@nodii/db-rls 0.2.2 → 0.4.0

package/dist/pg-pool-adapter.js

@@ -13,6 +13,7 @@
 // Pool-leak guard: client.release() ALWAYS runs in the finally block,
 // regardless of commit/rollback outcome. The acquire-timer fires a
 // telemetry span when acquisition exceeds 50ms (§ 5.10).
+import { emitSlowAcquireSpan, recordAcquisition, recordAcquisitionDuration, recordGucSetFailure, recordPoolSize, recordTxDuration, withTxSpan, } from "./metrics";
 class PgClientTx {
     poolKind;
     client;
@@ -26,7 +27,13 @@ class PgClientTx {
     async setConfig(key, value) {
         // set_config(name, value, is_local=true) — tx-local per § 5.3.
         // Never expose the false variant; library refuses session-scoped GUCs.
-        await this.client.query("SELECT set_config($1, $2, true)", [key, value]);
+        try {
+            await this.client.query("SELECT set_config($1, $2, true)", [key, value]);
+        }
+        catch (err) {
+            recordGucSetFailure(key);
+            throw err;
+        }
     }
 }
 /**
@@ -56,48 +63,94 @@ export class PgClientPool {
     }
     async withTransaction(fn) {
         const acquireStart = Date.now();
-        const client = await this.pool.connect();
+        let client;
+        try {
+            client = await this.pool.connect();
+        }
+        catch (err) {
+            recordAcquisition(this.kind, "failure");
+            throw err;
+        }
         const acquireMs = Date.now() - acquireStart;
-        if (acquireMs >= this.slowAcquireMs && this.onSlowAcquire) {
-            try {
-                this.onSlowAcquire({ pool: this.kind, durationMs: acquireMs });
-            }
-            catch {
-                /* hook errors are non-fatal */
+        recordAcquisition(this.kind, "success");
+        recordAcquisitionDuration(this.kind, acquireMs);
+        if (acquireMs >= this.slowAcquireMs) {
+            emitSlowAcquireSpan(this.kind, acquireMs);
+            if (this.onSlowAcquire) {
+                try {
+                    this.onSlowAcquire({ pool: this.kind, durationMs: acquireMs });
+                }
+                catch {
+                    /* hook errors are non-fatal */
+                }
             }
         }
         const txStart = Date.now();
         let outcome = "error";
         try {
-            await client.query("BEGIN");
-            const tx = new PgClientTx(this.kind, client);
-            let result;
-            try {
-                result = await fn(tx);
-            }
-            catch (err) {
-                // Rollback then re-throw. Swallow rollback failure (don't double-throw).
+            return await withTxSpan(this.kind, async (setOutcome) => {
                 try {
-                    await client.query("ROLLBACK");
+                    await client.query("BEGIN");
+                    const tx = new PgClientTx(this.kind, client);
+                    let result;
+                    try {
+                        result = await fn(tx);
+                    }
+                    catch (err) {
+                        // Rollback then re-throw. Swallow rollback failure (don't
+                        // double-throw).
+                        try {
+                            await client.query("ROLLBACK");
+                        }
+                        catch {
+                            /* swallow per § 5.9 */
+                        }
+                        outcome = "rolled_back";
+                        setOutcome("rolled_back");
+                        throw err;
+                    }
+                    await client.query("COMMIT");
+                    outcome = "committed";
+                    setOutcome("committed");
+                    return result;
                 }
-                catch {
-                    /* swallow per § 5.9 */
+                catch (err) {
+                    // BEGIN failure (or other pre-fn throw) — record error path.
+                    if (outcome === "error") {
+                        setOutcome("error");
+                    }
+                    throw err;
                 }
-                outcome = "rolled_back";
-                throw err;
-            }
-            await client.query("COMMIT");
-            outcome = "committed";
-            return result;
+            });
         }
         finally {
             const durationMs = Date.now() - txStart;
+            recordTxDuration(this.kind, outcome, durationMs);
             try {
                 this.onTxFinish?.({ pool: this.kind, outcome, durationMs });
             }
             catch {
                 /* hook errors are non-fatal */
             }
+            // Sample pool-size gauge at tx end. pg.Pool exposes totalCount /
+            // idleCount / waitingCount; if absent (mocked or wrapped pool),
+            // skip silently.
