@nodii/db-rls 0.5.1 → 0.5.3

package/bin/migrate-gen.mjs

@@ -1,12 +1,29 @@
 #!/usr/bin/env node
-// CLI shim for `npx @nodii/db-rls migrate-gen <serviceName>`.
+// CLI shim for `npx @nodii/db-rls <subcommand>`.
 //
-// The real logic lives in src/migrate-gen.ts; this shim just unwraps
-// argv and calls runMigrateGenCli + translates the return value to
-// process.exit.
+// The real logic lives in src/*.ts; this shim unwraps argv, dispatches by
+// subcommand, and translates the return value to process.exit.
+//
+// Subcommands:
+//   migrate-gen <serviceName> [--out <dir>] [--stub]
+//   verify-rls  --tables <a,b,c> [--ref <x,y>] [--schema <name>] [--db <url>]
+//
+// (Filename kept as migrate-gen.mjs for the package.json `bin` mapping;
+// it is the single `nodii-db-rls` entrypoint, not migrate-gen only.)
 
 import { runMigrateGenCli } from "../dist/migrate-gen.js";
+import { runVerifyRlsCli } from "../dist/verify-rls-cli.js";
+
+const argv = process.argv.slice(2);
+const sub = argv[0];
 
-const args = process.argv.slice(2);
-const code = runMigrateGenCli(args);
-process.exit(code);
+if (sub === "verify-rls") {
+  const { code, message } = await runVerifyRlsCli(argv.slice(1));
+  // Coverage failures (1) + usage (2) go to stderr; success (0) to stdout.
+  (code === 0 ? console.log : console.error)(message);
+  process.exit(code);
+} else {
+  // migrate-gen (default + back-compat: runMigrateGenCli accepts the
+  // leading "migrate-gen" token and prints usage on a missing serviceName).
+  process.exit(runMigrateGenCli(argv));
+}

package/dist/drizzle-policies.d.ts

@@ -1,6 +1,9 @@
-import type { PgColumn, PgPolicy } from "drizzle-orm/pg-core";
-import type { PlatformOpsPerVerbPermissions, WithRlsOpts } from "./rls-policy-gen";
+import type { PgColumnBuilderBase, PgPolicy, PgTableWithColumns } from "drizzle-orm/pg-core";
+import type { PgColumn } from "drizzle-orm/pg-core";
+import type { PlatformOpsPerVerbPermissions, ReferenceTableSqlOpts, WithRlsOpts } from "./rls-policy-gen";
 export type { PlatformOpsPerVerbPermissions } from "./rls-policy-gen";
+export type { ReferenceTableReadRole, ReferenceTableSqlOpts, } from "./rls-policy-gen";
+export { ReferenceTableTenantColumnError, referenceTableGrantsSql, } from "./rls-policy-gen";
 /**
  * Returns the canonical 5-policy Drizzle constructs (per doctrine § 4)
  * for a tenant-scoped table.
@@ -78,4 +81,33 @@ export declare function withPlatformOpsGlobal(table: {
     };
     [key: string]: unknown;
 }, perms: PlatformOpsPerVerbPermissions, opts?: WithPlatformOpsOpts): PgPolicy[];
+/**
+ * Builds a pure platform-global reference table (08-rls § 7.6).
+ *
+ * Identical signature to Drizzle's `pgTable(name, columns)` — returns the
+ * `PgTableWithColumns`. No third-arg extras callback is accepted because a
+ * reference table gets NO RLS policies (GRANT-controlled per § 7.6).
+ *
+ * Throws {@link ReferenceTableTenantColumnError} at construction time if any
+ * column is named `tenant_id` (case-insensitive). A reference table is
+ * platform-global by definition; a `tenant_id` column means the table is
+ * tenant-scoped and should use `withRls` + the canonical 5-policy DDL instead.
+ *
+ * @param name    Postgres table name.
+ * @param columns Drizzle column-builder map (same shape as `pgTable`'s).
+ */
+export declare function referenceTable<TColumns extends Record<string, PgColumnBuilderBase>>(name: string, columns: TColumns): PgTableWithColumns<any>;
+/**
+ * Emits the GRANT/REVOKE DDL (08-rls § 7.6) for a reference table built via
+ * {@link referenceTable}. Convenience wrapper over `referenceTableGrantsSql`
+ * that derives the table name from the Drizzle table.
+ *
+ * Same single-source SQL as migrate-gen's `platform_global_reference` kind.
+ */
+export declare function referenceTableGrants(table: {
+    _: {
+        name: string;
+    };
+    [key: string]: unknown;
+}, opts?: ReferenceTableSqlOpts): string;
 //# sourceMappingURL=drizzle-policies.d.ts.map

package/dist/drizzle-policies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drizzle-policies.d.ts","sourceRoot":"","sources":["../src/drizzle-policies.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAO9D,OAAO,KAAK,EACV,6BAA6B,EAE7B,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAI1B,YAAY,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAItE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,QAAQ,EACnB,IAAI,GAAE,WAAgB,GACrB,QAAQ,EAAE,CAsCZ;AA6ED,MAAM,WAAW,mBAAmB;IAClC;;kEAE8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6CACyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,QAAQ,EACnB,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,EAAE,CAwBZ;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE;IAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EACtD,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,EAAE,CA4BZ"}
+{"version":3,"file":"drizzle-policies.d.ts","sourceRoot":"","sources":["../src/drizzle-policies.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EACV,mBAAmB,EACnB,QAAQ,EACR,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAUpD,OAAO,KAAK,EACV,6BAA6B,EAC7B,qBAAqB,EAErB,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAI1B,YAAY,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACtE,YAAY,EACV,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAI1B;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CACrB,SAAS,EAAE,QAAQ,EACnB,IAAI,GAAE,WAAgB,GACrB,QAAQ,EAAE,CAsCZ;AA6ED,MAAM,WAAW,mBAAmB;IAClC;;kEAE8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6CACyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,QAAQ,EACnB,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,EAAE,CAwBZ;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE;IAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EACtD,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,mBAAwB,GAC7B,QAAQ,EAAE,CA4BZ;AA6DD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAEpD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,QAAQ,GAEhB,kBAAkB,CAAC,GAAG,CAAC,CAoBzB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE;IAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EACtD,IAAI,GAAE,qBAA0B,GAC/B,MAAM,CAKR"}

package/dist/drizzle-policies.js

@@ -25,9 +25,11 @@
 // The legacy string-DDL `withRls(table: string)` helper exported from
 // `@nodii/db-rls` (main barrel) keeps its `*_policy` suffix for backwards
 // parity with v0.1.x consumers — both surfaces ship.
-import { getTableName, sql } from "drizzle-orm";
+import { getTableColumns, getTableName, sql } from "drizzle-orm";
+import { pgTable } from "drizzle-orm/pg-core";
 import { pgPolicy } from "drizzle-orm/pg-core";
-import { PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, platformOpsGlobalPredicateSql, platformOpsTenantPredicateSql, } from "./rls-policy-gen";
+import { PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, ReferenceTableTenantColumnError, findTenantColumn, platformOpsGlobalPredicateSql, platformOpsTenantPredicateSql, referenceTableGrantsSql, } from "./rls-policy-gen";
+export { ReferenceTableTenantColumnError, referenceTableGrantsSql, } from "./rls-policy-gen";
 const DEFAULT_ALLOW = ["SELECT", "INSERT"];
 /**
  * Returns the canonical 5-policy Drizzle constructs (per doctrine § 4)
@@ -208,4 +210,84 @@ function platformOpsPredicates(verb, predicate) {
             return { using: predicate };
     }
 }
+// ----------------------------------------------------------------------------
+// 08-rls § 7.6 — pure platform-global reference table builder.
+//
+// A pure platform-global reference table (no tenant_id + non-confidential +
+// platform-admin write path) is GRANT-controlled, NOT RLS-protected. This
+// builder wraps Drizzle's `pgTable` and:
+//
+//   1. REFUSES (throws ReferenceTableTenantColumnError) if a `tenant_id`
+//      column is declared — a tenant_id is a category error for a
+//      platform-global reference table (§ 7.6 property 1). This is the
+//      doctrine's hard safety boundary.
+//   2. Returns the plain pgTable — NO RLS policies are attached (§ 7.6
+//      INTENTIONALLY omits ENABLE ROW LEVEL SECURITY).
+//
+// The companion GRANT/REVOKE DDL (GRANT SELECT to the read role + GRANT
+// write to nodii_owner + REVOKE write from the read role) is emitted by
+// `referenceTableGrantsSql(getTableName(t))` — apply it in the consumer's
+// migration. migrate-gen's `platform_global_reference` kind emits the same
+// DDL via the same single-source `referenceTableGrantsSql` (no fork).
+//
+// Usage:
+//
+//   import { referenceTable, referenceTableGrantsSql } from "@nodii/db-rls/drizzle";
+//   import { getTableName } from "drizzle-orm";
+//
+//   export const taskActionButtonRegistry = referenceTable(
+//     "task_action_button_registry",
+//     {
+//       id: text("id").primaryKey(),
+//       label: text("label").notNull(),
+//       icon: text("icon"),
+//     },
+//   );
+//   // Apply alongside the Drizzle migration:
+//   const grantDdl = referenceTableGrantsSql(getTableName(taskActionButtonRegistry));
+/**
+ * Builds a pure platform-global reference table (08-rls § 7.6).
+ *
+ * Identical signature to Drizzle's `pgTable(name, columns)` — returns the
+ * `PgTableWithColumns`. No third-arg extras callback is accepted because a
+ * reference table gets NO RLS policies (GRANT-controlled per § 7.6).
+ *
+ * Throws {@link ReferenceTableTenantColumnError} at construction time if any
+ * column is named `tenant_id` (case-insensitive). A reference table is
+ * platform-global by definition; a `tenant_id` column means the table is
+ * tenant-scoped and should use `withRls` + the canonical 5-policy DDL instead.
+ *
+ * @param name    Postgres table name.
+ * @param columns Drizzle column-builder map (same shape as `pgTable`'s).
+ */
+export function referenceTable(name, columns) {
+    // Refuse a tenant_id column declared in the column map — the § 7.6
+    // safety boundary. Check the keys first (the column property name) so we
+    // reject `tenantId: uuid("tenant_id")` AND `tenant_id: ...`.
+    const declaredKey = findTenantColumn(Object.keys(columns));
+    if (declaredKey) {
+        throw new ReferenceTableTenantColumnError(name, declaredKey);
+    }
+    const table = pgTable(name, columns);
+    // Also refuse if the resolved DB column name is tenant_id even when the
+    // property key isn't (e.g. `foo: uuid("tenant_id")`). getTableColumns
+    // resolves the actual DB column names.
+    const resolvedCols = getTableColumns(table);
+    const tenantDbCol = findTenantColumn(Object.values(resolvedCols).map((c) => c.name));
+    if (tenantDbCol) {
+        throw new ReferenceTableTenantColumnError(name, tenantDbCol);
+    }
+    return table;
+}
+/**
+ * Emits the GRANT/REVOKE DDL (08-rls § 7.6) for a reference table built via
+ * {@link referenceTable}. Convenience wrapper over `referenceTableGrantsSql`
+ * that derives the table name from the Drizzle table.
+ *
+ * Same single-source SQL as migrate-gen's `platform_global_reference` kind.
+ */
+export function referenceTableGrants(table, opts = {}) {
+    const tableName = getTableName(table);
+    return referenceTableGrantsSql(tableName, opts);
+}
 //# sourceMappingURL=drizzle-policies.js.map

