@ddd-ts-kit/kernel 0.7.0 → 0.8.0

package/README.md

@@ -552,8 +552,13 @@ The authenticated session of an actor, as plain data.
 | `authenticationStrength?` | `{ mfa?, assuranceLevel? }` |
 | `impersonatedBy?` | id of the support actor acting as `actor`; `logFieldsOf` carries it to every log line |
 | `locale?`, `timeZone?`, `client?` | BCP 47 tag, IANA zone, `{ ip?, userAgent? }` as opaque strings |
+| `scopes?` | what the credential allows whoever presents it (the OAuth 2.0 `scope`): a limit on the client, never what the actor may do |
 | `extensions` | the fields of the project |
 
+`hasScope(session, scope)` reads the scopes; a project names its scope vocabulary once by
+declaration merging of `SessionScopes` (`interface SessionScopes { readonly 'invoices:read': true }`),
+and `SessionScope`, the type a guard takes, is then that vocabulary instead of any string.
+
 `isExpired(session, clock.now())`, `isImpersonated(session)`, `anonymousSession()`,
 `systemSession(name, issuedAt?)`, and `isSession(value)`, the structural guard a boundary uses on
 what it received as a principal.
@@ -561,8 +566,8 @@ what it received as a principal.
 ### ExecutionContext and ExecutionScope
 
 What every unit of work carries, whatever started it: `correlationId`, `causationId?`, `actor`,
-`session?`, `tenantId?`, `locale?`, `deadline?`, `scheduledAt?` (for a scheduled job, the instant it
-was due), `origin` (`http`, `event`, `schedule`, `cli`, or a string of the project) and `extensions`. `executionContext(init)` builds one and takes the tenant
+`session?`, `tenantId?`, `elevation?` (platform staff reading over tenants, see "Tenancy"),
+`locale?`, `deadline?`, `scheduledAt?` (for a scheduled job, the instant it was due), `origin` (`http`, `event`, `schedule`, `cli`, or a string of the project) and `extensions`. `executionContext(init)` builds one and takes the tenant
 of the actor; `withActor(context, actor)` is the same work seen as another actor.
 
 `ExecutionScope` (`current()`, `require()`, `run(context, work)`) gives the context of the work
@@ -584,11 +589,13 @@ tenant scoping and outgoing headers.
 
 A consumed event opens its own context: `executionContextOfEvent(event, { consumer })` has
 origin `event`, the correlation of the event (its id when it names none), the event as
-`causationId` and `systemActor(consumer)` as actor; `inEventScope(scope, { consumer }, handler)`
+`causationId`, `systemActor(consumer)` as actor and the `tenantId` of the event, so the
+consumer reads and writes in that tenant only; `inEventScope(scope, { consumer }, handler)`
 wraps a handler with it. The standard envelope carries no actor, so that no personal data
 travels by default: a project whose envelopes name one passes `actorOf`. On the way out,
-`scopedPublisher(publisher, scope)` stamps the correlation of the work in progress on every
-event published without one, so everything one stimulus causes is found again across processes.
+`scopedPublisher(publisher, scope)` stamps the correlation and the tenant of the work in
+progress on every event published without them, so everything one stimulus causes is found
+again across processes and stays in its tenant.
 
 `ActorContext` stays, unchanged. `ScopedActorContext` implements it on top of a scope: the
 current actor is the actor of the current execution context, so the two cannot disagree.
@@ -701,7 +708,8 @@ const hit: Quote | undefined = await cache.get(quoteKey('EUR-USD'));
 ```
 
 The key carries the type of its value. `InMemoryCache(clock, { maxEntries? })` expires by the
-`Clock` and is bounded.
+`Clock` and is bounded. `tenantCacheKey<Quote>(scope, 'quote', pair)` is the same key confined to
+the tenant of the work in progress: what one tenant cached is never served to another.
 
 ### Lock
 
@@ -748,9 +756,10 @@ instead of rejecting: only an unknown name rejects (`UnknownJobError`), and a na
 twice throws (`DuplicateJobError`).
 
 A run happens inside `ExecutionScope`, in the context `executionContextOfJob(name, { correlationId,
-scheduledAt, deadline? })` builds: origin `schedule`, `systemActor(name)`, a correlation of its
+scheduledAt, deadline?, tenantId? })` builds: origin `schedule`, `systemActor(name)`, a correlation of its
 own, and `scheduledAt`, the instant the run was due, which `ExecutionContext` carries for this
-origin.
