@wrelik/db 0.1.3 → 2.0.0

package/.turbo/turbo-build.log

@@ -1,23 +1,27 @@
 
-> @wrelik/db@0.1.3 build /home/runner/work/wrelik-kit/wrelik-kit/packages/db
-> tsup src/index.ts src/unsupported.ts --format cjs,esm --dts --clean
+> @wrelik/db@2.0.0 build /home/runner/work/wrelik-kit/wrelik-kit/packages/db
+> tsup src/server/index.ts src/client/index.ts src/shared/index.ts --format cjs,esm --dts --clean
 
-CLI Building entry: src/index.ts, src/unsupported.ts
+CLI Building entry: src/client/index.ts, src/server/index.ts, src/shared/index.ts
 CLI Using tsconfig: tsconfig.json
 CLI tsup v8.5.1
 CLI Target: es2022
 CLI Cleaning output folder
 CJS Build start
 ESM Build start
-ESM dist/index.mjs       958.00 B
-ESM dist/unsupported.mjs 402.00 B
-ESM ⚡️ Build success in 58ms
-CJS dist/index.js       2.08 KB
-CJS dist/unsupported.js 1.28 KB
-CJS ⚡️ Build success in 60ms
+CJS dist/client/index.js 1.27 KB
+CJS dist/server/index.js 2.37 KB
+CJS dist/shared/index.js 767.00 B
+CJS ⚡️ Build success in 95ms
+ESM dist/shared/index.mjs 0 B
+ESM dist/client/index.mjs 268.00 B
+ESM dist/server/index.mjs 1.19 KB
+ESM ⚡️ Build success in 94ms
 DTS Build start
-DTS ⚡️ Build success in 3421ms
-DTS dist/index.d.ts        483.00 B
-DTS dist/unsupported.d.ts  74.00 B
-DTS dist/index.d.mts       483.00 B
-DTS dist/unsupported.d.mts 74.00 B
+DTS ⚡️ Build success in 5047ms
+DTS dist/client/index.d.ts  77.00 B
+DTS dist/server/index.d.ts  718.00 B
+DTS dist/shared/index.d.ts  340.00 B
+DTS dist/client/index.d.mts 77.00 B
+DTS dist/server/index.d.mts 719.00 B
+DTS dist/shared/index.d.mts 340.00 B

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @wrelik/db
 
+## 2.0.0
+
+### Major Changes
+
+- 818ed58: Refactor runtime packages to strict subpath exports (`/server`, `/client`, `/shared`) with side-effect free entrypoints and hard CI/runtime boundary enforcement.
+
+### Patch Changes
+
+- Updated dependencies [818ed58]
+  - @wrelik/errors@2.0.0
+
 ## 0.1.3
 
 ### Patch Changes

package/dist/client/index.d.mts

@@ -0,0 +1,3 @@
+declare const serverOnlyClientStub: never;
+
+export { serverOnlyClientStub };

package/dist/client/index.d.ts

@@ -0,0 +1,3 @@
+declare const serverOnlyClientStub: never;
+
+export { serverOnlyClientStub };

package/dist/{unsupported.js → client/index.js}

@@ -17,17 +17,18 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/unsupported.ts
-var unsupported_exports = {};
-__export(unsupported_exports, {
-  default: () => unsupported
+// src/client/index.ts
+var client_exports = {};
+__export(client_exports, {
+  serverOnlyClientStub: () => serverOnlyClientStub
 });
-module.exports = __toCommonJS(unsupported_exports);
-function unsupported() {
+module.exports = __toCommonJS(client_exports);
+var serverOnlyClientStub = (() => {
   throw new Error(
-    "This package is server-only and cannot be used in client/mobile environments. Access this functionality via a backend API instead."
+    "@wrelik/db/client is a server-only adapter stub. Use @wrelik/db/server on the backend and call your backend API from client or Expo apps."
   );
-}
-throw new Error(
-  "This package is server-only and cannot be used in client/mobile environments. Access this functionality via a backend API instead."
-);
+})();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  serverOnlyClientStub
+});

