{
  "class": "tenant-isolation",
  "holes": [
    {
      "id": "ti-001",
      "severity": "P2",
      "summary": "setAccountantExportJobDone queries accountantExportJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/accountant-export.ts:157",
      "fn_or_route": "setAccountantExportJobDone",
      "missing": "eq(accountantExportJobs.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(accountantExportJobs.tenantId, tenantId), eq(accountantExportJobs.id, id))",
      "evidence": "downloadExpiresAt: Date,"
    },
    {
      "id": "ti-002",
      "severity": "P2",
      "summary": "setAccountantExportJobError queries accountantExportJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/accountant-export.ts:169",
      "fn_or_route": "setAccountantExportJobError",
      "missing": "eq(accountantExportJobs.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(accountantExportJobs.tenantId, tenantId), eq(accountantExportJobs.id, id))",
      "evidence": "await db"
    },
    {
      "id": "ti-003",
      "severity": "P0",
      "summary": "softDeleteCustomerActivity queries customerActivities by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/activities.ts:65",
      "fn_or_route": "softDeleteCustomerActivity",
      "missing": "eq(customerActivities.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(customerActivities.tenantId, tenantId), eq(customerActivities.id, id))",
      "evidence": "await db"
    },
    {
      "id": "ti-004",
      "severity": "P0",
      "summary": "softDeleteInvoiceActivity queries invoiceActivities by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/activities.ts:109",
      "fn_or_route": "softDeleteInvoiceActivity",
      "missing": "eq(invoiceActivities.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(invoiceActivities.tenantId, tenantId), eq(invoiceActivities.id, id))",
      "evidence": "await db"
    },
    {
      "id": "ti-005",
      "severity": "P0",
      "summary": "softDeleteProjectActivity queries projectActivities by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/activities.ts:153",
      "fn_or_route": "softDeleteProjectActivity",
      "missing": "eq(projectActivities.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(projectActivities.tenantId, tenantId), eq(projectActivities.id, id))",
      "evidence": "await db"
    },
    {
      "id": "ti-006",
      "severity": "P0",
      "summary": "softDeleteVendorActivity queries vendorActivities by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/activities.ts:197",
      "fn_or_route": "softDeleteVendorActivity",
      "missing": "eq(vendorActivities.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(vendorActivities.tenantId, tenantId), eq(vendorActivities.id, id))",
      "evidence": "await db"
    },
    {
      "id": "ti-007",
      "severity": "P2",
      "summary": "hardDeleteAttachmentRow queries attachments by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/attachments.ts:206",
      "fn_or_route": "hardDeleteAttachmentRow",
      "missing": "eq(attachments.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(attachments.tenantId, tenantId), eq(attachments.id, id))",
      "evidence": "db: Db,"
    },
    {
      "id": "ti-008",
      "severity": "P0",
      "summary": "getRoleById queries roles by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/auth-reads.ts:80",
      "fn_or_route": "getRoleById",
      "missing": "eq(roles.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(roles.tenantId, tenantId), eq(roles.id, id))",
      "evidence": "const [row] = await db.select().from(roles).where(eq(roles.id, roleId)).limit(1)"
    },
    {
      "id": "ti-009",
      "severity": "P0",
      "summary": "performRecovery queries badDebtVatReclaims by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/bad-debt.ts:271",
      "fn_or_route": "performRecovery",
      "missing": "eq(badDebtVatReclaims.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(badDebtVatReclaims.tenantId, tenantId), eq(badDebtVatReclaims.id, id))",
      "evidence": "eq(badDebtVatReclaims.id, reclaim.id)) reclaimStatus = 'reversed' } else if (['pending', '"
    },
    {
      "id": "ti-010",
      "severity": "P0",
      "summary": "performRecovery queries badDebtVatReclaims by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/bad-debt.ts:277",
      "fn_or_route": "performRecovery",
      "missing": "eq(badDebtVatReclaims.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(badDebtVatReclaims.tenantId, tenantId), eq(badDebtVatReclaims.id, id))",
      "evidence": ".where(eq(badDebtVatReclaims.id, reclaim.id))"
    },
    {
      "id": "ti-011",
      "severity": "P0",
      "summary": "getCalendarConnectionById queries calendarConnections by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/calendar.ts:230",
      "fn_or_route": "getCalendarConnectionById",
      "missing": "eq(calendarConnections.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(calendarConnections.tenantId, tenantId), eq(calendarConnections.id, id))",
      "evidence": "const rows = await db"
    },
    {
      "id": "ti-012",
      "severity": "P0",
      "summary": "updateCalendarConnectionTokens queries calendarConnections by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/calendar.ts:273",
      "fn_or_route": "updateCalendarConnectionTokens",
      "missing": "eq(calendarConnections.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(calendarConnections.tenantId, tenantId), eq(calendarConnections.id, id))",
      "evidence": "tokenExpiresAt: Date,"
    },
    {
      "id": "ti-013",
      "severity": "P0",
      "summary": "updateCalendarConnectionLastSynced queries calendarConnections by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/calendar.ts:285",
      "fn_or_route": "updateCalendarConnectionLastSynced",
      "missing": "eq(calendarConnections.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(calendarConnections.tenantId, tenantId), eq(calendarConnections.id, id))",
      "evidence": "await db"
    },
    {
      "id": "ti-014",
