@nextage/era-lib 1.0.210 → 1.0.212

package/build/utils/tenancy.d.ts

@@ -10,14 +10,14 @@
  * restated, because two implementations of one rule eventually disagree and any             *
  * disagreement is a leak.                                                                   *
  *                                                                                           *
- * WHY THE SCOPING IS NOW OPT-OUT (T55, T58)                                                 *
+ * WHY THE SCOPING IS NOW OPT-OUT                                                            *
  *                                                                                           *
  * It used to be opt-IN: a model owning a `tenantId` was isolated only for as long as its    *
  * author remembered to override five hooks, one class at a time. That is 45 methods saying  *
  * the same thing across nine models, and the failure mode is silence - the collection       *
- * simply answers every tenant. It went wrong three times: T31 (a read by id escaping the    *
- * filters), T37 (a delete with no tenancy filter at all), T55 (`controlAttribute`, whose    *
- * body is empty). T58 is the same shape once more, on the two hooks nobody had even         *
+ * simply answers every tenant. It went wrong three times: a read by id escaping the         *
+ * filters, a delete with no tenancy filter at all, and `controlAttribute`, whose            *
+ * body is empty. The same shape turned up once more, on the two hooks nobody had even       *
  * counted among the five: the subscription ones.                                            *
  *                                                                                           *
  * Registering this provider inverts the default. A model with the field is scoped unless    *

package/build/utils/tenancy.js

@@ -11,14 +11,14 @@
  * restated, because two implementations of one rule eventually disagree and any             *
  * disagreement is a leak.                                                                   *
  *                                                                                           *
- * WHY THE SCOPING IS NOW OPT-OUT (T55, T58)                                                 *
+ * WHY THE SCOPING IS NOW OPT-OUT                                                            *
  *                                                                                           *
  * It used to be opt-IN: a model owning a `tenantId` was isolated only for as long as its    *
  * author remembered to override five hooks, one class at a time. That is 45 methods saying  *
  * the same thing across nine models, and the failure mode is silence - the collection       *
- * simply answers every tenant. It went wrong three times: T31 (a read by id escaping the    *
- * filters), T37 (a delete with no tenancy filter at all), T55 (`controlAttribute`, whose    *
- * body is empty). T58 is the same shape once more, on the two hooks nobody had even         *
+ * simply answers every tenant. It went wrong three times: a read by id escaping the         *
+ * filters, a delete with no tenancy filter at all, and `controlAttribute`, whose            *
+ * body is empty. The same shape turned up once more, on the two hooks nobody had even       *
  * counted among the five: the subscription ones.                                            *
  *                                                                                           *
  * Registering this provider inverts the default. A model with the field is scoped unless    *
@@ -73,7 +73,7 @@ exports.eraTenancy = {
      * caller's own tenant - a silent downgrade would let a client discover the rule by
      * watching where its documents end up.
      *
-     * Anything else in the payload is ignored outright, which is the invariant of T34: the
+     * Anything else in the payload is ignored outright, and that is the invariant: the
      * owner comes from the request context and never from the body.
      *
      * ### What happens when nothing is asked, on a mixed collection

