@nodii/db-rls 0.10.0 → 0.12.0

package/dist/tenant-fence.js

@@ -0,0 +1,542 @@
+// verifyTenantFence — the catalog-time half of the guard.
+//
+// Fixing the generator fixes what the generator emits. The operator's
+// requirement is stronger: *"enforce that even if this shape regresses we DON'T
+// ALLOW ANYTHING CROSS-TENANT EVER"*. Three mechanisms cover three different
+// ways a regression arrives, and they are deliberately NOT the same mechanism:
+//
+//   1. GENERATION TIME — `authenticatedPredicate` is the single source of truth
+//      for every emitter (both string generators, the Drizzle builder, and the
+//      three libraries that inline a copy). One function to change, and the
+//      byte-equality tests in saga / dsar / audit-chain fail the moment a copy
+//      drifts from it.
+//
+//   2. SESSION TIME — `withUserMembershipContext` throws, and
+//      `auth.session_tenant_ids()` raises 42501 on an unbound session, so a
+//      tenant-less user session cannot quietly become either a union or a
+//      silently-empty grid.
+//
+//   3. CATALOG TIME — THIS MODULE. It reads what POSTGRES ACTUALLY STORED
+//      (`pg_policies.qual` / `.with_check`, already deparsed by the server) and
+//      refuses to let a deployment proceed unless every `authenticated` policy
+//      resolves through `auth.session_tenant_ids()`.
+//
+// (3) is the one a static source lint cannot reach, and that is the whole reason
+// it exists. A source rule sees the repository. It does not see:
+//   - a `CREATE POLICY` run by hand against prod during an incident;
+//   - a migration that landed from a branch the lint never ran on;
+//   - a policy that predates the lint and was never regenerated;
+//   - a hand-edited `0010_rls_policies.sql` whose header says "GENERATED";
+//   - a service still on an old @nodii/db-rls that emits the union;
+//   - a boot-time re-emitter (saga / dsar / audit-chain DROP+CREATE on EVERY
+//     boot) that reinstates its own copy after a correct migration ran.
+// The catalog sees all six, because the catalog is the thing that actually
+// decides who reads which row. A source lint and this verifier are complements:
+// the lint fails the PR, this fails the deploy.
+//
+// WHY THE ASSERTION IS POSITIVE.
+//
+// The tempting implementation is "find policies containing
+// `user_tenant_ids` without a fence, and fail if any remain" — an ABSENCE
+// assertion. It passes in a case it must not: a sweep (or a hand-edit, or a
+// regexp_replace repair) that mangles a policy into something which no longer
+// mentions `user_tenant_ids` AND is not correctly fenced either. Absence of the
+// bad string is not presence of the good one. So the rule here is inverted:
+// every policy granted to `authenticated` MUST resolve through
+// `auth.session_tenant_ids()`, or appear on an explicit, argued exemption list.
+// Anything else is an offender, including shapes nobody has thought of yet.
+//
+// Wire it into `db:setup` / `db:verify` next to `verifyRls`:
+//
+//     await verifyRls(pool, { requiredTables });
+//     await verifyTenantFence(pool);      // throws TenantFenceError, loud
+import { SESSION_TENANT_IDS_DEGRADED_MARKER } from "./auth-schema.js";
+import { DbRlsError } from "./types.js";
+/**
+ * Thrown by {@link verifyTenantFence}. Carries the structured offender list so
+ * a `db:setup` gate can render a precise failure — and so a caller can tell
+ * "this is a stale service that needs regenerating" apart from "someone
+ * hand-wrote a cross-tenant policy in prod".
+ */
+export class TenantFenceError extends DbRlsError {
+    offenders;
+    constructor(offenders) {
+        super(formatFenceMessage(offenders));
+        this.name = "TenantFenceError";
+        this.offenders = offenders;
+    }
+}
+const REASON_TEXT = {
+    cross_tenant_union: "consults auth.user_tenant_ids directly instead of auth.session_tenant_ids() — resolves across EVERY tenant the principal belongs to",
+    unfenced_permissive: "is permissive with no tenant reference at all — every tenant, every row",
+    not_resolved_through_session: "does not resolve through auth.session_tenant_ids() — it may be fenced some other way, but nothing here proves it, and an unrecognized shape is not a safe shape",
+    resolver_missing: "auth.session_tenant_ids() is not installed — apply SESSION_TENANT_IDS_SQL (applyAuthSchemaMigrations ships it)",
+    resolver_not_loud: "auth.session_tenant_ids() does not RAISE on an unbound session — it was replaced with a NULL-returning getter, which restores silent failure",
+    resolver_not_security_definer: "auth.session_tenant_ids() is not SECURITY DEFINER — it cannot read the membership mirror (permission denied), or will recurse into the mirror's own policy (54001)",
+    resolver_degraded: "the DEGRADED fence-only resolver is installed — the session tenant is trusted WITHOUT proving membership. Valid only for a service with no membership mirror; pass allowDegradedResolver to accept it deliberately",
+    membership_helper_is_stub: "auth.user_tenant_ids is still the bootstrap stub returning the empty set — the strict resolver intersects to nothing, so the authenticated pool is silently deny-all",
+    rls_disabled_on_tenant_table: "has a tenant_id column but ROW LEVEL SECURITY is NOT ENABLED — with the canonical blanket grants this table is readable and writable across EVERY tenant, and no policy is ever consulted. Fix: ALTER TABLE … ENABLE ROW LEVEL SECURITY and apply withRls()",
