pipework 0.198.0 → 0.200.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.200.0
+
+- **Added: platform mode, so tenant data is reached by no BYPASSRLS role at runtime** (#759).
+  - Set per database `systemUrl` / `systemTestUrl` and `rls.platformRole`. `pipe.system()` and pipework's own runtime connections then run on that platform role:
+    - trace, worker and queue, scheduler, health, quota, rate limits, faults, cache, RBAC and the storage sweep;
+    - the role must not be BYPASSRLS.
+  - Only `pipework migrate` and the trace-partition and audit-chain DDL use the owner. Pass `pool.getOrCreate(cfg, 'owner', '<label>')` there.
+  - Startup refuses a platform role that is SUPERUSER, has BYPASSRLS or does not match `rls.platformRole`. Without platform mode, behaviour is unchanged, and a database with `rls` logs one warning that its system channel bypasses RLS.
+- **Added: doors, named cross-tenant reads.** `doors: { 'admission.ledger': { table, reason } }` generates a SELECT policy on that one table, `TO <platformRole>`. It opens only while `pipework.door` is set to the door's name.
+  - `pipe.door(name, db => …)` runs one transaction with the door set. Its `db` can read the door's table and non-tenant tables, and refuses any other tenant table and any write at build time.
+  - A tenant-table statement through `pipe.system()` in platform mode is refused at build time, naming the table and `pipe.door`.
+  - `pipework check` lists the doors and the runtime role.
+- **Pipework's own doors:** `pipework.storage_sweep` (SELECT and DELETE on `storage_file`) and `pipework.queue.<table>` (SELECT and UPDATE, for queues with a tenant column). They are generated in platform mode. App door names may not start with `pipework.`.
+  - The storage sweep refuses, removing nothing, if its door's policies are missing.
+- **Changed in platform mode only:**
+  - Cache loaders and RBAC resolution run with the tenant set.
+  - `pipe()` / `pipeRaw()` with no bound transaction refuses when a tenant is in context; use `pipe.transaction` or the request's transaction.
+  - `pipework db setup` creates the platform role and grants it the runtime privileges.
+- **Not covered by doors:** limiting a door to some of a table's columns.
+
+## 0.199.0
+
+- **Added: a process that is not a pipework surface can record faults and loop beats** (#769). Before this, `alerts.recordFault` outside a Flow did nothing unless a worker surface had registered a target. Now:
+  - **`alerts.useFaultTarget(manifold | db | () => db)`:** a custom drain registers once at boot. It returns the release to call at shutdown. A manifold without `alerts` registers nothing.
+  - **`alerts.recordFaultFor(manifold, kind, message, context?)`:** writes a fault from code that holds the manifold.
+  - **`alerts.recordBeat(manifold, name, { ok, error?, everyMs })`:** your own loop beats for `alerts.source.loopStalled`, recorded outside any Flow.
+- **Changed: a fault with nowhere to go is no longer silent.** When there is no Flow and no registered target, `recordFault` logs one warning per kind: `fault "<kind>" dropped: no Flow and no fault target; call alerts.useFaultTarget(manifold) at boot`.
+
 ## 0.198.0
 
 - **Added: a queue job's claim history** (#765). Queue tables gain `claims jsonb NOT NULL DEFAULT '[]'`.

package/REFERENCE.md

@@ -730,6 +730,59 @@ Database accessor — returns a Drizzle DB instance scoped to the current reques
 
 The system channel — deliberate cross-tenant access for pre-tenant surfaces (auth membership resolution, public webhook ingress, admin tooling). Never tenant-scoped or tenant-guarded; runs on the owner-role connection outside the request transaction.
 
