@nodii/db-rls 0.5.2 → 0.5.3

package/bin/migrate-gen.mjs

@@ -1,12 +1,29 @@
 #!/usr/bin/env node
-// CLI shim for `npx @nodii/db-rls migrate-gen <serviceName>`.
+// CLI shim for `npx @nodii/db-rls <subcommand>`.
 //
-// The real logic lives in src/migrate-gen.ts; this shim just unwraps
-// argv and calls runMigrateGenCli + translates the return value to
-// process.exit.
+// The real logic lives in src/*.ts; this shim unwraps argv, dispatches by
+// subcommand, and translates the return value to process.exit.
+//
+// Subcommands:
+//   migrate-gen <serviceName> [--out <dir>] [--stub]
+//   verify-rls  --tables <a,b,c> [--ref <x,y>] [--schema <name>] [--db <url>]
+//
+// (Filename kept as migrate-gen.mjs for the package.json `bin` mapping;
+// it is the single `nodii-db-rls` entrypoint, not migrate-gen only.)
 
 import { runMigrateGenCli } from "../dist/migrate-gen.js";
+import { runVerifyRlsCli } from "../dist/verify-rls-cli.js";
+
+const argv = process.argv.slice(2);
+const sub = argv[0];
 
-const args = process.argv.slice(2);
-const code = runMigrateGenCli(args);
-process.exit(code);
+if (sub === "verify-rls") {
+  const { code, message } = await runVerifyRlsCli(argv.slice(1));
+  // Coverage failures (1) + usage (2) go to stderr; success (0) to stdout.
+  (code === 0 ? console.log : console.error)(message);
+  process.exit(code);
+} else {
+  // migrate-gen (default + back-compat: runMigrateGenCli accepts the
+  // leading "migrate-gen" token and prints usage on a missing serviceName).
+  process.exit(runMigrateGenCli(argv));
+}

package/dist/index.d.ts

@@ -11,6 +11,8 @@ export { withUserContextDb, withSystemContextDb, withOwnerContextDb, } from "./d
 export type { DrizzleClient, NodePgDatabase } from "./drizzle-client";
 export type { OwnerContextOpts } from "./migrate-guard";
 export { assertMigrateAllowed } from "./migrate-guard";
+export { RlsCoverageError, verifyRls } from "./verify-rls";
+export type { ReferenceTablePredicate, RlsCoverageOffender, RlsQuerier, VerifyRlsOpts, } from "./verify-rls";
 export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, } from "./auth-schema";
 export type { SqlExecutor } from "./auth-schema";
 export { withRls, generateTableGrants, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, referenceTableGrantsSql, findTenantColumn, ReferenceTableTenantColumnError, REFERENCE_TABLE_SKIP_RLS_MARKER, } from "./rls-policy-gen";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EAItB,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC,EAEnC,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,OAAO,EACP,WAAW,EACX,eAAe,EACf,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,sBAAsB,EACtB,QAAQ,EACR,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,QAAQ,WAAW,CAAC;AACjC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EAItB,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAMvD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC3D,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,UAAU,EACV,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC,EAEnC,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,OAAO,EACP,WAAW,EACX,eAAe,EACf,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,IAAI,EACJ,sBAAsB,EACtB,QAAQ,EACR,iBAAiB,EACjB,eAAe,GAChB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -42,6 +42,11 @@ export { withUserContext, withSystemContext, withOwnerContext, withPlatformOpsCo
 withPlatformOps, _resetWithPlatformOpsDeprecationWarnedForTests, autoDispatch, } from "./context";
 export { withUserContextDb, withSystemContextDb, withOwnerContextDb, } from "./drizzle-client";
 export { assertMigrateAllowed } from "./migrate-guard";
+// 08-rls § A1 + § 7.6 — RLS-coverage preflight guard. Service db:setup
+// gates call verifyRls() after migrations to catch the drizzle-snapshot
+// RLS hazard (a tenant table created without ENABLE ROW LEVEL SECURITY),
+// exempting § 7.6 reference tables (GRANT-controlled, NO RLS by design).
+export { RlsCoverageError, verifyRls } from "./verify-rls";
 export { AUTH_SCHEMA_SQL, AUTH_SCHEMA_GRANTS_SQL, applyAuthSchemaMigrations, authSchemaFullSql, } from "./auth-schema";
 export { withRls, generateTableGrants, withPlatformOpsTenantSql, withPlatformOpsGlobalSql, platformOpsTenantPredicateSql, platformOpsGlobalPredicateSql, platformOpsVerbClauseSql, sqlLiteral, PLATFORM_OPS_GRANTS_REPLICA_DEFAULT, 
 // 08-rls § 7.6 — pure platform-global reference tables (GRANT-controlled).

