okengine 0.15.2 → 0.17.0

package/src/elements/store/sql-session.ts

@@ -34,6 +34,15 @@ import {
 
 export type { WhereMap } from "./sql-condition.ts";
 
+/**
+ * Inferred select-row shape for a table handle.
+ *
+ * Uses `$inferSelect` when present (OKE `store.schema.table()` and Drizzle
+ * `pgTable()` / `sqliteTable()`). Bare {@link TableHandle} / `unknown` stay
+ * {@link SqlRow}.
+ */
+export type InferSelectRow<T> = T extends { readonly $inferSelect: infer R } ? R : SqlRow;
+
 /** Serialize stamp frames on a shared connection so concurrent identities cannot interleave. */
 const rlsStampTails = new WeakMap<SqlConnection, Promise<unknown>>();
 
@@ -97,44 +106,44 @@ export interface SqlSessionOptions {
  * Continuations after `.orderBy(...)` — awaitable, optional `.limit` /
  * `.offset`.
  */
-export interface SelectOrderBuilder extends PromiseLike<SqlRow[]> {
+export interface SelectOrderBuilder<TRow = SqlRow> extends PromiseLike<TRow[]> {
   /**
    * Cap the number of returned rows.
    *
    * @param n - Max rows
    */
-  limit(n: number): Promise<SqlRow[]>;
+  limit(n: number): Promise<TRow[]>;
   /**
    * Skip the first `n` rows (`LIMIT … OFFSET …`).
    *
    * @param n - Rows to skip
    */
-  offset(n: number): Promise<SqlRow[]>;
+  offset(n: number): Promise<TRow[]>;
 }
 
 /**
  * Continuations after `.where(...)` on a select — awaitable, optional
  * `.orderBy(...)` / `.limit(...)` / `.offset(...)`.
  */
-export interface SelectWhereBuilder extends PromiseLike<SqlRow[]> {
+export interface SelectWhereBuilder<TRow = SqlRow> extends PromiseLike<TRow[]> {
   /**
    * Order rows with Drizzle `asc()` / `desc()` terms.
    *
    * @param orders - Order terms
    */
-  orderBy(...orders: readonly unknown[]): SelectOrderBuilder;
+  orderBy(...orders: readonly unknown[]): SelectOrderBuilder<TRow>;
   /**
    * Cap the number of returned rows.
    *
    * @param n - Max rows
    */
-  limit(n: number): Promise<SqlRow[]>;
+  limit(n: number): Promise<TRow[]>;
   /**
    * Skip the first `n` rows.
    *
    * @param n - Rows to skip
    */
-  offset(n: number): Promise<SqlRow[]>;
+  offset(n: number): Promise<TRow[]>;
 }
 
 /**
@@ -142,42 +151,49 @@ export interface SelectWhereBuilder extends PromiseLike<SqlRow[]> {
  * `.where(...)` / `.orderBy(...)` / `.limit(...)` / `.offset(...)` in any
  * order.
  */
-export interface SelectFromBuilder extends PromiseLike<SqlRow[]> {
+export interface SelectFromBuilder<TRow = SqlRow> extends PromiseLike<TRow[]> {
   /**
    * Filter with a plain equality map or a Drizzle SQL condition
    * (`eq`, `and`, `or`, `lt`, `like`, …).
    *
    * @param where - Condition
    */
-  where(where: unknown): SelectWhereBuilder;
+  where(where: unknown): SelectWhereBuilder<TRow>;
   /**
    * Order rows with Drizzle `asc()` / `desc()` terms.
    *
    * @param orders - Order terms
    */
-  orderBy(...orders: readonly unknown[]): SelectOrderBuilder;
+  orderBy(...orders: readonly unknown[]): SelectOrderBuilder<TRow>;
   /**
    * Cap the number of returned rows.
    *
    * @param n - Max rows
    */
-  limit(n: number): Promise<SqlRow[]>;
+  limit(n: number): Promise<TRow[]>;
   /**
    * Skip the first `n` rows.
    *
    * @param n - Rows to skip
    */
-  offset(n: number): Promise<SqlRow[]>;
+  offset(n: number): Promise<TRow[]>;
 }
 
