@plumbus/core 0.7.1 → 0.8.0-beta.0

package/dist/tenancy/data-plane-resolver.d.ts

@@ -0,0 +1,37 @@
+import type { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import { PlumbusError } from '../errors/plumbus-error.js';
+import type { DataPlaneResolver, PooledDataPlaneResolver, PooledDataPlaneResolverOptions, SingleDataPlaneResolverOptions } from './types.js';
+/**
+ * Schema the framework's own tables resolve to when the host names none.
+ * `public` reproduces today's behavior: unqualified table names under a
+ * default `search_path`.
+ */
+export declare const DEFAULT_CORE_SCHEMA = "public";
+/** Prefix reported for per-package schemas when the host names none. */
+export declare const DEFAULT_PACKAGE_SCHEMA_PREFIX = "pkg_";
+/** Default number of data planes held open by the pooled resolver. */
+export declare const DEFAULT_DATA_PLANE_CACHE_SIZE = 32;
+/** Raised when a tenant reference resolves to no data plane. Never falls back. */
+export declare class UnknownTenantError extends PlumbusError {
+    constructor(tenantRef: string, metadata?: Record<string, unknown>);
+}
+/**
+ * Back-compat resolver: one database serves every tenant reference.
+ *
+ * This is today's single-database behavior expressed through the resolver
+ * interface — the same `db` the caller already owns is handed back for any
+ * reference, including the empty reference used by untenanted callers. Use it
+ * wherever a `DataPlaneResolver` is required but routing has not been adopted.
+ */
+export declare function createSingleDataPlaneResolver(db: PostgresJsDatabase, options?: SingleDataPlaneResolverOptions): DataPlaneResolver;
+/**
+ * Caching resolver over host-supplied routing.
+ *
+ * The host answers two questions — where does this tenant live (`describe`) and
+ * how do I open a connection to it (`connect`) — and the framework owns
+ * everything else: an LRU of open data planes, deduplication of concurrent
+ * resolutions, generation-based revalidation, explicit invalidation, and
+ * throwing on an unknown tenant rather than falling back.
+ */
+export declare function createPooledDataPlaneResolver<TConnectionInfo = unknown>(options: PooledDataPlaneResolverOptions<TConnectionInfo>): PooledDataPlaneResolver;
+//# sourceMappingURL=data-plane-resolver.d.ts.map

package/dist/tenancy/data-plane-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-plane-resolver.d.ts","sourceRoot":"","sources":["../../src/tenancy/data-plane-resolver.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,KAAK,EAIV,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,SAAS,CAAC;AAEpD,sEAAsE;AACtE,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAShD,kFAAkF;AAClF,qBAAa,kBAAmB,SAAQ,YAAY;gBACtC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAOlE;AAgCD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,EAAE,EAAE,kBAAkB,EACtB,OAAO,GAAE,8BAAmC,GAC3C,iBAAiB,CAMnB;AAWD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,eAAe,GAAG,OAAO,EACrE,OAAO,EAAE,8BAA8B,CAAC,eAAe,CAAC,GACvD,uBAAuB,CAuPzB"}

