@nodii/db-rls 0.10.0 → 0.12.0

package/dist/auth-schema.d.ts

@@ -5,6 +5,125 @@ import type { Pool, PoolClient } from "pg";
  * / Go ports (asserted by the parity-fence CI).
  */
 export declare const AUTH_SCHEMA_SQL = "CREATE SCHEMA IF NOT EXISTS auth;\n\nCREATE OR REPLACE FUNCTION auth.set_user_id(p_user_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.user_id', p_user_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.set_tenant_id(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.init(p_user_id uuid, p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$\n  SELECT set_config('app.user_id', p_user_id::text, true);\n  SELECT set_config('app.tenant_id', p_tenant_id::text, true);\n$$;\n\nCREATE OR REPLACE FUNCTION auth.init_tenant(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.get_user_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.user_id', true), '')::uuid $$;\n\nCREATE OR REPLACE FUNCTION auth.get_tenant_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true), '')::uuid $$;\n\n-- Stub variant. Replaced in-place by migrate-gen's 0001_user_tenant_ids.sql\n-- once the service has employees_mirror + customers_mirror tables.\nCREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid\nLANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;\n";
+/**
+ * `auth.session_tenant_ids()` — THE authenticated-pool resolver.
+ *
+ * Returns AT MOST ONE tenant: the one bound to `app.tenant_id`, and only if the
+ * principal in `app.user_id` genuinely holds it per `auth.user_tenant_ids`.
+ * Edge-signed session tenant **INTERSECT** server-resolved membership.
+ *
+ * WHY THIS EXISTS. The `authenticated` predicate used to be
+ * `tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id()))` — the UNION
+ * of every tenant the user belongs to, with no tenant fence at all. A session
+ * opened for a user with memberships in tenants A and B could read AND write
+ * both. Reproduced end-to-end: a legitimate tenant-A session transitioned a
+ * tenant-B approval task, got HTTP 200, and released a 250,000 INR refund.
+ *
+ * WHY SUBSTITUTION RATHER THAN APPENDING A FENCE. The obvious repair is to
+ * append `AND tenant_id = auth.get_tenant_id()` at the top level of each
+ * policy. That breaks every policy whose shape is not a bare tenant equality,
+ * and the fleet is full of them:
+ *
+ *   - tables with NO `tenant_id` column that reach it through a nested
+ *     `EXISTS` or a sub-`SELECT` (`tenant_role_permissions`, `fx_rate_cache`)
+ *   - platform-default escape hatches — `tenant_id IS NULL OR tenant_id IN (…)`
+ *     (hr's statutory masters, `pricing_snapshots`)
+ *   - additive ORs on a differently-named column — `is_public_listing = TRUE OR
+ *     developer_tenant_id IN (…)` (`oauth_apps` marketplace listings)
+ *   - policies fencing on a column that is not `tenant_id` at all (`tenants.id`,
+ *     `legal_documents.scope`, `impersonation_sessions.target_tenant_id`)
+ *   - TEXT-vs-uuid casts that need fixing in opposite directions per table
+ *
+ * Swapping the resolver INSIDE the subquery leaves the column, the cast and the
+ * surrounding OR untouched, so all of those keep working while the set the
+ * subquery yields narrows from "every tenant you belong to" to "the one you are
+ * logged into, if you really belong to it". One substitution, zero shape
+ * changes, and NO `AS RESTRICTIVE` (which would AND against the additive
+ * permissive master policies and kill every platform-default row).
+ *
+ * `user_tenant_ids` is deliberately LEFT INTACT. It still answers the honest
+ * question "which tenants does this user belong to", which a tenant-switcher or
+ * a login tenant-picker legitimately needs. Overloading it with session scope
+ * would have silently broken those callers with no error and no test coverage.
+ *
+ * SECURITY DEFINER is required, not decorative:
+ *   - `authenticated` has no privilege on the membership mirror, so an INVOKER
+ *     function raises `permission denied for table user_memberships`;
+ *   - if the mirror is itself RLS-policied, an INVOKER function re-enters its
+ *     own policy and dies with `stack depth limit exceeded` (54001).
+ *
+ * FAIL-CLOSED SPLIT, deliberate:
+ *   - GUCs unset  → RAISE 42501. Misconfiguration is LOUD. An unbound session
+ *     silently yielding an empty grid reads to a human as "there is no data
+ *     here", which is how a broken session survives a week of QA.
+ *   - bound, but no membership → EMPTY SET, no error. A legitimate non-member
+ *     seeing nothing is not an error condition, and platform-default rows
+ *     reached through a sibling `OR` must still resolve.
+ */
+export declare const SESSION_TENANT_IDS_SQL = "CREATE OR REPLACE FUNCTION auth.session_tenant_ids() RETURNS SETOF uuid\nLANGUAGE plpgsql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public, pg_temp\nAS $session$\nDECLARE\n  v_user uuid;\n  v_tenant uuid;\nBEGIN\n  v_user := nullif(current_setting('app.user_id', true), '')::uuid;\n  v_tenant := nullif(current_setting('app.tenant_id', true), '')::uuid;\n  IF v_user IS NULL THEN\n    RAISE EXCEPTION 'db_rls_session_user_missing: app.user_id is not bound on this connection'\n      USING ERRCODE = '42501',\n            HINT = 'The authenticated pool is the user-session pool; a session with no principal cannot be membership-checked. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';\n  END IF;\n  IF v_tenant IS NULL THEN\n    RAISE EXCEPTION 'db_rls_session_tenant_missing: app.tenant_id is not bound on this connection'\n      USING ERRCODE = '42501',\n            HINT = 'Every authenticated-pool session must be EXPLICITLY tenant-scoped. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';\n  END IF;\n  RETURN QUERY SELECT v_tenant WHERE v_tenant IN (SELECT auth.user_tenant_ids(v_user));\nEND\n$session$;\n";