+    tenant_unscoped_unique_index: "is a UNIQUE index on a tenant-scoped table that omits the tenant column from its KEY — RLS filters visibility but does NOT partition uniqueness, so one tenant can collide with (or resolve onto) another tenant's row. Fix: make it UNIQUE (tenant_id, …)",
+    unprotected_relation: "exposes a tenant column but cannot enforce RLS — a materialized/foreign relation has no row policies at all, and a view without `security_invoker = true` runs as its OWNER and bypasses the underlying table's policies. Fix: CREATE VIEW … WITH (security_invoker = true), or revoke it from authenticated",
+};
+function formatFenceMessage(offenders) {
+    const lines = offenders.map((o) => `  - ${o.object} [${o.policy}${o.command === "-" ? "" : ` ${o.command}`}] ${REASON_TEXT[o.reason]}\n      ${o.expression ?? "(no expression)"}`);
+    return `tenant_fence: ${offenders.length} authenticated-pool policy/helper defect(s). A user session must reach exactly ONE tenant — the one the edge resolved from the request — and nothing else, ever.\n${lines.join("\n")}\nFix: regenerate policies with @nodii/db-rls withRls() / generateRlsPolicy(), which emit \`<col> IN (SELECT auth.session_tenant_ids())\`, and apply the resolver via applyAuthSchemaMigrations. Nodii-staff cross-tenant access is a different path entirely: the platform_ops pool + withPlatformOpsContext.`;
+}
+// Matching notes — the `auth.` prefix is OPTIONAL on purpose.
+//
+// `pg_policies.qual` is `pg_get_expr(...)`, and pg_get_expr omits a schema
+// qualifier for any function already reachable through the CALLER'S
+// search_path. So the identical policy deparses as
+//   `(tenant_id IN (SELECT auth.session_tenant_ids()))`  with search_path=public
+//   `(tenant_id IN (SELECT session_tenant_ids()))`       with `auth` on the path
+// A verifier that insisted on `auth.` would silently PASS every policy on every
+// service whose migration runner puts `auth` in its search_path — which is most
+// of them. A security check that quietly finds nothing is worse than no check,
+// because it is reported as a green.
+const RESOLVER_RE = /\b(?:auth\s*\.\s*)?session_tenant_ids\s*\(/i;
+const UNION_RE = /\b(?:auth\s*\.\s*)?user_tenant_ids\s*\(/i;
+/** Does this expression resolve through the session resolver? */
+export function resolvesThroughSession(expr) {
+    return expr !== null && RESOLVER_RE.test(expr);
+}
+/** Does this expression consult the raw membership union? */
+export function consultsMembershipUnion(expr) {
+    return expr !== null && UNION_RE.test(expr);
+}
+// (Role matching used to live here as a string compare over
+// `pg_policies.roles`. It is now resolved by the catalog in SQL — see the note
+// on the policy query in `verifyTenantFence`. A `{public}` policy applies to
+// authenticated without containing the word, and role membership is
+// transitive; neither fact is visible to a substring test.)
+function isExempt(row, exempt) {
+    if (!exempt || exempt.length === 0)
+        return false;
+    const qualified = `${row.tablename}.${row.policyname}`;
+    return exempt.includes(row.policyname) || exempt.includes(qualified);
+}
+/**
+ * Classify ONE authenticated policy. Exported so the test-suite can assert the
+ * classification directly without standing up every offending shape in the
+ * catalog, and so a caller can reuse the rule in a bespoke gate.
+ *
+ * The order matters: the two SPECIFIC diagnoses come first because they tell a
+ * reader what to do, and the general positive-rule failure is the fallback.
+ */
+export function classifyAuthPolicy(expr) {
+    if (resolvesThroughSession(expr))
+        return null;
+    if (consultsMembershipUnion(expr))
+        return "cross_tenant_union";
+    if (expr === null || expr.trim() === "" || /^\(?\s*true\s*\)?$/i.test(expr)) {
+        return "unfenced_permissive";
+    }
+    return "not_resolved_through_session";
+}
+/**
+ * Asserts that EVERY policy granted to `authenticated` resolves through
+ * `auth.session_tenant_ids()`, and that the resolver itself is installed, loud,
+ * and SECURITY DEFINER.
+ *
+ * @throws {TenantFenceError} listing every offender, with the deparsed
+ * expression straight from the catalog.
+ */
+export async function verifyTenantFence(querier, opts = {}) {
+    const schemas = opts.schema === undefined
+        ? ["public"]
+        : typeof opts.schema === "string"
+            ? [opts.schema]
+            : [...opts.schema];
+    const checkHelpers = opts.checkHelpers ?? true;
+    const offenders = [];
+    // ROLE RESOLUTION IS DONE IN SQL, AND IT IS NOT A STRING COMPARE.
+    //
+    // The first version of this read `pg_policies.roles::text` and skipped any
+    // policy whose text did not literally contain "authenticated". Three ways
+    // through that, each proven to yield a live cross-tenant read AND write while
+    // the verifier reported zero offenders:
+    //
+    //   1. `CREATE POLICY … FOR ALL USING (true)` with NO `TO` clause. Postgres
+    //      records `polroles = {0}` (PUBLIC), rendered `{public}`. It APPLIES to
+    //      authenticated and ORs with the fenced policy — permissive policies are
+    //      unioned — but the literal string is absent, so it was skipped. This is
+    //      item 1 on this module's own threat list: the hand-written hotfix.