package/dist/drizzle-policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"drizzle-policies.js","sourceRoot":"","sources":["../src/drizzle-policies.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,mBAAmB;AACnB,EAAE;AACF,qDAAqD;AACrD,EAAE;AACF,iEAAiE;AACjE,mDAAmD;AACnD,6CAA6C;AAC7C,2CAA2C;AAC3C,gBAAgB;AAChB,sFAAsF;AACtF,8BAA8B;AAC9B,mFAAmF;AACnF,QAAQ;AACR,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,oEAAoE;AACpE,yBAAyB;AACzB,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,qDAAqD;AAErD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG/C,OAAO,EACL,mCAAmC,EACnC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAW1B,MAAM,aAAa,GAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,OAAO,CACrB,SAAmB,EACnB,OAAoB,EAAE;IAEtB,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;IAEzD,0FAA0F;IAC1F,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAC3B,GAAG,YAAY,uDAAuD,CACvE,CAAC;IACF,uDAAuD;IACvD,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,yBAAyB,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,oBAAoB;IACpB,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,QAAQ,EAAE;QAC9B,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,KAAK;QACV,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,GAAG,CAAA,MAAM;QAChB,SAAS,EAAE,GAAG,CAAA,MAAM;KACrB,CAAC,CACH,CAAC;IAEF,6BAA6B;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CACpB,UAAkB,EAClB,IAAa,EACb,SAAqC;IAErC,MAAM,IAAI,GAAG,GAAG,UAAU,SAAS,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACxD,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,eAAe;QACnB,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,UAAkB,EAClB,IAAa,EACb,SAAqC;IAErC,MAAM,IAAI,GAAG,GAAG,UAAU,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACvD,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,gBAAgB;QACpB,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,IAAI,CAAC,WAAW,EAA+C,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CACjB,IAAa,EACb,SAAqC;IAKrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD;YACE,iBAAiB;YACjB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAgCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAmB,EACnB,KAAoC,EACpC,OAA4B,EAAE;IAE9B,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CACvB,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CACrE,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE,EAAE;YAC7C,EAAE,EAAE,YAAY;YAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC;YAChC,EAAE,EAAE,oBAAoB;YACxB,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAsD,EACtD,KAAoC,EACpC,OAA4B,EAAE;IAE9B,sEAAsE;IACtE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,SAAS,GAAG,YAAY,CAC5B,KAAsD,CACvD,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CACvB,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,CACvD,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE,EAAE;YAC7C,EAAE,EAAE,YAAY;YAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC;YAChC,EAAE,EAAE,oBAAoB;YACxB,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6C;IAE7C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6C,EAC7C,SAAqC;IAKrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD;YACE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC"}
+{"version":3,"file":"drizzle-policies.js","sourceRoot":"","sources":["../src/drizzle-policies.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,mBAAmB;AACnB,EAAE;AACF,qDAAqD;AACrD,EAAE;AACF,iEAAiE;AACjE,mDAAmD;AACnD,6CAA6C;AAC7C,2CAA2C;AAC3C,gBAAgB;AAChB,sFAAsF;AACtF,8BAA8B;AAC9B,mFAAmF;AACnF,QAAQ;AACR,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,oEAAoE;AACpE,yBAAyB;AACzB,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,qDAAqD;AAErD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAQ/C,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,gBAAgB,EAChB,6BAA6B,EAC7B,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,aAAa,GAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,OAAO,CACrB,SAAmB,EACnB,OAAoB,EAAE;IAEtB,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;IAEzD,0FAA0F;IAC1F,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAC3B,GAAG,YAAY,uDAAuD,CACvE,CAAC;IACF,uDAAuD;IACvD,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,yBAAyB,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,oBAAoB;IACpB,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,QAAQ,EAAE;QAC9B,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,KAAK;QACV,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,GAAG,CAAA,MAAM;QAChB,SAAS,EAAE,GAAG,CAAA,MAAM;KACrB,CAAC,CACH,CAAC;IAEF,6BAA6B;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CACpB,UAAkB,EAClB,IAAa,EACb,SAAqC;IAErC,MAAM,IAAI,GAAG,GAAG,UAAU,SAAS,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACxD,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,eAAe;QACnB,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,UAAkB,EAClB,IAAa,EACb,SAAqC;IAErC,MAAM,IAAI,GAAG,GAAG,UAAU,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACvD,OAAO,QAAQ,CAAC,IAAI,EAAE;QACpB,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,gBAAgB;QACpB,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,IAAI,CAAC,WAAW,EAA+C,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CACjB,IAAa,EACb,SAAqC;IAKrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD;YACE,iBAAiB;YACjB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAgCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAmB,EACnB,KAAoC,EACpC,OAA4B,EAAE;IAE9B,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CACvB,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CACrE,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE,EAAE;YAC7C,EAAE,EAAE,YAAY;YAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC;YAChC,EAAE,EAAE,oBAAoB;YACxB,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAsD,EACtD,KAAoC,EACpC,OAA4B,EAAE;IAE9B,sEAAsE;IACtE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,SAAS,GAAG,YAAY,CAC5B,KAAsD,CACvD,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CACvB,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,CACvD,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE,EAAE;YAC7C,EAAE,EAAE,YAAY;YAChB,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC;YAChC,EAAE,EAAE,oBAAoB;YACxB,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6C;IAE7C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAA6C,EAC7C,SAAqC;IAKrC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACpD;YACE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,+DAA+D;AAC/D,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,yCAAyC;AACzC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,uEAAuE;AACvE,wCAAwC;AACxC,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,SAAS;AACT,EAAE;AACF,qFAAqF;AACrF,gDAAgD;AAChD,EAAE;AACF,4DAA4D;AAC5D,qCAAqC;AACrC,QAAQ;AACR,qCAAqC;AACrC,wCAAwC;AACxC,4BAA4B;AAC5B,SAAS;AACT,OAAO;AACP,8CAA8C;AAC9C,sFAAsF;AAEtF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAG5B,IAAY,EACZ,OAAiB;IAGjB,mEAAmE;IACnE,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,+BAA+B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,wEAAwE;IACxE,sEAAsE;IACtE,uCAAuC;IACvC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAClC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/C,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,+BAA+B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAsD,EACtD,OAA8B,EAAE;IAEhC,MAAM,SAAS,GAAG,YAAY,CAC5B,KAAsD,CACvD,CAAC;IACF,OAAO,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC"}

