@nodii/db-rls 0.2.2 → 0.4.0

package/dist/index.js

@@ -1,32 +1,43 @@
-// @nodii/db-rls — v0.1.1 public barrel.
+// @nodii/db-rls — v0.2.3 public barrel.
 //
 // Spec: planning hub feature_doc serviceId=nodii-libs docKey=db-rls
-// (A1 posture — RLS on every tenant-scoped table — locked 2026-05-25).
+// + global doctrine `08-rls-doctrine.md` (A1 posture — RLS on every
+// tenant-scoped table — operator-confirmed 2026-06-02).
 // Polyglot ship: TS + Python + Go in parity.
 //
-// v0.1.1 surface:
-//   - configureDbRls (real pg.Pool-aware boot helper) + initDbRls (raw)
+// v0.2.3 surface (additive over v0.1.1):
+//   - configureDbRls (3-pool) + configureDbRls2Pool (2-pool exception
+//     per 08-rls § 7) + initDbRls (raw)
 //   - PgClientPool (wraps pg.Pool → PgPool interface)
 //   - InMemoryPgPool (still exported — used by upstream tests)
 //   - withUserContext / withSystemContext / withOwnerContext / autoDispatch
 //     (operates on the substrate-agnostic PgTx)
 //   - withUserContextDb / withSystemContextDb / withOwnerContextDb
 //     (Drizzle-bound; require a real PgClientPool)
+//   - withOwnerContext now enforces NODII_ENV=migrate per 08-rls § 10.2
 //   - applyAuthSchemaMigrations + AUTH_SCHEMA_SQL + AUTH_SCHEMA_GRANTS_SQL
-//   - withRls() (RLS-policy DDL generator per § 5.5)
+//   - withRls() (legacy DDL-string generator per § 5.5; keeps *_policy suffix)
+//   - withRls() Drizzle table-builder (subpath `@nodii/db-rls/drizzle`)
+//     per doctrine § 4.2 — emits canonical 5-policy DDL via Drizzle's
+//     pgPolicy constructs, naming follows doctrine § 4 (no `_policy` suffix)
+//   - postgres-js adapter (subpath `@nodii/db-rls/postgres-js`) — nodii-auth
+//     and other postgres-js consumers
+//   - DB_RLS_METRIC_VOCABULARY + 9 locked metrics + 2 spans per § 5.10
 //   - generateRlsPolicy / authSchemaHelpers (deprecated aliases, kept for
 //     parity-fence + parity with the v0.1.0 surface; no NotImplemented paths)
 //   - migrateGen + runMigrateGenCli + userTenantIdsRealSql + userTenantIdsStubSql
 //   - Typed errors: DbRlsError + DbRlsNotInitialized + PoolUnavailable +
 //                   MissingTenantContext + TransactionRolledBack +
-//                   PoolCredentialMismatch
+//                   PoolCredentialMismatch + OwnerContextOutsideMigrate +
+//                   DbRlsConfigError
 export const LIB_NAME = "db-rls";
-export const VERSION = "0.1.1";
+export const VERSION = "0.4.0";
 export { initDbRls, requireDbRls, getDbRlsOrNull, requirePool, _resetForTests, } from "./init";
-export { configureDbRls, PoolCredentialMismatch, _resetConfigureForTests, } from "./configure";
+export { configureDbRls, configureDbRls2Pool, configureDbRls4Pool, PoolCredentialMismatch, _resetConfigureForTests, } from "./configure";
 export { PgClientPool } from "./pg-pool-adapter";
-export { withUserContext, withSystemContext, withOwnerContext, autoDispatch, } from "./context";
+export { withUserContext, withSystemContext, withOwnerContext, withPlatformOps, autoDispatch, } from "./context";
 export { withUserContextDb, withSystemContextDb, withOwnerContextDb, } from "./drizzle-client";
+export { assertMigrateAllowed } from "./migrate-guard";
 export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, } from "./auth-schema";
 export { withRls, generateTableGrants } from "./rls-policy-gen";
 export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, } from "./migrate-gen";
@@ -34,5 +45,6 @@ export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSq
 // names. Both are byte-equal SQL helpers — no NotImplemented paths.
 export { generateRlsPolicy, authSchemaHelpers } from "./rls-policy";
 export { InMemoryPgPool } from "./in-memory-pool";
-export { DbRlsError, DbRlsNotInitialized, PoolUnavailable, MissingTenantContext, TransactionRolledBack, } from "./types";
+export { DB_RLS_METRIC_VOCABULARY, _resetMetricsWarnLedgerForTests, } from "./metrics";
+export { DbRlsConfigError, DbRlsError, DbRlsNotInitialized, MissingTenantContext, OwnerContextOutsideMigrate, PoolUnavailable, TransactionRolledBack, } from "./types";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,kBAAkB;AAClB,wEAAwE;AACxE,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,2EAA2E;AAC3E,qDAAqD;AACrD,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,2CAA2C;AAE3C,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAGvB,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,wDAAwD;AACxD,6CAA6C;AAC7C,EAAE;AACF,yCAAyC;AACzC,sEAAsE;AACtE,wCAAwC;AACxC,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,wEAAwE;AACxE,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,sCAAsC;AACtC,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,0EAA0E;AAC1E,qCAAqC;AAErC,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAGvB,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC"}

