@nodii/db-rls 0.2.2 → 0.4.0

package/dist/drizzle-grants.d.ts

@@ -0,0 +1,203 @@
+export type PlatformOpsScopeKind = "tenant" | "platform_global" | "all_tenants";
+/**
+ * Returns a Drizzle pgTable definition for the
+ * `platform_ops_grants_replica` table per D185 § 2.
+ *
+ * Schema:
+ *   - id                  UUID PRIMARY KEY DEFAULT gen_random_uuid()
+ *   - user_id             UUID NOT NULL                              -- principal with platform-admin membership
+ *   - service_id          TEXT NOT NULL                              -- consumer service id
+ *   - scope_kind          TEXT NOT NULL CHECK (IN ('tenant','platform_global','all_tenants'))
+ *   - scope_target        UUID                                       -- tenant_id when scope_kind='tenant'; NULL otherwise
+ *   - permission          TEXT NOT NULL                              -- catalog entry name
+ *   - granted_by_user_id  UUID NOT NULL                              -- audit trail
+ *   - granted_at          TIMESTAMPTZ NOT NULL DEFAULT NOW()
+ *   - expires_at          TIMESTAMPTZ                                -- optional time-bound
+ *   - revoked_at          TIMESTAMPTZ                                -- soft revoke
+ *
+ *   Constraints:
+ *     - UNIQUE (user_id, service_id, scope_kind, scope_target, permission)
+ *     - CHECK ((scope_kind = 'tenant' AND scope_target IS NOT NULL)
+ *              OR (scope_kind IN ('platform_global','all_tenants') AND scope_target IS NULL))
+ *
+ *   Indexes:
+ *     - (user_id, service_id) WHERE revoked_at IS NULL
+ */
+export declare function platformOpsGrantsReplica(name?: string): import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: string;
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: string;
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        serviceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "service_id";
+            tableName: string;
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scopeKind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope_kind";
+            tableName: string;
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scopeTarget: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope_target";
+            tableName: string;
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        permission: import("drizzle-orm/pg-core").PgColumn<{
+            name: "permission";
+            tableName: string;
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        grantedByUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "granted_by_user_id";
+            tableName: string;
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        grantedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "granted_at";
+            tableName: string;
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: string;
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked_at";
+            tableName: string;
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=drizzle-grants.d.ts.map

package/dist/drizzle-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle-grants.d.ts","sourceRoot":"","sources":["../src/drizzle-grants.ts"],"names":[],"mappings":"AA8BA,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,SAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsC5E"}

package/dist/drizzle-grants.js

@@ -0,0 +1,68 @@
+// D185 — Drizzle table builder for `platform_ops_grants_replica`.
+//
+// Per hub decision D185 § 2 + § 6.2. The canonical schema lives in
+// `nodii-tenant-service` (source of truth); each consumer service that
+// wires a 4-pool db-rls replicates the table locally via the
+// `@nodii/replica-consumer` outbox-consumer pattern (`09-replication
+// § 6.2`). This helper emits the Drizzle schema for the replica so
+// consumer services don't drift on column shape.
+//
+// Subpath export: `@nodii/db-rls/drizzle/platform-ops-grants`.
+//
+// Usage:
+//
+//   import { platformOpsGrantsReplica } from "@nodii/db-rls/drizzle/platform-ops-grants";
+//
+//   export const grantsReplica = platformOpsGrantsReplica();
+//   // OR with custom name:
+//   export const grantsReplica = platformOpsGrantsReplica("tenant_platform_ops_grants_replica");
+import { sql } from "drizzle-orm";
+import { check, index, pgTable, text, timestamp, unique, uuid, } from "drizzle-orm/pg-core";
+/**
+ * Returns a Drizzle pgTable definition for the
+ * `platform_ops_grants_replica` table per D185 § 2.