package/dist/index.d.ts

@@ -11,12 +11,14 @@ export { withUserContextDb, withSystemContextDb, withOwnerContextDb, } from "./d
 export type { DrizzleClient, NodePgDatabase } from "./drizzle-client";
 export type { OwnerContextOpts } from "./migrate-guard";
 export { assertMigrateAllowed } from "./migrate-guard";
+export { RlsCoverageError, verifyRls } from "./verify-rls";
+export type { ReferenceTablePredicate, RlsCoverageOffender, RlsQuerier, VerifyRlsOpts, } from "./verify-rls";
 export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, } from "./auth-schema";
 export type { SqlExecutor } from "./auth-schema";
-export { withRls, generateTableGrants, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, } from "./rls-policy-gen";
-export type { RlsVerb, WithRlsOpts, PlatformOpsVerb, PlatformOpsPerVerbPermissions, WithPlatformOpsSqlOpts, } from "./rls-policy-gen";
-export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, platformOpsPoliciesSql, } from "./migrate-gen";
-export type { MigrateGenInput, MigrateGenResult, PlatformOpsTableSpec, } from "./migrate-gen";
+export { withRls, generateTableGrants, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, referenceTableGrantsSql, findTenantColumn, ReferenceTableTenantColumnError, REFERENCE_TABLE_SKIP_RLS_MARKER, } from "./rls-policy-gen";
+export type { RlsVerb, WithRlsOpts, PlatformOpsVerb, PlatformOpsPerVerbPermissions, WithPlatformOpsSqlOpts, ReferenceTableReadRole, ReferenceTableSqlOpts, } from "./rls-policy-gen";
+export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, platformOpsPoliciesSql, referenceTablesSql, } from "./migrate-gen";
+export type { MigrateGenInput, MigrateGenResult, PlatformOpsTableSpec, ReferenceTableSpec, } from "./migrate-gen";
 export { generateRlsPolicy, authSchemaHelpers } from "./rls-policy";
 export { InMemoryPgPool } from "./in-memory-pool";
 export type { TranscriptEntry } from "./in-memory-pool";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EAItB,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC,GACpC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,OAAO,EACP,WAAW,EACX,eAAe,EACf,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,sBAAsB,EACtB,QAAQ,EACR,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EAItB,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAMvD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC3D,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,UAAU,EACV,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC,EAEnC,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,OAAO,EACP,WAAW,EACX,eAAe,EACf,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,sBAAsB,EACtB,QAAQ,EACR,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -42,9 +42,16 @@ export { withUserContext, withSystemContext, withOwnerContext, withPlatformOpsCo
 withPlatformOps, _resetWithPlatformOpsDeprecationWarnedForTests, autoDispatch, } from "./context";
 export { withUserContextDb, withSystemContextDb, withOwnerContextDb, } from "./drizzle-client";
 export { assertMigrateAllowed } from "./migrate-guard";
+// 08-rls § A1 + § 7.6 — RLS-coverage preflight guard. Service db:setup
+// gates call verifyRls() after migrations to catch the drizzle-snapshot
+// RLS hazard (a tenant table created without ENABLE ROW LEVEL SECURITY),
+// exempting § 7.6 reference tables (GRANT-controlled, NO RLS by design).
+export { RlsCoverageError, verifyRls } from "./verify-rls";
 export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, } from "./auth-schema";
-export { withRls, generateTableGrants, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, } from "./rls-policy-gen";
-export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, platformOpsPoliciesSql, } from "./migrate-gen";
+export { withRls, generateTableGrants, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, 
+// 08-rls § 7.6 — pure platform-global reference tables (GRANT-controlled).
+referenceTableGrantsSql, findTenantColumn, ReferenceTableTenantColumnError, REFERENCE_TABLE_SKIP_RLS_MARKER, } from "./rls-policy-gen";
+export { migrateGen, runMigrateGenCli, userTenantIdsRealSql, userTenantIdsStubSql, platformOpsPoliciesSql, referenceTablesSql, } from "./migrate-gen";
 // Legacy v0.1.0 surface kept for callers that already imported these
 // names. Both are byte-equal SQL helpers — no NotImplemented paths.
 export { generateRlsPolicy, authSchemaHelpers } from "./rls-policy";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,wDAAwD;AACxD,6CAA6C;AAC7C,EAAE;AACF,yCAAyC;AACzC,sEAAsE;AACtE,wCAAwC;AACxC,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,wEAAwE;AACxE,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,sCAAsC;AACtC,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,0EAA0E;AAC1E,qCAAqC;AAErC,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB;AACtB,uEAAuE;AACvE,wEAAwE;AACxE,sCAAsC;AACtC,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC,GACpC,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAOvB,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,wDAAwD;AACxD,6CAA6C;AAC7C,EAAE;AACF,yCAAyC;AACzC,sEAAsE;AACtE,wCAAwC;AACxC,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,wEAAwE;AACxE,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,sCAAsC;AACtC,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,0EAA0E;AAC1E,qCAAqC;AAErC,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB;AACtB,uEAAuE;AACvE,wEAAwE;AACxE,sCAAsC;AACtC,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQ3D,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC;AACnC,2EAA2E;AAC3E,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAQvB,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC"}

package/dist/migrate-gen.d.ts

@@ -1,4 +1,4 @@
-import { type PlatformOpsPerVerbPermissions } from "./rls-policy-gen";
+import { type PlatformOpsPerVerbPermissions, type ReferenceTableReadRole } from "./rls-policy-gen";
 /**
  * One table exposed via the platform-ops cross-tenant surface (D185).
  * `scope='tenant'` tables emit the tenant predicate (joins on
@@ -21,6 +21,27 @@ export interface PlatformOpsTableSpec {
     /** Override the `platform_ops_grants_replica` table name. */
     grantsTable?: string;
 }
+/**
+ * One pure platform-global reference table (08-rls § 7.6). Declaring a
+ * table here makes migrate-gen emit the GRANT-controlled (NO RLS) DDL —
+ * `GRANT SELECT` to the read role(s) + `GRANT INSERT, UPDATE, DELETE` to
+ * `nodii_owner` + `REVOKE` write from the read role(s) — and NOT the
+ * 5-policy RLS DDL.
+ *
+ * `kind` is fixed to the discriminant `'platform_global_reference'` so a
+ * schema's table-set can be a heterogeneous list and migrate-gen routes
+ * each entry by `kind`.
+ */
+export interface ReferenceTableSpec {
+    /** Discriminant — pure platform-global reference table per 08-rls § 7.6. */
+    kind: "platform_global_reference";
+    /** Table name. May be schema-qualified (`schema.tbl`). */
+    table: string;
+    /** Read role(s) that get `GRANT SELECT` + `REVOKE` write. Defaults to
+     *  `["nodii_services"]` (3-pool). 2-pool services may pass
+     *  `["authenticated"]`; 4-pool may add `"nodii_platform_ops"`. */
+    readRoles?: readonly ReferenceTableReadRole[];
+}
 export interface MigrateGenInput {
     /** Pattern A service name, e.g. "nodii-billing-service". Used only for
      *  the file header comment; not in the SQL body. */
@@ -35,6 +56,10 @@ export interface MigrateGenInput {
      *  file `0002_platform_ops_policies.sql` is emitted with the per-verb
      *  platform-ops CREATE POLICY DDL. Applies only in the non-stub path. */
     platformOps?: readonly PlatformOpsTableSpec[];
+    /** Pure platform-global reference tables (08-rls § 7.6). When non-empty,
+     *  a file `0003_reference_table_grants.sql` is emitted with the
+     *  GRANT-controlled (NO RLS) DDL. Applies only in the non-stub path. */
+    referenceTables?: readonly ReferenceTableSpec[];
 }
 export interface MigrateGenResult {
     /** Absolute path of the file that was written. */
@@ -46,6 +71,11 @@ export interface MigrateGenResult {
     /** Platform-ops policy DDL contents, when emitted (also returned for
      *  parity-fence + test assertions). */
     platformOpsContents?: string;
+    /** Absolute path of the reference-table grants file, when emitted. */
+    referenceTablesPath?: string;
+    /** Reference-table grants DDL contents, when emitted (also returned for
+     *  parity-fence + test assertions). */
+    referenceTablesContents?: string;
 }
 /**
  * SQL text for the real (joins mirror tables) helper. Module-level
@@ -66,6 +96,22 @@ export declare function userTenantIdsStubSql(serviceName: string): string;
  * Returns `""` when no tables are configured.
  */
 export declare function platformOpsPoliciesSql(serviceName: string, tables: readonly PlatformOpsTableSpec[]): string;
+/**
+ * SQL text for the pure platform-global reference-table grants file
+ * (08-rls § 7.6). One GRANT-block per configured table, in input order.
+ * Reuses `referenceTableGrantsSql` — the same single-source generator the
+ * Drizzle `referenceTable` table-builder consumes — so the emitted DDL is
+ * equivalent (no forked GRANT DDL).
+ *
+ * GATE: each block carries the skip-RLS marker comment and INTENTIONALLY
+ * never emits `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`. This function
+ * asserts (throws) if any generated block somehow contains an ENABLE RLS
+ * statement — a structural guard against the § 7.6 boundary being violated
+ * by a future refactor.
+ *
+ * Returns `""` when no tables are configured.
+ */
+export declare function referenceTablesSql(serviceName: string, tables: readonly ReferenceTableSpec[]): string;
 /**
  * Generates the residual migration phase file and returns its contents.
  * If `outDir` is set, writes the file to disk; otherwise just returns
@@ -74,6 +120,10 @@ export declare function platformOpsPoliciesSql(serviceName: string, tables: read
  * When `platformOps` tables are configured (and not in `--stub` mode), a
  * second file `0002_platform_ops_policies.sql` is also written with the
  * per-verb platform-ops CREATE POLICY DDL (08-rls § 7.6).
+ *
+ * When `referenceTables` are configured (and not in `--stub` mode), a file
+ * `0003_reference_table_grants.sql` is also written with the
+ * GRANT-controlled (NO RLS) DDL (08-rls § 7.6).
  */
 export declare function migrateGen(input: MigrateGenInput): MigrateGenResult;
 /**

package/dist/migrate-gen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-gen.d.ts","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,KAAK,6BAA6B,EAGnC,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;qCACiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;wDACoD;IACpD,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B;qCACiC;IACjC,WAAW,EAAE,6BAA6B,CAAC;IAC3C;yBACqB;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B;wDACoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;6CAEyC;IACzC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;6EAEyE;IACzE,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;2CACuC;IACvC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAehE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAWhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,oBAAoB,EAAE,GACtC,MAAM,CAoBR;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAiCnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA6BhE"}
+{"version":3,"file":"migrate-gen.d.ts","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAK5B,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;qCACiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;wDACoD;IACpD,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B;qCACiC;IACjC,WAAW,EAAE,6BAA6B,CAAC;IAC3C;yBACqB;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,IAAI,EAAE,2BAA2B,CAAC;IAClC,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd;;sEAEkE;IAClE,SAAS,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B;wDACoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;6CAEyC;IACzC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;6EAEyE;IACzE,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9C;;4EAEwE;IACxE,eAAe,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;2CACuC;IACvC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;2CACuC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAehE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAWhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,oBAAoB,EAAE,GACtC,MAAM,CAoBR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,kBAAkB,EAAE,GACpC,MAAM,CAoCR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAuDnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA6BhE"}

