pipework 0.56.2 → 0.57.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.57.1
+
+- **Fix: the built-in `trace`, `trace_step`, `trace_retained`, `trace_step_retained` and `audit_record` tables had no row-level security.** With `rls` configured on the default database, a query on them under the app role returned every tenant's rows. `pipework migrate` (and the test template) now enables RLS on each, forced when `rls.force` is on, with the same tenant rule as an application table: a tenant reads and updates only rows whose `tenant_id` is its own, and rows with no tenant are visible to no tenant. Inserts stay open to the framework. `trace_step` and `trace_step_retained` gain a nullable `tenant_id`, stamped from the trace; `migrate` adds it to an existing table, and steps written before it are not visible under RLS. The framework's own cross-tenant passes (closing a trace, copy-on-error, `expireStaleTraces`, audit partition retirement, `audit.verify` of the tenantless chain) run with the transaction-local setting `pipework.maintenance`; application code must not set it. Run `pipework migrate` to apply the policies to an existing database. Closing a trace and the other framework writes now go through a short transaction.
+- **Fix: retiring an audit partition could take tens of seconds with a few hundred partitions.** Postgres JIT-compiled the pruning query; it is now run with JIT off.
+
+## 0.57.0
+
+**Can break on upgrade:** a `@touches` entity must now match a defined table (or a table's `auditEntity`), or the first write in that step throws naming the entity and the closest tables. Rename the entity or set `auditEntity` before upgrading.
+
+- **Fix: `.returning()` under an audited step returned raw database rows.** A `pipe.insert`, `update`, `delete` or `upsert` run inside a step with `@touches` gave back snake_case keys and timestamps, bigints and json as the driver's strings. Rows are now decoded through the table's columns, so the result is identical with and without an audited step, chunked or not, for `.returning()` and for a per-key `.returning({ ... })`.
+- **Fix: `@touches` audited every write in the step under every declared entity, whatever table it hit.** A step declaring `Version:update` that also updated a `Document` wrote an audit row for the `Document` update under `Version`. A write is now audited only under the touches whose entity is the written table: the definition's new `auditEntity` option (`define(name, fields, { auditEntity: 'Version' })`) matching exactly, otherwise the table name matching ignoring case and underscores, optionally plural (`Version` matches `versions`; `DocumentVersion` matches `document_versions`). A write to a table no touch matches is not audited; a touch no write was audited under gets its read row when the step completes, per touch; and a write under a touch whose entity matches no defined table throws, naming the closest tables. **Behaviour change:** a step whose touch names an entity that is not a table name (for example `Item` on `audit_test_items`) now throws on its first write: set `auditEntity` on the table or rename the entity.
+
 ## 0.56.2
 
 - **Fix: `@flow_step` and `@touches` annotations are now applied at runtime.** The annotations were parsed by `pipework check` but nothing wrapped the functions, so annotated code recorded no `trace_step` and no `audit_record` (with `audit: { chain: true }`, a `pipe.update` under `@touches` left no audit row). Annotated functions are now wrapped with `__flowStep` automatically under `pipework test` and the vitest preset, and under `pipework dev` and `pipework serve`, with no change to app code; `@touches` targets are carried into the step. The `ref` is the file's path relative to the directory holding `pipework.config.ts` (the one `pipework check` runs from), plus the function name. A `@flow_step` that cannot be wrapped (a default export, a method) now fails the load with its file and line instead of running unwrapped. Stack-trace line numbers inside an annotated file can shift. An app built with plain `tsc` is not wrapped: run it through `pipework serve`, or wrap with `__flowStep` by hand.

package/REFERENCE.md

@@ -480,6 +480,16 @@ Returns the SQL string for a tenant isolation RLS policy — use in migrations.
 
 Cross-checks the ALS principal (tenant, user, asOf) against the Postgres session GUCs — defense-in-depth.
 
+#### Built-in tables
+
+When the default database configures `rls`, `pipework migrate` and the test template give `trace`, `trace_step`, `trace_retained`, `trace_step_retained` and `audit_record` row-level security (enabled, and forced when `rls.force` is on) with three policies per table: `pipework_tenant_read` (SELECT) and `pipework_tenant_update` (UPDATE) admit a row whose `tenant_id` equals the session setting `rls.sessionVar`, and `pipework_tenant_insert` (INSERT) admits any row. Rows with no tenant are visible to no tenant. There is no DELETE policy: retention drops partitions, and `audit_record` is append-only. The policies are replaced on every `migrate`, so an existing database gets them by running it again. `trace_step` and `trace_step_retained` carry a nullable `tenant_id` (the trace's tenant), added to an existing table by `migrate`; steps written before it have none and are invisible under RLS.
+
+A read of these tables sees a tenant's rows only on a connection that carries the tenant setting: inside the request transaction, or `pipe.transaction`. On a pooled connection with no setting a tenant query returns nothing, as for any application table.
+
+Inserts are framework-only by convention: the policy cannot tell the framework's trace and audit writes (which run on pooled connections, for any tenant or none) from application code, so app code must not insert into these tables.
+
+The setting `pipework.maintenance` = `on` makes a transaction see and update every tenant's rows. The framework sets it, transaction-locally, and only in: closing or truncating a trace, copy-on-error, `expireStaleTraces`, retiring an audit partition in `syncTracePartitions`, and `audit.verify` of the tenantless chain. Application code must not set it.
+
 ### `tenant.propagate`
 
 Sets pipework.tenant_id on the Postgres connection via set_config().
@@ -699,7 +709,7 @@ Field builders for domain definitions — uuid(), text(), integer(), etc.
 
 ### `pipe.define`
 
-Registers a domain definition with table, validators, and factory projections.
+Registers a domain definition with table, validators, and factory projections. The `auditEntity` option names the `@touches` entity writes to this table are audited under (see `__flowStep`).
 
 ### `pipe.definitions`
 
@@ -1318,6 +1328,8 @@ Wraps `impl` so that, under an active traced Flow, each call records a `trace_st
 
 A function documented with `@flow_step` (and `@touches Entity:verb`) is wrapped automatically: under `pipework test` and the vitest preset, and under `pipework dev` and `pipework serve`. An app built with plain `tsc` gets no wrapping: run it through `pipework serve`, or call `__flowStep` by hand.
 
+* A write under a step with `@touches` is audited only under the touches whose entity is the written table, one `audit_record` per affected row per matching touch. A touch's `Entity` matches a table when the definition declares `define(name, fields, { auditEntity })` equal to `Entity` exactly; otherwise when the names agree ignoring case and underscores, with the table name optionally plural (`Version` matches `version` and `versions`; `DocumentVersion` matches `document_versions`). A write to a table no touch matches is not audited. A touch that no write of the step was audited under gets a read row (`before` and `after` null) when the step completes. A write under a step with a touch whose entity matches no defined table throws, naming the closest table names. `.returning()` returns the same rows with or without an audited step.
+
 ```typescript
 function __flowStep<F extends AnyFunction>(meta: FlowStepMeta, impl: F): F
 ```

package/dist/audit/chain/retire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../../src/audit/chain/retire.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAGhD,uFAAuF;AACvF,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAMlE;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa/E"}
+{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../../src/audit/chain/retire.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAGhD,uFAAuF;AACvF,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAMlE;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB/E"}

package/dist/audit/chain/retire.js

@@ -20,6 +20,10 @@ export async function auditChainInstalled(db) {
  * to. A chain with no rows left keeps just its highest retired entry.
  */
 export async function retireAuditPartition(tx, child) {
+    // The pruning DELETE below scans every audit partition; with a few hundred
+    // partitions Postgres spends tens of seconds JIT-compiling it (measured 10s
+    // with no row-level security, 20s with it) to save milliseconds.
+    await tx.execute(sql `SELECT set_config('jit', 'off', true)`);
     await tx.execute(sql.raw(`INSERT INTO ${CHAIN_RETIRED_TABLE} (chain_key, seq, hash) ` +
         `SELECT ${CHAIN_KEY_SQL}, chain_seq, decode(hash, 'hex') FROM ${child} ` +
         `WHERE chain_seq IS NOT NULL ON CONFLICT DO NOTHING`));

