@nodii/db-rls 0.12.0 → 0.14.0

package/dist/postgres-js-client.js

@@ -24,8 +24,9 @@
 // internally inside `sql.begin(...)`.
 import { sql as drizzleSql } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/postgres-js";
+import { assertNoTenantArgument, assertSystemContextEscapeAllowed, requireVerifiedTenantClaims, } from "./claims-context.js";
 import { requirePool } from "./init.js";
-import { emitSlowAcquireSpan, recordAcquisition, recordAcquisitionDuration, recordGucSetFailure, recordOwnerContextInvocation, recordTxDuration, withTxSpan, } from "./metrics.js";
+import { emitSlowAcquireSpan, recordAcquisition, recordAcquisitionDuration, recordCrossPoolNesting, recordGucSetFailure, recordOwnerContextInvocation, recordTxDuration, withTxSpan, } from "./metrics.js";
 import { assertMigrateAllowed, } from "./migrate-guard.js";
 import { MissingTenantContext, TransactionRolledBack, CrossTenantSessionRefused, } from "./types.js";
 /**
@@ -248,12 +249,19 @@ async function withPostgresJsTx(pool, setup, fn) {
  * postgres-js Drizzle variant of `withUserContext`. Opens a tx on the
  * `authenticated` pool, sets `app.user_id` + `app.tenant_id` via the
  * canonical `auth.init(...)` helper, yields a Drizzle client.
+ *
+ * BREAKING (unforgeable tenant binding): the tenant is NO LONGER an
+ * argument — it is read from the request's verified claims, bound once by
+ * auth middleware via `runWithVerifiedTenantClaims`. See
+ * {@link withUserContext} in `src/context.ts` for the full rationale.
+ * This is the fleet-default driver, so this is the variant most of the
+ * 271 call sites go through.
+ *
+ * Throws `NoVerifiedTenantClaims` if no claims are bound.
  */
-export async function withUserContextDbPostgresJs(opts, fn) {
-    if (!opts.userId)
-        throw new MissingTenantContext();
-    if (!opts.tenantId)
-        throw new MissingTenantContext();
+export async function withUserContextDbPostgresJs(fn) {
+    assertNoTenantArgument("withUserContextDbPostgresJs", fn);
+    const opts = requireVerifiedTenantClaims("withUserContextDbPostgresJs");
     const pool = requirePostgresJsPool("authenticated");
     return withPostgresJsTx(pool, async (db) => {
         await db.execute(drizzleSql `SELECT auth.init(${opts.userId}::uuid, ${opts.tenantId}::uuid)`);
@@ -272,7 +280,9 @@ export async function withUserContextDbPostgresJs(opts, fn) {
  * a legitimate tenant-A session transitioned a tenant-B approval task, got
  * HTTP 200, and released a 250,000 INR refund.
  *
- * Migrate to `withUserContextDbPostgresJs({ userId, tenantId }, fn)`.
+ * Migrate to `withUserContextDbPostgresJs(fn)` — the same pool, with the
+ * tenant the request's VERIFIED claims resolved to (bound by auth middleware
+ * via `runWithVerifiedTenantClaims`; it is no longer an argument).
  * To LIST a user's tenants (switcher / login picker), query
  * `auth.user_tenant_ids` from a services-pool context — that function is
  * intact; what is gone is opening a DATA session that spans them.
@@ -286,10 +296,23 @@ export async function withUserMembershipContextDbPostgresJs(_opts, _fn) {
 /**
  * postgres-js Drizzle variant of `withSystemContext`. Opens a tx on the
  * `services` pool with `app.tenant_id` GUC bound; yields a Drizzle client.
+ *
+ * Carries the STEP-1 FENCE: with verified claims bound
+ * (`hasVerifiedTenantClaims()` true) this throws
+ * `SystemContextUnderClaimsRefused` before touching a pool unless the
+ * caller passes an explicit non-blank `{ reason }` — the services-pool
+ * predicate is the bare `tenant_id = auth.get_tenant_id()` with no
+ * membership proof, the seam where the ₹250,000 cross-tenant refund
+ * reproduced. Unbound contexts (workers, cron, boot) are unchanged.
+ * See {@link withSystemContext} in `src/context.ts`.
  */
 export async function withSystemContextDbPostgresJs(opts, fn) {
     if (!opts.tenantId)
         throw new MissingTenantContext();
+    const sanctioned = assertSystemContextEscapeAllowed("withSystemContextDbPostgresJs", opts);
+    if (sanctioned) {
+        recordCrossPoolNesting("authenticated", "services", sanctioned.reason);
+    }
     const pool = requirePostgresJsPool("services");
     return withPostgresJsTx(pool, async (db) => {
         await db.execute(drizzleSql `SELECT auth.init_tenant(${opts.tenantId}::uuid)`);
@@ -365,6 +388,11 @@ function normalizeOwnerArgs(fnOrOpts, maybeFn) {
 // ergonomics gap 01371c61.
 export { _resetForTests, getDbRlsOrNull, initDbRls, requireDbRls, requirePool, } from "./init.js";
 export { assertMigrateAllowed } from "./migrate-guard.js";
+// Unforgeable tenant binding. `claims-context.ts` imports only
+// `node:async_hooks` + `./types.js`, so postgres-js-only services (the
+// fleet default — no `pg` installed) can bind verified claims in their auth
+// middleware without reaching for the pg-coupled entry points.
