@ingram-tech/nk-auth 0.19.3 → 0.19.5

package/dist/chain.d.ts

@@ -32,8 +32,11 @@ export interface AuthChainCheckOptions {
  * Returns the runner's status when it is, or `null` when the database has no
  * nk-auth journal table at all: a site that owns Better Auth's tables in its
  * own chain (a squashed baseline) never records this one, and that is not a
- * deployment mistake. Throws {@link AuthChainNotAppliedError} when the journal
- * exists but lags the installed package.
+ * deployment mistake. Also `null` when this role cannot read the journal (a
+ * least-privilege auth role with no access to the `drizzle` schema): it could
+ * not have applied the chain either, so there is nothing to verify through it.
+ * Throws {@link AuthChainNotAppliedError} when the journal exists but lags the
+ * installed package.
  *
  * `createAuthHelpers` runs this once per process on the first session read
  * when the instance's `database` is a `pg` Pool; call it yourself from

package/dist/chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGrF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAO,MAOtC,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAS3D;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,YAAY,OAAO,EAAE,SAAS,MAAM,EAAE,EAMrC;CACD;AAED,MAAM,WAAW,qBAAqB;IACrC,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,SAC5B,IAAI,YACD,qBAAqB,KAC5B,OAAO,CAAC,eAAe,GAAG,IAAI,CAkBhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,aAChB,OAAO,YACR,qBAAqB,KAC5B,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAOtB,CAAC"}
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGrF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAG/B;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAO,MAOtC,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAS3D;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,YAAY,OAAO,EAAE,SAAS,MAAM,EAAE,EAMrC;CACD;AAED,MAAM,WAAW,qBAAqB;IACrC,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAsDD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,SAC5B,IAAI,YACD,qBAAqB,KAC5B,OAAO,CAAC,eAAe,GAAG,IAAI,CAahC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,aAChB,OAAO,YACR,qBAAqB,KAC5B,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAOtB,CAAC"}

package/dist/chain.js

@@ -1,6 +1,7 @@
 import { inspectMigrations } from "@ingram-tech/nk-db/migrate";
 import { createRequire } from "node:module";
 import { dirname } from "node:path";
+import { SHIPPED_AUTH_CHAIN } from "./shipped-chain.js";
 /**
  * The migration chain this package ships: `migrations/` in the installed
  * package. Resolved through the package manifest, at call time, so a bundler
@@ -30,24 +31,62 @@ export class AuthChainNotAppliedError extends Error {
         this.pending = pending;
     }
 }
+const journalOf = (options) => ({
+    schema: options.migrationsSchema ?? "drizzle",
+    table: options.migrationsTable ?? AUTH_MIGRATIONS_TABLE,
+});
+/**
+ * Whether this role can read the journal table. Looked up in pg_catalog, which
+ * every role can read: `to_regclass` raises "permission denied" instead of
+ * returning null when the role lacks USAGE on the schema, and that broke every
+ * session read on a site whose auth role has no business in `drizzle`.
+ */
+const journalReadable = async (pool, schema, table) => {
+    const { rows } = await pool.query(`select has_schema_privilege(n.oid, 'USAGE')
+			and has_table_privilege(c.oid, 'SELECT') as readable
+		from pg_catalog.pg_class c
+		join pg_catalog.pg_namespace n on n.oid = c.relnamespace
+		where n.nspname = $1 and c.relname = $2`, [schema, table]);
+    return rows[0]?.readable === true;
+};
+const quoteIdent = (name) => `"${name.replaceAll('"', '""')}"`;
+/**
+ * The same verdict as {@link assertAuthChainApplied}, decided against
+ * {@link SHIPPED_AUTH_CHAIN} instead of the `migrations/` folder: a shipped
+ * file is pending when its hash is not recorded (the set difference nk-db's
+ * runner uses). It never touches the filesystem, so it is safe inside a
+ * site's server bundle, where it runs on the first session read.
+ */
+const assertShippedChainRecorded = async (pool, options) => {
+    const { schema, table } = journalOf(options);
+    if (!(await journalReadable(pool, schema, table)))
+        return;
+    const { rows } = await pool.query(`select hash from ${quoteIdent(schema)}.${quoteIdent(table)}`);
+    const recorded = new Set(rows.map((row) => row.hash));
+    const pending = SHIPPED_AUTH_CHAIN.filter((file) => !recorded.has(file.hash));
+    if (pending.length > 0) {
+        throw new AuthChainNotAppliedError(pending.map((file) => file.tag));
+    }
+};
 /**
  * Verify the shipped auth chain is fully applied to the database behind `pool`.
  *
  * Returns the runner's status when it is, or `null` when the database has no
  * nk-auth journal table at all: a site that owns Better Auth's tables in its
  * own chain (a squashed baseline) never records this one, and that is not a
- * deployment mistake. Throws {@link AuthChainNotAppliedError} when the journal
- * exists but lags the installed package.
+ * deployment mistake. Also `null` when this role cannot read the journal (a
+ * least-privilege auth role with no access to the `drizzle` schema): it could
+ * not have applied the chain either, so there is nothing to verify through it.
+ * Throws {@link AuthChainNotAppliedError} when the journal exists but lags the
+ * installed package.
  *
  * `createAuthHelpers` runs this once per process on the first session read
  * when the instance's `database` is a `pg` Pool; call it yourself from
  * `instrumentation.ts` or a health check to fail a deploy earlier.
  */
 export const assertAuthChainApplied = async (pool, options = {}) => {
-    const schema = options.migrationsSchema ?? "drizzle";
-    const table = options.migrationsTable ?? AUTH_MIGRATIONS_TABLE;
-    const { rows } = await pool.query("select to_regclass($1) as present", [`"${schema}"."${table}"`]);
-    if (rows[0]?.present === null || rows[0]?.present === undefined)
+    const { schema, table } = journalOf(options);
+    if (!(await journalReadable(pool, schema, table)))
         return null;
     const status = await inspectMigrations({
         pool,
@@ -72,7 +111,7 @@ export const authChainCheck = (database, options = {}) => {
         return async () => { };
     let checked;
     return () => {
-        checked ??= assertAuthChainApplied(database, options).then(() => undefined);
+        checked ??= assertShippedChainRecorded(database, options);
         return checked;
     };
 };