package/dist/init.d.ts

@@ -1,13 +1,31 @@
-import { type PgPool, type PoolKind } from "./types";
+import { type DbRlsMode, type PgPool, type PoolKind } from "./types";
+/**
+ * Process-local config. `services` and `authenticated` are optional ONLY
+ * in 2-pool mode; in 3-pool mode (the default) the type guard runs at
+ * init time and throws `DbRlsConfigError` if either is missing.
+ *
+ * v0.4.0 (D185): `platformOps` is REQUIRED when `mode:
+ * "3-pool-with-platform-ops"` and FORBIDDEN otherwise.
+ */
 export interface InitDbRlsConfig {
     owner: PgPool;
-    services: PgPool;
-    authenticated: PgPool;
+    services?: PgPool;
+    authenticated?: PgPool;
+    /** D185 platform-ops pool. Required in 4-pool mode; forbidden in
+     *  3-pool / 2-pool modes. RLS-bound (NOT BYPASSRLS); policies use
+     *  the grants-lookup predicate against `platform_ops_grants_replica`. */
+    platformOps?: PgPool;
+    /** Defaults to `"3-pool"`. Set `"2-pool"` for nodii-auth-shape services
+     *  per 08-rls § 7. Set `"3-pool-with-platform-ops"` for services with a
+     *  platform-ops surface per D185 (nodii-tenant-service, etc.). */
+    mode?: DbRlsMode;
 }
 export interface ResolvedDbRls {
     owner: PgPool;
-    services: PgPool;
-    authenticated: PgPool;
+    services: PgPool | null;
+    authenticated: PgPool | null;
+    platform_ops: PgPool | null;
+    mode: DbRlsMode;
 }
 export declare function initDbRls(config: InitDbRlsConfig): void;
 export declare function requireDbRls(): ResolvedDbRls;

package/dist/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,MAAM,EAEX,KAAK,QAAQ,EACd,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAcvD;AAED,wBAAgB,YAAY,IAAI,aAAa,CAK5C;AAED,wBAAgB,cAAc,IAAI,aAAa,GAAG,IAAI,CAErD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAOlD;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,IAAI,IAAI,CAErC"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,MAAM,EAEX,KAAK,QAAQ,EACd,MAAM,SAAS,CAAC;AAEjB;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;6EAEyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;sEAEkE;IAClE,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;CACjB;AAID,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAwDvD;AAED,wBAAgB,YAAY,IAAI,aAAa,CAK5C;AAED,wBAAgB,cAAc,IAAI,aAAa,GAAG,IAAI,CAErD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAOlD;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,IAAI,IAAI,CAErC"}

