@venturekit-pro/tenancy 0.0.0-dev.20260701100017 → 0.0.0-dev.20260704225856

package/dist/crud/crud.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Column-agnostic CRUD over `vk_tenants`.
+ *
+ * Pure SQL against a caller-supplied `Querier`; no `@venturekit/data`
+ * import. Reads `SELECT *` so app-added columns ride along (the data
+ * client maps them). Writes take a camelCase field bag and infer the
+ * right binding per value:
+ *   - `status`            → cast to the `tenant_status` enum.
+ *   - plain object / array → serialized + cast to `jsonb`.
+ *   - `Date` / scalar / null → bound as a plain parameter.
+ *
+ * This lets a consumer that ALTERed extra columns onto `vk_tenants`
+ * (e.g. `branding jsonb`, `secret_arn_prefix text`) create / update
+ * them through the same helpers without the package knowing the shape.
+ */
+import type { Querier, TenantRecord, TenantStatus, TenantWriteFields } from './types.js';
+/** List every tenant, newest first. */
+export declare function listTenants(querier: Querier): Promise<TenantRecord[]>;
+/** Fetch one tenant by id, or `null` when absent. */
+export declare function getTenantById(querier: Querier, id: string): Promise<TenantRecord | null>;
+/** Fetch one tenant by its unique `slug`, or `null`. */
+export declare function getTenantBySlug(querier: Querier, slug: string): Promise<TenantRecord | null>;
+/** Fetch one tenant by its `primary_domain`, or `null`. */
+export declare function getTenantByPrimaryDomain(querier: Querier, domain: string): Promise<TenantRecord | null>;
+/**
+ * Insert a tenant from a camelCase field bag. Omit `id` to let the DB
+ * default (`gen_random_uuid()`) assign it. The `slug` unique constraint
+ * is DB-enforced — callers map `23505` via `isUniqueViolation`.
+ */
+export declare function createTenant(querier: Querier, fields: TenantWriteFields): Promise<TenantRecord>;
+/**
+ * Update a tenant from a camelCase field bag. Always bumps `updated_at`.
+ * Returns the updated row, or `null` when no tenant matches `id`. A
+ * no-op (`fields` empty) still touches `updated_at` and returns the row.
+ */
+export declare function updateTenant(querier: Querier, id: string, fields: TenantWriteFields): Promise<TenantRecord | null>;
+/**
+ * Convenience: flip a tenant's lifecycle `status`. Returns the updated
+ * row, or `null` when no tenant matches. For richer transitions
+ * (stamping `suspended_at` / `archived_at`, cascades) use the lifecycle
+ * helpers in `../lifecycle`.
+ */
+export declare function setTenantStatus(querier: Querier, id: string, status: TenantStatus): Promise<TenantRecord | null>;
+/** True when `err` is a Postgres `unique_violation` (23505). */
+export declare function isUniqueViolation(err: unknown): boolean;
+//# sourceMappingURL=crud.d.ts.map

package/dist/crud/crud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crud.d.ts","sourceRoot":"","sources":["../../src/crud/crud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAsCpB,uCAAuC;AACvC,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAI3E;AAED,qDAAqD;AACrD,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAM9B;AAED,wDAAwD;AACxD,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAM9B;AAED,2DAA2D;AAC3D,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAM9B;AAID;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,YAAY,CAAC,CAsBvB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAiB9B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAMvD"}

package/dist/crud/crud.js

@@ -0,0 +1,127 @@
+/**
+ * Column-agnostic CRUD over `vk_tenants`.
+ *
+ * Pure SQL against a caller-supplied `Querier`; no `@venturekit/data`
+ * import. Reads `SELECT *` so app-added columns ride along (the data
+ * client maps them). Writes take a camelCase field bag and infer the
+ * right binding per value:
+ *   - `status`            → cast to the `tenant_status` enum.
+ *   - plain object / array → serialized + cast to `jsonb`.
+ *   - `Date` / scalar / null → bound as a plain parameter.
+ *
+ * This lets a consumer that ALTERed extra columns onto `vk_tenants`
+ * (e.g. `branding jsonb`, `secret_arn_prefix text`) create / update
+ * them through the same helpers without the package knowing the shape.
+ */
+/** `displayName` → `display_name`, `additionalDomains` → `additional_domains`. */
+function camelToSnake(key) {
+    return key.replace(/[A-Z]/g, (m) => `_${m.toLowerCase()}`);
+}
+/**
+ * Build a single `column = $n[::cast]` (or VALUES placeholder) for one
+ * field, pushing the bound value onto `params`. Centralizes the
+ * type-inference rules shared by INSERT + UPDATE.
+ */
+function bindField(key, value, params) {
+    const column = camelToSnake(key);
+    params.push(value);
+    const n = params.length;
+    if (key === 'status') {
+        return { column, placeholder: `$${n}::tenant_status` };
+    }
+    const isJsonb = value !== null &&
+        typeof value === 'object' &&
+        !(value instanceof Date);
+    if (isJsonb) {
+        // Replace the raw value with its JSON serialization.
+        params[n - 1] = JSON.stringify(value);
+        return { column, placeholder: `$${n}::jsonb` };
+    }
+    return { column, placeholder: `$${n}` };
+}
+// ─── Reads ──────────────────────────────────────────────────────────
+/** List every tenant, newest first. */
+export async function listTenants(querier) {
+    return querier(`SELECT * FROM vk_tenants ORDER BY created_at DESC`);
+}
+/** Fetch one tenant by id, or `null` when absent. */
+export async function getTenantById(querier, id) {
+    const rows = await querier(`SELECT * FROM vk_tenants WHERE id = $1 LIMIT 1`, [id]);
+    return rows[0] ?? null;
+}
+/** Fetch one tenant by its unique `slug`, or `null`. */
+export async function getTenantBySlug(querier, slug) {
+    const rows = await querier(`SELECT * FROM vk_tenants WHERE slug = $1 LIMIT 1`, [slug]);
+    return rows[0] ?? null;
+}
+/** Fetch one tenant by its `primary_domain`, or `null`. */
+export async function getTenantByPrimaryDomain(querier, domain) {
+    const rows = await querier(`SELECT * FROM vk_tenants WHERE primary_domain = $1 LIMIT 1`, [domain]);
+    return rows[0] ?? null;
+}
+// ─── Writes ─────────────────────────────────────────────────────────
+/**
+ * Insert a tenant from a camelCase field bag. Omit `id` to let the DB
+ * default (`gen_random_uuid()`) assign it. The `slug` unique constraint
+ * is DB-enforced — callers map `23505` via `isUniqueViolation`.
+ */
+export async function createTenant(querier, fields) {
+    const keys = Object.keys(fields);
+    if (keys.length === 0) {
+        throw new Error('createTenant requires at least one field');
+    }
+    const params = [];
+    const columns = [];
+    const placeholders = [];
+    for (const key of keys) {
+        const { column, placeholder } = bindField(key, fields[key], params);
+        columns.push(column);
+        placeholders.push(placeholder);
+    }
+    const rows = await querier(`INSERT INTO vk_tenants (${columns.join(', ')})
+     VALUES (${placeholders.join(', ')})
+     RETURNING *`, params);
+    const row = rows[0];
+    if (!row)
+        throw new Error('vk_tenants insert returned no rows');
+    return row;
+}
+/**
+ * Update a tenant from a camelCase field bag. Always bumps `updated_at`.
+ * Returns the updated row, or `null` when no tenant matches `id`. A
+ * no-op (`fields` empty) still touches `updated_at` and returns the row.
+ */
+export async function updateTenant(querier, id, fields) {
+    const params = [];
+    const sets = [];
+    for (const key of Object.keys(fields)) {
+        const { column, placeholder } = bindField(key, fields[key], params);
+        sets.push(`${column} = ${placeholder}`);
+    }
+    sets.push('updated_at = NOW()');
+    params.push(id);
+    const rows = await querier(`UPDATE vk_tenants
+        SET ${sets.join(', ')}
+      WHERE id = $${params.length}
+      RETURNING *`, params);
+    return rows[0] ?? null;
+}
+/**
+ * Convenience: flip a tenant's lifecycle `status`. Returns the updated
+ * row, or `null` when no tenant matches. For richer transitions
+ * (stamping `suspended_at` / `archived_at`, cascades) use the lifecycle
+ * helpers in `../lifecycle`.
+ */
+export async function setTenantStatus(querier, id, status) {
+    return updateTenant(querier, id, { status });
+}
+/** True when `err` is a Postgres `unique_violation` (23505). */
+export function isUniqueViolation(err) {
+    if (err && typeof err === 'object' && 'code' in err) {
+        if (err.code === '23505')
+            return true;
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    return /duplicate key|unique constraint/i.test(message);
+}
+//# sourceMappingURL=crud.js.map

