@facilis.dev/db 0.0.0-stage → 0.1.1

package/src/sudo.ts

@@ -0,0 +1,200 @@
+/**
+ * Audited sudo (D-099): run a block of code in the current transaction as the framework's
+ * `facilis_system` Postgres role.
+ *
+ * The system role is the one named exception to SPEC §8.4.5's "no Postgres roles" rule: it
+ * is NOLOGIN, NOSUPERUSER with BYPASSRLS and DML grants only (no DDL), it is never assigned
+ * to users and never referenced by policies, and it is reachable only through this module.
+ * Every escalation is recorded on the append-only audit sink first (fail closed), then in
+ * the SAVEPOINT, so a crash between entries leaves a visible trace instead of a silent one.
+ */
+
+import { sql } from "drizzle-orm";
+
+import type { FacilisDb } from "./client.ts";
+import { APP_ROLE, type PolicyScopedDatabase } from "./policy.ts";
+import { newSudoId, writeSudoAudit } from "./sudo-audit.ts";
+import { guardDatabase, TableAccessError } from "./table-guard.ts";
+
+/** The elevated Postgres role; provisioned by `ensureSystemRole` (dev) or the deploy step. */
+export const SYSTEM_ROLE = "facilis_system";
+
+/** GUC carrying the audit call id while a sudo block runs. Not a provenance column. */
+export const SUDO_ID_GUC = "app.sudo_id";
+
+/**
+ * Creates the system role and grants it DML on the public schema, plus membership to
+ * facilis_app (production connects as the app role and must be able to SET ROLE). Idempotent
+ * and re-asserting, like ensureAppRole: an older dataDir must not keep weaker attributes.
+ */
+export async function ensureSystemRole(db: FacilisDb): Promise<void> {
+  const existing = await db.db.execute(sql`select 1 from pg_roles where rolname = ${SYSTEM_ROLE}`);
+  if (existing.rows.length === 0) {
+    await db.db.execute(sql.raw(`CREATE ROLE ${SYSTEM_ROLE} NOLOGIN NOSUPERUSER BYPASSRLS`));
+  }
+  // Re-assert attributes in case an older dev dataDir created the role differently.
+  await db.db.execute(sql.raw(`ALTER ROLE ${SYSTEM_ROLE} NOSUPERUSER BYPASSRLS NOLOGIN`));
+  await db.db.execute(sql.raw(`GRANT USAGE ON SCHEMA public TO ${SYSTEM_ROLE}`));
+  await db.db.execute(
+    sql.raw(
+      `GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO ${SYSTEM_ROLE}`,
+    ),
+  );
+  await db.db.execute(
+    sql.raw(
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${SYSTEM_ROLE}`,
+    ),
+  );
+  await db.db.execute(
+    sql.raw(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO ${SYSTEM_ROLE}`),
+  );
+  await db.db.execute(
+    sql.raw(
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${SYSTEM_ROLE}`,
+    ),
+  );
+  // The runtime may connect as facilis_app: membership is what lets it SET ROLE.
+  await db.db.execute(sql.raw(`GRANT ${SYSTEM_ROLE} TO ${APP_ROLE}`));
+}
+
+export interface RunWithSystemRoleOptions {
+  /** Audit call id, exposed as app.sudo_id for correlation inside the block. */
+  readonly sudoId: string;
+}
+
+/**
+ * Runs `fn` in a SAVEPOINT of the current transaction as facilis_system.
+ *
+ * On success the role is restored to facilis_app explicitly: RESET ROLE would return to the
+ * connecting session user (a superuser in dev) and silently widen the rest of the request.
+ * On failure the savepoint rollback restores both the role and the GUCs.
