@nodii/db-rls 0.13.0 → 0.14.0

package/dist/postgres-js-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-js-client.js","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,+DAA+D;AAC/D,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,WAAW;AACX,0EAA0E;AAC1E,kEAAkE;AAClE,qBAAqB;AACrB,oEAAoE;AACpE,uEAAuE;AACvE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,gCAAgC;AAChC,2DAA2D;AAC3D,sCAAsC;AACtC,6CAA6C;AAC7C,qEAAqE;AACrE,sCAAsC;AAEtC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,OAAO,EAA2B,MAAM,yBAAyB,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EAKpB,qBAAqB,EAGrB,yBAAyB,GAE1B,MAAM,YAAY,CAAC;AAMpB;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,CAAW;IACP,GAAG,CAAM;IAC1B;gFAC4E;IACpE,SAAS,CAA6C;IAC7C,aAAa,CAAS;IACtB,aAAa,CAGnB;IACM,UAAU,CAIhB;IAEX,YAAY,IAUX;QACC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;qEACiE;IACjE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;wBAC3B,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,6DAA6D;gBAC7D,oDAAoD;gBACpD,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,EAAmD;QAEnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAClB,IAA8C,CAC/C,CAAC;wBACF,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,+CAA+C;gBAC/C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,YAAY;IACP,QAAQ,CAAW;IACnB,GAAG,CAAiB;IAE7B,YAAY,IAAc,EAAE,GAAmB;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,SAAS,qBAAqB,CAC5B,IAA6D;IAE7D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,YAAY,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wLAAwL,CACxM,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAsB,EACtB,KAA8D,EAC9D,EAAwD;IAExD,8EAA8E;IAC9E,wEAAwE;IACxE,sEAAsE;IACtE,OAAO,IAAI,CAAC,sBAAsB,CAAa,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAI/C,IAAqB,EACrB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACpD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oBAAoB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,QAAQ,SAAS,CAC3E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,sCAAsC,IAAI,CAAC,QAAQ,SAAS,CACvE,CAAC;QACJ,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAIzD,KAAgC,EAChC,GAAyD;IAEzD,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAIjD,IAAuB,EACvB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,2BAA2B,IAAI,CAAC,QAAQ,SAAS,CAC5D,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAItD,IAA4B,EAC5B,EAAwD;IAExD,MAAM,IAAI,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oCAAoC,IAAI,CAAC,MAAM,SAAS,CACnE,CAAC;QACF,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oDAAoD,IAAI,CAAC,SAAS,SAAS,CACtF,CAAC;QACF,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oDAAoD,IAAI,CAAC,UAAU,SAAS,CACvF,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAIhD,QAE0D,EAC1D,OAA8D;IAE9D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAa,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAa,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,QAE0D,EAC1D,OAA8D;IAK9D,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAID,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAC9E,2BAA2B;AAC3B,OAAO,EACL,cAAc,EACd,cAAc,EAEd,SAAS,EACT,YAAY,EACZ,WAAW,GAEZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,oEAAoE;AACpE,oEAAoE;AACpE,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"postgres-js-client.js","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,+DAA+D;AAC/D,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,WAAW;AACX,0EAA0E;AAC1E,kEAAkE;AAClE,qBAAqB;AACrB,oEAAoE;AACpE,uEAAuE;AACvE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,gCAAgC;AAChC,2DAA2D;AAC3D,sCAAsC;AACtC,6CAA6C;AAC7C,qEAAqE;AACrE,sCAAsC;AAEtC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,OAAO,EAA2B,MAAM,yBAAyB,CAAC;AAG3E,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EAKpB,qBAAqB,EAErB,yBAAyB,GAE1B,MAAM,YAAY,CAAC;AAMpB;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,CAAW;IACP,GAAG,CAAM;IAC1B;gFAC4E;IACpE,SAAS,CAA6C;IAC7C,aAAa,CAAS;IACtB,aAAa,CAGnB;IACM,UAAU,CAIhB;IAEX,YAAY,IAUX;QACC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;qEACiE;IACjE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;wBAC3B,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,6DAA6D;gBAC7D,