+    //   2. Explicit `TO PUBLIC` — same thing, said out loud.
+    //   3. `TO app_reader`, where `authenticated` has been GRANTed app_reader.
+    //      Role membership is transitive; a string compare does not know that.
+    //
+    // `pg_has_role(role, role, 'USAGE')` is the authority Postgres itself uses,
+    // and OID 0 in `polroles` is the canonical spelling of PUBLIC. Both are
+    // resolved here rather than in TypeScript, because the catalog is the only
+    // thing that knows the role graph.
+    const { rows } = await querier.query(`SELECT n.nspname AS schemaname,
+            c.relname  AS tablename,
+            pol.polname AS policyname,
+            CASE pol.polcmd WHEN 'r' THEN 'SELECT' WHEN 'a' THEN 'INSERT'
+                            WHEN 'w' THEN 'UPDATE' WHEN 'd' THEN 'DELETE'
+                            ELSE 'ALL' END AS cmd,
+            pol.polpermissive AS permissive,
+            pg_get_expr(pol.polqual, pol.polrelid)      AS qual,
+            pg_get_expr(pol.polwithcheck, pol.polrelid) AS with_check,
+            (
+              -- PUBLIC (OID 0) applies to everyone. Otherwise ask Postgres
+              -- whether 'authenticated' IS or INHERITS the policy's role.
+              EXISTS (SELECT 1 FROM unnest(pol.polroles) r WHERE r = 0)
+              OR (
+                EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
+                AND EXISTS (
+                  SELECT 1 FROM unnest(pol.polroles) r
+                   WHERE pg_has_role('authenticated', r, 'USAGE')
+                )
+              )
+            ) AS applies_to_authenticated
+       FROM pg_policy pol
+       JOIN pg_class c ON c.oid = pol.polrelid
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE n.nspname = ANY($1::text[])
+      ORDER BY c.relname, pol.polname`, [schemas]);
+    const wanted = opts.tables?.map((t) => t.split(".").pop() ?? t);
+    for (const row of rows) {
+        if (!row.applies_to_authenticated)
+            continue;
+        // A RESTRICTIVE policy can only ever narrow access — it is ANDed, never
+        // ORed — so it cannot be the source of a cross-tenant grant and is not
+        // required to carry the fence itself.
+        if (row.permissive === false)
+            continue;
+        if (wanted && !wanted.includes(row.tablename))
+            continue;
+        if (isExempt(row, opts.exemptPolicies))
+            continue;
+        // A policy can carry USING, WITH CHECK, or both. EVERY clause present must
+        // resolve — a fenced read with an unfenced WITH CHECK is a cross-tenant
+        // WRITE, which is exactly what the refund incident exercised.
+        for (const expr of [row.qual, row.with_check]) {
+            if (expr === null)
+                continue;
+            const reason = classifyAuthPolicy(expr);
+            if (reason !== null) {
+                offenders.push({
+                    object: `${row.schemaname}.${row.tablename}`,
+                    policy: row.policyname,
+                    command: row.cmd,
+                    reason,
+                    expression: expr,
+                });
+            }
+        }
+        // A policy with NEITHER clause is permissive-everything.
+        if (row.qual === null && row.with_check === null) {
+            offenders.push({
+                object: `${row.schemaname}.${row.tablename}`,
+                policy: row.policyname,
+                command: row.cmd,
+                reason: "unfenced_permissive",
+                expression: null,
+            });
+        }
+    }
+    if (opts.checkTableCoverage ?? true) {
+        offenders.push(...(await checkTenantTableCoverage(querier, schemas, opts)));
+    }
+    if (opts.checkUniqueIndexes ?? true) {
+        offenders.push(...(await checkTenantUniqueIndexes(querier, schemas, opts)));
+    }
+    if (checkHelpers) {
+        offenders.push(...(await checkResolverHelpers(querier, opts.allowDegradedResolver)));
+    }
+    if (offenders.length > 0)
+        throw new TenantFenceError(offenders);
+}
+const RELKIND_LABEL = {
+    v: "VIEW",
+    m: "MATERIALIZED VIEW",
+    f: "FOREIGN TABLE",
+    p: "PARTITIONED TABLE",
+    r: "TABLE",
+};
+/** Default column names that mark a relation as tenant-scoped. `org_id` is in
+ *  the default set because `withRls`/`generateRlsPolicy` accept an arbitrary
+ *  `tenantColumn` and ship a test for `org_id` specifically — coverage keyed on
+ *  a single configured name exempted exactly the tables the library encourages
+ *  people to create. */
+const DEFAULT_TENANT_COLUMNS = ["tenant_id", "org_id", "organization_id"];
+/** Normalise a Postgres `text[]` that may arrive parsed or as `{a,b}`. */
+function toStringArray(v) {
+    if (Array.isArray(v))
+        return v;
+    if (typeof v !== "string")
+        return [];
+    return v
+        .replace(/^\{|\}$/g, "")
+        .split(",")
+        .map((x) => x.replace(/^"|"$/g, "").trim())
+        .filter(Boolean);
+}
+function tenantColumnNames(opts) {
+    const extra = opts.tenantColumn ? [opts.tenantColumn] : [];
+    const all = [...extra, ...(opts.tenantColumns ?? DEFAULT_TENANT_COLUMNS)];
+    return [...new Set(all)];
+}
+function tableExempt(row, exempt) {
+    if (!exempt || exempt.length === 0)
+        return false;
+    return (exempt.includes(row.tablename) ||
+        exempt.includes(`${row.schemaname}.${row.tablename}`));
+}
+/**
+ * THE TABLE-LEVEL POSITIVE ASSERTION.