+origin. A job is `global` by default and runs in no tenant; `tenancy: 'per-tenant'` makes the
+scheduler run it once per tenant of a `TenantDirectory`, each run in that tenant.
 
 `parseJobSchedule(schedule)` validates a schedule and answers the form occurrences are
 computed from (`InvalidJobScheduleError`, code `INVALID_JOB_SCHEDULE`, otherwise);
@@ -770,12 +779,36 @@ if (!decision.allowed) {
 
 A sliding window: at any instant, at most `limit` allowed calls in the `windowMs` before it. A
 `RateLimitDecision` is `{ allowed, remaining, retryAfterMs }`; a refused call is not counted.
-The key is whatever is limited: a client, a tenant, a route and an address together.
+The key is whatever is limited: a client, a tenant, a route and an address together. In a
+multi-tenant project, `tenantKey(scope, 'password-reset', accountId)` confines it to the tenant of
+the work in progress (`tenant:<id>:password-reset:<account>`) and refuses work that names none.
 
 `InMemoryRateLimiter(clock)` counts inside one process; the adapter shared by several instances
 is in `@ddd-ts-kit/redis`. `rateLimitDecisionOf(counted, limit)` turns what an adapter counted
 into the decision.
 
+### Tenancy
+
+The tenant of the work is `ExecutionContext.tenantId`, set at the boundary and read by
+infrastructure only, like the rest of the context. The kernel holds what every strategy shares;
+the isolation itself (tenant column, row-level security, schema or database per tenant) is in the
+persistence packages, and the whole picture in
+[Multitenancy](../../docs/concepts/multitenancy.md).
+
+| Concept | What it does |
+|---|---|
+| `isTenantId(value)`, `assertTenantId(id)`, `InvalidTenantIdError` | the one grammar of a tenant id (letters, digits, `_`, `-`, at most 63): `executionContext`, `executionContextOfEvent`, `acrossTenants`, `InMemoryTenantDirectory`, `tenantScopeOf`, `tenantReachOf` and the row-level security settings refuse any other, so that no tenant id can be read as a wildcard, a list or a key separator |
+| `tenantScopeOf(scope)` | the one tenant a write names; `NoCurrentTenantError` for work that names none |
+| `tenantReachOf(scope)` | what a read may see: `{ kind: 'tenant', tenantId }`, or `{ kind: 'elevated', tenants }` under an elevation |
+| `tenantsOf(actor)`, `isTenantMember(actor, tenantId)` | the tenants an actor belongs to: its `tenantId` and its `tenants` attribute |
+| `acrossTenants({ scope, trail, clock, ids }, { reason, tenants }, work)` | platform staff reading over tenants: refused without a reason or a tenant, recorded in the `AuditTrail` (action `tenancy:elevate`) before the work runs; writes still name one tenant |
+| `tenantKey(scope, ...segments)`, `tenantCacheKey(scope, ...segments)` | keys of rate limits, locks and caches confined to the tenant: `tenant:<id>:<segments>`, each segment percent-encoded, so that two lists of segments never give one key |
+| `TenantDirectory`, `InMemoryTenantDirectory` | the tenants that exist, for per-tenant jobs, provisioning and migrations |
+| `TENANT_SETTINGS`, `tenantSettingValues(context)`, `TENANT_ISOLATION_POLICIES`, `tenantPolicyExpressions(column)` | what the row-level security of the persistence packages shares: the three settings of a transaction (`ddd_ts_kit.tenant_id`, and for an elevation only `ddd_ts_kit.reach` and `ddd_ts_kit.every_tenant`), their values for the work in progress, the names of the four policies (one per command) and their `read` and `write` expressions |
+
+An elevation is never implied by a role: the platform decides the permission to elevate (a use
+case or a guard), then calls `acrossTenants`. A trail that fails to record it refuses it.
+
 ### Page and PageRequest
 
 One shape for every search, in two variants:

package/dist/application/audit/tenant-scope-of.d.ts

@@ -1,5 +1,8 @@
 import type { ExecutionScope } from '../ports/execution-scope.js';
 import type { TenantScoped } from './tenant-scoped.js';
-/** For a repository adapter scoping a statement: the tenant of the work in progress. */
+/**
+ * For a repository adapter scoping a statement: the tenant of the work in progress, checked
+ * against the grammar of `isTenantId` again however the context was built.
