pipework 0.7.12 → 0.7.13

package/dist/auth/rbac/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../../src/auth/rbac/seed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAG1C,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAErF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,EAAM,EACN,IAAc,EACd,MAAkB;IAElB,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,sBAAsB,CAAA;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,gBAAgB,CAAA;IAC1D,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,EAAE,eAAe,IAAI,2BAA2B,CAAA;IACzF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,qBAAqB,CAAA;IAEvE,qBAAqB,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAA;IAC5D,qBAAqB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAChD,qBAAqB,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAA;IACpE,qBAAqB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;IAExD,MAAM,KAAK,GAAG,eAAe,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,eAAe,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAA;IAChF,MAAM,UAAU,GAAG,eAAe,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;IAErE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;oBACJ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;gBAClB,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM;;KAExC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACJ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;kBACnB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW;;;OAG3D,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACJ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;kBACnB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ;;;OAGtC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACJ,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;6BACX,EAAE,CAAC,KAAK;eACtB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;yBAC1B,IAAI,CAAC,IAAI,sBAAsB,IAAI,CAAC,QAAQ;6BACxC,EAAE,CAAC,QAAQ,mBAAmB,EAAE,CAAC,MAAM;;OAE7D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACJ,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;iBACxB,EAAE,CAAC,MAAM,WAAW,EAAE,CAAC,QAAQ;eACjC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;yBACL,EAAE,CAAC,QAAQ,sBAAsB,EAAE,CAAC,QAAQ;;OAE9D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/auth/rbac/types.d.ts

@@ -0,0 +1,56 @@
+import type { DB } from '../../data/db/index.js';
+export type Scope = 'own' | 'team' | 'territory' | 'tenant';
+export interface RbacConfig {
+    readonly database: string;
+    readonly scopes?: readonly string[];
+    readonly cacheTtlMs?: number;
+    readonly table?: {
+        readonly permissions?: string;
+        readonly roles?: string;
+        readonly rolePermissions?: string;
+        readonly userRoles?: string;
+    };
+}
+export interface ResolvedPermission {
+    readonly resource: string;
+    readonly action: string;
+    readonly scope: string;
+}
+export interface PermissionSet {
+    readonly userId: string;
+    readonly tenantId: string;
+    readonly authVersion: number;
+    readonly permissions: readonly ResolvedPermission[];
+}
+export interface SeedPermission {
+    readonly resource: string;
+    readonly action: string;
+}
+export interface SeedRolePermission {
+    readonly resource: string;
+    readonly action: string;
+    readonly scope: string;
+}
+export interface SeedRole {
+    readonly name: string;
+    readonly tenantId: string;
+    readonly description?: string;
+    readonly permissions: readonly SeedRolePermission[];
+}
+export interface SeedUserRole {
+    readonly userId: string;
+    readonly roleName: string;
+    readonly tenantId: string;
+}
+export interface SeedData {
+    readonly permissions: readonly SeedPermission[];
+    readonly roles: readonly SeedRole[];
+    readonly userRoles?: readonly SeedUserRole[];
+}
+export interface Rbac {
+    resolve(db: DB, userId: string, tenantId: string, authVersion: number): Promise<PermissionSet>;
+    check(permissions: PermissionSet, resource: string, action: string, requiredScope?: string): boolean;
+    invalidate(userId: string, tenantId: string): void;
+    seed(db: DB, data: SeedData): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/rbac/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/rbac/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAEhD,MAAM,MAAM,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE3D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;QACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAA;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,IAAI;IACnB,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9F,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACpG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAClD,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5C"}

package/dist/auth/rbac/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/rbac/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/rbac/types.ts"],"names":[],"mappings":""}

package/dist/auth/tenant/extract.d.ts

@@ -0,0 +1,6 @@
+import type { TenantConfig } from './types.js';
+export interface TenantExtractionResult {
+    readonly tenant: string | null;
+}
+export declare function extractTenant(auth: unknown, config: TenantConfig): TenantExtractionResult;
+//# sourceMappingURL=extract.d.ts.map

package/dist/auth/tenant/extract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/extract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAI9C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,YAAY,GACnB,sBAAsB,CAqBxB"}