      "severity": "P2",
      "summary": "getSchedulingConnectionById queries schedulingConnections by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/calendar.ts:342",
      "fn_or_route": "getSchedulingConnectionById",
      "missing": "eq(schedulingConnections.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(schedulingConnections.tenantId, tenantId), eq(schedulingConnections.id, id))",
      "evidence": "const rows = await db"
    },
    {
      "id": "ti-015",
      "severity": "P0",
      "summary": "bulkUpsertSignatories queries contractSignatories by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/contract-signatories.ts:128",
      "fn_or_route": "bulkUpsertSignatories",
      "missing": "eq(contractSignatories.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(contractSignatories.tenantId, tenantId), eq(contractSignatories.id, id))",
      "evidence": ")"
    },
    {
      "id": "ti-016",
      "severity": "P0",
      "summary": "markManualReminderSent queries contractSignatories by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/contract-signatories.ts:195",
      "fn_or_route": "markManualReminderSent",
      "missing": "eq(contractSignatories.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(contractSignatories.tenantId, tenantId), eq(contractSignatories.id, id))",
      "evidence": "const [updated] = await db.transaction(async (tx) => {"
    },
    {
      "id": "ti-017",
      "severity": "P0",
      "summary": "resendSignatoryLink queries contractSignatories by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/contract-signatories.ts:229",
      "fn_or_route": "resendSignatoryLink",
      "missing": "eq(contractSignatories.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(contractSignatories.tenantId, tenantId), eq(contractSignatories.id, id))",
      "evidence": "actorId: string,"
    },
    {
      "id": "ti-018",
      "severity": "P0",
      "summary": "replaceSignatory queries contractSignatories by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/contract-signatories.ts:260",
      "fn_or_route": "replaceSignatory",
      "missing": "eq(contractSignatories.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(contractSignatories.tenantId, tenantId), eq(contractSignatories.id, id))",
      "evidence": "actorId: string,"
    },
    {
      "id": "ti-019",
      "severity": "P1",
      "summary": "markSignatoryReminderSent queries contractSignatories by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/contract-signatories.ts:294",
      "fn_or_route": "markSignatoryReminderSent",
      "missing": "eq(contractSignatories.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(contractSignatories.tenantId, tenantId), eq(contractSignatories.id, id))",
      "evidence": ".set({"
    },
    {
      "id": "ti-020",
      "severity": "P0",
      "summary": "getContractPublic queries contracts by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/contracts.ts:80",
      "fn_or_route": "getContractPublic",
      "missing": "eq(contracts.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(contracts.tenantId, tenantId), eq(contracts.id, id))",
      "evidence": "const rows = await db"
    },
    {
      "id": "ti-021",
      "severity": "P0",
      "summary": "mergeCustomers queries customerMergeSuggestions by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/customer-dedup.ts:374",
      "fn_or_route": "mergeCustomers",
      "missing": "eq(customerMergeSuggestions.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(customerMergeSuggestions.tenantId, tenantId), eq(customerMergeSuggestions.id, id))",
      "evidence": "await tx"
    },
    {
      "id": "ti-022",
      "severity": "P0",
      "summary": "setImportJobProcessing queries importJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/data-import.ts:188",
      "fn_or_route": "setImportJobProcessing",
      "missing": "eq(importJobs.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(importJobs.tenantId, tenantId), eq(importJobs.id, id))",
      "evidence": "totalRows,"
    },
    {
      "id": "ti-023",
      "severity": "P0",
      "summary": "getExpenseById queries expenses by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/expenses.ts:225",
      "fn_or_route": "getExpenseById",
      "missing": "eq(expenses.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(expenses.tenantId, tenantId), eq(expenses.id, id))",
      "evidence": "const [row] = await db.select().from(expenses).where(eq(expenses.id, id))"
    },
    {
      "id": "ti-024",
      "severity": "P0",
      "summary": "setExpenseStatus queries expenses by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/expenses.ts:431",
      "fn_or_route": "setExpenseStatus",
      "missing": "eq(expenses.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(expenses.tenantId, tenantId), eq(expenses.id, id))",
      "evidence": "extra?: Partial<NewExpense>,"
    },
    {
      "id": "ti-025",
      "severity": "P1",
      "summary": "getLeadWebhookById queries leadWebhooks by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/marketing.ts:949",
      "fn_or_route": "getLeadWebhookById",
      "missing": "eq(leadWebhooks.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(leadWebhooks.tenantId, tenantId), eq(leadWebhooks.id, id))",
      "evidence": "const [row] = await db"
    },
    {
      "id": "ti-026",
      "severity": "P1",
      "summary": "touchWebhookLastReceived queries leadWebhooks by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/marketing.ts:1012",
      "fn_or_route": "touchWebhookLastReceived",
      "missing": "eq(leadWebhooks.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(leadWebhooks.tenantId, tenantId), eq(leadWebhooks.id, id))",
      "evidence": "await db"
    },
    {
      "id": "ti-027",
      "severity": "P1",
      "summary": "markAuthorizationCodeUsed queries oauthAuthorizationCodes by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/oauth.ts:152",
      "fn_or_route": "markAuthorizationCodeUsed",