+That holds where the database has no `rls.platformRole`. Where the owner role has BYPASSRLS, every system-channel statement bypasses row-level security; at startup a database with `rls` and no platform role logs one warning saying so (not an error).
+
+With `rls.platformRole` set (platform mode), `pipe.system()` runs on the `systemUrl` connection, as that role, outside the request transaction. The role must have no SUPERUSER or BYPASSRLS; startup refuses a `systemUrl` role that has either, or whose `current_user` is not `rls.platformRole`. The handle refuses at build time any statement built over a tenant-scoped table, naming the table and pointing at `pipe.door`. A table with no tenant (auth registry, queues, `pipework_*` tables) reads and writes as before, on the role's grants. `db.execute(sql...)` cannot be inspected; a raw statement over a tenant table returns no rows, because no policy admits the platform role without a door. Under collapsed test isolation the same guards apply on the test connection.
+
+### `pipe.door`
+
+`pipe.door(name, fn, options?: { database? })` — a named cross-tenant read for platform work with no requesting tenant (sweeps, integrity checks, reaper reads). It needs an active Flow and `rls.platformRole` on the door's database; outside platform mode it throws, naming the database.
+
+Declare each door in config, by name:
+
+```ts
+createManifold({
+  databases: {
+    app: {
+      url: 'DATABASE_URL',
+      systemUrl: 'SYSTEM_DATABASE_URL',      // connection as the platform role
+      systemTestUrl: 'SYSTEM_DATABASE_URL_TEST',
+      rls: { platformRole: 'app_platform' },  // NOSUPERUSER NOBYPASSRLS
+    },
+  },
+  doors: {
+    'admission.ledger': { table: 'walk_job_costs', reason: 'admission reads every tenant\'s spend' },
+  },
+})
+
+const rows = await pipe.door('admission.ledger', db => db.select().from(walkJobCosts))
+```
+
+A door name is lowercase dotted words (`/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$/`). `table` is the SQL table name; `database` defaults to the default database; `reason` is required. Config refuses, at load: a door on a database with no `rls.platformRole`; `systemUrl` without `rls.platformRole`; `rls.platformRole` without `systemUrl`.
+
+`pipework generate` writes, for each door, `CREATE POLICY "pipework_door_<name, . as __>" ON <table> AS PERMISSIVE FOR SELECT TO <platformRole> USING (current_setting('pipework.door', true) = '<name>')`. Doors are recorded in the migration snapshot: adding one, removing one, or changing its table or the platform role makes the next `generate` emit the matching `CREATE POLICY` or `DROP POLICY IF EXISTS`, even when no table changed. A door on a table that is not tenant-scoped in any definition is refused by name at generate: such a table is not row-secured and needs no door.
+
+`fn(db)` runs in one transaction on the system connection; the transaction first runs `set_config('pipework.door', name, true)`, so the door is open for that transaction only, and `pipe.door` resolves with `fn`'s result. `db` allows `select` from the door's table and from any table with no tenant. It refuses at build time any other tenant-scoped table (naming the table and the door) and `insert`, `update` and `delete` on the door's table. An undeclared name throws, listing the declared doors. Column limiting is out of scope: a door opens the whole table to SELECT for the transaction. `pipework check` lists the declared doors as `name -> database.table: reason`.
+
+**pipework's own doors.** Where the default database has `rls.platformRole` and the blueprint has `storage: {}`, pipework declares the door `pipework.storage_sweep` on `storage_file` itself. It is the only door that also deletes: `pipework generate` writes two policies for it, `FOR SELECT` and `FOR DELETE`, both `TO <platformRole>` and open on the door setting. It is recorded in the snapshot like an app door. App config may not declare a name starting `pipework.`; config refuses it. `pipework check` lists it, marked `(pipework's own)`. `storage.sweep()` runs its expiry delete, its read of referenced files and its per-object re-check (with the content lock) inside that door. Before listing any object it checks `pg_policy` for both policies and throws by name, removing nothing, if either is missing, because without the door the sweep would see no file referencing any object. Run `pipework generate` and `pipework migrate` after turning platform mode on. Outside platform mode the sweep is unchanged.
+
+`pipework db setup` creates the platform role like the runtime role (LOGIN, a generated password, NOBYPASSRLS), grants it the same table and sequence privileges and default privileges, and writes `systemUrl`/`systemTestUrl` to `.env`. The test template creates `rls.platformRole` NOLOGIN, never BYPASSRLS, before its migrations run, and grants it to the test login. Under collapsed test isolation the door runs on the test connection, each statement bracketed with `pipework.door` and the test-only system policy open, so the test connection reads the door's table across tenants; the build-time guards are the same.
+
+#### Platform mode: the runtime role
+
+In platform mode a running manifold opens no connection on the database's owner role (`url`). `pool.getOrCreate(config)` with no role resolves to `'system'` (the platform role, `systemUrl`) where the database sets `rls.platformRole`, and to `'owner'` otherwise; `getOrCreate(config, 'owner', label)` still gives the owner, and in platform mode logs one info line naming `label`. `pool.ownerConnectionsCreated()` counts the owner connections a pool has created; a running platform-mode manifold keeps it at 0. `pipework check` prints `runtime role: <platformRole> (owner used only for: migrate, trace-partition-maintenance)`.
+
+What runs on the platform role: trace open, flush, close, truncate and copy-on-error; faults, loop beats and alert sources; the worker's LISTEN, claim loop, reaper and scheduler; the step-graph dead letter; the storage sweep (through `pipework.storage_sweep`); startup and `/ready` database checks (and the startup connectivity probe, which dials `systemUrl`); quota; rate-limit classes; `AuthContext.db`; `pipework alerts stale` and `unit-fault`. Their tables carry no tenant column, or the framework policies (insert for anyone; read and update for a transaction that sets `pipework.maintenance`, which these paths already do). Their grants are the platform role's, written by `pipework db setup`.
+
+Tenant tables are read with the tenant set. Where a database is in platform mode:
+- cache loaders (`cache.create`, `cache.createTenant`) and RBAC resolution for a route's `.permission()` run their statements in a short transaction on the platform connection that first sets `rls.sessionVar` to the tenant (the Flow's, or for `cache.createTenant` the tenant asked for; for RBAC the request's). With no tenant in the Flow a cache loader runs on the platform connection as is, and tenant tables return nothing.
+- `pipe()`, `pipeRaw()` and a handler's database dependency with no bound transaction use the pooled platform connection. With no tenant in the Flow they run as is: a table with no tenant reads, a tenant table returns nothing. With a tenant in the Flow they throw, naming `pipe.transaction` and the request or job transaction: the tenant setting is set per transaction, and a builder runs its statement unwrapped on the connection it was made from. Inside a request, a job or `pipe.transaction` the tenant is set as always.
+- `inTenant`, which the access-link, storage, support and credits `...For` forms use, runs on the platform connection without the system channel's build-time guard, with the tenant set for the transaction.
+
+A queue whose `exclusion.tenantColumn` is set has a tenant-secured table that claim and reap scan across tenants. In platform mode pipework declares the framework door `pipework.queue.<table>` for it, one of pipework's own doors (like `pipework.storage_sweep`, same snapshot `ops`, same `(pipework's own)` line in `pipework check`): `FOR SELECT` and `FOR UPDATE` policies (`..._update`) to the platform role that open while `pipework.door` names it. No DELETE: a queue never deletes a row. Queue tables register when a worker surface or step graph is constructed, so the door is declared from the loaded app, not from config. The worker runs claim, reap, heartbeat, complete, fail, later and hand-back through it, each in its own transaction with the door set. `queue.door` is its name, `null` for a queue with no tenant column. A scheduled job on a tenant-column queue cannot be enqueued by the scheduler (it has no tenant to give), as before.
+
+The owner stays for DDL: `pipework migrate` and `pipework generate` (the migrate runner opens it as `migrate`), and trace and audit partition maintenance (`createTracePartitionStartupHook`, `scheduleTracePartitionMaintenance`, `syncTracePartitions`, `installAuditChain`, `retireAuditPartition`), which take the `db` the app hands them: pass `pool.getOrCreate(config, 'owner', 'trace-partition-maintenance')`. A manifold that must not hold the owner at runtime runs partition maintenance from a process that does. The `app` role still falls back to `url` when `appUrl` is unset; set `appUrl` so the request path is not the owner either.
+
 ### `pipe.filter`
 