package/dist/migrate-gen.js

@@ -26,7 +26,7 @@
 // asserts directly.
 import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
-import { withPlatformOpsGlobalSql, withPlatformOpsTenantSql, } from "./rls-policy-gen";
+import { REFERENCE_TABLE_SKIP_RLS_MARKER, referenceTableGrantsSql, withPlatformOpsGlobalSql, withPlatformOpsTenantSql, } from "./rls-policy-gen";
 /**
  * SQL text for the real (joins mirror tables) helper. Module-level
  * constant so parity-fence can byte-compare.
@@ -93,6 +93,55 @@ export function platformOpsPoliciesSql(serviceName, tables) {
 `;
     return `${header}\n${blocks.join("")}`;
 }
+/**
+ * SQL text for the pure platform-global reference-table grants file
+ * (08-rls § 7.6). One GRANT-block per configured table, in input order.
+ * Reuses `referenceTableGrantsSql` — the same single-source generator the
+ * Drizzle `referenceTable` table-builder consumes — so the emitted DDL is
+ * equivalent (no forked GRANT DDL).
+ *
+ * GATE: each block carries the skip-RLS marker comment and INTENTIONALLY
+ * never emits `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`. This function
+ * asserts (throws) if any generated block somehow contains an ENABLE RLS
+ * statement — a structural guard against the § 7.6 boundary being violated
+ * by a future refactor.
+ *
+ * Returns `""` when no tables are configured.
+ */
+export function referenceTablesSql(serviceName, tables) {
+    if (tables.length === 0)
+        return "";
+    const blocks = [];
+    for (const spec of tables) {
+        if (spec.kind !== "platform_global_reference") {
+            throw new Error(`migrate-gen: unknown reference-table kind "${spec.kind}" — expected "platform_global_reference" (08-rls § 7.6).`);
+        }
+        const block = referenceTableGrantsSql(spec.table, {
+            readRoles: spec.readRoles,
+        });
+        // GATE — a reference table MUST NOT enable RLS (08-rls § 7.6). If the
+        // single-source generator ever emits an ENABLE RLS *statement*, fail
+        // loudly here rather than apply a doctrine-violating migration. We
+        // strip comment lines first so the skip-RLS marker (which deliberately
+        // contains the literal "ENABLE ROW LEVEL SECURITY" inside a comment
+        // documenting its omission) does not trip the guard.
+        const executableSql = block
+            .split("\n")
+            .filter((line) => !line.trimStart().startsWith("--"))
+            .join("\n");
+        if (/ENABLE\s+ROW\s+LEVEL\s+SECURITY/i.test(executableSql)) {
+            throw new Error(`migrate-gen: reference table "${spec.table}" generated an ENABLE ROW LEVEL SECURITY statement — forbidden by 08-rls § 7.6 (reference tables are GRANT-controlled, NOT RLS).`);
+        }
+        blocks.push(block);
+    }
+    const header = `-- Service: ${serviceName}
+-- Generated by @nodii/db-rls migrate-gen
+-- Phase: 004-helpers-and-grants — pure platform-global reference-table grants
+-- Spec: 08-rls § 7.6 (GRANT-controlled, NO RLS)
+-- ${REFERENCE_TABLE_SKIP_RLS_MARKER.replace(/^-- /, "")}
+`;
+    return `${header}\n${blocks.join("\n")}`;
+}
 /**
  * Generates the residual migration phase file and returns its contents.
  * If `outDir` is set, writes the file to disk; otherwise just returns
@@ -101,6 +150,10 @@ export function platformOpsPoliciesSql(serviceName, tables) {
  * When `platformOps` tables are configured (and not in `--stub` mode), a
  * second file `0002_platform_ops_policies.sql` is also written with the
  * per-verb platform-ops CREATE POLICY DDL (08-rls § 7.6).
+ *
+ * When `referenceTables` are configured (and not in `--stub` mode), a file
+ * `0003_reference_table_grants.sql` is also written with the
+ * GRANT-controlled (NO RLS) DDL (08-rls § 7.6).
  */
 export function migrateGen(input) {
     const contents = input.stub
@@ -114,6 +167,7 @@ export function migrateGen(input) {
     const path = join(outDir, phase, fileName);
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, contents);
+    const result = { path, contents };
     // Platform-ops policies (08-rls § 7.6). Skipped in the stub path —
     // the stub variant is the chicken-and-egg bootstrap and shouldn't
     // create cross-tenant policies before the grants replica exists.
@@ -123,9 +177,21 @@ export function migrateGen(input) {
         const platformOpsPath = join(outDir, phase, "0002_platform_ops_policies.sql");
         mkdirSync(dirname(platformOpsPath), { recursive: true });
         writeFileSync(platformOpsPath, platformOpsContents);
-        return { path, contents, platformOpsPath, platformOpsContents };
+        result.platformOpsPath = platformOpsPath;
+        result.platformOpsContents = platformOpsContents;
+    }
+    // Pure platform-global reference-table grants (08-rls § 7.6). Skipped in
+    // the stub path. Emits the GRANT-controlled (NO RLS) DDL.
+    const referenceTables = input.stub ? [] : (input.referenceTables ?? []);
+    if (referenceTables.length > 0) {
+        const referenceTablesContents = referenceTablesSql(input.serviceName, referenceTables);
+        const referenceTablesPath = join(outDir, phase, "0003_reference_table_grants.sql");
+        mkdirSync(dirname(referenceTablesPath), { recursive: true });
+        writeFileSync(referenceTablesPath, referenceTablesContents);
+        result.referenceTablesPath = referenceTablesPath;
+        result.referenceTablesContents = referenceTablesContents;
     }
-    return { path, contents };
+    return result;
 }
 /**
  * CLI entrypoint. Invoked via `npx @nodii/db-rls migrate-gen ...` or

package/dist/migrate-gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-gen.js","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,aAAa;AACb,EAAE;AACF,UAAU;AACV,6DAA6D;AAC7D,0EAA0E;AAC1E,iEAAiE;AACjE,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,+DAA+D;AAC/D,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,+DAA+D;AAC/D,mDAAmD;AACnD,EAAE;AACF,aAAa;AACb,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,oBAAoB;AAEpB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAEL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAqD1B;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,eAAe,WAAW;;;;;;;;;;;;;CAalC,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,eAAe,WAAW;;;;;;;;;CASlC,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,MAAuC;IAEvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG;YACX,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,QAAQ;YACrB,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;YAC9D,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,WAAW;;;;CAI1C,CAAC;IACA,OAAO,GAAG,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,0BAA0B,CAAC;IAC/B,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE9B,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,mBAAmB,GAAG,sBAAsB,CAChD,KAAK,CAAC,WAAW,EACjB,iBAAiB,CAClB,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAC1B,MAAM,EACN,KAAK,EACL,gCAAgC,CACjC,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,aAAa,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,WAAW,GACf,UAAU,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU;IACjB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC;;;;;uDAKyC,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"migrate-gen.js","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,aAAa;AACb,EAAE;AACF,UAAU;AACV,6DAA6D;AAC7D,0EAA0E;AAC1E,iEAAiE;AACjE,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,+DAA+D;AAC/D,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,+DAA+D;AAC/D,mDAAmD;AACnD,EAAE;AACF,aAAa;AACb,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,oBAAoB;AAEpB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAGL,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAoF1B;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,eAAe,WAAW;;;;;;;;;;;;;CAalC,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,eAAe,WAAW;;;;;;;;;CASlC,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,MAAuC;IAEvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG;YACX,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,QAAQ;YACrB,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;YAC9D,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,WAAW;;;;CAI1C,CAAC;IACA,OAAO,GAAG,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,MAAqC;IAErC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,8CAA+C,IAAyB,CAAC,IAAI,0DAA0D,CACxI,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE;YAChD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,sEAAsE;QACtE,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,oEAAoE;QACpE,qDAAqD;QACrD,MAAM,aAAa,GAAG,KAAK;aACxB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;aACpD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,kCAAkC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,KAAK,kIAAkI,CAC9K,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,WAAW;;;;KAItC,+BAA+B,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;CACvD,CAAC;IACA,OAAO,GAAG,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,0BAA0B,CAAC;IAC/B,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE9B,MAAM,MAAM,GAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEpD,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,mBAAmB,GAAG,sBAAsB,CAChD,KAAK,CAAC,WAAW,EACjB,iBAAiB,CAClB,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAC1B,MAAM,EACN,KAAK,EACL,gCAAgC,CACjC,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,aAAa,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACpD,MAAM,CAAC,eAAe,GAAG,eAAe,CAAC;QACzC,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,uBAAuB,GAAG,kBAAkB,CAChD,KAAK,CAAC,WAAW,EACjB,eAAe,CAChB,CAAC;QACF,MAAM,mBAAmB,GAAG,IAAI,CAC9B,MAAM,EACN,KAAK,EACL,iCAAiC,CAClC,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,aAAa,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;QAC5D,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QACjD,MAAM,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;IAC3D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,WAAW,GACf,UAAU,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU;IACjB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC;;;;;uDAKyC,CAAC,CAAC;AACzD,CAAC"}

