@nodii/db-rls 0.5.1 → 0.5.2

package/dist/drizzle-policies.d.ts

@@ -1,6 +1,9 @@
-import type { PgColumn, PgPolicy } from "drizzle-orm/pg-core";
-import type { PlatformOpsPerVerbPermissions, WithRlsOpts } from "./rls-policy-gen";
+import type { PgColumnBuilderBase, PgPolicy, PgTableWithColumns } from "drizzle-orm/pg-core";
+import type { PgColumn } from "drizzle-orm/pg-core";
+import type { PlatformOpsPerVerbPermissions, ReferenceTableSqlOpts, WithRlsOpts } from "./rls-policy-gen";
 export type { PlatformOpsPerVerbPermissions } from "./rls-policy-gen";
+export type { ReferenceTableReadRole, ReferenceTableSqlOpts, } from "./rls-policy-gen";
+export { ReferenceTableTenantColumnError, referenceTableGrantsSql, } from "./rls-policy-gen";
 /**
  * Returns the canonical 5-policy Drizzle constructs (per doctrine § 4)
  * for a tenant-scoped table.
@@ -78,4 +81,33 @@ export declare function withPlatformOpsGlobal(table: {
     };
     [key: string]: unknown;
 }, perms: PlatformOpsPerVerbPermissions, opts?: WithPlatformOpsOpts): PgPolicy[];
+/**
+ * Builds a pure platform-global reference table (08-rls § 7.6).
+ *
+ * Identical signature to Drizzle's `pgTable(name, columns)` — returns the
+ * `PgTableWithColumns`. No third-arg extras callback is accepted because a
+ * reference table gets NO RLS policies (GRANT-controlled per § 7.6).
+ *
+ * Throws {@link ReferenceTableTenantColumnError} at construction time if any
+ * column is named `tenant_id` (case-insensitive). A reference table is
+ * platform-global by definition; a `tenant_id` column means the table is
+ * tenant-scoped and should use `withRls` + the canonical 5-policy DDL instead.
+ *
+ * @param name    Postgres table name.
+ * @param columns Drizzle column-builder map (same shape as `pgTable`'s).
+ */
+export declare function referenceTable<TColumns extends Record<string, PgColumnBuilderBase>>(name: string, columns: TColumns): PgTableWithColumns<any>;
+/**
+ * Emits the GRANT/REVOKE DDL (08-rls § 7.6) for a reference table built via
+ * {@link referenceTable}. Convenience wrapper over `referenceTableGrantsSql`
+ * that derives the table name from the Drizzle table.
+ *
+ * Same single-source SQL as migrate-gen's `platform_global_reference` kind.
+ */
+export declare function referenceTableGrants(table: {
+    _: {
+        name: string;
+    };
+    [key: string]: unknown;
+}, opts?: ReferenceTableSqlOpts): string;
 //# sourceMappingURL=drizzle-policies.d.ts.map

package/dist/drizzle-policies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drizzle-policies.d.ts","sourceRoot":"","sources":["../src/drizzle-policies.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAO9D,OAAO,KAAK,EACV,6BAA6B,EAE7B,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAI1B,YAAY,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAItE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,QAAQ,EACnB,IAAI,GAAE,WAAgB,GACrB,QAAQ,EAAE,CAsCZ;AA6ED,MAAM,WAAW,mBAAmB;IAClC;;kEAE8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6CACyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,QAAQ,EACnB,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,EAAE,CAwBZ;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE;IAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EACtD,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,EAAE,CA4BZ"}
+{"version":3,"file":"drizzle-policies.d.ts","sourceRoot":"","sources":["../src/drizzle-policies.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EACV,mBAAmB,EACnB,QAAQ,EACR,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAUpD,OAAO,KAAK,EACV,6BAA6B,EAC7B,qBAAqB,EAErB,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAI1B,YAAY,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACtE,YAAY,EACV,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAI1B;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,QAAQ,EACnB,IAAI,GAAE,WAAgB,GACrB,QAAQ,EAAE,CAsCZ;AA6ED,MAAM,WAAW,mBAAmB;IAClC;;kEAE8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6CACyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,QAAQ,EACnB,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,EAAE,CAwBZ;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE;IAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EACtD,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,EAAE,CA4BZ;AA6DD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAEpD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,QAAQ,GAEhB,kBAAkB,CAAC,GAAG,CAAC,CAoBzB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE;IAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EACtD,IAAI,GAAE,qBAA0B,GAC/B,MAAM,CAKR"}

