@nodii/db-rls 0.12.0 → 0.13.0

package/bin/migrate-gen.mjs

@@ -7,12 +7,15 @@
 // Subcommands:
 //   migrate-gen <serviceName> [--out <dir>] [--stub]
 //   verify-rls  --tables <a,b,c> [--ref <x,y>] [--schema <name>] [--db <url>]
+//   install-fence [--db <url>] [--skip-grants]
+//   verify-fence  [--db <url>] [--schema <name>] [--strict-only]
 //
 // (Filename kept as migrate-gen.mjs for the package.json `bin` mapping;
 // it is the single `nodii-db-rls` entrypoint, not migrate-gen only.)
 
 import { runMigrateGenCli } from "../dist/migrate-gen.js";
 import { runVerifyRlsCli } from "../dist/verify-rls-cli.js";
+import { runInstallFenceCli, runVerifyFenceCli } from "../dist/fence-cli.js";
 
 const argv = process.argv.slice(2);
 const sub = argv[0];
@@ -22,6 +25,14 @@ if (sub === "verify-rls") {
   // Coverage failures (1) + usage (2) go to stderr; success (0) to stdout.
   (code === 0 ? console.log : console.error)(message);
   process.exit(code);
+} else if (sub === "install-fence") {
+  const { code, message } = await runInstallFenceCli(argv.slice(1));
+  (code === 0 ? console.log : console.error)(message);
+  process.exit(code);
+} else if (sub === "verify-fence") {
+  const { code, message } = await runVerifyFenceCli(argv.slice(1));
+  (code === 0 ? console.log : console.error)(message);
+  process.exit(code);
 } else {
   // migrate-gen (default + back-compat: runMigrateGenCli accepts the
   // leading "migrate-gen" token and prints usage on a missing serviceName).

package/dist/auth-schema.d.ts

@@ -4,7 +4,7 @@ import type { Pool, PoolClient } from "pg";
  * compliance requirement. Identical byte-equal payload across TS / Python
  * / Go ports (asserted by the parity-fence CI).
  */
-export declare const AUTH_SCHEMA_SQL = "CREATE SCHEMA IF NOT EXISTS auth;\n\nCREATE OR REPLACE FUNCTION auth.set_user_id(p_user_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.user_id', p_user_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.set_tenant_id(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.init(p_user_id uuid, p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$\n  SELECT set_config('app.user_id', p_user_id::text, true);\n  SELECT set_config('app.tenant_id', p_tenant_id::text, true);\n$$;\n\nCREATE OR REPLACE FUNCTION auth.init_tenant(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.get_user_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.user_id', true), '')::uuid $$;\n\nCREATE OR REPLACE FUNCTION auth.get_tenant_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true), '')::uuid $$;\n\n-- Stub variant. Replaced in-place by migrate-gen's 0001_user_tenant_ids.sql\n-- once the service has employees_mirror + customers_mirror tables.\nCREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid\nLANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;\n";
+export declare const AUTH_SCHEMA_SQL = "CREATE SCHEMA IF NOT EXISTS auth;\n\nCREATE OR REPLACE FUNCTION auth.set_user_id(p_user_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.user_id', p_user_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.set_tenant_id(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.init(p_user_id uuid, p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$\n  SELECT set_config('app.user_id', p_user_id::text, true);\n  SELECT set_config('app.tenant_id', p_tenant_id::text, true);\n$$;\n\nCREATE OR REPLACE FUNCTION auth.init_tenant(p_tenant_id uuid) RETURNS void\nLANGUAGE sql AS $$ SELECT set_config('app.tenant_id', p_tenant_id::text, true) $$;\n\nCREATE OR REPLACE FUNCTION auth.get_user_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.user_id', true), '')::uuid $$;\n\nCREATE OR REPLACE FUNCTION auth.get_tenant_id() RETURNS uuid\nLANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true), '')::uuid $$;\n\n-- Stub variant, installed ONLY IF ABSENT. Replaced in-place by migrate-gen's\n-- 0001_user_tenant_ids.sql once the service has employees_mirror +\n-- customers_mirror tables.\n--\n-- IT IS A GUARDED CREATE, NOT A `CREATE OR REPLACE`, AND THAT IS LOAD-BEARING.\n-- As an unguarded REPLACE this statement silently overwrote a service's REAL\n-- membership helper with the dead stub every time the auth schema was\n-- re-applied \u2014 turning a correctly-fenced service into a deny-all one with no\n-- error, which is the same fail-silent shape this release exists to remove.\n-- It also made `INSTALL_SESSION_RESOLVER_SQL` unable to classify: running\n-- immediately after this block, it would read the stub this block had just\n-- stamped and conclude EVERY service needed the degraded body.\n--\n-- A bootstrap default must never win against the real thing it is standing in\n-- for.\nDO $ensure_user_tenant_ids$\nBEGIN\n  IF to_regprocedure('auth.user_tenant_ids(uuid)') IS NULL THEN\n    EXECUTE $utid$CREATE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid\nLANGUAGE sql STABLE AS $utid_body$ SELECT NULL::uuid WHERE false $utid_body$;$utid$;\n  END IF;\nEND\n$ensure_user_tenant_ids$;\n";
 /**
  * `auth.session_tenant_ids()` — THE authenticated-pool resolver.
  *
@@ -124,6 +124,64 @@ export declare const SESSION_TENANT_IDS_DEGRADED_SQL = "CREATE OR REPLACE FUNCTI
 /** Grant for the resolver. Separate from {@link AUTH_SCHEMA_GRANTS_SQL} for the
  *  same reason: the roles must exist before the GRANT runs. */
 export declare const SESSION_TENANT_IDS_GRANTS_SQL = "GRANT EXECUTE ON FUNCTION auth.session_tenant_ids() TO nodii_services, authenticated;\n";
+/**
+ * THE DELIVERY UNIT. One idempotent, re-runnable, SELF-CLASSIFYING statement
+ * that installs whichever resolver body this database can actually support.
+ *
+ * WHY IT SELF-CLASSIFIES RATHER THAN TAKING A FLAG.
+ *
+ * The strict and degraded bodies are not interchangeable, and picking the wrong
+ * one is silent in BOTH directions:
+ *
+ *   - strict on a service whose `auth.user_tenant_ids` is the bootstrap stub
+ *     (`SELECT NULL::uuid WHERE false`) intersects to the EMPTY SET, so every
+ *     authenticated policy denies every row. No error. Measured live on
+ *     `nodii-dev-postgres`: crm carries 507 authenticated policies, and a strict
+ *     install there takes ALL 507 dark, not just the 85 already dead.
+ *   - degraded on a service that HAS a real membership mirror silently drops
+ *     the principal check, which is the defence-in-depth this release exists to
+ *     add.
+ *
+ * A caller-supplied boolean makes that choice a thing somebody has to know. The
+ * library shipped exactly such a list in prose — and it was WRONG BY SIX
+ * SERVICES on the first pass and had to be re-derived from the repos. A list
+ * that was wrong once, maintained by hand, across fifteen repos, on a
+ * fail-silent switch, is not a control. It is a countdown.
+ *
+ * So the choice is made from what the database ACTUALLY CONTAINS, at the moment
+ * of install, by the same structural test `isStubMembershipHelper` applies in
+ * TypeScript: a membership helper that is absent, or whose body can never
+ * return a row, cannot support the intersect. Nobody has to know anything, and
+ * there is no list to get wrong.
+ *
+ * D415 (LOCKED) is the governing decision: a single-tenant-session service
+ * whose `user_tenant_ids` is absent, stubbed or uncalled MAY fence on the
+ * session tenant — isolation-equivalent, forfeiting no cross-tenant protection.
+ * The predicate at every call site is IDENTICAL for both bodies, which is what
+ * makes this substitutable at all.
+ *
+ * IT IS ALSO D415's SUNSET, AUTOMATED. D415's exit path is "land a membership
+ * mirror → repoint the helper → swap in the strict body". Because this block
+ * re-reads the catalog on EVERY run and is `CREATE OR REPLACE`, the swap
+ * happens by itself on the next boot after the mirror lands. Nobody files a
+ * follow-up ticket, because there is nothing to follow up.
+ *
+ * THE ONE-WAY RATCHET. The condition is "absent OR stub", so a real helper
+ * ALWAYS yields strict. This block can upgrade degraded → strict; it can never
+ * downgrade strict → degraded. That direction is the one that matters: it means
+ * this delivery path cannot overwrite a correctly-strict service, and cannot
+ * overwrite crm's deliberately-degraded body with a strict one either, because
+ * crm's helper is still the stub and will keep classifying as such until it
+ * genuinely isn't.
+ *
+ * Byte-identical across the TS / Go / Python ports (asserted by the parity
+ * test). The nested dollar-quote tags are all distinct — `$fence_install$`
+ * outer, `$fence_strict$` / `$fence_degraded$` for the EXECUTE literals,
+ * `$session$` inside the bodies — so the statement survives every dollar-quote
+ * -aware splitter in the fleet, including the ones in @nodii/saga and
+ * @nodii/dsar that split the mirrors' DDL on `;\n`.
+ */
+export declare const INSTALL_SESSION_RESOLVER_SQL: string;
 /**
  * Grants for the 7 helper functions. Emitted separately because they
  * reference roles that must exist before the GRANT runs — applied last
@@ -154,6 +212,34 @@ export declare function applyAuthSchemaMigrations(client: AnyExecutor, opts?: {
     includeGrants?: boolean;
     degradedSessionResolver?: boolean;
 }): Promise<void>;
+/**
+ * THE WHOLE DELIVERY UNIT AS ONE STRING — resolver + gate, self-classifying,
+ * idempotent, re-runnable, and safe to apply on every boot.
+ *
+ * This is what the three mirrors inline byte-equal, what the CLI applies, and
+ * what a service with no other delivery path should call directly from its boot
+ * sequence, BEFORE any code that opens an authenticated transaction:
+ *
+ *     import { applySessionFenceBootstrap } from "@nodii/db-rls";
+ *     await applySessionFenceBootstrap(ownerSql);
+ *
+ * Grants are separate (as everywhere else in this package) because the runtime
+ * roles must exist before a GRANT naming them can run, and on a fresh database
+ * they do not yet.
+ */
+export declare const SESSION_FENCE_BOOTSTRAP_SQL: string;
+/**
+ * Apply {@link SESSION_FENCE_BOOTSTRAP_SQL} against an owner-privileged client.
+ *
+ * Idempotent and safe on every boot: the resolver and gate are
+ * `CREATE OR REPLACE`, the schema is `IF NOT EXISTS`, and the body selection
+ * re-derives from the catalog each run — so a service that lands a membership
+ * mirror upgrades itself from the degraded body to the strict one on its next
+ * restart, with no migration and no policy change (D415's exit path).
+ */
+export declare function applySessionFenceBootstrap(client: AnyExecutor, opts?: {
+    includeGrants?: boolean;
+}): Promise<void>;
 /**
  * Composite full DDL — the schema + helpers + grants, joined.
  * Provided for migrate-gen + parity-fence byte-equality.