+ */
 export declare function tenantScopeOf(scope: ExecutionScope): TenantScoped;
 //# sourceMappingURL=tenant-scope-of.d.ts.map

package/dist/application/audit/tenant-scope-of.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope-of.d.ts","sourceRoot":"","sources":["../../../src/application/audit/tenant-scope-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,CAQjE"}
+{"version":3,"file":"tenant-scope-of.d.ts","sourceRoot":"","sources":["../../../src/application/audit/tenant-scope-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,CAQjE"}

package/dist/application/audit/tenant-scope-of.js

@@ -1,10 +1,14 @@
+import { assertTenantId } from '../tenancy/assert-tenant-id.js';
 import { NoCurrentTenantError } from './no-current-tenant-error.js';
-/** For a repository adapter scoping a statement: the tenant of the work in progress. */
+/**
+ * For a repository adapter scoping a statement: the tenant of the work in progress, checked
+ * against the grammar of `isTenantId` again however the context was built.
+ */
 export function tenantScopeOf(scope) {
     const { tenantId } = scope.require();
     if (tenantId === undefined) {
         throw new NoCurrentTenantError();
     }
-    return { tenantId };
+    return { tenantId: assertTenantId(tenantId) };
 }
 //# sourceMappingURL=tenant-scope-of.js.map

package/dist/application/audit/tenant-scope-of.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope-of.js","sourceRoot":"","sources":["../../../src/application/audit/tenant-scope-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAErC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"tenant-scope-of.js","sourceRoot":"","sources":["../../../src/application/audit/tenant-scope-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAErC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/dist/application/cache/tenant-cache-key.d.ts

@@ -0,0 +1,5 @@
+import type { ExecutionScope } from '../ports/execution-scope.js';
+import { type CacheKey } from './cache-key.js';
+/** `cacheKey` confined to the tenant of the work in progress: what one tenant cached is never served to another. */
+export declare function tenantCacheKey<T>(scope: ExecutionScope, ...segments: readonly string[]): CacheKey<T>;
+//# sourceMappingURL=tenant-cache-key.d.ts.map

package/dist/application/cache/tenant-cache-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-cache-key.d.ts","sourceRoot":"","sources":["../../../src/application/cache/tenant-cache-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,KAAK,QAAQ,EAAY,MAAM,gBAAgB,CAAC;AAEzD,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAEpG"}

package/dist/application/cache/tenant-cache-key.js

@@ -0,0 +1,7 @@
+import { tenantKey } from '../tenancy/tenant-key.js';
+import { cacheKey } from './cache-key.js';
+/** `cacheKey` confined to the tenant of the work in progress: what one tenant cached is never served to another. */
+export function tenantCacheKey(scope, ...segments) {
+    return cacheKey(tenantKey(scope, ...segments));
+}
+//# sourceMappingURL=tenant-cache-key.js.map

package/dist/application/cache/tenant-cache-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-cache-key.js","sourceRoot":"","sources":["../../../src/application/cache/tenant-cache-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAiB,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEzD,oHAAoH;AACpH,MAAM,UAAU,cAAc,CAAI,KAAqB,EAAE,GAAG,QAA2B;IACrF,OAAO,QAAQ,CAAI,SAAS,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/application/events/execution-context-of-event.d.ts

@@ -3,7 +3,8 @@ import type { EventExecutionOptions } from './event-execution-options.js';
 import type { IntegrationEvent } from './integration-event.js';
 /**
  * The execution context of a consumed event: origin `event`, the correlation of the event (its
- * own id when it names none, which starts a new chain), and the event as the direct cause.
+ * own id when it names none, which starts a new chain), the event as the direct cause, and the
+ * tenant the event belongs to, so the consumer reads and writes in that tenant only.
  */
 export declare function executionContextOfEvent(event: IntegrationEvent, options: EventExecutionOptions): ExecutionContext;
 //# sourceMappingURL=execution-context-of-event.d.ts.map

package/dist/application/events/execution-context-of-event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context-of-event.d.ts","sourceRoot":"","sources":["../../../src/application/events/execution-context-of-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,mCAAmC,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,qBAAqB,GAAG,gBAAgB,CAOjH"}
+{"version":3,"file":"execution-context-of-event.d.ts","sourceRoot":"","sources":["../../../src/application/events/execution-context-of-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,mCAAmC,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,qBAAqB,GAAG,gBAAgB,CAQjH"}

package/dist/application/events/execution-context-of-event.js

@@ -2,7 +2,8 @@ import { systemActor } from '../actor/system-actor.js';
 import { executionContext } from '../execution/execution-context.js';
 /**
  * The execution context of a consumed event: origin `event`, the correlation of the event (its
- * own id when it names none, which starts a new chain), and the event as the direct cause.