package/dist/auth/tenant/extract.js

@@ -0,0 +1,18 @@
+import { validateTenantId } from './validate.js';
+import { UnauthorizedError } from '../../core/errors/index.js';
+export function extractTenant(auth, config) {
+    const raw = config.extract(auth);
+    if (raw === null || raw === '') {
+        if (config.required !== false) {
+            throw new UnauthorizedError('Tenant context required but not present. Ensure auth strategy returns a tenantId.');
+        }
+        return { tenant: null };
+    }
+    const validator = config.validate ?? validateTenantId;
+    if (!validator(raw)) {
+        throw new UnauthorizedError(`Invalid tenant identifier: "${raw.slice(0, 40)}${raw.length > 40 ? '...' : ''}". ` +
+            `Tenant IDs must be valid UUIDs (or pass your custom validate function).`);
+    }
+    return { tenant: raw };
+}
+//# sourceMappingURL=extract.js.map

package/dist/auth/tenant/extract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../../src/auth/tenant/extract.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAM9D,MAAM,UAAU,aAAa,CAC3B,IAAa,EACb,MAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,mFAAmF,CACpF,CAAA;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAA;IACrD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,+BAA+B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK;YACnF,yEAAyE,CAC1E,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AACxB,CAAC"}

package/dist/auth/tenant/index.d.ts

@@ -0,0 +1,8 @@
+export type { TenantConfig, TenantContext } from './types.js';
+export { validateTenantId, validateSessionVarName, validateSessionVarValue } from './validate.js';
+export { propagateTenantLocals } from './propagate.js';
+export { extractTenant, type TenantExtractionResult } from './extract.js';
+export { tenantIsolationPolicy, enableTenantRls, verifyTenantContext } from './rls.js';
+export { scopeTable, getScopeConfig, isTenantScoped, type ScopeConfig } from './scope.js';
+export { createScopedDb, createTenantGuardDb } from './scoped-db.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/tenant/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/tenant/index.js

@@ -0,0 +1,7 @@
+export { validateTenantId, validateSessionVarName, validateSessionVarValue } from './validate.js';
+export { propagateTenantLocals } from './propagate.js';
+export { extractTenant } from './extract.js';
+export { tenantIsolationPolicy, enableTenantRls, verifyTenantContext } from './rls.js';
+export { scopeTable, getScopeConfig, isTenantScoped } from './scope.js';
+export { createScopedDb, createTenantGuardDb } from './scoped-db.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/tenant/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/tenant/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAA+B,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAoB,MAAM,YAAY,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/tenant/namespace.d.ts

@@ -0,0 +1,23 @@
+import { validateTenantId } from './validate.js';
+import { enableTenantRls, tenantIsolationPolicy, verifyTenantContext } from './rls.js';
+import { propagateTenantLocals } from './propagate.js';
+import { extractTenant } from './extract.js';
+import { isTenantScoped } from './scope.js';
+/** Multi-tenant isolation namespace — RLS policies, tenant extraction, Postgres-side verification. */
+export declare const tenant: {
+    /** Validates a tenant ID format (non-empty string, safe characters). */
+    validate: typeof validateTenantId;
+    /** Enables RLS on a table and creates the tenant isolation policy in Postgres. */
+    rls: typeof enableTenantRls;
+    /** Returns the SQL string for a tenant isolation RLS policy — use in migrations. */
+    policy: typeof tenantIsolationPolicy;
+    /** Cross-checks ALS tenant against Postgres set_config('pipework.tenant_id') — defense-in-depth. */
+    verify: typeof verifyTenantContext;
+    /** Sets pipework.tenant_id on the Postgres connection via set_config(). */
+    propagate: typeof propagateTenantLocals;
+    /** Extracts tenant ID from auth context using the configured extraction strategy. */
+    extract: typeof extractTenant;
+    /** Returns true if a table has been marked as tenant-scoped (via .tenant() field metadata). */
+    isTenantScoped: typeof isTenantScoped;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/auth/tenant/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,sGAAsG;AACtG,eAAO,MAAM,MAAM;IACjB,wEAAwE;;IAExE,kFAAkF;;IAElF,oFAAoF;;IAEpF,oGAAoG;;IAEpG,2EAA2E;;IAE3E,qFAAqF;;IAErF,+FAA+F;;CAEhG,CAAA"}