package/dist/init.js

@@ -2,18 +2,52 @@
 //
 // Spec § 5.2. Caller supplies one PgPool per role. Subsequent calls warn +
 // no-op (first-init wins). Public APIs throw `DbRlsNotInitialized` before init.
-import { DbRlsNotInitialized, PoolUnavailable, } from "./types";
+//
+// v0.2.x adds the 2-pool exception per `08-rls-doctrine § 7` — nodii-auth
+// boots without `services`/`authenticated` until its admin portal lands.
+// Mode is explicit (`"3-pool"` | `"2-pool"`) so a missing pool is never
+// silent.
+import { DbRlsConfigError, DbRlsNotInitialized, PoolUnavailable, } from "./types";
 let resolved = null;
 export function initDbRls(config) {
     if (resolved) {
-        // eslint-disable-next-line no-console
         console.warn("[@nodii/db-rls] initDbRls() called more than once; ignoring subsequent call.");
         return;
     }
+    const mode = config.mode ?? "3-pool";
+    if (mode === "3-pool") {
+        if (!config.services || !config.authenticated) {
+            throw new DbRlsConfigError("initDbRls: 3-pool mode requires owner + services + authenticated pools. Either supply both, or set mode: '2-pool' (nodii-auth shape per 08-rls § 7).");
+        }
+        if (config.platformOps) {
+            throw new DbRlsConfigError("initDbRls: 3-pool mode must not supply a 'platformOps' pool — use mode: '3-pool-with-platform-ops' per hub decision D185 if you have a platform-ops surface.");
+        }
+    }
+    // 2-pool: services optional, authenticated forbidden (the whole point
+    // of the exception is that nodii-auth has no user-context surface yet).
+    if (mode === "2-pool") {
+        if (config.authenticated) {
+            throw new DbRlsConfigError("initDbRls: 2-pool mode must not supply an 'authenticated' pool — the 2-pool exception per 08-rls § 7 covers services without user-context. Use mode: '3-pool' if you have an authenticated pool.");
+        }
+        if (config.platformOps) {
+            throw new DbRlsConfigError("initDbRls: 2-pool mode must not supply a 'platformOps' pool — the 2-pool exception per 08-rls § 7 has no platform-ops surface. Use mode: '3-pool-with-platform-ops' per D185.");
+        }
+    }
+    // 4-pool (D185): owner + services + authenticated + platformOps all required.
+    if (mode === "3-pool-with-platform-ops") {
+        if (!config.services || !config.authenticated) {
+            throw new DbRlsConfigError("initDbRls: '3-pool-with-platform-ops' mode requires owner + services + authenticated + platformOps pools (D185). All four are mandatory.");
+        }
+        if (!config.platformOps) {
+            throw new DbRlsConfigError("initDbRls: '3-pool-with-platform-ops' mode requires a 'platformOps' pool wired against the nodii_platform_ops Postgres role (D185 § 1). Did you mean mode: '3-pool'?");
+        }
+    }
     resolved = {
         owner: config.owner,
-        services: config.services,
-        authenticated: config.authenticated,
+        services: config.services ?? null,
+        authenticated: config.authenticated ?? null,
+        platform_ops: config.platformOps ?? null,
+        mode,
     };
 }
 export function requireDbRls() {

package/dist/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAEhF,OAAO,EACL,mBAAmB,EAEnB,eAAe,GAEhB,MAAM,SAAS,CAAC;AAcjB,IAAI,QAAQ,GAAyB,IAAI,CAAC;AAE1C,MAAM,UAAU,SAAS,CAAC,MAAuB;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACb,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,8EAA8E,CAC/E,CAAC;QACF,OAAO;IACT,CAAC;IAED,QAAQ,GAAG;QACT,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,mBAAmB,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAc;IACxC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc;IAC5B,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,UAAU;AAEV,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EAGnB,eAAe,GAEhB,MAAM,SAAS,CAAC;AAgCjB,IAAI,QAAQ,GAAyB,IAAI,CAAC;AAE1C,MAAM,UAAU,SAAS,CAAC,MAAuB;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,8EAA8E,CAC/E,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAc,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC;IAChD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC9C,MAAM,IAAI,gBAAgB,CACxB,sJAAsJ,CACvJ,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,gBAAgB,CACxB,8JAA8J,CAC/J,CAAC;QACJ,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,MAAM,IAAI,gBAAgB,CACxB,kMAAkM,CACnM,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,gBAAgB,CACxB,+KAA+K,CAChL,CAAC;QACJ,CAAC;IACH,CAAC;IACD,8EAA8E;IAC9E,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC9C,MAAM,IAAI,gBAAgB,CACxB,0IAA0I,CAC3I,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CACxB,sKAAsK,CACvK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,GAAG;QACT,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;QAC3C,YAAY,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;QACxC,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,mBAAmB,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAc;IACxC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc;IAC5B,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC"}

