@hasna/nopen 0.0.1

package/dist/db/client.d.ts

@@ -0,0 +1,32 @@
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+import * as schema from "./schema.js";
+type Db = ReturnType<typeof drizzle<typeof schema>>;
+export declare function postgresOptions(max: number, host?: string | undefined, ssl?: string | undefined): {
+    ssl?: {
+        rejectUnauthorized: boolean;
+    } | undefined;
+    host?: string | undefined;
+    max: number;
+};
+export declare function getSql(): postgres.Sql<{}>;
+/** Contextual db: the active tenant/owner tx if inside one, else the singleton. */
+export declare function getDb(): Db;
+export declare function closeDb(): Promise<void>;
+/**
+ * Run `fn` scoped to a tenant. Inside a tx we `SET LOCAL ROLE nopen_tenant`
+ * (non-owner → RLS enforced) and set app.user_id, so only that tenant's rows
+ * are visible. getDb() inside fn returns the tenant-scoped tx db.
+ */
+export declare function withTenant<T>(userId: string, fn: (tx: Db) => Promise<T>): Promise<T>;
+/**
+ * Run `fn` as the platform/system agent (table owner connection → bypasses RLS).
+ * No transaction/role change needed.
+ *
+ * Asserts it is NOT nested inside withTenant: there, getDb() returns the tenant tx,
+ * so the work would run RLS-restricted as the tenant instead of as the owner — a
+ * silent privilege/visibility bug. Owner work must originate outside a tenant scope.
+ */
+export declare function withOwner<T>(fn: (tx: Db) => Promise<T>): Promise<T>;
+export { schema };
+//# sourceMappingURL=client.d.ts.map

package/dist/db/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/db/client.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElD,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC;AAUpD,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,qBAAsB,EAC1B,GAAG,qBAAqB;;;;;;EASzB;AAED,wBAAgB,MAAM,qBAGrB;AAED,mFAAmF;AACnF,wBAAgB,KAAK,IAAI,EAAE,CAK1B;AAED,wBAAsB,OAAO,kBAM5B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAOpF;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAOnE;AAED,OAAO,EAAE,MAAM,EAAE,CAAC"}

package/dist/db/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/db/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC"}

package/dist/db/migrate.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=migrate.d.ts.map

