pipework 0.7.26 → 0.8.1

package/dist/tenant/extract.js

@@ -1,18 +0,0 @@
-import { validateTenantId } from './validate.js';
-import { UnauthorizedError } from '../errors/index.js';
-export function extractTenant(auth, config) {
-    const raw = config.extract(auth);
-    if (raw === null || raw === '') {
-        if (config.required !== false) {
-            throw new UnauthorizedError('Tenant context required but not present. Ensure auth strategy returns a tenantId.');
-        }
-        return { tenant: null };
-    }
-    const validator = config.validate ?? validateTenantId;
-    if (!validator(raw)) {
-        throw new UnauthorizedError(`Invalid tenant identifier: "${raw.slice(0, 40)}${raw.length > 40 ? '...' : ''}". ` +
-            `Tenant IDs must be valid UUIDs (or pass your custom validate function).`);
-    }
-    return { tenant: raw };
-}
-//# sourceMappingURL=extract.js.map

package/dist/tenant/extract.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../src/tenant/extract.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAMtD,MAAM,UAAU,aAAa,CAC3B,IAAa,EACb,MAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,mFAAmF,CACpF,CAAA;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAA;IACrD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,+BAA+B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK;YACnF,yEAAyE,CAC1E,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AACxB,CAAC"}

package/dist/tenant/index.d.ts

@@ -1,8 +0,0 @@
-export type { TenantConfig, TenantContext } from './types.js';
-export { validateTenantId, validateSessionVarName, validateSessionVarValue } from './validate.js';
-export { propagateTenantLocals } from './propagate.js';
-export { extractTenant, type TenantExtractionResult } from './extract.js';
-export { tenantIsolationPolicy, enableTenantRls, verifyTenantContext } from './rls.js';
-export { scopeTable, getScopeConfig, isTenantScoped, type ScopeConfig } from './scope.js';
-export { createScopedDb, createTenantGuardDb } from './scoped-db.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/tenant/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tenant/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/tenant/index.js

@@ -1,7 +0,0 @@
-export { validateTenantId, validateSessionVarName, validateSessionVarValue } from './validate.js';
-export { propagateTenantLocals } from './propagate.js';
-export { extractTenant } from './extract.js';
-export { tenantIsolationPolicy, enableTenantRls, verifyTenantContext } from './rls.js';
-export { scopeTable, getScopeConfig, isTenantScoped } from './scope.js';
-export { createScopedDb, createTenantGuardDb } from './scoped-db.js';
-//# sourceMappingURL=index.js.map

package/dist/tenant/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tenant/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAA+B,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAoB,MAAM,YAAY,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/tenant/namespace.d.ts

@@ -1,23 +0,0 @@
-import { validateTenantId } from './validate.js';
-import { enableTenantRls, tenantIsolationPolicy, verifyTenantContext } from './rls.js';
-import { propagateTenantLocals } from './propagate.js';
-import { extractTenant } from './extract.js';
-import { isTenantScoped } from './scope.js';
-/** Multi-tenant isolation namespace — RLS policies, tenant extraction, Postgres-side verification. */
-export declare const tenant: {
-    /** Validates a tenant ID format (non-empty string, safe characters). */
-    validate: typeof validateTenantId;
-    /** Enables RLS on a table and creates the tenant isolation policy in Postgres. */
-    rls: typeof enableTenantRls;
-    /** Returns the SQL string for a tenant isolation RLS policy — use in migrations. */
-    policy: typeof tenantIsolationPolicy;
-    /** Cross-checks ALS tenant against Postgres set_config('pipework.tenant_id') — defense-in-depth. */
-    verify: typeof verifyTenantContext;
-    /** Sets pipework.tenant_id on the Postgres connection via set_config(). */
-    propagate: typeof propagateTenantLocals;
-    /** Extracts tenant ID from auth context using the configured extraction strategy. */
-    extract: typeof extractTenant;
-    /** Returns true if a table has been marked as tenant-scoped (via .tenant() field metadata). */
-    isTenantScoped: typeof isTenantScoped;
-};
-//# sourceMappingURL=namespace.d.ts.map

package/dist/tenant/namespace.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/tenant/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,sGAAsG;AACtG,eAAO,MAAM,MAAM;IACjB,wEAAwE;;IAExE,kFAAkF;;IAElF,oFAAoF;;IAEpF,oGAAoG;;IAEpG,2EAA2E;;IAE3E,qFAAqF;;IAErF,+FAA+F;;CAEhG,CAAA"}

