@nodii/db-rls 0.0.2 → 0.2.1

package/bin/migrate-gen.mjs

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+// CLI shim for `npx @nodii/db-rls migrate-gen <serviceName>`.
+//
+// The real logic lives in src/migrate-gen.ts; this shim just unwraps
+// argv and calls runMigrateGenCli + translates the return value to
+// process.exit.
+
+import { runMigrateGenCli } from "../dist/migrate-gen.js";
+
+const args = process.argv.slice(2);
+const code = runMigrateGenCli(args);
+process.exit(code);

package/dist/auth-schema.d.ts

@@ -0,0 +1,45 @@
+import type { Pool, PoolClient } from "pg";
+/**
+ * Canonical SQL string exported as a module-level constant per the R1
+ * compliance requirement. Identical byte-equal payload across TS / Python
+ * / Go ports (asserted by the parity-fence CI).
+ */
+export declare const AUTH_SCHEMA_SQL = "CREATE SCHEMA IF NOT EXISTS auth;\n\nCREATE OR REPLACE FUNCTION auth.set_user_id(p_user_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.user_id', p_user_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.set_tenant_id(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.init(p_user_id uuid, p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$\n  SELECT set_config('app.user_id', p_user_id::text, true);\n  SELECT set_config('app.tenant_id', p_tenant_id::text, true);\n$$;\n\nCREATE OR REPLACE FUNCTION auth.init_tenant(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.get_user_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.user_id', true), '')::uuid $$;\n\nCREATE OR REPLACE FUNCTION auth.get_tenant_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true), '')::uuid $$;\n\n-- Stub variant. Replaced in-place by migrate-gen's 0001_user_tenant_ids.sql\n-- once the service has employees_mirror + customers_mirror tables.\nCREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid\nLANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;\n";
+/**
+ * Grants for the 7 helper functions. Emitted separately because they
+ * reference roles that must exist before the GRANT runs — applied last
+ * after all role creation has settled.
+ */
+export declare const AUTH_SCHEMA_GRANTS_SQL = "GRANT USAGE ON SCHEMA auth TO nodii_services, authenticated;\nGRANT EXECUTE ON FUNCTION auth.set_user_id(uuid) TO nodii_services, authenticated;\nGRANT EXECUTE ON FUNCTION auth.set_tenant_id(uuid) TO nodii_services, authenticated;\nGRANT EXECUTE ON FUNCTION auth.init(uuid, uuid) TO nodii_services, authenticated;\nGRANT EXECUTE ON FUNCTION auth.init_tenant(uuid) TO nodii_services, authenticated;\nGRANT EXECUTE ON FUNCTION auth.get_user_id() TO nodii_services, authenticated;\nGRANT EXECUTE ON FUNCTION auth.get_tenant_id() TO nodii_services, authenticated;\nGRANT EXECUTE ON FUNCTION auth.user_tenant_ids(uuid) TO nodii_services, authenticated;\n";
+/**
+ * Minimal client surface — works with `pg.Pool`, `pg.PoolClient`, or
+ * `pg.Client`. We accept anything with a `.query(sql)` method.
+ */
+export interface SqlExecutor {
+    query(sql: string): Promise<unknown>;
+}
+type AnyExecutor = Pool | PoolClient | SqlExecutor;
+/**
+ * Applies the canonical auth schema + 7 helper functions idempotently.
+ *
+ * Caller MUST run this against the `owner` (nodii_owner BYPASSRLS) pool
+ * — function definitions require schema-creation privilege which is
+ * owner-only per § 5.7 terraform-bootstrap split.
+ *
+ * Per § 5.7: existing services migrating from the old 4-phase model run
+ * this as a one-shot before deploying. New services let terraform's
+ * `null_resource.auth_schema_bootstrap` run this; the library function
+ * exists for tests + local dev where terraform isn't in play.
+ */
+export declare function applyAuthSchemaMigrations(client: AnyExecutor, opts?: {
+    includeGrants?: boolean;
+}): Promise<void>;
+/**
+ * Composite full DDL — the schema + helpers + grants, joined.
+ * Provided for migrate-gen + parity-fence byte-equality.
+ */
+export declare function authSchemaFullSql(opts?: {
+    includeGrants?: boolean;
+}): string;
+export {};
+//# sourceMappingURL=auth-schema.d.ts.map

