@burdenoff/be-sdk 2026.705.3 → 2026.706.1

package/dist/{chunk-QLXIIF4I.js → chunk-MXLCLLCI.js}

@@ -35,7 +35,8 @@ var defaultConfig = {
   strictMode: true,
   allowedUnguardedOperations: [],
   debug: false,
-  enableApplicationNameTagging: false
+  enableApplicationNameTagging: false,
+  enableRlsGucTagging: false
 };
 function hasField(data, field) {
   return field in data;
@@ -153,6 +154,18 @@ async function maybeTagConnection(rawPrisma, wsCtx) {
   }
 }
 __name(maybeTagConnection, "maybeTagConnection");
+var rlsTaggedContexts = /* @__PURE__ */ new WeakSet();
+async function maybeSetRlsGuc(rawPrisma, wsCtx) {
+  if (rlsTaggedContexts.has(wsCtx)) return;
+  rlsTaggedContexts.add(wsCtx);
+  const safeWs = (wsCtx.workspaceId ?? "").replace(/[^a-zA-Z0-9\-_]/g, "");
+  try {
+    await rawPrisma.$executeRawUnsafe(`SET app.workspace_id = '${safeWs}'`);
+  } catch {
+    rlsTaggedContexts.delete(wsCtx);
+  }
+}
+__name(maybeSetRlsGuc, "maybeSetRlsGuc");
 function addWorkspaceExtension(baseClient, config) {
   const fullConfig = {
     ...defaultConfig,
@@ -176,7 +189,8 @@ function addWorkspaceExtension(baseClient, config) {
     excludeModels: fullConfig.excludeModels,
     excludeModelsFromReadIsolation: fullConfig.excludeModelsFromReadIsolation,
     allowedUnguardedOperations: fullConfig.allowedUnguardedOperations,
-    enableApplicationNameTagging: fullConfig.enableApplicationNameTagging
+    enableApplicationNameTagging: fullConfig.enableApplicationNameTagging,
+    enableRlsGucTagging: fullConfig.enableRlsGucTagging
   });
   return prismaClient.$extends({
     query: {
@@ -196,6 +210,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedData = injectCreateFields(args.data, wsCtx, fullConfig);
           if (fullConfig.debug) {
             const injectedKeys = Object.keys(injectedData).filter((k) => !(k in args.data));
@@ -223,6 +240,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const dataArray = Array.isArray(args.data) ? args.data : [
             args.data
           ];
@@ -244,6 +264,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const dataArray = Array.isArray(args.data) ? args.data : [
             args.data
           ];
@@ -268,6 +291,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedData = injectUpdateFields(args.data, wsCtx, fullConfig);
           let injectedWhere = args.where;
           if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {
@@ -298,6 +324,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedData = injectUpdateFields(args.data, wsCtx, fullConfig);
           let injectedWhere = args.where;
           if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {
@@ -321,6 +350,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedCreate = injectCreateFields(args.create, wsCtx, fullConfig);
           const injectedUpdate = injectUpdateFields(args.update, wsCtx, fullConfig);
           let injectedWhere = args.where;
@@ -349,6 +381,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findMany - injected workspaceId into where`, {
@@ -372,6 +407,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findFirst - injected workspaceId into where`, {
@@ -395,6 +433,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findFirstOrThrow - injected workspaceId into where`, {
@@ -418,6 +459,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findUnique - injected workspaceId into where`, {
@@ -441,6 +485,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.findUniqueOrThrow - injected workspaceId into where`, {
@@ -464,6 +511,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.count - injected workspaceId into where`, {
@@ -487,6 +537,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.aggregate - injected workspaceId into where`, {
@@ -510,6 +563,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.groupBy - injected workspaceId into where`, {
@@ -536,6 +592,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.delete - injected workspaceId into where`, {
@@ -559,6 +618,9 @@ function addWorkspaceExtension(baseClient, config) {
           if (fullConfig.enableApplicationNameTagging) {
             await maybeTagConnection(rawPrisma, wsCtx);
           }
+          if (fullConfig.enableRlsGucTagging) {
+            await maybeSetRlsGuc(rawPrisma, wsCtx);
+          }
           const injectedWhere = injectWhereClause(args.where, wsCtx);
           if (fullConfig.debug) {
             logger.debug(`[WorkspaceExtension] ${model}.deleteMany - injected workspaceId into where`, {
@@ -576,6 +638,6 @@ function addWorkspaceExtension(baseClient, config) {
 }
 __name(addWorkspaceExtension, "addWorkspaceExtension");
 
-export { addWorkspaceExtension, getWorkspaceContext, injectWhereWorkspaceId, maybeTagConnection, setWorkspaceContext, withWorkspaceContext, withWorkspaceContextSync };
-//# sourceMappingURL=chunk-QLXIIF4I.js.map
-//# sourceMappingURL=chunk-QLXIIF4I.js.map
+export { addWorkspaceExtension, getWorkspaceContext, injectWhereWorkspaceId, maybeSetRlsGuc, maybeTagConnection, setWorkspaceContext, withWorkspaceContext, withWorkspaceContextSync };
+//# sourceMappingURL=chunk-MXLCLLCI.js.map
+//# sourceMappingURL=chunk-MXLCLLCI.js.map

package/dist/chunk-MXLCLLCI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/prisma/workspace-extension.ts"],"names":["workspaceContextStore","AsyncLocalStorage","fallbackContext","setWorkspaceContext","context","enterWith","getWorkspaceContext","getStore","withWorkspaceContext","fn","run","withWorkspaceContextSync","defaultConfig","enabled","enableReadIsolation","enableDeleteIsolation","enableUpdateWhereIsolation","populateContextJson","populateCreatedBy","populateUpdatedBy","populateTenantId","excludeModels","excludeModelsFromReadIsolation","strictMode","allowedUnguardedOperations","debug","enableApplicationNameTagging","enableRlsGucTagging","hasField","data","field","injectCreateFields","wsCtx","config","injected","workspaceId","tenantId","actorId","onBehalfOf","contextJson","buildContextJsonFromWorkspaceContext","injectUpdateFields","injectWhereClause","where","organizationId","projectId","appId","Object","keys","length","undefined","injectWhereWorkspaceId","ctx","stripSkipFlag","args","cleaned","isExcludedFromReadIsolation","model","includes","enforceStrictMode","operation","opKey","Error","taggedContexts","WeakSet","maybeTagConnection","rawPrisma","has","add","safeSvc","process","env","replace","safeWs","tag","$executeRawUnsafe","delete","rlsTaggedContexts","maybeSetRlsGuc","addWorkspaceExtension","baseClient","fullConfig","logger","info","prismaClient","$extends","query","$allModels","create","_skipWorkspaceInjection","injectedData","injectedKeys","filter","k","join","createMany","dataArray","Array","isArray","map","item","createManyAndReturn","update","injectedWhere","injectedDataKeys","whereChanged","updateMany","upsert","injectedCreate","injectedUpdate","findMany","findFirst","findFirstOrThrow","findUnique","findUniqueOrThrow","count","aggregate","groupBy","deleteMany"],"mappings":";;;;AA6EA,IAAMA,qBAAAA,GAAwB,IAAIC,iBAAAA,EAAAA;AAUlC,IAAIC,eAAAA;AA6BG,SAASC,oBAAoBC,OAAAA,EAAyB;AAC3DJ,EAAAA,qBAAAA,CAAsBK,UAAUD,OAAAA,CAAAA;AAChCF,EAAAA,eAAAA,GAAkBE,OAAAA;AACpB;AAHgBD,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAaT,SAASG,mBAAAA,GAAAA;AACd,EAAA,OAAON,qBAAAA,CAAsBO,UAAQ,IAAML,eAAAA;AAC7C;AAFgBI,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAuBhB,eAAsBE,oBAAAA,CAAwBJ,SAA2BK,EAAAA,EAAoB;AAC3F,EAAA,OAAOT,qBAAAA,CAAsBU,GAAAA,CAAIN,OAAAA,EAASK,EAAAA,CAAAA;AAC5C;AAFsBD,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAOf,SAASG,wBAAAA,CAA4BP,SAA2BK,EAAAA,EAAW;AAChF,EAAA,OAAOT,qBAAAA,CAAsBU,GAAAA,CAAIN,OAAAA,EAASK,EAAAA,CAAAA;AAC5C;AAFgBE,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAoLhB,IAAMC,aAAAA,GAAoD;EACxDC,OAAAA,EAAS,IAAA;EACTC,mBAAAA,EAAqB,IAAA;EACrBC,qBAAAA,EAAuB,IAAA;EACvBC,0BAAAA,EAA4B,IAAA;EAC5BC,mBAAAA,EAAqB,IAAA;EACrBC,iBAAAA,EAAmB,IAAA;EACnBC,iBAAAA,EAAmB,IAAA;EACnBC,gBAAAA,EAAkB,KAAA;AAClBC,EAAAA,aAAAA,EAAe,EAAA;AACfC,EAAAA,8BAAAA,EAAgC,EAAA;EAChCC,UAAAA,EAAY,IAAA;AACZC,EAAAA,0BAAAA,EAA4B,EAAA;EAC5BC,KAAAA,EAAO,KAAA;EACPC,4BAAAA,EAA8B