@wtfalch/authz-store 0.1.0

package/dist/schema.js

@@ -0,0 +1,193 @@
+import { sql } from 'drizzle-orm';
+import { bigint, boolean, index, jsonb, pgTable, primaryKey, smallint, text, timestamp, uniqueIndex, uuid, } from 'drizzle-orm/pg-core';
+/**
+ * Drizzle mirror of the authority tables: the eight drizzle/0003_authz.sql
+ * ships (tenants, roles, role_permissions, memberships, invitations,
+ * break_glass_sessions, credentials, authz_events) and the ninth
+ * drizzle/0005_nesting.sql adds (attach_proposals). drizzle/0006_credentials.sql
+ * adds a column to `credentials` rather than a table, and
+ * drizzle/0008_erasure_and_boot.sql adds the tenth (system_role_versions).
+ *
+ * CHECK constraints, partial indexes, INCLUDE columns and triggers are not
+ * expressible in this version of Drizzle's table builder and live only in
+ * the SQL; the index declarations below exist so `getTableConfig` reports
+ * one index per table index for the host's tenancy manifest,
+ * not so this file reproduces the SQL's exact predicate or INCLUDE list.
+ * Read the migration for the authoritative definition of every constraint.
+ *
+ * `profiles` is not here: it is a person-scoped table the host's own database
+ * module owns, not one of the authority tables.
+ */
+// ---------------------------------------------------------------- tenants
+export const tenants = pgTable('tenants', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    kind: text('kind').$type().notNull().default('customer'),
+    slug: text('slug').notNull(),
+    name: text('name').notNull(),
+    state: text('state').$type().notNull().default('active'),
+    parentId: uuid('parent_id'),
+    // Vocabulary-offered permissions this tenant may use (D22). No default:
+    // the creating transaction always writes one explicitly.
+    ceiling: text('ceiling').array().notNull(),
+    selfDenied: text('self_denied').array().notNull().default(sql `'{}'`),
+    // Only the single `kind = 'operator'` row may ever be true, enforced by
+    // tenants_frozen_operator_check. The two hosts number that migration
+    // differently (0010 and 0012), which is why no number is named here.
+    frozen: boolean('frozen').notNull().default(false),
+    createdBy: text('created_by'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().default(sql `now()`),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().default(sql `now()`),
+}, (t) => [
+    // Full definition is a partial unique index (only kind = 'operator');
+    // this declares the column so the manifest sees an index here.
+    uniqueIndex('tenants_one_operator_idx').on(t.kind),
+    index('tenants_parent_idx').on(t.parentId),
+]);
+// ------------------------------------------------------------- memberships
+export const memberships = pgTable('memberships', {
+    tenantId: uuid('tenant_id').notNull(),
+    principalId: text('principal_id').notNull(),
+    principalClass: text('principal_class').notNull(),
+    source: text('source').notNull().default('direct'),
+    viaTenantId: uuid('via_tenant_id'),
+    // Denormalised from tenants.name so the switcher reads one index range
+    // (D5); renameTenant rewrites it in the same transaction.
+    tenantName: text('tenant_name').notNull(),
+    grantedBy: text('granted_by'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().default(sql `now()`),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().default(sql `now()`),
+}, (t) => [
+    primaryKey({ columns: [t.tenantId, t.principalClass, t.principalId] }),
+    // Full definition also INCLUDEs (role, source, principal_class); not
+    // expressible here, see the file header.
+    index('memberships_principal_idx').on(t.principalId, t.tenantName, t.tenantId),
+    index('memberships_via_idx').on(t.viaTenantId),
+]);
+// ------------------------------------------------------------- invitations
+export const invitations = pgTable('invitations', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    tenantId: uuid('tenant_id').notNull(),
+    email: text('email').notNull(),
+    roleId: uuid('role_id').notNull(),
+    tokenHash: text('token_hash').notNull().unique(),
+    status: text('status').notNull().default('pending'),
+    mailState: text('mail_state').notNull().default('pending'),
+    // When mail_state last changed, so D9's "mail failed for more than an
+    // hour" alert measures the right thing (0008). Null on a row that
+    // predates the column.