package/dist/auth-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,eAAe,s1CA2B3B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,8oBAQlC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,KAAK,WAAW,GAAG,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,MAAM,CAKR"}

package/dist/auth-schema.js

@@ -0,0 +1,101 @@
+// Auth schema SQL helpers — canonical SECURITY DEFINER block per § 5.7.
+//
+// Exports the 7 canonical helper functions as a single module-level
+// constant + an apply helper that runs them idempotently against any
+// `pg.Pool`-shaped client.
+//
+// The seven canonical helpers per `07-rls-doctrine.md` § canonical
+// helper signatures:
+//
+//   - auth.set_user_id(uuid)         → set_config('app.user_id', ..., true)
+//   - auth.set_tenant_id(uuid)       → set_config('app.tenant_id', ..., true)
+//   - auth.init(uuid, uuid)          → both of the above in one shot
+//   - auth.init_tenant(uuid)         → set_config('app.tenant_id', ..., true) (system path)
+//   - auth.get_user_id()             → current_setting → uuid
+//   - auth.get_tenant_id()           → current_setting → uuid
+//   - auth.user_tenant_ids(uuid)     → stub here; replaced by migrate-gen
+//
+// The stub variant of `auth.user_tenant_ids` returns an empty set so RLS
+// fails closed if a service applies the helpers but hasn't yet emitted
+// the real per-service helper via `migrate-gen`. Once `migrate-gen` ships
+// the real helper, `CREATE OR REPLACE` replaces this stub in place.
+/**
+ * Canonical SQL string exported as a module-level constant per the R1
+ * compliance requirement. Identical byte-equal payload across TS / Python
+ * / Go ports (asserted by the parity-fence CI).
+ */
+export const AUTH_SCHEMA_SQL = `CREATE SCHEMA IF NOT EXISTS auth;
+
+CREATE OR REPLACE FUNCTION auth.set_user_id(p_user_id uuid) RETURNS void
+LANGUAGE sql AS $$ SELECT set_config('app.user_id', p_user_id::text, true) $$;
+
+CREATE OR REPLACE FUNCTION auth.set_tenant_id(p_tenant_id uuid) RETURNS void
+LANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;
+
+CREATE OR REPLACE FUNCTION auth.init(p_user_id uuid, p_tenant_id uuid) RETURNS void
+LANGUAGE sql AS $$
+  SELECT set_config('app.user_id', p_user_id::text, true);
+  SELECT set_config('app.tenant_id', p_tenant_id::text, true);
+$$;
+
+CREATE OR REPLACE FUNCTION auth.init_tenant(p_tenant_id uuid) RETURNS void
+LANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;
+
+CREATE OR REPLACE FUNCTION auth.get_user_id() RETURNS uuid
+LANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.user_id', true), '')::uuid $$;
+
+CREATE OR REPLACE FUNCTION auth.get_tenant_id() RETURNS uuid
+LANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true), '')::uuid $$;
+
+-- Stub variant. Replaced in-place by migrate-gen's 0001_user_tenant_ids.sql
+-- once the service has employees_mirror + customers_mirror tables.
+CREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid
+LANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;
+`;
+/**
+ * Grants for the 7 helper functions. Emitted separately because they
+ * reference roles that must exist before the GRANT runs — applied last
+ * after all role creation has settled.
+ */
+export const AUTH_SCHEMA_GRANTS_SQL = `GRANT USAGE ON SCHEMA auth TO nodii_services, authenticated;
+GRANT EXECUTE ON FUNCTION auth.set_user_id(uuid) TO nodii_services, authenticated;
+GRANT EXECUTE ON FUNCTION auth.set_tenant_id(uuid) TO nodii_services, authenticated;
+GRANT EXECUTE ON FUNCTION auth.init(uuid, uuid) TO nodii_services, authenticated;
+GRANT EXECUTE ON FUNCTION auth.init_tenant(uuid) TO nodii_services, authenticated;
+GRANT EXECUTE ON FUNCTION auth.get_user_id() TO nodii_services, authenticated;
+GRANT EXECUTE ON FUNCTION auth.get_tenant_id() TO nodii_services, authenticated;
+GRANT EXECUTE ON FUNCTION auth.user_tenant_ids(uuid) TO nodii_services, authenticated;
+`;
+/**
+ * Applies the canonical auth schema + 7 helper functions idempotently.
+ *
+ * Caller MUST run this against the `owner` (nodii_owner BYPASSRLS) pool
+ * — function definitions require schema-creation privilege which is
+ * owner-only per § 5.7 terraform-bootstrap split.
+ *
+ * Per § 5.7: existing services migrating from the old 4-phase model run
+ * this as a one-shot before deploying. New services let terraform's
+ * `null_resource.auth_schema_bootstrap` run this; the library function
+ * exists for tests + local dev where terraform isn't in play.
+ */
+export async function applyAuthSchemaMigrations(client, opts = {}) {
+    const includeGrants = opts.includeGrants ?? true;
+    // pg's typings union overloads can't infer through `Pool | PoolClient |
+    // SqlExecutor`; cast to the minimal shape.
+    const exec = client;
+    await exec.query(AUTH_SCHEMA_SQL);
+    if (includeGrants) {
+        await exec.query(AUTH_SCHEMA_GRANTS_SQL);
+    }
+}
+/**
+ * Composite full DDL — the schema + helpers + grants, joined.
+ * Provided for migrate-gen + parity-fence byte-equality.
+ */
+export function authSchemaFullSql(opts = {}) {
+    const includeGrants = opts.includeGrants ?? true;
+    return includeGrants
+        ? `${AUTH_SCHEMA_SQL}\n${AUTH_SCHEMA_GRANTS_SQL}`
+        : AUTH_SCHEMA_SQL;
+}
+//# sourceMappingURL=auth-schema.js.map