package/dist/auth/tenant/namespace.js

@@ -0,0 +1,23 @@
+import { validateTenantId } from './validate.js';
+import { enableTenantRls, tenantIsolationPolicy, verifyTenantContext } from './rls.js';
+import { propagateTenantLocals } from './propagate.js';
+import { extractTenant } from './extract.js';
+import { isTenantScoped } from './scope.js';
+/** Multi-tenant isolation namespace — RLS policies, tenant extraction, Postgres-side verification. */
+export const tenant = {
+    /** Validates a tenant ID format (non-empty string, safe characters). */
+    validate: validateTenantId,
+    /** Enables RLS on a table and creates the tenant isolation policy in Postgres. */
+    rls: enableTenantRls,
+    /** Returns the SQL string for a tenant isolation RLS policy — use in migrations. */
+    policy: tenantIsolationPolicy,
+    /** Cross-checks ALS tenant against Postgres set_config('pipework.tenant_id') — defense-in-depth. */
+    verify: verifyTenantContext,
+    /** Sets pipework.tenant_id on the Postgres connection via set_config(). */
+    propagate: propagateTenantLocals,
+    /** Extracts tenant ID from auth context using the configured extraction strategy. */
+    extract: extractTenant,
+    /** Returns true if a table has been marked as tenant-scoped (via .tenant() field metadata). */
+    isTenantScoped,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/auth/tenant/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/auth/tenant/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,sGAAsG;AACtG,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,wEAAwE;IACxE,QAAQ,EAAE,gBAAgB;IAC1B,kFAAkF;IAClF,GAAG,EAAE,eAAe;IACpB,oFAAoF;IACpF,MAAM,EAAE,qBAAqB;IAC7B,oGAAoG;IACpG,MAAM,EAAE,mBAAmB;IAC3B,2EAA2E;IAC3E,SAAS,EAAE,qBAAqB;IAChC,qFAAqF;IACrF,OAAO,EAAE,aAAa;IACtB,+FAA+F;IAC/F,cAAc;CACf,CAAA"}

package/dist/auth/tenant/propagate.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../../data/db/index.js';
+import type { TenantConfig, TenantContext } from './types.js';
+export declare function propagateTenantLocals(tx: DB, config: TenantConfig, ctx: TenantContext): Promise<void>;
+//# sourceMappingURL=propagate.d.ts.map

package/dist/auth/tenant/propagate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagate.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/propagate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG7D,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/auth/tenant/propagate.js

@@ -0,0 +1,15 @@
+import { sql } from '../../data/db/sql.js';
+import { validateSessionVarValue } from './validate.js';
+export async function propagateTenantLocals(tx, config, ctx) {
+    const vars = config.sessionVars;
+    if (!vars)
+        return;
+    for (const [name, resolver] of Object.entries(vars)) {
+        const value = resolver(ctx);
+        if (value === '')
+            continue;
+        validateSessionVarValue(value);
+        await tx.execute(sql `SELECT set_config(${name}, ${value}, true)`);
+    }
+}
+//# sourceMappingURL=propagate.js.map

package/dist/auth/tenant/propagate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagate.js","sourceRoot":"","sources":["../../../src/auth/tenant/propagate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAG1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAEvD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAM,EACN,MAAoB,EACpB,GAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAA;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,KAAK,KAAK,EAAE;YAAE,SAAQ;QAC1B,uBAAuB,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,qBAAqB,IAAI,KAAK,KAAK,SAAS,CAAC,CAAA;IACnE,CAAC;AACH,CAAC"}

package/dist/auth/tenant/rls.d.ts

@@ -0,0 +1,5 @@
+import type { DB } from '../../data/db/index.js';
+export declare function tenantIsolationPolicy(table: string, column?: string, sessionVar?: string): string;
+export declare function enableTenantRls(db: DB, table: string, column?: string): Promise<void>;
+export declare function verifyTenantContext(db: DB, expectedTenant: string | null): Promise<void>;
+//# sourceMappingURL=rls.d.ts.map

package/dist/auth/tenant/rls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/rls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAIhD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,MAAoB,EAAE,UAAU,GAAE,MAA6B,GAAG,MAAM,CAYpI;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/auth/tenant/rls.js