+/**
+ * Marker embedded in the DEGRADED body so `pg_proc.prosrc` introspection can
+ * tell the two variants apart. {@link verifyTenantFence} reports any database
+ * running the degraded resolver — the point is that a service is never on it by
+ * accident.
+ */
+export declare const SESSION_TENANT_IDS_DEGRADED_MARKER = "DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR";
+/**
+ * DEGRADED variant of {@link SESSION_TENANT_IDS_SQL} — fence ONLY, no
+ * membership intersect.
+ *
+ * FOR SERVICES THAT SHIP NO MEMBERSHIP MIRROR, AND NOTHING ELSE. Such a service
+ * has `auth.user_tenant_ids` as the bootstrap stub (`SELECT NULL::uuid WHERE
+ * false`), so the strict resolver intersects to the empty set and the entire
+ * authenticated pool becomes silently deny-all — the P0 shape of drift
+ * 199feabc, where crm's 430 policies were dead and nobody noticed.
+ *
+ * THE LIST BELOW IS DERIVED FROM THE REPOS, NOT FROM MEMORY. An earlier
+ * revision of this comment asserted "nodii-crm-service alone", which was wrong
+ * by six services and wrong about crm's urgency. Several repos ship a phase-004
+ * or phase-005 `0002_create_rls_helpers.sql` whose real `user_tenant_ids` is
+ * FULLY COMMENTED OUT, so the phase-002 stub is still the winner:
+ *
+ *   STUB + a LIVE authenticated pool  → deny-all TODAY, needs this variant:
+ *     - nodii-billing-service   77 call sites; saga + dsar migrations run at
+ *                               BOOT (`src/lib/bootstrap.ts`), so its
+ *                               `saga_outbox` / `lifecycle_requests` /
+ *                               `data_residency_holds` are library-owned. The
+ *                               money path. Highest risk in the fleet.
+ *     - nodii-finance-service   14 call sites. Already self-mitigates via
+ *                               `010-lib-auth-pool-mode`, which rewrites the
+ *                               lib policies to `= auth.get_tenant_id()`.
+ *     - nodii-notification-service  3 call sites. Its own policies use
+ *                               `= auth.get_tenant_id()` and keep working, so
+ *                               only the library-owned tables go dark — which
+ *                               is exactly the shape nobody notices.
+ *
+ *   STUB + a pool that is built but has ZERO handler call sites → not broken
+ *   today, breaks the moment a handler uses it:
+ *     - nodii-crm-service, nodii-kyc-service, nodii-ticketing-service,
+ *       nodii-product-service
+ *
+ *   Does NOT need it: nodii-geo-service (no authenticated pool at all —
+ *   2-pool), nodii-edge (no `user_tenant_ids`, RLS mode `single`),
+ *   nodii-customer-service and nodii-vendor-service (already GUC-bodied),
+ *   nodii-auth / nodii-hr-service / nodii-task-tracking / nodii-tenant-service
+ *   (REAL membership helpers).
+ *
+ * WHAT YOU GIVE UP. The database stops verifying the principal. Isolation rests
+ * entirely on the application binding `app.tenant_id` correctly — RLS degrades
+ * from an independent second layer into "the app said so". A forged or simply
+ * mistaken tenant binding becomes access. That is a real reduction in
+ * defence-in-depth and it is why this is a separate, named, reported constant
+ * rather than a boolean flag on the strict one.
+ *
+ * THE EXIT. Land a membership mirror, point `auth.user_tenant_ids` at it, then
+ * apply {@link SESSION_TENANT_IDS_SQL} over this. No policy changes — the
+ * predicate at every call site is identical for both variants.
+ */
+export declare const SESSION_TENANT_IDS_DEGRADED_SQL = "CREATE OR REPLACE FUNCTION auth.session_tenant_ids() RETURNS SETOF uuid\nLANGUAGE plpgsql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public, pg_temp\nAS $session$\nDECLARE\n  v_tenant uuid;\nBEGIN\n  -- DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR: no membership mirror in this service,\n  -- so the session tenant is accepted WITHOUT proving the principal holds it.\n  -- Replace with the strict resolver as soon as a mirror exists.\n  IF nullif(current_setting('app.user_id', true), '') IS NULL THEN\n    RAISE EXCEPTION 'db_rls_session_user_missing: app.user_id is not bound on this connection'\n      USING ERRCODE = '42501',\n            HINT = 'Open the session with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';\n  END IF;\n  v_tenant := nullif(current_setting('app.tenant_id', true), '')::uuid;\n  IF v_tenant IS NULL THEN\n    RAISE EXCEPTION 'db_rls_session_tenant_missing: app.tenant_id is not bound on this connection'\n      USING ERRCODE = '42501',\n            HINT = 'Every authenticated-pool session must be EXPLICITLY tenant-scoped. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';\n  END IF;\n  RETURN QUERY SELECT v_tenant;\nEND\n$session$;\n";
+/** Grant for the resolver. Separate from {@link AUTH_SCHEMA_GRANTS_SQL} for the
+ *  same reason: the roles must exist before the GRANT runs. */
+export declare const SESSION_TENANT_IDS_GRANTS_SQL = "GRANT EXECUTE ON FUNCTION auth.session_tenant_ids() TO nodii_services, authenticated;\n";
 /**
  * Grants for the 7 helper functions. Emitted separately because they
  * reference roles that must exist before the GRANT runs — applied last
@@ -33,6 +152,7 @@ type AnyExecutor = Pool | PoolClient | SqlExecutor;
  */
 export declare function applyAuthSchemaMigrations(client: AnyExecutor, opts?: {
     includeGrants?: boolean;
+    degradedSessionResolver?: boolean;
 }): Promise<void>;
 /**
  * Composite full DDL — the schema + helpers + grants, joined.

