@cedarjs/tenancy 7.0.0-canary.3092

package/README.md

@@ -0,0 +1,98 @@
+# @cedarjs/tenancy
+
+Opt-in, row-level multi-tenancy for Cedar apps: organizations, memberships,
+per-organization roles and a Prisma client extension that scopes every query on
+a tenant-owned model to the current organization.
+
+Set it up with `yarn cedar setup tenancy`. See the
+[multi-tenancy how-to](https://cedarjs.com/docs/how-to/multi-tenancy) and the
+[reference docs](https://cedarjs.com/docs/tenancy).
+
+## The Prisma extension
+
+`createTenancyExtension()` wraps a Prisma Client so every operation on a
+tenant-owned model gets an `organizationId` equality check added to it — `where`
+for reads, `data` for writes, and any nested relation reached through
+`include`/`select`. A tenant-owned model queried with no organization in scope
+throws `TenantScopeError` instead of silently returning unscoped data.
+
+```ts
+// api/src/lib/db.ts
+import { createTenancyExtension } from '@cedarjs/tenancy'
+
+import { PrismaClient } from './generated/prisma/client'
+
+const prismaClient = new PrismaClient()
+
+export const db = prismaClient.$extends(
+  createTenancyExtension<typeof prismaClient>({
+    // Every model is tenant-owned except these three, which `setup tenancy`
+    // adds to the schema. New models are scoped automatically.
+    models: { allExcept: ['user', 'organization', 'membership'] },
+  }),
+)
+```
+
+By default the extension reads the current organization from
+`context.currentOrg?.id` (set by `resolveCurrentOrg`/`withTenancy`, below). Pass
+`getTenantId` to source it differently, and `tenantField` if the column isn't
+named `organizationId`.
+
+### Escape hatches
+
+```ts
+db.$forOrg(organizationId) // scoped to one organization, ignoring context
+db.$withoutTenant() // unscoped, for seeds, scripts, admin tooling
+```
+
+Both share the same underlying connection pool as `db`. Use `$forOrg` in
+background jobs and webhooks, where there's no request context but the
+organization is known; use `$withoutTenant` for code that intentionally reads or
+writes across organizations. Raw SQL (`$queryRaw`, `$executeRaw`, and their
+`Unsafe` variants) is blocked on a tenant-scoped client and only available on
+`$withoutTenant()`.
+
+## Context helpers
+
+```ts
+import {
+  resolveCurrentOrg,
+  requireCurrentOrg,
+  getCurrentOrg,
+} from '@cedarjs/tenancy'
+```
+
+- `resolveCurrentOrg({ event, variables, currentUser, lookupOrg })` — resolves
+  the organization a request targets (the `cedar-org` header, then
+  `orgId`/`orgSlug` GraphQL variables), validates the user has a membership in
+  it, and sets `context.currentOrg`. Wire it into `createGraphQLHandler`'s
+  `context` option.
+- `withTenancy(handler, { authDecoder, getCurrentUser, lookupOrg })` — the same
+  setup for a plain `api/src/functions/*` handler that doesn't go through the
+  GraphQL context.
+- `getCurrentOrg()` / `requireCurrentOrg()` — read the organization set on the
+  current request; the latter throws `TenantScopeError` when none is set.
+
+## Auth helpers
+
+```ts
+import { hasOrgRole, requireMembership } from '@cedarjs/tenancy'
+
+// In a service:
+requireMembership({ roles: ['owner', 'admin'] })
+
+// Anywhere:
+if (hasOrgRole('owner')) { ... }
+```
+
+`requireMembership` throws `AuthenticationError` with no current user and
+`ForbiddenError` with no current organization or a role mismatch — the same
+error types `requireAuth` uses.
+
+## Web
+
+`@cedarjs/tenancy/web` exports `OrgScope`, `useCurrentOrg`, `OrgContext` and
+`getMemberships`/`hasOrgRole` for the client side: a per-organization Apollo
+client provided under organization routes, keyed by the immutable organization
+id so switching organizations never mixes caches. See the how-to for the full
+`<Set wrap={OrgScope}>` setup `yarn cedar setup tenancy` generates.