package/dist/chain.js.map

@@ -1 +1 @@
-{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAwB,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAW,EAAE,CAChD,OAAO,CACN,OAAO,CACN,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CACrC,oDAAoD,CACpD,CACD,CACD,CAAC;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAE3D,mEAAmE;AACnE,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE,CAChD,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,OAAQ,KAA6B,CAAC,KAAK,KAAK,UAAU;IAC1D,OAAQ,KAA+B,CAAC,OAAO,KAAK,UAAU,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACzC,OAAO,CAAoB;IACpC,YAAY,OAA0B;QACrC,KAAK,CACJ,yBAAyB,OAAO,CAAC,MAAM,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0GAA0G,qBAAqB,kCAAkC,CACvS,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAC1C,IAAU,EACV,OAAO,GAA0B,EAAE,EACD,EAAE;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,IAAI,qBAAqB,CAAC;IAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAChC,mCAAmC,EACnC,CAAC,IAAI,MAAM,MAAM,KAAK,GAAG,CAAC,CAC1B,CAAC;IACF,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACtC,IAAI;QACJ,gBAAgB,EAAE,oBAAoB,EAAE;QACxC,gBAAgB,EAAE,MAAM;QACxB,eAAe,EAAE,KAAK;KACtB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,QAAiB,EACjB,OAAO,GAA0B,EAAE,EACX,EAAE;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IAC7C,IAAI,OAAkC,CAAC;IACvC,OAAO,GAAG,EAAE;QACX,OAAO,KAAK,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5E,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAwB,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAW,EAAE,CAChD,OAAO,CACN,OAAO,CACN,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CACrC,oDAAoD,CACpD,CACD,CACD,CAAC;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAE3D,mEAAmE;AACnE,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE,CAChD,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,OAAQ,KAA6B,CAAC,KAAK,KAAK,UAAU;IAC1D,OAAQ,KAA+B,CAAC,OAAO,KAAK,UAAU,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACzC,OAAO,CAAoB;IACpC,YAAY,OAA0B;QACrC,KAAK,CACJ,yBAAyB,OAAO,CAAC,MAAM,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0GAA0G,qBAAqB,kCAAkC,CACvS,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AASD,MAAM,SAAS,GAAG,CAAC,OAA8B,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,OAAO,CAAC,gBAAgB,IAAI,SAAS;IAC7C,KAAK,EAAE,OAAO,CAAC,eAAe,IAAI,qBAAqB;CACvD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,eAAe,GAAG,KAAK,EAC5B,IAAU,EACV,MAAc,EACd,KAAa,EACM,EAAE;IACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAChC;;;;0CAIwC,EACxC,CAAC,MAAM,EAAE,KAAK,CAAC,CACf,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,KAAK,EACvC,IAAU,EACV,OAA8B,EACd,EAAE;IAClB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAChC,oBAAoB,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAC7D,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;AACF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAC1C,IAAU,EACV,OAAO,GAA0B,EAAE,EACD,EAAE;IACpC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACtC,IAAI;QACJ,gBAAgB,EAAE,oBAAoB,EAAE;QACxC,gBAAgB,EAAE,MAAM;QACxB,eAAe,EAAE,KAAK;KACtB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,QAAiB,EACjB,OAAO,GAA0B,EAAE,EACX,EAAE;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IAC7C,IAAI,OAAkC,CAAC;IACvC,OAAO,GAAG,EAAE;QACX,OAAO,KAAK,0BAA0B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;AACH,CAAC,CAAC"}