package/dist/tenancy/data-plane-resolver.js

@@ -0,0 +1,302 @@
+// ── Data Plane Resolver ──
+// Turns an opaque tenant reference into the database handle and schema
+// namespaces its work runs in. Two implementations ship here:
+//
+//   createSingleDataPlaneResolver — every tenant reference resolves to one
+//     boot-time database. This is exactly what the server and worker bootstraps
+//     do today, expressed as a resolver, so existing consumers are unaffected.
+//
+//   createPooledDataPlaneResolver — the host supplies how to look up a tenant's
+//     placement (`describe`) and how to open a connection (`connect`); the
+//     framework owns the LRU cache, generation-based revalidation, explicit
+//     invalidation and fail-closed behavior on an unknown tenant.
+//
+// Fail-closed is the load-bearing rule: an unresolvable tenant reference throws
+// and no code path substitutes another tenant's database.
+import { logHookError } from '../errors/hook-log.js';
+import { PlumbusError } from '../errors/plumbus-error.js';
+import { ErrorCode } from '../types/enums.js';
+/**
+ * Schema the framework's own tables resolve to when the host names none.
+ * `public` reproduces today's behavior: unqualified table names under a
+ * default `search_path`.
+ */
+export const DEFAULT_CORE_SCHEMA = 'public';
+/** Prefix reported for per-package schemas when the host names none. */
+export const DEFAULT_PACKAGE_SCHEMA_PREFIX = 'pkg_';
+/** Default number of data planes held open by the pooled resolver. */
+export const DEFAULT_DATA_PLANE_CACHE_SIZE = 32;
+/**
+ * How many times a resolution restarts when an `invalidate` lands while it is
+ * in flight. Bounded so a pathological invalidation loop surfaces as an error
+ * instead of spinning.
+ */
+const MAX_RESOLVE_ATTEMPTS = 3;
+/** Raised when a tenant reference resolves to no data plane. Never falls back. */
+export class UnknownTenantError extends PlumbusError {
+    constructor(tenantRef, metadata) {
+        super(ErrorCode.NotFound, `No data plane is registered for tenant reference "${tenantRef}"`, {
+            tenantRef,
+            ...metadata,
+        });
+        this.name = 'UnknownTenantError';
+    }
+}
+function assertTenantRef(tenantRef) {
+    if (typeof tenantRef !== 'string' || tenantRef.trim() === '') {
+        throw new PlumbusError(ErrorCode.Validation, 'A data plane cannot be resolved without a tenant reference');
+    }
+}
+function freezeHandle(handle) {
+    return Object.freeze(handle);
+}
+function buildHandle(tenantRef, db, descriptor) {
+    return freezeHandle({
+        db,
+        coreSchema: descriptor.coreSchema ?? DEFAULT_CORE_SCHEMA,
+        packageSchemaPrefix: descriptor.packageSchemaPrefix ?? DEFAULT_PACKAGE_SCHEMA_PREFIX,
+        tenantRef,
+        ...(descriptor.generation !== undefined ? { generation: descriptor.generation } : {}),
+    });
+}
+/**
+ * Back-compat resolver: one database serves every tenant reference.
+ *
+ * This is today's single-database behavior expressed through the resolver
+ * interface — the same `db` the caller already owns is handed back for any
+ * reference, including the empty reference used by untenanted callers. Use it
+ * wherever a `DataPlaneResolver` is required but routing has not been adopted.
+ */
+export function createSingleDataPlaneResolver(db, options = {}) {
+    return {
+        async resolve(tenantRef) {
+            return buildHandle(tenantRef, db, options);
+        },
+    };
+}
+/**
+ * Caching resolver over host-supplied routing.
+ *
+ * The host answers two questions — where does this tenant live (`describe`) and
+ * how do I open a connection to it (`connect`) — and the framework owns
+ * everything else: an LRU of open data planes, deduplication of concurrent
+ * resolutions, generation-based revalidation, explicit invalidation, and
+ * throwing on an unknown tenant rather than falling back.
+ */
+export function createPooledDataPlaneResolver(options) {
+    const cacheSize = options.cacheSize ?? DEFAULT_DATA_PLANE_CACHE_SIZE;
+    if (!Number.isInteger(cacheSize) || cacheSize < 1) {
+        throw new PlumbusError(ErrorCode.Validation, `Data plane cacheSize must be a positive integer (received ${String(options.cacheSize)})`);
+    }
+    const now = options.now ?? Date.now;
+    const revalidateAfterMs = options.revalidateAfterMs;
+    const onCloseError = options.onCloseError ??
+        ((info) => logHookError('dataPlaneConnectionClose', info.error));
+    /** Insertion-ordered LRU: least recently used first. */
+    const entries = new Map();
+    /** One in-flight resolution per tenant reference. */
+    const inFlight = new Map();
+    /** Bumped by `invalidate` while a resolution for that tenant is in flight. */
+    const epochs = new Map();
+    let closed = false;
+    function currentEpoch(tenantRef) {
+        return epochs.get(tenantRef) ?? 0;
+    }
+    function bumpEpoch(tenantRef) {
+        if (inFlight.has(tenantRef)) {
+            epochs.set(tenantRef, currentEpoch(tenantRef) + 1);
+        }
+    }
+    async function closeQuietly(tenantRef, connection) {
+        try {
+            await connection.close?.();
+        }
+        catch (error) {
+            onCloseError({ tenantRef, error });
+        }
+    }
+    async function evict(tenantRef) {
+        const entry = entries.get(tenantRef);
+        if (!entry)
+            return;
+        entries.delete(tenantRef);
+        await closeQuietly(tenantRef, entry.connection);
+    }
+    /** Move an entry to the most-recently-used end of the LRU. */
+    function touch(tenantRef, entry) {
+        entries.delete(tenantRef);
+        entries.set(tenantRef, entry);
+    }
+    async function enforceCapacity() {
+        while (entries.size > cacheSize) {
+            const oldest = entries.keys().next();
+            if (oldest.done)
+                return;
+            await evict(oldest.value);
+        }
+    }
+    function isStale(entry) {
+        if (revalidateAfterMs === undefined)
+            return false;
+        return now() - entry.resolvedAt >= revalidateAfterMs;
+    }
+    async function describeChecked(tenantRef) {
+        const descriptor = await options.describe(tenantRef);
+        if (descriptor === undefined || descriptor === null) {
+            throw new UnknownTenantError(tenantRef);
+        }
+        return descriptor;
+    }
+    /**
