@stratum-hq/db-adapters 1.2.0 → 1.4.0

package/README.md

@@ -2,6 +2,8 @@
 
 PostgreSQL adapters for [Stratum](https://github.com/stratum-hq/Stratum) that automatically scope queries to the current tenant using Row-Level Security. Supports raw `pg`, Prisma, Drizzle, and Sequelize, plus helpers for enabling RLS on your tables.
 
+Read the documentation at [docs.stratum-hq.org/packages/db-adapters](https://docs.stratum-hq.org/packages/db-adapters/).
+
 ## Installation
 
 ```bash
@@ -35,7 +37,7 @@ import { prismaWithTenant } from "@stratum-hq/db-adapters";        // Prisma
 import { drizzleWithTenant } from "@stratum-hq/db-adapters";  // Drizzle
 import { SequelizeAdapter, sequelizeWithTenantScope } from "@stratum-hq/db-adapters"; // Sequelize
 
-// Prisma — all queries scoped to the current tenant
+// Prisma: all queries scoped to the current tenant
 const tenantPrisma = prismaWithTenant(prisma, () => getTenantContext().tenant_id, pool);
 const orders = await tenantPrisma.order.findMany();
 ```
@@ -56,6 +58,16 @@ try {
 }
 ```
 
+`createPolicy` checks every row-level security policy already on the table (the table the name resolves to through the `search_path`) before it adds the `tenant_isolation` policy or keeps an existing one, and throws without changing anything if any check fails:
+
+- PostgreSQL ORs permissive policies together, so every permissive policy, whatever its name or roles, must compare `tenant_id` with the current tenant setting `app.current_tenant_id` for the commands it covers (`USING` for reads, updates and deletes; `WITH CHECK` for inserts, and for updates when set). A role-specific permissive policy counts too, because `createPolicy` cannot know which role your application connects as.
+- Restrictive policies can only narrow access, so they may check anything.
+- An existing `tenant_isolation` policy must be permissive, apply to all commands, and apply to `PUBLIC` (no `TO` clause), like the one `createPolicy` generates and every policy Stratum ships.
+
+The check recognizes the form Stratum generates, with the operands in either order, with casts, ANDed with other conditions, or ORed with Stratum's `app.bypass_rls` bypass. A policy that isolates correctly but is written in another form is also refused; replace it with the generated form. This is a breaking change for callers that relied on the old skip, shipped in a minor release.
+
+`isRLSEnabled` reports on the table that the name resolves to through the `search_path`, not on a table with the same name in another schema.
+
 Also available: `disableRLS`, `dropPolicy`, `isRLSEnabled`, `addTenantColumn`, `createIsolationPolicy`, and low-level session helpers `setTenantContext` / `resetTenantContext` / `getCurrentTenantId`. Schema-per-tenant and database-per-tenant variants (`SchemaRawAdapter`, `DatabasePoolManager`, …) are exported too.
 
 ## Schema-per-tenant search_path
@@ -93,10 +105,55 @@ When the pool count reaches `maxPools`, the manager ends the least recently used
 
 Concurrent first requests for one tenant share one pool.
 
+## PGlite
+
+`@stratum-hq/db-adapters/pglite` runs `@stratum-hq/lib` on [PGlite](https://pglite.dev), which is PostgreSQL compiled to WebAssembly. It works in Node and in the browser, and it needs no database server. Use it for fast local tests and for demos.
+
+Install PGlite. It is an optional peer dependency, so npm does not install it for you.
+
+```bash
+npm install @electric-sql/pglite
+```
+
+```typescript
+import { Stratum } from "@stratum-hq/lib";
+import { withTenantContext } from "@stratum-hq/db-adapters";
+import { createPglitePool, createRestrictedPool } from "@stratum-hq/db-adapters/pglite";
+
+// In-memory database. Pass PGlite options, such as { dataDir: "idb://my-db" }, to keep data.
+const pool = await createPglitePool();
+const stratum = new Stratum({ pool, autoMigrate: true });
+await stratum.initialize();
+
+const acme = await stratum.createTenant({ name: "Acme", slug: "acme" });
+
+// Row-level security applies only to a role that is not a superuser.
+const appPool = await createRestrictedPool(pool);
+await withTenantContext(appPool, acme.id, (client) => client.query("SELECT * FROM config_entries"));
+```
+
+`createPglitePool(source?)` returns a `pg.Pool`-compatible object:
+
+- `source` is a PGlite instance or PGlite options. When you pass options, the pool creates the instance and loads the `ltree` and `uuid_ossp` extensions. `pool.end()` then closes the instance.
+- When you pass your own instance, load `ltree` and `uuid_ossp` yourself. `pool.end()` does not close your instance.
+- `pool.pglite` is the PGlite instance.
+
+`createRestrictedPool(pool, { role? })` creates the role `stratum_app` (or the name you give) with `NOSUPERUSER NOBYPASSRLS`. It grants the role read and write access to every table and sequence in the `public` schema. Default privileges extend the grants to tables that the superuser creates later. The returned pool runs every query as that role.
+
+The restricted role is a test and demo convenience, not a security boundary: any query can leave it with `RESET ROLE`.
+
+Limits:
+
+- **One connection.** A client from `connect()` holds the only connection until `release()`. Other callers wait in order. If you hold a client and call `pool.query()`, the call waits forever. `release()` rolls back a transaction the client left open and resets the session settings and the role, so the next client starts clean.
+- **No concurrency.** Queries run one at a time. Do not use this adapter to test race conditions or lock contention.
+- **Superuser by default.** PGlite connects as the superuser `postgres`, and a superuser bypasses row-level security. Use `createRestrictedPool` when a test must prove isolation.
+- **Only part of `pg.Pool`.** The pool supports `query`, `connect`, `end` and `on`. Callbacks, cursors, `totalCount` and the other pool counters do not exist.
+- PGlite `^0.4.2` is the supported version.
+
 ## Security
 
 - All DDL validates table names against `/^[a-zA-Z_][a-zA-Z0-9_]*$/`.
-- Tenant ID is always set via `set_config($1, true)` — fully parameterized.
+- Tenant ID is always set via `set_config($1, true)`, fully parameterized.
 - `enableRLS()` always applies `FORCE ROW LEVEL SECURITY`, preventing bypass by table owners.
 - Always reset the tenant context when returning connections to the pool; `createTenantPool` handles this for you.
 

package/dist/database/manager.d.ts

@@ -21,7 +21,7 @@ export declare function createDatabase(client: pg.PoolClient | pg.Client, tenant
  * Drops the per-tenant database if it exists.
  *
  * IMPORTANT: DROP DATABASE cannot run inside a transaction block.
- * Same constraint as createDatabase — use a standalone client.
+ * Same constraint as createDatabase: use a standalone client.
  */
 export declare function dropDatabase(client: pg.PoolClient | pg.Client, tenantSlug: string): Promise<void>;
 //# sourceMappingURL=manager.d.ts.map

package/dist/database/manager.js

@@ -38,7 +38,7 @@ async function databaseExists(client, tenantSlug) {
  */
 async function createDatabase(client, tenantSlug, templateDb) {
     const dbName = getDatabaseName(tenantSlug);
-    // Identifiers validated by regex — no user-supplied interpolation outside of validated values.
+    // Identifiers validated by regex: no user-supplied interpolation outside of validated values.
     // pg does not support parameterized DDL identifiers, so we construct the SQL string directly.
     let sql = `CREATE DATABASE "${dbName}"`;
     if (templateDb) {
@@ -54,7 +54,7 @@ async function createDatabase(client, tenantSlug, templateDb) {
  * Drops the per-tenant database if it exists.
  *
  * IMPORTANT: DROP DATABASE cannot run inside a transaction block.
- * Same constraint as createDatabase — use a standalone client.
+ * Same constraint as createDatabase: use a standalone client.