oDAAoD;gBACpD,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,EAAmD;QAEnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAClB,IAA8C,CAC/C,CAAC;wBACF,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,+CAA+C;gBAC/C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,YAAY;IACP,QAAQ,CAAW;IACnB,GAAG,CAAiB;IAE7B,YAAY,IAAc,EAAE,GAAmB;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,SAAS,qBAAqB,CAC5B,IAA6D;IAE7D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,YAAY,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wLAAwL,CACxM,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAsB,EACtB,KAA8D,EAC9D,EAAwD;IAExD,8EAA8E;IAC9E,wEAAwE;IACxE,sEAAsE;IACtE,OAAO,IAAI,CAAC,sBAAsB,CAAa,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAG/C,EAAwD;IACxD,sBAAsB,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACpD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oBAAoB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,QAAQ,SAAS,CAC3E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,sCAAsC,IAAI,CAAC,QAAQ,SAAS,CACvE,CAAC;QACJ,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAIzD,KAAgC,EAChC,GAAyD;IAEzD,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAIjD,IAAuB,EACvB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,gCAAgC,CACjD,+BAA+B,EAC/B,IAAI,CACL,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,sBAAsB,CAAC,eAAe,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,2BAA2B,IAAI,CAAC,QAAQ,SAAS,CAC5D,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAItD,IAA4B,EAC5B,EAAwD;IAExD,MAAM,IAAI,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oCAAoC,IAAI,CAAC,MAAM,SAAS,CACnE,CAAC;QACF,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oDAAoD,IAAI,CAAC,SAAS,SAAS,CACtF,CAAC;QACF,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oDAAoD,IAAI,CAAC,UAAU,SAAS,CACvF,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAIhD,QAE0D,EAC1D,OAA8D;IAE9D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAa,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAa,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,QAE0D,EAC1D,OAA8D;IAK9D,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAID,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAC9E,2BAA2B;AAC3B,OAAO,EACL,cAAc,EACd,cAAc,EAEd,SAAS,EACT,YAAY,EACZ,WAAW,GAEZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,+DAA+D;AAC/D,uEAAuE;AACvE,4EAA4E;AAC5E,+DAA+D;AAC/D,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,6BAA6B,EAC7B,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,oEAAoE;AACpE,oEAAoE;AACpE,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,eAAe,EACf,+BAA+B,EAC/B,qBAAqB,EACrB,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,YAAY,CAAC"}

package/dist/types.d.ts

@@ -33,21 +33,28 @@ export interface PgPool {
  * `3-pool`.
  */
 export type DbRlsMode = "3-pool" | "2-pool" | "3-pool-with-platform-ops";
-/** Auth context bound by `@nodii/auth-sdk` middleware. Mirrors the
- *  fields autoDispatch reads — kept structural so the real auth-sdk
- *  context shape can grow without breaking us. */
-export interface AuthContext {
-    /** Verified principal id (sub). */
-    userId: string;
-    /** Resolved tenant id (pinned by the JWT). */
-    tenantId: string;
-    /** Optional source IP for forensic GUC binding. */
-    sourceIp?: string;
-}
-/** withUserContext opts. */
-export interface UserContextOpts {
+/**
+ * The VERIFIED claim set for one request — the ONLY source of the tenant on
+ * the authenticated path.
+ *
+ * Bound once per request by auth middleware via
+ * `runWithVerifiedTenantClaims`, read by `withUserContext` /
+ * `withUserContextDb` / `withUserContextDbPostgresJs` / `autoDispatch`.
+ * These fields must come off the verified JWT claim set — never off the
+ * request body, path params, or headers.
+ *
+ * This REPLACES the removed `AuthContext` and `UserContextOpts`. Those two
+ * types existed to carry a tenant into the authenticated path as an
+ * argument, which is exactly the forgery this release removes; they are
+ * deleted rather than deprecated so that a consumer still importing them
+ * gets a compile error instead of a type that no longer does anything.