package/dist/auth-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,mEAAmE;AACnE,qBAAqB;AACrB,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,qEAAqE;AACrE,4FAA4F;AAC5F,8DAA8D;AAC9D,8DAA8D;AAC9D,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,oEAAoE;AAIpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;CAQrC,CAAC;AAYF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAmB,EACnB,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAqB,CAAC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,OAAO,aAAa;QAClB,CAAC,CAAC,GAAG,eAAe,KAAK,sBAAsB,EAAE;QACjD,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC"}

package/dist/configure.d.ts

@@ -0,0 +1,45 @@
+import type { Pool } from "pg";
+import { DbRlsError, type PoolKind } from "./types";
+export interface ConfigureDbRlsOpts {
+    /** Per `nodii-libs/telemetry.md` § 5.4. Used in error messages + spans. */
+    serviceName: string;
+    /** Underlying pg.Pool instances per role. Caller owns lifecycle. */
+    pools: {
+        owner: Pool;
+        services: Pool;
+        authenticated: Pool;
+    };
+    /** Enable role-name validation at boot (default true). Set false in
+     *  unit tests that wire raw postgres without dedicated roles. */
+    validateRoles?: boolean;
+    /** Slow-acquire threshold in ms — propagated to PgClientPool. */
+    slowAcquireMs?: number;
+    /** Hook fired on slow acquisitions. */
+    onSlowAcquire?: (info: {
+        pool: PoolKind;
+        durationMs: number;
+    }) => void;
+    /** Hook fired on every tx finish (commit/rollback). */
+    onTxFinish?: (info: {
+        pool: PoolKind;
+        outcome: "committed" | "rolled_back" | "error";
+        durationMs: number;
+    }) => void;
+}
+export declare class PoolCredentialMismatch extends DbRlsError {
+    readonly pool: PoolKind;
+    readonly expected: string;
+    readonly actual: string;
+    constructor(pool: PoolKind, expected: string, actual: string);
+}
+/**
+ * configureDbRls — call once at process start.
+ *
+ * On failure (credential mismatch, connection failure during validation),
+ * throws and leaves db-rls UNinitialized — the caller MUST surface and
+ * exit; running with the wrong credentials is a silent cross-tenant leak
+ * per the spec's failure modes.
+ */
+export declare function configureDbRls(opts: ConfigureDbRlsOpts): Promise<void>;
+export declare function _resetConfigureForTests(): void;
+//# sourceMappingURL=configure.d.ts.map

package/dist/configure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIpD,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,EAAE;QACL,KAAK,EAAE,IAAI,CAAC;QACZ,QAAQ,EAAE,IAAI,CAAC;QACf,aAAa,EAAE,IAAI,CAAC;KACrB,CAAC;IACF;qEACiE;IACjE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uCAAuC;IACvC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACvE,uDAAuD;IACvD,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,QAAQ,CAAC;QACf,OAAO,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;QAC/C,UAAU,EAAE,MAAM,CAAC;KACpB,KAAK,IAAI,CAAC;CACZ;AAQD,qBAAa,sBAAuB,SAAQ,UAAU;IACpD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAS7D;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B5E;AAgBD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}