+            try {
+                // biome-ignore lint/suspicious/noExplicitAny: pg.Pool stats
+                const stats = this.pool;
+                if (typeof stats.totalCount === "number") {
+                    const total = stats.totalCount;
+                    const idle = stats.idleCount ?? 0;
+                    const waiting = stats.waitingCount ?? 0;
+                    const active = Math.max(0, total - idle);
+                    recordPoolSize(this.kind, "active", active);
+                    recordPoolSize(this.kind, "idle", idle);
+                    recordPoolSize(this.kind, "waiting", waiting);
+                }
+            }
+            catch {
+                /* gauge sampling errors are non-fatal */
+            }
             // Pool-leak guard — release ALWAYS runs, even on commit/rollback failure.
             try {
                 client.release();

package/dist/pg-pool-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"pg-pool-adapter.js","sourceRoot":"","sources":["../src/pg-pool-adapter.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,qBAAqB;AACrB,EAAE;AACF,uBAAuB;AACvB,2EAA2E;AAC3E,aAAa;AACb,wEAAwE;AACxE,8BAA8B;AAC9B,+CAA+C;AAC/C,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,yDAAyD;AAyBzD,MAAM,UAAU;IACL,QAAQ,CAAW;IACnB,MAAM,CAAa;IAE5B,YAAY,IAAc,EAAE,MAAkB;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,+DAA+D;QAC/D,uEAAuE;QACvE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACd,IAAI,CAAW;IACP,IAAI,CAAO;IACX,aAAa,CAAS;IACtB,aAAa,CAAsC;IACnD,UAAU,CAAmC;IAE9D,YAAY,IAAuB;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;;;sEAGkE;IAClE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAC5C,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,MAAS,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,yEAAyE;gBACzE,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;gBACD,OAAO,GAAG,aAAa,CAAC;gBACxB,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,GAAG,WAAW,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;YACD,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"pg-pool-adapter.js","sourceRoot":"","sources":["../src/pg-pool-adapter.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,qBAAqB;AACrB,EAAE;AACF,uBAAuB;AACvB,2EAA2E;AAC3E,aAAa;AACb,wEAAwE;AACxE,8BAA8B;AAC9B,+CAA+C;AAC/C,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,yDAAyD;AAGzD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,UAAU,GACX,MAAM,WAAW,CAAC;AAuBnB,MAAM,UAAU;IACL,QAAQ,CAAW;IACnB,MAAM,CAAa;IAE5B,YAAY,IAAc,EAAE,MAAkB;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,+DAA+D;QAC/D,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACd,IAAI,CAAW;IACP,IAAI,CAAO;IACX,aAAa,CAAS;IACtB,aAAa,CAAsC;IACnD,UAAU,CAAmC;IAE9D,YAAY,IAAuB;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;;;sEAGkE;IAClE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACxC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,CAAC;YACH,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBACtD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC5B,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC7C,IAAI,MAAS,CAAC;oBACd,IAAI,CAAC;wBACH,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBACxB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,0DAA0D;wBAC1D,iBAAiB;wBACjB,IAAI,CAAC;4BACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;wBACjC,CAAC;wBAAC,MAAM,CAAC;4BACP,uBAAuB;wBACzB,CAAC;wBACD,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,MAAM,GAAG,CAAC;oBACZ,CAAC;oBACD,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC7B,OAAO,GAAG,WAAW,CAAC;oBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;oBACxB,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,6DAA6D;oBAC7D,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;wBACxB,UAAU,CAAC,OAAO,CAAC,CAAC;oBACtB,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;YACD,iEAAiE;YACjE,gEAAgE;YAChE,iBAAiB;YACjB,IAAI,CAAC;gBACH,4DAA4D;gBAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAW,CAAC;gBAC/B,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;oBACzC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAoB,CAAC;oBACzC,MAAM,IAAI,GAAI,KAAK,CAAC,SAAgC,IAAI,CAAC,CAAC;oBAC1D,MAAM,OAAO,GAAI,KAAK,CAAC,YAAmC,IAAI,CAAC,CAAC;oBAChE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;oBACzC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAC5C,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;oBACxC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yCAAyC;YAC3C,CAAC;YACD,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/postgres-js-client.d.ts

@@ -0,0 +1,60 @@
+import { type PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import type { Sql } from "postgres";
+import { type OwnerContextOpts } from "./migrate-guard";
+import { type PgPool, type PgTx, type PoolKind, type SystemContextOpts, type UserContextOpts } from "./types";
+type PostgresJsDrizzleClient<TSchema extends Record<string, unknown> = Record<string, unknown>> = PostgresJsDatabase<TSchema>;
+/**
+ * PgPool adapter wrapping a postgres-js `Sql` instance. Caller owns the
+ * underlying Sql's lifecycle (creation + .end()).