  */
 async function dropDatabase(client, tenantSlug) {
     const dbName = getDatabaseName(tenantSlug);

package/dist/database/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/database/manager.ts"],"names":[],"mappings":";;AAWA,0CASC;AAMD,wCAUC;AASD,wCAiBC;AAQD,oCAMC;AA3ED,2CAAgD;AAEhD,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;GAGG;AACH,SAAgB,eAAe,CAAC,UAAkB;IAChD,IAAA,mBAAY,EAAC,UAAU,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,UAAU,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,kCAAkC,UAAU,aAAa,oBAAoB,QAAQ,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,cAAc,CAClC,MAAiC,EACjC,UAAkB;IAElB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uEAAuE,EACvE,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,cAAc,CAClC,MAAiC,EACjC,UAAkB,EAClB,UAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,+FAA+F;IAC/F,8FAA8F;IAC9F,IAAI,GAAG,GAAG,oBAAoB,MAAM,GAAG,CAAC;IACxC,IAAI,UAAU,EAAE,CAAC;QACf,iEAAiE;QACjE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,IAAI,cAAc,UAAU,GAAG,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAChC,MAAiC,EACjC,UAAkB;IAElB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,GAAG,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/database/manager.ts"],"names":[],"mappings":";;AAWA,0CASC;AAMD,wCAUC;AASD,wCAiBC;AAQD,oCAMC;AA3ED,2CAAgD;AAEhD,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;GAGG;AACH,SAAgB,eAAe,CAAC,UAAkB;IAChD,IAAA,mBAAY,EAAC,UAAU,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,UAAU,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,kCAAkC,UAAU,aAAa,oBAAoB,QAAQ,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,cAAc,CAClC,MAAiC,EACjC,UAAkB;IAElB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uEAAuE,EACvE,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,cAAc,CAClC,MAAiC,EACjC,UAAkB,EAClB,UAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,8FAA8F;IAC9F,8FAA8F;IAC9F,IAAI,GAAG,GAAG,oBAAoB,MAAM,GAAG,CAAC;IACxC,IAAI,UAAU,EAAE,CAAC;QACf,iEAAiE;QACjE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,IAAI,cAAc,UAAU,GAAG,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAChC,MAAiC,EACjC,UAAkB;IAElB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,GAAG,CAAC,CAAC;AAC5D,CAAC"}

package/dist/database/pool-manager.d.ts

@@ -1,6 +1,6 @@
 import pg from "pg";
 export interface DatabasePoolManagerOptions {
-    /** Template connection config (host, port, user, password, ssl, etc.) — database name is overridden per tenant. */
+    /** Template connection config (host, port, user, password, ssl, etc.). The database name is overridden per tenant. */
     baseConnectionConfig: pg.PoolConfig;
     /** Maximum number of tenant pools to keep open simultaneously. Default: 50. */
     maxPools?: number;

package/dist/database/pool-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool-manager.d.ts","sourceRoot":"","sources":["../../src/database/pool-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,0BAA0B;IACzC,mHAAmH;IACnH,oBAAoB,EAAE,EAAE,CAAC,UAAU,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AASD;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,OAAO,EAAE,0BAA0B;IAM/C;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC;IAgCtE;;;;;;;;OAQG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAqBxD;gFAC4E;IACtE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBrE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAO/B,uGAAuG;IACvG,OAAO,CAAC,iBAAiB;IAKzB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAWtB,qDAAqD;IACrD,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IAW5D;;;OAGG;IACH,OAAO,CAAC,OAAO;CAgBhB"}
+{"version":3,"file":"pool-manager.d.ts","sourceRoot":"","sources":["../../src/database/pool-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,0BAA0B;IACzC,sHAAsH;IACtH,oBAAoB,EAAE,EAAE,CAAC,UAAU,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AASD;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,OAAO,EAAE,0BAA0B;IAM/C;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC;IAgCtE;;;;;;;;OAQG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAqBxD;gFAC4E;IACtE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBrE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAO/B,uGAAuG;IACvG,OAAO,CAAC,iBAAiB;IAKzB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAWtB,qDAAqD;IACrD,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IAW5D;;;OAGG;IACH,OAAO,CAAC,OAAO;CAgBhB"}

package/dist/index.d.ts

@@ -5,7 +5,9 @@ export { SchemaRawAdapter, createSchemaTenantPool, } from "./adapters/schema-raw
 export type { SchemaAdapterOptions } from "./adapters/schema-raw.js";
 export { SchemaPrismaAdapter, withSchemaTenant, } from "./adapters/schema-prisma.js";
 export { createPolicy, dropPolicy, enableRLS, disableRLS, isRLSEnabled, } from "./rls/manager.js";
+export type { CreatePolicyOptions } from "./rls/manager.js";
 export { setTenantContext, resetTenantContext, withTenantContext, withRlsBypass, getCurrentTenantId, } from "./rls/session.js";
+export type { TenantScope, TenantContextOptions } from "./rls/session.js";
 export { createSchema, dropSchema, schemaExists, listTenantSchemas, replicateTableToSchema, tenantSchemaName, } from "./schema/manager.js";
 export { setSchemaSearchPath, resetSearchPath, getCurrentSearchPath, } from "./schema/session.js";
 export { addTenantColumn, enableRLS as enableRLSForMigration, createIsolationPolicy, migrateTable, } from "./migration-helpers.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,SAAS,IAAI,qBAAqB,EAClC,qBAAqB,EACrB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxG,OAAO,EACL,cAAc,EACd,UAAU,IAAI,iBAAiB,EAC/B,eAAe,IAAI,sBAAsB,GAC1C,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,SAAS,IAAI,qBAAqB,EAClC,qBAAqB,EACrB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxG,OAAO,EACL,cAAc,EACd,UAAU,IAAI,iBAAiB,EAC/B,eAAe,IAAI,sBAAsB,GAC1C,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,qDAAgD;AAAvC,8GAAA,WAAW,OAAA;AAEpB,4CAAiE;AAAxD,oGAAA,UAAU,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AACrC,kDAAqF;AAA5E,0GAAA,aAAa,OAAA;AAAE,6GAAA,UAAU,OAAoB;AACtD,0DAGkC;AAFhC,iHAAA,gBAAgB,OAAA;AAChB,uHAAA,sBAAsB,OAAA;AAGxB,gEAGqC;AAFnC,uHAAA,mBAAmB,OAAA;AACnB,oHAAA,gBAAgB,OAAA;AAGlB,+CAM0B;AALxB,0GAAA,YAAY,OAAA;AACZ,wGAAA,UAAU,OAAA;AACV,uGAAA,SAAS,OAAA;AACT,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AAGd,+CAM0B;AALxB,8GAAA,gBAAgB,OAAA;AAChB,gHAAA,kBAAkB,OAAA;AAClB,+GAAA,iBAAiB,OAAA;AACjB,2GAAA,aAAa,OAAA;AACb,gHAAA,kBAAkB,OAAA;AAGpB,kDAO6B;AAN3B,0GAAA,YAAY,OAAA;AACZ,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AACZ,+GAAA,iBAAiB,OAAA;AACjB,oHAAA,sBAAsB,OAAA;AACtB,8GAAA,gBAAgB,OAAA;AAGlB,kDAI6B;AAH3B,iHAAA,mBAAmB,OAAA;AACnB,6GAAA,eAAe,OAAA;AACf,kHAAA,oBAAoB,OAAA;AAGtB,+DAKgC;AAJ9B,uHAAA,eAAe,OAAA;AACf,6HAAA,SAAS,OAAyB;AAClC,6HAAA,qBAAqB,OAAA;AACrB,oHAAA,YAAY,OAAA;AAGd,0BAA0B;AAC1B,oDAK+B;AAJ7B,6GAAA,eAAe,OAAA;AACf,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,0GAAA,YAAY,OAAA;AAGd,8DAAiE;AAAxD,sHAAA,mBAAmB,OAAA;AAG5B,8DAAgE;AAAvD,qHAAA,kBAAkB,OAAA;AAC3B,oEAAsE;AAA7D,2HAAA,qBAAqB,OAAA;AAC9B,wDAAwG;AAA/F,gHAAA,gBAAgB,OAAA;AAAE,wHAAA,eAAe,OAA4B;AACtE,oDAI+B;AAH7B,4GAAA,cAAc,OAAA;AACd,+GAAA,UAAU,OAAqB;AAC/B,oHAAA,eAAe,OAA0B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,qDAAgD;AAAvC,8GAAA,WAAW,OAAA;AAEpB,4CAAiE;AAAxD,oGAAA,UAAU,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AACrC,kDAAqF;AAA5E,0GAAA,aAAa,OAAA;AAAE,6GAAA,UAAU,OAAoB;AACtD,0DAGkC;AAFhC,iHAAA,gBAAgB,OAAA;AAChB,uHAAA,sBAAsB,OAAA;AAGxB,gEAGqC;AAFnC,uHAAA,mBAAmB,OAAA;AACnB,oHAAA,gBAAgB,OAAA;AAGlB,+CAM0B;AALxB,0GAAA,YAAY,OAAA;AACZ,wGAAA,UAAU,OAAA;AACV,uGAAA,SAAS,OAAA;AACT,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AAId,+CAM0B;AALxB,8GAAA,gBAAgB,OAAA;AAChB,gHAAA,kBAAkB,OAAA;AAClB,+GAAA,iBAAiB,OAAA;AACjB,2GAAA,aAAa,OAAA;AACb,gHAAA,kBAAkB,OAAA;AAIpB,kDAO6B;AAN3B,0GAAA,YAAY,OAAA;AACZ,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AACZ,+GAAA,iBAAiB,OAAA;AACjB,oHAAA,sBAAsB,OAAA;AACtB,8GAAA,gBAAgB,OAAA;AAGlB,kDAI6B;AAH3B,iHAAA,mBAAmB,OAAA;AACnB,6GAAA,eAAe,OAAA;AACf,kHAAA,oBAAoB,OAAA;AAGtB,+DAKgC;AAJ9B,uHAAA,eAAe,OAAA;AACf,6HAAA,SAAS,OAAyB;AAClC,6HAAA,qBAAqB,OAAA;AACrB,oHAAA,YAAY,OAAA;AAGd,0BAA0B;AAC1B,oDAK+B;AAJ7B,6GAAA,eAAe,OAAA;AACf,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,0GAAA,YAAY,OAAA;AAGd,8DAAiE;AAAxD,sHAAA,mBAAmB,OAAA;AAG5B,8DAAgE;AAAvD,qHAAA,kBAAkB,OAAA;AAC3B,oEAAsE;AAA7D,2HAAA,qBAAqB,OAAA;AAC9B,wDAAwG;AAA/F,gHAAA,gBAAgB,OAAA;AAAE,wHAAA,eAAe,OAA4B;AACtE,oDAI+B;AAH7B,4GAAA,cAAc,OAAA;AACd,+GAAA,UAAU,OAAqB;AAC/B,oHAAA,eAAe,OAA0B"}