@@ -0,0 +1,35 @@
+import { sql } from '../../data/db/sql.js';
+import { quoteIdentifier } from '../../data/db/identifiers.js';
+import { validateSessionVarName } from './validate.js';
+export function tenantIsolationPolicy(table, column = 'tenant_id', sessionVar = 'pipework.tenant_id') {
+    validateSessionVarName(sessionVar);
+    const t = quoteIdentifier(table, 'table');
+    const c = quoteIdentifier(column, 'column');
+    const policyName = `pipework_tenant_isolation_${table.replace(/[^a-zA-Z0-9_]/g, '_')}`;
+    return [
+        `ALTER TABLE ${t} ENABLE ROW LEVEL SECURITY`,
+        `ALTER TABLE ${t} FORCE ROW LEVEL SECURITY`,
+        `CREATE POLICY ${quoteIdentifier(policyName, 'policy')} ON ${t} USING (${c} = current_setting('${sessionVar}', true))`,
+    ].join(';\n');
+}
+export async function enableTenantRls(db, table, column = 'tenant_id') {
+    const t = quoteIdentifier(table, 'table');
+    const c = quoteIdentifier(column, 'column');
+    const policyName = quoteIdentifier(`pipework_tenant_isolation_${table.replace(/[^a-zA-Z0-9_]/g, '_')}`, 'policy');
+    await db.execute(sql.raw(`ALTER TABLE ${t} ENABLE ROW LEVEL SECURITY`));
+    await db.execute(sql.raw(`ALTER TABLE ${t} FORCE ROW LEVEL SECURITY`));
+    await db.execute(sql.raw(`CREATE POLICY ${policyName} ON ${t} USING (${c} = current_setting('pipework.tenant_id', true))`));
+}
+export async function verifyTenantContext(db, expectedTenant) {
+    const result = await db.execute(sql `SELECT current_setting('pipework.tenant_id', true) AS tenant_id`);
+    const raw = result[0]?.tenant_id ?? null;
+    const pgTenant = raw === '' ? null : raw;
+    if (pgTenant !== expectedTenant) {
+        throw new Error(`[pipework] Tenant context mismatch between application and database.\n\n` +
+            `  Application context tenant: ${expectedTenant ?? '(null)'}\n` +
+            `  PostgreSQL session tenant:  ${pgTenant ?? '(null)'}\n\n` +
+            `  This indicates an AsyncLocalStorage context integrity failure.\n` +
+            `  The request has been aborted to prevent cross-tenant data access.\n`);
+    }
+}
+//# sourceMappingURL=rls.js.map

package/dist/auth/tenant/rls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../../src/auth/tenant/rls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAEtD,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB,WAAW,EAAE,aAAqB,oBAAoB;IAC1H,sBAAsB,CAAC,UAAU,CAAC,CAAA;IAElC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,6BAA6B,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAA;IAEtF,OAAO;QACL,eAAe,CAAC,4BAA4B;QAC5C,eAAe,CAAC,2BAA2B;QAC3C,iBAAiB,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAuB,UAAU,WAAW;KACvH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa,EACb,SAAiB,WAAW;IAE5B,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,eAAe,CAChC,6BAA6B,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,EACnE,QAAQ,CACT,CAAA;IAED,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAA;IACvE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CACtB,iBAAiB,UAAU,OAAO,CAAC,WAAW,CAAC,iDAAiD,CACjG,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,cAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,iEAAiE,CAAC,CAAA;IACrG,MAAM,GAAG,GAAI,MAAyD,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAA;IAC5F,MAAM,QAAQ,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;IAExC,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,0EAA0E;YAC1E,iCAAiC,cAAc,IAAI,QAAQ,IAAI;YAC/D,iCAAiC,QAAQ,IAAI,QAAQ,MAAM;YAC3D,oEAAoE;YACpE,uEAAuE,CACxE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/auth/tenant/scope.d.ts

@@ -0,0 +1,8 @@
+import type { PgTable } from 'drizzle-orm/pg-core';
+export interface ScopeConfig {
+    readonly columnKey: string;
+}
+export declare function scopeTable<T extends PgTable>(table: T, column?: string): T;
+export declare function getScopeConfig(table: PgTable): ScopeConfig | null;
+export declare function isTenantScoped(table: PgTable): boolean;
+//# sourceMappingURL=scope.d.ts.map

package/dist/auth/tenant/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAID,wBAAgB,UAAU,CAAC,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,CAe1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAEjE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD"}