+ */
+export async function runWithSystemRole<T>(
+  db: PolicyScopedDatabase,
+  options: RunWithSystemRoleOptions,
+  fn: (systemDb: PolicyScopedDatabase) => Promise<T>,
+): Promise<T> {
+  return db.transaction(async (tx) => {
+    await tx.execute(sql.raw(`SET LOCAL ROLE ${SYSTEM_ROLE}`));
+    await tx.execute(sql`select set_config('app.sudo_id', ${options.sudoId}, true)`);
+    const result = await fn(tx);
+    await tx.execute(sql.raw(`SET LOCAL ROLE ${APP_ROLE}`));
+    await tx.execute(sql`select set_config('app.sudo_id', '', true)`);
+    return result;
+  });
+}
+
+export interface RunAsSystemOptions {
+  /** Audit actor label for a job/CLI caller, e.g. "system:nightly-reindex". */
+  readonly actor: `system:${string}`;
+  readonly operation: string;
+  readonly reason: string;
+  /**
+   * The job's declared tables and views (SQL names), possibly empty. The elevated client is
+   * guarded by this declaration, not by whatever the system role happens to reach (D-157).
+   */
+  readonly dbTables: readonly string[];
+  /** Explicit exception for raw SQL inside the job (D-157); default false. */
+  readonly rawSql?: boolean;
+  /** Correlation id when the job was triggered by a request. */
+  readonly requestId?: string;
+}
+
+/**
+ * Runs `fn` in its own transaction as facilis_system, audited like `ctx.sudo`, and returns
+ * its result. This is the job/CLI counterpart of the route context's sudo.
+ */
+export async function runAsSystem<T>(
+  db: FacilisDb,
+  options: RunAsSystemOptions,
+  fn: (systemDb: PolicyScopedDatabase) => Promise<T>,
+): Promise<T> {
+  assertSystemRunOptions(options);
+  const id = newSudoId();
+  const startedAt = Date.now();
+  // Relations the guarded client actually reached; only declared ones can get this far.
+  const observed = new Set<string>();
+  const base = {
+    id,
+    actor: options.actor,
+    roles: [] as readonly string[],
+    operation: options.operation,
+    reason: options.reason,
+    tables: options.dbTables,
+    ...(options.requestId === undefined ? {} : { requestId: options.requestId }),
+  };
+  writeSudoAudit({ ...base, event: "started", at: new Date().toISOString() });
+
+  try {
+    const result = await db.db.transaction((tx) =>
+      runWithSystemRole(tx, { sudoId: id }, (systemDb) =>
+        fn(
+          guardDatabase(systemDb, {
+            declared: options.dbTables,
+            allowRawSql: options.rawSql === true,
+            onRelation: (relation) => observed.add(relation),
+          }),
+        ),
+      ),
+    );
+    writeSudoAudit({
+      ...base,
+      event: "succeeded",
+      outcome: "succeeded",
+      observedTables: [...observed],
+      at: new Date().toISOString(),
+      durationMs: Date.now() - startedAt,
+    });
+    return result;
+  } catch (error) {
+    // Canonical code only: the internal message may name the relation, which is not audited.
+    writeSudoAudit({
+      ...base,
+      event: "failed",
+      outcome: "failed",
+      at: new Date().toISOString(),
+      errorCode: error instanceof TableAccessError ? error.code : "handler_failed",
+      durationMs: Date.now() - startedAt,
+    });
+    throw error;
+  }
+}
+
+/**
+ * Rejects a job call that could not produce a meaningful audit entry.
+ *
+ * An empty `dbTables` list is deliberately allowed here (D-107): a job may declare that it
+ * touches no relation, and it is the only caller permitted to do so — `ctx.sudo`/`ctx.system`
+ * still reject an empty subset in @facilis.dev/core. The declaration is enforced by the guard.
+ */
+function assertSystemRunOptions(options: RunAsSystemOptions): void {
+  if (typeof options.actor !== "string" || !options.actor.startsWith("system:")) {
+    throw new Error('sudo_invalid_actor: actor must be "system:<job>" for a system run.');
+  }
+  if (typeof options.operation !== "string" || options.operation.trim().length === 0) {
+    throw new Error("sudo_invalid_operation: operation must be a non-empty string.");
+  }
+  if (typeof options.reason !== "string" || options.reason.trim().length === 0) {
+    throw new Error("sudo_invalid_reason: reason must be a non-empty string.");
+  }
+  if (!isStringList(options.dbTables)) {
+    throw new Error(
+      "sudo_invalid_dbTables: dbTables must be an array of non-empty strings (possibly empty).",
+    );
+  }
+  if (options.rawSql !== undefined && typeof options.rawSql !== "boolean") {
+    throw new Error("sudo_invalid_rawSql: rawSql must be a boolean when present.");
+  }
+}
+
+/**
+ * An array of non-empty strings, possibly empty: a job that declares no relation still
+ * produces a valid audit entry (D-107). The empty case is left to the caller's policy, so
+ * runAsSystem can accept it while the route-scoped sudo keeps its non-empty subset rule.
