@nodii/db-rls 0.11.0 → 0.13.0

package/dist/verify-rls-cli.js

@@ -6,9 +6,55 @@
 // deliverable — this is the optional bin mirror of migrate-gen's CLI.
 //
 // Connection string comes from `--db <url>` or the `DATABASE_URL` /
-// `DB_RLS_PG_URL` env var (in that order). `pg` is an optional peer dep;
-// the CLI imports it lazily so importing the library does not require it.
+// `DB_RLS_PG_URL` env var (in that order).
+//
+// DRIVER (0.12.0): both `pg` and `postgres` are OPTIONAL peer deps and both
+// are imported LAZILY, so importing the library requires neither and the CLI
+// runs on whichever the host service actually installed. Before 0.12.0 this
+// path did an unconditional `await import("pg")` — and most Nodii services
+// run postgres-js and have no `pg` at all (finance, billing, auth all lack
+// it), so `nodii-db-rls verify-rls` threw `Cannot find package 'pg'` for the
+// majority of the fleet. That, plus the node-pg-only `verifyRls` signature,
+// is why the function had zero adoption while five services hand-rolled the
+// same catalog query in tests.
+//
+// Preference order: `postgres` (postgres-js) FIRST, since it is the fleet
+// default, then `pg`. `--driver pg|postgres-js` pins it explicitly.
 import { RlsCoverageError, verifyRls } from "./verify-rls.js";
+/**
+ * Open a connection with whichever supported driver is installed.
+ * Returns `null` (with the attempted-driver list) when neither resolves, so
+ * the caller can emit an actionable usage error instead of a raw MODULE_NOT_-
+ * FOUND.
+ */
+async function connect(connectionString, pinned) {
+    const order = pinned ? [pinned] : ["postgres-js", "pg"];
+    const failed = [];
+    for (const driver of order) {
+        try {
+            if (driver === "postgres-js") {
+                const mod = (await import("postgres"));
+                const sql = mod.default(connectionString, { max: 1 });
+                return {
+                    pool: sql,
+                    close: () => sql.end(),
+                    driver,
+                };
+            }
+            const { Pool } = await import("pg");
+            const pool = new Pool({ connectionString, max: 1 });
+            return {
+                pool: pool,
+                close: () => pool.end(),
+                driver,
+            };
+        }
+        catch (err) {
+            failed.push(`${driver}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return { failed };
+}
 function splitList(value) {
     if (!value)
         return [];
@@ -17,6 +63,15 @@ function splitList(value) {
         .map((s) => s.trim())
         .filter((s) => s.length > 0);
 }
+/**
+ * Invariant head of the "no usable driver" message. Split out so the message
+ * is ONE template literal (biome `lint/style/useTemplate` rejects
+ * `"literal" + template`) without a 200-column line. Literal-to-literal `+`
+ * is fine — only concatenating with an interpolation trips the rule. The
+ * trailing space is load-bearing: `--driver.` continues this sentence.
+ */
+const NO_DRIVER_DETAIL = "verify-rls: no usable Postgres driver. Install `postgres` (postgres-js, " +
+    "the Nodii default) or `pg` (node-postgres), or pin one with ";
 /**
  * Parses argv (without the leading `verify-rls` token) and runs the
  * coverage check. Returns an exit code + message rather than calling
@@ -34,6 +89,7 @@ export async function runVerifyRlsCli(args) {
     let refs;
     let schema;
     let dbUrl;
+    let driver;
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
         if (a === "--tables" && i + 1 < args.length)
@@ -44,6 +100,16 @@ export async function runVerifyRlsCli(args) {
             schema = args[++i];
         else if (a === "--db" && i + 1 < args.length)
             dbUrl = args[++i];
+        else if (a === "--driver" && i + 1 < args.length) {
+            const v = args[++i];
+            if (v !== "pg" && v !== "postgres-js") {
+                return {
+                    code: 2,
+                    message: `verify-rls: --driver must be \`pg\` or \`postgres-js\` (got \`${v}\`).`,
+                };
+            }
+            driver = v;
+        }
         else if (a === "--help" || a === "-h") {
             return { code: 0, message: usage() };
         }
@@ -59,19 +125,24 @@ export async function runVerifyRlsCli(args) {
             message: "verify-rls: no connection string — pass --db <url> or set DATABASE_URL / DB_RLS_PG_URL.",
         };
     }
-    // Lazy-import pg (optional peer dep). Keeps the library importable
-    // without pg installed; only the CLI path requires it.
-    const { Pool } = await import("pg");
-    const pool = new Pool({ connectionString, max: 1 });
+    // Lazy-import whichever driver the host service installed (both are
+    // OPTIONAL peer deps). Keeps the library importable with neither.
+    const conn = await connect(connectionString, driver);
+    if ("failed" in conn) {
+        return {
+            code: 2,
+            message: `${NO_DRIVER_DETAIL}--driver.\nAttempted:\n  ${conn.failed.join("\n  ")}`,
+        };
+    }
     try {
-        await verifyRls(pool, {
+        await verifyRls(conn.pool, {
             requiredTables,
             schema,
             referenceTables: splitList(refs),
         });
         return {
             code: 0,
-            message: `verify-rls: OK — ${requiredTables.length} RLS-required table(s) covered.`,
+            message: `verify-rls: OK — ${requiredTables.length} RLS-required table(s) covered (driver: ${conn.driver}).`,
         };
     }
     catch (err) {
@@ -81,11 +152,11 @@ export async function runVerifyRlsCli(args) {
         throw err;
     }
     finally {
-        await pool.end().catch(() => { });
+        await conn.close().catch(() => { });
     }
 }
 function usage() {
-    return `usage: verify-rls --tables <a,b,c> [--ref <x,y>] [--schema <name>] [--db <url>]
+    return `usage: verify-rls --tables <a,b,c> [--ref <x,y>] [--schema <name>] [--db <url>] [--driver pg|postgres-js]
 
