@xemahq/biome-database-nest 0.12.0 → 0.12.2

package/src/lib/tenant-isolation/org-erasure.ts

@@ -1,235 +0,0 @@
-/**
- * LC-1 topology-1 org erasure — the generic, DETERMINISTIC eraser for
- * shared-table by-row org data.
- *
- * A first-party biome holds an org's data as rows carrying the org column in a
- * schema-per-service database. To erase an org we must delete exactly those
- * rows, in every org-scoped model. The set of org-scoped models is NOT guessed:
- * it is the SAME set the tenant-isolation extension scopes queries by —
- * {@link collectOrgScopedModels}, which reads the generated Prisma runtime data
- * model and picks every model declaring the org field. Reusing that set is what
- * makes this deterministic rather than a heuristic: a model is erased here iff
- * it is scoped there.
- *
- * FK-safe WITHOUT parsing private relation metadata: each `deleteMany` is its
- * own statement (no wrapping transaction to poison), so a child→parent FK
- * violation (Prisma `P2003`) simply defers that model to the next pass. We loop
- * until every model is deleted; a pass that makes NO progress while models
- * remain means something outside the org-scoped set (a non-org-scoped child
- * row, or a cycle) blocks deletion — we FAIL LOUD with the blocked models
- * rather than leave a silent partial erasure. Idempotent + resumable: re-running
- * re-deletes already-gone rows as no-ops, so the orchestrator saga can retry.
- *
- * A participant that matches ZERO models is likewise a FAILURE, not a clean run
- * — see {@link assertOrgErasureMatchesModels} for why, and for the distinction
- * (models vs rows) that makes that assertion correct rather than a new bug.
- */
-import {
-  DEFAULT_ORG_FIELD,
-  collectOrgScopedModels,
-  readRuntimeModels,
-} from './tenant-isolation.extension';
-
-/** Prisma's error code for a foreign-key constraint failure on delete. */
-const PRISMA_FK_VIOLATION_CODE = 'P2003';
-
-export interface EraseOrgDataOptions {
-  /** Org column. Defaults to {@link DEFAULT_ORG_FIELD} (`orgId`). */
-  readonly orgField?: string;
-  /**
-   * Models to exclude from erasure even though they carry the org field.
-   * Passed through to {@link collectOrgScopedModels}, which fails fast on a
-   * name that matches no model. Use for models an org must NOT lose on erasure
-   * (there should be none for GDPR erasure — this exists for symmetry with the
-   * isolation extension's exemptions).
-   */
-  readonly exemptModels?: readonly string[];
-}
-
-export interface OrgErasureReport {
-  readonly orgId: string;
-  /** Rows deleted per org-scoped model. */
-  readonly deletedByModel: Readonly<Record<string, number>>;
-  readonly totalDeleted: number;
-  /** Passes taken to converge (FK ordering) — observability only. */
-  readonly passes: number;
-}
-
-/** Thrown when org-scoped models remain undeletable after a no-progress pass. */
-export class OrgErasureBlockedError extends Error {
-  constructor(
-    readonly orgId: string,
-    readonly blockedModels: readonly string[],
-  ) {
-    super(
-      `[org-erasure] could not erase org "${orgId}": models [${blockedModels.join(
-        ', ',
-      )}] remain blocked by a foreign key after a no-progress pass. This means a ` +
-        `non-org-scoped table references these org rows, or the org-scoped models ` +
-        `form a delete cycle. Add an onDelete rule or a service-specific eraser — ` +
-        `erasure MUST NOT leave a silent partial.`,
-    );
-    this.name = 'OrgErasureBlockedError';
-  }
-}
-
-/**
- * Thrown when an erasure participant's configuration matches NO org-scoped
- * model at all — it is structurally incapable of deleting anything.
- *
- * This is a MISCONFIGURATION, never an empty org. `memory-api` shipped as a
- * registered GDPR erasure participant whose every model spells the org column
- * `organizationId` while the participant was registered with no `orgField`, so
- * {@link collectOrgScopedModels} returned an empty set, the delete loop never
- * executed, and every erasure answered `200 {totalDeleted: 0}` — which the
- * orchestrator saga records as a SUCCESSFUL erasure. A Data Subject Request
- * answered from that record is false in writing.
- *
- * There is no degraded mode here: a participant that cannot delete anything
- * must not be allowed to report success.