+ */
+export interface VerifiedTenantClaims {
+    /** Verified principal id — the JWT `sub`. */
     userId: string;
+    /** Verified tenant id — the tenant claim the JWT was minted for. */
     tenantId: string;
+    /** Optional source IP, bound to `app.source_ip` for forensics. */
     sourceIp?: string;
 }
 /**
@@ -64,11 +71,50 @@ export interface UserMembershipContextOpts {
 /** withSystemContext opts. */
 export interface SystemContextOpts {
     tenantId: string;
+    /**
+     * REQUIRED when calling from inside a claims-bound request (i.e. while
+     * `hasVerifiedTenantClaims()` is true) — otherwise the call throws
+     * `SystemContextUnderClaimsRefused` before any pool is touched.
+     *
+     * The services-pool predicate is the bare
+     * `tenant_id = auth.get_tenant_id()` with no membership proof, so an
+     * authenticated request that falls through to `withSystemContext` can aim
+     * the session at ANY tenant — the seam where the ₹250,000 cross-tenant
+     * refund reproduced. A non-blank `reason` names the deliberate escape and
+     * is emitted to telemetry
+     * (`db_rls.cross_pool_nesting_total{outer=authenticated,inner=services,reason}`).
+     *
+     * Outside any claims-bound context (workers, cron, S2S, webhooks, boot)
+     * this field is ignored and the helper behaves exactly as before.
+     */
+    reason?: string;
 }
-/** autoDispatch opts. */
+/**
+ * autoDispatch opts — the SYSTEM leg only.
+ *
+ * The field is `systemTenantId`, not `tenantId`, and it is REQUIRED. Both
+ * are deliberate: the old shape was `{ authContext?, tenantId? }` with
+ * everything optional, so dropping `authContext` alone would have left
+ * `autoDispatch(opts, fn)` compiling against a variable that still carried
+ * an `authContext` — the argument would just be ignored, which is a silent
+ * behaviour change with green CI. A renamed, required property is a
+ * compile error for every previous call shape, literal or not.
+ *
+ * Passing this selects the `services` pool explicitly, exactly as
+ * `withSystemContext({ tenantId }, fn)` does — including the
+ * under-claims fence: inside a claims-bound request the system leg needs
+ * a non-blank `reason` or it throws `SystemContextUnderClaimsRefused`.
+ * Omit the opts entirely (call `autoDispatch(fn)`) to run on the
+ * authenticated pool against the request's verified claims.
+ */
 export interface AutoDispatchOpts {
-    authContext?: AuthContext;
-    tenantId?: string;
+    /** Tenant for the SYSTEM (services-pool) leg: workers, cron, S2S,
+     *  webhooks. Named `systemTenantId` so a reviewer reading the call site
+     *  can see that no user claim is involved. */
+    systemTenantId: string;
+    /** Passed through to `withSystemContext` — required when dispatching the
+     *  system leg from inside a claims-bound request. */
+    reason?: string;
 }
 /**
  * withPlatformOpsContext opts. Per hub decision D185:
@@ -116,7 +162,105 @@ export declare class PoolUnavailable extends DbRlsError {
     constructor(pool: PoolKind);
 }
 export declare class MissingTenantContext extends DbRlsError {
-    constructor();
+    constructor(detail?: string);
+}
+/**
+ * Thrown by the authenticated-pool helpers when NOTHING bound verified
+ * claims for the current request.
+ *
+ * Fail closed and loud. There is no default tenant, no fallback to a
+ * caller-supplied value, and no "return an empty result and carry on" — a
+ * silently-empty result is how the crm 85-policy blackout hid for weeks.
+ * If you see this, the cause is one of:
+ *
+ *   1. Your auth middleware does not call `runWithVerifiedTenantClaims`
+ *      yet (the usual one — see the migration note in the README).
+ *   2. The DB call escaped the request's async context: it was scheduled
+ *      with `setTimeout` / an unawaited promise / a queue callback that
+ *      outlives the request, so the AsyncLocalStorage store is gone. Await
+ *      the work inside the request, or run it as a worker on
+ *      `withSystemContext({ tenantId }, fn)`.
