pipework 0.8.6 → 0.8.8

package/dist/temporal/get-current.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-current.js","sourceRoot":"","sources":["../../src/temporal/get-current.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,8CAA8C,CAAA;AAE3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAEpD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAwB;IACvD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE7F,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,iCAAiC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,KAAK,2BAA2B,CACpG,CAAA;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,sBAAsB,CAC9B,uCAAuC,KAAK,gCAAgC;YAC5E,6DAA6D,IAAI,CAAC,MAAM,GAAG,EAC3E,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAC9B,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;IACpB,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAW,EAAE,CAAA;AACvE,CAAC"}

package/dist/temporal/index.d.ts

@@ -0,0 +1,9 @@
+export { temporalColumns } from './columns.js';
+export { atTime, current, between } from './query.js';
+export { revise } from './revise.js';
+export { close } from './close.js';
+export { getCurrent } from './get-current.js';
+export { TemporalIntegrityError } from './errors.js';
+export { asOf, allVersions, effectiveUpdate, type DefinitionReviseOptions } from './definition-queries.js';
+export type { TemporalOptions, ReviseOptions, ReviseResult, GetCurrentResult } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/temporal/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/temporal/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAC1G,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA"}

package/dist/temporal/index.js

@@ -0,0 +1,8 @@
+export { temporalColumns } from './columns.js';
+export { atTime, current, between } from './query.js';
+export { revise } from './revise.js';
+export { close } from './close.js';
+export { getCurrent } from './get-current.js';
+export { TemporalIntegrityError } from './errors.js';
+export { asOf, allVersions, effectiveUpdate } from './definition-queries.js';
+//# sourceMappingURL=index.js.map

package/dist/temporal/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/temporal/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAgC,MAAM,yBAAyB,CAAA"}

package/dist/temporal/namespace.d.ts

@@ -0,0 +1,31 @@
+import { temporalColumns } from './columns.js';
+import { revise } from './revise.js';
+import { close } from './close.js';
+import { getCurrent } from './get-current.js';
+import { atTime, between } from './query.js';
+import { TemporalIntegrityError } from './errors.js';
+import { asOf, allVersions, effectiveUpdate } from './definition-queries.js';
+/** Temporal (bitemporal) data namespace — version history with effective date ranges. */
+export declare const temporal: {
+    /** Returns the standard temporal column definitions (effectiveFrom, effectiveTo, version, createdBy) for table schemas. */
+    columns: typeof temporalColumns;
+    /** Creates a new version of a temporal record, closing the previous version's effectiveTo. */
+    revise: typeof revise;
+    /** Closes a temporal record by setting effectiveTo to now. Returns number of rows affected. */
+    close: typeof close;
+    /** Fetches the currently-effective version of a temporal record (effectiveTo IS NULL). */
+    current: typeof getCurrent;
+    /** Returns a SQL condition for records effective at a specific point in time. */
+    atTime: typeof atTime;
+    /** Returns a SQL condition for records overlapping a date range. */
+    between: typeof between;
+    /** Thrown when a temporal operation would violate version continuity. */
+    TemporalIntegrityError: typeof TemporalIntegrityError;
+    /** Query records effective at a specific date, using a domain definition with .effectiveDated() trait. */
+    asOf: typeof asOf;
+    /** Query all versions of temporal records (no date filter). */
+    allVersions: typeof allVersions;
+    /** Close the current version and create a new one with updated data. */
+    effectiveUpdate: typeof effectiveUpdate;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/temporal/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/temporal/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAE5E,yFAAyF;AACzF,eAAO,MAAM,QAAQ;IACnB,2HAA2H;;IAE3H,8FAA8F;;IAE9F,+FAA+F;;IAE/F,0FAA0F;;IAE1F,iFAAiF;;IAEjF,oEAAoE;;IAEpE,yEAAyE;;IAEzE,0GAA0G;;IAE1G,+DAA+D;;IAE/D,wEAAwE;;CAEzE,CAAA"}