package/dist/metrics.d.ts

@@ -0,0 +1,28 @@
+import { type MetricVocabularyRegistry } from "@nodii/telemetry";
+import type { PoolKind } from "./types";
+export declare const DB_RLS_METRIC_VOCABULARY: MetricVocabularyRegistry;
+export declare function recordAcquisition(pool: PoolKind, outcome: "success" | "failure"): void;
+export declare function recordAcquisitionDuration(pool: PoolKind, durationMs: number): void;
+export declare function recordPoolSize(pool: PoolKind, state: "active" | "idle" | "waiting", size: number): void;
+export declare function recordTxDuration(pool: PoolKind, outcome: "committed" | "rolled_back" | "error", durationMs: number): void;
+export declare function recordCrossPoolNesting(outer: PoolKind, inner: PoolKind, reason: string): void;
+export declare function recordCrossPoolViolation(outer: PoolKind, attemptedInner: PoolKind): void;
+export declare function recordOwnerContextInvocation(outcome: "allowed" | "refused"): void;
+export declare function recordGucSetFailure(guc: string): void;
+/**
+ * Wraps `fn` in a `db.rls.tx` span scoped to `pool`. The span stamps
+ * the final outcome attribute (`committed` / `rolled_back` / `error`)
+ * via the `setOutcome` callback the caller passes through. On thrown
+ * exceptions the tracer.span lifecycle marks status=ERROR + records
+ * the exception — no extra work needed here.
+ */
+export declare function withTxSpan<T>(pool: PoolKind, fn: (setOutcome: (o: "committed" | "rolled_back" | "error") => void) => Promise<T>): Promise<T>;
+/**
+ * Emits a one-shot `db.rls.pool.acquire` span. Caller invokes this only
+ * when acquisition time exceeds the slow threshold (default 50ms per
+ * § 5.10) — keeps span volume bounded.
+ */
+export declare function emitSlowAcquireSpan(pool: PoolKind, durationMs: number): void;
+/** Test-only: reset the one-shot warn ledger so each test runs clean. */
+export declare function _resetMetricsWarnLedgerForTests(): void;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../src/metrics.ts"],"names":[],"mappings":"AAmBA,OAAO,EAEL,KAAK,wBAAwB,EAI9B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAWxC,eAAO,MAAM,wBAAwB,EAAE,wBAsDtC,CAAC;AAuFF,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,SAAS,GAAG,SAAS,GAC7B,IAAI,CAKN;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,QAAQ,EACd,UAAU,EAAE,MAAM,GACjB,IAAI,CAMN;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,EACpC,IAAI,EAAE,MAAM,GACX,IAAI,CAMN;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,EAC9C,UAAU,EAAE,MAAM,GACjB,IAAI,CAUN;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,QAAQ,EACf,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,MAAM,GACb,IAAI,CAKN;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,EACf,cAAc,EAAE,QAAQ,GACvB,IAAI,CAKN;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,GAAG,SAAS,GAC7B,IAAI,CAKN;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAKrD;AAQD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAChC,IAAI,EAAE,QAAQ,EACd,EAAE,EAAE,CACF,UAAU,EAAE,CAAC,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,KAAK,IAAI,KAC3D,OAAO,CAAC,CAAC,CAAC,GACd,OAAO,CAAC,CAAC,CAAC,CA8BZ;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAgB5E;AAKD,yEAAyE;AACzE,wBAAgB,+BAA+B,IAAI,IAAI,CAGtD"}

