@nodii/db-rls 0.2.1 → 0.3.1

package/dist/postgres-js-client.d.ts

@@ -0,0 +1,60 @@
+import { type PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import type { Sql } from "postgres";
+import { type OwnerContextOpts } from "./migrate-guard";
+import { type PgPool, type PgTx, type PoolKind, type SystemContextOpts, type UserContextOpts } from "./types";
+type PostgresJsDrizzleClient<TSchema extends Record<string, unknown> = Record<string, unknown>> = PostgresJsDatabase<TSchema>;
+/**
+ * PgPool adapter wrapping a postgres-js `Sql` instance. Caller owns the
+ * underlying Sql's lifecycle (creation + .end()).
+ *
+ * The adapter implements the substrate-agnostic `PgPool` interface from
+ * `src/types.ts` so the existing `withUserContext` / `withSystemContext` /
+ * `withOwnerContext` helpers (in `src/context.ts`) work transparently
+ * against postgres-js — they receive a `PgTx` whose `setConfig` /
+ * `exec` calls land on the underlying postgres-js transaction.
+ */
+export declare class PgPostgresJsPool implements PgPool {
+    readonly kind: PoolKind;
+    private readonly sql;
+    private readonly slowAcquireMs;
+    private readonly onSlowAcquire?;
+    private readonly onTxFinish?;
+    constructor(opts: {
+        sql: Sql;
+        kind: PoolKind;
+        slowAcquireMs?: number;
+        onSlowAcquire?: (info: {
+            pool: PoolKind;
+            durationMs: number;
+        }) => void;
+        onTxFinish?: (info: {
+            pool: PoolKind;
+            outcome: "committed" | "rolled_back" | "error";
+            durationMs: number;
+        }) => void;
+    });
+    /** Direct access to the underlying postgres-js Sql (for ORM clients
+     *  that need the raw handle — e.g. Drizzle's `drizzle(sql)`). */
+    get rawSql(): Sql;
+    withTransaction<T>(fn: (tx: PgTx) => Promise<T>): Promise<T>;
+}
+/**
+ * postgres-js Drizzle variant of `withUserContext`. Opens a tx on the
+ * `authenticated` pool, sets `app.user_id` + `app.tenant_id` via the
+ * canonical `auth.init(...)` helper, yields a Drizzle client.
+ */
+export declare function withUserContextDbPostgresJs<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(opts: UserContextOpts, fn: (db: PostgresJsDrizzleClient<TSchema>) => Promise<T>): Promise<T>;
+/**
+ * postgres-js Drizzle variant of `withSystemContext`. Opens a tx on the
+ * `services` pool with `app.tenant_id` GUC bound; yields a Drizzle client.
+ */
+export declare function withSystemContextDbPostgresJs<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(opts: SystemContextOpts, fn: (db: PostgresJsDrizzleClient<TSchema>) => Promise<T>): Promise<T>;
+/**
+ * postgres-js Drizzle variant of `withOwnerContext`. Opens a tx on the
+ * `owner` (BYPASSRLS) pool with no GUCs. Migrations only per § 5.3 +
+ * doctrine § 10.2 — gated by `NODII_ENV=migrate` or explicit
+ * `{ allowOutsideMigrate: true, reason }` opt-in.