package/dist/auth.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Whether the current request holds one of `roles` in an organization.
+ *
+ * With `organizationId`, this checks `context.currentUser.memberships` for a
+ * membership in that specific organization — useful for checking access to
+ * an organization other than the one in scope. Without it, this checks the
+ * role on `context.currentOrg`, the organization already resolved for this
+ * request.
+ *
+ * Returns `false` when there's no authenticated user, no matching
+ * organization, or no matching membership. An empty `roles` array returns
+ * `true` as long as a matching membership exists, mirroring `hasRole()`'s
+ * behavior for global roles.
+ */
+export declare function hasOrgRole(roles: string | string[], organizationId?: string): boolean;
+/**
+ * Guards a service or directive on the current request having a membership
+ * in the current organization, optionally with one of `roles`.
+ *
+ * Throws `AuthenticationError` when there's no authenticated user, and
+ * `ForbiddenError` when there's no current organization or the membership's
+ * role doesn't match — the same error types `requireAuth` uses, so existing
+ * error handling on the web side applies unchanged.
+ */
+export declare function requireMembership(options?: {
+    roles?: string | string[];
+}): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CA4BT;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAAO,GAC1C,IAAI,CAwBN"}

package/dist/auth.js

@@ -0,0 +1,47 @@
+import { context } from "@cedarjs/context";
+import { AuthenticationError, ForbiddenError } from "@cedarjs/graphql-server";
+import { getCurrentOrg, isUserWithMemberships } from "./context.js";
+function hasOrgRole(roles, organizationId) {
+  const roleList = Array.isArray(roles) ? roles : [roles];
+  if (organizationId) {
+    const currentUser = context.currentUser;
+    if (!isUserWithMemberships(currentUser)) {
+      return false;
+    }
+    const membership = currentUser.memberships.find(
+      (m) => m.organizationId === organizationId
+    );
+    if (!membership) {
+      return false;
+    }
+    return roleList.length === 0 || roleList.includes(membership.role);
+  }
+  const currentOrg = getCurrentOrg();
+  if (!currentOrg) {
+    return false;
+  }
+  return roleList.length === 0 || roleList.includes(currentOrg.role);
+}
+function requireMembership(options = {}) {
+  if (!context.currentUser) {
+    throw new AuthenticationError("You must be logged in to do that.");
+  }
+  const currentOrg = getCurrentOrg();
+  if (!currentOrg) {
+    throw new ForbiddenError(
+      "You must be a member of an organization to do that."
+    );
+  }
+  const { roles } = options;
+  if (roles === void 0) {
+    return;
+  }
+  const roleList = Array.isArray(roles) ? roles : [roles];
+  if (roleList.length > 0 && !roleList.includes(currentOrg.role)) {
+    throw new ForbiddenError("You do not have permission to do that.");
+  }
+}
+export {
+  hasOrgRole,
+  requireMembership
+};