+     * Connect against `descriptor` and cache the result. Returns `undefined` when
+     * an `invalidate` landed while connecting — the fresh connection is closed
+     * and the caller retries, so an invalidation is never overtaken by a
+     * resolution that started before it.
+     */
+    async function connectAndStore(tenantRef, descriptor, epoch) {
+        const connection = await options.connect({ tenantRef, descriptor });
+        if (closed) {
+            await closeQuietly(tenantRef, connection);
+            throw closedError(tenantRef);
+        }
+        if (currentEpoch(tenantRef) !== epoch) {
+            await closeQuietly(tenantRef, connection);
+            return undefined;
+        }
+        const handle = buildHandle(tenantRef, connection.db, descriptor);
+        const entry = {
+            handle,
+            connection,
+            generation: descriptor.generation,
+            coreSchema: handle.coreSchema,
+            packageSchemaPrefix: handle.packageSchemaPrefix,
+            resolvedAt: now(),
+        };
+        await evict(tenantRef);
+        entries.set(tenantRef, entry);
+        await enforceCapacity();
+        return handle;
+    }
+    async function load(tenantRef) {
+        for (let attempt = 0; attempt < MAX_RESOLVE_ATTEMPTS; attempt += 1) {
+            const epoch = currentEpoch(tenantRef);
+            const descriptor = await describeChecked(tenantRef);
+            const handle = await connectAndStore(tenantRef, descriptor, epoch);
+            if (handle)
+                return handle;
+        }
+        throw invalidationRaceError(tenantRef);
+    }
+    /**
+     * Re-read a cached tenant's placement. The cache is read again after the
+     * lookup rather than trusted from before it, so an eviction or invalidation
+     * that landed meanwhile cannot be overwritten with the older placement.
+     */
+    async function revalidate(tenantRef) {
+        for (let attempt = 0; attempt < MAX_RESOLVE_ATTEMPTS; attempt += 1) {
+            const epoch = currentEpoch(tenantRef);
+            let descriptor;
+            try {
+                descriptor = await describeChecked(tenantRef);
+            }
+            catch (error) {
+                if (error instanceof UnknownTenantError) {
+                    // The tenant is gone: drop the cached data plane rather than keep
+                    // serving it.
+                    await evict(tenantRef);
+                }
+                throw error;
+            }
+            const current = entries.get(tenantRef);
+            if (!current || currentEpoch(tenantRef) !== epoch) {
+                // Invalidated or evicted while describing — resolve from scratch.
+                const handle = await connectAndStore(tenantRef, descriptor, currentEpoch(tenantRef));
+                if (handle)
+                    return handle;
+                continue;
+            }
+            if (descriptor.generation === current.generation) {
+                const coreSchema = descriptor.coreSchema ?? DEFAULT_CORE_SCHEMA;
+                const packageSchemaPrefix = descriptor.packageSchemaPrefix ?? DEFAULT_PACKAGE_SCHEMA_PREFIX;
+                const schemasUnchanged = coreSchema === current.coreSchema && packageSchemaPrefix === current.packageSchemaPrefix;
+                const entry = {
+                    ...current,
+                    coreSchema,
+                    packageSchemaPrefix,
+                    handle: schemasUnchanged
+                        ? current.handle
+                        : buildHandle(tenantRef, current.connection.db, descriptor),
+                    resolvedAt: now(),
+                };
+                touch(tenantRef, entry);
+                return entry.handle;
+            }
+            // Generation moved: the cached connection points at a superseded
+            // placement. Close it before connecting to the new one.
+            entries.delete(tenantRef);
+            await closeQuietly(tenantRef, current.connection);
+            const handle = await connectAndStore(tenantRef, descriptor, epoch);
+            if (handle)
+                return handle;
+        }
+        throw invalidationRaceError(tenantRef);
+    }
+    function closedError(tenantRef) {
+        return new PlumbusError(ErrorCode.Internal, 'Data plane resolver is closed and cannot resolve further tenants', { tenantRef });
+    }
+    function invalidationRaceError(tenantRef) {
+        return new PlumbusError(ErrorCode.Conflict, `Data plane resolution for tenant reference "${tenantRef}" was invalidated ` +
+            `${MAX_RESOLVE_ATTEMPTS} times while resolving`, { tenantRef });
+    }
+    function start(tenantRef, work) {
+        const pending = inFlight.get(tenantRef);
+        if (pending)
+            return pending;
+        const promise = work().finally(() => {
+            inFlight.delete(tenantRef);
+            epochs.delete(tenantRef);
+        });
+        inFlight.set(tenantRef, promise);
+        return promise;
+    }
+    return {
+        async resolve(tenantRef) {
+            if (closed) {
+                throw closedError(tenantRef);
+            }
+            assertTenantRef(tenantRef);
+            const cached = entries.get(tenantRef);
+            if (cached && !isStale(cached)) {
+                touch(tenantRef, cached);
+                return cached.handle;
+            }
+            if (cached) {
+                return start(tenantRef, () => revalidate(tenantRef));
+            }
+            return start(tenantRef, () => load(tenantRef));
+        },
+        async invalidate(tenantRef) {
+            assertTenantRef(tenantRef);
+            bumpEpoch(tenantRef);
+            await evict(tenantRef);
+        },
+        async invalidateAll() {
+            for (const tenantRef of [...entries.keys(), ...inFlight.keys()]) {
+                bumpEpoch(tenantRef);
+            }
+            for (const tenantRef of [...entries.keys()]) {
+                await evict(tenantRef);
+            }
+        },
+        async close() {
+            closed = true;
+            for (const tenantRef of [...inFlight.keys()]) {
+                bumpEpoch(tenantRef);
+            }
+            for (const tenantRef of [...entries.keys()]) {
+                await evict(tenantRef);
+            }
+        },
+    };
+}
+//# sourceMappingURL=data-plane-resolver.js.map