 Verifies every --tables relation has ROW LEVEL SECURITY enabled
 (pg_class.relrowsecurity = true), exempting any --ref reference table
@@ -93,6 +164,11 @@ Verifies every --tables relation has ROW LEVEL SECURITY enabled
 any RLS-required table is missing RLS.
 
 Connection string: --db <url>, else DATABASE_URL, else DB_RLS_PG_URL.
+Driver: auto-detected — postgres-js (\`postgres\`) preferred, then \`pg\`.
+Both are optional peer deps; pin one with --driver.
+
+Wire it as a db:setup gate, AFTER migrations apply:
+  "db:setup": "... && nodii-db-rls verify-rls --tables \\"$(...)\\""
 
 Spec: @nodii/db-rls 08-rls § A1 (RLS on every tenant-scoped table).`;
 }

package/dist/verify-rls-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-rls-cli.js","sourceRoot":"","sources":["../src/verify-rls-cli.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,oEAAoE;AACpE,yEAAyE;AACzE,0EAA0E;AAE1E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAS9D,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAuB;IAEvB,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAyB,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAChE,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,gBAAgB,GACpB,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACjE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EACL,yFAAyF;SAC5F,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,uDAAuD;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE;YACpB,cAAc;YACd,MAAM;YACN,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,oBAAoB,cAAc,CAAC,MAAM,iCAAiC;SACpF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,KAAK;IACZ,OAAO;;;;;;;;;oEAS2D,CAAC;AACrE,CAAC"}
+{"version":3,"file":"verify-rls-cli.js","sourceRoot":"","sources":["../src/verify-rls-cli.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,oEAAoE;AACpE,2CAA2C;AAC3C,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,+BAA+B;AAC/B,EAAE;AACF,0EAA0E;AAC1E,oEAAoE;AAEpE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAU9D;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CACpB,gBAAwB,EACxB,MAA6B;IAE7B,MAAM,KAAK,GAAgB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAWpC,CAAC;gBACF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACtD,OAAO;oBACL,IAAI,EAAE,GAAsC;oBAC5C,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE;oBACtB,MAAM;iBACP,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO;gBACL,IAAI,EAAE,IAAkD;gBACxD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;gBACvB,MAAM;aACP,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AASD,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GACpB,0EAA0E;IAC1E,8DAA8D,CAAC;AAEjE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAuB;IAEvB,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAyB,CAAC;IAC9B,IAAI,MAA6B,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAChE,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;gBACtC,OAAO;oBACL,IAAI,EAAE,CAAC;oBACP,OAAO,EAAE,iEAAiE,CAAC,MAAM;iBAClF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,gBAAgB,GACpB,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACjE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EACL,yFAAyF;SAC5F,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,GAAG,gBAAgB,4BAA4B,IAAI,CAAC,MAAM,CAAC,IAAI,CACtE,MAAM,CACP,EAAE;SACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE;YACzB,cAAc;YACd,MAAM;YACN,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,oBAAoB,cAAc,CAAC,MAAM,2CAA2C,IAAI,CAAC,MAAM,IAAI;SAC7G,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,KAAK;IACZ,OAAO;;;;;;;;;;;;;;oEAc2D,CAAC;AACrE,CAAC"}