- */
-export class OrgErasureMatchesNothingError extends Error {
-  constructor(
-    readonly orgField: string,
-    readonly knownModels: readonly string[],
-    readonly exemptModels: readonly string[],
-  ) {
-    super(
-      `[org-erasure] this erasure participant matched ZERO models on org ` +
-        `field "${orgField}" — it cannot delete anything, so it MUST NOT ` +
-        `report a successful erasure (the orchestrator would record proof of ` +
-        `an erasure that never happened). Known models: [${knownModels.join(
-          ', ',
-        )}]` +
-        (exemptModels.length > 0
-          ? `; exemptModels: [${exemptModels.join(', ')}]` +
-            ` — exempting every org-scoped model leaves nothing to erase`
-          : '') +
-        `. Fix the participant's orgField (or stop registering the service as ` +
-        `an org-erasure participant) rather than relaxing this check.`,
-    );
-    this.name = 'OrgErasureMatchesNothingError';
-  }
-}
-
-/**
- * Assert the participant can possibly delete something, and return the models
- * it covers.
- *
- * **Models, never rows.** Zero MODELS matched means the participant is
- * structurally incapable of erasing — a configuration defect. Zero ROWS deleted
- * across a non-empty model set is a legitimate clean run: an org that genuinely
- * holds no data in this service must succeed (and re-running an erasure must
- * stay idempotent). Conflating the two would fail every honest erasure for an
- * org with no data here, which is strictly worse than the bug this closes.
- *
- * Exported so a participant can gate at BOOT as well as per request:
- * {@link OrgErasureModule} calls it while wiring its runner, so a service
- * refuses to start rather than advertise `xema.org-data-erasure` it cannot
- * honour. Boot proves the CONFIGURATION; the per-request call inside
- * {@link eraseOrgData} proves the RUN that is about to be recorded as erasure
- * evidence. Both are cheap and neither subsumes the other.
- */
-export function assertOrgErasureMatchesModels(
-  client: unknown,
-  options: EraseOrgDataOptions = {},
-): ReadonlySet<string> {
-  const orgField = options.orgField ?? DEFAULT_ORG_FIELD;
-  const exemptModels = options.exemptModels ?? [];
-  const scoped = collectOrgScopedModels(client, orgField, exemptModels);
-  if (scoped.size === 0) {
-    throw new OrgErasureMatchesNothingError(
-      orgField,
-      Object.keys(readRuntimeModels(client)),
-      exemptModels,
-    );
-  }
-  return scoped;
-}
-
-interface DeleteManyDelegate {
-  deleteMany(args: { where: Record<string, unknown> }): Promise<{ count: number }>;
-}
-
-/** Prisma exposes a model `Foo` as the client property `foo`. */
-function delegateKeyForModel(modelName: string): string {
-  return modelName.charAt(0).toLowerCase() + modelName.slice(1);
-}
-
-function isForeignKeyViolation(error: unknown): boolean {
-  return (
-    typeof error === 'object' &&
-    error !== null &&
-    (error as { code?: unknown }).code === PRISMA_FK_VIOLATION_CODE
-  );
-}
-
-/**
- * Erase every row belonging to `orgId` across all org-scoped models of the
- * given Prisma client. Returns a per-model report. Fails loud (throws) rather
- * than leaving a partial erasure.
- *
- * `client` is the RAW/base Prisma client (NOT an org-scoped `forOrg` client):
- * the org filter is applied explicitly here, so this must not be double-scoped.
- */
-export async function eraseOrgData(
-  client: unknown,
-  orgId: string,
-  options: EraseOrgDataOptions = {},
-): Promise<OrgErasureReport> {
-  const orgField = options.orgField ?? DEFAULT_ORG_FIELD;
-  if (orgId.trim() === '') {
-    throw new Error('[org-erasure] orgId must be a non-empty string.');
-  }
-
-  // Matching no model is a misconfiguration, not an empty org — never let it
-  // return `{ totalDeleted: 0 }`, which the orchestrator reads as success.