package/dist/client/index.mjs

@@ -0,0 +1,9 @@
+// src/client/index.ts
+var serverOnlyClientStub = (() => {
+  throw new Error(
+    "@wrelik/db/client is a server-only adapter stub. Use @wrelik/db/server on the backend and call your backend API from client or Expo apps."
+  );
+})();
+export {
+  serverOnlyClientStub
+};

package/dist/server/index.d.mts

@@ -0,0 +1,12 @@
+import { TenantAccessChecker, TransactionExecutor } from '../shared/index.mjs';
+
+declare function createTenantAccessService(checker: TenantAccessChecker): {
+    assertTenantAccess(userId: string, tenantId: string): Promise<void>;
+};
+declare function withTenantContext<T>(tenantId: string, handler: (tenantId: string) => Promise<T>): Promise<T>;
+declare function withTransaction<TClient, T>(executor: TransactionExecutor<TClient>, handler: (tx: TClient) => Promise<T>): Promise<T>;
+declare function applyTenantScope<TWhere extends Record<string, unknown>>(tenantId: string, where?: TWhere): TWhere & {
+    tenantId: string;
+};
+
+export { applyTenantScope, createTenantAccessService, withTenantContext, withTransaction };

package/dist/server/index.d.ts

@@ -0,0 +1,12 @@
+import { TenantAccessChecker, TransactionExecutor } from '../shared/index.js';
+
+declare function createTenantAccessService(checker: TenantAccessChecker): {
+    assertTenantAccess(userId: string, tenantId: string): Promise<void>;
+};
+declare function withTenantContext<T>(tenantId: string, handler: (tenantId: string) => Promise<T>): Promise<T>;
+declare function withTransaction<TClient, T>(executor: TransactionExecutor<TClient>, handler: (tx: TClient) => Promise<T>): Promise<T>;
+declare function applyTenantScope<TWhere extends Record<string, unknown>>(tenantId: string, where?: TWhere): TWhere & {
+    tenantId: string;
+};
+
+export { applyTenantScope, createTenantAccessService, withTenantContext, withTransaction };

package/dist/server/index.js

@@ -0,0 +1,71 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server/index.ts
+var server_exports = {};
+__export(server_exports, {
+  applyTenantScope: () => applyTenantScope,
+  createTenantAccessService: () => createTenantAccessService,
+  withTenantContext: () => withTenantContext,
+  withTransaction: () => withTransaction
+});
+module.exports = __toCommonJS(server_exports);
+var import_shared = require("@wrelik/errors/shared");
+function createTenantAccessService(checker) {
+  return {
+    async assertTenantAccess(userId, tenantId) {
+      if (!userId || !tenantId) {
+        throw new import_shared.TenantRequiredError();
+      }
+      const allowed = await checker({ userId, tenantId });
+      if (!allowed) {
+        throw new import_shared.PermissionDeniedError(`User ${userId} does not have access to tenant ${tenantId}`);
+      }
+    }
+  };
+}
+async function withTenantContext(tenantId, handler) {
+  if (!tenantId) {
+    throw new import_shared.TenantRequiredError();
+  }
+  return handler(tenantId);
+}
+async function withTransaction(executor, handler) {
+  return executor.transaction(handler);
+}
+function applyTenantScope(tenantId, where) {
+  if (!tenantId) {
+    throw new import_shared.TenantRequiredError();
+  }
+  const tenantIdInWhere = where?.tenantId;
+  if (typeof tenantIdInWhere === "string" && tenantIdInWhere !== tenantId) {
+    throw new import_shared.PermissionDeniedError(`Cross-tenant access blocked for tenant ${tenantIdInWhere}`);
+  }
+  return {
+    ...where ?? {},
+    tenantId
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  applyTenantScope,
+  createTenantAccessService,
+  withTenantContext,
+  withTransaction
+});

