pipework 0.190.0 → 0.191.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.191.0
+
+- **Added: `$with` on a tenant-scoped connection** (#748). `db.$with('m').materialized().as(db.select(…).from(tenantTable))` followed by `db.with(m).select().from(m)` returns only the context tenant's rows, the same as an inline subquery.
+  - A CTE body must be built by the same scoped connection. The callback form `(qb) => …` gets a scoped query builder.
+  - A raw `sql` body, or a builder from `pipe.system()` or another connection, is refused with a message saying why.
+  - `db.with(…)` accepts only this connection's CTEs and scopes what follows it.
+- **Fixed: the tenant-scoped connection let other tenants' rows through on several paths** (#748). Postgres row-level security still applied wherever it was configured, but pipework's own tenant filter was missing on these:
+  - A scoped select used as a subquery, through `inArray(…)`, `.as()`, `getSQL()` or `toSQL()`, had no tenant filter. The filter used to be added only when the query was awaited. It is now in the SQL as soon as the table is named.
+  - A joined tenant table (inner, left, right, full or cross) wasn't filtered. Its condition now goes in the join's ON clause, so a left join keeps its unmatched rows. Right and full joins also keep the tables before them to the tenant.
+  - `db.with(x)` passed straight through to the unscoped connection.
+  - `db.transaction(cb)` handed `cb` an unscoped `tx`.
+  - `$count` counted every tenant's rows.
+  - `update().from(tenantTable)` read every tenant's rows.
+  - A `union` (or other set operation) accepted an operand built elsewhere.
+  - An `onConflictDoUpdate` upsert on a unique key that excludes the tenant column could overwrite another tenant's row. Its update is now limited to the tenant's own rows, and a conflict with another tenant's row updates nothing and returns no row. `pipe.upsert` and audited upserts are covered.
+  - The no-tenant guard connection refuses a tenant table on all of the same paths.
+- **Changed:**
+  - `insert().select()` into a tenant table is refused on a scoped connection, because the tenant column can't be set from a select.
+  - `db.query` (relational queries) is refused on a scoped connection that has tables.
+
 ## 0.190.0
 
 - **Fixed: a NULL element in an array read back wrong** (#747). On every path (column selects, `db.execute`, `arrayAgg`) an unquoted NULL element now reads as `null`, for every array type:

package/dist/REFERENCE.md

@@ -1,7 +1,7 @@
 # Pipework API Reference
 
 > Auto-generated from source JSDoc. Do not edit manually.
-> Generated: 2026-10-22
+> Generated: 2026-10-20
 
 ## Contents
 
@@ -816,10 +816,6 @@ Acquires a transaction-scoped advisory lock. Released at commit/rollback.
 
 Runs a function in a SERIALIZABLE transaction with automatic retry on serialization failures and deadlocks.
 
-### `pipe.withTimeouts`
-
-Sets statement_timeout and/or lock_timeout for the current transaction in one statement, then runs fn; a statement cancelled for them rejects with StatementTimeoutError or LockTimeoutError.
-
 ### `pipe.bulkSet`
 
 Bulk UPDATE ... FROM (VALUES ...) — updates multiple rows with per-row values in a single statement.
@@ -828,10 +824,6 @@ Bulk UPDATE ... FROM (VALUES ...) — updates multiple rows with per-row values
 
 Produces a typed VALUES clause for bulk operations — the base primitive for bulkSet and bulkUpsert.
 
-### `pipe.fn`
-
-A set-returning SQL function as a typed source for `.from()` and joins — `pipe.fn('schema.f', { args: [field.uuid()], columns: { path: field.text() } })`. Arguments are bound and cast to their declared types.
-
 ### `pipe.field`
 
 Field builders for domain definitions — uuid(), text(), integer(), etc.
@@ -844,10 +836,6 @@ Registers a domain definition with table, validators, and factory projections. T
 
 Returns the global registry of all domain definitions.
 
-### `pipe.external`
-
-Declares a table or view another service owns (`pipe.external(name, fields, { schema, table? })`): typed columns and every query operator, read-only, never migrated, not tenant-scoped.
-
 ### `pipe.update`
 
 Pipework-owned UPDATE builder — the only consumer-facing way to update pipework-managed tables (Q8).
@@ -878,54 +866,12 @@ interface WindowSpec
 interface ValueColumnDef
 ```
 
-**`JsonbElements`** — A jsonb array read as its elements' text. Produced by {@link jsonbElements}.
-
-```typescript
-interface JsonbElements
-```
-
-**`ArraySource`** — Something whose elements `arrayAny` / `arrayAll` can test.
-
-```typescript
-type ArraySource =
-```
-
-**`ElementOf`** — The element type of an {@link ArraySource}.
-
-```typescript
-type ElementOf<S> =
-```
-
-**`FunctionSpec`** — Declares a SQL function's argument and result-column shapes. See {@link fn}.
-
-```typescript
-interface FunctionSpec<TArgs extends readonly AnyField[], TColumns extends Record<string, AnyField>>
-```
-
-**`FunctionSourceFields`** — The selected fields of a function source: each result column as a typed SQL expression.
-
-```typescript
-type FunctionSourceFields<TColumns extends Record<string, AnyField>> =
-```
-
-**`FunctionSource`** — A function call usable in `.from()` and joins; its result columns are properties of it.
-
-```typescript
-type FunctionSource<TAlias extends string, TColumns extends Record<string, AnyField>> =
-```
-
 **`SerializableOptions`** — Retry policy for {@link serializable}: how many attempts on a serialization failure / deadlock, and the base backoff between them.
 
 ```typescript
 interface SerializableOptions
 ```
 
-**`TimeoutOptions`** — Which timeouts {@link withTimeouts} sets; each a positive integer number of milliseconds.
-
-```typescript
-interface TimeoutOptions
-```
-
 **`ManagedConnection`** — A standalone pooled connection: the raw postgres.js client, its drizzle handle, and a `close()` that ends the pool.
 
 ```typescript
@@ -946,10 +892,6 @@ JSONB query operators — typed helpers for PostgreSQL JSONB containment, key ch
 
 The @> containment operator — tests whether a JSONB column contains the given value.
 
-### `jsonb.merge`
-
-Merges an object into a JSONB column in `.set()`: `coalesce(col, '{}') || value`. Top-level keys overwrite; others are kept.
-
 ### `jsonb.containedBy`
 