package/dist/db/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":""}

package/dist/db/repo.d.ts

@@ -0,0 +1,320 @@
+import { sites, agentRuns, goals, appTasks } from "./schema.js";
+type NewTask = typeof appTasks.$inferInsert;
+type Task = typeof appTasks.$inferSelect;
+export declare function createSite(input: {
+    prompt: string;
+    kind?: string;
+    userId?: string | null;
+}): Promise<{
+    workerName: string | null;
+    domain: string | null;
+    id: string;
+    name: string | null;
+    createdAt: Date;
+    prompt: string;
+    userId: string | null;
+    kind: string;
+    status: "pending" | "planning" | "buying_domain" | "generating" | "deploying" | "configuring_email" | "live" | "failed";
+    liveUrl: string | null;
+    sourceDir: string | null;
+    meta: Record<string, unknown> | null;
+    updatedAt: Date;
+}>;
+export declare function updateSite(id: string, patch: Partial<typeof sites.$inferInsert>): Promise<{
+    id: string;
+    userId: string | null;
+    prompt: string;
+    kind: string;
+    name: string | null;
+    domain: string | null;
+    status: "pending" | "planning" | "buying_domain" | "generating" | "deploying" | "configuring_email" | "live" | "failed";
+    workerName: string | null;
+    liveUrl: string | null;
+    sourceDir: string | null;
+    meta: Record<string, unknown> | null;
+    createdAt: Date;
+    updatedAt: Date;
+}>;
+export declare function getSite(id: string): Promise<{
+    workerName: string | null;
+    domain: string | null;
+    id: string;
+    name: string | null;
+    createdAt: Date;
+    prompt: string;
+    userId: string | null;
+    kind: string;
+    status: "pending" | "planning" | "buying_domain" | "generating" | "deploying" | "configuring_email" | "live" | "failed";
+    liveUrl: string | null;
+    sourceDir: string | null;
+    meta: Record<string, unknown> | null;
+    updatedAt: Date;
+} | null>;
+export declare function listSites(): Promise<{
+    workerName: string | null;
+    domain: string | null;
+    id: string;
+    name: string | null;
+    createdAt: Date;
+    prompt: string;
+    userId: string | null;
+    kind: string;
+    status: "pending" | "planning" | "buying_domain" | "generating" | "deploying" | "configuring_email" | "live" | "failed";
+    liveUrl: string | null;
+    sourceDir: string | null;
+    meta: Record<string, unknown> | null;
+    updatedAt: Date;
+}[]>;
+export declare function createRun(input: {
+    siteId: string;
+    agentName: string;
+    prompt: string;
+}): Promise<{
+    error: string | null;
+    id: string;
+    prompt: string;
+    status: "failed" | "queued" | "running" | "succeeded" | "cancelled";
+    siteId: string | null;
+    lastHeartbeatAt: Date | null;
+    agentName: string;
+    steps: number;
+    costUsd: number | null;
+    startedAt: Date;
+    finishedAt: Date | null;
+}>;
+export declare function updateRun(id: string, patch: Partial<typeof agentRuns.$inferInsert>): Promise<{
+    id: string;
+    siteId: string | null;
+    agentName: string;
+    status: "failed" | "queued" | "running" | "succeeded" | "cancelled";
+    prompt: string;
+    steps: number;
+    costUsd: number | null;
+    lastHeartbeatAt: Date | null;
+    error: string | null;
+    startedAt: Date;
+    finishedAt: Date | null;
+}>;
+/** Heartbeat: bump the run's lastHeartbeatAt and log an event. */
+export declare function heartbeat(runId: string, siteId: string, message: string): Promise<void>;
+export declare function logEvent(input: {
+    runId?: string | null;
+    siteId?: string | null;
+    type: string;
+    message?: string;
+    data?: Record<string, unknown>;
+}): Promise<void>;
+/** Recent activity for a site (newest first) — drives the dashboard activity feed. */
+export declare function listEvents(siteId: string, limit?: number): Promise<{
+    type: string;
+    id: string;
+    data: Record<string, unknown> | null;
+    createdAt: Date;
+    siteId: string | null;
+    runId: string | null;
+    message: string | null;
+}[]>;
+export declare function recordDeployment(input: {
+    siteId: string;
+    workerName: string;
+    url: string;
+    success: boolean;
+    versionId?: string | null;
+}): Promise<{
+    workerName: string;
+    url: string | null;
+    success: boolean;
+    versionId: string | null;
+    id: string;
+    createdAt: Date;
+    siteId: string | null;
+    provider: string;
+    logs: string | null;
+    deployedAt: Date | null;
+}>;
+export declare function recordDomain(input: {
+    siteId: string;
+    domain: string;
+    zoneId?: string | null;
+    pricePaidCents?: number | null;
+}): Promise<{
+    domain: string;
+    zoneId: string | null;
+    pricePaidCents: number | null;
+    id: string;
+    createdAt: Date;
+    siteId: string | null;
+    registrar: string;
+    purchasedAt: Date | null;
+}>;
+export declare function createGoal(input: {
+    siteId: string;
+    northStar: string;
+    successMetric?: string | null;
+    budgetCredits?: number;
+    dailyCapCredits?: number;
+    constraints?: Record<string, unknown>;
+}): Promise<{
+    id: string;
+    createdAt: Date;
+    status: string;
+    updatedAt: Date;
+    siteId: string;
+    northStar: string;
+    successMetric: string | null;
+    budgetCredits: number;
+    dailyCapCredits: number;
+    constraints: Record<string, unknown> | null;
+}>;
+export declare function getGoal(siteId: string): Promise<{
+    id: string;
+    createdAt: Date;
+    status: string;
+    updatedAt: Date;
+    siteId: string;
+    northStar: string;
+    successMetric: string | null;
+    budgetCredits: number;
+    dailyCapCredits: number;
+    constraints: Record<string, unknown> | null;
+} | null>;
+export declare function updateGoal(siteId: string, patch: Partial<typeof goals.$inferInsert>): Promise<{
+    id: string;
+    siteId: string;
+    northStar: string;
+    successMetric: string | null;
+    budgetCredits: number;
+    dailyCapCredits: number;
+    status: string;
+    constraints: Record<string, unknown> | null;
+    createdAt: Date;
+    updatedAt: Date;
+} | null>;
+export declare function insertTasks(rows: NewTask[]): Promise<Task[]>;
+export declare function listTasks(siteId: string): Promise<Task[]>;
+export declare function getTask(id: string): Promise<Task | null>;
+export declare function updateTask(id: string, patch: Partial<NewTask>): Promise<Task | null>;
+/** Types already `done` for a site (for dependency satisfaction). */
+export declare function doneTaskTypes(siteId: string): Promise<Set<string>>;
+/**
+ * Atomically claim the next actionable task for a worker, using FOR UPDATE SKIP
+ * LOCKED so concurrent cycles never grab the same row. "Actionable" = pending,
+ * due (nextRunAt null or past), approved (if required), lease-free, and with all
+ * `dependsOn` types satisfied for its site. Marks it running + increments attempts.
+ */
+export declare function claimNextTask(workerId: string, leaseMs?: number, siteIds?: string[]): Promise<Task | null>;
+export declare function createProduct(input: {
+    siteId: string;
+    name: string;
+    priceCents: number;
+    currency?: string;
+    recurring?: string | null;
+}): Promise<{
+    priceCents: number;
+    currency: string;
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    siteId: string;
+    recurring: string | null;
+    active: boolean;
+}>;
+export declare function getActiveProduct(siteId: string): Promise<{
+    priceCents: number;
+    currency: string;
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    siteId: string;
+    recurring: string | null;
+    active: boolean;
+} | null>;
+export declare function recordPayment(input: {
+    siteId: string;
+    userId?: string | null;
+    amountCents: number;
+    currency?: string;
+    kind?: string;
+    status?: string;
+    stripePaymentIntentId?: string | null;
+}): Promise<{
+    currency: string;
+    id: string;
+    createdAt: Date;
+    userId: string | null;
+    kind: string;
+    status: string;
+    siteId: string | null;
+    amountCents: number;
+    stripePaymentIntentId: string | null;
+} | null>;
+/** Total paid revenue (cents) + order count for a site. */
+export declare function siteRevenue(siteId: string): Promise<{
+    totalCents: number;
+    orders: number;
+}>;
+/** Idempotency: whether an order payment with this intent already exists. */
+export declare function paymentExists(stripePaymentIntentId: string | null): Promise<boolean>;
+/** Mark all still-pending tasks for a site as skipped (used when an app is killed). */
+export declare function skipPendingTasks(siteId: string): Promise<void>;
+/** Capture a pre-signup lead (email gate for the planner report). */
+export declare function captureLead(input: {
+    email: string;
+    prompt?: string | null;
+    source?: string;
+}): Promise<{
+    id: string;
+    email: string;
+    createdAt: Date;
+    prompt: string | null;
+    source: string;
+    convertedUserId: string | null;
+}>;
+/** Add an end-user subscriber captured by a generated site. Idempotent per (site,email). */
+export declare function addSubscriber(input: {
+    siteId: string;
+    email: string;
+}): Promise<{
+    id: string;
+    email: string;
+    createdAt: Date;
+    siteId: string;
+    nurturedAt: Date | null;
+} | null>;
+/** Total subscribers for a site. */
+export declare function countSubscribers(siteId: string): Promise<number>;
+/** Subscribers not nurtured since `since` (or never), oldest first. */
+export declare function listSubscribersToNurture(siteId: string, since: Date, limit?: number): Promise<{
+    id: string;
+    email: string;
+    createdAt: Date;
+    siteId: string;
+    nurturedAt: Date | null;
+}[]>;
+/** Stamp subscribers as nurtured (now). */
+export declare function markSubscribersNurtured(ids: string[], at?: Date): Promise<void>;
+/** Record a traffic/conversion event for a site. */
+export declare function recordVisit(input: {
+    siteId: string;
+    kind?: string;
+    path?: string | null;
+    ref?: string | null;
+}): Promise<{
+    path: string | null;
+    id: string;
+    createdAt: Date;
+    ref: string | null;
+    kind: string;
+    siteId: string;
+}>;
+/** Aggregate analytics for a site: total + last-7-day views, conversions, conversion rate. */
+export declare function siteAnalytics(siteId: string): Promise<{
+    views: number;
+    views7d: number;
+    conversions: number;
+    conversionRate: number;
+}>;
+export {};
+//# sourceMappingURL=repo.d.ts.map