package/dist/auth-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,eAAe,s1CA2B3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,eAAO,MAAM,sBAAsB,iqCAuBlC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,yCACP,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,eAAO,MAAM,+BAA+B,isCAwB3C,CAAC;AAEF;+DAC+D;AAC/D,eAAO,MAAM,6BAA6B,4FACzC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,8oBAQlC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,KAAK,WAAW,GAAG,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,MAAM,CAKR"}
+{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAO3C;;;;GAIG;AACH,eAAO,MAAM,eAAe,0uEA8C3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,eAAO,MAAM,sBAAsB,iqCAuBlC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,yCACP,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,eAAO,MAAM,+BAA+B,isCAwB3C,CAAC;AAEF;+DAC+D;AAC/D,eAAO,MAAM,6BAA6B,4FACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,4BAA4B,QA4BxC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,8oBAQlC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,KAAK,WAAW,GAAG,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,MAAM,CAKR"}

package/dist/auth-schema.js

@@ -19,6 +19,7 @@
 // fails closed if a service applies the helpers but hasn't yet emitted
 // the real per-service helper via `migrate-gen`. Once `migrate-gen` ships
 // the real helper, `CREATE OR REPLACE` replaces this stub in place.
+import { sessionFenceBootstrapSql, TENANT_FENCE_GATE_GRANTS_SQL, TENANT_FENCE_GATE_SQL, } from "./tenant-fence-gate.js";
 /**
  * Canonical SQL string exported as a module-level constant per the R1
  * compliance requirement. Identical byte-equal payload across TS / Python
@@ -47,10 +48,29 @@ LANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.user_id', true), ''
 CREATE OR REPLACE FUNCTION auth.get_tenant_id() RETURNS uuid
 LANGUAGE sql STABLE AS $$ SELECT nullif(current_setting('app.tenant_id', true), '')::uuid $$;
 
--- Stub variant. Replaced in-place by migrate-gen's 0001_user_tenant_ids.sql
--- once the service has employees_mirror + customers_mirror tables.
-CREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid
-LANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;
+-- Stub variant, installed ONLY IF ABSENT. Replaced in-place by migrate-gen's
+-- 0001_user_tenant_ids.sql once the service has employees_mirror +
+-- customers_mirror tables.
+--
+-- IT IS A GUARDED CREATE, NOT A \`CREATE OR REPLACE\`, AND THAT IS LOAD-BEARING.
+-- As an unguarded REPLACE this statement silently overwrote a service's REAL
+-- membership helper with the dead stub every time the auth schema was
+-- re-applied — turning a correctly-fenced service into a deny-all one with no
+-- error, which is the same fail-silent shape this release exists to remove.
+-- It also made \`INSTALL_SESSION_RESOLVER_SQL\` unable to classify: running
+-- immediately after this block, it would read the stub this block had just
+-- stamped and conclude EVERY service needed the degraded body.
+--
+-- A bootstrap default must never win against the real thing it is standing in
+-- for.
+DO $ensure_user_tenant_ids$
+BEGIN
+  IF to_regprocedure('auth.user_tenant_ids(uuid)') IS NULL THEN
+    EXECUTE $utid$CREATE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid
+LANGUAGE sql STABLE AS $utid_body$ SELECT NULL::uuid WHERE false $utid_body$;$utid$;
+  END IF;
+END
+$ensure_user_tenant_ids$;
 `;
 /**
  * `auth.session_tenant_ids()` — THE authenticated-pool resolver.
@@ -219,6 +239,92 @@ $session$;
  *  same reason: the roles must exist before the GRANT runs. */
 export const SESSION_TENANT_IDS_GRANTS_SQL = `GRANT EXECUTE ON FUNCTION auth.session_tenant_ids() TO nodii_services, authenticated;
 `;
+/**
+ * THE DELIVERY UNIT. One idempotent, re-runnable, SELF-CLASSIFYING statement
+ * that installs whichever resolver body this database can actually support.
+ *
+ * WHY IT SELF-CLASSIFIES RATHER THAN TAKING A FLAG.
+ *
+ * The strict and degraded bodies are not interchangeable, and picking the wrong
+ * one is silent in BOTH directions:
+ *
+ *   - strict on a service whose `auth.user_tenant_ids` is the bootstrap stub
+ *     (`SELECT NULL::uuid WHERE false`) intersects to the EMPTY SET, so every
+ *     authenticated policy denies every row. No error. Measured live on
+ *     `nodii-dev-postgres`: crm carries 507 authenticated policies, and a strict
+ *     install there takes ALL 507 dark, not just the 85 already dead.
+ *   - degraded on a service that HAS a real membership mirror silently drops
+ *     the principal check, which is the defence-in-depth this release exists to
+ *     add.
+ *
+ * A caller-supplied boolean makes that choice a thing somebody has to know. The
+ * library shipped exactly such a list in prose — and it was WRONG BY SIX
+ * SERVICES on the first pass and had to be re-derived from the repos. A list
+ * that was wrong once, maintained by hand, across fifteen repos, on a
+ * fail-silent switch, is not a control. It is a countdown.
+ *
+ * So the choice is made from what the database ACTUALLY CONTAINS, at the moment
+ * of install, by the same structural test `isStubMembershipHelper` applies in
+ * TypeScript: a membership helper that is absent, or whose body can never
+ * return a row, cannot support the intersect. Nobody has to know anything, and
+ * there is no list to get wrong.
+ *
+ * D415 (LOCKED) is the governing decision: a single-tenant-session service
+ * whose `user_tenant_ids` is absent, stubbed or uncalled MAY fence on the
+ * session tenant — isolation-equivalent, forfeiting no cross-tenant protection.
+ * The predicate at every call site is IDENTICAL for both bodies, which is what
+ * makes this substitutable at all.
+ *
+ * IT IS ALSO D415's SUNSET, AUTOMATED. D415's exit path is "land a membership
+ * mirror → repoint the helper → swap in the strict body". Because this block
+ * re-reads the catalog on EVERY run and is `CREATE OR REPLACE`, the swap
+ * happens by itself on the next boot after the mirror lands. Nobody files a
+ * follow-up ticket, because there is nothing to follow up.
+ *
+ * THE ONE-WAY RATCHET. The condition is "absent OR stub", so a real helper
+ * ALWAYS yields strict. This block can upgrade degraded → strict; it can never
+ * downgrade strict → degraded. That direction is the one that matters: it means
+ * this delivery path cannot overwrite a correctly-strict service, and cannot
+ * overwrite crm's deliberately-degraded body with a strict one either, because
+ * crm's helper is still the stub and will keep classifying as such until it
+ * genuinely isn't.
+ *
+ * Byte-identical across the TS / Go / Python ports (asserted by the parity
+ * test). The nested dollar-quote tags are all distinct — `$fence_install$`
+ * outer, `$fence_strict$` / `$fence_degraded$` for the EXECUTE literals,
+ * `$session$` inside the bodies — so the statement survives every dollar-quote
+ * -aware splitter in the fleet, including the ones in @nodii/saga and
+ * @nodii/dsar that split the mirrors' DDL on `;\n`.
+ */
+export const INSTALL_SESSION_RESOLVER_SQL = `CREATE SCHEMA IF NOT EXISTS auth;
+DO $fence_install$
+DECLARE
+  v_src text;
+  v_is_stub boolean;
+BEGIN
+  SELECT p.prosrc INTO v_src
+    FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+   WHERE n.nspname = 'auth' AND p.proname = 'user_tenant_ids'
+   LIMIT 1;
+
+  -- Structural, not an exact-string compare: the bootstrap stub is
+  -- \`SELECT NULL::uuid WHERE false\` — an unsatisfiable WHERE and no FROM. A
+  -- reformatted or re-indented copy of the same dead body still classifies as a
+  -- stub. Mirrors isStubMembershipHelper() in tenant-fence.ts exactly; the two
+  -- are asserted equivalent in the test-suite so a fix to one cannot leave the
+  -- other behind.
+  v_is_stub := v_src IS NULL
+               OR (v_src ~* 'where\\s+false' AND v_src !~* 'from\\s+\\w');
+
+  IF v_is_stub THEN
+    EXECUTE $fence_degraded$${SESSION_TENANT_IDS_DEGRADED_SQL.trimEnd()}$fence_degraded$;
+  ELSE
+    EXECUTE $fence_strict$${SESSION_TENANT_IDS_SQL.trimEnd()}$fence_strict$;
+  END IF;
+END
+$fence_install$;
+`;
 /**
  * Grants for the 7 helper functions. Emitted separately because they
  * reference roles that must exist before the GRANT runs — applied last
@@ -257,12 +363,56 @@ export async function applyAuthSchemaMigrations(client, opts = {}) {
     // CREATE POLICY time, so the migration itself fails with `function
     // auth.session_tenant_ids() does not exist`. Installing both together makes
     // that unreachable.
+    //
+    // WHICH BODY IS NOT A DECISION THIS FUNCTION MAKES. It is derived from the
+    // membership helper actually present in THIS database — see
+    // INSTALL_SESSION_RESOLVER_SQL. `degradedSessionResolver` remains as an
+    // explicit override for the one case derivation cannot cover: a service that
+    // has a real-looking helper but knows it is not yet populated. Passing it is
+    // a deliberate, argued act; the default is derivation, so a caller who knows
+    // nothing gets the right body.
     await exec.query(opts.degradedSessionResolver
         ? SESSION_TENANT_IDS_DEGRADED_SQL
-        : SESSION_TENANT_IDS_SQL);
+        : INSTALL_SESSION_RESOLVER_SQL);
+    // The gate ships with the resolver, always. See sessionFenceBootstrapSql.
+    await exec.query(TENANT_FENCE_GATE_SQL);
     if (includeGrants) {
         await exec.query(AUTH_SCHEMA_GRANTS_SQL);
         await exec.query(SESSION_TENANT_IDS_GRANTS_SQL);
+        await exec.query(TENANT_FENCE_GATE_GRANTS_SQL);
+    }
+}
+/**
+ * THE WHOLE DELIVERY UNIT AS ONE STRING — resolver + gate, self-classifying,
+ * idempotent, re-runnable, and safe to apply on every boot.
+ *
+ * This is what the three mirrors inline byte-equal, what the CLI applies, and
+ * what a service with no other delivery path should call directly from its boot
+ * sequence, BEFORE any code that opens an authenticated transaction:
+ *
+ *     import { applySessionFenceBootstrap } from "@nodii/db-rls";
+ *     await applySessionFenceBootstrap(ownerSql);
+ *
+ * Grants are separate (as everywhere else in this package) because the runtime
+ * roles must exist before a GRANT naming them can run, and on a fresh database
+ * they do not yet.
+ */
+export const SESSION_FENCE_BOOTSTRAP_SQL = sessionFenceBootstrapSql(INSTALL_SESSION_RESOLVER_SQL);
+/**
+ * Apply {@link SESSION_FENCE_BOOTSTRAP_SQL} against an owner-privileged client.
+ *
+ * Idempotent and safe on every boot: the resolver and gate are
+ * `CREATE OR REPLACE`, the schema is `IF NOT EXISTS`, and the body selection
+ * re-derives from the catalog each run — so a service that lands a membership
+ * mirror upgrades itself from the degraded body to the strict one on its next
+ * restart, with no migration and no policy change (D415's exit path).
+ */
+export async function applySessionFenceBootstrap(client, opts = {}) {
+    const exec = client;
+    await exec.query(SESSION_FENCE_BOOTSTRAP_SQL);
+    if (opts.includeGrants ?? false) {
+        await exec.query(SESSION_TENANT_IDS_GRANTS_SQL);
+        await exec.query(TENANT_FENCE_GATE_GRANTS_SQL);
     }
 }
 /**