,KAAA;EAC9BC,mBAAAA,EAAqB;AACvB,CAAA;AASA,SAASC,QAAAA,CAASC,MAA+BC,KAAAA,EAAa;AAC5D,EAAA,OAAOA,KAAAA,IAASD,IAAAA;AAClB;AAFSD,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAOT,SAASG,kBAAAA,CACPF,IAAAA,EACAG,KAAAA,EACAC,MAAAA,EAA0C;AAE1C,EAAA,MAAMC,QAAAA,GAAW;IAAE,GAAGL;AAAK,GAAA;AAG3B,EAAA,IAAIG,MAAMG,WAAAA,IAAe,CAACP,QAAAA,CAASM,QAAAA,EAAU,aAAA,CAAA,EAAgB;AAC3DA,IAAAA,QAAAA,CAAS,aAAA,IAAiBF,KAAAA,CAAMG,WAAAA;AAClC,EAAA;AAGA,EAAA,IAAIF,MAAAA,CAAOb,oBAAoBY,KAAAA,CAAMI,QAAAA,IAAY,CAACR,QAAAA,CAASM,QAAAA,EAAU,UAAA,CAAA,EAAa;AAChFA,IAAAA,QAAAA,CAAS,UAAA,IAAcF,KAAAA,CAAMI,QAAAA;AAC/B,EAAA;AAGA,EAAA,IAAIH,MAAAA,CAAOf,qBAAqBc,KAAAA,CAAMK,OAAAA,IAAW,CAACT,QAAAA,CAASM,QAAAA,EAAU,WAAA,CAAA,EAAc;AACjFA,IAAAA,QAAAA,CAAS,WAAA,IAAeF,KAAAA,CAAMK,OAAAA;AAChC,EAAA;AAGA,EAAA,IAAIJ,MAAAA,CAAOd,qBAAqBa,KAAAA,CAAMK,OAAAA,IAAW,CAACT,QAAAA,CAASM,QAAAA,EAAU,WAAA,CAAA,EAAc;AACjFA,IAAAA,QAAAA,CAAS,WAAA,IAAeF,KAAAA,CAAMK,OAAAA;AAChC,EAAA;AAIA,EAAA,IAAIL,MAAMM,UAAAA,IAAc,CAACV,QAAAA,CAASM,QAAAA,EAAU,YAAA,CAAA,EAAe;AACzDA,IAAAA,QAAAA,CAAS,YAAA,IAAgBF,KAAAA,CAAMM,UAAAA;AACjC,EAAA,CAAA,MAAA,IAAWN,MAAMK,OAAAA,IAAW,CAACT,QAAAA,CAASM,QAAAA,EAAU,YAAA,CAAA,EAAe;AAE7DA,IAAAA,QAAAA,CAAS,YAAA,IAAgBF,KAAAA,CAAMK,OAAAA;AACjC,EAAA;AAGA,EAAA,IAAIJ,OAAOhB,mBAAAA,IAAuB,CAACW,QAAAA,CAASM,QAAAA,EAAU,SAAA,CAAA,EAAY;AAChE,IAAA,MAAMK,WAAAA,GAAcC,qCAAqCR,KAAAA,CAAAA;AACzD,IAAA,IAAIO,WAAAA,EAAa;AACfL,MAAAA,QAAAA,CAAS,SAAA,CAAA,GAAaK,WAAAA;AACxB,IAAA;AACF,EAAA;AAEA,EAAA,OAAOL,QAAAA;AACT;AA7CSH,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAkDT,SAASU,kBAAAA,CACPZ,IAAAA,EACAG,KAAAA,EACAC,MAAAA,EAA0C;AAE1C,EAAA,MAAMC,QAAAA,GAAW;IAAE,GAAGL;AAAK,GAAA;AAG3B,EAAA,IAAII,MAAAA,CAAOd,qBAAqBa,KAAAA,CAAMK,OAAAA,IAAW,CAACT,QAAAA,CAASM,QAAAA,EAAU,WAAA,CAAA,EAAc;AACjFA,IAAAA,QAAAA,CAAS,WAAA,IAAeF,KAAAA,CAAMK,OAAAA;AAChC,EAAA;AAMA,EAAA,OAAOH,QAAAA;AACT;AAjBSO,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AA0BT,SAASC,iBAAAA,CACPC,OACAX,KAAAA,EAAuB;AAEvB,EAAA,IAAI,CAACA,KAAAA,CAAMG,WAAAA,EAAa,OAAOQ,KAAAA;AAE/B,EAAA,IAAI,CAACA,KAAAA,EAAO;AAEV,IAAA,OAAO;AAAER,MAAAA,WAAAA,EAAaH,KAAAA,CAAMG;AAAY,KAAA;AAC1C,EAAA;AAGA,EAAA,IAAI,CAACP,QAAAA,CAASe,KAAAA,EAAO,aAAA,CAAA,EAAgB;AACnC,IAAA,OAAO;MAAE,GAAGA,KAAAA;AAAOR,MAAAA,WAAAA,EAAaH,KAAAA,CAAMG;AAAY,KAAA;AACpD,EAAA;AAEA,EAAA,OAAOQ,KAAAA;AACT;AAjBSD,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAsBT,SAASF,qCAAqCR,KAAAA,EAAuB;AACnE,EAAA,MAAM5B,UAAkC,EAAC;AAEzC,EAAA,IAAI4B,KAAAA,CAAMG,WAAAA,EAAa/B,OAAAA,CAAQ,aAAA,IAAiB4B,KAAAA,CAAMG,WAAAA;AACtD,EAAA,IAAIH,KAAAA,CAAMK,OAAAA,EAASjC,OAAAA,CAAQ,QAAA,IAAY4B,KAAAA,CAAMK,OAAAA;AAC7C,EAAA,IAAIL,KAAAA,CAAMY,cAAAA,EAAgBxC,OAAAA,CAAQ,gBAAA,IAAoB4B,KAAAA,CAAMY,cAAAA;AAC5D,EAAA,IAAIZ,KAAAA,CAAMa,SAAAA,EAAWzC,OAAAA,CAAQ,WAAA,IAAe4B,KAAAA,CAAMa,SAAAA;AAClD,EAAA,IAAIb,KAAAA,CAAMc,KAAAA,EAAO1C,OAAAA,CAAQ,OAAA,IAAW4B,KAAAA,CAAMc,KAAAA;AAE1C,EAAA,OAAOC,OAAOC,IAAAA,CAAK5C,OAAAA,CAAAA,CAAS6C,MAAAA,GAAS,IAAI7C,OAAAA,GAAU8C,MAAAA;AACrD;AAVSV,MAAAA,CAAAA,oCAAAA,EAAAA,sCAAAA,CAAAA;AA8BF,SAASW,sBAAAA,CACdR,OACAX,KAAAA,EAAwB;AAExB,EAAA,MAAMoB,GAAAA,GAAMpB,SAAS1B,mBAAAA,EAAAA;AACrB,EAAA,IAAI,CAACqC,KAAAA,IAAS,CAACS,GAAAA,EAAKjB,aAAa,OAAOQ,KAAAA;AAGxC,EAAA,IAAI,CAACf,QAAAA,CAASe,KAAAA,EAAO,aAAA,CAAA,EAAgB;AACnC,IAAA,OAAO;MAAE,GAAGA,KAAAA;AAAOR,MAAAA,WAAAA,EAAaiB,GAAAA,CAAIjB;AAAY,KAAA;AAClD,EAAA;AAEA,EAAA,OAAOQ,KAAAA;AACT;AAbgBQ,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAmBhB,SAASE,cAAiDC,IAAAA,EAAO;AAC/D,EAAA,MAAMC,OAAAA,GAAU;IAAE,GAAGD;AAAK,GAAA;AAC1B,EAAA,OAAQC,QAAoC,yBAAA,CAAA;AAC5C,EAAA,OAAOA,OAAAA;AACT;AAJSF,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAUT,SAASG,2BAAAA,CAA4BC,OAAexB,MAAAA,EAA0C;AAC5F,EAAA,OAAOA,MAAAA,CAAOZ,cAAcqC,QAAAA,CAASD,KAAAA,KAAUxB,MAAAA,CAAOX,8BAAAA,CAA+BoC,SAASD,KAAAA,CAAAA;AAChG;AAFSD,MAAAA,CAAAA,2BAAAA,EAAAA,6BAAAA,CAAAA;AAeT,SAASG,iBAAAA,CACPF,KAAAA,EACAG,SAAAA,EACA5B,KAAAA,EACAC,MAAAA,EAA0C;AAG1C,EAAA,IAAID,OAAOG,WAAAA,EAAa;AAGxB,EAAA,IAAI,CAACF,OAAOV,UAAAA,EAAY;AAGxB,EAAA,MAAMsC,KAAAA,GAAQ,CAAA,EAAGJ,KAAAA,CAAAA,CAAAA,EAASG,SAAAA,CAAAA,CAAAA;AAC1B,EAAA,IAAI3B,MAAAA,CAAOT,0BAAAA,CAA2BkC,QAAAA,CAASG,KAAAA,CAAAA,EAAQ;AAGvD,EAAA,MAAM,IAAIC,KAAAA,CACR,CAAA,oDAAA,EAAuDL,KAAAA,CAAAA,CAAAA,EAASG,SAAAA,CAAAA,uEAAAA,EAElDH,KAAAA,CAAAA,6BAAAA,EACAI,KAAAA,CAAAA,6FAAAA,CAC+C,CAAA;AAEjE;AAxBSF,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAgGT,IAAMI,cAAAA,uBAAqBC,OAAAA,EAAAA;AAS3B,eAAsBC,kBAAAA,CAAmBC,WAAgClC,KAAAA,EAAuB;AAC9F,EAAA,IAAI+B,cAAAA,CAAeI,GAAAA,CAAInC,KAAAA,CAAAA,EAAQ;AAC/B+B,EAAAA,cAAAA,CAAeK,IAAIpC,KAAAA,CAAAA;AAEnB,EAAA,MAAMqC,OAAAA,GAAAA,CAAWC,QAAQC,GAAAA,CAAI,cAAA,KAAmB,KAAA,EAAOC,OAAAA,CAAQ,oBAAoB,EAAA,CAAA;AACnF,EAAA,MAAMC,UAAUzC,KAAAA,CAAMG,WAAAA,IAAe,EAAA,EAAIqC,OAAAA,CAAQ,oBAAoB,EAAA,CAAA;AACrE,EAAA,MAAME,GAAAA,GAAM,CAAA,IAAA,EAAOL,OAAAA,CAAAA,IAAAA,EAAcI,MAAAA,CAAAA,CAAAA;AACjC,EAAA,IAAI;AACF,IAAA,MAAMP,SAAAA,CAAUS,iBAAAA,CAAkB,CAAA,wBAAA,EAA2BD,GAAAA,CAAAA,CAAAA,CAAM,CAAA;EACrE,CAAA,CAAA,MAAQ;AAENX,IAAAA,cAAAA,CAAea,OAAO5C,KAAAA,CAAAA;AACxB,EAAA;AACF;AAbsBiC,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAsBtB,IAAMY,iBAAAA,uBAAwBb,OAAAA,EAAAA;AAW9B,eAAsBc,cAAAA,CAAeZ,WAAgClC,KAAAA,EAAuB;AAC1F,EAAA,IAAI6C,iBAAAA,CAAkBV,GAAAA,CAAInC,KAAAA,CAAAA,EAAQ;AAClC6C,EAAAA,iBAAAA,CAAkBT,IAAIpC,KAAAA,CAAAA;AAEtB,EAAA,MAAMyC,UAAUzC,KAAAA,CAAMG,WAAAA,IAAe,EAAA,EAAIqC,OAAAA,CAAQ,oBAAoB,EAAA,CAAA;AACrE,EAAA,IAAI;AACF,IAAA,MAAMN,SAAAA,CAAUS,iBAAAA,CAAkB,CAAA,wBAAA,EAA2BF,MAAAA,CAAAA,CAAAA,CAAS,CAAA;EACxE,CAAA,CAAA,MAAQ;AAENI,IAAAA,iBAAAA,CAAkBD,OAAO5C,KAAAA,CAAAA;AAC3B,EAAA;AACF;AAXsB8C,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAaf,SAASC,qBAAAA,CAAyBC,YAAe/C,MAAAA,EAAiC;AACvF,EAAA,MAAMgD,UAAAA,GAAiD;IACrD,GAAGrE,aAAAA;IACH,GAAGqB;AACL,GAAA;AAEA,EAAA,IAAI,CAACgD,WAAWpE,OAAAA,EAAS;AACvBqE,IAAAA,MAAAA,CAAOC,KAAK,0DAAA,CAAA;AACZ,IAAA,OAAOH,UAAAA;AACT,EAAA;AAGA,EAAA,MAAMd,SAAAA,GAAYc,UAAAA;AAGlB,EAAA,MAAMI,YAAAA,GAAeJ,UAAAA;AAErBE,EAAAA,MAAAA,CAAOC,KAAK,kDAAA,EAAoD;AAC9DlE,IAAAA,mBAAAA,EAAqBgE,UAAAA,CAAWhE,mBAAAA;AAChCC,IAAAA,iBAAAA,EAAmB+D,UAAAA,CAAW/D,iBAAAA;AAC9BC,IAAAA,iBAAAA,EAAmB8D,UAAAA,CAAW9D,iBAAAA;AAC9BC,IAAAA,gBAAAA,EAAkB6D,UAAAA,CAAW7D,gBAAAA;AAC7BN,IAAAA,mBAAAA,EAAqBmE,UAAAA,CAAWnE,mBAAAA;AAChCC,IAAAA,qBAAAA,EAAuBkE,UAAAA,CAAWlE,qBAAAA;AAClCC,IAAAA,0BAAAA,EAA4BiE,UAAAA,CAAWjE,0BAAAA;AACvCO,IAAAA,UAAAA,EAAY0D,UAAAA,CAAW1D,UAAAA;AACvBF,IAAAA,aAAAA,EAAe4D,UAAAA,CAAW5D,aAAAA;AAC1BC,IAAAA,8BAAAA,EAAgC2D,UAAAA,CAAW3D,8BAAAA;AAC3CE,IAAAA,0BAAAA,EAA4ByD,UAAAA,CAAWzD,0BAAAA;AACvCE,IAAAA,4BAAAA,EAA8BuD,UAAAA,CAAWvD,4BAAAA;AACzCC,IAAAA,mBAAAA,EAAqBsD,UAAAA,CAAWtD;GAClC,CAAA;AAEA,EAAA,OAAOyD,aAAaC,QAAAA,CAAS;IAC3BC,KAAAA,EAAO;MACLC,UAAAA,EAAY;;;;AAKV,QAAA,MAAMC,MAAAA,CAAO,EACX/B,KAAAA,EACAH,IAAAA,EACAgC,OAAK,EAKL;AAEA,UAAA,IAAIL,WAAW5D,aAAAA,CAAcqC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKmC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,QAAA,EAAUzB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC1C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAGA,UAAA,MAAM0D,YAAAA,GAAe3D,kBAAAA,CAAmBuB,IAAAA,CAAKzB,IAAAA,EAAMG,OAAOiD,UAAAA,CAAAA;AAE1D,UAAA,IAAIA,WAAWxD,KAAAA,EAAO;AACpB,YAAA,MAAMkE,YAAAA,GAAe5C,MAAAA,CAAOC,IAAAA,CAAK0C,YAAAA,CAAAA,CAAcE,MAAAA,CAAO,CAACC,CAAAA,KAAM,EAAEA,CAAAA,IAAKvC,IAAAA,CAAKzB,IAAAA,CAAG,CAAA;AAC5E,YAAA,IAAI8D,YAAAA,CAAa1C,SAAS,CAAA,EAAG;AAC3BiC,cAAAA,MAAAA,CAAOzD,KAAAA,CAAM,wBAAwBgC,KAAAA,CAAAA,oBAAAA,EAA4BkC,aAAaG,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAA,EAAS;AAC1F3D,gBAAAA,WAAAA,EAAaH,KAAAA,CAAMG,WAAAA;AACnBE,gBAAAA,OAAAA,EAASL,KAAAA,CAAMK;eACjB,CAAA;AACF,YAAA;AACF,UAAA;AAEA,UAAA,OAAOiD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBzB,IAAAA,EAAM6D;WACR,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMK,UAAAA,CAAW,EACftC,KAAAA,EACAH,IAAAA,EACAgC,OAAK,EAKL;AACA,UAAA,IAAIL,WAAW5D,aAAAA,CAAcqC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKmC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,YAAA,EAAczB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC9C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAGA,UAAA,MAAMgE,YAAYC,KAAAA,CAAMC,OAAAA,CAAQ5C,KAAKzB,IAAI,CAAA,GAAIyB,KAAKzB,IAAAA,GAAO;YAACyB,IAAAA,CAAKzB;;AAC/D,UAAA,MAAM6D,YAAAA,GAAeM,UAAUG,GAAAA,CAAI,CAACC,SAASrE,kBAAAA,CAAmBqE,IAAAA,EAAMpE,KAAAA,EAAOiD,UAAAA,CAAAA,CAAAA;AAE7E,UAAA,OAAOK,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;AACjBzB,YAAAA,IAAAA,EAAMoE,MAAMC,OAAAA,CAAQ5C,IAAAA,CAAKzB,IAAI,CAAA,GAAI6D,YAAAA,GAAeA,aAAa,CAAA;WAC/D,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMW,mBAAAA,CAAoB,EACxB5C,KAAAA,EACAH,IAAAA,EACAgC,OAAK,EAKL;AACA,UAAA,IAAIL,WAAW5D,aAAAA,CAAcqC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKmC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,qBAAA,EAAuBzB,KAAAA,EAAOiD,UAAAA,CAAAA;AACvD,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAMgE,YAAYC,KAAAA,CAAMC,OAAAA,CAAQ5C,KAAKzB,IAAI,CAAA,GAAIyB,KAAKzB,IAAAA,GAAO;YAACyB,IAAAA,CAAKzB;;AAC/D,UAAA,MAAM6D,YAAAA,GAAeM,UAAUG,GAAAA,CAAI,CAACC,SAASrE,kBAAAA,CAAmBqE,IAAAA,EAAMpE,KAAAA,EAAOiD,UAAAA,CAAAA,CAAAA;AAE7E,UAAA,OAAOK,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;AACjBzB,YAAAA,IAAAA,EAAMoE,MAAMC,OAAAA,CAAQ5C,IAAAA,CAAKzB,IAAI,CAAA,GAAI6D,YAAAA,GAAeA,aAAa,CAAA;WAC/D,CAAA;AACF,QAAA,CAAA;;;;AAMA,QAAA,MAAMY,MAAAA,CAAO,EACX7C,KAAAA,EACAH,IAAAA,EACAgC,OAAK,EAML;AACA,UAAA,IAAIL,WAAW5D,aAAAA,CAAcqC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKmC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,QAAA,EAAUzB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC1C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAM0D,YAAAA,GAAejD,kBAAAA,CAAmBa,IAAAA,CAAKzB,IAAAA,EAAMG,OAAOiD,UAAAA,CAAAA;AAG1D,UAAA,IAAIsB,gBAAgBjD,IAAAA,CAAKX,KAAAA;AACzB,UAAA,IAAIsC,WAAWjE,0BAAAA,IAA8B,CAACwC,2BAAAA,CAA4BC,KAAAA,EAAOwB,UAAAA,CAAAA,EAAa;AAC5FsB,YAAAA,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAChD,UAAA;AAEA,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpB,YAAA,MAAM+E,gBAAAA,GAAmBzD,MAAAA,CAAOC,IAAAA,CAAK0C,YAAAA,CAAAA,CAAcE,MAAAA,CAAO,CAACC,CAAAA,KAAM,EAAEA,CAAAA,IAAKvC,IAAAA,CAAKzB,IAAAA,CAAG,CAAA;AAChF,YAAA,MAAM4E,YAAAA,GAAeF,kBAAkBjD,IAAAA,CAAKX,KAAAA;AAC5C,YAAA,IAAI6D,gBAAAA,CAAiBvD,MAAAA,GAAS,CAAA,IAAKwD,YAAAA,EAAc;AAC/CvB,cAAAA,MAAAA,CAAOzD,KAAAA,CACL,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,yBAAAA,EAAiC+C,gBAAAA,CAAiBV,IAAAA,CAAK,IAAA,CAAA,CAAA,EAAQW,YAAAA,GAAe,sBAAA,GAAyB,EAAA,CAAA,CAAI,CAAA;AAEvI,YAAA;AACF,UAAA;AAEA,UAAA,OAAOnB,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBzB,IAAAA,EAAM6D,YAAAA;YACN/C,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMG,UAAAA,CAAW,EACfjD,KAAAA,EACAH,IAAAA,EACAgC,OAAK,EAML;AACA,UAAA,IAAIL,WAAW5D,aAAAA,CAAcqC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKmC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,YAAA,EAAczB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC9C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAM0D,YAAAA,GAAejD,kBAAAA,CAAmBa,IAAAA,CAAKzB,IAAAA,EAAMG,OAAOiD,UAAAA,CAAAA;AAG1D,UAAA,IAAIsB,gBAAgBjD,IAAAA,CAAKX,KAAAA;AACzB,UAAA,IAAIsC,WAAWjE,0BAAAA,IAA8B,CAACwC,2BAAAA,CAA4BC,KAAAA,EAAOwB,UAAAA,CAAAA,EAAa;AAC5FsB,YAAAA,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAChD,UAAA;AAEA,UAAA,OAAOsD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBzB,IAAAA,EAAM6D,YAAAA;YACN/C,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMI,MAAAA,CAAO,EACXlD,KAAAA,EACAH,IAAAA,EACAgC,OAAK,EAOL;AACA,UAAA,IAAIL,WAAW5D,aAAAA,CAAcqC,QAAAA,CAASD,KAAAA,CAAAA,IAAUH,KAAKmC,uBAAAA,EAAyB;AAC5E,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,QAAA,EAAUzB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC1C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAM4E,cAAAA,GAAiB7E,kBAAAA,CAAmBuB,IAAAA,CAAKkC,MAAAA,EAAQxD,OAAOiD,UAAAA,CAAAA;AAC9D,UAAA,MAAM4B,cAAAA,GAAiBpE,kBAAAA,CAAmBa,IAAAA,CAAKgD,MAAAA,EAAQtE,OAAOiD,UAAAA,CAAAA;AAG9D,UAAA,IAAIsB,gBAAgBjD,IAAAA,CAAKX,KAAAA;AACzB,UAAA,IAAIsC,WAAWjE,0BAAAA,IAA8B,CAACwC,2BAAAA,CAA4BC,KAAAA,EAAOwB,UAAAA,CAAAA,EAAa;AAC5FsB,YAAAA,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAChD,UAAA;AAEA,UAAA,OAAOsD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBkC,MAAAA,EAAQoB,cAAAA;YACRN,MAAAA,EAAQO,cAAAA;YACRlE,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;;;;AAMA,QAAA,MAAMO,QAAAA,CAAS,EAAErD,KAAAA,EAAOH,IAAAA,EAAMgC,OAAK,EAAqC;AACtE,UAAA,IACE,CAACL,WAAWnE,mBAAAA,IACZ0C,2BAAAA,CAA4BC,OAAOwB,UAAAA,CAAAA,IACnC3B,KAAKmC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,UAAA,EAAYzB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC5C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAMuE,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpByD,YAAAA,MAAAA,CAAOzD,KAAAA,CAAM,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,2CAAAA,CAAAA,EAAoD;AACvFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOmD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMQ,SAAAA,CAAU,EAAEtD,KAAAA,EAAOH,IAAAA,EAAMgC,OAAK,EAAqC;AACvE,UAAA,IACE,CAACL,WAAWnE,mBAAAA,IACZ0C,2BAAAA,CAA4BC,OAAOwB,UAAAA,CAAAA,IACnC3B,KAAKmC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,WAAA,EAAazB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC7C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAMuE,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpByD,YAAAA,MAAAA,CAAOzD,KAAAA,CAAM,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,4CAAAA,CAAAA,EAAqD;AACxFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOmD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMS,gBAAAA,CAAiB,EAAEvD,KAAAA,EAAOH,IAAAA,EAAMgC,OAAK,EAAqC;AAC9E,UAAA,IACE,CAACL,WAAWnE,mBAAAA,IACZ0C,2BAAAA,CAA4BC,OAAOwB,UAAAA,CAAAA,IACnC3B,KAAKmC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,kBAAA,EAAoBzB,KAAAA,EAAOiD,UAAAA,CAAAA;AACpD,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAMuE,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpByD,YAAAA,MAAAA,CAAOzD,KAAAA,CAAM,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,mDAAAA,CAAAA,EAA4D;AAC/FtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOmD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMU,UAAAA,CAAW,EAAExD,KAAAA,EAAOH,IAAAA,EAAMgC,OAAK,EAAqC;AACxE,UAAA,IACE,CAACL,WAAWnE,mBAAAA,IACZ0C,2BAAAA,CAA4BC,OAAOwB,UAAAA,CAAAA,IACnC3B,KAAKmC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,YAAA,EAAczB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC9C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAKA,UAAA,MAAMuE,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpByD,YAAAA,MAAAA,CAAOzD,KAAAA,CAAM,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,6CAAAA,CAAAA,EAAsD;AACzFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOmD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMW,iBAAAA,CAAkB,EAAEzD,KAAAA,EAAOH,IAAAA,EAAMgC,OAAK,EAAqC;AAC/E,UAAA,IACE,CAACL,WAAWnE,mBAAAA,IACZ0C,2BAAAA,CAA4BC,OAAOwB,UAAAA,CAAAA,IACnC3B,KAAKmC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,mBAAA,EAAqBzB,KAAAA,EAAOiD,UAAAA,CAAAA;AACrD,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAMuE,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpByD,YAAAA,MAAAA,CAAOzD,KAAAA,CAAM,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,oDAAAA,CAAAA,EAA6D;AAChGtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOmD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMY,KAAAA,CAAM,EAAE1D,KAAAA,EAAOH,IAAAA,EAAMgC,OAAK,EAAqC;AACnE,UAAA,IACE,CAACL,WAAWnE,mBAAAA,IACZ0C,2BAAAA,CAA4BC,OAAOwB,UAAAA,CAAAA,IACnC3B,KAAKmC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,OAAA,EAASzB,KAAAA,EAAOiD,UAAAA,CAAAA;AACzC,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAMuE,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpByD,YAAAA,MAAAA,CAAOzD,KAAAA,CAAM,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,wCAAAA,CAAAA,EAAiD;AACpFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOmD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMa,SAAAA,CAAU,EAAE3D,KAAAA,EAAOH,IAAAA,EAAMgC,OAAK,EAAqC;AACvE,UAAA,IACE,CAACL,WAAWnE,mBAAAA,IACZ0C,2BAAAA,CAA4BC,OAAOwB,UAAAA,CAAAA,IACnC3B,KAAKmC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,WAAA,EAAazB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC7C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAMuE,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpByD,YAAAA,MAAAA,CAAOzD,KAAAA,CAAM,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,4CAAAA,CAAAA,EAAqD;AACxFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOmD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMc,OAAAA,CAAQ,EAAE5D,KAAAA,EAAOH,IAAAA,EAAMgC,OAAK,EAAqC;AACrE,UAAA,IACE,CAACL,WAAWnE,mBAAAA,IACZ0C,2BAAAA,CAA4BC,OAAOwB,UAAAA,CAAAA,IACnC3B,KAAKmC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,SAAA,EAAWzB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC3C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAMuE,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpByD,YAAAA,MAAAA,CAAOzD,KAAAA,CAAM,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,0CAAAA,CAAAA,EAAmD;AACtFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOmD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;;;;AAMA,QAAA,MAAM3B,MAAAA,CAAO,EAAEnB,KAAAA,EAAOH,IAAAA,EAAMgC,OAAK,EAAqC;AACpE,UAAA,IACE,CAACL,WAAWlE,qBAAAA,IACZyC,2BAAAA,CAA4BC,OAAOwB,UAAAA,CAAAA,IACnC3B,KAAKmC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,QAAA,EAAUzB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC1C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAMuE,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpByD,YAAAA,MAAAA,CAAOzD,KAAAA,CAAM,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,yCAAAA,CAAAA,EAAkD;AACrFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOmD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA,CAAA;AAEA,QAAA,MAAMe,UAAAA,CAAW,EAAE7D,KAAAA,EAAOH,IAAAA,EAAMgC,OAAK,EAAqC;AACxE,UAAA,IACE,CAACL,WAAWlE,qBAAAA,IACZyC,2BAAAA,CAA4BC,OAAOwB,UAAAA,CAAAA,IACnC3B,KAAKmC,uBAAAA,EACL;AACA,YAAA,OAAOH,KAAAA,CAAMjC,aAAAA,CAAcC,IAAAA,CAAAA,CAAAA;AAC7B,UAAA;AAEA,UAAA,MAAMtB,QAAQ1B,mBAAAA,EAAAA;AACdqD,UAAAA,iBAAAA,CAAkBF,KAAAA,EAAO,YAAA,EAAczB,KAAAA,EAAOiD,UAAAA,CAAAA;AAC9C,UAAA,IAAI,CAACjD,OAAOG,WAAAA,EAAa;AACvB,YAAA,OAAOmD,MAAMhC,IAAAA,CAAAA;AACf,UAAA;AAEA,UAAA,IAAI2B,WAAWvD,4BAAAA,EAA8B;AAC3C,YAAA,MAAMuC,kBAAAA,CAAmBC,WAAWlC,KAAAA,CAAAA;AACtC,UAAA;AACA,UAAA,IAAIiD,WAAWtD,mBAAAA,EAAqB;AAClC,YAAA,MAAMmD,cAAAA,CAAeZ,WAAWlC,KAAAA,CAAAA;AAClC,UAAA;AAEA,UAAA,MAAMuE,aAAAA,GAAgB7D,iBAAAA,CAAkBY,IAAAA,CAAKX,KAAAA,EAAOX,KAAAA,CAAAA;AAEpD,UAAA,IAAIiD,WAAWxD,KAAAA,EAAO;AACpByD,YAAAA,MAAAA,CAAOzD,KAAAA,CAAM,CAAA,qBAAA,EAAwBgC,KAAAA,CAAAA,6CAAAA,CAAAA,EAAsD;AACzFtB,cAAAA,WAAAA,EAAaH,KAAAA,CAAMG;aACrB,CAAA;AACF,UAAA;AAEA,UAAA,OAAOmD,KAAAA,CAAM;AACX,YAAA,GAAGjC,cAAcC,IAAAA,CAAAA;YACjBX,KAAAA,EAAO4D;WACT,CAAA;AACF,QAAA;AACF;AACF;GACF,CAAA;AACF;AAjqBgBxB,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA","file":"chunk-MXLCLLCI.js","sourcesContent":["/**\n * Prisma Workspace Extension\n *\n * Automatically injects workspaceId into ALL Prisma operations using\n * request-scoped context from AsyncLocalStorage:\n *\n * **Write operations** (create, createMany, update, upsert):\n * - Auto-populates `workspaceId`, `tenantId`, `createdBy`, `updatedBy`, `context` JSON\n *\n * **Read operations** (findMany, findFirst, findUnique, count, aggregate, groupBy):\n * - Auto-injects `workspaceId` into the `where` clause for workspace isolation\n *\n * **Delete operations** (delete, deleteMany):\n * - Auto-injects `workspaceId` into the `where` clause to prevent cross-workspace deletion\n *\n * **Update where clause** (update, updateMany):\n * - Auto-injects `workspaceId` into the `where` clause to prevent cross-workspace updates\n *\n * **How it works:**\n * 1. The GraphQL server's buildContext extracts workspaceId from x-workspace-id header\n * 2. The workspace context store (AsyncLocalStorage) holds the current request's workspace info\n * 3. This Prisma extension intercepts ALL operations and auto-injects workspaceId\n *\n * **What gets auto-populated on writes:**\n * - `workspaceId` field (String or String?) - set from context if not explicitly provided\n * - `context` field (Json) - merged with workspace/actor info if not explicitly provided\n * - `tenantId` field (String or String?) - set from context if not explicitly provided\n * - `createdBy` / `updatedBy` fields - set from actor context if not explicitly provided\n *\n * **What gets auto-injected on reads/updates/deletes:**\n * - `workspaceId` in the `where` clause - ensures queries only access data within the workspace\n *\n * **Opt-out:**\n * - Explicitly providing `workspaceId` in the where/data will override auto-injection\n * - Pass `_skipWorkspaceInjection: true` in the query args to skip entirely\n * - Set `enableReadIsolation: false` in config to disable read-side injection only\n * - Add model names to `excludeModels` to skip specific models\n *\n * @module prisma/workspace-extension\n * @category Database\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { logger } from '../logger/index.js';\nimport type { InputJsonValue } from './context.js';\n\n// ============================================================================\n// Workspace Context Store (AsyncLocalStorage)\n// ============================================================================\n\n/**\n * Workspace context for the current request scope\n */\nexport interface WorkspaceContext {\n  /** Workspace ID (from x-workspace-id header) */\n  workspaceId?: string;\n  /** Tenant ID (from x-tenant-id header or derived from workspace) */\n  tenantId?: string;\n  /** Actor ID (user/service/app performing the operation) */\n  actorId?: string;\n  /** Actor type (user, app, service, super_admin) */\n  actorType?: string;\n  /** Organization ID */\n  organizationId?: string;\n  /** Project ID */\n  projectId?: string;\n  /** App ID */\n  appId?: string;\n  /** On behalf of actor ID (for consent-based delegation) */\n  onBehalfOf?: string;\n}\n\n/**\n * AsyncLocalStorage for workspace context\n * This is separate from the SDK's general ContextManager to allow\n * fine-grained control over workspace-specific context propagation.\n */\nconst workspaceContextStore = new AsyncLocalStorage<WorkspaceContext>();\n\n/**\n * Fallback context for environments where AsyncLocalStorage.enterWith()\n * doesn't propagate across async boundaries (e.g., Bun + GraphQL Yoga).\n *\n * IMPORTANT: This is NOT request-isolated — it's a module-level singleton.\n * It works for single-request-at-a-time scenarios but could race under\n * concurrent requests. The ALS is the primary mechanism; this is a fallback.\n */\nlet fallbackContext: WorkspaceContext | undefined;\n\n/**\n * Set workspace context for the current async scope.\n * Call this in your GraphQL context builder or middleware.\n *\n * Uses AsyncLocalStorage.enterWith() as the primary mechanism,\n * with a module-level fallback for runtimes where enterWith()\n * doesn't propagate through all async chains (e.g., Bun).\n *\n * @param context - The workspace context for this request\n *\n * @example\n * ```typescript\n * // In your server's buildContext:\n * import { setWorkspaceContext } from '@burdenoff/be-sdk/prisma';\n *\n * buildContext: async (defaultContext) => {\n *   setWorkspaceContext({\n *     workspaceId: defaultContext.workspace?.id,\n *     tenantId: defaultContext.tenant?.id,\n *     actorId: defaultContext.actor?.id,\n *     actorType: defaultContext.actor?.type,\n *     organizationId: defaultContext.organization?.id,\n *   });\n *   return defaultContext;\n * }\n * ```\n */\nexport function setWorkspaceContext(context: WorkspaceContext): void {\n  workspaceContextStore.enterWith(context);\n  fallbackContext = context;\n}\n\n/**\n * Get the current workspace context from AsyncLocalStorage.\n * Falls back to module-level context if ALS returns undefined\n * (can happen in Bun where enterWith() doesn't propagate through\n * some async chains like GraphQL Yoga's execution pipeline).\n *\n * @returns The current workspace context, or undefined if not set\n */\nexport function getWorkspaceContext(): WorkspaceContext | undefined {\n  return workspaceContextStore.getStore() ?? fallbackContext;\n}\n\n/**\n * Run a function with a specific workspace context.\n * The context is isolated to this execution and its children.