package/dist/drizzle-policies.js

@@ -25,9 +25,11 @@
 // The legacy string-DDL `withRls(table: string)` helper exported from
 // `@nodii/db-rls` (main barrel) keeps its `*_policy` suffix for backwards
 // parity with v0.1.x consumers — both surfaces ship.
-import { getTableName, sql } from "drizzle-orm";
+import { getTableColumns, getTableName, sql } from "drizzle-orm";
+import { pgTable } from "drizzle-orm/pg-core";
 import { pgPolicy } from "drizzle-orm/pg-core";
-import { PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, platformOpsGlobalPredicateSql, platformOpsTenantPredicateSql, } from "./rls-policy-gen";
+import { PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, ReferenceTableTenantColumnError, findTenantColumn, platformOpsGlobalPredicateSql, platformOpsTenantPredicateSql, referenceTableGrantsSql, } from "./rls-policy-gen";
+export { ReferenceTableTenantColumnError, referenceTableGrantsSql, } from "./rls-policy-gen";
 const DEFAULT_ALLOW = ["SELECT", "INSERT"];
 /**
  * Returns the canonical 5-policy Drizzle constructs (per doctrine § 4)
@@ -208,4 +210,84 @@ function platformOpsPredicates(verb, predicate) {
             return { using: predicate };
     }
 }
+// ----------------------------------------------------------------------------
+// 08-rls § 7.6 — pure platform-global reference table builder.
+//
+// A pure platform-global reference table (no tenant_id + non-confidential +
+// platform-admin write path) is GRANT-controlled, NOT RLS-protected. This
+// builder wraps Drizzle's `pgTable` and:
+//
+//   1. REFUSES (throws ReferenceTableTenantColumnError) if a `tenant_id`
+//      column is declared — a tenant_id is a category error for a
+//      platform-global reference table (§ 7.6 property 1). This is the
+//      doctrine's hard safety boundary.
+//   2. Returns the plain pgTable — NO RLS policies are attached (§ 7.6
+//      INTENTIONALLY omits ENABLE ROW LEVEL SECURITY).
+//
+// The companion GRANT/REVOKE DDL (GRANT SELECT to the read role + GRANT
+// write to nodii_owner + REVOKE write from the read role) is emitted by
+// `referenceTableGrantsSql(getTableName(t))` — apply it in the consumer's
+// migration. migrate-gen's `platform_global_reference` kind emits the same
+// DDL via the same single-source `referenceTableGrantsSql` (no fork).
+//
+// Usage:
+//
+//   import { referenceTable, referenceTableGrantsSql } from "@nodii/db-rls/drizzle";
+//   import { getTableName } from "drizzle-orm";
+//
+//   export const taskActionButtonRegistry = referenceTable(
+//     "task_action_button_registry",
+//     {
+//       id: text("id").primaryKey(),
+//       label: text("label").notNull(),
+//       icon: text("icon"),
+//     },
+//   );
+//   // Apply alongside the Drizzle migration:
+//   const grantDdl = referenceTableGrantsSql(getTableName(taskActionButtonRegistry));
+/**
+ * Builds a pure platform-global reference table (08-rls § 7.6).
+ *
+ * Identical signature to Drizzle's `pgTable(name, columns)` — returns the
+ * `PgTableWithColumns`. No third-arg extras callback is accepted because a
+ * reference table gets NO RLS policies (GRANT-controlled per § 7.6).
+ *
+ * Throws {@link ReferenceTableTenantColumnError} at construction time if any
+ * column is named `tenant_id` (case-insensitive). A reference table is
+ * platform-global by definition; a `tenant_id` column means the table is
+ * tenant-scoped and should use `withRls` + the canonical 5-policy DDL instead.
+ *
+ * @param name    Postgres table name.
+ * @param columns Drizzle column-builder map (same shape as `pgTable`'s).
+ */
+export function referenceTable(name, columns) {
+    // Refuse a tenant_id column declared in the column map — the § 7.6
+    // safety boundary. Check the keys first (the column property name) so we
+    // reject `tenantId: uuid("tenant_id")` AND `tenant_id: ...`.
+    const declaredKey = findTenantColumn(Object.keys(columns));
+    if (declaredKey) {
+        throw new ReferenceTableTenantColumnError(name, declaredKey);
+    }
+    const table = pgTable(name, columns);
+    // Also refuse if the resolved DB column name is tenant_id even when the
+    // property key isn't (e.g. `foo: uuid("tenant_id")`). getTableColumns
+    // resolves the actual DB column names.
+    const resolvedCols = getTableColumns(table);
+    const tenantDbCol = findTenantColumn(Object.values(resolvedCols).map((c) => c.name));
+    if (tenantDbCol) {
+        throw new ReferenceTableTenantColumnError(name, tenantDbCol);
+    }
+    return table;
+}
+/**
+ * Emits the GRANT/REVOKE DDL (08-rls § 7.6) for a reference table built via
+ * {@link referenceTable}. Convenience wrapper over `referenceTableGrantsSql`
+ * that derives the table name from the Drizzle table.
+ *
+ * Same single-source SQL as migrate-gen's `platform_global_reference` kind.
+ */
+export function referenceTableGrants(table, opts = {}) {
+    const tableName = getTableName(table);
+    return referenceTableGrantsSql(tableName, opts);
+}
 //# sourceMappingURL=drizzle-policies.js.map

package/dist/drizzle-policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"drizzle-policies.js","sourceRoot":"","sources":["../src/drizzle-policies.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,mBAAmB;AACnB,EAAE;AACF,qDAAqD;AACrD,EAAE;AACF,iEAAiE;AACjE,mDAAmD;AACnD,6CAA6C;AAC7C,2CAA2C;AAC3C,gBAAgB;AAChB,sFAAsF;AACtF,8BAA8B;AAC9B,mFAAmF;AACnF,QAAQ;AACR,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,oEAAoE;AACpE,yBAAyB;AACzB,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,qDAAqD;AAErD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG/C,OAAO,EACL,mCAAmC,EACnC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAW1B,MAAM,aAAa,GAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,OAAO,CACrB,SAAmB,EACnB,OAAoB,EAAE;IAEtB,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;IAEzD,0FAA0F;IAC1F,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAC3B,GAAG,YAAY,uDAAuD,CACvE,CAAC;IACF,uDAAuD;IACvD,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,yBAAyB,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,oBAAoB;IACpB,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,QAAQ,EAAE;QAC9B,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,KAAK;QACV,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,GAAG,CAAA,MAAM;QAChB,SAAS,EAAE,GAAG,CAAA,MAAM;KACrB,CAAC,CACH,CAAC;IAEF,6BAA6B;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CACpB,UAAkB,EAClB,IAAa,EACb,SAAqC;IAErC,MAAM,IAAI,GAAG,GAAG,UAAU,SAAS,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACxD,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,eAAe;QACnB,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,UAAkB,EAClB,IAAa,EACb,SAAqC;IAErC,MAAM,IAAI,GAAG,GAAG,UAAU,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACvD,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,gBAAgB;QACpB,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,IAAI,CAAC,WAAW,EAA+C,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CACjB,IAAa,EACb,SAAqC;IAKrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD;YACE,iBAAiB;YACjB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAgCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAmB,EACnB,KAAoC,EACpC,OAA4B,EAAE;IAE9B,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CACvB,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CACrE,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE,EAAE;YAC7C,EAAE,EAAE,YAAY;YAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC;YAChC,EAAE,EAAE,oBAAoB;YACxB,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAsD,EACtD,KAAoC,EACpC,OAA4B,EAAE;IAE9B,sEAAsE;IACtE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,SAAS,GAAG,YAAY,CAC5B,KAAsD,CACvD,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CACvB,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,CACvD,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE,EAAE;YAC7C,EAAE,EAAE,YAAY;YAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC;YAChC,EAAE,EAAE,oBAAoB;YACxB,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6C;IAE7C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6C,EAC7C,SAAqC;IAKrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD;YACE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC"}
+{"version":3,"file":"drizzle-policies.js","sourceRoot":"","sources":["../src/drizzle-policies.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,mBAAmB;AACnB,EAAE;AACF,qDAAqD;AACrD,EAAE;AACF,iEAAiE;AACjE,mDAAmD;AACnD,6CAA6C;AAC7C,2CAA2C;AAC3C,gBAAgB;AAChB,sFAAsF;AACtF,8BAA8B;AAC9B,mFAAmF;AACnF,QAAQ;AACR,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,oEAAoE;AACpE,yBAAyB;AACzB,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,qDAAqD;AAErD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAQ/C,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,gBAAgB,EAChB,6BAA6B,EAC7B,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,aAAa,GAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,OAAO,CACrB,SAAmB,EACnB,OAAoB,EAAE;IAEtB,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;IAEzD,0FAA0F;IAC1F,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAC3B,GAAG,YAAY,uDAAuD,CACvE,CAAC;IACF,uDAAuD;IACvD,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,yBAAyB,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,oBAAoB;IACpB,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,QAAQ,EAAE;QAC9B,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,KAAK;QACV,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,GAAG,CAAA,MAAM;QAChB,SAAS,EAAE,GAAG,CAAA,MAAM;KACrB,CAAC,CACH,CAAC;IAEF,6BAA6B;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CACpB,UAAkB,EAClB,IAAa,EACb,SAAqC;IAErC,MAAM,IAAI,GAAG,GAAG,UAAU,SAAS,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACxD,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,eAAe;QACnB,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,UAAkB,EAClB,IAAa,EACb,SAAqC;IAErC,MAAM,IAAI,GAAG,GAAG,UAAU,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACvD,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,gBAAgB;QACpB,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,IAAI,CAAC,WAAW,EAA+C,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CACjB,IAAa,EACb,SAAqC;IAKrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD;YACE,iBAAiB;YACjB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAgCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAmB,EACnB,KAAoC,EACpC,OAA4B,EAAE;IAE9B,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CACvB,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CACrE,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE,EAAE;YAC7C,EAAE,EAAE,YAAY;YAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC;YAChC,EAAE,EAAE,oBAAoB;YACxB,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAsD,EACtD,KAAoC,EACpC,OAA4B,EAAE;IAE9B,sEAAsE;IACtE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,SAAS,GAAG,YAAY,CAC5B,KAAsD,CACvD,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CACvB,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,CACvD,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE,EAAE;YAC7C,EAAE,EAAE,YAAY;YAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC;YAChC,EAAE,EAAE,oBAAoB;YACxB,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6C;IAE7C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6C,EAC7C,SAAqC;IAKrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD;YACE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,+DAA+D;AAC/D,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,yCAAyC;AACzC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,uEAAuE;AACvE,wCAAwC;AACxC,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,SAAS;AACT,EAAE;AACF,qFAAqF;AACrF,gDAAgD;AAChD,EAAE;AACF,4DAA4D;AAC5D,qCAAqC;AACrC,QAAQ;AACR,qCAAqC;AACrC,wCAAwC;AACxC,4BAA4B;AAC5B,SAAS;AACT,OAAO;AACP,8CAA8C;AAC9C,sFAAsF;AAEtF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAG5B,IAAY,EACZ,OAAiB;IAGjB,mEAAmE;IACnE,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,+BAA+B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,wEAAwE;IACxE,sEAAsE;IACtE,uCAAuC;IACvC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAClC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/C,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,+BAA+B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAsD,EACtD,OAA8B,EAAE;IAEhC,MAAM,SAAS,GAAG,YAAY,CAC5B,KAAsD,CACvD,CAAC;IACF,OAAO,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC"}

