glasswork 1.0.1 → 1.2.0

package/dist/observability/pino-logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"pino-logger.js","sourceRoot":"","sources":["../../src/observability/pino-logger.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAiCzD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAgC;IAC3E,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAElC,SAAS,WAAW;QAClB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;QAChC,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAE7C,IAAI,GAAG,EAAE,SAAS,EAAE,CAAC;YACnB,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QACrC,CAAC;QACD,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;YAChB,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QAC7B,CAAC;QAED,yBAAyB;QACzB,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAe;QACpD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,IAAI,GAAG,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;QAEnD,wBAAwB;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,GAAI,IAAgC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAW,EAAE,GAAG,IAAe;YACnC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAW,EAAE,GAAG,IAAe;YAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,GAAW,EAAE,GAAG,IAAe;YAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,GAAW,EAAE,GAAG,IAAe;YACnC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,QAAiC;YACrC,OAAO,4BAA4B,CAAC;gBAClC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC1B,OAAO;aACR,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAgB;IACvD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,MAAM,IAAI,EAAE,CAAC;QAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACpC,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;QAEhC,MAAM,SAAS,GAA4B;YACzC,SAAS,EAAE,GAAG,EAAE,SAAS;YACzB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,QAAQ;SACT,CAAC;QAEF,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;YAChB,SAAS,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;IACtC,0CAA0C;IAC1C,UAAU,EAAE;QACV,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;KAC7C;IACD,0BAA0B;IAC1B,SAAS,EAAE,SAAS;IACpB,wCAAwC;IACxC,IAAI,EAAE,SAAS;CAChB,CAAC"}
+{"version":3,"file":"pino-logger.js","sourceRoot":"","sources":["../../src/observability/pino-logger.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAiCzD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,sBAAsB,CAC7B,GAA0C;IAE1C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAE7C,IAAI,GAAG,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IACtD,IAAI,GAAG,CAAC,MAAM;QAAE,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7C,IAAI,GAAG,CAAC,WAAW;QAAE,QAAQ,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IAC5D,IAAI,GAAG,CAAC,eAAe;QAAE,QAAQ,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;IACxE,IAAI,GAAG,CAAC,eAAe;QAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC;IACzD,IAAI,GAAG,CAAC,QAAQ;QAAE,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IACnD,IAAI,GAAG,CAAC,MAAM;QAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAAgC;IAC3E,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAElC,SAAS,WAAW;QAClB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QAC7B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAe;QACpD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,IAAI,GAAG,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;QAEnD,wBAAwB;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,GAAI,IAAgC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAW,EAAE,GAAG,IAAe;YACnC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAW,EAAE,GAAG,IAAe;YAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,GAAW,EAAE,GAAG,IAAe;YAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,GAAW,EAAE,GAAG,IAAe;YACnC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,QAAiC;YACrC,OAAO,4BAA4B,CAAC;gBAClC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC1B,OAAO;aACR,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAgB;IACvD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,MAAM,IAAI,EAAE,CAAC;QAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACpC,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;QAEhC,MAAM,SAAS,GAA4B;YACzC,SAAS,EAAE,GAAG,EAAE,SAAS;YACzB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,QAAQ;SACT,CAAC;QAEF,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;YAChB,SAAS,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;IACtC,0CAA0C;IAC1C,UAAU,EAAE;QACV,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;KAC7C;IACD,0BAA0B;IAC1B,SAAS,EAAE,SAAS;IACpB,wCAAwC;IACxC,IAAI,EAAE,SAAS;CAChB,CAAC"}