 The <@ contained-by operator — tests whether a JSONB column is contained by the given value.
@@ -1016,60 +958,6 @@ type Schema<T = unknown> = z.ZodType<T>
 type Infer<T extends Schema> = z.infer<T>
 ```
 
-**`StringSchema`** — A string validator — what check.string() returns, nameable without importing zod.
-
-```typescript
-interface StringSchema extends z.ZodString
-```
-
-**`NumberSchema`** — A number validator — what check.number() returns.
-
-```typescript
-interface NumberSchema extends z.ZodNumber
-```
-
-**`BooleanSchema`** — A boolean validator — what check.boolean() returns.
-
-```typescript
-interface BooleanSchema extends z.ZodBoolean
-```
-
-**`EnumSchema`** — An enum validator over string literals — what check.enum([...]) returns.
-
-```typescript
-interface EnumSchema<V extends string = string> extends z.ZodEnum<
-```
-
-**`LiteralSchema`** — A literal validator — what check.literal(v) returns.
-
-```typescript
-interface LiteralSchema<V extends string | number | boolean | null = string> extends z.ZodLiteral<V>
-```
-
-**`ArraySchema`** — An array validator — what check.array(item) returns.
-
-```typescript
-interface ArraySchema<Item extends z.core.SomeType = z.core.SomeType> extends z.ZodArray<Item>
-```
-
-**`OptionalSchema`** — An optional validator — what check.optional(inner) returns.
-
-```typescript
-interface OptionalSchema<Inner extends z.core.SomeType = z.core.SomeType> extends z.ZodOptional<Inner>
-```
-
-**`NullableSchema`** — A nullable validator — what check.nullable(inner) returns.
-
-```typescript
-interface NullableSchema<Inner extends z.core.SomeType = z.core.SomeType> extends z.ZodNullable<Inner>
-```
-
-**`ObjectSchema`** — An object validator whose .extend, .pick, .omit and .partial results stay ObjectSchema — what check.object({...}) returns.
-
-```typescript
-type ObjectSchema<S extends Shape = Shape> =
-```
-
 ## temporal — Bitemporal Data
 
 Temporal (bitemporal) data namespace — version history with effective date ranges.
@@ -1586,11 +1474,7 @@ interface RateLimitConfig
 interface RateLimitWindow
 ```
 
-**`RateLimitClass`**
-
-A named limit class: any of a per-user, per-tenant, per-address and total window, each counted on its own.
-Each key takes one window or an array of windows (distinct `windowSeconds`); a request is counted against
-all of a key's windows and refused if any is over.
+**`RateLimitClass`** — A named limit class: any of a per-user, per-tenant and per-address window, each counted on its own.
 
 ```typescript
 interface RateLimitClass
@@ -1606,8 +1490,8 @@ interface RateLimitRefusal
 
 Named limit classes, checked after auth and counted in Postgres (`pipework_rate_limit_counts`, opted in
 with the blueprint's `rateLimits: {}`), so every server process on the same database shares one count.
-Keys are counted perUser, perTenant, perAddress, total in turn, up to the first key with a window over its max, so one user's
-refused requests don't spend the tenant's budget. The 429's Retry-After is the longest wait of the windows that refused. A route is in `signedIn` (auth required, or optional with
+Windows are counted perUser, perTenant, perAddress in turn, up to the first one over its max, so one user's
+refused requests don't spend the tenant's budget. A route is in `signedIn` (auth required, or optional with
 a user), `public` (no auth, or optional without a user) or the class its fitting names with `.rateLimit(name)`.
 
 ```typescript
@@ -1759,20 +1643,15 @@ interface TraceTree
 
 ## data
 
-### `StatementTimeoutError`
-
-A statement was cancelled by Postgres for running past the statement timeout a {@link withTimeouts} call set. `cause` is the driver error.
-
-```typescript
-class StatementTimeoutError extends Error constructor(readonly statementTimeoutMs: number, cause: unknown)
-```
-
-### `LockTimeoutError`
+### `tap`
 
-A statement gave up waiting for a lock past the lock timeout a {@link withTimeouts} call set. `cause` is the driver error.
+Opens a standalone managed connection outside the manifold's pools — the
+sanctioned door for contexts where `pipe()` structurally cannot resolve:
+`worker_threads`, detached monitors, one-off scripts. Callers own the
+lifecycle: always `await conn.close()`.
 
 ```typescript
-class LockTimeoutError extends Error constructor(readonly lockTimeoutMs: number, cause: unknown)
+function tap(url: string, options?: ConnectOptions): ManagedConnection
 ```
 
 ## request

package/dist/auth/tenant/scoped-db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-db.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/scoped-db.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAiKhD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAsB9C;AAmBD,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,CAgE3D"}
+{"version":3,"file":"scoped-db.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/scoped-db.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAichD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAE9C;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,CAE3D"}