package/build/utils/tenant.d.ts

@@ -16,7 +16,7 @@ import { ExistenceCheckModel, ScopedReadModel } from './tenant.interfaces';
  * The selection NEVER comes from the payload: it travels out of band (`X-Org-Id`
  * header, or `orgId` in the WebSocket connection params) and lands on
  * `NxContext.orgId`. Reading it from the body would let a client name any tenant
- * simply by adding a field to a mutation input (T34).
+ * simply by adding a field to a mutation input.
  *
  * Resolution order (ADR-0005 section 5.1) - the first match wins:
  *
@@ -54,7 +54,7 @@ export declare function resolveTenant(user?: BaseUser, orgId?: string): string;
  * defect D2 of ADR-0005 section 5.1, a fail-open by default.
  *
  * IMPORTANT: **What it is FOR, since 2026-08-13.** Scoping is no longer its job: `BaseModel`
- * applies the tenant on its own (opt-out, T55), so this is not what keeps a query
+ * applies the tenant on its own (opt-out), so this is not what keeps a query
  * inside its organization anymore. The four remaining callers use it for a different
  * reason - they need the resolved tenant as a VALUE, to then load
  * `organization.get(params.tenantId)` or to pick the right items while composing a
@@ -84,11 +84,11 @@ export declare function getTenant(user?: BaseUser): string;
  * tenant scoping is **opt-out**: `BaseModel.beforeRemove` refuses an out-of-scope `_id`
  * on its own, so the nine `beforeRemove` overrides that called this helper are gone
  * (OPS-10) and it has **no production caller left**. Do NOT reach for it in new code -
- * a second copy of the rule is exactly what T55 set out to remove. It stays exported,
+ * a second copy of the rule is exactly what the opt-out design removed. It stays exported,
  * and covered by its test, because the framework keeps its old behaviour whenever no
  * tenancy provider is registered: a consumer in that state still needs this.
  *
- * Fills the gap of **T37**: `BaseModel.remove(id)` calls `beforeRemove` and then
+ * Fills a gap in the framework: `BaseModel.remove(id)` calls `beforeRemove` and then
  * `findByIdAndDelete(id)`, applying neither `updateFilters` nor any `tenantId`
  * constraint - and `bulkRemove(ids)` is nothing but `ids.map(remove)`. Without this
  * check any user deletes documents belonging to OTHER organizations, knowing only
@@ -103,7 +103,7 @@ export declare function getTenant(user?: BaseUser): string;
  * **Fail-closed**: a missing or out-of-scope `id` raises an error, without telling
  * the two cases apart (the existence of someone else's document is never confirmed).
  * That muteness was lost when the guard moved into the framework, which at first
- * refused only EXISTING documents - an enumeration oracle, filed as **T60** and
+ * refused only EXISTING documents - an enumeration oracle, since
  * repaired in nx-frame-be 1.0.47.
  *
  * @param model   the model the removal happens on (`this` inside the hook)
@@ -114,7 +114,7 @@ export declare function getTenant(user?: BaseUser): string;
  */
 export declare function assertTenantScope(model: ScopedReadModel, id: string, context?: NxContext): Promise<string>;
 /**
- * Answers whether the organization NAMED by a request actually exists (T49).
+ * Answers whether the organization NAMED by a request actually exists.
  *
  * {@link resolveTenant} answers one question - "may this user REACH the
  * selection" - and for a cross-tenant role the answer is "any of them", so it

package/build/utils/tenant.js

@@ -25,7 +25,7 @@ const scope_1 = require("./scope");
  * The selection NEVER comes from the payload: it travels out of band (`X-Org-Id`
  * header, or `orgId` in the WebSocket connection params) and lands on
  * `NxContext.orgId`. Reading it from the body would let a client name any tenant
- * simply by adding a field to a mutation input (T34).
+ * simply by adding a field to a mutation input.
  *
  * Resolution order (ADR-0005 section 5.1) - the first match wins:
  *
@@ -62,7 +62,7 @@ function resolveTenant(user, orgId) {
         return orgId;
     // `messages.forbidden` was defined by NO dictionary, so the client - which
     // falls back to the message when `extensions.i18n` is absent - showed the raw
-    // key to the user (T52). This refusal is an access denial, and reads as one.
+    // key to the user. This refusal is an access denial, and reads as one.
     if (!reachable.includes(orgId))
         throw new nx_frame_be_1.AppError('messages.authorization.accessDenied');
     return orgId;
@@ -76,7 +76,7 @@ function resolveTenant(user, orgId) {
  * defect D2 of ADR-0005 section 5.1, a fail-open by default.
  *
  * IMPORTANT: **What it is FOR, since 2026-08-13.** Scoping is no longer its job: `BaseModel`
- * applies the tenant on its own (opt-out, T55), so this is not what keeps a query
+ * applies the tenant on its own (opt-out), so this is not what keeps a query
  * inside its organization anymore. The four remaining callers use it for a different
  * reason - they need the resolved tenant as a VALUE, to then load
  * `organization.get(params.tenantId)` or to pick the right items while composing a
@@ -112,11 +112,11 @@ function getTenant(user) {
  * tenant scoping is **opt-out**: `BaseModel.beforeRemove` refuses an out-of-scope `_id`
  * on its own, so the nine `beforeRemove` overrides that called this helper are gone
  * (OPS-10) and it has **no production caller left**. Do NOT reach for it in new code -
- * a second copy of the rule is exactly what T55 set out to remove. It stays exported,
+ * a second copy of the rule is exactly what the opt-out design removed. It stays exported,
  * and covered by its test, because the framework keeps its old behaviour whenever no
  * tenancy provider is registered: a consumer in that state still needs this.
  *
- * Fills the gap of **T37**: `BaseModel.remove(id)` calls `beforeRemove` and then
+ * Fills a gap in the framework: `BaseModel.remove(id)` calls `beforeRemove` and then
  * `findByIdAndDelete(id)`, applying neither `updateFilters` nor any `tenantId`
  * constraint - and `bulkRemove(ids)` is nothing but `ids.map(remove)`. Without this
  * check any user deletes documents belonging to OTHER organizations, knowing only
@@ -131,7 +131,7 @@ function getTenant(user) {
  * **Fail-closed**: a missing or out-of-scope `id` raises an error, without telling
  * the two cases apart (the existence of someone else's document is never confirmed).
  * That muteness was lost when the guard moved into the framework, which at first
- * refused only EXISTING documents - an enumeration oracle, filed as **T60** and
+ * refused only EXISTING documents - an enumeration oracle, since
  * repaired in nx-frame-be 1.0.47.
  *
  * @param model   the model the removal happens on (`this` inside the hook)
@@ -146,7 +146,7 @@ async function assertTenantScope(model, id, context = {}) {
     return id;
 }
 /**
- * Answers whether the organization NAMED by a request actually exists (T49).
+ * Answers whether the organization NAMED by a request actually exists.
  *
  * {@link resolveTenant} answers one question - "may this user REACH the
  * selection" - and for a cross-tenant role the answer is "any of them", so it