package/dist/auth-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,eAAe,s1CA2B3B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,8oBAQlC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,KAAK,WAAW,GAAG,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,MAAM,CAKR"}
+{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,eAAe,s1CA2B3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,eAAO,MAAM,sBAAsB,iqCAuBlC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,yCACP,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,eAAO,MAAM,+BAA+B,isCAwB3C,CAAC;AAEF;+DAC+D;AAC/D,eAAO,MAAM,6BAA6B,4FACzC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,8oBAQlC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,KAAK,WAAW,GAAG,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,MAAM,CAKR"}

package/dist/auth-schema.js

@@ -52,6 +52,173 @@ LANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true),
 CREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid
 LANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;
 `;
+/**
+ * `auth.session_tenant_ids()` — THE authenticated-pool resolver.
+ *
+ * Returns AT MOST ONE tenant: the one bound to `app.tenant_id`, and only if the
+ * principal in `app.user_id` genuinely holds it per `auth.user_tenant_ids`.
+ * Edge-signed session tenant **INTERSECT** server-resolved membership.
+ *
+ * WHY THIS EXISTS. The `authenticated` predicate used to be
+ * `tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id()))` — the UNION
+ * of every tenant the user belongs to, with no tenant fence at all. A session
+ * opened for a user with memberships in tenants A and B could read AND write
+ * both. Reproduced end-to-end: a legitimate tenant-A session transitioned a
+ * tenant-B approval task, got HTTP 200, and released a 250,000 INR refund.
+ *
+ * WHY SUBSTITUTION RATHER THAN APPENDING A FENCE. The obvious repair is to
+ * append `AND tenant_id = auth.get_tenant_id()` at the top level of each
+ * policy. That breaks every policy whose shape is not a bare tenant equality,
+ * and the fleet is full of them:
+ *
+ *   - tables with NO `tenant_id` column that reach it through a nested
+ *     `EXISTS` or a sub-`SELECT` (`tenant_role_permissions`, `fx_rate_cache`)
+ *   - platform-default escape hatches — `tenant_id IS NULL OR tenant_id IN (…)`
+ *     (hr's statutory masters, `pricing_snapshots`)
+ *   - additive ORs on a differently-named column — `is_public_listing = TRUE OR
+ *     developer_tenant_id IN (…)` (`oauth_apps` marketplace listings)
+ *   - policies fencing on a column that is not `tenant_id` at all (`tenants.id`,
+ *     `legal_documents.scope`, `impersonation_sessions.target_tenant_id`)
+ *   - TEXT-vs-uuid casts that need fixing in opposite directions per table
+ *
+ * Swapping the resolver INSIDE the subquery leaves the column, the cast and the
+ * surrounding OR untouched, so all of those keep working while the set the
+ * subquery yields narrows from "every tenant you belong to" to "the one you are
+ * logged into, if you really belong to it". One substitution, zero shape
+ * changes, and NO `AS RESTRICTIVE` (which would AND against the additive
+ * permissive master policies and kill every platform-default row).
+ *
+ * `user_tenant_ids` is deliberately LEFT INTACT. It still answers the honest
+ * question "which tenants does this user belong to", which a tenant-switcher or
+ * a login tenant-picker legitimately needs. Overloading it with session scope
+ * would have silently broken those callers with no error and no test coverage.
+ *
+ * SECURITY DEFINER is required, not decorative:
+ *   - `authenticated` has no privilege on the membership mirror, so an INVOKER
+ *     function raises `permission denied for table user_memberships`;
+ *   - if the mirror is itself RLS-policied, an INVOKER function re-enters its
+ *     own policy and dies with `stack depth limit exceeded` (54001).
+ *
+ * FAIL-CLOSED SPLIT, deliberate:
+ *   - GUCs unset  → RAISE 42501. Misconfiguration is LOUD. An unbound session
+ *     silently yielding an empty grid reads to a human as "there is no data
+ *     here", which is how a broken session survives a week of QA.
+ *   - bound, but no membership → EMPTY SET, no error. A legitimate non-member
+ *     seeing nothing is not an error condition, and platform-default rows
+ *     reached through a sibling `OR` must still resolve.
+ */
+export const SESSION_TENANT_IDS_SQL = `CREATE OR REPLACE FUNCTION auth.session_tenant_ids() RETURNS SETOF uuid
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = pg_catalog, public, pg_temp
+AS $session$
+DECLARE
+  v_user uuid;
+  v_tenant uuid;
+BEGIN
+  v_user := nullif(current_setting('app.user_id', true), '')::uuid;
+  v_tenant := nullif(current_setting('app.tenant_id', true), '')::uuid;
+  IF v_user IS NULL THEN
+    RAISE EXCEPTION 'db_rls_session_user_missing: app.user_id is not bound on this connection'
+      USING ERRCODE = '42501',
+            HINT = 'The authenticated pool is the user-session pool; a session with no principal cannot be membership-checked. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';
+  END IF;
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'db_rls_session_tenant_missing: app.tenant_id is not bound on this connection'
+      USING ERRCODE = '42501',
+            HINT = 'Every authenticated-pool session must be EXPLICITLY tenant-scoped. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';
+  END IF;
+  RETURN QUERY SELECT v_tenant WHERE v_tenant IN (SELECT auth.user_tenant_ids(v_user));
+END
+$session$;
+`;
+/**
+ * Marker embedded in the DEGRADED body so `pg_proc.prosrc` introspection can
+ * tell the two variants apart. {@link verifyTenantFence} reports any database
+ * running the degraded resolver — the point is that a service is never on it by
+ * accident.