package/dist/context.d.ts

@@ -0,0 +1,121 @@
+import type { APIGatewayProxyEvent, Context as LambdaContext } from 'aws-lambda';
+import type { Decoder } from '@cedarjs/api';
+/**
+ * The organization resolved for the current request: the identity fields
+ * from `Organization`, plus the role and membership id derived from the
+ * authenticated user's own membership in it.
+ */
+export interface CurrentOrg {
+    id: string;
+    slug: string;
+    role: string;
+    membershipId: string;
+}
+/**
+ * The shape of a `Membership` row that `setCurrentOrg` and `resolveCurrentOrg`
+ * need: enough to derive a `CurrentOrg` without importing a generated Prisma
+ * type into this package.
+ */
+export interface MembershipSummary {
+    id: string;
+    organizationId: string;
+    role: string;
+}
+/**
+ * The shape `getCurrentUser()` must return once an app has set up tenancy:
+ * the user's memberships across every organization they belong to.
+ */
+export interface UserWithMemberships {
+    memberships: MembershipSummary[];
+}
+/**
+ * Request header carrying the organization the request targets, by id or by
+ * slug. No `X-` prefix, per RFC 6648, matching the existing `auth-provider`
+ * header.
+ */
+export declare const CEDAR_ORG_HEADER = "cedar-org";
+/**
+ * Narrows an unknown `currentUser` value down to one carrying memberships,
+ * without assuming anything else about its shape.
+ */
+export declare function isUserWithMemberships(value: unknown): value is UserWithMemberships;
+/**
+ * Sets the current request's organization from its identity alone. `role`
+ * and `membershipId` are derived from `currentUser.memberships`, never from
+ * the caller, so nothing that calls this function can grant a role that
+ * doesn't already exist. Throws `ForbiddenError` when the user has no
+ * membership in the organization, the same error a non-member gets, so a
+ * caller can't distinguish "no such organization" from "not your
+ * organization".
+ */
+export declare function setCurrentOrg(org: {
+    id: string;
+    slug: string;
+}, currentUser: UserWithMemberships): CurrentOrg;
+/**
+ * Reads the organization set on the current request context, if any.
+ */
+export declare function getCurrentOrg(): CurrentOrg | undefined;
+/**
+ * Reads the organization set on the current request context. Throws
+ * `TenantScopeError` when none is set, for code that cannot proceed without
+ * one (the Prisma extension uses the same error for the same reason).
+ */
+export declare function requireCurrentOrg(): CurrentOrg;
+/**
+ * Resolves the organization a request targets and sets it on the context.
+ *
+ * Resolution order: the `cedar-org` request header, then the `orgId`
+ * GraphQL variable, then the `orgSlug` variable. When none is present, the
+ * request has no organization in scope: this returns `undefined` and sets
+ * nothing, which is correct for anonymous requests and for operations that
+ * don't touch tenant-owned data.
+ *
+ * An id or slug that doesn't resolve to an organization the user belongs to
+ * — whether it doesn't exist at all, or exists but the user isn't a member —
+ * is rejected the same way, with `ForbiddenError`, so a caller can't use this
+ * function to probe which organizations exist.
+ */
+export declare function resolveCurrentOrg(args: {
+    event: APIGatewayProxyEvent | Request;
+    variables?: Record<string, unknown>;
+    currentUser: UserWithMemberships;
+    lookupOrg: (idOrSlug: string) => Promise<{
+        id: string;
+        slug: string;
+    } | null>;
+}): Promise<CurrentOrg | undefined>;
+/**
+ * Wraps a plain `api/src/functions/*` handler — one that doesn't go through
+ * the GraphQL context — with the same request-context setup a GraphQL
+ * request gets: it authenticates the request, loads the current user, and
+ * resolves the current organization from the request headers, all inside a
+ * fresh `@cedarjs/context` store, before calling the handler.
+ *
+ * An unauthenticated request, or one whose `getCurrentUser` result doesn't
+ * carry memberships, still reaches the handler; it simply runs with no
+ * `currentOrg` set, so any tenant-owned query inside it fails with
+ * `TenantScopeError` unless the handler uses `db.$forOrg()` explicitly.
+ */
+export declare function withTenancy<Event extends APIGatewayProxyEvent | Request, Ctx extends LambdaContext = LambdaContext, Result = unknown>(handler: (event: Event, context: Ctx) => Promise<Result> | Result, options: {
+    authDecoder: Decoder | Decoder[];
+    getCurrentUser: (decoded: unknown, raw: {
+        type: string;
+        schema: string;
+        token: string;
+    }, req: {
+        event: APIGatewayProxyEvent | Request;
+        request?: Request;
+        context?: LambdaContext;
+    }) => Promise<unknown>;
+    lookupOrg: (idOrSlug: string) => Promise<{
+        id: string;
+        slug: string;
+    } | null>;
+}): (event: Event, context: Ctx) => Promise<Result>;
+declare module '@cedarjs/context' {
+    interface GlobalContext {
+        currentOrg?: CurrentOrg;
+    }
+}
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,YAAY,CAAA;AAEhF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAQ3C;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,iBAAiB,EAAE,CAAA;CACjC;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAE3C;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,mBAAmB,CAM9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACjC,WAAW,EAAE,mBAAmB,GAC/B,UAAU,CAmBZ;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,UAAU,GAAG,SAAS,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAY9C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAA;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,WAAW,EAAE,mBAAmB,CAAA;IAChC,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;CAC9E,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAsBlC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,KAAK,SAAS,oBAAoB,GAAG,OAAO,EAC5C,GAAG,SAAS,aAAa,GAAG,aAAa,EACzC,MAAM,GAAG,OAAO,EAEhB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,EACjE,OAAO,EAAE;IACP,WAAW,EAAE,OAAO,GAAG,OAAO,EAAE,CAAA;IAChC,cAAc,EAAE,CACd,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EACpD,GAAG,EAAE;QACH,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAA;QACrC,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,OAAO,CAAC,EAAE,aAAa,CAAA;KACxB,KACE,OAAO,CAAC,OAAO,CAAC,CAAA;IACrB,SAAS,EAAE,CACT,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;CAClD,GACA,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CA4BjD;AAED,OAAO,QAAQ,kBAAkB,CAAC;IAChC,UAAU,aAAa;QACrB,UAAU,CAAC,EAAE,UAAU,CAAA;KACxB;CACF"}