package/dist/temporal/namespace.js

@@ -0,0 +1,31 @@
+import { temporalColumns } from './columns.js';
+import { revise } from './revise.js';
+import { close } from './close.js';
+import { getCurrent } from './get-current.js';
+import { atTime, between } from './query.js';
+import { TemporalIntegrityError } from './errors.js';
+import { asOf, allVersions, effectiveUpdate } from './definition-queries.js';
+/** Temporal (bitemporal) data namespace — version history with effective date ranges. */
+export const temporal = {
+    /** Returns the standard temporal column definitions (effectiveFrom, effectiveTo, version, createdBy) for table schemas. */
+    columns: temporalColumns,
+    /** Creates a new version of a temporal record, closing the previous version's effectiveTo. */
+    revise,
+    /** Closes a temporal record by setting effectiveTo to now. Returns number of rows affected. */
+    close,
+    /** Fetches the currently-effective version of a temporal record (effectiveTo IS NULL). */
+    current: getCurrent,
+    /** Returns a SQL condition for records effective at a specific point in time. */
+    atTime,
+    /** Returns a SQL condition for records overlapping a date range. */
+    between,
+    /** Thrown when a temporal operation would violate version continuity. */
+    TemporalIntegrityError,
+    /** Query records effective at a specific date, using a domain definition with .effectiveDated() trait. */
+    asOf,
+    /** Query all versions of temporal records (no date filter). */
+    allVersions,
+    /** Close the current version and create a new one with updated data. */
+    effectiveUpdate,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/temporal/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/temporal/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAE5E,yFAAyF;AACzF,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,2HAA2H;IAC3H,OAAO,EAAE,eAAe;IACxB,8FAA8F;IAC9F,MAAM;IACN,+FAA+F;IAC/F,KAAK;IACL,0FAA0F;IAC1F,OAAO,EAAE,UAAU;IACnB,iFAAiF;IACjF,MAAM;IACN,oEAAoE;IACpE,OAAO;IACP,yEAAyE;IACzE,sBAAsB;IACtB,0GAA0G;IAC1G,IAAI;IACJ,+DAA+D;IAC/D,WAAW;IACX,wEAAwE;IACxE,eAAe;CAChB,CAAA"}

package/dist/temporal/query.d.ts

@@ -0,0 +1,10 @@
+import type { SQL, Column } from '../db/types.js';
+interface HasTemporalColumns {
+    effectiveFrom: Column;
+    effectiveTo: Column;
+}
+export declare function atTime<T extends HasTemporalColumns>(table: T, asOf: Date): SQL;
+export declare function current<T extends HasTemporalColumns>(table: T): SQL;
+export declare function between<T extends HasTemporalColumns>(table: T, from: Date, to: Date): SQL;
+export {};
+//# sourceMappingURL=query.d.ts.map

package/dist/temporal/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/temporal/query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAEjD,UAAU,kBAAkB;IAC1B,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,wBAAgB,MAAM,CAAC,CAAC,SAAS,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,GAAG,CAK9E;AAED,wBAAgB,OAAO,CAAC,CAAC,SAAS,kBAAkB,EAAE,KAAK,EAAE,CAAC,GAAG,GAAG,CAEnE;AAED,wBAAgB,OAAO,CAAC,CAAC,SAAS,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,GAAG,GAAG,CAKzF"}

package/dist/temporal/query.js

@@ -0,0 +1,11 @@
+import { and, lte, gt, isNull, or } from '../db/generated/drizzle-orm/operator.js';
+export function atTime(table, asOf) {
+    return and(lte(table.effectiveFrom, asOf), or(isNull(table.effectiveTo), gt(table.effectiveTo, asOf)));
+}
+export function current(table) {
+    return isNull(table.effectiveTo);
+}
+export function between(table, from, to) {
+    return and(lte(table.effectiveFrom, to), or(isNull(table.effectiveTo), gt(table.effectiveTo, from)));
+}
+//# sourceMappingURL=query.js.map

package/dist/temporal/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/temporal/query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,yCAAyC,CAAA;AAQlF,MAAM,UAAU,MAAM,CAA+B,KAAQ,EAAE,IAAU;IACvE,OAAO,GAAG,CACR,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,EAC9B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAC1D,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAA+B,KAAQ;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,OAAO,CAA+B,KAAQ,EAAE,IAAU,EAAE,EAAQ;IAClF,OAAO,GAAG,CACR,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,EAC5B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAC1D,CAAA;AACJ,CAAC"}