-  const scoped = assertOrgErasureMatchesModels(client, options);
-
-  const deletedByModel: Record<string, number> = {};
-  let remaining = [...scoped];
-  let passes = 0;
-
-  while (remaining.length > 0) {
-    passes += 1;
-    const blocked: string[] = [];
-    let progressed = false;
-
-    for (const modelName of remaining) {
-      const delegate = (client as Record<string, unknown>)[
-        delegateKeyForModel(modelName)
-      ] as DeleteManyDelegate | undefined;
-      if (delegate?.deleteMany === undefined) {
-        throw new Error(
-          `[org-erasure] Prisma client has no deleteMany delegate for model ` +
-            `"${modelName}" (looked up "${delegateKeyForModel(modelName)}").`,
-        );
-      }
-
-      try {
-        const { count } = await delegate.deleteMany({
-          where: { [orgField]: orgId },
-        });
-        deletedByModel[modelName] = (deletedByModel[modelName] ?? 0) + count;
-        progressed = true;
-      } catch (error) {
-        if (isForeignKeyViolation(error)) {
-          blocked.push(modelName);
-          continue;
-        }
-        throw error;
-      }
-    }
-
-    if (!progressed && blocked.length > 0) {
-      throw new OrgErasureBlockedError(orgId, blocked);
-    }
-    remaining = blocked;
-  }
-
-  const totalDeleted = Object.values(deletedByModel).reduce(
-    (sum, n) => sum + n,
-    0,
-  );
-  return { orgId, deletedByModel, totalDeleted, passes };
-}

package/src/lib/tenant-isolation/org-scope.ts

@@ -1,305 +0,0 @@
-/**
- * PURE Prisma-arg transformers for org-tenant scoping. No I/O, no logging, no
- * mode logic — given (model, operation, args, orgId, orgField) they return the
- * rewritten args plus every violation found, and the caller (the client
- * extension) decides throw-vs-warn per {@link TenantIsolationMode}. Never
- * mutates the input args.
- */
-import {
-  TenantIsolationViolationKind,
-  type TenantIsolationViolation,
-} from './tenant-isolation-error';
-
-/**
- * The closed set of Prisma model-delegate operations tenant isolation knows
- * how to scope (relational providers; the raw Mongo ops do not apply). An
- * operation outside this set reaching an org-scoped model is reported as an
- * `UnsupportedOperation` violation — never silently passed through.
- */
-export enum PrismaModelOperation {
-  FindUnique = 'findUnique',
-  FindUniqueOrThrow = 'findUniqueOrThrow',
-  FindFirst = 'findFirst',
-  FindFirstOrThrow = 'findFirstOrThrow',
-  FindMany = 'findMany',
-  Create = 'create',
-  CreateMany = 'createMany',
-  CreateManyAndReturn = 'createManyAndReturn',
-  Update = 'update',
-  UpdateMany = 'updateMany',
-  UpdateManyAndReturn = 'updateManyAndReturn',
-  Upsert = 'upsert',
-  Delete = 'delete',
-  DeleteMany = 'deleteMany',
-  Aggregate = 'aggregate',
-  Count = 'count',
-  GroupBy = 'groupBy',
-}
-
-/** How an operation's `where` participates in scoping. */
-enum WhereShape {
-  /** No `where` clause on this operation. */
-  None = 'none',
-  /** A plain filter `where` — the org clause is AND-ed in. */
-  Filter = 'filter',
-  /**
-   * A `WhereUniqueInput`. Since Prisma 5 (extendedWhereUnique GA) a unique
-   * where accepts additional non-unique filter fields and `AND`/`OR`/`NOT`,
-   * so the org clause is AND-ed in exactly like a filter where — a cross-org
-   * unique read resolves to `null` and a cross-org update/delete raises
-   * Prisma's P2025 (record not found), with no post-verification race.