+ * own id when it names none, which starts a new chain), the event as the direct cause, and the
+ * tenant the event belongs to, so the consumer reads and writes in that tenant only.
  */
 export function executionContextOfEvent(event, options) {
     return executionContext({
@@ -10,6 +11,7 @@ export function executionContextOfEvent(event, options) {
         causationId: event.id,
         actor: options.actorOf?.(event) ?? systemActor(options.consumer),
         origin: 'event',
+        ...(event.tenantId === undefined ? {} : { tenantId: event.tenantId }),
     });
 }
 //# sourceMappingURL=execution-context-of-event.js.map

package/dist/application/events/execution-context-of-event.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context-of-event.js","sourceRoot":"","sources":["../../../src/application/events/execution-context-of-event.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAI5F;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB,EAAE,OAA8B;IAC7F,OAAO,gBAAgB,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,EAAE;QAC9C,WAAW,EAAE,KAAK,CAAC,EAAE;QACrB,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChE,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"execution-context-of-event.js","sourceRoot":"","sources":["../../../src/application/events/execution-context-of-event.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAI5F;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB,EAAE,OAA8B;IAC7F,OAAO,gBAAgB,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,EAAE;QAC9C,WAAW,EAAE,KAAK,CAAC,EAAE;QACrB,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChE,MAAM,EAAE,OAAO;QACf,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;KACtE,CAAC,CAAC;AACL,CAAC"}

package/dist/application/events/integration-event.d.ts

@@ -13,5 +13,11 @@ export interface IntegrationEvent<Payload = unknown> {
     /** W3C traceparent captured at publication so consumers continue the same trace. */
     readonly traceparent?: string;
     readonly correlationId?: string;
+    /**
+     * The tenant the fact belongs to, stamped from the work that published it. A consumer handles
+     * the event in that tenant's scope, so its reads and writes stay in the tenant. Absent for a
+     * fact of no tenant (the platform's own).
+     */
+    readonly tenantId?: string;
 }
 //# sourceMappingURL=integration-event.d.ts.map

package/dist/application/events/integration-event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration-event.d.ts","sourceRoot":"","sources":["../../../src/application/events/integration-event.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,gBAAgB,CAAC,OAAO,GAAG,OAAO;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC"}
+{"version":3,"file":"integration-event.d.ts","sourceRoot":"","sources":["../../../src/application/events/integration-event.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,gBAAgB,CAAC,OAAO,GAAG,OAAO;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/application/events/scoped-publisher.d.ts

@@ -2,9 +2,10 @@ import type { ExecutionScope } from '../ports/execution-scope.js';
 import type { IntegrationEventPublisher } from '../ports/integration-event-publisher.js';
 /**
  * Decorates a publisher: an event published without `correlationId` takes the one of the work
- * in progress, so everything one stimulus causes can be found again. An event that names its
- * correlation keeps it, and outside of any execution context nothing is stamped. The name of
- * the transport (`messagingSystem`) is passed on.
+ * in progress, so everything one stimulus causes can be found again, and one without `tenantId`
+ * the tenant of that work, so its consumers run in the same tenant. What an event names is
+ * kept, and outside of any execution context nothing is stamped. The name of the transport
+ * (`messagingSystem`) is passed on.
  */
 export declare function scopedPublisher(publisher: IntegrationEventPublisher, scope: ExecutionScope): IntegrationEventPublisher;
 //# sourceMappingURL=scoped-publisher.d.ts.map

package/dist/application/events/scoped-publisher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-publisher.d.ts","sourceRoot":"","sources":["../../../src/application/events/scoped-publisher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAIzF;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,yBAAyB,EACpC,KAAK,EAAE,cAAc,GACpB,yBAAyB,CAO3B"}
+{"version":3,"file":"scoped-publisher.d.ts","sourceRoot":"","sources":["../../../src/application/events/scoped-publisher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAIzF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,yBAAyB,EACpC,KAAK,EAAE,cAAc,GACpB,yBAAyB,CAO3B"}

package/dist/application/events/scoped-publisher.js

@@ -1,9 +1,10 @@
 import { messagingSystemOf } from './messaging-system-of.js';
 /**
  * Decorates a publisher: an event published without `correlationId` takes the one of the work
- * in progress, so everything one stimulus causes can be found again. An event that names its
- * correlation keeps it, and outside of any execution context nothing is stamped. The name of
- * the transport (`messagingSystem`) is passed on.