package/dist/crud/crud.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crud.js","sourceRoot":"","sources":["../../src/crud/crud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,kFAAkF;AAClF,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,GAAW,EACX,KAAc,EACd,MAAiB;IAEjB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAExB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,OAAO,GACX,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;IAC3B,IAAI,OAAO,EAAE,CAAC;QACZ,qDAAqD;QACrD,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,uEAAuE;AAEvE,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,OAAO,OAAO,CACZ,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,EAAU;IAEV,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,gDAAgD,EAChD,CAAC,EAAE,CAAC,CACL,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,kDAAkD,EAClD,CAAC,IAAI,CAAC,CACP,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,4DAA4D,EAC5D,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,MAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;eAClC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;iBACrB,EACb,MAAM,CACP,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,EAAU,EACV,MAAyB;IAEzB,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,MAAM,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB;cACU,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBACT,MAAM,CAAC,MAAM;kBACf,EACd,MAAM,CACP,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,EAAU,EACV,MAAoB;IAEpB,OAAO,YAAY,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QACpD,IAAK,GAA0B,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC"}

package/dist/crud/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `vk_tenants` CRUD — column-agnostic create / read / update + types.
+ *
+ * The lean parent-row primitives. Lifecycle transitions with cascade
+ * (suspend / archive / restore / hard-delete) live in `../lifecycle`.
+ */
+export type { TenantStatus, TenantRecord, TenantWriteFields, Querier, } from './types.js';
+export { listTenants, getTenantById, getTenantBySlug, getTenantByPrimaryDomain, createTenant, updateTenant, setTenantStatus, isUniqueViolation, } from './crud.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/crud/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crud/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,OAAO,GACR,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,WAAW,EACX,aAAa,EACb,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAC"}

package/dist/crud/index.js

@@ -0,0 +1,8 @@
+/**
+ * `vk_tenants` CRUD — column-agnostic create / read / update + types.
+ *
+ * The lean parent-row primitives. Lifecycle transitions with cascade
+ * (suspend / archive / restore / hard-delete) live in `../lifecycle`.
+ */
+export { listTenants, getTenantById, getTenantBySlug, getTenantByPrimaryDomain, createTenant, updateTenant, setTenantStatus, isUniqueViolation, } from './crud.js';
+//# sourceMappingURL=index.js.map

package/dist/crud/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crud/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EACL,WAAW,EACX,aAAa,EACb,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAC"}

package/dist/crud/types.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Types for the bare `vk_tenants` CRUD module.
+ *
+ * The tenancy package owns the lean parent row (`id`, `slug`,
+ * `display_name`, `status`, `primary_domain`, lifecycle + `metadata`).
+ * Consuming apps may ALTER the table to add their own columns (e.g. the
+ * CMS adds `branding` / `settings` / `additional_domains`). The CRUD here
+ * is deliberately **column-agnostic**: reads `SELECT *` (the data client
+ * auto-maps every column, app-added ones included) and writes accept a
+ * camelCase field bag so app columns flow through without the package
+ * enumerating them.
+ */
+/** Lifecycle status — mirrors the DB enum `tenant_status`. */
+export type TenantStatus = 'pending' | 'active' | 'suspended' | 'archived' | 'deleted';
+/**
+ * A `vk_tenants` row, post-mapping (snake_case → camelCase). The package
+ * guarantees the base columns; app-added columns appear too at runtime
+ * (the data client maps them) — consumers cast to a wider row type.
+ */
+export interface TenantRecord {
+    id: string;
+    slug: string;
+    displayName: string;
+    status: TenantStatus;
+    primaryDomain: string | null;
+    metadata: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+    /** App-added columns (branding, settings, …) surface here at runtime. */
+    [column: string]: unknown;
+}
+/**
+ * A camelCase field bag for create / update. Base columns plus any
+ * app-added columns the consumer ALTERed onto `vk_tenants`. Object /
+ * array values are written as `jsonb`; `status` is cast to the
+ * `tenant_status` enum; everything else binds as a plain param.
+ */
+export type TenantWriteFields = Record<string, unknown>;
+/**
+ * Querier — same shape as the rest of the workspace. Declared locally so
+ * the package carries no hard dependency on `@venturekit/data`.
+ */
+export type Querier = <T = Record<string, unknown>[]>(sql: string, params?: unknown[]) => Promise<T>;
+//# sourceMappingURL=types.d.ts.map

package/dist/crud/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/crud/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,UAAU,GACV,SAAS,CAAC;AAEd;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,yEAAyE;IACzE,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAExD;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAClD,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,OAAO,EAAE,KACf,OAAO,CAAC,CAAC,CAAC,CAAC"}

package/dist/crud/types.js

@@ -0,0 +1,14 @@
+/**
+ * Types for the bare `vk_tenants` CRUD module.
+ *
+ * The tenancy package owns the lean parent row (`id`, `slug`,
+ * `display_name`, `status`, `primary_domain`, lifecycle + `metadata`).
+ * Consuming apps may ALTER the table to add their own columns (e.g. the
+ * CMS adds `branding` / `settings` / `additional_domains`). The CRUD here
+ * is deliberately **column-agnostic**: reads `SELECT *` (the data client
+ * auto-maps every column, app-added ones included) and writes accept a
+ * camelCase field bag so app columns flow through without the package
+ * enumerating them.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/crud/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/crud/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/index.d.ts

