@nodii/db-rls 0.0.1 → 0.2.0

package/dist/rls-policy-gen.js

@@ -0,0 +1,81 @@
+// withRls — emits the 3-policy DDL for a tenant-scoped table per § 5.5.
+//
+// One policy per role: nodii_owner (FOR ALL bypass), authenticated (FOR
+// ALL gated on auth.user_tenant_ids), nodii_services (FOR ALL gated on
+// app.tenant_id GUC). Per § 5.5 the `{ allow }` option restricts which
+// CRUD verbs the non-owner roles get; owner ALWAYS gets FOR ALL.
+//
+// Output byte-equal across TS / Python / Go ports.
+const DEFAULT_ALLOW = ["SELECT", "INSERT"];
+/**
+ * Emits the policy DDL block for `table`.
+ *
+ * Returned string ends with `\n` for file-friendliness. Single
+ * deterministic output (no whitespace drift, stable ordering) so the
+ * parity-fence test is byte-equal.
+ *
+ * If `table` is schema-qualified (`schema.tbl`), the ALTER + ON clauses
+ * use the qualified form; the policy NAME uses only the unqualified
+ * tail (Postgres policy names live in the table's namespace and must
+ * be a plain identifier, not a dotted path).
+ */
+export function withRls(table, opts = {}) {
+    const tenantColumn = opts.tenantColumn ?? "tenant_id";
+    const verbs = opts.allow && opts.allow.length > 0 ? opts.allow : DEFAULT_ALLOW;
+    const policyBase = unqualifiedName(table);
+    const lines = [];
+    lines.push(`ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;`);
+    // 1. Owner policy: FOR ALL bypass.
+    lines.push(`CREATE POLICY ${policyBase}_owner_policy ON ${table} FOR ALL TO nodii_owner USING (true) WITH CHECK (true);`);
+    // 2. Authenticated policy: gated on auth.user_tenant_ids(auth.get_user_id()).
+    //    One policy per verb so the surface honestly reflects sanctioned
+    //    mutations.
+    for (const verb of verbs) {
+        lines.push(authPolicyFor(table, policyBase, tenantColumn, verb));
+    }
+    // 3. Services policy: gated on app.tenant_id GUC.
+    for (const verb of verbs) {
+        lines.push(servicesPolicyFor(table, policyBase, tenantColumn, verb));
+    }
+    return `${lines.join("\n")}\n`;
+}
+function unqualifiedName(table) {
+    // Strip optional schema prefix + any surrounding quotes.
+    const tail = table.includes(".") ? (table.split(".").pop() ?? table) : table;
+    return tail.replace(/^"|"$/g, "");
+}
+/**
+ * Per-table grants — non-owner roles need GRANT on the verbs in `allow`.
+ * Owner doesn't need a grant (BYPASSRLS + table-owner).
+ */
+export function generateTableGrants(table, opts = {}) {
+    const verbs = opts.allow && opts.allow.length > 0 ? opts.allow : DEFAULT_ALLOW;
+    const verbList = verbs.join(", ");
+    const lines = [
+        `GRANT ${verbList} ON ${table} TO nodii_services;`,
+        `GRANT ${verbList} ON ${table} TO authenticated;`,
+    ];
+    return `${lines.join("\n")}\n`;
+}
+function authPolicyFor(table, policyBase, tenantColumn, verb) {
+    // Authenticated role: tenant_id must be one of auth.user_tenant_ids(auth.get_user_id()).
+    const cond = `${tenantColumn} IN (SELECT auth.user_tenant_ids(auth.get_user_id()))`;
+    return policyLine(table, policyBase, "auth", verb, "authenticated", cond);
+}
+function servicesPolicyFor(table, policyBase, tenantColumn, verb) {
+    // Services role: tenant_id must equal current_setting('app.tenant_id').
+    const cond = `${tenantColumn} = auth.get_tenant_id()`;
+    return policyLine(table, policyBase, "svc", verb, "nodii_services", cond);
+}
+function policyLine(table, policyBase, flavor, verb, role, cond) {
+    const lcVerb = verb.toLowerCase();
+    const policyName = `${policyBase}_${flavor}_${lcVerb}_policy`;
+    if (verb === "INSERT") {
+        return `CREATE POLICY ${policyName} ON ${table} FOR INSERT TO ${role} WITH CHECK (${cond});`;
+    }
+    if (verb === "UPDATE") {
+        return `CREATE POLICY ${policyName} ON ${table} FOR UPDATE TO ${role} USING (${cond}) WITH CHECK (${cond});`;
+    }
+    return `CREATE POLICY ${policyName} ON ${table} FOR ${verb} TO ${role} USING (${cond});`;
+}
+//# sourceMappingURL=rls-policy-gen.js.map

