@nodii/db-rls 0.0.1 → 0.2.0

package/dist/in-memory-pool.js

@@ -0,0 +1,53 @@
+// In-memory PgPool / PgTx test doubles.
+//
+// Records every `set_config` call and every `exec` invocation so tests
+// can assert the exact transcript without needing a real Postgres.
+// Production wiring (pg / Drizzle / psycopg / pgx) lands in v0.1.x —
+// `// TODO db-rls-v0.1.x: real driver adapters`.
+/** In-memory PgPool. Each instance owns its own transcript so tests can
+ *  inspect what each pool was asked to do. */
+export class InMemoryPgPool {
+    kind;
+    transcript = [];
+    constructor(kind) {
+        this.kind = kind;
+    }
+    async withTransaction(fn) {
+        this.transcript.push({ kind: "begin", pool: this.kind });
+        const tx = new InMemoryPgTx(this);
+        try {
+            const result = await fn(tx);
+            this.transcript.push({ kind: "commit", pool: this.kind });
+            return result;
+        }
+        catch (err) {
+            this.transcript.push({ kind: "rollback", pool: this.kind });
+            throw err;
+        }
+    }
+}
+class InMemoryPgTx {
+    poolKind;
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+        this.poolKind = pool.kind;
+    }
+    async exec(sql, params = []) {
+        this.pool.transcript.push({
+            kind: "exec",
+            pool: this.poolKind,
+            sql,
+            params,
+        });
+    }
+    async setConfig(key, value) {
+        this.pool.transcript.push({
+            kind: "set_config",
+            pool: this.poolKind,
+            key,
+            value,
+        });
+    }
+}
+//# sourceMappingURL=in-memory-pool.js.map