+ */
+function isStringList(value: unknown): value is readonly string[] {
+  return (
+    Array.isArray(value) &&
+    value.every((entry): entry is string => typeof entry === "string" && entry.length > 0)
+  );
+}

package/src/table-guard.ts

@@ -0,0 +1,296 @@
+/**
+ * Runtime enforcement of a route's `dbTables` declaration (D-157).
+ *
+ * The static analyzer can see a route's queries, but only the wrapper sees every relation
+ * the handler actually touches. `guardDatabase` wraps the policy-scoped client in a Proxy:
+ * a relation is checked against the declaration before its query builder runs, so an
+ * incomplete declaration fails closed instead of querying and auditing whatever it likes.
+ *
+ * The wrapper never executes a query itself: it forwards fluent calls to the real Drizzle
+ * builder and only intercepts the next relation-bearing call. Query builders are thenable,
+ * so `then`/`catch`/`finally` are bound to the unwrapped target and awaiting a guarded
+ * builder still runs the original query exactly once.
+ */
+
+import { Column, Table, ViewBaseConfig, getTableName, getViewName, is, isView } from "drizzle-orm";
+
+import type { PolicyScopedDatabase } from "./policy.ts";
+
+/** Canonical failure codes of the guard; both are 500s in the core error registry. */
+export type TableAccessErrorCode = "table_not_declared" | "raw_sql_not_allowed";
+
+/** Thrown before execution when a route reaches outside its declaration. */
+export class TableAccessError extends Error {
+  readonly code: TableAccessErrorCode;
+  /** Server-side context only: the route wrapper never puts it in the response body. */
+  readonly relation?: string;
+
+  constructor(code: TableAccessErrorCode, relation?: string) {
+    super(
+      code === "raw_sql_not_allowed"
+        ? "db.execute is not allowed: the route must declare rawSql: true."
+        : `Relation "${relation ?? "unknown"}" is not declared in the route's dbTables.`,
+    );
+    this.name = "TableAccessError";
+    this.code = code;
+    if (relation !== undefined) this.relation = relation;
+  }
+}
+
+/** What a route exposes to the guard: its declaration plus the audited-observation hook. */
+export interface TableGuardOptions {
+  /** The route's `dbTables` (tables and views, SQL names). */
+  readonly declared: readonly string[];
+  /** `rawSql: true` on the route; only then may `db.execute` run. */
+  readonly allowRawSql?: boolean;
+  /** Called for every declared relation the handler actually reaches (sudo audit, D-157). */
+  readonly onRelation?: (relation: string) => void;
+}
+
+/** Calls that take a relation and must be checked before the builder runs. */
+const RELATION_METHODS: ReadonlySet<string> = new Set([
+  "select",
+  "selectDistinct",
+  "insert",
+  "update",
+  "delete",
+  "from",
+  "join",
+  "leftJoin",
+  "rightJoin",
+  "innerJoin",
+  "fullJoin",
+  "into",
+]);
+
+/** Query-builder promise methods: bound to the real builder, never wrapped as fluent calls. */
+const THEN_METHODS: ReadonlySet<string> = new Set(["then", "catch", "finally"]);
+
+/** Runtime table symbols; Drizzle 0.45 omits its `Table.Symbol` from the declarations. */
+const TABLE_SYMBOLS = (
+  Table as unknown as {
+    readonly Symbol: {
+      readonly IsAlias: symbol;
+      readonly OriginalName: symbol;
+    };
+  }
+).Symbol;
+
+type SurfaceKind = "db" | "query" | "builder" | "relation";
+
+interface GuardState {
+  readonly declared: ReadonlySet<string>;
+  readonly allowRawSql: boolean;
+  readonly onRelation: ((relation: string) => void) | undefined;
+  readonly proxies: WeakMap<object, object>;
+  readonly targets: WeakMap<object, object>;
+  /** Set when an allowed `db.execute` runs; raw SQL has no inspectable relation names. */
+  rawSqlUsed: boolean;
+}
+
+/**
+ * Wraps a policy-scoped client so every relation is checked against `declared` before the
+ * query executes. The returned value is the same Drizzle transaction surface.