package/dist/shipped-chain.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The migration chain this package ships, as data: each `migrations/*.sql`
+ * file's tag and the sha256 nk-db's runner records for it.
+ *
+ * The per-request chain check runs inside the site's server bundle, where the
+ * package's files are not reliably on disk: Next rewrites `require.resolve`
+ * to a numeric module id, so resolving `migrations/` there made every session
+ * read throw. Carrying the chain in code keeps the check off the filesystem.
+ * `chain.test.ts` fails if this list drifts from `migrations/`, so a new
+ * migration must be added here in the same change.
+ */
+export declare const SHIPPED_AUTH_CHAIN: ReadonlyArray<{
+    tag: string;
+    hash: string;
+}>;
+//# sourceMappingURL=shipped-chain.d.ts.map

package/dist/shipped-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shipped-chain.d.ts","sourceRoot":"","sources":["../src/shipped-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAAa,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAa3E,CAAC"}

package/dist/shipped-chain.js

@@ -0,0 +1,26 @@
+/**
+ * The migration chain this package ships, as data: each `migrations/*.sql`
+ * file's tag and the sha256 nk-db's runner records for it.
+ *
+ * The per-request chain check runs inside the site's server bundle, where the
+ * package's files are not reliably on disk: Next rewrites `require.resolve`
+ * to a numeric module id, so resolving `migrations/` there made every session
+ * read throw. Carrying the chain in code keeps the check off the filesystem.
+ * `chain.test.ts` fails if this list drifts from `migrations/`, so a new
+ * migration must be added here in the same change.
+ */
+export const SHIPPED_AUTH_CHAIN = [
+    {
+        tag: "0001_better_auth",
+        hash: "5f44f3294805908dc7a946ac4fb2032d868da5f04e98f496ddfe76e8c0f8cddc",
+    },
+    {
+        tag: "0002_better_auth_1_7",
+        hash: "fa64a63e86ea862aff393fef6ecc705fb478d10c7bfc9e390ed475fa990aedea",
+    },
+    {
+        tag: "0003_better_auth_1_7_3",
+        hash: "45152bfe9401ace12ac860ccfc4ae49b6a3ab69cf2460947a964c5f231aa4919",
+    },
+];
+//# sourceMappingURL=shipped-chain.js.map

package/dist/shipped-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shipped-chain.js","sourceRoot":"","sources":["../src/shipped-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAiD;IAC/E;QACC,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,kEAAkE;KACxE;IACD;QACC,GAAG,EAAE,sBAAsB;QAC3B,IAAI,EAAE,kEAAkE;KACxE;IACD;QACC,GAAG,EAAE,wBAAwB;QAC7B,IAAI,EAAE,kEAAkE;KACxE;CACD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/nk-auth",
-	"version": "0.19.3",
+	"version": "0.19.5",
 	"description": "The Ingram Better Auth foundation: composable presets (org, dual-shape JWT, active-org hooks, pg pool) for Next.js sites.",
 	"license": "MIT",
 	"type": "module",

package/src/chain.ts

@@ -2,6 +2,7 @@ import { inspectMigrations, type MigrationStatus } from "@ingram-tech/nk-db/migr
 import { createRequire } from "node:module";
 import { dirname } from "node:path";
 import type { Pool } from "pg";
+import { SHIPPED_AUTH_CHAIN } from "./shipped-chain.js";
 
 /**
  * The migration chain this package ships: `migrations/` in the installed
@@ -53,14 +54,69 @@ export interface AuthChainCheckOptions {
 	migrationsSchema?: string;
 }
 