package/dist/verify-rls.d.ts

@@ -1,13 +1,20 @@
 import { DbRlsError } from "./types.js";
-/** Minimal query surface for the preflight catalog read. `pg.Pool` and
- *  `pg.PoolClient` both satisfy this; `PgClientPool` exposes `.rawPool`.
- *  We deliberately do NOT reuse the tx-bound `PgPool` — the preflight is a
- *  single read, not a GUC-scoped transaction. */
+/** node-postgres-shaped query surface (`pg.Pool` / `pg.PoolClient` /
+ *  `PgClientPool.rawPool`). We deliberately do NOT reuse the tx-bound
+ *  `PgPool` — the preflight is a single read, not a GUC-scoped transaction. */
 export interface RlsQuerier {
     query<R = unknown>(sql: string, params?: readonly unknown[]): Promise<{
         rows: R[];
     }>;
 }
+/** postgres-js (porsager) query surface — `sql.unsafe(text, params)` resolves
+ *  to a bare row ARRAY, not a `{ rows }` envelope. This is the shape every
+ *  postgres-js Nodii service already has in hand. */
+export interface RlsQuerierPostgresJs {
+    unsafe<R = unknown>(sql: string, params?: readonly unknown[]): Promise<R[]>;
+}
+/** Either supported driver shape. */
+export type AnyRlsQuerier = RlsQuerier | RlsQuerierPostgresJs;
 /** A predicate that returns `true` when `table` is a reference table
  *  (GRANT-controlled, NO RLS by design — § 7.6) and must therefore be
  *  EXEMPT from the RLS-coverage check. `table` is the table name exactly
@@ -88,6 +95,20 @@ export declare class RlsCoverageError extends DbRlsError {
  * The query is a single read against `pg_class` joined to `pg_namespace`
  * — read-only, no GUCs, no writes. Run it from a migration / `db:setup`
  * gate against any pool (typically the owner/admin pool).
+ *
+ * `pool` accepts EITHER driver shape (0.12.0): node-postgres
+ * (`query(sql, params) → { rows }`) or postgres-js
+ * (`unsafe(sql, params) → rows[]`). Wire it into `db:setup` after
+ * migrations apply:
+ *
+ * ```ts
+ * // postgres-js service (the common Nodii case)
+ * import { verifyRls } from "@nodii/db-rls";
+ * await verifyRls(getPools().owner.sql, {
+ *   requiredTables: ["finance_journal_entries", "finance_ledger_entries"],
+ *   referenceTables: ["currency_codes"],   // § 7.6 — GRANT-controlled, no RLS
+ * });
+ * ```
  */
-export declare function verifyRls(pool: RlsQuerier, opts: VerifyRlsOpts): Promise<void>;
+export declare function verifyRls(pool: AnyRlsQuerier, opts: VerifyRlsOpts): Promise<void>;
 //# sourceMappingURL=verify-rls.d.ts.map