package/dist/tenant/namespace.js

@@ -1,23 +0,0 @@
-import { validateTenantId } from './validate.js';
-import { enableTenantRls, tenantIsolationPolicy, verifyTenantContext } from './rls.js';
-import { propagateTenantLocals } from './propagate.js';
-import { extractTenant } from './extract.js';
-import { isTenantScoped } from './scope.js';
-/** Multi-tenant isolation namespace — RLS policies, tenant extraction, Postgres-side verification. */
-export const tenant = {
-    /** Validates a tenant ID format (non-empty string, safe characters). */
-    validate: validateTenantId,
-    /** Enables RLS on a table and creates the tenant isolation policy in Postgres. */
-    rls: enableTenantRls,
-    /** Returns the SQL string for a tenant isolation RLS policy — use in migrations. */
-    policy: tenantIsolationPolicy,
-    /** Cross-checks ALS tenant against Postgres set_config('pipework.tenant_id') — defense-in-depth. */
-    verify: verifyTenantContext,
-    /** Sets pipework.tenant_id on the Postgres connection via set_config(). */
-    propagate: propagateTenantLocals,
-    /** Extracts tenant ID from auth context using the configured extraction strategy. */
-    extract: extractTenant,
-    /** Returns true if a table has been marked as tenant-scoped (via .tenant() field metadata). */
-    isTenantScoped,
-};
-//# sourceMappingURL=namespace.js.map

package/dist/tenant/namespace.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/tenant/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,sGAAsG;AACtG,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,wEAAwE;IACxE,QAAQ,EAAE,gBAAgB;IAC1B,kFAAkF;IAClF,GAAG,EAAE,eAAe;IACpB,oFAAoF;IACpF,MAAM,EAAE,qBAAqB;IAC7B,oGAAoG;IACpG,MAAM,EAAE,mBAAmB;IAC3B,2EAA2E;IAC3E,SAAS,EAAE,qBAAqB;IAChC,qFAAqF;IACrF,OAAO,EAAE,aAAa;IACtB,+FAA+F;IAC/F,cAAc;CACf,CAAA"}

package/dist/tenant/propagate.d.ts

@@ -1,4 +0,0 @@
-import type { DB } from '../db/index.js';
-import type { TenantConfig, TenantContext } from './types.js';
-export declare function propagateTenantLocals(tx: DB, config: TenantConfig, ctx: TenantContext): Promise<void>;
-//# sourceMappingURL=propagate.d.ts.map

package/dist/tenant/propagate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"propagate.d.ts","sourceRoot":"","sources":["../../src/tenant/propagate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG7D,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/tenant/propagate.js

@@ -1,15 +0,0 @@
-import { sql } from '../db/sql.js';
-import { validateSessionVarValue } from './validate.js';
-export async function propagateTenantLocals(tx, config, ctx) {
-    const vars = config.sessionVars;
-    if (!vars)
-        return;
-    for (const [name, resolver] of Object.entries(vars)) {
-        const value = resolver(ctx);
-        if (value === '')
-            continue;
-        validateSessionVarValue(value);
-        await tx.execute(sql `SELECT set_config(${name}, ${value}, true)`);
-    }
-}
-//# sourceMappingURL=propagate.js.map

package/dist/tenant/propagate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"propagate.js","sourceRoot":"","sources":["../../src/tenant/propagate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAGlC,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAEvD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAM,EACN,MAAoB,EACpB,GAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAA;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,KAAK,KAAK,EAAE;YAAE,SAAQ;QAC1B,uBAAuB,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,qBAAqB,IAAI,KAAK,KAAK,SAAS,CAAC,CAAA;IACnE,CAAC;AACH,CAAC"}

package/dist/tenant/rls.d.ts

@@ -1,5 +0,0 @@
-import type { DB } from '../db/index.js';
-export declare function tenantIsolationPolicy(table: string, column?: string, sessionVar?: string): string;
-export declare function enableTenantRls(db: DB, table: string, column?: string): Promise<void>;
-export declare function verifyTenantContext(db: DB, expectedTenant: string | null): Promise<void>;
-//# sourceMappingURL=rls.d.ts.map

package/dist/tenant/rls.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../src/tenant/rls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAIxC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,MAAoB,EAAE,UAAU,GAAE,MAA6B,GAAG,MAAM,CAYpI;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/tenant/rls.js