+    mailStateAt: timestamp('mail_state_at', { withTimezone: true }),
+    invitedBy: text('invited_by'),
+    invitedByClass: text('invited_by_class'),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    acceptedBy: text('accepted_by'),
+    acceptedAt: timestamp('accepted_at', { withTimezone: true }),
+    revokedBy: text('revoked_by'),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+    // A child a parent creates is born attached (D10, D19): accepting this
+    // invitation writes the first owner's membership and performs the
+    // attachment in one transaction. Null on every ordinary invitation.
+    attachParentId: uuid('attach_parent_id'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().default(sql `now()`),
+}, (t) => [
+    // Full definition is a partial unique index (only status = 'pending');
+    // this declares the columns so the manifest sees an index here.
+    uniqueIndex('invitations_pending_idx').on(t.tenantId, t.email),
+    index('invitations_tenant_idx').on(t.tenantId, t.createdAt.desc()),
+]);
+// -------------------------------------------------------- attach_proposals
+export const attachProposals = pgTable('attach_proposals', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    parentId: uuid('parent_id').notNull(),
+    childId: uuid('child_id').notNull(),
+    status: text('status').notNull().default('pending'),
+    reason: text('reason').notNull(),
+    reference: text('reference').notNull(),
+    proposedBy: text('proposed_by').notNull(),
+    parentAcceptedBy: text('parent_accepted_by'),
+    parentAcceptedAt: timestamp('parent_accepted_at', { withTimezone: true }),
+    decidedBy: text('decided_by'),
+    decidedAt: timestamp('decided_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().default(sql `now()`),
+}, (t) => [
+    // Full definition is a partial unique index (only status = 'pending');
+    // this declares the columns so the manifest sees an index here.
+    uniqueIndex('attach_proposals_pending_idx').on(t.parentId, t.childId),
+    index('attach_proposals_child_idx').on(t.childId, t.createdAt.desc()),
+    index('attach_proposals_parent_idx').on(t.parentId, t.createdAt.desc()),
+]);
+// ----------------------------------------------------- break_glass_sessions
+export const breakGlassSessions = pgTable('break_glass_sessions', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    operatorId: text('operator_id').notNull(),
+    tenantId: uuid('tenant_id').notNull(),
+    roleId: uuid('role_id').notNull(),
+    readOnly: boolean('read_only').notNull().default(true),
+    reasonCode: text('reason_code').notNull(),
+    reference: text('reference').notNull(),
+    startedAt: timestamp('started_at', { withTimezone: true }).notNull().default(sql `now()`),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    endedAt: timestamp('ended_at', { withTimezone: true }),
+    endedBy: text('ended_by'),
+}, (t) => [
+    // Full definition is partial (WHERE ended_at IS NULL); see the header.
+    index('bg_active_idx').on(t.operatorId, t.tenantId),
+    index('bg_tenant_idx').on(t.tenantId, t.startedAt.desc()),
+]);
+// -------------------------------------------------------------- credentials
+export const credentials = pgTable('credentials', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    tenantId: uuid('tenant_id').notNull(),
+    kind: text('kind').notNull(),
+    issuerId: text('issuer_id').notNull(),
+    issuerClass: text('issuer_class').notNull(),
+    name: text('name').notNull(),
+    secretHash: text('secret_hash').notNull().unique(),
+    // The first characters of the secret's random half, kept in clear so a
+    // list can tell one credential from another (0006). Not a secret.
+    secretPrefix: text('secret_prefix'),
+    createdBy: text('created_by'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().default(sql `now()`),
+    expiresAt: timestamp('expires_at', { withTimezone: true }),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+    lastUsedAt: timestamp('last_used_at', { withTimezone: true }),
+}, (t) => [
+    index('credentials_tenant_idx').on(t.tenantId),
+    // Full definition is partial (WHERE revoked_at IS NULL); see the header.
+    index('credentials_live_idx').on(t.tenantId, t.createdAt.desc()),
+]);
+// ------------------------------------------------------------- authz_events
+export const authzEvents = pgTable('authz_events', {
+    // (occurred_at, id) is the ordering; see the migration for why this is a
+    // bigint identity rather than a time-ordered uuid.