-/** Fluent select builder. */
-export interface SelectBuilder {
+/**
+ * Fluent select builder.
+ *
+ * `TLocked` is `undefined` for `select()` (row type inferred from `.from`)
+ * and {@link SqlRow} for `select({ alias: col })` projections.
+ */
+export interface SelectBuilder<TLocked extends SqlRow | undefined = undefined> {
   /**
    * Choose the source table.
    *
    * @param table - Table handle or Drizzle table
    */
-  from(table: TableHandle | unknown): SelectFromBuilder;
+  from<TTable>(
+    table: TTable,
+  ): SelectFromBuilder<TLocked extends undefined ? InferSelectRow<TTable> : TLocked>;
 }
 
 /** Fluent insert builder. */
@@ -244,12 +260,13 @@ export interface SqlStoreHandle {
   /** Underlying driver id. */
   readonly driverId: SqlConnection["driverId"];
   /**
-   * Start a select. Optional column map projects / aliases columns
-   * (`select({ clicks: links.clicks })`).
+   * Start a select. No-arg form infers the row from `.from(table)`.
+   * A column map (`select({ clicks: links.clicks })`) stays {@link SqlRow}.
    *
    * @param columns - Optional `{ alias: drizzleColumn }` map
    */
-  select(columns?: unknown): SelectBuilder;
+  select(): SelectBuilder<undefined>;
+  select(columns: unknown): SelectBuilder<SqlRow>;
   /**
    * Start an insert into `table`.
    *
@@ -600,20 +617,20 @@ export function createSqlStoreHandle(
     };
   }
 
-  const handle: SqlStoreHandle = {
+  const handle = {
     ref,
     routedRole: options.routedRole,
     driverId: connection.driverId,
 
-    select(columns?) {
+    select(columns?: unknown) {
       return {
-        from(table) {
+        from(table: TableHandle | unknown) {
           return selectFrom(table, columns);
         },
       };
     },
 
-    insert(table): InsertBuilder {
+    insert(table: TableHandle | unknown): InsertBuilder {
       const name = resolveTableName(table);
       return {
         values(row) {
@@ -648,7 +665,7 @@ export function createSqlStoreHandle(
       };
     },
 
-    update(table): UpdateBuilder {
+    update(table: TableHandle | unknown): UpdateBuilder {
       const name = resolveTableName(table);
       return {
         set(row) {
@@ -675,7 +692,7 @@ export function createSqlStoreHandle(
       };
     },
 
-    async findById(table, idValue) {
+    async findById(table: TableHandle | unknown, idValue: string) {
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       const pk = resolvePkColumn(table);
@@ -716,7 +733,7 @@ export function createSqlStoreHandle(
       return builder;
     }) as SqlStoreHandle["delete"],
 
-    async exists(table, idOrWhere) {
+    async exists(table: TableHandle | unknown, idOrWhere: string | WhereMap) {
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       const where: WhereMap =
@@ -734,7 +751,12 @@ export function createSqlStoreHandle(
       return rows.length > 0;
     },
 
-    async upsert(table, matchOn, values, upsertOptions) {
+    async upsert(
+      table: TableHandle | unknown,
+      matchOn: WhereMap | unknown,
+      values: SqlRow,
+      upsertOptions?: { readonly onExisting?: "update" },
+    ) {
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       const compiled = compileTableWhere(table, matchOn);
@@ -766,7 +788,7 @@ export function createSqlStoreHandle(
       return { status: "changed" as const };
     },
 
-    async increment(table, idValue, column, by = 1) {
+    async increment(table: TableHandle | unknown, idValue: string, column: string, by = 1) {
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       const pk = resolvePkColumn(table);
@@ -785,7 +807,7 @@ export function createSqlStoreHandle(
       return asNumber(row[sqlCol], sqlCol);
     },
 
