@forklaunch/core 1.6.6 → 2.0.0

package/lib/persistence/encryptedType.d.ts

@@ -5,6 +5,45 @@ import type { FieldEncryptor } from './fieldEncryptor';
  * Call this once at application bootstrap (e.g., in mikro-orm.config.ts).
  */
 export declare function registerEncryptor(encryptor: FieldEncryptor): void;
+/**
+ * The empty string was offered as a tenant id.
+ *
+ * `''` used to mean "the global tenant", which made it impossible to tell a
+ * deliberate global row from a tenant that was never resolved — the two are
+ * the same key. Rows written by mistake under `''` read back fine from any
+ * other unbound path and fail only when a correctly-bound caller finally
+ * touches them, arbitrarily far from the code that caused it.
+ *
+ * Global rows need a tenant id you can name and search for — a constant like
+ * `'_internal'` that no organization can collide with. Pick one and pass it.
+ */
+export declare class EmptyTenantError extends Error {
+    constructor(api: string);
+}
+/**
+ * An encrypted column was read or written with no tenant bound.
+ *
+ * This is the failure the empty tenant used to hide. An unbound write
+ * encrypted under `''` and looked like it worked; the row then failed to
+ * decrypt for the tenant that owned it, and the stack trace pointed at the
+ * innocent reader. Failing here names the actual culprit: the write path
+ * that never bound a tenant.
+ *
+ * Bind one with `wrapEmWithTenantContext(em, tenantId)` in the DI
+ * `EntityManager` factory, or `withEncryptionContext(tenantId, fn)` around
+ * the work. A raw manager — `orm.em.fork()`, or the `__em` off a wrapped
+ * entity — escapes the proxy and arrives here unbound.
+ */
+export declare class UnboundTenantError extends Error {
+    constructor(operation: string);
+}
+/**
+ * Reject `''` at every door that binds a tenant.
+ *
+ * Exported so the binding helpers in this package share one rule, and so an
+ * application's own factory can apply the same one at its own boundary.
+ */
+export declare function assertBindableTenantId(tenantId: string, api: string): asserts tenantId is string;
 /**
  * Set the encryption tenant ID for the current async context.
  *
@@ -39,10 +78,24 @@ export declare function setEncryptionTenantId(tenantId: string): void;
  */
 export declare function withEncryptionContext<T>(tenantId: string, fn: () => T): T;
 /**
- * Get the current tenant ID. Returns empty string when no context is set
- * (startup, seeders, better-auth, background jobs).
+ * Get the current tenant ID, or the empty string when none is bound.
+ *
+ * @deprecated The empty string it returns when nothing is bound is the whole
+ * problem: "no tenant" and "the global tenant" became the same value, so an
+ * unbound write encrypted under `''` and surfaced as somebody else's decrypt
+ * failure. Encryption no longer reads through this — it uses the bound tenant
+ * and throws {@link UnboundTenantError} when there is none. Use
+ * {@link getBoundTenantId} and handle `undefined` explicitly.
  */
 export declare function getCurrentTenantId(): string;
+/**
+ * The tenant bound to the current async context, or `undefined` if none is.
+ *
+ * The distinction {@link getCurrentTenantId} cannot make: `undefined` is
+ * "nobody bound a tenant", which is a bug on any path that touches an
+ * encrypted column, and never a key.
+ */
+export declare function getBoundTenantId(): string | undefined;
 /**
  * Resolve a MikroORM type value (string, constructor, or instance) to a
  * Type instance. Returns undefined if unresolvable.

package/lib/persistence/encryptedType.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryptedType.d.ts","sourceRoot":"","sources":["../../src/persistence/encryptedType.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAoBvD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,cAAc,GAAG,IAAI,CAEjE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEzE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAMD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,GACZ,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,SAAS,CAWpC;AAwCD;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAc,SAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAI7D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAE5C;;;;;;OAMG;IACH,YACE,kBAAkB,GAAE,MAAiB,EACrC,OAAO,GAAE,OAAe,EACxB,UAAU,CAAC,EAAE,OAAO,EAAE,EAMvB;IAEQ,sBAAsB,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,QAAQ,EACnB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,MAAM,GAAG,IAAI,CA4Bf;IAEQ,gBAAgB,CACvB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,SAAS,EAAE,QAAQ,GAClB,OAAO,CA2BT;IAEQ,aAAa,IAAI,MAAM,CAE/B;IAED,IAAa,WAAW,IAAI,MAAM,CAGjC;IAEQ,gBAAgB,IAAI,OAAO,CAEnC;IAMD,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,WAAW;IAiCnB,OAAO,CAAC,YAAY;CAOrB"}
+{"version":3,"file":"encryptedType.d.ts","sourceRoot":"","sources":["../../src/persistence/encryptedType.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAoBvD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,cAAc,GAAG,IAAI,CAEjE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,GAAG,EAAE,MAAM,EAQtB;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,SAAS,EAAE,MAAM,EAQ5B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,QAAQ,IAAI,MAAM,CAI5B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAG5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAGzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAErD;AAeD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,GACZ,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,SAAS,CAWpC;AAwCD;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAc,SAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAI7D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAE5C;;;;;;OAMG;IACH,YACE,kBAAkB,GAAE,MAAiB,EACrC,OAAO,GAAE,OAAe,EACxB,UAAU,CAAC,EAAE,OAAO,EAAE,EAMvB;IAEQ,sBAAsB,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,QAAQ,EACnB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,MAAM,GAAG,IAAI,CAmCf;IAEQ,gBAAgB,CACvB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,SAAS,EAAE,QAAQ,GAClB,OAAO,CA2BT;IAEQ,aAAa,IAAI,MAAM,CAE/B;IAED,IAAa,WAAW,IAAI,MAAM,CAGjC;IAEQ,gBAAgB,IAAI,OAAO,CAEnC;IAMD,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,WAAW;IAiCnB,OAAO,CAAC,YAAY;CAOrB"}