package/dist/auth/tenant/scoped-db.js

@@ -1,236 +1,399 @@
-import { eq, and, getTableColumns, getTableName } from '../../data/query/index.js';
+import { eq, and, or, isNull, is, SQL as SQLClass, getTableColumns, getTableName } from '../../data/query/index.js';
 import { getScopeConfig } from './scope.js';
-function buildTenantCondition(table, columnKey, tenantId) {
-    const columns = getTableColumns(table);
-    const col = columns[columnKey];
-    return eq(col, tenantId);
-}
-function bindMethod(obj, prop) {
-    const val = Reflect.get(obj, prop, obj);
-    return typeof val === 'function' ? val.bind(obj) : val;
-}
-function wrapFinalBuilder(builder, condition) {
-    let whereApplied = false;
-    const wrap = (target) => new Proxy(target, {
-        get(t, prop) {
-            if (prop === 'where') {
-                return (userCondition) => {
-                    whereApplied = true;
-                    const combined = userCondition != null ? and(userCondition, condition) : condition;
-                    const result = t['where'].call(t, combined);
-                    return passthrough(result);
-                };
-            }
-            if (prop === 'then') {
-                if (!whereApplied) {
-                    const scoped = t['where'].call(t, condition);
-                    return bindMethod(scoped, 'then');
-                }
-                return bindMethod(t, 'then');
-            }
-            if (prop === 'catch' || prop === 'finally') {
-                if (!whereApplied) {
-                    const scoped = t['where'].call(t, condition);
-                    return bindMethod(scoped, prop);
-                }
-                return bindMethod(t, prop);
-            }
-            const value = Reflect.get(t, prop, t);
-            if (typeof value !== 'function')
-                return value;
-            return (...args) => {
-                const result = value.apply(t, args);
-                if (result != null && typeof result === 'object' && 'where' in result) {
-                    return wrap(result);
-                }
-                if (result != null && typeof result === 'object' && 'then' in result) {
-                    return passthrough(result);
-                }
-                return result;
-            };
+const GUARD = Symbol('tenant-guard');
+const made = new WeakMap();
+const JOINS = {
+    leftJoin: 'left', leftJoinLateral: 'left', rightJoin: 'right', innerJoin: 'inner',
+    innerJoinLateral: 'inner', fullJoin: 'full', crossJoin: 'cross', crossJoinLateral: 'cross',
+};
+const SET_OPERATORS = ['union', 'unionAll', 'intersect', 'intersectAll', 'except', 'exceptAll'];
+const SELECTS = ['select', 'selectDistinct', 'selectDistinctOn'];
+function throwTenantRequired(tableName, operation) {
+    throw new Error(`[pipework] Cannot ${operation} tenant-scoped table "${tableName}" without a tenant in context.\n\n` +
+        '  This table has a .tenant() field, which means all operations require\n' +
+        '  an active tenant in the request/job context.\n\n' +
+        '  If this is a system-level operation that legitimately needs cross-tenant\n' +
+        '  access — pre-tenant auth (e.g. resolving org membership during login),\n' +
+        '  public webhook ingress, admin tooling — use pipe.system() instead. It is\n' +
+        '  the explicit unscoped channel: owner-role connection, outside the request\n' +
+        '  transaction, never tenant-filtered. Every query through it must be\n' +
+        '  deliberately cross-tenant-safe.\n');
+}
+function scopedPolicy(tenantId) {
+    return {
+        owner: tenantId,
+        tenantId,
+        refuseExecute: true,
+        scope(table) {
+            const config = getScopeConfig(table);
+            if (!config)
+                return null;
+            const column = getTableColumns(table)[config.columnKey];
+            return { cond: eq(column, tenantId), column, columnKey: config.columnKey };
         },
-    });
-    const passthrough = (target) => new Proxy(target, {
+    };
+}
+const guardPolicy = {
+    owner: GUARD,
+    tenantId: null,
+    refuseExecute: false,
+    scope(table, operation) {
+        if (getScopeConfig(table))
+            throwTenantRequired(getTableName(table), operation);
+        return null;
+    },
+};
+function refuse(what, why) {
+    throw new Error(`[pipework] ${what} is not allowed on this database connection: ${why}\n\n` +
+        '  A tenant-scoped connection filters every tenant table its own builders read.\n' +
+        '  Build the statement with this connection (select, insert, update or delete, or\n' +
+        '  the callback form of $with) so the filter is part of its SQL. A raw sql fragment\n' +
+        '  or a builder from another connection (pipe.system(), an unscoped db) cannot be\n' +
+        '  filtered, so it is refused.\n');
+}
+function checkBuilder(policy, what, builder) {
+    if (builder != null && typeof builder === 'object' && made.get(builder) === policy.owner)
+        return;
+    if (is(builder, SQLClass))
+        refuse(what, 'a raw sql fragment cannot be scoped to the tenant.');
+    refuse(what, 'it was not built by this connection.');
+}
+function withCond(on, cond) {
+    if (typeof on === 'function')
+        return (...args) => and(on(...args), cond);
+    return on === undefined ? cond : and(on, cond);
+}
+/**
+ * The where clause of one statement: the user's condition plus the tenant
+ * condition of every tenant table the statement reads. It is rewritten onto the
+ * builder after every call that changes it, so the filter is in the SQL as soon
+ * as the table is named. A table a right or full join can null-extend accepts
+ * its null rows (the tenant column is NOT NULL, so null means no row there).
+ */
+class WhereScope {
+    target;
+    policy;
+    user;
+    entries = [];
+    position = 0;
+    widest = -1;
+    constructor(target, policy) {
+        this.target = target;
+        this.policy = policy;
+    }
+    table(table, operation, strict) {
+        this.position++;
+        const scope = this.policy.scope(table, operation);
+        if (scope)
+            this.entries.push({ cond: scope.cond, column: scope.column, position: this.position, strict, tolerant: false });
+        this.refresh();
+    }
+    join(table, type, on) {
+        this.position++;
+        const wide = type === 'right' || type === 'full';
+        const scope = this.policy.scope(table, 'join');
+        const conds = [];
+        if (scope && type !== 'cross')
+            conds.push(scope.cond);
+        // A right or full join keeps unmatched rows of the tables before it: a row of
+        // another tenant must not match, so those tables' conditions go in its ON too.
+        if (wide)
+            conds.push(...this.entries.map(e => or(e.cond, isNull(e.column))));
+        if (scope && (wide || type === 'cross')) {
+            this.entries.push({ cond: scope.cond, column: scope.column, position: this.position, strict: false, tolerant: wide });
+        }
+        if (wide)
+            this.widest = this.position;
+        return conds.length > 0 ? withCond(on, and(...conds)) : on;
+    }
+    where(user) {
+        this.user = user;
+        this.refresh();
+    }
+    refresh() {
+        if (this.user === undefined && this.entries.length === 0)
+            return;
+        const conds = this.entries.map(e => e.tolerant || (!e.strict && this.widest > e.position) ? or(e.cond, isNull(e.column)) : e.cond);
+        this.target['where'](and(this.user, ...conds));
+    }
+}
+/** Wraps a builder so the calls that return it return the wrapper, and `hooks` replace named methods. */
+function wrap(target, policy, hooksFor) {
+    let hooks;
+    const self = new Proxy(target, {
         get(t, prop) {
-            if (prop === 'then' || prop === 'catch' || prop === 'finally') {
-                return bindMethod(t, prop);
+            if (typeof prop === 'string') {
+                hooks ??= hooksFor(self, t);
+                if (Object.hasOwn(hooks, prop))
+                    return hooks[prop];
             }
             const value = Reflect.get(t, prop, t);
             if (typeof value !== 'function')
                 return value;
             return (...args) => {
                 const result = value.apply(t, args);
-                if (result != null && typeof result === 'object' && 'then' in result) {
-                    return passthrough(result);
-                }
-                return result;
+                return result === t ? self : result;
             };
         },
     });