      "missing": "eq(oauthAuthorizationCodes.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(oauthAuthorizationCodes.tenantId, tenantId), eq(oauthAuthorizationCodes.id, id))",
      "evidence": "): Promise<void> {"
    },
    {
      "id": "ti-028",
      "severity": "P1",
      "summary": "rotateOAuthRefreshToken queries oauthRefreshTokens by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/oauth.ts:274",
      "fn_or_route": "rotateOAuthRefreshToken",
      "missing": "eq(oauthRefreshTokens.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(oauthRefreshTokens.tenantId, tenantId), eq(oauthRefreshTokens.id, id))",
      "evidence": "await tx"
    },
    {
      "id": "ti-029",
      "severity": "P0",
      "summary": "getProjectProfitability queries customers by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/profitability.ts:121",
      "fn_or_route": "getProjectProfitability",
      "missing": "eq(customers.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(customers.tenantId, tenantId), eq(customers.id, id))",
      "evidence": "if (proj.customerId) {"
    },
    {
      "id": "ti-030",
      "severity": "P0",
      "summary": "updateTemplateTask queries projectTemplateTasks by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/project-templates.ts:374",
      "fn_or_route": "updateTemplateTask",
      "missing": "eq(projectTemplateTasks.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(projectTemplateTasks.tenantId, tenantId), eq(projectTemplateTasks.id, id))",
      "evidence": "? String(input.estimated_hours)"
    },
    {
      "id": "ti-031",
      "severity": "P0",
      "summary": "deleteTemplateTask queries projectTemplateTasks by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/project-templates.ts:396",
      "fn_or_route": "deleteTemplateTask",
      "missing": "eq(projectTemplateTasks.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(projectTemplateTasks.tenantId, tenantId), eq(projectTemplateTasks.id, id))",
      "evidence": "const template = await getTemplate(db, templateId, tenantId)"
    },
    {
      "id": "ti-032",
      "severity": "P0",
      "summary": "instantiateTemplate queries projectTemplates by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/project-templates.ts:576",
      "fn_or_route": "instantiateTemplate",
      "missing": "eq(projectTemplates.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(projectTemplates.tenantId, tenantId), eq(projectTemplates.id, id))",
      "evidence": "eq(projectTemplates.id, input.template_id)"
    },
    {
      "id": "ti-033",
      "severity": "P1",
      "summary": "revertLeadToQualifiedIfNoLiveProposal queries leads by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/proposal-expiry-cron.ts:154",
      "fn_or_route": "revertLeadToQualifiedIfNoLiveProposal",
      "missing": "eq(leads.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(leads.tenantId, tenantId), eq(leads.id, id))",
      "evidence": "if (otherLive) return false"
    },
    {
      "id": "ti-034",
      "severity": "P0",
      "summary": "voidReceipt queries receipts by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/receipts.ts:538",
      "fn_or_route": "voidReceipt",
      "missing": "eq(receipts.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(receipts.tenantId, tenantId), eq(receipts.id, id))",
      "evidence": "status: 'VOIDED',"
    },
    {
      "id": "ti-035",
      "severity": "P0",
      "summary": "voidReceipt queries invoicePayments by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/receipts.ts:557",
      "fn_or_route": "voidReceipt",
      "missing": "eq(invoicePayments.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(invoicePayments.tenantId, tenantId), eq(invoicePayments.id, id))",
      "evidence": ".map((l) => l.invoicePaymentId as string)"
    },
    {
      "id": "ti-036",
      "severity": "P0",
      "summary": "advanceRecurringTemplate queries recurringInvoiceTemplates by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/recurring-invoices.ts:405",
      "fn_or_route": "advanceRecurringTemplate",
      "missing": "eq(recurringInvoiceTemplates.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(recurringInvoiceTemplates.tenantId, tenantId), eq(recurringInvoiceTemplates.id, id))",
      "evidence": "status: newStatus,"
    },
    {
      "id": "ti-037",
      "severity": "P1",
      "summary": "touchRecurringGenerated queries recurringTasks by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/recurring-tasks.ts:146",
      "fn_or_route": "touchRecurringGenerated",
      "missing": "eq(recurringTasks.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(recurringTasks.tenantId, tenantId), eq(recurringTasks.id, id))",
      "evidence": ".where(eq(recurringTasks.id, id))"
    },
    {
      "id": "ti-038",
      "severity": "P2",
      "summary": "getReportScheduleById queries reportSchedules by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/report-schedules.ts:137",
      "fn_or_route": "getReportScheduleById",
      "missing": "eq(reportSchedules.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(reportSchedules.tenantId, tenantId), eq(reportSchedules.id, id))",
      "evidence": "const rows = await db"
    },
    {
      "id": "ti-039",
      "severity": "P2",
      "summary": "touchScheduleRun queries reportSchedules by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/report-schedules.ts:166",
      "fn_or_route": "touchScheduleRun",
      "missing": "eq(reportSchedules.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(reportSchedules.tenantId, tenantId), eq(reportSchedules.id, id))",
      "evidence": "nextRunAt: Date | null,"
    },
    {
      "id": "ti-040",
      "severity": "P2",
      "summary": "deactivateSchedule queries reportSchedules by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/report-schedules.ts:178",
      "fn_or_route": "deactivateSchedule",
      "missing": "eq(reportSchedules.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(reportSchedules.tenantId, tenantId), eq(reportSchedules.id, id))",
