pipework 0.1.0

package/dist/pipeline/execute.js

@@ -0,0 +1,90 @@
+import { sql } from '../db/sql.js';
+import { PipelineStepError } from './errors.js';
+export async function executePipeline(db, config, input, context) {
+    const [runRow] = await db.execute(sql `
+    INSERT INTO pipework_pipeline_runs (pipeline_name, tenant_id, status, current_step, input, metadata)
+    VALUES (${config.name}, ${context.tenant}, 'running', 0, ${JSON.stringify(input)}::jsonb, ${JSON.stringify(context.metadata ?? {})}::jsonb)
+    RETURNING id, started_at
+  `);
+    const runId = String(runRow['id']);
+    const startedAt = new Date(String(runRow['started_at']));
+    for (let i = 0; i < config.steps.length; i++) {
+        const step = config.steps[i];
+        await db.execute(sql `
+      INSERT INTO pipework_pipeline_steps (run_id, step_index, step_name, status)
+      VALUES (${runId}::uuid, ${i}, ${step.name}, 'pending')
+    `);
+    }
+    let lastOutput = input;
+    for (let i = 0; i < config.steps.length; i++) {
+        const step = config.steps[i];
+        if (step.async === true) {
+            await db.execute(sql `
+        UPDATE pipework_pipeline_runs SET status = 'waiting', current_step = ${i}
+        WHERE id = ${runId}::uuid
+      `);
+            return {
+                id: runId,
+                pipelineName: config.name,
+                status: 'waiting',
+                currentStep: i,
+                input,
+                startedAt,
+                completedAt: null,
+                error: null,
+            };
+        }
+        await db.execute(sql `
+      UPDATE pipework_pipeline_steps SET status = 'running', started_at = now()
+      WHERE run_id = ${runId}::uuid AND step_index = ${i}
+    `);
+        try {
+            const stepCtx = {
+                db,
+                input: lastOutput,
+                runId,
+                stepIndex: i,
+                tenant: context.tenant,
+                metadata: context.metadata ?? {},
+            };
+            lastOutput = await step.handler(stepCtx);
+            await db.execute(sql `
+        UPDATE pipework_pipeline_steps SET status = 'completed', output = ${JSON.stringify(lastOutput ?? null)}::jsonb, completed_at = now()
+        WHERE run_id = ${runId}::uuid AND step_index = ${i}
+      `);
+            await db.execute(sql `
+        UPDATE pipework_pipeline_runs SET current_step = ${i + 1}
+        WHERE id = ${runId}::uuid
+      `);
+        }
+        catch (error) {
+            const errorJson = error instanceof Error
+                ? { message: error.message, stack: error.stack }
+                : { message: String(error) };
+            await db.execute(sql `
+        UPDATE pipework_pipeline_steps SET status = 'failed', error = ${JSON.stringify(errorJson)}::jsonb, completed_at = now()
+        WHERE run_id = ${runId}::uuid AND step_index = ${i}
+      `);
+            await db.execute(sql `
+        UPDATE pipework_pipeline_runs SET status = 'failed', error = ${JSON.stringify(errorJson)}::jsonb, completed_at = now()
+        WHERE id = ${runId}::uuid
+      `);
+            throw new PipelineStepError(config.name, step.name, i, error);
+        }
+    }
+    await db.execute(sql `
+    UPDATE pipework_pipeline_runs SET status = 'completed', completed_at = now()
+    WHERE id = ${runId}::uuid
+  `);
+    return {
+        id: runId,
+        pipelineName: config.name,
+        status: 'completed',
+        currentStep: config.steps.length,
+        input,
+        startedAt,
+        completedAt: new Date(),
+        error: null,
+    };
+}
+//# sourceMappingURL=execute.js.map