@@ -10,6 +10,8 @@
 export * from './types/index.js';
 export { TenantContext, createTenantContext, getCurrentTenant, resolveTenant, } from './context/index.js';
 export * from './middleware/index.js';
+export { listTenants, getTenantById, getTenantBySlug, getTenantByPrimaryDomain, createTenant, updateTenant, setTenantStatus, isUniqueViolation as isTenantUniqueViolation, } from './crud/index.js';
+export type { TenantRecord, TenantWriteFields, TenantStatus as TenantDbStatus, } from './crud/index.js';
 export { suspendTenant, archiveTenant, restoreTenant, hardDeleteTenant, planCascade, executeCascade, } from './lifecycle/index.js';
 export type { TenantLifecycleStatus, LifecycleArgs, LifecycleOperationArgs, HardDeleteArgs, LifecycleAuditEvent, LifecycleAuditSink, CascadePlanEntry, CascadeOptions, CascadeResult, } from './lifecycle/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAG5B,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAG5B,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EACL,WAAW,EACX,aAAa,EACb,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,iBAAiB,IAAI,uBAAuB,GAC7C,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,YAAY,EACZ,iBAAiB,EAGjB,YAAY,IAAI,cAAc,GAC/B,MAAM,iBAAiB,CAAC;AAQzB,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -13,6 +13,12 @@ export * from './types/index.js';
 export { createTenantContext, getCurrentTenant, resolveTenant, } from './context/index.js';
 // Middleware
 export * from './middleware/index.js';
+// Bare vk_tenants CRUD (column-agnostic create / read / update)
+export { listTenants, getTenantById, getTenantBySlug, getTenantByPrimaryDomain, createTenant, updateTenant, setTenantStatus, isUniqueViolation as isTenantUniqueViolation, } from './crud/index.js';
+// Role → scopes mapping lives in @venturekit/auth (vk_role_scopes +
+// createRoleScopesResolver) — baseline authorization, useful without
+// tenancy. The scopes middleware consumes it through the structural
+// `RoleScopesLookup` type (re-exported via ./middleware above).
 // Lifecycle (suspend / archive / restore / hard-delete + cascade walker)
 export { suspendTenant, archiveTenant, restoreTenant, hardDeleteTenant, planCascade, executeCascade, } from './lifecycle/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,UAAU;AACV,OAAO,EAEL,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,aAAa;AACb,cAAc,uBAAuB,CAAC;AAEtC,yEAAyE;AACzE,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,cAAc,GACf,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,UAAU;AACV,OAAO,EAEL,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,aAAa;AACb,cAAc,uBAAuB,CAAC;AAEtC,gEAAgE;AAChE,OAAO,EACL,WAAW,EACX,aAAa,EACb,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,iBAAiB,IAAI,uBAAuB,GAC7C,MAAM,iBAAiB,CAAC;AASzB,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,gEAAgE;AAEhE,yEAAyE;AACzE,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,cAAc,GACf,MAAM,sBAAsB,CAAC"}

package/dist/lifecycle/cascade.js

@@ -42,10 +42,10 @@
 export async function planCascade(querier, options = {}) {
     const schema = options.schema ?? 'public';
     const skip = new Set([
-        // `tenants` is the root we're collapsing into; the helper deletes
+        // `vk_tenants` is the root we're collapsing into; the helper deletes
         // it separately at the very end. Including it in the cascade
         // would cause a "depends on itself" cycle.
-        'tenants',
+        'vk_tenants',
         ...(options.skipTables ?? []),
     ]);
     const tables = await querier(`SELECT table_schema AS "schema_name", table_name
@@ -162,7 +162,7 @@ export async function executeCascade(querier, options) {
         counts[entry.tableName] = rows.length;
     }
     // Finally, delete the tenants row itself.
-    const tenantsTable = `${schema}.tenants`;
+    const tenantsTable = `${schema}.vk_tenants`;
     const rows = await querier(`DELETE FROM ${tenantsTable} WHERE id = $1 RETURNING 1 AS id`, [options.tenantId]);
     counts[tenantsTable] = rows.length;
     return {

package/dist/lifecycle/cascade.js.map

@@ -1 +1 @@
-{"version":3,"file":"cascade.js","sourceRoot":"","sources":["../../src/lifecycle/cascade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAqDH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,UAAyD,EAAE;IAE3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;QACnB,kEAAkE;QAClE,6DAA6D;QAC7D,2CAA2C;QAC3C,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;KAC9B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B;;;uCAGmC,EACnC,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAClE,CAAC;IACF,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B;;;;;;;;;;iCAU6B,EAC7B,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,mCAAmC;IACnC,sEAAsE;IACtE,sEAAsE;IACtE,6DAA6D;IAC7D,mEAAmE;IACnE,qDAAqD;IACrD,EAAE;IACF,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,+DAA+D;IAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACxD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QACnC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IACE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;YAClC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;YACnC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,EACtC,CAAC;YACD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/D,4DAA4D;YAC5D,kEAAkE;YAClE,YAAY;YACZ,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,+BAA+B;IAC/B,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACjD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,oEAAoE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBAC3F,kEAAkE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,2CAA2C;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;gBAC3B,KAAK;gBACL,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAE;aAC7B,CAAC,CAAC;YACH,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,sEAAsE;QACtE,KAAK,MAAM,QAAQ,IAAI,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,KAAK,MAAM,IAAI,IAAI,MAAM;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,EAAE,CAAC;IACV,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,OAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEjD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,uDAAuD;QACvD,0CAA0C;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,eAAe,KAAK,CAAC,SAAS,yCAAyC,EACvE,CAAC,OAAO,CAAC,QAAQ,CAAC,CACnB,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACxC,CAAC;IAED,0CAA0C;IAC1C,MAAM,YAAY,GAAG,GAAG,MAAM,UAAU,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,eAAe,YAAY,kCAAkC,EAC7D,CAAC,OAAO,CAAC,QAAQ,CAAC,CACnB,CAAC;IACF,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IAEnC,OAAO;QACL,IAAI;QACJ,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cascade.js","sourceRoot":"","sources":["../../src/lifecycle/cascade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAqDH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,UAAyD,EAAE;IAE3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;QACnB,qEAAqE;QACrE,6DAA6D;QAC7D,2CAA2C;QAC3C,YAAY;QACZ,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;KAC9B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B;;;uCAGmC,EACnC,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAClE,CAAC;IACF,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B;;;;;;;;;;iCAU6B,EAC7B,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,mCAAmC;IACnC,sEAAsE;IACtE,sEAAsE;IACtE,6DAA6D;IAC7D,mEAAmE;IACnE,qDAAqD;IACrD,EAAE;IACF,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,+DAA+D;IAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACxD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QACnC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IACE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;YAClC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;YACnC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,EACtC,CAAC;YACD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/D,4DAA4D;YAC5D,kEAAkE;YAClE,YAAY;YACZ,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,+BAA+B;IAC/B,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACjD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,oEAAoE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBAC3F,kEAAkE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,2CAA2C;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;gBAC3B,KAAK;gBACL,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAE;aAC7B,CAAC,CAAC;YACH,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,sEAAsE;QACtE,KAAK,MAAM,QAAQ,IAAI,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,KAAK,MAAM,IAAI,IAAI,MAAM;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,EAAE,CAAC;IACV,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,OAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEjD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,uDAAuD;QACvD,0CAA0C;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,eAAe,KAAK,CAAC,SAAS,yCAAyC,EACvE,CAAC,OAAO,CAAC,QAAQ,CAAC,CACnB,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACxC,CAAC;IAED,0CAA0C;IAC1C,MAAM,YAAY,GAAG,GAAG,MAAM,aAAa,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,eAAe,YAAY,kCAAkC,EAC7D,CAAC,OAAO,CAAC,QAAQ,CAAC,CACnB,CAAC;IACF,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IAEnC,OAAO;QACL,IAAI;QACJ,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC"}

package/dist/lifecycle/operations.js

@@ -112,7 +112,7 @@ async function mutateStatus(querier, tenantId, status, reason) {
     // app-side derived state (e.g. cached counters) is the app's
     // responsibility to refresh.
     if (reason !== undefined && reason !== null) {
-        await querier(`UPDATE tenants
+        await querier(`UPDATE vk_tenants
           SET status = $2,
               metadata = jsonb_set(
                 COALESCE(metadata, '{}'::jsonb),
@@ -124,7 +124,7 @@ async function mutateStatus(querier, tenantId, status, reason) {
         WHERE id = $1`, [tenantId, status, reason]);
     }
     else {
-        await querier(`UPDATE tenants
+        await querier(`UPDATE vk_tenants
           SET status = $2,
               updated_at = now()
         WHERE id = $1`, [tenantId, status]);