package/dist/metrics.js

@@ -0,0 +1,263 @@
+// 9 locked db-rls metrics + 2 spans per `db-rls.md § 5.10` + doctrine
+// `08-rls-doctrine.md § 12.4`. Wired through `@nodii/telemetry`'s
+// vocabulary-bound `metrics.counter` / `metrics.histogram` API.
+//
+// Behavioral discipline:
+//   - Each metric is registered lazily on first emit. If the consumer
+//     hasn't merged `DB_RLS_METRIC_VOCABULARY` into their
+//     `initTelemetry({ vocabularyRegistry })` call, the registration
+//     throws `MetricVocabularyError`. We catch + `console.warn` once per
+//     metric so adopters see the gap; subsequent emissions are silently
+//     no-op for that name. Mirrors the pattern in
+//     `ts/approval/src/telemetry-shim.ts`.
+//   - Consumers wire `DB_RLS_METRIC_VOCABULARY` into their telemetry init
+//     so the registrations succeed; from then on the metrics emit
+//     normally.
+//   - Spans are emitted via `@nodii/telemetry`'s `tracer.startSpan`. Same
+//     try/swallow pattern — `TelemetryNotInitialized` is caught + the
+//     fn runs without a span.
+import { MetricVocabularyError, metrics, tracer, TelemetryNotInitialized, } from "@nodii/telemetry";
+/**
+ * Vocabulary registration. Adopters merge this into their `initTelemetry({
+ * vocabularyRegistry })` call so the metrics emitted by `@nodii/db-rls`
+ * are recognized.
+ */
+// All 9 metrics map to D18 family `pool` + the doctrine § 12.4 decision
+// `D-rls-metrics-v1` (recorded in the locked db-rls.md § 5.10 table).
+const DOCTRINE_DECISION = "D-rls-metrics-v1";
+export const DB_RLS_METRIC_VOCABULARY = {
+    "db_rls.pool.acquisitions_total": {
+        family: "pool",
+        description: "Pool connection acquisitions per pool + outcome (success|failure).",
+        decision: DOCTRINE_DECISION,
+    },
+    "db_rls.pool.acquisition_duration_seconds": {
+        family: "pool",
+        description: "Duration (s) from pool.connect() request to client ready.",
+        decision: DOCTRINE_DECISION,
+    },
+    "db_rls.pool.size": {
+        family: "pool",
+        description: "Pool size sampled at tx finish; state ∈ {active, idle, waiting}.",
+        decision: DOCTRINE_DECISION,
+    },
+    "db_rls.tx.duration_seconds": {
+        family: "pool",
+        description: "Per-transaction duration (s) from BEGIN to COMMIT/ROLLBACK, per pool + outcome.",
+        decision: DOCTRINE_DECISION,
+    },
+    "db_rls.tx.outcomes_total": {
+        family: "pool",
+        description: "Transaction outcomes per pool. outcome ∈ {committed, rolled_back, error}.",
+        decision: DOCTRINE_DECISION,
+    },
+    "db_rls.cross_pool_nesting_total": {
+        family: "pool",
+        description: "Sanctioned cross-pool nesting events ({outer}→{inner}, with reason).",
+        decision: DOCTRINE_DECISION,
+    },
+    "db_rls.cross_pool_violations_total": {
+        family: "pool",
+        description: "Refused cross-pool nesting attempts ({outer}→{attempted_inner}).",
+        decision: DOCTRINE_DECISION,
+    },
+    "db_rls.owner_context_invocations_total": {
+        family: "pool",
+        description: "withOwnerContext entry events. Should be 0 in non-migration prod runtime.",
+        decision: DOCTRINE_DECISION,
+    },
+    "db_rls.guc_set_failures_total": {
+        family: "pool",
+        description: "GUC set_config failures by GUC name — indicates auth.* helper drift.",
+        decision: DOCTRINE_DECISION,
+    },
+};
+/**
+ * One-shot warn ledger for metric names whose registration failed (e.g.
+ * because the consumer didn't merge `DB_RLS_METRIC_VOCABULARY`). Each
+ * name warn-logs once; subsequent emissions of that name are silent.
+ */
+const WARNED = new Set();
+let TELEMETRY_WARNED = false;
+function warnOnce(metric, err) {
+    if (WARNED.has(metric))
+        return;
+    WARNED.add(metric);
+    const msg = err instanceof Error ? err.message : String(err);
+    console.warn(`[@nodii/db-rls] metric '${metric}' swallowed: ${msg}. Merge DB_RLS_METRIC_VOCABULARY into your initTelemetry({ vocabularyRegistry }) call so db-rls metrics emit. Further failures for '${metric}' will be silent.`);
+}
+function warnTelemetryOnce(err) {
+    if (TELEMETRY_WARNED)
+        return;
+    TELEMETRY_WARNED = true;
+    const msg = err instanceof Error ? err.message : String(err);
+    console.warn(`[@nodii/db-rls] telemetry not initialized: ${msg}. Call initTelemetry({ vocabularyRegistry: { ...DB_RLS_METRIC_VOCABULARY, ... } }) at process start. Further telemetry failures will be silent.`);
+}
+function inc(args) {
+    try {
+        const handle = metrics.counter(args.name, {
+            family: "pool",
+            description: DB_RLS_METRIC_VOCABULARY[args.name]?.description ?? "",
+            labelKeys: args.labels ? Object.keys(args.labels) : [],
+        });
+        handle.inc(args.by ?? 1, args.labels ?? {});
+    }
+    catch (err) {
+        if (err instanceof MetricVocabularyError) {
+            warnOnce(args.name, err);
+            return;
+        }
+        if (err instanceof TelemetryNotInitialized) {
+            warnTelemetryOnce(err);
+            return;
+        }