package/dist/configure.js

@@ -0,0 +1,85 @@
+// configureDbRls — boot helper per § 5.2.
+//
+// Wraps initDbRls with:
+//   - Optional pool-credential validation (SELECT current_user per pool;
+//     fails boot loud on mismatch per § 5.2 + § 5.9 PoolCredentialMismatch).
+//   - Automatic conversion of `pg.Pool` instances → `PgClientPool` adapters
+//     so consumers just supply their raw pg.Pool from their existing
+//     wiring code.
+//   - Service name binding (currently used for log lines; future
+//     telemetry resource attribute).
+import { DbRlsError } from "./types";
+import { _resetForTests as resetInit, initDbRls } from "./init";
+import { PgClientPool } from "./pg-pool-adapter";
+const EXPECTED_ROLES = {
+    owner: "nodii_owner",
+    services: "nodii_services",
+    authenticated: "authenticated",
+};
+export class PoolCredentialMismatch extends DbRlsError {
+    pool;
+    expected;
+    actual;
+    constructor(pool, expected, actual) {
+        super(`pool_credential_mismatch: ${pool} pool connected as '${actual}' but expected '${expected}' — wire the correct role's credentials per § 5.2.`);
+        this.name = "PoolCredentialMismatch";
+        this.pool = pool;
+        this.expected = expected;
+        this.actual = actual;
+    }
+}
+/**
+ * configureDbRls — call once at process start.
+ *
+ * On failure (credential mismatch, connection failure during validation),
+ * throws and leaves db-rls UNinitialized — the caller MUST surface and
+ * exit; running with the wrong credentials is a silent cross-tenant leak
+ * per the spec's failure modes.
+ */
+export async function configureDbRls(opts) {
+    const validate = opts.validateRoles ?? true;
+    if (validate) {
+        await assertPoolRole(opts.pools.owner, "owner");
+        await assertPoolRole(opts.pools.services, "services");
+        await assertPoolRole(opts.pools.authenticated, "authenticated");
+    }
+    const owner = new PgClientPool({
+        pool: opts.pools.owner,
+        kind: "owner",
+        slowAcquireMs: opts.slowAcquireMs,
+        onSlowAcquire: opts.onSlowAcquire,
+        onTxFinish: opts.onTxFinish,
+    });
+    const services = new PgClientPool({
+        pool: opts.pools.services,
+        kind: "services",
+        slowAcquireMs: opts.slowAcquireMs,
+        onSlowAcquire: opts.onSlowAcquire,
+        onTxFinish: opts.onTxFinish,
+    });
+    const authenticated = new PgClientPool({
+        pool: opts.pools.authenticated,
+        kind: "authenticated",
+        slowAcquireMs: opts.slowAcquireMs,
+        onSlowAcquire: opts.onSlowAcquire,
+        onTxFinish: opts.onTxFinish,
+    });
+    initDbRls({ owner, services, authenticated });
+}
+async function assertPoolRole(pool, kind) {
+    const expected = EXPECTED_ROLES[kind];
+    const res = await pool.query("SELECT current_user");
+    // pg returns the field lowercase.
+    // biome-ignore lint/suspicious/noExplicitAny: shape from pg lib
+    const actual = res.rows[0]?.current_user;
+    if (!actual) {
+        throw new PoolCredentialMismatch(kind, expected, "(unknown)");
+    }
+    if (actual !== expected) {
+        throw new PoolCredentialMismatch(kind, expected, actual);
+    }
+}
+export function _resetConfigureForTests() {
+    resetInit();
+}
+//# sourceMappingURL=configure.js.map