+ */
+export const SESSION_TENANT_IDS_DEGRADED_MARKER = "DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR";
+/**
+ * DEGRADED variant of {@link SESSION_TENANT_IDS_SQL} — fence ONLY, no
+ * membership intersect.
+ *
+ * FOR SERVICES THAT SHIP NO MEMBERSHIP MIRROR, AND NOTHING ELSE. Such a service
+ * has `auth.user_tenant_ids` as the bootstrap stub (`SELECT NULL::uuid WHERE
+ * false`), so the strict resolver intersects to the empty set and the entire
+ * authenticated pool becomes silently deny-all — the P0 shape of drift
+ * 199feabc, where crm's 430 policies were dead and nobody noticed.
+ *
+ * THE LIST BELOW IS DERIVED FROM THE REPOS, NOT FROM MEMORY. An earlier
+ * revision of this comment asserted "nodii-crm-service alone", which was wrong
+ * by six services and wrong about crm's urgency. Several repos ship a phase-004
+ * or phase-005 `0002_create_rls_helpers.sql` whose real `user_tenant_ids` is
+ * FULLY COMMENTED OUT, so the phase-002 stub is still the winner:
+ *
+ *   STUB + a LIVE authenticated pool  → deny-all TODAY, needs this variant:
+ *     - nodii-billing-service   77 call sites; saga + dsar migrations run at
+ *                               BOOT (`src/lib/bootstrap.ts`), so its
+ *                               `saga_outbox` / `lifecycle_requests` /
+ *                               `data_residency_holds` are library-owned. The
+ *                               money path. Highest risk in the fleet.
+ *     - nodii-finance-service   14 call sites. Already self-mitigates via
+ *                               `010-lib-auth-pool-mode`, which rewrites the
+ *                               lib policies to `= auth.get_tenant_id()`.
+ *     - nodii-notification-service  3 call sites. Its own policies use
+ *                               `= auth.get_tenant_id()` and keep working, so
+ *                               only the library-owned tables go dark — which
+ *                               is exactly the shape nobody notices.
+ *
+ *   STUB + a pool that is built but has ZERO handler call sites → not broken
+ *   today, breaks the moment a handler uses it:
+ *     - nodii-crm-service, nodii-kyc-service, nodii-ticketing-service,
+ *       nodii-product-service
+ *
+ *   Does NOT need it: nodii-geo-service (no authenticated pool at all —
+ *   2-pool), nodii-edge (no `user_tenant_ids`, RLS mode `single`),
+ *   nodii-customer-service and nodii-vendor-service (already GUC-bodied),
+ *   nodii-auth / nodii-hr-service / nodii-task-tracking / nodii-tenant-service
+ *   (REAL membership helpers).
+ *
+ * WHAT YOU GIVE UP. The database stops verifying the principal. Isolation rests
+ * entirely on the application binding `app.tenant_id` correctly — RLS degrades
+ * from an independent second layer into "the app said so". A forged or simply
+ * mistaken tenant binding becomes access. That is a real reduction in
+ * defence-in-depth and it is why this is a separate, named, reported constant
+ * rather than a boolean flag on the strict one.
+ *
+ * THE EXIT. Land a membership mirror, point `auth.user_tenant_ids` at it, then
+ * apply {@link SESSION_TENANT_IDS_SQL} over this. No policy changes — the
+ * predicate at every call site is identical for both variants.
+ */
+export const SESSION_TENANT_IDS_DEGRADED_SQL = `CREATE OR REPLACE FUNCTION auth.session_tenant_ids() RETURNS SETOF uuid
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = pg_catalog, public, pg_temp
+AS $session$
+DECLARE
+  v_tenant uuid;
+BEGIN
+  -- ${SESSION_TENANT_IDS_DEGRADED_MARKER}: no membership mirror in this service,
+  -- so the session tenant is accepted WITHOUT proving the principal holds it.
+  -- Replace with the strict resolver as soon as a mirror exists.
+  IF nullif(current_setting('app.user_id', true), '') IS NULL THEN
+    RAISE EXCEPTION 'db_rls_session_user_missing: app.user_id is not bound on this connection'
+      USING ERRCODE = '42501',
+            HINT = 'Open the session with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';
+  END IF;
+  v_tenant := nullif(current_setting('app.tenant_id', true), '')::uuid;
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'db_rls_session_tenant_missing: app.tenant_id is not bound on this connection'
+      USING ERRCODE = '42501',
+            HINT = 'Every authenticated-pool session must be EXPLICITLY tenant-scoped. Open it with withUserContext({ userId, tenantId }, fn) from @nodii/db-rls.';
+  END IF;
+  RETURN QUERY SELECT v_tenant;
+END
+$session$;
+`;
+/** Grant for the resolver. Separate from {@link AUTH_SCHEMA_GRANTS_SQL} for the
+ *  same reason: the roles must exist before the GRANT runs. */
+export const SESSION_TENANT_IDS_GRANTS_SQL = `GRANT EXECUTE ON FUNCTION auth.session_tenant_ids() TO nodii_services, authenticated;
+`;
 /**
  * Grants for the 7 helper functions. Emitted separately because they
  * reference roles that must exist before the GRANT runs — applied last
@@ -84,8 +251,18 @@ export async function applyAuthSchemaMigrations(client, opts = {}) {
     // SqlExecutor`; cast to the minimal shape.
     const exec = client;
     await exec.query(AUTH_SCHEMA_SQL);
+    // The resolver is applied unconditionally alongside the seven. A database
+    // where the policies reference `auth.session_tenant_ids()` but the function is
+    // absent does not merely misbehave — Postgres validates the reference at
+    // CREATE POLICY time, so the migration itself fails with `function
+    // auth.session_tenant_ids() does not exist`. Installing both together makes
+    // that unreachable.
+    await exec.query(opts.degradedSessionResolver
+        ? SESSION_TENANT_IDS_DEGRADED_SQL
+        : SESSION_TENANT_IDS_SQL);
     if (includeGrants) {
         await exec.query(AUTH_SCHEMA_GRANTS_SQL);
+        await exec.query(SESSION_TENANT_IDS_GRANTS_SQL);
     }
 }
 /**