package/dist/pipeline/execute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../src/pipeline/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAGlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,MAAsB,EACtB,KAAc,EACd,OAA+B;IAE/B,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;cAEzB,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,mBAAmB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;;GAEnI,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAEzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAA;QAE7B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;gBAER,KAAK,WAAW,CAAC,KAAK,IAAI,CAAC,IAAI;KAC1C,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,UAAU,GAAY,KAAK,CAAA;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAA;QAE7B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;+EACqD,CAAC;qBAC3D,KAAK;OACnB,CAAC,CAAA;YAEF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,MAAM,CAAC,IAAI;gBACzB,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,CAAC;gBACd,KAAK;gBACL,SAAS;gBACT,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,IAAI;aACZ,CAAA;QACH,CAAC;QAED,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;uBAED,KAAK,2BAA2B,CAAC;KACnD,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,OAAO,GAAgB;gBAC3B,EAAE;gBACF,KAAK,EAAE,UAAU;gBACjB,KAAK;gBACL,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;aACjC,CAAA;YAED,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAExC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;4EACkD,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC;yBACrF,KAAK,2BAA2B,CAAC;OACnD,CAAC,CAAA;YAEF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;2DACiC,CAAC,GAAG,CAAC;qBAC3C,KAAK;OACnB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,KAAK,YAAY,KAAK;gBACtC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAChD,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;YAE9B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;wEAC8C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;yBACxE,KAAK,2BAA2B,CAAC;OACnD,CAAC,CAAA;YAEF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;uEAC6C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;qBAC3E,KAAK;OACnB,CAAC,CAAA;YAEF,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;iBAEL,KAAK;GACnB,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAChC,KAAK;QACL,SAAS;QACT,WAAW,EAAE,IAAI,IAAI,EAAE;QACvB,KAAK,EAAE,IAAI;KACZ,CAAA;AACH,CAAC"}

package/dist/pipeline/index.d.ts

@@ -0,0 +1,4 @@
+export { definePipeline } from './define.js';
+export { PipelineStepError, PipelineResumeError } from './errors.js';
+export type { PipelineConfig, Pipeline, PipelineRun, PipelineExecuteContext, StepDefinition, StepContext, StepRunResult, PipelineStatus, StepStatus, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/pipeline/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pipeline/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACpE,YAAY,EACV,cAAc,EACd,QAAQ,EACR,WAAW,EACX,sBAAsB,EACtB,cAAc,EACd,WAAW,EACX,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,YAAY,CAAA"}

package/dist/pipeline/index.js

@@ -0,0 +1,3 @@
+export { definePipeline } from './define.js';
+export { PipelineStepError, PipelineResumeError } from './errors.js';
+//# sourceMappingURL=index.js.map

package/dist/pipeline/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pipeline/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA"}

package/dist/pipeline/namespace.d.ts

@@ -0,0 +1,8 @@
+import { definePipeline } from './define.js';
+import { PipelineStepError, PipelineResumeError } from './errors.js';
+export declare const pipeline: {
+    define: typeof definePipeline;
+    PipelineStepError: typeof PipelineStepError;
+    PipelineResumeError: typeof PipelineResumeError;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/pipeline/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/pipeline/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEpE,eAAO,MAAM,QAAQ;;;;CAIpB,CAAA"}

package/dist/pipeline/namespace.js

@@ -0,0 +1,8 @@
+import { definePipeline } from './define.js';
+import { PipelineStepError, PipelineResumeError } from './errors.js';
+export const pipeline = {
+    define: definePipeline,
+    PipelineStepError,
+    PipelineResumeError,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/pipeline/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/pipeline/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEpE,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,MAAM,EAAE,cAAc;IACtB,iBAAiB;IACjB,mBAAmB;CACpB,CAAA"}

package/dist/pipeline/resume.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../db/index.js';
+import type { PipelineConfig, PipelineRun } from './types.js';
+export declare function resumePipeline(db: DB, config: PipelineConfig, runId: string, stepOutput: unknown): Promise<PipelineRun>;
+//# sourceMappingURL=resume.d.ts.map

package/dist/pipeline/resume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume.d.ts","sourceRoot":"","sources":["../../src/pipeline/resume.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAe,MAAM,YAAY,CAAA;AAG1E,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,WAAW,CAAC,CAmHtB"}