+ *
+ * The adapter implements the substrate-agnostic `PgPool` interface from
+ * `src/types.ts` so the existing `withUserContext` / `withSystemContext` /
+ * `withOwnerContext` helpers (in `src/context.ts`) work transparently
+ * against postgres-js — they receive a `PgTx` whose `setConfig` /
+ * `exec` calls land on the underlying postgres-js transaction.
+ */
+export declare class PgPostgresJsPool implements PgPool {
+    readonly kind: PoolKind;
+    private readonly sql;
+    private readonly slowAcquireMs;
+    private readonly onSlowAcquire?;
+    private readonly onTxFinish?;
+    constructor(opts: {
+        sql: Sql;
+        kind: PoolKind;
+        slowAcquireMs?: number;
+        onSlowAcquire?: (info: {
+            pool: PoolKind;
+            durationMs: number;
+        }) => void;
+        onTxFinish?: (info: {
+            pool: PoolKind;
+            outcome: "committed" | "rolled_back" | "error";
+            durationMs: number;
+        }) => void;
+    });
+    /** Direct access to the underlying postgres-js Sql (for ORM clients
+     *  that need the raw handle — e.g. Drizzle's `drizzle(sql)`). */
+    get rawSql(): Sql;
+    withTransaction<T>(fn: (tx: PgTx) => Promise<T>): Promise<T>;
+}
+/**
+ * postgres-js Drizzle variant of `withUserContext`. Opens a tx on the
+ * `authenticated` pool, sets `app.user_id` + `app.tenant_id` via the
+ * canonical `auth.init(...)` helper, yields a Drizzle client.
+ */
+export declare function withUserContextDbPostgresJs<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(opts: UserContextOpts, fn: (db: PostgresJsDrizzleClient<TSchema>) => Promise<T>): Promise<T>;
+/**
+ * postgres-js Drizzle variant of `withSystemContext`. Opens a tx on the
+ * `services` pool with `app.tenant_id` GUC bound; yields a Drizzle client.
+ */
+export declare function withSystemContextDbPostgresJs<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(opts: SystemContextOpts, fn: (db: PostgresJsDrizzleClient<TSchema>) => Promise<T>): Promise<T>;
+/**
+ * postgres-js Drizzle variant of `withOwnerContext`. Opens a tx on the
+ * `owner` (BYPASSRLS) pool with no GUCs. Migrations only per § 5.3 +
+ * doctrine § 10.2 — gated by `NODII_ENV=migrate` or explicit
+ * `{ allowOutsideMigrate: true, reason }` opt-in.
+ */
+export declare function withOwnerContextDbPostgresJs<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(fnOrOpts: OwnerContextOpts | ((db: PostgresJsDrizzleClient<TSchema>) => Promise<T>), maybeFn?: (db: PostgresJsDrizzleClient<TSchema>) => Promise<T>): Promise<T>;
+export type { PostgresJsDrizzleClient };
+//# sourceMappingURL=postgres-js-client.d.ts.map

package/dist/postgres-js-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-js-client.d.ts","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAW,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,EAAE,GAAG,EAAkB,MAAM,UAAU,CAAC;AAYpD,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,IAAI,EACT,KAAK,QAAQ,EAEb,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,SAAS,CAAC;AAEjB,KAAK,uBAAuB,CAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAC/D,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,qBAAa,gBAAiB,YAAW,MAAM;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAGpB;IACX,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAIjB;gBAEC,IAAI,EAAE;QAChB,GAAG,EAAE,GAAG,CAAC;QACT,IAAI,EAAE,QAAQ,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,KAAK,IAAI,CAAC;QACvE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE,QAAQ,CAAC;YACf,OAAO,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;YAC/C,UAAU,EAAE,MAAM,CAAC;SACpB,KAAK,IAAI,CAAC;KACZ;IAQD;qEACiE;IACjE,IAAI,MAAM,IAAI,GAAG,CAEhB;IAEK,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAuDnE;AAuDD;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,QAAQ,EACJ,gBAAgB,GAChB,CAAC,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAC1D,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7D,OAAO,CAAC,CAAC,CAAC,CAWZ;AAsBD,YAAY,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/postgres-js-client.js

@@ -0,0 +1,223 @@
+// postgres-js adapter per request 813cd066 + 06-library-integration § 4.9.