package/dist/audit/chain/retire.js.map

@@ -1 +1 @@
-{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../../src/audit/chain/retire.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,4EAA4E;AAC5E,2CAA2C;AAE3C,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEnF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAM;IAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;yBACV,gBAAgB;yBAChB,mBAAmB;GACzC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,IAAI,CAAA;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAM,EAAE,KAAa;IAC9D,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CACtB,eAAe,mBAAmB,0BAA0B;QAC5D,UAAU,aAAa,yCAAyC,KAAK,GAAG;QACxE,oDAAoD,CACrD,CAAC,CAAA;IACF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC,CAAA;IAC1D,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CACtB,eAAe,mBAAmB,4BAA4B;QAC9D,mDAAmD;QACnD,SAAS,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,+CAA+C;QACzG,2BAA2B,mBAAmB,sCAAsC,CACrF,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../../src/audit/chain/retire.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,4EAA4E;AAC5E,2CAA2C;AAE3C,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEnF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAM;IAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;yBACV,gBAAgB;yBAChB,mBAAmB;GACzC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,IAAI,CAAA;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAM,EAAE,KAAa;IAC9D,2EAA2E;IAC3E,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,uCAAuC,CAAC,CAAA;IAC5D,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CACtB,eAAe,mBAAmB,0BAA0B;QAC5D,UAAU,aAAa,yCAAyC,KAAK,GAAG;QACxE,oDAAoD,CACrD,CAAC,CAAA;IACF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC,CAAA;IAC1D,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CACtB,eAAe,mBAAmB,4BAA4B;QAC9D,mDAAmD;QACnD,SAAS,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,+CAA+C;QACzG,2BAA2B,mBAAmB,sCAAsC,CACrF,CAAC,CAAA;AACJ,CAAC"}

package/dist/audit/chain/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/audit/chain/verify.ts"],"names":[],"mappings":"AAoBA,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,qBAAqB,GAC7B,eAAe,GACf,eAAe,GACf,SAAS,GACT,eAAe,GACf,iBAAiB,CAAA;AAErB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAA;IAClB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CACjC;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAA;AAsBrF;;;GAGG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAEhE;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgIzF"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/audit/chain/verify.ts"],"names":[],"mappings":"AAqBA,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,qBAAqB,GAC7B,eAAe,GACf,eAAe,GACf,SAAS,GACT,eAAe,GACf,iBAAiB,CAAA;AAErB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAA;IAClB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CACjC;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAA;AAsBrF;;;GAGG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAEhE;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAWzF"}

package/dist/audit/chain/verify.js

@@ -7,6 +7,7 @@
 import { auditRecord } from '../schema/audit-record.js';
 import { pipeRaw } from '../../data/db/db.js';
 import { sql } from '../../data/db/sql.js';
+import { withMaintenance } from '../../data/db/maintenance.js';
 import { getContext } from '../../request/context/store.js';
 import { ValidationError } from '../../core/errors/index.js';
 import { CHAIN_HEAD_TABLE, CHAIN_RETIRED_TABLE, CHAIN_KEY_SQL, NULL_TENANT_CHAIN_KEY, } from './install.js';
@@ -46,6 +47,12 @@ export async function verify(options = {}) {
     }
     const db = pipeRaw(auditRecord.$options.database);
     const key = chainKey();
+    // Rows with no tenant are visible to no tenant setting, so the tenantless chain is read as a maintenance pass.
+    if (key === NULL_TENANT_CHAIN_KEY)
+        return withMaintenance(db, tx => verifyChain(tx, key, options));
+    return verifyChain(db, key, options);
+}
+async function verifyChain(db, key, options) {
     const keyMatch = sql `${sql.raw(CHAIN_KEY_SQL)} = ${key}::uuid`;
     const bounded = options.toSeq !== undefined || options.to !== undefined;
     const head = await readHead(db, key);

package/dist/audit/chain/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/audit/chain/verify.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAC9E,kBAAkB;AAElB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,GACtB,MAAM,cAAc,CAAA;AAuCrB,MAAM,UAAU,GAAG,IAAI,CAAA;AACvB,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEnC,SAAS,QAAQ;IACf,OAAO,UAAU,EAAE,EAAE,MAAM,IAAI,qBAAqB,CAAA;AACtD,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,GAAW;IACzC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;mDACgB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC;wBACpD,GAAG;GACxB,CAAC,CAAA;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAW,EAAE,CAAA;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,OAAO,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,UAA8B,EAAE;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAU,EAAE,CAAC;QAC9F,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,eAAe,CAAC,iBAAiB,IAAI,oCAAoC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvG,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;IACtB,MAAM,QAAQ,GAAG,GAAG,CAAA,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAA;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,CAAA;IAEvE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAEpC,8BAA8B;IAC9B,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAA;IAC7B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;oCACE,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,sBAAsB,GAAG;KACpF,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;YAEzB,QAAQ;GACjB,CAAC,CAAA;IACF,4FAA4F;IAC5F,IAAI,EAAE,GAAG,IAAI,KAAK,IAAI;QACpB,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACjG,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;cAEpB,QAAQ,iDAAiD,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE;KAC5F,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;QAChG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;cAEpB,QAAQ,gDAAgD,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE;KACzF,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;QAChG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEnD,8FAA8F;IAC9F,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;mDACS,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC;wBACvD,GAAG,qBAAqB,EAAE,GAAG,CAAC,eAAe,EAAE;GACpE,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAiB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,CAAA;IAErG,IAAI,IAAwB,CAAA;IAC5B,IAAI,EAAE,KAAK,CAAC;QAAE,IAAI,GAAG,YAAY,CAAA;SAC5B,CAAC;QACJ,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;8CACU,QAAQ,oBAAoB,EAAE,GAAG,CAAC;OACzE,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAuB,CAAA;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,IAAI,GAA0B,IAAI,CAAA;IACtC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,QAAuB,EAAE,MAA6B,EAAqB,EAAE,CACtG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAE5D,OAAO,QAAQ,IAAI,EAAE,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;cAIxB,QAAQ,uBAAuB,QAAQ,uBAAuB,EAAE;;cAEhE,UAAU;KACnB,CAAC,CAAA;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,QAAQ,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAClC,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC9D,IAAI,GAAG,IAAI,CAAA;YACb,CAAC;YACD,MAAK;QACP,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;YAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAW,CAAA;YAC9B,OAAO,QAAQ,GAAG,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAClC,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC9D,IAAI,GAAG,IAAI,CAAA;YACb,CAAC;YACD,IAAI,GAAG,GAAG,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;YACzD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;YACjE,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;YAC7D,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;YACpE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAW,CAAA;YAC5B,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;YAC1B,OAAO,EAAE,CAAA;YACT,QAAQ,GAAG,GAAG,GAAG,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,IAAI,MAAM,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,IAAI,CAAA;QACzB,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI;YACpF,CAAC,GAAG,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QACpC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;4CACU,QAAQ,oBAAoB,GAAG;;wCAEnC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,sBAAsB,GAAG,oBAAoB,GAAG;KAC/G,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAA;IACrF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACpC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAM,EAAE,GAAW;IAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;mDACgB,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC;wBACvD,GAAG;GACxB,CAAC,CAAA;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAW,EAAE,CAAA;AAC3F,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/audit/chain/verify.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAC9E,kBAAkB;AAElB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,GACtB,MAAM,cAAc,CAAA;AAuCrB,MAAM,UAAU,GAAG,IAAI,CAAA;AACvB,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEnC,SAAS,QAAQ;IACf,OAAO,UAAU,EAAE,EAAE,MAAM,IAAI,qBAAqB,CAAA;AACtD,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,GAAW;IACzC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;mDACgB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC;wBACpD,GAAG;GACxB,CAAC,CAAA;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAW,EAAE,CAAA;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,OAAO,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,UAA8B,EAAE;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAU,EAAE,CAAC;QAC9F,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,eAAe,CAAC,iBAAiB,IAAI,oCAAoC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvG,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;IACtB,+GAA+G;IAC/G,IAAI,GAAG,KAAK,qBAAqB;QAAE,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;IAClG,OAAO,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,GAAW,EAAE,OAA2B;IACzE,MAAM,QAAQ,GAAG,GAAG,CAAA,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAA;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,CAAA;IAEvE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAEpC,8BAA8B;IAC9B,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAA;IAC7B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;oCACE,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,sBAAsB,GAAG;KACpF,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;YAEzB,QAAQ;GACjB,CAAC,CAAA;IACF,4FAA4F;IAC5F,IAAI,EAAE,GAAG,IAAI,KAAK,IAAI;QACpB,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACjG,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;cAEpB,QAAQ,iDAAiD,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE;KAC5F,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;QAChG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;cAEpB,QAAQ,gDAAgD,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE;KACzF,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;QAChG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEnD,8FAA8F;IAC9F,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;mDACS,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC;wBACvD,GAAG,qBAAqB,EAAE,GAAG,CAAC,eAAe,EAAE;GACpE,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAiB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,CAAA;IAErG,IAAI,IAAwB,CAAA;IAC5B,IAAI,EAAE,KAAK,CAAC;QAAE,IAAI,GAAG,YAAY,CAAA;SAC5B,CAAC;QACJ,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;8CACU,QAAQ,oBAAoB,EAAE,GAAG,CAAC;OACzE,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAuB,CAAA;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,IAAI,GAA0B,IAAI,CAAA;IACtC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,QAAuB,EAAE,MAA6B,EAAqB,EAAE,CACtG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAE5D,OAAO,QAAQ,IAAI,EAAE,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;cAIxB,QAAQ,uBAAuB,QAAQ,uBAAuB,EAAE;;cAEhE,UAAU;KACnB,CAAC,CAAA;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,QAAQ,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAClC,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC9D,IAAI,GAAG,IAAI,CAAA;YACb,CAAC;YACD,MAAK;QACP,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;YAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAW,CAAA;YAC9B,OAAO,QAAQ,GAAG,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAClC,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC9D,IAAI,GAAG,IAAI,CAAA;YACb,CAAC;YACD,IAAI,GAAG,GAAG,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;YACzD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;YACjE,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;YAC7D,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,eAAe,CAAC,CAAA;YACpE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAW,CAAA;YAC5B,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;YAC1B,OAAO,EAAE,CAAA;YACT,QAAQ,GAAG,GAAG,GAAG,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,IAAI,MAAM,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,IAAI,CAAA;QACzB,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI;YACpF,CAAC,GAAG,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QACpC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;4CACU,QAAQ,oBAAoB,GAAG;;wCAEnC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,sBAAsB,GAAG,oBAAoB,GAAG;KAC/G,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAA;IACrF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACpC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAM,EAAE,GAAW;IAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;mDACgB,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC;wBACvD,GAAG;GACxB,CAAC,CAAA;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAW,EAAE,CAAA;AAC3F,CAAC"}