 Query operators and aggregates — eq, gt, lt, and, or, count, sum, etc.
@@ -1792,6 +1845,9 @@ Pass in `sources`; each raises with a fixed key on a tick and, where it can tell
 - `alerts.source.traces({ graceMs? = 93_600_000, settleMs?, severity?, owner?, runbook?, database? })` — `trace-expired:<entryKind>` for traces the expiry sweep force-closed since the last tick (read from `closed_at` where `status = 'expired'`); `trace-expiry-undrained:all` while open traces are more than `graceMs` (default 26 h, as the maintenance job is daily) past `expires_at`, meaning the expiry job is not running. Needs the `trace` block in the blueprint.
 - `alerts.source.faults({ kinds?, settleMs?, severity? = 'error', owner?, runbook?, database? })` — failures that code swallowed and only logged, recorded in `pipework_faults` (comes with the `alerts` blueprint flag; not tenant-scoped): `fault:<kind>`, message `<count> <kind> fault(s); last: <message>`, context `count`, `lastMessage`, `lastContext`; clears by the quiet period. `kinds` limits it. Pipework records `audit-write` (alert, auth, email, storage, support audit writes and read touches), `quota-record`, `credits-callback`, `trace-steps-lost`, `trace-write`, `trace-record`, `support-inbound-untenanted`, `queue-listener`, `queue-reaper`, `queue-heartbeat`, `scheduler`, `job-event-callback`, `queue-handback`, `step-graph-on-failed`, `inbound-raw-delete`, `access-link-on-miss` and `client-fault-raise`.
 - `alerts.recordFault(kind, message, context?)` — records a failure your own code swallowed so the faults source can raise it: `void alerts.recordFault('webhook-parse', err.message, { id })` next to the log line. Best effort: never throws (a failed write is one `log.warn`), does nothing where the blueprint has no `alerts`, writes on the system connection outside the caller's transaction (so a rollback keeps it), stores the current tenant, cuts `message` at 2000 characters, and redacts email addresses from message and context before storing. Rows older than `occurrenceRetentionMs` are pruned by the tick, as occurrences are. `kind` is a short stable name.
+- `alerts.useFaultTarget(manifold | db | () => db)` — registers where `alerts.recordFault` writes when it runs outside any Flow, for a process that is not a pipework surface (a custom queue drain). Call it once at boot and keep the release for shutdown: `const release = alerts.useFaultTarget(manifold)` ... `release()`. A manifold resolves lazily to its default database and registers nothing (the release is a no-op) where the blueprint has no `alerts`. With no Flow and no target, `recordFault` writes nothing and logs one warn per kind per process: `fault "<kind>" dropped: no Flow and no fault target; call alerts.useFaultTarget(manifold) at boot`.
+- `alerts.recordFaultFor(manifold, kind, message, context?)` — `recordFault` for code that holds the manifold: writes on its default database with no Flow and no registered target; never warns, does nothing without `alerts`.
+- `alerts.recordBeat(manifold, name, { ok, error?, everyMs })` — one iteration of a background loop of your own, for `alerts.source.loopStalled` to raise when it stops. Works outside any Flow on the manifold's default database; best effort, never throws, does nothing without `alerts`.
 - `queue.totals(db)` — `{ overall, byType }`, each `{ ready, running, oldestReadyWaitMs }` (ready: pending and not waiting on a retry time; running: claimed or running; wait from `queued_at`, null when none is ready); `byType` omits a type with neither.
 - `alerts.source.health(checks, { severity? = 'error' })` — `health:<name>` while a `HealthCheck` is unhealthy or throws; resolves when it recovers. Degraded is not a fault.
 