package/dist/middleware/handoff-authorize.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Tenancy-side authorization gate for cross-domain session handoff.
+ *
+ * The handoff MECHANISM (single-use codes, refresh-token exchange,
+ * cookie minting) lives in `@venturekit/auth/server` — it is session
+ * machinery and knows nothing about tenants. The QUESTION it delegates
+ * — *"may this user get a session on that host?"* — is pure tenancy:
+ * resolve the host to a tenant, check the user is an active tenant
+ * user there. This factory packages that answer so apps don't
+ * hand-roll host normalization and the fail-closed rules:
+ *
+ * ```ts
+ * // app code
+ * createSessionHandoffRoutes({
+ *   store,
+ *   authorize: createTenantHandoffAuthorize({
+ *     resolveTenantByHost: (host) => loadByDomain(host),
+ *     isActiveTenantUser: ({ tenantId, userSub }) =>
+ *       hasApprovedMembership(tenantId, userSub),
+ *   }),
+ *   ...
+ * });
+ * ```
+ *
+ * Fail-closed by construction: unknown host → false, resolver error →
+ * false is the CALLER's job to avoid (let errors propagate = request
+ * fails, which is also closed), missing tenant user → false.
+ */
+/** Host → tenant resolution, app-provided (usually the same lookup the
+ *  tenant middleware uses). Receives a bare lowercase hostname — no
+ *  port, no `www.` prefix. Return null for unknown hosts. */
+export type HandoffTenantResolver = (host: string) => Promise<{
+    id: string;
+} | null>;
+export interface TenantHandoffAuthorizeOptions {
+    /** Resolve the (normalized) target host to a tenant. */
+    resolveTenantByHost: HandoffTenantResolver;
+    /**
+     * Is this user an ACTIVE tenant user of the resolved tenant?
+     * Apps define "active" (approved, not suspended, not deleted, …) —
+     * the same rule their scope middleware uses.
+     */
+    isActiveTenantUser: (args: {
+        tenantId: string;
+        userSub: string;
+    }) => Promise<boolean>;
+}
+/**
+ * Normalize a browser-facing host for tenant resolution: lowercase,
+ * strip the port and a leading `www.`.
+ */
+export declare function normalizeHandoffHost(targetHost: string): string;
+/**
+ * Build an `authorize` function for
+ * `@venturekit/auth/server`'s `createSessionHandoffRoutes`.
+ */
+export declare function createTenantHandoffAuthorize(options: TenantHandoffAuthorizeOptions): (args: {
+    userSub: string;
+    targetHost: string;
+}) => Promise<boolean>;
+//# sourceMappingURL=handoff-authorize.d.ts.map

package/dist/middleware/handoff-authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff-authorize.d.ts","sourceRoot":"","sources":["../../src/middleware/handoff-authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;6DAE6D;AAC7D,MAAM,MAAM,qBAAqB,GAAG,CAClC,IAAI,EAAE,MAAM,KACT,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,6BAA6B;IAC5C,wDAAwD;IACxD,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,IAAI,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAM/D;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAUrE"}

package/dist/middleware/handoff-authorize.js

@@ -0,0 +1,55 @@
+/**
+ * Tenancy-side authorization gate for cross-domain session handoff.
+ *
+ * The handoff MECHANISM (single-use codes, refresh-token exchange,
+ * cookie minting) lives in `@venturekit/auth/server` — it is session
+ * machinery and knows nothing about tenants. The QUESTION it delegates
+ * — *"may this user get a session on that host?"* — is pure tenancy:
+ * resolve the host to a tenant, check the user is an active tenant
+ * user there. This factory packages that answer so apps don't
+ * hand-roll host normalization and the fail-closed rules:
+ *
+ * ```ts
+ * // app code
+ * createSessionHandoffRoutes({
+ *   store,
+ *   authorize: createTenantHandoffAuthorize({
+ *     resolveTenantByHost: (host) => loadByDomain(host),
+ *     isActiveTenantUser: ({ tenantId, userSub }) =>
+ *       hasApprovedMembership(tenantId, userSub),
+ *   }),
+ *   ...
+ * });
+ * ```
+ *
+ * Fail-closed by construction: unknown host → false, resolver error →
+ * false is the CALLER's job to avoid (let errors propagate = request
+ * fails, which is also closed), missing tenant user → false.
+ */
+/**
+ * Normalize a browser-facing host for tenant resolution: lowercase,
+ * strip the port and a leading `www.`.
+ */
+export function normalizeHandoffHost(targetHost) {
+    return (targetHost || '')
+        .trim()
+        .toLowerCase()
+        .split(':', 1)[0]
+        .replace(/^www\./, '');
+}
+/**
+ * Build an `authorize` function for
+ * `@venturekit/auth/server`'s `createSessionHandoffRoutes`.
+ */
+export function createTenantHandoffAuthorize(options) {
+    return async ({ userSub, targetHost }) => {
+        const host = normalizeHandoffHost(targetHost);
+        if (!host || !userSub)
+            return false;
+        const tenant = await options.resolveTenantByHost(host);
+        if (!tenant)
+            return false;
+        return options.isActiveTenantUser({ tenantId: tenant.id, userSub });
+    };
+}
+//# sourceMappingURL=handoff-authorize.js.map

package/dist/middleware/handoff-authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff-authorize.js","sourceRoot":"","sources":["../../src/middleware/handoff-authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAuBH;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;SACtB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE;SACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsC;IAEtC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,OAAO,OAAO,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/index.d.ts

@@ -5,4 +5,10 @@ export { createTenantMiddleware, TenantNotFoundError, TenantSuspendedError, Tena
 export { createQuotaMiddleware, QuotaExceededError, checkQuotas } from './quota-middleware.js';
 export { createRuntimeTenantMiddleware, hostPrefixDomainResolver, } from './runtime-tenant-middleware.js';
 export type { RuntimeTenantResolver, RuntimeTenantMiddlewareOptions, HostPrefixDomainResolverOptions, } from './runtime-tenant-middleware.js';
+export { createTenantUserScopesMiddleware, getTenantUser, requireTenantUser, } from './tenant-user-scopes-middleware.js';
+export type { TenantUserWithRole, TenantUserResolver, TenantUserScopesMiddlewareOptions, RoleScopesLookup, } from './tenant-user-scopes-middleware.js';
+export { TENANT_ROLES_CLAIM, TENANT_ROLES_MAX_LENGTH, packTenantRoles, unpackTenantRoles, } from './tenant-roles-claim.js';
+export type { TenantRoleEntry } from './tenant-roles-claim.js';
+export { createTenantHandoffAuthorize, normalizeHandoffHost, } from './handoff-authorize.js';
+export type { HandoffTenantResolver, TenantHandoffAuthorizeOptions, } from './handoff-authorize.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,qBAAqB,EACrB,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,qBAAqB,EACrB,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,iBAAiB,GAClB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iCAAiC,EACjC,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC"}

package/dist/middleware/index.js

@@ -4,4 +4,7 @@
 export { createTenantMiddleware, TenantNotFoundError, TenantSuspendedError, TenantInactiveError, } from './tenant-middleware.js';
 export { createQuotaMiddleware, QuotaExceededError, checkQuotas } from './quota-middleware.js';
 export { createRuntimeTenantMiddleware, hostPrefixDomainResolver, } from './runtime-tenant-middleware.js';
+export { createTenantUserScopesMiddleware, getTenantUser, requireTenantUser, } from './tenant-user-scopes-middleware.js';
+export { TENANT_ROLES_CLAIM, TENANT_ROLES_MAX_LENGTH, packTenantRoles, unpackTenantRoles, } from './tenant-roles-claim.js';
+export { createTenantHandoffAuthorize, normalizeHandoffHost, } from './handoff-authorize.js';
 //# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,iBAAiB,GAClB,MAAM,oCAAoC,CAAC;AAO5C,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}