+        // Anything else: also one-shot warn, never throw out of the metric path.
+        warnOnce(args.name, err);
+    }
+}
+function observe(args) {
+    try {
+        const handle = metrics.histogram(args.name, {
+            family: "pool",
+            description: DB_RLS_METRIC_VOCABULARY[args.name]?.description ?? "",
+            labelKeys: args.labels ? Object.keys(args.labels) : [],
+        });
+        handle.record(args.value, args.labels ?? {});
+    }
+    catch (err) {
+        if (err instanceof MetricVocabularyError) {
+            warnOnce(args.name, err);
+            return;
+        }
+        if (err instanceof TelemetryNotInitialized) {
+            warnTelemetryOnce(err);
+            return;
+        }
+        warnOnce(args.name, err);
+    }
+}
+// ---------------------------------------------------------------------------
+// Public emission helpers — called by PgClientPool / PgPostgresJsPool /
+// context.ts. Each helper is a thin shim so the call sites stay readable.
+export function recordAcquisition(pool, outcome) {
+    inc({
+        name: "db_rls.pool.acquisitions_total",
+        labels: { pool, outcome },
+    });
+}
+export function recordAcquisitionDuration(pool, durationMs) {
+    observe({
+        name: "db_rls.pool.acquisition_duration_seconds",
+        value: durationMs / 1000,
+        labels: { pool },
+    });
+}
+export function recordPoolSize(pool, state, size) {
+    observe({
+        name: "db_rls.pool.size",
+        value: size,
+        labels: { pool, state },
+    });
+}
+export function recordTxDuration(pool, outcome, durationMs) {
+    observe({
+        name: "db_rls.tx.duration_seconds",
+        value: durationMs / 1000,
+        labels: { pool, outcome },
+    });
+    inc({
+        name: "db_rls.tx.outcomes_total",
+        labels: { pool, outcome },
+    });
+}
+export function recordCrossPoolNesting(outer, inner, reason) {
+    inc({
+        name: "db_rls.cross_pool_nesting_total",
+        labels: { outer, inner, reason },
+    });
+}
+export function recordCrossPoolViolation(outer, attemptedInner) {
+    inc({
+        name: "db_rls.cross_pool_violations_total",
+        labels: { outer, attempted_inner: attemptedInner },
+    });
+}
+export function recordOwnerContextInvocation(outcome) {
+    inc({
+        name: "db_rls.owner_context_invocations_total",
+        labels: { outcome },
+    });
+}
+export function recordGucSetFailure(guc) {
+    inc({
+        name: "db_rls.guc_set_failures_total",
+        labels: { guc },
+    });
+}
+// ---------------------------------------------------------------------------
+// Spans — `db.rls.tx{pool}` per § 5.10 wraps the tx fn so the span end
+// runs deterministically on success + throw. `db.rls.pool.acquire{pool}`
+// is emitted as a one-shot span only when acquisition exceeds the slow
+// threshold (default 50ms) per the doctrine.
+/**
+ * Wraps `fn` in a `db.rls.tx` span scoped to `pool`. The span stamps
+ * the final outcome attribute (`committed` / `rolled_back` / `error`)
+ * via the `setOutcome` callback the caller passes through. On thrown
+ * exceptions the tracer.span lifecycle marks status=ERROR + records
+ * the exception — no extra work needed here.
+ */
+export async function withTxSpan(pool, fn) {
+    try {
+        return await tracer.span("db.rls.tx", async (span) => {
+            let outcome = "error";
+            try {
+                const out = await fn((o) => {
+                    outcome = o;
+                });
+                span.setAttribute("outcome", outcome);
+                return out;
+            }
+            catch (err) {
+                span.setAttribute("outcome", "error");
+                throw err;
+            }
+        }, { attributes: { pool } });
+    }
+    catch (err) {
+        if (err instanceof TelemetryNotInitialized) {
+            warnTelemetryOnce(err);
+            // Telemetry not initialized — degrade to a plain pass-through.
+            let outcome = "error";
+            return await fn((o) => {
+                outcome = o;
+            }).finally(() => void outcome);
+        }
+        throw err;
+    }
+}
+/**
+ * Emits a one-shot `db.rls.pool.acquire` span. Caller invokes this only
+ * when acquisition time exceeds the slow threshold (default 50ms per
+ * § 5.10) — keeps span volume bounded.
+ */
+export function emitSlowAcquireSpan(pool, durationMs) {
+    // Fire-and-forget single-tick span — no fn body to wrap.
+    void tracer
+        .span("db.rls.pool.acquire", async (_span) => {
+        /* attributes set via opts; no inner work. */
+    }, { attributes: { pool, "duration.ms": durationMs } })
+        .catch((err) => {
+        if (err instanceof TelemetryNotInitialized) {
+            warnTelemetryOnce(err);
+        }
+        /* otherwise swallow */
+    });
+}
+// ---------------------------------------------------------------------------
+// Test hooks.
+/** Test-only: reset the one-shot warn ledger so each test runs clean. */
+export function _resetMetricsWarnLedgerForTests() {
+    WARNED.clear();
+    TELEMETRY_WARNED = false;
+}
+//# sourceMappingURL=metrics.js.map