package/dist/auth/tenant/rls.d.ts

@@ -7,6 +7,17 @@ import type { DB } from '../../data/db/index.js';
  * layer rejects it before reaching here (see rls-generate.ts).
  */
 export type TenantKeyType = 'uuid' | 'text' | 'integer' | 'bigint';
+/**
+ * The USING predicate of a tenant isolation policy.
+ *
+ * The cast (`::uuid` etc.) is required: current_setting returns text, and
+ * Postgres will not implicitly compare `uuid = text`. NULLIF(...,'') means an
+ * unset or explicitly-empty session GUC yields NULL — a deny-by-default match —
+ * instead of throwing on `''::uuid`. (current_setting(var, true) is itself NULL
+ * when the GUC was never set; the NULLIF only guards the empty-string case that
+ * set_config can produce.)
+ */
+export declare function tenantUsingClause(column: string, keyType: TenantKeyType, sessionVar: string): string;
 export declare function tenantIsolationPolicy(table: string, column?: string, keyType?: TenantKeyType, sessionVar?: string, force?: boolean): string;
 export declare function enableTenantRls(db: DB, table: string, column?: string, keyType?: TenantKeyType, force?: boolean): Promise<void>;
 /** The principal axes carried on the request/job context and propagated as GUCs. */

package/dist/auth/tenant/rls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/rls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAIhD;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAA;AAqBlE,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAoB,EAC5B,OAAO,GAAE,aAAsB,EAC/B,UAAU,GAAE,MAA6B,EACzC,KAAK,GAAE,OAAc,GACpB,MAAM,CAUR;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAoB,EAC5B,OAAO,GAAE,aAAsB,EAC/B,KAAK,GAAE,OAAc,GACpB,OAAO,CAAC,IAAI,CAAC,CASf;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAoBf"}
+{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/rls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAIhD;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAA;AAMlE;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGpG;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAoB,EAC5B,OAAO,GAAE,aAAsB,EAC/B,UAAU,GAAE,MAA6B,EACzC,KAAK,GAAE,OAAc,GACpB,MAAM,CAUR;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAoB,EAC5B,OAAO,GAAE,aAAsB,EAC/B,KAAK,GAAE,OAAc,GACpB,OAAO,CAAC,IAAI,CAAC,CASf;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/auth/tenant/rls.js

@@ -14,7 +14,7 @@ function tenantPolicyName(table) {
  * when the GUC was never set; the NULLIF only guards the empty-string case that
  * set_config can produce.)
  */
-function tenantUsingClause(column, keyType, sessionVar) {
+export function tenantUsingClause(column, keyType, sessionVar) {
     const c = quoteIdentifier(column, 'column');
     return `${c} = NULLIF(current_setting('${sessionVar}', true), '')::${keyType}`;
 }

package/dist/auth/tenant/rls.js.map

@@ -1 +1 @@
-{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../../src/auth/tenant/rls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAWtD,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,6BAA6B,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAA;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,MAAc,EAAE,OAAsB,EAAE,UAAkB;IACnF,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3C,OAAO,GAAG,CAAC,8BAA8B,UAAU,kBAAkB,OAAO,EAAE,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,SAAiB,WAAW,EAC5B,UAAyB,MAAM,EAC/B,aAAqB,oBAAoB,EACzC,QAAiB,IAAI;IAErB,sBAAsB,CAAC,UAAU,CAAC,CAAA;IAElC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAEzC,OAAO;QACL,eAAe,CAAC,4BAA4B;QAC5C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,iBAAiB,eAAe,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG;KACxI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa,EACb,SAAiB,WAAW,EAC5B,UAAyB,MAAM,EAC/B,QAAiB,IAAI;IAErB,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,UAAU,GAAG,eAAe,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAA;IAErE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAA;IACvE,IAAI,KAAK;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAA;IACjF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CACtB,iBAAiB,UAAU,OAAO,CAAC,WAAW,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAC1G,CAAC,CAAA;AACJ,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;mDAGc,CAAC,CAAA;IAClD,MAAM,GAAG,GAAI,MAAsG,CAAC,CAAC,CAAC,CAAA;IAEtH,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,QAAQ,CAAC,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;IAC1I,IAAI,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAChI,IAAI,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAE1H,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,6EAA6E;YAC7E,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM;YAC9B,oEAAoE;YACpE,qFAAqF,CACtF,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gCAAgC;AAChC,SAAS,YAAY,CAAC,GAA8B;IAClD,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,CAAA;IACrB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAkB,EAAE,EAAiB;IACrE,OAAO,KAAK,IAAI,2BAA2B,GAAG,IAAI,QAAQ,0BAA0B,EAAE,IAAI,QAAQ,EAAE,CAAA;AACtG,CAAC"}
+{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../../src/auth/tenant/rls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAWtD,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,6BAA6B,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAA;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAAsB,EAAE,UAAkB;IAC1F,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3C,OAAO,GAAG,CAAC,8BAA8B,UAAU,kBAAkB,OAAO,EAAE,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,SAAiB,WAAW,EAC5B,UAAyB,MAAM,EAC/B,aAAqB,oBAAoB,EACzC,QAAiB,IAAI;IAErB,sBAAsB,CAAC,UAAU,CAAC,CAAA;IAElC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAEzC,OAAO;QACL,eAAe,CAAC,4BAA4B;QAC5C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,iBAAiB,eAAe,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG;KACxI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa,EACb,SAAiB,WAAW,EAC5B,UAAyB,MAAM,EAC/B,QAAiB,IAAI;IAErB,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,UAAU,GAAG,eAAe,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAA;IAErE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAA;IACvE,IAAI,KAAK;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAA;IACjF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CACtB,iBAAiB,UAAU,OAAO,CAAC,WAAW,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAC1G,CAAC,CAAA;AACJ,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,QAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;mDAGc,CAAC,CAAA;IAClD,MAAM,GAAG,GAAI,MAAsG,CAAC,CAAC,CAAC,CAAA;IAEtH,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,QAAQ,CAAC,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;IAC1I,IAAI,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAChI,IAAI,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAE1H,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,6EAA6E;YAC7E,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM;YAC9B,oEAAoE;YACpE,qFAAqF,CACtF,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gCAAgC;AAChC,SAAS,YAAY,CAAC,GAA8B;IAClD,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,CAAA;IACrB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAkB,EAAE,EAAiB;IACrE,OAAO,KAAK,IAAI,2BAA2B,GAAG,IAAI,QAAQ,0BAA0B,EAAE,IAAI,QAAQ,EAAE,CAAA;AACtG,CAAC"}