package/dist/server/index.mjs

@@ -0,0 +1,43 @@
+// src/server/index.ts
+import { PermissionDeniedError, TenantRequiredError } from "@wrelik/errors/shared";
+function createTenantAccessService(checker) {
+  return {
+    async assertTenantAccess(userId, tenantId) {
+      if (!userId || !tenantId) {
+        throw new TenantRequiredError();
+      }
+      const allowed = await checker({ userId, tenantId });
+      if (!allowed) {
+        throw new PermissionDeniedError(`User ${userId} does not have access to tenant ${tenantId}`);
+      }
+    }
+  };
+}
+async function withTenantContext(tenantId, handler) {
+  if (!tenantId) {
+    throw new TenantRequiredError();
+  }
+  return handler(tenantId);
+}
+async function withTransaction(executor, handler) {
+  return executor.transaction(handler);
+}
+function applyTenantScope(tenantId, where) {
+  if (!tenantId) {
+    throw new TenantRequiredError();
+  }
+  const tenantIdInWhere = where?.tenantId;
+  if (typeof tenantIdInWhere === "string" && tenantIdInWhere !== tenantId) {
+    throw new PermissionDeniedError(`Cross-tenant access blocked for tenant ${tenantIdInWhere}`);
+  }
+  return {
+    ...where ?? {},
+    tenantId
+  };
+}
+export {
+  applyTenantScope,
+  createTenantAccessService,
+  withTenantContext,
+  withTransaction
+};

package/dist/shared/index.d.mts

@@ -0,0 +1,10 @@
+interface TenantAccessInput {
+    userId: string;
+    tenantId: string;
+}
+type TenantAccessChecker = (input: TenantAccessInput) => Promise<boolean>;
+interface TransactionExecutor<TClient> {
+    transaction<T>(handler: (tx: TClient) => Promise<T>): Promise<T>;
+}
+
+export type { TenantAccessChecker, TenantAccessInput, TransactionExecutor };

package/dist/shared/index.d.ts

@@ -0,0 +1,10 @@
+interface TenantAccessInput {
+    userId: string;
+    tenantId: string;
+}
+type TenantAccessChecker = (input: TenantAccessInput) => Promise<boolean>;
+interface TransactionExecutor<TClient> {
+    transaction<T>(handler: (tx: TClient) => Promise<T>): Promise<T>;
+}
+
+export type { TenantAccessChecker, TenantAccessInput, TransactionExecutor };

package/dist/shared/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/shared/index.ts
+var shared_exports = {};
+module.exports = __toCommonJS(shared_exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrelik/db",
-  "version": "0.1.3",
+  "version": "2.0.0",
   "publishConfig": {
     "access": "public"
   },
@@ -9,11 +9,27 @@
     "url": "https://github.com/lwhite702/wrelik-kit.git",
     "directory": "packages/db"
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "react-native": "./dist/unsupported.js",
+  "sideEffects": false,
+  "exports": {
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.mjs",
+      "require": "./dist/server/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.mjs",
+      "require": "./dist/client/index.js"
+    },
+    "./shared": {
+      "types": "./dist/shared/index.d.ts",
+      "import": "./dist/shared/index.mjs",
+      "require": "./dist/shared/index.js"
+    },
+    "./package.json": "./package.json"
+  },
   "dependencies": {
-    "@wrelik/errors": "0.2.1"
+    "@wrelik/errors": "2.0.0"
   },
   "devDependencies": {
     "@types/node": "^25.2.0",
@@ -22,9 +38,17 @@
     "@wrelik/eslint-config": "0.1.1",
     "@wrelik/tsconfig": "0.1.1"
   },
+  "wrelik": {
+    "runtimes": [
+      "server",
+      "client",
+      "shared"
+    ]
+  },
   "scripts": {
-    "build": "tsup src/index.ts src/unsupported.ts --format cjs,esm --dts --clean",
+    "build": "tsup src/server/index.ts src/client/index.ts src/shared/index.ts --format cjs,esm --dts --clean",
     "lint": "eslint src/",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests"
   }
 }