+export { assertNoTenantArgument, assertSystemContextEscapeAllowed, getVerifiedTenantClaimsOrNull, hasVerifiedTenantClaims, requireVerifiedTenantClaims, runWithVerifiedTenantClaims, } from "./claims-context.js";
 // DB_RLS_METRIC_VOCABULARY is a pure const (its module imports only
 // @nodii/telemetry + a type), so pg-free services can merge it into
 // initTelemetry({ vocabularyRegistry }) without pulling in `pg`. Without this
@@ -373,5 +401,5 @@ export { assertMigrateAllowed } from "./migrate-guard.js";
 // db-rls's own metrics swallowed as 'not_in_vocabulary' (request 95a860a1).
 export { DB_RLS_METRIC_VOCABULARY } from "./metrics.js";
 export { generateTableGrants, withRls } from "./rls-policy-gen.js";
-export { DbRlsConfigError, DbRlsError, DbRlsNotInitialized, MissingTenantContext, OwnerContextOutsideMigrate, PoolUnavailable, TransactionRolledBack, } from "./types.js";
+export { DbRlsConfigError, DbRlsError, DbRlsNotInitialized, InvalidVerifiedTenantClaims, MissingTenantContext, NoVerifiedTenantClaims, OwnerContextOutsideMigrate, PoolUnavailable, SystemContextUnderClaimsRefused, TenantArgumentRefused, TransactionRolledBack, VerifiedTenantClaimsAlreadyBound, } from "./types.js";
 //# sourceMappingURL=postgres-js-client.js.map

package/dist/postgres-js-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-js-client.js","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,+DAA+D;AAC/D,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,WAAW;AACX,0EAA0E;AAC1E,kEAAkE;AAClE,qBAAqB;AACrB,oEAAoE;AACpE,uEAAuE;AACvE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,gCAAgC;AAChC,2DAA2D;AAC3D,sCAAsC;AACtC,6CAA6C;AAC7C,qEAAqE;AACrE,sCAAsC;AAEtC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,OAAO,EAA2B,MAAM,yBAAyB,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EAKpB,qBAAqB,EAGrB,yBAAyB,GAE1B,MAAM,YAAY,CAAC;AAMpB;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,CAAW;IACP,GAAG,CAAM;IAC1B;gFAC4E;IACpE,SAAS,CAA6C;IAC7C,aAAa,CAAS;IACtB,aAAa,CAGnB;IACM,UAAU,CAIhB;IAEX,YAAY,IAUX;QACC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;qEACiE;IACjE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;wBAC3B,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,6DAA6D;gBAC7D,oDAAoD;gBACpD,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,EAAmD;QAEnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAClB,IAA8C,CAC/C,CAAC;wBACF,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,+CAA+C;gBAC/C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,YAAY;IACP,QAAQ,CAAW;IACnB,GAAG,CAAiB;IAE7B,YAAY,IAAc,EAAE,GAAmB;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,SAAS,qBAAqB,CAC5B,IAA6D;IAE7D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,YAAY,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wLAAwL,CACxM,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAsB,EACtB,KAA8D,EAC9D,EAAwD;IAExD,8EAA8E;IAC9E,wEAAwE;IACxE,sEAAsE;IACtE,OAAO,IAAI,CAAC,sBAAsB,CAAa,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAI/C,IAAqB,EACrB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACpD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oBAAoB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,QAAQ,SAAS,CAC3E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,sCAAsC,IAAI,CAAC,QAAQ,SAAS,CACvE,CAAC;QACJ,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAIzD,KAAgC,EAChC,GAAyD;IAEzD,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAIjD,IAAuB,EACvB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,2BAA2B,IAAI,CAAC,QAAQ,SAAS,CAC5D,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAItD,IAA4B,EAC5B,EAAwD;IAExD,MAAM,IAAI,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oCAAoC,IAAI,CAAC,MAAM,SAAS,CACnE,CAAC;QACF,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oDAAoD,IAAI,CAAC,SAAS,SAAS,CACtF,CAAC;QACF,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oDAAoD,IAAI,CAAC,UAAU,SAAS,CACvF,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAIhD,QAE0D,EAC1D,OAA8D;IAE9D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAa,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAa,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,QAE0D,EAC1D,OAA8D;IAK9D,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAID,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAC9E,2BAA2B;AAC3B,OAAO,EACL,cAAc,EACd,cAAc,EAEd,SAAS,EACT,YAAY,EACZ,WAAW,GAEZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,oEAAoE;AACpE,oEAAoE;AACpE,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"postgres-js-client.js","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,+DAA+D;AAC/D,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,WAAW;AACX,0EAA0E;AAC1E,kEAAkE;AAClE,qBAAqB;AACrB,oEAAoE;AACpE,uEAAuE;AACvE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,gCAAgC;AAChC,2DAA2D;AAC3D,sCAAsC;AACtC,6CAA6C;AAC7C,qEAAqE;AACrE,sCAAsC;AAEtC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,OAAO,EAA2B,MAAM,yBAAyB,CAAC;AAG3E,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EAKpB,qBAAqB,EAErB,yBAAyB,GAE1B,MAAM,YAAY,CAAC;AAMpB;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,CAAW;IACP,GAAG,CAAM;IAC1B;gFAC4E;IACpE,SAAS,CAA6C;IAC7C,aAAa,CAAS;IACtB,aAAa,CAGnB;IACM,UAAU,CAIhB;IAEX,YAAY,IAUX;QACC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;qEACiE;IACjE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;wBAC3B,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,6DAA6D;gBAC7D,oDAAoD;gBACpD,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,EAAmD;QAEnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAClB,IAA8C,CAC/C,CAAC;wBACF,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