package/dist/auth-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,mEAAmE;AACnE,qBAAqB;AACrB,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,qEAAqE;AACrE,4FAA4F;AAC5F,8DAA8D;AAC9D,8DAA8D;AAC9D,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,oEAAoE;AAIpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;CAQrC,CAAC;AAYF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAmB,EACnB,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAqB,CAAC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,OAAO,aAAa;QAClB,CAAC,CAAC,GAAG,eAAe,KAAK,sBAAsB,EAAE;QACjD,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC"}
+{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,mEAAmE;AACnE,qBAAqB;AACrB,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,qEAAqE;AACrE,4FAA4F;AAC5F,8DAA8D;AAC9D,8DAA8D;AAC9D,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,oEAAoE;AAIpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuBrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,sCAAsC,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;;OAOxC,kCAAkC;;;;;;;;;;;;;;;;;CAiBxC,CAAC;AAEF;+DAC+D;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG;CAC5C,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;CAQrC,CAAC;AAYF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAmB,EACnB,OAAuE,EAAE;IAEzE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAqB,CAAC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAClC,0EAA0E;IAC1E,+EAA+E;IAC/E,yEAAyE;IACzE,mEAAmE;IACnE,4EAA4E;IAC5E,oBAAoB;IACpB,MAAM,IAAI,CAAC,KAAK,CACd,IAAI,CAAC,uBAAuB;QAC1B,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,sBAAsB,CAC3B,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,OAAO,aAAa;QAClB,CAAC,CAAC,GAAG,eAAe,KAAK,sBAAsB,EAAE;QACjD,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC"}

package/dist/context.d.ts

@@ -11,15 +11,33 @@ import { type AutoDispatchOpts, type PgTx, type PlatformOpsContextOpts, type Sys
  */
 export declare function withUserContext<T>(opts: UserContextOpts, fn: (tx: PgTx) => Promise<T>): Promise<T>;
 /**
- * withUserMembershipContext — the doctrine 08-rls §4 multi-membership
- * variant of `withUserContext`. Opens a tx on the `authenticated` pool and
- * sets ONLY `app.user_id` (no `app.tenant_id` pin), so the authenticated
- * predicate `tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id()))`
- * resolves across ALL of the user's tenant memberships. Use this for §4
- * multi-membership query paths (e.g. task-tracking); use `withUserContext`
- * when a single tenant must be pinned.
+ * @deprecated REMOVED — always throws {@link CrossTenantSessionRefused}.
+ *
+ * This helper opened an `authenticated`-pool transaction binding ONLY
+ * `app.user_id`, deliberately leaving `app.tenant_id` unset so that the old
+ * union predicate `tenant_id IN (SELECT auth.user_tenant_ids(...))` would
+ * resolve across EVERY tenant the principal was an active member of. Its own
+ * docblock named task-tracking as the use case.
+ *
+ * That is not a policy bug that the predicate fix cleans up incidentally — it
+ * is the MECHANISM of the incident, sitting in the library. Reproduced
+ * end-to-end: a legitimate tenant-A session transitioned a tenant-B approval
+ * task, got HTTP 200, and released a 250,000 INR refund. Rewriting predicates
+ * while leaving this callable would have changed nothing for any caller of it.
+ *
+ * Migrate to `withUserContext({ userId, tenantId }, fn)` — the same pool, with
+ * the tenant the request actually resolved to. If a caller genuinely needs to
+ * know which tenants a user belongs to (a tenant switcher, a login
+ * tenant-picker), query `auth.user_tenant_ids` directly from a services-pool
+ * context; that function is deliberately left intact and still answers exactly
+ * that question. What is no longer available is opening a DATA session that
+ * spans them.
+ *
+ * The symbol is retained rather than deleted so a JavaScript consumer (no
+ * typechecker) gets this explanation at runtime instead of
+ * `undefined is not a function`.
  */
-export declare function withUserMembershipContext<T>(opts: UserMembershipContextOpts, fn: (tx: PgTx) => Promise<T>): Promise<T>;
+export declare function withUserMembershipContext<T>(_opts: UserMembershipContextOpts, _fn: (tx: PgTx) => Promise<T>): Promise<T>;
 /**
  * withSystemContext — opens a tx on the `services` (nodii_services) pool,
  * sets `app.tenant_id` via tx-scoped `set_config`, yields the tx, commits