-    return wrap(builder);
+    made.set(self, policy.owner);
+    return self;
+}
+function whereHook(scope, self) {
+    return (user) => {
+        scope.where(user);
+        return self;
+    };
+}
+function joinHooks(scope, self, t) {
+    const hooks = {};
+    for (const [name, type] of Object.entries(JOINS)) {
+        hooks[name] = (table, on) => {
+            const scopedOn = scope.join(table, type, on);
+            t[name](...(scopedOn === undefined ? [table] : [table, scopedOn]));
+            scope.refresh();
+            return self;
+        };
+    }
+    return hooks;
 }
-function wrapUpdateBuilder(builder, condition) {
+function selectBuilder(builder, table, policy) {
+    const t = builder;
+    const scope = new WhereScope(t, policy);
+    scope.table(table, 'select from', false);
+    return wrap(builder, policy, (self) => ({
+        where: whereHook(scope, self),
+        ...joinHooks(scope, self, t),
+        ...Object.fromEntries(SET_OPERATORS.map(name => [name, (right) => {
+                const checked = typeof right === 'function'
+                    ? (...ops) => {
+                        const resolved = right(...ops);
+                        checkBuilder(policy, `${name}()`, resolved);
+                        return resolved;
+                    }
+                    : right;
+                if (typeof right !== 'function')
+                    checkBuilder(policy, `${name}()`, right);
+                t[name](checked);
+                return self;
+            }])),
+    }));
+}
+function selectStart(builder, policy) {
     return new Proxy(builder, {
         get(t, prop) {
-            if (prop === 'set') {
-                return (...args) => {
-                    const result = t['set'].apply(t, args);
-                    return wrapFinalBuilder(result, condition);
-                };
+            if (prop === 'from') {
+                return (table, ...rest) => selectBuilder(t['from'](table, ...rest), table, policy);
             }
             const value = Reflect.get(t, prop, t);
             return typeof value === 'function' ? value.bind(t) : value;
         },
     });
 }
-function wrapInsertBuilder(builder, columnKey, tenantId) {
-    return new Proxy(builder, {
-        get(t, prop) {
-            if (prop === 'values') {
-                return (values) => {
-                    const inject = (row) => {
-                        const existing = row[columnKey];
-                        if (existing !== undefined && existing !== tenantId) {
-                            throw new Error(`[pipework] Tenant-scoped insert: value has ${columnKey} "${String(existing)}" ` +
-                                `but the current context tenant is "${tenantId}".\n\n` +
-                                `  Remove the explicit ${columnKey} from your insert values — it's set automatically.\n` +
-                                '  If you need cross-tenant writes, file an issue on the pipework repo.\n');
-                        }
-                        return { ...row, [columnKey]: tenantId };
-                    };
-                    const scoped = Array.isArray(values)
-                        ? values.map(inject)
-                        : inject(values);
-                    return t['values'].call(t, scoped);
-                };
-            }
-            const value = Reflect.get(t, prop, t);
-            return typeof value === 'function' ? value.bind(t) : value;
+function updateBuilder(builder, table, policy) {
+    const t = builder;
+    const scope = new WhereScope(t, policy);
+    scope.table(table, 'update', true);
+    return wrap(builder, policy, (self) => ({
+        where: whereHook(scope, self),
+        ...joinHooks(scope, self, t),
+        from: (source) => {
+            t['from'](source);
+            scope.table(source, 'update from', false);
+            return self;
         },
-    });
+    }));
 }
-function wrapSelectBuilder(builder, tenantId) {
+function updateStart(builder, table, policy) {
     return new Proxy(builder, {
         get(t, prop) {
-            if (prop === 'from') {
-                return (table, ...rest) => {
-                    const result = t['from'].call(t, table, ...rest);
-                    const config = getScopeConfig(table);
-                    if (!config)
-                        return result;
-                    const cond = buildTenantCondition(table, config.columnKey, tenantId);
-                    return wrapFinalBuilder(result, cond);
-                };
+            if (prop === 'set') {
+                return (...args) => updateBuilder(t['set'](...args), table, policy);
             }
             const value = Reflect.get(t, prop, t);
             return typeof value === 'function' ? value.bind(t) : value;
         },
     });
 }
-function throwTenantRequired(tableName, operation) {
-    throw new Error(`[pipework] Cannot ${operation} tenant-scoped table "${tableName}" without a tenant in context.\n\n` +
-        '  This table has a .tenant() field, which means all operations require\n' +
-        '  an active tenant in the request/job context.\n\n' +
-        '  If this is a system-level operation that legitimately needs cross-tenant\n' +
-        '  access — pre-tenant auth (e.g. resolving org membership during login),\n' +
-        '  public webhook ingress, admin tooling — use pipe.system() instead. It is\n' +
-        '  the explicit unscoped channel: owner-role connection, outside the request\n' +
-        '  transaction, never tenant-filtered. Every query through it must be\n' +
-        '  deliberately cross-tenant-safe.\n');
+function deleteBuilder(builder, table, policy) {
+    const scope = new WhereScope(builder, policy);
+    scope.table(table, 'delete', true);
+    return wrap(builder, policy, (self) => ({ where: whereHook(scope, self) }));
 }
-export function createTenantGuardDb(db) {
-    return new Proxy(db, {
-        get(target, prop, receiver) {
-            if (prop === 'insert' || prop === 'update' || prop === 'delete') {
-                return (table) => {
-                    if (getScopeConfig(table)) {
-                        throwTenantRequired(getTableName(table), prop);
-                    }
-                    return target[prop].call(target, table);
-                };
+function insertBuilder(builder, table, policy) {
+    const t = builder;
+    const scope = policy.scope(table, 'insert');
+    // A conflict with another tenant's row must update nothing: the existing row has to be ours.
+    const finish = (result) => wrap(result, policy, (self, base) => ({
+        ...(scope && {
+            onConflictDoUpdate: (config) => {
+                const { where, setWhere, ...rest } = config;
+                base['onConflictDoUpdate']({ ...rest, setWhere: and(where, setWhere, scope.cond) });
+                return self;
+            },
+        }),
+    }));
+    return wrap(builder, policy, (self) => ({
+        values: (values) => {
+            if (!scope)
+                return finish(t['values'](values));
+            const { columnKey } = scope;
+            const tenantId = policy.tenantId;
+            const inject = (row) => {
+                const existing = row[columnKey];
+                if (existing !== undefined && existing !== tenantId) {
+                    throw new Error(`[pipework] Tenant-scoped insert: value has ${columnKey} "${String(existing)}" ` +
+                        `but the current context tenant is "${tenantId}".\n\n` +
+                        `  Remove the explicit ${columnKey} from your insert values — it's set automatically.\n` +
+                        '  If you need cross-tenant writes, file an issue on the pipework repo.\n');
+                }
+                return { ...row, [columnKey]: tenantId };
+            };
+            const scoped = Array.isArray(values)
+                ? values.map(inject)
+                : inject(values);
+            return finish(t['values'](scoped));
+        },
+        select: (source) => {
+            if (scope) {
+                refuse(`insert().select() into tenant-scoped table "${getTableName(table)}"`, `the tenant column ${scope.columnKey} cannot be set from a select.`);
             }
-            if (prop === 'select' || prop === 'selectDistinct' || prop === 'selectDistinctOn') {
-                return (...args) => {
-                    const selectBuilder = target[prop](...args);
-                    return wrapGuardSelectBuilder(selectBuilder);
-                };
+            if (typeof source === 'function') {
+                return finish(t['select']((qb) => {