@@ -1,35 +0,0 @@
-import { sql } from '../db/sql.js';
-import { quoteIdentifier } from '../db/identifiers.js';
-import { validateSessionVarName } from './validate.js';
-export function tenantIsolationPolicy(table, column = 'tenant_id', sessionVar = 'pipework.tenant_id') {
-    validateSessionVarName(sessionVar);
-    const t = quoteIdentifier(table, 'table');
-    const c = quoteIdentifier(column, 'column');
-    const policyName = `pipework_tenant_isolation_${table.replace(/[^a-zA-Z0-9_]/g, '_')}`;
-    return [
-        `ALTER TABLE ${t} ENABLE ROW LEVEL SECURITY`,
-        `ALTER TABLE ${t} FORCE ROW LEVEL SECURITY`,
-        `CREATE POLICY ${quoteIdentifier(policyName, 'policy')} ON ${t} USING (${c} = current_setting('${sessionVar}', true))`,
-    ].join(';\n');
-}
-export async function enableTenantRls(db, table, column = 'tenant_id') {
-    const t = quoteIdentifier(table, 'table');
-    const c = quoteIdentifier(column, 'column');
-    const policyName = quoteIdentifier(`pipework_tenant_isolation_${table.replace(/[^a-zA-Z0-9_]/g, '_')}`, 'policy');
-    await db.execute(sql.raw(`ALTER TABLE ${t} ENABLE ROW LEVEL SECURITY`));
-    await db.execute(sql.raw(`ALTER TABLE ${t} FORCE ROW LEVEL SECURITY`));
-    await db.execute(sql.raw(`CREATE POLICY ${policyName} ON ${t} USING (${c} = current_setting('pipework.tenant_id', true))`));
-}
-export async function verifyTenantContext(db, expectedTenant) {
-    const result = await db.execute(sql `SELECT current_setting('pipework.tenant_id', true) AS tenant_id`);
-    const raw = result[0]?.tenant_id ?? null;
-    const pgTenant = raw === '' ? null : raw;
-    if (pgTenant !== expectedTenant) {
-        throw new Error(`[pipework] Tenant context mismatch between application and database.\n\n` +
-            `  Application context tenant: ${expectedTenant ?? '(null)'}\n` +
-            `  PostgreSQL session tenant:  ${pgTenant ?? '(null)'}\n\n` +
-            `  This indicates an AsyncLocalStorage context integrity failure.\n` +
-            `  The request has been aborted to prevent cross-tenant data access.\n`);
-    }
-}
-//# sourceMappingURL=rls.js.map

package/dist/tenant/rls.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../src/tenant/rls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAElC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAEtD,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB,WAAW,EAAE,aAAqB,oBAAoB;IAC1H,sBAAsB,CAAC,UAAU,CAAC,CAAA;IAElC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,6BAA6B,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAA;IAEtF,OAAO;QACL,eAAe,CAAC,4BAA4B;QAC5C,eAAe,CAAC,2BAA2B;QAC3C,iBAAiB,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAuB,UAAU,WAAW;KACvH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa,EACb,SAAiB,WAAW;IAE5B,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,eAAe,CAChC,6BAA6B,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,EACnE,QAAQ,CACT,CAAA;IAED,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAA;IACvE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CACtB,iBAAiB,UAAU,OAAO,CAAC,WAAW,CAAC,iDAAiD,CACjG,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,cAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,iEAAiE,CAAC,CAAA;IACrG,MAAM,GAAG,GAAI,MAAyD,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAA;IAC5F,MAAM,QAAQ,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;IAExC,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,0EAA0E;YAC1E,iCAAiC,cAAc,IAAI,QAAQ,IAAI;YAC/D,iCAAiC,QAAQ,IAAI,QAAQ,MAAM;YAC3D,oEAAoE;YACpE,uEAAuE,CACxE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/tenant/scope.d.ts