+ *   3. It genuinely is not an authenticated request — a worker, cron job,
+ *      S2S call, or webhook. Those have a legitimately resolved tenant and
+ *      no user claim: use `withSystemContext({ tenantId }, fn)`.
+ */
+export declare class NoVerifiedTenantClaims extends DbRlsError {
+    readonly helper: string | null;
+    constructor(helper?: string);
+}
+/**
+ * Thrown when something tries to bind verified claims while claims are
+ * ALREADY bound in the current async context.
+ *
+ * Re-binding is refused unconditionally, including to identical claims.
+ * The whole point of deriving the tenant from a request-scoped store is
+ * that a handler downstream of auth middleware cannot choose a different
+ * one; a permitted nested bind would hand that ability straight back
+ * ("bind again with `req.body.tenantId`"), so it is refused rather than
+ * merged, warned about, or last-write-wins.
+ */
+export declare class VerifiedTenantClaimsAlreadyBound extends DbRlsError {
+    readonly boundTenantId: string;
+    readonly attemptedTenantId: string;
+    constructor(boundTenantId: string, attemptedTenantId: string);
+}
+/**
+ * Thrown when the claim set handed to `runWithVerifiedTenantClaims` is not
+ * usable — a missing / non-string / blank `userId` or `tenantId` (or a
+ * blank `sourceIp`).
+ *
+ * Rejected at BIND time rather than at query time on purpose. A blank
+ * tenant binds an empty `app.tenant_id` GUC, and the RLS predicate then
+ * resolves nothing — which surfaces as "this user has no rows", not as
+ * "this request was refused".
+ */
+export declare class InvalidVerifiedTenantClaims extends DbRlsError {
+    readonly field: string;
+    constructor(field: string, detail: string);
+}
+/**
+ * Thrown when an authenticated-pool helper is called with the retired
+ * `helper(opts, fn)` shape — i.e. something passed a tenant.
+ *
+ * TypeScript rejects this at compile time (the helpers take the callback as
+ * their only argument). This error is the runtime backstop for consumers
+ * that do not typecheck against this package: plain JavaScript, a stale
+ * published `dist/`, or an `any`-typed wrapper. Without it the opts object
+ * would be invoked as the callback and the failure would read as
+ * `opts is not a function` — a db-rls bug rather than an unmigrated call.
+ */
+export declare class TenantArgumentRefused extends DbRlsError {
+    readonly helper: string;
+    constructor(helper: string, received: string);
+}
+/**
+ * THE STEP-1 SEAM, refused by name. Thrown when a system-pool helper
+ * (`withSystemContext` / `withSystemContextDb` /
+ * `withSystemContextDbPostgresJs`, or `autoDispatch`'s system leg) is
+ * called INSIDE a request that has verified tenant claims bound, without
+ * an explicit non-blank `{ reason }`.
+ *
+ * The services-pool predicate is the bare
+ * `tenant_id = auth.get_tenant_id()` — it trusts the GUC completely and
+ * proves no membership. So an authenticated request that falls through to
+ * the system pool re-opens exactly the forgery the verified-claims binding
+ * closes on the authenticated pool: the handler supplies the tenant, and
+ * nothing checks the principal holds it. That fall-through is the seam
+ * where the ₹250,000 cross-tenant refund reproduced.
+ *
+ * This is a THROW, not a warning, and it fires BEFORE any pool is
+ * acquired. Deliberate system work inside a request (an outbox write, a
+ * cross-tenant rollup) passes `{ reason: "..." }`, which sanctions the
+ * escape AND emits it to telemetry
+ * (`db_rls.cross_pool_nesting_total{outer=authenticated,inner=services,reason}`)
+ * so every such crossing is named, counted, and audit-greppable. Unbound
+ * contexts (workers, cron, boot, S2S, webhooks) never see this error.