\n *\n * @param context - The workspace context\n * @param fn - The function to run\n * @returns The result of the function\n *\n * @example\n * ```typescript\n * const result = await withWorkspaceContext(\n *   { workspaceId: 'ws-123', actorId: 'user-456' },\n *   async () => {\n *     // All Prisma operations in here will auto-inject workspaceId\n *     return await prisma.tag.create({ data: { name: 'test' } });\n *   }\n * );\n * ```\n */\nexport async function withWorkspaceContext<T>(context: WorkspaceContext, fn: () => Promise<T>): Promise<T> {\n  return workspaceContextStore.run(context, fn);\n}\n\n/**\n * Run a synchronous function with a specific workspace context.\n */\nexport function withWorkspaceContextSync<T>(context: WorkspaceContext, fn: () => T): T {\n  return workspaceContextStore.run(context, fn);\n}\n\n// ============================================================================\n// Extension Configuration\n// ============================================================================\n\n/**\n * Configuration for the workspace extension\n */\nexport interface WorkspaceExtensionConfig {\n  /**\n   * Enable automatic workspaceId injection on create/update\n   * @default true\n   */\n  enabled?: boolean;\n\n  /**\n   * Enable automatic workspaceId injection on read operations\n   * (findMany, findFirst, findUnique, findFirstOrThrow, findUniqueOrThrow,\n   *  count, aggregate, groupBy)\n   *\n   * When enabled, every read query automatically includes `workspaceId`\n   * in the `where` clause, preventing cross-workspace data leakage.\n   *\n   * @default true\n   */\n  enableReadIsolation?: boolean;\n\n  /**\n   * Enable automatic workspaceId injection on delete operations\n   * (delete, deleteMany)\n   *\n   * When enabled, every delete operation automatically includes `workspaceId`\n   * in the `where` clause, preventing cross-workspace deletion.\n   *\n   * @default true\n   */\n  enableDeleteIsolation?: boolean;\n\n  /**\n   * Enable automatic workspaceId injection into update/updateMany `where` clauses.\n   *\n   * When enabled, update operations automatically include `workspaceId`\n   * in the `where` clause in addition to the `data` injection,\n   * preventing cross-workspace updates.\n   *\n   * @default true\n   */\n  enableUpdateWhereIsolation?: boolean;\n\n  /**\n   * Automatically populate the `context` JSON field with workspace/actor info\n   * @default true\n   */\n  populateContextJson?: boolean;\n\n  /**\n   * Automatically populate `createdBy` field on create operations\n   * @default true\n   */\n  populateCreatedBy?: boolean;\n\n  /**\n   * Automatically populate `updatedBy` field on update operations\n   * @default true\n   */\n  populateUpdatedBy?: boolean;\n\n  /**\n   * Automatically populate `tenantId` field from context\n   * @default false (tenantId is typically derived from workspaceId at the DB level)\n   */\n  populateTenantId?: boolean;\n\n  /**\n   * Models to exclude from auto-injection (both reads and writes).\n   * Use this for models that intentionally don't have workspaceId.\n   *\n   * Common exclusions: system tables, infra tables, global reference data.\n   *\n   * @default []\n   */\n  excludeModels?: string[];\n\n  /**\n   * Models to exclude from read isolation only.\n   * These models will still get write-side injection (workspaceId on create)\n   * but reads will NOT have workspaceId auto-injected into `where`.\n   *\n   * Use this for child/join tables where workspace scoping is inherited\n   * through parent relations, or for models queried by ID that don't\n   * have a workspaceId column.\n   *\n   * @default []\n   */\n  excludeModelsFromReadIsolation?: string[];\n\n  /**\n   * When true, throws an error if workspaceId is missing from context\n   * for any non-excluded model operation. This prevents silent\n   * workspace-unscoped queries that could leak data across workspaces.\n   *\n   * When false, operations without workspace context proceed without\n   * workspaceId injection (legacy behavior).\n   *\n   * @default true\n   */\n  strictMode?: boolean;\n\n  /**\n   * Operations that are allowed without workspace context even in strict mode.\n   * Use `Model.operation` format (e.g., `['Workspace.create', 'RevokedToken.findMany']`).\n   *\n   * Valid operation names: create, createMany, createManyAndReturn, update, updateMany,\n   * upsert, findMany, findFirst, findFirstOrThrow, findUnique, findUniqueOrThrow,\n   * count, aggregate, groupBy, delete, deleteMany.\n   *\n   * @default []\n   */\n  allowedUnguardedOperations?: string[];\n\n  /**\n   * Log injection events (useful for debugging)\n   * @default false\n   */\n  debug?: boolean;\n\n  /**\n   * Tag the PostgreSQL connection with workspace attribution for pg_stat_activity visibility.\n   *\n   * When enabled, the first DB operation per workspace context sets:\n   *   `application_name = 'svc=<SERVICE_NAME>;ws=<workspaceId>'`\n   *\n   * This makes workspace-level query attribution visible in pg_stat_activity,\n   * pg_locks, auto_explain, and monitoring tools without any schema changes.\n   * Subsequent operations in the same request are deduplicated via WeakSet,\n   * costing ~0 overhead after the first round-trip per request context.\n   *\n   * NOTE: This is a session-level SET so attribution may drift across ops\n   * that reuse the same pooled connection from different requests. Use for\n   * aggregate observability, not per-query forensics.\n   *\n   * @default false\n   */\n  enableApplicationNameTagging?: boolean;\n\n  /**\n   * Set the `app.workspace_id` GUC for Row Level Security enforcement.\n   *\n   * When enabled, the first DB operation per workspace context executes:\n   *   `SET app.workspace_id = '<workspaceId>'`\n   *\n   * RLS policies using `current_setting('app.workspace_id', true)` then filter\n   * rows by workspace, providing a defense-in-depth backstop to the application-\n   * layer workspaceId injection in the WHERE clause.\n   *\n   * Pair with migrations that run per table:\n   *   `ALTER TABLE t ENABLE ROW LEVEL SECURITY;`\n   *   `CREATE POLICY ws_isolation ON t\n   *      USING (workspace_id = current_setting('app.workspace_id', true))\n   *      WITH CHECK (workspace_id = current_setting('app.workspace_id', true));`\n   *\n   * Fail-closed semantics: if the GUC is unset (NULL from missing_ok=true),\n   * `workspace_id = NULL` is always false, so RLS returns no rows — leaking\n   * nothing rather than everything.\n   *\n   * NOTE: Uses session-level SET (safe without a pooler or with session-mode\n   * pooling). Upgrade to SET LOCAL inside `$transaction` when PgBouncer\n   * transaction-mode pooling is enabled (Phase 3b).\n   *\n   * @default false\n   */\n  enableRlsGucTagging?: boolean;\n}\n\n/**\n * Default configuration\n */\nconst defaultConfig: Required<WorkspaceExtensionConfig> = {\n  enabled: true,\n  enableReadIsolation: true,\n  enableDeleteIsolation: true,\n  enableUpdateWhereIsolation: true,\n  populateContextJson: true,\n  populateCreatedBy: true,\n  populateUpdatedBy: true,\n  populateTenantId: false,\n  excludeModels: [],\n  excludeModelsFromReadIsolation: [],\n  strictMode: true,\n  allowedUnguardedOperations: [],\n  debug: false,\n  enableApplicationNameTagging: false,\n  enableRlsGucTagging: false,\n};\n\n// ============================================================================\n// Data Injection Helpers\n// ============================================================================\n\n/**\n * Check if a field exists in the data object (including being set to null/undefined explicitly)\n */\nfunction hasField(data: Record<string, unknown>, field: string): boolean {\n  return field in data;\n}\n\n/**\n * Inject workspace-related fields into create data\n */\nfunction injectCreateFields(\n  data: Record<string, unknown>,\n  wsCtx: WorkspaceContext,\n  config: Required<WorkspaceExtensionConfig>\n): Record<string, unknown> {\n  const injected = { ...data };\n\n  // Inject workspaceId if not already provided\n  if (wsCtx.workspaceId && !hasField(injected, 'workspaceId')) {\n    injected['workspaceId'] = wsCtx.workspaceId;\n  }\n\n  // Inject tenantId if configured and not already provided\n  if (config.populateTenantId && wsCtx.tenantId && !hasField(injected, 'tenantId')) {\n    injected['tenantId'] = wsCtx.tenantId;\n  }\n\n  // Inject createdBy if