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,wDAAwD;AACxD,6CAA6C;AAC7C,EAAE;AACF,yCAAyC;AACzC,sEAAsE;AACtE,wCAAwC;AACxC,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,wEAAwE;AACxE,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,sCAAsC;AACtC,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,0EAA0E;AAC1E,qCAAqC;AAErC,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB;AACtB,uEAAuE;AACvE,wEAAwE;AACxE,sCAAsC;AACtC,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC;AACnC,2EAA2E;AAC3E,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAQvB,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,wDAAwD;AACxD,6CAA6C;AAC7C,EAAE;AACF,yCAAyC;AACzC,sEAAsE;AACtE,wCAAwC;AACxC,sDAAsD;AACtD,+DAA+D;AAC/D,4EAA4E;AAC5E,gDAAgD;AAChD,mEAAmE;AACnE,mDAAmD;AACnD,wEAAwE;AACxE,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,sCAAsC;AACtC,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,0EAA0E;AAC1E,qCAAqC;AAErC,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;AACjC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,cAAc,GACf,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB;AACtB,uEAAuE;AACvE,wEAAwE;AACxE,sCAAsC;AACtC,eAAe,EACf,8CAA8C,EAC9C,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQ3D,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,UAAU,EACV,mCAAmC;AACnC,2EAA2E;AAC3E,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAQvB,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC"}

package/dist/verify-rls-cli.d.ts

@@ -0,0 +1,20 @@
+export interface RunVerifyRlsCliResult {
+    /** Process exit code: 0 = all covered, 1 = coverage failure, 2 = usage. */
+    code: number;
+    /** Human-readable line for stdout/stderr (caller prints). */
+    message: string;
+}
+/**
+ * Parses argv (without the leading `verify-rls` token) and runs the
+ * coverage check. Returns an exit code + message rather than calling
+ * `process.exit`, so it is unit-testable. The bin shim translates.
+ *
+ * Flags:
+ *   --tables a,b,c   (required) RLS-required tables (comma-separated)
+ *   --ref c,d        reference tables to exempt (§ 7.6)
+ *   --schema public  default schema for bare names (default: public)
+ *   --db <url>       connection string (else DATABASE_URL / DB_RLS_PG_URL)
+ *   --help / -h
+ */
+export declare function runVerifyRlsCli(args: readonly string[]): Promise<RunVerifyRlsCliResult>;
+//# sourceMappingURL=verify-rls-cli.d.ts.map

package/dist/verify-rls-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-rls-cli.d.ts","sourceRoot":"","sources":["../src/verify-rls-cli.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAqDhC"}