package/dist/observability/request-context.d.ts

@@ -11,8 +11,16 @@ export interface RequestContext {
     method: string;
     /** Request path */
     path: string;
-    /** Optional user ID (set via setUser) */
+    /** Optional user ID (set via setUser or setRequestAuth) */
     userId?: string;
+    /** Physical actor user ID (e.g. Superadmin during impersonation, otherwise same as userId) */
+    actorUserId?: string;
+    /** Effective target user ID when impersonating */
+    effectiveUserId?: string;
+    /** Whether the request is being executed via user impersonation */
+    isImpersonating?: boolean;
+    /** Organization or tenant ID associated with the authenticated user/request */
+    tenantId?: string;
     /** Custom context data */
     custom: Record<string, unknown>;
 }
@@ -62,6 +70,14 @@ export declare function getRequestContext(): RequestContext | undefined;
  * ```
  */
 export declare function getRequestId(): string | undefined;
+export interface RequestAuthContext {
+    /** Effective user ID (whose permissions and identity apply) */
+    userId: string;
+    /** Organization or tenant ID associated with the user/request */
+    tenantId?: string | null | undefined;
+    /** Impersonator user ID if this request is performed via impersonation */
+    impersonatedBy?: string | null | undefined;
+}
 /**
  * Set user information in the current request context.
  * Useful for correlating logs and errors with users after authentication.
@@ -78,6 +94,25 @@ export declare function getRequestId(): string | undefined;
  * ```
  */
 export declare function setRequestUser(userId: string): void;
+/**
+ * Set full authentication and actor context for the current request.
+ * Automatically resolves whether impersonation is active:
+ * - If impersonatedBy is provided: actorUserId is the impersonator, effectiveUserId is the target user, isImpersonating is true.
+ * - Otherwise: actorUserId is the user, effectiveUserId is undefined, isImpersonating is false.
+ *
+ * @param auth - Authentication context including user ID, tenant ID, and optional impersonator ID
+ */
+export declare function setRequestAuth(auth: RequestAuthContext): void;
+/**
+ * Get the current actor context for auditing and security correlation.
+ * Returns undefined if called outside a request lifecycle.
+ */
+export declare function getRequestActor(): {
+    actorUserId?: string;
+    effectiveUserId?: string;
+    isImpersonating: boolean;
+    tenantId?: string;
+} | undefined;
 /**
  * Set custom context data for the current request.
  * Useful for adding business-specific context to logs.

package/dist/observability/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/observability/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,mCAA0C,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAE9D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAEjD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAKnD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAKxE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,IAAI,iBAAiB,CAelE"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/observability/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,mCAA0C,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAE9D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAEjD;AAED,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACrC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAMnD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAiB7D;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAC3B;IACE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD,SAAS,CASZ;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAKxE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,IAAI,iBAAiB,CAelE"}

package/dist/observability/request-context.js

@@ -68,8 +68,51 @@ export function setRequestUser(userId) {
     const store = requestContextStorage.getStore();
     if (store) {
         store.userId = userId;
+        store.actorUserId = store.actorUserId ?? userId;
     }
 }
+/**
+ * Set full authentication and actor context for the current request.
+ * Automatically resolves whether impersonation is active:
+ * - If impersonatedBy is provided: actorUserId is the impersonator, effectiveUserId is the target user, isImpersonating is true.
+ * - Otherwise: actorUserId is the user, effectiveUserId is undefined, isImpersonating is false.
+ *
+ * @param auth - Authentication context including user ID, tenant ID, and optional impersonator ID
+ */
+export function setRequestAuth(auth) {
+    const store = requestContextStorage.getStore();
+    if (store) {
+        store.userId = auth.userId;
+        if (typeof auth.tenantId === 'string') {
+            store.tenantId = auth.tenantId;
+        }
+        if (auth.impersonatedBy) {
+            store.actorUserId = auth.impersonatedBy;
+            store.effectiveUserId = auth.userId;
+            store.isImpersonating = true;
+        }
+        else {
+            store.actorUserId = auth.userId;
+            store.effectiveUserId = undefined;
+            store.isImpersonating = false;
+        }
+    }
+}
+/**
+ * Get the current actor context for auditing and security correlation.
+ * Returns undefined if called outside a request lifecycle.
+ */
+export function getRequestActor() {
+    const store = requestContextStorage.getStore();
+    if (!store)
+        return undefined;
+    return {
+        actorUserId: store.actorUserId ?? store.userId,
+        effectiveUserId: store.effectiveUserId,
+        isImpersonating: Boolean(store.isImpersonating),
+        tenantId: store.tenantId,
+    };
+}
 /**
  * Set custom context data for the current request.
  * Useful for adding business-specific context to logs.

package/dist/observability/request-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/observability/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAoBrD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,KAAc;IAChE,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAE5D,MAAM,OAAO,GAAmB;YAC9B,SAAS;YACT,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;YAChB,MAAM,EAAE,EAAE;SACX,CAAC;QAEF,MAAM,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/observability/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA4BrD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC;AACrD,CAAC;AAWD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjC,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC;YACxC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;YACpC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;YAChC,KAAK,CAAC,eAAe,GAAG,SAAS,CAAC;YAClC,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAQ7B,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM;QAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QAC/C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,KAAc;IAChE,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAE5D,MAAM,OAAO,GAAmB;YAC9B,SAAS;YACT,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;YAChB,MAAM,EAAE,EAAE;SACX,CAAC;QAEF,MAAM,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/openapi/openapi.d.ts