package/dist/index.d.ts

@@ -13,10 +13,10 @@ export type { OwnerContextOpts } from "./migrate-guard";
 export { assertMigrateAllowed } from "./migrate-guard";
 export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, } from "./auth-schema";
 export type { SqlExecutor } from "./auth-schema";
-export { withRls, generateTableGrants, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, } from "./rls-policy-gen";
-export type { RlsVerb, WithRlsOpts, PlatformOpsVerb, PlatformOpsPerVerbPermissions, WithPlatformOpsSqlOpts, } from "./rls-policy-gen";
-export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, platformOpsPoliciesSql, } from "./migrate-gen";
-export type { MigrateGenInput, MigrateGenResult, PlatformOpsTableSpec, } from "./migrate-gen";
+export { withRls, generateTableGrants, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, referenceTableGrantsSql, findTenantColumn, ReferenceTableTenantColumnError, REFERENCE_TABLE_SKIP_RLS_MARKER, } from "./rls-policy-gen";
+export type { RlsVerb, WithRlsOpts, PlatformOpsVerb, PlatformOpsPerVerbPermissions, WithPlatformOpsSqlOpts, ReferenceTableReadRole, ReferenceTableSqlOpts, } from "./rls-policy-gen";
+export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, platformOpsPoliciesSql, referenceTablesSql, } from "./migrate-gen";
+export type { MigrateGenInput, MigrateGenResult, PlatformOpsTableSpec, ReferenceTableSpec, } from "./migrate-gen";
 export { generateRlsPolicy, authSchemaHelpers } from "./rls-policy";
 export { InMemoryPgPool } from "./in-memory-pool";
 export type { TranscriptEntry } from "./in-memory-pool";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EAItB,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC,GACpC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,OAAO,EACP,WAAW,EACX,eAAe,EACf,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,sBAAsB,EACtB,QAAQ,EACR,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EAItB,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC,EAEnC,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,OAAO,EACP,WAAW,EACX,eAAe,EACf,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,sBAAsB,EACtB,QAAQ,EACR,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -43,8 +43,10 @@ withPlatformOps, _resetWithPlatformOpsDeprecationWarnedForTests, autoDispatch, }
 export { withUserContextDb, withSystemContextDb, withOwnerContextDb, } from "./drizzle-client";
 export { assertMigrateAllowed } from "./migrate-guard";
 export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, } from "./auth-schema";
-export { withRls, generateTableGrants, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, } from "./rls-policy-gen";
-export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, platformOpsPoliciesSql, } from "./migrate-gen";
+export { withRls, generateTableGrants, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, 
+// 08-rls § 7.6 — pure platform-global reference tables (GRANT-controlled).
+referenceTableGrantsSql, findTenantColumn, ReferenceTableTenantColumnError, REFERENCE_TABLE_SKIP_RLS_MARKER, } from "./rls-policy-gen";
+export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, platformOpsPoliciesSql, referenceTablesSql, } from "./migrate-gen";
 // Legacy v0.1.0 surface kept for callers that already imported these
 // names. Both are byte-equal SQL helpers — no NotImplemented paths.
 export { generateRlsPolicy, authSchemaHelpers } from "./rls-policy";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,wDAAwD;AACxD,6CAA6C;AAC7C,EAAE;AACF,yCAAyC;AACzC,sEAAsE;AACtE,wCAAwC;AACxC,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,wEAAwE;AACxE,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,sCAAsC;AACtC,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,0EAA0E;AAC1E,qCAAqC;AAErC,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB;AACtB,uEAAuE;AACvE,wEAAwE;AACxE,sCAAsC;AACtC,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC,GACpC,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAOvB,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,wDAAwD;AACxD,6CAA6C;AAC7C,EAAE;AACF,yCAAyC;AACzC,sEAAsE;AACtE,wCAAwC;AACxC,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,wEAAwE;AACxE,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,sCAAsC;AACtC,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,0EAA0E;AAC1E,qCAAqC;AAErC,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB;AACtB,uEAAuE;AACvE,wEAAwE;AACxE,sCAAsC;AACtC,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC;AACnC,2EAA2E;AAC3E,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAQvB,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC"}