package/build/utils/tenant.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/utils/tenant.ts"],"names":[],"mappings":";AAAA;;;;;;;;;+FAS+F;;AA0C/F,sCAkBC;AAqBD,8BAGC;AAaD,8BAMC;AAqCD,8CAMC;AAqDD,8CASC;AAkBD,0DAIC;AApOD,sDAA+E;AAC/E,oFAA6G;AAE7G,mCAAkE;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,aAAa,CAAC,IAAe,EAAE,KAAc;IAE3D,IAAI,CAAC,KAAK;QACR,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC;IAExC,sEAAsE;IACtE,IAAI,CAAC,SAAS;QACZ,OAAO,KAAK,CAAC;IAEf,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;IAE5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,SAAS,CAAC,IAAc,EAAE,UAAqB,EAAE;IAE/D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,SAAS,CAAC,IAAe;IAEvC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE1D,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAAsB,EAAE,EAAU,EAAE,UAAqB,EAAE;IAEjG,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;QAC/B,MAAM,IAAI,sBAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE1C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAA0B,EAAE,KAAc;IAEhF,IAAI,CAAC,KAAK;QACR,OAAO,IAAI,CAAC;IAEd,IAAI,CAAC,IAAA,6BAAe,EAAC,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC;IAEf,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAA,wBAAU,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,uBAAuB,CAAC,KAA0B,EAAE,KAAc;IAEtF,IAAI,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;QACxC,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/utils/tenant.ts"],"names":[],"mappings":";AAAA;;;;;;;;;+FAS+F;;AA0C/F,sCAkBC;AAqBD,8BAGC;AAaD,8BAMC;AAqCD,8CAMC;AAqDD,8CASC;AAkBD,0DAIC;AApOD,sDAA+E;AAC/E,oFAA6G;AAE7G,mCAAkE;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,aAAa,CAAC,IAAe,EAAE,KAAc;IAE3D,IAAI,CAAC,KAAK;QACR,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC;IAExC,sEAAsE;IACtE,IAAI,CAAC,SAAS;QACZ,OAAO,KAAK,CAAC;IAEf,2EAA2E;IAC3E,8EAA8E;IAC9E,uEAAuE;IACvE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;IAE5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,SAAS,CAAC,IAAc,EAAE,UAAqB,EAAE;IAE/D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,SAAS,CAAC,IAAe;IAEvC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE1D,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAAsB,EAAE,EAAU,EAAE,UAAqB,EAAE;IAEjG,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;QAC/B,MAAM,IAAI,sBAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE1C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAA0B,EAAE,KAAc;IAEhF,IAAI,CAAC,KAAK;QACR,OAAO,IAAI,CAAC;IAEd,IAAI,CAAC,IAAA,6BAAe,EAAC,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC;IAEf,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAA,wBAAU,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,uBAAuB,CAAC,KAA0B,EAAE,KAAc;IAEtF,IAAI,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;QACxC,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;AAC9D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextage/era-lib",
-  "version": "1.0.210",
+  "version": "1.0.212",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
   "files": [