package/dist/pipeline/resume.js

@@ -0,0 +1,100 @@
+import { sql } from '../db/sql.js';
+import { PipelineResumeError, PipelineStepError } from './errors.js';
+export async function resumePipeline(db, config, runId, stepOutput) {
+    const [runRow] = await db.execute(sql `
+    UPDATE pipework_pipeline_runs
+    SET status = 'running'
+    WHERE id = ${runId}::uuid AND status = 'waiting'
+    RETURNING id, current_step, input, tenant_id, metadata, started_at
+  `);
+    if (runRow === undefined) {
+        const [existingRow] = await db.execute(sql `
+      SELECT status FROM pipework_pipeline_runs WHERE id = ${runId}::uuid
+    `);
+        if (existingRow === undefined) {
+            throw new PipelineResumeError(runId, 'Pipeline run not found.');
+        }
+        throw new PipelineResumeError(runId, `Expected status "waiting" but found "${String(existingRow['status'])}".`);
+    }
+    const currentStep = Number(runRow['current_step']);
+    const input = runRow['input'];
+    const tenant = String(runRow['tenant_id']);
+    const metadata = runRow['metadata'] ?? {};
+    const startedAt = new Date(String(runRow['started_at']));
+    await db.execute(sql `
+    UPDATE pipework_pipeline_steps SET status = 'completed', output = ${JSON.stringify(stepOutput ?? null)}::jsonb, completed_at = now()
+    WHERE run_id = ${runId}::uuid AND step_index = ${currentStep}
+  `);
+    let lastOutput = stepOutput;
+    for (let i = currentStep + 1; i < config.steps.length; i++) {
+        const step = config.steps[i];
+        if (step.async === true) {
+            await db.execute(sql `
+        UPDATE pipework_pipeline_runs SET status = 'waiting', current_step = ${i}
+        WHERE id = ${runId}::uuid
+      `);
+            return {
+                id: runId,
+                pipelineName: config.name,
+                status: 'waiting',
+                currentStep: i,
+                input,
+                startedAt,
+                completedAt: null,
+                error: null,
+            };
+        }
+        await db.execute(sql `
+      UPDATE pipework_pipeline_steps SET status = 'running', started_at = now()
+      WHERE run_id = ${runId}::uuid AND step_index = ${i}
+    `);
+        try {
+            const stepCtx = {
+                db,
+                input: lastOutput,
+                runId,
+                stepIndex: i,
+                tenant,
+                metadata,
+            };
+            lastOutput = await step.handler(stepCtx);
+            await db.execute(sql `
+        UPDATE pipework_pipeline_steps SET status = 'completed', output = ${JSON.stringify(lastOutput ?? null)}::jsonb, completed_at = now()
+        WHERE run_id = ${runId}::uuid AND step_index = ${i}
+      `);
+            await db.execute(sql `
+        UPDATE pipework_pipeline_runs SET current_step = ${i + 1}
+        WHERE id = ${runId}::uuid
+      `);
+        }
+        catch (error) {
+            const errorJson = error instanceof Error
+                ? { message: error.message, stack: error.stack }
+                : { message: String(error) };
+            await db.execute(sql `
+        UPDATE pipework_pipeline_steps SET status = 'failed', error = ${JSON.stringify(errorJson)}::jsonb, completed_at = now()
+        WHERE run_id = ${runId}::uuid AND step_index = ${i}
+      `);
+            await db.execute(sql `
+        UPDATE pipework_pipeline_runs SET status = 'failed', error = ${JSON.stringify(errorJson)}::jsonb, completed_at = now()
+        WHERE id = ${runId}::uuid
+      `);
+            throw new PipelineStepError(config.name, step.name, i, error);
+        }
+    }
+    await db.execute(sql `
+    UPDATE pipework_pipeline_runs SET status = 'completed', current_step = ${config.steps.length}, completed_at = now()
+    WHERE id = ${runId}::uuid
+  `);
+    return {
+        id: runId,
+        pipelineName: config.name,
+        status: 'completed',
+        currentStep: config.steps.length,
+        input,
+        startedAt,
+        completedAt: new Date(),
+        error: null,
+    };
+}
+//# sourceMappingURL=resume.js.map