+ *
+ * Schema:
+ *   - id                  UUID PRIMARY KEY DEFAULT gen_random_uuid()
+ *   - user_id             UUID NOT NULL                              -- principal with platform-admin membership
+ *   - service_id          TEXT NOT NULL                              -- consumer service id
+ *   - scope_kind          TEXT NOT NULL CHECK (IN ('tenant','platform_global','all_tenants'))
+ *   - scope_target        UUID                                       -- tenant_id when scope_kind='tenant'; NULL otherwise
+ *   - permission          TEXT NOT NULL                              -- catalog entry name
+ *   - granted_by_user_id  UUID NOT NULL                              -- audit trail
+ *   - granted_at          TIMESTAMPTZ NOT NULL DEFAULT NOW()
+ *   - expires_at          TIMESTAMPTZ                                -- optional time-bound
+ *   - revoked_at          TIMESTAMPTZ                                -- soft revoke
+ *
+ *   Constraints:
+ *     - UNIQUE (user_id, service_id, scope_kind, scope_target, permission)
+ *     - CHECK ((scope_kind = 'tenant' AND scope_target IS NOT NULL)
+ *              OR (scope_kind IN ('platform_global','all_tenants') AND scope_target IS NULL))
+ *
+ *   Indexes:
+ *     - (user_id, service_id) WHERE revoked_at IS NULL
+ */
+export function platformOpsGrantsReplica(name = "platform_ops_grants_replica") {
+    return pgTable(name, {
+        id: uuid("id").primaryKey().default(sql `gen_random_uuid()`),
+        userId: uuid("user_id").notNull(),
+        serviceId: text("service_id").notNull(),
+        scopeKind: text("scope_kind").notNull(),
+        scopeTarget: uuid("scope_target"),
+        permission: text("permission").notNull(),
+        grantedByUserId: uuid("granted_by_user_id").notNull(),
+        grantedAt: timestamp("granted_at", { withTimezone: true })
+            .notNull()
+            .default(sql `NOW()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }),
+        revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    }, (t) => [
+        unique(`${name}_grant_uniq`).on(t.userId, t.serviceId, t.scopeKind, t.scopeTarget, t.permission),
+        check(`${name}_scope_target_shape`, sql `(${t.scopeKind} = 'tenant' AND ${t.scopeTarget} IS NOT NULL) OR (${t.scopeKind} IN ('platform_global','all_tenants') AND ${t.scopeTarget} IS NULL)`),
+        check(`${name}_scope_kind_enum`, sql `${t.scopeKind} IN ('tenant','platform_global','all_tenants')`),
+        index(`${name}_user_service_active`)
+            .on(t.userId, t.serviceId)
+            .where(sql `${t.revokedAt} IS NULL`),
+    ]);
+}
+//# sourceMappingURL=drizzle-grants.js.map

package/dist/drizzle-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle-grants.js","sourceRoot":"","sources":["../src/drizzle-grants.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,6DAA6D;AAC7D,qEAAqE;AACrE,mEAAmE;AACnE,iDAAiD;AACjD,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,SAAS;AACT,EAAE;AACF,0FAA0F;AAC1F,EAAE;AACF,6DAA6D;AAC7D,4BAA4B;AAC5B,iGAAiG;AAEjG,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,KAAK,EACL,KAAK,EACL,OAAO,EACP,IAAI,EACJ,SAAS,EACT,MAAM,EACN,IAAI,GACL,MAAM,qBAAqB,CAAC;AAI7B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAI,GAAG,6BAA6B;IAC3E,OAAO,OAAO,CACZ,IAAI,EACJ;QACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;QAC3D,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACjC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACvC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;QACjC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACxC,eAAe,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;QACrD,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;aACvD,OAAO,EAAE;aACT,OAAO,CAAC,GAAG,CAAA,OAAO,CAAC;QACtB,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1D,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAC3D,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;QACL,MAAM,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC,EAAE,CAC7B,CAAC,CAAC,MAAM,EACR,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,UAAU,CACb;QACD,KAAK,CACH,GAAG,IAAI,qBAAqB,EAC5B,GAAG,CAAA,IAAI,CAAC,CAAC,SAAS,mBAAmB,CAAC,CAAC,WAAW,qBAAqB,CAAC,CAAC,SAAS,6CAA6C,CAAC,CAAC,WAAW,WAAW,CACxJ;QACD,KAAK,CACH,GAAG,IAAI,kBAAkB,EACzB,GAAG,CAAA,GAAG,CAAC,CAAC,SAAS,gDAAgD,CAClE;QACD,KAAK,CAAC,GAAG,IAAI,sBAAsB,CAAC;aACjC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;aACzB,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,SAAS,UAAU,CAAC;KACtC,CACF,CAAC;AACJ,CAAC"}

package/dist/drizzle-policies.d.ts

@@ -0,0 +1,90 @@
+import type { PgColumn, PgPolicy } from "drizzle-orm/pg-core";
+import type { WithRlsOpts } from "./rls-policy-gen";
+/**
+ * Returns the canonical 5-policy Drizzle constructs (per doctrine § 4)
+ * for a tenant-scoped table.