package/dist/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../src/metrics.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,kEAAkE;AAClE,gEAAgE;AAChE,EAAE;AACF,yBAAyB;AACzB,sEAAsE;AACtE,0DAA0D;AAC1D,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,2CAA2C;AAC3C,0EAA0E;AAC1E,kEAAkE;AAClE,gBAAgB;AAChB,0EAA0E;AAC1E,sEAAsE;AACtE,8BAA8B;AAE9B,OAAO,EACL,qBAAqB,EAErB,OAAO,EACP,MAAM,EACN,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAI1B;;;;GAIG;AACH,wEAAwE;AACxE,sEAAsE;AACtE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAE7C,MAAM,CAAC,MAAM,wBAAwB,GAA6B;IAChE,gCAAgC,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,WAAW,EACT,oEAAoE;QACtE,QAAQ,EAAE,iBAAiB;KAC5B;IACD,0CAA0C,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,2DAA2D;QACxE,QAAQ,EAAE,iBAAiB;KAC5B;IACD,kBAAkB,EAAE;QAClB,MAAM,EAAE,MAAM;QACd,WAAW,EACT,kEAAkE;QACpE,QAAQ,EAAE,iBAAiB;KAC5B;IACD,4BAA4B,EAAE;QAC5B,MAAM,EAAE,MAAM;QACd,WAAW,EACT,iFAAiF;QACnF,QAAQ,EAAE,iBAAiB;KAC5B;IACD,0BAA0B,EAAE;QAC1B,MAAM,EAAE,MAAM;QACd,WAAW,EACT,2EAA2E;QAC7E,QAAQ,EAAE,iBAAiB;KAC5B;IACD,iCAAiC,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,WAAW,EACT,sEAAsE;QACxE,QAAQ,EAAE,iBAAiB;KAC5B;IACD,oCAAoC,EAAE;QACpC,MAAM,EAAE,MAAM;QACd,WAAW,EACT,kEAAkE;QACpE,QAAQ,EAAE,iBAAiB;KAC5B;IACD,wCAAwC,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,WAAW,EACT,2EAA2E;QAC7E,QAAQ,EAAE,iBAAiB;KAC5B;IACD,+BAA+B,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,WAAW,EACT,sEAAsE;QACxE,QAAQ,EAAE,iBAAiB;KAC5B;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;AACjC,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B,SAAS,QAAQ,CAAC,MAAc,EAAE,GAAY;IAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO;IAC/B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CACV,2BAA2B,MAAM,gBAAgB,GAAG,uIAAuI,MAAM,mBAAmB,CACrN,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,gBAAgB;QAAE,OAAO;IAC7B,gBAAgB,GAAG,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CACV,8CAA8C,GAAG,iJAAiJ,CACnM,CAAC;AACJ,CAAC;AAQD,SAAS,GAAG,CAAC,IAAiB;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE;YACnE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SACvD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC3C,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAQD,SAAS,OAAO,CAAC,IAAmB;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE;YACnE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SACvD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC3C,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,0EAA0E;AAE1E,MAAM,UAAU,iBAAiB,CAC/B,IAAc,EACd,OAA8B;IAE9B,GAAG,CAAC;QACF,IAAI,EAAE,gCAAgC;QACtC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,IAAc,EACd,UAAkB;IAElB,OAAO,CAAC;QACN,IAAI,EAAE,0CAA0C;QAChD,KAAK,EAAE,UAAU,GAAG,IAAI;QACxB,MAAM,EAAE,EAAE,IAAI,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAc,EACd,KAAoC,EACpC,IAAY;IAEZ,OAAO,CAAC;QACN,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;KACxB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAc,EACd,OAA8C,EAC9C,UAAkB;IAElB,OAAO,CAAC;QACN,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,UAAU,GAAG,IAAI;QACxB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KAC1B,CAAC,CAAC;IACH,GAAG,CAAC;QACF,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAe,EACf,KAAe,EACf,MAAc;IAEd,GAAG,CAAC;QACF,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAe,EACf,cAAwB;IAExB,GAAG,CAAC;QACF,IAAI,EAAE,oCAAoC;QAC1C,MAAM,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE;KACnD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAA8B;IAE9B,GAAG,CAAC;QACF,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,EAAE,OAAO,EAAE;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,GAAG,CAAC;QACF,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,EAAE,GAAG,EAAE;KAChB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,6CAA6C;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAc,EACd,EAEe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,IAAI,CACtB,WAAW,EACX,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,IAAI,OAAO,GAA0C,OAAO,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;oBACzB,OAAO,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACtC,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACtC,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,EACD,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,CACzB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC3C,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACvB,+DAA+D;YAC/D,IAAI,OAAO,GAA0C,OAAO,CAAC;YAC7D,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpB,OAAO,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAc,EAAE,UAAkB;IACpE,yDAAyD;IACzD,KAAK,MAAM;SACR,IAAI,CACH,qBAAqB,EACrB,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,6CAA6C;IAC/C,CAAC,EACD,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,CACpD;SACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC3C,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,uBAAuB;IACzB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8EAA8E;AAC9E,cAAc;AAEd,yEAAyE;AACzE,MAAM,UAAU,+BAA+B;IAC7C,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC"}