package/dist/pipeline/resume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume.js","sourceRoot":"","sources":["../../src/pipeline/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAGlC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEpE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAM,EACN,MAAsB,EACtB,KAAa,EACb,UAAmB;IAEnB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;iBAGtB,KAAK;;GAEnB,CAAC,CAAA;IAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;6DACe,KAAK;KAC7D,CAAC,CAAA;QACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,mBAAmB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,KAAK,EACL,wCAAwC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC1E,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAI,MAAM,CAAC,UAAU,CAAoC,IAAI,EAAE,CAAA;IAC7E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAExD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;wEACkD,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC;qBACrF,KAAK,2BAA2B,WAAW;GAC7D,CAAC,CAAA;IAEF,IAAI,UAAU,GAAY,UAAU,CAAA;IAEpC,KAAK,IAAI,CAAC,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAA;QAE7B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;+EACqD,CAAC;qBAC3D,KAAK;OACnB,CAAC,CAAA;YAEF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,MAAM,CAAC,IAAI;gBACzB,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,CAAC;gBACd,KAAK;gBACL,SAAS;gBACT,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,IAAI;aACZ,CAAA;QACH,CAAC;QAED,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;uBAED,KAAK,2BAA2B,CAAC;KACnD,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,OAAO,GAAgB;gBAC3B,EAAE;gBACF,KAAK,EAAE,UAAU;gBACjB,KAAK;gBACL,SAAS,EAAE,CAAC;gBACZ,MAAM;gBACN,QAAQ;aACT,CAAA;YAED,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAExC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;4EACkD,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC;yBACrF,KAAK,2BAA2B,CAAC;OACnD,CAAC,CAAA;YAEF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;2DACiC,CAAC,GAAG,CAAC;qBAC3C,KAAK;OACnB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,KAAK,YAAY,KAAK;gBACtC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAChD,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;YAE9B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;wEAC8C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;yBACxE,KAAK,2BAA2B,CAAC;OACnD,CAAC,CAAA;YAEF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;uEAC6C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;qBAC3E,KAAK;OACnB,CAAC,CAAA;YAEF,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;6EACuD,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC/E,KAAK;GACnB,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAChC,KAAK;QACL,SAAS;QACT,WAAW,EAAE,IAAI,IAAI,EAAE;QACvB,KAAK,EAAE,IAAI;KACZ,CAAA;AACH,CAAC"}

package/dist/pipeline/types.d.ts

@@ -0,0 +1,50 @@
+import type { DB } from '../db/index.js';
+export interface StepDefinition<TInput = unknown, TOutput = unknown> {
+    readonly name: string;
+    readonly async?: boolean;
+    readonly handler: (ctx: StepContext<TInput>) => Promise<TOutput>;
+}
+export interface StepContext<TInput = unknown> {
+    readonly db: DB;
+    readonly input: TInput;
+    readonly runId: string;
+    readonly stepIndex: number;
+    readonly tenant: string;
+    readonly metadata: Record<string, unknown>;
+}
+export interface PipelineConfig {
+    readonly name: string;
+    readonly database: string;
+    readonly steps: readonly StepDefinition[];
+}
+export type PipelineStatus = 'running' | 'waiting' | 'completed' | 'failed';
+export type StepStatus = 'pending' | 'running' | 'completed' | 'failed';
+export interface PipelineRun {
+    readonly id: string;
+    readonly pipelineName: string;
+    readonly status: PipelineStatus;
+    readonly currentStep: number;
+    readonly input: unknown;
+    readonly startedAt: Date;
+    readonly completedAt: Date | null;
+    readonly error: unknown | null;
+}
+export interface StepRunResult {
+    readonly stepName: string;
+    readonly status: StepStatus;
+    readonly output: unknown | null;
+    readonly startedAt: Date | null;
+    readonly completedAt: Date | null;
+    readonly error: unknown | null;
+}
+export interface PipelineExecuteContext {
+    readonly tenant: string;
+    readonly metadata?: Record<string, unknown>;
+}
+export interface Pipeline {
+    execute(db: DB, input: unknown, context: PipelineExecuteContext): Promise<PipelineRun>;
+    resume(db: DB, runId: string, stepOutput: unknown): Promise<PipelineRun>;
+    getStatus(db: DB, runId: string): Promise<PipelineRun | null>;
+    readonly definition: PipelineConfig;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/pipeline/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/pipeline/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAExC,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,WAAW,CAAC,MAAM,GAAG,OAAO;IAC3C,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAA;IACf,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC3C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;CAC1C;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;AAC3E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;AAEvE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC5C;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACtF,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACxE,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAC7D,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;CACpC"}