      "evidence": "await db"
    },
    {
      "id": "ti-041",
      "severity": "P2",
      "summary": "touchSession queries userSessions by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/sessions.ts:62",
      "fn_or_route": "touchSession",
      "missing": "eq(userSessions.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(userSessions.tenantId, tenantId), eq(userSessions.id, id))",
      "evidence": "await (db as Db)"
    },
    {
      "id": "ti-042",
      "severity": "P2",
      "summary": "getTenantExportJobById queries tenantExportJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/tenant-export-jobs.ts:53",
      "fn_or_route": "getTenantExportJobById",
      "missing": "eq(tenantExportJobs.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(tenantExportJobs.tenantId, tenantId), eq(tenantExportJobs.id, id))",
      "evidence": "): Promise<TenantExportJobObject | null> {"
    },
    {
      "id": "ti-043",
      "severity": "P2",
      "summary": "markTenantExportJobStatus queries tenantExportJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/tenant-export-jobs.ts:73",
      "fn_or_route": "markTenantExportJobStatus",
      "missing": "eq(tenantExportJobs.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(tenantExportJobs.tenantId, tenantId), eq(tenantExportJobs.id, id))",
      "evidence": ".set({"
    },
    {
      "id": "ti-044",
      "severity": "P0",
      "summary": "approveTimeEntries queries timeApprovalRequests by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/time-approval.ts:208",
      "fn_or_route": "approveTimeEntries",
      "missing": "eq(timeApprovalRequests.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(timeApprovalRequests.tenantId, tenantId), eq(timeApprovalRequests.id, id))",
      "evidence": ".set({"
    },
    {
      "id": "ti-045",
      "severity": "P0",
      "summary": "rejectTimeEntries queries timeApprovalRequests by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/time-approval.ts:282",
      "fn_or_route": "rejectTimeEntries",
      "missing": "eq(timeApprovalRequests.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(timeApprovalRequests.tenantId, tenantId), eq(timeApprovalRequests.id, id))",
      "evidence": ".set({"
    },
    {
      "id": "ti-046",
      "severity": "P1",
      "summary": "stopStaleEntry queries timeEntries by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/time.ts:703",
      "fn_or_route": "stopStaleEntry",
      "missing": "eq(timeEntries.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(timeEntries.tenantId, tenantId), eq(timeEntries.id, id))",
      "evidence": ".where(eq(timeEntries.id, entry.id))"
    },
    {
      "id": "ti-047",
      "severity": "P0",
      "summary": "getTaskProjectId queries tasks by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/time.ts:857",
      "fn_or_route": "getTaskProjectId",
      "missing": "eq(tasks.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(tasks.tenantId, tenantId), eq(tasks.id, id))",
      "evidence": "const [row] = await db"
    },
    {
      "id": "ti-048",
      "severity": "P0",
      "summary": "getTaskTitle queries tasks by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/time.ts:872",
      "fn_or_route": "getTaskTitle",
      "missing": "eq(tasks.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(tasks.tenantId, tenantId), eq(tasks.id, id))",
      "evidence": "const [row] = await db"
    },
    {
      "id": "ti-049",
      "severity": "P2",
      "summary": "setUniformExportJobRunning queries uniformExportJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/uniform-export.ts:51",
      "fn_or_route": "setUniformExportJobRunning",
      "missing": "eq(uniformExportJobs.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(uniformExportJobs.tenantId, tenantId), eq(uniformExportJobs.id, id))",
      "evidence": "await db"
    },
    {
      "id": "ti-050",
      "severity": "P2",
      "summary": "setUniformExportJobDone queries uniformExportJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/uniform-export.ts:66",
      "fn_or_route": "setUniformExportJobDone",
      "missing": "eq(uniformExportJobs.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(uniformExportJobs.tenantId, tenantId), eq(uniformExportJobs.id, id))",
      "evidence": ".set({"
    },
    {
      "id": "ti-051",
      "severity": "P2",
      "summary": "setUniformExportJobError queries uniformExportJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/uniform-export.ts:79",
      "fn_or_route": "setUniformExportJobError",
      "missing": "eq(uniformExportJobs.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(uniformExportJobs.tenantId, tenantId), eq(uniformExportJobs.id, id))",
      "evidence": "): Promise<void> {"
    },
    {
      "id": "ti-052",
      "severity": "P0",
      "summary": "updateUniformExportJobDownloadExpiry queries uniformExportJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/uniform-export.ts:90",
      "fn_or_route": "updateUniformExportJobDownloadExpiry",
      "missing": "eq(uniformExportJobs.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(uniformExportJobs.tenantId, tenantId), eq(uniformExportJobs.id, id))",
      "evidence": "): Promise<void> {"
    },
    {
      "id": "ti-053",
      "severity": "P2",
      "summary": "updateWebhookDelivery queries webhookDeliveries by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/webhooks.ts:290",
      "fn_or_route": "updateWebhookDelivery",
      "missing": "eq(webhookDeliveries.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(webhookDeliveries.tenantId, tenantId), eq(webhookDeliveries.id, id))",
      "evidence": "db: Db,"
    },
    {
      "id": "ti-054",
      "severity": "P2",
      "summary": "updateApiKeyLastUsed queries tenantApiKeys by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/webhooks.ts:357",
      "fn_or_route": "updateApiKeyLastUsed",
      "missing": "eq(tenantApiKeys.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(tenantApiKeys.tenantId, tenantId), eq(tenantApiKeys.id, id))",