package/dist/migrate-guard.d.ts

@@ -0,0 +1,14 @@
+export interface OwnerContextOpts {
+    /** Bypass the `NODII_ENV=migrate` guard. Requires `reason` to be a
+     *  non-empty string so the bypass is at least intentional. v0.2.x:
+     *  the reason is captured for log lines + future audit emission. */
+    allowOutsideMigrate?: boolean;
+    /** Operator-attested reason, required iff `allowOutsideMigrate` is true. */
+    reason?: string;
+}
+/**
+ * Asserts the caller can legitimately enter `withOwnerContext`. Throws
+ * `OwnerContextOutsideMigrate` if the guard is not satisfied.
+ */
+export declare function assertMigrateAllowed(opts?: OwnerContextOpts): void;
+//# sourceMappingURL=migrate-guard.d.ts.map

package/dist/migrate-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-guard.d.ts","sourceRoot":"","sources":["../src/migrate-guard.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,gBAAgB;IAC/B;;wEAEoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,gBAAqB,GAAG,IAAI,CAWtE"}

package/dist/migrate-guard.js

@@ -0,0 +1,33 @@
+// migrate-guard — per `08-rls-doctrine § 10.2`.
+//
+// `withOwnerContext` / `withOwnerContextDb` connect via `nodii_owner`
+// which is BYPASSRLS. Invoking it outside a migration is a tenant-
+// isolation escape: an owner-pool query against the live request path
+// returns ALL tenants' rows. The guard refuses by default unless:
+//
+//   1. `NODII_ENV=migrate` (migration scripts opt in via env), OR
+//   2. The caller explicitly passes `{ allowOutsideMigrate: true,
+//      reason: "..." }` with an operator-attested reason.
+//
+// Both paths are first-class — option 2 exists for legitimate ops
+// tooling (DSAR fulfillment, support-ticket data extraction) where the
+// caller has attested authorization. v0.2.x ships the guard; the
+// audit-row-on-bypass extension lands in a follow-up slot.
+import { OwnerContextOutsideMigrate } from "./types";
+/**
+ * Asserts the caller can legitimately enter `withOwnerContext`. Throws
+ * `OwnerContextOutsideMigrate` if the guard is not satisfied.
+ */
+export function assertMigrateAllowed(opts = {}) {
+    if (opts.allowOutsideMigrate) {
+        if (!opts.reason || opts.reason.trim() === "") {
+            throw new OwnerContextOutsideMigrate(process.env.NODII_ENV ?? "(unset)");
+        }
+        return;
+    }
+    const env = process.env.NODII_ENV ?? "";
+    if (env !== "migrate") {
+        throw new OwnerContextOutsideMigrate(env === "" ? "(unset)" : env);
+    }
+}
+//# sourceMappingURL=migrate-guard.js.map

package/dist/migrate-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-guard.js","sourceRoot":"","sources":["../src/migrate-guard.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,kEAAkE;AAClE,EAAE;AACF,kEAAkE;AAClE,kEAAkE;AAClE,0DAA0D;AAC1D,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,iEAAiE;AACjE,2DAA2D;AAE3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAWrD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAyB,EAAE;IAC9D,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,0BAA0B,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,0BAA0B,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/pg-pool-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pg-pool-adapter.d.ts","sourceRoot":"","sources":["../src/pg-pool-adapter.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,IAAI,EAAE,IAAI,CAAC;IACX,sDAAsD;IACtD,IAAI,EAAE,QAAQ,CAAC;IACf;uDACmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;qDACiD;IACjD,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACvE;qDACiD;IACjD,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,QAAQ,CAAC;QACf,OAAO,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;QAC/C,UAAU,EAAE,MAAM,CAAC;KACpB,KAAK,IAAI,CAAC;CACZ;AAsBD;;;;GAIG;AACH,qBAAa,YAAa,YAAW,MAAM;IACzC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAkC;gBAElD,IAAI,EAAE,iBAAiB;IAQnC;;;sEAGkE;IAClE,IAAI,OAAO,IAAI,IAAI,CAElB;IAEK,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAgDnE"}
+{"version":3,"file":"pg-pool-adapter.d.ts","sourceRoot":"","sources":["../src/pg-pool-adapter.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAU3C,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,IAAI,EAAE,IAAI,CAAC;IACX,sDAAsD;IACtD,IAAI,EAAE,QAAQ,CAAC;IACf;uDACmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;qDACiD;IACjD,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACvE;qDACiD;IACjD,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,QAAQ,CAAC;QACf,OAAO,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;QAC/C,UAAU,EAAE,MAAM,CAAC;KACpB,KAAK,IAAI,CAAC;CACZ;AA2BD;;;;GAIG;AACH,qBAAa,YAAa,YAAW,MAAM;IACzC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAkC;gBAElD,IAAI,EAAE,iBAAiB;IAQnC;;;sEAGkE;IAClE,IAAI,OAAO,IAAI,IAAI,CAElB;IAEK,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CA2FnE"}