@@ -1,8 +0,0 @@
-import type { PgTable } from 'drizzle-orm/pg-core';
-export interface ScopeConfig {
-    readonly columnKey: string;
-}
-export declare function scopeTable<T extends PgTable>(table: T, column?: string): T;
-export declare function getScopeConfig(table: PgTable): ScopeConfig | null;
-export declare function isTenantScoped(table: PgTable): boolean;
-//# sourceMappingURL=scope.d.ts.map

package/dist/tenant/scope.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/tenant/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAID,wBAAgB,UAAU,CAAC,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,CAe1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAEjE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD"}

package/dist/tenant/scope.js

@@ -1,21 +0,0 @@
-import { getTableColumns } from '../db/generated/drizzle-orm/introspection.js';
-const SCOPED_TABLES = new WeakMap();
-export function scopeTable(table, column) {
-    const key = column ?? 'tenantId';
-    const columns = getTableColumns(table);
-    if (!(key in columns)) {
-        const available = Object.keys(columns).join(', ');
-        throw new Error(`[pipework] tenant.scoped(): Table does not have column "${key}".\n\n` +
-            `  Available columns: ${available}\n` +
-            `  Hint: Pass the column name as the second argument: tenant.scoped(table, 'myColumn')\n`);
-    }
-    SCOPED_TABLES.set(table, { columnKey: key });
-    return table;
-}
-export function getScopeConfig(table) {
-    return SCOPED_TABLES.get(table) ?? null;
-}
-export function isTenantScoped(table) {
-    return SCOPED_TABLES.has(table);
-}
-//# sourceMappingURL=scope.js.map

package/dist/tenant/scope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/tenant/scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAA;AAM9E,MAAM,aAAa,GAAG,IAAI,OAAO,EAAwB,CAAA;AAEzD,MAAM,UAAU,UAAU,CAAoB,KAAQ,EAAE,MAAe;IACrE,MAAM,GAAG,GAAG,MAAM,IAAI,UAAU,CAAA;IAChC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAEtC,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjD,MAAM,IAAI,KAAK,CACb,2DAA2D,GAAG,QAAQ;YACtE,wBAAwB,SAAS,IAAI;YACrC,yFAAyF,CAC1F,CAAA;IACH,CAAC;IAED,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC"}

package/dist/tenant/scoped-db.d.ts

@@ -1,4 +0,0 @@
-import type { DB } from '../db/types.js';
-export declare function createTenantGuardDb(db: DB): DB;
-export declare function createScopedDb(db: DB, tenantId: string): DB;
-//# sourceMappingURL=scoped-db.d.ts.map

package/dist/tenant/scoped-db.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scoped-db.d.ts","sourceRoot":"","sources":["../../src/tenant/scoped-db.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AA+JxC,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAsB9C;AAmBD,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,CAgE3D"}