+ */
+export declare class SystemContextUnderClaimsRefused extends DbRlsError {
+    readonly helper: string;
+    readonly boundTenantId: string;
+    readonly requestedTenantId: string;
+    constructor(helper: string, boundTenantId: string, requestedTenantId: string);
 }
 /**
  * Thrown when something asks for a database session that would let a tenant

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAoBA;;;;;wDAKwD;AACxD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,eAAe,GAAG,cAAc,CAAC;AAE/E;;wBAEwB;AACxB,MAAM,WAAW,IAAI;IACnB,6CAA6C;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oEAAoE;IACpE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE;;kDAEkD;AAClD,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yBAAyB;AACzB,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8BAA8B;AAC9B,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAKD,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,UAAU;;CAOlD;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACZ,IAAI,EAAE,QAAQ;CAK3B;AAED,qBAAa,oBAAqB,SAAQ,UAAU;;CAOnD;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,yBAA0B,SAAQ,UAAU;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAO3B;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAS3B;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,UAAU;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM;CAO7B;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAoBA;;;;;wDAKwD;AACxD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,eAAe,GAAG,cAAc,CAAC;AAE/E;;wBAEwB;AACxB,MAAM,WAAW,IAAI;IACnB,6CAA6C;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oEAAoE;IACpE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;kDAE8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB;yDACqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8BAA8B;AAC9B,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAKD,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,UAAU;;CAOlD;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACZ,IAAI,EAAE,QAAQ;CAK3B;AAED,qBAAa,oBAAqB,SAAQ,UAAU;gBACtC,MAAM,CAAC,EAAE,MAAM;CAQ5B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;gBACnB,MAAM,CAAC,EAAE,MAAM;CAS5B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gCAAiC,SAAQ,UAAU;IAC9D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;gBACvB,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM;CAQ7D;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,SAAQ,UAAU;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAO1C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAO7C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,+BAAgC,SAAQ,UAAU;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;gBAEjC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,MAAM;CAU5B;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,yBAA0B,SAAQ,UAAU;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAO3B;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAS3B;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,UAAU;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM;CAO7B;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/types.js

@@ -40,11 +40,134 @@ export class PoolUnavailable extends DbRlsError {
     }
 }
 export class MissingTenantContext extends DbRlsError {
-    constructor() {
-        super("missing_tenant_context: autoDispatch requires either authContext or tenantId.");
+    constructor(detail) {
+        super(detail
+            ? `missing_tenant_context: ${detail}`
+            : "missing_tenant_context: a tenant-scoped helper was called without a tenant.");
         this.name = "MissingTenantContext";
     }
 }
+/**
+ * Thrown by the authenticated-pool helpers when NOTHING bound verified
+ * claims for the current request.
+ *
+ * Fail closed and loud. There is no default tenant, no fallback to a
+ * caller-supplied value, and no "return an empty result and carry on" — a
+ * silently-empty result is how the crm 85-policy blackout hid for weeks.
+ * If you see this, the cause is one of:
+ *
+ *   1. Your auth middleware does not call `runWithVerifiedTenantClaims`
+ *      yet (the usual one — see the migration note in the README).
+ *   2. The DB call escaped the request's async context: it was scheduled
+ *      with `setTimeout` / an unawaited promise / a queue callback that
+ *      outlives the request, so the AsyncLocalStorage store is gone. Await
+ *      the work inside the request, or run it as a worker on
+ *      `withSystemContext({ tenantId }, fn)`.
+ *   3. It genuinely is not an authenticated request — a worker, cron job,
+ *      S2S call, or webhook. Those have a legitimately resolved tenant and
+ *      no user claim: use `withSystemContext({ tenantId }, fn)`.
+ */
+export class NoVerifiedTenantClaims extends DbRlsError {
+    helper;
+    constructor(helper) {
+        super(`no_verified_tenant_claims: ${helper ? `${helper}()` : "an authenticated-pool helper"} needs the request's VERIFIED claims, and none are bound in this async context. The tenant is derived from those claims — it is not an argument, and there is no default. Bind them ONCE in auth middleware, straight after JWT verification: runWithVerifiedTenantClaims({ userId: claims.sub, tenantId: claims.tenant_id }, () => next()). If this is a worker / cron / S2S / webhook with no user claim, use withSystemContext({ tenantId }, fn) instead. If it is a request whose DB work escaped the request scope (setTimeout, unawaited promise, queue callback), await the work inside the request.`);
+        this.name = "NoVerifiedTenantClaims";
+        this.helper = helper ?? null;
+    }
+}
+/**
+ * Thrown when something tries to bind verified claims while claims are
+ * ALREADY bound in the current async context.