package/dist/REFERENCE.md

@@ -1,7 +1,7 @@
 # Pipework API Reference
 
 > Auto-generated from source JSDoc. Do not edit manually.
-> Generated: 2026-10-20
+> Generated: 2026-10-09
 
 ## Contents
 
@@ -10,7 +10,6 @@
 - [jobs — Background Jobs](#jobs-background-jobs)
 - [pipeline — Multi-Step Pipelines](#pipeline-multi-step-pipelines)
 - [state — State Machines](#state-state-machines)
-- [steps](#steps)
 - [auth — Authentication](#auth-authentication)
 - [rbac — Access Control](#rbac-access-control)
 - [tenant — Multi-Tenancy](#tenant-multi-tenancy)
@@ -31,9 +30,7 @@
 - [cache — Caching](#cache-caching)
 - [credits](#credits)
 - [mail](#mail)
-- [untrustedFetch](#untrustedfetch)
 - [storage](#storage)
-- [support](#support)
 - [webhook — Inbound & Outbound Webhooks](#webhook-inbound-outbound-webhooks)
 - [behavior — Resource Decorators](#behavior-resource-decorators)
 - [fitting — Dependency Injection](#fitting-dependency-injection)
@@ -88,18 +85,6 @@ function createManifold<const TEnv extends EnvDefs = EnvDefs>( raw: Omit<Bluepri
 interface Manifold<TEnv extends EnvDefs = EnvDefs>
 ```
 
-**`ScriptOptions`** — Options for {@link Manifold.script}.
-
-```typescript
-interface ScriptOptions
-```
-
-**`StartOptions`** — Options for {@link Manifold.start}.
-
-```typescript
-interface StartOptions
-```
-
 **`SeedOptions`** — ALS context the {@link Manifold.seed} callback runs under — tenant scope, auth principal, and job type.
 
 ```typescript
@@ -244,14 +229,6 @@ Creates a job queue with claim/complete/fail lifecycle, heartbeat, and dead lett
 
 Executes a fitting handler as a background job with its own Flow context.
 
-### `jobs.later`
-
-The error to throw to end an attempt as "later": pending again after `delayMs`, no attempt counted.
-
-### `jobs.permanent`
-
-The error to throw to dead-letter the job now, whatever attempts remain.
-
 ### `jobs.parseCron`
 
 Parses a 5-field cron expression into a CronSchedule (minute, hour, dom, month, dow).
@@ -292,14 +269,6 @@ Thrown when a transition is not allowed from the current state.
 
 Thrown when the state machine definition is internally inconsistent.
 
-## steps
-
-Step graphs over a job queue: results recorded by their inputs, only missing steps run.
-
-### `steps.define`
-
-Defines a graph of named steps over a jobs Queue. Pass it to `createWorkerSurface({ graphs })` to run its steps.
-
 ## auth — Authentication
 
 Authentication namespace — session management, multi-org support, auth chain resolution.
@@ -320,10 +289,6 @@ Hashes and verifies passwords with scrypt; reports when a stored hash needs reha
 
 Guarded password sign-in that slows, then refuses, repeated failures per account and per client.
 
-### `auth.emailLinks`
-
-Emailed single-use links that prove control of an address: password reset and address verification; the token is never stored.
-
 ### `auth.runChain`
 
 Executes an auth chain (strategy pipeline) to resolve auth + tenant from a request.
@@ -358,7 +323,7 @@ interface AuthContext
 interface AuthStrategy<TAuth>
 ```
 
-**`AuthRequest`** — Normalized request shape passed to auth strategies — headers, the parsed `Cookie` header, and the upper-case HTTP method.
+**`AuthRequest`** — Normalized request shape passed to auth strategies — headers, cookies, method, url.
 
 ```typescript
 interface AuthRequest
@@ -388,18 +353,6 @@ interface TenantResolver<TAuth>
 interface AuthChainConfig<TAuth>
 ```
 
-**`SessionAuth`** — What `sessions.strategy()` authenticates: the token's user and org, its roles, and where the token came from.
-
-```typescript
-type SessionAuth = BaseAuth &
-```
-
-**`SessionStrategyOptions`** — Options for `sessions.strategy()`.
-
-```typescript
-interface SessionStrategyOptions
-```
-
 **`SessionConfig`** — Session configuration — signing keys, issuer, audience, token TTLs, refresh rotation.
 
 ```typescript
@@ -671,10 +624,6 @@ Base error class with code, statusCode, and suggestion fields.
 
 403 — authenticated but insufficient permissions.
 
-### `errors.CrossSiteRequest`
-
-403 `CROSS_SITE_REQUEST` — a cookie-authenticated write that did not come from the app's own site.
-
 ### `errors.Validation`
 
 422 — input validation failed, carries field-level details.
@@ -695,17 +644,13 @@ Base error class with code, statusCode, and suggestion fields.
 