package/dist/data/db/maintenance.d.ts

@@ -0,0 +1,10 @@
+import type { DB } from './index.js';
+export declare const MAINTENANCE_SETTING = "pipework.maintenance";
+/** The policy predicate that admits a maintenance transaction. */
+export declare const MAINTENANCE_CLAUSE = "current_setting('pipework.maintenance', true) = 'on'";
+/**
+ * Runs `fn` in a transaction (a savepoint when `db` is already one) with the
+ * maintenance setting on, and puts the previous value back when `fn` returns.
+ */
+export declare function withMaintenance<T>(db: DB, fn: (tx: DB) => Promise<T>): Promise<T>;
+//# sourceMappingURL=maintenance.d.ts.map

package/dist/data/db/maintenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../../src/data/db/maintenance.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAEpC,eAAO,MAAM,mBAAmB,yBAAyB,CAAA;AAEzD,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,yDAA2D,CAAA;AAE1F;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CASvF"}

package/dist/data/db/maintenance.js

@@ -0,0 +1,24 @@
+// The maintenance setting: lets framework passes that must read or update the
+// built-in trace and audit tables across tenants (closing a trace, expiring
+// stale ones, retiring an audit partition, verifying the tenantless chain)
+// satisfy those tables' row-level security policies. Set transaction-locally,
+// by the framework only; application code must never set it.
+import { sql } from './sql.js';
+export const MAINTENANCE_SETTING = 'pipework.maintenance';
+/** The policy predicate that admits a maintenance transaction. */
+export const MAINTENANCE_CLAUSE = `current_setting('${MAINTENANCE_SETTING}', true) = 'on'`;
+/**
+ * Runs `fn` in a transaction (a savepoint when `db` is already one) with the
+ * maintenance setting on, and puts the previous value back when `fn` returns.
+ */
+export async function withMaintenance(db, fn) {
+    return db.transaction(async (raw) => {
+        const tx = raw;
+        const before = await tx.execute(sql `SELECT current_setting(${MAINTENANCE_SETTING}, true) AS v`);
+        await tx.execute(sql `SELECT set_config(${MAINTENANCE_SETTING}, 'on', true)`);
+        const result = await fn(tx);
+        await tx.execute(sql `SELECT set_config(${MAINTENANCE_SETTING}, ${before[0]?.['v'] ?? ''}, true)`);
+        return result;
+    });
+}
+//# sourceMappingURL=maintenance.js.map

package/dist/data/db/maintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.js","sourceRoot":"","sources":["../../../src/data/db/maintenance.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,6DAA6D;AAE7D,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAG9B,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAA;AAEzD,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,mBAAmB,iBAAiB,CAAA;AAE1F;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,EAAM,EAAE,EAA0B;IACzE,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;QAChC,MAAM,EAAE,GAAG,GAAoB,CAAA;QAC/B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,0BAA0B,mBAAmB,cAAc,CAAC,CAAA;QAC/F,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,qBAAqB,mBAAmB,eAAe,CAAC,CAAA;QAC5E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QAC3B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,qBAAqB,mBAAmB,KAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAmB,IAAI,EAAE,SAAS,CAAC,CAAA;QACpH,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/data/db/namespace.d.ts

@@ -144,7 +144,7 @@ export declare const pipe: typeof getDb & {
         pgLsn(): import("../domain/types.js").FieldDescriptor<string, {}> & import("../domain/field.js").FieldModifiers<string, {}>;
         custom<S extends import("zod/v4").ZodType>(column: unknown, validator: S): import("../domain/types.js").FieldDescriptor<import("zod/v4").infer<S>, {}> & import("../domain/field.js").FieldModifiers<import("zod/v4").infer<S>, {}>;
     };
-    /** Registers a domain definition with table, validators, and factory projections. */
+    /** Registers a domain definition with table, validators, and factory projections. The `auditEntity` option names the `@touches` entity writes to this table are audited under (see `__flowStep`). */
     define: typeof define;
     /** Returns the global registry of all domain definitions. */
     definitions: typeof definitions;

package/dist/data/db/namespace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/data/db/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAElE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAGnM,OAAO,EAAS,MAAM,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAG/D,YAAY,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAE3E,6EAA6E;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,6EAA6E;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,mJAAmJ;AACnJ,eAAO,MAAM,IAAI;IACf,iQAAiQ;;IAGjQ,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAG7E,+RAA+R;;;;;;;;;;;;;IAkB/R,oDAAoD;;IAEpD,mDAAmD;;IAGnD,6EAA6E;;IAG7E,gFAAgF;;IAGhF,kHAAkH;;IAGlH,2GAA2G;;IAG3G,0GAA0G;;IAG1G,8EAA8E;;;;;;;;;;;;;;;;;;;;;;;IAE9E,qFAAqF;;IAErF,6DAA6D;;IAG7D,2GAA2G;;IAE3G,gHAAgH;;IAEhH,gHAAgH;;IAEhH,4EAA4E;;CAE5E,CAAA"}
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/data/db/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAElE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAGnM,OAAO,EAAS,MAAM,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAG/D,YAAY,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAE3E,6EAA6E;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,6EAA6E;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,mJAAmJ;AACnJ,eAAO,MAAM,IAAI;IACf,iQAAiQ;;IAGjQ,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAG7E,+RAA+R;;;;;;;;;;;;;IAkB/R,oDAAoD;;IAEpD,mDAAmD;;IAGnD,6EAA6E;;IAG7E,gFAAgF;;IAGhF,kHAAkH;;IAGlH,2GAA2G;;IAG3G,0GAA0G;;IAG1G,8EAA8E;;;;;;;;;;;;;;;;;;;;;;;IAE9E,qMAAqM;;IAErM,6DAA6D;;IAG7D,2GAA2G;;IAE3G,gHAAgH;;IAEhH,gHAAgH;;IAEhH,4EAA4E;;CAE5E,CAAA"}

package/dist/data/db/namespace.js

@@ -52,7 +52,7 @@ export const pipe = Object.assign(getDb, {
     values,
     /** Field builders for domain definitions — uuid(), text(), integer(), etc. */
     field,
-    /** Registers a domain definition with table, validators, and factory projections. */
+    /** Registers a domain definition with table, validators, and factory projections. The `auditEntity` option names the `@touches` entity writes to this table are audited under (see `__flowStep`). */
     define,
     /** Returns the global registry of all domain definitions. */
     definitions,