package/dist/in-memory-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-pool.js","sourceRoot":"","sources":["../src/in-memory-pool.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,qEAAqE;AACrE,iDAAiD;AAYjD;8CAC8C;AAC9C,MAAM,OAAO,cAAc;IAChB,IAAI,CAAW;IACf,UAAU,GAAsB,EAAE,CAAC;IAE5C,YAAY,IAAc;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,MAAM,YAAY;IACP,QAAQ,CAAW;IACX,IAAI,CAAiB;IAEtC,YAAY,IAAoB;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,GAAG;YACH,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxB,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,GAAG;YACH,KAAK;SACN,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,3 +1,23 @@
 export declare const LIB_NAME = "db-rls";
-export declare const VERSION = "0.0.1";
+export declare const VERSION = "0.1.1";
+export { initDbRls, requireDbRls, getDbRlsOrNull, requirePool, _resetForTests, } from "./init";
+export type { InitDbRlsConfig, ResolvedDbRls } from "./init";
+export { configureDbRls, PoolCredentialMismatch, _resetConfigureForTests, } from "./configure";
+export type { ConfigureDbRlsOpts } from "./configure";
+export { PgClientPool } from "./pg-pool-adapter";
+export type { PgPoolAdapterOpts } from "./pg-pool-adapter";
+export { withUserContext, withSystemContext, withOwnerContext, autoDispatch, } from "./context";
+export { withUserContextDb, withSystemContextDb, withOwnerContextDb, } from "./drizzle-client";
+export type { DrizzleClient, NodePgDatabase } from "./drizzle-client";
+export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, } from "./auth-schema";
+export type { SqlExecutor } from "./auth-schema";
+export { withRls, generateTableGrants } from "./rls-policy-gen";
+export type { RlsVerb, WithRlsOpts } from "./rls-policy-gen";
+export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, } from "./migrate-gen";
+export type { MigrateGenInput, MigrateGenResult } from "./migrate-gen";
+export { generateRlsPolicy, authSchemaHelpers } from "./rls-policy";
+export { InMemoryPgPool } from "./in-memory-pool";
+export type { TranscriptEntry } from "./in-memory-pool";
+export { DbRlsError, DbRlsNotInitialized, PoolUnavailable, MissingTenantContext, TransactionRolledBack, } from "./types";
+export type { AuthContext, AutoDispatchOpts, GenerateRlsPolicyOpts, PgPool, PgTx, PoolKind, SystemContextOpts, UserContextOpts, } from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,OAAO,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE7D,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIvE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -1,7 +1,38 @@
-// @nodii/db-rls — placeholder at v0.0.1.
-// Implementation lands at v0.1.0 per the locked feature_doc.
+// @nodii/db-rls — v0.1.1 public barrel.
 //
-// Spec: https://planning.dev.nucleus-cloud.in/api/v1/feature-docs?serviceId=nodii-libs&docKey=db-rls
+// Spec: planning hub feature_doc serviceId=nodii-libs docKey=db-rls
+// (A1 posture — RLS on every tenant-scoped table — locked 2026-05-25).
+// Polyglot ship: TS + Python + Go in parity.
+//
+// v0.1.1 surface:
+//   - configureDbRls (real pg.Pool-aware boot helper) + initDbRls (raw)
+//   - PgClientPool (wraps pg.Pool → PgPool interface)
+//   - InMemoryPgPool (still exported — used by upstream tests)
+//   - withUserContext / withSystemContext / withOwnerContext / autoDispatch
+//     (operates on the substrate-agnostic PgTx)
+//   - withUserContextDb / withSystemContextDb / withOwnerContextDb
+//     (Drizzle-bound; require a real PgClientPool)
+//   - applyAuthSchemaMigrations + AUTH_SCHEMA_SQL + AUTH_SCHEMA_GRANTS_SQL
+//   - withRls() (RLS-policy DDL generator per § 5.5)
+//   - generateRlsPolicy / authSchemaHelpers (deprecated aliases, kept for
+//     parity-fence + parity with the v0.1.0 surface; no NotImplemented paths)
+//   - migrateGen + runMigrateGenCli + userTenantIdsRealSql + userTenantIdsStubSql
+//   - Typed errors: DbRlsError + DbRlsNotInitialized + PoolUnavailable +
+//                   MissingTenantContext + TransactionRolledBack +
+//                   PoolCredentialMismatch
 export const LIB_NAME = "db-rls";
-export const VERSION = "0.0.1";
+export const VERSION = "0.1.1";
+export { initDbRls, requireDbRls, getDbRlsOrNull, requirePool, _resetForTests, } from "./init";
+export { configureDbRls, PoolCredentialMismatch, _resetConfigureForTests, } from "./configure";
+export { PgClientPool } from "./pg-pool-adapter";
+export { withUserContext, withSystemContext, withOwnerContext, autoDispatch, } from "./context";
+export { withUserContextDb, withSystemContextDb, withOwnerContextDb, } from "./drizzle-client";
+export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, } from "./auth-schema";
+export { withRls, generateTableGrants } from "./rls-policy-gen";
+export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, } from "./migrate-gen";
+// Legacy v0.1.0 surface kept for callers that already imported these
+// names. Both are byte-equal SQL helpers — no NotImplemented paths.
+export { generateRlsPolicy, authSchemaHelpers } from "./rls-policy";
+export { InMemoryPgPool } from "./in-memory-pool";
+export { DbRlsError, DbRlsNotInitialized, PoolUnavailable, MissingTenantContext, TransactionRolledBack, } from "./types";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,6DAA6D;AAC7D,EAAE;AACF,qGAAqG;AAErG,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,kBAAkB;AAClB,wEAAwE;AACxE,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,2EAA2E;AAC3E,qDAAqD;AACrD,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,2CAA2C;AAE3C,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAGvB,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,SAAS,CAAC"}

package/dist/init.d.ts

@@ -0,0 +1,18 @@
+import { type PgPool, type PoolKind } from "./types";
+export interface InitDbRlsConfig {
+    owner: PgPool;
+    services: PgPool;
+    authenticated: PgPool;
+}
+export interface ResolvedDbRls {
+    owner: PgPool;
+    services: PgPool;
+    authenticated: PgPool;
+}
+export declare function initDbRls(config: InitDbRlsConfig): void;
+export declare function requireDbRls(): ResolvedDbRls;
+export declare function getDbRlsOrNull(): ResolvedDbRls | null;
+export declare function requirePool(kind: PoolKind): PgPool;
+/** Test-only reset; NOT exported through the public barrel. */
+export declare function _resetForTests(): void;
+//# sourceMappingURL=init.d.ts.map