+ *
+ * Default (`allow=["SELECT","INSERT"]`) emits:
+ *
+ *   1. `<table>_owner`        FOR ALL TO nodii_owner USING (true) WITH CHECK (true)
+ *   2. `<table>_auth_select`  FOR SELECT TO authenticated USING (<col> IN (SELECT auth.user_tenant_ids(auth.get_user_id())))
+ *   3. `<table>_auth_insert`  FOR INSERT TO authenticated WITH CHECK (...)
+ *   4. `<table>_svc_select`   FOR SELECT TO nodii_services USING (<col> = auth.get_tenant_id())
+ *   5. `<table>_svc_insert`   FOR INSERT TO nodii_services WITH CHECK (...)
+ *
+ * Extending `allow` to include `"UPDATE"` / `"DELETE"` adds the
+ * corresponding verb policies for both auth + svc.
+ *
+ * `t.tenantId` must be a Drizzle column reference (used to thread the
+ * column name + table binding into the policy `link(table)` step that
+ * drizzle-kit performs).
+ */
+export declare function withRls(tenantCol: PgColumn, opts?: WithRlsOpts): PgPolicy[];
+/** Per-verb permission name binding for the platform-ops policies. Each
+ *  string is a catalog entry name (e.g. `"modules.write"`) — when a
+ *  request runs with `app.platform_ops_permission` matching this name,
+ *  the corresponding policy applies. A missing entry means there's no
+ *  policy emitted for that verb (deny-by-default RLS behavior). */
+export interface PlatformOpsPerVerbPermissions {
+    read?: string;
+    insert?: string;
+    update?: string;
+    delete?: string;
+}
+export interface WithPlatformOpsOpts {
+    /** Override the default `platform_ops_grants_replica` table name.
+     *  Use when the consuming service replicates the grants table under
+     *  a different name (e.g. prefixed with the service slug). */
+    grantsTable?: string;
+    /** Override the tenant column name in the generated predicate. Falls
+     *  back to the Drizzle column's name. */
+    tenantColumn?: string;
+}
+/**
+ * Returns the platform-ops policy bundle (per D185 § 3) for a
+ * **tenant-scoped** table exposed via a platform-ops cross-tenant
+ * surface. Emits one policy per verb in `perms`:
+ *
+ *   - `<table>_platform_ops_read`    FOR SELECT TO nodii_platform_ops USING (<grants-predicate with perms.read>)
+ *   - `<table>_platform_ops_insert`  FOR INSERT TO nodii_platform_ops WITH CHECK (<grants-predicate with perms.insert>)
+ *   - `<table>_platform_ops_update`  FOR UPDATE TO nodii_platform_ops USING + WITH CHECK (<grants-predicate with perms.update>)
+ *   - `<table>_platform_ops_delete`  FOR DELETE TO nodii_platform_ops USING (<grants-predicate with perms.delete>)
+ *
+ * Predicate shape (per D185 § 3):
+ *
+ *   EXISTS (
+ *     SELECT 1 FROM platform_ops_grants_replica g
+ *     WHERE g.user_id    = current_setting('app.user_id')::uuid
+ *       AND g.service_id = current_setting('app.platform_ops_service_id')
+ *       AND g.permission = <permission name literal>
+ *       AND g.revoked_at IS NULL
+ *       AND (g.expires_at IS NULL OR g.expires_at > NOW())
+ *       AND (
+ *         g.scope_kind = 'all_tenants'
+ *         OR (g.scope_kind = 'tenant' AND g.scope_target = <tenantCol>)
+ *       )
+ *   )
+ *
+ * Note: the permission literal is embedded in the policy body at
+ * migration-emit time (not read from `app.platform_ops_permission` at
+ * runtime). This means each verb can be bound to a distinct catalog
+ * entry — `app.platform_ops_permission` GUC is set by `withPlatformOps`
+ * to enable auditing/forensics but is NOT what the policy checks.