+    id: bigint('id', { mode: 'number' }).generatedAlwaysAsIdentity().primaryKey(),
+    occurredAt: timestamp('occurred_at', { withTimezone: true }).notNull().default(sql `now()`),
+    tenantId: uuid('tenant_id'),
+    teamId: uuid('team_id'),
+    subjectId: text('subject_id'),
+    subjectClass: text('subject_class'),
+    actorClass: text('actor_class').notNull(),
+    actorId: text('actor_id').notNull(),
+    actorDisplay: text('actor_display').notNull(),
+    action: text('action').notNull(),
+    targetType: text('target_type').notNull(),
+    targetId: text('target_id').notNull(),
+    outcome: text('outcome').notNull(),
+    context: text('context').notNull(),
+    sessionId: text('session_id'),
+    reason: text('reason'),
+    reference: text('reference'),
+    requestId: text('request_id'),
+    ip: text('ip'),
+    userAgent: text('user_agent'),
+    tenantVisible: boolean('tenant_visible').notNull(),
+    before: jsonb('before'),
+    after: jsonb('after'),
+    erasedAt: timestamp('erased_at', { withTimezone: true }),
+    schemaVersion: smallint('schema_version').notNull().default(1),
+}, (t) => [
+    index('authz_events_tenant_time_idx').on(t.tenantId, t.occurredAt.desc(), t.id.desc()),
+    index('authz_events_actor_time_idx').on(t.actorId, t.occurredAt.desc()),
+    index('authz_events_team_time_idx').on(t.tenantId, t.teamId, t.occurredAt.desc(), t.id.desc()),
+    index('authz_events_subject_time_idx').on(t.tenantId, t.subjectClass, t.subjectId, t.occurredAt.desc(), t.id.desc()),
+    index('authz_events_action_time_idx').on(t.action, t.occurredAt.desc()),
+]);

package/dist/scoped.d.ts

@@ -0,0 +1,140 @@
+import { type SQL } from 'drizzle-orm';
+import type { PgColumn, PgDatabase, PgInsertValue, PgQueryResultHKT, PgTable, PgTransaction, PgUpdateSetSource } from 'drizzle-orm/pg-core';
+/**
+ * Thrown by a write method (insert, update, delete, transaction) called on a
+ * scope that is read-only: a tenant whose state is `read_only` or
+ * `suspended`, or a read-only break-glass session. Thrown synchronously,
+ * before a query is built or a connection touched, so a page that writes on
+ * read (a last-viewed stamp, a draft autosave) cannot leak a write through a
+ * read-only context regardless of what the call site already checked (D6,
+ * M4).
+ */
+export declare class ReadOnlyAccessError extends Error {
+}
+/**
+ * Thrown when a table has no column registered for the scope in use.
+ * The host's registries are the only source of truth for what a `ScopedDb`
+ * may touch; a table missing from all of them is a bug in the host's registry,
+ * not something the caller can work around.
+ */
+export declare class UnscopedTableError extends Error {
+}
+/**
+ * What one `ScopedDb` carries. `column` is a function rather than one fixed
+ * column because a single scope kind (tenant, person) covers many tables,
+ * each with its own scope column; `value` is the id every predicate compares
+ * it against; `readOnly` and `label` are used by the guard and its error
+ * messages respectively.
+ */
+export interface Scope {
+    readonly column: (table: PgTable) => PgColumn | undefined;
+    readonly value: string;
+    readonly readOnly: boolean;
+    readonly label: 'tenant' | 'person';
+}
+/**
+ * Either the raw handle or a transaction already open on it. Every method
+ * below accepts both, so code already inside one transaction (a `grant`
+ * writing a membership and its audit row together) passes that transaction
+ * through rather than opening a second, nested one for no reason.
+ *
+ * Named through drizzle's own base types rather than one host's concrete
+ * handle: this package does not know which driver a host uses, and every
+ * method here builds statements rather than sending them.