+ *
+ * Discovers tenant-scoped tables FROM THE CATALOG — every table carrying a
+ * `tenant_id` column — rather than from a caller-supplied list, and requires
+ * each to have `relrowsecurity = true`.
+ *
+ * The discovery is the entire point, and it is why this does not simply reuse
+ * `verifyRls`. `verifyRls` takes `requiredTables`: the caller enumerates the
+ * tables that need RLS. But the failure being defended against is a migration
+ * that adds a tenant-scoped table and forgets to protect it — and an author who
+ * forgets `ENABLE ROW LEVEL SECURITY` in that migration is the same author who
+ * forgets to add the table to the list, in the same change. A hand-maintained
+ * list is blind to precisely the tables at risk, which is why `verifyRls` can
+ * sit in a repo, wired and green, while twelve unprotected tables accumulate
+ * behind it. Asking the catalog "which tables have a tenant column?" cannot be
+ * forgotten, because nobody has to remember anything.
+ *
+ * Tables WITHOUT a tenant column are deliberately not considered: a
+ * platform-global reference table is GRANT-controlled with no RLS by design
+ * (08-rls § 7.6), and flagging those would train everyone to pass
+ * `exemptTables` until the check means nothing.
+ */
+async function checkTenantTableCoverage(querier, schemas, opts) {
+    const tenantColumns = tenantColumnNames(opts);
+    // relkind: r = table, p = partitioned table, v = view, m = matview,
+    // f = foreign table. The original version filtered `relkind = 'r'`, which
+    // silently exempted the four kinds that CANNOT protect themselves — and a
+    // view over a tenant table is an ordinary migration artifact, not an exotic
+    // case. Partitioned parents were excluded too, despite being where the
+    // policies for an entire partition set are declared.
+    const { rows } = await querier.query(`SELECT n.nspname AS schemaname,
+            c.relname AS tablename,
+            c.relrowsecurity,
+            c.relkind::text AS relkind,
+            COALESCE(
+              (SELECT true FROM unnest(COALESCE(c.reloptions, '{}'))  o
+                WHERE lower(replace(o, ' ', '')) = 'security_invoker=true'),
+              false) AS security_invoker,
+            (SELECT a.attname FROM pg_attribute a
+              WHERE a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped
+                AND a.attname = ANY($2::text[]) LIMIT 1) AS tenant_column
+       FROM pg_class c
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relkind = ANY('{r,p,v,m,f}')
+        AND n.nspname = ANY($1::text[])
+        AND EXISTS (
+          SELECT 1 FROM pg_attribute a
+           WHERE a.attrelid = c.oid
+             AND a.attname = ANY($2::text[])
+             AND a.attnum > 0
+             AND NOT a.attisdropped
+        )
+      ORDER BY n.nspname, c.relname`, [schemas, tenantColumns]);
+    const wanted = opts.tables?.map((t) => t.split(".").pop() ?? t);
+    const out = [];
+    for (const row of rows) {
+        if (wanted && !wanted.includes(row.tablename))
+            continue;
+        if (tableExempt(row, opts.exemptTables))
+            continue;
+        const col = row.tenant_column ?? tenantColumns[0];
+        if (row.relkind === "v" || row.relkind === "m" || row.relkind === "f") {
+            // A view with security_invoker=true executes as the CALLER, so the
+            // underlying table's RLS applies and the view is genuinely safe.
+            if (row.relkind === "v" && row.security_invoker)
+                continue;
+            out.push({
+                object: `${row.schemaname}.${row.tablename}`,
+                policy: `(${RELKIND_LABEL[row.relkind] ?? row.relkind})`,
+                command: "-",
+                reason: "unprotected_relation",
+                expression: `${row.tablename} exposes ${col}; relkind=${row.relkind}${row.relkind === "v" ? ", security_invoker=false" : ", RLS is not supported on this relkind"}`,
+            });
+            continue;
+        }
+        if (row.relrowsecurity)
+            continue;
+        out.push({
+            object: `${row.schemaname}.${row.tablename}`,
+            policy: "(no policies — RLS is OFF)",
+            command: "-",
+            reason: "rls_disabled_on_tenant_table",
+            expression: `${row.tablename} has a ${col} column; relrowsecurity = false`,
+        });
+    }
+    return out;
+}
+/**
+ * Flags UNIQUE indexes on tenant-scoped tables whose KEY omits the tenant
+ * column.
+ *
+ * RLS decides which rows a session may SEE. It does not partition the
+ * uniqueness namespace, and the two are independent in a way that is easy to
+ * miss: a table can be flawlessly fenced and still let one tenant reach
+ * another's row through a unique key.