package/dist/rls-policy-gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-policy-gen.js","sourceRoot":"","sources":["../src/rls-policy-gen.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,mDAAmD;AAWnD,MAAM,aAAa,GAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,OAAoB,EAAE;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,6BAA6B,CAAC,CAAC;IAC9D,mCAAmC;IACnC,KAAK,CAAC,IAAI,CACR,iBAAiB,UAAU,oBAAoB,KAAK,yDAAyD,CAC9G,CAAC;IAEF,8EAA8E;IAC9E,qEAAqE;IACrE,gBAAgB;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,kDAAkD;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,yDAAyD;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,OAAoB,EAAE;IAEtB,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG;QACZ,SAAS,QAAQ,OAAO,KAAK,qBAAqB;QAClD,SAAS,QAAQ,OAAO,KAAK,oBAAoB;KAClD,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CACpB,KAAa,EACb,UAAkB,EAClB,YAAoB,EACpB,IAAa;IAEb,yFAAyF;IACzF,MAAM,IAAI,GAAG,GAAG,YAAY,uDAAuD,CAAC;IACpF,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAa,EACb,UAAkB,EAClB,YAAoB,EACpB,IAAa;IAEb,wEAAwE;IACxE,MAAM,IAAI,GAAG,GAAG,YAAY,yBAAyB,CAAC;IACtD,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,UAAkB,EAClB,MAAsB,EACtB,IAAa,EACb,IAAY,EACZ,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,GAAG,UAAU,IAAI,MAAM,IAAI,MAAM,SAAS,CAAC;IAC9D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,IAAI,gBAAgB,IAAI,IAAI,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,IAAI,WAAW,IAAI,iBAAiB,IAAI,IAAI,CAAC;IAC/G,CAAC;IACD,OAAO,iBAAiB,UAAU,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,WAAW,IAAI,IAAI,CAAC;AAC3F,CAAC"}

package/dist/rls-policy.d.ts

@@ -0,0 +1,30 @@
+import type { GenerateRlsPolicyOpts } from "./types";
+/**
+ * Generates the canonical 3-policy DDL block:
+ *
+ *   1. `<table>_owner_policy`        — nodii_owner FOR ALL USING (true) WITH CHECK (true)
+ *   2. `<table>_auth_policy`         — authenticated FOR ALL USING (<tenant_col> IN auth.user_tenant_ids(...))
+ *   3. `<table>_services_policy`     — nodii_services FOR ALL USING (<tenant_col> = current_setting('app.tenant_id')::uuid)
+ *
+ * Plus the `ALTER TABLE ... ENABLE ROW LEVEL SECURITY;` prelude.
+ *
+ * Output is deterministic (no whitespace drift, stable column ordering)
+ * for cross-language byte-equality.
+ */
+export declare function generateRlsPolicy(opts: GenerateRlsPolicyOpts): string;
+/**
+ * authSchemaHelpers — returns the canonical SECURITY DEFINER SQL block
+ * defining the helper functions services rely on (`auth.set_user_id`,
+ * `auth.set_tenant_id`, `auth.set_source_ip`, `auth.get_user_id`,
+ * `auth.get_tenant_id`, `auth.user_tenant_ids`).
+ *
+ * Service-owned helpers (`auth.user_tenant_ids` joins
+ * `employees_mirror` + `customers_mirror`) — per spec § 5.7, the real
+ * version is generated by `migrate-gen` and JOINs the service's mirror
+ * tables. v0.1.0 ships the stub variant — returns the empty set so
+ * RLS fails closed if the service hasn't replaced the helper yet.
+ *
+ * Output is byte-equal across TS / Python / Go ports.
+ */
+export declare function authSchemaHelpers(): string;
+//# sourceMappingURL=rls-policy.d.ts.map