package/dist/tenancy/data-plane-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-plane-resolver.js","sourceRoot":"","sources":["../../src/tenancy/data-plane-resolver.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,uEAAuE;AACvE,8DAA8D;AAC9D,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,gFAAgF;AAChF,0DAA0D;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAW9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAEpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,kFAAkF;AAClF,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IAClD,YAAY,SAAiB,EAAE,QAAkC;QAC/D,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,qDAAqD,SAAS,GAAG,EAAE;YAC3F,SAAS;YACT,GAAG,QAAQ;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,UAAU,EACpB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAuB;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAClB,SAAiB,EACjB,EAAsB,EACtB,UAGC;IAED,OAAO,YAAY,CAAC;QAClB,EAAE;QACF,UAAU,EAAE,UAAU,CAAC,UAAU,IAAI,mBAAmB;QACxD,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,IAAI,6BAA6B;QACpF,SAAS;QACT,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,EAAsB,EACtB,UAA0C,EAAE;IAE5C,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAwD;IAExD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,6BAA6B,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,UAAU,EACpB,6DAA6D,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACpD,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;QACpB,CAAC,CAAC,IAA2C,EAAE,EAAE,CAC/C,YAAY,CAAC,0BAA0B,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1D,wDAAwD;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,qDAAqD;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC7D,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,SAAS,YAAY,CAAC,SAAiB;QACrC,OAAO,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,SAAS,SAAS,CAAC,SAAiB;QAClC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,UAA+B;QAC5E,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,SAAiB;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAED,8DAA8D;IAC9D,SAAS,KAAK,CAAC,SAAiB,EAAE,KAAiB;QACjD,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,OAAO,OAAO,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI;gBAAE,OAAO;YACxB,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,SAAS,OAAO,CAAC,KAAiB;QAChC,IAAI,iBAAiB,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAClD,OAAO,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACvD,CAAC;IAED,KAAK,UAAU,eAAe,CAAC,SAAiB;QAC9C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,UAAgD,EAChD,KAAa;QAEb,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QACpE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC1C,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACjE,MAAM,KAAK,GAAe;YACxB,MAAM;YACN,UAAU;YACV,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,UAAU,EAAE,GAAG,EAAE;SAClB,CAAC;QACF,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,eAAe,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,SAAiB;QACnC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,oBAAoB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACtC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YACnE,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QACD,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,UAAU,CAAC,SAAiB;QACzC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,oBAAoB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,UAAgD,CAAC;YACrD,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;oBACxC,kEAAkE;oBAClE,cAAc;oBACd,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;gBACzB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;gBAClD,kEAAkE;gBAClE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBACrF,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,UAAU,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;gBACjD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,mBAAmB,CAAC;gBAChE,MAAM,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,IAAI,6BAA6B,CAAC;gBAC5F,MAAM,gBAAgB,GACpB,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,mBAAmB,KAAK,OAAO,CAAC,mBAAmB,CAAC;gBAC3F,MAAM,KAAK,GAAe;oBACxB,GAAG,OAAO;oBACV,UAAU;oBACV,mBAAmB;oBACnB,MAAM,EAAE,gBAAgB;wBACtB,CAAC,CAAC,OAAO,CAAC,MAAM;wBAChB,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC;oBAC7D,UAAU,EAAE,GAAG,EAAE;iBAClB,CAAC;gBACF,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBACxB,OAAO,KAAK,CAAC,MAAM,CAAC;YACtB,CAAC;YACD,iEAAiE;YACjE,wDAAwD;YACxD,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YACnE,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QACD,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,WAAW,CAAC,SAAiB;QACpC,OAAO,IAAI,YAAY,CACrB,SAAS,CAAC,QAAQ,EAClB,kEAAkE,EAClE,EAAE,SAAS,EAAE,CACd,CAAC;IACJ,CAAC;IAED,SAAS,qBAAqB,CAAC,SAAiB;QAC9C,OAAO,IAAI,YAAY,CACrB,SAAS,CAAC,QAAQ,EAClB,+CAA+C,SAAS,oBAAoB;YAC1E,GAAG,oBAAoB,wBAAwB,EACjD,EAAE,SAAS,EAAE,CACd,CAAC;IACJ,CAAC;IAED,SAAS,KAAK,CACZ,SAAiB,EACjB,IAAoC;QAEpC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YACD,eAAe,CAAC,SAAS,CAAC,CAAC;YAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACzB,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,SAAiB;YAChC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC3B,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,aAAa;YACjB,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChE,SAAS,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC7C,SAAS,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tenancy/index.d.ts