package/dist/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,MAAM,EAEX,KAAK,QAAQ,EACd,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAcvD;AAED,wBAAgB,YAAY,IAAI,aAAa,CAK5C;AAED,wBAAgB,cAAc,IAAI,aAAa,GAAG,IAAI,CAErD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAOlD;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,IAAI,IAAI,CAErC"}

package/dist/init.js

@@ -0,0 +1,40 @@
+// initDbRls — process-local bootstrap; mirrors initSaga / initTelemetry.
+//
+// Spec § 5.2. Caller supplies one PgPool per role. Subsequent calls warn +
+// no-op (first-init wins). Public APIs throw `DbRlsNotInitialized` before init.
+import { DbRlsNotInitialized, PoolUnavailable, } from "./types";
+let resolved = null;
+export function initDbRls(config) {
+    if (resolved) {
+        // eslint-disable-next-line no-console
+        console.warn("[@nodii/db-rls] initDbRls() called more than once; ignoring subsequent call.");
+        return;
+    }
+    resolved = {
+        owner: config.owner,
+        services: config.services,
+        authenticated: config.authenticated,
+    };
+}
+export function requireDbRls() {
+    if (!resolved) {
+        throw new DbRlsNotInitialized();
+    }
+    return resolved;
+}
+export function getDbRlsOrNull() {
+    return resolved;
+}
+export function requirePool(kind) {
+    const cfg = requireDbRls();
+    const pool = cfg[kind];
+    if (!pool) {
+        throw new PoolUnavailable(kind);
+    }
+    return pool;
+}
+/** Test-only reset; NOT exported through the public barrel. */
+export function _resetForTests() {
+    resolved = null;
+}
+//# sourceMappingURL=init.js.map

package/dist/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAEhF,OAAO,EACL,mBAAmB,EAEnB,eAAe,GAEhB,MAAM,SAAS,CAAC;AAcjB,IAAI,QAAQ,GAAyB,IAAI,CAAC;AAE1C,MAAM,UAAU,SAAS,CAAC,MAAuB;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACb,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,8EAA8E,CAC/E,CAAC;QACF,OAAO;IACT,CAAC;IAED,QAAQ,GAAG;QACT,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,mBAAmB,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAc;IACxC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc;IAC5B,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC"}

package/dist/migrate-gen.d.ts

@@ -0,0 +1,41 @@
+export interface MigrateGenInput {
+    /** Pattern A service name, e.g. "nodii-billing-service". Used only for
+     *  the file header comment; not in the SQL body. */
+    serviceName: string;
+    /** Defaults to `./infra/postgres`. */
+    outDir?: string;
+    /** When `true`, emit ONLY the stub variant (returns empty set). Use
+     *  when running in the chicken-and-egg case where Drizzle migrate has
+     *  not yet created the mirror tables. */
+    stub?: boolean;
+}
+export interface MigrateGenResult {
+    /** Absolute path of the file that was written. */
+    path: string;
+    /** Contents written (also returned for parity-fence assertions). */
+    contents: string;
+}
+/**
+ * SQL text for the real (joins mirror tables) helper. Module-level
+ * constant so parity-fence can byte-compare.
+ */
+export declare function userTenantIdsRealSql(serviceName: string): string;
+/**
+ * SQL text for the chicken-and-egg stub variant (returns empty set).
+ */
+export declare function userTenantIdsStubSql(serviceName: string): string;
+/**
+ * Generates the residual migration phase file and returns its contents.
+ * If `outDir` is set, writes the file to disk; otherwise just returns
+ * the contents (used by tests + parity-fence).
+ */
+export declare function migrateGen(input: MigrateGenInput): MigrateGenResult;
+/**
+ * CLI entrypoint. Invoked via `npx @nodii/db-rls migrate-gen ...` or
+ * `bun ts/db-rls/src/migrate-gen.ts ...`.
+ *
+ * Returns exit code (0 on success, non-zero on usage error). Caller
+ * (a small bin/migrate-gen.js shim) translates to process.exit.
+ */
+export declare function runMigrateGenCli(args: readonly string[]): number;
+//# sourceMappingURL=migrate-gen.d.ts.map