@@ -44,10 +44,7 @@ export interface ConfigureOpenAPIResult {
  *
  * @example
  * ```typescript
- * // Basic usage (auto-write with delay)
- * configureOpenAPI({ app, environment, openapi });
- *
- * // Explicit write after routes are registered (recommended)
+ * // Configure first, then explicitly write after routes are registered.
  * const { writeSpec } = configureOpenAPI({ app, environment, openapi });
  * // ... register all routes ...
  * await writeSpec?.();

package/dist/openapi/openapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAQ1B,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,sBAAsB,CA6EzF"}
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAqB,MAAM,MAAM,CAAC;AAGpD,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAK1B,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,sBAAsB,CA8DzF"}

package/dist/openapi/openapi.js

@@ -1,11 +1,8 @@
 import { writeFile } from 'node:fs/promises';
-import { swaggerUI } from '@hono/swagger-ui';
-import { openAPIRouteHandler } from 'hono-openapi';
+import { generateSpecs, openAPIRouteHandler } from 'hono-openapi';
 import { deepMerge } from '../utils/deep-merge.js';
 import { createLogger } from '../utils/logger.js';
 import { defaultOpenAPIComponents } from './defaults.js';
-/** Default delay before writing OpenAPI spec (ms). Allows routes to register. */
-const DEFAULT_WRITE_DELAY_MS = 1000;
 /**
  * Configure OpenAPI documentation for the application.
  *
@@ -22,10 +19,7 @@ const DEFAULT_WRITE_DELAY_MS = 1000;
  *
  * @example
  * ```typescript
- * // Basic usage (auto-write with delay)
- * configureOpenAPI({ app, environment, openapi });
- *
- * // Explicit write after routes are registered (recommended)
+ * // Configure first, then explicitly write after routes are registered.
  * const { writeSpec } = configureOpenAPI({ app, environment, openapi });
  * // ... register all routes ...
  * await writeSpec?.();
@@ -54,40 +48,26 @@ export function configureOpenAPI(options) {
     }
     // Serve Swagger UI (development only by default)
     if (shouldServeUI) {
-        app.get('/api', swaggerUI({ url: '/api/openapi.json' }));
+        let handlerPromise;
+        app.get('/api', async (c, next) => {
+            handlerPromise ??= import('@hono/swagger-ui')
+                .then(({ swaggerUI }) => swaggerUI({ url: '/api/openapi.json' }))
+                .catch((cause) => {
+                throw new Error('Unable to load Swagger UI. Install the optional peer with: npm install @hono/swagger-ui', { cause });
+            });
+            const handler = await handlerPromise;
+            return handler(c, next);
+        });
     }
     // Create writeSpec function if file writing is configured
     let writeSpec;
     if (openapi.writeToFile) {
         const filePath = openapi.writeToFile;
         writeSpec = async () => {
-            try {
-                let specContent;
-                if (shouldServeSpecs) {
-                    // Use Hono's built-in request method to simulate the request
-                    const response = await app.request('/api/openapi.json');
-                    specContent = await response.text();
-                }
-                else {
-                    // If not serving specs, generate manually
-                    // Mount a temporary internal endpoint
-                    app.get('/api/openapi-internal.json', openAPIRouteHandler(app, { documentation: mergedDocumentation }));
-                    const response = await app.request('/api/openapi-internal.json');
-                    const spec = (await response.json());
-                    specContent = JSON.stringify(spec, null, 2);
-                }
-                await writeFile(filePath, specContent, 'utf-8');
-                logger.info(`OpenAPI spec written to ${filePath}`);
-            }
-            catch (error) {
-                logger.error('Failed to write OpenAPI spec:', error);
-            }
+            const spec = await generateSpecs(app, { documentation: mergedDocumentation });
+            await writeFile(filePath, JSON.stringify(spec, null, 2), 'utf-8');
+            logger.info(`OpenAPI spec written to ${filePath}`);
         };
-        // Auto-write with delay for backward compatibility
-        // NOTE: For more reliable writes, call writeSpec() explicitly after registering routes
-        setTimeout(() => {
-            writeSpec?.();
-        }, DEFAULT_WRITE_DELAY_MS);
     }
     return { writeSpec };
 }