package/dist/migration-helpers.d.ts

@@ -1,6 +1,7 @@
 import pg from "pg";
+import { type CreatePolicyOptions } from "./rls/manager.js";
 export declare function addTenantColumn(client: pg.PoolClient, tableName: string): Promise<void>;
 export declare function enableRLS(client: pg.PoolClient, tableName: string): Promise<void>;
-export declare function createIsolationPolicy(client: pg.PoolClient, tableName: string): Promise<void>;
+export declare function createIsolationPolicy(client: pg.PoolClient, tableName: string, options?: CreatePolicyOptions): Promise<void>;
 export declare function migrateTable(client: pg.PoolClient, tableName: string): Promise<void>;
 //# sourceMappingURL=migration-helpers.d.ts.map

package/dist/migration-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration-helpers.d.ts","sourceRoot":"","sources":["../src/migration-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAUpB,wBAAsB,eAAe,CACnC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"migration-helpers.d.ts","sourceRoot":"","sources":["../src/migration-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAA8C,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAUxG,wBAAsB,eAAe,CACnC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/migration-helpers.js

@@ -4,6 +4,7 @@ exports.addTenantColumn = addTenantColumn;
 exports.enableRLS = enableRLS;
 exports.createIsolationPolicy = createIsolationPolicy;
 exports.migrateTable = migrateTable;
+const manager_js_1 = require("./rls/manager.js");
 // Validate table name to prevent SQL injection (only allows alphanumeric + underscores)
 function validateTableName(name) {
     if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
@@ -20,10 +21,16 @@ async function enableRLS(client, tableName) {
     await client.query(`ALTER TABLE ${safe} ENABLE ROW LEVEL SECURITY`);
     await client.query(`ALTER TABLE ${safe} FORCE ROW LEVEL SECURITY`);
 }
-async function createIsolationPolicy(client, tableName) {
+async function createIsolationPolicy(client, tableName, options = {}) {
     const safe = validateTableName(tableName);
+    if (options.subtreeRead) {
+        await (0, manager_js_1.assertSubtreeFunction)(client);
+    }
     await client.query(`CREATE POLICY tenant_isolation ON ${safe}
      USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid)`);
+    if (options.subtreeRead) {
+        await client.query(`CREATE POLICY tenant_subtree_read ON ${safe} FOR SELECT USING (${manager_js_1.SUBTREE_READ_FILTER})`);
+    }
 }
 async function migrateTable(client, tableName) {
     await addTenantColumn(client, tableName);

package/dist/migration-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"migration-helpers.js","sourceRoot":"","sources":["../src/migration-helpers.ts"],"names":[],"mappings":";;AAUA,0CAQC;AAED,8BAOC;AAED,sDASC;AAED,oCAOC;AA7CD,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAChB,eAAe,IAAI,qCAAqC,CACzD,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,4BAA4B,CAAC,CAAC;IACpE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC;AACrE,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAChB,qCAAqC,IAAI;0FAC6C,CACvF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,MAAM,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"migration-helpers.js","sourceRoot":"","sources":["../src/migration-helpers.ts"],"names":[],"mappings":";;AAWA,0CAQC;AAED,8BAOC;AAED,sDAkBC;AAED,oCAOC;AAxDD,iDAAwG;AAExG,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAChB,eAAe,IAAI,qCAAqC,CACzD,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,4BAA4B,CAAC,CAAC;IACpE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC;AACrE,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,MAAqB,EACrB,SAAiB,EACjB,UAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAA,kCAAqB,EAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,CAChB,qCAAqC,IAAI;0FAC6C,CACvF,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,KAAK,CAChB,wCAAwC,IAAI,sBAAsB,gCAAmB,GAAG,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,MAAM,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC"}

package/dist/pglite/index.d.ts

@@ -0,0 +1,60 @@
+import type pg from "pg";
+import type { PGliteInterface, PGliteOptions } from "@electric-sql/pglite" with { "resolution-mode": "import" };
+/**
+ * A `pg.Pool`-compatible object over one PGlite instance.
+ *
+ * Only these members work: `query`, `connect` (a client with `query` and
+ * `release`), `end` and `on`. Other `pg.Pool` members are undefined.
+ */
+export type PglitePool = pg.Pool & {
+    /** The PGlite instance that runs every query of this pool. */
+    readonly pglite: PGliteInterface;
+};
+export interface RestrictedPoolOptions {
+    /**
+     * The name of the role. It must match `^[a-z_][a-z0-9_]{0,62}$`.
+     * Defaults to `stratum_app`.
+     */
+    role?: string;
+}
+/**
+ * Return a `pg.Pool`-compatible pool that runs every query on one PGlite instance.
+ *
+ * The pool has one connection. A client from `connect()` holds it until
+ * `release()`, and other callers wait in order. `release()` rolls back a
+ * transaction the client left open and resets the session settings, so the
+ * next client does not inherit them. Queries run as the PGlite
+ * superuser, so row-level security does not apply; use
+ * {@link createRestrictedPool} for that.
+ *
+ * @param source - A PGlite instance, or options to create one. When the
+ *   pool creates the instance, it loads the `ltree` and `uuid_ossp`
+ *   extensions, and `end()` closes the instance. When you pass an instance,
+ *   you load the extensions and you close it.
+ * @returns The pool, after PGlite is ready.
+ */
+export declare function createPglitePool(source?: PGliteInterface | PGliteOptions): Promise<PglitePool>;
+/**
+ * Return a pool that runs every query as a role that is not a superuser, so
+ * that row-level security applies.
+ *
+ * The function creates the role when it does not exist, with NOSUPERUSER and
+ * NOBYPASSRLS. It grants the role SELECT, INSERT, UPDATE and DELETE on every
+ * table in the `public` schema, and usage of every sequence. Default
+ * privileges extend these grants to tables that the current user creates
+ * later.
+ *
+ * The returned pool shares the connection and the lock of `pool`. Each client
+ * runs `SET ROLE` when it gets the connection and `RESET ROLE` at release.
+ * Its `end()` closes nothing; end the source pool instead.
+ *
+ * The restricted role is a convenience for tests and demos, not a security
+ * boundary: any query can leave it with `RESET ROLE`, because the session
+ * belongs to the superuser.
+ *
+ * @param pool - A pool from {@link createPglitePool} that runs as the superuser.
+ * @param options - The role name.
+ * @throws Error - The role name is not a plain lowercase identifier.
+ */
+export declare function createRestrictedPool(pool: PglitePool, options?: RestrictedPoolOptions): Promise<PglitePool>;
+//# sourceMappingURL=index.d.ts.map

package/dist/pglite/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pglite/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAW,MAAM,sBAAsB,CAAC,OAAO,iBAAiB,EAAE,QAAQ,EAAE,CAAC;AAMzH;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,GAAG;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAuID;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBpG;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,UAAU,CAAC,CAoBrB"}

package/dist/pglite/index.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPglitePool = createPglitePool;
+exports.createRestrictedPool = createRestrictedPool;
+// pg returns int8 and numeric values as strings, because a JavaScript number
+// loses precision above 2^53. PGlite returns numbers, so these parsers
+// restore the pg behavior.
+const PG_PARSERS = { 20: (value) => value, 1700: (value) => value };
+const ROLE_NAME = /^[a-z_][a-z0-9_]{0,62}$/;
+// A restricted pool must share the lock of its source pool, because both
+// use the same connection.