,+CAA+C;gBAC/C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,YAAY;IACP,QAAQ,CAAW;IACnB,GAAG,CAAiB;IAE7B,YAAY,IAAc,EAAE,GAAmB;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,SAAS,qBAAqB,CAC5B,IAA6D;IAE7D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,YAAY,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wLAAwL,CACxM,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAsB,EACtB,KAA8D,EAC9D,EAAwD;IAExD,8EAA8E;IAC9E,wEAAwE;IACxE,sEAAsE;IACtE,OAAO,IAAI,CAAC,sBAAsB,CAAa,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAG/C,EAAwD;IACxD,sBAAsB,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACpD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oBAAoB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,QAAQ,SAAS,CAC3E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,sCAAsC,IAAI,CAAC,QAAQ,SAAS,CACvE,CAAC;QACJ,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAIzD,KAAgC,EAChC,GAAyD;IAEzD,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAIjD,IAAuB,EACvB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,gCAAgC,CACjD,+BAA+B,EAC/B,IAAI,CACL,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,sBAAsB,CAAC,eAAe,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,2BAA2B,IAAI,CAAC,QAAQ,SAAS,CAC5D,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAItD,IAA4B,EAC5B,EAAwD;IAExD,MAAM,IAAI,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oCAAoC,IAAI,CAAC,MAAM,SAAS,CACnE,CAAC;QACF,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oDAAoD,IAAI,CAAC,SAAS,SAAS,CACtF,CAAC;QACF,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oDAAoD,IAAI,CAAC,UAAU,SAAS,CACvF,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAIhD,QAE0D,EAC1D,OAA8D;IAE9D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAa,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAa,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,QAE0D,EAC1D,OAA8D;IAK9D,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAID,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAC9E,2BAA2B;AAC3B,OAAO,EACL,cAAc,EACd,cAAc,EAEd,SAAS,EACT,YAAY,EACZ,WAAW,GAEZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,+DAA+D;AAC/D,uEAAuE;AACvE,4EAA4E;AAC5E,+DAA+D;AAC/D,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,6BAA6B,EAC7B,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,oEAAoE;AACpE,oEAAoE;AACpE,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,eAAe,EACf,+BAA+B,EAC/B,qBAAqB,EACrB,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,YAAY,CAAC"}

package/dist/tenant-fence-gate.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Installs `auth.assert_tenant_fence()`.
+ *
+ * The function RAISES `P0001` naming every offender when the fence is broken,
+ * and returns silently when it is intact. It is the runtime post-condition:
+ * cheap enough to run once per process, specific enough that the error text
+ * tells an on-call engineer what to fix.
+ *
+ * The rule is the POSITIVE one, identical to `classifyAuthPolicy`: every
+ * permissive policy applying to `authenticated` MUST resolve through
+ * `auth.session_tenant_ids()`. Absence of the bad shape is not presence of the
+ * good one — a policy mangled by a sweep into something that mentions neither
+ * helper is an offender, not a pass.
+ *
+ * Role resolution uses `pg_has_role(..., 'USAGE')` plus OID 0 for PUBLIC, for
+ * the same reason the TypeScript verifier does: a `{public}` policy applies to
+ * `authenticated` without containing the word, and role membership is
+ * transitive. A substring test over `pg_policies.roles` misses both, and each
+ * was proven to yield a live cross-tenant read AND write while the check
+ * reported zero offenders.
+ */
+export declare const TENANT_FENCE_GATE_SQL = "CREATE SCHEMA IF NOT EXISTS auth;\nCREATE OR REPLACE FUNCTION auth._fence_reason(p_expr text) RETURNS text\nLANGUAGE sql IMMUTABLE\nSET search_path = pg_catalog, public, pg_temp\nAS $reason$\n  SELECT CASE\n    WHEN p_expr ~* '(auth\\s*\\.\\s*)?user_tenant_ids\\s*\\('\n      THEN 'consults auth.user_tenant_ids directly instead of auth.session_tenant_ids() \u2014 resolves across EVERY tenant the principal belongs to'\n    WHEN p_expr IS NULL OR btrim(p_expr) = '' OR p_expr ~* '^\\(?\\s*true\\s*\\)?$'\n      THEN 'is permissive with no tenant reference at all \u2014 every tenant, every row'\n    ELSE 'does not resolve through auth.session_tenant_ids() \u2014 it may be fenced some other way, but nothing here proves it, and an unrecognized shape is not a safe shape'\n  END\n$reason$;\nCREATE OR REPLACE FUNCTION auth.assert_tenant_fence(\n  p_schemas text[] DEFAULT ARRAY['public'],\n  p_exempt_policies text[] DEFAULT ARRAY[]::text[],\n  p_exempt_tables text[] DEFAULT ARRAY[]::text[],\n  p_tenant_columns text[] DEFAULT ARRAY['tenant_id','org_id','organization_id'],\n  p_allow_degraded boolean DEFAULT true\n) RETURNS void\nLANGUAGE plpgsql STABLE SECURITY DEFINER\nSET search_path = pg_catalog, public, pg_temp\nAS $fence_check$\nDECLARE\n  v_offenders text[] := ARRAY[]::text[];\n  v_row record;\n  v_resolver record;\n  v_membership record;\n  v_degraded boolean := false;\nBEGIN\n  -- ---------------------------------------------------------------------\n  -- 1. The resolver itself. If it is missing, every policy referencing it is\n  --    already broken, and nothing below can be interpreted.