package/dist/verify-rls-cli.js

@@ -0,0 +1,99 @@
+// verify-rls CLI — `nodii-db-rls verify-rls --tables a,b [--ref c] [--schema public]`.
+//
+// Thin CLI around `verifyRls` so a service can wire a `db:verify-rls`
+// script (or a CI step) without writing its own pg-connect boilerplate.
+// The importable `verifyRls` function (src/verify-rls.ts) remains the core
+// deliverable — this is the optional bin mirror of migrate-gen's CLI.
+//
+// Connection string comes from `--db <url>` or the `DATABASE_URL` /
+// `DB_RLS_PG_URL` env var (in that order). `pg` is an optional peer dep;
+// the CLI imports it lazily so importing the library does not require it.
+import { RlsCoverageError, verifyRls } from "./verify-rls";
+function splitList(value) {
+    if (!value)
+        return [];
+    return value
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+/**
+ * Parses argv (without the leading `verify-rls` token) and runs the
+ * coverage check. Returns an exit code + message rather than calling
+ * `process.exit`, so it is unit-testable. The bin shim translates.
+ *
+ * Flags:
+ *   --tables a,b,c   (required) RLS-required tables (comma-separated)
+ *   --ref c,d        reference tables to exempt (§ 7.6)
+ *   --schema public  default schema for bare names (default: public)
+ *   --db <url>       connection string (else DATABASE_URL / DB_RLS_PG_URL)
+ *   --help / -h
+ */
+export async function runVerifyRlsCli(args) {
+    let tables;
+    let refs;
+    let schema;
+    let dbUrl;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--tables" && i + 1 < args.length)
+            tables = args[++i];
+        else if (a === "--ref" && i + 1 < args.length)
+            refs = args[++i];
+        else if (a === "--schema" && i + 1 < args.length)
+            schema = args[++i];
+        else if (a === "--db" && i + 1 < args.length)
+            dbUrl = args[++i];
+        else if (a === "--help" || a === "-h") {
+            return { code: 0, message: usage() };
+        }
+    }
+    const requiredTables = splitList(tables);
+    if (requiredTables.length === 0) {
+        return { code: 2, message: usage() };
+    }
+    const connectionString = dbUrl ?? process.env.DATABASE_URL ?? process.env.DB_RLS_PG_URL;
+    if (!connectionString) {
+        return {
+            code: 2,
+            message: "verify-rls: no connection string — pass --db <url> or set DATABASE_URL / DB_RLS_PG_URL.",
+        };
+    }
+    // Lazy-import pg (optional peer dep). Keeps the library importable
+    // without pg installed; only the CLI path requires it.
+    const { Pool } = await import("pg");
+    const pool = new Pool({ connectionString, max: 1 });
+    try {
+        await verifyRls(pool, {
+            requiredTables,
+            schema,
+            referenceTables: splitList(refs),
+        });
+        return {
+            code: 0,
+            message: `verify-rls: OK — ${requiredTables.length} RLS-required table(s) covered.`,
+        };
+    }
+    catch (err) {
+        if (err instanceof RlsCoverageError) {
+            return { code: 1, message: err.message };
+        }
+        throw err;
+    }
+    finally {
+        await pool.end().catch(() => { });
+    }
+}
+function usage() {
+    return `usage: verify-rls --tables <a,b,c> [--ref <x,y>] [--schema <name>] [--db <url>]
+
+Verifies every --tables relation has ROW LEVEL SECURITY enabled
+(pg_class.relrowsecurity = true), exempting any --ref reference table
+(08-rls § 7.6 — GRANT-controlled, NO RLS by design). Exits 1 (loud) if
+any RLS-required table is missing RLS.
+
+Connection string: --db <url>, else DATABASE_URL, else DB_RLS_PG_URL.
+
+Spec: @nodii/db-rls 08-rls § A1 (RLS on every tenant-scoped table).`;
+}
+//# sourceMappingURL=verify-rls-cli.js.map

package/dist/verify-rls-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-rls-cli.js","sourceRoot":"","sources":["../src/verify-rls-cli.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,oEAAoE;AACpE,yEAAyE;AACzE,0EAA0E;AAE1E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAS3D,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAuB;IAEvB,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAyB,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAChE,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,gBAAgB,GACpB,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACjE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EACL,yFAAyF;SAC5F,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,uDAAuD;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE;YACpB,cAAc;YACd,MAAM;YACN,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,oBAAoB,cAAc,CAAC,MAAM,iCAAiC;SACpF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,KAAK;IACZ,OAAO;;;;;;;;;oEAS2D,CAAC;AACrE,CAAC"}