+ */
+export declare function withOwnerContextDbPostgresJs<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(fnOrOpts: OwnerContextOpts | ((db: PostgresJsDrizzleClient<TSchema>) => Promise<T>), maybeFn?: (db: PostgresJsDrizzleClient<TSchema>) => Promise<T>): Promise<T>;
+export type { PostgresJsDrizzleClient };
+//# sourceMappingURL=postgres-js-client.d.ts.map

package/dist/postgres-js-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-js-client.d.ts","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAW,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,EAAE,GAAG,EAAkB,MAAM,UAAU,CAAC;AAYpD,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,IAAI,EACT,KAAK,QAAQ,EAEb,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,SAAS,CAAC;AAEjB,KAAK,uBAAuB,CAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAC/D,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,qBAAa,gBAAiB,YAAW,MAAM;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAGpB;IACX,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAIjB;gBAEC,IAAI,EAAE;QAChB,GAAG,EAAE,GAAG,CAAC;QACT,IAAI,EAAE,QAAQ,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,KAAK,IAAI,CAAC;QACvE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE,QAAQ,CAAC;YACf,OAAO,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;YAC/C,UAAU,EAAE,MAAM,CAAC;SACpB,KAAK,IAAI,CAAC;KACZ;IAQD;qEACiE;IACjE,IAAI,MAAM,IAAI,GAAG,CAEhB;IAEK,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAuDnE;AAuDD;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,QAAQ,EACJ,gBAAgB,GAChB,CAAC,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAC1D,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7D,OAAO,CAAC,CAAC,CAAC,CAWZ;AAsBD,YAAY,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/postgres-js-client.js

@@ -0,0 +1,223 @@
+// postgres-js adapter per request 813cd066 + 06-library-integration § 4.9.
+//
+// Exposed via subpath `@nodii/db-rls/postgres-js`. nodii-auth uses
+// `postgres` (postgres-js driver) — not `pg` (node-postgres). The
+// existing `drizzle-client.ts` hard-imports `drizzle-orm/node-postgres`
+// + requires `pool instanceof PgClient`, so it's unusable from
+// postgres-js callers. This module mirrors the same surface for the
+// postgres-js driver.
+//
+// Surface:
+//   - PgPostgresJsPool — wraps a `postgres.Sql` into the PgPool interface
+//     so the existing with*Context helpers in src/context.ts work
+//     transparently.
+//   - withUserContextDbPostgresJs / withSystemContextDbPostgresJs /
+//     withOwnerContextDbPostgresJs — Drizzle-bound helpers that return
+//     a `drizzle-orm/postgres-js` client bound to the transaction.
+//
+// Lifecycle per § 5.3 — identical to the node-postgres path:
+//   1. `sql.begin(...)` → BEGIN
+//   2. `tx.unsafe("SELECT set_config(...)")` → GUC binding
+//   3. yield Drizzle client to caller
+//   4. throw → ROLLBACK; clean exit → COMMIT
+// postgres-js handles the BEGIN/COMMIT/ROLLBACK + connection release
+// internally inside `sql.begin(...)`.
+import { drizzle } from "drizzle-orm/postgres-js";
+import { requirePool } from "./init";
+import { emitSlowAcquireSpan, recordAcquisition, recordAcquisitionDuration, recordGucSetFailure, recordOwnerContextInvocation, recordTxDuration, withTxSpan, } from "./metrics";
+import { assertMigrateAllowed } from "./migrate-guard";
+import { MissingTenantContext, TransactionRolledBack, } from "./types";
+/**
+ * PgPool adapter wrapping a postgres-js `Sql` instance. Caller owns the
+ * underlying Sql's lifecycle (creation + .end()).
+ *
+ * The adapter implements the substrate-agnostic `PgPool` interface from
+ * `src/types.ts` so the existing `withUserContext` / `withSystemContext` /
+ * `withOwnerContext` helpers (in `src/context.ts`) work transparently
+ * against postgres-js — they receive a `PgTx` whose `setConfig` /
+ * `exec` calls land on the underlying postgres-js transaction.