package/dist/openapi/openapi.js.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../src/openapi/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAQnD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAgCpC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAC/D,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAErE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAE1D,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,IAAI,WAAW,KAAK,aAAa,CAAC;IAC7E,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,WAAW,KAAK,aAAa,CAAC;IAEvE,4FAA4F;IAC5F,MAAM,kBAAkB,GAAG,0BAA0B,CAAC,wBAAwB,EAAE;QAC9E,gBAAgB,EAAE,SAAS,EAAE,OAAO,IAAI,KAAK;QAC7C,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI;KAChC,CAAC,CAAC;IAEH,mEAAmE;IACnE,MAAM,mBAAmB,GAAG,SAAS,CACnC,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAClC,OAAO,CAAC,aAAa,IAAI,EAAE,CAC5B,CAAC;IAEF,4DAA4D;IAC5D,IAAI,gBAAgB,EAAE,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,iDAAiD;IACjD,IAAI,aAAa,EAAE,CAAC;QAClB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,0DAA0D;IAC1D,IAAI,SAA4C,CAAC;IAEjD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;QAErC,SAAS,GAAG,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC;gBACH,IAAI,WAAmB,CAAC;gBAExB,IAAI,gBAAgB,EAAE,CAAC;oBACrB,6DAA6D;oBAC7D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;oBACxD,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtC,CAAC;qBAAM,CAAC;oBACN,0CAA0C;oBAC1C,sCAAsC;oBACtC,GAAG,CAAC,GAAG,CACL,4BAA4B,EAC5B,mBAAmB,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CACjE,CAAC;oBACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;oBACjE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;oBAC7D,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC9C,CAAC;gBAED,MAAM,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC;QAEF,mDAAmD;QACnD,uFAAuF;QACvF,UAAU,CAAC,GAAG,EAAE;YACd,SAAS,EAAE,EAAE,CAAC;QAChB,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CACjC,UAAsC,EACtC,QAA6D;IAE7D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CACxC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAC3F,CAAC;IAEF,OAAO;QACL,GAAG,UAAU;QACb,OAAO,EAAE,eAAe;KACzB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,EAAE,gBAAgB,EAAE,WAAW,EAAuD;IAEtF,gFAAgF;IAChF,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+CAA+C;IAC/C,IAAI,UAAU,KAAK,6BAA6B,EAAE,CAAC;QACjD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,8DAA8D;IAC9D,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACxE,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,mCAAmC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../src/openapi/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAQlE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAgCzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAC/D,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAErE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAE1D,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,IAAI,WAAW,KAAK,aAAa,CAAC;IAC7E,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,WAAW,KAAK,aAAa,CAAC;IAEvE,4FAA4F;IAC5F,MAAM,kBAAkB,GAAG,0BAA0B,CAAC,wBAAwB,EAAE;QAC9E,gBAAgB,EAAE,SAAS,EAAE,OAAO,IAAI,KAAK;QAC7C,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI;KAChC,CAAC,CAAC;IAEH,mEAAmE;IACnE,MAAM,mBAAmB,GAAG,SAAS,CACnC,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAClC,OAAO,CAAC,aAAa,IAAI,EAAE,CAC5B,CAAC;IAEF,4DAA4D;IAC5D,IAAI,gBAAgB,EAAE,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,iDAAiD;IACjD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,cAAsD,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAChC,cAAc,KAAK,MAAM,CAAC,kBAAkB,CAAC;iBAC1C,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;iBAChE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,EACzF,EAAE,KAAK,EAAE,CACV,CAAC;YACJ,CAAC,CAAC,CAAC;YACL,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC;YACrC,OAAO,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,IAAI,SAA4C,CAAC;IAEjD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;QAErC,SAAS,GAAG,KAAK,IAAI,EAAE;YACrB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC9E,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CACjC,UAAsC,EACtC,QAA6D;IAE7D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CACxC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAC3F,CAAC;IAEF,OAAO;QACL,GAAG,UAAU;QACb,OAAO,EAAE,eAAe;KACzB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,EAAE,gBAAgB,EAAE,WAAW,EAAuD;IAEtF,gFAAgF;IAChF,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+CAA+C;IAC/C,IAAI,UAAU,KAAK,6BAA6B,EAAE,CAAC;QACjD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,8DAA8D;IAC9D,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACxE,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,mCAAmC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/rls/configuration.d.ts

@@ -0,0 +1,3 @@
+/** PostgreSQL settings use qualified, case-insensitive names. */
+export declare function validateSessionVariables(sessionVariable: string, bypassVariable?: string): void;
+//# sourceMappingURL=configuration.d.ts.map

package/dist/rls/configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/rls/configuration.ts"],"names":[],"mappings":"AAIA,iEAAiE;AACjE,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAU/F"}

package/dist/rls/configuration.js

@@ -0,0 +1,13 @@
+import { RLSConfigurationException } from './types.js';
+const parameterName = /^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)+$/i;
+/** PostgreSQL settings use qualified, case-insensitive names. */
+export function validateSessionVariables(sessionVariable, bypassVariable) {
+    if (!parameterName.test(sessionVariable) ||
+        sessionVariable.toLowerCase() === bypassVariable?.toLowerCase()) {
+        throw new RLSConfigurationException('Use distinct, qualified session variables.');
+    }
+    if (bypassVariable !== undefined && !parameterName.test(bypassVariable)) {
+        throw new RLSConfigurationException('The bypass variable must be qualified.');
+    }
+}
+//# sourceMappingURL=configuration.js.map

package/dist/rls/configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/rls/configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,aAAa,GAAG,4CAA4C,CAAC;AAEnE,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CAAC,eAAuB,EAAE,cAAuB;IACvF,IACE,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC;QACpC,eAAe,CAAC,WAAW,EAAE,KAAK,cAAc,EAAE,WAAW,EAAE,EAC/D,CAAC;QACD,MAAM,IAAI,yBAAyB,CAAC,4CAA4C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,yBAAyB,CAAC,wCAAwC,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/rls/context.d.ts