+//
+// Exposed via subpath `@nodii/db-rls/postgres-js`. nodii-auth uses
+// `postgres` (postgres-js driver) — not `pg` (node-postgres). The
+// existing `drizzle-client.ts` hard-imports `drizzle-orm/node-postgres`
+// + requires `pool instanceof PgClient`, so it's unusable from
+// postgres-js callers. This module mirrors the same surface for the
+// postgres-js driver.
+//
+// Surface:
+//   - PgPostgresJsPool — wraps a `postgres.Sql` into the PgPool interface
+//     so the existing with*Context helpers in src/context.ts work
+//     transparently.
+//   - withUserContextDbPostgresJs / withSystemContextDbPostgresJs /
+//     withOwnerContextDbPostgresJs — Drizzle-bound helpers that return
+//     a `drizzle-orm/postgres-js` client bound to the transaction.
+//
+// Lifecycle per § 5.3 — identical to the node-postgres path:
+//   1. `sql.begin(...)` → BEGIN
+//   2. `tx.unsafe("SELECT set_config(...)")` → GUC binding
+//   3. yield Drizzle client to caller
+//   4. throw → ROLLBACK; clean exit → COMMIT
+// postgres-js handles the BEGIN/COMMIT/ROLLBACK + connection release
+// internally inside `sql.begin(...)`.
+import { drizzle } from "drizzle-orm/postgres-js";
+import { requirePool } from "./init";
+import { emitSlowAcquireSpan, recordAcquisition, recordAcquisitionDuration, recordGucSetFailure, recordOwnerContextInvocation, recordTxDuration, withTxSpan, } from "./metrics";
+import { assertMigrateAllowed } from "./migrate-guard";
+import { MissingTenantContext, TransactionRolledBack, } from "./types";
+/**
+ * PgPool adapter wrapping a postgres-js `Sql` instance. Caller owns the
+ * underlying Sql's lifecycle (creation + .end()).
+ *
+ * The adapter implements the substrate-agnostic `PgPool` interface from
+ * `src/types.ts` so the existing `withUserContext` / `withSystemContext` /
+ * `withOwnerContext` helpers (in `src/context.ts`) work transparently
+ * against postgres-js — they receive a `PgTx` whose `setConfig` /
+ * `exec` calls land on the underlying postgres-js transaction.
+ */
+export class PgPostgresJsPool {
+    kind;
+    sql;
+    slowAcquireMs;
+    onSlowAcquire;
+    onTxFinish;
+    constructor(opts) {
+        this.kind = opts.kind;
+        this.sql = opts.sql;
+        this.slowAcquireMs = opts.slowAcquireMs ?? 50;
+        this.onSlowAcquire = opts.onSlowAcquire;
+        this.onTxFinish = opts.onTxFinish;
+    }
+    /** Direct access to the underlying postgres-js Sql (for ORM clients
+     *  that need the raw handle — e.g. Drizzle's `drizzle(sql)`). */
+    get rawSql() {
+        return this.sql;
+    }
+    async withTransaction(fn) {
+        const acquireStart = Date.now();
+        const txStart = Date.now();
+        let outcome = "error";
+        let pendingError;
+        try {
+            const result = await withTxSpan(this.kind, async (setOutcome) => {
+                return await this.sql.begin(async (tx) => {
+                    const acquireMs = Date.now() - acquireStart;
+                    recordAcquisition(this.kind, "success");
+                    recordAcquisitionDuration(this.kind, acquireMs);
+                    if (acquireMs >= this.slowAcquireMs) {
+                        emitSlowAcquireSpan(this.kind, acquireMs);
+                        if (this.onSlowAcquire) {
+                            try {
+                                this.onSlowAcquire({ pool: this.kind, durationMs: acquireMs });
+                            }
+                            catch {
+                                /* non-fatal */
+                            }
+                        }
+                    }
+                    const pgTx = new PostgresJsTx(this.kind, tx);
+                    try {
+                        const out = await fn(pgTx);
+                        outcome = "committed";
+                        setOutcome("committed");
+                        return out;
+                    }
+                    catch (err) {
+                        outcome = "rolled_back";
+                        setOutcome("rolled_back");
+                        pendingError = err;
+                        throw err;
+                    }
+                });
+            });
+            return result;
+        }
+        catch (err) {
+            if (outcome === "error") {
+                // sql.begin's connect failed (or rethrown unwrapped) — count
+                // acquisition failure if we never recorded success.