package/dist/temporal/revise.d.ts

@@ -0,0 +1,3 @@
+import type { ReviseOptions, ReviseResult } from './types.js';
+export declare function revise(options: ReviseOptions): Promise<ReviseResult>;
+//# sourceMappingURL=revise.d.ts.map

package/dist/temporal/revise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revise.d.ts","sourceRoot":"","sources":["../../src/temporal/revise.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAI7D,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAoE1E"}

package/dist/temporal/revise.js

@@ -0,0 +1,52 @@
+import { sql } from '../db/sql.js';
+import { getTableName } from '../db/generated/drizzle-orm/introspection.js';
+import { TemporalIntegrityError } from './errors.js';
+import { assertValidIdentifier, quoteIdentifier } from '../db/identifiers.js';
+export async function revise(options) {
+    const { tx, where, data, userId } = options;
+    const table = typeof options.table === 'string' ? options.table : getTableName(options.table);
+    const current = await tx.execute(sql `SELECT id, version FROM ${sql.identifier(table)} WHERE ${where} AND effective_to IS NULL FOR UPDATE`);
+    if (current.length === 0) {
+        throw new TemporalIntegrityError(`No current version found. Cannot revise a record in "${table}" — ` +
+            `ensure the entity exists and has an open version (effective_to IS NULL).`, { table });
+    }
+    if (current.length > 1) {
+        throw new TemporalIntegrityError(`Multiple open versions detected in "${table}" — data integrity violation. ` +
+            `Expected exactly one row with effective_to IS NULL, found ${current.length}.`, { table, count: current.length });
+    }
+    const currentRow = current[0];
+    const currentId = currentRow['id'];
+    const currentVersion = currentRow['version'];
+    await tx.execute(sql `UPDATE ${sql.identifier(table)} SET effective_to = now() WHERE id = ${currentId}::uuid`);
+    const columns = Object.keys(data);
+    const values = Object.values(data);
+    for (const col of columns) {
+        assertValidIdentifier(col, 'column');
+    }
+    const allColumns = [...columns, 'effective_from', 'effective_to', 'version', 'created_by'];
+    const colListRaw = allColumns.map((c) => quoteIdentifier(c, 'column')).join(', ');
+    const serializedValues = values.map((v) => {
+        if (v === null || v === undefined)
+            return null;
+        if (typeof v === 'object')
+            return JSON.stringify(v);
+        return v;
+    });
+    const valueParts = [
+        ...serializedValues.map((v) => sql `${v ?? null}`),
+        sql `now()`,
+        sql `NULL`,
+        sql `${currentVersion + 1}`,
+        sql `${userId ?? null}`,
+    ];
+    const valuesList = valueParts.reduce((acc, part, i) => {
+        if (i === 0)
+            return part;
+        return sql `${acc}, ${part}`;
+    });
+    assertValidIdentifier(table, 'table');
+    const result = await tx.execute(sql `INSERT INTO ${sql.raw(quoteIdentifier(table, 'table'))} (${sql.raw(colListRaw)}) VALUES (${valuesList}) RETURNING id::text, version`);
+    const row = result[0];
+    return { id: row['id'], version: row['version'] };
+}
+//# sourceMappingURL=revise.js.map

package/dist/temporal/revise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revise.js","sourceRoot":"","sources":["../../src/temporal/revise.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,8CAA8C,CAAA;AAE3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE7E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAsB;IACjD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAC3C,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE7F,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAC9B,GAAG,CAAA,2BAA2B,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,KAAK,sCAAsC,CACzG,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,sBAAsB,CAC9B,wDAAwD,KAAK,MAAM;YACnE,0EAA0E,EAC1E,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,sBAAsB,CAC9B,uCAAuC,KAAK,gCAAgC;YAC5E,6DAA6D,OAAO,CAAC,MAAM,GAAG,EAC9E,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CACjC,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;IAC9B,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAW,CAAA;IAC5C,MAAM,cAAc,GAAG,UAAU,CAAC,SAAS,CAAW,CAAA;IAEtD,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,UAAU,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,wCAAwC,SAAS,QAAQ,CAC5F,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAElC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACtC,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;IAC1F,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEjF,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QACnD,OAAO,CAAC,CAAA;IACV,CAAC,CAAC,CAAA;IAEF,MAAM,UAAU,GAAG;QACjB,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACjD,GAAG,CAAA,OAAO;QACV,GAAG,CAAA,MAAM;QACT,GAAG,CAAA,GAAG,cAAc,GAAG,CAAC,EAAE;QAC1B,GAAG,CAAA,GAAG,MAAM,IAAI,IAAI,EAAE;KACvB,CAAA;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE;QACpD,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,GAAG,CAAA,GAAG,GAAG,KAAK,IAAI,EAAE,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B,GAAG,CAAA,eAAe,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,UAAU,+BAA+B,CACzI,CAAA;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IACtB,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAW,EAAE,CAAA;AACvE,CAAC"}