configured and not already provided\n  if (config.populateCreatedBy && wsCtx.actorId && !hasField(injected, 'createdBy')) {\n    injected['createdBy'] = wsCtx.actorId;\n  }\n\n  // Inject updatedBy on create as well (initial value)\n  if (config.populateUpdatedBy && wsCtx.actorId && !hasField(injected, 'updatedBy')) {\n    injected['updatedBy'] = wsCtx.actorId;\n  }\n\n  // Inject onBehalfOf (for consent-based delegation tracking)\n  // If onBehalfOf is in context (from consent), use it; otherwise defaults to actorId (self-action)\n  if (wsCtx.onBehalfOf && !hasField(injected, 'onBehalfOf')) {\n    injected['onBehalfOf'] = wsCtx.onBehalfOf;\n  } else if (wsCtx.actorId && !hasField(injected, 'onBehalfOf')) {\n    // Default to actorId if no delegation (self-action)\n    injected['onBehalfOf'] = wsCtx.actorId;\n  }\n\n  // Populate context JSON field\n  if (config.populateContextJson && !hasField(injected, 'context')) {\n    const contextJson = buildContextJsonFromWorkspaceContext(wsCtx);\n    if (contextJson) {\n      injected['context'] = contextJson;\n    }\n  }\n\n  return injected;\n}\n\n/**\n * Inject workspace-related fields into update data\n */\nfunction injectUpdateFields(\n  data: Record<string, unknown>,\n  wsCtx: WorkspaceContext,\n  config: Required<WorkspaceExtensionConfig>\n): Record<string, unknown> {\n  const injected = { ...data };\n\n  // Inject updatedBy if configured and not already provided\n  if (config.populateUpdatedBy && wsCtx.actorId && !hasField(injected, 'updatedBy')) {\n    injected['updatedBy'] = wsCtx.actorId;\n  }\n\n  // Note: We intentionally do NOT auto-inject workspaceId on updates\n  // because updates target existing records (workspaceId is immutable after creation)\n  // and changing it would be a data integrity issue.\n\n  return injected;\n}\n\n/**\n * Inject workspaceId into a where clause.\n * Only injects if workspaceId is available in context and not already present in where.\n *\n * For operations that may not have a where clause (e.g., findMany without filters),\n * creates a new where object with just workspaceId.\n */\nfunction injectWhereClause(\n  where: Record<string, unknown> | undefined,\n  wsCtx: WorkspaceContext\n): Record<string, unknown> | undefined {\n  if (!wsCtx.workspaceId) return where;\n\n  if (!where) {\n    // No where clause exists, create one with just workspaceId\n    return { workspaceId: wsCtx.workspaceId };\n  }\n\n  // Only inject if not already present\n  if (!hasField(where, 'workspaceId')) {\n    return { ...where, workspaceId: wsCtx.workspaceId };\n  }\n\n  return where;\n}\n\n/**\n * Build context JSON from workspace context\n */\nfunction buildContextJsonFromWorkspaceContext(wsCtx: WorkspaceContext): InputJsonValue | undefined {\n  const context: Record<string, string> = {};\n\n  if (wsCtx.workspaceId) context['workspaceId'] = wsCtx.workspaceId;\n  if (wsCtx.actorId) context['userId'] = wsCtx.actorId;\n  if (wsCtx.organizationId) context['organizationId'] = wsCtx.organizationId;\n  if (wsCtx.projectId) context['projectId'] = wsCtx.projectId;\n  if (wsCtx.appId) context['appId'] = wsCtx.appId;\n\n  return Object.keys(context).length > 0 ? context : undefined;\n}\n\n/**\n * Inject workspaceId into where clause for read/update/delete operations.\n * This is a utility function exported for services that want to manually\n * add workspace scoping to their queries.\n *\n * @param where - The existing where clause\n * @param wsCtx - The workspace context (or auto-detected from AsyncLocalStorage)\n * @returns The where clause with workspaceId injected if not already present\n *\n * @example\n * ```typescript\n * import { injectWhereWorkspaceId, getWorkspaceContext } from '@burdenoff/be-sdk/prisma';\n *\n * const wsCtx = getWorkspaceContext();\n * const where = injectWhereWorkspaceId({ status: 'ACTIVE' }, wsCtx);\n * // Result: { status: 'ACTIVE', workspaceId: 'ws-123' }\n * ```\n */\nexport function injectWhereWorkspaceId(\n  where: Record<string, unknown> | undefined,\n  wsCtx?: WorkspaceContext\n): Record<string, unknown> | undefined {\n  const ctx = wsCtx ?? getWorkspaceContext();\n  if (!where || !ctx?.workspaceId) return where;\n\n  // Only inject if not already present\n  if (!hasField(where, 'workspaceId')) {\n    return { ...where, workspaceId: ctx.workspaceId };\n  }\n\n  return where;\n}\n\n/**\n * Remove the _skipWorkspaceInjection flag from args before passing to Prisma.\n * Using a dedicated function avoids ESLint unused-variable warnings from destructuring.\n */\nfunction stripSkipFlag<T extends Record<string, unknown>>(args: T): Omit<T, '_skipWorkspaceInjection'> {\n  const cleaned = { ...args };\n  delete (cleaned as Record<string, unknown>)['_skipWorkspaceInjection'];\n  return cleaned;\n}\n\n/**\n * Check if a model should be excluded from read isolation.\n * A model is excluded if it's in excludeModels OR excludeModelsFromReadIsolation.\n */\nfunction isExcludedFromReadIsolation(model: string, config: Required<WorkspaceExtensionConfig>): boolean {\n  return config.excludeModels.includes(model) || config.excludeModelsFromReadIsolation.includes(model);\n}\n\n// ============================================================================\n// Strict Mode Enforcement\n// ============================================================================\n\n/**\n * Enforce strict mode: throw if workspace context is missing and the operation\n * is not explicitly allowed to run without it.\n *\n * @returns true if the operation should proceed without workspace injection (non-strict or allowed)\n * @throws Error if strict mode is enabled and the operation is not allowed\n */\nfunction enforceStrictMode(\n  model: string,\n  operation: string,\n  wsCtx: WorkspaceContext | undefined,\n  config: Required<WorkspaceExtensionConfig>\n): void {\n  // If workspace context has a workspaceId, nothing to enforce\n  if (wsCtx?.workspaceId) return;\n\n  // If strict mode is off, allow silently\n  if (!config.strictMode) return;\n\n  // Check if this specific operation is allowed without workspace context\n  const opKey = `${model}.${operation}`;\n  if (config.allowedUnguardedOperations.includes(opKey)) return;\n\n  // Strict mode violation — throw\n  throw new Error(\n    `[WorkspaceExtension] Workspace context required for ${model}.${operation}. ` +\n      `No workspaceId found in request context. To bypass, either: ` +\n      `(1) add \"${model}\" to excludeModels, ` +\n      `(2) add \"${opKey}\" to allowedUnguardedOperations, or ` +\n      `(3) pass _skipWorkspaceInjection: true in the query args.`\n  );\n}\n\n// ============================================================================\n// Prisma Extension\n// ============================================================================\n\n/**\n * Standard args shape for operations with a `where` clause\n */\ninterface WhereArgs {\n  where?: Record<string, unknown>;\n  _skipWorkspaceInjection?: boolean;\n  [key: string]: unknown;\n}\n\n/**\n * Standard handler params from Prisma $extends\n */\ninterface ExtensionHandlerParams<TArgs> {\n  model: string;\n  args: TArgs;\n  query: (args: unknown) => Promise<unknown>;\n}\n\n/**\n * Add workspace extension to a Prisma client.\n *\n * This extension provides comprehensive workspace isolation by automatically\n * injecting workspaceId into ALL Prisma operations:\n *\n * **Writes**: Auto-populates workspaceId, tenantId, createdBy, updatedBy, context JSON\n * **Reads**: Auto-injects workspaceId into where clause (findMany, findFirst, etc.)\n * **Updates**: Auto-injects workspaceId into where clause + updatedBy into data\n * **Deletes**: Auto-injects workspaceId into where clause\n *\n * **Chain order matters**: Apply this extension AFTER the graph extension\n * (handled automatically by createDatabaseClient).