+ *
+ * Compose alongside `withRls(t.tenantId)` on the same table when both
+ * platform-ops AND in-tenant surfaces are exposed.
+ */
+export declare function withPlatformOpsTenant(tenantCol: PgColumn, perms: PlatformOpsPerVerbPermissions, opts?: WithPlatformOpsOpts): PgPolicy[];
+/**
+ * Returns the platform-ops policy bundle (per D185 § 3) for a
+ * **platform-global** table that has no tenant_id column (modules,
+ * role catalogs, etc.). Emits one policy per verb in `perms` using the
+ * `scope_kind='platform_global'` predicate variant.
+ */
+export declare function withPlatformOpsGlobal(table: {
+    _: {
+        name: string;
+    };
+    [key: string]: unknown;
+}, perms: PlatformOpsPerVerbPermissions, opts?: WithPlatformOpsOpts): PgPolicy[];
+//# sourceMappingURL=drizzle-policies.d.ts.map

package/dist/drizzle-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle-policies.d.ts","sourceRoot":"","sources":["../src/drizzle-policies.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAI7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,QAAQ,EACnB,IAAI,GAAE,WAAgB,GACrB,QAAQ,EAAE,CAsCZ;AA6ED;;;;mEAImE;AACnE,MAAM,WAAW,6BAA6B;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,MAAM,WAAW,mBAAmB;IAClC;;kEAE8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6CACyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,QAAQ,EACnB,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,EAAE,CA0BZ;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE;IAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EACtD,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,EAAE,CA0BZ"}

package/dist/drizzle-policies.js

@@ -0,0 +1,223 @@
+// Drizzle table-builder helper — `withRls(t.tenantId)` per doctrine § 4.2.
+//
+// Exposed via subpath `@nodii/db-rls/drizzle`. Returns an array of
+// `PgPolicy` constructs that consumers spread into Drizzle's third-arg
+// extras callback:
+//
+//   import { withRls } from "@nodii/db-rls/drizzle";
+//
+//   export const billingInvoices = pgTable("billing_invoices", {
+//     id: uuid("id").primaryKey().defaultRandom(),
+//     tenantId: uuid("tenant_id").notNull(),
+//     amount: integer("amount").notNull(),
+//   }, (t) => [
+//     ...withRls(t.tenantId),                                   // default 5 policies
+//     // OR with extra verbs:
+//     // ...withRls(t.tenantId, { allow: ["SELECT","INSERT","UPDATE","DELETE"] }),
+//   ]);
+//
+// Drizzle-kit reads these PgPolicy constructs and emits the canonical
+// 5-policy DDL (§ 4) into the generated migration SQL. Naming follows
+// doctrine § 4 exactly: `<table>_owner`, `<table>_auth_select`,
+// `<table>_auth_insert`, `<table>_svc_select`, `<table>_svc_insert`
+// (no `_policy` suffix).
+//
+// The legacy string-DDL `withRls(table: string)` helper exported from
+// `@nodii/db-rls` (main barrel) keeps its `*_policy` suffix for backwards
+// parity with v0.1.x consumers — both surfaces ship.
+import { getTableName, sql } from "drizzle-orm";
+import { pgPolicy } from "drizzle-orm/pg-core";
+const DEFAULT_ALLOW = ["SELECT", "INSERT"];
+/**
+ * Returns the canonical 5-policy Drizzle constructs (per doctrine § 4)
+ * for a tenant-scoped table.