+ * in progress, so everything one stimulus causes can be found again, and one without `tenantId`
+ * the tenant of that work, so its consumers run in the same tenant. What an event names is
+ * kept, and outside of any execution context nothing is stamped. The name of the transport
+ * (`messagingSystem`) is passed on.
  */
 export function scopedPublisher(publisher, scope) {
     const messagingSystem = messagingSystemOf(publisher);
@@ -13,9 +14,14 @@ export function scopedPublisher(publisher, scope) {
     };
 }
 function correlated(event, context) {
-    if (event.correlationId !== undefined || context === undefined) {
+    if (context === undefined) {
         return event;
     }
-    return { ...event, correlationId: context.correlationId };
+    const { correlationId, tenantId } = context;
+    return {
+        ...event,
+        ...(event.correlationId === undefined ? { correlationId } : {}),
+        ...(event.tenantId === undefined && tenantId !== undefined ? { tenantId } : {}),
+    };
 }
 //# sourceMappingURL=scoped-publisher.js.map

package/dist/application/events/scoped-publisher.js.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-publisher.js","sourceRoot":"","sources":["../../../src/application/events/scoped-publisher.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAoC,EACpC,KAAqB;IAErB,MAAM,eAAe,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjG,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAuB,EAAE,OAAqC;IAChF,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"scoped-publisher.js","sourceRoot":"","sources":["../../../src/application/events/scoped-publisher.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAoC,EACpC,KAAqB;IAErB,MAAM,eAAe,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjG,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAuB,EAAE,OAAqC;IAChF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE5C,OAAO;QACL,GAAG,KAAK;QACR,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC;AACJ,CAAC"}

package/dist/application/execution/execution-context.d.ts

@@ -1,5 +1,6 @@
 import type { Actor } from '../actor/actor.js';
 import type { Session } from '../session/session.js';
+import type { TenantElevation } from '../tenancy/tenant-elevation.js';
 import type { ExecutionContextExtensionValues } from './execution-context-extension-values.js';
 import type { ExecutionOrigin } from './execution-origin.js';
 /**
@@ -14,6 +15,8 @@ export interface ExecutionContext {
     readonly actor: Actor;
     readonly session?: Session;
     readonly tenantId?: string;
+    /** Platform staff reading over tenants, opened by `acrossTenants` and audited. Absent otherwise. */
+    readonly elevation?: TenantElevation;
     readonly locale?: string;
     /** The instant after which the result is useless to the caller. */
     readonly deadline?: Date;
@@ -23,6 +26,9 @@ export interface ExecutionContext {
     readonly extensions: ExecutionContextExtensionValues;
 }
 export type ExecutionContextInit = Omit<ExecutionContext, 'extensions' | 'tenantId'> & Partial<Pick<ExecutionContext, 'extensions' | 'tenantId'>>;
-/** Fills what can be derived: the tenant of the actor, no extension. */
+/**
+ * Fills what can be derived: the tenant of the actor, no extension. A tenant id outside the
+ * grammar of `isTenantId` is refused (`InvalidTenantIdError`), whatever named it.
+ */
 export declare function executionContext(init: ExecutionContextInit): ExecutionContext;
 //# sourceMappingURL=execution-context.d.ts.map

package/dist/application/execution/execution-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context.d.ts","sourceRoot":"","sources":["../../../src/application/execution/execution-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IACzB,mGAAmG;IACnG,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;CACtD;AAED,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,UAAU,CAAC,GAClF,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC;AAE7D,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAQ7E"}
+{"version":3,"file":"execution-context.d.ts","sourceRoot":"","sources":["../../../src/application/execution/execution-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IACzB,mGAAmG;IACnG,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;CACtD;AAED,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,UAAU,CAAC,GAClF,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC;AAE7D;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAS7E"}

package/dist/application/execution/execution-context.js

@@ -1,6 +1,11 @@
-/** Fills what can be derived: the tenant of the actor, no extension. */
+import { assertTenantId } from '../tenancy/assert-tenant-id.js';
+/**
+ * Fills what can be derived: the tenant of the actor, no extension. A tenant id outside the
+ * grammar of `isTenantId` is refused (`InvalidTenantIdError`), whatever named it.