package/dist/rls-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-policy.d.ts","sourceRoot":"","sources":["../src/rls-policy.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAWrE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAkC1C"}

package/dist/rls-policy.js

@@ -0,0 +1,81 @@
+// generateRlsPolicy — returns the canonical 3-policy DDL string for a
+// tenant-scoped table per audit doctrine § 12 + PII doctrine § 8.
+//
+// Spec § 5.5 (A1 posture): every tenant-scoped table gets RLS via this
+// helper. The caller writes the DDL into a migration. Output is
+// byte-equal across TS / Python / Go ports — the polyglot parity-fence
+// test asserts this directly.
+/**
+ * Generates the canonical 3-policy DDL block:
+ *
+ *   1. `<table>_owner_policy`        — nodii_owner FOR ALL USING (true) WITH CHECK (true)
+ *   2. `<table>_auth_policy`         — authenticated FOR ALL USING (<tenant_col> IN auth.user_tenant_ids(...))
+ *   3. `<table>_services_policy`     — nodii_services FOR ALL USING (<tenant_col> = current_setting('app.tenant_id')::uuid)
+ *
+ * Plus the `ALTER TABLE ... ENABLE ROW LEVEL SECURITY;` prelude.
+ *
+ * Output is deterministic (no whitespace drift, stable column ordering)
+ * for cross-language byte-equality.
+ */
+export function generateRlsPolicy(opts) {
+    const table = opts.table;
+    const tenantColumn = opts.tenantColumn ?? "tenant_id";
+    // Stable single-string with trailing newline per SQL file convention.
+    const lines = [
+        `ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;`,
+        `CREATE POLICY ${table}_owner_policy ON ${table} FOR ALL TO nodii_owner USING (true) WITH CHECK (true);`,
+        `CREATE POLICY ${table}_auth_policy ON ${table} FOR ALL TO authenticated USING (${tenantColumn} IN (SELECT auth.user_tenant_ids(current_setting('app.user_id')::uuid))) WITH CHECK (${tenantColumn} IN (SELECT auth.user_tenant_ids(current_setting('app.user_id')::uuid)));`,
+        `CREATE POLICY ${table}_services_policy ON ${table} FOR ALL TO nodii_services USING (${tenantColumn} = current_setting('app.tenant_id')::uuid) WITH CHECK (${tenantColumn} = current_setting('app.tenant_id')::uuid);`,
+    ];
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * authSchemaHelpers — returns the canonical SECURITY DEFINER SQL block
+ * defining the helper functions services rely on (`auth.set_user_id`,
+ * `auth.set_tenant_id`, `auth.set_source_ip`, `auth.get_user_id`,
+ * `auth.get_tenant_id`, `auth.user_tenant_ids`).
+ *