package/dist/verify-rls.d.ts

@@ -0,0 +1,76 @@
+import { DbRlsError } from "./types";
+/** Minimal query surface for the preflight catalog read. `pg.Pool` and
+ *  `pg.PoolClient` both satisfy this; `PgClientPool` exposes `.rawPool`.
+ *  We deliberately do NOT reuse the tx-bound `PgPool` — the preflight is a
+ *  single read, not a GUC-scoped transaction. */
+export interface RlsQuerier {
+    query<R = unknown>(sql: string, params?: readonly unknown[]): Promise<{
+        rows: R[];
+    }>;
+}
+/** A predicate that returns `true` when `table` is a reference table
+ *  (GRANT-controlled, NO RLS by design — § 7.6) and must therefore be
+ *  EXEMPT from the RLS-coverage check. `table` is the table name exactly
+ *  as it appears in `requiredTables` (may be schema-qualified). */
+export type ReferenceTablePredicate = (table: string) => boolean;
+export interface VerifyRlsOpts {
+    /** Tables that REQUIRE RLS (the canonical 5-policy posture, § A1). Each
+     *  may be bare (`orders`) or schema-qualified (`billing.orders`); a bare
+     *  name resolves against `schema`. */
+    requiredTables: readonly string[];
+    /** Schema for bare (unqualified) table names. Defaults to `"public"`. */
+    schema?: string;
+    /** Reference tables to EXEMPT (§ 7.6 — GRANT-controlled, NO RLS by
+     *  design). Supply EITHER this list OR `isReferenceTable`. Entries are
+     *  matched against `requiredTables` after both are normalized to
+     *  `schema.table`, so `["billing.country_codes"]` and a bare
+     *  `["country_codes"]` (with `schema:"billing"`) both match. */
+    referenceTables?: readonly string[];
+    /** Alternative to `referenceTables` — a predicate receiving the table
+     *  name as it appears in `requiredTables`. Use when the exempt set is
+     *  computed (e.g. read from a registry). If both are supplied a table is
+     *  exempt when EITHER matches. */
+    isReferenceTable?: ReferenceTablePredicate;
+    /** Back-compat alias kept intentionally undocumented in callers: when
+     *  `false`, reference-table exemption is disabled and a reference table
+     *  missing RLS WOULD be flagged. Defaults to `true` (exemptions on). */
+    allowReferenceTables?: boolean;
+}
+/** One RLS-required table whose coverage is missing or whose catalog row
+ *  could not be found. */
+export interface RlsCoverageOffender {
+    /** Table name as supplied in `requiredTables`. */
+    table: string;
+    /** Resolved schema used for the catalog lookup. */
+    schema: string;
+    /** Resolved (unqualified) relation name used for the catalog lookup. */
+    relname: string;
+    /** Why this table is an offender:
+     *   - `"rls_disabled"` — the table exists but `relrowsecurity = false`.
+     *   - `"not_found"` — no `pg_class` row matched (table absent / wrong
+     *     schema). Also a failure: a required table that doesn't exist can't
+     *     be protected. */
+    reason: "rls_disabled" | "not_found";
+}
+/**
+ * Thrown by `verifyRls` when one or more RLS-required tables are missing
+ * row-level security (or are absent). Carries the structured offender list
+ * so a `db:setup` gate can render a precise failure. Reference tables
+ * (§ 7.6) are NEVER offenders — they are exempt before this is thrown.
+ */
+export declare class RlsCoverageError extends DbRlsError {
+    readonly offenders: readonly RlsCoverageOffender[];
+    constructor(offenders: readonly RlsCoverageOffender[]);
+}
+/**
+ * Verifies that every table in `requiredTables` has row-level security
+ * enabled (`pg_class.relrowsecurity = true`), exempting any § 7.6
+ * reference table. Resolves OK (returns `void`) when all required tables
+ * are covered; throws `RlsCoverageError` listing the offenders otherwise.
+ *
+ * The query is a single read against `pg_class` joined to `pg_namespace`
+ * — read-only, no GUCs, no writes. Run it from a migration / `db:setup`
+ * gate against any pool (typically the owner/admin pool).
+ */
+export declare function verifyRls(pool: RlsQuerier, opts: VerifyRlsOpts): Promise<void>;
+//# sourceMappingURL=verify-rls.d.ts.map

package/dist/verify-rls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-rls.d.ts","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC;;;iDAGiD;AACjD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,GAAG,OAAO,EACf,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3B;AAED;;;mEAGmE;AACnE,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B;;0CAEsC;IACtC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;oEAIgE;IAChE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;sCAGkC;IAClC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;4EAEwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;0BAC0B;AAC1B,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;2BAIuB;IACvB,MAAM,EAAE,cAAc,GAAG,WAAW,CAAC;CACtC;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;gBACvC,SAAS,EAAE,SAAS,mBAAmB,EAAE;CAKtD;AA2CD;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CA4Ef"}