+ */
 export function executionContext(init) {
-    const tenantId = init.tenantId ?? init.actor.tenantId;
+    const named = init.tenantId ?? init.actor.tenantId;
+    const tenantId = named === undefined ? undefined : assertTenantId(named);
     return Object.freeze({
         ...init,
         ...(tenantId === undefined ? {} : { tenantId }),

package/dist/application/execution/execution-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context.js","sourceRoot":"","sources":["../../../src/application/execution/execution-context.ts"],"names":[],"mappings":"AA6BA,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,IAA0B;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;IAEtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,IAAI;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;KACjD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"execution-context.js","sourceRoot":"","sources":["../../../src/application/execution/execution-context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AA+BhE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA0B;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;IACnD,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAEzE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,IAAI;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;KACjD,CAAC,CAAC;AACL,CAAC"}

package/dist/application/execution/log-fields-of.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log-fields-of.d.ts","sourceRoot":"","sources":["../../../src/application/execution/log-fields-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAShE"}
+{"version":3,"file":"log-fields-of.d.ts","sourceRoot":"","sources":["../../../src/application/execution/log-fields-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAUhE"}

package/dist/application/execution/log-fields-of.js

@@ -6,6 +6,7 @@ export function logFieldsOf(context) {
         actorId: context.actor.id,
         ...(context.causationId === undefined ? {} : { causationId: context.causationId }),
         ...(context.tenantId === undefined ? {} : { tenantId: context.tenantId }),
+        ...(context.elevation === undefined ? {} : { elevation: context.elevation.reason }),
         ...(context.session?.impersonatedBy === undefined ? {} : { impersonatedBy: context.session.impersonatedBy }),
     };
 }

package/dist/application/execution/log-fields-of.js.map

@@ -1 +1 @@
-{"version":3,"file":"log-fields-of.js","sourceRoot":"","sources":["../../../src/application/execution/log-fields-of.ts"],"names":[],"mappings":"AAGA,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,OAAyB;IACnD,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;QACzB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;KAC7G,CAAC;AACJ,CAAC"}
+{"version":3,"file":"log-fields-of.js","sourceRoot":"","sources":["../../../src/application/execution/log-fields-of.ts"],"names":[],"mappings":"AAGA,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,OAAyB;IACnD,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;QACzB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;KAC7G,CAAC;AACJ,CAAC"}

package/dist/application/ports/tenant-directory.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The tenants that exist, for work that runs once per tenant: a job declared `tenancy:
+ * 'per-tenant'`, the provisioning of a schema or a database, a migration applied to each.
+ */
+export declare abstract class TenantDirectory {
+    abstract tenants(): Promise<readonly string[]>;
+}
+//# sourceMappingURL=tenant-directory.d.ts.map

package/dist/application/ports/tenant-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-directory.d.ts","sourceRoot":"","sources":["../../../src/application/ports/tenant-directory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,8BAAsB,eAAe;IAKnC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CAChD"}

package/dist/application/ports/tenant-directory.js

@@ -0,0 +1,10 @@
+/**
+ * The tenants that exist, for work that runs once per tenant: a job declared `tenancy:
+ * 'per-tenant'`, the provisioning of a schema or a database, a migration applied to each.
+ */
+export class TenantDirectory {
+    static {
+        Object.defineProperty(this, 'tokenKey', { value: 'kernel.TenantDirectory' });
+    }
+}
+//# sourceMappingURL=tenant-directory.js.map

package/dist/application/ports/tenant-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-directory.js","sourceRoot":"","sources":["../../../src/application/ports/tenant-directory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAgB,eAAe;IACnC;QACE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC/E,CAAC;CAGF"}

package/dist/application/scheduling/execution-context-of-job.d.ts

@@ -4,10 +4,12 @@ export interface JobExecutionStart {
     readonly scheduledAt: Date;
     /** The instant the timeout of the job ends the run, when it has one. */
     readonly deadline?: Date;
+    /** For a job declared `tenancy: 'per-tenant'`: the tenant of this run. */
+    readonly tenantId?: string;
 }
 /**
  * The execution context of one run: origin `schedule`, the system actor named after the job, a
- * correlation of its own and the instant the run was due.
+ * correlation of its own, the instant the run was due, and the tenant of a per-tenant run.