package/dist/rls-policy-gen.d.ts

@@ -74,5 +74,48 @@ export declare function withPlatformOpsTenantSql(table: string, perms: PlatformO
  * **platform-global** table (08-rls § 7.6).
  */
 export declare function withPlatformOpsGlobalSql(table: string, perms: PlatformOpsPerVerbPermissions, opts?: WithPlatformOpsSqlOpts): string;
+/** Roles that may receive `GRANT SELECT` on a reference table. */
+declare const REFERENCE_TABLE_READ_ROLES: readonly ["nodii_services", "authenticated", "nodii_platform_ops"];
+export type ReferenceTableReadRole = (typeof REFERENCE_TABLE_READ_ROLES)[number];
+/** The doctrine-conformant skip-RLS marker comment line. Emitted in place of
+ *  `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` so the migrate-gen + reviewers
+ *  see the omission is intentional (08-rls § 7.6), not an oversight. */
+export declare const REFERENCE_TABLE_SKIP_RLS_MARKER = "-- INTENTIONALLY OMITTED: ALTER TABLE ... ENABLE ROW LEVEL SECURITY (08-rls \u00A7 7.6 \u2014 reference data has no per-row confidentiality boundary).";
+export interface ReferenceTableSqlOpts {
+    /** Read role(s) that get `GRANT SELECT` + `REVOKE` write. Defaults to
+     *  `["nodii_services"]` (canonical 3-pool). 2-pool services may pass
+     *  `["authenticated"]`; 4-pool services may add `"nodii_platform_ops"`. */
+    readRoles?: readonly ReferenceTableReadRole[];
+}
+/**
+ * Thrown when a `tenant_id` column is declared on a reference-table-typed
+ * table. A pure platform-global reference table is platform-global by
+ * definition (08-rls § 7.6 property 1: no `tenant_id`); a `tenant_id` column
+ * is a category error — the table should use the canonical 5-policy RLS DDL
+ * (§ 4) instead. This is the doctrine's safety boundary.
+ */
+export declare class ReferenceTableTenantColumnError extends Error {
+    readonly table: string;
+    readonly column: string;
+    constructor(table: string, column: string);
+}
+/** Returns the tenant-scoped column name if `columns` contains one, else
+ *  `null`. Case-insensitive. Used by the reference-table refusal guard. */
+export declare function findTenantColumn(columns: readonly string[]): string | null;
+/**
+ * Emits the canonical 08-rls § 7.6 GRANT/REVOKE DDL for a pure
+ * platform-global reference table. Does NOT include `CREATE TABLE` (the
+ * table shape is the consumer's; Drizzle/SQLAlchemy/sqlc emit it) and
+ * INTENTIONALLY does NOT include `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`.
+ *
+ * Output ends with `\n`. Byte-equal across TS / Python / Go ports.
+ *
+ * Order (deterministic for parity-fence):
+ *   1. skip-RLS marker comment
+ *   2. GRANT SELECT to each read role (in `readRoles` order)
+ *   3. GRANT INSERT, UPDATE, DELETE to nodii_owner
+ *   4. REVOKE INSERT, UPDATE, DELETE from each read role (in `readRoles` order)
+ */
+export declare function referenceTableGrantsSql(table: string, opts?: ReferenceTableSqlOpts): string;
 export {};
 //# sourceMappingURL=rls-policy-gen.d.ts.map

package/dist/rls-policy-gen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rls-policy-gen.d.ts","sourceRoot":"","sources":["../src/rls-policy-gen.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,MAAM,CA0BrE;AAQD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,WAAgB,GACrB,MAAM,CASR;AAqDD,4CAA4C;AAC5C,QAAA,MAAM,kBAAkB,iDAAkD,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE;;;qBAGqB;AACrB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,mCAAmC,gCACjB,CAAC;AAGhC,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5C;AAOD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED,0EAA0E;AAC1E,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,CAUR;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAER;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAER"}
+{"version":3,"file":"rls-policy-gen.d.ts","sourceRoot":"","sources":["../src/rls-policy-gen.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,MAAM,CA0BrE;AAQD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,WAAgB,GACrB,MAAM,CASR;AAqDD,4CAA4C;AAC5C,QAAA,MAAM,kBAAkB,iDAAkD,CAAC;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE;;;qBAGqB;AACrB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,mCAAmC,gCACjB,CAAC;AAGhC,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5C;AAOD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED,0EAA0E;AAC1E,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,CAUR;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAER;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAER;AAiDD,kEAAkE;AAClE,QAAA,MAAM,0BAA0B,oEAItB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAChC,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAK9C;;wEAEwE;AACxE,eAAO,MAAM,+BAA+B,2JACoG,CAAC;AAEjJ,MAAM,WAAW,qBAAqB;IACpC;;+EAE2E;IAC3E,SAAS,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC/C;AAMD;;;;;;GAMG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,KAAK,EAAE,MAAM;aACb,MAAM,EAAE,MAAM;gBADd,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM;CAOjC;AAMD;2EAC2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAK1E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,qBAA0B,GAC/B,MAAM,CAkBR"}

package/dist/rls-policy-gen.js

@@ -163,4 +163,97 @@ function platformOpsPolicyLines(table, perms, kind, opts) {
     }
     return lines.length > 0 ? `${lines.join("\n")}\n` : "";
 }
+// ----------------------------------------------------------------------------
+// 08-rls § 7.6 — pure platform-global reference tables (GRANT-controlled, NO RLS).
+//
+// A pure platform-global reference table has ALL THREE properties:
+//   1. No `tenant_id` column — rows are shared across every tenant.
+//   2. Non-confidential — reference / catalog / lookup data.
+//   3. Written via a controlled platform-admin path (nodii_owner migrations
+//      or a narrow operator-only RPC).
+//
+// Per § 7.6 such tables use GRANT-controlled access, NOT RLS:
+//   - INTENTIONALLY no `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`.
+//   - `GRANT SELECT` to the read role (`nodii_services` by default; 2-pool
+//     services may use `authenticated`; 4-pool services may add
+//     `nodii_platform_ops`).
+//   - `GRANT INSERT, UPDATE, DELETE` to `nodii_owner` (the write path).
+//   - `REVOKE INSERT, UPDATE, DELETE` from the read role(s) — the integrity
+//     boundary: the read pool can never write.
+//
+// Single source of truth: `referenceTableGrantsSql` is reused by the Drizzle
+// `referenceTable` table-builder helper AND by migrate-gen's
+// `platform_global_reference` path — no forked GRANT DDL.
+/** Roles that may receive `GRANT SELECT` on a reference table. */
+const REFERENCE_TABLE_READ_ROLES = [
+    "nodii_services",
+    "authenticated",
+    "nodii_platform_ops",
+];
+const REFERENCE_TABLE_OWNER_ROLE = "nodii_owner";
+const REFERENCE_TABLE_WRITE_VERBS = "INSERT, UPDATE, DELETE";
+/** The doctrine-conformant skip-RLS marker comment line. Emitted in place of
+ *  `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` so the migrate-gen + reviewers
+ *  see the omission is intentional (08-rls § 7.6), not an oversight. */
+export const REFERENCE_TABLE_SKIP_RLS_MARKER = "-- INTENTIONALLY OMITTED: ALTER TABLE ... ENABLE ROW LEVEL SECURITY (08-rls § 7.6 — reference data has no per-row confidentiality boundary).";
+const DEFAULT_REFERENCE_READ_ROLES = [
+    "nodii_services",
+];
+/**
+ * Thrown when a `tenant_id` column is declared on a reference-table-typed
+ * table. A pure platform-global reference table is platform-global by
+ * definition (08-rls § 7.6 property 1: no `tenant_id`); a `tenant_id` column
+ * is a category error — the table should use the canonical 5-policy RLS DDL
+ * (§ 4) instead. This is the doctrine's safety boundary.
+ */
+export class ReferenceTableTenantColumnError extends Error {
+    table;
+    column;
+    constructor(table, column) {
+        super(`Reference table "${table}" declares a tenant-scoped column "${column}". A pure platform-global reference table (08-rls § 7.6) MUST NOT have a tenant_id column — it is platform-global by definition. Use the canonical 5-policy RLS DDL (withRls) for tenant-scoped tables instead.`);
+        this.table = table;
+        this.column = column;
+        this.name = "ReferenceTableTenantColumnError";
+    }
+}
+/** Column names that mark a table as tenant-scoped (category error for a
+ *  reference table). Case-insensitive match. */
+const TENANT_COLUMN_NAMES = new Set(["tenant_id", "tenantid"]);
+/** Returns the tenant-scoped column name if `columns` contains one, else
+ *  `null`. Case-insensitive. Used by the reference-table refusal guard. */
+export function findTenantColumn(columns) {
+    for (const col of columns) {
+        if (TENANT_COLUMN_NAMES.has(col.toLowerCase()))
+            return col;
+    }
+    return null;
+}
+/**
+ * Emits the canonical 08-rls § 7.6 GRANT/REVOKE DDL for a pure
+ * platform-global reference table. Does NOT include `CREATE TABLE` (the
+ * table shape is the consumer's; Drizzle/SQLAlchemy/sqlc emit it) and
+ * INTENTIONALLY does NOT include `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`.
+ *
+ * Output ends with `\n`. Byte-equal across TS / Python / Go ports.
+ *
+ * Order (deterministic for parity-fence):
+ *   1. skip-RLS marker comment
+ *   2. GRANT SELECT to each read role (in `readRoles` order)
+ *   3. GRANT INSERT, UPDATE, DELETE to nodii_owner
+ *   4. REVOKE INSERT, UPDATE, DELETE from each read role (in `readRoles` order)
+ */
+export function referenceTableGrantsSql(table, opts = {}) {
+    const readRoles = opts.readRoles && opts.readRoles.length > 0
+        ? opts.readRoles
+        : DEFAULT_REFERENCE_READ_ROLES;
+    const lines = [REFERENCE_TABLE_SKIP_RLS_MARKER];
+    for (const role of readRoles) {
+        lines.push(`GRANT SELECT ON ${table} TO ${role};`);
+    }
+    lines.push(`GRANT ${REFERENCE_TABLE_WRITE_VERBS} ON ${table} TO ${REFERENCE_TABLE_OWNER_ROLE};`);
+    for (const role of readRoles) {
+        lines.push(`REVOKE ${REFERENCE_TABLE_WRITE_VERBS} ON ${table} FROM ${role};`);
+    }
+    return `${lines.join("\n")}\n`;
+}
 //# sourceMappingURL=rls-policy-gen.js.map