package/dist/verify-rls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-rls.d.ts","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC;;;iDAGiD;AACjD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,GAAG,OAAO,EACf,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3B;AAED;;;mEAGmE;AACnE,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B;;0CAEsC;IACtC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;oEAIgE;IAChE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;sCAGkC;IAClC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;4EAEwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;yEAWqE;IACrE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;0BAC0B;AAC1B,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;2EAOuE;IACvE,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,gBAAgB,CAAC;CACzD;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;gBACvC,SAAS,EAAE,SAAS,mBAAmB,EAAE;CAKtD;AA+CD;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAyFf"}
+{"version":3,"file":"verify-rls.d.ts","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AAuDA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC;;+EAE+E;AAC/E,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,GAAG,OAAO,EACf,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3B;AAED;;qDAEqD;AACrD,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CAC7E;AAED,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,oBAAoB,CAAC;AAoC9D;;;mEAGmE;AACnE,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B;;0CAEsC;IACtC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;oEAIgE;IAChE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;sCAGkC;IAClC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;4EAEwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;yEAWqE;IACrE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;0BAC0B;AAC1B,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;2EAOuE;IACvE,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,gBAAgB,CAAC;CACzD;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;gBACvC,SAAS,EAAE,SAAS,mBAAmB,EAAE;CAKtD;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CA0Ff"}