+ */
+export function guardDatabase(
+  db: PolicyScopedDatabase,
+  options: TableGuardOptions,
+): PolicyScopedDatabase {
+  const state: GuardState = {
+    declared: new Set(options.declared),
+    allowRawSql: options.allowRawSql === true,
+    onRelation: options.onRelation,
+    proxies: new WeakMap(),
+    targets: new WeakMap(),
+    rawSqlUsed: false,
+  };
+  return wrapSurface(db as object, "db", state) as PolicyScopedDatabase;
+}
+
+function wrapSurface(target: object, kind: SurfaceKind, state: GuardState): object {
+  const wrapped = state.proxies.get(target);
+  if (wrapped !== undefined) return wrapped;
+  const proxy = new Proxy(target, createHandler(state, kind));
+  state.proxies.set(target, proxy);
+  state.targets.set(proxy, target);
+  return proxy;
+}
+
+function createHandler(state: GuardState, kind: SurfaceKind): ProxyHandler<object> {
+  return {
+    get(target, property) {
+      const value: unknown = Reflect.get(target, property);
+
+      // Awaiting a guarded builder must call the real builder's then/catch/finally.
+      if (typeof property === "string" && THEN_METHODS.has(property)) {
+        return typeof value === "function"
+          ? (value as (...args: unknown[]) => unknown).bind(target)
+          : value;
+      }
+
+      // The relational API is keyed by relation: validate before handing out the builder.
+      if (kind === "db" && property === "query") {
+        return isObject(value) ? wrapSurface(value, "query", state) : value;
+      }
+      if (kind === "query" && typeof property === "string") {
+        if (!isObject(value)) return value;
+        const relation = relationFromQueryEntry(value) ?? property;
+        observe(relation, state);
+        return wrapSurface(value, "relation", state);
+      }
+
+      // The raw driver escape hatches are exactly the SQL the declaration cannot describe.
+      if (
+        kind === "db" &&
+        !state.allowRawSql &&
+        (property === "$client" || property === "session")
+      ) {
+        throw new TableAccessError("raw_sql_not_allowed");
+      }
+
+      if (typeof value !== "function") return value;
+      return createMethod(target, property, value as (...args: unknown[]) => unknown, kind, state);
+    },
+  };
+}
+
+function createMethod(
+  target: object,
+  property: string | symbol,
+  method: (...args: unknown[]) => unknown,
+  kind: SurfaceKind,
+  state: GuardState,
+): (...args: unknown[]) => unknown {
+  return (...args: unknown[]): unknown => {
+    if (kind === "db" && property === "execute") {
+      if (!state.allowRawSql) throw new TableAccessError("raw_sql_not_allowed");
+      state.rawSqlUsed = true;
+    }
+    if (kind === "db" && property === "transaction") {
+      return runTransaction(target, method, args, state);
+    }
+    if (typeof property === "string" && RELATION_METHODS.has(property)) {
+      for (const arg of args) observeArgument(arg, state);
+    }
+    const result = Reflect.apply(method, target, unwrapArgs(args, state));
+    return wrapResult(result, target, state);
+  };
+}
+
+/** Runs the callback with a guarded nested transaction; the query itself still executes once. */
+function runTransaction(
+  target: object,
+  method: (...args: unknown[]) => unknown,
+  args: unknown[],
+  state: GuardState,
+): unknown {
+  const [callback, ...rest] = args;
+  if (typeof callback !== "function") {
+    return Reflect.apply(method, target, unwrapArgs(args, state));
+  }
+  const wrapped = (tx: unknown, ...inner: unknown[]): unknown =>
+    (callback as (...callbackArgs: unknown[]) => unknown)(
+      isObject(tx) ? wrapSurface(tx, "db", state) : tx,
+      ...inner.map((value) => unwrap(value, state)),
+    );
+  return Reflect.apply(method, target, [wrapped, ...unwrapArgs(rest, state)]);
+}
+
+function wrapResult(result: unknown, target: object, state: GuardState): unknown {
+  // Drizzle returns `this` from fluent methods: reuse the existing proxy, do not nest.