package/dist/temporal/types.d.ts

@@ -0,0 +1,19 @@
+import type { DB, SQL, Table } from '../db/types.js';
+export interface TemporalOptions {
+    readonly tx: DB;
+    readonly table: string | Table;
+    readonly where: SQL;
+}
+export interface ReviseOptions extends TemporalOptions {
+    readonly data: Record<string, unknown>;
+    readonly userId?: string;
+}
+export interface ReviseResult {
+    readonly id: string;
+    readonly version: number;
+}
+export interface GetCurrentResult {
+    readonly id: string;
+    readonly version: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/temporal/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/temporal/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEpD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAA;IACf,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAA;CACpB;AAED,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB"}

package/dist/temporal/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/temporal/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/temporal/types.ts"],"names":[],"mappings":""}

package/dist/tenant/extract.d.ts

@@ -0,0 +1,6 @@
+import type { TenantConfig } from './types.js';
+export interface TenantExtractionResult {
+    readonly tenant: string | null;
+}
+export declare function extractTenant(auth: unknown, config: TenantConfig): TenantExtractionResult;
+//# sourceMappingURL=extract.d.ts.map

package/dist/tenant/extract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.d.ts","sourceRoot":"","sources":["../../src/tenant/extract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAI9C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,YAAY,GACnB,sBAAsB,CAqBxB"}

package/dist/tenant/extract.js

@@ -0,0 +1,18 @@
+import { validateTenantId } from './validate.js';
+import { UnauthorizedError } from '../errors/index.js';
+export function extractTenant(auth, config) {
+    const raw = config.extract(auth);
+    if (raw === null || raw === '') {
+        if (config.required !== false) {
+            throw new UnauthorizedError('Tenant context required but not present. Ensure auth strategy returns a tenantId.');
+        }
+        return { tenant: null };
+    }
+    const validator = config.validate ?? validateTenantId;
+    if (!validator(raw)) {
+        throw new UnauthorizedError(`Invalid tenant identifier: "${raw.slice(0, 40)}${raw.length > 40 ? '...' : ''}". ` +
+            `Tenant IDs must be valid UUIDs (or pass your custom validate function).`);
+    }
+    return { tenant: raw };
+}
+//# sourceMappingURL=extract.js.map

package/dist/tenant/extract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../src/tenant/extract.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAMtD,MAAM,UAAU,aAAa,CAC3B,IAAa,EACb,MAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,mFAAmF,CACpF,CAAA;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAA;IACrD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,+BAA+B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK;YACnF,yEAAyE,CAC1E,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AACxB,CAAC"}

package/dist/tenant/index.d.ts

@@ -0,0 +1,8 @@
+export type { TenantConfig, TenantContext } from './types.js';
+export { validateTenantId, validateSessionVarName, validateSessionVarValue } from './validate.js';
+export { propagateTenantLocals } from './propagate.js';
+export { extractTenant, type TenantExtractionResult } from './extract.js';
+export { tenantIsolationPolicy, enableTenantRls, verifyTenantContext } from './rls.js';
+export { scopeTable, getScopeConfig, isTenantScoped, type ScopeConfig } from './scope.js';
+export { createScopedDb, createTenantGuardDb } from './scoped-db.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tenant/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tenant/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/tenant/index.js

@@ -0,0 +1,7 @@
+export { validateTenantId, validateSessionVarName, validateSessionVarValue } from './validate.js';
+export { propagateTenantLocals } from './propagate.js';
+export { extractTenant } from './extract.js';
+export { tenantIsolationPolicy, enableTenantRls, verifyTenantContext } from './rls.js';
+export { scopeTable, getScopeConfig, isTenantScoped } from './scope.js';
+export { createScopedDb, createTenantGuardDb } from './scoped-db.js';
+//# sourceMappingURL=index.js.map

package/dist/tenant/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tenant/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAA+B,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAoB,MAAM,YAAY,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/tenant/namespace.d.ts