+ *
+ * The live exploit that motivated this: a queue table with a caller-supplied
+ * `dedupe_key` carrying `UNIQUE (dedupe_key)` rather than
+ * `UNIQUE (tenant_id, dedupe_key)`. Tenant A submits the key tenant B already
+ * used; the idempotent-mint lookup — a `SELECT` with no tenant predicate —
+ * finds B's row and the endpoint returns it. Even with RLS correctly enabled,
+ * the collision still surfaces as a 23505 that leaks the row's existence, and
+ * an `ON CONFLICT DO UPDATE` still targets a row the session cannot see.
+ *
+ * KEY COLUMNS COME FROM THE CATALOG, NOT FROM `indexdef`. The first version
+ * sliced the DDL text from the first `(` to the LAST `)`, which swallowed
+ * everything a unique index can legally carry after its key list, and then
+ * substring-matched the tenant column inside it. Both of these were therefore
+ * SKIPPED while remaining fully exploitable:
+ *
+ *   UNIQUE (dedupe_key) WHERE (tenant_id IS NOT NULL)   -- partial predicate
+ *   UNIQUE (dedupe_key) INCLUDE (tenant_id)             -- non-key payload
+ *
+ * A partial `WHERE` narrows which rows participate, not which tenants share the
+ * namespace; an `INCLUDE` column is payload and is not part of the uniqueness
+ * key at all. `pg_index.indnkeyatts` knows the difference and text-slicing
+ * cannot.
+ */
+async function checkTenantUniqueIndexes(querier, schemas, opts) {
+    const tenantColumns = tenantColumnNames(opts);
+    const { rows } = await querier.query(`SELECT n.nspname AS schemaname,
+            t.relname AS tablename,
+            ic.relname AS indexname,
+            pg_get_indexdef(i.indexrelid) AS indexdef,
+            i.indisprimary AS is_primary,
+            ARRAY(
+              SELECT a.attname
+                FROM generate_subscripts(i.indkey, 1) AS k
+                JOIN pg_attribute a
+                  ON a.attrelid = i.indrelid AND a.attnum = i.indkey[k]
+               WHERE k < i.indnkeyatts
+            ) AS key_columns,
+            NOT EXISTS (
+              SELECT 1
+                FROM generate_subscripts(i.indkey, 1) AS k
+                JOIN pg_attribute a
+                  ON a.attrelid = i.indrelid AND a.attnum = i.indkey[k]
+               WHERE k < i.indnkeyatts
+                 AND a.atthasdef IS NOT TRUE
+                 AND a.attidentity = ''
+            ) AS all_keys_generated
+       FROM pg_index i
+       JOIN pg_class t  ON t.oid = i.indrelid
+       JOIN pg_class ic ON ic.oid = i.indexrelid
+       JOIN pg_namespace n ON n.oid = t.relnamespace
+      WHERE i.indisunique
+        AND n.nspname = ANY($1::text[])
+        AND EXISTS (
+          SELECT 1 FROM pg_attribute a
+           WHERE a.attrelid = t.oid
+             AND a.attname = ANY($2::text[])
+             AND a.attnum > 0
+             AND NOT a.attisdropped
+        )
+      ORDER BY t.relname, ic.relname`, [schemas, tenantColumns]);
+    const wanted = opts.tables?.map((t) => t.split(".").pop() ?? t);
+    const out = [];
+    for (const row of rows) {
+        if (wanted && !wanted.includes(row.tablename))
+            continue;
+        if (tableExempt(row, opts.exemptTables))
+            continue;
+        // `RlsQuerier` is driver-agnostic: node-postgres hands back a parsed
+        // string[] for text[], postgres.js and a raw wire read can hand back the
+        // literal `{a,b}`. Normalise rather than assume — a silently-empty key list
+        // would make every index look unsafe (or, with the test inverted, safe).
+        const keyCols = toStringArray(row.key_columns);
+        // The tenant column is in the KEY — the namespace is partitioned. Safe.
+        if (keyCols.some((c) => tenantColumns.includes(c)))
+            continue;
+        // A SURROGATE primary key is safe, and only a surrogate one. The original
+        // exclusion dropped every `contype = 'p'` index on the rationale that "no
+        // tenant chooses its value" — true of `id uuid DEFAULT gen_random_uuid()`,
+        // false of `dedupe_key text PRIMARY KEY`, which is a caller-supplied
+        // natural key and is exactly the shape that was exploited. The honest test
+        // is not "is it the primary key" but "did the SERVER generate every key
+        // column", which `atthasdef` / `attidentity` answer directly.