+ *
+ * Re-binding is refused unconditionally, including to identical claims.
+ * The whole point of deriving the tenant from a request-scoped store is
+ * that a handler downstream of auth middleware cannot choose a different
+ * one; a permitted nested bind would hand that ability straight back
+ * ("bind again with `req.body.tenantId`"), so it is refused rather than
+ * merged, warned about, or last-write-wins.
+ */
+export class VerifiedTenantClaimsAlreadyBound extends DbRlsError {
+    boundTenantId;
+    attemptedTenantId;
+    constructor(boundTenantId, attemptedTenantId) {
+        super(`verified_tenant_claims_already_bound: this request already has verified claims bound for tenant ${JSON.stringify(boundTenantId)}, and something tried to re-bind it to ${JSON.stringify(attemptedTenantId)}. Re-binding is refused unconditionally — it is the one shape that would let a handler downstream of auth middleware pick a different tenant, which is the forgery this fence exists to prevent. Bind exactly once, at the outermost auth boundary. A worker that needs a different tenant is not an authenticated request: use withSystemContext({ tenantId }, fn).`);
+        this.name = "VerifiedTenantClaimsAlreadyBound";
+        this.boundTenantId = boundTenantId;
+        this.attemptedTenantId = attemptedTenantId;
+    }
+}
+/**
+ * Thrown when the claim set handed to `runWithVerifiedTenantClaims` is not
+ * usable — a missing / non-string / blank `userId` or `tenantId` (or a
+ * blank `sourceIp`).
+ *
+ * Rejected at BIND time rather than at query time on purpose. A blank
+ * tenant binds an empty `app.tenant_id` GUC, and the RLS predicate then
+ * resolves nothing — which surfaces as "this user has no rows", not as
+ * "this request was refused".
+ */
+export class InvalidVerifiedTenantClaims extends DbRlsError {
+    field;
+    constructor(field, detail) {
+        super(`invalid_verified_tenant_claims: ${field} — ${detail}. These fields must come off the VERIFIED JWT claim set (sub / tenant claim), never off the request body, path params, or headers.`);
+        this.name = "InvalidVerifiedTenantClaims";
+        this.field = field;
+    }
+}
+/**
+ * Thrown when an authenticated-pool helper is called with the retired
+ * `helper(opts, fn)` shape — i.e. something passed a tenant.
+ *
+ * TypeScript rejects this at compile time (the helpers take the callback as
+ * their only argument). This error is the runtime backstop for consumers
+ * that do not typecheck against this package: plain JavaScript, a stale
+ * published `dist/`, or an `any`-typed wrapper. Without it the opts object
+ * would be invoked as the callback and the failure would read as
+ * `opts is not a function` — a db-rls bug rather than an unmigrated call.
+ */
+export class TenantArgumentRefused extends DbRlsError {
+    helper;
+    constructor(helper, received) {
+        super(`tenant_argument_refused: ${helper}() takes the callback as its ONLY argument and derives the tenant from the request's verified claims — it received ${received} where the callback was expected, which is the retired ${helper}(opts, fn) shape. The tenant was a parameter a handler passed in, so any handler that passed a request-derived tenant instead of the verified claim silently defeated RLS; it is no longer expressible. Bind claims once in auth middleware — runWithVerifiedTenantClaims({ userId, tenantId }, () => next()) — then call ${helper}(async (tx) => ...). Workers / cron / S2S / webhooks keep their explicit tenant: withSystemContext({ tenantId }, fn).`);
+        this.name = "TenantArgumentRefused";
+        this.helper = helper;
+    }
+}
+/**
+ * THE STEP-1 SEAM, refused by name. Thrown when a system-pool helper
+ * (`withSystemContext` / `withSystemContextDb` /
+ * `withSystemContextDbPostgresJs`, or `autoDispatch`'s system leg) is
+ * called INSIDE a request that has verified tenant claims bound, without
+ * an explicit non-blank `{ reason }`.