-    async raw(sql, params = []) {
+    async raw(sql: string, params: readonly unknown[] = []) {
       const table = tableFromSql(sql);
       // Memory SQL (console-next seed) implements DML on `exec`, not `query`.
       // SELECT / RETURNING still go through `query` so callers get rows.
@@ -797,7 +819,7 @@ export function createSqlStoreHandle(
       return mask(rows, table);
     },
 
-    async count(table, where) {
+    async count(table: TableHandle | unknown, where?: unknown) {
       await ensureFromMeta(table);
       const name = resolveTableName(table);
       let sql = `SELECT COUNT(*) AS "count" FROM ${quoteIdent(name)}`;
@@ -813,7 +835,7 @@ export function createSqlStoreHandle(
       return asNumber(rows[0]?.count ?? rows[0]?.COUNT ?? 0, "count");
     },
 
-    async page(table, options) {
+    async page(table: TableHandle | unknown, options: SqlPageOptions) {
       if (options.after !== undefined && options.before !== undefined) {
         throw new Error("page(): after and before (keyset) cannot combine");
       }
@@ -838,7 +860,7 @@ export function createSqlStoreHandle(
       });
     },
 
-    async ensureTable(table) {
+    async ensureTable(table: TableHandle) {
       const cols = Object.values(table.columns);
       const pk = resolvePkColumn(table);
       const intType =
@@ -863,7 +885,7 @@ export function createSqlStoreHandle(
     },
   };
 
-  return handle;
+  return handle as SqlStoreHandle;
 }
 
 /**

package/src/elements/store.ts

@@ -31,6 +31,8 @@ export {
   schemaPolicyGate,
   schemaPolicyOwner,
   schemaPolicyScope,
+  schemaPolicyTenant,
+  schemaUnscoped,
   isSchemaTableDecl,
   isSchemaColumnDecl,
   isSchemaRelationsDecl,
@@ -47,6 +49,8 @@ export type {
   SchemaColumnInput,
   SchemaTableDecl,
   SchemaTableWithColumns,
+  InferColumnJs,
+  FinalizeColumn,
   SchemaRelationsDecl,
   SchemaPolicyDecl,
   SchemaTableExtra,
@@ -121,6 +125,7 @@ export type {
   SelectFromBuilder,
   SelectWhereBuilder,
   SelectOrderBuilder,
+  InferSelectRow,
   InsertBuilder,
   InsertValuesBuilder,
   SqlSessionOptions,

package/src/elements/vault/builtin-adapter.ts

@@ -204,6 +204,18 @@ export interface BuiltinVaultAdapter extends VaultAdapter {
 /** Numeric column as any supported driver may hand it back. */
 type SqlNumber = number | string | bigint;
 
+/**
+ * First path segment when the contract is stored as `{tenantId}/{name}`.
+ *
+ * @param path - Canonical vault path
+ */
+function tenantIdFromVaultPath(path: string): string | null {
+  const i = path.indexOf("/");
+  if (i <= 0) return null;
+  const id = path.slice(0, i);
+  return id.length > 0 ? id : null;
+}
+
 /** `oke_vault_secrets` row as returned by the driver. */
 interface SecretRow {
   id: string;
@@ -539,8 +551,8 @@ export function createBuiltinVaultAdapter(opts: CreateBuiltinVaultOptions): Buil
       updated_at: Date | string;
     }>(
       `INSERT INTO oke_vault_secrets
-         (path, encrypted_value, iv, auth_tag, version, metadata, algorithm, kek_version, expires_at)
-       VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7, $8, $9)
+         (path, encrypted_value, iv, auth_tag, version, metadata, algorithm, kek_version, expires_at, tenant_id)
+       VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7, $8, $9, $10)
        RETURNING id, created_at, updated_at`,
       [
         path,
@@ -552,6 +564,7 @@ export function createBuiltinVaultAdapter(opts: CreateBuiltinVaultOptions): Buil
         ALGORITHM,
         kekVersion,
         expiresAt ?? null,
+        tenantIdFromVaultPath(path),
       ],
     );
     const row = inserted[0];