+ */
+export class PgPostgresJsPool {
+    kind;
+    sql;
+    slowAcquireMs;
+    onSlowAcquire;
+    onTxFinish;
+    constructor(opts) {
+        this.kind = opts.kind;
+        this.sql = opts.sql;
+        this.slowAcquireMs = opts.slowAcquireMs ?? 50;
+        this.onSlowAcquire = opts.onSlowAcquire;
+        this.onTxFinish = opts.onTxFinish;
+    }
+    /** Direct access to the underlying postgres-js Sql (for ORM clients
+     *  that need the raw handle — e.g. Drizzle's `drizzle(sql)`). */
+    get rawSql() {
+        return this.sql;
+    }
+    async withTransaction(fn) {
+        const acquireStart = Date.now();
+        const txStart = Date.now();
+        let outcome = "error";
+        let pendingError;
+        try {
+            const result = await withTxSpan(this.kind, async (setOutcome) => {
+                return await this.sql.begin(async (tx) => {
+                    const acquireMs = Date.now() - acquireStart;
+                    recordAcquisition(this.kind, "success");
+                    recordAcquisitionDuration(this.kind, acquireMs);
+                    if (acquireMs >= this.slowAcquireMs) {
+                        emitSlowAcquireSpan(this.kind, acquireMs);
+                        if (this.onSlowAcquire) {
+                            try {
+                                this.onSlowAcquire({ pool: this.kind, durationMs: acquireMs });
+                            }
+                            catch {
+                                /* non-fatal */
+                            }
+                        }
+                    }
+                    const pgTx = new PostgresJsTx(this.kind, tx);
+                    try {
+                        const out = await fn(pgTx);
+                        outcome = "committed";
+                        setOutcome("committed");
+                        return out;
+                    }
+                    catch (err) {
+                        outcome = "rolled_back";
+                        setOutcome("rolled_back");
+                        pendingError = err;
+                        throw err;
+                    }
+                });
+            });
+            return result;
+        }
+        catch (err) {
+            if (outcome === "error") {
+                // sql.begin's connect failed (or rethrown unwrapped) — count
+                // acquisition failure if we never recorded success.
+                recordAcquisition(this.kind, "failure");
+                outcome = "rolled_back";
+                pendingError = err;
+            }
+            throw pendingError ?? err;
+        }
+        finally {
+            const durationMs = Date.now() - txStart;
+            recordTxDuration(this.kind, outcome, durationMs);
+            try {
+                this.onTxFinish?.({ pool: this.kind, outcome, durationMs });
+            }
+            catch {
+                /* non-fatal */
+            }
+        }
+    }
+}
+class PostgresJsTx {
+    poolKind;
+    raw;
+    constructor(kind, raw) {
+        this.poolKind = kind;
+        this.raw = raw;
+    }
+    async exec(sql, params = []) {
+        await this.raw.unsafe(sql, params);
+    }
+    async setConfig(key, value) {
+        // set_config(name, value, is_local=true) — tx-local per § 5.3.
+        try {
+            await this.raw.unsafe("SELECT set_config($1, $2, true)", [key, value]);
+        }
+        catch (err) {
+            recordGucSetFailure(key);
+            throw err;
+        }
+    }
+}
+function requirePostgresJsPool(kind) {
+    const pool = requirePool(kind);
+    if (!(pool instanceof PgPostgresJsPool)) {
+        throw new Error(`db-rls: ${kind} pool is not a PgPostgresJsPool — the postgres-js Drizzle helpers require a postgres-js-backed pool. Use withUserContextDb (node-postgres) or wire a PgPostgresJsPool for postgres-js.`);
+    }
+    return pool;
+}
+async function withPostgresJsTx(pool, setup, fn) {
+    return pool.withTransaction(async (pgTx) => {
+        const raw = pgTx.raw;
+        try {
+            await setup(raw);
+            const db = drizzle(raw);
+            return await fn(db);
+        }
+        catch (err) {
+            throw new TransactionRolledBack(err);
+        }
+    });
+}
+/**
+ * postgres-js Drizzle variant of `withUserContext`. Opens a tx on the
+ * `authenticated` pool, sets `app.user_id` + `app.tenant_id` via the
+ * canonical `auth.init(...)` helper, yields a Drizzle client.
+ */
+export async function withUserContextDbPostgresJs(opts, fn) {
+    if (!opts.userId)
+        throw new MissingTenantContext();
+    if (!opts.tenantId)
+        throw new MissingTenantContext();
+    const pool = requirePostgresJsPool("authenticated");
+    return withPostgresJsTx(pool, async (tx) => {
+        await tx.unsafe("SELECT auth.init($1::uuid, $2::uuid)", [
+            opts.userId,
+            opts.tenantId,
+        ]);
+        if (opts.sourceIp !== undefined) {
+            await tx.unsafe("SELECT set_config('app.source_ip', $1, true)", [
+                opts.sourceIp,
+            ]);
+        }
+    }, fn);
+}
+/**
+ * postgres-js Drizzle variant of `withSystemContext`. Opens a tx on the
+ * `services` pool with `app.tenant_id` GUC bound; yields a Drizzle client.