\n  -- ---------------------------------------------------------------------\n  SELECT p.prosrc, p.prosecdef INTO v_resolver\n    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n   WHERE n.nspname = 'auth' AND p.proname = 'session_tenant_ids' LIMIT 1;\n\n  IF v_resolver IS NULL THEN\n    RAISE EXCEPTION 'tenant_fence: auth.session_tenant_ids() is not installed'\n      USING ERRCODE = 'P0001',\n            HINT = 'Apply INSTALL_SESSION_RESOLVER_SQL (applyAuthSchemaMigrations ships it, and @nodii/saga + @nodii/dsar + @nodii/audit-chain install it before their policies).';\n  END IF;\n\n  v_degraded := v_resolver.prosrc LIKE '%DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR%';\n\n  IF v_resolver.prosrc !~* 'RAISE\\s+EXCEPTION' THEN\n    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] does not RAISE on an unbound session \u2014 it was replaced with a NULL-returning getter, which restores silent failure';\n  END IF;\n\n  IF NOT v_resolver.prosecdef THEN\n    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] is not SECURITY DEFINER \u2014 it cannot read the membership mirror (permission denied), or will recurse into the mirror''s own policy (54001)';\n  END IF;\n\n  IF v_degraded AND NOT p_allow_degraded THEN\n    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] is the DEGRADED fence-only resolver \u2014 the session tenant is trusted WITHOUT proving membership';\n  END IF;\n\n  -- The stub check applies ONLY to the strict resolver. Under the degraded body\n  -- auth.user_tenant_ids is never consulted, so a stub there is the expected,\n  -- D415-sanctioned terminal state \u2014 not a defect. Flagging it would make every\n  -- legitimately-degraded service permanently red, which is how a gate gets\n  -- switched off.\n  IF NOT v_degraded THEN\n    SELECT p.prosrc INTO v_membership\n      FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace\n     WHERE n.nspname = 'auth' AND p.proname = 'user_tenant_ids' LIMIT 1;\n    IF v_membership IS NOT NULL\n       AND v_membership.prosrc ~* 'where\\s+false'\n       AND v_membership.prosrc !~* 'from\\s+\\w' THEN\n      v_offenders := v_offenders || 'auth.user_tenant_ids(uuid) [user_tenant_ids] is still the bootstrap stub returning the empty set \u2014 the strict resolver intersects to nothing, so the authenticated pool is silently deny-all';\n    END IF;\n  END IF;\n\n  -- ---------------------------------------------------------------------\n  -- 2. The positive rule over every authenticated-applicable policy.\n  -- ---------------------------------------------------------------------\n  FOR v_row IN\n    SELECT n.nspname AS schemaname,\n           c.relname  AS tablename,\n           pol.polname AS policyname,\n           CASE pol.polcmd WHEN 'r' THEN 'SELECT' WHEN 'a' THEN 'INSERT'\n                           WHEN 'w' THEN 'UPDATE' WHEN 'd' THEN 'DELETE'\n                           ELSE 'ALL' END AS cmd,\n           pg_get_expr(pol.polqual, pol.polrelid)      AS qual,\n           pg_get_expr(pol.polwithcheck, pol.polrelid) AS with_check\n      FROM pg_policy pol\n      JOIN pg_class c ON c.oid = pol.polrelid\n      JOIN pg_namespace n ON n.oid = c.relnamespace\n     WHERE n.nspname = ANY(p_schemas)\n       -- RESTRICTIVE policies are ANDed; they can only narrow access, so they\n       -- cannot be the source of a cross-tenant grant.\n       AND pol.polpermissive\n       AND (\n         EXISTS (SELECT 1 FROM unnest(pol.polroles) r WHERE r = 0)\n         OR (\n           EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')\n           AND EXISTS (\n             SELECT 1 FROM unnest(pol.polroles) r\n              WHERE pg_has_role('authenticated', r, 'USAGE')\n           )\n         )\n       )\n       AND NOT (pol.polname = ANY(p_exempt_policies))\n       AND NOT ((c.relname || '.' || pol.polname) = ANY(p_exempt_policies))\n       AND NOT (c.relname = ANY(p_exempt_tables))\n       AND NOT ((n.nspname || '.' || c.relname) = ANY(p_exempt_tables))\n     ORDER BY c.relname, pol.polname\n  LOOP\n    -- A policy with NEITHER clause is permissive-everything.\n    IF v_row.qual IS NULL AND v_row.with_check IS NULL THEN\n      v_offenders := v_offenders || format(\n        '%s.%s [%s %s] is permissive with no tenant reference at all \u2014 every tenant, every row',\n        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd);\n      CONTINUE;\n    END IF;\n\n    -- EVERY clause present must resolve. A fenced read with an unfenced\n    -- WITH CHECK is a cross-tenant WRITE, which is what the refund incident\n    -- actually exercised.\n    IF v_row.qual IS NOT NULL\n       AND v_row.qual !~* '(auth\\s*\\.\\s*)?session_tenant_ids\\s*\\(' THEN\n      v_offenders := v_offenders || format('%s.%s [%s %s USING] %s :: %s',\n        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd,\n        auth._fence_reason(v_row.qual), v_row.qual);\n    END IF;\n\n    IF v_row.with_check IS NOT NULL\n       AND v_row.with_check !~* '(auth\\s*\\.\\s*)?session_tenant_ids\\s*\\(' THEN\n      v_offenders := v_offenders || format('%s.%s [%s %s WITH CHECK] %s :: %s',\n        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd,\n        auth._fence_reason(v_row.with_check), v_row.with_check);\n    END IF;\n  END LOOP;\n\n  -- ---------------------------------------------------------------------\n  -- 3. Table coverage. THE HOLE A POLICY-LEVEL CHECK CANNOT SEE: a table with\n  --    a tenant column and RLS switched off has no rows in pg_policy to\n  --    inspect, and under the canonical blanket grants it is readable AND\n  --    writable across every tenant \u2014 strictly more open than the union\n  --    predicate this release removes.\n  --\n  --    Discovered FROM THE CATALOG, never from a caller-supplied list. The\n  --    author who forgets ENABLE ROW LEVEL SECURITY is the same author who\n  --    forgets the list entry, in the same migration.