@@ -0,0 +1,23 @@
+import { validateTenantId } from './validate.js';
+import { enableTenantRls, tenantIsolationPolicy, verifyTenantContext } from './rls.js';
+import { propagateTenantLocals } from './propagate.js';
+import { extractTenant } from './extract.js';
+import { isTenantScoped } from './scope.js';
+/** Multi-tenant isolation namespace — RLS policies, tenant extraction, Postgres-side verification. */
+export declare const tenant: {
+    /** Validates a tenant ID format (non-empty string, safe characters). */
+    validate: typeof validateTenantId;
+    /** Enables RLS on a table and creates the tenant isolation policy in Postgres. */
+    rls: typeof enableTenantRls;
+    /** Returns the SQL string for a tenant isolation RLS policy — use in migrations. */
+    policy: typeof tenantIsolationPolicy;
+    /** Cross-checks ALS tenant against Postgres set_config('pipework.tenant_id') — defense-in-depth. */
+    verify: typeof verifyTenantContext;
+    /** Sets pipework.tenant_id on the Postgres connection via set_config(). */
+    propagate: typeof propagateTenantLocals;
+    /** Extracts tenant ID from auth context using the configured extraction strategy. */
+    extract: typeof extractTenant;
+    /** Returns true if a table has been marked as tenant-scoped (via .tenant() field metadata). */
+    isTenantScoped: typeof isTenantScoped;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/tenant/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/tenant/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,sGAAsG;AACtG,eAAO,MAAM,MAAM;IACjB,wEAAwE;;IAExE,kFAAkF;;IAElF,oFAAoF;;IAEpF,oGAAoG;;IAEpG,2EAA2E;;IAE3E,qFAAqF;;IAErF,+FAA+F;;CAEhG,CAAA"}

package/dist/tenant/namespace.js

@@ -0,0 +1,23 @@
+import { validateTenantId } from './validate.js';
+import { enableTenantRls, tenantIsolationPolicy, verifyTenantContext } from './rls.js';
+import { propagateTenantLocals } from './propagate.js';
+import { extractTenant } from './extract.js';
+import { isTenantScoped } from './scope.js';
+/** Multi-tenant isolation namespace — RLS policies, tenant extraction, Postgres-side verification. */
+export const tenant = {
+    /** Validates a tenant ID format (non-empty string, safe characters). */
+    validate: validateTenantId,
+    /** Enables RLS on a table and creates the tenant isolation policy in Postgres. */
+    rls: enableTenantRls,
+    /** Returns the SQL string for a tenant isolation RLS policy — use in migrations. */
+    policy: tenantIsolationPolicy,
+    /** Cross-checks ALS tenant against Postgres set_config('pipework.tenant_id') — defense-in-depth. */
+    verify: verifyTenantContext,
+    /** Sets pipework.tenant_id on the Postgres connection via set_config(). */
+    propagate: propagateTenantLocals,
+    /** Extracts tenant ID from auth context using the configured extraction strategy. */
+    extract: extractTenant,
+    /** Returns true if a table has been marked as tenant-scoped (via .tenant() field metadata). */
+    isTenantScoped,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/tenant/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/tenant/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,sGAAsG;AACtG,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,wEAAwE;IACxE,QAAQ,EAAE,gBAAgB;IAC1B,kFAAkF;IAClF,GAAG,EAAE,eAAe;IACpB,oFAAoF;IACpF,MAAM,EAAE,qBAAqB;IAC7B,oGAAoG;IACpG,MAAM,EAAE,mBAAmB;IAC3B,2EAA2E;IAC3E,SAAS,EAAE,qBAAqB;IAChC,qFAAqF;IACrF,OAAO,EAAE,aAAa;IACtB,+FAA+F;IAC/F,cAAc;CACf,CAAA"}

package/dist/tenant/propagate.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../db/index.js';
+import type { TenantConfig, TenantContext } from './types.js';
+export declare function propagateTenantLocals(tx: DB, config: TenantConfig, ctx: TenantContext): Promise<void>;
+//# sourceMappingURL=propagate.d.ts.map

package/dist/tenant/propagate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagate.d.ts","sourceRoot":"","sources":["../../src/tenant/propagate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG7D,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/tenant/propagate.js