package/dist/tenant/scoped-db.js

@@ -1,234 +0,0 @@
-import { eq, and } from '../db/generated/drizzle-orm/operator.js';
-import { getTableColumns, getTableName } from '../db/generated/drizzle-orm/introspection.js';
-import { getScopeConfig } from './scope.js';
-function buildTenantCondition(table, columnKey, tenantId) {
-    const columns = getTableColumns(table);
-    const col = columns[columnKey];
-    return eq(col, tenantId);
-}
-function bindMethod(obj, prop) {
-    const val = Reflect.get(obj, prop, obj);
-    return typeof val === 'function' ? val.bind(obj) : val;
-}
-function wrapFinalBuilder(builder, condition) {
-    let whereApplied = false;
-    const wrap = (target) => new Proxy(target, {
-        get(t, prop) {
-            if (prop === 'where') {
-                return (userCondition) => {
-                    whereApplied = true;
-                    const combined = userCondition != null ? and(userCondition, condition) : condition;
-                    const result = t['where'].call(t, combined);
-                    return passthrough(result);
-                };
-            }
-            if (prop === 'then') {
-                if (!whereApplied) {
-                    const scoped = t['where'].call(t, condition);
-                    return bindMethod(scoped, 'then');
-                }
-                return bindMethod(t, 'then');
-            }
-            if (prop === 'catch' || prop === 'finally') {
-                if (!whereApplied) {
-                    const scoped = t['where'].call(t, condition);
-                    return bindMethod(scoped, prop);
-                }
-                return bindMethod(t, prop);
-            }
-            const value = Reflect.get(t, prop, t);
-            if (typeof value !== 'function')
-                return value;
-            return (...args) => {
-                const result = value.apply(t, args);
-                if (result != null && typeof result === 'object' && 'where' in result) {
-                    return wrap(result);
-                }
-                if (result != null && typeof result === 'object' && 'then' in result) {
-                    return passthrough(result);
-                }
-                return result;
-            };
-        },
-    });
-    const passthrough = (target) => new Proxy(target, {
-        get(t, prop) {
-            if (prop === 'then' || prop === 'catch' || prop === 'finally') {
-                return bindMethod(t, prop);
-            }
-            const value = Reflect.get(t, prop, t);
-            if (typeof value !== 'function')
-                return value;
-            return (...args) => {
-                const result = value.apply(t, args);
-                if (result != null && typeof result === 'object' && 'then' in result) {
-                    return passthrough(result);
-                }
-                return result;
-            };
-        },
-    });
-    return wrap(builder);
-}
-function wrapUpdateBuilder(builder, condition) {
-    return new Proxy(builder, {
-        get(t, prop) {
-            if (prop === 'set') {
-                return (...args) => {
-                    const result = t['set'].apply(t, args);
-                    return wrapFinalBuilder(result, condition);
-                };
-            }
-            const value = Reflect.get(t, prop, t);
-            return typeof value === 'function' ? value.bind(t) : value;
-        },
-    });
-}
-function wrapInsertBuilder(builder, columnKey, tenantId) {
-    return new Proxy(builder, {
-        get(t, prop) {
-            if (prop === 'values') {
-                return (values) => {
-                    const inject = (row) => {
-                        const existing = row[columnKey];
-                        if (existing !== undefined && existing !== tenantId) {
-                            throw new Error(`[pipework] Tenant-scoped insert: value has ${columnKey} "${String(existing)}" ` +
-                                `but the current context tenant is "${tenantId}".\n\n` +
-                                `  Remove the explicit ${columnKey} from your insert values — it's set automatically.\n` +
-                                '  If you need cross-tenant writes, file an issue on the pipework repo.\n');
-                        }
-                        return { ...row, [columnKey]: tenantId };
-                    };
-                    const scoped = Array.isArray(values)
-                        ? values.map(inject)
-                        : inject(values);
-                    return t['values'].call(t, scoped);
-                };
-            }
-            const value = Reflect.get(t, prop, t);
-            return typeof value === 'function' ? value.bind(t) : value;
-        },
-    });
-}
-function wrapSelectBuilder(builder, tenantId) {
-    return new Proxy(builder, {
-        get(t, prop) {
-            if (prop === 'from') {
-                return (table, ...rest) => {
-                    const result = t['from'].call(t, table, ...rest);
-                    const config = getScopeConfig(table);
-                    if (!config)
-                        return result;