+                recordAcquisition(this.kind, "failure");
+                outcome = "rolled_back";
+                pendingError = err;
+            }
+            throw pendingError ?? err;
+        }
+        finally {
+            const durationMs = Date.now() - txStart;
+            recordTxDuration(this.kind, outcome, durationMs);
+            try {
+                this.onTxFinish?.({ pool: this.kind, outcome, durationMs });
+            }
+            catch {
+                /* non-fatal */
+            }
+        }
+    }
+}
+class PostgresJsTx {
+    poolKind;
+    raw;
+    constructor(kind, raw) {
+        this.poolKind = kind;
+        this.raw = raw;
+    }
+    async exec(sql, params = []) {
+        await this.raw.unsafe(sql, params);
+    }
+    async setConfig(key, value) {
+        // set_config(name, value, is_local=true) — tx-local per § 5.3.
+        try {
+            await this.raw.unsafe("SELECT set_config($1, $2, true)", [key, value]);
+        }
+        catch (err) {
+            recordGucSetFailure(key);
+            throw err;
+        }
+    }
+}
+function requirePostgresJsPool(kind) {
+    const pool = requirePool(kind);
+    if (!(pool instanceof PgPostgresJsPool)) {
+        throw new Error(`db-rls: ${kind} pool is not a PgPostgresJsPool — the postgres-js Drizzle helpers require a postgres-js-backed pool. Use withUserContextDb (node-postgres) or wire a PgPostgresJsPool for postgres-js.`);
+    }
+    return pool;
+}
+async function withPostgresJsTx(pool, setup, fn) {
+    return pool.withTransaction(async (pgTx) => {
+        const raw = pgTx.raw;
+        try {
+            await setup(raw);
+            const db = drizzle(raw);
+            return await fn(db);
+        }
+        catch (err) {
+            throw new TransactionRolledBack(err);
+        }
+    });
+}
+/**
+ * postgres-js Drizzle variant of `withUserContext`. Opens a tx on the
+ * `authenticated` pool, sets `app.user_id` + `app.tenant_id` via the
+ * canonical `auth.init(...)` helper, yields a Drizzle client.
+ */
+export async function withUserContextDbPostgresJs(opts, fn) {
+    if (!opts.userId)
+        throw new MissingTenantContext();
+    if (!opts.tenantId)
+        throw new MissingTenantContext();
+    const pool = requirePostgresJsPool("authenticated");
+    return withPostgresJsTx(pool, async (tx) => {
+        await tx.unsafe("SELECT auth.init($1::uuid, $2::uuid)", [
+            opts.userId,
+            opts.tenantId,
+        ]);
+        if (opts.sourceIp !== undefined) {
+            await tx.unsafe("SELECT set_config('app.source_ip', $1, true)", [
+                opts.sourceIp,
+            ]);
+        }
+    }, fn);
+}
+/**
+ * postgres-js Drizzle variant of `withSystemContext`. Opens a tx on the
+ * `services` pool with `app.tenant_id` GUC bound; yields a Drizzle client.
+ */
+export async function withSystemContextDbPostgresJs(opts, fn) {
+    if (!opts.tenantId)
+        throw new MissingTenantContext();
+    const pool = requirePostgresJsPool("services");
+    return withPostgresJsTx(pool, async (tx) => {
+        await tx.unsafe("SELECT auth.init_tenant($1::uuid)", [opts.tenantId]);
+    }, fn);
+}
+/**
+ * postgres-js Drizzle variant of `withOwnerContext`. Opens a tx on the
+ * `owner` (BYPASSRLS) pool with no GUCs. Migrations only per § 5.3 +
+ * doctrine § 10.2 — gated by `NODII_ENV=migrate` or explicit
+ * `{ allowOutsideMigrate: true, reason }` opt-in.