package/dist/rls-policy-gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"rls-policy-gen.js","sourceRoot":"","sources":["../src/rls-policy-gen.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,mDAAmD;AAWnD,MAAM,aAAa,GAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,OAAoB,EAAE;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,6BAA6B,CAAC,CAAC;IAC9D,mCAAmC;IACnC,KAAK,CAAC,IAAI,CACR,iBAAiB,UAAU,oBAAoB,KAAK,yDAAyD,CAC9G,CAAC;IAEF,8EAA8E;IAC9E,qEAAqE;IACrE,gBAAgB;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,kDAAkD;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,yDAAyD;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,OAAoB,EAAE;IAEtB,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG;QACZ,SAAS,QAAQ,OAAO,KAAK,qBAAqB;QAClD,SAAS,QAAQ,OAAO,KAAK,oBAAoB;KAClD,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CACpB,KAAa,EACb,UAAkB,EAClB,YAAoB,EACpB,IAAa;IAEb,yFAAyF;IACzF,MAAM,IAAI,GAAG,GAAG,YAAY,uDAAuD,CAAC;IACpF,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAa,EACb,UAAkB,EAClB,YAAoB,EACpB,IAAa;IAEb,wEAAwE;IACxE,MAAM,IAAI,GAAG,GAAG,YAAY,yBAAyB,CAAC;IACtD,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,UAAkB,EAClB,MAAsB,EACtB,IAAa,EACb,IAAY,EACZ,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,GAAG,UAAU,IAAI,MAAM,IAAI,MAAM,SAAS,CAAC;IAC9D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,IAAI,gBAAgB,IAAI,IAAI,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,IAAI,WAAW,IAAI,iBAAiB,IAAI,IAAI,CAAC;IAC/G,CAAC;IACD,OAAO,iBAAiB,UAAU,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,WAAW,IAAI,IAAI,CAAC;AAC3F,CAAC;AAED,+EAA+E;AAC/E,0DAA0D;AAC1D,EAAE;AACF,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,gEAAgE;AAEhE,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAqB3E,MAAM,CAAC,MAAM,mCAAmC,GAC9C,6BAA6B,CAAC;AAChC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAE/C,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,IAAqB;IAC/C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EACnB,YAAoB,EACpB,UAAkB;IAElB,OAAO,yBAAyB,WAAW,kJAAkJ,UAAU,CAAC,UAAU,CAAC,mKAAmK,YAAY,KAAK,CAAC;AAC1Y,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EACnB,UAAkB;IAElB,OAAO,yBAAyB,WAAW,uLAAuL,UAAU,CAAC,UAAU,CAAC,+EAA+E,CAAC;AAC1U,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CACtC,IAAqB,EACrB,SAAiB;IAEjB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,eAAe,SAAS,GAAG,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,UAAU,SAAS,iBAAiB,SAAS,GAAG,CAAC;QAC1D;YACE,wBAAwB;YACxB,OAAO,UAAU,SAAS,GAAG,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,KAAoC,EACpC,OAA+B,EAAE;IAEjC,OAAO,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,KAAoC,EACpC,OAA+B,EAAE;IAEjC,OAAO,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAa,EACb,KAAoC,EACpC,IAAyB,EACzB,IAA4B;IAE5B,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;YACf,CAAC,CAAC,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC;YACtE,CAAC,CAAC,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CACR,iBAAiB,UAAU,iBAAiB,IAAI,OAAO,KAAK,QAAQ,kBAAkB,CAAC,IAAI,CAAC,OAAO,iBAAiB,IAAI,MAAM,GAAG,CAClI,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"rls-policy-gen.js","sourceRoot":"","sources":["../src/rls-policy-gen.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,mDAAmD;AAWnD,MAAM,aAAa,GAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,OAAoB,EAAE;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,6BAA6B,CAAC,CAAC;IAC9D,mCAAmC;IACnC,KAAK,CAAC,IAAI,CACR,iBAAiB,UAAU,oBAAoB,KAAK,yDAAyD,CAC9G,CAAC;IAEF,8EAA8E;IAC9E,qEAAqE;IACrE,gBAAgB;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,kDAAkD;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,yDAAyD;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,OAAoB,EAAE;IAEtB,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG;QACZ,SAAS,QAAQ,OAAO,KAAK,qBAAqB;QAClD,SAAS,QAAQ,OAAO,KAAK,oBAAoB;KAClD,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CACpB,KAAa,EACb,UAAkB,EAClB,YAAoB,EACpB,IAAa;IAEb,yFAAyF;IACzF,MAAM,IAAI,GAAG,GAAG,YAAY,uDAAuD,CAAC;IACpF,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAa,EACb,UAAkB,EAClB,YAAoB,EACpB,IAAa;IAEb,wEAAwE;IACxE,MAAM,IAAI,GAAG,GAAG,YAAY,yBAAyB,CAAC;IACtD,OAAO,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,UAAkB,EAClB,MAAsB,EACtB,IAAa,EACb,IAAY,EACZ,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,GAAG,UAAU,IAAI,MAAM,IAAI,MAAM,SAAS,CAAC;IAC9D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,IAAI,gBAAgB,IAAI,IAAI,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,iBAAiB,UAAU,OAAO,KAAK,kBAAkB,IAAI,WAAW,IAAI,iBAAiB,IAAI,IAAI,CAAC;IAC/G,CAAC;IACD,OAAO,iBAAiB,UAAU,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,WAAW,IAAI,IAAI,CAAC;AAC3F,CAAC;AAED,+EAA+E;AAC/E,0DAA0D;AAC1D,EAAE;AACF,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,gEAAgE;AAEhE,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAqB3E,MAAM,CAAC,MAAM,mCAAmC,GAC9C,6BAA6B,CAAC;AAChC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAE/C,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,IAAqB;IAC/C,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EACnB,YAAoB,EACpB,UAAkB;IAElB,OAAO,yBAAyB,WAAW,kJAAkJ,UAAU,CAAC,UAAU,CAAC,mKAAmK,YAAY,KAAK,CAAC;AAC1Y,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EACnB,UAAkB;IAElB,OAAO,yBAAyB,WAAW,uLAAuL,UAAU,CAAC,UAAU,CAAC,+EAA+E,CAAC;AAC1U,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CACtC,IAAqB,EACrB,SAAiB;IAEjB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,eAAe,SAAS,GAAG,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,UAAU,SAAS,iBAAiB,SAAS,GAAG,CAAC;QAC1D;YACE,wBAAwB;YACxB,OAAO,UAAU,SAAS,GAAG,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,KAAoC,EACpC,OAA+B,EAAE;IAEjC,OAAO,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,KAAoC,EACpC,OAA+B,EAAE;IAEjC,OAAO,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAa,EACb,KAAoC,EACpC,IAAyB,EACzB,IAA4B;IAE5B,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mCAAmC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;YACf,CAAC,CAAC,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC;YACtE,CAAC,CAAC,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CACR,iBAAiB,UAAU,iBAAiB,IAAI,OAAO,KAAK,QAAQ,kBAAkB,CAAC,IAAI,CAAC,OAAO,iBAAiB,IAAI,MAAM,GAAG,CAClI,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,+EAA+E;AAC/E,mFAAmF;AACnF,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,6DAA6D;AAC7D,4EAA4E;AAC5E,uCAAuC;AACvC,EAAE;AACF,8DAA8D;AAC9D,oEAAoE;AACpE,2EAA2E;AAC3E,gEAAgE;AAChE,6BAA6B;AAC7B,wEAAwE;AACxE,4EAA4E;AAC5E,+CAA+C;AAC/C,EAAE;AACF,6EAA6E;AAC7E,6DAA6D;AAC7D,0DAA0D;AAE1D,kEAAkE;AAClE,MAAM,0BAA0B,GAAG;IACjC,gBAAgB;IAChB,eAAe;IACf,oBAAoB;CACZ,CAAC;AAKX,MAAM,0BAA0B,GAAG,aAAa,CAAC;AACjD,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAE7D;;wEAEwE;AACxE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8IAA8I,CAAC;AASjJ,MAAM,4BAA4B,GAAsC;IACtE,gBAAgB;CACjB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAEtC;IACA;IAFlB,YACkB,KAAa,EACb,MAAc;QAE9B,KAAK,CACH,oBAAoB,KAAK,sCAAsC,MAAM,iNAAiN,CACvR,CAAC;QALc,UAAK,GAAL,KAAK,CAAQ;QACb,WAAM,GAAN,MAAM,CAAQ;QAK9B,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED;gDACgD;AAChD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAE/D;2EAC2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,OAA8B,EAAE;IAEhC,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,SAAS;QAChB,CAAC,CAAC,4BAA4B,CAAC;IACnC,MAAM,KAAK,GAAa,CAAC,+BAA+B,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,OAAO,IAAI,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,CAAC,IAAI,CACR,SAAS,2BAA2B,OAAO,KAAK,OAAO,0BAA0B,GAAG,CACrF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,UAAU,2BAA2B,OAAO,KAAK,SAAS,IAAI,GAAG,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/verify-rls-cli.d.ts