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,IAAI,EACT,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC/B,MAAM,YAAY,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,IAAI,EAAE,yBAAyB,EAC/B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,gBAAgB,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EACvD,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAYZ;AAMD,4DAA4D;AAC5D,wBAAgB,8CAA8C,IAAI,IAAI,CAErE;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAeZ"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,gBAAgB,EAGrB,KAAK,IAAI,EACT,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC/B,MAAM,YAAY,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAyBZ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5B,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,gBAAgB,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EACvD,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAYZ;AAMD,4DAA4D;AAC5D,wBAAgB,8CAA8C,IAAI,IAAI,CAErE;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAeZ"}

package/dist/context.js

@@ -7,7 +7,7 @@
 import { requirePool } from "./init.js";
 import { recordOwnerContextInvocation } from "./metrics.js";
 import { assertMigrateAllowed, } from "./migrate-guard.js";
-import { MissingTenantContext, TransactionRolledBack, } from "./types.js";
+import { CrossTenantSessionRefused, MissingTenantContext, TransactionRolledBack, } from "./types.js";
 /**
  * withUserContext — opens a tx on the `authenticated` pool, sets
  * `app.user_id` + `app.tenant_id` (+ optional `app.source_ip`) via
@@ -18,6 +18,13 @@ import { MissingTenantContext, TransactionRolledBack, } from "./types.js";
  * Wraps any error thrown by `fn` in `TransactionRolledBack`.
  */
 export async function withUserContext(opts, fn) {
+    // Reject a blank principal or tenant HERE rather than binding an empty GUC
+    // and letting `auth.session_tenant_ids()` raise 42501 on the first query.
+    // Both fail closed, but this one names the caller instead of a policy.
+    if (!opts?.userId)
+        throw new MissingTenantContext();
+    if (!opts?.tenantId)
+        throw new MissingTenantContext();
     const pool = requirePool("authenticated");
     return pool.withTransaction(async (tx) => {
         // Canonical GUC namespace is `app.*` (08-rls §2/§6): the generated
@@ -40,30 +47,34 @@ export async function withUserContext(opts, fn) {
     });
 }
 /**
- * withUserMembershipContext — the doctrine 08-rls §4 multi-membership
- * variant of `withUserContext`. Opens a tx on the `authenticated` pool and
- * sets ONLY `app.user_id` (no `app.tenant_id` pin), so the authenticated
- * predicate `tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id()))`
- * resolves across ALL of the user's tenant memberships. Use this for §4
- * multi-membership query paths (e.g. task-tracking); use `withUserContext`
- * when a single tenant must be pinned.
+ * @deprecated REMOVED — always throws {@link CrossTenantSessionRefused}.
+ *
+ * This helper opened an `authenticated`-pool transaction binding ONLY
+ * `app.user_id`, deliberately leaving `app.tenant_id` unset so that the old
+ * union predicate `tenant_id IN (SELECT auth.user_tenant_ids(...))` would
+ * resolve across EVERY tenant the principal was an active member of. Its own
+ * docblock named task-tracking as the use case.
+ *
+ * That is not a policy bug that the predicate fix cleans up incidentally — it
+ * is the MECHANISM of the incident, sitting in the library. Reproduced
+ * end-to-end: a legitimate tenant-A session transitioned a tenant-B approval
+ * task, got HTTP 200, and released a 250,000 INR refund. Rewriting predicates
+ * while leaving this callable would have changed nothing for any caller of it.
+ *
+ * Migrate to `withUserContext({ userId, tenantId }, fn)` — the same pool, with
+ * the tenant the request actually resolved to. If a caller genuinely needs to
+ * know which tenants a user belongs to (a tenant switcher, a login
+ * tenant-picker), query `auth.user_tenant_ids` directly from a services-pool
+ * context; that function is deliberately left intact and still answers exactly
+ * that question. What is no longer available is opening a DATA session that
+ * spans them.
+ *
+ * The symbol is retained rather than deleted so a JavaScript consumer (no
+ * typechecker) gets this explanation at runtime instead of
+ * `undefined is not a function`.
  */
-export async function withUserMembershipContext(opts, fn) {
-    const pool = requirePool("authenticated");
-    return pool.withTransaction(async (tx) => {
-        // ONLY app.user_id — leaving app.tenant_id unset is intentional: the §4
-        // predicate keys on user_tenant_ids(get_user_id()), not a pinned tenant.
-        await tx.setConfig("app.user_id", opts.userId);
-        if (opts.sourceIp !== undefined) {
-            await tx.setConfig("app.source_ip", opts.sourceIp);
-        }
-        try {
-            return await fn(tx);
-        }
-        catch (cause) {
-            throw new TransactionRolledBack(cause);
-        }
-    });
+export async function withUserMembershipContext(_opts, _fn) {
+    throw new CrossTenantSessionRefused("withUserMembershipContext");
 }
 /**
  * withSystemContext — opens a tx on the `services` (nodii_services) pool,

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,kEAAkE;AAClE,YAAY;AAEZ,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,oBAAoB,EAIpB,qBAAqB,GAGtB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAqB,EACrB,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,mEAAmE;QACnE,yEAAyE;QACzE,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA+B,EAC/B,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB,EACvB,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAuD,EACvD,OAAkC;IAElC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAuD,EACvD,OAAkC;IAElC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA4B,EAC5B,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,0CAA0C;AAC1C,IAAI,iCAAiC,GAAG,KAAK,CAAC;AAE9C,4DAA4D;AAC5D,MAAM,UAAU,8CAA8C;IAC5D,iCAAiC,GAAG,KAAK,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA4B,EAC5B,EAA4B;IAE5B,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACvC,iCAAiC,GAAG,IAAI,CAAC;QACzC,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,uDAAuD;YACrD,+DAA+D;YAC/D,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,EAA4B;IAE5B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,eAAe,CACpB;YACE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM;YAC/B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;SACpC,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,oBAAoB,EAAE,CAAC;AACnC,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,kEAAkE;AAClE,YAAY;AAEZ,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,yBAAyB,EACzB,oBAAoB,EAIpB,qBAAqB,GAGtB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAqB,EACrB,EAA4B;IAE5B,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACpD,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,mEAAmE;QACnE,yEAAyE;QACzE,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAgC,EAChC,GAA6B;IAE7B,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB,EACvB,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAuD,EACvD,OAAkC;IAElC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAuD,EACvD,OAAkC;IAElC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA4B,EAC5B,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,0CAA0C;AAC1C,IAAI,iCAAiC,GAAG,KAAK,CAAC;AAE9C,4DAA4D;AAC5D,MAAM,UAAU,8CAA8C;IAC5D,iCAAiC,GAAG,KAAK,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA4B,EAC5B,EAA4B;IAE5B,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACvC,iCAAiC,GAAG,IAAI,CAAC;QACzC,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,uDAAuD;YACrD,+DAA+D;YAC/D,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,EAA4B;IAE5B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,eAAe,CACpB;YACE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM;YAC/B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;SACpC,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,oBAAoB,EAAE,CAAC;AACnC,CAAC"}