package/dist/auth-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,mEAAmE;AACnE,qBAAqB;AACrB,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,qEAAqE;AACrE,4FAA4F;AAC5F,8DAA8D;AAC9D,8DAA8D;AAC9D,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,oEAAoE;AAIpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuBrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,sCAAsC,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;;OAOxC,kCAAkC;;;;;;;;;;;;;;;;;CAiBxC,CAAC;AAEF;+DAC+D;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG;CAC5C,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;CAQrC,CAAC;AAYF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAmB,EACnB,OAAuE,EAAE;IAEzE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAqB,CAAC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAClC,0EAA0E;IAC1E,+EAA+E;IAC/E,yEAAyE;IACzE,mEAAmE;IACnE,4EAA4E;IAC5E,oBAAoB;IACpB,MAAM,IAAI,CAAC,KAAK,CACd,IAAI,CAAC,uBAAuB;QAC1B,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,sBAAsB,CAC3B,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,OAAO,aAAa;QAClB,CAAC,CAAC,GAAG,eAAe,KAAK,sBAAsB,EAAE;QACjD,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC"}
+{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,mEAAmE;AACnE,qBAAqB;AACrB,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,qEAAqE;AACrE,4FAA4F;AAC5F,8DAA8D;AAC9D,8DAA8D;AAC9D,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,oEAAoE;AAGpE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8C9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuBrC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,sCAAsC,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;;OAOxC,kCAAkC;;;;;;;;;;;;;;;;;CAiBxC,CAAC;AAEF;+DAC+D;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GAAG;CAC5C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;;;8BAsBd,+BAA+B,CAAC,OAAO,EAAE;;4BAE3C,sBAAsB,CAAC,OAAO,EAAE;;;;CAI3D,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;CAQrC,CAAC;AAYF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAmB,EACnB,OAAuE,EAAE;IAEzE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAqB,CAAC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAClC,0EAA0E;IAC1E,+EAA+E;IAC/E,yEAAyE;IACzE,mEAAmE;IACnE,4EAA4E;IAC5E,oBAAoB;IACpB,EAAE;IACF,2EAA2E;IAC3E,4DAA4D;IAC5D,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,+BAA+B;IAC/B,MAAM,IAAI,CAAC,KAAK,CACd,IAAI,CAAC,uBAAuB;QAC1B,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,4BAA4B,CACjC,CAAC;IACF,0EAA0E;IAC1E,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAW,wBAAwB,CACzE,4BAA4B,CAC7B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAmB,EACnB,OAAoC,EAAE;IAEtC,MAAM,IAAI,GAAG,MAAqB,CAAC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,aAAa,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,OAAO,aAAa;QAClB,CAAC,CAAC,GAAG,eAAe,KAAK,sBAAsB,EAAE;QACjD,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC"}

package/dist/context.d.ts

@@ -1,11 +1,16 @@
 import { type OwnerContextOpts } from "./migrate-guard.js";
 import { type AutoDispatchOpts, type PgTx, type PlatformOpsContextOpts, type SystemContextOpts, type UserContextOpts, type UserMembershipContextOpts } from "./types.js";
+/** Test-only. Not exported through the public barrel. */
+export declare function _resetFenceGateForTests(): void;
 /**
  * withUserContext — opens a tx on the `authenticated` pool, sets
  * `app.user_id` + `app.tenant_id` (+ optional `app.source_ip`) via
  * `set_config(..., true)` tx-scoped GUCs, yields the tx, commits/rolls
  * back per the PgPool contract.
  *
+ * On the FIRST call in a process it also runs the tenant-fence gate (see
+ * {@link assertFenceOnce}) and refuses to yield the tx if the fence is broken.
+ *
  * Throws `DbRlsNotInitialized` if `initDbRls` hasn't run.
  * Wraps any error thrown by `fn` in `TransactionRolledBack`.
  */

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,gBAAgB,EAGrB,KAAK,IAAI,EACT,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC/B,MAAM,YAAY,CAAC;AAEpB;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAyBZ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5B,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,gBAAgB,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EACvD,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAYZ;AAMD,4DAA4D;AAC5D,wBAAgB,8CAA8C,IAAI,IAAI,CAErE;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAeZ"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,gBAAgB,EAGrB,KAAK,IAAI,EACT,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC/B,MAAM,YAAY,CAAC;AAepB,yDAAyD;AACzD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAyCD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAmCZ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5B,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,gBAAgB,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EACvD,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAYZ;AAMD,4DAA4D;AAC5D,wBAAgB,8CAA8C,IAAI,IAAI,CAErE;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAeZ"}

package/dist/context.js

@@ -7,13 +7,71 @@
 import { requirePool } from "./init.js";
 import { recordOwnerContextInvocation } from "./metrics.js";
 import { assertMigrateAllowed, } from "./migrate-guard.js";
+import { TENANT_FENCE_GATE_CALL_SQL } from "./tenant-fence-gate.js";
 import { CrossTenantSessionRefused, MissingTenantContext, TransactionRolledBack, } from "./types.js";
+/**
+ * Process-local latch for the first-use fence gate. `null` until the gate has
+ * run; thereafter the settled promise, so the check costs one round-trip per
+ * PROCESS rather than one per transaction.
+ *
+ * A REJECTED promise is retained deliberately. A broken fence is not a
+ * transient condition — it is a property of the schema — so re-checking on
+ * every subsequent request would turn one clear failure into a storm of
+ * identical ones while adding a catalog scan to each. The service stays down
+ * and says the same thing every time, which is the intended behaviour.
+ */
+let fenceGate = null;
+/** Test-only. Not exported through the public barrel. */
+export function _resetFenceGateForTests() {
+    fenceGate = null;
+}
+/**
+ * THE GATE. Runs `auth.assert_tenant_fence()` once per process, on the first
+ * authenticated-pool checkout.
+ *
+ * WHY HERE, AND NOT IN A DEPLOY SCRIPT.
+ *
+ * The obvious home is a `db:verify` step in each service's deploy. It does not
+ * work, and this is measured rather than argued: SIX of the ten services this
+ * release has to reach — billing, kyc, notification, task-tracking, tenant and
+ * geo — have NO database step in `deploy-dev.yml` at all. Their `db:setup`
+ * runs in `ci.yml` against a throwaway Postgres. A gate wired there is green
+ * forever on the services that need it most, and reported as a pass.
+ *
+ * WHY NOT `initDbRls`. Boot order forbids it. billing runs `applySagaMigrations`
+ * and `applyDsarMigrations` at boot, AFTER its pools are constructed — a check
+ * at `initDbRls` time would fire against a schema that is about to be fixed
+ * two statements later and fail every deploy.
+ *
+ * First-authenticated-use is the earliest point that is both after all boot
+ * migrations and before any tenant row is served, and it is reached by
+ * construction: there is no way to open an authenticated transaction without
+ * passing through here. That is the "cannot forget to opt in" property. It is
+ * not a flag, a config key, or a script somebody adds to a pipeline — it is the
+ * function you must call to get the connection.
+ *
+ * WHY IT IS NOT THE `verifyRls` SHAPE. `verifyRls` takes `requiredTables` from
+ * the caller, and the author who forgets `ENABLE ROW LEVEL SECURITY` forgets
+ * the list entry in the same migration — so it sits wired and green while
+ * unprotected tables accumulate behind it. `auth.assert_tenant_fence()` asks
+ * the catalog which tables carry a tenant column. Nobody maintains a list,
+ * so nobody can omit the entry that mattered.
+ */
+async function assertFenceOnce(tx) {
+    if (fenceGate === null) {
+        fenceGate = tx.exec(TENANT_FENCE_GATE_CALL_SQL);
+    }
+    return fenceGate;
+}
 /**
  * withUserContext — opens a tx on the `authenticated` pool, sets
  * `app.user_id` + `app.tenant_id` (+ optional `app.source_ip`) via
  * `set_config(..., true)` tx-scoped GUCs, yields the tx, commits/rolls
  * back per the PgPool contract.
  *
+ * On the FIRST call in a process it also runs the tenant-fence gate (see
+ * {@link assertFenceOnce}) and refuses to yield the tx if the fence is broken.
+ *
  * Throws `DbRlsNotInitialized` if `initDbRls` hasn't run.
  * Wraps any error thrown by `fn` in `TransactionRolledBack`.
  */
@@ -38,6 +96,16 @@ export async function withUserContext(opts, fn) {
         if (opts.sourceIp !== undefined) {
             await tx.setConfig("app.source_ip", opts.sourceIp);
         }
+        // BEFORE `fn`, deliberately. The point of the gate is that no tenant row is
+        // served through a broken fence — running it afterwards would mean the
+        // first request reads cross-tenant data and THEN reports the problem.
+        //
+        // NOT wrapped in TransactionRolledBack: that wrapper exists to mark "the
+        // caller's own code threw". This is the library refusing to hand over the
+        // transaction, and it must surface with its own message and SQLSTATE
+        // intact so the on-call engineer sees the offender list rather than a
+        // generic rollback.
+        await assertFenceOnce(tx);
         try {
             return await fn(tx);
         }