package/dist/auth/tenant/scope.js

@@ -0,0 +1,21 @@
+import { getTableColumns } from '../../data/db/generated/drizzle-orm/introspection.js';
+const SCOPED_TABLES = new WeakMap();
+export function scopeTable(table, column) {
+    const key = column ?? 'tenantId';
+    const columns = getTableColumns(table);
+    if (!(key in columns)) {
+        const available = Object.keys(columns).join(', ');
+        throw new Error(`[pipework] tenant.scoped(): Table does not have column "${key}".\n\n` +
+            `  Available columns: ${available}\n` +
+            `  Hint: Pass the column name as the second argument: tenant.scoped(table, 'myColumn')\n`);
+    }
+    SCOPED_TABLES.set(table, { columnKey: key });
+    return table;
+}
+export function getScopeConfig(table) {
+    return SCOPED_TABLES.get(table) ?? null;
+}
+export function isTenantScoped(table) {
+    return SCOPED_TABLES.has(table);
+}
+//# sourceMappingURL=scope.js.map

package/dist/auth/tenant/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../src/auth/tenant/scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAA;AAMtF,MAAM,aAAa,GAAG,IAAI,OAAO,EAAwB,CAAA;AAEzD,MAAM,UAAU,UAAU,CAAoB,KAAQ,EAAE,MAAe;IACrE,MAAM,GAAG,GAAG,MAAM,IAAI,UAAU,CAAA;IAChC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAEtC,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjD,MAAM,IAAI,KAAK,CACb,2DAA2D,GAAG,QAAQ;YACtE,wBAAwB,SAAS,IAAI;YACrC,yFAAyF,CAC1F,CAAA;IACH,CAAC;IAED,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC"}

package/dist/auth/tenant/scoped-db.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../../data/db/types.js';
+export declare function createTenantGuardDb(db: DB): DB;
+export declare function createScopedDb(db: DB, tenantId: string): DB;
+//# sourceMappingURL=scoped-db.d.ts.map

package/dist/auth/tenant/scoped-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-db.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/scoped-db.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AA+JhD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAsB9C;AAmBD,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,CAgE3D"}