@@ -0,0 +1,9 @@
+export { createPooledDataPlaneResolver, createSingleDataPlaneResolver, UnknownTenantError, DEFAULT_CORE_SCHEMA, DEFAULT_DATA_PLANE_CACHE_SIZE, DEFAULT_PACKAGE_SCHEMA_PREFIX, } from './data-plane-resolver.js';
+export type { DataPlaneConnectRequest, DataPlaneConnection, DataPlaneDescriptor, DataPlaneHandle, DataPlaneResolver, PooledDataPlaneResolver, PooledDataPlaneResolverOptions, SingleDataPlaneResolverOptions, } from './types.js';
+export { openDataPlaneConnection, DataPlaneConnectionError, DEFAULT_DATA_PLANE_POOL_SIZE, MAX_DATA_PLANE_POOL_SIZE, } from './data-plane-connection.js';
+export type { DataPlaneConnectionFields, DataPlaneConnectionTarget, DataPlaneConnectionUrl, DataPlaneEndpoint, OpenDataPlaneConnectionOptions, OpenedDataPlaneConnection, } from './data-plane-connection.js';
+export { applyDataPlaneMigrations, DATA_PLANE_MIGRATE_APPLICATION_NAME, } from './data-plane-migrate.js';
+export type { ApplyDataPlaneMigrationsOptions, DataPlaneMigrationApplyResult, } from './data-plane-migrate.js';
+export { provisionDataPlane, dropDataPlane, assertSafeIdentifier, quoteIdentifier, DataPlaneGuardError, DataPlaneNameError, DataPlaneProvisioningError, } from './data-plane-provisioning.js';
+export type { DataPlaneAdminConnection, DataPlaneDropResult, DataPlaneRoleSpec, DataPlaneStep, DataPlaneStepName, DataPlaneStepOutcome, DataPlaneTablePrivilege, DropDataPlaneOptions, ProvisionDataPlaneOptions, DataPlaneProvisionResult, } from './data-plane-provisioning.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tenancy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tenancy/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAKpB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,yBAAyB,EACzB,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,wBAAwB,EACxB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC"}