package/dist/migrate-gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-gen.d.ts","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,eAAe;IAC9B;wDACoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;6CAEyC;IACzC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAehE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAWhE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAanE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA6BhE"}

package/dist/migrate-gen.js

@@ -0,0 +1,123 @@
+// migrate-gen — generates the per-service residual migration phase
+// per § 5.7.
+//
+// Output:
+//   <outDir>/004-helpers-and-grants/0001_user_tenant_ids.sql
+//
+// The generated file installs `auth.user_tenant_ids(uuid)` joining the
+// service's `employees_mirror` + `customers_mirror` tables (per PII
+// doctrine § Q5 + db-rls Q1 lock). Caller services apply it AFTER
+// Drizzle migrations create the mirror tables (or wire the stub
+// 0000_user_tenant_ids_stub.sql per the chicken-and-egg path).
+//
+// CLI shape:
+//   npx @nodii/db-rls migrate-gen <serviceName> [--out <path>]
+//   bun ts/db-rls/src/migrate-gen.ts <serviceName> [--out <path>]
+//
+// Output is byte-equal across TS / Python / Go ports — parity-fence test
+// asserts directly.
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+/**
+ * SQL text for the real (joins mirror tables) helper. Module-level
+ * constant so parity-fence can byte-compare.
+ */
+export function userTenantIdsRealSql(serviceName) {
+    return `-- Service: ${serviceName}
+-- Generated by @nodii/db-rls migrate-gen
+-- Phase: 004-helpers-and-grants — service-owned auth.user_tenant_ids
+-- Spec: § 5.7 (terraform-bootstrap split)
+
+CREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid
+LANGUAGE sql STABLE AS $$
+  SELECT tenant_id FROM employees_mirror WHERE id = p_user_id
+  UNION
+  SELECT tenant_id FROM customers_mirror WHERE id = p_user_id
+$$;
+
+GRANT EXECUTE ON FUNCTION auth.user_tenant_ids(uuid) TO nodii_services, authenticated;
+`;
+}
+/**
+ * SQL text for the chicken-and-egg stub variant (returns empty set).
+ */
+export function userTenantIdsStubSql(serviceName) {
+    return `-- Service: ${serviceName}
+-- Generated by @nodii/db-rls migrate-gen --stub
+-- Phase: 004-helpers-and-grants — stub variant (returns empty set)
+-- Spec: § 5.7 (chicken-and-egg)
+
+CREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid
+LANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;
+
+GRANT EXECUTE ON FUNCTION auth.user_tenant_ids(uuid) TO nodii_services, authenticated;
+`;
+}
+/**
+ * Generates the residual migration phase file and returns its contents.
+ * If `outDir` is set, writes the file to disk; otherwise just returns
+ * the contents (used by tests + parity-fence).
+ */
+export function migrateGen(input) {
+    const contents = input.stub
+        ? userTenantIdsStubSql(input.serviceName)
+        : userTenantIdsRealSql(input.serviceName);
+    const fileName = input.stub
+        ? "0000_user_tenant_ids_stub.sql"
+        : "0001_user_tenant_ids.sql";
+    const phase = "004-helpers-and-grants";
+    const outDir = resolve(input.outDir ?? "./infra/postgres");
+    const path = join(outDir, phase, fileName);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, contents);
+    return { path, contents };
+}
+/**
+ * CLI entrypoint. Invoked via `npx @nodii/db-rls migrate-gen ...` or
+ * `bun ts/db-rls/src/migrate-gen.ts ...`.
+ *
+ * Returns exit code (0 on success, non-zero on usage error). Caller
+ * (a small bin/migrate-gen.js shim) translates to process.exit.
+ */
+export function runMigrateGenCli(args) {
+    const positional = [];
+    let outDir;
+    let stub = false;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--out" && i + 1 < args.length) {
+            outDir = args[++i];
+        }
+        else if (a === "--stub") {
+            stub = true;
+        }
+        else if (a === "--help" || a === "-h") {
+            printUsage();
+            return 0;
+        }
+        else if (a && !a.startsWith("--")) {
+            positional.push(a);
+        }
+    }
+    // CLI form: `migrate-gen <serviceName>` — the first positional after the
+    // optional "migrate-gen" leading token (when invoked via `npx`).
+    const serviceName = positional[0] === "migrate-gen" ? positional[1] : positional[0];
+    if (!serviceName) {
+        printUsage();
+        return 2;
+    }
+    const result = migrateGen({ serviceName, outDir, stub });
+    // eslint-disable-next-line no-console
+    console.log(result.path);
+    return 0;
+}
+function printUsage() {
+    // eslint-disable-next-line no-console
+    console.log(`usage: migrate-gen <serviceName> [--out <dir>] [--stub]
+
+Emits infra/postgres/004-helpers-and-grants/0001_user_tenant_ids.sql
+(or the stub variant 0000_user_tenant_ids_stub.sql with --stub).
+
+Spec: @nodii/db-rls § 5.7 (terraform-bootstrap split).`);
+}
+//# sourceMappingURL=migrate-gen.js.map

