@loomwork/event-runtime 0.0.0-stage → 0.1.0

package/dist/SubscriberRegistry.d.ts

@@ -0,0 +1,59 @@
+import type { EventEnvelope } from "@loomwork/core";
+/**
+ * The backend-independent half of `EventStore.subscribe` (ADR 0074 D4).
+ *
+ * Every store has to do the same three things: keep a per-execution set of local handlers,
+ * fan an event out to them, and — for stores whose transport echoes an append back to its
+ * own publisher — ignore what it published itself. That was written three times
+ * (in-memory, SQLite, Postgres) before this existed.
+ *
+ * What it deliberately does NOT do is decide how events arrive. That is the genuinely
+ * backend-specific part: a global channel, a per-bucket channel, a Redis topic, a Kafka
+ * partition. {@link interest} exists so a transport can ask "what am I actually subscribed
+ * to?" and narrow what it asks for upstream instead of receiving everything and
+ * discarding — the difference between broadcast delivery and interest-filtered delivery.
+ *
+ * A bring-your-own backend composes this and implements only the transport.
+ */
+export declare class SubscriberRegistry {
+    private readonly handlers;
+    /**
+     * Fires when an execution gains its first handler or loses its last, so a transport can
+     * subscribe/unsubscribe upstream in step. Both arguments are supplied so a transport can
+     * work at whatever granularity it uses (per-execution, per-bucket).
+     */
+    private readonly onInterestChange;
+    constructor(options?: {
+        onInterestChange?: (executionId: string, kind: "first" | "last") => void;
+    });
+    /**
+     * Register a local handler. Returns an unsubscribe that removes it and, when it was the
+     * last for that execution, drops the entry (so {@link interest} stays tight).
+     */
+    add(executionId: string, handler: (event: EventEnvelope) => void): () => void;
+    /** Whether anything local cares about this execution. The transport's filter predicate. */
+    has(executionId: string): boolean;
+    /** The executions with at least one local handler — this node's interest set. */
+    interest(): string[];
+    /** Number of executions currently subscribed (not the number of handlers). */
+    get size(): number;
+    /**
+     * Fan an event out to local handlers. Synchronous, matching the store contract that a
+     * same-process subscriber sees the event as part of the append.
+     *
+     * Iterates a COPY: a handler that unsubscribes (or subscribes) during delivery must not
+     * perturb the set being walked.
+     */
+    emit(event: EventEnvelope): void;
+    /** Drop every subscription. Used by `close()`. */
+    clear(): void;
+}
+/**
+ * Map an executionId onto one of `buckets` channels, for transports that cannot afford a
+ * channel per execution but must not broadcast everything either (ADR 0074 D4).
+ *
+ * FNV-1a over the id: stable across processes and restarts — which is required, since two
+ * nodes must agree on which bucket an execution lives in — and dependency-free.
+ */
+export declare function bucketOf(executionId: string, buckets: number): number;
+//# sourceMappingURL=SubscriberRegistry.d.ts.map

package/dist/SubscriberRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriberRegistry.d.ts","sourceRoot":"","sources":["../src/SubscriberRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0D;IACnF;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAEnB;gBAGZ,OAAO,GAAE;QAAE,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,KAAK,IAAI,CAAA;KAAO;IAK5F;;;OAGG;IACH,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI;IAyB7E,2FAA2F;IAC3F,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIjC,iFAAiF;IACjF,QAAQ,IAAI,MAAM,EAAE;IAIpB,8EAA8E;IAC9E,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;IAMhC,kDAAkD;IAClD,KAAK,IAAI,IAAI;CAGd;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CASrE"}