+ *
+ * Default (`allow=["SELECT","INSERT"]`) emits:
+ *
+ *   1. `<table>_owner`        FOR ALL TO nodii_owner USING (true) WITH CHECK (true)
+ *   2. `<table>_auth_select`  FOR SELECT TO authenticated USING (<col> IN (SELECT auth.user_tenant_ids(auth.get_user_id())))
+ *   3. `<table>_auth_insert`  FOR INSERT TO authenticated WITH CHECK (...)
+ *   4. `<table>_svc_select`   FOR SELECT TO nodii_services USING (<col> = auth.get_tenant_id())
+ *   5. `<table>_svc_insert`   FOR INSERT TO nodii_services WITH CHECK (...)
+ *
+ * Extending `allow` to include `"UPDATE"` / `"DELETE"` adds the
+ * corresponding verb policies for both auth + svc.
+ *
+ * `t.tenantId` must be a Drizzle column reference (used to thread the
+ * column name + table binding into the policy `link(table)` step that
+ * drizzle-kit performs).
+ */
+export function withRls(tenantCol, opts = {}) {
+    const verbs = opts.allow && opts.allow.length > 0 ? opts.allow : DEFAULT_ALLOW;
+    const tableName = getTableName(tenantCol.table);
+    const policyBase = unqualifiedName(tableName);
+    const tenantColumn = opts.tenantColumn ?? tenantCol.name;
+    // Authenticated predicate: tenant_id IN (SELECT auth.user_tenant_ids(auth.get_user_id()))
+    const authPredicate = sql.raw(`${tenantColumn} IN (SELECT auth.user_tenant_ids(auth.get_user_id()))`);
+    // Services predicate: tenant_id = auth.get_tenant_id()
+    const svcPredicate = sql.raw(`${tenantColumn} = auth.get_tenant_id()`);
+    const policies = [];
+    // 1. Owner FOR ALL.
+    policies.push(pgPolicy(`${policyBase}_owner`, {
+        as: "permissive",
+        for: "all",
+        to: "nodii_owner",
+        using: sql `true`,
+        withCheck: sql `true`,
+    }));
+    // 2. authenticated per verb.
+    for (const verb of verbs) {
+        policies.push(authPolicyFor(policyBase, verb, authPredicate));
+    }
+    // 3. nodii_services per verb.
+    for (const verb of verbs) {
+        policies.push(svcPolicyFor(policyBase, verb, svcPredicate));
+    }
+    return policies;
+}
+function authPolicyFor(policyBase, verb, predicate) {
+    const name = `${policyBase}_auth_${verb.toLowerCase()}`;
+    return pgPolicy(name, {
+        as: "permissive",
+        for: drizzleFor(verb),
+        to: "authenticated",
+        ...predicates(verb, predicate),
+    });
+}
+function svcPolicyFor(policyBase, verb, predicate) {
+    const name = `${policyBase}_svc_${verb.toLowerCase()}`;
+    return pgPolicy(name, {
+        as: "permissive",
+        for: drizzleFor(verb),
+        to: "nodii_services",
+        ...predicates(verb, predicate),
+    });
+}
+function drizzleFor(verb) {
+    return verb.toLowerCase();
+}
+function predicates(verb, predicate) {
+    switch (verb) {
+        case "INSERT":
+            return { withCheck: predicate };
+        case "UPDATE":
+            return { using: predicate, withCheck: predicate };
+        default:
+            // SELECT, DELETE
+            return { using: predicate };
+    }
+}
+function unqualifiedName(table) {
+    const tail = table.includes(".") ? (table.split(".").pop() ?? table) : table;
+    return tail.replace(/^"|"$/g, "");
+}