 415 — request body media type not accepted by the route.
 
-### `errors.MalformedMultipart`
-
-400 `MALFORMED_MULTIPART` — a multipart body that cannot be parsed or ends before its closing boundary.
-
 ## lifecycle — Startup & Shutdown
 
 Application lifecycle namespace — startup orchestration with hooks and timeouts.
 
 ### `lifecycle.orchestrate`
 
-Runs pre-start hooks (DB readiness checks, migrations, etc.) with a configurable timeout. The hooks run in one trace that names the process; the trace-partition hook runs first, outside it.
+Runs pre-start hooks (DB readiness checks, migrations, etc.) with a configurable timeout.
 
 ## log — Structured Logging
 
@@ -745,7 +690,7 @@ Creates a worker surface — a long-running process that claims and executes job
 
 ### `surface.script`
 
-Creates a script surface — a one-shot process that runs and exits (migrations, seeds, CLI tools). The run is traced as a job-kind trace that names the surface.
+Creates a script surface — a one-shot process that runs and exits (migrations, seeds, CLI tools).
 
 ## pipe — Database
 
@@ -842,7 +787,7 @@ Pipework-owned UPDATE builder — the only consumer-facing way to update pipewor
 
 ### `pipe.insert`
 
-Pipework-owned INSERT builder — the only consumer-facing way to insert into pipework-managed tables (Q8). A list of any size is split into statements under Postgres's parameter limit, in one transaction.
+Pipework-owned INSERT builder — the only consumer-facing way to insert into pipework-managed tables (Q8).
 
 ### `pipe.delete`
 
@@ -850,7 +795,7 @@ Pipework-owned DELETE builder — the only consumer-facing way to delete from pi
 
 ### `pipe.upsert`
 
-Pipework-owned UPSERT builder — insert with conflict resolution (Q8). A list of any size is split into statements under Postgres's parameter limit, in one transaction; rows repeating a conflict key across statements do not fail as one statement would.
+Pipework-owned UPSERT builder — insert with conflict resolution (Q8).
 
 ### Types
 
@@ -1002,14 +947,6 @@ Query all versions of temporal records (no date filter).
 
 Close the current version and create a new one with updated data.
 
-### `temporal.setVersion`
-
-Append the next version of an append-only-versions definition: serialised per scope, numbered, never back-dated, audited.
-
-### `temporal.versionAt`
-
-The version in force at a moment: the row with the greatest effectiveFrom at or before it.
-
 ## valve
 
 Valve namespace — typed, directional, gated boundaries between code silos.
@@ -1192,18 +1129,6 @@ Alerts namespace — raise and resolve keyed conditions, grouped, delivered to s
 
 Creates an alerts handle.
 
-### `alerts.http`
-
-Routes for an operations agent: list, get, totals, delivery health, acknowledge, resolve, link; bearer credentials.
-
-### `alerts.clientFaults`
-
-One POST route that records failures reported by browser code as a trace step and an alert; answers 204, no session needed. Send with `reportClientFault` from `pipework/client`.
-
-### `alerts.requestFaults`
-
-An `onInternalError` hook for the HTTP server: raises `request-fault:<METHOD> <route>` for each internal 500.
-
 ### `alerts.webhook`
 
 A sink that POSTs the alert as signed JSON to a URL.
@@ -1236,10 +1161,6 @@ The newest record's `{ seq, hash }` in the tenant's audit hash chain (blueprint
 
 Walks the tenant's audit hash chain and reports the first break (hash-mismatch, prev-mismatch, missing, head-mismatch, anchor-mismatch), or `{ ok: true }`.
 
-### `audit.removeTenant`
-
-Deletes every audit record of one tenant and its hash chain, for the closure of that tenant's account. Irreversible; returns the number of records removed. Other tenants' records and chains are untouched.
-
 ## cache — Caching
 
 In-memory caching namespace — TTL-based with stats, preload, and tenant-aware variants.
@@ -1292,36 +1213,6 @@ Inbound source: SES receipt rule storing raw messages in S3 and notifying a sign
 
 Inbound development source: `.eml` files dropped in a folder, received by `scan()`; refused in production.
 