\n  -- ---------------------------------------------------------------------\n  FOR v_row IN\n    SELECT n.nspname AS schemaname, c.relname AS tablename,\n           c.relkind::text AS relkind, c.relrowsecurity,\n           COALESCE((SELECT true FROM unnest(COALESCE(c.reloptions,'{}')) o\n                      WHERE lower(replace(o,' ','')) = 'security_invoker=true'), false) AS security_invoker\n      FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace\n     WHERE c.relkind = ANY('{r,p,v,m,f}')\n       AND n.nspname = ANY(p_schemas)\n       AND NOT (c.relname = ANY(p_exempt_tables))\n       AND NOT ((n.nspname || '.' || c.relname) = ANY(p_exempt_tables))\n       AND EXISTS (SELECT 1 FROM pg_attribute a\n                    WHERE a.attrelid = c.oid AND a.attnum > 0\n                      AND NOT a.attisdropped AND a.attname = ANY(p_tenant_columns))\n     ORDER BY n.nspname, c.relname\n  LOOP\n    IF v_row.relkind IN ('v','m','f') THEN\n      -- A view with security_invoker=true executes as the CALLER, so the\n      -- underlying table's RLS applies and the view is genuinely safe.\n      IF v_row.relkind = 'v' AND v_row.security_invoker THEN CONTINUE; END IF;\n      v_offenders := v_offenders || format(\n        '%s.%s exposes a tenant column but cannot enforce RLS (relkind=%s) \u2014 a materialized/foreign relation has no row policies at all, and a view without security_invoker=true runs as its OWNER and bypasses the underlying table''s policies',\n        v_row.schemaname, v_row.tablename, v_row.relkind);\n    ELSIF NOT v_row.relrowsecurity THEN\n      v_offenders := v_offenders || format(\n        '%s.%s has a tenant column but ROW LEVEL SECURITY is NOT ENABLED \u2014 with the canonical blanket grants this table is readable and writable across EVERY tenant, and no policy is ever consulted',\n        v_row.schemaname, v_row.tablename);\n    END IF;\n  END LOOP;\n\n  IF array_length(v_offenders, 1) > 0 THEN\n    RAISE EXCEPTION 'tenant_fence: % authenticated-pool policy/helper defect(s). A user session must reach exactly ONE tenant \u2014 the one the edge resolved from the request \u2014 and nothing else, ever.%',\n      array_length(v_offenders, 1),\n      E'\\n  - ' || array_to_string(v_offenders, E'\\n  - ')\n      USING ERRCODE = 'P0001',\n            HINT = 'Regenerate policies with @nodii/db-rls withRls() / generateRlsPolicy(), which emit \"<col> IN (SELECT auth.session_tenant_ids())\". Nodii-staff cross-tenant access is a different path entirely: the platform_ops pool + withPlatformOpsContext.';\n  END IF;\nEND\n$fence_check$;\nGRANT EXECUTE ON FUNCTION auth._fence_reason(text) TO PUBLIC;\n";
+/** Grant for the gate. Split from the DDL for the same reason every other
+ *  grant in this package is: the roles must exist before the GRANT runs, and
+ *  on a fresh database they do not yet. */
+export declare const TENANT_FENCE_GATE_GRANTS_SQL = "GRANT EXECUTE ON FUNCTION auth.assert_tenant_fence(text[], text[], text[], text[], boolean) TO nodii_services, authenticated;\n";
+/** The statement `withUserContext` runs once per process on first authenticated
+ *  checkout. Kept as a named constant so the wiring is greppable from the call
+ *  site and the test-suite asserts the exact text. */
+export declare const TENANT_FENCE_GATE_CALL_SQL = "SELECT auth.assert_tenant_fence()";
+/**
+ * THE DELIVERY UNIT, whole: the resolver the policies reference, plus the gate
+ * that proves they reference it.
+ *
+ * These ship together because they fail together. A database with the resolver
+ * but no gate has a fence nobody checks; a database with the gate but no
+ * resolver cannot create the policies in the first place. Splitting them would
+ * create a state where a service is half-delivered and neither half complains,
+ * which is the condition this whole release exists to end.
+ *
+ * Every delivery path applies exactly this constant:
+ *   - `applyAuthSchemaMigrations` (@nodii/db-rls)
+ *   - `applySagaMigrations` (@nodii/saga)
+ *   - `applyDsarMigrations` (@nodii/dsar)
+ *   - `applyAuditChainMigrations` (@nodii/audit-chain)
+ *   - the `nodii-db-rls install-fence` CLI, for a service on none of the above
+ *
+ * The three mirrors inline a byte-equal copy rather than importing it, to
+ * preserve their deliberate zero-dependency posture on `@nodii/db-rls`. That
+ * duplication is guarded by a byte-equality test in each mirror's suite, not by
+ * a comment asking people to remember.
+ */
+export declare function sessionFenceBootstrapSql(installSql: string): string;
+//# sourceMappingURL=tenant-fence-gate.d.ts.map

package/dist/tenant-fence-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-fence-gate.d.ts","sourceRoot":"","sources":["../src/tenant-fence-gate.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qBAAqB,0hUAyLjC,CAAC;AAEF;;2CAE2C;AAC3C,eAAO,MAAM,4BAA4B,oIACxC,CAAC;AAEF;;sDAEsD;AACtD,eAAO,MAAM,0BAA0B,sCAAsC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnE"}

package/dist/tenant-fence-gate.js

@@ -0,0 +1,291 @@
+// The RUNTIME half of the fence gate: `auth.assert_tenant_fence()`.
+//
+// `verifyTenantFence` (tenant-fence.ts) is the deploy-time gate. It is
+// thorough, it reports every offender at once, and it is the right thing to run
+// in CI and in a `db:verify` step. It also cannot be the only gate, for a
+// reason that is structural rather than a matter of diligence:
+//
+//   SIX OF THE TEN SERVICES THIS RELEASE HAS TO REACH RUN NO DATABASE STEP ON
+//   DEPLOY AT ALL.
