@ultimat3/entity 6.0.0 → 7.0.0

package/CLAUDE.md

@@ -568,9 +568,24 @@ Columns + invariants; the row type is derived from the columns. Tier 2.
   the tenant is a request-time value, so the seam is the enforcement.
 - **`crossTenant(reason, fn)` (`cross-tenant.ts`) is the ONE way to read across tenants**, for the
   three cases that have no single one: an admin surface over every org, background reconciliation,
-  support tooling. An `AsyncLocalStorage` scope with a written reason, the same shape
+  support tooling. An async-context scope with a written reason, the same shape
   `@ultimat3/db`'s `expectedQueryLoop` has, never a boolean argument on a repository call — which
   reads exactly like forgetting the tenant — and never a config list of exempt entities (axiom 1).
+  The scope opens through `asyncContext<string>('the cross-tenant reason')` from `@ultimat3/core`,
+  **never a `new AsyncLocalStorage` here, and that is a build error rather than a convention `As of
+  2026-08`** — `scripts/async-context-guard.ts` refuses the construction *and* the import that
+  binds the class, anywhere but `packages/core/src/async-context.ts`, and
+  `scripts/async-context-guard.test.ts` runs it over the tree in the gate's `unit` step. The
+  module-scope `new` this replaced threw `TypeError: undefined is not a constructor` at module
+  **evaluation** in a browser bundle, where the bundler stubs `node:async_hooks` to `{}`, taking
+  every importer of `cross-tenant.ts` with it. Now the module evaluates and `crossTenantReason()`
+  answers `undefined` there — in a browser nothing IS in flight, so that is the true answer. A
+  write is the case that names itself: `storage.run` throws `X_ASYNC_CONTEXT_UNAVAILABLE` instead
+  of a bare `TypeError`, though `crossTenant()` reaches it only past `assertCrossTenant`, which
+  wants a request context a browser does not have. A server saves no allocation — the store is
+  built on the first `get()` **or** `run()`, so a read constructs it too; what the laziness costs
+  is nothing observable, since `getStore()` outside a scope answers `undefined` whether the storage
+  existed or not.
   **The capability is proven twice**: `CROSS_TENANT_SCOPE` (`tenancy:cross`) on the actor, at the
   call and again at every plan built inside it, because `withChildContext({ actor })` swaps the
   actor without closing the scope and an impersonated caller must not inherit it —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/entity",
-  "version": "6.0.0",
+  "version": "7.0.0",
   "description": "A table + its domain type + invariants the database also enforces",
   "license": "MIT",
   "type": "module",
@@ -31,9 +31,9 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "6.0.0",
-    "@ultimat3/db": "6.0.0",
-    "@ultimat3/schema": "6.0.0",
-    "@ultimat3/time": "6.0.0"
+    "@ultimat3/core": "7.0.0",
+    "@ultimat3/db": "7.0.0",
+    "@ultimat3/schema": "7.0.0",
+    "@ultimat3/time": "7.0.0"
   }
 }

package/src/cross-tenant.ts

@@ -3,11 +3,11 @@
 // reads exactly like forgetting the tenant, and never a config list of exempt entities (axiom 1):
 // both put the argument somewhere other than the read it defends.
 
-// `node:` because Bun exposes no native async-context primitive: the scope has to outlive every
-// `await` inside it, and `AsyncLocalStorage` is the only thing that carries a value across them.
-// A module-scope flag would be shared by two concurrent requests — one of them ordinary.
-import { AsyncLocalStorage } from 'node:async_hooks';
-import { actorLabel, assert, hasScope, tryUseContext } from '@ultimat3/core';
+// The scope has to outlive every `await` inside it and a module-scope flag would be shared by two
+// concurrent requests — one of them ordinary — so it needs an async context. Opened through core's
+// one lazy seam rather than a `node:async_hooks` construction here, which threw at module
+// EVALUATION in a browser bundle (the bundler stubs the module to `{}`).
+import { actorLabel, assert, asyncContext, hasScope, tryUseContext } from '@ultimat3/core';
 import { crossTenantDenied } from './errors';
 
 /**
@@ -18,7 +18,7 @@ import { crossTenantDenied } from './errors';
  */
 export const CROSS_TENANT_SCOPE = 'tenancy:cross';
 
-const storage = new AsyncLocalStorage<string>();
+const storage = asyncContext<string>('the cross-tenant reason');
 
 /**
  * Run `fn` with the tenant guard lifted — every read and write it issues, at any depth and across
@@ -54,7 +54,7 @@ export function crossTenant<T>(reason: string, fn: () => T): T {
  * The innermost enclosing reason, or `undefined` outside every scope — which is every query in an
  * app that never calls `crossTenant`. Read by the tenant guard, and by nothing else.
  */
-export const crossTenantReason = (): string | undefined => storage.getStore();
+export const crossTenantReason = (): string | undefined => storage.get();
 
 /**
  * The capability check itself, run at `crossTenant()` and again for every plan built inside it.