-   */
-  Unique = 'unique',
-}
-
-interface OperationScopeSpec {
-  readonly where: WhereShape;
-  /** Args key holding the create payload to stamp (`data` or `create`). */
-  readonly createDataKey?: 'data' | 'create';
-  /** Args key holding the update payload to mismatch-check (`data`/`update`). */
-  readonly updateDataKey?: 'data' | 'update';
-}
-
-const OPERATION_SCOPE_SPECS: Readonly<
-  Record<PrismaModelOperation, OperationScopeSpec>
-> = {
-  [PrismaModelOperation.FindUnique]: { where: WhereShape.Unique },
-  [PrismaModelOperation.FindUniqueOrThrow]: { where: WhereShape.Unique },
-  [PrismaModelOperation.FindFirst]: { where: WhereShape.Filter },
-  [PrismaModelOperation.FindFirstOrThrow]: { where: WhereShape.Filter },
-  [PrismaModelOperation.FindMany]: { where: WhereShape.Filter },
-  [PrismaModelOperation.Create]: {
-    where: WhereShape.None,
-    createDataKey: 'data',
-  },
-  [PrismaModelOperation.CreateMany]: {
-    where: WhereShape.None,
-    createDataKey: 'data',
-  },
-  [PrismaModelOperation.CreateManyAndReturn]: {
-    where: WhereShape.None,
-    createDataKey: 'data',
-  },
-  [PrismaModelOperation.Update]: {
-    where: WhereShape.Unique,
-    updateDataKey: 'data',
-  },
-  [PrismaModelOperation.UpdateMany]: {
-    where: WhereShape.Filter,
-    updateDataKey: 'data',
-  },
-  [PrismaModelOperation.UpdateManyAndReturn]: {
-    where: WhereShape.Filter,
-    updateDataKey: 'data',
-  },
-  [PrismaModelOperation.Upsert]: {
-    where: WhereShape.Unique,
-    createDataKey: 'create',
-    updateDataKey: 'update',
-  },
-  [PrismaModelOperation.Delete]: { where: WhereShape.Unique },
-  [PrismaModelOperation.DeleteMany]: { where: WhereShape.Filter },
-  [PrismaModelOperation.Aggregate]: { where: WhereShape.Filter },
-  [PrismaModelOperation.Count]: { where: WhereShape.Filter },
-  [PrismaModelOperation.GroupBy]: { where: WhereShape.Filter },
-};
-
-/** Input to {@link scopeArgsToOrg}. `orgId` is REQUIRED — resolving whether an
- * org context exists (and what missing context means per mode) is the
- * extension's job, not this pure module's. */
-export interface OrgScopeRequest {
-  readonly model: string;
-  readonly operation: string;
-  readonly args: Readonly<Record<string, unknown>> | undefined;
-  readonly orgId: string;
-  readonly orgField: string;
-}
-
-export interface OrgScopeOutcome {
-  /**
-   * The org-scoped args. Only meaningful when `violations` is empty — on any
-   * violation the caller must throw (Enforce) or warn + run the ORIGINAL args
-   * (Observe), never run a half-rewritten query.
-   */
-  readonly args: Record<string, unknown>;
-  readonly violations: readonly TenantIsolationViolation[];
-}
-
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-/** Append `clause` to an existing Prisma `AND` (absent | object | array). */
-function appendAndClause(
-  existing: unknown,
-  clause: Record<string, unknown>,
-): unknown[] {
-  if (existing === undefined) {
-    return [clause];
-  }
-  if (Array.isArray(existing)) {
-    return [...existing, clause];
-  }
-  return [existing, clause];
-}
-
-/**
- * AND `{ [orgField]: orgId }` into a `where` (filter or unique — both accept
- * `AND` since Prisma 5). AND-ing (instead of overwriting) means a caller that
- * explicitly filtered on ANOTHER org deterministically matches nothing rather
- * than silently having its filter replaced.
- */
-function andOrgIntoWhere(
-  where: unknown,
-  orgField: string,
-  orgId: string,
-): unknown {
-  const orgClause = { [orgField]: orgId };
-  if (where === undefined || where === null) {
-    return orgClause;
-  }
-  if (!isPlainObject(where)) {
-    // Malformed where — Prisma's own validation rejects the query; there is
-    // nothing meaningful to scope and no way the query can return rows.
-    return where;
-  }
-  return { ...where, AND: appendAndClause(where['AND'], orgClause) };
-}
-
-/** Unwrap `{ set: value }` (the atomic update shape for scalars). */
-function extractScalarWriteValue(value: unknown): unknown {
-  if (isPlainObject(value) && 'set' in value) {
-    return value['set'];
-  }
-  return value;
-}
-
-function orgMismatchViolation(
-  req: OrgScopeRequest,
-  actual: unknown,
-  path: string,
-): TenantIsolationViolation {
-  return {
-    kind: TenantIsolationViolationKind.OrgMismatch,
-    model: req.model,
-    operation: req.operation,
-    orgField: req.orgField,
-    expectedOrgId: req.orgId,
-    actualOrgId: String(actual),
-    path,
-  };
-}
-
-/**
- * Stamp one create row: fill `orgField` when absent; report a violation when
- * present with a DIFFERENT org than the scope.
- */
-function stampCreateRow(
-  row: unknown,
-  req: OrgScopeRequest,
-  path: string,
-  violations: TenantIsolationViolation[],
-): unknown {
-  if (!isPlainObject(row)) {
-    // Malformed payload — Prisma validation rejects it downstream.