+ *
+ * The services-pool predicate is the bare
+ * `tenant_id = auth.get_tenant_id()` — it trusts the GUC completely and
+ * proves no membership. So an authenticated request that falls through to
+ * the system pool re-opens exactly the forgery the verified-claims binding
+ * closes on the authenticated pool: the handler supplies the tenant, and
+ * nothing checks the principal holds it. That fall-through is the seam
+ * where the ₹250,000 cross-tenant refund reproduced.
+ *
+ * This is a THROW, not a warning, and it fires BEFORE any pool is
+ * acquired. Deliberate system work inside a request (an outbox write, a
+ * cross-tenant rollup) passes `{ reason: "..." }`, which sanctions the
+ * escape AND emits it to telemetry
+ * (`db_rls.cross_pool_nesting_total{outer=authenticated,inner=services,reason}`)
+ * so every such crossing is named, counted, and audit-greppable. Unbound
+ * contexts (workers, cron, boot, S2S, webhooks) never see this error.
+ */
+export class SystemContextUnderClaimsRefused extends DbRlsError {
+    helper;
+    boundTenantId;
+    requestedTenantId;
+    constructor(helper, boundTenantId, requestedTenantId) {
+        super(`system_context_under_verified_claims_refused: ${helper}() was called INSIDE a request that has verified tenant claims bound (tenant ${JSON.stringify(boundTenantId)}), asking the services pool for tenant ${JSON.stringify(requestedTenantId)} — with no { reason }. The services-pool predicate is the bare tenant_id = auth.get_tenant_id() with NO membership proof, so an authenticated request that falls through to it can aim the session at ANY tenant; this is the un-fenced seam where the ₹250,000 cross-tenant refund reproduced. If this really is deliberate system work inside a request (an outbox write, a cross-tenant rollup), pass an explicit { reason: "..." } — the escape is then emitted to telemetry (db_rls.cross_pool_nesting_total) and audit-greppable. Otherwise stay on the authenticated pool: withUserContext(fn). Workers / cron / S2S / webhooks with no bound claims are unaffected and need no reason.`);
+        this.name = "SystemContextUnderClaimsRefused";
+        this.helper = helper;
+        this.boundTenantId = boundTenantId;
+        this.requestedTenantId = requestedTenantId;
+    }
+}
 /**
  * Thrown when something asks for a database session that would let a tenant
  * user reach more than one tenant's rows.
@@ -62,7 +185,7 @@ export class MissingTenantContext extends DbRlsError {
 export class CrossTenantSessionRefused extends DbRlsError {
     helper;
     constructor(helper) {
-        super(`cross_tenant_session_refused: ${helper}() opened an authenticated-pool session with NO tenant bound, so the RLS predicate resolved across EVERY tenant the principal belonged to. That is the mechanism of the cross-tenant approval incident, and it is no longer available. Use withUserContext({ userId, tenantId }, fn) with the tenant the request resolved to. To LIST a user's tenants (switcher / login picker), query auth.user_tenant_ids from a services-pool context — that function is intact; what is gone is opening a data session that spans them. Nodii staff cross-tenant access is unchanged: withPlatformOpsContext.`);
+        super(`cross_tenant_session_refused: ${helper}() opened an authenticated-pool session with NO tenant bound, so the RLS predicate resolved across EVERY tenant the principal belonged to. That is the mechanism of the cross-tenant approval incident, and it is no longer available. Use withUserContext(fn) — the tenant comes from the request's VERIFIED claims, bound once by auth middleware via runWithVerifiedTenantClaims, and is no longer an argument. To LIST a user's tenants (switcher / login picker), query auth.user_tenant_ids from a services-pool context — that function is intact; what is gone is opening a data session that spans them. Nodii staff cross-tenant access is unchanged: withPlatformOpsContext.`);