+                    const body = source(scopedQueryBuilder(qb, policy));
+                    checkBuilder(policy, 'insert().select()', body);
+                    return body;
+                }));
             }
-            return Reflect.get(target, prop, receiver);
+            checkBuilder(policy, 'insert().select()', source);
+            return finish(t['select'](source));
         },
-    });
+        overridingSystemValue: () => {
+            t['overridingSystemValue']();
+            return self;
+        },
+    }));
 }
-function wrapGuardSelectBuilder(builder) {
-    return new Proxy(builder, {
-        get(t, prop) {
-            if (prop === 'from') {
-                return (table, ...rest) => {
-                    if (getScopeConfig(table)) {
-                        throwTenantRequired(getTableName(table), 'select from');
-                    }
-                    return t['from'].call(t, table, ...rest);
-                };
+function scopedWith(source, policy) {
+    return (alias, selection) => {
+        const raw = source['$with'](alias, selection);
+        const build = (as) => (body) => {
+            const cte = typeof body === 'function'
+                ? as((qb) => {
+                    const result = body(scopedQueryBuilder(qb, policy));
+                    checkBuilder(policy, '$with() body', result);
+                    return result;
+                })
+                : (checkBuilder(policy, '$with() body', body), as(body));
+            made.set(cte, policy.owner);
+            return cte;
+        };
+        return {
+            as: build(raw.as),
+            materialized: () => ({ as: build(raw.materialized().as) }),
+            notMaterialized: () => ({ as: build(raw.notMaterialized().as) }),
+        };
+    };
+}
+/** The statement starters of a connection, a `with(...)` result or a query builder. */
+function starters(source, policy) {
+    const hooks = {};
+    for (const name of SELECTS) {
+        if (typeof source[name] !== 'function')
+            continue;
+        hooks[name] = (...args) => selectStart(source[name](...args), policy);
+    }
+    if (typeof source['insert'] === 'function') {
+        hooks['insert'] = (table) => {
+            policy.scope(table, 'insert');
+            return insertBuilder(source['insert'](table), table, policy);
+        };
+    }
+    if (typeof source['update'] === 'function') {
+        hooks['update'] = (table) => {
+            policy.scope(table, 'update');
+            return updateStart(source['update'](table), table, policy);
+        };
+    }
+    if (typeof source['delete'] === 'function') {
+        hooks['delete'] = (table) => {
+            policy.scope(table, 'delete');
+            return deleteBuilder(source['delete'](table), table, policy);
+        };
+    }
+    return hooks;
+}
+function withHooks(source, policy) {
+    return {
+        $with: scopedWith(source, policy),
+        with: (...ctes) => {
+            for (const cte of ctes) {
+                if (cte == null || typeof cte !== 'object' || made.get(cte) !== policy.owner) {
+                    refuse('with()', 'every CTE must come from $with() on this connection.');
+                }
             }
+            return starters(source['with'](...ctes), policy);
+        },
+    };
+}
+function scopedQueryBuilder(qb, policy) {
+    const source = qb;
+    const hooks = { ...starters(source, policy), ...withHooks(source, policy) };
+    return new Proxy(qb, {
+        get(t, prop) {
+            if (typeof prop === 'string' && Object.hasOwn(hooks, prop))
+                return hooks[prop];
             const value = Reflect.get(t, prop, t);
             return typeof value === 'function' ? value.bind(t) : value;
         },
     });
 }
-export function createScopedDb(db, tenantId) {
+function createDb(db, policy) {
+    const source = db;
+    const hooks = {
+        ...starters(source, policy),
+        ...withHooks(source, policy),
+        $count: (table, filters) => {
+            const scope = policy.scope(table, 'count');
+            const combined = scope ? (filters !== undefined ? and(filters, scope.cond) : scope.cond) : filters;
+            return source['$count'](table, combined);
+        },
+        transaction: (callback, config) => source['transaction']((tx) => callback(createDb(tx, policy)), config),
+    };
+    if (policy.refuseExecute) {
+        hooks['execute'] = () => {
+            throw new Error('[pipework] execute() is not available on a tenant-scoped database connection.\n\n' +
+                '  Tenant-scoped connections only support select, insert, update, and delete\n' +
+                '  operations, which are automatically filtered by tenant.\n\n' +
+                '  If you need to run a query that the builder cannot express, file an issue\n' +
+                '  on the pipework repo describing your use case.\n');
+        };
+    }
     return new Proxy(db, {
         get(target, prop, receiver) {
-            if (prop === 'insert') {
-                return (table) => {
-                    const builder = target.insert(table);
-                    const config = getScopeConfig(table);
-                    if (!config)
-                        return builder;
-                    return wrapInsertBuilder(builder, config.columnKey, tenantId);
-                };
-            }
-            if (prop === 'update') {
-                return (table) => {
-                    const builder = target.update(table);
-                    const config = getScopeConfig(table);
-                    if (!config)
-                        return builder;
-                    const cond = buildTenantCondition(table, config.columnKey, tenantId);
-                    return wrapUpdateBuilder(builder, cond);
-                };
-            }
-            if (prop === 'delete') {
-                return (table) => {
-                    const builder = target.delete(table);
-                    const config = getScopeConfig(table);
-                    if (!config)
-                        return builder;
-                    const cond = buildTenantCondition(table, config.columnKey, tenantId);
-                    return wrapFinalBuilder(builder, cond);
-                };
-            }
-            if (prop === 'select' || prop === 'selectDistinct' || prop === 'selectDistinctOn') {
-                return (...args) => {
-                    const selectBuilder = target[prop](...args);
-                    return wrapSelectBuilder(selectBuilder, tenantId);
-                };
-            }
-            if (prop === 'execute') {
-                return () => {
-                    throw new Error('[pipework] execute() is not available on a tenant-scoped database connection.\n\n' +
-                        '  Tenant-scoped connections only support select, insert, update, and delete\n' +
-                        '  operations, which are automatically filtered by tenant.\n\n' +
-                        '  If you need to run a query that the builder cannot express, file an issue\n' +
-                        '  on the pipework repo describing your use case.\n');
-                };
-            }
-            if (prop === '$with') {
-                return () => {
-                    throw new Error('[pipework] $with() (common table expressions) is not available on a tenant-scoped database connection.\n\n' +
-                        '  CTEs bypass tenant scoping. If you need CTE support, file an issue\n' +
-                        '  on the pipework repo describing your use case.\n');
-                };
+            if (typeof prop === 'string') {
+                if (Object.hasOwn(hooks, prop))
+                    return hooks[prop];
+                if (prop === 'query') {
+                    const query = Reflect.get(target, prop, receiver);
+                    if (query && Object.keys(query).length > 0) {
+                        return new Proxy({}, {
+                            get() {
+                                refuse('A relational query (db.query)', 'it reads tables without the tenant filter.');
+                            },
+                        });
+                    }
+                    return query;
+                }
             }
             return Reflect.get(target, prop, receiver);
         },
     });
 }
+export function createTenantGuardDb(db) {
+    return createDb(db, guardPolicy);
+}
+export function createScopedDb(db, tenantId) {
+    return createDb(db, scopedPolicy(tenantId));
+}
 //# sourceMappingURL=scoped-db.js.map