      "evidence": ".where(eq(tenantApiKeys.id, id))"
    },
    {
      "id": "ti-055",
      "severity": "P0",
      "summary": "Foreign id project_id,status_id,assignee_id accepted without tenant-ownership check",
      "code_ref": "apps/zync-api/src/routes/tasks.ts:96",
      "fn_or_route": "POST / (createTask handler)",
      "missing": "Verify project_id,status_id,assignee_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "const task = await createTask(db, session.tid, input)"
    },
    {
      "id": "ti-056",
      "severity": "P0",
      "summary": "Foreign id project_id,status_id,assignee_id accepted without tenant-ownership check",
      "code_ref": "apps/zync-api/src/routes/tasks.ts:138",
      "fn_or_route": "PATCH /:id (updateTask handler)",
      "missing": "Verify project_id,status_id,assignee_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "const task = await updateTask(db, session.tid, taskId, parsed.data)"
    },
    {
      "id": "ti-057",
      "severity": "P0",
      "summary": "Foreign id project_id,status_id,assignee_id accepted without tenant-ownership check",
      "code_ref": "packages/db/src/queries/tasks.ts:254",
      "fn_or_route": "createTask",
      "missing": "Verify project_id,status_id,assignee_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "statusId: input.status_id, projectId: input.project_id, assigneeId: input.assignee_id"
    },
    {
      "id": "ti-058",
      "severity": "P0",
      "summary": "Foreign id project_id,status_id,assignee_id accepted without tenant-ownership check",
      "code_ref": "packages/db/src/queries/tasks.ts:309",
      "fn_or_route": "updateTask",
      "missing": "Verify project_id,status_id,assignee_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "setValues from patch.project_id/status_id/assignee_id without FK tenant verify"
    },
    {
      "id": "ti-059",
      "severity": "P0",
      "summary": "Foreign id customer_id,contact_id,category_id accepted without tenant-ownership check",
      "code_ref": "apps/zync-api/src/routes/support/index.ts:127",
      "fn_or_route": "POST / (createTicket handler)",
      "missing": "Verify customer_id,contact_id,category_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "const ticket = await createTicket(db, session.tid, parsed.data)"
    },
    {
      "id": "ti-060",
      "severity": "P0",
      "summary": "Foreign id customer_id,contact_id,category_id accepted without tenant-ownership check",
      "code_ref": "packages/db/src/queries/support.ts:288",
      "fn_or_route": "createTicket",
      "missing": "Verify customer_id,contact_id,category_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "customerId/contactId/categoryId from input without tenant FK checks"
    },
    {
      "id": "ti-061",
      "severity": "P0",
      "summary": "Foreign id category_id,assignee_id accepted without tenant-ownership check",
      "code_ref": "apps/zync-api/src/routes/support/index.ts:155",
      "fn_or_route": "PATCH /:id (updateTicket handler)",
      "missing": "Verify category_id,assignee_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "updateTicket(db, session.tid, id, parsed.data)"
    },
    {
      "id": "ti-062",
      "severity": "P0",
      "summary": "Foreign id category_id,assignee_id accepted without tenant-ownership check",
      "code_ref": "packages/db/src/queries/support.ts:319",
      "fn_or_route": "updateTicket",
      "missing": "Verify category_id,assignee_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "setValues.categoryId/assigneeId from patch without FK tenant verify"
    },
    {
      "id": "ti-063",
      "severity": "P0",
      "summary": "Foreign id customer_id,project_id accepted without tenant-ownership check",
      "code_ref": "apps/zync-api/src/routes/portal-files.ts:140",
      "fn_or_route": "POST /portal-files",
      "missing": "Verify customer_id,project_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "createPortalFile({ customerId: customer_id, projectId: project_id })"
    },
    {
      "id": "ti-064",
      "severity": "P0",
      "summary": "Foreign id customer_id,project_id accepted without tenant-ownership check",
      "code_ref": "packages/db/src/queries/portal-files.ts:209",
      "fn_or_route": "createPortalFile",
      "missing": "Verify customer_id,project_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "insert customerId/projectId without FK tenant ownership check"
    },
    {
      "id": "ti-065",
      "severity": "P0",
      "summary": "Foreign id customer_id accepted without tenant-ownership check",
      "code_ref": "apps/zync-api/src/routes/projects/crud.ts:86",
      "fn_or_route": "POST / (createProject handler)",
      "missing": "Verify customer_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "createProject(db, session.tid, parsed.data, session.sub)"
    },
    {
      "id": "ti-066",
      "severity": "P0",
      "summary": "Foreign id customer_id accepted without tenant-ownership check",
      "code_ref": "packages/db/src/queries/projects.ts:288",
      "fn_or_route": "createProject",
      "missing": "Verify customer_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "customerId: input.customer_id ?? null"
    },
    {
      "id": "ti-067",
      "severity": "P0",
      "summary": "Foreign id customer_id accepted without tenant-ownership check",
      "code_ref": "packages/db/src/queries/projects.ts:344",
      "fn_or_route": "updateProject",
      "missing": "Verify customer_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "setValues.customerId = patch.customer_id"
    },
    {
      "id": "ti-068",
      "severity": "P0",
      "summary": "Foreign id customer_id accepted without tenant-ownership check",
      "code_ref": "apps/zync-api/src/routes/projects/crud.ts:115",
      "fn_or_route": "PATCH /:id (updateProject handler)",
      "missing": "Verify customer_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "updateProject(db, session.tid, id, parsed.data, ...)"