+//
+// That is measured, not assumed — `.github/workflows/deploy-dev.yml` in
+// billing, kyc, notification, task-tracking, tenant and geo contains no
+// `db:setup` and no `db:migrate`. Their `db:setup` exists, and it runs in
+// `ci.yml`, against a throwaway CI Postgres that is deleted minutes later. A
+// gate wired into `db:setup` would be green on every one of those services
+// forever while their real databases drifted, which is worse than no gate,
+// because it would be REPORTED as a pass.
+//
+// So the runtime gate has to live somewhere every service reaches without
+// anyone wiring it. There are only two such places: the library code a service
+// calls to get a connection, and the database itself. This module uses both —
+// a SECURITY DEFINER function in the database, invoked by `withUserContext` on
+// first use (context.ts).
+//
+// WHY A SQL FUNCTION RATHER THAN THE TYPESCRIPT VERIFIER.
+//
+// `PgTx.exec` returns `Promise<void>`. The pool abstraction in this library
+// deliberately yields no row-returning query surface, so a JavaScript catalog
+// scan cannot run on the pool a service already has — it needs a separate
+// `RlsQuerier` the caller supplies. "The caller supplies it" is precisely the
+// property that left `verifyRls` unwired in every repo for a year. A check
+// whose invocation depends on somebody passing something is a check that will
+// not run.
+//
+// A SECURITY DEFINER function has none of that dependency. It is installed by
+// the same delivery unit as the resolver, so a database that can evaluate the
+// fence predicate can always also evaluate the fence check. It is reachable
+// through `exec`. It works identically from the Go and Python ports, and from
+// psql during an incident. And because it is SECURITY DEFINER it can read
+// `pg_policy`, which `authenticated` cannot.
+//
+// TWO IMPLEMENTATIONS IS A REAL COST, AND IT IS PAID DELIBERATELY.
+//
+// This function and `verifyTenantFence` encode the same rule twice, which is
+// the duplication failure this codebase keeps being bitten by. The control is
+// not a comment asking people to keep them in step: `tests/fence-gate-agreement
+// .integration.test.ts` stands up each offending shape in a real database and
+// asserts BOTH implementations reach the same verdict on it. If one is fixed
+// and the other is not, that test goes red.
+/**
+ * Installs `auth.assert_tenant_fence()`.
+ *
+ * The function RAISES `P0001` naming every offender when the fence is broken,
+ * and returns silently when it is intact. It is the runtime post-condition:
+ * cheap enough to run once per process, specific enough that the error text
+ * tells an on-call engineer what to fix.
+ *
+ * The rule is the POSITIVE one, identical to `classifyAuthPolicy`: every
+ * permissive policy applying to `authenticated` MUST resolve through
+ * `auth.session_tenant_ids()`. Absence of the bad shape is not presence of the
+ * good one — a policy mangled by a sweep into something that mentions neither
+ * helper is an offender, not a pass.
+ *
+ * Role resolution uses `pg_has_role(..., 'USAGE')` plus OID 0 for PUBLIC, for
+ * the same reason the TypeScript verifier does: a `{public}` policy applies to
+ * `authenticated` without containing the word, and role membership is
+ * transitive. A substring test over `pg_policies.roles` misses both, and each
+ * was proven to yield a live cross-tenant read AND write while the check
+ * reported zero offenders.
+ */
+export const TENANT_FENCE_GATE_SQL = `CREATE SCHEMA IF NOT EXISTS auth;
+CREATE OR REPLACE FUNCTION auth._fence_reason(p_expr text) RETURNS text
+LANGUAGE sql IMMUTABLE
+SET search_path = pg_catalog, public, pg_temp
+AS $reason$
+  SELECT CASE
+    WHEN p_expr ~* '(auth\\s*\\.\\s*)?user_tenant_ids\\s*\\('
+      THEN 'consults auth.user_tenant_ids directly instead of auth.session_tenant_ids() — resolves across EVERY tenant the principal belongs to'
+    WHEN p_expr IS NULL OR btrim(p_expr) = '' OR p_expr ~* '^\\(?\\s*true\\s*\\)?$'
+      THEN 'is permissive with no tenant reference at all — every tenant, every row'
+    ELSE 'does not resolve through auth.session_tenant_ids() — it may be fenced some other way, but nothing here proves it, and an unrecognized shape is not a safe shape'
+  END
+$reason$;
+CREATE OR REPLACE FUNCTION auth.assert_tenant_fence(
+  p_schemas text[] DEFAULT ARRAY['public'],
+  p_exempt_policies text[] DEFAULT ARRAY[]::text[],
+  p_exempt_tables text[] DEFAULT ARRAY[]::text[],
+  p_tenant_columns text[] DEFAULT ARRAY['tenant_id','org_id','organization_id'],
+  p_allow_degraded boolean DEFAULT true
+) RETURNS void
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = pg_catalog, public, pg_temp
+AS $fence_check$
+DECLARE
+  v_offenders text[] := ARRAY[]::text[];
+  v_row record;
+  v_resolver record;
+  v_membership record;
+  v_degraded boolean := false;
+BEGIN
+  -- ---------------------------------------------------------------------
+  -- 1. The resolver itself. If it is missing, every policy referencing it is
+  --    already broken, and nothing below can be interpreted.