package/dist/pipeline/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/pipeline/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/pipeline/types.ts"],"names":[],"mappings":""}

package/dist/pipework.d.ts

@@ -0,0 +1,35 @@
+import type { ResolvedConfig } from './config/load.js';
+import type { ResolvedDatabase } from './config/load.js';
+import type { Blueprint } from './config/schema.js';
+import type { ManagedConnection } from './db/pool.js';
+export interface Manifold {
+    readonly config: ResolvedConfig;
+    readonly pool: PoolState;
+    readonly isolation: IsolationState;
+    readonly connections: ConnectionTracker;
+}
+export interface PoolState {
+    getOrCreate(config: ResolvedDatabase): ManagedConnection;
+    get(name: string): ManagedConnection | undefined;
+    closeAll(): Promise<void>;
+    count(): number;
+}
+export interface IsolationState {
+    markBegin(): void;
+    markEnd(): void;
+    assertClean(): void;
+    stats(): {
+        active: number;
+        totalBegins: number;
+        totalEnds: number;
+    };
+    reset(): void;
+}
+export interface ConnectionTracker {
+    track(id: string, name: string, context: string): void;
+    release(id: string): void;
+    activeCount(): number;
+    assertNoLeaks(maxExpected: number): void;
+}
+export declare function createPipework(raw: Blueprint): Manifold;
+//# sourceMappingURL=pipework.d.ts.map

package/dist/pipework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipework.d.ts","sourceRoot":"","sources":["../src/pipework.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAIrD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;CACxC;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,iBAAiB,CAAA;IACxD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAA;IAChD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,KAAK,IAAI,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,IAAI,IAAI,CAAA;IACjB,OAAO,IAAI,IAAI,CAAA;IACf,WAAW,IAAI,IAAI,CAAA;IACnB,KAAK,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IACnE,KAAK,IAAI,IAAI,CAAA;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,IAAI,MAAM,CAAA;IACrB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,GAAG,QAAQ,CAOvD"}