package/dist/SubscriberRegistry.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubscriberRegistry = void 0;
+exports.bucketOf = bucketOf;
+/**
+ * The backend-independent half of `EventStore.subscribe` (ADR 0074 D4).
+ *
+ * Every store has to do the same three things: keep a per-execution set of local handlers,
+ * fan an event out to them, and — for stores whose transport echoes an append back to its
+ * own publisher — ignore what it published itself. That was written three times
+ * (in-memory, SQLite, Postgres) before this existed.
+ *
+ * What it deliberately does NOT do is decide how events arrive. That is the genuinely
+ * backend-specific part: a global channel, a per-bucket channel, a Redis topic, a Kafka
+ * partition. {@link interest} exists so a transport can ask "what am I actually subscribed
+ * to?" and narrow what it asks for upstream instead of receiving everything and
+ * discarding — the difference between broadcast delivery and interest-filtered delivery.
+ *
+ * A bring-your-own backend composes this and implements only the transport.
+ */
+class SubscriberRegistry {
+    handlers = new Map();
+    /**
+     * Fires when an execution gains its first handler or loses its last, so a transport can
+     * subscribe/unsubscribe upstream in step. Both arguments are supplied so a transport can
+     * work at whatever granularity it uses (per-execution, per-bucket).
+     */
+    onInterestChange;
+    constructor(options = {}) {
+        this.onInterestChange = options.onInterestChange;
+    }
+    /**
+     * Register a local handler. Returns an unsubscribe that removes it and, when it was the
+     * last for that execution, drops the entry (so {@link interest} stays tight).
+     */
+    add(executionId, handler) {
+        let set = this.handlers.get(executionId);
+        const isFirst = set === undefined;
+        if (set === undefined) {
+            set = new Set();
+            this.handlers.set(executionId, set);
+        }
+        set.add(handler);
+        if (isFirst)
+            this.onInterestChange?.(executionId, "first");
+        let removed = false;
+        return () => {
+            // Idempotent: a caller may unsubscribe twice, and must not then fire "last" twice or
+            // tear down a subscription a later subscriber re-established.
+            if (removed)
+                return;
+            removed = true;
+            const current = this.handlers.get(executionId);
+            if (current === undefined)
+                return;
+            current.delete(handler);
+            if (current.size === 0) {
+                this.handlers.delete(executionId);
+                this.onInterestChange?.(executionId, "last");
+            }
+        };
+    }
+    /** Whether anything local cares about this execution. The transport's filter predicate. */
+    has(executionId) {
+        return this.handlers.has(executionId);
+    }
+    /** The executions with at least one local handler — this node's interest set. */
+    interest() {
+        return [...this.handlers.keys()];
+    }
+    /** Number of executions currently subscribed (not the number of handlers). */
+    get size() {
+        return this.handlers.size;
+    }
+    /**
+     * Fan an event out to local handlers. Synchronous, matching the store contract that a
+     * same-process subscriber sees the event as part of the append.
+     *
+     * Iterates a COPY: a handler that unsubscribes (or subscribes) during delivery must not
+     * perturb the set being walked.
+     */
+    emit(event) {
+        const set = this.handlers.get(event.executionId);
+        if (set === undefined || set.size === 0)
+            return;
+        for (const handler of [...set])
+            handler(event);
+    }
+    /** Drop every subscription. Used by `close()`. */
+    clear() {
+        this.handlers.clear();
+    }
+}
+exports.SubscriberRegistry = SubscriberRegistry;
+/**
+ * Map an executionId onto one of `buckets` channels, for transports that cannot afford a
+ * channel per execution but must not broadcast everything either (ADR 0074 D4).
+ *
+ * FNV-1a over the id: stable across processes and restarts — which is required, since two
+ * nodes must agree on which bucket an execution lives in — and dependency-free.
+ */
+function bucketOf(executionId, buckets) {
+    if (buckets <= 1)
+        return 0;
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < executionId.length; i++) {
+        hash ^= executionId.charCodeAt(i);
+        // 32-bit FNV prime multiply via shifts; `>>> 0` keeps it unsigned.
+        hash = (hash + ((hash << 1) + (hash << 4) + (hash << 7) + (hash << 8) + (hash << 24))) >>> 0;
+    }
+    return hash % buckets;
+}
+//# sourceMappingURL=SubscriberRegistry.js.map

package/dist/SubscriberRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriberRegistry.js","sourceRoot":"","sources":["../src/SubscriberRegistry.ts"],"names":[],"mappings":";;;AAyGA,4BASC;AAhHD;;;;;;;;;;;;;;;GAeG;AACH,MAAa,kBAAkB;IACZ,QAAQ,GAAG,IAAI,GAAG,EAA+C,CAAC;IACnF;;;;OAIG;IACc,gBAAgB,CAEnB;IAEd,YACE,UAAwF,EAAE;QAE1F,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,WAAmB,EAAE,OAAuC;QAC9D,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,OAAO;YAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,OAAO,GAAG,EAAE;YACV,qFAAqF;YACrF,8DAA8D;YAC9D,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO;YAClC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAClC,IAAI,CAAC,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,GAAG,CAAC,WAAmB;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED,iFAAiF;IACjF,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAoB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAChD,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,kDAAkD;IAClD,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF;AA9ED,gDA8EC;AAED;;;;;;GAMG;AACH,SAAgB,QAAQ,CAAC,WAAmB,EAAE,OAAe;IAC3D,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3B,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,mEAAmE;QACnE,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,IAAI,GAAG,OAAO,CAAC;AACxB,CAAC"}