+ * Service-owned helpers (`auth.user_tenant_ids` joins
+ * `employees_mirror` + `customers_mirror`) — per spec § 5.7, the real
+ * version is generated by `migrate-gen` and JOINs the service's mirror
+ * tables. v0.1.0 ships the stub variant — returns the empty set so
+ * RLS fails closed if the service hasn't replaced the helper yet.
+ *
+ * Output is byte-equal across TS / Python / Go ports.
+ */
+export function authSchemaHelpers() {
+    // Note: stable formatting (single space indent, no trailing whitespace)
+    // for cross-language byte-equality.
+    return [
+        "CREATE SCHEMA IF NOT EXISTS auth;",
+        "",
+        "CREATE OR REPLACE FUNCTION auth.set_user_id(p_user_id uuid) RETURNS void",
+        "LANGUAGE sql AS $$ SELECT set_config('app.user_id', p_user_id::text, true) $$;",
+        "",
+        "CREATE OR REPLACE FUNCTION auth.set_tenant_id(p_tenant_id uuid) RETURNS void",
+        "LANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;",
+        "",
+        "CREATE OR REPLACE FUNCTION auth.set_source_ip(p_source_ip text) RETURNS void",
+        "LANGUAGE sql AS $$ SELECT set_config('app.source_ip', p_source_ip, true) $$;",
+        "",
+        "CREATE OR REPLACE FUNCTION auth.get_user_id() RETURNS uuid",
+        "LANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.user_id', true), '')::uuid $$;",
+        "",
+        "CREATE OR REPLACE FUNCTION auth.get_tenant_id() RETURNS uuid",
+        "LANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true), '')::uuid $$;",
+        "",
+        "-- TODO db-rls-v0.1.x: migrate-gen replaces this stub with a UNION over",
+        "-- the service's employees_mirror + customers_mirror tables.",
+        "CREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid",
+        "LANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;",
+        "",
+        "GRANT EXECUTE ON FUNCTION auth.set_user_id(uuid) TO nodii_services, authenticated;",
+        "GRANT EXECUTE ON FUNCTION auth.set_tenant_id(uuid) TO nodii_services, authenticated;",
+        "GRANT EXECUTE ON FUNCTION auth.set_source_ip(text) TO nodii_services, authenticated;",
+        "GRANT EXECUTE ON FUNCTION auth.get_user_id() TO nodii_services, authenticated;",
+        "GRANT EXECUTE ON FUNCTION auth.get_tenant_id() TO nodii_services, authenticated;",
+        "GRANT EXECUTE ON FUNCTION auth.user_tenant_ids(uuid) TO nodii_services, authenticated;",
+        "",
+    ].join("\n");
+}
+//# sourceMappingURL=rls-policy.js.map