-## untrustedFetch
-
-Untrusted fetch — fetch one URL a stranger gave without letting them reach the app's private network.
-
-### `untrustedFetch.get`
-
-Fetches `url` with GET and returns `{ ok: true, url, status, contentType, body, bytes }`, or `{ ok: false, reason, message }`
-naming the rule that refused: `scheme`, `address`, `redirects`, `too_large`, `timeout`, `status`, `rejected` or `network`.
-It does not throw for these.
-
-Rules, none of which can be switched off: only `http:` and `https:`; the name is resolved and every address is checked
-(loopback, private, link-local including cloud metadata, CGNAT, unique-local and site-local IPv6, multicast, reserved,
-unspecified, and IPv4-mapped or NAT64 forms of these; literal IP URLs likewise) and the connection goes to a checked
-address; redirects are followed up to `maxRedirects` and each hop is checked as the first, and the app's `headers` go only to the first origin;
-the body is stopped the moment it passes `maxBytes`, whatever Content-Length says; `timeoutMs` covers the whole fetch.
-`accept({ status, contentType, firstBytes })` sees the first 1024 bytes before the body is kept: return false, or a string
-(your own message), to refuse with `rejected`. Messages never contain an address or anything a server sent.
-
-`resolve` and `connect` are for tests: `resolve(hostname)` replaces DNS and `connect(target)` replaces the socket after the
-address check passed, so a test sends a fake public address to a local server. The address check always runs on what `resolve` returns.
-
-The call is the trace step `pipework/fetch:get`; its child `pipework/fetch:outcome` carries host, status, bytes and reason.
-The full URL is recorded only when `urlIsSafeToTrace` is true; otherwise only the host.
-
-```ts
-const got = await untrustedFetch.get(pasted, { maxBytes: 5_000_000, timeoutMs: 10_000, maxRedirects: 3,
-  accept: h => h.firstBytes[0] === 0x25 || 'That does not look like a PDF.' })
-if (!got.ok) return tell(got.message)
-```
-
 ## storage
 
 Storage namespace — tenant-scoped, content-addressed file storage with signed URLs and retention.
@@ -1338,18 +1229,6 @@ S3-compatible backend (AWS S3, MinIO, R2): SigV4 over `fetch`, multipart streami
 
 Local-disk backend for development and tests; refused in production.
 
-## support
-
-Support namespace — tickets from email (and later chat), with replies sent only after an approval.
-
-### `support.create`
-
-Creates the support handle: tickets, messages, notes, links, drafts, `approve`, `receiveEmail`, and the events job.
-
-### `support.templates`
-
-The reply template to spread into `mail.create({ templates })`; it renders the approved draft verbatim.
-
 ## webhook — Inbound & Outbound Webhooks
 
 Webhook namespace — inbound verification, outbound delivery with retries, HMAC signing.
@@ -1440,10 +1319,6 @@ Returns the current Flow or undefined — use for optional context detection.
 
 Creates a Flow for test isolation with optional auth and tenant overrides.
 
-### `flow.actAs`
-
-Runs `fn` as a tenant and user chosen inside a tenantless Flow (sign-up, a public sign-in): RLS, audit and trace under that tenant, on the request's transaction.
-
 ## http — Server
 
 HTTP namespace: `http.file()` builds a file response; the server itself is managed by manifold.start().
@@ -1468,36 +1343,6 @@ interface SecurityConfig
 interface RateLimitConfig
 ```
 
-**`RateLimitWindow`** — One fixed window: at most `max` requests per `windowSeconds`.
-
-```typescript
-interface RateLimitWindow
-```
-
-**`RateLimitClass`** — A named limit class: any of a per-user, per-tenant and per-address window, each counted on its own.
-
-```typescript
-interface RateLimitClass
-```
-
-**`RateLimitRefusal`** — What `onRefused` is told about one refused window of one request.
-
-```typescript
-interface RateLimitRefusal
-```
-
-**`RateLimitClassesConfig`**
-
-Named limit classes, checked after auth and counted in Postgres (`pipework_rate_limit_counts`, opted in
-with the blueprint's `rateLimits: {}`), so every server process on the same database shares one count.
-Windows are counted perUser, perTenant, perAddress in turn, up to the first one over its max, so one user's
-refused requests don't spend the tenant's budget. A route is in `signedIn` (auth required, or optional with
-a user), `public` (no auth, or optional without a user) or the class its fitting names with `.rateLimit(name)`.
-
-```typescript
-interface RateLimitClassesConfig
-```
-
 **`InjectOptions`** — Options for server.inject() — method, url, headers, payload for testing without HTTP.
 
 ```typescript
@@ -1516,12 +1361,6 @@ interface InjectResponse
 interface ServerConfig
 ```
 
-**`InternalErrorFault`** — What `onInternalError` is told about one request that ended in an internal error.
-
-```typescript
-interface InternalErrorFault
-```
-
 **`HandlerResponse`** — Standard handler response shape — statusCode, headers, body.
 
 ```typescript
@@ -1580,7 +1419,7 @@ Generates an OpenAPI 3.1 document from route registrations — schemas derived f
 
 ## trace
 
-Trace namespace — hand the current trace to a process outside Node, record the steps it reports back, mark point events, and read a trace tree.
+Trace namespace — hand the current trace to a process outside Node and record the steps it reports back.
 
 ### `trace.traceparent`
 
@@ -1594,15 +1433,6 @@ W3C `traceparent` for the current trace and open step; `null` outside a traced f
 
 Records steps reported as JSON lines (or objects) by an outside process under the step open now. Synchronous; never throws.
 