-                    const cond = buildTenantCondition(table, config.columnKey, tenantId);
-                    return wrapFinalBuilder(result, cond);
-                };
-            }
-            const value = Reflect.get(t, prop, t);
-            return typeof value === 'function' ? value.bind(t) : value;
-        },
-    });
-}
-function throwTenantRequired(tableName, operation) {
-    throw new Error(`[pipework] Cannot ${operation} tenant-scoped table "${tableName}" without a tenant in context.\n\n` +
-        '  This table has a .tenant() field, which means all operations require\n' +
-        '  an active tenant in the request/job context.\n\n' +
-        '  If this is a system-level operation that legitimately needs to operate\n' +
-        '  without a tenant (admin tooling, analytics), file an issue on the\n' +
-        '  pipework repo describing your use case.\n');
-}
-export function createTenantGuardDb(db) {
-    return new Proxy(db, {
-        get(target, prop, receiver) {
-            if (prop === 'insert' || prop === 'update' || prop === 'delete') {
-                return (table) => {
-                    if (getScopeConfig(table)) {
-                        throwTenantRequired(getTableName(table), prop);
-                    }
-                    return target[prop].call(target, table);
-                };
-            }
-            if (prop === 'select' || prop === 'selectDistinct' || prop === 'selectDistinctOn') {
-                return (...args) => {
-                    const selectBuilder = target[prop](...args);
-                    return wrapGuardSelectBuilder(selectBuilder);
-                };
-            }
-            return Reflect.get(target, prop, receiver);
-        },
-    });
-}
-function wrapGuardSelectBuilder(builder) {
-    return new Proxy(builder, {
-        get(t, prop) {
-            if (prop === 'from') {
-                return (table, ...rest) => {
-                    if (getScopeConfig(table)) {
-                        throwTenantRequired(getTableName(table), 'select from');
-                    }
-                    return t['from'].call(t, table, ...rest);
-                };
-            }
-            const value = Reflect.get(t, prop, t);
-            return typeof value === 'function' ? value.bind(t) : value;
-        },
-    });
-}
-export function createScopedDb(db, tenantId) {
-    return new Proxy(db, {
-        get(target, prop, receiver) {
-            if (prop === 'insert') {
-                return (table) => {
-                    const builder = target.insert(table);
-                    const config = getScopeConfig(table);
-                    if (!config)
-                        return builder;
-                    return wrapInsertBuilder(builder, config.columnKey, tenantId);
-                };
-            }
-            if (prop === 'update') {
-                return (table) => {
-                    const builder = target.update(table);
-                    const config = getScopeConfig(table);
-                    if (!config)
-                        return builder;
-                    const cond = buildTenantCondition(table, config.columnKey, tenantId);
-                    return wrapUpdateBuilder(builder, cond);
-                };
-            }
-            if (prop === 'delete') {
-                return (table) => {
-                    const builder = target.delete(table);
-                    const config = getScopeConfig(table);
-                    if (!config)
-                        return builder;
-                    const cond = buildTenantCondition(table, config.columnKey, tenantId);
-                    return wrapFinalBuilder(builder, cond);
-                };
-            }
-            if (prop === 'select' || prop === 'selectDistinct' || prop === 'selectDistinctOn') {
-                return (...args) => {
-                    const selectBuilder = target[prop](...args);
-                    return wrapSelectBuilder(selectBuilder, tenantId);
-                };
-            }
-            if (prop === 'execute') {
-                return () => {
-                    throw new Error('[pipework] execute() is not available on a tenant-scoped database connection.\n\n' +
-                        '  Tenant-scoped connections only support select, insert, update, and delete\n' +
-                        '  operations, which are automatically filtered by tenant.\n\n' +
-                        '  If you need to run a query that the builder cannot express, file an issue\n' +
-                        '  on the pipework repo describing your use case.\n');
-                };
-            }
-            if (prop === '$with') {
-                return () => {
-                    throw new Error('[pipework] $with() (common table expressions) is not available on a tenant-scoped database connection.\n\n' +
-                        '  CTEs bypass tenant scoping. If you need CTE support, file an issue\n' +
-                        '  on the pipework repo describing your use case.\n');
-                };
-            }
-            return Reflect.get(target, prop, receiver);
-        },
-    });
-}
-//# sourceMappingURL=scoped-db.js.map