package/dist/middleware/tenant-roles-claim.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Packed per-tenant roles claim — the token-side half of
+ * `createTenantUserScopesMiddleware`'s claims-first fast path.
+ *
+ * Multi-tenant apps assign users one role PER TENANT (a membership,
+ * a staff assignment, a seat, …). A single Cognito custom attribute
+ * can carry all of them:
+ *
+ *     custom:tenantRoles = "<tenantId>:<role>|<tenantId>:<role>|…"
+ *
+ * Contract (both halves matter — read the write-path rules!):
+ *
+ *   READ  — the middleware unpacks the claim from the verified ID
+ *     token and grants `scopesByRole[role]` for the current tenant
+ *     with NO store round-trip. A missing tenant falls back to the
+ *     app's `tenantUser` resolver, so a stale-but-too-narrow claim
+ *     can never lock a user out — it only costs the query the claim
+ *     would have saved.
+ *
+ *   WRITE — the app re-derives the FULL pack from its tenant-user
+ *     store and writes it (e.g. `adminUpdateUserAttributes`) on every
+ *     tenant-user mutation: sign-in upsert, approve, role change,
+ *     suspend / unsuspend, leave. Two rules:
+ *       1. Pack ACTIVE tenant users only (approved, not suspended,
+ *          not deleted). "Active" is decided at write time — the
+ *          claims path deliberately has no `isActive` hook.
+ *       2. Always recompute from the store; never string-edit the
+ *          previous value. Recomputing is self-healing.
+ *
+ * Staleness — the honest trade-off vs. the per-request store lookup:
+ * attributes are baked into tokens at issue time, so a change lands
+ * on the caller's NEXT token refresh (≤ the ID-token TTL, 1h by
+ * default). GRANTS take effect immediately anyway thanks to the
+ * claim-miss fallback; REVOCATIONS (suspend, demote) keep honoring
+ * the old role until refresh. Apps for which that window is
+ * unacceptable should not enable the claims path.
+ *
+ * Size — Cognito caps custom attribute values at 2048 chars
+ * ({@link TENANT_ROLES_MAX_LENGTH}), ≈ 40 UUID-keyed entries.
+ * {@link packTenantRoles} keeps entries in the given order and drops
+ * whatever doesn't fit; dropped tenants degrade to the fallback query.
+ * Order entries by likelihood of use (e.g. most recently active).
+ */
+/**
+ * Default claim name. The pool must declare a `tenantRoles` custom
+ * attribute (`customAttributes: ['tenantRoles', …]` on the auth
+ * intent in vk.config.ts) — Cognito prefixes it to
+ * `custom:tenantRoles` in JWTs.
+ *
+ * Deliberately NOT `custom:role` (the conventional login-tenant role
+ * claim, per-user and single-valued) and NOT `custom:roles`
+ * (`@venturekit/auth`'s session helpers parse that as a flat
+ * comma-separated role list).
+ */
+export declare const TENANT_ROLES_CLAIM = "custom:tenantRoles";
+/** Cognito's hard cap on a custom attribute value. */
+export declare const TENANT_ROLES_MAX_LENGTH = 2048;
+/** One packed entry: which role the user holds in which tenant. */
+export interface TenantRoleEntry {
+    tenantId: string;
+    role: string;
+}
+/**
+ * Pack tenant-role entries into the claim value, first-entry-wins on
+ * duplicate tenants, dropping trailing entries that would push the
+ * value past {@link TENANT_ROLES_MAX_LENGTH} (or a custom `maxLength`
+ * in tests). Returns `''` for no entries — write the empty string
+ * anyway; it must OVERWRITE the previous pack when the user's last
+ * tenant goes away.
+ *
+ * Throws on entries the codec cannot round-trip (empty fields or
+ * separator characters inside ids/roles) — those indicate a bug in
+ * the caller's derivation query, not user input.
+ */
+export declare function packTenantRoles(entries: readonly TenantRoleEntry[], maxLength?: number): string;
+/**
+ * Decode a packed claim into a `tenantId → role` map. Fail-closed on
+ * anything unexpected: a non-string claim, malformed segments, or
+ * duplicate tenants (first wins) silently contribute nothing — a
+ * garbled claim must never grant scopes, and the middleware's
+ * fallback query covers the affected tenant.
+ */
+export declare function unpackTenantRoles(raw: unknown): ReadonlyMap<string, string>;
+//# sourceMappingURL=tenant-roles-claim.d.ts.map

package/dist/middleware/tenant-roles-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-roles-claim.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-roles-claim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,SAAS,GAAE,MAAgC,GAC1C,MAAM,CAyBR;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAY3E"}

package/dist/middleware/tenant-roles-claim.js

@@ -0,0 +1,120 @@
+/**
+ * Packed per-tenant roles claim — the token-side half of
+ * `createTenantUserScopesMiddleware`'s claims-first fast path.
+ *
+ * Multi-tenant apps assign users one role PER TENANT (a membership,
+ * a staff assignment, a seat, …). A single Cognito custom attribute
+ * can carry all of them:
+ *
+ *     custom:tenantRoles = "<tenantId>:<role>|<tenantId>:<role>|…"
+ *
+ * Contract (both halves matter — read the write-path rules!):
+ *
+ *   READ  — the middleware unpacks the claim from the verified ID
+ *     token and grants `scopesByRole[role]` for the current tenant
+ *     with NO store round-trip. A missing tenant falls back to the
+ *     app's `tenantUser` resolver, so a stale-but-too-narrow claim
+ *     can never lock a user out — it only costs the query the claim
+ *     would have saved.
+ *
+ *   WRITE — the app re-derives the FULL pack from its tenant-user
+ *     store and writes it (e.g. `adminUpdateUserAttributes`) on every
+ *     tenant-user mutation: sign-in upsert, approve, role change,
+ *     suspend / unsuspend, leave. Two rules:
+ *       1. Pack ACTIVE tenant users only (approved, not suspended,
+ *          not deleted). "Active" is decided at write time — the
+ *          claims path deliberately has no `isActive` hook.
+ *       2. Always recompute from the store; never string-edit the
+ *          previous value. Recomputing is self-healing.
+ *
+ * Staleness — the honest trade-off vs. the per-request store lookup:
+ * attributes are baked into tokens at issue time, so a change lands
+ * on the caller's NEXT token refresh (≤ the ID-token TTL, 1h by
+ * default). GRANTS take effect immediately anyway thanks to the
+ * claim-miss fallback; REVOCATIONS (suspend, demote) keep honoring
+ * the old role until refresh. Apps for which that window is
+ * unacceptable should not enable the claims path.
+ *
+ * Size — Cognito caps custom attribute values at 2048 chars
+ * ({@link TENANT_ROLES_MAX_LENGTH}), ≈ 40 UUID-keyed entries.
+ * {@link packTenantRoles} keeps entries in the given order and drops
+ * whatever doesn't fit; dropped tenants degrade to the fallback query.
+ * Order entries by likelihood of use (e.g. most recently active).
+ */
+/**
+ * Default claim name. The pool must declare a `tenantRoles` custom
+ * attribute (`customAttributes: ['tenantRoles', …]` on the auth
+ * intent in vk.config.ts) — Cognito prefixes it to
+ * `custom:tenantRoles` in JWTs.
+ *
+ * Deliberately NOT `custom:role` (the conventional login-tenant role
+ * claim, per-user and single-valued) and NOT `custom:roles`
+ * (`@venturekit/auth`'s session helpers parse that as a flat
+ * comma-separated role list).
+ */
+export const TENANT_ROLES_CLAIM = 'custom:tenantRoles';
+/** Cognito's hard cap on a custom attribute value. */
+export const TENANT_ROLES_MAX_LENGTH = 2048;
+const ENTRY_SEPARATOR = '|';
+const PAIR_SEPARATOR = ':';
+/**
+ * Pack tenant-role entries into the claim value, first-entry-wins on
+ * duplicate tenants, dropping trailing entries that would push the
+ * value past {@link TENANT_ROLES_MAX_LENGTH} (or a custom `maxLength`
+ * in tests). Returns `''` for no entries — write the empty string
+ * anyway; it must OVERWRITE the previous pack when the user's last
+ * tenant goes away.
+ *
+ * Throws on entries the codec cannot round-trip (empty fields or
+ * separator characters inside ids/roles) — those indicate a bug in
+ * the caller's derivation query, not user input.
+ */
+export function packTenantRoles(entries, maxLength = TENANT_ROLES_MAX_LENGTH) {
+    let packed = '';
+    const seen = new Set();
+    for (const { tenantId, role } of entries) {
+        if (!tenantId ||
+            !role ||
+            tenantId.includes(ENTRY_SEPARATOR) ||
+            tenantId.includes(PAIR_SEPARATOR) ||
+            role.includes(ENTRY_SEPARATOR) ||
+            role.includes(PAIR_SEPARATOR)) {
+            throw new Error(`packTenantRoles: entry {tenantId: '${tenantId}', role: '${role}'} ` +
+                `is empty or contains a reserved separator ('${ENTRY_SEPARATOR}' / '${PAIR_SEPARATOR}')`);
+        }
+        if (seen.has(tenantId))
+            continue;
+        const segment = `${tenantId}${PAIR_SEPARATOR}${role}`;
+        const next = packed ? `${packed}${ENTRY_SEPARATOR}${segment}` : segment;
+        if (next.length > maxLength)
+            break;
+        packed = next;
+        seen.add(tenantId);
+    }
+    return packed;
+}
+/**
+ * Decode a packed claim into a `tenantId → role` map. Fail-closed on
+ * anything unexpected: a non-string claim, malformed segments, or
+ * duplicate tenants (first wins) silently contribute nothing — a
+ * garbled claim must never grant scopes, and the middleware's
+ * fallback query covers the affected tenant.
+ */
+export function unpackTenantRoles(raw) {
+    const out = new Map();
+    if (typeof raw !== 'string' || raw === '')
+        return out;
+    for (const segment of raw.split(ENTRY_SEPARATOR)) {
+        const sep = segment.indexOf(PAIR_SEPARATOR);
+        if (sep <= 0 || sep === segment.length - 1)
+            continue;
+        const tenantId = segment.slice(0, sep);
+        const role = segment.slice(sep + 1);
+        if (role.includes(PAIR_SEPARATOR))
+            continue;
+        if (!out.has(tenantId))
+            out.set(tenantId, role);
+    }
+    return out;
+}
+//# sourceMappingURL=tenant-roles-claim.js.map