-### `trace.event`
-
-Records one zero-length step `external:<name>` under the step open now, with an optional `capture` and `error`. A no-op outside a traced flow; never throws.
-
-### `trace.tree`
-
-Reads every hot trace sharing `rootId` (a request's trace and the jobs it queued) with their steps. Runs on the
-given `db`, so tenant policies apply: only an unrestricted connection (table owner, tests) sees every tenant's rows.
-
 ### Types
 
 **`FlowStepMeta`** — Trace metadata for one documented flow-step: its `path:symbol` graph node id and the per-argument capture projections.
@@ -1623,24 +1453,6 @@ type ExternalStepReport = z.infer<typeof externalStepReportSchema>
 interface ExternalRecordResult
 ```
 
-**`TraceStepNode`** — One step of a trace. `ref` is the flow step's `path:symbol`, or `external:<name>` for a recorded or point-event step.
-
-```typescript
-interface TraceStepNode
-```
-
-**`TraceNode`** — One trace of the tree, with its steps ordered by `seq`.
-
-```typescript
-interface TraceNode
-```
-
-**`TraceTree`** — The traces that share a root id, ordered by when they opened.
-
-```typescript
-interface TraceTree
-```
-
 ## data
 
 ### `tap`

package/dist/async/jobs/queue-door.d.ts

@@ -0,0 +1,20 @@
+import type { ResolvedDoor } from '../../core/config/load.js';
+/** The framework door a tenant-column queue table's claim, reap, heartbeat and complete run through. */
+export declare function queueDoorName(table: string): string;
+/** A queue only selects and updates its rows: it never deletes one. */
+export declare function queueFrameworkDoor(table: string, database: string): ResolvedDoor;
+/**
+ * The queue doors pipework declares: one per registered queue table with a
+ * tenant column, where the default database sets `rls.platformRole`. Queue
+ * tables register when a worker surface or graph is constructed, so ask after
+ * the app's modules are loaded.
+ */
+export declare function queueFrameworkDoors(config: {
+    defaultDatabaseName(): string;
+    database(name?: string): {
+        readonly rls?: {
+            readonly platformRole?: string;
+        } | undefined;
+    };
+}): Record<string, ResolvedDoor>;
+//# sourceMappingURL=queue-door.d.ts.map

package/dist/async/jobs/queue-door.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue-door.d.ts","sourceRoot":"","sources":["../../../src/async/jobs/queue-door.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAI7D,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CAMhF;AAKD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,mBAAmB,IAAI,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE;YAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAA;KAAE,CAAA;CAC3F,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAa/B"}

package/dist/async/jobs/queue-door.js

@@ -0,0 +1,38 @@
+import { queueDefinitions } from './table.js';
+/** The framework door a tenant-column queue table's claim, reap, heartbeat and complete run through. */
+export function queueDoorName(table) {
+    return `pipework.queue.${table}`;
+}
+/** A queue only selects and updates its rows: it never deletes one. */
+export function queueFrameworkDoor(table, database) {
+    return Object.freeze({
+        name: queueDoorName(table), table, database,
+        reason: 'the queue claims, reaps and completes jobs across tenants',
+        framework: true, ops: ['select', 'update'],
+    });
+}
+const hasTenant = (definition) => Object.values(definition.$fields).some(field => field._meta.tenant === true);
+/**
+ * The queue doors pipework declares: one per registered queue table with a
+ * tenant column, where the default database sets `rls.platformRole`. Queue
+ * tables register when a worker surface or graph is constructed, so ask after
+ * the app's modules are loaded.
+ */
+export function queueFrameworkDoors(config) {
+    const out = {};
+    let database;
+    try {
+        database = config.defaultDatabaseName();
+    }
+    catch {
+        return out;
+    }
+    if (config.database(database).rls?.platformRole === undefined)
+        return out;
+    for (const [table, definition] of queueDefinitions()) {
+        if (hasTenant(definition))
+            out[queueDoorName(table)] = queueFrameworkDoor(table, database);
+    }
+    return out;
+}
+//# sourceMappingURL=queue-door.js.map

package/dist/async/jobs/queue-door.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue-door.js","sourceRoot":"","sources":["../../../src/async/jobs/queue-door.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C,wGAAwG;AACxG,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,kBAAkB,KAAK,EAAE,CAAA;AAClC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,QAAgB;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ;QAC3C,MAAM,EAAE,2DAA2D;QACnE,SAAS,EAAE,IAAa,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAU;KAC7D,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,UAAwB,EAAW,EAAE,CACtD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAGnC;IACC,MAAM,GAAG,GAAiC,EAAE,CAAA;IAC5C,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,YAAY,KAAK,SAAS;QAAE,OAAO,GAAG,CAAA;IACzE,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACrD,IAAI,SAAS,CAAC,UAAU,CAAC;YAAE,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/async/jobs/queue.d.ts

@@ -141,6 +141,11 @@ export interface QueueTotals {
 export interface Queue {
     /** The queue table as a pipe.define() definition — `pipework generate` emits its DDL. */
     readonly definition: DefinedTable;
+    /**
+     * The framework door (`pipework.queue.<table>`) that claim, reap, heartbeat and complete need on a platform-mode
+     * database; null when the queue has no `exclusion.tenantColumn`, whose table is not row-secured by tenant.
+     */
+    readonly door: string | null;
     enqueue(db: DB, opts: EnqueueOptions): Promise<string>;
     /** Claims the next eligible job (of one of `types`, when given), retrying transient conflicts until clean. The signal ends the retry loop on shutdown — claim resolves null promptly. */
     claim(db: DB, workerId: string, signal?: AbortSignal, types?: readonly string[], release?: string | null): Promise<ClaimedJob | null>;

package/dist/async/jobs/queue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../../src/async/jobs/queue.