+const locks = new WeakMap();
+/**
+ * Return a lock that gives one holder at a time the connection, in request order.
+ */
+function createLock() {
+    let tail = Promise.resolve();
+    return () => {
+        let unlock;
+        const held = new Promise((resolve) => (unlock = resolve));
+        const acquired = tail.then(() => unlock);
+        tail = tail.then(() => held);
+        return acquired;
+    };
+}
+// pg sends a plain object as JSON text for every parameter type. PGlite
+// serializes by the inferred parameter type and rejects an object for a text
+// parameter, so the conversion happens here.
+function prepareValue(value) {
+    if (value === undefined)
+        return null;
+    if (value !== null &&
+        typeof value === "object" &&
+        !(value instanceof Date) &&
+        !(value instanceof Uint8Array) &&
+        !Array.isArray(value)) {
+        return JSON.stringify(value);
+    }
+    return value;
+}
+function toQueryResult(result) {
+    // PGlite reports affectedRows 0 for a SELECT. pg reports the number of rows
+    // for any statement that returns rows.
+    const rowCount = result.fields.length > 0 ? result.rows.length : (result.affectedRows ?? 0);
+    return { rows: result.rows, rowCount, fields: result.fields };
+}
+async function run(db, textOrConfig, values) {
+    const text = typeof textOrConfig === "string" ? textOrConfig : textOrConfig.text;
+    const params = values ?? (typeof textOrConfig === "string" ? undefined : textOrConfig.values);
+    if (!params || params.length === 0) {
+        // pg uses the simple query protocol when there are no parameters, and
+        // that protocol accepts several statements, as migration files hold.
+        // PGlite exec() is the same protocol. It returns one result per statement,
+        // and pg returns the last one.
+        const results = await db.exec(text, { parsers: PG_PARSERS });
+        return toQueryResult(results[results.length - 1] ?? { rows: [], fields: [] });
+    }
+    return toQueryResult(await db.query(text, params.map(prepareValue), { parsers: PG_PARSERS }));
+}
+function makePool(db, acquire, ownsInstance, role) {
+    const connect = async () => {
+        const unlock = await acquire();
+        try {
+            if (role)
+                await db.exec(`SET ROLE "${role}"`);
+        }
+        catch (err) {
+            unlock();
+            throw err;
+        }
+        let released = false;
+        return {
+            query: (textOrConfig, values) => run(db, textOrConfig, values),
+            // pg gives each client its own session and destroys the connection when
+            // release() receives an error. This pool has one session for every
+            // client, so release cleans it instead: it rolls back a transaction the
+            // client left open, and resets the settings and the role the client
+            // set. The lock stays held until the cleanup ends, so the next client
+            // gets a clean session.
+            release: () => {
+                if (released)
+                    return;
+                released = true;
+                // RESET ALL leaves the role alone, so RESET ROLE follows it.
+                db.exec("ROLLBACK; RESET ALL; RESET ROLE").then(unlock, unlock);
+            },
+        };
+    };
+    const pool = {
+        pglite: db,
+        connect,
+        async query(textOrConfig, values) {
+            const client = await connect();
+            try {
+                return await client.query(textOrConfig, values);
+            }
+            finally {
+                client.release();
+            }
+        },
+        async end() {
+            if (ownsInstance && !db.closed)
+                await db.close();
+        },
+        on() {
+            return pool;
+        },
+    };
+    const result = pool;
+    locks.set(result, acquire);
+    return result;
+}
+function isPglite(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        typeof value.exec === "function" &&
+        typeof value.query === "function");
+}
+/**
+ * Return a `pg.Pool`-compatible pool that runs every query on one PGlite instance.
+ *
+ * The pool has one connection. A client from `connect()` holds it until
+ * `release()`, and other callers wait in order. `release()` rolls back a
+ * transaction the client left open and resets the session settings, so the
+ * next client does not inherit them. Queries run as the PGlite
+ * superuser, so row-level security does not apply; use
+ * {@link createRestrictedPool} for that.
+ *
+ * @param source - A PGlite instance, or options to create one. When the
+ *   pool creates the instance, it loads the `ltree` and `uuid_ossp`
+ *   extensions, and `end()` closes the instance. When you pass an instance,
+ *   you load the extensions and you close it.
+ * @returns The pool, after PGlite is ready.
+ */
+async function createPglitePool(source) {
+    if (isPglite(source)) {
+        await source.waitReady;
+        return makePool(source, createLock(), false, null);
+    }
+    const [{ PGlite }, { ltree }, { uuid_ossp }] = await Promise.all([
+        import("@electric-sql/pglite"),
+        import("@electric-sql/pglite/contrib/ltree"),
+        import("@electric-sql/pglite/contrib/uuid_ossp"),
+    ]);
+    const options = source ?? {};
+    const db = await PGlite.create({
+        ...options,
+        extensions: { ltree, uuid_ossp, ...options.extensions },
+    });
+    return makePool(db, createLock(), true, null);
+}
+/**
+ * Return a pool that runs every query as a role that is not a superuser, so
+ * that row-level security applies.
+ *
+ * The function creates the role when it does not exist, with NOSUPERUSER and
+ * NOBYPASSRLS. It grants the role SELECT, INSERT, UPDATE and DELETE on every
+ * table in the `public` schema, and usage of every sequence. Default
+ * privileges extend these grants to tables that the current user creates
+ * later.
+ *
+ * The returned pool shares the connection and the lock of `pool`. Each client
+ * runs `SET ROLE` when it gets the connection and `RESET ROLE` at release.
+ * Its `end()` closes nothing; end the source pool instead.
+ *
+ * The restricted role is a convenience for tests and demos, not a security
+ * boundary: any query can leave it with `RESET ROLE`, because the session
+ * belongs to the superuser.
+ *
+ * @param pool - A pool from {@link createPglitePool} that runs as the superuser.
+ * @param options - The role name.
+ * @throws Error - The role name is not a plain lowercase identifier.
+ */
+async function createRestrictedPool(pool, options = {}) {
+    const role = options.role ?? "stratum_app";
+    if (!ROLE_NAME.test(role)) {
+        throw new Error(`Invalid role name '${role}': use lowercase letters, digits and underscores`);
+    }
+    await pool.query(`
+    DO $$ BEGIN
+      IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}') THEN
+        CREATE ROLE "${role}" NOLOGIN NOSUPERUSER NOBYPASSRLS;
+      END IF;
+    END $$;
+    GRANT USAGE ON SCHEMA public TO "${role}";
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO "${role}";
+    GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO "${role}";
+    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO "${role}";
+    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO "${role}";
+  `);
+    const acquire = locks.get(pool);
+    if (!acquire)
+        throw new Error("createRestrictedPool needs a pool from createPglitePool");
+    return makePool(pool.pglite, acquire, false, role);
+}
+//# sourceMappingURL=index.js.map

package/dist/pglite/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pglite/index.ts"],"names":[],"mappings":";;AA+KA,4CAgBC;AAwBD,oDAuBC;AAlND,6EAA6E;AAC7E,uEAAuE;AACvE,2BAA2B;AAC3B,MAAM,UAAU,GAAG,EAAE,EAAE,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC;AAEpF,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAE5C,yEAAyE;AACzE,2BAA2B;AAC3B,MAAM,KAAK,GAAG,IAAI,OAAO,EAAyC,CAAC;AAEnE;;GAEG;AACH,SAAS,UAAU;IACjB,IAAI,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,OAAO,GAAG,EAAE;QACV,IAAI,MAAmB,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,6EAA6E;AAC7E,6CAA6C;AAC7C,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC;QACxB,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;QAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACrB,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,MAAe;IACpC,4EAA4E;IAC5E,uCAAuC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;IAC5F,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAA+B,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,EAAmB,EACnB,YAAkC,EAClC,MAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,sEAAsE;QACtE,qEAAqE;QACrE,2EAA2E;QAC3E,+BAA+B;QAC/B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7D,OAAO,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,QAAQ,CACf,EAAmB,EACnB,OAAkC,EAClC,YAAqB,EACrB,IAAmB;IAEnB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,IAAI;gBAAE,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC;YACT,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,OAAO;YACL,KAAK,EAAE,CAAC,YAAkC,EAAE,MAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC;YAChG,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,wBAAwB;YACxB,OAAO,EAAE,GAAG,EAAE;gBACZ,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,6DAA6D;gBAC7D,EAAE,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAClE,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,EAAE;QACV,OAAO;QACP,KAAK,CAAC,KAAK,CAAC,YAAkC,EAAE,MAAkB;YAChE,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAClD,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG;YACP,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC,MAAM;gBAAE,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnD,CAAC;QACD,EAAE;YACA,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IACF,MAAM,MAAM,GAAG,IAA6B,CAAC;IAC7C,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAAyB,CAAC,IAAI,KAAK,UAAU;QACrD,OAAQ,KAAyB,CAAC,KAAK,KAAK,UAAU,CACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,gBAAgB,CAAC,MAAwC;IAC7E,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,SAAS,CAAC;QACvB,OAAO,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/D,MAAM,CAAC,sBAAsB,CAAC;QAC9B,MAAM,CAAC,oCAAoC,CAAC;QAC5C,MAAM,CAAC,wCAAwC,CAAC;KACjD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAC7B,GAAG,OAAO;QACV,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE;KACxD,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAAgB,EAChB,UAAiC,EAAE;IAEnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,aAAa,CAAC;IAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,kDAAkD,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,CAAC,KAAK,CAAC;;+DAE4C,IAAI;uBAC5C,IAAI;;;uCAGY,IAAI;8EACmC,IAAI;gEAClB,IAAI;mGAC+B,IAAI;qFAClB,IAAI;GACtF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/dist/rls/manager.d.ts

@@ -1,5 +1,25 @@
 import pg from "pg";
-export declare function createPolicy(client: pg.PoolClient, tableName: string): Promise<void>;
+/**
+ * The read-only subtree predicate of migration 031. It admits the rows of the
+ * current tenant's descendants only when the session set app.tenant_scope to
+ * 'subtree'. It goes in a FOR SELECT policy only, so writes stay exact.