package/dist/verify-rls.js

@@ -0,0 +1,145 @@
+// verify-rls — a preflight RLS-coverage guard (08-rls § A1 + § 7.6).
+//
+// A service's `scripts/db/verify-rls.ts` (and any `db:setup` gate) calls
+// `verifyRls(pool, { requiredTables })` after migrations apply. It queries
+// `pg_class.relrowsecurity` (joined with `pg_namespace` for the schema)
+// for each table that REQUIRES RLS and FAILS LOUD — throwing
+// `RlsCoverageError` listing the offenders — if any RLS-required table
+// reports `relrowsecurity = false`.
+//
+// This catches the "drizzle snapshot RLS hazard": a migration that creates
+// a tenant-scoped table but never `ALTER TABLE ... ENABLE ROW LEVEL
+// SECURITY`. Without RLS the table leaks every tenant's rows to the
+// services / authenticated pools — a silent tenant-isolation breach that
+// the 5-policy DDL exists to prevent.
+//
+// Composition with 08-rls § 7.6 (db-rls 0.5.1) — a pure platform-global
+// reference table is GRANT-controlled with NO RLS *by design*
+// (`relrowsecurity = false` is the correct state, see `referenceTableGrantsSql`).
+// Such tables MUST NOT be flagged. `verifyRls` therefore takes the set of
+// reference tables (or a predicate) to EXEMPT: an RLS-required table missing
+// RLS is an error; a reference table missing RLS is expected.
+//
+// The verify path is a single read-only catalog query — it does NOT need
+// the GUC/tx-bound `PgPool` surface. It accepts any object exposing a
+// `query(sql, params)` returning `{ rows }`, which `pg.Pool` /
+// `PgClientPool.rawPool` satisfy directly. Byte-consistent error semantics
+// across TS / Python / Go ports.
+import { DbRlsError } from "./types";
+/**
+ * Thrown by `verifyRls` when one or more RLS-required tables are missing
+ * row-level security (or are absent). Carries the structured offender list
+ * so a `db:setup` gate can render a precise failure. Reference tables
+ * (§ 7.6) are NEVER offenders — they are exempt before this is thrown.
+ */
+export class RlsCoverageError extends DbRlsError {
+    offenders;
+    constructor(offenders) {
+        super(formatMessage(offenders));
+        this.name = "RlsCoverageError";
+        this.offenders = offenders;
+    }
+}
+function formatMessage(offenders) {
+    const lines = offenders.map((o) => {
+        const qualified = `${o.schema}.${o.relname}`;
+        return o.reason === "not_found"
+            ? `  - ${qualified} (NOT FOUND — required RLS table is absent from the catalog)`
+            : `  - ${qualified} (relrowsecurity = false — RLS not enabled)`;
+    });
+    return `rls_coverage: ${offenders.length} RLS-required table(s) missing row-level security (08-rls § A1). A migration created the table but never \`ALTER TABLE ... ENABLE ROW LEVEL SECURITY\` — these tables leak every tenant's rows to the services/authenticated pools. Offenders:\n${lines.join("\n")}\nFix: add the canonical 5-policy DDL (withRls) for each, or register it as a § 7.6 reference table if it is genuinely platform-global GRANT-controlled data.`;
+}
+/** Strip optional surrounding double-quotes from one identifier part. */
+function unquote(part) {
+    return part.replace(/^"|"$/g, "");
+}
+/** Resolve a (possibly schema-qualified, possibly quoted) table name to
+ *  `{ schema, relname }`. Bare names resolve against `defaultSchema`. */
+function resolveTable(table, defaultSchema) {
+    if (table.includes(".")) {
+        const idx = table.indexOf(".");
+        const schema = unquote(table.slice(0, idx));
+        const relname = unquote(table.slice(idx + 1));
+        return { original: table, schema, relname };
+    }
+    return { original: table, schema: defaultSchema, relname: unquote(table) };
+}
+/** Normalized `schema.relname` key for exemption matching. */
+function key(r) {
+    return `${r.schema}.${r.relname}`;
+}
+/**
+ * Verifies that every table in `requiredTables` has row-level security
+ * enabled (`pg_class.relrowsecurity = true`), exempting any § 7.6
+ * reference table. Resolves OK (returns `void`) when all required tables
+ * are covered; throws `RlsCoverageError` listing the offenders otherwise.
+ *
+ * The query is a single read against `pg_class` joined to `pg_namespace`
+ * — read-only, no GUCs, no writes. Run it from a migration / `db:setup`
+ * gate against any pool (typically the owner/admin pool).
+ */
+export async function verifyRls(pool, opts) {
+    const defaultSchema = opts.schema ?? "public";
+    const exemptionsEnabled = opts.allowReferenceTables ?? true;
+    // Build the exempt set (normalized schema.relname keys) + predicate.
+    const exemptKeys = new Set();
+    if (exemptionsEnabled && opts.referenceTables) {
+        for (const t of opts.referenceTables) {
+            exemptKeys.add(key(resolveTable(t, defaultSchema)));
+        }
+    }
+    const predicate = exemptionsEnabled && opts.isReferenceTable
+        ? opts.isReferenceTable
+        : undefined;
+    // Resolve + filter out exempt reference tables BEFORE querying.
+    const toCheck = [];
+    for (const original of opts.requiredTables) {
+        const resolved = resolveTable(original, defaultSchema);
+        const isExempt = exemptKeys.has(key(resolved)) ||
+            (predicate ? predicate(original) : false);
+        if (!isExempt)
+            toCheck.push(resolved);
+    }
+    if (toCheck.length === 0)
+        return;
+    // One catalog query covering all to-check tables. We pass parallel
+    // schema[] + relname[] arrays and join in SQL so a single round-trip
+    // resolves every table; missing rows are detected by set difference.
+    const schemas = toCheck.map((t) => t.schema);
+    const relnames = toCheck.map((t) => t.relname);
+    const res = await pool.query(`SELECT n.nspname, c.relname, c.relrowsecurity
+       FROM unnest($1::text[], $2::text[]) AS req(schemaname, tablename)
+       JOIN pg_namespace n ON n.nspname = req.schemaname
+       JOIN pg_class c ON c.relnamespace = n.oid
+        AND c.relname = req.tablename
+        AND c.relkind IN ('r', 'p')`, [schemas, relnames]);
+    // Index the catalog rows by schema.relname.
+    const found = new Map();
+    for (const row of res.rows) {
+        found.set(`${row.nspname}.${row.relname}`, row.relrowsecurity);
+    }
+    const offenders = [];
+    for (const t of toCheck) {
+        const k = key(t);
+        if (!found.has(k)) {
+            offenders.push({
+                table: t.original,
+                schema: t.schema,
+                relname: t.relname,
+                reason: "not_found",
+            });
+        }
+        else if (found.get(k) === false) {
+            offenders.push({
+                table: t.original,
+                schema: t.schema,
+                relname: t.relname,
+                reason: "rls_disabled",
+            });
+        }
+    }
+    if (offenders.length > 0) {
+        throw new RlsCoverageError(offenders);
+    }
+}
+//# sourceMappingURL=verify-rls.js.map