@@ -0,0 +1,15 @@
+import { sql } from '../db/sql.js';
+import { validateSessionVarValue } from './validate.js';
+export async function propagateTenantLocals(tx, config, ctx) {
+    const vars = config.sessionVars;
+    if (!vars)
+        return;
+    for (const [name, resolver] of Object.entries(vars)) {
+        const value = resolver(ctx);
+        if (value === '')
+            continue;
+        validateSessionVarValue(value);
+        await tx.execute(sql `SELECT set_config(${name}, ${value}, true)`);
+    }
+}
+//# sourceMappingURL=propagate.js.map

package/dist/tenant/propagate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagate.js","sourceRoot":"","sources":["../../src/tenant/propagate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAGlC,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAEvD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAM,EACN,MAAoB,EACpB,GAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAA;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,KAAK,KAAK,EAAE;YAAE,SAAQ;QAC1B,uBAAuB,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,qBAAqB,IAAI,KAAK,KAAK,SAAS,CAAC,CAAA;IACnE,CAAC;AACH,CAAC"}

package/dist/tenant/rls.d.ts

@@ -0,0 +1,5 @@
+import type { DB } from '../db/index.js';
+export declare function tenantIsolationPolicy(table: string, column?: string, sessionVar?: string): string;
+export declare function enableTenantRls(db: DB, table: string, column?: string): Promise<void>;
+export declare function verifyTenantContext(db: DB, expectedTenant: string | null): Promise<void>;
+//# sourceMappingURL=rls.d.ts.map

package/dist/tenant/rls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../src/tenant/rls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAIxC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,MAAoB,EAAE,UAAU,GAAE,MAA6B,GAAG,MAAM,CAYpI;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/tenant/rls.js

@@ -0,0 +1,35 @@
+import { sql } from '../db/sql.js';
+import { quoteIdentifier } from '../db/identifiers.js';
+import { validateSessionVarName } from './validate.js';
+export function tenantIsolationPolicy(table, column = 'tenant_id', sessionVar = 'pipework.tenant_id') {
+    validateSessionVarName(sessionVar);
+    const t = quoteIdentifier(table, 'table');
+    const c = quoteIdentifier(column, 'column');
+    const policyName = `pipework_tenant_isolation_${table.replace(/[^a-zA-Z0-9_]/g, '_')}`;
+    return [
+        `ALTER TABLE ${t} ENABLE ROW LEVEL SECURITY`,
+        `ALTER TABLE ${t} FORCE ROW LEVEL SECURITY`,
+        `CREATE POLICY ${quoteIdentifier(policyName, 'policy')} ON ${t} USING (${c} = current_setting('${sessionVar}', true))`,
+    ].join(';\n');
+}
+export async function enableTenantRls(db, table, column = 'tenant_id') {
+    const t = quoteIdentifier(table, 'table');
+    const c = quoteIdentifier(column, 'column');
+    const policyName = quoteIdentifier(`pipework_tenant_isolation_${table.replace(/[^a-zA-Z0-9_]/g, '_')}`, 'policy');
+    await db.execute(sql.raw(`ALTER TABLE ${t} ENABLE ROW LEVEL SECURITY`));
+    await db.execute(sql.raw(`ALTER TABLE ${t} FORCE ROW LEVEL SECURITY`));
+    await db.execute(sql.raw(`CREATE POLICY ${policyName} ON ${t} USING (${c} = current_setting('pipework.tenant_id', true))`));
+}
+export async function verifyTenantContext(db, expectedTenant) {
+    const result = await db.execute(sql `SELECT current_setting('pipework.tenant_id', true) AS tenant_id`);
+    const raw = result[0]?.tenant_id ?? null;
+    const pgTenant = raw === '' ? null : raw;
+    if (pgTenant !== expectedTenant) {
+        throw new Error(`[pipework] Tenant context mismatch between application and database.\n\n` +
+            `  Application context tenant: ${expectedTenant ?? '(null)'}\n` +
+            `  PostgreSQL session tenant:  ${pgTenant ?? '(null)'}\n\n` +
+            `  This indicates an AsyncLocalStorage context integrity failure.\n` +
+            `  The request has been aborted to prevent cross-tenant data access.\n`);
+    }
+}
+//# sourceMappingURL=rls.js.map