+ */
+type HostSchema = any;
+export type DbOrTx = PgDatabase<PgQueryResultHKT, HostSchema, HostSchema> | PgTransaction<PgQueryResultHKT, HostSchema, HostSchema>;
+/**
+ * The only way feature code touches a tenant or person table (D6). A tenant
+ * instance is built by `openScopedDb` from a fresh membership read inside
+ * the host's `accessFor`; a person instance is built from that person's own
+ * id. Nothing else constructs one, which is what the private constructor is
+ * for: even a module-level function in this same file cannot call it, only a
+ * static member of the class, which is why `openScopedDb` wraps
+ * `ScopedDb.open` rather than calling `new ScopedDb` itself.
+ *
+ * Every write method refuses at the query-builder layer when the scope is
+ * read-only, before building or sending anything, independent of whatever
+ * the call site already decided.
+ */
+export declare class ScopedDb {
+    private readonly root;
+    private readonly scope;
+    private constructor();
+    static open(root: DbOrTx, scope: Scope): ScopedDb;
+    private columnFor;
+    /**
+     * The property key an insert or update payload uses for this column.
+     * Drizzle keys `.values()`/`.set()` by the table's own field name (for
+     * example `tenantId`), not the SQL column name (`tenant_id`), and a column
+     * does not know its own field name, so this looks it up the same way
+     * drizzle itself does: by identity against `getTableColumns`.
+     */
+    private keyFor;
+    private assertWritable;
+    /**
+     * The predicate every method here builds from: the scope column compared
+     * to the scope's own value. Exposed on its own because a caller sometimes
+     * needs it directly (a join, a count) rather than through one of the
+     * methods below.
+     */
+    predicate(table: PgTable): SQL;
+    /**
+     * The select builder, scoped, so `.orderBy`/`.limit`/further `.where`
+     * continue to chain on the result. The cast on `table` works around a
+     * drizzle typing limitation (a generic table parameter does not satisfy
+     * `.from()`'s subquery-detection conditional); the query it builds is
+     * identical either way, the cast only affects the row type TypeScript
+     * infers back, which is why insert and update below, which do not touch
+     * `.from()`, keep their full per-table typing.
+     */
+    select<T extends PgTable>(table: T, extra?: SQL): Omit<import("drizzle-orm/pg-core").PgSelectBase<string, Record<string, PgColumn<import("drizzle-orm").ColumnBaseConfig<import("drizzle-orm").ColumnDataType, string>, {}, {}>>, "single", Record<string, "not-null">, false, "where", {
+        [x: string]: unknown;
+    }[], {
+        [x: string]: PgColumn<import("drizzle-orm").ColumnBaseConfig<import("drizzle-orm").ColumnDataType, string>, {}, {}>;
+    }>, "where">;
+    /**
+     * Strips the scope column from every row and writes the scope's own value
+     * instead, after the spread rather than merged into it, so a caller-
+     * supplied value for that column (a compromised form body setting
+     * `tenantId` to some other tenant) never survives into the statement.
+     */
+    insert<T extends PgTable>(table: T, values: PgInsertValue<T> | PgInsertValue<T>[]): import("drizzle-orm/pg-core").PgInsertBase<T, PgQueryResultHKT, undefined, undefined, false, never>;
+    /**
+     * Strips the scope column from `set` (dropped, not overwritten: an update
+     * never moves a row between tenants) and adds the scope predicate to the
+     * WHERE, so a write can only ever land on the caller's own rows.
+     */
+    update<T extends PgTable>(table: T, set: Partial<PgUpdateSetSource<T>>, extra?: SQL): Omit<import("drizzle-orm/pg-core").PgUpdateBase<T, PgQueryResultHKT, undefined, undefined, undefined, Record<T["_"]["name"], "not-null">, [], false, "where" | "leftJoin" | "rightJoin" | "innerJoin" | "fullJoin">, "where" | "leftJoin" | "rightJoin" | "innerJoin" | "fullJoin">;
+    /**
+     * `extra` is required, not optional: a delete with only the scope
+     * predicate would remove every row this principal can see, so the type
+     * system refuses a call without it. The runtime check is the second net
+     * for a caller that reaches this past the type system (an `any`-typed call
+     * site).