package/dist/configure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,wBAAwB;AACxB,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,qEAAqE;AACrE,mBAAmB;AACnB,iEAAiE;AACjE,qCAAqC;AAGrC,OAAO,EAAE,UAAU,EAAiB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,cAAc,IAAI,SAAS,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AA0BjD,MAAM,cAAc,GAA6B;IAC/C,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,gBAAgB;IAC1B,aAAa,EAAE,eAAe;CAC/B,CAAC;AAEF,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IAC3C,IAAI,CAAW;IACf,QAAQ,CAAS;IACjB,MAAM,CAAS;IACxB,YAAY,IAAc,EAAE,QAAgB,EAAE,MAAc;QAC1D,KAAK,CACH,6BAA6B,IAAI,uBAAuB,MAAM,mBAAmB,QAAQ,oDAAoD,CAC9I,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;QACtB,IAAI,EAAE,OAAO;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;QACzB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAI,YAAY,CAAC;QACrC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa;QAC9B,IAAI,EAAE,eAAe;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE,IAAc;IACtD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAA2B,qBAAqB,CAAC,CAAC;IAC9E,kCAAkC;IAClC,gEAAgE;IAChE,MAAM,MAAM,GAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,YAAkC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,SAAS,EAAE,CAAC;AACd,CAAC"}

package/dist/context.d.ts

@@ -0,0 +1,43 @@
+import { type AutoDispatchOpts, type PgTx, type SystemContextOpts, type UserContextOpts } from "./types";
+/**
+ * withUserContext — opens a tx on the `authenticated` pool, sets
+ * `auth.user_id` + `auth.tenant_id` (+ optional `auth.source_ip`) via
+ * `set_config(..., true)` tx-scoped GUCs, yields the tx, commits/rolls
+ * back per the PgPool contract.
+ *
+ * Throws `DbRlsNotInitialized` if `initDbRls` hasn't run.
+ * Wraps any error thrown by `fn` in `TransactionRolledBack`.
+ */
+export declare function withUserContext<T>(opts: UserContextOpts, fn: (tx: PgTx) => Promise<T>): Promise<T>;
+/**
+ * withSystemContext — opens a tx on the `services` (nodii_services) pool,
+ * sets `app.tenant_id` via tx-scoped `set_config`, yields the tx, commits
+ * / rolls back per the PgPool contract.
+ */
+export declare function withSystemContext<T>(opts: SystemContextOpts, fn: (tx: PgTx) => Promise<T>): Promise<T>;
+/**
+ * withOwnerContext — opens a tx on the `owner` (nodii_owner BYPASSRLS)
+ * pool. No GUCs are set — owner is the migrations-only context.
+ *
+ * NOTE: v0.1.0 ships this on the runtime barrel for symmetry. The spec
+ * § 5.3 + § Open Q3 calls out that future v0.1.x moves this to
+ * `@nodii/db-rls/migrate` sub-package + adds a `NODII_ENV=migrate`
+ * runtime guard. Documented as `// TODO db-rls-v0.1.x: move to /migrate
+ * sub-package + NODII_ENV guard`.
+ */
+export declare function withOwnerContext<T>(fn: (tx: PgTx) => Promise<T>): Promise<T>;
+/**
+ * autoDispatch — chooses the right pool based on what's bound.
+ *
+ *   - `authContext` present → dispatch through withUserContext
+ *     (uses authContext.userId + authContext.tenantId).
+ *   - only `tenantId` present → dispatch through withSystemContext.
+ *   - neither → throw `MissingTenantContext`.
+ *
+ * This mirrors `withRequestContext` from the spec § 5.4 with one
+ * simplification: the auth context is passed explicitly rather than
+ * being read from ALS. Real auth-sdk integration lands in v0.1.x —
+ * `// TODO db-rls-v0.1.x: ALS-bound auto-dispatch`.
+ */
+export declare function autoDispatch<T>(opts: AutoDispatchOpts, fn: (tx: PgTx) => Promise<T>): Promise<T>;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,IAAI,EACT,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,SAAS,CAAC;AAEjB;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAcZ;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CASZ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAeZ"}