package/dist/auth/tenant/scoped-db.js

@@ -0,0 +1,234 @@
+import { eq, and } from '../../data/db/generated/drizzle-orm/operator.js';
+import { getTableColumns, getTableName } from '../../data/db/generated/drizzle-orm/introspection.js';
+import { getScopeConfig } from './scope.js';
+function buildTenantCondition(table, columnKey, tenantId) {
+    const columns = getTableColumns(table);
+    const col = columns[columnKey];
+    return eq(col, tenantId);
+}
+function bindMethod(obj, prop) {
+    const val = Reflect.get(obj, prop, obj);
+    return typeof val === 'function' ? val.bind(obj) : val;
+}
+function wrapFinalBuilder(builder, condition) {
+    let whereApplied = false;
+    const wrap = (target) => new Proxy(target, {
+        get(t, prop) {
+            if (prop === 'where') {
+                return (userCondition) => {
+                    whereApplied = true;
+                    const combined = userCondition != null ? and(userCondition, condition) : condition;
+                    const result = t['where'].call(t, combined);
+                    return passthrough(result);
+                };
+            }
+            if (prop === 'then') {
+                if (!whereApplied) {
+                    const scoped = t['where'].call(t, condition);
+                    return bindMethod(scoped, 'then');
+                }
+                return bindMethod(t, 'then');
+            }
+            if (prop === 'catch' || prop === 'finally') {
+                if (!whereApplied) {
+                    const scoped = t['where'].call(t, condition);
+                    return bindMethod(scoped, prop);
+                }
+                return bindMethod(t, prop);
+            }
+            const value = Reflect.get(t, prop, t);
+            if (typeof value !== 'function')
+                return value;
+            return (...args) => {
+                const result = value.apply(t, args);
+                if (result != null && typeof result === 'object' && 'where' in result) {
+                    return wrap(result);
+                }
+                if (result != null && typeof result === 'object' && 'then' in result) {
+                    return passthrough(result);
+                }
+                return result;
+            };
+        },
+    });
+    const passthrough = (target) => new Proxy(target, {
+        get(t, prop) {
+            if (prop === 'then' || prop === 'catch' || prop === 'finally') {
+                return bindMethod(t, prop);
+            }
+            const value = Reflect.get(t, prop, t);
+            if (typeof value !== 'function')
+                return value;
+            return (...args) => {
+                const result = value.apply(t, args);
+                if (result != null && typeof result === 'object' && 'then' in result) {
+                    return passthrough(result);
+                }
+                return result;
+            };
+        },
+    });
+    return wrap(builder);
+}
+function wrapUpdateBuilder(builder, condition) {
+    return new Proxy(builder, {
+        get(t, prop) {
+            if (prop === 'set') {
+                return (...args) => {
+                    const result = t['set'].apply(t, args);
+                    return wrapFinalBuilder(result, condition);
+                };
+            }
+            const value = Reflect.get(t, prop, t);
+            return typeof value === 'function' ? value.bind(t) : value;
+        },
+    });
+}
+function wrapInsertBuilder(builder, columnKey, tenantId) {
+    return new Proxy(builder, {
+        get(t, prop) {
+            if (prop === 'values') {
+                return (values) => {
+                    const inject = (row) => {
+                        const existing = row[columnKey];
+                        if (existing !== undefined && existing !== tenantId) {
+                            throw new Error(`[pipework] Tenant-scoped insert: value has ${columnKey} "${String(existing)}" ` +
+                                `but the current context tenant is "${tenantId}".\n\n` +
+                                `  Remove the explicit ${columnKey} from your insert values — it's set automatically.\n` +
+                                '  If you need cross-tenant writes, file an issue on the pipework repo.\n');
+                        }
+                        return { ...row, [columnKey]: tenantId };
+                    };
+                    const scoped = Array.isArray(values)
+                        ? values.map(inject)
+                        : inject(values);
+                    return t['values'].call(t, scoped);
+                };
+            }
+            const value = Reflect.get(t, prop, t);
+            return typeof value === 'function' ? value.bind(t) : value;
+        },
+    });
+}
+function wrapSelectBuilder(builder, tenantId) {
+    return new Proxy(builder, {
+        get(t, prop) {
+            if (prop === 'from') {
+                return (table, ...rest) => {
+                    const result = t['from'].call(t, table, ...rest);
+                    const config = getScopeConfig(table);
+                    if (!config)
+                        return result;