package/dist/tenancy/index.js

@@ -0,0 +1,22 @@
+// ── Tenancy Module ──
+// Per-tenant data-plane resolution: the mechanism that maps an opaque tenant
+// reference to the database handle and schema namespaces its work runs in.
+// The framework owns caching, invalidation and fail-closed behavior; the host
+// application owns routing lookup and connection creation.
+//
+// Key exports: createSingleDataPlaneResolver (back-compat single database),
+// createPooledDataPlaneResolver (host-routed, cached), openDataPlaneConnection
+// (the connect step it routes through), applyDataPlaneMigrations (owner-role
+// apply of generated migrations to a named tenant database), UnknownTenantError.
+export { createPooledDataPlaneResolver, createSingleDataPlaneResolver, UnknownTenantError, DEFAULT_CORE_SCHEMA, DEFAULT_DATA_PLANE_CACHE_SIZE, DEFAULT_PACKAGE_SCHEMA_PREFIX, } from './data-plane-resolver.js';
+// Opening a data plane: a bounded, per-tenant pool against one named database,
+// opened as one named role, in the shape `connect` must return. Credentials
+// never reach a message, an error's metadata, or the notice stream.
+export { openDataPlaneConnection, DataPlaneConnectionError, DEFAULT_DATA_PLANE_POOL_SIZE, MAX_DATA_PLANE_POOL_SIZE, } from './data-plane-connection.js';
+// Apply generated migrations to one named tenant database through the same
+// connection factory the resolver uses. Connect as the owner role.
+export { applyDataPlaneMigrations, DATA_PLANE_MIGRATE_APPLICATION_NAME, } from './data-plane-migrate.js';
+// Data-plane provisioning: creating a tenant's database and its owner/runtime role pair.
+// Idempotent and resumable; identifiers are validated and quoted, never interpolated.
+export { provisionDataPlane, dropDataPlane, assertSafeIdentifier, quoteIdentifier, DataPlaneGuardError, DataPlaneNameError, DataPlaneProvisioningError, } from './data-plane-provisioning.js';
+//# sourceMappingURL=index.js.map

package/dist/tenancy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tenancy/index.ts"],"names":[],"mappings":"AAAA,uBAAuB;AACvB,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,2DAA2D;AAC3D,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,iFAAiF;AAEjF,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAYlC,+EAA+E;AAC/E,4EAA4E;AAC5E,oEAAoE;AACpE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AAUpC,2EAA2E;AAC3E,mEAAmE;AACnE,OAAO,EACL,wBAAwB,EACxB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AAMjC,yFAAyF;AACzF,sFAAsF;AACtF,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC"}