@@ -0,0 +1,37 @@
+import { type TenantContext } from './types.js';
+/**
+ * Run an asynchronous function within a specific tenant context.
+ *
+ * @param context - The TenantContext to bind.
+ * @param fn - The asynchronous callback function.
+ * @returns The resolved return value of `fn`.
+ *
+ * @example
+ * ```typescript
+ * const result = await runWithTenant({ tenantId: 'tenant_123' }, async () => {
+ *   return await prisma.poll.findMany();
+ * });
+ * ```
+ */
+export declare function runWithTenant<T>(context: TenantContext | undefined, fn: () => T | PromiseLike<T>): Promise<T>;
+/**
+ * Run trusted system code with an explicit bypass.
+ *
+ * Only tables with a matching bypass policy allow access across tenants.
+ */
+export declare function runWithBypass<T>(fn: () => T | PromiseLike<T>): Promise<T>;
+/**
+ * Get the current active TenantContext, or undefined if outside a tenant execution boundary.
+ */
+export declare function getTenantContext(): Readonly<TenantContext> | undefined;
+/**
+ * Get the current active tenant ID, or undefined if outside a tenant boundary.
+ */
+export declare function getTenantId(): string | undefined;
+/**
+ * Get the current active tenant ID, throwing `MissingTenantContextException` if not present.
+ *
+ * @param modelName - Optional model name for descriptive error reporting.
+ */
+export declare function requireTenantId(modelName?: string): string;
+//# sourceMappingURL=context.d.ts.map

package/dist/rls/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/rls/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAiC,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAO/E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC7B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,EAAE,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEzE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,SAAS,CAEtE;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,GAAG,SAAS,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAM1D"}

package/dist/rls/context.js

@@ -0,0 +1,56 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { MissingTenantContextException } from './types.js';
+/**
+ * AsyncLocalStorage instance holding the active TenantContext for the current execution chain.
+ */
+const tenantContextStorage = new AsyncLocalStorage();
+/**
+ * Run an asynchronous function within a specific tenant context.
+ *
+ * @param context - The TenantContext to bind.
+ * @param fn - The asynchronous callback function.
+ * @returns The resolved return value of `fn`.
+ *
+ * @example
+ * ```typescript
+ * const result = await runWithTenant({ tenantId: 'tenant_123' }, async () => {
+ *   return await prisma.poll.findMany();
+ * });
+ * ```
+ */
+export function runWithTenant(context, fn) {
+    return tenantContextStorage.run(context && Object.freeze({ ...context }), async () => await fn());
+}
+/**
+ * Run trusted system code with an explicit bypass.
+ *
+ * Only tables with a matching bypass policy allow access across tenants.
+ */
+export function runWithBypass(fn) {
+    return runWithTenant({ bypass: true }, fn);
+}
+/**
+ * Get the current active TenantContext, or undefined if outside a tenant execution boundary.
+ */
+export function getTenantContext() {
+    return tenantContextStorage.getStore();
+}
+/**
+ * Get the current active tenant ID, or undefined if outside a tenant boundary.
+ */
+export function getTenantId() {
+    return tenantContextStorage.getStore()?.tenantId;
+}
+/**
+ * Get the current active tenant ID, throwing `MissingTenantContextException` if not present.
+ *
+ * @param modelName - Optional model name for descriptive error reporting.
+ */
+export function requireTenantId(modelName) {
+    const context = getTenantContext();
+    if (!context?.tenantId) {
+        throw new MissingTenantContextException(modelName);
+    }
+    return context.tenantId;
+}
+//# sourceMappingURL=context.js.map

package/dist/rls/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/rls/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAsB,MAAM,YAAY,CAAC;AAE/E;;GAEG;AACH,MAAM,oBAAoB,GAAG,IAAI,iBAAiB,EAAuC,CAAC;AAE1F;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAkC,EAClC,EAA4B;IAE5B,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAI,EAA4B;IAC3D,OAAO,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,oBAAoB,CAAC,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,oBAAoB,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,SAAkB;IAChD,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC"}