package/lib/persistence/index.d.ts

@@ -4,7 +4,7 @@ export { asEncryptionSafe, type ContextFreeKeysOfSchema, type ContextFreeReadOpt
 export { fp } from './compliancePropertyBuilder';
 export { defineComplianceEntity } from './defineComplianceEntity';
 export { wrapEmWithNativeQueryBlocking } from './complianceEventSubscriber';
-export { EncryptedType, registerEncryptor, setEncryptionTenantId, withEncryptionContext, getCurrentTenantId } from './encryptedType';
+export { EncryptedType, registerEncryptor, setEncryptionTenantId, withEncryptionContext, getCurrentTenantId, getBoundTenantId, assertBindableTenantId, EmptyTenantError, UnboundTenantError } from './encryptedType';
 export { FieldEncryptor, MissingEncryptionKeyError, DecryptionError, EncryptionRequiredError, parseEncryptionKeyList, encryptionKeyId, stampedKeyId, stampedPrefix, isEncryptedCiphertext, ENCRYPTED_PREFIXES, ENCRYPTION_FORMAT_ENV, ENCRYPTION_KEY_ENV, LEGACY_ENCRYPTION_KEYS_ENV, LEGACY_ENCRYPTION_KEY_ENV, type FieldEncryptorOptions, type OpenedCiphertext, type CiphertextFormat } from './fieldEncryptor';
 export { reencryptEncryptedColumns, classifyEncryptedValue, collectFallbackTenantIds, defaultTenantIdsFor, entityMetadataList, rotationTotals, countValuesByKeyId, isEncryptedValue, type ReencryptOptions, type RotationOutcome, type RotationTableReport, type SqlExecute, type EntityMetadataLike } from './keyRotation';
 export { setupTenantFilter, getSuperAdminContext, createTenantFilterDef, TENANT_FILTER_NAME } from './tenantFilter';

package/lib/persistence/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/persistence/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EAExB,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,eAAe,EACpB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,KAAK,cAAc,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACrC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,6BAA6B,EAC7B,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACrC,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAGjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAG5E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAErE,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/persistence/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EAExB,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,eAAe,EACpB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,KAAK,cAAc,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACrC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,6BAA6B,EAC7B,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACrC,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAGjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAG5E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAErE,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC"}