package/src/elements/vault/declare.ts

@@ -24,6 +24,11 @@ export interface VaultSecretOptions {
    * in the clear. Defaults to `true` for secrets and `false` for config.
    */
   readonly sensitive?: boolean;
+  /**
+   * Resolve per `fx.tenant.id` at request time (not boot).
+   * Default true when `gate.auth.tenant` is on.
+   */
+  readonly perTenant?: boolean;
 }
 
 /** Declared vault contract handle. */
@@ -38,6 +43,8 @@ export interface VaultSecretDecl {
   readonly dev?: string;
   /** Whether cleartext must never leave the runtime (default by kind). */
   readonly sensitive: boolean;
+  /** Request-time tenant path when true. */
+  readonly perTenant?: boolean;
 }
 
 /**
@@ -82,6 +89,7 @@ function declareSecret(name: string, options: VaultSecretOptions = {}): VaultSec
     ...(options.rotate !== undefined ? { rotate: options.rotate } : {}),
     ...(options.schema !== undefined ? { schema: options.schema } : {}),
     ...(options.dev !== undefined ? { dev: options.dev } : {}),
+    ...(options.perTenant !== undefined ? { perTenant: options.perTenant } : {}),
   };
   secretRegistry.push(decl);
   return decl;

package/src/elements/vault/runtime.ts

@@ -95,6 +95,10 @@ export interface CreateVaultRuntimeOptions {
   readonly allowGaps?: boolean;
   /** Clock for last-read timestamps (tests). */
   readonly now?: () => number;
+  /**
+   * When true, contracts with `perTenant !== false` are not boot-gap fatal.
+   */
+  readonly tenantEnabled?: boolean;
 }
 
 /** Vault runtime surface. */
@@ -244,6 +248,9 @@ export function createVaultRuntime(options: CreateVaultRuntimeOptions = {}): Vau
 
     const gaps: VaultGap[] = [];
     for (const c of contracts.values()) {
+      const perTenant =
+        c.perTenant === true || (options.tenantEnabled === true && c.perTenant !== false);
+      if (perTenant) continue;
       const value = merged.get(c.name);
       if (value === undefined || value.length === 0) {
         gaps.push({