package/dist/rls/extension.d.ts

@@ -0,0 +1,7 @@
+import { type RLSExtensionOptions, type RLSTransactionClient, type RLSTransactionOptions, type TenantContext } from './types.js';
+/** Prisma extension for transaction-scoped PostgreSQL RLS. Apply this extension last. */
+export declare function createRLSExtension(options?: RLSExtensionOptions): (client: any) => import("@prisma/client/extension").PrismaClientExtends<import("@prisma/client/runtime/client").InternalArgs<{}, {}, {}, {
+    $transaction<TClient, TResult>(this: TClient, fn: (tx: RLSTransactionClient<TClient>) => Promise<TResult>, transactionOptions?: RLSTransactionOptions): Promise<TResult>;
+    $withTenant<TClient, TResult>(this: TClient, context: TenantContext, fn: (tx: RLSTransactionClient<TClient>) => Promise<TResult>, transactionOptions?: RLSTransactionOptions): Promise<TResult>;
+}> & import("@prisma/client/runtime/client").DefaultArgs>;
+//# sourceMappingURL=extension.d.ts.map

package/dist/rls/extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../../src/rls/extension.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAQpB,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB;iBA6E/C,OAAO,EAAE,OAAO,QACrB,OAAO,MACT,CAAC,EAAE,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,uBACtC,qBAAqB;gBAIhC,OAAO,EAAE,OAAO,QACpB,OAAO,WACJ,aAAa,MAClB,CAAC,EAAE,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,uBACtC,qBAAqB;0DAqBnD"}

package/dist/rls/extension.js

@@ -0,0 +1,91 @@
+import { Prisma } from '@prisma/client/extension';
+import { validateSessionVariables } from './configuration.js';
+import { getTenantContext, runWithTenant } from './context.js';
+import { MissingTenantContextException, RLSConfigurationException, } from './types.js';
+/** Prisma extension for transaction-scoped PostgreSQL RLS. Apply this extension last. */
+export function createRLSExtension(options = {}) {
+    const { sessionVariable = 'app.current_tenant_id', bypassVariable, models, missingContextBehavior = 'throw', } = options;
+    validateSessionVariables(sessionVariable, bypassVariable);
+    function resolveContext(model) {
+        const context = getTenantContext();
+        if (context?.bypass && !bypassVariable) {
+            throw new RLSConfigurationException('This RLS extension does not allow bypass.');
+        }
+        if (context?.tenantId || context?.bypass)
+            return context;
+        if (missingContextBehavior === 'throw' &&
+            (!models || (model !== undefined && models.includes(model)))) {
+            throw new MissingTenantContextException(model);
+        }
+        return undefined;
+    }
+    return Prisma.defineExtension((base) => {
+        function sessionConfig(context) {
+            const tenantId = context.tenantId ?? '';
+            // Set or clear both settings each time; values remain parameterized.
+            return bypassVariable
+                ? [
+                    'SELECT set_config($1, $2, true), set_config($3, $4, true)',
+                    sessionVariable,
+                    tenantId,
+                    bypassVariable,
+                    context.bypass ? 'true' : '',
+                ]
+                : ['SELECT set_config($1, $2, true)', sessionVariable, tenantId];
+        }
+        async function transact(fn, transactionOptions) {
+            if (typeof fn !== 'function') {
+                throw new RLSConfigurationException('Use the callback form of $transaction for RLS.');
+            }
+            const context = resolveContext();
+            if (!context)
+                throw new MissingTenantContextException();
+            // A separate extension keeps Prisma's query callback on the transaction client.
+            // No private Prisma transaction fields or global client redirection are needed.
+            const transactional = base.$extends({
+                name: 'glasswork-rls-transaction',
+                query: {
+                    async $allOperations({ model, args, query }) {
+                        const active = resolveContext(model);
+                        if (active?.tenantId !== context.tenantId || active?.bypass !== context.bypass) {
+                            throw new RLSConfigurationException('The RLS context cannot change within a transaction.');
+                        }
+                        return query(args);
+                    },
+                },
+            });
+            return transactional.$transaction(async (tx) => {
+                await tx.$executeRawUnsafe(...sessionConfig(context));
+                // Prisma preserves the model delegates and previously applied extensions.
+                return fn(tx);
+            }, transactionOptions);
+        }
+        return base.$extends({
+            name: 'glasswork-rls',
+            client: {
+                $transaction(fn, transactionOptions) {
+                    return transact(fn, transactionOptions);
+                },
+                $withTenant(context, fn, transactionOptions) {
+                    return runWithTenant(context, () => transact(fn, transactionOptions));
+                },
+            },
+            query: {
+                async $allOperations({ model, args, query }) {
+                    const context = resolveContext(model);
+                    if (!context)
+                        return query(args);
+                    // A batch binds the original PrismaPromise to the same connection.
+                    // Global models can also load tenant relations: scope every query.
+                    const operation = query(args);
+                    const [, result] = await base.$transaction([
+                        base.$executeRawUnsafe(...sessionConfig(context)),
+                        operation,
+                    ]);
+                    return result;
+                },
+            },
+        });
+    });
+}
+//# sourceMappingURL=extension.js.map