package/dist/context.js

@@ -0,0 +1,84 @@
+import { getAuthenticationContext, getEventHeader } from "@cedarjs/api";
+import { context, setContext } from "@cedarjs/context";
+import { getAsyncStoreInstance } from "@cedarjs/context/dist/store.js";
+import { ForbiddenError } from "@cedarjs/graphql-server";
+import { TenantScopeError } from "./errors.js";
+const CEDAR_ORG_HEADER = "cedar-org";
+function isUserWithMemberships(value) {
+  return typeof value === "object" && value !== null && Array.isArray(value.memberships);
+}
+function setCurrentOrg(org, currentUser) {
+  const membership = currentUser.memberships.find(
+    (m) => m.organizationId === org.id
+  );
+  if (!membership) {
+    throw new ForbiddenError("You are not a member of this organization.");
+  }
+  const currentOrg = {
+    id: org.id,
+    slug: org.slug,
+    role: membership.role,
+    membershipId: membership.id
+  };
+  context.currentOrg = currentOrg;
+  return currentOrg;
+}
+function getCurrentOrg() {
+  return context.currentOrg;
+}
+function requireCurrentOrg() {
+  const currentOrg = getCurrentOrg();
+  if (!currentOrg) {
+    throw new TenantScopeError(
+      `No organization is set on the current request. Send the \`${CEDAR_ORG_HEADER}\` header, or an \`orgId\`/\`orgSlug\` variable, to select one.`
+    );
+  }
+  return currentOrg;
+}
+async function resolveCurrentOrg(args) {
+  const { event, variables, currentUser, lookupOrg } = args;
+  const headerOrg = getEventHeader(event, CEDAR_ORG_HEADER);
+  const orgIdOrSlug = headerOrg || (typeof variables?.orgId === "string" ? variables.orgId : void 0) || (typeof variables?.orgSlug === "string" ? variables.orgSlug : void 0);
+  if (!orgIdOrSlug) {
+    return void 0;
+  }
+  const org = await lookupOrg(orgIdOrSlug);
+  if (!org) {
+    throw new ForbiddenError("You are not a member of this organization.");
+  }
+  return setCurrentOrg(org, currentUser);
+}
+function withTenancy(handler, options) {
+  return async (event, lambdaContext) => {
+    return getAsyncStoreInstance().run(/* @__PURE__ */ new Map(), async () => {
+      const authContext = await getAuthenticationContext({
+        authDecoder: options.authDecoder,
+        event,
+        context: lambdaContext
+      });
+      if (!authContext) {
+        return handler(event, lambdaContext);
+      }
+      const [decoded, raw, req] = authContext;
+      const currentUser = await options.getCurrentUser(decoded, raw, req);
+      setContext({ currentUser });
+      if (isUserWithMemberships(currentUser)) {
+        await resolveCurrentOrg({
+          event,
+          currentUser,
+          lookupOrg: options.lookupOrg
+        });
+      }
+      return handler(event, lambdaContext);
+    });
+  };
+}
+export {
+  CEDAR_ORG_HEADER,
+  getCurrentOrg,
+  isUserWithMemberships,
+  requireCurrentOrg,
+  resolveCurrentOrg,
+  setCurrentOrg,
+  withTenancy
+};

