@cedarjs/tenancy 8.0.0-canary.3553 → 8.0.0-canary.3557

package/dist/index.d.ts

@@ -3,5 +3,5 @@ export * from './context.js';
 export * from './auth.js';
 export * from './permissions.js';
 export { createTenancyExtension } from './prismaExtension.js';
-export type { ModelNamesFor, TenancyConfig } from './prismaExtension.js';
+export type { ModelNamesFor, TenancyConfig, UnscopedClient, } from './prismaExtension.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,YAAY,EACV,aAAa,EACb,aAAa,EACb,cAAc,GACf,MAAM,sBAAsB,CAAA"}

package/dist/prismaExtension.d.ts

@@ -57,29 +57,79 @@ interface ParsedModelFields {
  */
 export declare function parseListFieldsFromSchema(schemaText: string): Map<string, ParsedModelFields>;
 declare function throwRawQueryBlocked(): never;
+/**
+ * A client the escape hatches can be called on. Prisma's interactive
+ * transaction client has no `$extends`, so a client built for it couldn't
+ * stay on the transaction's connection; leaving `$extends` out of its type
+ * makes `tx.$forOrg()` a type error, and `isTransactionClient` refuses it at
+ * runtime.
+ */
+type ExtendableClient = {
+    $extends: unknown;
+};
+/**
+ * The client methods a scoped client blocks (see `throwRawQueryBlocked`) and
+ * an unscoped one allows.
+ */
+type RawSqlMethod = '$queryRaw' | '$queryRawUnsafe' | '$executeRaw' | '$executeRawUnsafe';
+/**
+ * Raw SQL typed the way the un-extended client types it, instead of as
+ * always throwing.
+ */
+type AllowedRawSql<TClient> = Pick<TClient, Extract<keyof TClient, RawSqlMethod>>;
+/**
+ * The `tx` and the options of `TDb`'s interactive `$transaction`, read from
+ * Prisma's own signature. A conditional type matches the last overload, which
+ * for Prisma is the interactive one (the batch form comes first).
+ */
+type InteractiveTransaction<TDb> = TDb extends {
+    $transaction: (fn: (tx: infer Tx) => Promise<unknown>, options?: infer Options) => Promise<unknown>;
+} ? {
+    tx: Tx;
+    options: Options;
+} : never;
+/**
+ * The `$transaction` of `db.$withoutTenant()`: its callback's `tx` is `db`'s
+ * own transaction client with raw SQL allowed, like the client it was started
+ * on (at runtime it's built from that unscoped client). `db`'s own overloads
+ * follow it, unchanged: the batch form, and the callback form for a callback
+ * that names `db`'s `tx` type. Keeping them also lets TypeScript call
+ * `$transaction` on a union of `db` and the unscoped client, using the
+ * signatures the two have in common.
+ */
+type UnscopedTransaction<TDb, TClient> = (<R>(fn: (tx: Omit<InteractiveTransaction<TDb>['tx'], RawSqlMethod> & AllowedRawSql<TClient>) => Promise<R>, options?: InteractiveTransaction<TDb>['options']) => Promise<R>) & (TDb extends {
+    $transaction: infer T;
+} ? T : never);
+/**
+ * The type of `db.$withoutTenant()`: `db`'s own type, with raw SQL typed the
+ * way the un-extended client types it instead of as always throwing, on the
+ * client and on its interactive transactions' `tx`. Every other member, the
+ * models included, has exactly `db`'s type, so code can take either client
+ * without the two forming a union TypeScript can't call model methods on.
+ */
+export type UnscopedClient<TDb, TClient> = Omit<TDb, RawSqlMethod | '$transaction' | '$forOrg' | '$withoutTenant'> & AllowedRawSql<TClient> & {
+    $transaction: UnscopedTransaction<TDb, TClient>;
+    $forOrg(this: ExtendableClient, organizationId: string): TDb;
+    $withoutTenant(this: ExtendableClient): UnscopedClient<TDb, TClient>;
+};
 /**
  * Builds a Prisma Client extension that scopes every operation on a
  * tenant-owned model to the tenant id `config.getTenantId()` (or the
  * default reader of `context.currentOrg?.id`) returns, and adds
  * `db.$forOrg(organizationId)` / `db.$withoutTenant()` escape hatches.
  *
+ * Every client the escape hatches return carries them too, and
+ * `db.$forOrg(id)` has the same type as `db`: TypeScript takes that type from
+ * the client the method is called on (`this`). So the tenancy extension
+ * should be the last one `db` is extended with; one added after it would be
+ * in the type of a `$forOrg` client but not on the client itself.
+ *
  * See `docs/implementation-plans/2026-08-26-multi-tenancy.md` ("Layer 1")
  * for the full behavior table this implements.
  */
 export declare function createTenancyExtension<TClient>(config: TenancyConfig<TClient>): (client: any) => import("@prisma/client/extension").PrismaClientExtends<import("@prisma/client/runtime/client").InternalArgs<{}, {}, {}, {
-    /**
-     * A client scoped to `organizationId` regardless of request
-     * context — for background jobs, webhooks, and other code that
-     * knows the tenant but doesn't run inside a request.
-     */
-    $forOrg(organizationId: string): TClient;
-    /**
-     * An unscoped client for code that intentionally reads or writes
-     * across organizations: seeds, data migrations, admin tooling.
-     * Nothing here is scoped, and raw SQL is allowed.
-     */
-    $withoutTenant(): TClient;
-}> & import("@prisma/client/runtime/client").InternalArgs<{}, {}, {}, {
+    $forOrg: <T extends ExtendableClient>(this: T, organizationId: string) => T;
+    $withoutTenant: <T extends ExtendableClient>(this: T) => UnscopedClient<T, TClient>;
     $queryRaw: typeof throwRawQueryBlocked;
     $queryRawUnsafe: typeof throwRawQueryBlocked;
     $executeRaw: typeof throwRawQueryBlocked;