package/dist/migrate-gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-gen.js","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,aAAa;AACb,EAAE;AACF,UAAU;AACV,6DAA6D;AAC7D,EAAE;AACF,uEAAuE;AACvE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,+DAA+D;AAC/D,EAAE;AACF,aAAa;AACb,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,oBAAoB;AAEpB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBnD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,eAAe,WAAW;;;;;;;;;;;;;CAalC,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,eAAe,WAAW;;;;;;;;;CASlC,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,0BAA0B,CAAC;IAC/B,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,WAAW,GACf,UAAU,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU;IACjB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC;;;;;uDAKyC,CAAC,CAAC;AACzD,CAAC"}

package/dist/pg-pool-adapter.d.ts

@@ -0,0 +1,44 @@
+import type { Pool } from "pg";
+import type { PgPool, PgTx, PoolKind } from "./types";
+export interface PgPoolAdapterOpts {
+    /** Underlying pg.Pool. Caller owns lifecycle (creation + .end()). */
+    pool: Pool;
+    /** Logical pool role — drives error/metric labels. */
+    kind: PoolKind;
+    /** Acquire-time threshold (ms) above which we surface a slow-acquire
+     *  telemetry hook. Defaults to 50ms per § 5.10. */
+    slowAcquireMs?: number;
+    /** Optional hook fired when acquisition exceeds `slowAcquireMs`. Tests
+     *  hook this to assert the metric path fires. */
+    onSlowAcquire?: (info: {
+        pool: PoolKind;
+        durationMs: number;
+    }) => void;
+    /** Optional hook fired every time a tx finishes (commit OR rollback).
+     *  Tests use this to assert lifecycle parity. */
+    onTxFinish?: (info: {
+        pool: PoolKind;
+        outcome: "committed" | "rolled_back" | "error";
+        durationMs: number;
+    }) => void;
+}
+/**
+ * Real PgPool adapter wrapping `pg.Pool`. Caller supplies the underlying
+ * pool with the right role credentials (boot validation in
+ * `configureDbRls` enforces this).
+ */
+export declare class PgClientPool implements PgPool {
+    readonly kind: PoolKind;
+    private readonly pool;
+    private readonly slowAcquireMs;
+    private readonly onSlowAcquire?;
+    private readonly onTxFinish?;
+    constructor(opts: PgPoolAdapterOpts);
+    /** Direct access to the underlying pg.Pool (for ORM clients that need
+     *  the raw handle — Drizzle's `drizzle(pool)` constructor for instance).
+     *  Library code does NOT use this for tx work; that path goes through
+     *  withTransaction so the GUC + release lifecycle is enforced. */
+    get rawPool(): Pool;
+    withTransaction<T>(fn: (tx: PgTx) => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=pg-pool-adapter.d.ts.map