+ */
+export declare const SUBTREE_READ_FILTER: string;
+export interface CreatePolicyOptions {
+    /**
+     * Also create the tenant_subtree_read policy, so that a session in the
+     * "subtree" scope reads the rows of the tenant's descendants. Needs
+     * migration 031 of @stratum-hq/lib. Default false.
+     */
+    subtreeRead?: boolean;
+}
+/**
+ * Throws when the database has no stratum_subtree_tenant_ids() function. The
+ * subtree read policy calls it, and without it CREATE POLICY fails with a
+ * less clear error.
+ */
+export declare function assertSubtreeFunction(client: pg.PoolClient): Promise<void>;
+export declare function createPolicy(client: pg.PoolClient, tableName: string, options?: CreatePolicyOptions): Promise<void>;
 export declare function dropPolicy(client: pg.PoolClient, tableName: string): Promise<void>;
 export declare function enableRLS(client: pg.PoolClient, tableName: string): Promise<void>;
 export declare function disableRLS(client: pg.PoolClient, tableName: string): Promise<void>;

package/dist/rls/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/rls/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAUpB,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CASlB"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/rls/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAKpB;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAEuC,CAAC;AAExE,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhF;AAUD,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/rls/manager.js

@@ -1,10 +1,33 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUBTREE_READ_FILTER = void 0;
+exports.assertSubtreeFunction = assertSubtreeFunction;
 exports.createPolicy = createPolicy;
 exports.dropPolicy = dropPolicy;
 exports.enableRLS = enableRLS;
 exports.disableRLS = disableRLS;
 exports.isRLSEnabled = isRLSEnabled;
+const policy_check_js_1 = require("./policy-check.js");
+const TENANT_FILTER = "tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid";
+/**
+ * The read-only subtree predicate of migration 031. It admits the rows of the
+ * current tenant's descendants only when the session set app.tenant_scope to
+ * 'subtree'. It goes in a FOR SELECT policy only, so writes stay exact.
+ */
+exports.SUBTREE_READ_FILTER = "current_setting('app.tenant_scope', true) = 'subtree' " +
+    "AND tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[])";
+/**
+ * Throws when the database has no stratum_subtree_tenant_ids() function. The
+ * subtree read policy calls it, and without it CREATE POLICY fails with a
+ * less clear error.
+ */
+async function assertSubtreeFunction(client) {
+    const res = await client.query("SELECT to_regprocedure('stratum_subtree_tenant_ids()') IS NOT NULL AS present");
+    if (!res.rows[0]?.present) {
+        throw new Error("[stratum] The subtree read policy needs the function stratum_subtree_tenant_ids(), " +
+            "which migration 031 of @stratum-hq/lib creates. Run the Stratum migrations first.");
+    }
+}
 // Validate table name to prevent SQL injection (only allows alphanumeric + underscores)
 function validateTableName(tableName) {
     if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(tableName)) {
@@ -12,18 +35,42 @@ function validateTableName(tableName) {
     }
     return tableName;
 }
-async function createPolicy(client, tableName) {
+async function createPolicy(client, tableName, options = {}) {
     const safe = validateTableName(tableName);
-    // Cannot use parameterized queries inside DO blocks or for DDL identifiers.
-    // Table name is validated via allowlist regex above.
-    const exists = await client.query(`SELECT count(*) FROM pg_policies WHERE tablename = $1 AND policyname = 'tenant_isolation'`, [safe]);
-    if (parseInt(exists.rows[0].count, 10) === 0) {
-        await client.query(`CREATE POLICY tenant_isolation ON ${safe} USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid)`);
+    if (options.subtreeRead) {
+        await assertSubtreeFunction(client);
+    }
+    // Read every policy on the table that the name resolves to, in whichever
+    // schema that is. PostgreSQL ORs permissive policies together, so each one
+    // must filter by tenant, and a policy's name proves nothing.
+    // Each row also carries the schema of the tenants table, the only schema
+    // that may qualify the subtree function (migration 031 creates it there).
+    const existing = await client.query(`SELECT p.policyname, p.permissive, p.cmd, p.qual, p.with_check, p.roles::text[] AS roles,
+            (SELECT tn.nspname FROM pg_class tc JOIN pg_namespace tn ON tn.oid = tc.relnamespace
+              WHERE tc.oid = to_regclass('tenants')) AS tenants_schema
+       FROM pg_policies p
+       JOIN pg_class c ON c.relname = p.tablename
+       JOIN pg_namespace n ON n.oid = c.relnamespace AND n.nspname = p.schemaname
+      WHERE c.oid = to_regclass($1)`, [safe]);
+    const issues = (0, policy_check_js_1.tablePolicyIssues)(existing.rows, existing.rows[0]?.tenants_schema ?? undefined);
+    if (issues.length > 0) {
+        throw new Error(`[stratum] Table ${safe} has row-level security policies that do not isolate it by tenant: ` +
+            `${issues.join("; ")} (expected ${TENANT_FILTER}). ` +
+            `Drop or correct those policies, then call createPolicy again.`);
+    }
+    if (!existing.rows.some((p) => p.policyname === "tenant_isolation")) {
+        // Cannot use parameterized queries inside DO blocks or for DDL identifiers.
+        // Table name is validated via allowlist regex above.
+        await client.query(`CREATE POLICY tenant_isolation ON ${safe} USING (${TENANT_FILTER})`);
+    }
+    if (options.subtreeRead && !existing.rows.some((p) => p.policyname === "tenant_subtree_read")) {
+        await client.query(`CREATE POLICY tenant_subtree_read ON ${safe} FOR SELECT USING (${exports.SUBTREE_READ_FILTER})`);
     }
 }
 async function dropPolicy(client, tableName) {
     const safe = validateTableName(tableName);
     await client.query(`DROP POLICY IF EXISTS tenant_isolation ON ${safe}`);
+    await client.query(`DROP POLICY IF EXISTS tenant_subtree_read ON ${safe}`);
 }
 async function enableRLS(client, tableName) {
     const safe = validateTableName(tableName);
@@ -36,7 +83,9 @@ async function disableRLS(client, tableName) {
     await client.query(`ALTER TABLE ${safe} DISABLE ROW LEVEL SECURITY`);
 }
 async function isRLSEnabled(client, tableName) {
-    const res = await client.query(`SELECT relrowsecurity FROM pg_class WHERE relname = $1`, [tableName]);
+    const safe = validateTableName(tableName);
+    // The table the name resolves to, in whichever schema that is.