package/dist/tenant/scoped-db.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scoped-db.js","sourceRoot":"","sources":["../../src/tenant/scoped-db.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,yCAAyC,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,8CAA8C,CAAA;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAI3C,SAAS,oBAAoB,CAAC,KAAc,EAAE,SAAiB,EAAE,QAAgB;IAC/E,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAE,CAAA;IAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAqB;IACpD,MAAM,GAAG,GAAY,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IAChD,OAAO,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAE,GAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,SAAc;IACvD,IAAI,YAAY,GAAG,KAAK,CAAA;IAExB,MAAM,IAAI,GAAG,CAAC,MAAc,EAAU,EAAE,CACtC,IAAI,KAAK,CAAC,MAAM,EAAE;QAChB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,aAA8B,EAAE,EAAE;oBACxC,YAAY,GAAG,IAAI,CAAA;oBACnB,MAAM,QAAQ,GAAG,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBAClF,MAAM,MAAM,GAAI,CAA2B,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAW,CAAA;oBACjF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAA;gBAC5B,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAI,CAA2B,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAW,CAAA;oBAClF,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBACnC,CAAC;gBACD,OAAO,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YAC9B,CAAC;YAED,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAI,CAA2B,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAW,CAAA;oBAClF,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACjC,CAAC;gBACD,OAAO,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;YAC5B,CAAC;YAED,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;YAE7C,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAI,KAAe,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC9C,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAK,MAAiB,EAAE,CAAC;oBAClF,OAAO,IAAI,CAAC,MAAgB,CAAC,CAAA;gBAC/B,CAAC;gBACD,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAK,MAAiB,EAAE,CAAC;oBACjF,OAAO,WAAW,CAAC,MAAgB,CAAC,CAAA;gBACtC,CAAC;gBACD,OAAO,MAAM,CAAA;YACf,CAAC,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEJ,MAAM,WAAW,GAAG,CAAC,MAAc,EAAU,EAAE,CAC7C,IAAI,KAAK,CAAC,MAAM,EAAE;QAChB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9D,OAAO,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;YAC5B,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;YAC7C,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAI,KAAe,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC9C,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAK,MAAiB,EAAE,CAAC;oBACjF,OAAO,WAAW,CAAC,MAAgB,CAAC,CAAA;gBACtC,CAAC;gBACD,OAAO,MAAM,CAAA;YACf,CAAC,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEJ,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,SAAc;IACxD,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAI,CAA2B,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAW,CAAA;oBAC5E,OAAO,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;gBAC5C,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,SAAiB,EAAE,QAAgB;IAC7E,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAe,EAAE,EAAE;oBACzB,MAAM,MAAM,GAAG,CAAC,GAA4B,EAA2B,EAAE;wBACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;wBAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACpD,MAAM,IAAI,KAAK,CACb,8CAA8C,SAAS,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI;gCAChF,sCAAsC,QAAQ,QAAQ;gCACtD,yBAAyB,SAAS,sDAAsD;gCACxF,0EAA0E,CAC3E,CAAA;wBACH,CAAC;wBACD,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;oBAC1C,CAAC,CAAA;oBACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;wBAClC,CAAC,CAAE,MAAoC,CAAC,GAAG,CAAC,MAAM,CAAC;wBACnD,CAAC,CAAC,MAAM,CAAC,MAAiC,CAAC,CAAA;oBAC7C,OAAQ,CAA2B,CAAC,QAAQ,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;gBAChE,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,QAAgB;IAC1D,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAI,CAA2B,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,CAAW,CAAA;oBACtF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,MAAM,CAAA;oBAC1B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACpE,OAAO,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACvC,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB,EAAE,SAAiB;IAC/D,MAAM,IAAI,KAAK,CACb,qBAAqB,SAAS,yBAAyB,SAAS,oCAAoC;QACpG,0EAA0E;QAC1E,oDAAoD;QACpD,4EAA4E;QAC5E,uEAAuE;QACvE,6CAA6C,CAC9C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAM;IACxC,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChE,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1B,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,IAAc,CAAC,CAAA;oBAC1D,CAAC;oBACD,OAAQ,MAA2C,CAAC,IAAc,CAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;gBAC1F,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAClF,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,aAAa,GAAI,MAA2C,CAAC,IAAc,CAAE,CAAC,GAAG,IAAI,CAAC,CAAA;oBAC5F,OAAO,sBAAsB,CAAC,aAAuB,CAAC,CAAA;gBACxD,CAAC,CAAA;YACH,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC5C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE;QACxB,GAAG,CAAC,CAAC,EAAE,IAAI;YACT,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE;oBAC5C,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1B,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAA;oBACzD,CAAC;oBACD,OAAQ,CAA2B,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAA;gBACtE,CAAC,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YAC9C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAM,EAAE,QAAgB;IACrD,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAA;oBAC3B,OAAO,iBAAiB,CAAC,OAA4B,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;gBACpF,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAA;oBAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACpE,OAAO,iBAAiB,CAAC,OAA4B,EAAE,IAAI,CAAC,CAAA;gBAC9D,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAc,EAAE,EAAE;oBACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;oBACpC,IAAI,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAA;oBAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACpE,OAAO,gBAAgB,CAAC,OAA4B,EAAE,IAAI,CAAC,CAAA;gBAC7D,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAClF,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,aAAa,GAAI,MAA2C,CAAC,IAAc,CAAE,CAAC,GAAG,IAAI,CAAC,CAAA;oBAC5F,OAAO,iBAAiB,CAAC,aAAuB,EAAE,QAAQ,CAAC,CAAA;gBAC7D,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,GAAG,EAAE;oBACV,MAAM,IAAI,KAAK,CACb,mFAAmF;wBACnF,+EAA+E;wBAC/E,+DAA+D;wBAC/D,+EAA+E;wBAC/E,oDAAoD,CACrD,CAAA;gBACH,CAAC,CAAA;YACH,CAAC;YAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,OAAO,GAAG,EAAE;oBACV,MAAM,IAAI,KAAK,CACb,4GAA4G;wBAC5G,wEAAwE;wBACxE,oDAAoD,CACrD,CAAA;gBACH,CAAC,CAAA;YACH,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC5C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/tenant/types.d.ts