package/dist/TenantScopedArchiveStore.d.ts

@@ -0,0 +1,36 @@
+import type { ArchiveExecutionPage, ArchiveSegment, ArchiveSegmentHeader, ArchiveStore } from "./archiveSpi";
+/**
+ * ADR 0138 H3 - the archive half of tenant scoping (see `TenantScopedEventStore`). Key-prefixes the
+ * executionId so a `LogLifecycle` over a tenant-scoped event store, given a shared archive, can only
+ * address its own tenant's segments: another tenant's history cannot be read, extended, or (on the
+ * plain-delete retention path) deleted, by construction. `LogLifecycle.compact` REFUSES a tenant-scoped
+ * event store paired with an archive that is not scoped to the SAME tenant (`tenantScope` is the marker).
+ *
+ * The sealing markers of a wrapped `EncryptingArchiveStore` (`keys`, `sealsSegments`, `subjectOf`)
+ * are forwarded, so the erasure-boundary guard sees through this decorator.
+ */
+export declare class TenantScopedArchiveStore implements ArchiveStore {
+    private readonly inner;
+    private readonly tenant;
+    readonly deleteExecution?: NonNullable<ArchiveStore["deleteExecution"]>;
+    readonly replaceSegments?: NonNullable<ArchiveStore["replaceSegments"]>;
+    constructor(inner: ArchiveStore, tenant: string);
+    /** Structural marker: the tenant this archive is scoped to (read by `LogLifecycle.compact`). */
+    get tenantScope(): string;
+    get keys(): unknown;
+    get sealsSegments(): unknown;
+    get subjectOf(): unknown;
+    private scope;
+    append(executionId: string, segment: ArchiveSegment): Promise<void>;
+    headers(executionId: string): Promise<ArchiveSegmentHeader[]>;
+    read(executionId: string, range?: {
+        readonly from?: number;
+        readonly through?: number;
+    }): Promise<ArchiveSegment[]>;
+    listExecutions(opts?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<ArchiveExecutionPage>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=TenantScopedArchiveStore.d.ts.map

package/dist/TenantScopedArchiveStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantScopedArchiveStore.d.ts","sourceRoot":"","sources":["../src/TenantScopedArchiveStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,cAAc,CAAC;AAKtB;;;;;;;;;GASG;AACH,qBAAa,wBAAyB,YAAW,YAAY;IAKzD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,QAAQ,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxE,QAAQ,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAGrD,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM;IAkBjC,gGAAgG;IAChG,IAAI,WAAW,IAAI,MAAM,CAExB;IACD,IAAI,IAAI,IAAI,OAAO,CAElB;IACD,IAAI,aAAa,IAAI,OAAO,CAE3B;IACD,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,OAAO,CAAC,KAAK;IAIb,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAI7D,IAAI,CACF,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5D,OAAO,CAAC,cAAc,EAAE,CAAC;IAItB,cAAc,CAClB,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7C,OAAO,CAAC,oBAAoB,CAAC;IA+BhC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAGvB"}

package/dist/TenantScopedArchiveStore.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantScopedArchiveStore = void 0;
+const executionIdOrder_1 = require("./executionIdOrder");
+const SEP = ":"; // the same tenant separator as TenantScopedEventStore / TenantScopedSnapshotStore
+/**
+ * ADR 0138 H3 - the archive half of tenant scoping (see `TenantScopedEventStore`). Key-prefixes the
+ * executionId so a `LogLifecycle` over a tenant-scoped event store, given a shared archive, can only
+ * address its own tenant's segments: another tenant's history cannot be read, extended, or (on the
+ * plain-delete retention path) deleted, by construction. `LogLifecycle.compact` REFUSES a tenant-scoped
+ * event store paired with an archive that is not scoped to the SAME tenant (`tenantScope` is the marker).
+ *
+ * The sealing markers of a wrapped `EncryptingArchiveStore` (`keys`, `sealsSegments`, `subjectOf`)
+ * are forwarded, so the erasure-boundary guard sees through this decorator.
+ */
+class TenantScopedArchiveStore {
+    inner;
+    tenant;
+    deleteExecution;
+    replaceSegments;
+    constructor(inner, tenant) {
+        this.inner = inner;
+        this.tenant = tenant;
+        if (tenant === "" || tenant.includes(SEP)) {
+            throw new TypeError(`TenantScopedArchiveStore: tenant must be non-empty and must not contain the separator "${SEP}" (got ${JSON.stringify(tenant)})`);
+        }
+        const innerDelete = inner.deleteExecution;
+        if (innerDelete !== undefined) {
+            this.deleteExecution = (id) => innerDelete.call(inner, this.scope(id));
+        }
+        const innerReplace = inner.replaceSegments;
+        if (innerReplace !== undefined) {
+            this.replaceSegments = (id, expected, next) => innerReplace.call(inner, this.scope(id), expected, next);
+        }
+    }
+    /** Structural marker: the tenant this archive is scoped to (read by `LogLifecycle.compact`). */
+    get tenantScope() {
+        return this.tenant;
+    }
+    get keys() {
+        return this.inner.keys;
+    }
+    get sealsSegments() {
+        return this.inner.sealsSegments;
+    }
+    get subjectOf() {
+        return this.inner.subjectOf;
+    }
+    scope(id) {
+        return `${this.tenant}${SEP}${id}`;
+    }
+    append(executionId, segment) {
+        return this.inner.append(this.scope(executionId), segment);
+    }
+    headers(executionId) {
+        return this.inner.headers(this.scope(executionId));
+    }
+    read(executionId, range) {
+        return this.inner.read(this.scope(executionId), range);
+    }
+    async listExecutions(opts = {}) {
+        const prefix = `${this.tenant}${SEP}`;
+        // Seek to the tenant's contiguous id range, and stop at the first id past it.
+        let cursor = opts.cursor === undefined ? `${this.tenant}9\u{10FFFF}` : `${prefix}${opts.cursor}`;
+        for (;;) {
+            const page = await this.inner.listExecutions({
+                cursor,
+                ...(opts.limit !== undefined && { limit: opts.limit }),
+            });
+            const executionIds = [];
+            let past = false;
+            for (const id of page.executionIds) {
+                if (id.startsWith(prefix))
+                    executionIds.push(id.slice(prefix.length));
+                else if ((0, executionIdOrder_1.compareExecutionIds)(id, prefix) > 0) {
+                    past = true;
+                    break;
+                }
+            }
+            if (past || page.nextCursor === undefined)
+                return { executionIds };
+            const last = executionIds[executionIds.length - 1];
+            if (last !== undefined)
+                return { executionIds, nextCursor: last };
+            if (page.nextCursor === cursor) {
+                throw new TypeError("TenantScopedArchiveStore: listExecutions returned a non-advancing cursor");
+            }
+            cursor = page.nextCursor;
+        }
+    }
+    close() {
+        return this.inner.close();
+    }
+}
+exports.TenantScopedArchiveStore = TenantScopedArchiveStore;
+//# sourceMappingURL=TenantScopedArchiveStore.js.map