package/dist/data/db/namespace.js.map

@@ -1 +1 @@
-{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/data/db/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAElE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAEnM,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAK/D,6EAA6E;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,6EAA6E;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,mJAAmJ;AACnJ,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;IACvC,iQAAiQ;IACjQ,MAAM,EAAE,UAAU;IAElB,6EAA6E;IAC7E,MAAM;IAEN,+RAA+R;IAC/R,GAAG;IAEH,kGAAkG;IAClG,eAAe;IACf,YAAY;IACZ,kBAAkB;IAClB,eAAe;IACf,YAAY;IACZ,WAAW;IACX,qBAAqB;IACrB,OAAO;IAEP,qDAAqD;IACrD,UAAU;IACV,SAAS;IACT,SAAS;IAET,oDAAoD;IACpD,OAAO,EAAE,UAAU;IACnB,mDAAmD;IACnD,UAAU;IAEV,6EAA6E;IAC7E,QAAQ;IAER,gFAAgF;IAChF,YAAY;IAEZ,kHAAkH;IAClH,YAAY;IAEZ,2GAA2G;IAC3G,OAAO;IAEP,0GAA0G;IAC1G,MAAM;IAEN,8EAA8E;IAC9E,KAAK;IACL,qFAAqF;IACrF,MAAM;IACN,6DAA6D;IAC7D,WAAW;IAEX,2GAA2G;IAC3G,MAAM;IACN,gHAAgH;IAChH,MAAM;IACN,gHAAgH;IAChH,MAAM,EAAE,MAAM;IACd,4EAA4E;IAC5E,MAAM;CACP,CAAC,CAAA"}
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/data/db/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAElE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAEnM,qBAAqB;AACrB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAK/D,6EAA6E;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,6EAA6E;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,mJAAmJ;AACnJ,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;IACvC,iQAAiQ;IACjQ,MAAM,EAAE,UAAU;IAElB,6EAA6E;IAC7E,MAAM;IAEN,+RAA+R;IAC/R,GAAG;IAEH,kGAAkG;IAClG,eAAe;IACf,YAAY;IACZ,kBAAkB;IAClB,eAAe;IACf,YAAY;IACZ,WAAW;IACX,qBAAqB;IACrB,OAAO;IAEP,qDAAqD;IACrD,UAAU;IACV,SAAS;IACT,SAAS;IAET,oDAAoD;IACpD,OAAO,EAAE,UAAU;IACnB,mDAAmD;IACnD,UAAU;IAEV,6EAA6E;IAC7E,QAAQ;IAER,gFAAgF;IAChF,YAAY;IAEZ,kHAAkH;IAClH,YAAY;IAEZ,2GAA2G;IAC3G,OAAO;IAEP,0GAA0G;IAC1G,MAAM;IAEN,8EAA8E;IAC9E,KAAK;IACL,qMAAqM;IACrM,MAAM;IACN,6DAA6D;IAC7D,WAAW;IAEX,2GAA2G;IAC3G,MAAM;IACN,gHAAgH;IAChH,MAAM;IACN,gHAAgH;IAChH,MAAM,EAAE,MAAM;IACd,4EAA4E;IAC5E,MAAM;CACP,CAAC,CAAA"}

package/dist/data/domain/types.d.ts

@@ -118,6 +118,12 @@ export interface DefineOptions {
     readonly foreignKeys?: readonly CompositeForeignKey[];
     /** Marks the table RANGE-partitioned. Partitions are managed outside the migration. */
     readonly partitionBy?: PartitionSpec;
+    /**
+     * The `@touches` entity name writes to this table are audited under. When set it
+     * must equal the touch's entity exactly; otherwise the touch matches by normalized
+     * name (case-insensitive, underscores ignored, table name optionally plural).
+     */
+    readonly auditEntity?: string;
 }
 /** Column type projected from a FieldDescriptor — carries the right data type for Drizzle operators. */
 export type FieldColumn<F extends FieldDescriptor, TName extends string = string> = AnyPgColumn<{

package/dist/data/domain/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/data/domain/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,WAAW,GACX,MAAM,GACN,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,OAAO,GACP,QAAQ,CAAA;AAEZ,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB;;;;;WAKG;QACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,CAAC,CAAA;QAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB;;;;;;WAMG;QACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAC5B,CAAA;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,OAAO,CAAA;CACrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,+FAA+F;AAC/F,MAAM,WAAW,eAAe,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,SAAS,UAAU,GAAG,UAAU;IACxF,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAGD,KAAK,kBAAkB,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAEnD,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;AAE5D,+DAA+D;AAC/D,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAA;AAEhG,kGAAkG;AAClG,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE;QACnB;;;;;WAKG;QAEH,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAClE,6DAA6D;QAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KACpC,CAAA;IACD,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CACrC;AAED,kFAAkF;AAElF,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAEvF;AAED,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAE1B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxE,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACrD,uFAAuF;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAA;CACrC;AAED,wGAAwG;AACxG,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,eAAe,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,IAAI,WAAW,CAAC;IAC9F,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,OAAO,EAAE,IAAI,SAAS,gBAAgB,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAA;IACxD,SAAS,EAAE,KAAK,CAAA;CACjB,CAAC,CAAA;AAEF,iEAAiE;AACjE,MAAM,MAAM,gBAAgB,CAAC,OAAO,SAAS,WAAW,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,IAAI;IACzF,QAAQ,EAAE,CAAC,IAAI,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACvE,CAAA;AAED,4FAA4F;AAC5F,MAAM,WAAW,iBAAiB,CAAC,OAAO,SAAS,WAAW,GAAG,WAAW,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM;IACzG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,KAAK,IAAI,KAAK,CAAA;IACd,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;IACnD,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;IACnD,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,cAAc,CAAA;IACzB,cAAc,IAAI,YAAY,CAAC,OAAO,GAAG,oBAAoB,EAAE,KAAK,CAAC,CAAA;IACrE,OAAO,IAAI,YAAY,CAAC,OAAO,GAAG,aAAa,EAAE,KAAK,CAAC,CAAA;IACvD,WAAW,IAAI,YAAY,CAAC,OAAO,GAAG,iBAAiB,EAAE,KAAK,CAAC,CAAA;IAC/D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;CAC3C;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,CAAC,OAAO,SAAS,WAAW,GAAG,WAAW,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,IAC/F,OAAO,CAAC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,GAC5G,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,GAChC,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,OAAO,SAAS,WAAW,GAAG,WAAW,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,IACnG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AAE9B,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACtF,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,GAAG,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACzF,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;CACnF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IAClG,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IAClF,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACzG,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;CAC1F;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,GAAG,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACvF,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;CAC1F;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAChH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;CAC9L;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/data/domain/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,WAAW,GACX,MAAM,GACN,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,OAAO,GACP,QAAQ,CAAA;AAEZ,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB;;;;;WAKG;QACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,CAAC,CAAA;QAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB;;;;;;WAMG;QACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAC5B,CAAA;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,OAAO,CAAA;CACrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,+FAA+F;AAC/F,MAAM,WAAW,eAAe,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,SAAS,UAAU,GAAG,UAAU;IACxF,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAGD,KAAK,kBAAkB,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAEnD,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;AAE5D,+DAA+D;AAC/D,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAA;AAEhG,kGAAkG;AAClG,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE;QACnB;;;;;WAKG;QAEH,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAClE,6DAA6D;QAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KACpC,CAAA;IACD,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CACrC;AAED,kFAAkF;AAElF,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAEvF;AAED,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAE1B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxE,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACrD,uFAAuF;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,wGAAwG;AACxG,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,eAAe,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,IAAI,WAAW,CAAC;IAC9F,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,OAAO,EAAE,IAAI,SAAS,gBAAgB,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAA;IACxD,SAAS,EAAE,KAAK,CAAA;CACjB,CAAC,CAAA;AAEF,iEAAiE;AACjE,MAAM,MAAM,gBAAgB,CAAC,OAAO,SAAS,WAAW,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,IAAI;IACzF,QAAQ,EAAE,CAAC,IAAI,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACvE,CAAA;AAED,4FAA4F;AAC5F,MAAM,WAAW,iBAAiB,CAAC,OAAO,SAAS,WAAW,GAAG,WAAW,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM;IACzG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,KAAK,IAAI,KAAK,CAAA;IACd,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;IACnD,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;IACnD,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,cAAc,CAAA;IACzB,cAAc,IAAI,YAAY,CAAC,OAAO,GAAG,oBAAoB,EAAE,KAAK,CAAC,CAAA;IACrE,OAAO,IAAI,YAAY,CAAC,OAAO,GAAG,aAAa,EAAE,KAAK,CAAC,CAAA;IACvD,WAAW,IAAI,YAAY,CAAC,OAAO,GAAG,iBAAiB,EAAE,KAAK,CAAC,CAAA;IAC/D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;CAC3C;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,CAAC,OAAO,SAAS,WAAW,GAAG,WAAW,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,IAC/F,OAAO,CAAC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,GAC5G,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,GAChC,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,OAAO,SAAS,WAAW,GAAG,WAAW,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,IACnG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AAE9B,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACtF,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,GAAG,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACzF,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;CACnF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IAClG,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IAClF,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACzG,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;CAC1F;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,GAAG,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACvF,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,GAAG,IAAI,EAAE;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;CAC1F;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAChH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;CAC9L;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B"}