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,kEAAkE;AAClE,YAAY;AAEZ,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,yBAAyB,EACzB,oBAAoB,EAIpB,qBAAqB,GAGtB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAqB,EACrB,EAA4B;IAE5B,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACpD,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,mEAAmE;QACnE,yEAAyE;QACzE,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAgC,EAChC,GAA6B;IAE7B,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB,EACvB,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAuD,EACvD,OAAkC;IAElC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAuD,EACvD,OAAkC;IAElC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA4B,EAC5B,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,0CAA0C;AAC1C,IAAI,iCAAiC,GAAG,KAAK,CAAC;AAE9C,4DAA4D;AAC5D,MAAM,UAAU,8CAA8C;IAC5D,iCAAiC,GAAG,KAAK,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA4B,EAC5B,EAA4B;IAE5B,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACvC,iCAAiC,GAAG,IAAI,CAAC;QACzC,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,uDAAuD;YACrD,+DAA+D;YAC/D,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,EAA4B;IAE5B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,eAAe,CACpB;YACE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM;YAC/B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;SACpC,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,oBAAoB,EAAE,CAAC;AACnC,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,kEAAkE;AAClE,YAAY;AAEZ,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAEL,yBAAyB,EACzB,oBAAoB,EAIpB,qBAAqB,GAGtB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,IAAI,SAAS,GAAyB,IAAI,CAAC;AAE3C,yDAAyD;AACzD,MAAM,UAAU,uBAAuB;IACrC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,KAAK,UAAU,eAAe,CAAC,EAAQ;IACrC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,SAAS,GAAG,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAqB,EACrB,EAA4B;IAE5B,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACpD,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,mEAAmE;QACnE,yEAAyE;QACzE,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,4EAA4E;QAC5E,uEAAuE;QACvE,sEAAsE;QACtE,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,sEAAsE;QACtE,oBAAoB;QACpB,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAgC,EAChC,GAA6B;IAE7B,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB,EACvB,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAuD,EACvD,OAAkC;IAElC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAuD,EACvD,OAAkC;IAElC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA4B,EAC5B,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,0CAA0C;AAC1C,IAAI,iCAAiC,GAAG,KAAK,CAAC;AAE9C,4DAA4D;AAC5D,MAAM,UAAU,8CAA8C;IAC5D,iCAAiC,GAAG,KAAK,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA4B,EAC5B,EAA4B;IAE5B,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACvC,iCAAiC,GAAG,IAAI,CAAC;QACzC,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,uDAAuD;YACrD,+DAA+D;YAC/D,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,EAA4B;IAE5B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,eAAe,CACpB;YACE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM;YAC/B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;SACpC,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,oBAAoB,EAAE,CAAC;AACnC,CAAC"}

package/dist/fence-cli.d.ts

@@ -0,0 +1,21 @@
+export interface FenceCliResult {
+    /** 0 = clean, 1 = fence defect, 2 = usage / connection error. */
+    code: number;
+    message: string;
+}
+/**
+ * `install-fence` — apply the delivery unit (resolver + gate).
+ *
+ * Idempotent and re-runnable. Must be run with OWNER credentials: it creates
+ * functions in the `auth` schema. Safe to run on every deploy; safe to run
+ * twice; and re-running is how a service that has since landed a membership
+ * mirror upgrades itself from the degraded body to the strict one.
+ */
+export declare function runInstallFenceCli(args: readonly string[]): Promise<FenceCliResult>;
+/**
+ * `verify-fence` — assert the fence from the CATALOG, using the TypeScript
+ * verifier (which reports EVERY offender at once rather than raising on the
+ * first, and covers the unique-index check the SQL gate leaves to deploy time).
+ */
+export declare function runVerifyFenceCli(args: readonly string[]): Promise<FenceCliResult>;
+//# sourceMappingURL=fence-cli.d.ts.map

package/dist/fence-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fence-cli.d.ts","sourceRoot":"","sources":["../src/fence-cli.ts"],"names":[],"mappings":"AA+BA,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAkDD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,cAAc,CAAC,CAsCzB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,cAAc,CAAC,CAkCzB"}

package/dist/fence-cli.js

@@ -0,0 +1,191 @@
+// `nodii-db-rls install-fence` and `nodii-db-rls verify-fence`.
+//
+// The eager, pipeline-facing half of the gate. `withUserContext` runs
+// `auth.assert_tenant_fence()` on first authenticated use, which is the
+// unforgettable check — but "unforgettable" is not the same as "early", and a
+// deploy that can fail at 09:00 rather than on the first customer request at
+// 09:04 should.
+//
+// THIS IS NOT OFFERED AS THE PRIMARY MECHANISM, and the reason is measured
+// rather than stylistic. Of the ten services that call neither
+// `applyAuthSchemaMigrations` nor `authSchemaHelpers`, SIX — billing, kyc,
+// notification, task-tracking, tenant and geo — have NO database step in
+// `deploy-dev.yml`. Wiring the fence exclusively into a deploy script would
+// leave those six permanently unchecked while reporting green, which is the
+// precise failure mode this release exists to end. So the CLI is the
+// belt-and-braces for pipelines that DO have a database step, and the runtime
+// gate is the floor for everyone.
+//
+// `install-fence` exists because the delivery unit has to be applicable to a
+// service that is on none of the library paths — one command, owner
+// credentials, no code change:
+//
+//     bunx @nodii/db-rls install-fence --db "$DATABASE_URL"
+import { SESSION_FENCE_BOOTSTRAP_SQL, SESSION_TENANT_IDS_GRANTS_SQL, } from "./auth-schema.js";
+import { TENANT_FENCE_GATE_GRANTS_SQL } from "./tenant-fence-gate.js";
+import { TenantFenceError, verifyTenantFence } from "./tenant-fence.js";
+function splitList(value) {
+    if (!value)
+        return [];
+    return value
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+function parse(args) {
+    const out = {
+        allowDegraded: true,
+        skipGrants: false,
+        help: false,
+    };
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--db" && i + 1 < args.length)
+            out.dbUrl = args[++i];
+        else if (a === "--schema" && i + 1 < args.length)
+            out.schema = args[++i];
+        else if (a === "--exempt-policies" && i + 1 < args.length)
+            out.exemptPolicies = args[++i];
+        else if (a === "--exempt-tables" && i + 1 < args.length)
+            out.exemptTables = args[++i];
+        // Default is to ACCEPT the degraded resolver: it is the D415-sanctioned
+        // terminal state for a service with no membership mirror, and a gate that
+        // is red on a legitimate configuration gets switched off. `--strict-only`
+        // is for a service that HAS a mirror and wants to prove it never silently
+        // regresses to fence-only.
+        else if (a === "--strict-only")
+            out.allowDegraded = false;
+        else if (a === "--skip-grants")
+            out.skipGrants = true;
+        else if (a === "--help" || a === "-h")
+            out.help = true;
+    }
+    return out;
+}
+function connectionString(parsed) {
+    return parsed.dbUrl ?? process.env.DATABASE_URL ?? process.env.DB_RLS_PG_URL;
+}
+/**
+ * `install-fence` — apply the delivery unit (resolver + gate).
+ *
+ * Idempotent and re-runnable. Must be run with OWNER credentials: it creates
+ * functions in the `auth` schema. Safe to run on every deploy; safe to run
+ * twice; and re-running is how a service that has since landed a membership
+ * mirror upgrades itself from the degraded body to the strict one.
+ */
+export async function runInstallFenceCli(args) {
+    const parsed = parse(args);
+    if (parsed.help)
+        return { code: 0, message: installUsage() };
+    const conn = connectionString(parsed);
+    if (!conn) {
+        return {
+            code: 2,
+            message: "install-fence: no connection string — pass --db <url> or set DATABASE_URL / DB_RLS_PG_URL.",
+        };
+    }
+    const { Pool } = await import("pg");
+    const pool = new Pool({ connectionString: conn, max: 1 });
+    try {
+        await pool.query(SESSION_FENCE_BOOTSTRAP_SQL);
+        if (!parsed.skipGrants) {
+            await pool.query(SESSION_TENANT_IDS_GRANTS_SQL);
+            await pool.query(TENANT_FENCE_GATE_GRANTS_SQL);
+        }
+        const { rows } = await pool.query(`SELECT prosrc FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'session_tenant_ids'`);
+        const body = rows[0]?.prosrc ?? "";
+        const variant = body.includes("DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR")
+            ? "DEGRADED (fence-only, D415) — auth.user_tenant_ids is absent or still the bootstrap stub"
+            : "STRICT — session tenant INTERSECT server-resolved membership";
+        return {
+            code: 0,
+            message: `install-fence: OK. auth.session_tenant_ids() installed as ${variant}\ninstall-fence: auth.assert_tenant_fence() installed.`,
+        };
+    }
+    catch (err) {
+        return { code: 2, message: `install-fence: ${err.message}` };
+    }
+    finally {
+        await pool.end().catch(() => { });
+    }
+}
+/**
+ * `verify-fence` — assert the fence from the CATALOG, using the TypeScript
+ * verifier (which reports EVERY offender at once rather than raising on the
+ * first, and covers the unique-index check the SQL gate leaves to deploy time).
+ */
+export async function runVerifyFenceCli(args) {
+    const parsed = parse(args);
+    if (parsed.help)
+        return { code: 0, message: verifyUsage() };
+    const conn = connectionString(parsed);
+    if (!conn) {
+        return {
+            code: 2,
+            message: "verify-fence: no connection string — pass --db <url> or set DATABASE_URL / DB_RLS_PG_URL.",
+        };
+    }
+    const { Pool } = await import("pg");
+    const pool = new Pool({ connectionString: conn, max: 1 });
+    try {
+        await verifyTenantFence(pool, {
+            schema: parsed.schema,
+            exemptPolicies: splitList(parsed.exemptPolicies),
+            exemptTables: splitList(parsed.exemptTables),
+            allowDegradedResolver: parsed.allowDegraded,
+        });
+        return {
+            code: 0,
+            message: "verify-fence: OK — every authenticated policy resolves through auth.session_tenant_ids(), every tenant-scoped relation is protected.",
+        };
+    }
+    catch (err) {
+        if (err instanceof TenantFenceError)
+            return { code: 1, message: err.message };
+        return { code: 2, message: `verify-fence: ${err.message}` };
+    }
+    finally {
+        await pool.end().catch(() => { });
+    }
+}
+function installUsage() {
+    return `usage: install-fence [--db <url>] [--skip-grants]
+
+Applies the tenant-fence delivery unit with OWNER credentials:
+  - auth.session_tenant_ids()  — the authenticated-pool resolver. The STRICT
+    body (session tenant INTERSECT membership) is installed where a real
+    auth.user_tenant_ids exists; the DEGRADED fence-only body (D415) where it
+    is absent or still the bootstrap stub. Derived from the catalog on every
+    run — there is no per-service list to get wrong, and re-running after a
+    membership mirror lands upgrades degraded to strict automatically.
+  - auth.assert_tenant_fence() — the runtime gate @nodii/db-rls calls on the
+    first authenticated-pool checkout.
+
+Idempotent. Safe on every deploy. Run BEFORE any migration that creates a
+policy referencing the resolver: Postgres validates the reference at CREATE
+POLICY time, so an absent resolver fails the migration with 42883.
+
+Connection string: --db <url>, else DATABASE_URL, else DB_RLS_PG_URL.`;
+}
+function verifyUsage() {
+    return `usage: verify-fence [--db <url>] [--schema <name>] [--strict-only]
+                    [--exempt-policies <a.b,c>] [--exempt-tables <x,y>]
+
+Asserts from the CATALOG that every permissive policy applying to the
+'authenticated' role resolves through auth.session_tenant_ids(), that every
+relation carrying a tenant column can enforce RLS, and that the resolver is
+installed, loud, and SECURITY DEFINER. Exits 1 (loud) listing every offender.
+
+Tables are DISCOVERED from the catalog, never supplied by the caller: the
+author who forgets ENABLE ROW LEVEL SECURITY forgets the list entry in the
+same migration, which is why a caller-supplied list is blind to exactly the
+tables at risk.
+
+--strict-only additionally rejects the DEGRADED fence-only resolver. The
+default accepts it: it is the D415-sanctioned terminal state for a service
+with no membership mirror.
+
+Connection string: --db <url>, else DATABASE_URL, else DB_RLS_PG_URL.`;
+}
+//# sourceMappingURL=fence-cli.js.map