package/dist/tenancy/types.d.ts

@@ -0,0 +1,117 @@
+import type { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+/**
+ * A resolved data plane — everything a request, flow step or worker needs to
+ * read and write one tenant's state.
+ *
+ * `coreSchema` and `packageSchemaPrefix` are the namespaces the framework's own
+ * tables and the per-package tables live in. Handles are frozen: a caller that
+ * receives one cannot repoint it at another tenant.
+ */
+export interface DataPlaneHandle {
+    /** Database handle for this tenant's data plane. */
+    db: PostgresJsDatabase;
+    /** Schema holding the framework's own tenant-local tables. */
+    coreSchema: string;
+    /** Prefix for per-package schemas (a package's schema is `${prefix}${package}`). */
+    packageSchemaPrefix: string;
+    /** The opaque tenant reference this handle was resolved for. */
+    tenantRef: string;
+    /**
+     * Monotonic generation of the tenant's data plane, when the host tracks one.
+     * A changed generation means the placement changed (restore, move, rotation)
+     * and any handle carrying the older value is stale.
+     */
+    generation?: number;
+}
+/**
+ * Resolves an opaque tenant reference to its data plane.
+ *
+ * Implementations MUST fail closed: an unresolvable reference throws, and no
+ * implementation may fall back to a default database — that would be a
+ * cross-tenant leak.
+ */
+export interface DataPlaneResolver {
+    resolve(tenantRef: string): Promise<DataPlaneHandle>;
+    /**
+     * Drop any cached handle for `tenantRef` so the next `resolve` re-reads the
+     * host's routing. Absent on resolvers that hold no cache.
+     */
+    invalidate?(tenantRef: string): Promise<void>;
+}
+/**
+ * What the host reports about a tenant's data plane placement.
+ *
+ * `connectionInfo` is opaque to the framework — it is handed back verbatim to
+ * `connect`, so hosts can carry connection strings, credential references,
+ * pool names, or anything else their connect step needs.
+ */
+export interface DataPlaneDescriptor<TConnectionInfo = unknown> {
+    /** Host-defined connection details, passed through to `connect` unchanged. */
+    connectionInfo: TConnectionInfo;
+    /** Schema holding the framework's own tenant-local tables. */
+    coreSchema?: string;
+    /** Prefix for per-package schemas. */
+    packageSchemaPrefix?: string;
+    /**
+     * Monotonic generation of this placement. When revalidation observes a
+     * changed generation the pooled resolver closes the old connection and
+     * connects again; an unchanged generation keeps the existing connection.
+     */
+    generation?: number;
+}
+/** An open connection to one tenant's data plane, owned by the resolver. */
+export interface DataPlaneConnection {
+    db: PostgresJsDatabase;
+    /** Called when the resolver evicts, invalidates or closes this connection. */
+    close?(): Promise<void>;
+}
+/** Arguments handed to the host's `connect` step. */
+export interface DataPlaneConnectRequest<TConnectionInfo = unknown> {
+    tenantRef: string;
+    descriptor: DataPlaneDescriptor<TConnectionInfo>;
+}
+export interface PooledDataPlaneResolverOptions<TConnectionInfo = unknown> {
+    /**
+     * Look up a tenant's placement. Return `undefined` or `null` for an unknown
+     * tenant — the resolver then throws `UnknownTenantError` and never falls
+     * back to another database.
+     */
+    describe(tenantRef: string): Promise<DataPlaneDescriptor<TConnectionInfo> | undefined | null>;
+    /** Open a connection for a described tenant. */
+    connect(request: DataPlaneConnectRequest<TConnectionInfo>): Promise<DataPlaneConnection>;
+    /** Maximum number of cached data planes (LRU, default 32). */
+    cacheSize?: number;
+    /**
+     * Re-run `describe` for a cached tenant once its entry is older than this
+     * many milliseconds. Omitted (the default) means cached entries are only
+     * refreshed by an explicit `invalidate`.
+     */
+    revalidateAfterMs?: number;
+    /** Clock source, injectable for tests (default `Date.now`). */
+    now?: () => number;
+    /** Notified when closing an evicted connection fails (default: logs). */
+    onCloseError?: (info: {
+        tenantRef: string;
+        error: unknown;
+    }) => void;
+}
+/** A `DataPlaneResolver` that caches connections and can be invalidated. */
+export interface PooledDataPlaneResolver extends DataPlaneResolver {
+    resolve(tenantRef: string): Promise<DataPlaneHandle>;
+    /** Evict and close the cached data plane for one tenant. */
+    invalidate(tenantRef: string): Promise<void>;
+    /** Evict and close every cached data plane. */
+    invalidateAll(): Promise<void>;
+    /** Close every cached data plane; further `resolve` calls throw. */
+    close(): Promise<void>;
+}
+/** Options for the single-data-plane (back-compat) resolver. */
+export interface SingleDataPlaneResolverOptions {
+    /** Schema holding the framework's own tables (default `public`). */
+    coreSchema?: string;
+    /** Prefix for per-package schemas (default `pkg_`). */
+    packageSchemaPrefix?: string;
+    /** Generation reported on every handle, when the host tracks one. */
+    generation?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/tenancy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/tenancy/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,EAAE,EAAE,kBAAkB,CAAC;IACvB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrD;;;OAGG;IACH,UAAU,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB,CAAC,eAAe,GAAG,OAAO;IAC5D,8EAA8E;IAC9E,cAAc,EAAE,eAAe,CAAC;IAChC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,kBAAkB,CAAC;IACvB,8EAA8E;IAC9E,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,qDAAqD;AACrD,MAAM,WAAW,uBAAuB,CAAC,eAAe,GAAG,OAAO;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,mBAAmB,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,8BAA8B,CAAC,eAAe,GAAG,OAAO;IACvE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;IAC9F,gDAAgD;IAChD,OAAO,CAAC,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzF,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yEAAyE;IACzE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;CACtE;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrD,4DAA4D;IAC5D,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,+CAA+C;IAC/C,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,oEAAoE;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,8BAA8B;IAC7C,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/tenancy/types.js