+ */
+export async function withOwnerContextDbPostgresJs(fnOrOpts, maybeFn) {
+    const { opts, fn } = normalizeOwnerArgs(fnOrOpts, maybeFn);
+    try {
+        assertMigrateAllowed(opts);
+    }
+    catch (err) {
+        recordOwnerContextInvocation("refused");
+        throw err;
+    }
+    recordOwnerContextInvocation("allowed");
+    const pool = requirePostgresJsPool("owner");
+    return withPostgresJsTx(pool, async () => { }, fn);
+}
+function normalizeOwnerArgs(fnOrOpts, maybeFn) {
+    if (typeof fnOrOpts === "function") {
+        return { opts: {}, fn: fnOrOpts };
+    }
+    if (!maybeFn) {
+        throw new TypeError("withOwnerContextDbPostgresJs: when opts are passed, the second argument must be the callback.");
+    }
+    return { opts: fnOrOpts, fn: maybeFn };
+}
+//# sourceMappingURL=postgres-js-client.js.map

package/dist/postgres-js-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-js-client.js","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,+DAA+D;AAC/D,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,WAAW;AACX,0EAA0E;AAC1E,kEAAkE;AAClE,qBAAqB;AACrB,oEAAoE;AACpE,uEAAuE;AACvE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,gCAAgC;AAChC,2DAA2D;AAC3D,sCAAsC;AACtC,6CAA6C;AAC7C,qEAAqE;AACrE,sCAAsC;AAEtC,OAAO,EAAE,OAAO,EAA2B,MAAM,yBAAyB,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAyB,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EAIpB,qBAAqB,GAGtB,MAAM,SAAS,CAAC;AAMjB;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,CAAW;IACP,GAAG,CAAM;IACT,aAAa,CAAS;IACtB,aAAa,CAGnB;IACM,UAAU,CAIhB;IAEX,YAAY,IAUX;QACC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;qEACiE;IACjE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;wBAC3B,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,6DAA6D;gBAC7D,oDAAoD;gBACpD,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,YAAY;IACP,QAAQ,CAAW;IACnB,GAAG,CAAiB;IAE7B,YAAY,IAAc,EAAE,GAAmB;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,SAAS,qBAAqB,CAC5B,IAA4C;IAE5C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,YAAY,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wLAAwL,CACxM,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAsB,EACtB,KAA4C,EAC5C,EAAwD;IAExD,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,GAAG,GAAI,IAAqB,CAAC,GAAG,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACjB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAgD,CAAC;YACvE,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAI/C,IAAqB,EACrB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACpD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,MAAM,CAAC,sCAAsC,EAAE;YACtD,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,QAAQ;SACd,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,MAAM,CAAC,8CAA8C,EAAE;gBAC9D,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAIjD,IAAuB,EACvB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,MAAM,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAIhD,QAE0D,EAC1D,OAA8D;IAE9D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAa,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAa,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,QAE0D,EAC1D,OAA8D;IAK9D,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC"}

package/dist/types.d.ts

@@ -1,5 +1,10 @@
-/** PoolKind names map 1:1 to the canonical three roles. */
-export type PoolKind = "owner" | "services" | "authenticated";
+/** PoolKind names map 1:1 to the canonical pool roles.
+ *
+ *  v0.4.0 adds `platform_ops` per hub decision D185 — a 4th
+ *  RLS-bound pool with RBAC-gated cross-tenant + platform-global
+ *  predicates via the `platform_ops_grants` table. NOT BYPASSRLS
+ *  (unlike owner): just a different predicate shape. */
+export type PoolKind = "owner" | "services" | "authenticated" | "platform_ops";
 /** Pluggable transaction handle — substrate-agnostic. v0.1.0 ships the
  *  in-memory transcript-recording test double; pg / psycopg / pgx adapters
  *  arrive in v0.1.x. */
@@ -18,6 +23,16 @@ export interface PgPool {
     /** Acquire a connection, BEGIN a tx, yield, and COMMIT/ROLLBACK. */
     withTransaction<T>(fn: (tx: PgTx) => Promise<T>): Promise<T>;
 }
+/**
+ * Pool topology mode. v0.2.x adds the `2-pool` exception per
+ * `08-rls-doctrine § 7` — nodii-auth runs owner + services only until
+ * its admin portal lands. v0.4.0 adds the 4-pool platform-ops variant
+ * per hub decision D185 — services that expose a platform-ops surface
+ * (nodii-tenant-service, nodii-billing-service, etc.) add a 4th
+ * `platform_ops` pool with RBAC-gated grants policies. Default is
+ * `3-pool`.
