pipework 0.189.0 → 0.191.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.191.0
+
+- **Added: `$with` on a tenant-scoped connection** (#748). `db.$with('m').materialized().as(db.select(…).from(tenantTable))` followed by `db.with(m).select().from(m)` returns only the context tenant's rows, the same as an inline subquery.
+  - A CTE body must be built by the same scoped connection. The callback form `(qb) => …` gets a scoped query builder.
+  - A raw `sql` body, or a builder from `pipe.system()` or another connection, is refused with a message saying why.
+  - `db.with(…)` accepts only this connection's CTEs and scopes what follows it.
+- **Fixed: the tenant-scoped connection let other tenants' rows through on several paths** (#748). Postgres row-level security still applied wherever it was configured, but pipework's own tenant filter was missing on these:
+  - A scoped select used as a subquery, through `inArray(…)`, `.as()`, `getSQL()` or `toSQL()`, had no tenant filter. The filter used to be added only when the query was awaited. It is now in the SQL as soon as the table is named.
+  - A joined tenant table (inner, left, right, full or cross) wasn't filtered. Its condition now goes in the join's ON clause, so a left join keeps its unmatched rows. Right and full joins also keep the tables before them to the tenant.
+  - `db.with(x)` passed straight through to the unscoped connection.
+  - `db.transaction(cb)` handed `cb` an unscoped `tx`.
+  - `$count` counted every tenant's rows.
+  - `update().from(tenantTable)` read every tenant's rows.
+  - A `union` (or other set operation) accepted an operand built elsewhere.
+  - An `onConflictDoUpdate` upsert on a unique key that excludes the tenant column could overwrite another tenant's row. Its update is now limited to the tenant's own rows, and a conflict with another tenant's row updates nothing and returns no row. `pipe.upsert` and audited upserts are covered.
+  - The no-tenant guard connection refuses a tenant table on all of the same paths.
+- **Changed:**
+  - `insert().select()` into a tenant table is refused on a scoped connection, because the tenant column can't be set from a select.
+  - `db.query` (relational queries) is refused on a scoped connection that has tables.
+
+## 0.190.0
+
+- **Fixed: a NULL element in an array read back wrong** (#747). On every path (column selects, `db.execute`, `arrayAgg`) an unquoted NULL element now reads as `null`, for every array type:
+  - Numeric arrays used to give `NaN`, and bigint arrays threw `Cannot convert NULL to a BigInt`.
+  - `text[]`, `uuid[]` and enum arrays gave the string `'NULL'`, which a real `'NULL'` string couldn't be told apart from.
+  - `bool[]` gave `false`.
+  - `jsonb[]` threw on parse.
+  - Date and timestamp array columns gave `Invalid Date`.
+
+  A quoted `"NULL"` string stays a string, and a float `NaN` stays `NaN`.
+  - The fix replaces the driver's array parser for every array type it learns at connect, enums and domains included. An enum created after a connection opened is learned by connections opened after it.
+  - `db.execute` now returns a `numeric[]` as an array of strings (`['1.5', null]`) instead of the text `'{1.5,NULL}'`.
+
 ## 0.189.0
 
 - **Added: a step's own priority** (#744). `steps: { shadow: { priority: -100, … } }` queues that step's jobs at its own priority instead of the run's, in every run and for every fan-out instance. Higher priorities are claimed first, across runs, per worker class. A measurement step set below every run priority waits behind every other step on its workers, and its run still finishes and records as before. The steps it needs, the steps that need it and the run's finish job keep the run's priority.

package/dist/REFERENCE.md

@@ -1,7 +1,7 @@
 # Pipework API Reference
 
 > Auto-generated from source JSDoc. Do not edit manually.
-> Generated: 2026-10-22
+> Generated: 2026-10-20
 
 ## Contents
 
@@ -816,10 +816,6 @@ Acquires a transaction-scoped advisory lock. Released at commit/rollback.
 
 Runs a function in a SERIALIZABLE transaction with automatic retry on serialization failures and deadlocks.
 