package/dist/auth/tenant/scoped-db.js.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-db.js","sourceRoot":"","sources":["../../../src/auth/tenant/scoped-db.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAI3C,SAAS,oBAAoB,CAAC,KAAc,EAAE,SAAiB,EAAE,QAAgB;IAC/E,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAE,CAAA;IAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAqB;IACpD,MAAM,GAAG,GAAY,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IAChD,OAAO,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAE,GAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,SAAc;IACvD,IAAI,YAAY,GAAG,KAAK,CAAA;IAExB,MAAM,IAAI,GAAG,CAAC,MAAc,EAAU,EAAE,CACtC,IAAI,KAAK,CAAC,MAAM,EAAE;QAChB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,aAA8B,EAAE,EAAE;oBACxC,YAAY,GAAG,IAAI,CAAA;oBACnB,MAAM,QAAQ,GAAG,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBAClF,MAAM,MAAM,GAAI,CAA2B,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAW,CAAA;oBACjF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAA;gBAC5B,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAI,CAA2B,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAW,CAAA;oBAClF,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBACnC,CAAC;gBACD,OAAO,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YAC9B,CAAC;YAED,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAI,CAA2B,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAW,CAAA;oBAClF,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACjC,CAAC;gBACD,OAAO,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;YAC5B,CAAC;YAED,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;YAE7C,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAI,KAAe,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC9C,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAK,MAAiB,EAAE,CAAC;oBAClF,OAAO,IAAI,CAAC,MAAgB,CAAC,CAAA;gBAC/B,CAAC;gBACD,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAK,MAAiB,EAAE,CAAC;oBACjF,OAAO,WAAW,CAAC,MAAgB,CAAC,CAAA;gBACtC,CAAC;gBACD,OAAO,MAAM,CAAA;YACf,CAAC,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEJ,MAAM,WAAW,GAAG,CAAC,MAAc,EAAU,EAAE,CAC7C,IAAI,KAAK,CAAC,MAAM,EAAE;QAChB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9D,OAAO,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;YAC5B,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;YAC7C,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAI,KAAe,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC9C,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAK,MAAiB,EAAE,CAAC;oBACjF,OAAO,WAAW,CAAC,MAAgB,CAAC,CAAA;gBACtC,CAAC;gBACD,OAAO,MAAM,CAAA;YACf,CAAC,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEJ,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,SAAc;IACxD,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAI,CAA2B,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAW,CAAA;oBAC5E,OAAO,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;gBAC5C,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,SAAiB,EAAE,QAAgB;IAC7E,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAe,EAAE,EAAE;oBACzB,MAAM,MAAM,GAAG,CAAC,GAA4B,EAA2B,EAAE;wBACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;wBAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACpD,MAAM,IAAI,KAAK,CACb,8CAA8C,SAAS,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI;gCAChF,sCAAsC,QAAQ,QAAQ;gCACtD,yBAAyB,SAAS,sDAAsD;gCACxF,0EAA0E,CAC3E,CAAA;wBACH,CAAC;wBACD,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;oBAC1C,CAAC,CAAA;oBACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;wBAClC,CAAC,CAAE,MAAoC,CAAC,GAAG,CAAC,MAAM,CAAC;wBACnD,CAAC,CAAC,MAAM,CAAC,MAAiC,CAAC,CAAA;oBAC7C,OAAQ,CAA2B,CAAC,QAAQ,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;gBAChE,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,QAAgB;IAC1D,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAI,CAA2B,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,CAAW,CAAA;oBACtF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,MAAM,CAAA;oBAC1B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACpE,OAAO,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACvC,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB,EAAE,SAAiB;IAC/D,MAAM,IAAI,KAAK,CACb,qBAAqB,SAAS,yBAAyB,SAAS,oCAAoC;QACpG,0EAA0E;QAC1E,oDAAoD;QACpD,8EAA8E;QAC9E,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,wEAAwE;QACxE,qCAAqC,CACtC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAM;IACxC,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChE,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1B,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,IAAc,CAAC,CAAA;oBAC1D,CAAC;oBACD,OAAQ,MAA2C,CAAC,IAAc,CAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;gBAC1F,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAClF,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,aAAa,GAAI,MAA2C,CAAC,IAAc,CAAE,CAAC,GAAG,IAAI,CAAC,CAAA;oBAC5F,OAAO,sBAAsB,CAAC,aAAuB,CAAC,CAAA;gBACxD,CAAC,CAAA;YACH,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC5C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE;oBAC5C,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1B,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAA;oBACzD,CAAC;oBACD,OAAQ,CAA2B,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAA;gBACtE,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAM,EAAE,QAAgB;IACrD,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAA;oBAC3B,OAAO,iBAAiB,CAAC,OAA4B,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;gBACpF,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAA;oBAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACpE,OAAO,iBAAiB,CAAC,OAA4B,EAAE,IAAI,CAAC,CAAA;gBAC9D,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAA;oBAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACpE,OAAO,gBAAgB,CAAC,OAA4B,EAAE,IAAI,CAAC,CAAA;gBAC7D,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAClF,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,aAAa,GAAI,MAA2C,CAAC,IAAc,CAAE,CAAC,GAAG,IAAI,CAAC,CAAA;oBAC5F,OAAO,iBAAiB,CAAC,aAAuB,EAAE,QAAQ,CAAC,CAAA;gBAC7D,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,GAAG,EAAE;oBACV,MAAM,IAAI,KAAK,CACb,mFAAmF;wBACnF,+EAA+E;wBAC/E,+DAA+D;wBAC/D,+EAA+E;wBAC/E,oDAAoD,CACrD,CAAA;gBACH,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,OAAO,GAAG,EAAE;oBACV,MAAM,IAAI,KAAK,CACb,4GAA4G;wBAC5G,wEAAwE;wBACxE,oDAAoD,CACrD,CAAA;gBACH,CAAC,CAAA;YACH,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC5C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"scoped-db.js","sourceRoot":"","sources":["../../../src/auth/tenant/scoped-db.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACnH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAiB3C,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAA;AACpC,MAAM,IAAI,GAAG,IAAI,OAAO,EAA2B,CAAA;AAEnD,MAAM,KAAK,GAA2B;IACpC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO;IACjF,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO;CAC3F,CAAA;AACD,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;AAC/F,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAA;AAEhE,SAAS,mBAAmB,CAAC,SAAiB,EAAE,SAAiB;IAC/D,MAAM,IAAI,KAAK,CACb,qBAAqB,SAAS,yBAAyB,SAAS,oCAAoC;QACpG,0EAA0E;QAC1E,oDAAoD;QACpD,8EAA8E;QAC9E,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,wEAAwE;QACxE,qCAAqC,CACtC,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,QAAQ;QACR,aAAa,EAAE,IAAI;QACnB,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,GAAG,cAAc,CAAC,KAAgB,CAAC,CAAA;YAC/C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAgB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAE,CAAA;YACnE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;QAC5E,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,WAAW,GAAW;IAC1B,KAAK,EAAE,KAAK;IACZ,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,KAAK;IACpB,KAAK,CAAC,KAAK,EAAE,SAAS;QACpB,IAAI,cAAc,CAAC,KAAgB,CAAC;YAAE,mBAAmB,CAAC,YAAY,CAAC,KAAgB,CAAC,EAAE,SAAS,CAAC,CAAA;QACpG,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,gDAAgD,GAAG,MAAM;QAC3E,kFAAkF;QAClF,oFAAoF;QACpF,sFAAsF;QACtF,oFAAoF;QACpF,iCAAiC,CAClC,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,OAAgB;IAClE,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,KAAK;QAAE,OAAM;IAChG,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,MAAM,CAAC,IAAI,EAAE,oDAAoD,CAAC,CAAA;IAC7F,MAAM,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,EAAW,EAAE,IAAS;IACtC,IAAI,OAAO,EAAE,KAAK,UAAU;QAAE,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,GAAG,CAAE,EAAY,CAAC,GAAG,IAAI,CAAoB,EAAE,IAAI,CAAC,CAAA;IACjH,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAS,EAAE,IAAI,CAAC,CAAA;AACvD,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU;IAMe;IAA8B;IALnD,IAAI,CAAiB;IACZ,OAAO,GAAY,EAAE,CAAA;IAC9B,QAAQ,GAAG,CAAC,CAAA;IACZ,MAAM,GAAG,CAAC,CAAC,CAAA;IAEnB,YAA6B,MAAW,EAAmB,MAAc;QAA5C,WAAM,GAAN,MAAM,CAAK;QAAmB,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE7E,KAAK,CAAC,KAAc,EAAE,SAAiB,EAAE,MAAe;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAA;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACjD,IAAI,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1H,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC;IAED,IAAI,CAAC,KAAc,EAAE,IAAY,EAAE,EAAW;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAA;QACf,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,CAAA;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAU,EAAE,CAAA;QACvB,IAAI,KAAK,IAAI,IAAI,KAAK,