+ */
+export async function withSystemContextDbPostgresJs(opts, fn) {
+    if (!opts.tenantId)
+        throw new MissingTenantContext();
+    const pool = requirePostgresJsPool("services");
+    return withPostgresJsTx(pool, async (tx) => {
+        await tx.unsafe("SELECT auth.init_tenant($1::uuid)", [opts.tenantId]);
+    }, fn);
+}
+/**
+ * postgres-js Drizzle variant of `withOwnerContext`. Opens a tx on the
+ * `owner` (BYPASSRLS) pool with no GUCs. Migrations only per § 5.3 +
+ * doctrine § 10.2 — gated by `NODII_ENV=migrate` or explicit
+ * `{ allowOutsideMigrate: true, reason }` opt-in.
+ */
+export async function withOwnerContextDbPostgresJs(fnOrOpts, maybeFn) {
+    const { opts, fn } = normalizeOwnerArgs(fnOrOpts, maybeFn);
+    try {
+        assertMigrateAllowed(opts);
+    }
+    catch (err) {
+        recordOwnerContextInvocation("refused");
+        throw err;
+    }
+    recordOwnerContextInvocation("allowed");
+    const pool = requirePostgresJsPool("owner");
+    return withPostgresJsTx(pool, async () => { }, fn);
+}
+function normalizeOwnerArgs(fnOrOpts, maybeFn) {
+    if (typeof fnOrOpts === "function") {
+        return { opts: {}, fn: fnOrOpts };
+    }
+    if (!maybeFn) {
+        throw new TypeError("withOwnerContextDbPostgresJs: when opts are passed, the second argument must be the callback.");
+    }
+    return { opts: fnOrOpts, fn: maybeFn };
+}
+//# sourceMappingURL=postgres-js-client.js.map

package/dist/postgres-js-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-js-client.js","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,+DAA+D;AAC/D,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,WAAW;AACX,0EAA0E;AAC1E,kEAAkE;AAClE,qBAAqB;AACrB,oEAAoE;AACpE,uEAAuE;AACvE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,gCAAgC;AAChC,2DAA2D;AAC3D,sCAAsC;AACtC,6CAA6C;AAC7C,qEAAqE;AACrE,sCAAsC;AAEtC,OAAO,EAAE,OAAO,EAA2B,MAAM,yBAAyB,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAyB,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EAIpB,qBAAqB,GAGtB,MAAM,SAAS,CAAC;AAMjB;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,CAAW;IACP,GAAG,CAAM;IACT,aAAa,CAAS;IACtB,aAAa,CAGnB;IACM,UAAU,CAIhB;IAEX,YAAY,IAUX;QACC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;qEACiE;IACjE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;wBAC3B,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,6DAA6D;gBAC7D,oDAAoD;gBACpD,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,YAAY;IACP,QAAQ,CAAW;IACnB,GAAG,CAAiB;IAE7B,YAAY,IAAc,EAAE,GAAmB;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,SAAS,qBAAqB,CAC5B,IAA4C;IAE5C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,YAAY,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wLAAwL,CACxM,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAsB,EACtB,KAA4C,EAC5C,EAAwD;IAExD,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,GAAG,GAAI,IAAqB,CAAC,GAAG,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACjB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAgD,CAAC;YACvE,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAI/C,IAAqB,EACrB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACpD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,MAAM,CAAC,sCAAsC,EAAE;YACtD,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,QAAQ;SACd,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,MAAM,CAAC,8CAA8C,EAAE;gBAC9D,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAIjD,IAAuB,EACvB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,MAAM,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAIhD,QAE0D,EAC1D,OAA8D;IAE9D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAa,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAa,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,QAE0D,EAC1D,OAA8D;IAK9D,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC"}

package/dist/types.d.ts

@@ -18,6 +18,12 @@ export interface PgPool {
     /** Acquire a connection, BEGIN a tx, yield, and COMMIT/ROLLBACK. */
     withTransaction<T>(fn: (tx: PgTx) => Promise<T>): Promise<T>;
 }
+/**
+ * Pool topology mode. v0.2.x adds the `2-pool` exception per
+ * `08-rls-doctrine § 7` — nodii-auth runs owner + services only until
+ * its admin portal lands. Default is `3-pool`.