package/dist/db/repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/db/repo.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,EACL,SAAS,EAIT,KAAK,EACL,QAAQ,EACT,MAAM,aAAa,CAAC;AAErB,KAAK,OAAO,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAC;AAC5C,KAAK,IAAI,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAC;AAEzC,wBAAsB,UAAU,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;;;;;;;;;;;;;;GAMA;AAED,wBAAsB,UAAU,CAC9B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,OAAO,KAAK,CAAC,YAAY,CAAC;;;;;;;;;;;;;;GAQ1C;AAED,wBAAsB,OAAO,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;;UAGvC;AAED,wBAAsB,SAAS;;;;;;;;;;;;;;KAE9B;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;;;;;;;;;;;;GAMA;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,OAAO,SAAS,CAAC,YAAY,CAAC;;;;;;;;;;;;GAQ9C;AAED,kEAAkE;AAClE,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,iBAG7E;AAED,wBAAsB,QAAQ,CAAC,KAAK,EAAE;IACpC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,iBAQA;AAED,sFAAsF;AACtF,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAK;;;;;;;;KAO1D;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;;;;;;;;;;;GAaA;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;;;;;;;;;GAYA;AAID,wBAAsB,UAAU,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;;;;;;;;;;;GAaA;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;UAG3C;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,KAAK,CAAC,YAAY,CAAC;;;;;;;;;;;UAOzF;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAGlE;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAM/D;AAED,wBAAsB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAG9D;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAO1F;AAED,qEAAqE;AACrE,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAMxE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CA8CjH;AAKD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;;;;;;;;;;GAYA;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;UAMpD;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;;;;;;;;;;UAeA;AAED,2DAA2D;AAC3D,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CASjG;AAED,6EAA6E;AAC7E,wBAAsB,aAAa,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ1F;AAED,uFAAuF;AACvF,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpE;AAKD,qEAAqE;AACrE,wBAAsB,WAAW,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;GAMlG;AAKD,4FAA4F;AAC5F,wBAAsB,aAAa,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;;;;;;UAO3E;AAED,oCAAoC;AACpC,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMtE;AAED,uEAAuE;AACvE,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,SAAK;;;;;;KAYrF;AAED,2CAA2C;AAC3C,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,OAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3F;AAKD,oDAAoD;AACpD,wBAAsB,WAAW,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;;;;;;;GAMpH;AAED,8FAA8F;AAC9F,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC,CAYD"}