+  -- ---------------------------------------------------------------------
+  SELECT p.prosrc, p.prosecdef INTO v_resolver
+    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+   WHERE n.nspname = 'auth' AND p.proname = 'session_tenant_ids' LIMIT 1;
+
+  IF v_resolver IS NULL THEN
+    RAISE EXCEPTION 'tenant_fence: auth.session_tenant_ids() is not installed'
+      USING ERRCODE = 'P0001',
+            HINT = 'Apply INSTALL_SESSION_RESOLVER_SQL (applyAuthSchemaMigrations ships it, and @nodii/saga + @nodii/dsar + @nodii/audit-chain install it before their policies).';
+  END IF;
+
+  v_degraded := v_resolver.prosrc LIKE '%DB_RLS_DEGRADED_NO_MEMBERSHIP_MIRROR%';
+
+  IF v_resolver.prosrc !~* 'RAISE\\s+EXCEPTION' THEN
+    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] does not RAISE on an unbound session — it was replaced with a NULL-returning getter, which restores silent failure';
+  END IF;
+
+  IF NOT v_resolver.prosecdef THEN
+    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] is not SECURITY DEFINER — it cannot read the membership mirror (permission denied), or will recurse into the mirror''s own policy (54001)';
+  END IF;
+
+  IF v_degraded AND NOT p_allow_degraded THEN
+    v_offenders := v_offenders || 'auth.session_tenant_ids() [session_tenant_ids] is the DEGRADED fence-only resolver — the session tenant is trusted WITHOUT proving membership';
+  END IF;
+
+  -- The stub check applies ONLY to the strict resolver. Under the degraded body
+  -- auth.user_tenant_ids is never consulted, so a stub there is the expected,
+  -- D415-sanctioned terminal state — not a defect. Flagging it would make every
+  -- legitimately-degraded service permanently red, which is how a gate gets
+  -- switched off.
+  IF NOT v_degraded THEN
+    SELECT p.prosrc INTO v_membership
+      FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+     WHERE n.nspname = 'auth' AND p.proname = 'user_tenant_ids' LIMIT 1;
+    IF v_membership IS NOT NULL
+       AND v_membership.prosrc ~* 'where\\s+false'
+       AND v_membership.prosrc !~* 'from\\s+\\w' THEN
+      v_offenders := v_offenders || 'auth.user_tenant_ids(uuid) [user_tenant_ids] is still the bootstrap stub returning the empty set — the strict resolver intersects to nothing, so the authenticated pool is silently deny-all';
+    END IF;
+  END IF;
+
+  -- ---------------------------------------------------------------------
+  -- 2. The positive rule over every authenticated-applicable policy.
+  -- ---------------------------------------------------------------------
+  FOR v_row IN
+    SELECT n.nspname AS schemaname,
+           c.relname  AS tablename,
+           pol.polname AS policyname,
+           CASE pol.polcmd WHEN 'r' THEN 'SELECT' WHEN 'a' THEN 'INSERT'
+                           WHEN 'w' THEN 'UPDATE' WHEN 'd' THEN 'DELETE'
+                           ELSE 'ALL' END AS cmd,
+           pg_get_expr(pol.polqual, pol.polrelid)      AS qual,
+           pg_get_expr(pol.polwithcheck, pol.polrelid) AS with_check
+      FROM pg_policy pol
+      JOIN pg_class c ON c.oid = pol.polrelid
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE n.nspname = ANY(p_schemas)
+       -- RESTRICTIVE policies are ANDed; they can only narrow access, so they
+       -- cannot be the source of a cross-tenant grant.
+       AND pol.polpermissive
+       AND (
+         EXISTS (SELECT 1 FROM unnest(pol.polroles) r WHERE r = 0)
+         OR (
+           EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
+           AND EXISTS (
+             SELECT 1 FROM unnest(pol.polroles) r
+              WHERE pg_has_role('authenticated', r, 'USAGE')
+           )
+         )
+       )
+       AND NOT (pol.polname = ANY(p_exempt_policies))
+       AND NOT ((c.relname || '.' || pol.polname) = ANY(p_exempt_policies))
+       AND NOT (c.relname = ANY(p_exempt_tables))
+       AND NOT ((n.nspname || '.' || c.relname) = ANY(p_exempt_tables))
+     ORDER BY c.relname, pol.polname
+  LOOP
+    -- A policy with NEITHER clause is permissive-everything.
+    IF v_row.qual IS NULL AND v_row.with_check IS NULL THEN
+      v_offenders := v_offenders || format(
+        '%s.%s [%s %s] is permissive with no tenant reference at all — every tenant, every row',
+        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd);
+      CONTINUE;
+    END IF;
+
+    -- EVERY clause present must resolve. A fenced read with an unfenced
+    -- WITH CHECK is a cross-tenant WRITE, which is what the refund incident
+    -- actually exercised.
+    IF v_row.qual IS NOT NULL
+       AND v_row.qual !~* '(auth\\s*\\.\\s*)?session_tenant_ids\\s*\\(' THEN
+      v_offenders := v_offenders || format('%s.%s [%s %s USING] %s :: %s',
+        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd,
+        auth._fence_reason(v_row.qual), v_row.qual);
+    END IF;
+
+    IF v_row.with_check IS NOT NULL
+       AND v_row.with_check !~* '(auth\\s*\\.\\s*)?session_tenant_ids\\s*\\(' THEN
+      v_offenders := v_offenders || format('%s.%s [%s %s WITH CHECK] %s :: %s',
+        v_row.schemaname, v_row.tablename, v_row.policyname, v_row.cmd,
+        auth._fence_reason(v_row.with_check), v_row.with_check);
+    END IF;
+  END LOOP;
+
+  -- ---------------------------------------------------------------------
+  -- 3. Table coverage. THE HOLE A POLICY-LEVEL CHECK CANNOT SEE: a table with
+  --    a tenant column and RLS switched off has no rows in pg_policy to
+  --    inspect, and under the canonical blanket grants it is readable AND
+  --    writable across every tenant — strictly more open than the union
+  --    predicate this release removes.
+  --
+  --    Discovered FROM THE CATALOG, never from a caller-supplied list. The
+  --    author who forgets ENABLE ROW LEVEL SECURITY is the same author who
+  --    forgets the list entry, in the same migration.