package/src/client/index.test.ts

@@ -0,0 +1,7 @@
+import { describe, expect, it } from 'vitest';
+
+describe('@wrelik/db/client', () => {
+  it('fails fast with a server-only adapter message', async () => {
+    await expect(import('./index.js')).rejects.toThrow(/server-only adapter stub/i);
+  });
+});

package/src/client/index.ts

@@ -0,0 +1,5 @@
+export const serverOnlyClientStub = (() => {
+  throw new Error(
+    '@wrelik/db/client is a server-only adapter stub. Use @wrelik/db/server on the backend and call your backend API from client or Expo apps.',
+  );
+})();

package/src/server/index.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest';
+import { PermissionDeniedError, TenantRequiredError } from '@wrelik/errors/shared';
+import { applyTenantScope, createTenantAccessService, withTenantContext, withTransaction } from './index';
+
+describe('@wrelik/db/server', () => {
+  it('asserts tenant access with injected checker', async () => {
+    const service = createTenantAccessService(async ({ userId, tenantId }) => {
+      return userId === 'u1' && tenantId === 't1';
+    });
+
+    await expect(service.assertTenantAccess('u1', 't1')).resolves.toBeUndefined();
+    await expect(service.assertTenantAccess('', 't1')).rejects.toThrow(TenantRequiredError);
+    await expect(service.assertTenantAccess('u1', 't2')).rejects.toThrow(PermissionDeniedError);
+  });
+
+  it('runs work through explicit transaction wrappers', async () => {
+    const result = await withTransaction<{ txId: string }, string>(
+      {
+        transaction: async (handler) => handler({ txId: '1' }),
+      },
+      async (tx) => tx.txId,
+    );
+
+    expect(result).toBe('1');
+  });
+
+  it('rejects empty tenant contexts', async () => {
+    await expect(withTenantContext('', async () => 'ok')).rejects.toThrow(TenantRequiredError);
+  });
+
+  it('always applies tenant filters and preserves other filters', () => {
+    expect(applyTenantScope('t1', { status: 'active' })).toEqual({
+      status: 'active',
+      tenantId: 't1',
+    });
+  });
+
+  it('blocks cross-tenant reads by default', () => {
+    expect(() => applyTenantScope('t1', { tenantId: 't2', status: 'active' })).toThrow(PermissionDeniedError);
+    expect(() => applyTenantScope('', { status: 'active' })).toThrow(TenantRequiredError);
+  });
+
+  it('does not expose root or client subpath imports', () => {
+    expect(() => require.resolve('@wrelik/db')).toThrow();
+    expect(() => require.resolve('@wrelik/db/client')).not.toThrow();
+  });
+});

package/src/server/index.ts

@@ -0,0 +1,52 @@
+import { PermissionDeniedError, TenantRequiredError } from '@wrelik/errors/shared';
+import type { TenantAccessChecker, TransactionExecutor } from '../shared';
+
+export function createTenantAccessService(checker: TenantAccessChecker) {
+  return {
+    async assertTenantAccess(userId: string, tenantId: string): Promise<void> {
+      if (!userId || !tenantId) {
+        throw new TenantRequiredError();
+      }
+
+      const allowed = await checker({ userId, tenantId });
+
+      if (!allowed) {
+        throw new PermissionDeniedError(`User ${userId} does not have access to tenant ${tenantId}`);
+      }
+    },
+  };
+}
+
+export async function withTenantContext<T>(tenantId: string, handler: (tenantId: string) => Promise<T>) {
+  if (!tenantId) {
+    throw new TenantRequiredError();
+  }
+
+  return handler(tenantId);
+}
+
+export async function withTransaction<TClient, T>(
+  executor: TransactionExecutor<TClient>,
+  handler: (tx: TClient) => Promise<T>,
+): Promise<T> {
+  return executor.transaction(handler);
+}
+
+export function applyTenantScope<TWhere extends Record<string, unknown>>(
+  tenantId: string,
+  where?: TWhere,
+): TWhere & { tenantId: string } {
+  if (!tenantId) {
+    throw new TenantRequiredError();
+  }
+
+  const tenantIdInWhere = where?.tenantId;
+  if (typeof tenantIdInWhere === 'string' && tenantIdInWhere !== tenantId) {
+    throw new PermissionDeniedError(`Cross-tenant access blocked for tenant ${tenantIdInWhere}`);
+  }
+
+  return {
+    ...(where ?? ({} as TWhere)),
+    tenantId,
+  };
+}