package/dist/tenant/rls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.js","sourceRoot":"","sources":["../../src/tenant/rls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAElC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAEtD,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB,WAAW,EAAE,aAAqB,oBAAoB;IAC1H,sBAAsB,CAAC,UAAU,CAAC,CAAA;IAElC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,6BAA6B,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAA;IAEtF,OAAO;QACL,eAAe,CAAC,4BAA4B;QAC5C,eAAe,CAAC,2BAA2B;QAC3C,iBAAiB,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAuB,UAAU,WAAW;KACvH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa,EACb,SAAiB,WAAW;IAE5B,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,eAAe,CAChC,6BAA6B,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,EACnE,QAAQ,CACT,CAAA;IAED,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAA;IACvE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CACtB,iBAAiB,UAAU,OAAO,CAAC,WAAW,CAAC,iDAAiD,CACjG,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,cAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,iEAAiE,CAAC,CAAA;IACrG,MAAM,GAAG,GAAI,MAAyD,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAA;IAC5F,MAAM,QAAQ,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;IAExC,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,0EAA0E;YAC1E,iCAAiC,cAAc,IAAI,QAAQ,IAAI;YAC/D,iCAAiC,QAAQ,IAAI,QAAQ,MAAM;YAC3D,oEAAoE;YACpE,uEAAuE,CACxE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/tenant/scope.d.ts

@@ -0,0 +1,8 @@
+import type { PgTable } from 'drizzle-orm/pg-core';
+export interface ScopeConfig {
+    readonly columnKey: string;
+}
+export declare function scopeTable<T extends PgTable>(table: T, column?: string): T;
+export declare function getScopeConfig(table: PgTable): ScopeConfig | null;
+export declare function isTenantScoped(table: PgTable): boolean;
+//# sourceMappingURL=scope.d.ts.map

package/dist/tenant/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/tenant/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAID,wBAAgB,UAAU,CAAC,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,CAe1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAEjE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD"}

package/dist/tenant/scope.js

@@ -0,0 +1,21 @@
+import { getTableColumns } from '../db/generated/drizzle-orm/introspection.js';
+const SCOPED_TABLES = new WeakMap();
+export function scopeTable(table, column) {
+    const key = column ?? 'tenantId';
+    const columns = getTableColumns(table);
+    if (!(key in columns)) {
+        const available = Object.keys(columns).join(', ');
+        throw new Error(`[pipework] tenant.scoped(): Table does not have column "${key}".\n\n` +
+            `  Available columns: ${available}\n` +
+            `  Hint: Pass the column name as the second argument: tenant.scoped(table, 'myColumn')\n`);
+    }
+    SCOPED_TABLES.set(table, { columnKey: key });
+    return table;
+}
+export function getScopeConfig(table) {
+    return SCOPED_TABLES.get(table) ?? null;
+}
+export function isTenantScoped(table) {
+    return SCOPED_TABLES.has(table);
+}
+//# sourceMappingURL=scope.js.map

package/dist/tenant/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/tenant/scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAA;AAM9E,MAAM,aAAa,GAAG,IAAI,OAAO,EAAwB,CAAA;AAEzD,MAAM,UAAU,UAAU,CAAoB,KAAQ,EAAE,MAAe;IACrE,MAAM,GAAG,GAAG,MAAM,IAAI,UAAU,CAAA;IAChC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAEtC,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjD,MAAM,IAAI,KAAK,CACb,2DAA2D,GAAG,QAAQ;YACtE,wBAAwB,SAAS,IAAI;YACrC,yFAAyF,CAC1F,CAAA;IACH,CAAC;IAED,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC"}

package/dist/tenant/scoped-db.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../db/types.js';
+export declare function createTenantGuardDb(db: DB): DB;
+export declare function createScopedDb(db: DB, tenantId: string): DB;
+//# sourceMappingURL=scoped-db.d.ts.map

package/dist/tenant/scoped-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-db.d.ts","sourceRoot":"","sources":["../../src/tenant/scoped-db.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AA+JxC,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAsB9C;AAmBD,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,CAgE3D"}