+    const res = await client.query(`SELECT relrowsecurity FROM pg_class WHERE oid = to_regclass($1)`, [safe]);
     if (res.rows.length === 0) {
         return false;
     }

package/dist/rls/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/rls/manager.ts"],"names":[],"mappings":";;AAUA,oCAgBC;AAED,gCAMC;AAED,8BAOC;AAED,gCAOC;AAED,oCAYC;AAhED,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,2FAA2F,EAC3F,CAAC,IAAI,CAAC,CACP,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,KAAK,CAChB,qCAAqC,IAAI,uFAAuF,CACjI,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,4BAA4B,CAAC,CAAC;IACpE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC;AACrE,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,8BAA8B,CAAC,CAAC;IACtE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,6BAA6B,CAAC,CAAC;AACvE,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,wDAAwD,EACxD,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;AACpC,CAAC"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/rls/manager.ts"],"names":[],"mappings":";;;AA4BA,sDAUC;AAUD,oCA0CC;AAED,gCAOC;AAED,8BAOC;AAED,gCAOC;AAED,oCAcC;AApID,uDAAsE;AAEtE,MAAM,aAAa,GAAG,8EAA8E,CAAC;AAErG;;;;GAIG;AACU,QAAA,mBAAmB,GAC9B,wDAAwD;IACxD,qEAAqE,CAAC;AAWxE;;;;GAIG;AACI,KAAK,UAAU,qBAAqB,CAAC,MAAqB;IAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,+EAA+E,CAChF,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,mFAAmF,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB,EACjB,UAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,6DAA6D;IAC7D,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;;;oCAMgC,EAChC,CAAC,IAAI,CAAC,CACP,CAAC;IACF,MAAM,MAAM,GAAG,IAAA,mCAAiB,EAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,IAAI,SAAS,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,qEAAqE;YAC1F,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,aAAa,KAAK;YACpD,+DAA+D,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,kBAAkB,CAAC,EAAE,CAAC;QACpE,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,MAAM,CAAC,KAAK,CAAC,qCAAqC,IAAI,WAAW,aAAa,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,qBAAqB,CAAC,EAAE,CAAC;QAC9F,MAAM,MAAM,CAAC,KAAK,CAChB,wCAAwC,IAAI,sBAAsB,2BAAmB,GAAG,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,CAAC,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;AAC7E,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,4BAA4B,CAAC,CAAC;IACpE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC;AACrE,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,8BAA8B,CAAC,CAAC;IACtE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,6BAA6B,CAAC,CAAC;AACvE,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,iEAAiE,EACjE,CAAC,IAAI,CAAC,CACP,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;AACpC,CAAC"}

package/dist/rls/policy-check.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Decides whether the row-level security policies on a table restrict rows to
+ * the current tenant, from the expressions PostgreSQL stores in pg_policies.
+ *
+ * `createPolicy` uses this before it keeps an existing tenant_isolation policy
+ * or adds one, because a policy's name proves nothing about what it checks, and
+ * PostgreSQL ORs permissive policies together: one permissive policy that does
+ * not filter by tenant opens the table whatever tenant_isolation says.
+ *
+ * Rules:
+ * - Every permissive policy must filter by tenant for the commands it covers:
+ *   USING for SELECT, UPDATE, DELETE and ALL, WITH CHECK for INSERT, and WITH
+ *   CHECK for UPDATE and ALL when it is set. This applies whatever roles the
+ *   policy names, because this package cannot know which role the
+ *   application connects as.
+ * - Restrictive policies can only narrow access, so they may check anything.
+ * - The tenant_isolation policy itself must be permissive, apply to ALL
+ *   commands, and apply to PUBLIC, like the one `createPolicy` generates and
+ *   every policy Stratum ships.
+ *
+ * The check recognises the form this package generates, with the operands in
+ * either order, with casts, inside an AND with other conditions, and ORed with
+ * Stratum's administrative bypass. Anything else is reported as not filtering
+ * by tenant, so an unusual but correct policy is refused, never accepted.
+ *
+ * It also recognises the subtree read of migration 031: the
+ * stratum_subtree_tenant_ids() match ANDed with the app.tenant_scope =
+ * 'subtree' check. That form counts only in the USING clause of a SELECT
+ * policy. In any other policy, the same clause would let UPDATE or DELETE
+ * reach a descendant's rows, and in WITH CHECK it would let a write name a
+ * descendant.
+ */
+/** One row of pg_policies. */
+export interface PolicyRow {
+    policyname: string;
+    /** "PERMISSIVE" or "RESTRICTIVE". */
+    permissive: string;
+    /** "ALL", "SELECT", "INSERT", "UPDATE" or "DELETE". */
+    cmd: string;
+    qual: string | null;
+    with_check: string | null;
+    /** The roles the policy applies to; ["public"] for PUBLIC. */
+    roles: string[];
+}
+/**
+ * Every reason the table's policies do not isolate it by tenant. Empty when
+ * they do, or when the table has no policies.
+ *
+ * @param functionSchema - The schema of Stratum's tenants table, the only
+ *   schema that may qualify stratum_subtree_tenant_ids(). When it is
+ *   undefined, only the unqualified function counts.
+ */
+export declare function tablePolicyIssues(policies: PolicyRow[], functionSchema?: string): string[];
+//# sourceMappingURL=policy-check.d.ts.map

package/dist/rls/policy-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-check.d.ts","sourceRoot":"","sources":["../../src/rls/policy-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,8BAA8B;AAC9B,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAoMD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB1F"}

package/dist/rls/policy-check.js

@@ -0,0 +1,241 @@
+"use strict";
+/**
+ * Decides whether the row-level security policies on a table restrict rows to
+ * the current tenant, from the expressions PostgreSQL stores in pg_policies.
+ *
+ * `createPolicy` uses this before it keeps an existing tenant_isolation policy
+ * or adds one, because a policy's name proves nothing about what it checks, and
+ * PostgreSQL ORs permissive policies together: one permissive policy that does
+ * not filter by tenant opens the table whatever tenant_isolation says.
+ *
+ * Rules:
+ * - Every permissive policy must filter by tenant for the commands it covers:
+ *   USING for SELECT, UPDATE, DELETE and ALL, WITH CHECK for INSERT, and WITH
+ *   CHECK for UPDATE and ALL when it is set. This applies whatever roles the
+ *   policy names, because this package cannot know which role the
+ *   application connects as.
+ * - Restrictive policies can only narrow access, so they may check anything.
+ * - The tenant_isolation policy itself must be permissive, apply to ALL
+ *   commands, and apply to PUBLIC, like the one `createPolicy` generates and
+ *   every policy Stratum ships.
+ *
+ * The check recognises the form this package generates, with the operands in
+ * either order, with casts, inside an AND with other conditions, and ORed with
+ * Stratum's administrative bypass. Anything else is reported as not filtering
+ * by tenant, so an unusual but correct policy is refused, never accepted.
+ *
+ * It also recognises the subtree read of migration 031: the
+ * stratum_subtree_tenant_ids() match ANDed with the app.tenant_scope =
+ * 'subtree' check. That form counts only in the USING clause of a SELECT
+ * policy. In any other policy, the same clause would let UPDATE or DELETE
+ * reach a descendant's rows, and in WITH CHECK it would let a write name a
+ * descendant.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tablePolicyIssues = tablePolicyIssues;
+/** The session setting that holds the current tenant (see rls/session.ts). */
+const TENANT_SETTING = "app.current_tenant_id";
+/** The setting Stratum's own policies admit for administrative access. */
+const BYPASS_SETTING = "app.bypass_rls";
+/** The setting that opts a session in to the subtree read scope (migration 031). */
+const SCOPE_SETTING = "app.tenant_scope";
+/** The function that returns the current tenant and its descendants (migration 031). */
+const SUBTREE_FUNCTION = "stratum_subtree_tenant_ids";
+/** Drops whitespace and casts, lower-cases, and keeps string literals intact. */
+function normalize(expr) {
+    let out = "";
+    for (let i = 0; i < expr.length; i++) {
+        const ch = expr[i];
+        if (ch === "'") {
+            const end = expr.indexOf("'", i + 1);
+            const stop = end === -1 ? expr.length : end + 1;
+            out += expr.slice(i, stop);
+            i = stop - 1;
+        }
+        else if (!/\s/.test(ch)) {
+            out += ch.toLowerCase();
+        }
+    }
+    // Casts such as ::text, ::uuid and ::character varying (spaces already gone).
+    return out.replace(/::[a-z_]+(?:\[\])?/g, "");
+}
+/** Index of the parenthesis that closes the one at `open`. */
+function closingParen(expr, open) {
+    let depth = 0;
+    for (let i = open; i < expr.length; i++) {
+        const ch = expr[i];
+        if (ch === "'") {
+            const end = expr.indexOf("'", i + 1);
+            if (end === -1)
+                return -1;
+            i = end;
+        }
+        else if (ch === "(") {
+            depth++;
+        }
+        else if (ch === ")") {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+/** Removes parentheses that wrap the whole expression. */
+function stripOuterParens(expr) {
+    let e = expr;
+    while (e.startsWith("(") && e.endsWith(")") && closingParen(e, 0) === e.length - 1) {
+        e = e.slice(1, -1);
+    }
+    return e;
+}
+/**
+ * Splits a normalized expression on a top-level boolean operator. Whitespace
+ * is gone, so the operator is found between a closing parenthesis and an
+ * opening one, which is how PostgreSQL prints every operand of AND / OR.