+ */
+export type DbRlsMode = "3-pool" | "2-pool" | "3-pool-with-platform-ops";
 /** Auth context bound by `@nodii/auth-sdk` middleware. Mirrors the
  *  fields autoDispatch reads — kept structural so the real auth-sdk
  *  context shape can grow without breaking us. */
@@ -44,6 +59,34 @@ export interface AutoDispatchOpts {
     authContext?: AuthContext;
     tenantId?: string;
 }
+/**
+ * withPlatformOps opts. Per hub decision D185:
+ *   - `userId` — verified principal id (sub) from JWT.
+ *   - `serviceId` — which consumer service's platform-ops surface
+ *     this request is exercising. Must match the `service_id` column
+ *     in `platform_ops_grants_replica` for the grants-predicate to
+ *     allow the row.
+ *   - `permission` — the specific catalog entry being exercised
+ *     (e.g. `"modules.write"`, `"tenant.read"`). Denormalized in the
+ *     JWT `permissions[]` array per E6; matched against the
+ *     `permission` column in `platform_ops_grants_replica`.
+ *   - `grantId` — optional audit linkage to a specific grant row.
+ *   - `supportTicketId` — optional linkage for support-engineer
+ *     flows; emitted as a span attribute for forensic tracing.
+ *
+ * Sets transaction-local GUCs `app.user_id` +
+ * `app.platform_ops_service_id` + `app.platform_ops_permission` per
+ * D185 § 4. The RLS policies on the table being accessed read these
+ * GUCs and join against `platform_ops_grants_replica` to decide
+ * allow/deny per-row.
+ */
+export interface PlatformOpsContextOpts {
+    userId: string;
+    serviceId: string;
+    permission: string;
+    grantId?: string;
+    supportTicketId?: string;
+}
 /** generateRlsPolicy opts. */
 export interface GenerateRlsPolicyOpts {
     /** Table name (unqualified). */
@@ -68,4 +111,27 @@ export declare class TransactionRolledBack extends DbRlsError {
     readonly cause: unknown;
     constructor(cause: unknown);
 }
+/**
+ * Thrown by `withOwnerContext` / `withOwnerContextDb` when invoked outside
+ * `NODII_ENV=migrate` per `08-rls-doctrine § 10.2`. The owner pool runs
+ * BYPASSRLS — invoking it from a request handler is a tenant-isolation
+ * escape and must be loud + refused by default. Migration scripts opt in
+ * by setting `NODII_ENV=migrate`; ops tooling that genuinely needs owner
+ * access at runtime opts in by passing `{ allowOutsideMigrate: true }`
+ * with an operator-attested reason (audit row emitted in a future slot).
+ */
+export declare class OwnerContextOutsideMigrate extends DbRlsError {
+    readonly nodiiEnv: string;
+    constructor(nodiiEnv: string);
+}
+/**
+ * Thrown by `initDbRls` / `configureDbRls` when the supplied pool topology
+ * doesn't match the declared `mode`. E.g. `mode: "3-pool"` without a
+ * `services` pool, or `mode: "2-pool"` with an `authenticated` pool
+ * supplied (the 2-pool exception has no authenticated role per
+ * 08-rls § 7).