package/dist/rls-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-policy.js","sourceRoot":"","sources":["../src/rls-policy.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,kEAAkE;AAClE,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,8BAA8B;AAI9B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,sEAAsE;IACtE,MAAM,KAAK,GAAG;QACZ,eAAe,KAAK,6BAA6B;QACjD,iBAAiB,KAAK,oBAAoB,KAAK,yDAAyD;QACxG,iBAAiB,KAAK,mBAAmB,KAAK,oCAAoC,YAAY,wFAAwF,YAAY,2EAA2E;QAC7Q,iBAAiB,KAAK,uBAAuB,KAAK,qCAAqC,YAAY,0DAA0D,YAAY,6CAA6C;KACvN,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB;IAC/B,wEAAwE;IACxE,oCAAoC;IACpC,OAAO;QACL,mCAAmC;QACnC,EAAE;QACF,0EAA0E;QAC1E,gFAAgF;QAChF,EAAE;QACF,8EAA8E;QAC9E,oFAAoF;QACpF,EAAE;QACF,8EAA8E;QAC9E,8EAA8E;QAC9E,EAAE;QACF,4DAA4D;QAC5D,6FAA6F;QAC7F,EAAE;QACF,8DAA8D;QAC9D,+FAA+F;QAC/F,EAAE;QACF,yEAAyE;QACzE,8DAA8D;QAC9D,oFAAoF;QACpF,6DAA6D;QAC7D,EAAE;QACF,oFAAoF;QACpF,sFAAsF;QACtF,sFAAsF;QACtF,gFAAgF;QAChF,kFAAkF;QAClF,wFAAwF;QACxF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,71 @@
+/** PoolKind names map 1:1 to the canonical three roles. */
+export type PoolKind = "owner" | "services" | "authenticated";
+/** Pluggable transaction handle — substrate-agnostic. v0.1.0 ships the
+ *  in-memory transcript-recording test double; pg / psycopg / pgx adapters
+ *  arrive in v0.1.x. */
+export interface PgTx {
+    /** Execute a parameterized SQL statement. */
+    exec(sql: string, params?: readonly unknown[]): Promise<void>;
+    /** Set a per-tx GUC via `set_config($1, $2, true)`. */
+    setConfig(key: string, value: string): Promise<void>;
+    /** Internal — read the recorded transcript (test double only). */
+    readonly poolKind: PoolKind;
+}
+/** Pluggable Postgres pool — yields a tx for the lifetime of `fn`. */
+export interface PgPool {
+    /** Identifier for telemetry + error messages. */
+    readonly kind: PoolKind;
+    /** Acquire a connection, BEGIN a tx, yield, and COMMIT/ROLLBACK. */
+    withTransaction<T>(fn: (tx: PgTx) => Promise<T>): Promise<T>;
+}
+/** Auth context bound by `@nodii/auth-sdk` middleware. Mirrors the
+ *  fields autoDispatch reads — kept structural so the real auth-sdk
+ *  context shape can grow without breaking us. */
+export interface AuthContext {
+    /** Verified principal id (sub). */
+    userId: string;
+    /** Resolved tenant id (pinned by the JWT). */
+    tenantId: string;
+    /** Optional source IP for forensic GUC binding. */
+    sourceIp?: string;
+}
+/** withUserContext opts. */
+export interface UserContextOpts {
+    userId: string;
+    tenantId: string;
+    sourceIp?: string;
+}
+/** withSystemContext opts. */
+export interface SystemContextOpts {
+    tenantId: string;
+}
+/** autoDispatch opts. */
+export interface AutoDispatchOpts {
+    authContext?: AuthContext;
+    tenantId?: string;
+}
+/** generateRlsPolicy opts. */
+export interface GenerateRlsPolicyOpts {
+    /** Table name (unqualified). */
+    table: string;
+    /** Tenant column name. Defaults to `tenant_id`. */
+    tenantColumn?: string;
+}
+export declare class DbRlsError extends Error {
+    constructor(message: string);
+}
+export declare class DbRlsNotInitialized extends DbRlsError {
+    constructor();
+}
+export declare class PoolUnavailable extends DbRlsError {
+    readonly pool: PoolKind;
+    constructor(pool: PoolKind);
+}
+export declare class MissingTenantContext extends DbRlsError {
+    constructor();
+}
+export declare class TransactionRolledBack extends DbRlsError {
+    readonly cause: unknown;
+    constructor(cause: unknown);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAoBA,2DAA2D;AAC3D,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,eAAe,CAAC;AAE9D;;wBAEwB;AACxB,MAAM,WAAW,IAAI;IACnB,6CAA6C;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oEAAoE;IACpE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;kDAEkD;AAClD,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yBAAyB;AACzB,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAKD,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,UAAU;;CAOlD;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACZ,IAAI,EAAE,QAAQ;CAK3B;AAED,qBAAa,oBAAqB,SAAQ,UAAU;;CAOnD;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAS3B"}