+ */
+function splitTopLevel(expr, op) {
+    const parts = [];
+    let depth = 0;
+    let start = 0;
+    for (let i = 0; i < expr.length; i++) {
+        const ch = expr[i];
+        if (ch === "'") {
+            const end = expr.indexOf("'", i + 1);
+            if (end === -1)
+                break;
+            i = end;
+        }
+        else if (ch === "(") {
+            depth++;
+        }
+        else if (ch === ")") {
+            depth--;
+            if (depth === 0 && expr.startsWith(`${op}(`, i + 1)) {
+                parts.push(expr.slice(start, i + 1));
+                start = i + 1 + op.length;
+            }
+        }
+    }
+    parts.push(expr.slice(start));
+    return parts.map(stripOuterParens);
+}
+/** Removes every parenthesis; only safe on an operand with no AND / OR in it. */
+function flatten(expr) {
+    return expr.replace(/[()]/g, "");
+}
+const SETTING_READ = `current_setting'${TENANT_SETTING.replace(".", "\\.")}'(?:,(?:true|false))?`;
+/** The current tenant, read directly or through NULLIF(..., ''). */
+const CURRENT_TENANT = `(?:nullif${SETTING_READ},''|${SETTING_READ})`;
+const TENANT_MATCH = new RegExp(`^(?:tenant_id=${CURRENT_TENANT}|${CURRENT_TENANT}=tenant_id)$`);
+const BYPASS_MATCH = new RegExp(`^current_setting'${BYPASS_SETTING.replace(".", "\\.")}'(?:,(?:true|false))?='on'$`);
+const SCOPE_MATCH = new RegExp(`^current_setting'${SCOPE_SETTING.replace(".", "\\.")}'(?:,(?:true|false))?='subtree'$`);
+/**
+ * tenant_id = ANY ((SELECT stratum_subtree_tenant_ids())::uuid[]) after
+ * normalize and flatten. PostgreSQL qualifies the function with its schema
+ * when that schema is not on the search path of the reading session. Only the
+ * schema that holds Stratum's tenants table, where migration 031 creates the
+ * function, may qualify it: a function of the same name in another schema
+ * could return any ids.
+ */
+function subtreeMatch(functionSchema) {
+    const qualifier = functionSchema === undefined ? "" : `(?:${escapeRegExp(quoteIdent(functionSchema).toLowerCase())}\\.)?`;
+    return new RegExp(`^tenant_id=anyselect${qualifier}${SUBTREE_FUNCTION}(?:as${SUBTREE_FUNCTION})?$`);
+}
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** The identifier as PostgreSQL prints it: quoted unless it is a plain lowercase name. */
+function quoteIdent(name) {
+    return /^[a-z_][a-z0-9_$]*$/.test(name) ? name : `"${name.replace(/"/g, '""')}"`;
+}
+/**
+ * True when the normalized expression only admits rows of the current tenant.
+ * `subtree` matches the subtree function call that may appear in the
+ * expression, or is null where the subtree read is not allowed.
+ */
+function filtersByTenant(expr, subtree) {
+    const e = stripOuterParens(expr);
+    const disjuncts = splitTopLevel(e, "or");
+    if (disjuncts.length > 1) {
+        // Every branch must be safe; Stratum's administrative bypass is one of them.
+        return (disjuncts.every((d) => BYPASS_MATCH.test(flatten(d)) || filtersByTenant(d, subtree)) &&
+            disjuncts.some((d) => !BYPASS_MATCH.test(flatten(d))));
+    }
+    const conjuncts = splitTopLevel(e, "and");
+    if (conjuncts.length > 1) {
+        if (conjuncts.some((c) => filtersByTenant(c, subtree)))
+            return true;
+        // The subtree read of migration 031: the descendants of the current
+        // tenant, only when the session opted in with app.tenant_scope.
+        return (subtree !== null &&
+            conjuncts.some((c) => SCOPE_MATCH.test(flatten(c))) &&
+            conjuncts.some((c) => subtree.test(flatten(c))));
+    }
+    return TENANT_MATCH.test(flatten(e));
+}
+/** An expression on one line, for messages. */
+function oneLine(expr) {
+    return expr === null ? "none" : expr.replace(/\s+/g, " ");
+}
+/** Why one permissive policy lets rows of other tenants through, or null. */
+function permissiveIssue(p, subtree) {
+    const name = `policy "${oneLine(p.policyname)}" (${p.cmd})`;
+    // INSERT policies have only WITH CHECK; SELECT and DELETE only USING. For
+    // ALL and UPDATE a missing WITH CHECK means PostgreSQL reuses USING.
+    if (p.cmd !== "INSERT") {
+        // Only a SELECT policy may widen to the subtree: in any other policy the
+        // same USING clause would let UPDATE or DELETE reach a descendant's rows.
+        if (p.qual === null || !filtersByTenant(normalize(p.qual), p.cmd === "SELECT" ? subtree : null)) {
+            return `${name} USING (${oneLine(p.qual)}) does not filter by tenant`;
+        }
+    }
+    if (p.cmd === "INSERT" || p.with_check !== null) {
+        if (p.with_check === null || !filtersByTenant(normalize(p.with_check), null)) {
+            return `${name} WITH CHECK (${oneLine(p.with_check)}) does not filter by tenant`;
+        }
+    }
+    return null;
+}
+/** Why the tenant_isolation policy is not the shape createPolicy generates, or null. */
+function tenantIsolationShapeIssue(p) {
+    const name = `policy "${oneLine(p.policyname)}"`;
+    if (p.permissive !== "PERMISSIVE") {
+        return `${name} is ${p.permissive.toLowerCase()}, not permissive`;
+    }
+    if (p.cmd !== "ALL") {
+        return `${name} applies to ${p.cmd} only, not ALL commands`;
+    }
+    if (p.roles.length !== 1 || p.roles[0] !== "public") {
+        return `${name} applies to roles ${p.roles.join(", ")}, not PUBLIC`;
+    }
+    return null;
+}
+/**
+ * Every reason the table's policies do not isolate it by tenant. Empty when
+ * they do, or when the table has no policies.
+ *
+ * @param functionSchema - The schema of Stratum's tenants table, the only
+ *   schema that may qualify stratum_subtree_tenant_ids(). When it is
+ *   undefined, only the unqualified function counts.
+ */
+function tablePolicyIssues(policies, functionSchema) {
+    const subtree = subtreeMatch(functionSchema);
+    const issues = [];
+    for (const p of policies) {
+        if (p.policyname === "tenant_isolation") {
+            const shape = tenantIsolationShapeIssue(p);
+            if (shape !== null) {
+                issues.push(shape);
+                continue;
+            }
+        }
+        if (p.permissive === "PERMISSIVE") {
+            const issue = permissiveIssue(p, subtree);
+            if (issue !== null)
+                issues.push(issue);
+        }
+    }
+    return issues;
+}
+//# sourceMappingURL=policy-check.js.map

package/dist/rls/policy-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-check.js","sourceRoot":"","sources":["../../src/rls/policy-check.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;AAyNH,8CAiBC;AA3ND,8EAA8E;AAC9E,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,0EAA0E;AAC1E,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,oFAAoF;AACpF,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,wFAAwF;AACxF,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAEtD,iFAAiF;AACjF,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YAChD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1B,GAAG,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,8EAA8E;IAC9E,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,8DAA8D;AAC9D,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YAC1B,CAAC,GAAG,GAAG,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,0DAA0D;AAC1D,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,EAAgB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM;YACtB,CAAC,GAAG,GAAG,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACrC,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACrC,CAAC;AAED,iFAAiF;AACjF,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,YAAY,GAAG,mBAAmB,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,uBAAuB,CAAC;AAClG,oEAAoE;AACpE,MAAM,cAAc,GAAG,YAAY,YAAY,OAAO,YAAY,GAAG,CAAC;AACtE,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,iBAAiB,cAAc,IAAI,cAAc,cAAc,CAAC,CAAC;AACjG,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,oBAAoB,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,6BAA6B,CACpF,CAAC;AACF,MAAM,WAAW,GAAG,IAAI,MAAM,CAC5B,oBAAoB,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,kCAAkC,CACxF,CAAC;AACF;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,cAAkC;IACtD,MAAM,SAAS,GACb,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC;IAC1G,OAAO,IAAI,MAAM,CAAC,uBAAuB,SAAS,GAAG,gBAAgB,QAAQ,gBAAgB,KAAK,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,OAAsB;IAC3D,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEjC,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,6EAA6E;QAC7E,OAAO,CACL,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACpF,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,OAAO,CACL,OAAO,KAAK,IAAI;YAChB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,+CAA+C;AAC/C,SAAS,OAAO,CAAC,IAAmB;IAClC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,CAAY,EAAE,OAAe;IACpD,MAAM,IAAI,GAAG,WAAW,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC;IAC5D,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvB,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAChG,OAAO,GAAG,IAAI,WAAW,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;QACxE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7E,OAAO,GAAG,IAAI,gBAAgB,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,6BAA6B,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,SAAS,yBAAyB,CAAC,CAAY;IAC7C,MAAM,IAAI,GAAG,WAAW,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;IACjD,IAAI,CAAC,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,GAAG,IAAI,eAAe,CAAC,CAAC,GAAG,yBAAyB,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,GAAG,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,QAAqB,EAAE,cAAuB;IAC9E,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/rls/session.d.ts

@@ -1,7 +1,34 @@
 import pg from "pg";
-export declare function setTenantContext(client: pg.PoolClient, tenantId: string): Promise<void>;
+/**
+ * Which rows a tenant context can read.