package/src/elements/vault/sql-rls-isolation.test.ts

@@ -0,0 +1,145 @@
+/**
+ * `oke_vault_secrets` tenant RLS — same concurrent-identity proof as
+ * domain tables: two tenants, one shared PGlite connection, row-level
+ * isolation via `oke.tenant()`.
+ *
+ * Policy is installed by production DDL ({@link ensureVaultTables} /
+ * {@link installOkeRlsHelpers}), not by this file.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { connectPglite } from "../../drivers/pglite.ts";
+import { installOkeRlsHelpers } from "../../drivers/pg-rls.ts";
+import type { SqlConnection } from "../../drivers/types.ts";
+import { createSqlStoreHandle, type SqlStoreHandle } from "../store/sql-session.ts";
+import { sqlConnectionAsExec } from "./builtin-adapter.ts";
+import { ensureVaultTables } from "./storage.ts";
+
+const CIPHER = String.raw`'\x00'::bytea`;
+
+const SEED = `
+INSERT INTO oke_vault_secrets (path, encrypted_value, iv, auth_tag, version, tenant_id)
+VALUES
+  ('acme/stripe', ${CIPHER}, ${CIPHER}, ${CIPHER}, 1, 'acme'),
+  ('globex/stripe', ${CIPHER}, ${CIPHER}, ${CIPHER}, 1, 'globex'),
+  ('GLOBAL_KEY', ${CIPHER}, ${CIPHER}, ${CIPHER}, 1, NULL)
+`;
+
+/** File-scoped warmed PGlite. */
+let conn: SqlConnection;
+/** Stamped as tenant acme. */
+let asAcme: SqlStoreHandle;
+/** Stamped as tenant globex. */
+let asGlobex: SqlStoreHandle;
+/** No stamp — table-owner / superuser bypass (ENABLE without FORCE). */
+let asOwner: SqlStoreHandle;
+
+beforeAll(async () => {
+  conn = await connectPglite({ url: "memory://vault-sql-rls-isolation", role: "primary" });
+  await installOkeRlsHelpers((sql) => conn.exec(sql));
+  await ensureVaultTables(sqlConnectionAsExec(conn));
+  await conn.exec(SEED);
+  asAcme = createSqlStoreHandle("sql:app", {
+    connection: conn,
+    classifications: new Map(),
+    routedRole: "primary",
+    domainDdl: "off",
+    rls: { gate: "member", userId: "u1", scopes: ["member"], tenantId: "acme" },
+  });
+  asGlobex = createSqlStoreHandle("sql:app", {
+    connection: conn,
+    classifications: new Map(),
+    routedRole: "primary",
+    domainDdl: "off",
+    rls: { gate: "member", userId: "u1", scopes: ["member"], tenantId: "globex" },
+  });
+  asOwner = createSqlStoreHandle("sql:app", {
+    connection: conn,
+    classifications: new Map(),
+    routedRole: "primary",
+    domainDdl: "off",
+  });
+}, 15_000);
+
+afterAll(async () => {
+  await conn.close();
+});
+
+describe("oke_vault_secrets tenant RLS (pglite)", () => {
+  test("production DDL installed oke_vault_secrets_tenant", async () => {
+    const rows = await conn.query(
+      `SELECT policyname FROM pg_policies
+       WHERE tablename = 'oke_vault_secrets' AND policyname = 'oke_vault_secrets_tenant'`,
+    );
+    expect(rows).toEqual([{ policyname: "oke_vault_secrets_tenant" }]);
+  });
+
+  test("sequential identities see own tenant plus global NULL rows", async () => {
+    const acme = await asAcme.raw(`SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`);
+    const globex = await asGlobex.raw(
+      `SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`,
+    );
+    expect(acme).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "acme/stripe", tenant_id: "acme" },
+    ]);
+    expect(globex).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "globex/stripe", tenant_id: "globex" },
+    ]);
+  });
+
+  test("concurrent identities do not leak across the shared connection", async () => {
+    const [acme, globex, acmeAgain] = await Promise.all([
+      asAcme.raw(`SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`),
+      asGlobex.raw(`SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`),
+      asAcme.raw(`SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`),
+    ]);
+    expect(acme).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "acme/stripe", tenant_id: "acme" },
+    ]);
+    expect(globex).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "globex/stripe", tenant_id: "globex" },
+    ]);
+    expect(acmeAgain).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "acme/stripe", tenant_id: "acme" },
+    ]);
+  });
+
+  test("unstamped owner still sees every ciphertext row", async () => {
+    const rows = await asOwner.raw(`SELECT path, tenant_id FROM oke_vault_secrets ORDER BY path`);
+    expect(rows).toEqual([
+      { path: "GLOBAL_KEY", tenant_id: null },
+      { path: "acme/stripe", tenant_id: "acme" },
+      { path: "globex/stripe", tenant_id: "globex" },
+    ]);
+  });
+});
+
+describe("oke_vault_secrets tenant RLS — tables before helpers", () => {
+  test("helper install attaches the policy after the table exists", async () => {
+    const late = await connectPglite({
+      url: "memory://vault-sql-rls-late-helpers",
+      role: "primary",
+    });
+    try {
+      await ensureVaultTables(sqlConnectionAsExec(late));
+      const before = await late.query(
+        `SELECT COUNT(*)::text AS n FROM pg_policies
+         WHERE tablename = 'oke_vault_secrets' AND policyname = 'oke_vault_secrets_tenant'`,
+      );
+      expect(before[0]?.n).toBe("0");
+      await installOkeRlsHelpers((sql) => late.exec(sql));
+      const after = await late.query(
+        `SELECT COUNT(*)::text AS n FROM pg_policies
+         WHERE tablename = 'oke_vault_secrets' AND policyname = 'oke_vault_secrets_tenant'`,
+      );
+      expect(after[0]?.n).toBe("1");
+    } finally {
+      await late.close();
+    }
+  });
+});