package/dist/fence-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fence-cli.js","sourceRoot":"","sources":["../src/fence-cli.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,gBAAgB;AAChB,EAAE;AACF,2EAA2E;AAC3E,+DAA+D;AAC/D,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,qEAAqE;AACrE,8EAA8E;AAC9E,kCAAkC;AAClC,EAAE;AACF,6EAA6E;AAC7E,oEAAoE;AACpE,+BAA+B;AAC/B,EAAE;AACF,4DAA4D;AAE5D,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAQxE,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAYD,SAAS,KAAK,CAAC,IAAuB;IACpC,MAAM,GAAG,GAAe;QACtB,aAAa,EAAE,IAAI;QACnB,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC1D,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACpE,IAAI,CAAC,KAAK,mBAAmB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YACvD,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC5B,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YACrD,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,2BAA2B;aACtB,IAAI,CAAC,KAAK,eAAe;YAAE,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;aACrD,IAAI,CAAC,KAAK,eAAe;YAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;aACjD,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,OAAO,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB;IAEvB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC;IAE7D,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EACL,4FAA4F;SAC/F,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAChD,MAAM,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;sEACgE,CACjE,CAAC;QACF,MAAM,IAAI,GAAW,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YACnE,CAAC,CAAC,0FAA0F;YAC5F,CAAC,CAAC,8DAA8D,CAAC;QACnE,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,6DAA6D,OAAO,wDAAwD;SACtI,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC1E,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB;IAEvB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;IAE5D,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EACL,2FAA2F;SAC9F,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC;YAChD,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;YAC5C,qBAAqB,EAAE,MAAM,CAAC,aAAa;SAC5C,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EACL,sIAAsI;SACzI,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YACjC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACzE,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;;;;;;;;;;;;;;;;sEAgB6D,CAAC;AACvE,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;;;;;;;;;;;;;;;;;sEAiB6D,CAAC;AACvE,CAAC"}

package/dist/index.d.ts

@@ -11,8 +11,9 @@ export type { OwnerContextOpts } from "./migrate-guard.js";
 export { assertMigrateAllowed } from "./migrate-guard.js";
 export { RlsCoverageError, verifyRls } from "./verify-rls.js";
 export type { AnyRlsQuerier, ReferenceTablePredicate, RlsCoverageOffender, RlsQuerier, RlsQuerierPostgresJs, VerifyRlsOpts, } from "./verify-rls.js";
-export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, SESSION_TENANT_IDS_DEGRADED_MARKER, SESSION_TENANT_IDS_DEGRADED_SQL, SESSION_TENANT_IDS_GRANTS_SQL, SESSION_TENANT_IDS_SQL, } from "./auth-schema.js";
+export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, SESSION_TENANT_IDS_DEGRADED_MARKER, SESSION_TENANT_IDS_DEGRADED_SQL, SESSION_TENANT_IDS_GRANTS_SQL, SESSION_TENANT_IDS_SQL, applySessionFenceBootstrap, INSTALL_SESSION_RESOLVER_SQL, SESSION_FENCE_BOOTSTRAP_SQL, } from "./auth-schema.js";
 export type { SqlExecutor } from "./auth-schema.js";
+export { TENANT_FENCE_GATE_CALL_SQL, TENANT_FENCE_GATE_GRANTS_SQL, TENANT_FENCE_GATE_SQL, sessionFenceBootstrapSql, } from "./tenant-fence-gate.js";
 export { withRls, generateTableGrants, authenticatedPredicate, SESSION_TENANT_IDS_CALL, SESSION_TENANT_IDS_SUBQUERY, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, referenceTableGrantsSql, findTenantColumn, ReferenceTableTenantColumnError, REFERENCE_TABLE_SKIP_RLS_MARKER, } from "./rls-policy-gen.js";
 export type { RlsVerb, WithRlsOpts, AuthPoolMode, PlatformOpsVerb, PlatformOpsPerVerbPermissions, WithPlatformOpsSqlOpts, ReferenceTableReadRole, ReferenceTableSqlOpts, } from "./rls-policy-gen.js";
 export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, platformOpsPoliciesSql, referenceTablesSql, } from "./migrate-gen.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,QAAQ,WAAW,CAAC;AAejC,eAAO,MAAM,OAAO,EAAE,MAAoB,CAAC;AAE3C,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EAItB,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,cAAc,CAAC;AActB,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAkB1D,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9D,YAAY,EACV,aAAa,EACb,uBAAuB,EACvB,mBAAmB,EACnB,UAAU,EACV,oBAAoB,EACpB,aAAa,GACd,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,kCAAkC,EAClC,+BAA+B,EAC/B,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EACL,OAAO,EACP,mBAAmB,EAGnB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC,EAEnC,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,OAAO,EACP,WAAW,EAEX,YAAY,EACZ,eAAe,EACf,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,sBAAsB,EACtB,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,QAAQ,WAAW,CAAC;AAejC,eAAO,MAAM,OAAO,EAAE,MAAoB,CAAC;AAE3C,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EAItB,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,cAAc,CAAC;AActB,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAkB1D,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9D,YAAY,EACV,aAAa,EACb,uBAAuB,EACvB,mBAAmB,EACnB,UAAU,EACV,oBAAoB,EACpB,aAAa,GACd,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,kCAAkC,EAClC,+BAA+B,EAC/B,6BAA6B,EAC7B,sBAAsB,EAOtB,0BAA0B,EAC1B,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAKpD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,OAAO,EACP,mBAAmB,EAGnB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC,EAEnC,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,OAAO,EACP,WAAW,EAEX,YAAY,EACZ,eAAe,EACf,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,sBAAsB,EACtB,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -72,7 +72,18 @@ export { assertMigrateAllowed } from "./migrate-guard.js";
 // no `pg` installed) could not satisfy; that is why this had zero adoption
 // while five services hand-rolled the same pg_class query in their tests.
 export { RlsCoverageError, verifyRls } from "./verify-rls.js";
-export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, SESSION_TENANT_IDS_DEGRADED_MARKER, SESSION_TENANT_IDS_DEGRADED_SQL, SESSION_TENANT_IDS_GRANTS_SQL, SESSION_TENANT_IDS_SQL, } from "./auth-schema.js";
+export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, SESSION_TENANT_IDS_DEGRADED_MARKER, SESSION_TENANT_IDS_DEGRADED_SQL, SESSION_TENANT_IDS_GRANTS_SQL, SESSION_TENANT_IDS_SQL, 
+// THE DELIVERY PATH. `INSTALL_SESSION_RESOLVER_SQL` picks the strict or
+// degraded resolver body from what the database actually contains;
+// `SESSION_FENCE_BOOTSTRAP_SQL` is that plus the runtime gate, and
+// `applySessionFenceBootstrap` applies it. A service with no other delivery
+// path calls the last of these from its boot sequence, before anything opens
+// an authenticated transaction.
+applySessionFenceBootstrap, INSTALL_SESSION_RESOLVER_SQL, SESSION_FENCE_BOOTSTRAP_SQL, } from "./auth-schema.js";
+// The RUNTIME gate. `withUserContext` calls `auth.assert_tenant_fence()` once
+// per process on the first authenticated checkout — these are exported for the
+// CLI, for a bespoke `db:verify`, and so the wiring is greppable.
+export { TENANT_FENCE_GATE_CALL_SQL, TENANT_FENCE_GATE_GRANTS_SQL, TENANT_FENCE_GATE_SQL, sessionFenceBootstrapSql, } from "./tenant-fence-gate.js";
 export { withRls, generateTableGrants, 
 // 08-rls § 6 — the authenticated-pool predicate (single source of truth,
 // pool-mode aware). Exported so consumers can compose it directly.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,wDAAwD;AACxD,6CAA6C;AAC7C,EAAE;AACF,yCAAyC;AACzC,sEAAsE;AACtE,wCAAwC;AACxC,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,wEAAwE;AACxE,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,sCAAsC;AACtC,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,0EAA0E;AAC1E,qCAAqC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAEjC,yEAAyE;AACzE,4EAA4E;AAC5E,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,kEAAkE;AAClE,sEAAsE;AACtE,8BAA8B;AAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,iBAAiB,CAAwB,CAAC;AAC/D,MAAM,CAAC,MAAM,OAAO,GAAW,GAAG,CAAC,OAAO,CAAC;AAE3C,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB;AACtB,uEAAuE;AACvE,wEAAwE;AACxE,sCAAsC;AACtC,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,cAAc,CAAC;AAetB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,EAAE;AACF,uCAAuC;AACvC,sEAAsE;AACtE,qBAAqB;AACrB,wDAAwD;AACxD,yCAAyC;AACzC,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAU9D,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,kCAAkC,EAClC,+BAA+B,EAC/B,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,OAAO,EACP,mBAAmB;AACnB,yEAAyE;AACzE,mEAAmE;AACnE,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC;AACnC,2EAA2E;AAC3E,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAQ1B,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAepB,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,wDAAwD;AACxD,6CAA6C;AAC7C,EAAE;AACF,yCAAyC;AACzC,sEAAsE;AACtE,wCAAwC;AACxC,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,wEAAwE;AACxE,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,sCAAsC;AACtC,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,0EAA0E;AAC1E,qCAAqC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAEjC,yEAAyE;AACzE,4EAA4E;AAC5E,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,kEAAkE;AAClE,sEAAsE;AACtE,8BAA8B;AAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,iBAAiB,CAAwB,CAAC;AAC/D,MAAM,CAAC,MAAM,OAAO,GAAW,GAAG,CAAC,OAAO,CAAC;AAE3C,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB;AACtB,uEAAuE;AACvE,wEAAwE;AACxE,sCAAsC;AACtC,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,cAAc,CAAC;AAetB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,EAAE;AACF,uCAAuC;AACvC,sEAAsE;AACtE,qBAAqB;AACrB,wDAAwD;AACxD,yCAAyC;AACzC,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAU9D,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,kCAAkC,EAClC,+BAA+B,EAC/B,6BAA6B,EAC7B,sBAAsB;AACtB,wEAAwE;AACxE,mEAAmE;AACnE,mEAAmE;AACnE,4EAA4E;AAC5E,6EAA6E;AAC7E,gCAAgC;AAChC,0BAA0B,EAC1B,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAG1B,8EAA8E;AAC9E,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,OAAO,EACP,mBAAmB;AACnB,yEAAyE;AACzE,mEAAmE;AACnE,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC;AACnC,2EAA2E;AAC3E,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAQ1B,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAepB,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC"}