+                    const cond = buildTenantCondition(table, config.columnKey, tenantId);
+                    return wrapFinalBuilder(result, cond);
+                };
+            }
+            const value = Reflect.get(t, prop, t);
+            return typeof value === 'function' ? value.bind(t) : value;
+        },
+    });
+}
+function throwTenantRequired(tableName, operation) {
+    throw new Error(`[pipework] Cannot ${operation} tenant-scoped table "${tableName}" without a tenant in context.\n\n` +
+        '  This table has a .tenant() field, which means all operations require\n' +
+        '  an active tenant in the request/job context.\n\n' +
+        '  If this is a system-level operation that legitimately needs to operate\n' +
+        '  without a tenant (admin tooling, analytics), file an issue on the\n' +
+        '  pipework repo describing your use case.\n');
+}
+export function createTenantGuardDb(db) {
+    return new Proxy(db, {
+        get(target, prop, receiver) {
+            if (prop === 'insert' || prop === 'update' || prop === 'delete') {
+                return (table) => {
+                    if (getScopeConfig(table)) {
+                        throwTenantRequired(getTableName(table), prop);
+                    }
+                    return target[prop].call(target, table);
+                };
+            }
+            if (prop === 'select' || prop === 'selectDistinct' || prop === 'selectDistinctOn') {
+                return (...args) => {
+                    const selectBuilder = target[prop](...args);
+                    return wrapGuardSelectBuilder(selectBuilder);
+                };
+            }
+            return Reflect.get(target, prop, receiver);
+        },
+    });
+}
+function wrapGuardSelectBuilder(builder) {
+    return new Proxy(builder, {
+        get(t, prop) {
+            if (prop === 'from') {
+                return (table, ...rest) => {
+                    if (getScopeConfig(table)) {
+                        throwTenantRequired(getTableName(table), 'select from');
+                    }
+                    return t['from'].call(t, table, ...rest);
+                };
+            }
+            const value = Reflect.get(t, prop, t);
+            return typeof value === 'function' ? value.bind(t) : value;
+        },
+    });
+}
+export function createScopedDb(db, tenantId) {
+    return new Proxy(db, {
+        get(target, prop, receiver) {
+            if (prop === 'insert') {
+                return (table) => {
+                    const builder = target.insert(table);
+                    const config = getScopeConfig(table);
+                    if (!config)
+                        return builder;
+                    return wrapInsertBuilder(builder, config.columnKey, tenantId);
+                };
+            }
+            if (prop === 'update') {
+                return (table) => {
+                    const builder = target.update(table);
+                    const config = getScopeConfig(table);
+                    if (!config)
+                        return builder;
+                    const cond = buildTenantCondition(table, config.columnKey, tenantId);
+                    return wrapUpdateBuilder(builder, cond);
+                };
+            }
+            if (prop === 'delete') {
+                return (table) => {
+                    const builder = target.delete(table);
+                    const config = getScopeConfig(table);
+                    if (!config)
+                        return builder;
+                    const cond = buildTenantCondition(table, config.columnKey, tenantId);
+                    return wrapFinalBuilder(builder, cond);
+                };
+            }
+            if (prop === 'select' || prop === 'selectDistinct' || prop === 'selectDistinctOn') {
+                return (...args) => {
+                    const selectBuilder = target[prop](...args);
+                    return wrapSelectBuilder(selectBuilder, tenantId);
+                };
+            }
+            if (prop === 'execute') {
+                return () => {
+                    throw new Error('[pipework] execute() is not available on a tenant-scoped database connection.\n\n' +
+                        '  Tenant-scoped connections only support select, insert, update, and delete\n' +
+                        '  operations, which are automatically filtered by tenant.\n\n' +
+                        '  If you need to run a query that the builder cannot express, file an issue\n' +
+                        '  on the pipework repo describing your use case.\n');
+                };
+            }
+            if (prop === '$with') {
+                return () => {
+                    throw new Error('[pipework] $with() (common table expressions) is not available on a tenant-scoped database connection.\n\n' +
+                        '  CTEs bypass tenant scoping. If you need CTE support, file an issue\n' +
+                        '  on the pipework repo describing your use case.\n');
+                };
+            }
+            return Reflect.get(target, prop, receiver);
+        },
+    });
+}
+//# sourceMappingURL=scoped-db.js.map