package/src/elements/vault/storage.ts

@@ -14,6 +14,7 @@ import type { AuditAction, AuditEntry, AuditWriter } from "./audit.ts";
 import { VaultError } from "./errors.ts";
 import type { VaultErrorCode } from "./errors.ts";
 import type { VaultActorType } from "./types.ts";
+import { ensureVaultSecretsTenantRls } from "../../drivers/pg-vault-rls.ts";
 
 /**
  * Minimal SQL surface the Vault needs.
@@ -75,6 +76,7 @@ CREATE TABLE IF NOT EXISTS oke_vault_secrets (
   updated_at timestamptz NOT NULL DEFAULT now(),
   expires_at timestamptz,
   deleted_at timestamptz,
+  tenant_id text,
   CONSTRAINT oke_vault_secrets_path_version_key UNIQUE (path, version)
 )`;
 
@@ -168,6 +170,8 @@ const POST_DDL_STATEMENTS: readonly string[] = [
   `ALTER TABLE oke_vault_status ADD COLUMN IF NOT EXISTS rewrap_key_hash text`,
   `ALTER TABLE oke_vault_status ADD COLUMN IF NOT EXISTS rotate_locked_by text`,
   `ALTER TABLE oke_vault_status ADD COLUMN IF NOT EXISTS rotate_lease_expires_at bigint`,
+  `ALTER TABLE oke_vault_secrets ADD COLUMN IF NOT EXISTS tenant_id text`,
+  `CREATE INDEX IF NOT EXISTS oke_vault_secrets_tenant_idx ON oke_vault_secrets (tenant_id)`,
   `CREATE INDEX IF NOT EXISTS oke_vault_audit_seq_idx ON oke_vault_audit (seq)`,
   `CREATE INDEX IF NOT EXISTS oke_vault_audit_created_idx ON oke_vault_audit (created_at, id)`,
   `CREATE INDEX IF NOT EXISTS oke_vault_audit_path_idx ON oke_vault_audit (path)`,
@@ -200,6 +204,11 @@ export async function ensureVaultTables(db: SqlExec): Promise<void> {
       throw new VaultError("BACKEND_ERROR", "vault: failed to ensure vault tables");
     }
   }
+  try {
+    await ensureVaultSecretsTenantRls((sql: string) => db.execute(sql));
+  } catch {
+    throw new VaultError("BACKEND_ERROR", "vault: failed to ensure vault tables");
+  }
 }
 
 /**

package/src/elements/vault/test-helpers.ts

@@ -251,7 +251,8 @@ function isDdl(text: string): boolean {
   return (
     text.startsWith("create table") ||
     text.startsWith("alter table") ||
-    text.startsWith("create index")
+    text.startsWith("create index") ||
+    text.startsWith("do $oke_vault_rls$")
   );
 }
 