\n *\n * @param baseClient - The Prisma client to extend\n * @param config - Extension configuration\n * @returns Extended Prisma client with workspace auto-injection\n *\n * @example\n * ```typescript\n * import { PrismaClient } from './generated/prisma/client.js';\n * import { addWorkspaceExtension } from '@burdenoff/be-sdk/prisma';\n *\n * const baseClient = new PrismaClient({ adapter });\n * const client = addWorkspaceExtension(baseClient, {\n *   populateContextJson: true,\n *   populateCreatedBy: true,\n *   enableReadIsolation: true,\n *   debug: process.env.NODE_ENV === 'development',\n *   excludeModels: ['CircuitBreakerState', 'SchedulerState'],\n *   excludeModelsFromReadIsolation: ['Permission', 'RbacResourceType'],\n * });\n * ```\n */\n// ============================================================================\n// Connection Tagging (Phase 0.2)\n// ============================================================================\n\n/** Minimal Prisma raw-exec surface needed for SET application_name */\ntype RawPrismaForTagging = {\n  $executeRawUnsafe: (query: string, ...values: unknown[]) => Promise<number>;\n};\n\n/**\n * WeakSet of contexts that have already had the connection tagged this request.\n * WorkspaceContext objects live only for the duration of a request, so entries\n * are automatically GC'd when the context goes out of scope — no manual cleanup.\n */\nconst taggedContexts = new WeakSet<WorkspaceContext>();\n\n/**\n * Tag the current Postgres connection with workspace attribution (once per context).\n * Sets `application_name = 'svc=<name>;ws=<workspaceId>'` at the session level.\n * Non-fatal: tagging failures are swallowed so the main operation still proceeds.\n *\n * @internal Exported for unit testing only — do not call from product code.\n */\nexport async function maybeTagConnection(rawPrisma: RawPrismaForTagging, wsCtx: WorkspaceContext): Promise<void> {\n  if (taggedContexts.has(wsCtx)) return;\n  taggedContexts.add(wsCtx);\n  // Strip non-safe chars; workspace IDs are UUIDs/CUIDs, service names are kebab-case\n  const safeSvc = (process.env['SERVICE_NAME'] ?? 'svc').replace(/[^a-zA-Z0-9\\-_]/g, '');\n  const safeWs = (wsCtx.workspaceId ?? '').replace(/[^a-zA-Z0-9\\-_]/g, '');\n  const tag = `svc=${safeSvc};ws=${safeWs}`;\n  try {\n    await rawPrisma.$executeRawUnsafe(`SET application_name = '${tag}'`);\n  } catch {\n    // Retry on the next operation if this one failed\n    taggedContexts.delete(wsCtx);\n  }\n}\n\n// ============================================================================\n// RLS GUC Tagging (Phase 3)\n// ============================================================================\n\n/**\n * WeakSet of contexts that have already had the RLS GUC set this request.\n */\nconst rlsTaggedContexts = new WeakSet<WorkspaceContext>();\n\n/**\n * Set `app.workspace_id` GUC for RLS enforcement (once per context, session-level).\n *\n * When set, RLS policies using `current_setting('app.workspace_id', true)` filter\n * rows to the current workspace. Non-fatal: failures are swallowed and retried on\n * the next operation via WeakSet entry removal.\n *\n * @internal Exported for unit testing only — do not call from product code.\n */\nexport async function maybeSetRlsGuc(rawPrisma: RawPrismaForTagging, wsCtx: WorkspaceContext): Promise<void> {\n  if (rlsTaggedContexts.has(wsCtx)) return;\n  rlsTaggedContexts.add(wsCtx);\n  // Allow alphanumeric, hyphens, underscores — CUID/UUID safe, prevents SQL injection\n  const safeWs = (wsCtx.workspaceId ?? '').replace(/[^a-zA-Z0-9\\-_]/g, '');\n  try {\n    await rawPrisma.$executeRawUnsafe(`SET app.workspace_id = '${safeWs}'`);\n  } catch {\n    // Retry on the next operation if this one failed\n    rlsTaggedContexts.delete(wsCtx);\n  }\n}\n\nexport function addWorkspaceExtension<T>(baseClient: T, config?: WorkspaceExtensionConfig): T {\n  const fullConfig: Required<WorkspaceExtensionConfig> = {\n    ...defaultConfig,\n    ...config,\n  };\n\n  if (!fullConfig.enabled) {\n    logger.info('[WorkspaceExtension] Extension disabled by configuration');\n    return baseClient;\n  }\n\n  // Capture the unwrapped client for connection tagging (pre-extension, avoids recursion)\n  const rawPrisma = baseClient as unknown as RawPrismaForTagging;\n\n  // Type assertion for Prisma client $extends\n  const prismaClient = baseClient as { $extends: (args: unknown) => T };\n\n  logger.info('[WorkspaceExtension] Workspace extension enabled', {\n    populateContextJson: fullConfig.populateContextJson,\n    populateCreatedBy: fullConfig.populateCreatedBy,\n    populateUpdatedBy: fullConfig.populateUpdatedBy,\n    populateTenantId: fullConfig.populateTenantId,\n    enableReadIsolation: fullConfig.enableReadIsolation,\n    enableDeleteIsolation: fullConfig.enableDeleteIsolation,\n    enableUpdateWhereIsolation: fullConfig.enableUpdateWhereIsolation,\n    strictMode: fullConfig.strictMode,\n    excludeModels: fullConfig.excludeModels,\n    excludeModelsFromReadIsolation: fullConfig.excludeModelsFromReadIsolation,\n    allowedUnguardedOperations: fullConfig.allowedUnguardedOperations,\n    enableApplicationNameTagging: fullConfig.enableApplicationNameTagging,\n    enableRlsGucTagging: fullConfig.enableRlsGucTagging,\n  });\n\n  return prismaClient.$extends({\n    query: {\n      $allModels: {\n        // ================================================================\n        // WRITE OPERATIONS - inject workspaceId into data\n        // ================================================================\n\n        async create({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          data: Record<string, unknown>;\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          // Skip if model is excluded or injection is explicitly skipped\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'create', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          // Inject fields into data\n          const injectedData = injectCreateFields(args.data, wsCtx, fullConfig);\n\n          if (fullConfig.debug) {\n            const injectedKeys = Object.keys(injectedData).filter((k) => !(k in args.data));\n            if (injectedKeys.length > 0) {\n              logger.debug(`[WorkspaceExtension] ${model}.create - injected: ${injectedKeys.join(', ')}`, {\n                workspaceId: wsCtx.workspaceId,\n                actorId: wsCtx.actorId,\n              });\n            }\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            data: injectedData,\n          });\n        },\n\n        async createMany({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          data: Record<string, unknown> | Record<string, unknown>[];\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'createMany', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          // Handle both single object and array\n          const dataArray = Array.isArray(args.data) ? args.data : [args.data];\n          const injectedData = dataArray.map((item) => injectCreateFields(item, wsCtx, fullConfig));\n\n          return query({\n            ...stripSkipFlag(args),\n            data: Array.isArray(args.data) ? injectedData : injectedData[0],\n          });\n        },\n\n        async createManyAndReturn({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          data: Record<string, unknown> | Record<string, unknown>[];\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'createManyAndReturn', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const dataArray = Array.isArray(args.data) ? args.data : [args.data];\n          const injectedData = dataArray.map((item) => injectCreateFields(item, wsCtx, fullConfig));\n\n          return query({\n            ...stripSkipFlag(args),\n            data: Array.isArray(args.data) ? injectedData : injectedData[0],\n          });\n        },\n\n        // ================================================================\n        // UPDATE OPERATIONS - inject updatedBy into data + workspaceId into where\n        // ================================================================\n\n        async update({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          data: Record<string, unknown>;\n          where?: Record<string, unknown>;\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'update', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedData = injectUpdateFields(args.data, wsCtx, fullConfig);\n\n          // Inject workspaceId into where clause for update isolation\n          let injectedWhere = args.where;\n          if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {\n            injectedWhere = injectWhereClause(args.where, wsCtx);\n          }\n\n          if (fullConfig.debug) {\n            const injectedDataKeys = Object.keys(injectedData).filter((k) => !