package/dist/context.js

@@ -0,0 +1,98 @@
+// Entry-point helpers — explicit pool dispatch.
+//
+// Spec § 5.3 + § 5.4. Each helper opens a tx on the correct pool, sets
+// the canonical GUCs via `set_config(..., true)` (tx-scoped), yields, and
+// commits / rollbacks per the underlying PgPool's withTransaction
+// contract.
+import { requirePool } from "./init";
+import { MissingTenantContext, TransactionRolledBack, } from "./types";
+/**
+ * withUserContext — opens a tx on the `authenticated` pool, sets
+ * `auth.user_id` + `auth.tenant_id` (+ optional `auth.source_ip`) via
+ * `set_config(..., true)` tx-scoped GUCs, yields the tx, commits/rolls
+ * back per the PgPool contract.
+ *
+ * Throws `DbRlsNotInitialized` if `initDbRls` hasn't run.
+ * Wraps any error thrown by `fn` in `TransactionRolledBack`.
+ */
+export async function withUserContext(opts, fn) {
+    const pool = requirePool("authenticated");
+    return pool.withTransaction(async (tx) => {
+        await tx.setConfig("auth.user_id", opts.userId);
+        await tx.setConfig("auth.tenant_id", opts.tenantId);
+        if (opts.sourceIp !== undefined) {
+            await tx.setConfig("auth.source_ip", opts.sourceIp);
+        }
+        try {
+            return await fn(tx);
+        }
+        catch (cause) {
+            throw new TransactionRolledBack(cause);
+        }
+    });
+}
+/**
+ * withSystemContext — opens a tx on the `services` (nodii_services) pool,
+ * sets `app.tenant_id` via tx-scoped `set_config`, yields the tx, commits
+ * / rolls back per the PgPool contract.
+ */
+export async function withSystemContext(opts, fn) {
+    const pool = requirePool("services");
+    return pool.withTransaction(async (tx) => {
+        await tx.setConfig("app.tenant_id", opts.tenantId);
+        try {
+            return await fn(tx);
+        }
+        catch (cause) {
+            throw new TransactionRolledBack(cause);
+        }
+    });
+}
+/**
+ * withOwnerContext — opens a tx on the `owner` (nodii_owner BYPASSRLS)
+ * pool. No GUCs are set — owner is the migrations-only context.
+ *
+ * NOTE: v0.1.0 ships this on the runtime barrel for symmetry. The spec
+ * § 5.3 + § Open Q3 calls out that future v0.1.x moves this to
+ * `@nodii/db-rls/migrate` sub-package + adds a `NODII_ENV=migrate`
+ * runtime guard. Documented as `// TODO db-rls-v0.1.x: move to /migrate
+ * sub-package + NODII_ENV guard`.
+ */
+export async function withOwnerContext(fn) {
+    const pool = requirePool("owner");
+    return pool.withTransaction(async (tx) => {
+        try {
+            return await fn(tx);
+        }
+        catch (cause) {
+            throw new TransactionRolledBack(cause);
+        }
+    });
+}
+/**
+ * autoDispatch — chooses the right pool based on what's bound.
+ *
+ *   - `authContext` present → dispatch through withUserContext
+ *     (uses authContext.userId + authContext.tenantId).
+ *   - only `tenantId` present → dispatch through withSystemContext.
+ *   - neither → throw `MissingTenantContext`.
+ *
+ * This mirrors `withRequestContext` from the spec § 5.4 with one
+ * simplification: the auth context is passed explicitly rather than
+ * being read from ALS. Real auth-sdk integration lands in v0.1.x —
+ * `// TODO db-rls-v0.1.x: ALS-bound auto-dispatch`.
+ */
+export async function autoDispatch(opts, fn) {
+    if (opts.authContext) {
+        return withUserContext({
+            userId: opts.authContext.userId,
+            tenantId: opts.authContext.tenantId,
+            sourceIp: opts.authContext.sourceIp,
+        }, fn);
+    }
+    if (opts.tenantId !== undefined) {
+        return withSystemContext({ tenantId: opts.tenantId }, fn);
+    }
+    throw new MissingTenantContext();
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,kEAAkE;AAClE,YAAY;AAEZ,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAEL,oBAAoB,EAGpB,qBAAqB,GAEtB,MAAM,SAAS,CAAC;AAEjB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAqB,EACrB,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB,EACvB,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,EAA4B;IAE5B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,eAAe,CACpB;YACE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM;YAC/B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;SACpC,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,oBAAoB,EAAE,CAAC;AACnC,CAAC"}