package/dist/prismaExtension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prismaExtension.d.ts","sourceRoot":"","sources":["../src/prismaExtension.ts"],"names":[],"mappings":"AAQA,KAAK,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,EAAE,GACpD,KAAK,GACL,CAAC,SAAS,MAAM,GACd,KAAK,GACL,CAAC,CAAA;AAEP;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,IAAI,uBAAuB,CAAC,MAAM,OAAO,CAAC,CAAA;AAE3E,MAAM,WAAW,aAAa,CAAC,OAAO;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG;QAAE,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAA;KAAE,CAAA;IAC1E;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;CACvC;AA4ID;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,GACjB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAwChC;AAiwBD,iBAAS,oBAAoB,IAAI,KAAK,CAErC;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAC5C,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;IA6DxB;;;;OAIG;4BACqB,MAAM,GAMiC,OAAO;IAEtE;;;;OAIG;sBAE2B,OAAO;;;;;;0DAK5C"}
+{"version":3,"file":"prismaExtension.d.ts","sourceRoot":"","sources":["../src/prismaExtension.ts"],"names":[],"mappings":"AAQA,KAAK,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,EAAE,GACpD,KAAK,GACL,CAAC,SAAS,MAAM,GACd,KAAK,GACL,CAAC,CAAA;AAEP;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,IAAI,uBAAuB,CAAC,MAAM,OAAO,CAAC,CAAA;AAE3E,MAAM,WAAW,aAAa,CAAC,OAAO;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG;QAAE,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAA;KAAE,CAAA;IAC1E;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;CACvC;AA4ID;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,GACjB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAwChC;AAiwBD,iBAAS,oBAAoB,IAAI,KAAK,CAErC;AAQD;;;;;;GAMG;AACH,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAA;AAQ7C;;;GAGG;AACH,KAAK,YAAY,GACf,WAAW,GAAG,iBAAiB,GAAG,aAAa,GAAG,mBAAmB,CAAA;AAEvE;;;GAGG;AACH,KAAK,aAAa,CAAC,OAAO,IAAI,IAAI,CAChC,OAAO,EACP,OAAO,CAAC,MAAM,OAAO,EAAE,YAAY,CAAC,CACrC,CAAA;AAED;;;;GAIG;AACH,KAAK,sBAAsB,CAAC,GAAG,IAAI,GAAG,SAAS;IAC7C,YAAY,EAAE,CACZ,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,EACtC,OAAO,CAAC,EAAE,MAAM,OAAO,KACpB,OAAO,CAAC,OAAO,CAAC,CAAA;CACtB,GACG;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC5B,KAAK,CAAA;AAET;;;;;;;;GAQG;AACH,KAAK,mBAAmB,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,EAC1C,EAAE,EAAE,CACF,EAAE,EAAE,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,GACvD,aAAa,CAAC,OAAO,CAAC,KACrB,OAAO,CAAC,CAAC,CAAC,EACf,OAAO,CAAC,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAC7C,OAAO,CAAC,CAAC,CAAC,CAAC,GACd,CAAC,GAAG,SAAS;IAAE,YAAY,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;AAErD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,IAAI,IAAI,CAC7C,GAAG,EACH,YAAY,GAAG,cAAc,GAAG,SAAS,GAAG,gBAAgB,CAC7D,GACC,aAAa,CAAC,OAAO,CAAC,GAAG;IACvB,YAAY,EAAE,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC/C,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,GAAG,GAAG,CAAA;IAC5D,cAAc,CAAC,IAAI,EAAE,gBAAgB,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;CACrE,CAAA;AAEH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAC5C,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;cA8BX,CAAC,SAAS,gBAAgB,QACnC,CAAC,kBACS,MAAM,KACrB,CAAC;qBAaoB,CAAC,SAAS,gBAAgB,QAC1C,CAAC,KACN,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC;;;;;0DA2DhC"}