  */
 export declare function executionContextOfJob(job: string, start: JobExecutionStart): ExecutionContext;
 //# sourceMappingURL=execution-context-of-job.d.ts.map

package/dist/application/scheduling/execution-context-of-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context-of-job.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/execution-context-of-job.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,mCAAmC,CAAC;AAE5F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,gBAAgB,CAE7F"}
+{"version":3,"file":"execution-context-of-job.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/execution-context-of-job.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,mCAAmC,CAAC;AAE5F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,gBAAgB,CAE7F"}

package/dist/application/scheduling/execution-context-of-job.js

@@ -2,7 +2,7 @@ import { systemActor } from '../actor/system-actor.js';
 import { executionContext } from '../execution/execution-context.js';
 /**
  * The execution context of one run: origin `schedule`, the system actor named after the job, a
- * correlation of its own and the instant the run was due.
+ * correlation of its own, the instant the run was due, and the tenant of a per-tenant run.
  */
 export function executionContextOfJob(job, start) {
     return executionContext({ ...start, actor: systemActor(job), origin: 'schedule' });

package/dist/application/scheduling/execution-context-of-job.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context-of-job.js","sourceRoot":"","sources":["../../../src/application/scheduling/execution-context-of-job.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAS5F;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,KAAwB;IACzE,OAAO,gBAAgB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AACrF,CAAC"}
+{"version":3,"file":"execution-context-of-job.js","sourceRoot":"","sources":["../../../src/application/scheduling/execution-context-of-job.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAW5F;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,KAAwB;IACzE,OAAO,gBAAgB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/dist/application/scheduling/job-execution.d.ts

@@ -8,5 +8,7 @@ export interface JobExecution {
     readonly attempt: number;
     /** Aborted when the run exceeds its timeout or the scheduler stops: a long job checks it. */
     readonly signal: AbortSignal;
+    /** The tenant of this run, for a job declared `tenancy: 'per-tenant'`. */
+    readonly tenantId?: string;
 }
 //# sourceMappingURL=job-execution.d.ts.map

package/dist/application/scheduling/job-execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-execution.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-execution.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,yGAAyG;IACzG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B"}
+{"version":3,"file":"job-execution.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-execution.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,yGAAyG;IACzG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/application/scheduling/job-options.d.ts

@@ -21,5 +21,11 @@ export interface JobOptions {
      * an application running several runs it. Best effort: see the scheduler.
      */
     readonly singleInstance?: boolean;
+    /**
+     * `global` (default): one run per occurrence, in no tenant. `per-tenant`: one run per tenant
+     * of the `TenantDirectory` for each occurrence, each in that tenant's execution scope, so the
+     * job reads and writes one tenant at a time; one failing tenant does not stop the others.
+     */
+    readonly tenancy?: 'global' | 'per-tenant';
 }
 //# sourceMappingURL=job-options.d.ts.map

package/dist/application/scheduling/job-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-options.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-options.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sHAAsH;IACtH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,uGAAuG;IACvG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC"}
+{"version":3,"file":"job-options.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-options.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sHAAsH;IACtH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,uGAAuG;IACvG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC5C"}

package/dist/application/scheduling/job-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-policy.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,iDAAiD;AACjD,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAEhG,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,CAiBxD"}
+{"version":3,"file":"job-policy.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,iDAAiD;AACjD,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAEhG,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,CAmBxD"}

package/dist/application/scheduling/job-policy.js

@@ -3,15 +3,17 @@ import { parseDuration } from './parse-duration.js';
 /** Validates the options and fills in the defaults. Throws `InvalidJobScheduleError`. */
 export function jobPolicy(options) {
     const { overlap = 'skip', missed = 'skip', timeoutMs, jitterMs = 0, enabled = true, singleInstance = true } = options;
+    const tenancy = options.tenancy ?? 'global';
     assertOneOf('overlap', overlap, ['skip', 'queue']);
     assertOneOf('missed', missed, ['skip', 'run-once']);
+    assertOneOf('tenancy', tenancy, ['global', 'per-tenant']);
     if (!Number.isSafeInteger(jitterMs) || jitterMs < 0) {
         throw new InvalidJobScheduleError(`jitterMs is ${jitterMs}: a whole number of milliseconds, zero or more, is expected.`);
     }
     if (timeoutMs === undefined) {
-        return { overlap, missed, jitterMs, enabled, singleInstance };
+        return { overlap, missed, jitterMs, enabled, singleInstance, tenancy };