package/dist/verify-rls.js

@@ -21,11 +21,65 @@
 // RLS is an error; a reference table missing RLS is expected.
 //
 // The verify path is a single read-only catalog query — it does NOT need
-// the GUC/tx-bound `PgPool` surface. It accepts any object exposing a
-// `query(sql, params)` returning `{ rows }`, which `pg.Pool` /
-// `PgClientPool.rawPool` satisfy directly. Byte-consistent error semantics
+// the GUC/tx-bound `PgPool` surface. Byte-consistent error semantics
 // across TS / Python / Go ports.
+//
+// DRIVER SHAPE (0.12.0) — WHY THIS WAS ZERO-ADOPTED
+// -------------------------------------------------
+// Until 0.12.0 the first parameter was typed ONLY as
+// `{ query(sql, params): Promise<{ rows: R[] }> }` — the node-postgres result
+// shape. This barrel's own header says why that was fatal: "every Nodii
+// service runs postgres-js (porsager), which never installs `pg`". A
+// postgres-js service literally cannot pass its pool here; it would have to
+// hand-wrap `sql.unsafe(text, args)` (which resolves to a bare `T[]`) into a
+// `{ rows }` envelope first. And the shipped `verify-rls` CLI does
+// `await import("pg")`, so the CLI was unusable for the same services.
+//
+// The result, at the 0.12.0 audit: `verifyRls` had ZERO references across all
+// 16 service repos, while FIVE services hand-rolled the identical
+// `SELECT relname, relrowsecurity FROM pg_class` check in their own tests —
+// billing, finance, vendor, ticketing, and obs-interface (Go). Of the five,
+// finance and billing have no `pg` dependency at all. The barrel comment
+// claiming "service db:setup gates call verifyRls() after migrations" was
+// describing an API nobody could reach.
+//
+// So `verifyRls` now accepts EITHER driver shape and normalises internally:
+//
+//   node-postgres  { query(sql, params) } → Promise<{ rows: R[] }>
+//   postgres-js    { unsafe(sql, params) } → Promise<R[]>
+//
+// Both satisfy a single read-only catalog SELECT with positional parameters;
+// nothing driver-specific is used. `pg.Pool`, `pg.PoolClient`,
+// `PgClientPool.rawPool`, a porsager `Sql` instance, and
+// `PgPostgresJsPool`'s underlying `sql` all work unchanged.
 import { DbRlsError } from "./types.js";
+/**
+ * Run one positional-parameter SELECT against either driver shape and return
+ * a plain row array.
+ *
+ * Duck-typed rather than flagged: a pool that exposes BOTH (a drizzle
+ * postgres-js client wrapping a porsager `Sql`, say) is served by `query`,
+ * which is the stricter, better-typed path.
+ */
+async function queryRows(pool, sql, params) {
+    const asNodePg = pool;
+    if (typeof asNodePg.query === "function") {
+        const res = await asNodePg.query(sql, params);
+        // A postgres-js `Sql` tagged template is ALSO callable, and some wrappers
+        // expose a `query` that resolves to an array. Accept both results rather
+        // than reading `.rows` off an array and silently getting `undefined`.
+        return Array.isArray(res) ? res : res.rows;
+    }
+    const asPgJs = pool;
+    if (typeof asPgJs.unsafe === "function") {
+        const rows = await asPgJs.unsafe(sql, params);
+        return rows;
+    }
+    throw new DbRlsError("verifyRls: the supplied pool exposes neither `query(sql, params)` " +
+        "(node-postgres) nor `unsafe(sql, params)` (postgres-js). Pass a " +
+        "`pg.Pool`/`pg.PoolClient`, a `PgClientPool.rawPool`, or a postgres-js " +
+        "`Sql` instance (e.g. `getPools().owner.sql`).");
+}
 /**
  * Thrown by `verifyRls` when one or more RLS-required tables are missing
  * row-level security (or are absent). Carries the structured offender list
@@ -82,6 +136,20 @@ function key(r) {
  * The query is a single read against `pg_class` joined to `pg_namespace`
  * — read-only, no GUCs, no writes. Run it from a migration / `db:setup`
  * gate against any pool (typically the owner/admin pool).
+ *
+ * `pool` accepts EITHER driver shape (0.12.0): node-postgres
+ * (`query(sql, params) → { rows }`) or postgres-js
+ * (`unsafe(sql, params) → rows[]`). Wire it into `db:setup` after
+ * migrations apply:
+ *
+ * ```ts
+ * // postgres-js service (the common Nodii case)
+ * import { verifyRls } from "@nodii/db-rls";
+ * await verifyRls(getPools().owner.sql, {
+ *   requiredTables: ["finance_journal_entries", "finance_ledger_entries"],
+ *   referenceTables: ["currency_codes"],   // § 7.6 — GRANT-controlled, no RLS
+ * });
+ * ```
  */
 export async function verifyRls(pool, opts) {
     const defaultSchema = opts.schema ?? "public";
@@ -113,7 +181,7 @@ export async function verifyRls(pool, opts) {
     // resolves every table; missing rows are detected by set difference.
     const schemas = toCheck.map((t) => t.schema);
     const relnames = toCheck.map((t) => t.relname);
-    const res = await pool.query(`SELECT n.nspname, c.relname, c.relrowsecurity, c.relforcerowsecurity
+    const rows = await queryRows(pool, `SELECT n.nspname, c.relname, c.relrowsecurity, c.relforcerowsecurity
        FROM unnest($1::text[], $2::text[]) AS req(schemaname, tablename)
        JOIN pg_namespace n ON n.nspname = req.schemaname
        JOIN pg_class c ON c.relnamespace = n.oid
@@ -121,7 +189,7 @@ export async function verifyRls(pool, opts) {
         AND c.relkind IN ('r', 'p')`, [schemas, relnames]);
     // Index the catalog rows by schema.relname.
     const found = new Map();
-    for (const row of res.rows) {
+    for (const row of rows) {
         found.set(`${row.nspname}.${row.relname}`, {
             enabled: row.relrowsecurity,
             forced: row.relforcerowsecurity,