package/dist/migrate-gen.d.ts

@@ -1,4 +1,4 @@
-import { type PlatformOpsPerVerbPermissions } from "./rls-policy-gen";
+import { type PlatformOpsPerVerbPermissions, type ReferenceTableReadRole } from "./rls-policy-gen";
 /**
  * One table exposed via the platform-ops cross-tenant surface (D185).
  * `scope='tenant'` tables emit the tenant predicate (joins on
@@ -21,6 +21,27 @@ export interface PlatformOpsTableSpec {
     /** Override the `platform_ops_grants_replica` table name. */
     grantsTable?: string;
 }
+/**
+ * One pure platform-global reference table (08-rls § 7.6). Declaring a
+ * table here makes migrate-gen emit the GRANT-controlled (NO RLS) DDL —
+ * `GRANT SELECT` to the read role(s) + `GRANT INSERT, UPDATE, DELETE` to
+ * `nodii_owner` + `REVOKE` write from the read role(s) — and NOT the
+ * 5-policy RLS DDL.
+ *
+ * `kind` is fixed to the discriminant `'platform_global_reference'` so a
+ * schema's table-set can be a heterogeneous list and migrate-gen routes
+ * each entry by `kind`.
+ */
+export interface ReferenceTableSpec {
+    /** Discriminant — pure platform-global reference table per 08-rls § 7.6. */
+    kind: "platform_global_reference";
+    /** Table name. May be schema-qualified (`schema.tbl`). */
+    table: string;
+    /** Read role(s) that get `GRANT SELECT` + `REVOKE` write. Defaults to
+     *  `["nodii_services"]` (3-pool). 2-pool services may pass
+     *  `["authenticated"]`; 4-pool may add `"nodii_platform_ops"`. */
+    readRoles?: readonly ReferenceTableReadRole[];
+}
 export interface MigrateGenInput {
     /** Pattern A service name, e.g. "nodii-billing-service". Used only for
      *  the file header comment; not in the SQL body. */
@@ -35,6 +56,10 @@ export interface MigrateGenInput {
      *  file `0002_platform_ops_policies.sql` is emitted with the per-verb
      *  platform-ops CREATE POLICY DDL. Applies only in the non-stub path. */
     platformOps?: readonly PlatformOpsTableSpec[];
+    /** Pure platform-global reference tables (08-rls § 7.6). When non-empty,
+     *  a file `0003_reference_table_grants.sql` is emitted with the
+     *  GRANT-controlled (NO RLS) DDL. Applies only in the non-stub path. */
+    referenceTables?: readonly ReferenceTableSpec[];
 }
 export interface MigrateGenResult {
     /** Absolute path of the file that was written. */
@@ -46,6 +71,11 @@ export interface MigrateGenResult {
     /** Platform-ops policy DDL contents, when emitted (also returned for
      *  parity-fence + test assertions). */
     platformOpsContents?: string;
+    /** Absolute path of the reference-table grants file, when emitted. */
+    referenceTablesPath?: string;
+    /** Reference-table grants DDL contents, when emitted (also returned for
+     *  parity-fence + test assertions). */
+    referenceTablesContents?: string;
 }
 /**
  * SQL text for the real (joins mirror tables) helper. Module-level
@@ -66,6 +96,22 @@ export declare function userTenantIdsStubSql(serviceName: string): string;
  * Returns `""` when no tables are configured.
  */
 export declare function platformOpsPoliciesSql(serviceName: string, tables: readonly PlatformOpsTableSpec[]): string;
+/**
+ * SQL text for the pure platform-global reference-table grants file
+ * (08-rls § 7.6). One GRANT-block per configured table, in input order.
+ * Reuses `referenceTableGrantsSql` — the same single-source generator the
+ * Drizzle `referenceTable` table-builder consumes — so the emitted DDL is
+ * equivalent (no forked GRANT DDL).
+ *
+ * GATE: each block carries the skip-RLS marker comment and INTENTIONALLY
+ * never emits `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`. This function
+ * asserts (throws) if any generated block somehow contains an ENABLE RLS
+ * statement — a structural guard against the § 7.6 boundary being violated
+ * by a future refactor.
+ *
+ * Returns `""` when no tables are configured.
+ */
+export declare function referenceTablesSql(serviceName: string, tables: readonly ReferenceTableSpec[]): string;
 /**
  * Generates the residual migration phase file and returns its contents.
  * If `outDir` is set, writes the file to disk; otherwise just returns
@@ -74,6 +120,10 @@ export declare function platformOpsPoliciesSql(serviceName: string, tables: read
  * When `platformOps` tables are configured (and not in `--stub` mode), a
  * second file `0002_platform_ops_policies.sql` is also written with the
  * per-verb platform-ops CREATE POLICY DDL (08-rls § 7.6).
+ *
+ * When `referenceTables` are configured (and not in `--stub` mode), a file
+ * `0003_reference_table_grants.sql` is also written with the
+ * GRANT-controlled (NO RLS) DDL (08-rls § 7.6).
  */
 export declare function migrateGen(input: MigrateGenInput): MigrateGenResult;
 /**

package/dist/migrate-gen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-gen.d.ts","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,KAAK,6BAA6B,EAGnC,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;qCACiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;wDACoD;IACpD,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B;qCACiC;IACjC,WAAW,EAAE,6BAA6B,CAAC;IAC3C;yBACqB;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B;wDACoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;6CAEyC;IACzC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;6EAEyE;IACzE,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;2CACuC;IACvC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAehE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAWhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,oBAAoB,EAAE,GACtC,MAAM,CAoBR;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAiCnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA6BhE"}
+{"version":3,"file":"migrate-gen.d.ts","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAK5B,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;qCACiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;wDACoD;IACpD,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B;qCACiC;IACjC,WAAW,EAAE,6BAA6B,CAAC;IAC3C;yBACqB;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,IAAI,EAAE,2BAA2B,CAAC;IAClC,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd;;sEAEkE;IAClE,SAAS,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B;wDACoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;6CAEyC;IACzC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;6EAEyE;IACzE,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9C;;4EAEwE;IACxE,eAAe,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;2CACuC;IACvC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;2CACuC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAehE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAWhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,oBAAoB,EAAE,GACtC,MAAM,CAoBR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,kBAAkB,EAAE,GACpC,MAAM,CAoCR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAuDnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA6BhE"}