package/dist/errors.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Thrown when a tenant-owned model is queried with no organization in
+ * scope: no `context.currentOrg`, and neither `db.$forOrg(id)` nor
+ * `db.$withoutTenant()` was used explicitly. A loud failure here is
+ * preferable to a silent cross-tenant read.
+ */
+export declare class TenantScopeError extends Error {
+    name: string;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,IAAI,SAAqB;CAC1B"}

package/dist/errors.js

@@ -0,0 +1,6 @@
+class TenantScopeError extends Error {
+  name = "TenantScopeError";
+}
+export {
+  TenantScopeError
+};

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './errors.js';
+export * from './context.js';
+export * from './auth.js';
+export { createTenancyExtension } from './prismaExtension.js';
+export type { ModelNamesFor, TenancyConfig } from './prismaExtension.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export * from "./errors.js";
+export * from "./context.js";
+export * from "./auth.js";
+import { createTenancyExtension } from "./prismaExtension.js";
+export {
+  createTenancyExtension
+};

package/dist/prismaExtension.d.ts

@@ -0,0 +1,89 @@
+type FilterOutDollarPrefixed<T> = T extends `$${string}` ? never : T extends symbol ? never : T;
+/**
+ * The Prisma Client's model accessor names (`project`, `organization`, ...),
+ * excluding client-level members like `$transaction` and `$extends`.
+ */
+export type ModelNamesFor<TClient> = FilterOutDollarPrefixed<keyof TClient>;
+export interface TenancyConfig<TClient> {
+    /**
+     * The column name on every tenant-owned model that stores the
+     * organization id. Default: `'organizationId'`.
+     */
+    tenantField?: string;
+    /**
+     * Either the exact list of tenant-owned models, or every model except the
+     * ones listed in `allExcept`. `allExcept` is the safer default for an app:
+     * a model added later is scoped automatically instead of silently staying
+     * unscoped because it was never added to an explicit list. Cedar's own
+     * `RW_DataMigration` model is never tenant-owned in either form.
+     */
+    models: ModelNamesFor<TClient>[] | {
+        allExcept: ModelNamesFor<TClient>[];
+    };
+    /**
+     * Returns the current tenant id, or `undefined` when none is in scope.
+     * Default: reads `context.currentOrg?.id` from `@cedarjs/context`.
+     */
+    getTenantId?: () => string | undefined;
+}
+/**
+ * The result of line-parsing one model body: which field names were
+ * actually read off a line (`knownFields`), and which of those declared a
+ * type ending in `[]` (`listFields`, always a subset of `knownFields`).
+ * `knownFields` is what lets `isListRelationField` tell "this field is
+ * to-one" apart from "this field was never classified" — see there.
+ */
+interface ParsedModelFields {
+    knownFields: Set<string>;
+    listFields: Set<string>;
+}
+/**
+ * Parses `model X { ... }` blocks out of a `.prisma` schema source and
+ * returns, per model, which fields were read off a line and which of those
+ * are lists (type ending in `[]`) — the exact list-cardinality signal
+ * Prisma's compact runtime data model doesn't carry (see
+ * `isListRelationField`). Model bodies are located by `findModelBodyRange`,