(k in args.data));\n            const whereChanged = injectedWhere !== args.where;\n            if (injectedDataKeys.length > 0 || whereChanged) {\n              logger.debug(\n                `[WorkspaceExtension] ${model}.update - injected data: ${injectedDataKeys.join(', ')}${whereChanged ? ', where: workspaceId' : ''}`\n              );\n            }\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            data: injectedData,\n            where: injectedWhere,\n          });\n        },\n\n        async updateMany({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          data: Record<string, unknown>;\n          where?: Record<string, unknown>;\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'updateMany', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedData = injectUpdateFields(args.data, wsCtx, fullConfig);\n\n          // Inject workspaceId into where clause for update isolation\n          let injectedWhere = args.where;\n          if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {\n            injectedWhere = injectWhereClause(args.where, wsCtx);\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            data: injectedData,\n            where: injectedWhere,\n          });\n        },\n\n        async upsert({\n          model,\n          args,\n          query,\n        }: ExtensionHandlerParams<{\n          create: Record<string, unknown>;\n          update: Record<string, unknown>;\n          where?: Record<string, unknown>;\n          _skipWorkspaceInjection?: boolean;\n          [key: string]: unknown;\n        }>) {\n          if (fullConfig.excludeModels.includes(model) || args._skipWorkspaceInjection) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'upsert', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedCreate = injectCreateFields(args.create, wsCtx, fullConfig);\n          const injectedUpdate = injectUpdateFields(args.update, wsCtx, fullConfig);\n\n          // Inject workspaceId into where clause for upsert isolation\n          let injectedWhere = args.where;\n          if (fullConfig.enableUpdateWhereIsolation && !isExcludedFromReadIsolation(model, fullConfig)) {\n            injectedWhere = injectWhereClause(args.where, wsCtx);\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            create: injectedCreate,\n            update: injectedUpdate,\n            where: injectedWhere,\n          });\n        },\n\n        // ================================================================\n        // READ OPERATIONS - inject workspaceId into where clause\n        // ================================================================\n\n        async findMany({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'findMany', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.findMany - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async findFirst({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'findFirst', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.findFirst - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async findFirstOrThrow({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'findFirstOrThrow', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.findFirstOrThrow - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async findUnique({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'findUnique', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          // For findUnique, the where clause uses unique fields.\n          // We inject workspaceId only if the where clause is a plain object\n          // (compound unique keys with workspaceId are common and already include it).\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.findUnique - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async findUniqueOrThrow({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'findUniqueOrThrow', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.findUniqueOrThrow - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async count({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'count', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.count - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async aggregate({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'aggregate', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.aggregate - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async groupBy({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableReadIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'groupBy', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.groupBy - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        // ================================================================\n        // DELETE OPERATIONS - inject workspaceId into where clause\n        // ================================================================\n\n        async delete({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableDeleteIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'delete', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.delete - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n\n        async deleteMany({ model, args, query }: ExtensionHandlerParams<WhereArgs>) {\n          if (\n            !fullConfig.enableDeleteIsolation ||\n            isExcludedFromReadIsolation(model, fullConfig) ||\n            args._skipWorkspaceInjection\n          ) {\n            return query(stripSkipFlag(args));\n          }\n\n          const wsCtx = getWorkspaceContext();\n          enforceStrictMode(model, 'deleteMany', wsCtx, fullConfig);\n          if (!wsCtx?.workspaceId) {\n            return query(args);\n          }\n\n          if (fullConfig.enableApplicationNameTagging) {\n            await maybeTagConnection(rawPrisma, wsCtx);\n          }\n          if (fullConfig.enableRlsGucTagging) {\n            await maybeSetRlsGuc(rawPrisma, wsCtx);\n          }\n\n          const injectedWhere = injectWhereClause(args.where, wsCtx);\n\n          if (fullConfig.debug) {\n            logger.debug(`[WorkspaceExtension] ${model}.deleteMany - injected workspaceId into where`, {\n              workspaceId: wsCtx.workspaceId,\n            });\n          }\n\n          return query({\n            ...stripSkipFlag(args),\n            where: injectedWhere,\n          });\n        },\n      },\n    },\n  });\n}\n"]}

package/dist/{chunk-STLDHYPB.js → chunk-QPL6BOLH.js}

@@ -1,5 +1,5 @@
 import { shouldSyncRelationship, shouldSyncEntity, parseRelationship, getCollectionForEntity, extractMinimalFields, extractEntityTitle, createRelationshipEvent, createEntityEvent, addGraphExtension, GraphRegistry, ensureServiceApplicationName } from './chunk-Q23NPVWQ.js';
-import { getGraphEventEmitter, GraphEventEmitterImpl } from './chunk-OHEPNJ2X.js';
+import { getGraphEventEmitter, GraphEventEmitterImpl } from './chunk-4ALVWJTM.js';
 import { ValidationError } from './chunk-QGBXVNRM.js';
 import { logger } from './chunk-CBZNP6RF.js';
 import { __export, __name } from './chunk-XE4OXN2W.js';
@@ -1874,5 +1874,5 @@ var GraphModule = class {
 };
 
 export { AUDIT_FIELDS, GraphEventsPublisher, GraphExportService, GraphModule, SOFT_DELETE_FIELDS, STANDARD_FIELDS, TENANT_FIELDS, createGraphEventsHelper, createGraphExportService, createPrismaGraphIntegration, createRelationshipFromEntity, defineEntity, defineGraphConfig, defineModuleGraph, defineRelationship, getGraphEventsPublisher, getGraphStats, graph_exports, initializeGraph, isGraphInitialized };
-//# sourceMappingURL=chunk-STLDHYPB.js.map
-//# sourceMappingURL=chunk-STLDHYPB.js.map
+//# sourceMappingURL=chunk-QPL6BOLH.js.map
+//# sourceMappingURL=chunk-QPL6BOLH.js.map