package/dist/pipework.js

@@ -0,0 +1,102 @@
+import { loadConfig as parseConfig } from './config/load.js';
+import { createManagedConnection } from './db/pool.js';
+import { InvariantViolation } from './invariants/assert.js';
+export function createPipework(raw) {
+    const config = parseConfig(raw);
+    const pool = createPoolState();
+    const isolation = createIsolationState();
+    const connections = createConnectionTracker();
+    return { config, pool, isolation, connections };
+}
+function createPoolState() {
+    const map = new Map();
+    return {
+        getOrCreate(config) {
+            const existing = map.get(config.name);
+            if (existing)
+                return existing;
+            const managed = createManagedConnection(config, () => map.delete(config.name));
+            map.set(config.name, managed);
+            return managed;
+        },
+        get(name) {
+            return map.get(name);
+        },
+        async closeAll() {
+            const closing = [...map.values()].map(c => c.close());
+            await Promise.all(closing);
+        },
+        count() {
+            return map.size;
+        },
+    };
+}
+function createIsolationState() {
+    let active = 0;
+    let totalBegins = 0;
+    let totalEnds = 0;
+    return {
+        markBegin() {
+            active++;
+            totalBegins++;
+        },
+        markEnd() {
+            if (active <= 0) {
+                throw new InvariantViolation('isolation-end-without-begin', {
+                    activeIsolationContexts: active,
+                    totalBegins,
+                    totalEnds,
+                });
+            }
+            active--;
+            totalEnds++;
+        },
+        assertClean() {
+            if (active !== 0) {
+                throw new InvariantViolation('isolation-context-leak', {
+                    activeIsolationContexts: active,
+                    totalBegins,
+                    totalEnds,
+                    delta: totalBegins - totalEnds,
+                });
+            }
+        },
+        stats() {
+            return { active, totalBegins, totalEnds };
+        },
+        reset() {
+            active = 0;
+            totalBegins = 0;
+            totalEnds = 0;
+        },
+    };
+}
+function createConnectionTracker() {
+    const tracked = new Map();
+    return {
+        track(id, name, context) {
+            tracked.set(id, { name, createdAt: Date.now(), context });
+        },
+        release(id) {
+            tracked.delete(id);
+        },
+        activeCount() {
+            return tracked.size;
+        },
+        assertNoLeaks(maxExpected) {
+            if (tracked.size > maxExpected) {
+                throw new InvariantViolation('connection-pool-bounded', {
+                    active: tracked.size,
+                    maxExpected,
+                    connections: [...tracked.entries()].map(([id, c]) => ({
+                        id,
+                        name: c.name,
+                        age_ms: Date.now() - c.createdAt,
+                        context: c.context,
+                    })),
+                });
+            }
+        },
+    };
+}
+//# sourceMappingURL=pipework.js.map

package/dist/pipework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipework.js","sourceRoot":"","sources":["../src/pipework.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAG5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AA+B3D,MAAM,UAAU,cAAc,CAAC,GAAc;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAA;IAC9B,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAA;IACxC,MAAM,WAAW,GAAG,uBAAuB,EAAE,CAAA;IAE7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;AACjD,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAA;IAEhD,OAAO;QACL,WAAW,CAAC,MAAwB;YAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACrC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAE7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9E,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YAC7B,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,GAAG,CAAC,IAAY;YACd,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;QAED,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;YACrD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC5B,CAAC;QAED,KAAK;YACH,OAAO,GAAG,CAAC,IAAI,CAAA;QACjB,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,OAAO;QACL,SAAS;YACP,MAAM,EAAE,CAAA;YACR,WAAW,EAAE,CAAA;QACf,CAAC;QAED,OAAO;YACL,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,EAAE;oBAC1D,uBAAuB,EAAE,MAAM;oBAC/B,WAAW;oBACX,SAAS;iBACV,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,EAAE,CAAA;YACR,SAAS,EAAE,CAAA;QACb,CAAC;QAED,WAAW;YACT,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE;oBACrD,uBAAuB,EAAE,MAAM;oBAC/B,WAAW;oBACX,SAAS;oBACT,KAAK,EAAE,WAAW,GAAG,SAAS;iBAC/B,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,KAAK;YACH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAA;QAC3C,CAAC;QAED,KAAK;YACH,MAAM,GAAG,CAAC,CAAA;YACV,WAAW,GAAG,CAAC,CAAA;YACf,SAAS,GAAG,CAAC,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgE,CAAA;IAEvF,OAAO;QACL,KAAK,CAAC,EAAU,EAAE,IAAY,EAAE,OAAe;YAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,OAAO,CAAC,EAAU;YAChB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpB,CAAC;QAED,WAAW;YACT,OAAO,OAAO,CAAC,IAAI,CAAA;QACrB,CAAC;QAED,aAAa,CAAC,WAAmB;YAC/B,IAAI,OAAO,CAAC,IAAI,GAAG,WAAW,EAAE,CAAC;gBAC/B,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,EAAE;oBACtD,MAAM,EAAE,OAAO,CAAC,IAAI;oBACpB,WAAW;oBACX,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACpD,EAAE;wBACF,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS;wBAChC,OAAO,EAAE,CAAC,CAAC,OAAO;qBACnB,CAAC,CAAC;iBACJ,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/rbac/cache.d.ts