+ */
+export declare class DbRlsConfigError extends DbRlsError {
+    constructor(message: string);
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAoBA,2DAA2D;AAC3D,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,eAAe,CAAC;AAE9D;;wBAEwB;AACxB,MAAM,WAAW,IAAI;IACnB,6CAA6C;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oEAAoE;IACpE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;kDAEkD;AAClD,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yBAAyB;AACzB,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAKD,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,UAAU;;CAOlD;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACZ,IAAI,EAAE,QAAQ;CAK3B;AAED,qBAAa,oBAAqB,SAAQ,UAAU;;CAOnD;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAS3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAoBA;;;;;wDAKwD;AACxD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,eAAe,GAAG,cAAc,CAAC;AAE/E;;wBAEwB;AACxB,MAAM,WAAW,IAAI;IACnB,6CAA6C;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,oEAAoE;IACpE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE;;kDAEkD;AAClD,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yBAAyB;AACzB,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8BAA8B;AAC9B,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAKD,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,UAAU;;CAOlD;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACZ,IAAI,EAAE,QAAQ;CAK3B;AAED,qBAAa,oBAAqB,SAAQ,UAAU;;CAOnD;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,KAAK,EAAE,OAAO;CAS3B;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,UAAU;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM;CAO7B;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/types.js

@@ -27,7 +27,7 @@ export class DbRlsError extends Error {
 }
 export class DbRlsNotInitialized extends DbRlsError {
     constructor() {
-        super("@nodii/db-rls is not initialized — call initDbRls({ owner, services, authenticated }) at process start.");
+        super("@nodii/db-rls is not initialized — call initDbRls({ owner, services, authenticated, platformOps? }) at process start.");
         this.name = "DbRlsNotInitialized";
     }
 }
@@ -53,4 +53,34 @@ export class TransactionRolledBack extends DbRlsError {
         this.cause = cause;
     }
 }
+/**
+ * Thrown by `withOwnerContext` / `withOwnerContextDb` when invoked outside
+ * `NODII_ENV=migrate` per `08-rls-doctrine § 10.2`. The owner pool runs
+ * BYPASSRLS — invoking it from a request handler is a tenant-isolation
+ * escape and must be loud + refused by default. Migration scripts opt in
+ * by setting `NODII_ENV=migrate`; ops tooling that genuinely needs owner
+ * access at runtime opts in by passing `{ allowOutsideMigrate: true }`
+ * with an operator-attested reason (audit row emitted in a future slot).
+ */
+export class OwnerContextOutsideMigrate extends DbRlsError {
+    nodiiEnv;
+    constructor(nodiiEnv) {
+        super(`owner_context_outside_migrate: NODII_ENV=${JSON.stringify(nodiiEnv)}, expected "migrate". Owner pool BYPASSRLS — only callable during migrations (08-rls § 10.2). Set NODII_ENV=migrate for migration scripts, or pass { allowOutsideMigrate: true, reason: "..." } with operator-attested reason.`);
+        this.name = "OwnerContextOutsideMigrate";
+        this.nodiiEnv = nodiiEnv;
+    }
+}
+/**
+ * Thrown by `initDbRls` / `configureDbRls` when the supplied pool topology
+ * doesn't match the declared `mode`. E.g. `mode: "3-pool"` without a
+ * `services` pool, or `mode: "2-pool"` with an `authenticated` pool
+ * supplied (the 2-pool exception has no authenticated role per
+ * 08-rls § 7).
+ */
+export class DbRlsConfigError extends DbRlsError {
+    constructor(message) {
+        super(message);
+        this.name = "DbRlsConfigError";
+    }
+}
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,EAAE;AACF,gBAAgB;AAChB,qDAAqD;AACrD,uEAAuE;AACvE,0EAA0E;AAC1E,oDAAoD;AACpD,0EAA0E;AAC1E,wBAAwB;AACxB,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,uCAAuC;AACvC,0CAA0C;AAC1C,kDAAkD;AAClD,0EAA0E;AA+D1E,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD;QACE,KAAK,CACH,yGAAyG,CAC1G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACpC,IAAI,CAAW;IACxB,YAAY,IAAc;QACxB,KAAK,CAAC,yBAAyB,IAAI,sCAAsC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD;QACE,KAAK,CACH,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CACH,4BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,EAAE;AACF,gBAAgB;AAChB,qDAAqD;AACrD,uEAAuE;AACvE,0EAA0E;AAC1E,oDAAoD;AACpD,0EAA0E;AAC1E,wBAAwB;AACxB,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,uCAAuC;AACvC,0CAA0C;AAC1C,kDAAkD;AAClD,0EAA0E;AA4G1E,+EAA+E;AAC/E,yBAAyB;AAEzB,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACjD;QACE,KAAK,CACH,uHAAuH,CACxH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACpC,IAAI,CAAW;IACxB,YAAY,IAAc;QACxB,KAAK,CAAC,yBAAyB,IAAI,sCAAsC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD;QACE,KAAK,CACH,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,KAAK,CAAU;IACxB,YAAY,KAAc;QACxB,KAAK,CACH,4BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,UAAU;IAC/C,QAAQ,CAAS;IAC1B,YAAY,QAAgB;QAC1B,KAAK,CACH,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gOAAgO,CACrS,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}