package/dist/data/migrate/framework-rls.d.ts

@@ -0,0 +1,10 @@
+import type { DB } from '../db/index.js';
+export declare const FRAMEWORK_POLICY_NAMES: readonly ["pipework_tenant_read", "pipework_tenant_update", "pipework_tenant_insert"];
+export interface FrameworkRls {
+    readonly sessionVar: string;
+    readonly force: boolean;
+}
+/** Statements that (re)install the policies on `table`. Safe to run again. */
+export declare function frameworkTablePolicies(table: string, rls: FrameworkRls): string[];
+export declare function installFrameworkPolicies(db: DB, tables: readonly string[], rls: FrameworkRls): Promise<void>;
+//# sourceMappingURL=framework-rls.d.ts.map

package/dist/data/migrate/framework-rls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-rls.d.ts","sourceRoot":"","sources":["../../../src/data/migrate/framework-rls.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAMxC,eAAO,MAAM,sBAAsB,uFAAwF,CAAA;AAE3H,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,MAAM,EAAE,CAajF;AAED,wBAAsB,wBAAwB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlH"}

package/dist/data/migrate/framework-rls.js

@@ -0,0 +1,40 @@
+// Row-level security for the built-in tenant tables. They are provisioned by
+// `provisionFrameworkTables`, not through generated migrations, so
+// `rls-generate` never sees them. When the default database configures `rls`,
+// each gets the same tenant rule as an application table, split by command:
+//
+//   pipework_tenant_read    SELECT  tenant matches the session setting, or a maintenance transaction
+//   pipework_tenant_update  UPDATE  same
+//   pipework_tenant_insert  INSERT  anything: the framework writes traces and audit rows
+//                                   for any tenant, and for none, from connections that
+//                                   carry no tenant setting
+//
+// No DELETE policy: retention drops partitions, and audit_record is append-only.
+import { sql } from '../db/sql.js';
+import { quoteIdentifier } from '../db/identifiers.js';
+import { tenantUsingClause } from '../../auth/tenant/rls.js';
+import { validateSessionVarName } from '../../auth/tenant/validate.js';
+import { MAINTENANCE_CLAUSE } from '../db/maintenance.js';
+export const FRAMEWORK_POLICY_NAMES = ['pipework_tenant_read', 'pipework_tenant_update', 'pipework_tenant_insert'];
+/** Statements that (re)install the policies on `table`. Safe to run again. */
+export function frameworkTablePolicies(table, rls) {
+    validateSessionVarName(rls.sessionVar);
+    const t = quoteIdentifier(table, 'table');
+    const visible = `(${tenantUsingClause('tenant_id', 'uuid', rls.sessionVar)} OR ${MAINTENANCE_CLAUSE})`;
+    const policy = (name) => quoteIdentifier(name, 'policy');
+    return [
+        `ALTER TABLE ${t} ENABLE ROW LEVEL SECURITY`,
+        `ALTER TABLE ${t} ${rls.force ? 'FORCE' : 'NO FORCE'} ROW LEVEL SECURITY`,
+        ...FRAMEWORK_POLICY_NAMES.map(name => `DROP POLICY IF EXISTS ${policy(name)} ON ${t}`),
+        `CREATE POLICY ${policy('pipework_tenant_read')} ON ${t} FOR SELECT USING ${visible}`,
+        `CREATE POLICY ${policy('pipework_tenant_update')} ON ${t} FOR UPDATE USING ${visible}`,
+        `CREATE POLICY ${policy('pipework_tenant_insert')} ON ${t} FOR INSERT WITH CHECK (true)`,
+    ];
+}
+export async function installFrameworkPolicies(db, tables, rls) {
+    for (const table of tables) {
+        for (const statement of frameworkTablePolicies(table, rls))
+            await db.execute(sql.raw(statement));
+    }
+}
+//# sourceMappingURL=framework-rls.js.map

package/dist/data/migrate/framework-rls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-rls.js","sourceRoot":"","sources":["../../../src/data/migrate/framework-rls.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,mEAAmE;AACnE,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,qGAAqG;AACrG,yCAAyC;AACzC,yFAAyF;AACzF,wFAAwF;AACxF,4DAA4D;AAC5D,EAAE;AACF,iFAAiF;AAEjF,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAElC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,wBAAwB,CAAU,CAAA;AAO3H,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,GAAiB;IACrE,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,kBAAkB,GAAG,CAAA;IACtG,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAChE,OAAO;QACL,eAAe,CAAC,4BAA4B;QAC5C,eAAe,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,qBAAqB;QACzE,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,iBAAiB,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,qBAAqB,OAAO,EAAE;QACrF,iBAAiB,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,qBAAqB,OAAO,EAAE;QACvF,iBAAiB,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,+BAA+B;KACzF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAAM,EAAE,MAAyB,EAAE,GAAiB;IACjG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,SAAS,IAAI,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;IAClG,CAAC;AACH,CAAC"}

package/dist/data/migrate/provision-framework.d.ts

@@ -1,6 +1,7 @@
 import type { DB } from '../db/index.js';
 import type { Blueprint } from '../../core/config/schema.js';
 import { type TracePartitionConfig } from '../../trace/partition/index.js';
+import { type FrameworkRls } from './framework-rls.js';
 export interface FrameworkTablesResult {
     /** Parent tables that did not exist and were created. */
     created: string[];
@@ -25,9 +26,12 @@ export declare class FrameworkTableColumnError extends Error {
  * definition has and it lacks; nothing is dropped, renamed or altered. A
  * missing NOT NULL column with no default cannot be added to a table that has
  * rows and fails naming the table and column. `unlogged` is for test databases;
- * a real database gets logged tables. Idempotent.
+ * a real database gets logged tables. When the database configures `rls`, each
+ * table also gets the tenant policies of `framework-rls.ts`, replaced on every
+ * run so an existing database picks them up. Idempotent.
  */
 export declare function provisionFrameworkTables(db: DB, blueprint: Blueprint, traceConfig: TracePartitionConfig, isDefaultDatabase: boolean, options?: {
     unlogged: boolean;
+    rls?: FrameworkRls | undefined;
 }): Promise<FrameworkTablesResult>;
 //# sourceMappingURL=provision-framework.d.ts.map

package/dist/data/migrate/provision-framework.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provision-framework.d.ts","sourceRoot":"","sources":["../../../src/data/migrate/provision-framework.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AAS/F,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,8BAA8B;IAC9B,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAExE;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAkB,IAAI,+BAA8B;CACrD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,oBAAoB,EACjC,iBAAiB,EAAE,OAAO,EAC1B,OAAO,GAAE;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAuB,GAClD,OAAO,CAAC,qBAAqB,CAAC,CAgDhC"}
+{"version":3,"file":"provision-framework.d.ts","sourceRoot":"","sources":["../../../src/data/migrate/provision-framework.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AAQ/F,OAAO,EAA4B,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEhF,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,8BAA8B;IAC9B,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAExE;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAkB,IAAI,+BAA8B;CACrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,oBAAoB,EACjC,iBAAiB,EAAE,OAAO,EAC1B,OAAO,GAAE;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;CAAuB,GAClF,OAAO,CAAC,qBAAqB,CAAC,CAiDhC"}