@@ -0,0 +1,20 @@
+export interface RunVerifyRlsCliResult {
+    /** Process exit code: 0 = all covered, 1 = coverage failure, 2 = usage. */
+    code: number;
+    /** Human-readable line for stdout/stderr (caller prints). */
+    message: string;
+}
+/**
+ * Parses argv (without the leading `verify-rls` token) and runs the
+ * coverage check. Returns an exit code + message rather than calling
+ * `process.exit`, so it is unit-testable. The bin shim translates.
+ *
+ * Flags:
+ *   --tables a,b,c   (required) RLS-required tables (comma-separated)
+ *   --ref c,d        reference tables to exempt (§ 7.6)
+ *   --schema public  default schema for bare names (default: public)
+ *   --db <url>       connection string (else DATABASE_URL / DB_RLS_PG_URL)
+ *   --help / -h
+ */
+export declare function runVerifyRlsCli(args: readonly string[]): Promise<RunVerifyRlsCliResult>;
+//# sourceMappingURL=verify-rls-cli.d.ts.map

package/dist/verify-rls-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-rls-cli.d.ts","sourceRoot":"","sources":["../src/verify-rls-cli.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAqDhC"}

package/dist/verify-rls-cli.js

@@ -0,0 +1,99 @@
+// verify-rls CLI — `nodii-db-rls verify-rls --tables a,b [--ref c] [--schema public]`.
+//
+// Thin CLI around `verifyRls` so a service can wire a `db:verify-rls`
+// script (or a CI step) without writing its own pg-connect boilerplate.
+// The importable `verifyRls` function (src/verify-rls.ts) remains the core
+// deliverable — this is the optional bin mirror of migrate-gen's CLI.
+//
+// Connection string comes from `--db <url>` or the `DATABASE_URL` /
+// `DB_RLS_PG_URL` env var (in that order). `pg` is an optional peer dep;
+// the CLI imports it lazily so importing the library does not require it.
+import { RlsCoverageError, verifyRls } from "./verify-rls";
+function splitList(value) {
+    if (!value)
+        return [];
+    return value
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+/**
+ * Parses argv (without the leading `verify-rls` token) and runs the
+ * coverage check. Returns an exit code + message rather than calling
+ * `process.exit`, so it is unit-testable. The bin shim translates.
+ *
+ * Flags:
+ *   --tables a,b,c   (required) RLS-required tables (comma-separated)
+ *   --ref c,d        reference tables to exempt (§ 7.6)
+ *   --schema public  default schema for bare names (default: public)
+ *   --db <url>       connection string (else DATABASE_URL / DB_RLS_PG_URL)
+ *   --help / -h
+ */
+export async function runVerifyRlsCli(args) {
+    let tables;
+    let refs;
+    let schema;
+    let dbUrl;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--tables" && i + 1 < args.length)
+            tables = args[++i];
+        else if (a === "--ref" && i + 1 < args.length)
+            refs = args[++i];
+        else if (a === "--schema" && i + 1 < args.length)
+            schema = args[++i];
+        else if (a === "--db" && i + 1 < args.length)
+            dbUrl = args[++i];
+        else if (a === "--help" || a === "-h") {
+            return { code: 0, message: usage() };
+        }
+    }
+    const requiredTables = splitList(tables);
+    if (requiredTables.length === 0) {
+        return { code: 2, message: usage() };
+    }
+    const connectionString = dbUrl ?? process.env.DATABASE_URL ?? process.env.DB_RLS_PG_URL;
+    if (!connectionString) {
+        return {
+            code: 2,
+            message: "verify-rls: no connection string — pass --db <url> or set DATABASE_URL / DB_RLS_PG_URL.",
+        };
+    }
+    // Lazy-import pg (optional peer dep). Keeps the library importable
+    // without pg installed; only the CLI path requires it.
+    const { Pool } = await import("pg");
+    const pool = new Pool({ connectionString, max: 1 });
+    try {
+        await verifyRls(pool, {
+            requiredTables,
+            schema,
+            referenceTables: splitList(refs),
+        });
+        return {
+            code: 0,
+            message: `verify-rls: OK — ${requiredTables.length} RLS-required table(s) covered.`,
+        };
+    }
+    catch (err) {
+        if (err instanceof RlsCoverageError) {
+            return { code: 1, message: err.message };
+        }
+        throw err;
+    }
+    finally {
+        await pool.end().catch(() => { });
+    }
+}
+function usage() {
+    return `usage: verify-rls --tables <a,b,c> [--ref <x,y>] [--schema <name>] [--db <url>]
+
+Verifies every --tables relation has ROW LEVEL SECURITY enabled
+(pg_class.relrowsecurity = true), exempting any --ref reference table
+(08-rls § 7.6 — GRANT-controlled, NO RLS by design). Exits 1 (loud) if
+any RLS-required table is missing RLS.
+
+Connection string: --db <url>, else DATABASE_URL, else DB_RLS_PG_URL.
+
+Spec: @nodii/db-rls 08-rls § A1 (RLS on every tenant-scoped table).`;
+}
+//# sourceMappingURL=verify-rls-cli.js.map

package/dist/verify-rls-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-rls-cli.js","sourceRoot":"","sources":["../src/verify-rls-cli.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,oEAAoE;AACpE,yEAAyE;AACzE,0EAA0E;AAE1E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAS3D,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAuB;IAEvB,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAyB,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAChE,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,gBAAgB,GACpB,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACjE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EACL,yFAAyF;SAC5F,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,uDAAuD;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE;YACpB,cAAc;YACd,MAAM;YACN,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,oBAAoB,cAAc,CAAC,MAAM,iCAAiC;SACpF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,KAAK;IACZ,OAAO;;;;;;;;;oEAS2D,CAAC;AACrE,CAAC"}

package/dist/verify-rls.d.ts

@@ -0,0 +1,76 @@
+import { DbRlsError } from "./types";
+/** Minimal query surface for the preflight catalog read. `pg.Pool` and
+ *  `pg.PoolClient` both satisfy this; `PgClientPool` exposes `.rawPool`.
+ *  We deliberately do NOT reuse the tx-bound `PgPool` — the preflight is a
+ *  single read, not a GUC-scoped transaction. */
+export interface RlsQuerier {
+    query<R = unknown>(sql: string, params?: readonly unknown[]): Promise<{
+        rows: R[];
+    }>;
+}
+/** A predicate that returns `true` when `table` is a reference table
+ *  (GRANT-controlled, NO RLS by design — § 7.6) and must therefore be
+ *  EXEMPT from the RLS-coverage check. `table` is the table name exactly
+ *  as it appears in `requiredTables` (may be schema-qualified). */
+export type ReferenceTablePredicate = (table: string) => boolean;
+export interface VerifyRlsOpts {
+    /** Tables that REQUIRE RLS (the canonical 5-policy posture, § A1). Each
+     *  may be bare (`orders`) or schema-qualified (`billing.orders`); a bare
+     *  name resolves against `schema`. */
+    requiredTables: readonly string[];
+    /** Schema for bare (unqualified) table names. Defaults to `"public"`. */
+    schema?: string;
+    /** Reference tables to EXEMPT (§ 7.6 — GRANT-controlled, NO RLS by
+     *  design). Supply EITHER this list OR `isReferenceTable`. Entries are
+     *  matched against `requiredTables` after both are normalized to
+     *  `schema.table`, so `["billing.country_codes"]` and a bare
+     *  `["country_codes"]` (with `schema:"billing"`) both match. */
+    referenceTables?: readonly string[];
+    /** Alternative to `referenceTables` — a predicate receiving the table
+     *  name as it appears in `requiredTables`. Use when the exempt set is
+     *  computed (e.g. read from a registry). If both are supplied a table is
+     *  exempt when EITHER matches. */
+    isReferenceTable?: ReferenceTablePredicate;
+    /** Back-compat alias kept intentionally undocumented in callers: when
+     *  `false`, reference-table exemption is disabled and a reference table
+     *  missing RLS WOULD be flagged. Defaults to `true` (exemptions on). */
+    allowReferenceTables?: boolean;
+}
+/** One RLS-required table whose coverage is missing or whose catalog row
+ *  could not be found. */
+export interface RlsCoverageOffender {
+    /** Table name as supplied in `requiredTables`. */
+    table: string;
+    /** Resolved schema used for the catalog lookup. */
+    schema: string;
+    /** Resolved (unqualified) relation name used for the catalog lookup. */
+    relname: string;
+    /** Why this table is an offender:
+     *   - `"rls_disabled"` — the table exists but `relrowsecurity = false`.
+     *   - `"not_found"` — no `pg_class` row matched (table absent / wrong
+     *     schema). Also a failure: a required table that doesn't exist can't
+     *     be protected. */
+    reason: "rls_disabled" | "not_found";
+}
+/**
+ * Thrown by `verifyRls` when one or more RLS-required tables are missing
+ * row-level security (or are absent). Carries the structured offender list
+ * so a `db:setup` gate can render a precise failure. Reference tables
+ * (§ 7.6) are NEVER offenders — they are exempt before this is thrown.
+ */
+export declare class RlsCoverageError extends DbRlsError {
+    readonly offenders: readonly RlsCoverageOffender[];
+    constructor(offenders: readonly RlsCoverageOffender[]);
+}
+/**
+ * Verifies that every table in `requiredTables` has row-level security
+ * enabled (`pg_class.relrowsecurity = true`), exempting any § 7.6
+ * reference table. Resolves OK (returns `void`) when all required tables
+ * are covered; throws `RlsCoverageError` listing the offenders otherwise.
+ *
+ * The query is a single read against `pg_class` joined to `pg_namespace`
+ * — read-only, no GUCs, no writes. Run it from a migration / `db:setup`
+ * gate against any pool (typically the owner/admin pool).
+ */
+export declare function verifyRls(pool: RlsQuerier, opts: VerifyRlsOpts): Promise<void>;
+//# sourceMappingURL=verify-rls.d.ts.map