package/dist/middleware/tenant-roles-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-roles-claim.js","sourceRoot":"","sources":["../../src/middleware/tenant-roles-claim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,sDAAsD;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAQ5C,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAmC,EACnC,YAAoB,uBAAuB;IAE3C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QACzC,IACE,CAAC,QAAQ;YACT,CAAC,IAAI;YACL,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;YAClC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,aAAa,IAAI,KAAK;gBAClE,+CAA+C,eAAe,QAAQ,cAAc,IAAI,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,MAAM,OAAO,GAAG,GAAG,QAAQ,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,eAAe,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;YAAE,MAAM;QACnC,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IACtD,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/middleware/tenant-user-scopes-middleware.d.ts

@@ -0,0 +1,100 @@
+import type { Middleware, RequestContext } from '@venturekit/runtime';
+/**
+ * Dynamic role → scopes lookup. Structurally identical to
+ * `@venturekit/auth`'s `RoleScopesLookup` (the `vk_role_scopes`-backed
+ * resolver) — declared locally so this package carries no dependency
+ * on the auth package; any `(role) => scopes` function fits.
+ */
+export type RoleScopesLookup = (role: string) => Promise<readonly string[]> | readonly string[];
+/**
+ * Minimal structural requirement on the app's tenant-user row: the
+ * per-tenant role that keys into `scopesByRole`. Apps extend it with
+ * their own columns (id, status, timestamps, …) and get them back,
+ * typed, from {@link getTenantUser}.
+ */
+export interface TenantUserWithRole {
+    role: string;
+}
+/**
+ * Loads the caller's tenant-user row for the CURRENT tenant. Called
+ * only when both `ctx.user` and `ctx.tenant` are set. Return `null`
+ * for "no row" — never throw for the not-found case.
+ */
+export interface TenantUserResolver<M extends TenantUserWithRole> {
+    (ctx: RequestContext): Promise<M | null> | M | null;
+}
+export interface TenantUserScopesMiddlewareOptions<M extends TenantUserWithRole> {
+    /**
+     * Tenant-user lookup for `(ctx.user, ctx.tenant)` — the store
+     * fallback for claim misses, and the lazy row loader behind
+     * {@link getTenantUser} / {@link requireTenantUser}.
+     */
+    tenantUser: TenantUserResolver<M>;
+    /**
+     * JWT claim carrying the packed per-tenant roles (see
+     * ./tenant-roles-claim.ts for the format and the write-path
+     * contract). Defaults to {@link TENANT_ROLES_CLAIM}
+     * (`custom:tenantRoles`) — harmless for apps that never write the
+     * attribute, since an absent claim always falls back to
+     * {@link TenantUserScopesMiddlewareOptions.tenantUser}. Pass
+     * `false` to force the store lookup on every request (instant
+     * revocation at one query per privileged request).
+     */
+    rolesClaim?: string | false;
+    /**
+     * The role → scopes matrix of the app — either a static table or a
+     * (possibly async) lookup function. Roles that resolve to nothing
+     * grant nothing (fail-closed). Tiered role models should build
+     * cumulative sets so higher roles are supersets of lower ones.
+     *
+     * For a DB-backed matrix (mutable at runtime, manageable from an
+     * admin UI) pass `@venturekit/auth`'s
+     * `createRoleScopesResolver(...).lookup` — the mapping lives in
+     * `vk_role_scopes` (structure shipped by the auth package's
+     * migrations, rows seeded by the app).
+     */
+    scopesByRole: Record<string, readonly string[]> | RoleScopesLookup;
+    /**
+     * Gate evaluated before any role scope is granted — the hook for
+     * app-specific "row exists but is not in good standing" rules
+     * (pending verification, active suspension, unpaid seat, …).
+     * The tenant-user row is still cached for {@link getTenantUser} so
+     * handlers can inspect WHY the caller is inactive.
+     *
+     * Default: every resolved row is active.
+     */
+    isActive?: (tenantUser: M) => boolean;
+    /**
+     * Tenant-INDEPENDENT extra scopes for the authenticated user —
+     * evaluated even when no tenant resolved. Use for cross-tenant
+     * operator allowlists (platform admins) or per-user scope
+     * overrides. Keep it fail-closed: return `[]` on any doubt.
+     */
+    userScopes?: (ctx: RequestContext) => Promise<readonly string[]> | readonly string[];
+}
+/**
+ * Build the middleware. See the module header for placement and
+ * semantics.
+ */
+export declare function createTenantUserScopesMiddleware<M extends TenantUserWithRole>(options: TenantUserScopesMiddlewareOptions<M>): Middleware<RequestContext>;
+/**
+ * The caller's tenant-user row in the current tenant, or `null` when
+ * there is none (or the middleware didn't run for this request).
+ *
+ * Lazy: the claims fast path grants scopes without loading the row,
+ * so the first call here triggers the middleware's `tenantUser`
+ * resolver; the result — including `null` — is cached on the request
+ * context and shared with concurrent callers.
+ */
+export declare function getTenantUser<M extends TenantUserWithRole>(ctx: RequestContext): Promise<M | null>;
+/**
+ * Like {@link getTenantUser} but throws `ForbiddenError` (403) when
+ * no tenant-user row resolves. For handlers whose scope gate already
+ * implies a row exists (any role-granted scope does), a miss here
+ * means either a wiring bug (middleware absent from the route's
+ * `middleware: [...]` array) or a stale packed claim for an
+ * assignment that was just revoked — in both cases 403 is the right
+ * answer.
+ */
+export declare function requireTenantUser<M extends TenantUserWithRole>(ctx: RequestContext): Promise<M>;
+//# sourceMappingURL=tenant-user-scopes-middleware.d.ts.map