package/dist/drizzle-client.d.ts

@@ -10,12 +10,24 @@ type DrizzleClient<TSchema extends Record<string, unknown> = Record<string, unkn
  */
 export declare function withUserContextDb<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(opts: UserContextOpts, fn: (db: DrizzleClient<TSchema>) => Promise<T>): Promise<T>;
 /**
- * withUserMembershipContextDb — the doctrine 08-rls §4 multi-membership
- * Drizzle variant. Sets ONLY `app.user_id` via the canonical
- * `auth.set_user_id(...)` helper (no `auth.init` tenant pin), so the
- * authenticated predicate spans all of the user's tenant memberships.
+ * @deprecated REMOVED — always throws {@link CrossTenantSessionRefused}.
+ *
+ * Opened an `authenticated`-pool transaction binding ONLY `app.user_id`,
+ * leaving `app.tenant_id` deliberately unset so the old union predicate
+ * resolved across EVERY tenant the principal belonged to. That is the
+ * mechanism of the cross-tenant approval incident, not a side effect of it:
+ * a legitimate tenant-A session transitioned a tenant-B approval task, got
+ * HTTP 200, and released a 250,000 INR refund.
+ *
+ * Migrate to `withUserContextDb({ userId, tenantId }, fn)`.
+ * To LIST a user's tenants (switcher / login picker), query
+ * `auth.user_tenant_ids` from a services-pool context — that function is
+ * intact; what is gone is opening a DATA session that spans them.
+ *
+ * Retained as a throwing stub rather than deleted so a JavaScript consumer
+ * gets this explanation instead of `undefined is not a function`.
  */
-export declare function withUserMembershipContextDb<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(opts: UserMembershipContextOpts, fn: (db: DrizzleClient<TSchema>) => Promise<T>): Promise<T>;
+export declare function withUserMembershipContextDb<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(_opts: UserMembershipContextOpts, _fn: (db: DrizzleClient<TSchema>) => Promise<T>): Promise<T>;
 /**
  * withSystemContext (Drizzle variant) — opens a tx on the `services` pool
  * with `app.tenant_id` GUC bound; yields a Drizzle client.

package/dist/drizzle-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drizzle-client.d.ts","sourceRoot":"","sources":["../src/drizzle-client.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAKzE,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAOpB,KAAK,aAAa,CAChB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAC/D,cAAc,CAAC,OAAO,CAAC,CAAC;AA2D5B;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,yBAAyB,EAC/B,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,QAAQ,EAAE,gBAAgB,GAAG,CAAC,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EACzE,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACnD,OAAO,CAAC,CAAC,CAAC,CAeZ;AAoBD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"drizzle-client.d.ts","sourceRoot":"","sources":["../src/drizzle-client.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAKzE,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAWpB,KAAK,aAAa,CAChB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAC/D,cAAc,CAAC,OAAO,CAAC,CAAC;AA2D5B;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,2BAA2B,CAC/C,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9C,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,QAAQ,EAAE,gBAAgB,GAAG,CAAC,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EACzE,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACnD,OAAO,CAAC,CAAC,CAAC,CAeZ;AAoBD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC"}

package/dist/drizzle-client.js

@@ -21,7 +21,7 @@ import { requirePool } from "./init.js";
 import { recordOwnerContextInvocation, withTxSpan } from "./metrics.js";
 import { assertMigrateAllowed, } from "./migrate-guard.js";
 import { PgClientPool } from "./pg-pool-adapter.js";
-import { MissingTenantContext, TransactionRolledBack } from "./types.js";
+import { CrossTenantSessionRefused, MissingTenantContext, TransactionRolledBack, } from "./types.js";
 function clientFor(_pool) {
     // Only PgClientPool exposes a real pg PoolClient. In-memory pools don't.
     // The caller is responsible for using *Db helpers only against real pools.
@@ -97,24 +97,25 @@ export async function withUserContextDb(opts, fn) {
     }, (db) => fn(db));
 }
 /**
- * withUserMembershipContextDb — the doctrine 08-rls §4 multi-membership
- * Drizzle variant. Sets ONLY `app.user_id` via the canonical
- * `auth.set_user_id(...)` helper (no `auth.init` tenant pin), so the
- * authenticated predicate spans all of the user's tenant memberships.
+ * @deprecated REMOVED — always throws {@link CrossTenantSessionRefused}.
+ *
+ * Opened an `authenticated`-pool transaction binding ONLY `app.user_id`,
+ * leaving `app.tenant_id` deliberately unset so the old union predicate
+ * resolved across EVERY tenant the principal belonged to. That is the
+ * mechanism of the cross-tenant approval incident, not a side effect of it:
+ * a legitimate tenant-A session transitioned a tenant-B approval task, got
+ * HTTP 200, and released a 250,000 INR refund.
+ *
+ * Migrate to `withUserContextDb({ userId, tenantId }, fn)`.
+ * To LIST a user's tenants (switcher / login picker), query
+ * `auth.user_tenant_ids` from a services-pool context — that function is
+ * intact; what is gone is opening a DATA session that spans them.
+ *
+ * Retained as a throwing stub rather than deleted so a JavaScript consumer
+ * gets this explanation instead of `undefined is not a function`.
  */
-export async function withUserMembershipContextDb(opts, fn) {
-    if (!opts.userId)
-        throw new MissingTenantContext();
-    const pool = requireRealPool("authenticated");
-    return withRealTx(pool, async (client) => {
-        // ONLY app.user_id — set_user_id, not init, so no tenant is pinned.
-        await client.query("SELECT auth.set_user_id($1::uuid)", [opts.userId]);
-        if (opts.sourceIp !== undefined) {
-            await client.query("SELECT set_config('app.source_ip', $1, true)", [
-                opts.sourceIp,
-            ]);
-        }
-    }, (db) => fn(db));
+export async function withUserMembershipContextDb(_opts, _fn) {
+    throw new CrossTenantSessionRefused("withUserMembershipContextDb");
 }
 /**
  * withSystemContext (Drizzle variant) — opens a tx on the `services` pool