package/dist/pg-pool-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-pool-adapter.d.ts","sourceRoot":"","sources":["../src/pg-pool-adapter.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,IAAI,EAAE,IAAI,CAAC;IACX,sDAAsD;IACtD,IAAI,EAAE,QAAQ,CAAC;IACf;uDACmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;qDACiD;IACjD,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACvE;qDACiD;IACjD,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,QAAQ,CAAC;QACf,OAAO,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;QAC/C,UAAU,EAAE,MAAM,CAAC;KACpB,KAAK,IAAI,CAAC;CACZ;AAsBD;;;;GAIG;AACH,qBAAa,YAAa,YAAW,MAAM;IACzC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAkC;gBAElD,IAAI,EAAE,iBAAiB;IAQnC;;;sEAGkE;IAClE,IAAI,OAAO,IAAI,IAAI,CAElB;IAEK,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAgDnE"}

package/dist/pg-pool-adapter.js

@@ -0,0 +1,111 @@
+// Real PgPool adapter wrapping a `pg.Pool` instance — implements the
+// PgPool/PgTx surface from src/types.ts so the existing with*Context
+// helpers, in-memory test doubles, and parity-fence asserts all keep
+// working unchanged.
+//
+// Lifecycle per § 5.3:
+//   1. Acquire client from pg.Pool (timed; metric emitted on slow acquire)
+//   2. BEGIN
+//   3. set_config(GUC, value, true)  ← caller-driven via PgTx.setConfig
+//   4. yield client to caller
+//   5. COMMIT (or ROLLBACK on throw) + release
+//
+// Pool-leak guard: client.release() ALWAYS runs in the finally block,
+// regardless of commit/rollback outcome. The acquire-timer fires a
+// telemetry span when acquisition exceeds 50ms (§ 5.10).
+class PgClientTx {
+    poolKind;
+    client;
+    constructor(kind, client) {
+        this.poolKind = kind;
+        this.client = client;
+    }
+    async exec(sql, params = []) {
+        await this.client.query(sql, params);
+    }
+    async setConfig(key, value) {
+        // set_config(name, value, is_local=true) — tx-local per § 5.3.
+        // Never expose the false variant; library refuses session-scoped GUCs.
+        await this.client.query("SELECT set_config($1, $2, true)", [key, value]);
+    }
+}
+/**
+ * Real PgPool adapter wrapping `pg.Pool`. Caller supplies the underlying
+ * pool with the right role credentials (boot validation in
+ * `configureDbRls` enforces this).
+ */
+export class PgClientPool {
+    kind;
+    pool;
+    slowAcquireMs;
+    onSlowAcquire;
+    onTxFinish;
+    constructor(opts) {
+        this.kind = opts.kind;
+        this.pool = opts.pool;
+        this.slowAcquireMs = opts.slowAcquireMs ?? 50;
+        this.onSlowAcquire = opts.onSlowAcquire;
+        this.onTxFinish = opts.onTxFinish;
+    }
+    /** Direct access to the underlying pg.Pool (for ORM clients that need
+     *  the raw handle — Drizzle's `drizzle(pool)` constructor for instance).
+     *  Library code does NOT use this for tx work; that path goes through
+     *  withTransaction so the GUC + release lifecycle is enforced. */
+    get rawPool() {
+        return this.pool;
+    }
+    async withTransaction(fn) {
+        const acquireStart = Date.now();
+        const client = await this.pool.connect();
+        const acquireMs = Date.now() - acquireStart;
+        if (acquireMs >= this.slowAcquireMs && this.onSlowAcquire) {
+            try {
+                this.onSlowAcquire({ pool: this.kind, durationMs: acquireMs });
+            }
+            catch {
+                /* hook errors are non-fatal */
+            }
+        }
+        const txStart = Date.now();
+        let outcome = "error";
+        try {
+            await client.query("BEGIN");
+            const tx = new PgClientTx(this.kind, client);
+            let result;
+            try {
+                result = await fn(tx);
+            }
+            catch (err) {
+                // Rollback then re-throw. Swallow rollback failure (don't double-throw).
+                try {
+                    await client.query("ROLLBACK");
+                }
+                catch {
+                    /* swallow per § 5.9 */
+                }
+                outcome = "rolled_back";
+                throw err;
+            }
+            await client.query("COMMIT");
+            outcome = "committed";
+            return result;
+        }
+        finally {
+            const durationMs = Date.now() - txStart;
+            try {
+                this.onTxFinish?.({ pool: this.kind, outcome, durationMs });
+            }
+            catch {
+                /* hook errors are non-fatal */
+            }
+            // Pool-leak guard — release ALWAYS runs, even on commit/rollback failure.
+            try {
+                client.release();
+            }
+            catch {
+                /* swallow release errors */
+            }
+        }
+    }
+}
+//# sourceMappingURL=pg-pool-adapter.js.map