package/dist/migrate-gen.js

@@ -26,7 +26,7 @@
 // asserts directly.
 import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
-import { withPlatformOpsGlobalSql, withPlatformOpsTenantSql, } from "./rls-policy-gen";
+import { REFERENCE_TABLE_SKIP_RLS_MARKER, referenceTableGrantsSql, withPlatformOpsGlobalSql, withPlatformOpsTenantSql, } from "./rls-policy-gen";
 /**
  * SQL text for the real (joins mirror tables) helper. Module-level
  * constant so parity-fence can byte-compare.
@@ -93,6 +93,55 @@ export function platformOpsPoliciesSql(serviceName, tables) {
 `;
     return `${header}\n${blocks.join("")}`;
 }
+/**
+ * SQL text for the pure platform-global reference-table grants file
+ * (08-rls § 7.6). One GRANT-block per configured table, in input order.
+ * Reuses `referenceTableGrantsSql` — the same single-source generator the
+ * Drizzle `referenceTable` table-builder consumes — so the emitted DDL is
+ * equivalent (no forked GRANT DDL).
+ *
+ * GATE: each block carries the skip-RLS marker comment and INTENTIONALLY
+ * never emits `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`. This function
+ * asserts (throws) if any generated block somehow contains an ENABLE RLS
+ * statement — a structural guard against the § 7.6 boundary being violated
+ * by a future refactor.
+ *
+ * Returns `""` when no tables are configured.
+ */
+export function referenceTablesSql(serviceName, tables) {
+    if (tables.length === 0)
+        return "";
+    const blocks = [];
+    for (const spec of tables) {
+        if (spec.kind !== "platform_global_reference") {
+            throw new Error(`migrate-gen: unknown reference-table kind "${spec.kind}" — expected "platform_global_reference" (08-rls § 7.6).`);
+        }
+        const block = referenceTableGrantsSql(spec.table, {
+            readRoles: spec.readRoles,
+        });
+        // GATE — a reference table MUST NOT enable RLS (08-rls § 7.6). If the
+        // single-source generator ever emits an ENABLE RLS *statement*, fail
+        // loudly here rather than apply a doctrine-violating migration. We
+        // strip comment lines first so the skip-RLS marker (which deliberately
+        // contains the literal "ENABLE ROW LEVEL SECURITY" inside a comment
+        // documenting its omission) does not trip the guard.
+        const executableSql = block
+            .split("\n")
+            .filter((line) => !line.trimStart().startsWith("--"))
+            .join("\n");
+        if (/ENABLE\s+ROW\s+LEVEL\s+SECURITY/i.test(executableSql)) {
+            throw new Error(`migrate-gen: reference table "${spec.table}" generated an ENABLE ROW LEVEL SECURITY statement — forbidden by 08-rls § 7.6 (reference tables are GRANT-controlled, NOT RLS).`);
+        }
+        blocks.push(block);
+    }
+    const header = `-- Service: ${serviceName}
+-- Generated by @nodii/db-rls migrate-gen
+-- Phase: 004-helpers-and-grants — pure platform-global reference-table grants
+-- Spec: 08-rls § 7.6 (GRANT-controlled, NO RLS)
+-- ${REFERENCE_TABLE_SKIP_RLS_MARKER.replace(/^-- /, "")}
+`;
+    return `${header}\n${blocks.join("\n")}`;
+}
 /**
  * Generates the residual migration phase file and returns its contents.
  * If `outDir` is set, writes the file to disk; otherwise just returns
@@ -101,6 +150,10 @@ export function platformOpsPoliciesSql(serviceName, tables) {
  * When `platformOps` tables are configured (and not in `--stub` mode), a
  * second file `0002_platform_ops_policies.sql` is also written with the
  * per-verb platform-ops CREATE POLICY DDL (08-rls § 7.6).
+ *
+ * When `referenceTables` are configured (and not in `--stub` mode), a file
+ * `0003_reference_table_grants.sql` is also written with the
+ * GRANT-controlled (NO RLS) DDL (08-rls § 7.6).
  */
 export function migrateGen(input) {
     const contents = input.stub
@@ -114,6 +167,7 @@ export function migrateGen(input) {
     const path = join(outDir, phase, fileName);
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, contents);
+    const result = { path, contents };
     // Platform-ops policies (08-rls § 7.6). Skipped in the stub path —
     // the stub variant is the chicken-and-egg bootstrap and shouldn't
     // create cross-tenant policies before the grants replica exists.
@@ -123,9 +177,21 @@ export function migrateGen(input) {
         const platformOpsPath = join(outDir, phase, "0002_platform_ops_policies.sql");
         mkdirSync(dirname(platformOpsPath), { recursive: true });
         writeFileSync(platformOpsPath, platformOpsContents);
-        return { path, contents, platformOpsPath, platformOpsContents };
+        result.platformOpsPath = platformOpsPath;
+        result.platformOpsContents = platformOpsContents;
+    }
+    // Pure platform-global reference-table grants (08-rls § 7.6). Skipped in
+    // the stub path. Emits the GRANT-controlled (NO RLS) DDL.
+    const referenceTables = input.stub ? [] : (input.referenceTables ?? []);
+    if (referenceTables.length > 0) {
+        const referenceTablesContents = referenceTablesSql(input.serviceName, referenceTables);
+        const referenceTablesPath = join(outDir, phase, "0003_reference_table_grants.sql");
+        mkdirSync(dirname(referenceTablesPath), { recursive: true });
+        writeFileSync(referenceTablesPath, referenceTablesContents);
+        result.referenceTablesPath = referenceTablesPath;
+        result.referenceTablesContents = referenceTablesContents;
     }
-    return { path, contents };
+    return result;
 }
 /**
  * CLI entrypoint. Invoked via `npx @nodii/db-rls migrate-gen ...` or

package/dist/migrate-gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-gen.js","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,aAAa;AACb,EAAE;AACF,UAAU;AACV,6DAA6D;AAC7D,0EAA0E;AAC1E,iEAAiE;AACjE,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,+DAA+D;AAC/D,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,+DAA+D;AAC/D,mDAAmD;AACnD,EAAE;AACF,aAAa;AACb,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,oBAAoB;AAEpB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAEL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAqD1B;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,eAAe,WAAW;;;;;;;;;;;;;CAalC,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,eAAe,WAAW;;;;;;;;;CASlC,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,MAAuC;IAEvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG;YACX,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,QAAQ;YACrB,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;YAC9D,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,WAAW;;;;CAI1C,CAAC;IACA,OAAO,GAAG,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,0BAA0B,CAAC;IAC/B,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE9B,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,mBAAmB,GAAG,sBAAsB,CAChD,KAAK,CAAC,WAAW,EACjB,iBAAiB,CAClB,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAC1B,MAAM,EACN,KAAK,EACL,gCAAgC,CACjC,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,aAAa,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,WAAW,GACf,UAAU,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU;IACjB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC;;;;;uDAKyC,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"migrate-gen.js","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,aAAa;AACb,EAAE;AACF,UAAU;AACV,6DAA6D;AAC7D,0EAA0E;AAC1E,iEAAiE;AACjE,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,+DAA+D;AAC/D,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,+DAA+D;AAC/D,mDAAmD;AACnD,EAAE;AACF,aAAa;AACb,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,oBAAoB;AAEpB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAGL,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAoF1B;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,eAAe,WAAW;;;;;;;;;;;;;CAalC,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,eAAe,WAAW;;;;;;;;;CASlC,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,MAAuC;IAEvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG;YACX,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,QAAQ;YACrB,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;YAC9D,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,WAAW;;;;CAI1C,CAAC;IACA,OAAO,GAAG,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,MAAqC;IAErC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,8CAA+C,IAAyB,CAAC,IAAI,0DAA0D,CACxI,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE;YAChD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,sEAAsE;QACtE,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,oEAAoE;QACpE,qDAAqD;QACrD,MAAM,aAAa,GAAG,KAAK;aACxB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;aACpD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,kCAAkC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,KAAK,kIAAkI,CAC9K,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,WAAW;;;;KAItC,+BAA+B,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;CACvD,CAAC;IACA,OAAO,GAAG,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,0BAA0B,CAAC;IAC/B,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE9B,MAAM,MAAM,GAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEpD,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,mBAAmB,GAAG,sBAAsB,CAChD,KAAK,CAAC,WAAW,EACjB,iBAAiB,CAClB,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAC1B,MAAM,EACN,KAAK,EACL,gCAAgC,CACjC,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,aAAa,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACpD,MAAM,CAAC,eAAe,GAAG,eAAe,CAAC;QACzC,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,uBAAuB,GAAG,kBAAkB,CAChD,KAAK,CAAC,WAAW,EACjB,eAAe,CAChB,CAAC;QACF,MAAM,mBAAmB,GAAG,IAAI,CAC9B,MAAM,EACN,KAAK,EACL,iCAAiC,CAClC,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,aAAa,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;QAC5D,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QACjD,MAAM,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;IAC3D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,WAAW,GACf,UAAU,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU;IACjB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC;;;;;uDAKyC,CAAC,CAAC;AACzD,CAAC"}