package/dist/types.js

@@ -0,0 +1,56 @@
+// Core type surface for @nodii/db-rls v0.1.0.
+//
+// Spec: planning hub feature_doc serviceId=nodii-libs docKey=db-rls
+// (A1 posture — RLS on every tenant-scoped table — locked 2026-05-25).
+//
+// v0.1.0 ships:
+//   - initDbRls / requireDbRls + DbRlsNotInitialized
+//   - PgPool / PgTx pluggable Postgres surface (in-memory test double)
+//   - withUserContext / withSystemContext / withOwnerContext entry points
+//   - autoDispatch (auth-sdk-style context routing)
+//   - generateRlsPolicy (canonical 3-policy DDL per audit doctrine § 12 +
+//     PII doctrine § 8)
+//   - authSchemaHelpers (canonical SECURITY DEFINER SQL block)
+//   - Typed-error hierarchy rooted at DbRlsError
+//
+// Deferred (`// TODO db-rls-v0.1.x:`):
+//   - Real pg / psycopg / pgx pool wiring
+//   - Drizzle / SQLAlchemy / sqlc client wrappers
+//   - migrate-gen CLI that emits per-service auth.sql + per-table RLS DDL
+// ----------------------------------------------------------------------------
+// Typed-error hierarchy.
+export class DbRlsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DbRlsError";
+    }
+}
+export class DbRlsNotInitialized extends DbRlsError {
+    constructor() {
+        super("@nodii/db-rls is not initialized — call initDbRls({ owner, services, authenticated }) at process start.");
+        this.name = "DbRlsNotInitialized";
+    }
+}
+export class PoolUnavailable extends DbRlsError {
+    pool;
+    constructor(pool) {
+        super(`pool_unavailable: the ${pool} pool was not supplied to initDbRls.`);
+        this.name = "PoolUnavailable";
+        this.pool = pool;
+    }
+}
+export class MissingTenantContext extends DbRlsError {
+    constructor() {
+        super("missing_tenant_context: autoDispatch requires either authContext or tenantId.");
+        this.name = "MissingTenantContext";
+    }
+}
+export class TransactionRolledBack extends DbRlsError {
+    cause;
+    constructor(cause) {
+        super(`transaction_rolled_back: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.name = "TransactionRolledBack";
+        this.cause = cause;
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,EAAE;AACF,gBAAgB;AAChB,qDAAqD;AACrD,uEAAuE;AACvE,0EAA0E;AAC1E,oDAAoD;AACpD,0EAA0E;AAC1E,wBAAwB;AACxB,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,uCAAuC;AACvC,0CAA0C;AAC1C,kDAAkD;AAClD,0EAA0E;AA+D1E,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD;QACE,KAAK,CACH,yGAAyG,CAC1G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACpC,IAAI,CAAW;IACxB,YAAY,IAAc;QACxB,KAAK,CAAC,yBAAyB,IAAI,sCAAsC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD;QACE,KAAK,CACH,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CACH,4BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF"}

package/package.json

@@ -1,33 +1,57 @@
 {
   "name": "@nodii/db-rls",
-  "version": "0.0.1",
-  "description": "Placeholder for @nodii/db-rls — implementation lands at v0.1.0",
+  "version": "0.2.0",
+  "description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "nodii-db-rls": "./bin/migrate-gen.mjs"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     }
   },
-  "files": ["dist"],
+  "files": [
+    "dist",
+    "bin",
+    "README.md"
+  ],
   "publishConfig": {
-    "access": "public",
-    "provenance": true
+    "access": "public"
   },
   "scripts": {
     "build": "tsc",
     "typecheck": "tsc --noEmit",
-    "test": "echo 'no tests yet; placeholder package'"
+    "test": "bun test"
+  },
+  "peerDependencies": {
+    "@nodii/telemetry": "workspace:*",
+    "drizzle-orm": "^0.36.0",
+    "pg": "^8.13.0"
+  },
+  "peerDependenciesMeta": {
+    "drizzle-orm": {
+      "optional": false
+    },
+    "pg": {
+      "optional": false
+    }
   },
   "devDependencies": {
+    "@nodii/telemetry": "workspace:*",
+    "@types/bun": "^1.3.13",
+    "@types/pg": "^8.11.10",
+    "drizzle-orm": "^0.36.4",
+    "pg": "^8.13.1",
     "typescript": "^5.9.3"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/cognion-nucleus/nodii-libs.git",
+    "url": "git+https://github.com/cognion-nucleus/nodii-libs.git",
     "directory": "ts/db-rls"
   }
 }