package/dist/auth/tenant/scoped-db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-db.js","sourceRoot":"","sources":["../../../src/auth/tenant/scoped-db.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,iDAAiD,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sDAAsD,CAAA;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAI3C,SAAS,oBAAoB,CAAC,KAAc,EAAE,SAAiB,EAAE,QAAgB;IAC/E,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAE,CAAA;IAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAqB;IACpD,MAAM,GAAG,GAAY,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IAChD,OAAO,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAE,GAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,SAAc;IACvD,IAAI,YAAY,GAAG,KAAK,CAAA;IAExB,MAAM,IAAI,GAAG,CAAC,MAAc,EAAU,EAAE,CACtC,IAAI,KAAK,CAAC,MAAM,EAAE;QAChB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,aAA8B,EAAE,EAAE;oBACxC,YAAY,GAAG,IAAI,CAAA;oBACnB,MAAM,QAAQ,GAAG,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBAClF,MAAM,MAAM,GAAI,CAA2B,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAW,CAAA;oBACjF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAA;gBAC5B,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAI,CAA2B,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAW,CAAA;oBAClF,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBACnC,CAAC;gBACD,OAAO,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YAC9B,CAAC;YAED,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAI,CAA2B,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAW,CAAA;oBAClF,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACjC,CAAC;gBACD,OAAO,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;YAC5B,CAAC;YAED,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;YAE7C,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAI,KAAe,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC9C,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAK,MAAiB,EAAE,CAAC;oBAClF,OAAO,IAAI,CAAC,MAAgB,CAAC,CAAA;gBAC/B,CAAC;gBACD,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAK,MAAiB,EAAE,CAAC;oBACjF,OAAO,WAAW,CAAC,MAAgB,CAAC,CAAA;gBACtC,CAAC;gBACD,OAAO,MAAM,CAAA;YACf,CAAC,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEJ,MAAM,WAAW,GAAG,CAAC,MAAc,EAAU,EAAE,CAC7C,IAAI,KAAK,CAAC,MAAM,EAAE;QAChB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9D,OAAO,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;YAC5B,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;YAC7C,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAI,KAAe,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC9C,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAK,MAAiB,EAAE,CAAC;oBACjF,OAAO,WAAW,CAAC,MAAgB,CAAC,CAAA;gBACtC,CAAC;gBACD,OAAO,MAAM,CAAA;YACf,CAAC,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEJ,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,SAAc;IACxD,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAI,CAA2B,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAW,CAAA;oBAC5E,OAAO,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;gBAC5C,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,SAAiB,EAAE,QAAgB;IAC7E,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAe,EAAE,EAAE;oBACzB,MAAM,MAAM,GAAG,CAAC,GAA4B,EAA2B,EAAE;wBACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;wBAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACpD,MAAM,IAAI,KAAK,CACb,8CAA8C,SAAS,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI;gCAChF,sCAAsC,QAAQ,QAAQ;gCACtD,yBAAyB,SAAS,sDAAsD;gCACxF,0EAA0E,CAC3E,CAAA;wBACH,CAAC;wBACD,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;oBAC1C,CAAC,CAAA;oBACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;wBAClC,CAAC,CAAE,MAAoC,CAAC,GAAG,CAAC,MAAM,CAAC;wBACnD,CAAC,CAAC,MAAM,CAAC,MAAiC,CAAC,CAAA;oBAC7C,OAAQ,CAA2B,CAAC,QAAQ,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;gBAChE,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,QAAgB;IAC1D,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAI,CAA2B,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,CAAW,CAAA;oBACtF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,MAAM,CAAA;oBAC1B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACpE,OAAO,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACvC,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB,EAAE,SAAiB;IAC/D,MAAM,IAAI,KAAK,CACb,qBAAqB,SAAS,yBAAyB,SAAS,oCAAoC;QACpG,0EAA0E;QAC1E,oDAAoD;QACpD,4EAA4E;QAC5E,uEAAuE;QACvE,6CAA6C,CAC9C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAM;IACxC,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChE,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1B,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,IAAc,CAAC,CAAA;oBAC1D,CAAC;oBACD,OAAQ,MAA2C,CAAC,IAAc,CAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;gBAC1F,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAClF,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,aAAa,GAAI,MAA2C,CAAC,IAAc,CAAE,CAAC,GAAG,IAAI,CAAC,CAAA;oBAC5F,OAAO,sBAAsB,CAAC,aAAuB,CAAC,CAAA;gBACxD,CAAC,CAAA;YACH,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC5C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE;oBAC5C,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1B,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAA;oBACzD,CAAC;oBACD,OAAQ,CAA2B,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAA;gBACtE,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAM,EAAE,QAAgB;IACrD,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAA;oBAC3B,OAAO,iBAAiB,CAAC,OAA4B,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;gBACpF,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAA;oBAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACpE,OAAO,iBAAiB,CAAC,OAA4B,EAAE,IAAI,CAAC,CAAA;gBAC9D,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAA;oBAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACpE,OAAO,gBAAgB,CAAC,OAA4B,EAAE,IAAI,CAAC,CAAA;gBAC7D,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAClF,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,aAAa,GAAI,MAA2C,CAAC,IAAc,CAAE,CAAC,GAAG,IAAI,CAAC,CAAA;oBAC5F,OAAO,iBAAiB,CAAC,aAAuB,EAAE,QAAQ,CAAC,CAAA;gBAC7D,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,GAAG,EAAE;oBACV,MAAM,IAAI,KAAK,CACb,mFAAmF;wBACnF,+EAA+E;wBAC/E,+DAA+D;wBAC/D,+EAA+E;wBAC/E,oDAAoD,CACrD,CAAA;gBACH,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,OAAO,GAAG,EAAE;oBACV,MAAM,IAAI,KAAK,CACb,4GAA4G;wBAC5G,wEAAwE;wBACxE,oDAAoD,CACrD,CAAA;gBACH,CAAC,CAAA;YACH,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC5C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/auth/tenant/types.d.ts

@@ -0,0 +1,14 @@
+/** Configuration for tenant extraction and isolation strategy. */
+export interface TenantConfig {
+    readonly extract: (auth: unknown) => string | null;
+    readonly sessionVars?: Record<string, (ctx: TenantContext) => string>;
+    readonly validate?: (tenantId: string) => boolean;
+    readonly required?: boolean;
+}
+/** Resolved tenant context — tenant ID, request ID, and user ID. */
+export interface TenantContext {
+    readonly tenant: string;
+    readonly requestId: string;
+    readonly userId: string | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/tenant/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/types.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAA;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,MAAM,CAAC,CAAA;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B"}

package/dist/auth/tenant/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/tenant/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/tenant/types.ts"],"names":[],"mappings":""}

package/dist/auth/tenant/validate.d.ts

@@ -0,0 +1,4 @@
+export declare function validateTenantId(value: string): boolean;
+export declare function validateSessionVarName(name: string): void;
+export declare function validateSessionVarValue(value: string): void;
+//# sourceMappingURL=validate.d.ts.map

package/dist/auth/tenant/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/auth/tenant/validate.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQzD;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAQ3D"}