@@ -1,14 +0,0 @@
-/** Configuration for tenant extraction and isolation strategy. */
-export interface TenantConfig {
-    readonly extract: (auth: unknown) => string | null;
-    readonly sessionVars?: Record<string, (ctx: TenantContext) => string>;
-    readonly validate?: (tenantId: string) => boolean;
-    readonly required?: boolean;
-}
-/** Resolved tenant context — tenant ID, request ID, and user ID. */
-export interface TenantContext {
-    readonly tenant: string;
-    readonly requestId: string;
-    readonly userId: string | null;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/tenant/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/tenant/types.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAA;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,MAAM,CAAC,CAAA;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B"}

package/dist/tenant/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map

package/dist/tenant/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tenant/types.ts"],"names":[],"mappings":""}

package/dist/tenant/validate.d.ts

@@ -1,4 +0,0 @@
-export declare function validateTenantId(value: string): boolean;
-export declare function validateSessionVarName(name: string): void;
-export declare function validateSessionVarValue(value: string): void;
-//# sourceMappingURL=validate.d.ts.map

package/dist/tenant/validate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/tenant/validate.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQzD;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAQ3D"}

package/dist/tenant/validate.js

@@ -1,20 +0,0 @@
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const SAFE_VAR_NAME = /^[a-z][a-z0-9_.]*$/;
-export function validateTenantId(value) {
-    return UUID_PATTERN.test(value);
-}
-export function validateSessionVarName(name) {
-    if (!SAFE_VAR_NAME.test(name)) {
-        throw new Error(`[pipework] Invalid session variable name: "${name}". ` +
-            `Variable names must match /^[a-z][a-z0-9_.]*$/. ` +
-            `This prevents SQL injection in SET LOCAL statements.`);
-    }
-}
-export function validateSessionVarValue(value) {
-    if (/[;'"\n\r]/.test(value)) {
-        throw new Error(`[pipework] Unsafe session variable value rejected. ` +
-            `Values must not contain semicolons, quotes, or newlines. ` +
-            `Received: "${value.slice(0, 40)}${value.length > 40 ? '...' : ''}"`);
-    }
-}
-//# sourceMappingURL=validate.js.map

package/dist/tenant/validate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/tenant/validate.ts"],"names":[],"mappings":"AAAA,MAAM,YAAY,GAAG,iEAAiE,CAAA;AAEtF,MAAM,aAAa,GAAG,oBAAoB,CAAA;AAE1C,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,KAAK;YACvD,kDAAkD;YAClD,sDAAsD,CACvD,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,qDAAqD;YACrD,2DAA2D;YAC3D,cAAc,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CACrE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/test/vitest-config.d.ts

@@ -1,21 +0,0 @@
-import { type ViteUserConfig } from 'vitest/config';
-import { type PipeworkVitestOptions } from './vitest-plugin.js';
-export { resolveVitestWorkspace, resolveVitestModules } from './vitest-workspace.js';
-export type { PipeworkVitestOptions };
-export interface TestConfigOptions {
-    /** Set to `false` to skip DB auto-setup — use for pure unit test configs that never call `pipe()` or `withFlow()`. Shorthand for `pipework: { database: false }`. */
-    database?: boolean;
-    pipework?: PipeworkVitestOptions;
-    test?: {
-        setupFiles?: string | string[];
-        testTimeout?: number;
-        hookTimeout?: number;
-        pool?: string;
-        include?: string[];
-        exclude?: string[];
-        [key: string]: unknown;
-    };
-    [key: string]: unknown;
-}
-export declare function defineTestConfig(overrides?: TestConfigOptions): ViteUserConfig;
-//# sourceMappingURL=vitest-config.d.ts.map

package/dist/test/vitest-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vitest-config.d.ts","sourceRoot":"","sources":["../../src/test/vitest-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,EAAY,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAEzE,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACpF,YAAY,EAAE,qBAAqB,EAAE,CAAA;AAErC,MAAM,WAAW,iBAAiB;IAChC,qKAAqK;IACrK,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,IAAI,CAAC,EAAE;QACL,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,iBAAiB,GAAG,cAAc,CAuC9E"}