("LOGOUT"))
+          return;
+        await writeAuthEntry(ctx.db, {
+          timestamp: /* @__PURE__ */ new Date(),
+          eventType: "LOGOUT",
+          actorId: null,
+          actorType: "user",
+          targetId: null,
+          targetType: null,
+          ipAddress: ctx.meta?.ipAddress ?? null,
+          userAgent: ctx.meta?.userAgent ?? null,
+          outcome: "success",
+          metadata: null
+        }, ctx.config.logger);
+      },
+      async afterRegister(ctx, user) {
+        if (!shouldLog("REGISTER"))
+          return;
+        await writeAuthEntry(ctx.db, {
+          timestamp: /* @__PURE__ */ new Date(),
+          eventType: "REGISTER",
+          actorId: user.id,
+          actorType: "user",
+          targetId: user.id,
+          targetType: "user",
+          ipAddress: ctx.meta?.ipAddress ?? null,
+          userAgent: ctx.meta?.userAgent ?? null,
+          outcome: "success",
+          metadata: null
+        }, ctx.config.logger);
+      },
+      async afterTokenRefresh(ctx, result) {
+        if (!shouldLog("TOKEN_REFRESH"))
+          return result;
+        await writeAuthEntry(ctx.db, {
+          timestamp: /* @__PURE__ */ new Date(),
+          eventType: "TOKEN_REFRESH",
+          actorId: null,
+          actorType: "user",
+          targetId: null,
+          targetType: null,
+          ipAddress: ctx.meta?.ipAddress ?? null,
+          userAgent: ctx.meta?.userAgent ?? null,
+          outcome: "success",
+          metadata: null
+        }, ctx.config.logger);
+        return result;
+      }
+    },
+    methods: (ctx) => ({
+      async getAuditLog(options) {
+        return queryAuditLog(ctx.db, options);
+      },
+      async logCustomEvent(event) {
+        const eventType = event.eventType;
+        if (allowedEvents && !allowedEvents.includes(eventType))
+          return;
+        await writeEntry(ctx.db, {
+          timestamp: /* @__PURE__ */ new Date(),
+          eventType,
+          actorId: event.actorId ?? null,
+          actorType: event.actorType ?? "system",
+          targetId: event.targetId ?? null,
+          targetType: event.targetType ?? null,
+          ipAddress: event.ipAddress ?? null,
+          userAgent: event.userAgent ?? null,
+          outcome: event.outcome ?? "success",
+          metadata: event.metadata ? JSON.stringify(event.metadata) : null
+        });
+      },
+      async rebaselineChain() {
+        if (!hashChain)
+          throw new Error("Enable hashChain before rebaselining the audit log");
+        return withAuditChainLock(ctx.db, async (tx) => {
+          const anchor = await readChainAnchor(tx);
+          if (!anchor)
+            throw new Error("Cannot rebaseline without the persistent audit hash-chain anchor");
+          if (anchor.entryCount !== 0 || anchor.lastHash !== null) {
+            throw new Error("Cannot rebaseline an audit hash chain that has already been initialized");
+          }
+          const entries = await tx.findMany({ model: "audit_log" });
+          if (entries.some((entry) => entry.previousHash !== null)) {
+            throw new Error("Cannot rebaseline a partially or previously chained audit log");
+          }
+          entries.sort((left, right) => {
+            const timeDifference = left.createdAt.getTime() - right.createdAt.getTime();
+            if (timeDifference !== 0)
+              return timeDifference;
+            return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+          });
+          let previousHash = null;
+          const rebaselined = [];
+          for (const entry of entries) {
+            const updated = await tx.update({
+              model: "audit_log",
+              where: [{ field: "id", operator: "=", value: entry.id }],
+              data: { previousHash }
+            });
+            if (!updated)
+              throw new Error(`Audit entry ${entry.id} disappeared during rebaseline`);
+            rebaselined.push(updated);
+            previousHash = await computeEntryHash(updated);
+          }
+          const updatedAt = /* @__PURE__ */ new Date();
+          const updatedAnchor = await tx.update({
+            model: "audit_chain_state",
+            where: [{ field: "id", operator: "=", value: anchor.id }],
+            data: { lastHash: previousHash, entryCount: entries.length, updatedAt }
+          });