package/dist/TenantScopedArchiveStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantScopedArchiveStore.js","sourceRoot":"","sources":["../src/TenantScopedArchiveStore.ts"],"names":[],"mappings":";;;AAMA,yDAAyD;AAEzD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,kFAAkF;AAEnG;;;;;;;;;GASG;AACH,MAAa,wBAAwB;IAKhB;IACA;IALV,eAAe,CAAgD;IAC/D,eAAe,CAAgD;IAExE,YACmB,KAAmB,EACnB,MAAc;QADd,UAAK,GAAL,KAAK,CAAc;QACnB,WAAM,GAAN,MAAM,CAAQ;QAE/B,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CACjB,0FAA0F,GAAG,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CACjI,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,CAAC;QAC1C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC;QAC3C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAC5C,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,IAAI,IAAI;QACN,OAAQ,IAAI,CAAC,KAA4B,CAAC,IAAI,CAAC;IACjD,CAAC;IACD,IAAI,aAAa;QACf,OAAQ,IAAI,CAAC,KAAqC,CAAC,aAAa,CAAC;IACnE,CAAC;IACD,IAAI,SAAS;QACX,OAAQ,IAAI,CAAC,KAAiC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,CAAC,WAAmB,EAAE,OAAuB;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,CAAC,WAAmB;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CACF,WAAmB,EACnB,KAA6D;QAE7D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,OAA4C,EAAE;QAE9C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,8EAA8E;QAC9E,IAAI,MAAM,GACR,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACtF,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC3C,MAAM;gBACN,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;aACvD,CAAC,CAAC;YACH,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;qBACjE,IAAI,IAAA,sCAAmB,EAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7C,IAAI,GAAG,IAAI,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAClE,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AA7FD,4DA6FC"}

package/dist/TenantScopedEventStore.d.ts

@@ -0,0 +1,59 @@
+import type { EventEnvelope } from "@loomwork/core";
+import type { EventStore } from "./types";
+/**
+ * K12.5 — a tenant-scoped view of a shared {@link EventStore}. Every execution
+ * id is key-prefixed with the tenant on the way in and un-prefixed on the way
+ * out, so a store scoped to tenant A can only ever ADDRESS keys under A —
+ * reading or subscribing to tenant B's executions is impossible **by
+ * construction**, not by a filter that could be bypassed. The app sees its own
+ * unprefixed ids throughout (append/read/subscribe/fork all round-trip).
+ *
+ * Default scoping mechanism per the amendment (A7): key-prefixing. Postgres
+ * row-level security is an optional hardening layer on top, not a replacement.
+ */
+export declare class TenantScopedEventStore implements EventStore {
+    private readonly inner;
+    private readonly tenant;
+    readonly appendBatch?: NonNullable<EventStore["appendBatch"]>;
+    readonly head?: NonNullable<EventStore["head"]>;
+    readonly readRange?: NonNullable<EventStore["readRange"]>;
+    readonly acquireFence?: NonNullable<EventStore["acquireFence"]>;
+    readonly acquireFenceIf?: NonNullable<EventStore["acquireFenceIf"]>;
+    readonly appendIfUnchanged?: NonNullable<EventStore["appendIfUnchanged"]>;
+    readonly storeNow?: NonNullable<EventStore["storeNow"]>;
+    readonly sealingCapability?: NonNullable<EventStore["sealingCapability"]>;
+    readonly readAtRest?: NonNullable<EventStore["readAtRest"]>;
+    readonly copyPrefix?: NonNullable<EventStore["copyPrefix"]>;
+    readonly deleteExecution?: NonNullable<EventStore["deleteExecution"]>;
+    readonly deleteThrough?: NonNullable<EventStore["deleteThrough"]>;
+    readonly truncatePrefix?: NonNullable<EventStore["truncatePrefix"]>;
+    readonly truncatePrefixKeeping?: NonNullable<EventStore["truncatePrefixKeeping"]>;
+    readonly listExecutions?: NonNullable<EventStore["listExecutions"]>;
+    readonly listExecutionsPage?: NonNullable<EventStore["listExecutionsPage"]>;
+    constructor(inner: EventStore, tenant: string);
+    /** Structural marker: the tenant this view is scoped to (`LogLifecycle.compact` pairs it with the archive's). */
+    get tenantScope(): string;
+    private scope;
+    /** Rewrite a stored envelope's scoped executionId/id back to the app's view. */
+    private unscope;
+    /** Prefix an envelope for storage under the tenant scope. */
+    private scopeEnvelope;
+    append(envelope: EventEnvelope): Promise<void>;
+    /**
+     * L20 — the store's write refusals name the id it WROTE, which is the scoped one (`acme:x`).
+     * The app never sees scoped ids anywhere else, and callers key on the refusal's id: a
+     * dispatcher decides "another holder owns THIS execution" by comparing it with its own
+     * (`isSupersededRefusal`), so a prefixed id made every fenced-out attempt read as a genuine
+     * failure and the ping-pong came back under tenancy. The three normalized refusals are
+     * re-raised as the same class and name with the ids unscoped and the original as `cause`.
+     * Anything else — and a refusal naming another tenant's key, which cannot be unscoped — passes
+     * through untouched.
+     */
+    private readonly rethrowUnscoped;
+    private unscopeError;
+    read(executionId: string): Promise<EventEnvelope[]>;
+    readFrom(executionId: string, fromSequence: number): Promise<EventEnvelope[]>;
+    subscribe(executionId: string, handler: (event: EventEnvelope) => void): Promise<() => void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=TenantScopedEventStore.d.ts.map