package/dist/verify-rls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-rls.js","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,6DAA6D;AAC7D,uEAAuE;AACvE,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,8DAA8D;AAC9D,kFAAkF;AAClF,0EAA0E;AAC1E,6EAA6E;AAC7E,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,+DAA+D;AAC/D,2EAA2E;AAC3E,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA4DrC;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IACrC,SAAS,CAAiC;IACnD,YAAY,SAAyC;QACnD,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,SAAyC;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7C,OAAO,CAAC,CAAC,MAAM,KAAK,WAAW;YAC7B,CAAC,CAAC,OAAO,SAAS,8DAA8D;YAChF,CAAC,CAAC,OAAO,SAAS,6CAA6C,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,OAAO,iBAAiB,SAAS,CAAC,MAAM,mPAAmP,KAAK,CAAC,IAAI,CACnS,IAAI,CACL,+JAA+J,CAAC;AACnK,CAAC;AASD,yEAAyE;AACzE,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;yEACyE;AACzE,SAAS,YAAY,CAAC,KAAa,EAAE,aAAqB;IACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,8DAA8D;AAC9D,SAAS,GAAG,CAAC,CAAsC;IACjD,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAgB,EAChB,IAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC;IAE5D,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,iBAAiB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GACb,iBAAiB,IAAI,IAAI,CAAC,gBAAgB;QACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,SAAS,CAAC;IAEhB,gEAAgE;IAChE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAK1B;;;;;oCAKgC,EAChC,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;IAEF,4CAA4C;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/db-rls",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
   "license": "MIT",
   "type": "module",