-    return row;
-  }
-  const current = row[req.orgField];
-  if (current === undefined) {
-    return { ...row, [req.orgField]: req.orgId };
-  }
-  if (extractScalarWriteValue(current) !== req.orgId) {
-    violations.push(
-      orgMismatchViolation(req, extractScalarWriteValue(current), path),
-    );
-  }
-  return row;
-}
-
-function stampCreatePayload(
-  payload: unknown,
-  req: OrgScopeRequest,
-  path: string,
-  violations: TenantIsolationViolation[],
-): unknown {
-  if (Array.isArray(payload)) {
-    return payload.map((row) => stampCreateRow(row, req, path, violations));
-  }
-  return stampCreateRow(payload, req, path, violations);
-}
-
-/**
- * Update payloads are never rewritten — only checked: setting `orgField` to a
- * different org would re-home the row into another tenant.
- */
-function checkUpdatePayload(
-  payload: unknown,
-  req: OrgScopeRequest,
-  path: string,
-  violations: TenantIsolationViolation[],
-): void {
-  if (!isPlainObject(payload)) {
-    return;
-  }
-  const current = payload[req.orgField];
-  if (current === undefined) {
-    return;
-  }
-  if (extractScalarWriteValue(current) !== req.orgId) {
-    violations.push(
-      orgMismatchViolation(req, extractScalarWriteValue(current), path),
-    );
-  }
-}
-
-/**
- * Rewrite one org-scoped model operation's args so it can only see/touch rows
- * of `orgId`, and report every violation found. Pure: the input args object is
- * never mutated.
- */
-export function scopeArgsToOrg(req: OrgScopeRequest): OrgScopeOutcome {
-  const spec = (
-    OPERATION_SCOPE_SPECS as Readonly<
-      Record<string, OperationScopeSpec | undefined>
-    >
-  )[req.operation];
-  if (spec === undefined) {
-    return {
-      args: { ...(req.args ?? {}) },
-      violations: [
-        {
-          kind: TenantIsolationViolationKind.UnsupportedOperation,
-          model: req.model,
-          operation: req.operation,
-          orgField: req.orgField,
-          expectedOrgId: req.orgId,
-        },
-      ],
-    };
-  }
-
-  const violations: TenantIsolationViolation[] = [];
-  const args: Record<string, unknown> = { ...(req.args ?? {}) };
-
-  if (spec.where !== WhereShape.None) {
-    args['where'] = andOrgIntoWhere(args['where'], req.orgField, req.orgId);
-  }
-  if (spec.createDataKey !== undefined) {
-    args[spec.createDataKey] = stampCreatePayload(
-      args[spec.createDataKey],
-      req,
-      spec.createDataKey,
-      violations,
-    );
-  }
-  if (spec.updateDataKey !== undefined) {
-    checkUpdatePayload(
-      args[spec.updateDataKey],
-      req,
-      spec.updateDataKey,
-      violations,
-    );
-  }
-
-  return { args, violations };
-}

package/src/lib/tenant-isolation/tenant-isolation-error.ts

@@ -1,79 +0,0 @@
-/**
- * What went wrong from a tenant-isolation point of view. Closed set.
- *
- * - `OrgMismatch` — a write payload names an org that differs from the org the
- *   client is scoped to (attempted cross-org create, or re-homing a row into
- *   another org via update data).
- * - `MissingOrgContext` — an org-scoped model was accessed through the
- *   ambient-scoped client while NO org context was present (boot, migrations,
- *   seeding, contribution sync, Temporal activities, background workers).
- * - `UnsupportedOperation` — a Prisma operation outside the known closed set
- *   reached an org-scoped model; isolation cannot prove it is scoped, so it is
- *   rejected rather than silently passed through.