package/dist/TenantScopedEventStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantScopedEventStore.d.ts","sourceRoot":"","sources":["../src/TenantScopedEventStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,OAAO,KAAK,EAAE,UAAU,EAA2C,MAAM,SAAS,CAAC;AA6EnF;;;;;;;;;;GAUG;AACH,qBAAa,sBAAuB,YAAW,UAAU;IAmBrD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAnBzB,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IAClE,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBAGzD,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,MAAM;IA+DjC,iHAAiH;IACjH,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,OAAO,CAAC,KAAK;IAIb,gFAAgF;IAChF,OAAO,CAAC,OAAO;IAOf,6DAA6D;IAC7D,OAAO,CAAC,aAAa;IAIf,MAAM,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAE9B;IAEF,OAAO,CAAC,YAAY;IA8Bd,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAInD,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAM7E,SAAS,CACb,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GACtC,OAAO,CAAC,MAAM,IAAI,CAAC;IAIhB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/TenantScopedEventStore.js

@@ -0,0 +1,227 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantScopedEventStore = void 0;
+const executionIdOrder_1 = require("./executionIdOrder");
+const fencing_1 = require("./fencing");
+const installOptional_1 = require("./installOptional");
+const writeConflicts_1 = require("./writeConflicts");
+// The tenant/execution key separator — a control char that can't appear in a
+// normal executionId, so prefixing is unambiguous and un-stripping is exact.
+const SEP = ":"; // ":" is not in the ULID alphabet — an unambiguous, collision-free tenant separator
+/**
+ * One tenant's page of a shared store's keyset-paged enumeration.
+ *
+ * The cursor is an OUTER id — this tenant's unprefixed executionId — because that is what a
+ * caller holds: `ShardedEventStore` (the ADR 0074 composition, sharding outermost) resumes
+ * every shard from the last id of its MERGED page, which it only ever sees unprefixed. Before
+ * L10 this passed the inner, prefixed cursor out, and got the unprefixed one back in, so
+ * `Sharded(TenantScoped(…))` compared `e-04` against `acme:e-…` and re-served its first page
+ * forever.
+ *
+ * Since EventStore SPI 2.0.0 every store pages in code point order, where the ids under
+ * `prefix` are CONTIGUOUS. So a page seeks to the tenant (the empty id `prefix` included —
+ * a blank stream is still this tenant's, and repair must be able to find it) and stops at
+ * the first id past the prefix, instead of walking the whole shared store. The cursor is
+ * exclusive, so a fresh scan cannot start AT `prefix`; it starts at {@link seekBelow}, the
+ * largest practical string below `prefix` (`acme9\u{10FFFF}` for `acme:`): every other
+ * tenant whose name extends this one with a character below `:` (`acme-eu`, `acme.io`,
+ * `acme0`…`acme9`) sorts before it and is never read.
+ *
+ * It does not stop early with an empty page and a cursor: a non-final page with no ids is not
+ * something consumers are written for (`ShardedEventStore` reads an empty merged page as the
+ * end). Memory stays one inner page.
+ */
+/**
+ * The exclusive cursor a fresh tenant scan starts from: `SEP` is `:` (U+003A), so the string
+ * just below `tenant + ":"` is `tenant + "9"` (U+0039) followed by the highest code point.
+ * Only an id that continues past `tenant + "9\u{10FFFF}"` (never produced by an id
+ * generator) could sit between it and the tenant's range, and would be walked and dropped.
+ * The tenant's blank stream (`tenant + ":"`) sorts after it, so repair still finds it.
+ */
+function seekBelow(tenant) {
+    return `${tenant}9\u{10FFFF}`;
+}
+async function pageWithinPrefix(inner, tenant, prefix, opts) {
+    let cursor = opts?.cursor === undefined ? seekBelow(tenant) : `${prefix}${opts.cursor}`;
+    for (;;) {
+        const page = await inner.listExecutionsPage({
+            cursor,
+            ...(opts?.limit !== undefined && { limit: opts.limit }),
+        });
+        const executionIds = [];
+        let pastPrefix = false;
+        for (const id of page.executionIds) {
+            if (id.startsWith(prefix))
+                executionIds.push(id.slice(prefix.length));
+            // Every id after the tenant's range sorts after `prefix` without starting with it.
+            else if ((0, executionIdOrder_1.compareExecutionIds)(id, prefix) > 0) {