+const PLATFORM_OPS_GRANTS_REPLICA_DEFAULT = "platform_ops_grants_replica";
+/**
+ * Returns the platform-ops policy bundle (per D185 § 3) for a
+ * **tenant-scoped** table exposed via a platform-ops cross-tenant
+ * surface. Emits one policy per verb in `perms`:
+ *
+ *   - `<table>_platform_ops_read`    FOR SELECT TO nodii_platform_ops USING (<grants-predicate with perms.read>)
+ *   - `<table>_platform_ops_insert`  FOR INSERT TO nodii_platform_ops WITH CHECK (<grants-predicate with perms.insert>)
+ *   - `<table>_platform_ops_update`  FOR UPDATE TO nodii_platform_ops USING + WITH CHECK (<grants-predicate with perms.update>)
+ *   - `<table>_platform_ops_delete`  FOR DELETE TO nodii_platform_ops USING (<grants-predicate with perms.delete>)
+ *
+ * Predicate shape (per D185 § 3):
+ *
+ *   EXISTS (
+ *     SELECT 1 FROM platform_ops_grants_replica g
+ *     WHERE g.user_id    = current_setting('app.user_id')::uuid
+ *       AND g.service_id = current_setting('app.platform_ops_service_id')
+ *       AND g.permission = <permission name literal>
+ *       AND g.revoked_at IS NULL
+ *       AND (g.expires_at IS NULL OR g.expires_at > NOW())
+ *       AND (
+ *         g.scope_kind = 'all_tenants'
+ *         OR (g.scope_kind = 'tenant' AND g.scope_target = <tenantCol>)
+ *       )
+ *   )
+ *
+ * Note: the permission literal is embedded in the policy body at
+ * migration-emit time (not read from `app.platform_ops_permission` at
+ * runtime). This means each verb can be bound to a distinct catalog
+ * entry — `app.platform_ops_permission` GUC is set by `withPlatformOps`
+ * to enable auditing/forensics but is NOT what the policy checks.
+ *
+ * Compose alongside `withRls(t.tenantId)` on the same table when both
+ * platform-ops AND in-tenant surfaces are exposed.
+ */
+export function withPlatformOpsTenant(tenantCol, perms, opts = {}) {
+    const tableName = getTableName(tenantCol.table);
+    const policyBase = unqualifiedName(tableName);
+    const tenantColumn = opts.tenantColumn ?? tenantCol.name;
+    const grantsTable = opts.grantsTable ?? PLATFORM_OPS_GRANTS_REPLICA_DEFAULT;
+    const policies = [];
+    for (const verb of ["read", "insert", "update", "delete"]) {
+        const permission = perms[verb];
+        if (!permission)
+            continue;
+        const predicate = platformOpsTenantPredicate(grantsTable, tenantColumn, permission);
+        policies.push(pgPolicy(`${policyBase}_platform_ops_${verb}`, {
+            as: "permissive",
+            for: drizzleForPlatformOps(verb),
+            to: "nodii_platform_ops",
+            ...platformOpsPredicates(verb, predicate),
+        }));
+    }
+    return policies;
+}
+/**
+ * Returns the platform-ops policy bundle (per D185 § 3) for a
+ * **platform-global** table that has no tenant_id column (modules,
+ * role catalogs, etc.). Emits one policy per verb in `perms` using the
+ * `scope_kind='platform_global'` predicate variant.
+ */
+export function withPlatformOpsGlobal(table, perms, opts = {}) {
+    // For platform-global tables, callers pass the Drizzle pgTable itself
+    // (no tenant column to thread). We derive the policy name from the
+    // table's symbol identifier via getTableName(table).