package/dist/verify-rls.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-rls.js","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,6DAA6D;AAC7D,uEAAuE;AACvE,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,8DAA8D;AAC9D,kFAAkF;AAClF,0EAA0E;AAC1E,6EAA6E;AAC7E,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,+DAA+D;AAC/D,2EAA2E;AAC3E,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA4ExC;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IACrC,SAAS,CAAiC;IACnD,YAAY,SAAyC;QACnD,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,SAAyC;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,OAAO,SAAS,8DAA8D,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAClC,OAAO,OAAO,SAAS,oGAAoG,CAAC;QAC9H,CAAC;QACD,OAAO,OAAO,SAAS,6CAA6C,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,OAAO,iBAAiB,SAAS,CAAC,MAAM,mPAAmP,KAAK,CAAC,IAAI,CACnS,IAAI,CACL,+JAA+J,CAAC;AACnK,CAAC;AASD,yEAAyE;AACzE,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;yEACyE;AACzE,SAAS,YAAY,CAAC,KAAa,EAAE,aAAqB;IACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,8DAA8D;AAC9D,SAAS,GAAG,CAAC,CAAsC;IACjD,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAgB,EAChB,IAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;IAEhD,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,iBAAiB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GACb,iBAAiB,IAAI,IAAI,CAAC,gBAAgB;QACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,SAAS,CAAC;IAEhB,gEAAgE;IAChE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAM1B;;;;;oCAKgC,EAChC,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;IAEF,4CAA4C;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACvE,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE;YACzC,OAAO,EAAE,GAAG,CAAC,cAAc;YAC3B,MAAM,EAAE,GAAG,CAAC,mBAAmB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACnC,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify-rls.js","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,6DAA6D;AAC7D,uEAAuE;AACvE,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,8DAA8D;AAC9D,kFAAkF;AAClF,0EAA0E;AAC1E,6EAA6E;AAC7E,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,iCAAiC;AACjC,EAAE;AACF,oDAAoD;AACpD,oDAAoD;AACpD,qDAAqD;AACrD,8EAA8E;AAC9E,wEAAwE;AACxE,qEAAqE;AACrE,4EAA4E;AAC5E,6EAA6E;AAC7E,mEAAmE;AACnE,uEAAuE;AACvE,EAAE;AACF,8EAA8E;AAC9E,kEAAkE;AAClE,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,mEAAmE;AACnE,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,+DAA+D;AAC/D,yDAAyD;AACzD,4DAA4D;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAsBxC;;;;;;;GAOG;AACH,KAAK,UAAU,SAAS,CACtB,IAAmB,EACnB,GAAW,EACX,MAA0B;IAE1B,MAAM,QAAQ,GAAG,IAA2B,CAAC;IAC7C,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QACjD,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,IAAqC,CAAC;IACrD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,IAAW,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,UAAU,CAClB,oEAAoE;QAClE,kEAAkE;QAClE,wEAAwE;QACxE,+CAA+C,CAClD,CAAC;AACJ,CAAC;AAiED;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IACrC,SAAS,CAAiC;IACnD,YAAY,SAAyC;QACnD,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,SAAyC;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,OAAO,SAAS,8DAA8D,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAClC,OAAO,OAAO,SAAS,oGAAoG,CAAC;QAC9H,CAAC;QACD,OAAO,OAAO,SAAS,6CAA6C,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,OAAO,iBAAiB,SAAS,CAAC,MAAM,mPAAmP,KAAK,CAAC,IAAI,CACnS,IAAI,CACL,+JAA+J,CAAC;AACnK,CAAC;AASD,yEAAyE;AACzE,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;yEACyE;AACzE,SAAS,YAAY,CAAC,KAAa,EAAE,aAAqB;IACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,8DAA8D;AAC9D,SAAS,GAAG,CAAC,CAAsC;IACjD,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAmB,EACnB,IAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;IAEhD,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,iBAAiB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GACb,iBAAiB,IAAI,IAAI,CAAC,gBAAgB;QACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,SAAS,CAAC;IAEhB,gEAAgE;IAChE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,SAAS,CAM1B,IAAI,EACJ;;;;;oCAKgC,EAChC,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;IAEF,4CAA4C;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACvE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE;YACzC,OAAO,EAAE,GAAG,CAAC,cAAc;YAC3B,MAAM,EAAE,GAAG,CAAC,mBAAmB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACnC,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/db-rls",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
   "license": "MIT",
   "type": "module",
@@ -62,7 +62,7 @@
     }
   },
   "devDependencies": {
-    "@nodii/telemetry": "0.23.0",
+    "@nodii/telemetry": "0.27.0",
     "@types/bun": "^1.3.13",
     "@types/pg": "^8.11.10",
     "drizzle-orm": "^0.45.2",