package/dist/rls/extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../../src/rls/extension.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAK1B,MAAM,YAAY,CAAC;AAQpB,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,OAAO,GAAwB,EAAE;IAClE,MAAM,EACJ,eAAe,GAAG,uBAAuB,EACzC,cAAc,EACd,MAAM,EACN,sBAAsB,GAAG,OAAO,GACjC,GAAG,OAAO,CAAC;IAEZ,wBAAwB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IAE1D,SAAS,cAAc,CAAC,KAAc;QACpC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,IAAI,OAAO,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,MAAM,IAAI,yBAAyB,CAAC,2CAA2C,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,IAAI,OAAO,EAAE,MAAM;YAAE,OAAO,OAAO,CAAC;QACzD,IACE,sBAAsB,KAAK,OAAO;YAClC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAC5D,CAAC;YACD,MAAM,IAAI,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE;QACrC,SAAS,aAAa,CAAC,OAAgC;YACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;YACxC,qEAAqE;YACrE,OAAO,cAAc;gBACnB,CAAC,CAAC;oBACE,2DAA2D;oBAC3D,eAAe;oBACf,QAAQ;oBACR,cAAc;oBACd,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;iBAC7B;gBACH,CAAC,CAAC,CAAC,iCAAiC,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;QACrE,CAAC;QAED,KAAK,UAAU,QAAQ,CACrB,EAA2D,EAC3D,kBAA0C;YAE1C,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;gBAC7B,MAAM,IAAI,yBAAyB,CAAC,gDAAgD,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAExD,gFAAgF;YAChF,gFAAgF;YAChF,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAClC,IAAI,EAAE,2BAA2B;gBACjC,KAAK,EAAE;oBACL,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;wBACzC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;wBACrC,IAAI,MAAM,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;4BAC/E,MAAM,IAAI,yBAAyB,CACjC,qDAAqD,CACtD,CAAC;wBACJ,CAAC;wBACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrB,CAAC;iBACF;aACF,CAAC,CAAC;YAEH,OAAO,aAAa,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC7C,MAAO,EAA8B,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnF,0EAA0E;gBAC1E,OAAO,EAAE,CAAC,EAA8C,CAAC,CAAC;YAC5D,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;YACnB,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE;gBACN,YAAY,CAEV,EAA2D,EAC3D,kBAA0C;oBAE1C,OAAO,QAAQ,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBAC1C,CAAC;gBACD,WAAW,CAET,OAAsB,EACtB,EAA2D,EAC3D,kBAA0C;oBAE1C,OAAO,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBACxE,CAAC;aACF;YACD,KAAK,EAAE;gBACL,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;oBACzC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;oBACtC,IAAI,CAAC,OAAO;wBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;oBACjC,mEAAmE;oBACnE,mEAAmE;oBACnE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAkC,CAAC;oBAC/D,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;wBACxC,IAAkC,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;wBAChF,SAAS;qBACV,CAAC,CAAC;oBACH,OAAO,MAAM,CAAC;gBAChB,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/rls/generator.d.ts

@@ -0,0 +1,17 @@
+import type { GenerateRLSPoliciesOptions } from './types.js';
+/**
+ * Generate PostgreSQL Row Level Security DDL statements for a list of tables.
+ *
+ * @param options - Configuration options for policy generation.
+ * @returns Formatted SQL migration string containing DDL statements.
+ *
+ * @example
+ * ```typescript
+ * const sql = generateRLSPolicies({
+ *   models: ['Poll', 'MemberProfile'],
+ *   tenantField: 'tenantId',
+ * });
+ * ```
+ */
+export declare function generateRLSPolicies(options: GenerateRLSPoliciesOptions): string;
+//# sourceMappingURL=generator.d.ts.map

package/dist/rls/generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/rls/generator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAY7D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CA0C/E"}