+                pastPrefix = true;
+                break;
+            }
+        }
+        const last = executionIds[executionIds.length - 1];
+        if (pastPrefix || page.nextCursor === undefined)
+            return { executionIds };
+        if (last !== undefined)
+            return { executionIds, nextCursor: last };
+        if (page.nextCursor === cursor) {
+            // The same guard `iterateExecutionIds` applies — except this loop is internal, so
+            // without it a store bug would spin here where no caller could see it.
+            throw new TypeError("TenantScopedEventStore: listExecutionsPage returned a non-advancing cursor (store bug)");
+        }
+        cursor = page.nextCursor;
+    }
+}
+/**
+ * K12.5 — a tenant-scoped view of a shared {@link EventStore}. Every execution
+ * id is key-prefixed with the tenant on the way in and un-prefixed on the way
+ * out, so a store scoped to tenant A can only ever ADDRESS keys under A —
+ * reading or subscribing to tenant B's executions is impossible **by
+ * construction**, not by a filter that could be bypassed. The app sees its own
+ * unprefixed ids throughout (append/read/subscribe/fork all round-trip).
+ *
+ * Default scoping mechanism per the amendment (A7): key-prefixing. Postgres
+ * row-level security is an optional hardening layer on top, not a replacement.
+ */
+class TenantScopedEventStore {
+    inner;
+    tenant;
+    appendBatch;
+    head;
+    readRange;
+    acquireFence;
+    acquireFenceIf;
+    appendIfUnchanged;
+    storeNow;
+    sealingCapability;
+    readAtRest;
+    copyPrefix;
+    deleteExecution;
+    deleteThrough;
+    truncatePrefix;
+    truncatePrefixKeeping;
+    listExecutions;
+    listExecutionsPage;
+    constructor(inner, tenant) {
+        this.inner = inner;
+        this.tenant = tenant;
+        if (tenant === "" || tenant.includes(SEP)) {
+            // Prefix scoping is only isolation if no tenant's prefix is a prefix of another's:
+            // tenant "a" scopes "b:x" to "a:b:x", which is tenant "a:b"'s "x".
+            throw new TypeError(`TenantScopedEventStore: tenant must be non-empty and must not contain the separator "${SEP}" (got ${JSON.stringify(tenant)})`);
+        }
+        const scope = (id) => `${this.tenant}${SEP}${id}`;
+        const prefix = `${this.tenant}${SEP}`;
+        // Every optional method decided here, over the whole union (ADR 0074 Amendment): a new
+        // SPI method is a compile error until this decorator forwards, overrides or refuses it.
+        const plan = {
+            // Order preserved: the SPI's per-execution order is array order.
+            appendBatch: (envs) => inner.appendBatch(envs.map((e) => this.scopeEnvelope(e))).catch(this.rethrowUnscoped),
+            head: (id) => inner.head(scope(id)),
+            readRange: (id, from, to) => inner.readRange(scope(id), from, to).then((evs) => evs.map((e) => this.unscope(e))),
+            acquireFence: (id) => inner.acquireFence(scope(id)),
+            acquireFenceIf: (id, expect) => inner.acquireFenceIf(scope(id), expect),
+            appendIfUnchanged: (id, event, expect) => inner.appendIfUnchanged(scope(id), event === null ? null : this.scopeEnvelope(event), expect).catch(this.rethrowUnscoped),
+            storeNow: "forward", // the store clock is not tenant data
+            sealingCapability: "forward", // what the store seals is not tenant data
+            // The at-rest view is tenant-scoped like `read`: ids scoped on the way in, unscoped on the way out.
+            readAtRest: () => {
+                const raw = inner.readAtRest();
+                const back = async (p) => (await p).map((e) => this.unscope(e));
+                return {
+                    read: (id) => back(raw.read(scope(id))),
+                    readFrom: (id, from) => back(raw.readFrom(scope(id), from)),
+                    ...(raw.readRange !== undefined && {
+                        readRange: (id, a, b) => back(raw.readRange(scope(id), a, b)),
+                    }),
+                    ...(raw.head !== undefined && { head: (id) => raw.head(scope(id)) }),
+                };
+            },
+            // Fork stays IN-TENANT: both ids are scoped, so a fork can never cross the
+            // tenant boundary (a cross-tenant copy is unaddressable here).