package/dist/data/migrate/provision-framework.js

@@ -13,6 +13,7 @@ import { loadInternalDefinitions } from './internal-definitions.js';
 import { buildSnapshot, EMPTY_SNAPSHOT } from './snapshot.js';
 import { emitSQL } from './sql-emit.js';
 import { makeTablesUnlogged } from './apply.js';
+import { installFrameworkPolicies } from './framework-rls.js';
 export function frameworkTablesChanged(r) {
     return r.created.length + r.columnsAdded.length + r.partitionsCreated.length > 0;
 }
@@ -31,7 +32,9 @@ export class FrameworkTableColumnError extends Error {
  * definition has and it lacks; nothing is dropped, renamed or altered. A
  * missing NOT NULL column with no default cannot be added to a table that has
  * rows and fails naming the table and column. `unlogged` is for test databases;
- * a real database gets logged tables. Idempotent.
+ * a real database gets logged tables. When the database configures `rls`, each
+ * table also gets the tenant policies of `framework-rls.ts`, replaced on every
+ * run so an existing database picks them up. Idempotent.
  */
 export async function provisionFrameworkTables(db, blueprint, traceConfig, isDefaultDatabase, options = { unlogged: true }) {
     const result = { created: [], columnsAdded: [], partitionsCreated: [] };
@@ -75,6 +78,8 @@ export async function provisionFrameworkTables(db, blueprint, traceConfig, isDef
         await db.execute(sql.raw(statement));
     if (blueprint.audit?.chain === true)
         await installAuditChain(db);
+    if (options.rls !== undefined)
+        await installFrameworkPolicies(db, tables.map(t => t.name), options.rls);
     const synced = await syncTracePartitions(db, traceConfig);
     result.partitionsCreated.push(...synced.created);
     return result;

package/dist/data/migrate/provision-framework.js.map

@@ -1 +1 @@
-{"version":3,"file":"provision-framework.js","sourceRoot":"","sources":["../../../src/data/migrate/provision-framework.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,+EAA+E;AAC/E,uCAAuC;AAEvC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAGtD,OAAO,EAAE,mBAAmB,EAA6B,MAAM,gCAAgC,CAAA;AAC/F,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE7D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAW/C,MAAM,UAAU,sBAAsB,CAAC,CAAwB;IAC7D,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAA;AAClF,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAChC,IAAI,GAAG,2BAA2B,CAAA;CACrD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAM,EACN,SAAoB,EACpB,WAAiC,EACjC,iBAA0B,EAC1B,UAAiC,EAAE,QAAQ,EAAE,IAAI,EAAE;IAEnD,MAAM,MAAM,GAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAA;IAC9F,IAAI,CAAC,iBAAiB;QAAE,OAAO,MAAM,CAAA;IACrC,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IAEjF,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnF,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAEpG,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,MAAM,eAAe,GAAa,EAAE,CAAA;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC/B,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAC1C,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;gBACvG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,MAAM,CAAC,IAAI,yBAAyB,KAAK,CAAC,IAAI,oCAAoC;wBACxG,8FAA8F;wBAC9F,gEAAgE,CACjE,CAAA;gBACH,CAAC;YACH,CAAC;YACD,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAC/G,eAAe,CAAC,IAAI,CAAC,SAAU,CAAC,OAAO,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC,CAAA;YAClF,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,eAAe;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;IAE7E,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI;QAAE,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAA;IAEhE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAChD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,KAAe;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;uCAGE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;;KAEhE,CAAC,CAAA;QACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"provision-framework.js","sourceRoot":"","sources":["../../../src/data/migrate/provision-framework.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,+EAA+E;AAC/E,uCAAuC;AAEvC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAGtD,OAAO,EAAE,mBAAmB,EAA6B,MAAM,gCAAgC,CAAA;AAC/F,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE7D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,wBAAwB,EAAqB,MAAM,oBAAoB,CAAA;AAWhF,MAAM,UAAU,sBAAsB,CAAC,CAAwB;IAC7D,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAA;AAClF,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAChC,IAAI,GAAG,2BAA2B,CAAA;CACrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAM,EACN,SAAoB,EACpB,WAAiC,EACjC,iBAA0B,EAC1B,UAAiE,EAAE,QAAQ,EAAE,IAAI,EAAE;IAEnF,MAAM,MAAM,GAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAA;IAC9F,IAAI,CAAC,iBAAiB;QAAE,OAAO,MAAM,CAAA;IACrC,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IAEjF,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnF,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAEpG,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,MAAM,eAAe,GAAa,EAAE,CAAA;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC/B,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAC1C,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;gBACvG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,MAAM,CAAC,IAAI,yBAAyB,KAAK,CAAC,IAAI,oCAAoC;wBACxG,8FAA8F;wBAC9F,gEAAgE,CACjE,CAAA;gBACH,CAAC;YACH,CAAC;YACD,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAC/G,eAAe,CAAC,IAAI,CAAC,SAAU,CAAC,OAAO,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC,CAAA;YAClF,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,eAAe;QAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;IAE7E,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI;QAAE,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAA;IAChE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IAEvG,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAChD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,KAAe;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;uCAGE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;;KAEhE,CAAC,CAAA;QACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/data/migrate/run.js

@@ -60,7 +60,7 @@ export async function migrateOne(instance, dbConfig, _options = {}) {
         errorRetentionDays: instance.config.trace.errorRetentionDays,
         auditRetentionDays: instance.config.audit.retentionDays,
         partitionLeadDays: instance.config.trace.partitionLeadDays,
-    }, wantsFrameworkTables(instance) && dbConfig.name === instance.config.defaultDatabaseName(), { unlogged: false });
+    }, wantsFrameworkTables(instance) && dbConfig.name === instance.config.defaultDatabaseName(), { unlogged: false, rls: dbConfig.rls });
     return {
         database: dbConfig.name,
         migrationsRun,

package/dist/data/migrate/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/data/migrate/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAGvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,eAAe,EAA6B,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,wBAAwB,EAA8B,MAAM,0BAA0B,CAAA;AA0B/F,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAG3B;IAFA,IAAI,GAAG,sBAAsB,CAAA;IAC/C,YACkB,KAA2B,EAC3C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,UAAK,GAAL,KAAK,CAAsB;IAI7C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,UAA0B,EAAE;IAC/E,MAAM,OAAO,GAAoB,EAAE,CAAA;IAEnC,KAAK,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;QACvD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;YAAE,SAAQ;QAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,QAA0B,EAAE,WAA2B,EAAE;IAC5G,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;IAEhD,gFAAgF;IAChF,0EAA0E;IAC1E,+EAA+E;IAC/E,iDAAiD;IACjD,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,KAAK,SAAS;QACnD,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QACrG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAA0B,CAAA;IAExI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC1E,MAAM,MAAM,GAAG,KAAK;aACjB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aAClD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,oBAAoB,CAC5B,WAAW,EACX,kBAAkB,QAAQ,CAAC,IAAI,wDAAwD,MAAM,IAAI;YACjG,mFAAmF,CACpF,CAAA;IACH,CAAC;IAED,IAAI,iBAAiB,GAAa,EAAE,CAAA;IAEpC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,kCAAkC,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5G,CAAC;QACD,iBAAiB,GAAG,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC;QAC1C,gBAAgB,EAAE,QAAQ,CAAC,UAAW;QACtC,eAAe,EAAE,QAAQ,CAAC,cAAc;QACxC,aAAa,EAAE,QAAQ,CAAC,GAAG;QAC3B,QAAQ,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,eAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;KACzG,CAAC,CAAA;IAEF,wEAAwE;IACxE,kFAAkF;IAClF,MAAM,eAAe,GAAG,MAAM,wBAAwB,CACpD,IAAI,CAAC,OAAO,EACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,EACnB;QACE,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB;QACxD,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB;QAC5D,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa;QACvD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB;KAC3D,EACD,oBAAoB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,EACzF,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAA;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,aAAa;QACb,UAAU,EAAE,iBAAiB;QAC7B,WAAW;QACX,OAAO;QACP,eAAe;KAChB,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAkB;IAC9C,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAA;AAC3F,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/data/migrate/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAGvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,eAAe,EAA6B,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,wBAAwB,EAA8B,MAAM,0BAA0B,CAAA;AA0B/F,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAG3B;IAFA,IAAI,GAAG,sBAAsB,CAAA;IAC/C,YACkB,KAA2B,EAC3C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,UAAK,GAAL,KAAK,CAAsB;IAI7C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,UAA0B,EAAE;IAC/E,MAAM,OAAO,GAAoB,EAAE,CAAA;IAEnC,KAAK,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;QACvD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;YAAE,SAAQ;QAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,QAA0B,EAAE,WAA2B,EAAE;IAC5G,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;IAEhD,gFAAgF;IAChF,0EAA0E;IAC1E,+EAA+E;IAC/E,iDAAiD;IACjD,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,KAAK,SAAS;QACnD,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QACrG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAA0B,CAAA;IAExI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC1E,MAAM,MAAM,GAAG,KAAK;aACjB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aAClD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,oBAAoB,CAC5B,WAAW,EACX,kBAAkB,QAAQ,CAAC,IAAI,wDAAwD,MAAM,IAAI;YACjG,mFAAmF,CACpF,CAAA;IACH,CAAC;IAED,IAAI,iBAAiB,GAAa,EAAE,CAAA;IAEpC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,kCAAkC,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5G,CAAC;QACD,iBAAiB,GAAG,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC;QAC1C,gBAAgB,EAAE,QAAQ,CAAC,UAAW;QACtC,eAAe,EAAE,QAAQ,CAAC,cAAc;QACxC,aAAa,EAAE,QAAQ,CAAC,GAAG;QAC3B,QAAQ,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,eAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;KACzG,CAAC,CAAA;IAEF,wEAAwE;IACxE,kFAAkF;IAClF,MAAM,eAAe,GAAG,MAAM,wBAAwB,CACpD,IAAI,CAAC,OAAO,EACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,EACnB;QACE,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB;QACxD,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB;QAC5D,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa;QACvD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB;KAC3D,EACD,oBAAoB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,EACzF,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CACvC,CAAA;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,aAAa;QACb,UAAU,EAAE,iBAAiB;QAC7B,WAAW;QACX,OAAO;QACP,eAAe;KAChB,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAkB;IAC9C,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAA;AAC3F,CAAC"}