+  -- ---------------------------------------------------------------------
+  FOR v_row IN
+    SELECT n.nspname AS schemaname, c.relname AS tablename,
+           c.relkind::text AS relkind, c.relrowsecurity,
+           COALESCE((SELECT true FROM unnest(COALESCE(c.reloptions,'{}')) o
+                      WHERE lower(replace(o,' ','')) = 'security_invoker=true'), false) AS security_invoker
+      FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE c.relkind = ANY('{r,p,v,m,f}')
+       AND n.nspname = ANY(p_schemas)
+       AND NOT (c.relname = ANY(p_exempt_tables))
+       AND NOT ((n.nspname || '.' || c.relname) = ANY(p_exempt_tables))
+       AND EXISTS (SELECT 1 FROM pg_attribute a
+                    WHERE a.attrelid = c.oid AND a.attnum > 0
+                      AND NOT a.attisdropped AND a.attname = ANY(p_tenant_columns))
+     ORDER BY n.nspname, c.relname
+  LOOP
+    IF v_row.relkind IN ('v','m','f') THEN
+      -- A view with security_invoker=true executes as the CALLER, so the
+      -- underlying table's RLS applies and the view is genuinely safe.
+      IF v_row.relkind = 'v' AND v_row.security_invoker THEN CONTINUE; END IF;
+      v_offenders := v_offenders || format(
+        '%s.%s exposes a tenant column but cannot enforce RLS (relkind=%s) — a materialized/foreign relation has no row policies at all, and a view without security_invoker=true runs as its OWNER and bypasses the underlying table''s policies',
+        v_row.schemaname, v_row.tablename, v_row.relkind);
+    ELSIF NOT v_row.relrowsecurity THEN
+      v_offenders := v_offenders || format(
+        '%s.%s has a tenant column but ROW LEVEL SECURITY is NOT ENABLED — with the canonical blanket grants this table is readable and writable across EVERY tenant, and no policy is ever consulted',
+        v_row.schemaname, v_row.tablename);
+    END IF;
+  END LOOP;
+
+  IF array_length(v_offenders, 1) > 0 THEN
+    RAISE EXCEPTION 'tenant_fence: % authenticated-pool policy/helper defect(s). A user session must reach exactly ONE tenant — the one the edge resolved from the request — and nothing else, ever.%',
+      array_length(v_offenders, 1),
+      E'\\n  - ' || array_to_string(v_offenders, E'\\n  - ')
+      USING ERRCODE = 'P0001',
+            HINT = 'Regenerate policies with @nodii/db-rls withRls() / generateRlsPolicy(), which emit "<col> IN (SELECT auth.session_tenant_ids())". Nodii-staff cross-tenant access is a different path entirely: the platform_ops pool + withPlatformOpsContext.';
+  END IF;
+END
+$fence_check$;
+GRANT EXECUTE ON FUNCTION auth._fence_reason(text) TO PUBLIC;
+`;
+/** Grant for the gate. Split from the DDL for the same reason every other
+ *  grant in this package is: the roles must exist before the GRANT runs, and
+ *  on a fresh database they do not yet. */
+export const TENANT_FENCE_GATE_GRANTS_SQL = `GRANT EXECUTE ON FUNCTION auth.assert_tenant_fence(text[], text[], text[], text[], boolean) TO nodii_services, authenticated;
+`;
+/** The statement `withUserContext` runs once per process on first authenticated
+ *  checkout. Kept as a named constant so the wiring is greppable from the call
+ *  site and the test-suite asserts the exact text. */
+export const TENANT_FENCE_GATE_CALL_SQL = "SELECT auth.assert_tenant_fence()";
+/**
+ * THE DELIVERY UNIT, whole: the resolver the policies reference, plus the gate
+ * that proves they reference it.
+ *
+ * These ship together because they fail together. A database with the resolver
+ * but no gate has a fence nobody checks; a database with the gate but no
+ * resolver cannot create the policies in the first place. Splitting them would
+ * create a state where a service is half-delivered and neither half complains,
+ * which is the condition this whole release exists to end.
+ *
+ * Every delivery path applies exactly this constant:
+ *   - `applyAuthSchemaMigrations` (@nodii/db-rls)
+ *   - `applySagaMigrations` (@nodii/saga)
+ *   - `applyDsarMigrations` (@nodii/dsar)
+ *   - `applyAuditChainMigrations` (@nodii/audit-chain)
+ *   - the `nodii-db-rls install-fence` CLI, for a service on none of the above
+ *
+ * The three mirrors inline a byte-equal copy rather than importing it, to
+ * preserve their deliberate zero-dependency posture on `@nodii/db-rls`. That
+ * duplication is guarded by a byte-equality test in each mirror's suite, not by
+ * a comment asking people to remember.
+ */
+export function sessionFenceBootstrapSql(installSql) {
+    return `${installSql}${TENANT_FENCE_GATE_SQL}`;
+}
+//# sourceMappingURL=tenant-fence-gate.js.map

package/dist/tenant-fence-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-fence-gate.js","sourceRoot":"","sources":["../src/tenant-fence-gate.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,gFAAgF;AAChF,0EAA0E;AAC1E,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,mBAAmB;AACnB,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,0CAA0C;AAC1C,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,0BAA0B;AAC1B,EAAE;AACF,0DAA0D;AAC1D,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,WAAW;AACX,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,6CAA6C;AAC7C,EAAE;AACF,mEAAmE;AACnE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,4CAA4C;AAE5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyLpC,CAAC;AAEF;;2CAE2C;AAC3C,MAAM,CAAC,MAAM,4BAA4B,GAAG;CAC3C,CAAC;AAEF;;sDAEsD;AACtD,MAAM,CAAC,MAAM,0BAA0B,GAAG,mCAAmC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,GAAG,UAAU,GAAG,qBAAqB,EAAE,CAAC;AACjD,CAAC"}