package/dist/db/rls.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Postgres Row-Level Security for multi-tenancy.
+ *
+ * Strategy: ENABLE RLS (not FORCE) + a dedicated non-owner role `nopen_tenant`.
+ *  - Platform/agent code connects as the table owner → bypasses RLS naturally
+ *    (withOwner / getDb singleton). No wrapping needed.
+ *  - Tenant-facing reads run via withTenant, which does `SET LOCAL ROLE
+ *    nopen_tenant` + `app.user_id` inside a tx → policies enforced.
+ *
+ * Policies key on current_setting('app.user_id').
+ */
+import type postgres from "postgres";
+export declare const RLS_DIRECT_USER_TABLES: readonly ["sites", "subscriptions", "payments", "api_tokens", "credit_ledger", "checkout_sessions"];
+export declare const RLS_SITE_SCOPED_TABLES: readonly ["domains", "deployments", "agent_runs", "events", "goals", "app_tasks", "products", "subscribers", "visits"];
+export declare function applyRls(sql: ReturnType<typeof postgres>): Promise<void>;
+//# sourceMappingURL=rls.d.ts.map

package/dist/db/rls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../../src/db/rls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAErC,eAAO,MAAM,sBAAsB,qGAAsG,CAAC;AAC1I,eAAO,MAAM,sBAAsB,wHAAyH,CAAC;AAI7J,wBAAsB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwD9E"}