package/src/shared/index.ts

@@ -0,0 +1 @@
+export type { TenantAccessChecker, TenantAccessInput, TransactionExecutor } from './types';

package/src/shared/types.ts

@@ -0,0 +1,10 @@
+export interface TenantAccessInput {
+  userId: string;
+  tenantId: string;
+}
+
+export type TenantAccessChecker = (input: TenantAccessInput) => Promise<boolean>;
+
+export interface TransactionExecutor<TClient> {
+  transaction<T>(handler: (tx: TClient) => Promise<T>): Promise<T>;
+}

package/dist/index.d.mts

@@ -1,7 +0,0 @@
-type AccessChecker = (userId: string, tenantId: string) => Promise<boolean>;
-declare function setTenantAccessChecker(checker: AccessChecker): void;
-declare function assertTenantAccess(userId: string, tenantId: string): Promise<void>;
-declare function withTenant<T>(tenantId: string, fn: (tenantId: string) => Promise<T>): Promise<T>;
-declare function getPrismaSingleton<T>(factory: () => T): T;
-
-export { assertTenantAccess, getPrismaSingleton, setTenantAccessChecker, withTenant };

package/dist/index.d.ts

@@ -1,7 +0,0 @@
-type AccessChecker = (userId: string, tenantId: string) => Promise<boolean>;
-declare function setTenantAccessChecker(checker: AccessChecker): void;
-declare function assertTenantAccess(userId: string, tenantId: string): Promise<void>;
-declare function withTenant<T>(tenantId: string, fn: (tenantId: string) => Promise<T>): Promise<T>;
-declare function getPrismaSingleton<T>(factory: () => T): T;
-
-export { assertTenantAccess, getPrismaSingleton, setTenantAccessChecker, withTenant };

package/dist/index.js

@@ -1,63 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  assertTenantAccess: () => assertTenantAccess,
-  getPrismaSingleton: () => getPrismaSingleton,
-  setTenantAccessChecker: () => setTenantAccessChecker,
-  withTenant: () => withTenant
-});
-module.exports = __toCommonJS(index_exports);
-var import_errors = require("@wrelik/errors");
-var accessChecker = async () => false;
-function setTenantAccessChecker(checker) {
-  accessChecker = checker;
-}
-async function assertTenantAccess(userId, tenantId) {
-  if (!userId || !tenantId) {
-    throw new import_errors.TenantRequiredError();
-  }
-  const allowed = await accessChecker(userId, tenantId);
-  if (!allowed) {
-    throw new import_errors.PermissionDeniedError(`User ${userId} does not have access to tenant ${tenantId}`);
-  }
-}
-function withTenant(tenantId, fn) {
-  if (!tenantId) {
-    throw new import_errors.TenantRequiredError();
-  }
-  return fn(tenantId);
-}
-function getPrismaSingleton(factory) {
-  const globalForPrisma = global;
-  const prisma = globalForPrisma.prisma || factory();
-  if (process.env.NODE_ENV !== "production") {
-    globalForPrisma.prisma = prisma;
-  }
-  return prisma;
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  assertTenantAccess,
-  getPrismaSingleton,
-  setTenantAccessChecker,
-  withTenant
-});