+        if (row.is_primary && row.all_keys_generated)
+            continue;
+        out.push({
+            object: `${row.schemaname}.${row.tablename}`,
+            policy: row.indexname,
+            command: "-",
+            reason: "tenant_unscoped_unique_index",
+            expression: `${row.indexdef}  [key columns: ${keyCols.join(", ")}]`,
+        });
+    }
+    return out;
+}
+async function checkResolverHelpers(querier, allowDegraded) {
+    const out = [];
+    const { rows: procs } = await querier.query(`SELECT p.proname, p.prosrc, p.prosecdef
+       FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+      WHERE n.nspname = 'auth'
+        AND p.proname IN ('session_tenant_ids','user_tenant_ids')`, []);
+    const resolver = procs.find((p) => p.proname === "session_tenant_ids");
+    const membership = procs.find((p) => p.proname === "user_tenant_ids");
+    if (!resolver) {
+        out.push({
+            object: "auth.session_tenant_ids()",
+            policy: "session_tenant_ids",
+            command: "-",
+            reason: "resolver_missing",
+            expression: null,
+        });
+        return out;
+    }
+    if (!/RAISE\s+EXCEPTION/i.test(resolver.prosrc)) {
+        out.push({
+            object: "auth.session_tenant_ids()",
+            policy: "session_tenant_ids",
+            command: "-",
+            reason: "resolver_not_loud",
+            expression: resolver.prosrc.slice(0, 400),
+        });
+    }
+    if (!resolver.prosecdef) {
+        out.push({
+            object: "auth.session_tenant_ids()",
+            policy: "session_tenant_ids",
+            command: "-",
+            reason: "resolver_not_security_definer",
+            expression: resolver.prosrc.slice(0, 400),
+        });
+    }
+    const degraded = resolver.prosrc.includes(SESSION_TENANT_IDS_DEGRADED_MARKER);
+    if (degraded && !allowDegraded) {
+        out.push({
+            object: "auth.session_tenant_ids()",
+            policy: "session_tenant_ids",
+            command: "-",
+            reason: "resolver_degraded",
+            expression: resolver.prosrc.slice(0, 400),
+        });
+    }
+    // The stub check only matters for the STRICT resolver: the degraded one never
+    // consults `user_tenant_ids`, so a stub there is expected, not a defect.
+    if (!degraded && membership && isStubMembershipHelper(membership.prosrc)) {
+        out.push({
+            object: "auth.user_tenant_ids(uuid)",
+            policy: "user_tenant_ids",
+            command: "-",
+            reason: "membership_helper_is_stub",
+            expression: membership.prosrc.trim().slice(0, 400),
+        });
+    }
+    return out;
+}
+/** The bootstrap stub is `SELECT NULL::uuid WHERE false` — any body that can
+ *  never return a row. Matched structurally rather than by exact string so a
+ *  reformatted copy is still caught. */
+export function isStubMembershipHelper(prosrc) {
+    return /where\s+false/i.test(prosrc) && !/from\s+\w/i.test(prosrc);
+}
+//# sourceMappingURL=tenant-fence.js.map

package/dist/tenant-fence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-fence.js","sourceRoot":"","sources":["../src/tenant-fence.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,sEAAsE;AACtE,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,uBAAuB;AACvB,EAAE;AACF,8DAA8D;AAC9D,4EAA4E;AAC5E,0EAA0E;AAC1E,4BAA4B;AAC5B,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,qDAAqD;AACrD,EAAE;AACF,iFAAiF;AACjF,iEAAiE;AACjE,qEAAqE;AACrE,mEAAmE;AACnE,iEAAiE;AACjE,2EAA2E;AAC3E,oEAAoE;AACpE,6EAA6E;AAC7E,wEAAwE;AACxE,2EAA2E;AAC3E,gFAAgF;AAChF,gDAAgD;AAChD,EAAE;AACF,iCAAiC;AACjC,EAAE;AACF,2DAA2D;AAC3D,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAC5E,+DAA+D;AAC/D,gFAAgF;AAChF,4EAA4E;AAC5E,EAAE;AACF,6DAA6D;AAC7D,EAAE;AACF,iDAAiD;AACjD,2EAA2E;AAE3E,OAAO,EAAE,kCAAkC,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAgFxC;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IACrC,SAAS,CAAiC;IACnD,YAAY,SAAyC;QACnD,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,WAAW,GAAsC;IACrD,kBAAkB,EAChB,qIAAqI;IACvI,mBAAmB,EACjB,yEAAyE;IAC3E,4BAA4B,EAC1B,iKAAiK;IACnK,gBAAgB,EACd,gHAAgH;IAClH,iBAAiB,EACf,8IAA8I;IAChJ,6BAA6B,EAC3B,oKAAoK;IACtK,iBAAiB,EACf,oNAAoN;IACtN,yBAAyB,EACvB,sKAAsK;IACxK,4BAA4B,EAC1B,6PAA6P;IAC/P,4BAA4B,EAC1B,4PAA4P;IAC9P,oBAAoB,EAClB,8SAA8S;CACjT,CAAC;AAEF,SAAS,kBAAkB,CAAC,SAAyC;IACnE,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CACzB,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAClJ,CAAC;IACF,OAAO,iBAAiB,SAAS,CAAC,MAAM,qKAAqK,KAAK,CAAC,IAAI,CACrN,IAAI,CACL,gTAAgT,CAAC;AACpT,CAAC;AAyED,8DAA8D;AAC9D,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,mDAAmD;AACnD,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,qCAAqC;AACrC,MAAM,WAAW,GAAG,6CAA6C,CAAC;AAClE,MAAM,QAAQ,GAAG,0CAA0C,CAAC;AAE5D,iEAAiE;AACjE,MAAM,UAAU,sBAAsB,CAAC,IAAmB;IACxD,OAAO,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IACzD,OAAO,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,4DAA4D;AAC5D,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,4DAA4D;AAE5D,SAAS,QAAQ,CACf,GAAc,EACd,MAAqC;IAErC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;IACvD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAmB;IAEnB,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,uBAAuB,CAAC,IAAI,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAC/D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAmB,EACnB,OAA8B,EAAE;IAEhC,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,KAAK,SAAS;QACvB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACZ,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC/B,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YACf,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAC/C,MAAM,SAAS,GAA0B,EAAE,CAAC;IAE5C,kEAAkE;IAClE,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,8EAA8E;IAC9E,wCAAwC;IACxC,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,yDAAyD;IACzD,2EAA2E;IAC3E,2EAA2E;IAC3E,EAAE;IACF,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,mCAAmC;IACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAClC;;;;;;;;;;;;;;;;;;;;;;;;;sCAyBkC,EAClC,CAAC,OAAO,CAAC,CACV,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAEhE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,wBAAwB;YAAE,SAAS;QAC5C,wEAAwE;QACxE,uEAAuE;QACvE,sCAAsC;QACtC,IAAI,GAAG,CAAC,UAAU,KAAK,KAAK;YAAE,SAAS;QACvC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QACxD,IAAI,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC;YAAE,SAAS;QAEjD,2EAA2E;QAC3E,wEAAwE;QACxE,8DAA8D;QAC9D,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC5B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,SAAS,CAAC,IAAI,CAAC;oBACb,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,EAAE;oBAC5C,MAAM,EAAE,GAAG,CAAC,UAAU;oBACtB,OAAO,EAAE,GAAG,CAAC,GAAG;oBAChB,MAAM;oBACN,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,yDAAyD;QACzD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC;gBACb,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,EAAE;gBAC5C,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,OAAO,EAAE,GAAG,CAAC,GAAG;gBAChB,MAAM,EAAE,qBAAqB;gBAC7B,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QACpC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;QACpC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,CACrE,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAClE,CAAC;AAWD,MAAM,aAAa,GAA2B;IAC5C,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,mBAAmB;IACtB,CAAC,EAAE,eAAe;IAClB,CAAC,EAAE,mBAAmB;IACtB,CAAC,EAAE,OAAO;CACX,CAAC;AAEF;;;;wBAIwB;AACxB,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAE1E,0EAA0E;AAC1E,SAAS,aAAa,CAAC,CAAuC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,CAAC;SACL,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA2B;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAClB,GAA8C,EAC9C,MAAqC;IAErC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,KAAK,UAAU,wBAAwB,CACrC,OAAmB,EACnB,OAA0B,EAC1B,IAA2B;IAE3B,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9C,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAClC;;;;;;;;;;;;;;;;;;;;;;oCAsBgC,EAChC,CAAC,OAAO,EAAE,aAAa,CAAC,CACzB,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QACxD,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;YACtE,mEAAmE;YACnE,iEAAiE;YACjE,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,gBAAgB;gBAAE,SAAS;YAC1D,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,EAAE;gBAC5C,MAAM,EAAE,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,GAAG;gBACxD,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,sBAAsB;gBAC9B,UAAU,EAAE,GAAG,GAAG,CAAC,SAAS,YAAY,GAAG,aAAa,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,wCAAwC,EAAE;aACpK,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,cAAc;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,EAAE;YAC5C,MAAM,EAAE,4BAA4B;YACpC,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,8BAA8B;YACtC,UAAU,EAAE,GAAG,GAAG,CAAC,SAAS,UAAU,GAAG,iCAAiC;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,KAAK,UAAU,wBAAwB,CACrC,OAAmB,EACnB,OAA0B,EAC1B,IAA2B;IAE3B,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAkCiC,EACjC,CAAC,OAAO,EAAE,aAAa,CAAC,CACzB,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QACxD,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAClD,qEAAqE;QACrE,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,wEAAwE;QACxE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7D,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,qEAAqE;QACrE,2EAA2E;QAC3E,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB;YAAE,SAAS;QACvD,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,EAAE;YAC5C,MAAM,EAAE,GAAG,CAAC,SAAS;YACrB,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,8BAA8B;YACtC,UAAU,EAAE,GAAG,GAAG,CAAC,QAAQ,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACpE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAAmB,EACnB,aAAkC;IAElC,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CACzC;;;kEAG8D,EAC9D,EAAE,CACH,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,oBAAoB,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC;IAEtE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,2BAA2B;YACnC,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,2BAA2B;YACnC,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,2BAA2B;YACnC,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,+BAA+B;YACvC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;IAC9E,IAAI,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,2BAA2B;YACnC,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,CAAC,QAAQ,IAAI,UAAU,IAAI,sBAAsB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,4BAA4B;YACpC,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,2BAA2B;YACnC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;wCAEwC;AACxC,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC"}

package/dist/types.d.ts

@@ -118,6 +118,24 @@ export declare class PoolUnavailable extends DbRlsError {
 export declare class MissingTenantContext extends DbRlsError {
     constructor();
 }
+/**
+ * Thrown when something asks for a database session that would let a tenant
+ * user reach more than one tenant's rows.
+ *
+ * The only caller that triggers this today is `withUserMembershipContext`,
+ * which is retained as a throwing stub so a JavaScript consumer gets a sentence
+ * rather than `undefined is not a function`. It is a runtime throw and not
+ * merely a removed export because the call sites live in services that do not
+ * all typecheck against this package at build time.
+ *
+ * Nodii STAFF cross-tenant access is a different path entirely and is
+ * unaffected: the separate, RBAC-gated, audit-stamped `platform_ops` pool
+ * (`withPlatformOpsContext`).