+ */
+export type DbRlsMode = "3-pool" | "2-pool";
 /** Auth context bound by `@nodii/auth-sdk` middleware. Mirrors the
  *  fields autoDispatch reads — kept structural so the real auth-sdk
  *  context shape can grow without breaking us. */
@@ -68,4 +74,27 @@ export declare class TransactionRolledBack extends DbRlsError {
     readonly cause: unknown;
     constructor(cause: unknown);
 }
+/**
+ * Thrown by `withOwnerContext` / `withOwnerContextDb` when invoked outside
+ * `NODII_ENV=migrate` per `08-rls-doctrine § 10.2`. The owner pool runs
+ * BYPASSRLS — invoking it from a request handler is a tenant-isolation
+ * escape and must be loud + refused by default. Migration scripts opt in
+ * by setting `NODII_ENV=migrate`; ops tooling that genuinely needs owner
+ * access at runtime opts in by passing `{ allowOutsideMigrate: true }`
+ * with an operator-attested reason (audit row emitted in a future slot).
+ */
+export declare class OwnerContextOutsideMigrate extends DbRlsError {
+    readonly nodiiEnv: string;
+    constructor(nodiiEnv: string);
+}
+/**
+ * Thrown by `initDbRls` / `configureDbRls` when the supplied pool topology
+ * doesn't match the declared `mode`. E.g. `mode: "3-pool"` without a
+ * `services` pool, or `mode: "2-pool"` with an `authenticated` pool
+ * supplied (the 2-pool exception has no authenticated role per
+ * 08-rls § 7).
+ */
+export declare class DbRlsConfigError extends DbRlsError {
+    constructor(message: string);
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAoBA,2DAA2D;AAC3D,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,eAAe,CAAC;AAE9D;;wBAEwB;AACxB,MAAM,WAAW,IAAI;IACnB,6CAA6C;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oEAAoE;IACpE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;kDAEkD;AAClD,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yBAAyB;AACzB,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAKD,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,UAAU;;CAOlD;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACZ,IAAI,EAAE,QAAQ;CAK3B;AAED,qBAAa,oBAAqB,SAAQ,UAAU;;CAOnD;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAS3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAoBA,2DAA2D;AAC3D,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,eAAe,CAAC;AAE9D;;wBAEwB;AACxB,MAAM,WAAW,IAAI;IACnB,6CAA6C;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oEAAoE;IACpE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE5C;;kDAEkD;AAClD,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yBAAyB;AACzB,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAKD,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,UAAU;;CAOlD;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACZ,IAAI,EAAE,QAAQ;CAK3B;AAED,qBAAa,oBAAqB,SAAQ,UAAU;;CAOnD;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAS3B;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,UAAU;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM;CAO7B;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/types.js

@@ -53,4 +53,34 @@ export class TransactionRolledBack extends DbRlsError {
         this.cause = cause;
     }
 }
+/**
+ * Thrown by `withOwnerContext` / `withOwnerContextDb` when invoked outside
+ * `NODII_ENV=migrate` per `08-rls-doctrine § 10.2`. The owner pool runs
+ * BYPASSRLS — invoking it from a request handler is a tenant-isolation
+ * escape and must be loud + refused by default. Migration scripts opt in
+ * by setting `NODII_ENV=migrate`; ops tooling that genuinely needs owner
+ * access at runtime opts in by passing `{ allowOutsideMigrate: true }`
+ * with an operator-attested reason (audit row emitted in a future slot).