@@ -0,0 +1,8 @@
+// ── Tenancy Types ──
+// Data-plane resolution: the framework mechanism that turns an opaque tenant
+// reference into the database handle plus schema namespaces its work runs in.
+// The framework owns caching, invalidation and fail-closed behavior; the host
+// application owns the lookup (where tenant routing lives) and the connect
+// step (how a connection is opened).
+export {};
+//# sourceMappingURL=types.js.map

package/dist/tenancy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tenancy/types.ts"],"names":[],"mappings":"AAAA,sBAAsB;AACtB,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,qCAAqC"}

package/dist/testing/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/testing/context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAIhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAGV,UAAU,EACV,SAAS,EAET,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,WAAW,EACX,aAAa,EAEb,UAAU,EACV,WAAW,EACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAKxD,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,WAAW,CASrE;AAID,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACnF,kCAAkC;IAClC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,oEAAoE;AACpE,wBAAgB,SAAS,IAAI,gBAAgB,CAW5C;AAID,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,yBAAyB;IACzB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,2BAA2B;IAC3B,KAAK,IAAI,IAAI,CAAC;CACf;AAED,mEAAmE;AACnE,wBAAgB,UAAU,IAAI,gBAAgB,CAgB7C;AAID,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,wBAAwB;IACxB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,0BAA0B;IAC1B,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC1C;AAED,+DAA+D;AAC/D,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,eAAe,CA8BrE;AAID,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;CACzB;AAED,2DAA2D;AAC3D,wBAAgB,MAAM,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAkExD;AAID,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACnB,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;QAC3C,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,KAAK,IAAI,IAAI,CAAC;CACf;AAED,kEAAkE;AAClE,wBAAgB,UAAU,IAAI,iBAAiB,CAwB9C;AAID,mEAAmE;AACnE,wBAAgB,wBAAwB,CACtC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,WAAW,CAAC,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAkQlC;AA4DD,4EAA4E;AAC5E,wBAAgB,cAAc,CAC5B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAChD,UAAU,CAAC,EAAE,gBAAgB,EAAE,GAC9B,WAAW,CAwBb;AAID,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,WAAW,CAGlD;AAID,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACjD,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,EAAE,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAC5B,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yEAAyE;IACzE,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,gBAAgB,CAiChF"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/testing/context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAIhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAGV,UAAU,EACV,SAAS,EAET,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,WAAW,EACX,aAAa,EAEb,UAAU,EACV,WAAW,EACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAKxD,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,WAAW,CASrE;AAID,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACnF,kCAAkC;IAClC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,oEAAoE;AACpE,wBAAgB,SAAS,IAAI,gBAAgB,CAW5C;AAID,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,yBAAyB;IACzB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,2BAA2B;IAC3B,KAAK,IAAI,IAAI,CAAC;CACf;AAED,mEAAmE;AACnE,wBAAgB,UAAU,IAAI,gBAAgB,CAgB7C;AAID,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,wBAAwB;IACxB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,0BAA0B;IAC1B,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC1C;AAED,+DAA+D;AAC/D,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,eAAe,CA8BrE;AAID,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;CACzB;AAED,2DAA2D;AAC3D,wBAAgB,MAAM,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAkExD;AAID,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACnB,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;QAC3C,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,KAAK,IAAI,IAAI,CAAC;CACf;AAED,kEAAkE;AAClE,wBAAgB,UAAU,IAAI,iBAAiB,CAwB9C;AAID,mEAAmE;AACnE,wBAAgB,wBAAwB,CACtC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,WAAW,CAAC,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAkQlC;AA4DD,4EAA4E;AAC5E,wBAAgB,cAAc,CAC5B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAChD,UAAU,CAAC,EAAE,gBAAgB,EAAE,GAC9B,WAAW,CAwBb;AAID,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,WAAW,CAGlD;AAID,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACjD,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,EAAE,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAC5B,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yEAAyE;IACzE,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,gBAAgB,CAsChF"}

package/dist/testing/context.js

@@ -528,6 +528,11 @@ export function createTestContext(options) {
         progress: options?.progress ?? { report: () => { } },
         ...capRuntime,
     };
-    return createExecutionContext(deps);
+    // Test fixtures legitimately configure a context after construction (ctx.time, ctx.events,
+    // ctx.request, ctx.auth). The production factory seals the container to stop in-process code
+    // fabricating an actor; that property lives on the real path. Here we return a writable
+    // container over the same sealed `auth`, so authority still cannot be mutated in place while
+    // fixtures stay configurable.
+    return { ...createExecutionContext(deps) };
 }
 //# sourceMappingURL=context.js.map