package/dist/drizzle-client.d.ts

@@ -0,0 +1,22 @@
+import { type NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { SystemContextOpts, UserContextOpts } from "./types";
+type DrizzleClient<TSchema extends Record<string, unknown> = Record<string, unknown>> = NodePgDatabase<TSchema>;
+/**
+ * withUserContext (Drizzle variant) — opens a tx on the `authenticated`
+ * pool, sets `app.user_id` + `app.tenant_id` via `auth.init(...)` (the
+ * canonical helper from § 5.7), yields a Drizzle client bound to the tx,
+ * commits/rolls back.
+ */
+export declare function withUserContextDb<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(opts: UserContextOpts, fn: (db: DrizzleClient<TSchema>) => Promise<T>): Promise<T>;
+/**
+ * withSystemContext (Drizzle variant) — opens a tx on the `services` pool
+ * with `app.tenant_id` GUC bound; yields a Drizzle client.
+ */
+export declare function withSystemContextDb<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(opts: SystemContextOpts, fn: (db: DrizzleClient<TSchema>) => Promise<T>): Promise<T>;
+/**
+ * withOwnerContext (Drizzle variant) — opens a tx on the `owner`
+ * (BYPASSRLS) pool; no GUCs. Migrations only per § 5.3 + Q3.
+ */
+export declare function withOwnerContextDb<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(fn: (db: DrizzleClient<TSchema>) => Promise<T>): Promise<T>;
+export type { DrizzleClient, NodePgDatabase };
+//# sourceMappingURL=drizzle-client.d.ts.map

package/dist/drizzle-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle-client.d.ts","sourceRoot":"","sources":["../src/drizzle-client.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAKzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAOlE,KAAK,aAAa,CAChB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAC/D,cAAc,CAAC,OAAO,CAAC,CAAC;AAmD5B;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAO5D;AAED,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC"}

package/dist/drizzle-client.js

@@ -0,0 +1,109 @@
+// Real Drizzle client integration per § 5.8 + R1 § 4.
+//
+// withUserContext / withSystemContext / withOwnerContext return a usable
+// Drizzle client bound to the transaction. The consumer uses it exactly
+// as they would Drizzle's `drizzle(pool)` output — same methods,
+// same chaining, same query builder — but every statement runs through
+// the BEGIN/set_config/COMMIT lifecycle on the right pool.
+//
+// Compatibility:
+//   - We import `drizzle` from `drizzle-orm/node-postgres` (which targets
+//     the `pg` driver) — this is what every adopter uses today (saga,
+//     audit-chain, dsar).
+//   - The returned client is a `NodePgDatabase<any>` so consumers can
+//     pass their schema typing through.
+//   - We expose `withUserContextDb` / `withSystemContextDb` /
+//     `withOwnerContextDb` variants that emit the Drizzle client. The
+//     original `withUserContext` (in src/context.ts) still works for
+//     services using the raw `PgTx` surface.
+import { drizzle } from "drizzle-orm/node-postgres";
+import { requirePool } from "./init";
+import { PgClientPool } from "./pg-pool-adapter";
+import { MissingTenantContext, TransactionRolledBack } from "./types";
+function clientFor(_pool) {
+    // Only PgClientPool exposes a real pg PoolClient. In-memory pools don't.
+    // The caller is responsible for using *Db helpers only against real pools.
+    return null;
+}
+// (unused — keeps the symbol referenced; trimmed by tree-shake)
+void clientFor;
+async function withRealTx(pool, setup, fn) {
+    const acquireStart = Date.now();
+    const client = await pool.rawPool.connect();
+    void acquireStart;
+    try {
+        await client.query("BEGIN");
+        try {
+            await setup(client);
+            const db = drizzle(client);
+            const out = await fn(db, client);
+            await client.query("COMMIT");
+            return out;
+        }
+        catch (err) {
+            try {
+                await client.query("ROLLBACK");
+            }
+            catch {
+                /* swallow */
+            }
+            throw new TransactionRolledBack(err);
+        }
+    }
+    finally {
+        client.release();
+    }
+}
+function requireRealPool(kind) {
+    const pool = requirePool(kind);
+    if (!(pool instanceof PgClientPool)) {
+        throw new Error(`db-rls: ${kind} pool is not a PgClientPool — Drizzle helpers require a real pg-backed pool. Did you wire an InMemoryPgPool by mistake?`);
+    }
+    return pool;
+}
+/**
+ * withUserContext (Drizzle variant) — opens a tx on the `authenticated`
+ * pool, sets `app.user_id` + `app.tenant_id` via `auth.init(...)` (the
+ * canonical helper from § 5.7), yields a Drizzle client bound to the tx,
+ * commits/rolls back.
+ */
+export async function withUserContextDb(opts, fn) {
+    if (!opts.userId)
+        throw new MissingTenantContext();
+    if (!opts.tenantId)
+        throw new MissingTenantContext();
+    const pool = requireRealPool("authenticated");
+    return withRealTx(pool, async (client) => {
+        // Set both GUCs via the canonical auth.init helper.
+        await client.query("SELECT auth.init($1::uuid, $2::uuid)", [
+            opts.userId,
+            opts.tenantId,
+        ]);
+        if (opts.sourceIp !== undefined) {
+            await client.query("SELECT set_config('app.source_ip', $1, true)", [
+                opts.sourceIp,
+            ]);
+        }
+    }, (db) => fn(db));
+}
+/**
+ * withSystemContext (Drizzle variant) — opens a tx on the `services` pool
+ * with `app.tenant_id` GUC bound; yields a Drizzle client.
+ */
+export async function withSystemContextDb(opts, fn) {
+    if (!opts.tenantId)
+        throw new MissingTenantContext();
+    const pool = requireRealPool("services");
+    return withRealTx(pool, async (client) => {
+        await client.query("SELECT auth.init_tenant($1::uuid)", [opts.tenantId]);
+    }, (db) => fn(db));
+}
+/**
+ * withOwnerContext (Drizzle variant) — opens a tx on the `owner`
+ * (BYPASSRLS) pool; no GUCs. Migrations only per § 5.3 + Q3.
+ */
+export async function withOwnerContextDb(fn) {
+    const pool = requireRealPool("owner");
+    return withRealTx(pool, async () => { }, (db) => fn(db));
+}
+//# sourceMappingURL=drizzle-client.js.map