package/dist/tenant-fence-gate.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Installs `auth.assert_tenant_fence()`.
+ *
+ * The function RAISES `P0001` naming every offender when the fence is broken,
+ * and returns silently when it is intact. It is the runtime post-condition:
+ * cheap enough to run once per process, specific enough that the error text
+ * tells an on-call engineer what to fix.
+ *
+ * The rule is the POSITIVE one, identical to `classifyAuthPolicy`: every
+ * permissive policy applying to `authenticated` MUST resolve through
+ * `auth.session_tenant_ids()`. Absence of the bad shape is not presence of the
+ * good one — a policy mangled by a sweep into something that mentions neither
+ * helper is an offender, not a pass.
+ *
+ * Role resolution uses `pg_has_role(..., 'USAGE')` plus OID 0 for PUBLIC, for
+ * the same reason the TypeScript verifier does: a `{public}` policy applies to
+ * `authenticated` without containing the word, and role membership is
+ * transitive. A substring test over `pg_policies.roles` misses both, and each
+ * was proven to yield a live cross-tenant read AND write while the check
+ * reported zero offenders.
+ */
+export declare const TENANT_FENCE_GATE_SQL = "CREATE SCHEMA IF NOT EXISTS auth;\nCREATE OR REPLACE FUNCTION auth._fence_reason(p_expr text) RETURNS text\nLANGUAGE sql IMMUTABLE\nSET search_path = pg_catalog, public, pg_temp\nAS $reason$\n  SELECT CASE\n    WHEN p_expr ~* '(auth\\s*\\.\\s*)?user_tenant_ids\\s*\\('\n      THEN 'consults auth.user_tenant_ids directly instead of auth.session_tenant_ids() \u2014 resolves across EVERY tenant the principal belongs to'\n    WHEN p_expr IS NULL OR btrim(p_expr) = '' OR p_expr ~* '^\\(?\\s*true\\s*\\)?$'\n      THEN 'is permissive with no tenant reference at all \u2014 every tenant, every row'\n    ELSE 'does not resolve through auth.session_tenant_ids() \u2014 it may be fenced some other way, but nothing here proves it, and an unrecognized shape is not a safe shape'\n  END\n$reason$;\nCREATE OR REPLACE FUNCTION auth.assert_tenant_fence(\n  p_schemas text[] DEFAULT ARRAY['public'],\n  p_exempt_policies text[] DEFAULT ARRAY[]::text[],\n  p_exempt_tables text[] DEFAULT ARRAY[]::text[],\n  p_tenant_columns text[] DEFAULT ARRAY['tenant_id','org_id','organization_id'],\n  p_allow_degraded boolean DEFAULT true\n) RETURNS void\nLANGUAGE plpgsql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public, pg_temp\nAS $fence_check$\nDECLARE\n  v_offenders text[] := ARRAY[]::text[];\n  v_row record;\n  v_resolver record;\n  v_membership record;\n  v_degraded boolean := false;\nBEGIN\n  -- ---------------------------------------------------------------------\n  -- 1. The resolver itself. If it is missing, every policy referencing it is\n  --    already broken, and nothing below can be interpreted.\n  -- ---------------------------------------------------------------------\n  SELECT p.prosrc, p.prosecdef INTO v_resolver\n    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n   WHERE n.nspname = 'auth' AND p.proname = 'session_tenant_ids' LIMIT 1;\n\n  IF v_resolver IS NULL THEN\n    RAISE EXCEPTION 'tenant_fence: auth.session_tenant_ids() is not installed'\n      USING ERRCODE = 'P0001',\n            HINT = 'Apply INSTALL_SESSION_RESOLVER_SQL (applyAuthSchemaMigrations ships it, and @nodii/saga + @nodii/dsar + @nodii/audit-chain install it before their policies).';\n  END IF;\n\n  v_degraded := v_resolver.prosrc LIKE '%DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR%';\n\n  IF v_resolver.prosrc !~* 'RAISE\\s+EXCEPTION' THEN\n    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] does not RAISE on an unbound session \u2014 it was replaced with a NULL-returning getter, which restores silent failure';\n  END IF;\n\n  IF NOT v_resolver.prosecdef THEN\n    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] is not SECURITY DEFINER \u2014 it cannot read the membership mirror (permission denied), or will recurse into the mirror''s own policy (54001)';\n  END IF;\n\n  IF v_degraded AND NOT p_allow_degraded THEN\n    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] is the DEGRADED fence-only resolver \u2014 the session tenant is trusted WITHOUT proving membership';\n  END IF;\n\n  -- The stub check applies ONLY to the strict resolver. Under the degraded body\n  -- auth.user_tenant_ids is never consulted, so a stub there is the expected,\n  -- D415-sanctioned terminal state \u2014 not a defect. Flagging it would make every\n  -- legitimately-degraded service permanently red, which is how a gate gets\n  -- switched off.\n  IF NOT v_degraded THEN\n    SELECT p.prosrc INTO v_membership\n      FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n     WHERE n.nspname = 'auth' AND p.proname = 'user_tenant_ids' LIMIT 1;\n    IF v_membership IS NOT NULL\n       AND v_membership.prosrc ~* 'where\\s+false'\n       AND v_membership.prosrc !~* 'from\\s+\\w' THEN\n      v_offenders := v_offenders || 'auth.user_tenant_ids(uuid) [user_tenant_ids] is still the bootstrap stub returning the empty set \u2014 the strict resolver intersects to nothing, so the authenticated pool is silently deny-all';\n    END IF;\n  END IF;\n\n  -- ---------------------------------------------------------------------\n  -- 2. The positive rule over every authenticated-applicable policy.\n  -- ---------------------------------------------------------------------\n  FOR v_row IN\n    SELECT n.nspname AS schemaname,\n           c.relname  AS tablename,\n           pol.polname AS policyname,\n           CASE pol.polcmd WHEN 'r' THEN 'SELECT' WHEN 'a' THEN 'INSERT'\n                           WHEN 'w' THEN 'UPDATE' WHEN 'd' THEN 'DELETE'\n                           ELSE 'ALL' END AS cmd,\n           pg_get_expr(pol.polqual, pol.polrelid)      AS qual,\n           pg_get_expr(pol.polwithcheck, pol.polrelid) AS with_check\n      FROM pg_policy pol\n      JOIN pg_class c ON c.oid = pol.polrelid\n      JOIN pg_namespace n ON n.oid = c.relnamespace\n     WHERE n.nspname = ANY(p_schemas)\n       -- RESTRICTIVE policies are ANDed; they can only narrow access, so they\n       -- cannot be the source of a cross-tenant grant.\n       AND pol.polpermissive\n       AND (\n         EXISTS (SELECT 1 FROM unnest(pol.polroles) r WHERE r = 0)\n         OR (\n           EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')\n           AND EXISTS (\n             SELECT 1 FROM unnest(pol.polroles) r\n              WHERE pg_has_role('authenticated', r, 'USAGE')\n           )\n         )\n       )\n       AND NOT (pol.polname = ANY(p_exempt_policies))\n       AND NOT ((c.relname || '.' || pol.polname) = ANY(p_exempt_policies))\n       AND NOT (c.relname = ANY(p_exempt_tables))\n       AND NOT ((n.nspname || '.' || c.relname) = ANY(p_exempt_tables))\n     ORDER BY c.relname, pol.polname\n  LOOP\n    -- A policy with NEITHER clause is permissive-everything.\n    IF v_row.qual IS NULL AND v_row.with_check IS NULL THEN\n      v_offenders := v_offenders || format(\n        '%s.%s [%s %s] is permissive with no tenant reference at all \u2014 every tenant, every row',\n        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd);\n      CONTINUE;\n    END IF;\n\n    -- EVERY clause present must resolve. A fenced read with an unfenced\n    -- WITH CHECK is a cross-tenant WRITE, which is what the refund incident\n    -- actually exercised.\n    IF v_row.qual IS NOT NULL\n       AND v_row.qual !~* '(auth\\s*\\.\\s*)?session_tenant_ids\\s*\\(' THEN\n      v_offenders := v_offenders || format('%s.%s [%s %s USING] %s :: %s',\n        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd,\n        auth._fence_reason(v_row.qual), v_row.qual);\n    END IF;\n\n    IF v_row.with_check IS NOT NULL\n       AND v_row.with_check !~* '(auth\\s*\\.\\s*)?session_tenant_ids\\s*\\(' THEN\n      v_offenders := v_offenders || format('%s.%s [%s %s WITH CHECK] %s :: %s',\n        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd,\n        auth._fence_reason(v_row.with_check), v_row.with_check);\n    END IF;\n  END LOOP;\n\n  -- ---------------------------------------------------------------------\n  -- 3. Table coverage. THE HOLE A POLICY-LEVEL CHECK CANNOT SEE: a table with\n  --    a tenant column and RLS switched off has no rows in pg_policy to\n  --    inspect, and under the canonical blanket grants it is readable AND\n  --    writable across every tenant \u2014 strictly more open than the union\n  --    predicate this release removes.\n  --\n  --    Discovered FROM THE CATALOG, never from a caller-supplied list. The\n  --    author who forgets ENABLE ROW LEVEL SECURITY is the same author who\n  --    forgets the list entry, in the same migration.\n  -- ---------------------------------------------------------------------\n  FOR v_row IN\n    SELECT n.nspname AS schemaname, c.relname AS tablename,\n           c.relkind::text AS relkind, c.relrowsecurity,\n           COALESCE((SELECT true FROM unnest(COALESCE(c.reloptions,'{}')) o\n                      WHERE lower(replace(o,' ','')) = 'security_invoker=true'), false) AS security_invoker\n      FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace\n     WHERE c.relkind = ANY('{r,p,v,m,f}')\n       AND n.nspname = ANY(p_schemas)\n       AND NOT (c.relname = ANY(p_exempt_tables))\n       AND NOT ((n.nspname || '.' || c.relname) = ANY(p_exempt_tables))\n       AND EXISTS (SELECT 1 FROM pg_attribute a\n                    WHERE a.attrelid = c.oid AND a.attnum > 0\n                      AND NOT a.attisdropped AND a.attname = ANY(p_tenant_columns))\n     ORDER BY n.nspname, c.relname\n  LOOP\n    IF v_row.relkind IN ('v','m','f') THEN\n      -- A view with security_invoker=true executes as the CALLER, so the\n      -- underlying table's RLS applies and the view is genuinely safe.\n      IF v_row.relkind = 'v' AND v_row.security_invoker THEN CONTINUE; END IF;\n      v_offenders := v_offenders || format(\n        '%s.%s exposes a tenant column but cannot enforce RLS (relkind=%s) \u2014 a materialized/foreign relation has no row policies at all, and a view without security_invoker=true runs as its OWNER and bypasses the underlying table''s policies',\n        v_row.schemaname, v_row.tablename, v_row.relkind);\n    ELSIF NOT v_row.relrowsecurity THEN\n      v_offenders := v_offenders || format(\n        '%s.%s has a tenant column but ROW LEVEL SECURITY is NOT ENABLED \u2014 with the canonical blanket grants this table is readable and writable across EVERY tenant, and no policy is ever consulted',\n        v_row.schemaname, v_row.tablename);\n    END IF;\n  END LOOP;\n\n  IF array_length(v_offenders, 1) > 0 THEN\n    RAISE EXCEPTION 'tenant_fence: % authenticated-pool policy/helper defect(s). A user session must reach exactly ONE tenant \u2014 the one the edge resolved from the request \u2014 and nothing else, ever.%',\n      array_length(v_offenders, 1),\n      E'\\n  - ' || array_to_string(v_offenders, E'\\n  - ')\n      USING ERRCODE = 'P0001',\n            HINT = 'Regenerate policies with @nodii/db-rls withRls() / generateRlsPolicy(), which emit \"<col> IN (SELECT auth.session_tenant_ids())\". Nodii-staff cross-tenant access is a different path entirely: the platform_ops pool + withPlatformOpsContext.';\n  END IF;\nEND\n$fence_check$;\nGRANT EXECUTE ON FUNCTION auth._fence_reason(text) TO PUBLIC;\n";
+/** Grant for the gate. Split from the DDL for the same reason every other
+ *  grant in this package is: the roles must exist before the GRANT runs, and
+ *  on a fresh database they do not yet. */
+export declare const TENANT_FENCE_GATE_GRANTS_SQL = "GRANT EXECUTE ON FUNCTION auth.assert_tenant_fence(text[], text[], text[], text[], boolean) TO nodii_services, authenticated;\n";
+/** The statement `withUserContext` runs once per process on first authenticated
+ *  checkout. Kept as a named constant so the wiring is greppable from the call
+ *  site and the test-suite asserts the exact text. */
+export declare const TENANT_FENCE_GATE_CALL_SQL = "SELECT auth.assert_tenant_fence()";
+/**
+ * THE DELIVERY UNIT, whole: the resolver the policies reference, plus the gate
+ * that proves they reference it.
+ *
+ * These ship together because they fail together. A database with the resolver
+ * but no gate has a fence nobody checks; a database with the gate but no
+ * resolver cannot create the policies in the first place. Splitting them would
+ * create a state where a service is half-delivered and neither half complains,
+ * which is the condition this whole release exists to end.
+ *
+ * Every delivery path applies exactly this constant:
+ *   - `applyAuthSchemaMigrations` (@nodii/db-rls)
+ *   - `applySagaMigrations` (@nodii/saga)
+ *   - `applyDsarMigrations` (@nodii/dsar)
+ *   - `applyAuditChainMigrations` (@nodii/audit-chain)
+ *   - the `nodii-db-rls install-fence` CLI, for a service on none of the above
+ *
+ * The three mirrors inline a byte-equal copy rather than importing it, to
+ * preserve their deliberate zero-dependency posture on `@nodii/db-rls`. That
+ * duplication is guarded by a byte-equality test in each mirror's suite, not by
+ * a comment asking people to remember.
+ */
+export declare function sessionFenceBootstrapSql(installSql: string): string;
+//# sourceMappingURL=tenant-fence-gate.d.ts.map