+     */
+    delete<T extends PgTable>(table: T, extra: SQL): Omit<import("drizzle-orm/pg-core").PgDeleteBase<T, PgQueryResultHKT, undefined, undefined, false, "where">, "where">;
+    /**
+     * Refused outright on a read-only scope, the same as insert, update and
+     * delete: a transaction is opened to write, and refusing only once the
+     * callback attempts one would already have reached the client (postgres-js
+     * sends `BEGIN` the moment `transaction()` is called, before the callback
+     * ever runs), which is exactly what the read-only guard exists to prevent.
+     */
+    transaction<R>(fn: (tx: ScopedDb) => Promise<R>): Promise<R>;
+}
+/**
+ * The only way to build a `ScopedDb`. A host calls this from the two places
+ * that legitimately mint a scope — a tenant scope from a fresh membership
+ * read, and a person scope from a person's own id — and re-exports neither
+ * this nor the class from its own barrel, so a feature module cannot mint a
+ * scope of its own.
+ */
+export declare function openScopedDb(root: DbOrTx, scope: Scope): ScopedDb;
+/**
+ * Turns a host's table-to-column registry into a `Scope['column']`. The
+ * registry itself is the host's: only it knows which of its tables carry a
+ * tenant id and which carry a person id.
+ */
+export declare function scopeColumnOf(tables: ReadonlyMap<PgTable, PgColumn>): (table: PgTable) => PgColumn | undefined;
+export {};

package/dist/scoped.js

@@ -0,0 +1,176 @@
+import { and, eq, getTableColumns } from 'drizzle-orm';
+/**
+ * Thrown by a write method (insert, update, delete, transaction) called on a
+ * scope that is read-only: a tenant whose state is `read_only` or
+ * `suspended`, or a read-only break-glass session. Thrown synchronously,
+ * before a query is built or a connection touched, so a page that writes on
+ * read (a last-viewed stamp, a draft autosave) cannot leak a write through a
+ * read-only context regardless of what the call site already checked (D6,
+ * M4).
+ */
+export class ReadOnlyAccessError extends Error {
+}
+/**
+ * Thrown when a table has no column registered for the scope in use.
+ * The host's registries are the only source of truth for what a `ScopedDb`
+ * may touch; a table missing from all of them is a bug in the host's registry,
+ * not something the caller can work around.
+ */
+export class UnscopedTableError extends Error {
+}
+/**
+ * The only way feature code touches a tenant or person table (D6). A tenant
+ * instance is built by `openScopedDb` from a fresh membership read inside
+ * the host's `accessFor`; a person instance is built from that person's own
+ * id. Nothing else constructs one, which is what the private constructor is
+ * for: even a module-level function in this same file cannot call it, only a
+ * static member of the class, which is why `openScopedDb` wraps
+ * `ScopedDb.open` rather than calling `new ScopedDb` itself.
+ *
+ * Every write method refuses at the query-builder layer when the scope is
+ * read-only, before building or sending anything, independent of whatever
+ * the call site already decided.
+ */
+export class ScopedDb {
+    root;
+    scope;
+    constructor(root, scope) {
+        this.root = root;
+        this.scope = scope;
+    }
+    static open(root, scope) {
+        return new ScopedDb(root, scope);
+    }
+    columnFor(table) {
+        const column = this.scope.column(table);
+        if (!column) {
+            throw new UnscopedTableError(`table is not registered for the ${this.scope.label} scope; add it to the host's registry`);
+        }
+        return column;
+    }
+    /**
+     * The property key an insert or update payload uses for this column.
+     * Drizzle keys `.values()`/`.set()` by the table's own field name (for
+     * example `tenantId`), not the SQL column name (`tenant_id`), and a column
+     * does not know its own field name, so this looks it up the same way
+     * drizzle itself does: by identity against `getTableColumns`.
+     */
+    keyFor(table, column) {
+        for (const [key, candidate] of Object.entries(getTableColumns(table))) {
+            if (candidate === column)
+                return key;
+        }
+        // Unreachable given the invariant that every entry in a host's registry is
+        // one of that table's own columns.