package/dist/verify-rls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-rls.d.ts","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC;;;iDAGiD;AACjD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,GAAG,OAAO,EACf,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3B;AAED;;;mEAGmE;AACnE,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B;;0CAEsC;IACtC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;oEAIgE;IAChE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;sCAGkC;IAClC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;4EAEwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;0BAC0B;AAC1B,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;2BAIuB;IACvB,MAAM,EAAE,cAAc,GAAG,WAAW,CAAC;CACtC;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;gBACvC,SAAS,EAAE,SAAS,mBAAmB,EAAE;CAKtD;AA2CD;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CA4Ef"}

package/dist/verify-rls.js

@@ -0,0 +1,145 @@
+// verify-rls — a preflight RLS-coverage guard (08-rls § A1 + § 7.6).
+//
+// A service's `scripts/db/verify-rls.ts` (and any `db:setup` gate) calls
+// `verifyRls(pool, { requiredTables })` after migrations apply. It queries
+// `pg_class.relrowsecurity` (joined with `pg_namespace` for the schema)
+// for each table that REQUIRES RLS and FAILS LOUD — throwing
+// `RlsCoverageError` listing the offenders — if any RLS-required table
+// reports `relrowsecurity = false`.
+//
+// This catches the "drizzle snapshot RLS hazard": a migration that creates
+// a tenant-scoped table but never `ALTER TABLE ... ENABLE ROW LEVEL
+// SECURITY`. Without RLS the table leaks every tenant's rows to the
+// services / authenticated pools — a silent tenant-isolation breach that
+// the 5-policy DDL exists to prevent.
+//
+// Composition with 08-rls § 7.6 (db-rls 0.5.1) — a pure platform-global
+// reference table is GRANT-controlled with NO RLS *by design*
+// (`relrowsecurity = false` is the correct state, see `referenceTableGrantsSql`).
+// Such tables MUST NOT be flagged. `verifyRls` therefore takes the set of
+// reference tables (or a predicate) to EXEMPT: an RLS-required table missing
+// RLS is an error; a reference table missing RLS is expected.
+//
+// The verify path is a single read-only catalog query — it does NOT need
+// the GUC/tx-bound `PgPool` surface. It accepts any object exposing a
+// `query(sql, params)` returning `{ rows }`, which `pg.Pool` /
+// `PgClientPool.rawPool` satisfy directly. Byte-consistent error semantics
+// across TS / Python / Go ports.
+import { DbRlsError } from "./types";
+/**
+ * Thrown by `verifyRls` when one or more RLS-required tables are missing
+ * row-level security (or are absent). Carries the structured offender list
+ * so a `db:setup` gate can render a precise failure. Reference tables
+ * (§ 7.6) are NEVER offenders — they are exempt before this is thrown.
+ */
+export class RlsCoverageError extends DbRlsError {
+    offenders;
+    constructor(offenders) {
+        super(formatMessage(offenders));
+        this.name = "RlsCoverageError";
+        this.offenders = offenders;
+    }
+}
+function formatMessage(offenders) {
+    const lines = offenders.map((o) => {
+        const qualified = `${o.schema}.${o.relname}`;
+        return o.reason === "not_found"
+            ? `  - ${qualified} (NOT FOUND — required RLS table is absent from the catalog)`
+            : `  - ${qualified} (relrowsecurity = false — RLS not enabled)`;
+    });
+    return `rls_coverage: ${offenders.length} RLS-required table(s) missing row-level security (08-rls § A1). A migration created the table but never \`ALTER TABLE ... ENABLE ROW LEVEL SECURITY\` — these tables leak every tenant's rows to the services/authenticated pools. Offenders:\n${lines.join("\n")}\nFix: add the canonical 5-policy DDL (withRls) for each, or register it as a § 7.6 reference table if it is genuinely platform-global GRANT-controlled data.`;
+}
+/** Strip optional surrounding double-quotes from one identifier part. */
+function unquote(part) {
+    return part.replace(/^"|"$/g, "");
+}
+/** Resolve a (possibly schema-qualified, possibly quoted) table name to
+ *  `{ schema, relname }`. Bare names resolve against `defaultSchema`. */
+function resolveTable(table, defaultSchema) {
+    if (table.includes(".")) {
+        const idx = table.indexOf(".");
+        const schema = unquote(table.slice(0, idx));
+        const relname = unquote(table.slice(idx + 1));
+        return { original: table, schema, relname };
+    }
+    return { original: table, schema: defaultSchema, relname: unquote(table) };
+}
+/** Normalized `schema.relname` key for exemption matching. */
+function key(r) {
+    return `${r.schema}.${r.relname}`;
+}
+/**
+ * Verifies that every table in `requiredTables` has row-level security
+ * enabled (`pg_class.relrowsecurity = true`), exempting any § 7.6
+ * reference table. Resolves OK (returns `void`) when all required tables
+ * are covered; throws `RlsCoverageError` listing the offenders otherwise.
+ *
+ * The query is a single read against `pg_class` joined to `pg_namespace`
+ * — read-only, no GUCs, no writes. Run it from a migration / `db:setup`
+ * gate against any pool (typically the owner/admin pool).
+ */
+export async function verifyRls(pool, opts) {
+    const defaultSchema = opts.schema ?? "public";
+    const exemptionsEnabled = opts.allowReferenceTables ?? true;
+    // Build the exempt set (normalized schema.relname keys) + predicate.
+    const exemptKeys = new Set();
+    if (exemptionsEnabled && opts.referenceTables) {
+        for (const t of opts.referenceTables) {
+            exemptKeys.add(key(resolveTable(t, defaultSchema)));
+        }
+    }
+    const predicate = exemptionsEnabled && opts.isReferenceTable
+        ? opts.isReferenceTable
+        : undefined;
+    // Resolve + filter out exempt reference tables BEFORE querying.
+    const toCheck = [];
+    for (const original of opts.requiredTables) {
+        const resolved = resolveTable(original, defaultSchema);
+        const isExempt = exemptKeys.has(key(resolved)) ||
+            (predicate ? predicate(original) : false);
+        if (!isExempt)
+            toCheck.push(resolved);
+    }
+    if (toCheck.length === 0)
+        return;
+    // One catalog query covering all to-check tables. We pass parallel
+    // schema[] + relname[] arrays and join in SQL so a single round-trip
+    // resolves every table; missing rows are detected by set difference.
+    const schemas = toCheck.map((t) => t.schema);
+    const relnames = toCheck.map((t) => t.relname);
+    const res = await pool.query(`SELECT n.nspname, c.relname, c.relrowsecurity
+       FROM unnest($1::text[], $2::text[]) AS req(schemaname, tablename)
+       JOIN pg_namespace n ON n.nspname = req.schemaname
+       JOIN pg_class c ON c.relnamespace = n.oid
+        AND c.relname = req.tablename
+        AND c.relkind IN ('r', 'p')`, [schemas, relnames]);
+    // Index the catalog rows by schema.relname.
+    const found = new Map();
+    for (const row of res.rows) {
+        found.set(`${row.nspname}.${row.relname}`, row.relrowsecurity);
+    }
+    const offenders = [];
+    for (const t of toCheck) {
+        const k = key(t);
+        if (!found.has(k)) {
+            offenders.push({
+                table: t.original,
+                schema: t.schema,
+                relname: t.relname,
+                reason: "not_found",
+            });
+        }
+        else if (found.get(k) === false) {
+            offenders.push({
+                table: t.original,
+                schema: t.schema,
+                relname: t.relname,
+                reason: "rls_disabled",
+            });
+        }
+    }
+    if (offenders.length > 0) {
+        throw new RlsCoverageError(offenders);
+    }
+}
+//# sourceMappingURL=verify-rls.js.map

package/dist/verify-rls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-rls.js","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,6DAA6D;AAC7D,uEAAuE;AACvE,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,8DAA8D;AAC9D,kFAAkF;AAClF,0EAA0E;AAC1E,6EAA6E;AAC7E,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,+DAA+D;AAC/D,2EAA2E;AAC3E,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA4DrC;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IACrC,SAAS,CAAiC;IACnD,YAAY,SAAyC;QACnD,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,SAAyC;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7C,OAAO,CAAC,CAAC,MAAM,KAAK,WAAW;YAC7B,CAAC,CAAC,OAAO,SAAS,8DAA8D;YAChF,CAAC,CAAC,OAAO,SAAS,6CAA6C,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,OAAO,iBAAiB,SAAS,CAAC,MAAM,mPAAmP,KAAK,CAAC,IAAI,CACnS,IAAI,CACL,+JAA+J,CAAC;AACnK,CAAC;AASD,yEAAyE;AACzE,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;yEACyE;AACzE,SAAS,YAAY,CAAC,KAAa,EAAE,aAAqB;IACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,8DAA8D;AAC9D,SAAS,GAAG,CAAC,CAAsC;IACjD,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAgB,EAChB,IAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC;IAE5D,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,iBAAiB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GACb,iBAAiB,IAAI,IAAI,CAAC,gBAAgB;QACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,SAAS,CAAC;IAEhB,gEAAgE;IAChE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAK1B;;;;;oCAKgC,EAChC,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;IAEF,4CAA4C;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/db-rls",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
   "license": "MIT",
   "type": "module",