package/dist/rls/generator.js

@@ -0,0 +1,47 @@
+import { validateSessionVariables } from './configuration.js';
+/**
+ * Escape a PostgreSQL identifier (table name or column name) by wrapping in double quotes.
+ */
+function quoteIdentifier(identifier) {
+    if (!identifier.trim()) {
+        throw new Error('Identifier cannot be empty');
+    }
+    return `"${identifier.replaceAll('"', '""')}"`;
+}
+/**
+ * Generate PostgreSQL Row Level Security DDL statements for a list of tables.
+ *
+ * @param options - Configuration options for policy generation.
+ * @returns Formatted SQL migration string containing DDL statements.
+ *
+ * @example
+ * ```typescript
+ * const sql = generateRLSPolicies({
+ *   models: ['Poll', 'MemberProfile'],
+ *   tenantField: 'tenantId',
+ * });
+ * ```
+ */
+export function generateRLSPolicies(options) {
+    const { models, tenantField = 'tenantId', sessionVariable = 'app.current_tenant_id', bypassVariable, forceRLS = true, } = options;
+    if (!models || models.length === 0) {
+        return '';
+    }
+    const quotedTenantField = quoteIdentifier(tenantField);
+    validateSessionVariables(sessionVariable, bypassVariable);
+    const policyStatements = models.map((model) => {
+        const quotedTable = quoteIdentifier(model);
+        const policyName = quoteIdentifier(`tenant_isolation_${model}`);
+        const condition = bypassVariable
+            ? `current_setting('${bypassVariable}', true) = 'true' OR ${quotedTenantField} = NULLIF(current_setting('${sessionVariable}', true), '')`
+            : `${quotedTenantField} = NULLIF(current_setting('${sessionVariable}', true), '')`;
+        const lines = [`ALTER TABLE ${quotedTable} ENABLE ROW LEVEL SECURITY;`];
+        if (forceRLS) {
+            lines.push(`ALTER TABLE ${quotedTable} FORCE ROW LEVEL SECURITY;`);
+        }
+        lines.push(`DROP POLICY IF EXISTS ${policyName} ON ${quotedTable};`, `CREATE POLICY ${policyName} ON ${quotedTable}`, '  FOR ALL', `  USING (${condition})`, `  WITH CHECK (${condition});`);
+        return lines.join('\n');
+    });
+    return policyStatements.join('\n\n');
+}
+//# sourceMappingURL=generator.js.map

package/dist/rls/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/rls/generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAG9D;;GAEG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,MAAM,EACJ,MAAM,EACN,WAAW,GAAG,UAAU,EACxB,eAAe,GAAG,uBAAuB,EACzC,cAAc,EACd,QAAQ,GAAG,IAAI,GAChB,GAAG,OAAO,CAAC;IAEZ,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,iBAAiB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IACvD,wBAAwB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IAE1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,eAAe,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;QAEhE,MAAM,SAAS,GAAG,cAAc;YAC9B,CAAC,CAAC,oBAAoB,cAAc,wBAAwB,iBAAiB,8BAA8B,eAAe,eAAe;YACzI,CAAC,CAAC,GAAG,iBAAiB,8BAA8B,eAAe,eAAe,CAAC;QAErF,MAAM,KAAK,GAAa,CAAC,eAAe,WAAW,6BAA6B,CAAC,CAAC;QAElF,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,eAAe,WAAW,4BAA4B,CAAC,CAAC;QACrE,CAAC;QAED,KAAK,CAAC,IAAI,CACR,yBAAyB,UAAU,OAAO,WAAW,GAAG,EACxD,iBAAiB,UAAU,OAAO,WAAW,EAAE,EAC/C,WAAW,EACX,YAAY,SAAS,GAAG,EACxB,iBAAiB,SAAS,IAAI,CAC/B,CAAC;QAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC"}

package/dist/rls/index.d.ts

@@ -0,0 +1,7 @@
+export { getTenantContext, getTenantId, requireTenantId, runWithBypass, runWithTenant, } from './context.js';
+export { createRLSExtension } from './extension.js';
+export { generateRLSPolicies } from './generator.js';
+export { createRLSMiddleware } from './middleware.js';
+export { withBypass, withTenant } from './testing.js';
+export { type GenerateRLSPoliciesOptions, MissingTenantContextException, RLSConfigurationException, type RLSExtensionOptions, type RLSMiddlewareOptions, type RLSTransactionClient, type RLSTransactionOptions, type TenantContext, type TenantContextExtractor, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/rls/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rls/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,aAAa,EACb,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EACL,KAAK,0BAA0B,EAC/B,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,sBAAsB,GAC5B,MAAM,YAAY,CAAC"}

package/dist/rls/index.js

@@ -0,0 +1,7 @@
+export { getTenantContext, getTenantId, requireTenantId, runWithBypass, runWithTenant, } from './context.js';
+export { createRLSExtension } from './extension.js';
+export { generateRLSPolicies } from './generator.js';
+export { createRLSMiddleware } from './middleware.js';
+export { withBypass, withTenant } from './testing.js';
+export { MissingTenantContextException, RLSConfigurationException, } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/rls/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rls/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,aAAa,EACb,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAEL,6BAA6B,EAC7B,yBAAyB,GAO1B,MAAM,YAAY,CAAC"}