+        throw new UnscopedTableError("the scope column is not one of this table's own columns");
+    }
+    assertWritable() {
+        if (this.scope.readOnly) {
+            throw new ReadOnlyAccessError(`the ${this.scope.label} scope is read-only`);
+        }
+    }
+    /**
+     * The predicate every method here builds from: the scope column compared
+     * to the scope's own value. Exposed on its own because a caller sometimes
+     * needs it directly (a join, a count) rather than through one of the
+     * methods below.
+     */
+    predicate(table) {
+        return eq(this.columnFor(table), this.scope.value);
+    }
+    /**
+     * The select builder, scoped, so `.orderBy`/`.limit`/further `.where`
+     * continue to chain on the result. The cast on `table` works around a
+     * drizzle typing limitation (a generic table parameter does not satisfy
+     * `.from()`'s subquery-detection conditional); the query it builds is
+     * identical either way, the cast only affects the row type TypeScript
+     * infers back, which is why insert and update below, which do not touch
+     * `.from()`, keep their full per-table typing.
+     */
+    select(table, extra) {
+        const pred = this.predicate(table);
+        return this.root
+            .select()
+            .from(table)
+            .where(extra ? and(pred, extra) : pred);
+    }
+    /**
+     * Strips the scope column from every row and writes the scope's own value
+     * instead, after the spread rather than merged into it, so a caller-
+     * supplied value for that column (a compromised form body setting
+     * `tenantId` to some other tenant) never survives into the statement.
+     */
+    insert(table, values) {
+        this.assertWritable();
+        const column = this.columnFor(table);
+        const key = this.keyFor(table, column);
+        const rows = Array.isArray(values) ? values : [values];
+        const scoped = rows.map((row) => ({ ...row, [key]: this.scope.value }));
+        return this.root.insert(table).values(scoped);
+    }
+    /**
+     * Strips the scope column from `set` (dropped, not overwritten: an update
+     * never moves a row between tenants) and adds the scope predicate to the
+     * WHERE, so a write can only ever land on the caller's own rows.
+     */
+    update(table, set, extra) {
+        this.assertWritable();
+        const column = this.columnFor(table);
+        const key = this.keyFor(table, column);
+        const rest = { ...set };
+        delete rest[key];
+        const pred = this.predicate(table);
+        return this.root
+            .update(table)
+            .set(rest)
+            .where(extra ? and(pred, extra) : pred);
+    }
+    /**
+     * `extra` is required, not optional: a delete with only the scope
+     * predicate would remove every row this principal can see, so the type
+     * system refuses a call without it. The runtime check is the second net
+     * for a caller that reaches this past the type system (an `any`-typed call
+     * site).
+     */
+    delete(table, extra) {
+        this.assertWritable();
+        if (!extra) {
+            throw new Error('ScopedDb.delete requires an explicit predicate');
+        }
+        const pred = this.predicate(table);
+        return this.root.delete(table).where(and(pred, extra));
+    }
+    /**
+     * Refused outright on a read-only scope, the same as insert, update and
+     * delete: a transaction is opened to write, and refusing only once the
+     * callback attempts one would already have reached the client (postgres-js
+     * sends `BEGIN` the moment `transaction()` is called, before the callback
+     * ever runs), which is exactly what the read-only guard exists to prevent.
+     */
+    transaction(fn) {
+        // Deliberately not declared `async`: an `async` function always returns a
+        // promise and never throws to its caller synchronously, even when the
+        // very first line throws, which would turn this guard into a rejection
+        // instead of the synchronous refusal every other write method gives.
+        this.assertWritable();
+        return this.root.transaction((tx) => fn(ScopedDb.open(tx, this.scope)));
+    }
+}
+/**
+ * The only way to build a `ScopedDb`. A host calls this from the two places
+ * that legitimately mint a scope — a tenant scope from a fresh membership
+ * read, and a person scope from a person's own id — and re-exports neither
+ * this nor the class from its own barrel, so a feature module cannot mint a
+ * scope of its own.
+ */
+export function openScopedDb(root, scope) {
+    return ScopedDb.open(root, scope);
+}
+/**
+ * Turns a host's table-to-column registry into a `Scope['column']`. The
+ * registry itself is the host's: only it knows which of its tables carry a
+ * tenant id and which carry a person id.
+ */
+export function scopeColumnOf(tables) {
+    return (table) => tables.get(table);
+}