package/src/i18n/catalogs/ar.ts

@@ -36,6 +36,22 @@ export const builtinAr = {
       cause: 'التدفق "{flow}" يُصدِر الإشارة "{resource}" بلا مشترك.',
       fix: "أضف on({resource}, …) أو عيّن الإشارة '{'optional: true'}'.",
     },
+    "1014": {
+      cause: 'مؤشر البث "{afterId}" ليس على شريط "{signal}".',
+      fix: "أعد الاتصال بدون Last-Event-ID لإعادة تشغيل الشريط المتبقي.",
+    },
+    "1015": {
+      cause: "هذه العملية تحتاج مستأجراً، ولم يُحدَّد مستأجر لهذا الطلب.",
+      fix: "استدعِ fx.auth.switchTenant(id) أو أرسل مطالبة tid موقّعة أو رأس المستأجر.",
+    },
+    "1016": {
+      cause: 'المتصل ليس عضواً في المستأجر "{tenant}".',
+      fix: "اختر مستأجراً من fx.auth.listTenants() أو أضف المستخدم كعضو.",
+    },
+    "1017": {
+      cause: 'نطاق دور المستأجر "{scope}" ليس نطاقاً تطبيقياً معلناً.',
+      fix: "استخدم اسماً من كتالوج البيان لهذا التطبيق (وليس console:*).",
+    },
     "1101": {
       cause: "جدول النطاق غير موجود — لم تُطبَّق الترحيلات.",
       fix: "شغّل `oke db migrate` على هذه البيئة.",
@@ -62,6 +78,9 @@ export const builtinAr = {
     "Forbidden.ip_denied": "عنوان IP الخاص بك محظور.",
     "Forbidden.ip_not_allowed": "عنوان IP الخاص بك غير مسموح.",
     "Forbidden.policy_denied": "رفضت السياسة هذا الطلب.",
+    "Forbidden.tenant_required": "هذا الطلب يحتاج مستأجراً.",
+    "Forbidden.not_member": "لست عضواً في ذلك المستأجر.",
+    "Forbidden.unknown_scope": "نطاق دور المستأجر هذا ليس نطاقاً تطبيقياً معلناً.",
     "AuthRateLimited.rate_limited": "محاولات مصادقة كثيرة جداً. حاول لاحقاً.",
   },
 } as const;

package/src/i18n/catalogs/en.ts

@@ -36,6 +36,22 @@ export const builtinEn = {
       cause: 'Flow "{flow}" emits signal "{resource}" with no subscriber.',
       fix: "Add on({resource}, …) or mark the signal '{'optional: true'}'.",
     },
+    "1014": {
+      cause: 'Live cursor "{afterId}" is not on the tape for "{signal}".',
+      fix: "Reconnect without Last-Event-ID to replay the remaining tape.",
+    },
+    "1015": {
+      cause: "This operation needs a tenant, but none is resolved for this request.",
+      fix: "Call fx.auth.switchTenant(id), send a signed tid claim, or pass the tenant header.",
+    },
+    "1016": {
+      cause: 'The caller is not a member of tenant "{tenant}".',
+      fix: "Pick a tenant from fx.auth.listTenants() or add the user as a member.",
+    },
+    "1017": {
+      cause: 'Tenant role scope "{scope}" is not a declared application scope.',
+      fix: "Use a name from this app's Manifest catalog (never console:*).",
+    },
     "1101": {
       cause: "domain table not found — migrations have not been applied.",
       fix: "run `oke db migrate` against this environment.",
@@ -63,6 +79,9 @@ export const builtinEn = {
     "Forbidden.ip_denied": "Your IP address is blocked.",
     "Forbidden.ip_not_allowed": "Your IP address is not allowed.",
     "Forbidden.policy_denied": "Policy denied this request.",
+    "Forbidden.tenant_required": "This request needs a tenant.",
+    "Forbidden.not_member": "You are not a member of that tenant.",
+    "Forbidden.unknown_scope": "That tenant role scope is not a declared application scope.",
     "AuthRateLimited.rate_limited": "Too many authentication attempts. Try again later.",
   },
 } as const;

package/src/index.ts

@@ -62,6 +62,7 @@ export {
   type StoreDecl,
   type StoreRuntime,
   type SqlStoreHandle,
+  type InferSelectRow,
   type TableHandle,
   type SchemaTableDecl,
   type SchemaColumnDecl,
@@ -79,6 +80,7 @@ export {
   createSignalRuntime,
   type SignalDecl,
   type SignalOptions,
+  type SignalRetention,
   type SignalRuntime,
   type DeadLetter,
   type SignalFailureReason,