     }
-    return { overlap, missed, jitterMs, enabled, singleInstance, timeoutMs: parseDuration(timeoutMs) };
+    return { overlap, missed, jitterMs, enabled, singleInstance, tenancy, timeoutMs: parseDuration(timeoutMs) };
 }
 function assertOneOf(option, value, allowed) {
     if (allowed.includes(value)) {

package/dist/application/scheduling/job-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"job-policy.js","sourceRoot":"","sources":["../../../src/application/scheduling/job-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC3C,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,QAAQ,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAEtH,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAEpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,QAAQ,8DAA8D,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AACrG,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa,EAAE,OAA0B;IAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,uBAAuB,CAAC,GAAG,MAAM,QAAQ,KAAK,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC1G,CAAC"}
+{"version":3,"file":"job-policy.js","sourceRoot":"","sources":["../../../src/application/scheduling/job-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC3C,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,QAAQ,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACtH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;IAE5C,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACpD,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAE1D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,QAAQ,8DAA8D,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa,EAAE,OAA0B;IAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,uBAAuB,CAAC,GAAG,MAAM,QAAQ,KAAK,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC1G,CAAC"}

package/dist/application/session/has-scope.d.ts

@@ -0,0 +1,5 @@
+import type { SessionScope } from './session-scope.js';
+import type { Session } from './session.js';
+/** Whether the session was granted the scope; a request without a session was granted none. */
+export declare function hasScope(session: Session | undefined, scope: SessionScope): boolean;
+//# sourceMappingURL=has-scope.d.ts.map

package/dist/application/session/has-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-scope.d.ts","sourceRoot":"","sources":["../../../src/application/session/has-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,+FAA+F;AAC/F,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAEnF"}

package/dist/application/session/has-scope.js

@@ -0,0 +1,5 @@
+/** Whether the session was granted the scope; a request without a session was granted none. */
+export function hasScope(session, scope) {
+    return session?.scopes?.includes(scope) === true;
+}
+//# sourceMappingURL=has-scope.js.map

package/dist/application/session/has-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-scope.js","sourceRoot":"","sources":["../../../src/application/session/has-scope.ts"],"names":[],"mappings":"AAGA,+FAA+F;AAC/F,MAAM,UAAU,QAAQ,CAAC,OAA4B,EAAE,KAAmB;IACxE,OAAO,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACnD,CAAC"}

package/dist/application/session/session-scope.d.ts

@@ -0,0 +1,4 @@
+import type { SessionScopes } from './session-scopes.js';
+/** A scope of the project's vocabulary once `SessionScopes` declares one, any string before. */
+export type SessionScope = [keyof SessionScopes] extends [never] ? string : Extract<keyof SessionScopes, string>;
+//# sourceMappingURL=session-scope.d.ts.map

package/dist/application/session/session-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scope.d.ts","sourceRoot":"","sources":["../../../src/application/session/session-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,MAAM,CAAC,CAAC"}

package/dist/application/session/session-scope.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-scope.js.map

package/dist/application/session/session-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scope.js","sourceRoot":"","sources":["../../../src/application/session/session-scope.ts"],"names":[],"mappings":""}

package/dist/application/session/session-scopes.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The vocabulary of the scopes a project grants its clients, by declaration merging, so that a
+ * guard names only scopes that exist:
+ *
+ *     declare module '@ddd-ts-kit/kernel' {
+ *       interface SessionScopes { readonly 'invoices:read': true; readonly 'invoices:write': true }
+ *     }
+ */
+export interface SessionScopes {
+}
+//# sourceMappingURL=session-scopes.d.ts.map

package/dist/application/session/session-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scopes.d.ts","sourceRoot":"","sources":["../../../src/application/session/session-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;CAAG"}

package/dist/application/session/session-scopes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-scopes.js.map

package/dist/application/session/session-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scopes.js","sourceRoot":"","sources":["../../../src/application/session/session-scopes.ts"],"names":[],"mappings":""}

package/dist/application/session/session.d.ts

@@ -22,6 +22,12 @@ export interface Session {
     /** IANA time zone, for example `Europe/Paris`. */
     readonly timeZone?: string;
     readonly client?: SessionClient;
+    /**
+     * What the credential allows whoever presents it (the OAuth 2.0 `scope` of the token): a
+     * limit on the client, checked at the edge (`HasScope`), never what the actor may do, which
+     * stays a permission of the use case. Absent when the credential carries none.
+     */
+    readonly scopes?: readonly string[];
     readonly extensions: SessionExtensionValues;
 }
 //# sourceMappingURL=session.d.ts.map