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAO,MAAM,wBAAwB,CAAA;AAGrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAG9D,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAE1E,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAElF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAO3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAA;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,4GAA4G;AAC5G,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,MAAM,CAAA;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAA;IAChC,gIAAgI;IAChI,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,uHAAuH;IACvH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAA;CACrC;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;IACzC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,8GAA8G;IAC9G,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,0HAA0H;IAC1H,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;CACxC;AAED,2HAA2H;AAC3H,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAC3B;AAED,4FAA4F;AAC5F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED,gGAAgG;AAChG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAA;AAExC,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,+HAA+H;IAC/H,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,uIAAuI;IACvI,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,OAAO,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;IACnH,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAA;IACrC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,6GAA6G;IAC7G,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAA;CACrC;AAED,4GAA4G;AAC5G,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAAA;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAC3B;AAED,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAAA;IACzC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,CAAA;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,gJAAgJ;AAChJ,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1C;AAED,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;CAC3D;AAED,iGAAiG;AACjG,MAAM,WAAW,KAAK;IACpB,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAA;IACjC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACtD,yLAAyL;IACzL,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IACrI;;;;OAIG;IACH,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxF,kIAAkI;IAClI,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClH,wHAAwH;IACxH,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IACtI,gLAAgL;IAChL,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxF,mHAAmH;IACnH,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,gJAAgJ;IAChJ,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACjD,wGAAwG;IACxG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAC1D,0JAA0J;IAC1J,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACpC,yGAAyG;IACzG,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAClC;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAA;IAClF,iBAAiB,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACtE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACxF,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD,+HAA+H;IAC/H,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACrG,oIAAoI;IACpI,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACnD,gJAAgJ;IAChJ,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACnE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClD,aAAa,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC9C,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACrD,aAAa,IAAI,IAAI,CAAA;CACtB;AA6BD,wBAAgB,WAAW,CAAC,MAAM,GAAE,WAAgB,GAAG,KAAK,CAqhB3D"}
+{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../../src/async/jobs/queue.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAO,MAAM,wBAAwB,CAAA;AAGrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAG9D,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAE1E,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAElF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAQ3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAA;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,4GAA4G;AAC5G,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,MAAM,CAAA;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAA;IAChC,gIAAgI;IAChI,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,uHAAuH;IACvH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAA;CACrC;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;IACzC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,8GAA8G;IAC9G,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,0HAA0H;IAC1H,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;CACxC;AAED,2HAA2H;AAC3H,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAC3B;AAED,4FAA4F;AAC5F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED,gGAAgG;AAChG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAA;AAExC,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,+HAA+H;IAC/H,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,uIAAuI;IACvI,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,OAAO,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;IACnH,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAA;IACrC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,6GAA6G;IAC7G,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAA;CACrC;AAED,4GAA4G;AAC5G,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAAA;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAC3B;AAED,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAAA;IACzC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,CAAA;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,gJAAgJ;AAChJ,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1C;AAED,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;CAC3D;AAED,iGAAiG;AACjG,MAAM,WAAW,KAAK;IACpB,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAA;IACjC;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACtD,yLAAyL;IACzL,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IACrI;;;;OAIG;IACH,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxF,kIAAkI;IAClI,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClH,wHAAwH;IACxH,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IACtI,gLAAgL;IAChL,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxF,mHAAmH;IACnH,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,gJAAgJ;IAChJ,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACjD,wGAAwG;IACxG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAC1D,0JAA0J;IAC1J,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACpC,yGAAyG;IACzG,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAClC;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAA;IAClF,iBAAiB,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACtE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACxF,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD,+HAA+H;IAC/H,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACrG,oIAAoI;IACpI,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACnD,gJAAgJ;IAChJ,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACnE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClD,aAAa,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC9C,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACrD,aAAa,IAAI,IAAI,CAAA;CACtB;AA6BD,wBAAgB,WAAW,CAAC,MAAM,GAAE,WAAgB,GAAG,KAAK,CAshB3D"}

package/dist/async/jobs/queue.js

@@ -8,6 +8,7 @@ import { resolveExclusion, exclusionClaimClause } from './exclusion.js';
 import { openClaim, closeClaim, parseClaims } from './claims.js';
 import { serializeError } from './serialize-error.js';
 import { queueDefinition, registerProgressColumn } from './table.js';
+import { queueDoorName } from './queue-door.js';
 import { getContext } from '../../request/context/store.js';
 import { resolveActorId } from '../../data/write/audit/actor.js';
 import { getBaseLogger } from '../../core/logging/index.js';
@@ -469,6 +470,7 @@ export function createQueue(config = {}) {
     const sched = createScheduler({ enqueue }, tableQ);
     return {
         definition,
+        door: exclusion?.tenantColumn !== undefined ? queueDoorName(table) : null,
         onDeadLetter(listener) {
             deadLetterListeners.add(listener);
             return () => { deadLetterListeners.delete(listener); };