         this.name = "CrossTenantSessionRefused";
         this.helper = helper;
     }

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,EAAE;AACF,gBAAgB;AAChB,qDAAqD;AACrD,uEAAuE;AACvE,0EAA0E;AAC1E,oDAAoD;AACpD,0EAA0E;AAC1E,wBAAwB;AACxB,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,uCAAuC;AACvC,0CAA0C;AAC1C,kDAAkD;AAClD,0EAA0E;AAwH1E,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD;QACE,KAAK,CACH,uHAAuH,CACxH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACpC,IAAI,CAAW;IACxB,YAAY,IAAc;QACxB,KAAK,CAAC,yBAAyB,IAAI,sCAAsC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD;QACE,KAAK,CACH,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,yBAA0B,SAAQ,UAAU;IAC9C,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CACH,iCAAiC,MAAM,okBAAokB,CAC5mB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CACH,4BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,UAAU;IAC/C,QAAQ,CAAS;IAC1B,YAAY,QAAgB;QAC1B,KAAK,CACH,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gOAAgO,CACrS,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,EAAE;AACF,gBAAgB;AAChB,qDAAqD;AACrD,uEAAuE;AACvE,0EAA0E;AAC1E,oDAAoD;AACpD,0EAA0E;AAC1E,wBAAwB;AACxB,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,uCAAuC;AACvC,0CAA0C;AAC1C,kDAAkD;AAClD,0EAA0E;AAqK1E,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD;QACE,KAAK,CACH,uHAAuH,CACxH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACpC,IAAI,CAAW;IACxB,YAAY,IAAc;QACxB,KAAK,CAAC,yBAAyB,IAAI,sCAAsC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD,YAAY,MAAe;QACzB,KAAK,CACH,MAAM;YACJ,CAAC,CAAC,2BAA2B,MAAM,EAAE;YACrC,CAAC,CAAC,6EAA6E,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IAC3C,MAAM,CAAgB;IAC/B,YAAY,MAAe;QACzB,KAAK,CACH,8BACE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,8BAC3B,6kBAA6kB,CAC9kB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gCAAiC,SAAQ,UAAU;IACrD,aAAa,CAAS;IACtB,iBAAiB,CAAS;IACnC,YAAY,aAAqB,EAAE,iBAAyB;QAC1D,KAAK,CACH,mGAAmG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,sWAAsW,CACljB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA4B,SAAQ,UAAU;IAChD,KAAK,CAAS;IACvB,YAAY,KAAa,EAAE,MAAc;QACvC,KAAK,CACH,mCAAmC,KAAK,MAAM,MAAM,oIAAoI,CACzL,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,MAAM,CAAS;IACxB,YAAY,MAAc,EAAE,QAAgB;QAC1C,KAAK,CACH,4BAA4B,MAAM,sHAAsH,QAAQ,0DAA0D,MAAM,6TAA6T,MAAM,uHAAuH,CAC3pB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,+BAAgC,SAAQ,UAAU;IACpD,MAAM,CAAS;IACf,aAAa,CAAS;IACtB,iBAAiB,CAAS;IACnC,YACE,MAAc,EACd,aAAqB,EACrB,iBAAyB;QAEzB,KAAK,CACH,iDAAiD,MAAM,gFAAgF,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,gqBAAgqB,CACh5B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,yBAA0B,SAAQ,UAAU;IAC9C,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CACH,iCAAiC,MAAM,ypBAAypB,CACjsB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CACH,4BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,UAAU;IAC/C,QAAQ,CAAS;IAC1B,YAAY,QAAgB;QAC1B,KAAK,CACH,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gOAAgO,CACrS,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/db-rls",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
   "license": "MIT",
   "type": "module",
@@ -62,7 +62,7 @@
     }
   },
   "devDependencies": {
-    "@nodii/telemetry": "0.27.0",
+    "@nodii/telemetry": "0.29.0",
     "@types/bun": "^1.3.13",
     "@types/pg": "^8.11.10",
     "drizzle-orm": "^0.45.2",