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACrD,8EAA8E;QAC9E,+EAA+E;QAC/E,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAE,CAAC,CAAC,CAAA;QAC7E,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACvH,CAAC;QACD,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAA;QACrC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7D,CAAC;IAED,KAAK,CAAC,IAAqB;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACjC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAChG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAA;IACjD,CAAC;CACF;AAED,yGAAyG;AACzG,SAAS,IAAI,CACX,MAAc,EACd,MAAc,EACd,QAAyD;IAEzD,IAAI,KAAwC,CAAA;IAC5C,MAAM,IAAI,GAAW,IAAI,KAAK,CAAC,MAAM,EAAE;QACrC,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC,CAAA;gBAClC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAA;YACpD,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;YAC7C,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAI,KAAe,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC9C,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;YACrC,CAAC,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,IAAY;IAChD,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,KAAK,CAAC,KAAK,CAAC,IAAuB,CAAC,CAAA;QACpC,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,IAAY,EAAE,CAAM;IACxD,MAAM,KAAK,GAA0B,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;YAC5C,CAAC,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;YACnE,KAAK,CAAC,OAAO,EAAE,CAAA;YACf,OAAO,IAAI,CAAA;QACb,CAAC,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAc,EAAE,MAAc;IACpE,MAAM,CAAC,GAAG,OAAc,CAAA;IACxB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACvC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;IACxC,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;QAC7B,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5B,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAc,EAAE,EAAE;gBACxE,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,UAAU;oBACzC,CAAC,CAAC,CAAC,GAAG,GAAc,EAAE,EAAE;wBACpB,MAAM,QAAQ,GAAI,KAAe,CAAC,GAAG,GAAG,CAAC,CAAA;wBACzC,YAAY,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAA;wBAC3C,OAAO,QAAQ,CAAA;oBACjB,CAAC;oBACH,CAAC,CAAC,KAAK,CAAA;gBACT,IAAI,OAAO,KAAK,KAAK,UAAU;oBAAE,YAAY,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,CAAC,CAAA;gBACzE,CAAC,CAAC,IAAI,CAAE,CAAC,OAAO,CAAC,CAAA;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC,CAAC,CAAC,CAAC;KACL,CAAC,CAAC,CAAA;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE,CAC5C,aAAa,CAAE,CAAS,CAAC,MAAM,CAAE,CAAC,KAAK,EAAE,GAAG,IAAI,CAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;YAC/E,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAc,EAAE,MAAc;IACpE,MAAM,CAAC,GAAG,OAAc,CAAA;IACxB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACvC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IAClC,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;QAC7B,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YACf,CAAC,CAAC,MAAM,CAAE,CAAC,MAAM,CAAC,CAAA;YAClB,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAC,CAAC,CAAA;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,KAAc,EAAE,MAAc;IAClE,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,aAAa,CAAE,CAAS,CAAC,KAAK,CAAE,CAAC,GAAG,IAAI,CAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;YACpG,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAc,EAAE,MAAc;IACpE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAc,EAAE,MAAM,CAAC,CAAA;IACpD,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IAClC,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAc,EAAE,MAAc;IACpE,MAAM,CAAC,GAAG,OAAc,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC3C,6FAA6F;IAC7F,MAAM,MAAM,GAAG,CAAC,MAAe,EAAU,EAAE,CACzC,IAAI,CAAC,MAAgB,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,CAAC,KAAK,IAAI;YACX,kBAAkB,EAAE,CAAC,MAAe,EAAE,EAAE;gBACtC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAyC,CAAA;gBAC9E,IAAI,CAAC,oBAAoB,CAAE,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACpF,OAAO,IAAI,CAAA;YACb,CAAC;SACF,CAAC;KACH,CAAC,CAAC,CAAA;IACL,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;YACjB,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAE,CAAC,MAAM,CAAC,CAAC,CAAA;YAC/C,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAS,CAAA;YACjC,MAAM,MAAM,GAAG,CAAC,GAA4B,EAA2B,EAAE;gBACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;gBAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CACb,8CAA8C,SAAS,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI;wBAChF,sCAAsC,QAAQ,QAAQ;wBACtD,yBAAyB,SAAS,sDAAsD;wBACxF,0EAA0E,CAC3E,CAAA;gBACH,CAAC;gBACD,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;YAC1C,CAAC,CAAA;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAClC,CAAC,CAAE,MAAoC,CAAC,GAAG,CAAC,MAAM,CAAC;gBACnD,CAAC,CAAC,MAAM,CAAC,MAAiC,CAAC,CAAA;YAC7C,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAE,CAAC,MAAM,CAAC,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;YACjB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CACJ,+CAA+C,YAAY,CAAC,KAAgB,CAAC,GAAG,EAChF,qBAAqB,KAAK,CAAC,SAAS,+BAA+B,CACpE,CAAA;YACH,CAAC;YACD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAE,CAAC,CAAC,EAAW,EAAE,EAAE;oBACzC,MAAM,IAAI,GAAI,MAAgB,CAAC,kBAAkB,CAAC,EAAY,EAAE,MAAM,CAAC,CAAC,CAAA;oBACxE,YAAY,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAA;oBAC/C,OAAO,IAAI,CAAA;gBACb,CAAC,CAAC,CAAC,CAAA;YACL,CAAC;YACD,YAAY,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAA;YACjD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAE,CAAC,MAAM,CAAC,CAAC,CAAA;QACrC,CAAC;QACD,qBAAqB,EAAE,GAAG,EAAE;YAC1B,CAAC,CAAC,uBAAuB,CAAE,EAAE,CAAA;YAC7B,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAC,CAAC,CAAA;AACL,CAAC;AAED,SAAS,UAAU,CAAC,MAAW,EAAE,MAAc;IAC7C,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAE,CAAC,KAAK,EAAE,SAAS,CAI5C,CAAA;QACD,MAAM,KAAK,GAAG,CAAC,EAAS,EAAE,EAAE,CAAC,CAAC,IAAa,EAAE,EAAE;YAC7C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,UAAU;gBACpC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAW,EAAE,EAAE;oBACjB,MAAM,MAAM,GAAI,IAAc,CAAC,kBAAkB,CAAC,EAAY,EAAE,MAAM,CAAC,CAAC,CAAA;oBACxE,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;oBAC5C,OAAO,MAAM,CAAA;gBACf,CAAC,CAAC;gBACJ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;YACrC,OAAO,GAAG,CAAA;QACZ,CAAC,CAAA;QACD,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1D,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;SACjE,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,QAAQ,CAAC,MAAW,EAAE,MAAc;IAC3C,MAAM,KAAK,GAA0B,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,UAAU;YAAE,SAAQ;QAChD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,GAAG,IAAI,CAAW,EAAE,MAAM,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;QAC3C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC7B,OAAO,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,KAAK,CAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACzE,CAAC,CAAA;IACH,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;QAC3C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC7B,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,KAAK,CAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC,CAAA;IACH,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;QAC3C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC7B,OAAO,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,KAAK,CAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACzE,CAAC,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,SAAS,CAAC,MAAW,EAAE,MAAc;IAC5C,OAAO;QACL,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;QACjC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;oBAC7E,MAAM,CAAC,QAAQ,EAAE,sDAAsD,CAAC,CAAA;gBAC1E,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAE,CAAC,GAAG,IAAI,CAAQ,EAAE,MAAM,CAAC,CAAA;QAC1D,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAU,EAAE,MAAc;IACpD,MAAM,MAAM,GAAG,EAAS,CAAA;IACxB,MAAM,KAAK,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;IAC3E,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAA;YAC9E,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAM,EAAE,MAAc;IACtC,MAAM,MAAM,GAAG,EAAoB,CAAA;IACnC,MAAM,KAAK,GAA0B;QACnC,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAC3B,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;QAC5B,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAc,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACzG,OAAO,MAAM,CAAC,QAAQ,CAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QACD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,aAAa,CAAE,CAAC,CAAC,EAAW,EAAE,EAAE,CAAE,QAAkB,CAAC,QAAQ,CAAC,EAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC;KACnG,CAAA;IACD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE;YACtB,MAAM,IAAI,KAAK,CACb,mFAAmF;gBACnF,+EAA+E;gBAC/E,+DAA+D;gBAC/D,+EAA+E;gBAC/E,oDAAoD,CACrD,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAA;gBAClD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;oBACrB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAuB,CAAA;oBACvE,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC3C,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;4BACnB,GAAG;gCACD,MAAM,CAAC,+BAA+B,EAAE,4CAA4C,CAAC,CAAA;4BACvF,CAAC;yBACF,CAAC,CAAA;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC5C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAM;IACxC,OAAO,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAM,EAAE,QAAgB;IACrD,OAAO,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAA;AAC7C,CAAC"}