@@ -0,0 +1,13 @@
+import type { PermissionSet } from './types.js';
+export declare class PermissionCache {
+    private readonly store;
+    private readonly ttlMs;
+    constructor(ttlMs: number);
+    get(userId: string, tenantId: string, authVersion: number): PermissionSet | null;
+    set(permissionSet: PermissionSet): void;
+    invalidate(userId: string, tenantId: string): void;
+    clear(): void;
+    get size(): number;
+    private key;
+}
+//# sourceMappingURL=cache.d.ts.map

package/dist/rbac/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/rbac/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO/C,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;gBAElB,KAAK,EAAE,MAAM;IAIzB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAWhF,GAAG,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI;IAQvC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IASlD,KAAK,IAAI,IAAI;IAIb,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,GAAG;CAGZ"}

package/dist/rbac/cache.js

@@ -0,0 +1,43 @@
+export class PermissionCache {
+    store = new Map();
+    ttlMs;
+    constructor(ttlMs) {
+        this.ttlMs = ttlMs;
+    }
+    get(userId, tenantId, authVersion) {
+        const key = this.key(userId, tenantId, authVersion);
+        const entry = this.store.get(key);
+        if (!entry)
+            return null;
+        if (Date.now() > entry.expiresAt) {
+            this.store.delete(key);
+            return null;
+        }
+        return entry.set;
+    }
+    set(permissionSet) {
+        const key = this.key(permissionSet.userId, permissionSet.tenantId, permissionSet.authVersion);
+        this.store.set(key, {
+            set: permissionSet,
+            expiresAt: Date.now() + this.ttlMs,
+        });
+    }
+    invalidate(userId, tenantId) {
+        const prefix = `${userId}:${tenantId}:`;
+        for (const key of this.store.keys()) {
+            if (key.startsWith(prefix)) {
+                this.store.delete(key);
+            }
+        }
+    }
+    clear() {
+        this.store.clear();
+    }
+    get size() {
+        return this.store.size;
+    }
+    key(userId, tenantId, authVersion) {
+        return `${userId}:${tenantId}:${authVersion}`;
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/rbac/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/rbac/cache.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,eAAe;IACT,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;IACrC,KAAK,CAAQ;IAE9B,YAAY,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,WAAmB;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,CAAA;IAClB,CAAC;IAED,GAAG,CAAC,aAA4B;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;QAC7F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,GAAG,EAAE,aAAa;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;SACnC,CAAC,CAAA;IACJ,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,QAAgB;QACzC,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,QAAQ,GAAG,CAAA;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAA;IACxB,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,WAAmB;QAC/D,OAAO,GAAG,MAAM,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAA;IAC/C,CAAC;CACF"}

package/dist/rbac/check.d.ts

@@ -0,0 +1,4 @@
+import type { ResolvedPermission } from './types.js';
+export declare function scopeSatisfies(granted: string, required: string, hierarchy?: readonly string[]): boolean;
+export declare function hasPermission(permissions: readonly ResolvedPermission[], resource: string, action: string, requiredScope?: string, hierarchy?: readonly string[]): boolean;
+//# sourceMappingURL=check.d.ts.map

package/dist/rbac/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/rbac/check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAIpD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,SAAS,MAAM,EAAsB,GAC/C,OAAO,CAKT;AAED,wBAAgB,aAAa,CAC3B,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,SAAS,GAAE,SAAS,MAAM,EAAsB,GAC/C,OAAO,CAQT"}