package/dist/drizzle-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"drizzle-client.js","sourceRoot":"","sources":["../src/drizzle-client.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,iEAAiE;AACjE,uEAAuE;AACvE,2DAA2D;AAC3D,EAAE;AACF,iBAAiB;AACjB,0EAA0E;AAC1E,sEAAsE;AACtE,0BAA0B;AAC1B,sEAAsE;AACtE,wCAAwC;AACxC,8DAA8D;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,6CAA6C;AAE7C,OAAO,EAAE,OAAO,EAAuB,MAAM,2BAA2B,CAAC;AAGzE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAMpD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAUzE,SAAS,SAAS,CAAC,KAAqC;IACtD,yEAAyE;IACzE,2EAA2E;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AACD,gEAAgE;AAChE,KAAK,SAAS,CAAC;AAEf,KAAK,UAAU,UAAU,CACvB,IAAkB,EAClB,KAA4C,EAC5C,EAAkE;IAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,oEAAoE;QACpE,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,8EAA8E;QAC9E,0DAA0D;QAC1D,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YACtD,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAA2B,CAAC;gBACrD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,UAAU,CAAC,WAAW,CAAC,CAAC;gBACxB,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa;gBACf,CAAC;gBACD,UAAU,CAAC,aAAa,CAAC,CAAC;gBAC1B,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,IAA4C;IAE5C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,YAAY,YAAY,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,yHAAyH,CACzI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAIrC,IAAqB,EACrB,EAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAC9C,OAAO,UAAU,CACf,IAAI,EACJ,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,oDAAoD;QACpD,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;YACzD,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,QAAQ;SACd,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACjE,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EACD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACf,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAI/C,IAA+B,EAC/B,EAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAC9C,OAAO,UAAU,CACf,IAAI,EACJ,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,oEAAoE;QACpE,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACjE,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EACD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAIvC,IAAuB,EACvB,EAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,UAAU,CACf,IAAI,EACJ,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC,EACD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAItC,QAAyE,EACzE,OAAoD;IAEpD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,oBAAoB,CAAa,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,UAAU,CACf,IAAI,EACJ,KAAK,IAAI,EAAE,GAAE,CAAC,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACf,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAyE,EACzE,OAAoD;IAKpD,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"drizzle-client.js","sourceRoot":"","sources":["../src/drizzle-client.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,iEAAiE;AACjE,uEAAuE;AACvE,2DAA2D;AAC3D,EAAE;AACF,iBAAiB;AACjB,0EAA0E;AAC1E,sEAAsE;AACtE,0BAA0B;AAC1B,sEAAsE;AACtE,wCAAwC;AACxC,8DAA8D;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,6CAA6C;AAE7C,OAAO,EAAE,OAAO,EAAuB,MAAM,2BAA2B,CAAC;AAGzE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAMpD,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAUpB,SAAS,SAAS,CAAC,KAAqC;IACtD,yEAAyE;IACzE,2EAA2E;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AACD,gEAAgE;AAChE,KAAK,SAAS,CAAC;AAEf,KAAK,UAAU,UAAU,CACvB,IAAkB,EAClB,KAA4C,EAC5C,EAAkE;IAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,oEAAoE;QACpE,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,8EAA8E;QAC9E,0DAA0D;QAC1D,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YACtD,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAA2B,CAAC;gBACrD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,UAAU,CAAC,WAAW,CAAC,CAAC;gBACxB,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa;gBACf,CAAC;gBACD,UAAU,CAAC,aAAa,CAAC,CAAC;gBAC1B,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,IAA4C;IAE5C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,YAAY,YAAY,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,yHAAyH,CACzI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAIrC,IAAqB,EACrB,EAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAC9C,OAAO,UAAU,CACf,IAAI,EACJ,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,oDAAoD;QACpD,MAAM,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;YACzD,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,QAAQ;SACd,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACjE,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EACD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAI/C,KAAgC,EAChC,GAA+C;IAE/C,MAAM,IAAI,yBAAyB,CAAC,6BAA6B,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAIvC,IAAuB,EACvB,EAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,UAAU,CACf,IAAI,EACJ,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC,EACD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAItC,QAAyE,EACzE,OAAoD;IAEpD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,oBAAoB,CAAa,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,UAAU,CACf,IAAI,EACJ,KAAK,IAAI,EAAE,GAAE,CAAC,EACd,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACf,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAyE,EACzE,OAAoD;IAKpD,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC"}