+          if (!updatedAnchor)
+            throw new Error("Audit hash-chain anchor disappeared during rebaseline");
+          const { brokenLinks } = await inspectChain(rebaselined, updatedAnchor);
+          if (brokenLinks.length > 0)
+            throw new Error("Rebaselined audit hash chain failed verification");
+          return { valid: true, totalEntries: entries.length, brokenLinks: [] };
+        });
+      },
+      async exportEntries(format = "json", options) {
+        const entries = await queryAuditLog(ctx.db, options);
+        if (format === "csv")
+          return entriesToCsv(entries);
+        return JSON.stringify(entries, null, 2);
+      },
+      async verifyChain() {
+        return withAuditChainLock(ctx.db, async (tx) => {
+          const entries = await tx.findMany({ model: "audit_log" });
+          const anchor = await readChainAnchor(tx);
+          const { brokenLinks } = await inspectChain(entries, anchor);
+          return {
+            valid: brokenLinks.length === 0,
+            totalEntries: entries.length,
+            brokenLinks
+          };
+        });
+      }
+    })
+  };
+}
+export {
+  auditLog
+};

package/dist/plugins/data-isolation.cjs

@@ -0,0 +1,211 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/data-isolation/index.ts
+var data_isolation_exports = {};
+__export(data_isolation_exports, {
+  dataIsolation: () => dataIsolation
+});
+module.exports = __toCommonJS(data_isolation_exports);
+var import_node_async_hooks = require("async_hooks");
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/plugins/data-isolation/index.ts
+var bypassStore = new import_node_async_hooks.AsyncLocalStorage();
+function currentBypassState() {
+  return bypassStore.getStore();
+}
+function dataIsolation(config) {
+  return {
+    name: "data-isolation",
+    models: [{
+      name: "user_scope_assignment",
+      fields: {
+        id: { type: "number", required: true },
+        userId: { type: "number", required: true, references: { model: "user", field: "id" } },
+        scopeName: { type: "string", required: true },
+        scopeValue: { type: "string", required: true },
+        createdAt: { type: "date", required: true }
+      }
+    }],
+    async scopeRules(userId, model, ctx) {
+      const state = currentBypassState();
+      if (state?.all)
+        return null;
+      const filters = [];
+      const defaults = {};
+      for (const scope of config.scopes) {
+        if (state?.scopes.has(scope.name))
+          continue;
+        const applies = scope.models.includes("*") || scope.models.includes(model);
+        if (!applies)
+          continue;
+        const value = await scope.resolveValue(userId, ctx);
+        if (value === void 0 || value === null) {
+          if (config.unresolvedScope === "skip")
+            continue;
+          throw Errors.forbidden(`Data isolation scope '${scope.name}' could not be resolved`);
+        }
+        filters.push({ field: scope.field, operator: "=", value });
+        defaults[scope.field] = value;
+      }
+      return filters.length > 0 ? { filters, defaults } : null;
+    },
+    methods: () => ({
+      /**
+       * Execute a callback with a specific scope bypassed.
+       * Queries within the callback will not have the named scope filter applied.
+       *
+       * The bypass is async-context-local: it applies only to async work
+       * spawned inside `fn` and never leaks across concurrent requests.
+       */
+      async withoutScope(scopeName, fn) {
+        const existing = currentBypassState();
+        const nextScopes = new Set(existing?.scopes ?? []);
+        nextScopes.add(scopeName);
+        const next = { all: existing?.all ?? false, scopes: nextScopes };
+        return bypassStore.run(next, fn);
+      },
+      /**
+       * Execute a callback with all scopes bypassed.
+       * Use with caution \u2014 no row-level isolation is applied.
+       *
+       * The bypass is async-context-local. Calls outside the callback (and
+       * concurrent requests running on different async contexts) are
+       * unaffected.
+       */
+      async unscoped(fn) {
+        const existing = currentBypassState();
+        const next = { all: true, scopes: new Set(existing?.scopes ?? []) };
+        return bypassStore.run(next, fn);
+      }
+    })
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  dataIsolation
+});