+const journalOf = (options: AuthChainCheckOptions) => ({
+	schema: options.migrationsSchema ?? "drizzle",
+	table: options.migrationsTable ?? AUTH_MIGRATIONS_TABLE,
+});
+
+/**
+ * Whether this role can read the journal table. Looked up in pg_catalog, which
+ * every role can read: `to_regclass` raises "permission denied" instead of
+ * returning null when the role lacks USAGE on the schema, and that broke every
+ * session read on a site whose auth role has no business in `drizzle`.
+ */
+const journalReadable = async (
+	pool: Pool,
+	schema: string,
+	table: string,
+): Promise<boolean> => {
+	const { rows } = await pool.query<{ readable: boolean }>(
+		`select has_schema_privilege(n.oid, 'USAGE')
+			and has_table_privilege(c.oid, 'SELECT') as readable
+		from pg_catalog.pg_class c
+		join pg_catalog.pg_namespace n on n.oid = c.relnamespace
+		where n.nspname = $1 and c.relname = $2`,
+		[schema, table],
+	);
+	return rows[0]?.readable === true;
+};
+
+const quoteIdent = (name: string): string => `"${name.replaceAll('"', '""')}"`;
+
+/**
+ * The same verdict as {@link assertAuthChainApplied}, decided against
+ * {@link SHIPPED_AUTH_CHAIN} instead of the `migrations/` folder: a shipped
+ * file is pending when its hash is not recorded (the set difference nk-db's
+ * runner uses). It never touches the filesystem, so it is safe inside a
+ * site's server bundle, where it runs on the first session read.
+ */
+const assertShippedChainRecorded = async (
+	pool: Pool,
+	options: AuthChainCheckOptions,
+): Promise<void> => {
+	const { schema, table } = journalOf(options);
+	if (!(await journalReadable(pool, schema, table))) return;
+	const { rows } = await pool.query<{ hash: string }>(
+		`select hash from ${quoteIdent(schema)}.${quoteIdent(table)}`,
+	);
+	const recorded = new Set(rows.map((row) => row.hash));
+	const pending = SHIPPED_AUTH_CHAIN.filter((file) => !recorded.has(file.hash));
+	if (pending.length > 0) {
+		throw new AuthChainNotAppliedError(pending.map((file) => file.tag));
+	}
+};
+
 /**
  * Verify the shipped auth chain is fully applied to the database behind `pool`.
  *
  * Returns the runner's status when it is, or `null` when the database has no
  * nk-auth journal table at all: a site that owns Better Auth's tables in its
  * own chain (a squashed baseline) never records this one, and that is not a
- * deployment mistake. Throws {@link AuthChainNotAppliedError} when the journal
- * exists but lags the installed package.
+ * deployment mistake. Also `null` when this role cannot read the journal (a
+ * least-privilege auth role with no access to the `drizzle` schema): it could
+ * not have applied the chain either, so there is nothing to verify through it.
+ * Throws {@link AuthChainNotAppliedError} when the journal exists but lags the
+ * installed package.
  *
  * `createAuthHelpers` runs this once per process on the first session read
  * when the instance's `database` is a `pg` Pool; call it yourself from
@@ -70,13 +126,8 @@ export const assertAuthChainApplied = async (
 	pool: Pool,
 	options: AuthChainCheckOptions = {},
 ): Promise<MigrationStatus | null> => {
-	const schema = options.migrationsSchema ?? "drizzle";
-	const table = options.migrationsTable ?? AUTH_MIGRATIONS_TABLE;
-	const { rows } = await pool.query<{ present: string | null }>(
-		"select to_regclass($1) as present",
-		[`"${schema}"."${table}"`],
-	);
-	if (rows[0]?.present === null || rows[0]?.present === undefined) return null;
+	const { schema, table } = journalOf(options);
+	if (!(await journalReadable(pool, schema, table))) return null;
 	const status = await inspectMigrations({
 		pool,
 		migrationsFolder: authMigrationsFolder(),
@@ -103,7 +154,7 @@ export const authChainCheck = (
 	if (!isPool(database)) return async () => {};
 	let checked: Promise<void> | undefined;
 	return () => {
-		checked ??= assertAuthChainApplied(database, options).then(() => undefined);
+		checked ??= assertShippedChainRecorded(database, options);
 		return checked;
 	};
 };

package/src/shipped-chain.ts

@@ -0,0 +1,25 @@
+/**
+ * The migration chain this package ships, as data: each `migrations/*.sql`
+ * file's tag and the sha256 nk-db's runner records for it.
+ *
+ * The per-request chain check runs inside the site's server bundle, where the
+ * package's files are not reliably on disk: Next rewrites `require.resolve`
+ * to a numeric module id, so resolving `migrations/` there made every session
+ * read throw. Carrying the chain in code keeps the check off the filesystem.
+ * `chain.test.ts` fails if this list drifts from `migrations/`, so a new
+ * migration must be added here in the same change.
+ */
+export const SHIPPED_AUTH_CHAIN: ReadonlyArray<{ tag: string; hash: string }> = [
+	{
+		tag: "0001_better_auth",
+		hash: "5f44f3294805908dc7a946ac4fb2032d868da5f04e98f496ddfe76e8c0f8cddc",
+	},
+	{
+		tag: "0002_better_auth_1_7",
+		hash: "fa64a63e86ea862aff393fef6ecc705fb478d10c7bfc9e390ed475fa990aedea",
+	},
+	{
+		tag: "0003_better_auth_1_7_3",
+		hash: "45152bfe9401ace12ac860ccfc4ae49b6a3ab69cf2460947a964c5f231aa4919",
+	},
+];