    },
    {
      "id": "ti-069",
      "severity": "P0",
      "summary": "Foreign id project_id accepted without tenant-ownership check",
      "code_ref": "apps/zync-api/src/routes/expenses/index.ts:98",
      "fn_or_route": "POST per-diem schema",
      "missing": "Verify project_id belongs to caller tenant before use",
      "fix": "and(eq(<table>.tenantId, tenantId), eq(<table>.id, foreignId)) lookup; 404 if missing",
      "evidence": "perDiemSchema project_id optional without project tenant verify"
    },
    {
      "severity": "P1",
      "summary": "completeImportJob updates importJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/data-import.ts:251",
      "fn_or_route": "completeImportJob",
      "missing": "eq(importJobs.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(importJobs.tenantId, tenantId), eq(importJobs.id, id))",
      "evidence": ".where(eq(importJobs.id, id))",
      "id": "ti-070"
    },
    {
      "severity": "P0",
      "summary": "reverseInvoicePayment deletes invoicePayments by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/invoice-payments.ts:342",
      "fn_or_route": "reverseInvoicePayment",
      "missing": "eq(invoicePayments.tenantId, tenantId) in DELETE WHERE",
      "fix": "Add and(eq(invoicePayments.tenantId, tenantId), eq(invoicePayments.id, paymentId))",
      "evidence": ".delete(invoicePayments).where(eq(invoicePayments.id, paymentId))",
      "id": "ti-071"
    },
    {
      "severity": "P0",
      "summary": "restoreKbArticleVersion updates kbArticles by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/kb-versions.ts:309",
      "fn_or_route": "restoreKbArticleVersion",
      "missing": "eq(kbArticles.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add and(eq(kbArticles.tenantId, params.tenantId), eq(kbArticles.id, params.articleId))",
      "evidence": ".where(eq(kbArticles.id, params.articleId))",
      "id": "ti-072"
    },
    {
      "severity": "P0",
      "summary": "mergeCustomers updates customerMergeSuggestions by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/customer-dedup.ts:381",
      "fn_or_route": "mergeCustomers",
      "missing": "eq(customerMergeSuggestions.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(customerMergeSuggestions.tenantId, tenantId), eq(customerMergeSuggestions.id, suggestionId))",
      "evidence": ".where(eq(customerMergeSuggestions.id, suggestionId))",
      "id": "ti-073"
    },
    {
      "severity": "P0",
      "summary": "updateCustomRole updates roles by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/roles.ts:251",
      "fn_or_route": "updateCustomRole",
      "missing": "eq(roles.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add and(eq(roles.tenantId, tenantId), eq(roles.id, roleId))",
      "evidence": ".where(eq(roles.id, roleId))",
      "id": "ti-074"
    },
    {
      "severity": "P0",
      "summary": "deleteCustomRole deletes roles by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/roles.ts:344",
      "fn_or_route": "deleteCustomRole",
      "missing": "eq(roles.tenantId, tenantId) in DELETE WHERE",
      "fix": "Add and(eq(roles.tenantId, tenantId), eq(roles.id, roleId))",
      "evidence": "await tx.delete(roles).where(eq(roles.id, roleId))",
      "id": "ti-075"
    },
    {
      "severity": "P0",
      "summary": "deleteCustomRole deletes roles by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/roles.ts:361",
      "fn_or_route": "deleteCustomRole",
      "missing": "eq(roles.tenantId, tenantId) in DELETE WHERE",
      "fix": "Add and(eq(roles.tenantId, tenantId), eq(roles.id, roleId))",
      "evidence": "await tx.delete(roles).where(eq(roles.id, roleId))",
      "id": "ti-076"
    },
    {
      "severity": "P1",
      "summary": "updateWebhookDelivery updates webhookDeliveries by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/webhooks.ts:299",
      "fn_or_route": "updateWebhookDelivery",
      "missing": "eq(webhookDeliveries.tenantId, tenantId) in WHERE",
      "fix": "Join webhookEndpoints or add tenantId to delivery row predicate",
      "evidence": ".where(eq(webhookDeliveries.id, id))",
      "id": "ti-077"
    },
    {
      "severity": "P0",
      "summary": "getTenantExportJobById selects tenantExportJobs by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/tenant-export-jobs.ts:57",
      "fn_or_route": "getTenantExportJobById",
      "missing": "eq(tenantExportJobs.tenantId, tenantId) in SELECT WHERE",
      "fix": "Add and(eq(tenantExportJobs.tenantId, tenantId), eq(tenantExportJobs.id, id))",
      "evidence": ".where(eq(tenantExportJobs.id, id)) then app-level row.tenantId check",