package/dist/middleware/tenant-user-scopes-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-user-scopes-middleware.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-user-scopes-middleware.ts"],"names":[],"mappings":"AA+EA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGtE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,kBAAkB;IAC9D,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,iCAAiC,CAChD,CAAC,SAAS,kBAAkB;IAE5B;;;;OAIG;IACH,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAElC;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAE5B;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAAG,gBAAgB,CAAC;IAEnE;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,OAAO,CAAC;IAEtC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CACX,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC;CACrD;AAkBD;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,CAAC,SAAS,kBAAkB,EAC3E,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,UAAU,CAAC,cAAc,CAAC,CA2D5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,CAAC,SAAS,kBAAkB,EAC9D,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAKnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,SAAS,kBAAkB,EAClE,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,CAAC,CAAC,CAMZ"}

package/dist/middleware/tenant-user-scopes-middleware.js

@@ -0,0 +1,172 @@
+/**
+ * Tenant-user scopes middleware — per-tenant role → scope grants.
+ *
+ * Multi-tenant apps assign users a role PER TENANT (the `TenantUser`
+ * shape: one row per user × tenant — a community membership, a staff
+ * assignment, a seat, …). Grants come from two sources, in order:
+ *
+ *   1. CLAIMS FAST PATH — the packed `custom:tenantRoles` attribute
+ *      (see ./tenant-roles-claim.ts) carries the caller's role in
+ *      EVERY tenant, written by the app on each tenant-user mutation.
+ *      When the current tenant is in the pack, its role maps through
+ *      {@link TenantUserScopesMiddlewareOptions.scopesByRole} onto
+ *      `ctx.user.scopes` with zero store round-trips.
+ *   2. STORE FALLBACK — when the tenant is NOT in the pack (fresh
+ *      approval the token hasn't caught up with, first sign-in,
+ *      overflowed pack, app never writes the claim), the app-supplied
+ *      {@link TenantUserScopesMiddlewareOptions.tenantUser} resolver
+ *      loads the tenant-user row and
+ *      {@link TenantUserScopesMiddlewareOptions.isActive} gates the
+ *      grant — exactly the pre-claims behavior.
+ *
+ * The fallback means a too-NARROW claim can never lock a user out.
+ * The reverse staleness is the accepted trade-off: a REVOKED or
+ * demoted tenant user keeps their packed role until their next token
+ * refresh (≤ the ID-token TTL). Apps that cannot tolerate that
+ * window should disable the fast path with `rolesClaim: false` and
+ * eat one store query per privileged request.
+ *
+ * Placement: AFTER auth and AFTER tenant resolution
+ * (`createRuntimeTenantMiddleware`) in the route's middleware array —
+ * it needs `ctx.user` and `ctx.tenant`. The runtime's default auth
+ * middleware always runs before route middleware, so auth ordering is
+ * automatic.
+ *
+ * Fail-closed by design: no tenant-user row, an unknown role, a
+ * garbled claim, or a row rejected by `isActive` simply gains no
+ * scopes — the middleware never throws — and the runtime responds 403
+ * to any privileged route.
+ *
+ * The tenant-user ROW is resolved lazily: the claims path grants
+ * scopes without touching the store, so handlers that need the row
+ * (ids, timestamps, …) pull it through the async
+ * {@link getTenantUser} / {@link requireTenantUser} — one query on
+ * first access, cached on the request context afterwards. Routes
+ * that only scope-gate never pay it.
+ *
+ * @example
+ * ```ts
+ * // app/lib/authz.ts
+ * const SCOPES_BY_ROLE = {
+ *   member: ['member.verified'],
+ *   moderator: ['member.verified', 'moderation.reports.read'],
+ *   admin: ['member.verified', 'moderation.reports.read', 'admin.members.read'],
+ * };
+ *
+ * export const tenantUserScopes = () =>
+ *   createTenantUserScopesMiddleware({
+ *     tenantUser: (ctx) => loadMembership(ctx.tenant!.id, ctx.user!.id),
+ *     scopesByRole: SCOPES_BY_ROLE,
+ *     isActive: (m) => m.status === 'approved' && !m.suspendedUntil,
+ *   });
+ *
+ * // app/routes/admin/members/get.ts
+ * export const main = handler(async (_b, ctx) => {
+ *   const me = await requireTenantUser(ctx); // lazy row, cached
+ *   return listMembers(ctx.tenant!.id, me.id);
+ * }, {
+ *   scopes: ['admin.members.read'],
+ *   middleware: [tenancy, tenantUserScopes()],
+ * });
+ * ```
+ *
+ * Unlike the rest of this package's middleware, this module imports a
+ * VALUE (`ForbiddenError`) from `@venturekit/runtime`, not just types.
+ * That is deliberate: the middleware only makes sense inside
+ * `@venturekit/runtime.handler()` stacks, so the peer is always
+ * present wherever this module is loaded.
+ */
+import { ForbiddenError } from '@venturekit/runtime';
+import { TENANT_ROLES_CLAIM, unpackTenantRoles } from './tenant-roles-claim.js';
+const tenantUserStateByCtx = new WeakMap();
+/**
+ * Build the middleware. See the module header for placement and
+ * semantics.
+ */
+export function createTenantUserScopesMiddleware(options) {
+    const { tenantUser: resolveTenantUser, scopesByRole, isActive, userScopes } = options;
+    const rolesClaim = options.rolesClaim ?? TENANT_ROLES_CLAIM;
+    return {
+        name: 'tenant-user-scopes',
+        fn: async (ctx, next) => {
+            // Unauthenticated request: nothing to grant. Public routes pass
+            // through; scoped routes 401 at the runtime gate as usual.
+            if (!ctx.user)
+                return next();
+            const grant = (scopes) => {
+                for (const s of scopes) {
+                    if (!ctx.user.scopes.includes(s))
+                        ctx.user.scopes.push(s);
+                }
+            };
+            if (userScopes) {
+                grant(await userScopes(ctx));
+            }
+            // Static table or dynamic lookup — normalized to one async shape.
+            const scopesForRole = async (role) => typeof scopesByRole === 'function'
+                ? (await scopesByRole(role)) ?? []
+                : scopesByRole[role] ?? [];
+            if (ctx.tenant) {
+                // Handlers resolve the row on demand through getTenantUser().
+                const state = { load: () => Promise.resolve(resolveTenantUser(ctx)) };
+                tenantUserStateByCtx.set(ctx, state);
+                // Claims fast path: role for the current tenant straight from
+                // the verified token — no store round-trip. Packed roles are
+                // active-by-contract (the write path packs active tenant
+                // users only), so isActive is not consulted here.
+                const packedRole = rolesClaim === false
+                    ? undefined
+                    : unpackTenantRoles(ctx.user.claims?.[rolesClaim]).get(ctx.tenant.id);
+                if (packedRole !== undefined) {
+                    grant(await scopesForRole(packedRole));
+                }
+                else {
+                    // Store fallback — also covers "no row" (query returns
+                    // null and nothing is granted). Seed the lazy state so
+                    // handlers reading the row back don't query twice.
+                    const row = state.load();
+                    state.row = row;
+                    const tenantUser = (await row);
+                    if (tenantUser && (!isActive || isActive(tenantUser))) {
+                        grant(await scopesForRole(tenantUser.role));
+                    }
+                }
+            }
+            return next();
+        },
+    };
+}
+/**
+ * The caller's tenant-user row in the current tenant, or `null` when
+ * there is none (or the middleware didn't run for this request).
+ *
+ * Lazy: the claims fast path grants scopes without loading the row,
+ * so the first call here triggers the middleware's `tenantUser`
+ * resolver; the result — including `null` — is cached on the request
+ * context and shared with concurrent callers.
+ */
+export async function getTenantUser(ctx) {
+    const state = tenantUserStateByCtx.get(ctx);
+    if (!state)
+        return null;
+    if (!state.row)
+        state.row = state.load();
+    return (await state.row) ?? null;
+}
+/**
+ * Like {@link getTenantUser} but throws `ForbiddenError` (403) when
+ * no tenant-user row resolves. For handlers whose scope gate already
+ * implies a row exists (any role-granted scope does), a miss here
+ * means either a wiring bug (middleware absent from the route's
+ * `middleware: [...]` array) or a stale packed claim for an
+ * assignment that was just revoked — in both cases 403 is the right
+ * answer.
+ */
+export async function requireTenantUser(ctx) {
+    const tenantUser = await getTenantUser(ctx);
+    if (!tenantUser) {
+        throw new ForbiddenError('No tenant-user record in this tenant');
+    }
+    return tenantUser;
+}
+//# sourceMappingURL=tenant-user-scopes-middleware.js.map