package/dist/tenant-fence-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-fence-gate.d.ts","sourceRoot":"","sources":["../src/tenant-fence-gate.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qBAAqB,0hUAyLjC,CAAC;AAEF;;2CAE2C;AAC3C,eAAO,MAAM,4BAA4B,oIACxC,CAAC;AAEF;;sDAEsD;AACtD,eAAO,MAAM,0BAA0B,sCAAsC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnE"}

package/dist/tenant-fence-gate.js

@@ -0,0 +1,291 @@
+// The RUNTIME half of the fence gate: `auth.assert_tenant_fence()`.
+//
+// `verifyTenantFence` (tenant-fence.ts) is the deploy-time gate. It is
+// thorough, it reports every offender at once, and it is the right thing to run
+// in CI and in a `db:verify` step. It also cannot be the only gate, for a
+// reason that is structural rather than a matter of diligence:
+//
+//   SIX OF THE TEN SERVICES THIS RELEASE HAS TO REACH RUN NO DATABASE STEP ON
+//   DEPLOY AT ALL.
+//
+// That is measured, not assumed — `.github/workflows/deploy-dev.yml` in
+// billing, kyc, notification, task-tracking, tenant and geo contains no
+// `db:setup` and no `db:migrate`. Their `db:setup` exists, and it runs in
+// `ci.yml`, against a throwaway CI Postgres that is deleted minutes later. A
+// gate wired into `db:setup` would be green on every one of those services
+// forever while their real databases drifted, which is worse than no gate,
+// because it would be REPORTED as a pass.
+//
+// So the runtime gate has to live somewhere every service reaches without
+// anyone wiring it. There are only two such places: the library code a service
+// calls to get a connection, and the database itself. This module uses both —
+// a SECURITY DEFINER function in the database, invoked by `withUserContext` on
+// first use (context.ts).
+//
+// WHY A SQL FUNCTION RATHER THAN THE TYPESCRIPT VERIFIER.
+//
+// `PgTx.exec` returns `Promise<void>`. The pool abstraction in this library
+// deliberately yields no row-returning query surface, so a JavaScript catalog
+// scan cannot run on the pool a service already has — it needs a separate
+// `RlsQuerier` the caller supplies. "The caller supplies it" is precisely the
+// property that left `verifyRls` unwired in every repo for a year. A check
+// whose invocation depends on somebody passing something is a check that will
+// not run.
+//
+// A SECURITY DEFINER function has none of that dependency. It is installed by
+// the same delivery unit as the resolver, so a database that can evaluate the
+// fence predicate can always also evaluate the fence check. It is reachable
+// through `exec`. It works identically from the Go and Python ports, and from
+// psql during an incident. And because it is SECURITY DEFINER it can read
+// `pg_policy`, which `authenticated` cannot.
+//
+// TWO IMPLEMENTATIONS IS A REAL COST, AND IT IS PAID DELIBERATELY.
+//
+// This function and `verifyTenantFence` encode the same rule twice, which is
+// the duplication failure this codebase keeps being bitten by. The control is
+// not a comment asking people to keep them in step: `tests/fence-gate-agreement
+// .integration.test.ts` stands up each offending shape in a real database and
+// asserts BOTH implementations reach the same verdict on it. If one is fixed
+// and the other is not, that test goes red.
+/**
+ * Installs `auth.assert_tenant_fence()`.
+ *
+ * The function RAISES `P0001` naming every offender when the fence is broken,
+ * and returns silently when it is intact. It is the runtime post-condition:
+ * cheap enough to run once per process, specific enough that the error text
+ * tells an on-call engineer what to fix.
+ *
+ * The rule is the POSITIVE one, identical to `classifyAuthPolicy`: every
+ * permissive policy applying to `authenticated` MUST resolve through
+ * `auth.session_tenant_ids()`. Absence of the bad shape is not presence of the
+ * good one — a policy mangled by a sweep into something that mentions neither
+ * helper is an offender, not a pass.
+ *
+ * Role resolution uses `pg_has_role(..., 'USAGE')` plus OID 0 for PUBLIC, for
+ * the same reason the TypeScript verifier does: a `{public}` policy applies to
+ * `authenticated` without containing the word, and role membership is
+ * transitive. A substring test over `pg_policies.roles` misses both, and each
+ * was proven to yield a live cross-tenant read AND write while the check
+ * reported zero offenders.
+ */
+export const TENANT_FENCE_GATE_SQL = `CREATE SCHEMA IF NOT EXISTS auth;
+CREATE OR REPLACE FUNCTION auth._fence_reason(p_expr text) RETURNS text
+LANGUAGE sql IMMUTABLE
+SET search_path = pg_catalog, public, pg_temp
+AS $reason$
+  SELECT CASE
+    WHEN p_expr ~* '(auth\\s*\\.\\s*)?user_tenant_ids\\s*\\('
+      THEN 'consults auth.user_tenant_ids directly instead of auth.session_tenant_ids() — resolves across EVERY tenant the principal belongs to'
+    WHEN p_expr IS NULL OR btrim(p_expr) = '' OR p_expr ~* '^\\(?\\s*true\\s*\\)?$'
+      THEN 'is permissive with no tenant reference at all — every tenant, every row'
+    ELSE 'does not resolve through auth.session_tenant_ids() — it may be fenced some other way, but nothing here proves it, and an unrecognized shape is not a safe shape'
+  END
+$reason$;
+CREATE OR REPLACE FUNCTION auth.assert_tenant_fence(
+  p_schemas text[] DEFAULT ARRAY['public'],
+  p_exempt_policies text[] DEFAULT ARRAY[]::text[],
+  p_exempt_tables text[] DEFAULT ARRAY[]::text[],
+  p_tenant_columns text[] DEFAULT ARRAY['tenant_id','org_id','organization_id'],
+  p_allow_degraded boolean DEFAULT true
+) RETURNS void
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = pg_catalog, public, pg_temp
+AS $fence_check$
+DECLARE
+  v_offenders text[] := ARRAY[]::text[];
+  v_row record;
+  v_resolver record;
+  v_membership record;
+  v_degraded boolean := false;
+BEGIN
+  -- ---------------------------------------------------------------------
+  -- 1. The resolver itself. If it is missing, every policy referencing it is
+  --    already broken, and nothing below can be interpreted.
+  -- ---------------------------------------------------------------------
+  SELECT p.prosrc, p.prosecdef INTO v_resolver
+    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+   WHERE n.nspname = 'auth' AND p.proname = 'session_tenant_ids' LIMIT 1;
+
+  IF v_resolver IS NULL THEN
+    RAISE EXCEPTION 'tenant_fence: auth.session_tenant_ids() is not installed'
+      USING ERRCODE = 'P0001',
+            HINT = 'Apply INSTALL_SESSION_RESOLVER_SQL (applyAuthSchemaMigrations ships it, and @nodii/saga + @nodii/dsar + @nodii/audit-chain install it before their policies).';
+  END IF;
+
+  v_degraded := v_resolver.prosrc LIKE '%DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR%';
+
+  IF v_resolver.prosrc !~* 'RAISE\\s+EXCEPTION' THEN
+    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] does not RAISE on an unbound session — it was replaced with a NULL-returning getter, which restores silent failure';
+  END IF;
+
+  IF NOT v_resolver.prosecdef THEN
+    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] is not SECURITY DEFINER — it cannot read the membership mirror (permission denied), or will recurse into the mirror''s own policy (54001)';
+  END IF;
+
+  IF v_degraded AND NOT p_allow_degraded THEN
+    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] is the DEGRADED fence-only resolver — the session tenant is trusted WITHOUT proving membership';
+  END IF;
+
+  -- The stub check applies ONLY to the strict resolver. Under the degraded body
+  -- auth.user_tenant_ids is never consulted, so a stub there is the expected,
+  -- D415-sanctioned terminal state — not a defect. Flagging it would make every
+  -- legitimately-degraded service permanently red, which is how a gate gets
+  -- switched off.
+  IF NOT v_degraded THEN
+    SELECT p.prosrc INTO v_membership
+      FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+     WHERE n.nspname = 'auth' AND p.proname = 'user_tenant_ids' LIMIT 1;
+    IF v_membership IS NOT NULL
+       AND v_membership.prosrc ~* 'where\\s+false'
+       AND v_membership.prosrc !~* 'from\\s+\\w' THEN
+      v_offenders := v_offenders || 'auth.user_tenant_ids(uuid) [user_tenant_ids] is still the bootstrap stub returning the empty set — the strict resolver intersects to nothing, so the authenticated pool is silently deny-all';
+    END IF;
+  END IF;
+
+  -- ---------------------------------------------------------------------
+  -- 2. The positive rule over every authenticated-applicable policy.
+  -- ---------------------------------------------------------------------
+  FOR v_row IN
+    SELECT n.nspname AS schemaname,
+           c.relname  AS tablename,
+           pol.polname AS policyname,
+           CASE pol.polcmd WHEN 'r' THEN 'SELECT' WHEN 'a' THEN 'INSERT'
+                           WHEN 'w' THEN 'UPDATE' WHEN 'd' THEN 'DELETE'