-### `pipe.withTimeouts`
-
-Sets statement_timeout and/or lock_timeout for the current transaction in one statement, then runs fn; a statement cancelled for them rejects with StatementTimeoutError or LockTimeoutError.
-
 ### `pipe.bulkSet`
 
 Bulk UPDATE ... FROM (VALUES ...) — updates multiple rows with per-row values in a single statement.
@@ -828,10 +824,6 @@ Bulk UPDATE ... FROM (VALUES ...) — updates multiple rows with per-row values
 
 Produces a typed VALUES clause for bulk operations — the base primitive for bulkSet and bulkUpsert.
 
-### `pipe.fn`
-
-A set-returning SQL function as a typed source for `.from()` and joins — `pipe.fn('schema.f', { args: [field.uuid()], columns: { path: field.text() } })`. Arguments are bound and cast to their declared types.
-
 ### `pipe.field`
 
 Field builders for domain definitions — uuid(), text(), integer(), etc.
@@ -844,10 +836,6 @@ Registers a domain definition with table, validators, and factory projections. T
 
 Returns the global registry of all domain definitions.
 
-### `pipe.external`
-
-Declares a table or view another service owns (`pipe.external(name, fields, { schema, table? })`): typed columns and every query operator, read-only, never migrated, not tenant-scoped.
-
 ### `pipe.update`
 
 Pipework-owned UPDATE builder — the only consumer-facing way to update pipework-managed tables (Q8).
@@ -878,54 +866,12 @@ interface WindowSpec
 interface ValueColumnDef
 ```
 
-**`JsonbElements`** — A jsonb array read as its elements' text. Produced by {@link jsonbElements}.
-
-```typescript
-interface JsonbElements
-```
-
-**`ArraySource`** — Something whose elements `arrayAny` / `arrayAll` can test.
-
-```typescript
-type ArraySource =
-```
-
-**`ElementOf`** — The element type of an {@link ArraySource}.
-
-```typescript
-type ElementOf<S> =
-```
-
-**`FunctionSpec`** — Declares a SQL function's argument and result-column shapes. See {@link fn}.
-
-```typescript
-interface FunctionSpec<TArgs extends readonly AnyField[], TColumns extends Record<string, AnyField>>
-```
-
-**`FunctionSourceFields`** — The selected fields of a function source: each result column as a typed SQL expression.
-
-```typescript
-type FunctionSourceFields<TColumns extends Record<string, AnyField>> =
-```
-
-**`FunctionSource`** — A function call usable in `.from()` and joins; its result columns are properties of it.
-
-```typescript
-type FunctionSource<TAlias extends string, TColumns extends Record<string, AnyField>> =
-```
-
 **`SerializableOptions`** — Retry policy for {@link serializable}: how many attempts on a serialization failure / deadlock, and the base backoff between them.
 
 ```typescript
 interface SerializableOptions
 ```
 
-**`TimeoutOptions`** — Which timeouts {@link withTimeouts} sets; each a positive integer number of milliseconds.
-
-```typescript
-interface TimeoutOptions
-```
-
 **`ManagedConnection`** — A standalone pooled connection: the raw postgres.js client, its drizzle handle, and a `close()` that ends the pool.
 
 ```typescript
@@ -946,10 +892,6 @@ JSONB query operators — typed helpers for PostgreSQL JSONB containment, key ch
 
 The @> containment operator — tests whether a JSONB column contains the given value.
 
-### `jsonb.merge`
-
-Merges an object into a JSONB column in `.set()`: `coalesce(col, '{}') || value`. Top-level keys overwrite; others are kept.
-
 ### `jsonb.containedBy`
 