package/dist/middleware/tenant-user-scopes-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-user-scopes-middleware.js","sourceRoot":"","sources":["../../src/middleware/tenant-user-scopes-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAuGhF,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAA2B,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAA6C;IAE7C,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAE5D,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACtB,gEAAgE;YAChE,2DAA2D;YAC3D,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,OAAO,IAAI,EAAE,CAAC;YAE7B,MAAM,KAAK,GAAG,CAAC,MAAyB,EAAQ,EAAE;gBAChD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;oBACvB,IAAI,CAAC,GAAG,CAAC,IAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;wBAAE,GAAG,CAAC,IAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC,CAAC;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,KAAK,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,CAAC;YAED,kEAAkE;YAClE,MAAM,aAAa,GAAG,KAAK,EAAE,IAAY,EAA8B,EAAE,CACvE,OAAO,YAAY,KAAK,UAAU;gBAChC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;gBAClC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAE/B,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,8DAA8D;gBAC9D,MAAM,KAAK,GAAoB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvF,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAErC,8DAA8D;gBAC9D,6DAA6D;gBAC7D,yDAAyD;gBACzD,kDAAkD;gBAClD,MAAM,UAAU,GACd,UAAU,KAAK,KAAK;oBAClB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAE1E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,KAAK,CAAC,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;gBACzC,CAAC;qBAAM,CAAC;oBACN,uDAAuD;oBACvD,uDAAuD;oBACvD,mDAAmD;oBACnD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;oBACzB,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;oBAChB,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,CAAa,CAAC;oBAC3C,IAAI,UAAU,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;wBACtD,KAAK,CAAC,MAAM,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAmB;IAEnB,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzC,OAAQ,CAAC,MAAM,KAAK,CAAC,GAAG,CAAc,IAAI,IAAI,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAmB;IAEnB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAI,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,cAAc,CAAC,sCAAsC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/migrations/0000_vk_tenancy_tenants.sql

@@ -57,7 +57,7 @@ CREATE TYPE tenant_status AS ENUM (
 
 -- ─── tenants ───────────────────────────────────────────────────────
 
-CREATE TABLE IF NOT EXISTS tenants (
+CREATE TABLE IF NOT EXISTS vk_tenants (
   id                uuid          PRIMARY KEY DEFAULT gen_random_uuid(),
   -- URL-safe identifier. Used for sub-domains, log lines, S3
   -- prefixes (`<slug>/...`), and the tenant-routing middleware.
@@ -92,14 +92,14 @@ CREATE TABLE IF NOT EXISTS tenants (
 -- Slug is the editor-friendly id used in log lines and S3 prefixes.
 -- Unique on lower(slug) so `Demo` and `demo` collide.
 CREATE UNIQUE INDEX IF NOT EXISTS tenants_slug_unique
-  ON tenants (lower(slug));
+  ON vk_tenants (lower(slug));
 
 -- Primary-domain lookup is the hot path for the tenancy middleware
 -- (one query per request before any business logic runs).
 CREATE UNIQUE INDEX IF NOT EXISTS tenants_primary_domain_unique
-  ON tenants (lower(primary_domain))
+  ON vk_tenants (lower(primary_domain))
   WHERE primary_domain IS NOT NULL;
 
 -- Status filter for admin "active tenants" dashboards.
 CREATE INDEX IF NOT EXISTS tenants_status_idx
-  ON tenants (status);
+  ON vk_tenants (status);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venturekit-pro/tenancy",
-  "version": "0.0.0-dev.20260701100017",
+  "version": "0.0.0-dev.20260704225856",
   "description": "Multi-tenant utilities for VentureKit",
   "type": "module",
   "main": "./dist/index.js",
@@ -30,10 +30,10 @@
     }
   },
   "dependencies": {
-    "@venturekit/core": "0.0.0-dev.20260701100017"
+    "@venturekit/core": "0.0.0-dev.20260704225856"
   },
   "peerDependencies": {
-    "@venturekit/runtime": "0.0.0-dev.20260701100017"
+    "@venturekit/runtime": "0.0.0-dev.20260704225856"
   },
   "peerDependenciesMeta": {
     "@venturekit/runtime": {
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
-    "@venturekit/runtime": "0.0.0-dev.20260701100017",
+    "@venturekit/runtime": "0.0.0-dev.20260704225856",
     "typescript": "^5.3.0"
   },
   "scripts": {

package/src/migrations/0000_vk_tenancy_tenants.sql

@@ -57,7 +57,7 @@ CREATE TYPE tenant_status AS ENUM (
 
 -- ─── tenants ───────────────────────────────────────────────────────
 
-CREATE TABLE IF NOT EXISTS tenants (
+CREATE TABLE IF NOT EXISTS vk_tenants (
   id                uuid          PRIMARY KEY DEFAULT gen_random_uuid(),
   -- URL-safe identifier. Used for sub-domains, log lines, S3
   -- prefixes (`<slug>/...`), and the tenant-routing middleware.
@@ -92,14 +92,14 @@ CREATE TABLE IF NOT EXISTS tenants (
 -- Slug is the editor-friendly id used in log lines and S3 prefixes.
 -- Unique on lower(slug) so `Demo` and `demo` collide.
 CREATE UNIQUE INDEX IF NOT EXISTS tenants_slug_unique
-  ON tenants (lower(slug));
+  ON vk_tenants (lower(slug));
 
 -- Primary-domain lookup is the hot path for the tenancy middleware
 -- (one query per request before any business logic runs).
 CREATE UNIQUE INDEX IF NOT EXISTS tenants_primary_domain_unique
-  ON tenants (lower(primary_domain))
+  ON vk_tenants (lower(primary_domain))
   WHERE primary_domain IS NOT NULL;
 
 -- Status filter for admin "active tenants" dashboards.
 CREATE INDEX IF NOT EXISTS tenants_status_idx
-  ON tenants (status);
+  ON vk_tenants (status);