package/lib/persistence/index.js

@@ -35,6 +35,7 @@ __export(persistence_exports, {
   ENCRYPTED_PREFIXES: () => ENCRYPTED_PREFIXES2,
   ENCRYPTION_FORMAT_ENV: () => ENCRYPTION_FORMAT_ENV,
   ENCRYPTION_KEY_ENV: () => ENCRYPTION_KEY_ENV,
+  EmptyTenantError: () => EmptyTenantError,
   EncryptedType: () => EncryptedType,
   EncryptionRequiredError: () => EncryptionRequiredError,
   FieldEncryptor: () => FieldEncryptor,
@@ -45,7 +46,9 @@ __export(persistence_exports, {
   RetentionDuration: () => RetentionDuration,
   RlsEventSubscriber: () => RlsEventSubscriber,
   TENANT_FILTER_NAME: () => TENANT_FILTER_NAME,
+  UnboundTenantError: () => UnboundTenantError,
   asEncryptionSafe: () => asEncryptionSafe,
+  assertBindableTenantId: () => assertBindableTenantId,
   classifyEncryptedValue: () => classifyEncryptedValue,
   collectFallbackTenantIds: () => collectFallbackTenantIds,
   countValuesByKeyId: () => countValuesByKeyId,
@@ -58,6 +61,7 @@ __export(persistence_exports, {
   fp: () => fp,
   getAllRetentionPolicies: () => getAllRetentionPolicies,
   getAllUserIdFields: () => getAllUserIdFields,
+  getBoundTenantId: () => getBoundTenantId,
   getComplianceMetadata: () => getComplianceMetadata,
   getCurrentTenantId: () => getCurrentTenantId,
   getEntityComplianceFields: () => getEntityComplianceFields,
@@ -261,15 +265,48 @@ var _tenantContext = new import_node_async_hooks.AsyncLocalStorage();
 function registerEncryptor(encryptor) {
   _encryptor = encryptor;
 }
+var EmptyTenantError = class extends Error {
+  constructor(api) {
+    super(
+      `${api}: '' is not a tenant id. It used to mean "global", which made a deliberate global row indistinguishable from a tenant nobody resolved. Bind an explicit constant (for example '_internal') for rows that genuinely belong to no organization.`
+    );
+    this.name = "EmptyTenantError";
+  }
+};
+var UnboundTenantError = class extends Error {
+  constructor(operation) {
+    super(
+      `Cannot ${operation} an encrypted column with no tenant bound. Wrap the work in withEncryptionContext(tenantId, fn), or take the entity manager from a factory that calls wrapEmWithTenantContext. A raw em.fork() (or wrap(entity).__em) escapes the tenant proxy.`
+    );
+    this.name = "UnboundTenantError";
+  }
+};
+function assertBindableTenantId(tenantId, api) {
+  if (tenantId === "") {
+    throw new EmptyTenantError(api);
+  }
+}
 function setEncryptionTenantId(tenantId) {
+  assertBindableTenantId(tenantId, "setEncryptionTenantId");
   _tenantContext.enterWith({ tenantId });
 }
 function withEncryptionContext(tenantId, fn) {
+  assertBindableTenantId(tenantId, "withEncryptionContext");
   return _tenantContext.run({ tenantId }, fn);
 }
 function getCurrentTenantId() {
   return _tenantContext.getStore()?.tenantId ?? "";
 }
+function getBoundTenantId() {
+  return _tenantContext.getStore()?.tenantId;
+}
+function requireBoundTenantId(operation) {
+  const tenantId = _tenantContext.getStore()?.tenantId;
+  if (tenantId === void 0 || tenantId === "") {
+    throw new UnboundTenantError(operation);
+  }
+  return tenantId;
+}
 function resolveTypeInstance(type) {
   if (type instanceof import_core.Type) return type;
   if (typeof type === "function") {
@@ -343,7 +380,7 @@ var EncryptedType = class extends import_core.Type {
       return value;
     }
     const serialized = this.serialize(value);
-    return _encryptor.encrypt(serialized, getCurrentTenantId()) ?? serialized;
+    return _encryptor.encrypt(serialized, requireBoundTenantId("write")) ?? serialized;
   }
   convertToJSValue(value, _platform) {
     if (value === null || value === void 0) return null;
@@ -357,7 +394,7 @@ var EncryptedType = class extends import_core.Type {
       );
     }
     let decrypted;
-    const tenantId = getCurrentTenantId();
+    const tenantId = requireBoundTenantId("read");
     try {
       decrypted = _encryptor.decrypt(value, tenantId);
     } catch (err) {
@@ -1280,9 +1317,8 @@ function wrapEmWithTenantContext(em, tenantId) {
   if (tenantId === void 0) {
     return em;
   }
-  if (tenantId) {
-    em.setFilterParams("tenant", { tenantId });
-  }
+  assertBindableTenantId(tenantId, "wrapEmWithTenantContext");
+  em.setFilterParams("tenant", { tenantId });
   const proxy = new Proxy(em, {
     get(target, prop, receiver) {
       const value = Reflect.get(target, prop, receiver);
@@ -1294,23 +1330,14 @@ function wrapEmWithTenantContext(em, tenantId) {
           tenantId,
           () => value.apply(target, args)
         );
-        return rebind(result, target, proxy, tenantId);
+        return rebind(result, target, proxy);
       };
     }
   });
   return proxy;
 }
-function rebind(result, target, proxy, tenantId) {
-  if (result === target) {
-    return proxy;
-  }
-  if (isEntityManager(result) && result !== proxy) {
-    return wrapEmWithTenantContext(result, tenantId);
-  }
-  return result;
-}
-function isEntityManager(value) {
-  return typeof value === "object" && value !== null && "fork" in value && typeof value.fork === "function" && "flush" in value && typeof value.flush === "function" && "persist" in value && typeof value.persist === "function";
+function rebind(result, target, proxy) {
+  return result === target ? proxy : result;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -1319,6 +1346,7 @@ function isEntityManager(value) {
   ENCRYPTED_PREFIXES,
   ENCRYPTION_FORMAT_ENV,
   ENCRYPTION_KEY_ENV,
+  EmptyTenantError,
   EncryptedType,
   EncryptionRequiredError,
   FieldEncryptor,
@@ -1329,7 +1357,9 @@ function isEntityManager(value) {
   RetentionDuration,
   RlsEventSubscriber,
   TENANT_FILTER_NAME,
+  UnboundTenantError,
   asEncryptionSafe,
+  assertBindableTenantId,
   classifyEncryptedValue,
   collectFallbackTenantIds,
   countValuesByKeyId,
@@ -1342,6 +1372,7 @@ function isEntityManager(value) {
   fp,
   getAllRetentionPolicies,
   getAllUserIdFields,
+  getBoundTenantId,
   getComplianceMetadata,
   getCurrentTenantId,
   getEntityComplianceFields,