package/dist/prismaExtension.js

@@ -504,6 +504,10 @@ const RAW_QUERY_MESSAGE = "Raw SQL is not allowed on a tenant-scoped client. Use
 function throwRawQueryBlocked() {
   throw new TenantScopeError(RAW_QUERY_MESSAGE);
 }
+const TRANSACTION_MESSAGE = "$forOrg() and $withoutTenant() can't be called on a transaction client: the client they return would run its queries outside the transaction. Start the transaction on the client you need instead, e.g. db.$forOrg(organizationId).$transaction(async (tx) => ...).";
+function isTransactionClient(client) {
+  return typeof client === "object" && client !== null && !("$extends" in client);
+}
 function createTenancyExtension(config) {
   const tenantField = config.tenantField ?? "organizationId";
   const getTenantId = config.getTenantId ?? (() => getCurrentOrg()?.id);
@@ -514,6 +518,18 @@ function createTenancyExtension(config) {
       runtimeDataModel
     );
     const listFieldsByModel = getListFieldsByModel(client);
+    function $forOrg(organizationId) {
+      if (isTransactionClient(this)) {
+        throw new TenantScopeError(TRANSACTION_MESSAGE);
+      }
+      return buildScopedClient(() => organizationId);
+    }
+    function $withoutTenant() {
+      if (isTransactionClient(this)) {
+        throw new TenantScopeError(TRANSACTION_MESSAGE);
+      }
+      return unscopedClient;
+    }
     function buildScopedClient(tenantIdSource) {
       const ctx = {
         tenantField,
@@ -547,6 +563,8 @@ function createTenancyExtension(config) {
           $executeRawUnsafe: throwRawQueryBlocked
         },
         client: {
+          $forOrg,
+          $withoutTenant,
           $queryRaw: throwRawQueryBlocked,
           $queryRawUnsafe: throwRawQueryBlocked,
           $executeRaw: throwRawQueryBlocked,
@@ -554,27 +572,11 @@ function createTenancyExtension(config) {
         }
       });
     }
-    const scopedClient = buildScopedClient(getTenantId);
-    return scopedClient.$extends({
-      client: {
-        /**
-         * A client scoped to `organizationId` regardless of request
-         * context — for background jobs, webhooks, and other code that
-         * knows the tenant but doesn't run inside a request.
-         */
-        $forOrg(organizationId) {
-          return buildScopedClient(() => organizationId);
-        },
-        /**
-         * An unscoped client for code that intentionally reads or writes
-         * across organizations: seeds, data migrations, admin tooling.
-         * Nothing here is scoped, and raw SQL is allowed.
-         */
-        $withoutTenant() {
-          return client;
-        }
-      }
+    const unscopedClient = client.$extends({
+      name: "cedarjs-tenancy-unscoped",
+      client: { $forOrg, $withoutTenant }
     });
+    return buildScopedClient(getTenantId);
   });
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/tenancy",
-  "version": "8.0.0-canary.3553",
+  "version": "8.0.0-canary.3557",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -44,17 +44,17 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/api": "8.0.0-canary.3553",
-    "@cedarjs/context": "8.0.0-canary.3553",
-    "@cedarjs/graphql-server": "8.0.0-canary.3553"
+    "@cedarjs/api": "8.0.0-canary.3557",
+    "@cedarjs/context": "8.0.0-canary.3557",
+    "@cedarjs/graphql-server": "8.0.0-canary.3557"
   },
   "devDependencies": {
     "@apollo/client": "4.3.5",
     "@arethetypeswrong/cli": "0.18.5",
-    "@cedarjs/auth": "8.0.0-canary.3553",
-    "@cedarjs/framework-tools": "8.0.0-canary.3553",
-    "@cedarjs/router": "8.0.0-canary.3553",
-    "@cedarjs/web": "8.0.0-canary.3553",
+    "@cedarjs/auth": "8.0.0-canary.3557",
+    "@cedarjs/framework-tools": "8.0.0-canary.3557",
+    "@cedarjs/router": "8.0.0-canary.3557",
+    "@cedarjs/web": "8.0.0-canary.3557",
     "@prisma/adapter-better-sqlite3": "7.10.1",
     "@prisma/client": "7.10.1",
     "@testing-library/dom": "10.4.2",
@@ -80,9 +80,9 @@
   },
   "peerDependencies": {
     "@apollo/client": "4.3.5",
-    "@cedarjs/auth": "8.0.0-canary.3553",
-    "@cedarjs/router": "8.0.0-canary.3553",
-    "@cedarjs/web": "8.0.0-canary.3553",
+    "@cedarjs/auth": "8.0.0-canary.3557",
+    "@cedarjs/router": "8.0.0-canary.3557",
+    "@cedarjs/web": "8.0.0-canary.3557",
     "@prisma/client": "7.10.1",
     "react": "19.3.1"
   },