      "id": "ti-078"
    },
    {
      "severity": "P0",
      "summary": "stopEntry updates timeEntries by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/time.ts:260",
      "fn_or_route": "stopEntry",
      "missing": "eq(timeEntries.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add and(eq(timeEntries.tenantId, tenantId), eq(timeEntries.id, entryId))",
      "evidence": ".where(eq(timeEntries.id, entryId)) after tenant-scoped select",
      "id": "ti-079"
    },
    {
      "severity": "P0",
      "summary": "startEntry updates timeEntries by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/time.ts:327",
      "fn_or_route": "startEntry",
      "missing": "eq(timeEntries.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add and(eq(timeEntries.tenantId, tenantId), eq(timeEntries.id, running.id))",
      "evidence": ".where(eq(timeEntries.id, running.id)) on prior running entry stop",
      "id": "ti-080"
    },
    {
      "severity": "P1",
      "summary": "rejectProposalByToken updates proposals by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/proposals.ts:678",
      "fn_or_route": "rejectProposalByToken",
      "missing": "eq(proposals.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add tenantId from token lookup to WHERE",
      "evidence": ".where(eq(proposals.id, proposalId))",
      "id": "ti-081"
    },
    {
      "severity": "P0",
      "summary": "updatePayoutBill updates payoutBills by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/contractors.ts:906",
      "fn_or_route": "updatePayoutBill",
      "missing": "eq(payoutBills.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add and(eq(payoutBills.tenantId, tenantId), eq(payoutBills.id, billId))",
      "evidence": ".where(eq(payoutBills.id, billId))",
      "id": "ti-082"
    },
    {
      "severity": "P1",
      "summary": "signContract updates contractSignatories by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/contract-signing.ts:123",
      "fn_or_route": "signContract",
      "missing": "eq(contractSignatories.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add tenantId from signatory token lookup to WHERE",
      "evidence": ".where(eq(contractSignatories.id, input.signatoryId))",
      "id": "ti-083"
    },
    {
      "severity": "P1",
      "summary": "signContract updates contracts by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/contract-signing.ts:147",
      "fn_or_route": "signContract",
      "missing": "eq(contracts.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add and(eq(contracts.tenantId, tenantId), eq(contracts.id, contractId))",
      "evidence": ".where(eq(contracts.id, signatory[0]!.contractId))",
      "id": "ti-084"
    },
    {
      "severity": "P1",
      "summary": "declineContract updates contractSignatories by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/contract-signing.ts:179",
      "fn_or_route": "declineContract",
      "missing": "eq(contractSignatories.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add and(eq(contractSignatories.tenantId, tenantId), eq(contractSignatories.id, signatoryId))",
      "evidence": ".where(eq(contractSignatories.id, signatoryId))",
      "id": "ti-085"
    },
    {
      "severity": "P1",
      "summary": "rejectTimeEntries updates timeApprovalRequests by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/time-approval.ts:288",
      "fn_or_route": "rejectTimeEntries",
      "missing": "eq(timeApprovalRequests.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add and(eq(timeApprovalRequests.tenantId, tenantId), eq(timeApprovalRequests.id, requestId))",
      "evidence": ".where(eq(timeApprovalRequests.id, requestId))",
      "id": "ti-086"
    },
    {
      "severity": "P2",
      "summary": "advanceRecurringTemplate updates recurringInvoiceTemplates by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/recurring-invoices.ts:408",
      "fn_or_route": "advanceRecurringTemplate",
      "missing": "eq(recurringInvoiceTemplates.tenantId, tenantId) in WHERE",
      "fix": "Add and(eq(recurringInvoiceTemplates.tenantId, tenantId), eq(recurringInvoiceTemplates.id, template.id))",
      "evidence": ".where(eq(recurringInvoiceTemplates.id, template.id))",
      "id": "ti-087"
    },
    {
      "severity": "P2",
      "summary": "generateRecurringExpense updates recurringExpenseTemplates by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/recurring-expenses.ts:260",
      "fn_or_route": "generateDueExpenses",
      "missing": "eq(recurringExpenseTemplates.tenantId, tenantId) in WHERE",