package/dist/rls-policy-gen.d.ts

@@ -74,5 +74,48 @@ export declare function withPlatformOpsTenantSql(table: string, perms: PlatformO
  * **platform-global** table (08-rls § 7.6).
  */
 export declare function withPlatformOpsGlobalSql(table: string, perms: PlatformOpsPerVerbPermissions, opts?: WithPlatformOpsSqlOpts): string;
+/** Roles that may receive `GRANT SELECT` on a reference table. */
+declare const REFERENCE_TABLE_READ_ROLES: readonly ["nodii_services", "authenticated", "nodii_platform_ops"];
+export type ReferenceTableReadRole = (typeof REFERENCE_TABLE_READ_ROLES)[number];
+/** The doctrine-conformant skip-RLS marker comment line. Emitted in place of
+ *  `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` so the migrate-gen + reviewers
+ *  see the omission is intentional (08-rls § 7.6), not an oversight. */
+export declare const REFERENCE_TABLE_SKIP_RLS_MARKER = "-- INTENTIONALLY OMITTED: ALTER TABLE ... ENABLE ROW LEVEL SECURITY (08-rls \u00A7 7.6 \u2014 reference data has no per-row confidentiality boundary).";
+export interface ReferenceTableSqlOpts {
+    /** Read role(s) that get `GRANT SELECT` + `REVOKE` write. Defaults to
+     *  `["nodii_services"]` (canonical 3-pool). 2-pool services may pass
+     *  `["authenticated"]`; 4-pool services may add `"nodii_platform_ops"`. */
+    readRoles?: readonly ReferenceTableReadRole[];
+}
+/**
+ * Thrown when a `tenant_id` column is declared on a reference-table-typed
+ * table. A pure platform-global reference table is platform-global by
+ * definition (08-rls § 7.6 property 1: no `tenant_id`); a `tenant_id` column
+ * is a category error — the table should use the canonical 5-policy RLS DDL
+ * (§ 4) instead. This is the doctrine's safety boundary.
+ */
+export declare class ReferenceTableTenantColumnError extends Error {
+    readonly table: string;
+    readonly column: string;
+    constructor(table: string, column: string);
+}
+/** Returns the tenant-scoped column name if `columns` contains one, else
+ *  `null`. Case-insensitive. Used by the reference-table refusal guard. */
+export declare function findTenantColumn(columns: readonly string[]): string | null;
+/**
+ * Emits the canonical 08-rls § 7.6 GRANT/REVOKE DDL for a pure
+ * platform-global reference table. Does NOT include `CREATE TABLE` (the
+ * table shape is the consumer's; Drizzle/SQLAlchemy/sqlc emit it) and
+ * INTENTIONALLY does NOT include `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`.
+ *
+ * Output ends with `\n`. Byte-equal across TS / Python / Go ports.
+ *
+ * Order (deterministic for parity-fence):
+ *   1. skip-RLS marker comment
+ *   2. GRANT SELECT to each read role (in `readRoles` order)
+ *   3. GRANT INSERT, UPDATE, DELETE to nodii_owner
+ *   4. REVOKE INSERT, UPDATE, DELETE from each read role (in `readRoles` order)
+ */
+export declare function referenceTableGrantsSql(table: string, opts?: ReferenceTableSqlOpts): string;
 export {};
 //# sourceMappingURL=rls-policy-gen.d.ts.map

package/dist/rls-policy-gen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rls-policy-gen.d.ts","sourceRoot":"","sources":["../src/rls-policy-gen.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,MAAM,CA0BrE;AAQD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,WAAgB,GACrB,MAAM,CASR;AAqDD,4CAA4C;AAC5C,QAAA,MAAM,kBAAkB,iDAAkD,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE;;;qBAGqB;AACrB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,mCAAmC,gCACjB,CAAC;AAGhC,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5C;AAOD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED,0EAA0E;AAC1E,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,CAUR;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAER;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAER"}
+{"version":3,"file":"rls-policy-gen.d.ts","sourceRoot":"","sources":["../src/rls-policy-gen.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,MAAM,CA0BrE;AAQD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,WAAgB,GACrB,MAAM,CASR;AAqDD,4CAA4C;AAC5C,QAAA,MAAM,kBAAkB,iDAAkD,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE;;;qBAGqB;AACrB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,mCAAmC,gCACjB,CAAC;AAGhC,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5C;AAOD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED,0EAA0E;AAC1E,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,CAUR;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAER;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAER;AAiDD,kEAAkE;AAClE,QAAA,MAAM,0BAA0B,oEAItB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAChC,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAK9C;;wEAEwE;AACxE,eAAO,MAAM,+BAA+B,2JACoG,CAAC;AAEjJ,MAAM,WAAW,qBAAqB;IACpC;;+EAE2E;IAC3E,SAAS,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC/C;AAMD;;;;;;GAMG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,KAAK,EAAE,MAAM;aACb,MAAM,EAAE,MAAM;gBADd,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM;CAOjC;AAMD;2EAC2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAK1E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,qBAA0B,GAC/B,MAAM,CAkBR"}