+ * which counts brace depth (rather than matching up to the first `}`) so a
+ * brace inside a quoted attribute value or a `//` comment can't be mistaken
+ * for the model's end. Beyond that, this is a line-oriented reading of the
+ * schema, not a full parser: for each non-blank, non-comment, non-`@@`
+ * attribute line inside a model block, only the first two whitespace-
+ * separated tokens (field name, type) are read, so `@relation(...)`,
+ * `@map(...)` and other attributes on the same line are ignored along with
+ * everything after them.
+ *
+ * Exported only for `parseListFieldsFromSchema.test.ts`; not part of this
+ * package's public API.
+ */
+export declare function parseListFieldsFromSchema(schemaText: string): Map<string, ParsedModelFields>;
+declare function throwRawQueryBlocked(): never;
+/**
+ * Builds a Prisma Client extension that scopes every operation on a
+ * tenant-owned model to the tenant id `config.getTenantId()` (or the
+ * default reader of `context.currentOrg?.id`) returns, and adds
+ * `db.$forOrg(organizationId)` / `db.$withoutTenant()` escape hatches.
+ *
+ * See `docs/implementation-plans/2026-08-26-multi-tenancy.md` ("Layer 1")
+ * for the full behavior table this implements.
+ */
+export declare function createTenancyExtension<TClient>(config: TenancyConfig<TClient>): (client: any) => import("@prisma/client/extension").PrismaClientExtends<import("@prisma/client/runtime/client").InternalArgs<{}, {}, {}, {
+    /**
+     * A client scoped to `organizationId` regardless of request
+     * context — for background jobs, webhooks, and other code that
+     * knows the tenant but doesn't run inside a request.
+     */
+    $forOrg(organizationId: string): TClient;
+    /**
+     * An unscoped client for code that intentionally reads or writes
+     * across organizations: seeds, data migrations, admin tooling.
+     * Nothing here is scoped, and raw SQL is allowed.
+     */
+    $withoutTenant(): TClient;
+}> & import("@prisma/client/runtime/client").InternalArgs<{}, {}, {}, {
+    $queryRaw: typeof throwRawQueryBlocked;
+    $queryRawUnsafe: typeof throwRawQueryBlocked;
+    $executeRaw: typeof throwRawQueryBlocked;
+    $executeRawUnsafe: typeof throwRawQueryBlocked;
+}> & import("@prisma/client/runtime/client").DefaultArgs>;
+export {};
+//# sourceMappingURL=prismaExtension.d.ts.map

package/dist/prismaExtension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prismaExtension.d.ts","sourceRoot":"","sources":["../src/prismaExtension.ts"],"names":[],"mappings":"AAQA,KAAK,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,EAAE,GACpD,KAAK,GACL,CAAC,SAAS,MAAM,GACd,KAAK,GACL,CAAC,CAAA;AAEP;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,IAAI,uBAAuB,CAAC,MAAM,OAAO,CAAC,CAAA;AAE3E,MAAM,WAAW,aAAa,CAAC,OAAO;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG;QAAE,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAA;KAAE,CAAA;IAC1E;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;CACvC;AA4ID;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,GACjB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAwChC;AAiwBD,iBAAS,oBAAoB,IAAI,KAAK,CAErC;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAC5C,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;IA6DxB;;;;OAIG;4BACqB,MAAM,GAMiC,OAAO;IAEtE;;;;OAIG;sBAE2B,OAAO;;;;;;0DAK5C"}