package/dist/index.mjs

@@ -1,35 +0,0 @@
-// src/index.ts
-import { PermissionDeniedError, TenantRequiredError } from "@wrelik/errors";
-var accessChecker = async () => false;
-function setTenantAccessChecker(checker) {
-  accessChecker = checker;
-}
-async function assertTenantAccess(userId, tenantId) {
-  if (!userId || !tenantId) {
-    throw new TenantRequiredError();
-  }
-  const allowed = await accessChecker(userId, tenantId);
-  if (!allowed) {
-    throw new PermissionDeniedError(`User ${userId} does not have access to tenant ${tenantId}`);
-  }
-}
-function withTenant(tenantId, fn) {
-  if (!tenantId) {
-    throw new TenantRequiredError();
-  }
-  return fn(tenantId);
-}
-function getPrismaSingleton(factory) {
-  const globalForPrisma = global;
-  const prisma = globalForPrisma.prisma || factory();
-  if (process.env.NODE_ENV !== "production") {
-    globalForPrisma.prisma = prisma;
-  }
-  return prisma;
-}
-export {
-  assertTenantAccess,
-  getPrismaSingleton,
-  setTenantAccessChecker,
-  withTenant
-};

package/dist/unsupported.d.mts

@@ -1,3 +0,0 @@
-declare function unsupported(): void;
-
-export { unsupported as default };

package/dist/unsupported.d.ts

@@ -1,3 +0,0 @@
-declare function unsupported(): void;
-
-export { unsupported as default };

package/dist/unsupported.mjs

@@ -1,12 +0,0 @@
-// src/unsupported.ts
-function unsupported() {
-  throw new Error(
-    "This package is server-only and cannot be used in client/mobile environments. Access this functionality via a backend API instead."
-  );
-}
-throw new Error(
-  "This package is server-only and cannot be used in client/mobile environments. Access this functionality via a backend API instead."
-);
-export {
-  unsupported as default
-};

package/src/index.ts

@@ -1,39 +0,0 @@
-import { PermissionDeniedError, TenantRequiredError } from '@wrelik/errors';
-
-// Helper types
-type AccessChecker = (userId: string, tenantId: string) => Promise<boolean>;
-
-let accessChecker: AccessChecker = async () => false; // Default deny
-
-export function setTenantAccessChecker(checker: AccessChecker) {
-  accessChecker = checker;
-}
-
-export async function assertTenantAccess(userId: string, tenantId: string) {
-  if (!userId || !tenantId) {
-    throw new TenantRequiredError();
-  }
-  const allowed = await accessChecker(userId, tenantId);
-  if (!allowed) {
-    throw new PermissionDeniedError(`User ${userId} does not have access to tenant ${tenantId}`);
-  }
-}
-
-export function withTenant<T>(tenantId: string, fn: (tenantId: string) => Promise<T>): Promise<T> {
-  if (!tenantId) {
-    throw new TenantRequiredError();
-  }
-  return fn(tenantId);
-}
-
-// Singleton pattern for Prisma
-export function getPrismaSingleton<T>(factory: () => T): T {
-  const globalForPrisma = global as unknown as { prisma: T };
-  const prisma = globalForPrisma.prisma || factory();
-
-  if (process.env.NODE_ENV !== 'production') {
-    globalForPrisma.prisma = prisma;
-  }
-
-  return prisma;
-}

package/src/unsupported.ts

@@ -1,14 +0,0 @@
-export default function unsupported() {
-  throw new Error(
-    'This package is server-only and cannot be used in client/mobile environments. ' +
-      'Access this functionality via a backend API instead.',
-  );
-}
-
-// Using a Proxy to trap named imports if possible, or just the top level throw is usually enough for side-effect imports.
-// But for named imports, we might need to export them?
-// Since we can't mock all exports, the top level throw is best.
-throw new Error(
-  'This package is server-only and cannot be used in client/mobile environments. ' +
-    'Access this functionality via a backend API instead.',
-);