+    const tableName = getTableName(table);
+    const policyBase = unqualifiedName(tableName);
+    const grantsTable = opts.grantsTable ?? PLATFORM_OPS_GRANTS_REPLICA_DEFAULT;
+    const policies = [];
+    for (const verb of ["read", "insert", "update", "delete"]) {
+        const permission = perms[verb];
+        if (!permission)
+            continue;
+        const predicate = platformOpsGlobalPredicate(grantsTable, permission);
+        policies.push(pgPolicy(`${policyBase}_platform_ops_${verb}`, {
+            as: "permissive",
+            for: drizzleForPlatformOps(verb),
+            to: "nodii_platform_ops",
+            ...platformOpsPredicates(verb, predicate),
+        }));
+    }
+    return policies;
+}
+function platformOpsTenantPredicate(grantsTable, tenantColumn, permission) {
+    const lit = sqlLiteral(permission);
+    return sql.raw(`EXISTS (SELECT 1 FROM ${grantsTable} g WHERE g.user_id = current_setting('app.user_id')::uuid AND g.service_id = current_setting('app.platform_ops_service_id') AND g.permission = ${lit} AND g.revoked_at IS NULL AND (g.expires_at IS NULL OR g.expires_at > NOW()) AND (g.scope_kind = 'all_tenants' OR (g.scope_kind = 'tenant' AND g.scope_target = ${tenantColumn})))`);
+}
+function platformOpsGlobalPredicate(grantsTable, permission) {
+    const lit = sqlLiteral(permission);
+    return sql.raw(`EXISTS (SELECT 1 FROM ${grantsTable} g WHERE g.user_id = current_setting('app.user_id')::uuid AND g.service_id = current_setting('app.platform_ops_service_id') AND g.scope_kind = 'platform_global' AND g.permission = ${lit} AND g.revoked_at IS NULL AND (g.expires_at IS NULL OR g.expires_at > NOW()))`);
+}
+function drizzleForPlatformOps(verb) {
+    return verb === "read" ? "select" : verb;
+}
+function platformOpsPredicates(verb, predicate) {
+    switch (verb) {
+        case "insert":
+            return { withCheck: predicate };
+        case "update":
+            return { using: predicate, withCheck: predicate };
+        default:
+            return { using: predicate };
+    }
+}
+/** SQL literal escape — doubles single quotes, wraps in quotes. */
+function sqlLiteral(s) {
+    const escaped = s.replace(/'/g, "''");
+    return `'${escaped}'`;
+}
+//# sourceMappingURL=drizzle-policies.js.map

package/dist/drizzle-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle-policies.js","sourceRoot":"","sources":["../src/drizzle-policies.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,mBAAmB;AACnB,EAAE;AACF,qDAAqD;AACrD,EAAE;AACF,iEAAiE;AACjE,mDAAmD;AACnD,6CAA6C;AAC7C,2CAA2C;AAC3C,gBAAgB;AAChB,sFAAsF;AACtF,8BAA8B;AAC9B,mFAAmF;AACnF,QAAQ;AACR,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,oEAAoE;AACpE,yBAAyB;AACzB,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,qDAAqD;AAErD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAK/C,MAAM,aAAa,GAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,OAAO,CACrB,SAAmB,EACnB,OAAoB,EAAE;IAEtB,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;IAEzD,0FAA0F;IAC1F,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAC3B,GAAG,YAAY,uDAAuD,CACvE,CAAC;IACF,uDAAuD;IACvD,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,yBAAyB,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,oBAAoB;IACpB,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,QAAQ,EAAE;QAC9B,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,KAAK;QACV,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,GAAG,CAAA,MAAM;QAChB,SAAS,EAAE,GAAG,CAAA,MAAM;KACrB,CAAC,CACH,CAAC;IAEF,6BAA6B;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CACpB,UAAkB,EAClB,IAAa,EACb,SAAqC;IAErC,MAAM,IAAI,GAAG,GAAG,UAAU,SAAS,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACxD,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,eAAe;QACnB,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,UAAkB,EAClB,IAAa,EACb,SAAqC;IAErC,MAAM,IAAI,GAAG,GAAG,UAAU,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACvD,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,gBAAgB;QACpB,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,IAAI,CAAC,WAAW,EAA+C,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CACjB,IAAa,EACb,SAAqC;IAKrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD;YACE,iBAAiB;YACjB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAkCD,MAAM,mCAAmC,GAAG