- */
-export enum TenantIsolationViolationKind {
-  OrgMismatch = 'org_mismatch',
-  MissingOrgContext = 'missing_org_context',
-  UnsupportedOperation = 'unsupported_operation',
-}
-
-/** Structured description of one violation (also the Observe-mode log body). */
-export interface TenantIsolationViolation {
-  readonly kind: TenantIsolationViolationKind;
-  /** Prisma model name (as in the schema, e.g. `Artifact`). */
-  readonly model: string;
-  /** Prisma delegate operation (e.g. `findMany`, `create`). */
-  readonly operation: string;
-  /** The org column being enforced (default `orgId`). */
-  readonly orgField: string;
-  /** The org the client is scoped to (absent for MissingOrgContext). */
-  readonly expectedOrgId?: string;
-  /** The conflicting org named by the query args (OrgMismatch only). */
-  readonly actualOrgId?: string;
-  /** Which args key carried the conflict, e.g. `data`, `create`, `update`. */
-  readonly path?: string;
-}
-
-/** Render a violation as one structured, actionable log/error line. */
-export function formatTenantIsolationViolation(
-  violation: TenantIsolationViolation,
-): string {
-  const site = `${violation.model}.${violation.operation}`;
-  switch (violation.kind) {
-    case TenantIsolationViolationKind.OrgMismatch:
-      return (
-        `[tenant-isolation] org mismatch on ${site}: args` +
-        `${violation.path !== undefined ? ` "${violation.path}"` : ''} set ` +
-        `${violation.orgField}="${violation.actualOrgId}" but the client is ` +
-        `scoped to "${violation.expectedOrgId}".`
-      );
-    case TenantIsolationViolationKind.MissingOrgContext:
-      return (
-        `[tenant-isolation] ${site} executed with no org context. Outside a ` +
-        `request (boot, migrations, seeding, workers, Temporal activities) ` +
-        `there is no ambient org — use client.forOrg(orgId) for explicit ` +
-        `scoping, or client.asSystem() for a legitimate cross-org system path.`
-      );
-    case TenantIsolationViolationKind.UnsupportedOperation:
-      return (
-        `[tenant-isolation] unrecognized Prisma operation "${violation.operation}" ` +
-        `on org-scoped model ${violation.model} — tenant isolation cannot prove ` +
-        `it is org-scoped. Add it to PrismaModelOperation or exempt the model.`
-      );
-  }
-}
-
-/**
- * Typed error thrown in Enforce mode. Carries the structured
- * {@link TenantIsolationViolation} so callers/tests can branch on `kind`
- * without parsing the message.
- */
-export class TenantIsolationError extends Error {
-  readonly violation: TenantIsolationViolation;
-
-  constructor(violation: TenantIsolationViolation) {
-    super(formatTenantIsolationViolation(violation));
-    this.name = 'TenantIsolationError';
-    this.violation = violation;
-  }
-}

package/src/lib/tenant-isolation/tenant-isolation-mode.ts

@@ -1,55 +0,0 @@
-/**
- * How tenant isolation behaves for the DEFAULT (ambient-context-scoped)
- * client. Closed set — do not add members without a plan revision.
- *
- * - `Enforce` — org filters are injected into every query on an org-scoped
- *   model; violations (org mismatch in write payloads, org-model access with
- *   no org context) throw a typed {@link TenantIsolationError}.
- * - `Observe` — NO query is rewritten; instead every violation that Enforce
- *   would reject is logged as a structured warning. This is the rollout
- *   default so ~60 services can surface gaps without behavior change.
- * - `Off` — full passthrough (kill switch). Explicit `forOrg(orgId)` clients
- *   still enforce — explicit scoping is a correctness request, never silently
- *   degraded.
- */
-export enum TenantIsolationMode {
-  Enforce = 'enforce',
-  Observe = 'observe',
-  Off = 'off',
-}
-
-/** Env var read by {@link resolveTenantIsolationMode} when no option is set. */
-export const TENANT_ISOLATION_MODE_ENV_VAR = 'XEMA_TENANT_ISOLATION_MODE';
-
-const MODE_VALUES: readonly string[] = Object.values(TenantIsolationMode);
-
-function isTenantIsolationMode(value: string): value is TenantIsolationMode {
-  return MODE_VALUES.includes(value);
-}
-
-/**
- * Resolve the effective mode: explicit option > `XEMA_TENANT_ISOLATION_MODE`
- * env var > default {@link TenantIsolationMode.Observe}.
- *
- * Fail-fast: an env var set to anything outside the closed set throws — a
- * typo'd mode must never silently fall back to a weaker one.
- */
-export function resolveTenantIsolationMode(
-  explicit?: TenantIsolationMode,
-  env: NodeJS.ProcessEnv = process.env,
-): TenantIsolationMode {
-  if (explicit !== undefined) {
-    return explicit;
-  }
-  const raw = env[TENANT_ISOLATION_MODE_ENV_VAR];
-  if (raw === undefined || raw === '') {
-    return TenantIsolationMode.Observe;
-  }
-  if (!isTenantIsolationMode(raw)) {
-    throw new Error(
-      `[tenant-isolation] invalid ${TENANT_ISOLATION_MODE_ENV_VAR}="${raw}" — ` +
-        `expected one of: ${MODE_VALUES.join(', ')}.`,
-    );
-  }
-  return raw;
-}