package/dist/data/write/audit/audit-select.d.ts

@@ -1,5 +1,6 @@
 import type { SQL } from '../../db/types.js';
 import type { ActiveAuditStep } from '../../../trace/runtime/step-buffer.js';
+import type { MetaTouch } from '../../../trace/runtime/step-meta.js';
 /**
  * Information about the active flow_step plus the actor/tenant the row is
  * attributed to. The CTE compiler resolves these from the active `Flow` and
@@ -7,6 +8,8 @@ import type { ActiveAuditStep } from '../../../trace/runtime/step-buffer.js';
  */
 export interface AuditSelectContext {
     readonly step: ActiveAuditStep;
+    /** The step's touches that match the written table — one audit row per affected row per touch. */
+    readonly touches: readonly MetaTouch[];
     /** `auth?.userId`, or null when the trace ran without an authenticated principal. */
     readonly actorId: string | null;
     /** `flow.tenant`, or null when the entry was not tenant-scoped. */

package/dist/data/write/audit/audit-select.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-select.d.ts","sourceRoot":"","sources":["../../../../src/data/write/audit/audit-select.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAA;AAE5E;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,GAAG,EACX,KAAK,EAAE,GAAG,GACT,GAAG,CAwBL"}
+{"version":3,"file":"audit-select.d.ts","sourceRoot":"","sources":["../../../../src/data/write/audit/audit-select.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAA;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAEpE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;IACtC,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,GAAG,EACX,KAAK,EAAE,GAAG,GACT,GAAG,CAwBL"}

package/dist/data/write/audit/audit-select.js

@@ -28,7 +28,7 @@ export function buildAuditInserts(ctx, from, before, after) {
     const capturedJson = capturedInputs === null
         ? sql `NULL::jsonb`
         : sql `${JSON.stringify(capturedInputs)}::jsonb`;
-    const selects = ctx.step.touches.map(t => sql `
+    const selects = ctx.touches.map(t => sql `
     SELECT
       gen_random_uuid(),
       ${ctx.step.traceDay}::date,

package/dist/data/write/audit/audit-select.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-select.js","sourceRoot":"","sources":["../../../../src/data/write/audit/audit-select.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AACxE,4EAA4E;AAC5E,2EAA2E;AAC3E,uCAAuC;AACvC,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAE1E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAiBrC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAuB,EACvB,IAAS,EACT,MAAW,EACX,KAAU;IAEV,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAA;IAC9C,MAAM,YAAY,GAAG,cAAc,KAAK,IAAI;QAC1C,CAAC,CAAC,GAAG,CAAA,aAAa;QAClB,CAAC,CAAC,GAAG,CAAA,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAA;IAEjD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAA;;;QAGvC,GAAG,CAAC,IAAI,CAAC,QAAQ;QACjB,GAAG,CAAC,IAAI,CAAC,OAAO;QAChB,GAAG,CAAC,IAAI,CAAC,MAAM;QACf,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,OAAO;QACX,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI;QACN,MAAM;QACN,KAAK;QACL,YAAY;;MAEd,IAAI;GACP,CAAC,CAAA;IAEF,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAA,aAAa,CAAC,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"audit-select.js","sourceRoot":"","sources":["../../../../src/data/write/audit/audit-select.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AACxE,4EAA4E;AAC5E,2EAA2E;AAC3E,uCAAuC;AACvC,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAE1E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAoBrC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAuB,EACvB,IAAS,EACT,MAAW,EACX,KAAU;IAEV,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAA;IAC9C,MAAM,YAAY,GAAG,cAAc,KAAK,IAAI;QAC1C,CAAC,CAAC,GAAG,CAAA,aAAa;QAClB,CAAC,CAAC,GAAG,CAAA,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAA;IAEjD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAA;;;QAGlC,GAAG,CAAC,IAAI,CAAC,QAAQ;QACjB,GAAG,CAAC,IAAI,CAAC,OAAO;QAChB,GAAG,CAAC,IAAI,CAAC,MAAM;QACf,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,OAAO;QACX,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI;QACN,MAAM;QACN,KAAK;QACL,YAAY;;MAEd,IAAI;GACP,CAAC,CAAA;IAEF,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAA,aAAa,CAAC,CAAA;AAC5C,CAAC"}

package/dist/data/write/audit/cte-compile.js

@@ -9,9 +9,9 @@ import { compileUpdateAudit } from './verb-update.js';
 import { compileDeleteAudit } from './verb-delete.js';
 import { compileUpsertAudit } from './verb-upsert.js';
 export function compileAuditWrite(db, state, ctx) {
-    if (ctx.step.touches.length === 0) {
+    if (ctx.touches.length === 0) {
         throw new Error(`[pipework] compileAuditWrite called with empty touches on "${state.table.$name}". ` +
-            `Active step "${ctx.step.stepId}" has no @touches — the executor should have taken the vanilla DML branch.`);
+            `Active step "${ctx.step.stepId}" has no @touches matching this table — the executor should have taken the vanilla DML branch.`);
     }
     switch (state.verb) {
         case 'insert': return compileInsertAudit(db, state, ctx);

package/dist/data/write/audit/cte-compile.js.map

@@ -1 +1 @@
-{"version":3,"file":"cte-compile.js","sourceRoot":"","sources":["../../../../src/data/write/audit/cte-compile.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,0BAA0B;AAE1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAQrD,MAAM,UAAU,iBAAiB,CAAC,EAAS,EAAE,KAAiB,EAAE,GAAuB;IACrF,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,8DAA8D,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK;YACpF,gBAAgB,GAAG,CAAC,IAAI,CAAC,MAAM,4EAA4E,CAC5G,CAAA;IACH,CAAC;IACD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,OAAO,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;QACxD,KAAK,QAAQ,CAAC,CAAC,OAAO,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;QACxD,KAAK,QAAQ,CAAC,CAAC,OAAO,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;QACxD,KAAK,QAAQ,CAAC,CAAC,OAAO,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC"}
+{"version":3,"file":"cte-compile.js","sourceRoot":"","sources":["../../../../src/data/write/audit/cte-compile.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,0BAA0B;AAE1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAQrD,MAAM,UAAU,iBAAiB,CAAC,EAAS,EAAE,KAAiB,EAAE,GAAuB;IACrF,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,8DAA8D,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK;YACpF,gBAAgB,GAAG,CAAC,IAAI,CAAC,MAAM,gGAAgG,CAChI,CAAA;IACH,CAAC;IACD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,OAAO,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;QACxD,KAAK,QAAQ,CAAC,CAAC,OAAO,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;QACxD,KAAK,QAAQ,CAAC,CAAC,OAAO,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;QACxD,KAAK,QAAQ,CAAC,CAAC,OAAO,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC"}