package/dist/rls-policy-gen.js

@@ -163,4 +163,97 @@ function platformOpsPolicyLines(table, perms, kind, opts) {
     }
     return lines.length > 0 ? `${lines.join("\n")}\n` : "";
 }
+// ----------------------------------------------------------------------------
+// 08-rls § 7.6 — pure platform-global reference tables (GRANT-controlled, NO RLS).
+//
+// A pure platform-global reference table has ALL THREE properties:
+//   1. No `tenant_id` column — rows are shared across every tenant.
+//   2. Non-confidential — reference / catalog / lookup data.
+//   3. Written via a controlled platform-admin path (nodii_owner migrations
+//      or a narrow operator-only RPC).
+//
+// Per § 7.6 such tables use GRANT-controlled access, NOT RLS:
+//   - INTENTIONALLY no `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`.
+//   - `GRANT SELECT` to the read role (`nodii_services` by default; 2-pool
+//     services may use `authenticated`; 4-pool services may add
+//     `nodii_platform_ops`).
+//   - `GRANT INSERT, UPDATE, DELETE` to `nodii_owner` (the write path).
+//   - `REVOKE INSERT, UPDATE, DELETE` from the read role(s) — the integrity
+//     boundary: the read pool can never write.
+//
+// Single source of truth: `referenceTableGrantsSql` is reused by the Drizzle
+// `referenceTable` table-builder helper AND by migrate-gen's
+// `platform_global_reference` path — no forked GRANT DDL.
+/** Roles that may receive `GRANT SELECT` on a reference table. */
+const REFERENCE_TABLE_READ_ROLES = [
+    "nodii_services",
+    "authenticated",
+    "nodii_platform_ops",
+];
+const REFERENCE_TABLE_OWNER_ROLE = "nodii_owner";
+const REFERENCE_TABLE_WRITE_VERBS = "INSERT, UPDATE, DELETE";
+/** The doctrine-conformant skip-RLS marker comment line. Emitted in place of
+ *  `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` so the migrate-gen + reviewers
+ *  see the omission is intentional (08-rls § 7.6), not an oversight. */
+export const REFERENCE_TABLE_SKIP_RLS_MARKER = "-- INTENTIONALLY OMITTED: ALTER TABLE ... ENABLE ROW LEVEL SECURITY (08-rls § 7.6 — reference data has no per-row confidentiality boundary).";
+const DEFAULT_REFERENCE_READ_ROLES = [
+    "nodii_services",
+];
+/**
+ * Thrown when a `tenant_id` column is declared on a reference-table-typed
+ * table. A pure platform-global reference table is platform-global by
+ * definition (08-rls § 7.6 property 1: no `tenant_id`); a `tenant_id` column
+ * is a category error — the table should use the canonical 5-policy RLS DDL
+ * (§ 4) instead. This is the doctrine's safety boundary.
+ */
+export class ReferenceTableTenantColumnError extends Error {
+    table;
+    column;
+    constructor(table, column) {
+        super(`Reference table "${table}" declares a tenant-scoped column "${column}". A pure platform-global reference table (08-rls § 7.6) MUST NOT have a tenant_id column — it is platform-global by definition. Use the canonical 5-policy RLS DDL (withRls) for tenant-scoped tables instead.`);
+        this.table = table;
+        this.column = column;
+        this.name = "ReferenceTableTenantColumnError";
+    }
+}
+/** Column names that mark a table as tenant-scoped (category error for a
+ *  reference table). Case-insensitive match. */
+const TENANT_COLUMN_NAMES = new Set(["tenant_id", "tenantid"]);
+/** Returns the tenant-scoped column name if `columns` contains one, else
+ *  `null`. Case-insensitive. Used by the reference-table refusal guard. */
+export function findTenantColumn(columns) {
+    for (const col of columns) {
+        if (TENANT_COLUMN_NAMES.has(col.toLowerCase()))
+            return col;
+    }
+    return null;
+}
+/**
+ * Emits the canonical 08-rls § 7.6 GRANT/REVOKE DDL for a pure
+ * platform-global reference table. Does NOT include `CREATE TABLE` (the
+ * table shape is the consumer's; Drizzle/SQLAlchemy/sqlc emit it) and
+ * INTENTIONALLY does NOT include `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`.
+ *
+ * Output ends with `\n`. Byte-equal across TS / Python / Go ports.
+ *
+ * Order (deterministic for parity-fence):
+ *   1. skip-RLS marker comment
+ *   2. GRANT SELECT to each read role (in `readRoles` order)
+ *   3. GRANT INSERT, UPDATE, DELETE to nodii_owner
+ *   4. REVOKE INSERT, UPDATE, DELETE from each read role (in `readRoles` order)
+ */
+export function referenceTableGrantsSql(table, opts = {}) {
+    const readRoles = opts.readRoles && opts.readRoles.length > 0
+        ? opts.readRoles
+        : DEFAULT_REFERENCE_READ_ROLES;
+    const lines = [REFERENCE_TABLE_SKIP_RLS_MARKER];
+    for (const role of readRoles) {
+        lines.push(`GRANT SELECT ON ${table} TO ${role};`);
+    }
+    lines.push(`GRANT ${REFERENCE_TABLE_WRITE_VERBS} ON ${table} TO ${REFERENCE_TABLE_OWNER_ROLE};`);
+    for (const role of readRoles) {
+        lines.push(`REVOKE ${REFERENCE_TABLE_WRITE_VERBS} ON ${table} FROM ${role};`);
+    }
+    return `${lines.join("\n")}\n`;
+}
 //# sourceMappingURL=rls-policy-gen.js.map