+            copyPrefix: (from, to, through, metadata) => inner.copyPrefix(scope(from), scope(to), through, metadata).catch(this.rethrowUnscoped),
+            deleteExecution: (id) => inner.deleteExecution(scope(id)),
+            deleteThrough: (id, through) => inner.deleteThrough(scope(id), through),
+            truncatePrefix: (id, through) => inner.truncatePrefix(scope(id), through),
+            truncatePrefixKeeping: (id, through, keep) => inner.truncatePrefixKeeping(scope(id), through, keep),
+            // Enumerate only THIS tenant's executions: keep the ones under our prefix, strip it.
+            // Cross-tenant ids are invisible (isolation by construction, K12.5).
+            listExecutions: async () => (await inner.listExecutions())
+                .filter((id) => id.startsWith(prefix))
+                .map((id) => id.slice(prefix.length)),
+            listExecutionsPage: (opts) => pageWithinPrefix(inner, this.tenant, prefix, opts),
+        };
+        (0, installOptional_1.installOptional)(this, inner, plan);
+    }
+    /** Structural marker: the tenant this view is scoped to (`LogLifecycle.compact` pairs it with the archive's). */
+    get tenantScope() {
+        return this.tenant;
+    }
+    scope(id) {
+        return `${this.tenant}${SEP}${id}`;
+    }
+    /** Rewrite a stored envelope's scoped executionId/id back to the app's view. */
+    unscope(e) {
+        const prefix = `${this.tenant}${SEP}`;
+        if (!e.executionId.startsWith(prefix))
+            return e;
+        const executionId = e.executionId.slice(prefix.length);
+        return { ...e, executionId, id: e.id.startsWith(prefix) ? e.id.slice(prefix.length) : e.id };
+    }
+    /** Prefix an envelope for storage under the tenant scope. */
+    scopeEnvelope(e) {
+        return { ...e, executionId: this.scope(e.executionId), id: this.scope(e.id) };
+    }
+    async append(envelope) {
+        return this.inner.append(this.scopeEnvelope(envelope)).catch(this.rethrowUnscoped);
+    }
+    /**
+     * L20 — the store's write refusals name the id it WROTE, which is the scoped one (`acme:x`).
+     * The app never sees scoped ids anywhere else, and callers key on the refusal's id: a
+     * dispatcher decides "another holder owns THIS execution" by comparing it with its own
+     * (`isSupersededRefusal`), so a prefixed id made every fenced-out attempt read as a genuine
+     * failure and the ping-pong came back under tenancy. The three normalized refusals are
+     * re-raised as the same class and name with the ids unscoped and the original as `cause`.
+     * Anything else — and a refusal naming another tenant's key, which cannot be unscoped — passes
+     * through untouched.
+     */
+    rethrowUnscoped = (err) => {
+        throw this.unscopeError(err);
+    };
+    unscopeError(err) {
+        if (err === null || typeof err !== "object")
+            return err;
+        const prefix = `${this.tenant}${SEP}`;
+        const e = err;
+        const executionId = e.executionId;
+        if (typeof executionId !== "string" || !executionId.startsWith(prefix))
+            return err;
+        const id = executionId.slice(prefix.length);
+        switch (e.name) {
+            case "StaleFenceError":
+                return new fencing_1.StaleFenceError(id, e.staleFence, e.currentFence, err);
+            case "DuplicateSequenceError":
+                return new writeConflicts_1.DuplicateSequenceError(id, e.sequence, err);
+            case "DuplicateEnvelopeIdError": {
+                const envelopeId = String(e.envelopeId);
+                return new writeConflicts_1.DuplicateEnvelopeIdError(envelopeId.startsWith(prefix) ? envelopeId.slice(prefix.length) : envelopeId, id, err);
+            }
+            default:
+                return err;
+        }
+    }
+    async read(executionId) {
+        return (await this.inner.read(this.scope(executionId))).map((e) => this.unscope(e));
+    }
+    async readFrom(executionId, fromSequence) {
+        return (await this.inner.readFrom(this.scope(executionId), fromSequence)).map((e) => this.unscope(e));
+    }
+    async subscribe(executionId, handler) {
+        return this.inner.subscribe(this.scope(executionId), (e) => handler(this.unscope(e)));
+    }
+    async close() {
+        return this.inner.close();
+    }
+}
+exports.TenantScopedEventStore = TenantScopedEventStore;
+//# sourceMappingURL=TenantScopedEventStore.js.map