+  if (result === target) return state.proxies.get(target);
+  if (isObject(result) && isBuilderLike(result)) return wrapSurface(result, "builder", state);
+  return result;
+}
+
+/** Thenable query builders plus the pre-`from` select builder, which is not thenable yet. */
+function isBuilderLike(value: object): boolean {
+  if (isThenable(value)) return true;
+  for (const method of RELATION_METHODS) {
+    if (typeof (value as Record<string, unknown>)[method] === "function") return true;
+  }
+  return false;
+}
+
+function observeArgument(value: unknown, state: GuardState, seen: Set<object> = new Set()): void {
+  if (!isObject(value) || seen.has(value)) return;
+  seen.add(value);
+
+  const relation = relationNameOf(value);
+  if (relation !== null) {
+    observe(relation, state);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) observeArgument(item, state, seen);
+    return;
+  }
+  if (is(value, Column)) {
+    observeArgument(value.table, state, seen);
+    return;
+  }
+  if (isPlainObject(value)) {
+    for (const item of Object.values(value)) observeArgument(item, state, seen);
+  }
+}
+
+function observe(relation: string, state: GuardState): void {
+  if (!state.declared.has(relation)) throw new TableAccessError("table_not_declared", relation);
+  state.onRelation?.(relation);
+}
+
+/**
+ * SQL name of a relation: aliased tables resolve to their original name, and a view is its
+ * own relation (D-097/D-098), never its base tables.
+ */
+function relationNameOf(value: object): string | null {
+  if (is(value, Table)) {
+    // Drizzle 0.45 exposes the symbol table at runtime but not in its type declarations.
+    const symbols = (Table as unknown as { readonly Symbol: typeof TABLE_SYMBOLS }).Symbol;
+    const table = value as unknown as Record<symbol, unknown>;
+    if (table[symbols.IsAlias] === true) {
+      const original = table[symbols.OriginalName];
+      if (typeof original === "string" && original.length > 0) return original;
+    }
+    const name = getTableName(value);
+    return typeof name === "string" && name.length > 0 ? name : null;
+  }
+  if (isView(value)) {
+    const config = (value as unknown as Record<symbol, unknown>)[ViewBaseConfig];
+    if (isObject(config)) {
+      const record = config as Record<string, unknown>;
+      const name =
+        record["isAlias"] === true ? (record["originalName"] ?? record["name"]) : record["name"];
+      if (typeof name === "string" && name.length > 0) return name;
+    }
+    const name = getViewName(value);
+    return typeof name === "string" && name.length > 0 ? name : null;
+  }
+  return null;
+}
+
+function relationFromQueryEntry(value: object): string | null {
+  const table = (value as { readonly table?: unknown }).table;
+  return isObject(table) ? relationNameOf(table) : null;
+}
+
+function unwrap(value: unknown, state: GuardState): unknown {
+  return isObject(value) ? (state.targets.get(value) ?? value) : value;
+}
+
+function unwrapArgs(args: unknown[], state: GuardState): unknown[] {
+  return args.map((value) => unwrap(value, state));
+}
+
+function isThenable(value: object): boolean {
+  return typeof (value as { readonly then?: unknown }).then === "function";
+}
+
+function isObject(value: unknown): value is object {
+  return typeof value === "object" && value !== null;
+}
+
+function isPlainObject(value: object): boolean {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}

package/src/tasks.ts

@@ -0,0 +1,79 @@
+// The manual-task table (D-135, docs/WORKFLOWS.md §5).
+//
+// A task is framework state, not application data: tenant-scoped so the structural invariant
+// holds (pgPolicy + ENABLE ROW LEVEL SECURITY), re-exported by the project's db/schema.ts, and
+// DDL-owned by a Drizzle migration like the job queue (D-107).