+ */
+export declare class CrossTenantSessionRefused extends DbRlsError {
+    readonly helper: string;
+    constructor(helper: string);
+}
 export declare class TransactionRolledBack extends DbRlsError {
     readonly cause: unknown;
     constructor(cause: unknown);

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAoBA;;;;;wDAKwD;AACxD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,eAAe,GAAG,cAAc,CAAC;AAE/E;;wBAEwB;AACxB,MAAM,WAAW,IAAI;IACnB,6CAA6C;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oEAAoE;IACpE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE;;kDAEkD;AAClD,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yBAAyB;AACzB,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8BAA8B;AAC9B,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAKD,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,UAAU;;CAOlD;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACZ,IAAI,EAAE,QAAQ;CAK3B;AAED,qBAAa,oBAAqB,SAAQ,UAAU;;CAOnD;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAS3B;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,UAAU;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM;CAO7B;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAoBA;;;;;wDAKwD;AACxD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,eAAe,GAAG,cAAc,CAAC;AAE/E;;wBAEwB;AACxB,MAAM,WAAW,IAAI;IACnB,6CAA6C;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oEAAoE;IACpE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE;;kDAEkD;AAClD,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yBAAyB;AACzB,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8BAA8B;AAC9B,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAKD,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,UAAU;;CAOlD;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACZ,IAAI,EAAE,QAAQ;CAK3B;AAED,qBAAa,oBAAqB,SAAQ,UAAU;;CAOnD;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,yBAA0B,SAAQ,UAAU;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAO3B;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAS3B;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,UAAU;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM;CAO7B;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/types.js

@@ -45,6 +45,28 @@ export class MissingTenantContext extends DbRlsError {
         this.name = "MissingTenantContext";
     }
 }
+/**
+ * Thrown when something asks for a database session that would let a tenant
+ * user reach more than one tenant's rows.
+ *
+ * The only caller that triggers this today is `withUserMembershipContext`,
+ * which is retained as a throwing stub so a JavaScript consumer gets a sentence
+ * rather than `undefined is not a function`. It is a runtime throw and not
+ * merely a removed export because the call sites live in services that do not
+ * all typecheck against this package at build time.
+ *
+ * Nodii STAFF cross-tenant access is a different path entirely and is
+ * unaffected: the separate, RBAC-gated, audit-stamped `platform_ops` pool
+ * (`withPlatformOpsContext`).
+ */
+export class CrossTenantSessionRefused extends DbRlsError {
+    helper;
+    constructor(helper) {
+        super(`cross_tenant_session_refused: ${helper}() opened an authenticated-pool session with NO tenant bound, so the RLS predicate resolved across EVERY tenant the principal belonged to. That is the mechanism of the cross-tenant approval incident, and it is no longer available. Use withUserContext({ userId, tenantId }, fn) with the tenant the request resolved to. To LIST a user's tenants (switcher / login picker), query auth.user_tenant_ids from a services-pool context — that function is intact; what is gone is opening a data session that spans them. Nodii staff cross-tenant access is unchanged: withPlatformOpsContext.`);
+        this.name = "CrossTenantSessionRefused";
+        this.helper = helper;
+    }
+}
 export class TransactionRolledBack extends DbRlsError {
     cause;
     constructor(cause) {

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,EAAE;AACF,gBAAgB;AAChB,qDAAqD;AACrD,uEAAuE;AACvE,0EAA0E;AAC1E,oDAAoD;AACpD,0EAA0E;AAC1E,wBAAwB;AACxB,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,uCAAuC;AACvC,0CAA0C;AAC1C,kDAAkD;AAClD,0EAA0E;AAwH1E,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD;QACE,KAAK,CACH,uHAAuH,CACxH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACpC,IAAI,CAAW;IACxB,YAAY,IAAc;QACxB,KAAK,CAAC,yBAAyB,IAAI,sCAAsC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD;QACE,KAAK,CACH,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CACH,4BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,UAAU;IAC/C,QAAQ,CAAS;IAC1B,YAAY,QAAgB;QAC1B,KAAK,CACH,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gOAAgO,CACrS,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,EAAE;AACF,gBAAgB;AAChB,qDAAqD;AACrD,uEAAuE;AACvE,0EAA0E;AAC1E,oDAAoD;AACpD,0EAA0E;AAC1E,wBAAwB;AACxB,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,uCAAuC;AACvC,0CAA0C;AAC1C,kDAAkD;AAClD,0EAA0E;AAwH1E,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD;QACE,KAAK,CACH,uHAAuH,CACxH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACpC,IAAI,CAAW;IACxB,YAAY,IAAc;QACxB,KAAK,CAAC,yBAAyB,IAAI,sCAAsC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD;QACE,KAAK,CACH,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,yBAA0B,SAAQ,UAAU;IAC9C,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CACH,iCAAiC,MAAM,okBAAokB,CAC5mB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CACH,4BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,UAAU;IAC/C,QAAQ,CAAS;IAC1B,YAAY,QAAgB;QAC1B,KAAK,CACH,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gOAAgO,CACrS,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/dist/verify-rls-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-rls-cli.d.ts","sourceRoot":"","sources":["../src/verify-rls-cli.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAqDhC"}
+{"version":3,"file":"verify-rls-cli.d.ts","sourceRoot":"","sources":["../src/verify-rls-cli.ts"],"names":[],"mappings":"AAmFA,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;CACjB;AAqBD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAsEhC"}