package/dist/rbac/check.js

@@ -0,0 +1,20 @@
+const DEFAULT_HIERARCHY = ['own', 'team', 'territory', 'tenant'];
+export function scopeSatisfies(granted, required, hierarchy = DEFAULT_HIERARCHY) {
+    const grantedIdx = hierarchy.indexOf(granted);
+    const requiredIdx = hierarchy.indexOf(required);
+    if (grantedIdx === -1 || requiredIdx === -1)
+        return false;
+    return grantedIdx >= requiredIdx;
+}
+export function hasPermission(permissions, resource, action, requiredScope, hierarchy = DEFAULT_HIERARCHY) {
+    for (const perm of permissions) {
+        if (perm.resource === resource && perm.action === action) {
+            if (requiredScope === undefined)
+                return true;
+            if (scopeSatisfies(perm.scope, requiredScope, hierarchy))
+                return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=check.js.map

package/dist/rbac/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/rbac/check.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;AAEnF,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,QAAgB,EAChB,YAA+B,iBAAiB;IAEhD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACzD,OAAO,UAAU,IAAI,WAAW,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,WAA0C,EAC1C,QAAgB,EAChB,MAAc,EACd,aAAsB,EACtB,YAA+B,iBAAiB;IAEhD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACzD,IAAI,aAAa,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;QACvE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/rbac/index.d.ts

@@ -0,0 +1,7 @@
+import type { RbacConfig, Rbac } from './types.js';
+export type { RbacConfig, Rbac, PermissionSet, ResolvedPermission, Scope, SeedData, SeedPermission, SeedRole, SeedRolePermission, SeedUserRole } from './types.js';
+export { hasPermission, scopeSatisfies } from './check.js';
+export { PermissionCache } from './cache.js';
+export { enforcePermission } from './middleware.js';
+export declare function createRbac(config: RbacConfig): Rbac;
+//# sourceMappingURL=index.d.ts.map

package/dist/rbac/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAA2B,MAAM,YAAY,CAAA;AAM3E,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAClK,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CA0BnD"}

package/dist/rbac/index.js

@@ -0,0 +1,31 @@
+import { PermissionCache } from './cache.js';
+import { resolveUserPermissions } from './resolve.js';
+import { hasPermission } from './check.js';
+import { seedRbac } from './seed.js';
+export { hasPermission, scopeSatisfies } from './check.js';
+export { PermissionCache } from './cache.js';
+export { enforcePermission } from './middleware.js';
+export function createRbac(config) {
+    const cache = new PermissionCache(config.cacheTtlMs ?? 60_000);
+    const scopes = config.scopes ?? ['own', 'team', 'territory', 'tenant'];
+    return {
+        async resolve(db, userId, tenantId, authVersion) {
+            const cached = cache.get(userId, tenantId, authVersion);
+            if (cached)
+                return cached;
+            const resolved = await resolveUserPermissions(db, userId, tenantId, authVersion, config);
+            cache.set(resolved);
+            return resolved;
+        },
+        check(permissions, resource, action, requiredScope) {
+            return hasPermission(permissions.permissions, resource, action, requiredScope, scopes);
+        },
+        invalidate(userId, tenantId) {
+            cache.invalidate(userId, tenantId);
+        },
+        async seed(db, data) {
+            await seedRbac(db, data, config);
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/rbac/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAGpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IAEtE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,MAAc,EAAE,QAAgB,EAAE,WAAmB;YACzE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;YACvD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;YACxF,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACnB,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,WAA0B,EAAE,QAAgB,EAAE,MAAc,EAAE,aAAsB;YACxF,OAAO,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;QACxF,CAAC;QAED,UAAU,CAAC,MAAc,EAAE,QAAgB;YACzC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACpC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,IAAc;YAC/B,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/rbac/middleware.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../db/index.js';
+import type { Rbac } from './types.js';
+export declare function enforcePermission(rbac: Rbac, db: DB, userId: string, tenantId: string, authVersion: number, resource: string, action: string, requiredScope?: string): Promise<void>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/rbac/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/rbac/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAMf"}