package/dist/TenantScopedEventStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantScopedEventStore.js","sourceRoot":"","sources":["../src/TenantScopedEventStore.ts"],"names":[],"mappings":";;;AACA,yDAAyD;AACzD,uCAA4C;AAC5C,uDAAwE;AAExE,qDAAoF;AAEpF,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,oFAAoF;AAErG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,GAAG,MAAM,aAAa,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAiB,EACjB,MAAc,EACd,MAAc,EACd,IAAqD;IAErD,IAAI,MAAM,GAAG,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IACxF,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,kBAAmB,CAAC;YAC3C,MAAM;YACN,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,mFAAmF;iBAC9E,IAAI,IAAA,sCAAmB,EAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,UAAU,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACzE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAClE,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;YAC/B,kFAAkF;YAClF,uEAAuE;YACvE,MAAM,IAAI,SAAS,CACjB,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAa,sBAAsB;IAmBd;IACA;IAnBV,WAAW,CAA0C;IACrD,IAAI,CAAmC;IACvC,SAAS,CAAwC;IACjD,YAAY,CAA2C;IACvD,cAAc,CAA6C;IAC3D,iBAAiB,CAAgD;IACjE,QAAQ,CAAuC;IAC/C,iBAAiB,CAAgD;IACjE,UAAU,CAAyC;IACnD,UAAU,CAAyC;IACnD,eAAe,CAA8C;IAC7D,aAAa,CAA4C;IACzD,cAAc,CAA6C;IAC3D,qBAAqB,CAAoD;IACzE,cAAc,CAA6C;IAC3D,kBAAkB,CAAiD;IAE5E,YACmB,KAAiB,EACjB,MAAc;QADd,UAAK,GAAL,KAAK,CAAY;QACjB,WAAM,GAAN,MAAM,CAAQ;QAE/B,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,mFAAmF;YACnF,mEAAmE;YACnE,MAAM,IAAI,SAAS,CACjB,wFAAwF,GAAG,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAC/H,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,uFAAuF;QACvF,wFAAwF;QACxF,MAAM,IAAI,GAAG;YACX,iEAAiE;YACjE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CACpB,KAAK,CAAC,WAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;YACxF,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpC,SAAS,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,SAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACtF,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,YAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpD,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,cAAe,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;YACxE,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CACvC,KAAK,CAAC,iBAAkB,CACtB,KAAK,CAAC,EAAE,CAAC,EACT,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EACjD,MAAM,CACP,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;YAC/B,QAAQ,EAAE,SAAS,EAAE,qCAAqC;YAC1D,iBAAiB,EAAE,SAAS,EAAE,0CAA0C;YACxE,oGAAoG;YACpG,UAAU,EAAE,GAAG,EAAE;gBACf,MAAM,GAAG,GAAG,KAAK,CAAC,UAAW,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,KAAK,EAAE,CAA2B,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1F,OAAO;oBACL,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;oBACvC,QAAQ,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI;wBACjC,SAAS,EAAE,CAAC,EAAU,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;qBACvF,CAAC;oBACF,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;iBAC9E,CAAC;YACJ,CAAC;YACD,2EAA2E;YAC3E,+DAA+D;YAC/D,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAC1C,KAAK,CAAC,UAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;YAC1F,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,eAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1D,aAAa,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,aAAc,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;YACxE,cAAc,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,cAAe,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;YAC1E,qBAAqB,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAC3C,KAAK,CAAC,qBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC;YACxD,qFAAqF;YACrF,qEAAqE;YACrE,cAAc,EAAE,KAAK,IAAI,EAAE,CACzB,CAAC,MAAM,KAAK,CAAC,cAAe,EAAE,CAAC;iBAC5B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;iBACrC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzC,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC;SACnB,CAAC;QAChE,IAAA,iCAAe,EAAuC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,iHAAiH;IACjH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,gFAAgF;IACxE,OAAO,CAAC,CAAgB;QAC9B,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,OAAO,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC/F,CAAC;IAED,6DAA6D;IACrD,aAAa,CAAC,CAAgB;QACpC,OAAO,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAuB;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;;OASG;IACc,eAAe,GAAG,CAAC,GAAY,EAAS,EAAE;QACzD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEM,YAAY,CAAC,GAAY;QAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACxD,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;QAClC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC;QACnF,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,iBAAiB;gBACpB,OAAO,IAAI,yBAAe,CACxB,EAAE,EACF,CAAC,CAAC,UAAgC,EAClC,CAAC,CAAC,YAAsB,EACxB,GAAG,CACJ,CAAC;YACJ,KAAK,wBAAwB;gBAC3B,OAAO,IAAI,uCAAsB,CAAC,EAAE,EAAE,CAAC,CAAC,QAAkB,EAAE,GAAG,CAAC,CAAC;YACnE,KAAK,0BAA0B,CAAC,CAAC,CAAC;gBAChC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBACxC,OAAO,IAAI,yCAAwB,CACjC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAC5E,EAAE,EACF,GAAG,CACJ,CAAC;YACJ,CAAC;YACD;gBACE,OAAO,GAAG,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,YAAoB;QACtD,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClF,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CACb,WAAmB,EACnB,OAAuC;QAEvC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AA7KD,wDA6KC"}