+ *
+ * - "exact": the rows of the tenant only. This is the default.
+ * - "subtree": the rows of the tenant and of every descendant, through the
+ *   tenant_subtree_read policies of migration 031. Writes stay limited to the
+ *   exact tenant in both scopes, and so do reads of credential-bearing rows
+ *   (api_keys, webhooks and sensitive config_entries).
+ */
+export type TenantScope = "exact" | "subtree";
+export interface TenantContextOptions {
+    /** The read scope. Default "exact". */
+    scope?: TenantScope;
+}
+/**
+ * Sets the tenant and the read scope for the current transaction.
+ *
+ * It always writes both settings, so a second call in the same transaction
+ * replaces an earlier "subtree" scope instead of keeping it.
+ */
+export declare function setTenantContext(client: pg.PoolClient, tenantId: string, options?: TenantContextOptions): Promise<void>;
 export declare function resetTenantContext(client: pg.PoolClient): Promise<void>;
-export declare function withTenantContext<T>(pool: pg.Pool, tenantId: string, fn: (client: pg.PoolClient) => Promise<T>): Promise<T>;
+/**
+ * Runs `fn` in a transaction that is scoped to one tenant.
+ *
+ * @param options `{ scope: "subtree" }` also lets `fn` read the rows of every
+ *                descendant of the tenant. Writes stay limited to the tenant.
+ * @throws Error when `options.scope` is not "exact" or "subtree".
+ */
+export declare function withTenantContext<T>(pool: pg.Pool, tenantId: string, fn: (client: pg.PoolClient) => Promise<T>, options?: TenantContextOptions): Promise<T>;
 /**
  * Runs `fn` inside a transaction with the RLS bypass flag set, so control-plane
  * / system operations that legitimately span tenant boundaries (provisioning,

package/dist/rls/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/rls/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAcZ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAcZ;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,EAAE,CAAC,UAAU,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/rls/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;AAE9C,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAaD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EACzC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAcZ;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,EAAE,CAAC,UAAU,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB"}

package/dist/rls/session.js

@@ -5,17 +5,40 @@ exports.resetTenantContext = resetTenantContext;
 exports.withTenantContext = withTenantContext;
 exports.withRlsBypass = withRlsBypass;
 exports.getCurrentTenantId = getCurrentTenantId;
-async function setTenantContext(client, tenantId) {
-    await client.query("SELECT set_config('app.current_tenant_id', $1, true)", [tenantId]);
+/** The value of app.tenant_scope for a scope. Only 'subtree' widens reads. */
+function scopeSetting(options) {
+    const scope = options.scope ?? "exact";
+    if (scope !== "exact" && scope !== "subtree") {
+        throw new Error(`[stratum] Unknown tenant scope: ${String(scope)} (expected "exact" or "subtree")`);
+    }
+    return scope === "subtree" ? "subtree" : "";
+}
+/**
+ * Sets the tenant and the read scope for the current transaction.
+ *
+ * It always writes both settings, so a second call in the same transaction
+ * replaces an earlier "subtree" scope instead of keeping it.
+ */
+async function setTenantContext(client, tenantId, options = {}) {
+    await client.query("SELECT set_config('app.current_tenant_id', $1, true), set_config('app.tenant_scope', $2, true)", [tenantId, scopeSetting(options)]);
 }
 async function resetTenantContext(client) {
-    await client.query("SELECT set_config('app.current_tenant_id', '', true)");
+    await client.query("SELECT set_config('app.current_tenant_id', '', true), set_config('app.tenant_scope', '', true)");
 }
-async function withTenantContext(pool, tenantId, fn) {
+/**
+ * Runs `fn` in a transaction that is scoped to one tenant.
+ *
+ * @param options `{ scope: "subtree" }` also lets `fn` read the rows of every
+ *                descendant of the tenant. Writes stay limited to the tenant.
+ * @throws Error when `options.scope` is not "exact" or "subtree".
+ */
+async function withTenantContext(pool, tenantId, fn, options = {}) {
+    // Fail on an unknown scope before a connection is taken.
+    scopeSetting(options);
     const client = await pool.connect();
     try {
         await client.query("BEGIN");
-        await setTenantContext(client, tenantId);
+        await setTenantContext(client, tenantId, options);
         const result = await fn(client);
         await client.query("COMMIT");
         return result;

package/dist/rls/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/rls/session.ts"],"names":[],"mappings":";;AAEA,4CAKC;AAED,gDAEC;AAED,8CAkBC;AAeD,sCAiBC;AAED,gDAQC;AAvEM,KAAK,UAAU,gBAAgB,CACpC,MAAqB,EACrB,QAAgB;IAEhB,MAAM,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzF,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,MAAqB;IAC5D,MAAM,MAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAC7E,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,IAAa,EACb,QAAgB,EAChB,EAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,aAAa,CACjC,IAAa,EACb,EAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACtC,MAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,0EAA0E,CAC3E,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;IAC3C,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/rls/session.ts"],"names":[],"mappings":";;AAmCA,4CASC;AAED,gDAIC;AASD,8CAqBC;AAeD,sCAiBC;AAED,gDAQC;AAxGD,8EAA8E;AAC9E,SAAS,YAAY,CAAC,OAA6B;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC;IACvC,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,gBAAgB,CACpC,MAAqB,EACrB,QAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,MAAM,CAAC,KAAK,CAChB,gGAAgG,EAChG,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAClC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,MAAqB;IAC5D,MAAM,MAAM,CAAC,KAAK,CAChB,gGAAgG,CACjG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CACrC,IAAa,EACb,QAAgB,EAChB,EAAyC,EACzC,UAAgC,EAAE;IAElC,yDAAyD;IACzD,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,aAAa,CACjC,IAAa,EACb,EAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACtC,MAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,0EAA0E,CAC3E,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;IAC3C,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC"}

package/package.json

@@ -1,17 +1,26 @@
 {
   "name": "@stratum-hq/db-adapters",
-  "version": "1.2.0",
-  "description": "Stratum PostgreSQL adapters for tenant-scoped query isolation",
+  "version": "1.4.0",
+  "description": "Multi-tenant PostgreSQL row-level security for pg, Prisma, Drizzle, and Sequelize, plus schema-per-tenant and database-per-tenant isolation",
   "keywords": [
     "multi-tenancy",
+    "multitenancy",
     "multi-tenant",
     "saas",
     "tenant",
     "tenant-isolation",
-    "postgresql",
-    "postgres",
     "row-level-security",
     "rls",
+    "postgresql",
+    "prisma",
+    "drizzle",
+    "drizzle-orm",
+    "sequelize",
+    "pg",
+    "node-postgres",
+    "schema-per-tenant",
+    "database-per-tenant",
+    "postgres",
     "schema-isolation",
     "database",
     "stratum"
@@ -22,6 +31,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./pglite": {
+      "types": "./dist/pglite/index.d.ts",
+      "default": "./dist/pglite/index.js"
     }
   },
   "files": [
@@ -41,18 +54,23 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@stratum-hq/core": "^1.4.0",
+    "@stratum-hq/core": "^1.5.1",
     "pg": "^8.11.0"
   },
   "peerDependencies": {
+    "@electric-sql/pglite": "^0.4.2",
     "drizzle-orm": ">=0.29.0"
   },
   "peerDependenciesMeta": {
+    "@electric-sql/pglite": {
+      "optional": true
+    },
     "drizzle-orm": {
       "optional": true
     }
   },
   "devDependencies": {
+    "@electric-sql/pglite": "^0.4.6",
     "@prisma/client": "^5.10.0",
     "@types/pg": "^8.11.0",
     "drizzle-orm": "^0.45.3",
@@ -61,7 +79,7 @@
   },
   "license": "MIT",
   "author": "Christian Crank",
-  "homepage": "https://github.com/stratum-hq/Stratum/tree/main/packages/db-adapters#readme",
+  "homepage": "https://docs.stratum-hq.org/packages/db-adapters/",
   "bugs": "https://github.com/stratum-hq/Stratum/issues",
   "engines": {
     "node": ">=20.0.0"