package/dist/rls-policy-gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"rls-policy-gen.js","sourceRoot":"","sources":["../src/rls-policy-gen.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,mDAAmD;AAWnD,MAAM,aAAa,GAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,OAAoB,EAAE;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,6BAA6B,CAAC,CAAC;IAC9D,mCAAmC;IACnC,KAAK,CAAC,IAAI,CACR,iBAAiB,UAAU,oBAAoB,KAAK,yDAAyD,CAC9G,CAAC;IAEF,8EAA8E;IAC9E,qEAAqE;IACrE,gBAAgB;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,kDAAkD;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,yDAAyD;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,OAAoB,EAAE;IAEtB,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG;QACZ,SAAS,QAAQ,OAAO,KAAK,qBAAqB;QAClD,SAAS,QAAQ,OAAO,KAAK,oBAAoB;KAClD,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CACpB,KAAa,EACb,UAAkB,EAClB,YAAoB,EACpB,IAAa;IAEb,yFAAyF;IACzF,MAAM,IAAI,GAAG,GAAG,YAAY,uDAAuD,CAAC;IACpF,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAa,EACb,UAAkB,EAClB,YAAoB,EACpB,IAAa;IAEb,wEAAwE;IACxE,MAAM,IAAI,GAAG,GAAG,YAAY,yBAAyB,CAAC;IACtD,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,UAAkB,EAClB,MAAsB,EACtB,IAAa,EACb,IAAY,EACZ,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,GAAG,UAAU,IAAI,MAAM,IAAI,MAAM,SAAS,CAAC;IAC9D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,IAAI,gBAAgB,IAAI,IAAI,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,IAAI,WAAW,IAAI,iBAAiB,IAAI,IAAI,CAAC;IAC/G,CAAC;IACD,OAAO,iBAAiB,UAAU,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,WAAW,IAAI,IAAI,CAAC;AAC3F,CAAC;AAED,+EAA+E;AAC/E,0DAA0D;AAC1D,EAAE;AACF,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,gEAAgE;AAEhE,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAqB3E,MAAM,CAAC,MAAM,mCAAmC,GAC9C,6BAA6B,CAAC;AAChC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAE/C,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,IAAqB;IAC/C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EACnB,YAAoB,EACpB,UAAkB;IAElB,OAAO,yBAAyB,WAAW,kJAAkJ,UAAU,CAAC,UAAU,CAAC,mKAAmK,YAAY,KAAK,CAAC;AAC1Y,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EACnB,UAAkB;IAElB,OAAO,yBAAyB,WAAW,uLAAuL,UAAU,CAAC,UAAU,CAAC,+EAA+E,CAAC;AAC1U,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CACtC,IAAqB,EACrB,SAAiB;IAEjB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,eAAe,SAAS,GAAG,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,UAAU,SAAS,iBAAiB,SAAS,GAAG,CAAC;QAC1D;YACE,wBAAwB;YACxB,OAAO,UAAU,SAAS,GAAG,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,KAAoC,EACpC,OAA+B,EAAE;IAEjC,OAAO,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,KAAoC,EACpC,OAA+B,EAAE;IAEjC,OAAO,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAa,EACb,KAAoC,EACpC,IAAyB,EACzB,IAA4B;IAE5B,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;YACf,CAAC,CAAC,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC;YACtE,CAAC,CAAC,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CACR,iBAAiB,UAAU,iBAAiB,IAAI,OAAO,KAAK,QAAQ,kBAAkB,CAAC,IAAI,CAAC,OAAO,iBAAiB,IAAI,MAAM,GAAG,CAClI,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"rls-policy-gen.js","sourceRoot":"","sources":["../src/rls-policy-gen.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,mDAAmD;AAWnD,MAAM,aAAa,GAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,OAAoB,EAAE;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,6BAA6B,CAAC,CAAC;IAC9D,mCAAmC;IACnC,KAAK,CAAC,IAAI,CACR,iBAAiB,UAAU,oBAAoB,KAAK,yDAAyD,CAC9G,CAAC;IAEF,8EAA8E;IAC9E,qEAAqE;IACrE,gBAAgB;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,kDAAkD;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,yDAAyD;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,OAAoB,EAAE;IAEtB,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG;QACZ,SAAS,QAAQ,OAAO,KAAK,qBAAqB;QAClD,SAAS,QAAQ,OAAO,KAAK,oBAAoB;KAClD,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CACpB,KAAa,EACb,UAAkB,EAClB,YAAoB,EACpB,IAAa;IAEb,yFAAyF;IACzF,MAAM,IAAI,GAAG,GAAG,YAAY,uDAAuD,CAAC;IACpF,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAa,EACb,UAAkB,EAClB,YAAoB,EACpB,IAAa;IAEb,wEAAwE;IACxE,MAAM,IAAI,GAAG,GAAG,YAAY,yBAAyB,CAAC;IACtD,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,UAAkB,EAClB,MAAsB,EACtB,IAAa,EACb,IAAY,EACZ,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,GAAG,UAAU,IAAI,MAAM,IAAI,MAAM,SAAS,CAAC;IAC9D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,IAAI,gBAAgB,IAAI,IAAI,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,IAAI,WAAW,IAAI,iBAAiB,IAAI,IAAI,CAAC;IAC/G,CAAC;IACD,OAAO,iBAAiB,UAAU,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,WAAW,IAAI,IAAI,CAAC;AAC3F,CAAC;AAED,+EAA+E;AAC/E,0DAA0D;AAC1D,EAAE;AACF,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,gEAAgE;AAEhE,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAqB3E,MAAM,CAAC,MAAM,mCAAmC,GAC9C,6BAA6B,CAAC;AAChC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAE/C,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,IAAqB;IAC/C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EACnB,YAAoB,EACpB,UAAkB;IAElB,OAAO,yBAAyB,WAAW,kJAAkJ,UAAU,CAAC,UAAU,CAAC,mKAAmK,YAAY,KAAK,CAAC;AAC1Y,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EACnB,UAAkB;IAElB,OAAO,yBAAyB,WAAW,uLAAuL,UAAU,CAAC,UAAU,CAAC,+EAA+E,CAAC;AAC1U,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CACtC,IAAqB,EACrB,SAAiB;IAEjB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,eAAe,SAAS,GAAG,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,UAAU,SAAS,iBAAiB,SAAS,GAAG,CAAC;QAC1D;YACE,wBAAwB;YACxB,OAAO,UAAU,SAAS,GAAG,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,KAAoC,EACpC,OAA+B,EAAE;IAEjC,OAAO,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,KAAoC,EACpC,OAA+B,EAAE;IAEjC,OAAO,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAa,EACb,KAAoC,EACpC,IAAyB,EACzB,IAA4B;IAE5B,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;YACf,CAAC,CAAC,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC;YACtE,CAAC,CAAC,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CACR,iBAAiB,UAAU,iBAAiB,IAAI,OAAO,KAAK,QAAQ,kBAAkB,CAAC,IAAI,CAAC,OAAO,iBAAiB,IAAI,MAAM,GAAG,CAClI,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,+EAA+E;AAC/E,mFAAmF;AACnF,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,6DAA6D;AAC7D,4EAA4E;AAC5E,uCAAuC;AACvC,EAAE;AACF,8DAA8D;AAC9D,oEAAoE;AACpE,2EAA2E;AAC3E,gEAAgE;AAChE,6BAA6B;AAC7B,wEAAwE;AACxE,4EAA4E;AAC5E,+CAA+C;AAC/C,EAAE;AACF,6EAA6E;AAC7E,6DAA6D;AAC7D,0DAA0D;AAE1D,kEAAkE;AAClE,MAAM,0BAA0B,GAAG;IACjC,gBAAgB;IAChB,eAAe;IACf,oBAAoB;CACZ,CAAC;AAKX,MAAM,0BAA0B,GAAG,aAAa,CAAC;AACjD,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAE7D;;wEAEwE;AACxE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8IAA8I,CAAC;AASjJ,MAAM,4BAA4B,GAAsC;IACtE,gBAAgB;CACjB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAEtC;IACA;IAFlB,YACkB,KAAa,EACb,MAAc;QAE9B,KAAK,CACH,oBAAoB,KAAK,sCAAsC,MAAM,iNAAiN,CACvR,CAAC;QALc,UAAK,GAAL,KAAK,CAAQ;QACb,WAAM,GAAN,MAAM,CAAQ;QAK9B,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED;gDACgD;AAChD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAE/D;2EAC2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,OAA8B,EAAE;IAEhC,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,SAAS;QAChB,CAAC,CAAC,4BAA4B,CAAC;IACnC,MAAM,KAAK,GAAa,CAAC,+BAA+B,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,OAAO,IAAI,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,CAAC,IAAI,CACR,SAAS,2BAA2B,OAAO,KAAK,OAAO,0BAA0B,GAAG,CACrF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,UAAU,2BAA2B,OAAO,KAAK,SAAS,IAAI,GAAG,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/db-rls",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
   "license": "MIT",
   "type": "module",