,6BAA6B,CAAC;AAY1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAmB,EACnB,KAAoC,EACpC,OAA4B,EAAE;IAE9B,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,0BAA0B,CAC1C,WAAW,EACX,YAAY,EACZ,UAAU,CACX,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE,EAAE;YAC7C,EAAE,EAAE,YAAY;YAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC;YAChC,EAAE,EAAE,oBAAoB;YACxB,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAsD,EACtD,KAAoC,EACpC,OAA4B,EAAE;IAE9B,sEAAsE;IACtE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,SAAS,GAAG,YAAY,CAC5B,KAAsD,CACvD,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,0BAA0B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACtE,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE,EAAE;YAC7C,EAAE,EAAE,YAAY;YAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC;YAChC,EAAE,EAAE,oBAAoB;YACxB,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,0BAA0B,CACjC,WAAmB,EACnB,YAAoB,EACpB,UAAkB;IAElB,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,GAAG,CACZ,yBAAyB,WAAW,kJAAkJ,GAAG,mKAAmK,YAAY,KAAK,CAC9W,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,WAAmB,EACnB,UAAkB;IAElB,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,GAAG,CACZ,yBAAyB,WAAW,uLAAuL,GAAG,+EAA+E,CAC9S,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6C;IAE7C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6C,EAC7C,SAAqC;IAKrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD;YACE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,IAAI,OAAO,GAAG,CAAC;AACxB,CAAC"}

package/dist/index.d.ts

@@ -1,14 +1,16 @@
 export declare const LIB_NAME = "db-rls";
-export declare const VERSION = "0.1.1";
+export declare const VERSION = "0.4.0";
 export { initDbRls, requireDbRls, getDbRlsOrNull, requirePool, _resetForTests, } from "./init";
 export type { InitDbRlsConfig, ResolvedDbRls } from "./init";
-export { configureDbRls, PoolCredentialMismatch, _resetConfigureForTests, } from "./configure";
-export type { ConfigureDbRlsOpts } from "./configure";
+export { configureDbRls, configureDbRls2Pool, configureDbRls4Pool, PoolCredentialMismatch, _resetConfigureForTests, } from "./configure";
+export type { ConfigureDbRlsOpts, ConfigureDbRlsPools, } from "./configure";
 export { PgClientPool } from "./pg-pool-adapter";
 export type { PgPoolAdapterOpts } from "./pg-pool-adapter";
-export { withUserContext, withSystemContext, withOwnerContext, autoDispatch, } from "./context";
+export { withUserContext, withSystemContext, withOwnerContext, withPlatformOps, autoDispatch, } from "./context";
 export { withUserContextDb, withSystemContextDb, withOwnerContextDb, } from "./drizzle-client";
 export type { DrizzleClient, NodePgDatabase } from "./drizzle-client";
+export type { OwnerContextOpts } from "./migrate-guard";
+export { assertMigrateAllowed } from "./migrate-guard";
 export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, } from "./auth-schema";
 export type { SqlExecutor } from "./auth-schema";
 export { withRls, generateTableGrants } from "./rls-policy-gen";
@@ -18,6 +20,7 @@ export type { MigrateGenInput, MigrateGenResult } from "./migrate-gen";
 export { generateRlsPolicy, authSchemaHelpers } from "./rls-policy";
 export { InMemoryPgPool } from "./in-memory-pool";
 export type { TranscriptEntry } from "./in-memory-pool";
-export { DbRlsError, DbRlsNotInitialized, PoolUnavailable, MissingTenantContext, TransactionRolledBack, } from "./types";
-export type { AuthContext, AutoDispatchOpts, GenerateRlsPolicyOpts, PgPool, PgTx, PoolKind, SystemContextOpts, UserContextOpts, } from "./types";
+export { DB_RLS_METRIC_VOCABULARY, _resetMetricsWarnLedgerForTests, } from "./metrics";
+export { DbRlsConfigError, DbRlsError, DbRlsNotInitialized, MissingTenantContext, OwnerContextOutsideMigrate, PoolUnavailable, TransactionRolledBack, } from "./types";
+export type { AuthContext, AutoDispatchOpts, DbRlsMode, GenerateRlsPolicyOpts, PgPool, PgTx, PlatformOpsContextOpts, PoolKind, SystemContextOpts, UserContextOpts, } from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE7D,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIvE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIvE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,sBAAsB,EACtB,QAAQ,EACR,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC"}