 The <@ contained-by operator — tests whether a JSONB column is contained by the given value.
@@ -1016,60 +958,6 @@ type Schema<T = unknown> = z.ZodType<T>
 type Infer<T extends Schema> = z.infer<T>
 ```
 
-**`StringSchema`** — A string validator — what check.string() returns, nameable without importing zod.
-
-```typescript
-interface StringSchema extends z.ZodString
-```
-
-**`NumberSchema`** — A number validator — what check.number() returns.
-
-```typescript
-interface NumberSchema extends z.ZodNumber
-```
-
-**`BooleanSchema`** — A boolean validator — what check.boolean() returns.
-
-```typescript
-interface BooleanSchema extends z.ZodBoolean
-```
-
-**`EnumSchema`** — An enum validator over string literals — what check.enum([...]) returns.
-
-```typescript
-interface EnumSchema<V extends string = string> extends z.ZodEnum<
-```
-
-**`LiteralSchema`** — A literal validator — what check.literal(v) returns.
-
-```typescript
-interface LiteralSchema<V extends string | number | boolean | null = string> extends z.ZodLiteral<V>
-```
-
-**`ArraySchema`** — An array validator — what check.array(item) returns.
-
-```typescript
-interface ArraySchema<Item extends z.core.SomeType = z.core.SomeType> extends z.ZodArray<Item>
-```
-
-**`OptionalSchema`** — An optional validator — what check.optional(inner) returns.
-
-```typescript
-interface OptionalSchema<Inner extends z.core.SomeType = z.core.SomeType> extends z.ZodOptional<Inner>
-```
-
-**`NullableSchema`** — A nullable validator — what check.nullable(inner) returns.
-
-```typescript
-interface NullableSchema<Inner extends z.core.SomeType = z.core.SomeType> extends z.ZodNullable<Inner>
-```
-
-**`ObjectSchema`** — An object validator whose .extend, .pick, .omit and .partial results stay ObjectSchema — what check.object({...}) returns.
-
-```typescript
-type ObjectSchema<S extends Shape = Shape> =
-```
-
 ## temporal — Bitemporal Data
 
 Temporal (bitemporal) data namespace — version history with effective date ranges.
@@ -1586,11 +1474,7 @@ interface RateLimitConfig
 interface RateLimitWindow
 ```
 
-**`RateLimitClass`**
-
-A named limit class: any of a per-user, per-tenant, per-address and total window, each counted on its own.
-Each key takes one window or an array of windows (distinct `windowSeconds`); a request is counted against
-all of a key's windows and refused if any is over.
+**`RateLimitClass`** — A named limit class: any of a per-user, per-tenant and per-address window, each counted on its own.
 
 ```typescript
 interface RateLimitClass
@@ -1606,8 +1490,8 @@ interface RateLimitRefusal
 
 Named limit classes, checked after auth and counted in Postgres (`pipework_rate_limit_counts`, opted in
 with the blueprint's `rateLimits: {}`), so every server process on the same database shares one count.
-Keys are counted perUser, perTenant, perAddress, total in turn, up to the first key with a window over its max, so one user's
-refused requests don't spend the tenant's budget. The 429's Retry-After is the longest wait of the windows that refused. A route is in `signedIn` (auth required, or optional with
+Windows are counted perUser, perTenant, perAddress in turn, up to the first one over its max, so one user's
+refused requests don't spend the tenant's budget. A route is in `signedIn` (auth required, or optional with
 a user), `public` (no auth, or optional without a user) or the class its fitting names with `.rateLimit(name)`.
 
 ```typescript
@@ -1759,20 +1643,15 @@ interface TraceTree
 
 ## data
 
-### `StatementTimeoutError`
-
-A statement was cancelled by Postgres for running past the statement timeout a {@link withTimeouts} call set. `cause` is the driver error.
-
-```typescript
-class StatementTimeoutError extends Error constructor(readonly statementTimeoutMs: number, cause: unknown)
-```
-
-### `LockTimeoutError`
+### `tap`
 
-A statement gave up waiting for a lock past the lock timeout a {@link withTimeouts} call set. `cause` is the driver error.
+Opens a standalone managed connection outside the manifold's pools — the
+sanctioned door for contexts where `pipe()` structurally cannot resolve:
+`worker_threads`, detached monitors, one-off scripts. Callers own the
+lifecycle: always `await conn.close()`.
 
 ```typescript
-class LockTimeoutError extends Error constructor(readonly lockTimeoutMs: number, cause: unknown)
+function tap(url: string, options?: ConnectOptions): ManagedConnection
 ```
 
 ## request

package/dist/auth/tenant/scoped-db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-db.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/scoped-db.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAiKhD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAsB9C;AAmBD,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,CAgE3D"}
+{"version":3,"file":"scoped-db.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/scoped-db.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAichD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAE9C;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,CAE3D"}