+ */
+export class OwnerContextOutsideMigrate extends DbRlsError {
+    nodiiEnv;
+    constructor(nodiiEnv) {
+        super(`owner_context_outside_migrate: NODII_ENV=${JSON.stringify(nodiiEnv)}, expected "migrate". Owner pool BYPASSRLS — only callable during migrations (08-rls § 10.2). Set NODII_ENV=migrate for migration scripts, or pass { allowOutsideMigrate: true, reason: "..." } with operator-attested reason.`);
+        this.name = "OwnerContextOutsideMigrate";
+        this.nodiiEnv = nodiiEnv;
+    }
+}
+/**
+ * Thrown by `initDbRls` / `configureDbRls` when the supplied pool topology
+ * doesn't match the declared `mode`. E.g. `mode: "3-pool"` without a
+ * `services` pool, or `mode: "2-pool"` with an `authenticated` pool
+ * supplied (the 2-pool exception has no authenticated role per
+ * 08-rls § 7).
+ */
+export class DbRlsConfigError extends DbRlsError {
+    constructor(message) {
+        super(message);
+        this.name = "DbRlsConfigError";
+    }
+}
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,EAAE;AACF,gBAAgB;AAChB,qDAAqD;AACrD,uEAAuE;AACvE,0EAA0E;AAC1E,oDAAoD;AACpD,0EAA0E;AAC1E,wBAAwB;AACxB,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,uCAAuC;AACvC,0CAA0C;AAC1C,kDAAkD;AAClD,0EAA0E;AA+D1E,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD;QACE,KAAK,CACH,yGAAyG,CAC1G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACpC,IAAI,CAAW;IACxB,YAAY,IAAc;QACxB,KAAK,CAAC,yBAAyB,IAAI,sCAAsC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD;QACE,KAAK,CACH,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CACH,4BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,EAAE;AACF,gBAAgB;AAChB,qDAAqD;AACrD,uEAAuE;AACvE,0EAA0E;AAC1E,oDAAoD;AACpD,0EAA0E;AAC1E,wBAAwB;AACxB,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,uCAAuC;AACvC,0CAA0C;AAC1C,kDAAkD;AAClD,0EAA0E;AAsE1E,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD;QACE,KAAK,CACH,yGAAyG,CAC1G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACpC,IAAI,CAAW;IACxB,YAAY,IAAc;QACxB,KAAK,CAAC,yBAAyB,IAAI,sCAAsC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD;QACE,KAAK,CACH,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CACH,4BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,UAAU;IAC/C,QAAQ,CAAS;IAC1B,YAAY,QAAgB;QAC1B,KAAK,CACH,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gOAAgO,CACrS,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/db-rls",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
   "license": "MIT",
   "type": "module",
@@ -13,6 +13,14 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./drizzle": {
+      "types": "./dist/drizzle-policies.d.ts",
+      "default": "./dist/drizzle-policies.js"
+    },
+    "./postgres-js": {
+      "types": "./dist/postgres-js-client.d.ts",
+      "default": "./dist/postgres-js-client.js"
     }
   },
   "files": [
@@ -29,29 +37,36 @@
     "test": "bun test"
   },
   "peerDependencies": {
-    "@nodii/telemetry": "0.1.1",
     "drizzle-orm": "^0.36.0",
-    "pg": "^8.13.0"
+    "pg": "^8.13.0",
+    "postgres": "^3.4.0"
   },
   "peerDependenciesMeta": {
     "drizzle-orm": {
       "optional": false
     },
     "pg": {
-      "optional": false
+      "optional": true
+    },
+    "postgres": {
+      "optional": true
     }
   },
   "devDependencies": {
-    "@nodii/telemetry": "0.1.1",
+    "@nodii/telemetry": "0.3.0",
     "@types/bun": "^1.3.13",
     "@types/pg": "^8.11.10",
     "drizzle-orm": "^0.36.4",
     "pg": "^8.13.1",
+    "postgres": "^3.4.0",
     "typescript": "^5.9.3"
   },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cognion-nucleus/nodii-libs.git",
     "directory": "ts/db-rls"
+  },
+  "dependencies": {
+    "@nodii/telemetry": "0.3.0"
   }
 }