package/dist/pg-pool-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-pool-adapter.js","sourceRoot":"","sources":["../src/pg-pool-adapter.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,qBAAqB;AACrB,EAAE;AACF,uBAAuB;AACvB,2EAA2E;AAC3E,aAAa;AACb,wEAAwE;AACxE,8BAA8B;AAC9B,+CAA+C;AAC/C,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,yDAAyD;AAyBzD,MAAM,UAAU;IACL,QAAQ,CAAW;IACnB,MAAM,CAAa;IAE5B,YAAY,IAAc,EAAE,MAAkB;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,+DAA+D;QAC/D,uEAAuE;QACvE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACd,IAAI,CAAW;IACP,IAAI,CAAO;IACX,aAAa,CAAS;IACtB,aAAa,CAAsC;IACnD,UAAU,CAAmC;IAE9D,YAAY,IAAuB;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;;;sEAGkE;IAClE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAC5C,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,MAAS,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,yEAAyE;gBACzE,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;gBACD,OAAO,GAAG,aAAa,CAAC;gBACxB,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,GAAG,WAAW,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;YACD,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/rls-policy-gen.d.ts

@@ -0,0 +1,26 @@
+export type RlsVerb = "SELECT" | "INSERT" | "UPDATE" | "DELETE";
+export interface WithRlsOpts {
+    /** Defaults to `["SELECT", "INSERT"]` (the audit-flavor floor). */
+    allow?: readonly RlsVerb[];
+    /** Tenant column name; defaults to "tenant_id". */
+    tenantColumn?: string;
+}
+/**
+ * Emits the policy DDL block for `table`.
+ *
+ * Returned string ends with `\n` for file-friendliness. Single
+ * deterministic output (no whitespace drift, stable ordering) so the
+ * parity-fence test is byte-equal.
+ *
+ * If `table` is schema-qualified (`schema.tbl`), the ALTER + ON clauses
+ * use the qualified form; the policy NAME uses only the unqualified
+ * tail (Postgres policy names live in the table's namespace and must
+ * be a plain identifier, not a dotted path).
+ */
+export declare function withRls(table: string, opts?: WithRlsOpts): string;
+/**
+ * Per-table grants — non-owner roles need GRANT on the verbs in `allow`.
+ * Owner doesn't need a grant (BYPASSRLS + table-owner).
+ */
+export declare function generateTableGrants(table: string, opts?: WithRlsOpts): string;
+//# sourceMappingURL=rls-policy-gen.d.ts.map

package/dist/rls-policy-gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-policy-gen.d.ts","sourceRoot":"","sources":["../src/rls-policy-gen.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,MAAM,CA0BrE;AAQD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,WAAgB,GACrB,MAAM,CASR"}