package/dist/drizzle-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle-client.js","sourceRoot":"","sources":["../src/drizzle-client.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,iEAAiE;AACjE,uEAAuE;AACvE,2DAA2D;AAC3D,EAAE;AACF,iBAAiB;AACjB,0EAA0E;AAC1E,sEAAsE;AACtE,0BAA0B;AAC1B,sEAAsE;AACtE,wCAAwC;AACxC,8DAA8D;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,6CAA6C;AAE7C,OAAO,EAAE,OAAO,EAAuB,MAAM,2BAA2B,CAAC;AAGzE,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAUtE,SAAS,SAAS,CAAC,KAAqC;IACtD,yEAAyE;IACzE,2EAA2E;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AACD,gEAAgE;AAChE,KAAK,SAAS,CAAC;AAEf,KAAK,UAAU,UAAU,CACvB,IAAkB,EAClB,KAA4C,EAC5C,EAAkE;IAElE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,KAAK,YAAY,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAA2B,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,IAA4C;IAE5C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,YAAY,YAAY,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,yHAAyH,CACzI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAIrC,IAAqB,EACrB,EAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAC9C,OAAO,UAAU,CACf,IAAI,EACJ,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,oDAAoD;QACpD,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;YACzD,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,QAAQ;SACd,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACjE,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EACD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAIvC,IAAuB,EACvB,EAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,UAAU,CACf,IAAI,EACJ,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC,EACD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAGtC,EAA8C;IAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,UAAU,CACf,IAAI,EACJ,KAAK,IAAI,EAAE,GAAE,CAAC,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACf,CAAC;AACJ,CAAC"}

package/dist/in-memory-pool.d.ts

@@ -0,0 +1,31 @@
+import type { PgPool, PgTx, PoolKind } from "./types";
+/** One transcript entry — either a set_config or a raw exec. */
+export type TranscriptEntry = {
+    kind: "begin";
+    pool: PoolKind;
+} | {
+    kind: "set_config";
+    pool: PoolKind;
+    key: string;
+    value: string;
+} | {
+    kind: "exec";
+    pool: PoolKind;
+    sql: string;
+    params: readonly unknown[];
+} | {
+    kind: "commit";
+    pool: PoolKind;
+} | {
+    kind: "rollback";
+    pool: PoolKind;
+};
+/** In-memory PgPool. Each instance owns its own transcript so tests can
+ *  inspect what each pool was asked to do. */
+export declare class InMemoryPgPool implements PgPool {
+    readonly kind: PoolKind;
+    readonly transcript: TranscriptEntry[];
+    constructor(kind: PoolKind);
+    withTransaction<T>(fn: (tx: PgTx) => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=in-memory-pool.d.ts.map

package/dist/in-memory-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-pool.d.ts","sourceRoot":"","sources":["../src/in-memory-pool.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEtD,gEAAgE;AAChE,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEzC;8CAC8C;AAC9C,qBAAa,cAAe,YAAW,MAAM;IAC3C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,eAAe,EAAE,CAAM;gBAEhC,IAAI,EAAE,QAAQ;IAIpB,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAYnE"}