+import { sql } from "drizzle-orm";
+import {
+  index,
+  integer,
+  jsonb,
+  pgPolicy,
+  pgTable,
+  text,
+  timestamp,
+  uuid,
+} from "drizzle-orm/pg-core";
+
+import { tenantIsolationPolicy } from "./rls.ts";
+import { tenantColumn } from "./tenant-column.ts";
+
+/** Every facilis_tasks.status value, in lifecycle order. */
+export const FACILIS_TASK_STATUSES = ["pending", "decided", "expired", "cancelled"] as const;
+
+export type FacilisTaskStatus = (typeof FACILIS_TASK_STATUSES)[number];
+
+/** What the task asks for; approvals are the only kind the v1 slice ships. */
+export const FACILIS_TASK_KINDS = ["approval"] as const;
+
+export type FacilisTaskKind = (typeof FACILIS_TASK_KINDS)[number];
+
+/** How a decided task closes. */
+export const FACILIS_TASK_DECISIONS = ["approve", "reject"] as const;
+
+export type FacilisTaskDecision = (typeof FACILIS_TASK_DECISIONS)[number];
+
+/**
+ * One manual task. Statuses stay text (a new state is a code change, not a migration) and the
+ * workflow columns are nullable so a task can exist standalone before the workflow layer lands
+ * (D-135 W1).
+ */
+export const facilisTasks = pgTable(
+  "facilis_tasks",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    workflowId: uuid("workflow_id"),
+    stepIndex: integer("step_index"),
+    kind: text("kind").notNull(),
+    status: text("status").notNull(),
+    decision: text("decision"),
+    titleKey: text("title_key").notNull(),
+    titleParams: jsonb("title_params").notNull().default({}),
+    payload: jsonb("payload"),
+    requestedBy: text("requested_by"),
+    assignedPermission: text("assigned_permission"),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    decidedBy: text("decided_by"),
+    decidedAt: timestamp("decided_at", { withTimezone: true }),
+    comment: text("comment"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    tenantId: tenantColumn(),
+  },
+  (table) => [
+    tenantIsolationPolicy(),
+    // A RESTRICTIVE policy only narrows what a permissive policy already allows; with no
+    // permissive policy Postgres denies every row (D-008). The queue's reads/writes run as
+    // facilis_app, so the scoped tenant needs this gate — exactly like facilis_jobs.
+    pgPolicy("facilis_tasks_tenant_access", {
+      for: "all",
+      using: sql`nullif(current_setting('app.tenant_id', true), '') IS NOT NULL`,
+      withCheck: sql`nullif(current_setting('app.tenant_id', true), '') IS NOT NULL`,
+    }),
+    index("facilis_tasks_status_created_idx").on(table.status, table.createdAt),
+    index("facilis_tasks_workflow_idx").on(table.workflowId),
+    index("facilis_tasks_assigned_idx").on(table.assignedPermission, table.status),
+  ],
+).enableRLS();
+
+export type FacilisTaskRow = typeof facilisTasks.$inferSelect;
+export type NewFacilisTaskRow = typeof facilisTasks.$inferInsert;

package/src/tenant-column.ts

@@ -0,0 +1,29 @@
+import { sql } from "drizzle-orm";
+import { uuid } from "drizzle-orm/pg-core";
+
+/**
+ * SQL expression that fills a tenant column from the policy-scope GUC.
+ *
+ * It reads the same `app.tenant_id` every RLS policy reads, transaction-locally set by
+ * `runWithPolicyScope` before the handler runs (contracts §4.2). The `nullif` guard is the
+ * same one the policies use: after a `RESET` a GUC reads as `''`, and `''::uuid` raises.
+ */
+export function tenantDefaultSql() {
+  return sql`nullif(current_setting('app.tenant_id', true), '')::uuid`;
+}
+
+/**
+ * A `tenant_id` column that takes its value from the policy scope (D-040).
+ *
+ * ```ts
+ * export const todos = pgTable("todos", { tenantId: tenantColumn(), ... }, ...).enableRLS();
+ * ```
+ *
+ * The default is the DB's, not the app's: an insert never names the tenant (raw SQL included),
+ * and it cannot name a different one — the RESTRICTIVE tenant policy still checks the written
+ * row against the same GUC. It also makes the column optional in Drizzle's insert type, so app
+ * code stops passing `tenantId: auth.tenantId` and the compiler stops asking for it.
+ */
+export function tenantColumn(name = "tenant_id") {
+  return uuid(name).notNull().default(tenantDefaultSql());
+}