package/dist/data/db/db.d.ts

@@ -4,13 +4,9 @@ export declare namespace pipe {
     var transaction: <T>(nameOrFn: string | ((tx: DB) => Promise<T>), maybeFnOrConfig?: ((tx: DB) => Promise<T>) | TransactionConfig, maybeConfig?: TransactionConfig) => Promise<T>;
 }
 /**
- * The unwrapped database handle — bypasses the scoped/guard proxies that
- * normally wrap `pipe()`. The audit-write CTE path uses this to run the
- * compiled statement via `.execute()`, which the scoped proxy refuses (CTEs
- * bypass per-table tenant filtering by design). The compiled SQL is already
- * tenant-scoped at compile time when `ctx.tenant !== null` — the audit CTE
- * is built against the scoped `pipe()` DB, so the user write inside the CTE
- * picks up the tenant filter naturally; this raw handle is only the carrier.
+ * The unwrapped database handle: no tenant filter on anything it builds. Only a
+ * carrier for statements already compiled against the scoped `pipe()` db, such
+ * as the audit-write CTE, which the scoped connection cannot `.execute()`.
  */
 export declare function pipeRaw(name?: string): DB;
 /**

package/dist/data/db/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../../src/data/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAqBvD,wBAAgB,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,EAAE,CAQtC;yBARe,IAAI;sBA6D0B,CAAC,YACnC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,oBACzB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,gBAChD,iBAAiB,KAC9B,OAAO,CAAC,CAAC,CAAC;;AAvDb;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,EAAE,CAEzC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,EAAE,CAY5C"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../../src/data/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAqBvD,wBAAgB,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,EAAE,CAQtC;yBARe,IAAI;sBAyD0B,CAAC,YACnC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,oBACzB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,gBAChD,iBAAiB,KAC9B,OAAO,CAAC,CAAC,CAAC;;AAnDb;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,EAAE,CAEzC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,EAAE,CAY5C"}

package/dist/data/db/db.js

@@ -23,13 +23,9 @@ export function pipe(name) {
     return createTenantGuardDb(db);
 }
 /**
- * The unwrapped database handle — bypasses the scoped/guard proxies that
- * normally wrap `pipe()`. The audit-write CTE path uses this to run the
- * compiled statement via `.execute()`, which the scoped proxy refuses (CTEs
- * bypass per-table tenant filtering by design). The compiled SQL is already
- * tenant-scoped at compile time when `ctx.tenant !== null` — the audit CTE
- * is built against the scoped `pipe()` DB, so the user write inside the CTE
- * picks up the tenant filter naturally; this raw handle is only the carrier.
+ * The unwrapped database handle: no tenant filter on anything it builds. Only a
+ * carrier for statements already compiled against the scoped `pipe()` db, such
+ * as the audit-write CTE, which the scoped connection cannot `.execute()`.
  */
 export function pipeRaw(name) {
     return resolveDb(name);

package/dist/data/db/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/data/db/db.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAC7E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AAEpF,SAAS,SAAS,CAAC,IAAa;IAC9B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAA;IACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAE3D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAChD,IAAI,KAAK,EAAE,CAAC;QACV,wBAAwB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;QAClD,OAAO,KAAK,CAAC,OAAO,CAAA;IACtB,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;IACpD,OAAO,IAAI,CAAC,OAAO,CAAA;AACrB,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAa;IAChC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE1B,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,mBAAmB,CAAC,EAAE,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,IAAa;IACnC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAA;IAEtE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAChD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACpD,OAAO,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAA;IACtD,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;AACxD,CAAC;AAGD,IAAI,CAAC,WAAW,GAAG,KAAK,UAAU,WAAW,CAC3C,QAA2C,EAC3C,eAA8D,EAC9D,WAA+B;IAE/B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAE5B,IAAI,YAAoB,CAAA;IACxB,IAAI,EAA0B,CAAA;IAC9B,IAAI,MAAqC,CAAA;IAEzC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAA;QACxD,EAAE,GAAG,QAAQ,CAAA;QACb,MAAM,GAAG,eAAgD,CAAA;IAC3D,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,QAAQ,CAAA;QACvB,EAAE,GAAG,eAAyC,CAAA;QAC9C,MAAM,GAAG,WAAW,CAAA;IACtB,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,wBAAwB,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,gFAAgF;QAChF,6EAA6E;QAC7E,6EAA6E;QAC7E,OAAO,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC1D,MAAM,QAAQ,GAAG;gBACf,GAAG,GAAG;gBACN,YAAY,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC;aACxC,CAAA;YACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;YACrF,OAAO,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC3D,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,sCAAsC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAE3D,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG;YACf,GAAG,GAAG;YACN,YAAY,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC;SACxC,CAAA;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/E,MAAM,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;QAChD,OAAO,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7C,CAAC,EAAE,MAAM,CAAC,CAAA;AACZ,CAAC,CAAA"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/data/db/db.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAC7E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AAEpF,SAAS,SAAS,CAAC,IAAa;IAC9B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAA;IACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAE3D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAChD,IAAI,KAAK,EAAE,CAAC;QACV,wBAAwB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;QAClD,OAAO,KAAK,CAAC,OAAO,CAAA;IACtB,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;IACpD,OAAO,IAAI,CAAC,OAAO,CAAA;AACrB,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAa;IAChC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE1B,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,mBAAmB,CAAC,EAAE,CAAC,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,IAAa;IACnC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAA;IAEtE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAChD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACpD,OAAO,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAA;IACtD,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;AACxD,CAAC;AAGD,IAAI,CAAC,WAAW,GAAG,KAAK,UAAU,WAAW,CAC3C,QAA2C,EAC3C,eAA8D,EAC9D,WAA+B;IAE/B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAE5B,IAAI,YAAoB,CAAA;IACxB,IAAI,EAA0B,CAAA;IAC9B,IAAI,MAAqC,CAAA;IAEzC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAA;QACxD,EAAE,GAAG,QAAQ,CAAA;QACb,MAAM,GAAG,eAAgD,CAAA;IAC3D,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,QAAQ,CAAA;QACvB,EAAE,GAAG,eAAyC,CAAA;QAC9C,MAAM,GAAG,WAAW,CAAA;IACtB,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,wBAAwB,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,gFAAgF;QAChF,6EAA6E;QAC7E,6EAA6E;QAC7E,OAAO,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC1D,MAAM,QAAQ,GAAG;gBACf,GAAG,GAAG;gBACN,YAAY,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC;aACxC,CAAA;YACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;YACrF,OAAO,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC3D,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,sCAAsC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAE3D,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG;YACf,GAAG,GAAG;YACN,YAAY,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC;SACxC,CAAA;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/E,MAAM,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;QAChD,OAAO,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7C,CAAC,EAAE,MAAM,CAAC,CAAA;AACZ,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pipework",
-  "version": "0.190.0",
+  "version": "0.191.0",
   "description": "TypeScript framework for multi-tenant SaaS applications. PostgreSQL-only.",
   "type": "module",
   "license": "MIT",