+                           ELSE 'ALL' END AS cmd,
+           pg_get_expr(pol.polqual, pol.polrelid)      AS qual,
+           pg_get_expr(pol.polwithcheck, pol.polrelid) AS with_check
+      FROM pg_policy pol
+      JOIN pg_class c ON c.oid = pol.polrelid
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE n.nspname = ANY(p_schemas)
+       -- RESTRICTIVE policies are ANDed; they can only narrow access, so they
+       -- cannot be the source of a cross-tenant grant.
+       AND pol.polpermissive
+       AND (
+         EXISTS (SELECT 1 FROM unnest(pol.polroles) r WHERE r = 0)
+         OR (
+           EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
+           AND EXISTS (
+             SELECT 1 FROM unnest(pol.polroles) r
+              WHERE pg_has_role('authenticated', r, 'USAGE')
+           )
+         )
+       )
+       AND NOT (pol.polname = ANY(p_exempt_policies))
+       AND NOT ((c.relname || '.' || pol.polname) = ANY(p_exempt_policies))
+       AND NOT (c.relname = ANY(p_exempt_tables))
+       AND NOT ((n.nspname || '.' || c.relname) = ANY(p_exempt_tables))
+     ORDER BY c.relname, pol.polname
+  LOOP
+    -- A policy with NEITHER clause is permissive-everything.
+    IF v_row.qual IS NULL AND v_row.with_check IS NULL THEN
+      v_offenders := v_offenders || format(
+        '%s.%s [%s %s] is permissive with no tenant reference at all — every tenant, every row',
+        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd);
+      CONTINUE;
+    END IF;
+
+    -- EVERY clause present must resolve. A fenced read with an unfenced
+    -- WITH CHECK is a cross-tenant WRITE, which is what the refund incident
+    -- actually exercised.
+    IF v_row.qual IS NOT NULL
+       AND v_row.qual !~* '(auth\\s*\\.\\s*)?session_tenant_ids\\s*\\(' THEN
+      v_offenders := v_offenders || format('%s.%s [%s %s USING] %s :: %s',
+        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd,
+        auth._fence_reason(v_row.qual), v_row.qual);
+    END IF;
+
+    IF v_row.with_check IS NOT NULL
+       AND v_row.with_check !~* '(auth\\s*\\.\\s*)?session_tenant_ids\\s*\\(' THEN
+      v_offenders := v_offenders || format('%s.%s [%s %s WITH CHECK] %s :: %s',
+        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd,
+        auth._fence_reason(v_row.with_check), v_row.with_check);
+    END IF;
+  END LOOP;
+
+  -- ---------------------------------------------------------------------
+  -- 3. Table coverage. THE HOLE A POLICY-LEVEL CHECK CANNOT SEE: a table with
+  --    a tenant column and RLS switched off has no rows in pg_policy to
+  --    inspect, and under the canonical blanket grants it is readable AND
+  --    writable across every tenant — strictly more open than the union
+  --    predicate this release removes.
+  --
+  --    Discovered FROM THE CATALOG, never from a caller-supplied list. The
+  --    author who forgets ENABLE ROW LEVEL SECURITY is the same author who
+  --    forgets the list entry, in the same migration.
+  -- ---------------------------------------------------------------------
+  FOR v_row IN
+    SELECT n.nspname AS schemaname, c.relname AS tablename,
+           c.relkind::text AS relkind, c.relrowsecurity,
+           COALESCE((SELECT true FROM unnest(COALESCE(c.reloptions,'{}')) o
+                      WHERE lower(replace(o,' ','')) = 'security_invoker=true'), false) AS security_invoker
+      FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE c.relkind = ANY('{r,p,v,m,f}')
+       AND n.nspname = ANY(p_schemas)
+       AND NOT (c.relname = ANY(p_exempt_tables))
+       AND NOT ((n.nspname || '.' || c.relname) = ANY(p_exempt_tables))
+       AND EXISTS (SELECT 1 FROM pg_attribute a
+                    WHERE a.attrelid = c.oid AND a.attnum > 0
+                      AND NOT a.attisdropped AND a.attname = ANY(p_tenant_columns))
+     ORDER BY n.nspname, c.relname
+  LOOP
+    IF v_row.relkind IN ('v','m','f') THEN
+      -- A view with security_invoker=true executes as the CALLER, so the
+      -- underlying table's RLS applies and the view is genuinely safe.
+      IF v_row.relkind = 'v' AND v_row.security_invoker THEN CONTINUE; END IF;
+      v_offenders := v_offenders || format(
+        '%s.%s exposes a tenant column but cannot enforce RLS (relkind=%s) — a materialized/foreign relation has no row policies at all, and a view without security_invoker=true runs as its OWNER and bypasses the underlying table''s policies',
+        v_row.schemaname, v_row.tablename, v_row.relkind);
+    ELSIF NOT v_row.relrowsecurity THEN
+      v_offenders := v_offenders || format(
+        '%s.%s has a tenant column but ROW LEVEL SECURITY is NOT ENABLED — with the canonical blanket grants this table is readable and writable across EVERY tenant, and no policy is ever consulted',
+        v_row.schemaname, v_row.tablename);
+    END IF;
+  END LOOP;
+
+  IF array_length(v_offenders, 1) > 0 THEN
+    RAISE EXCEPTION 'tenant_fence: % authenticated-pool policy/helper defect(s). A user session must reach exactly ONE tenant — the one the edge resolved from the request — and nothing else, ever.%',
+      array_length(v_offenders, 1),
+      E'\\n  - ' || array_to_string(v_offenders, E'\\n  - ')
+      USING ERRCODE = 'P0001',
+            HINT = 'Regenerate policies with @nodii/db-rls withRls() / generateRlsPolicy(), which emit "<col> IN (SELECT auth.session_tenant_ids())". Nodii-staff cross-tenant access is a different path entirely: the platform_ops pool + withPlatformOpsContext.';
+  END IF;
+END
+$fence_check$;
+GRANT EXECUTE ON FUNCTION auth._fence_reason(text) TO PUBLIC;
+`;
+/** Grant for the gate. Split from the DDL for the same reason every other
+ *  grant in this package is: the roles must exist before the GRANT runs, and
+ *  on a fresh database they do not yet. */
+export const TENANT_FENCE_GATE_GRANTS_SQL = `GRANT EXECUTE ON FUNCTION auth.assert_tenant_fence(text[], text[], text[], text[], boolean) TO nodii_services, authenticated;
+`;
+/** The statement `withUserContext` runs once per process on first authenticated
+ *  checkout. Kept as a named constant so the wiring is greppable from the call
+ *  site and the test-suite asserts the exact text. */
+export const TENANT_FENCE_GATE_CALL_SQL = "SELECT auth.assert_tenant_fence()";
+/**
+ * THE DELIVERY UNIT, whole: the resolver the policies reference, plus the gate
+ * that proves they reference it.
+ *
+ * These ship together because they fail together. A database with the resolver
+ * but no gate has a fence nobody checks; a database with the gate but no
+ * resolver cannot create the policies in the first place. Splitting them would
+ * create a state where a service is half-delivered and neither half complains,
+ * which is the condition this whole release exists to end.
+ *
+ * Every delivery path applies exactly this constant:
+ *   - `applyAuthSchemaMigrations` (@nodii/db-rls)
+ *   - `applySagaMigrations` (@nodii/saga)
+ *   - `applyDsarMigrations` (@nodii/dsar)
+ *   - `applyAuditChainMigrations` (@nodii/audit-chain)
+ *   - the `nodii-db-rls install-fence` CLI, for a service on none of the above
+ *
+ * The three mirrors inline a byte-equal copy rather than importing it, to
+ * preserve their deliberate zero-dependency posture on `@nodii/db-rls`. That
+ * duplication is guarded by a byte-equality test in each mirror's suite, not by
+ * a comment asking people to remember.
+ */
+export function sessionFenceBootstrapSql(installSql) {
+    return `${installSql}${TENANT_FENCE_GATE_SQL}`;
+}
+//# sourceMappingURL=tenant-fence-gate.js.map

package/dist/tenant-fence-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-fence-gate.js","sourceRoot":"","sources":["../src/tenant-fence-gate.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,gFAAgF;AAChF,0EAA0E;AAC1E,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,mBAAmB;AACnB,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,0CAA0C;AAC1C,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,0BAA0B;AAC1B,EAAE;AACF,0DAA0D;AAC1D,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,WAAW;AACX,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,6CAA6C;AAC7C,EAAE;AACF,mEAAmE;AACnE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,4CAA4C;AAE5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyLpC,CAAC;AAEF;;2CAE2C;AAC3C,MAAM,CAAC,MAAM,4BAA4B,GAAG;CAC3C,CAAC;AAEF;;sDAEsD;AACtD,MAAM,CAAC,MAAM,0BAA0B,GAAG,mCAAmC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,GAAG,UAAU,GAAG,qBAAqB,EAAE,CAAC;AACjD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/db-rls",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
   "license": "MIT",
   "type": "module",
@@ -62,7 +62,7 @@
     }
   },
   "devDependencies": {
-    "@nodii/telemetry": "0.26.0",
+    "@nodii/telemetry": "0.27.0",
     "@types/bun": "^1.3.13",
     "@types/pg": "^8.11.10",
     "drizzle-orm": "^0.45.2",