      "fix": "Add tenantId predicate to template advance update",
      "evidence": ".where(eq(recurringExpenseTemplates.id, template.id))",
      "id": "ti-088"
    },
    {
      "severity": "P1",
      "summary": "recordProposalView selects proposals by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/proposals.ts:616",
      "fn_or_route": "recordProposalView",
      "missing": "eq(proposals.tenantId, tenantId) in SELECT WHERE",
      "fix": "Add and(eq(proposals.tenantId, tenantId), eq(proposals.id, proposalId))",
      "evidence": ".where(eq(proposals.id, proposalId))",
      "id": "ti-089"
    },
    {
      "severity": "P1",
      "summary": "recordProposalView updates proposals by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/proposals.ts:631",
      "fn_or_route": "recordProposalView",
      "missing": "eq(proposals.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add and(eq(proposals.tenantId, tenantId), eq(proposals.id, proposalId))",
      "evidence": "tx.update(proposals).where(eq(proposals.id, proposalId))",
      "id": "ti-090"
    },
    {
      "severity": "P1",
      "summary": "acceptProposalByToken selects proposals by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/proposals.ts:653",
      "fn_or_route": "acceptProposalByToken",
      "missing": "eq(proposals.tenantId, tenantId) in SELECT WHERE",
      "fix": "Add tenantId from public token to WHERE",
      "evidence": ".where(eq(proposals.id, proposalId))",
      "id": "ti-091"
    },
    {
      "severity": "P1",
      "summary": "acceptProposalByToken updates proposals by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/proposals.ts:660",
      "fn_or_route": "acceptProposalByToken",
      "missing": "eq(proposals.tenantId, tenantId) in UPDATE WHERE",
      "fix": "Add tenantId from token to WHERE",
      "evidence": "update(proposals).where(eq(proposals.id, proposalId))",
      "id": "ti-092"
    },
    {
      "severity": "P1",
      "summary": "rejectProposalByToken selects proposals by id without tenantId predicate",
      "code_ref": "packages/db/src/queries/proposals.ts:671",
      "fn_or_route": "rejectProposalByToken",
      "missing": "eq(proposals.tenantId, tenantId) in SELECT WHERE",
      "fix": "Add tenantId from token to WHERE",
      "evidence": ".where(eq(proposals.id, proposalId))",
      "id": "ti-093"
    }
  ],
  "summary": {
    "total": 93,
    "by_file": {
      "packages/db/src/queries/accountant-export.ts": 2,
      "packages/db/src/queries/activities.ts": 4,
      "packages/db/src/queries/attachments.ts": 1,
      "packages/db/src/queries/auth-reads.ts": 1,
      "packages/db/src/queries/bad-debt.ts": 2,
      "packages/db/src/queries/calendar.ts": 4,
      "packages/db/src/queries/contract-signatories.ts": 5,
      "packages/db/src/queries/contracts.ts": 1,
      "packages/db/src/queries/customer-dedup.ts": 2,
      "packages/db/src/queries/data-import.ts": 2,
      "packages/db/src/queries/expenses.ts": 2,
      "packages/db/src/queries/marketing.ts": 2,
      "packages/db/src/queries/oauth.ts": 2,
      "packages/db/src/queries/profitability.ts": 1,
      "packages/db/src/queries/project-templates.ts": 3,
      "packages/db/src/queries/proposal-expiry-cron.ts": 1,
      "packages/db/src/queries/receipts.ts": 2,
      "packages/db/src/queries/recurring-invoices.ts": 2,
      "packages/db/src/queries/recurring-tasks.ts": 1,
      "packages/db/src/queries/report-schedules.ts": 3,
      "packages/db/src/queries/sessions.ts": 1,
      "packages/db/src/queries/tenant-export-jobs.ts": 3,
      "packages/db/src/queries/time-approval.ts": 3,
      "packages/db/src/queries/time.ts": 5,
      "packages/db/src/queries/uniform-export.ts": 4,
      "packages/db/src/queries/webhooks.ts": 3,
      "apps/zync-api/src/routes/tasks.ts": 2,
      "packages/db/src/queries/tasks.ts": 2,
      "apps/zync-api/src/routes/support/index.ts": 2,
      "packages/db/src/queries/support.ts": 2,
      "apps/zync-api/src/routes/portal-files.ts": 1,
      "packages/db/src/queries/portal-files.ts": 1,
      "apps/zync-api/src/routes/projects/crud.ts": 2,
      "packages/db/src/queries/projects.ts": 2,
      "apps/zync-api/src/routes/expenses/index.ts": 1,
      "packages/db/src/queries/invoice-payments.ts": 1,
      "packages/db/src/queries/kb-versions.ts": 1,
      "packages/db/src/queries/roles.ts": 3,
      "packages/db/src/queries/proposals.ts": 6,
      "packages/db/src/queries/contractors.ts": 1,
      "packages/db/src/queries/contract-signing.ts": 3,
      "packages/db/src/queries/recurring-expenses.ts": 1
    }
  }
}