@wtfalch/authz-store 0.3.0 → 0.4.0

package/README.md

@@ -235,9 +235,10 @@ cycle; a later issue in the people repo makes it reuse this copy rather than
 carry its own. Every row helper is exported under a name distinct from its
 policy-layer counterpart (`insertMembershipRow`, `deleteMembershipRow`,
 `changeRoleRow`, `guardStaysHeldRow`, `membersOfRow`), since the two layers
-would otherwise claim the same five names on one package surface; none of
-the five is part of this package's public surface, since nothing outside
-`src/memberships.ts` needs them. `identityWhere` is not duplicated: people's
+would otherwise claim the same five names on one package surface. As of
+0.4.0 (https://github.com/wtfalch/people/issues/16) all five are exported
+from the main entry, so `@wtfalch/people` can call this copy instead of
+carrying its own — see the 0.4.0 note below. `identityWhere` is not duplicated: people's
 own copy tests the same three columns as `src/assignments.ts`'s, in a
 different argument order `and()` doesn't care about, so `membership-rows.ts`
 imports that one. `roster.js`'s `profiles` left join (a member with no
@@ -326,7 +327,7 @@ otf, not moved.
 Wave 11d (authz#83) moves Boule's own `src/lib/authz/erase.ts`, `alerts.ts`
 and `startup.ts` into `src/erase.ts`, `src/alerts.ts` and `src/startup.ts`.
 `erase.ts` moves `pseudonymFor` and `erasePerson`, the one sanctioned write
-to `authz_events`; the SQL function it calls (`erase_person`, `SECURITY
+to `authz_events`; the SQL function it calls (`authz_erase_person`, `SECURITY
 DEFINER`, a pinned `search_path`) ships as `migrations/0006_erase_person.sql`,
 sweeping `authz_events` and `invitations` the way Boule's
 `drizzle/0008_erasure_and_boot.sql` did. Boule's own function also scrubbed
@@ -346,6 +347,26 @@ to check simply does not call it, rather than this framework-neutral package
 reading `process.env` to decide the same thing for itself — and its
 `housekeeping` becomes a second structural port, `HousekeepingRegistry`.
 
+0.4.0 (authz#83 round 2, files#112): `loadAccess`'s credential-chain walk in
+`src/policy-access.ts` now selects only `issuerId`, `issuerClass`, `expiresAt`
+and `revokedAt` off `credentials`, instead of every column. files and ai
+dropped `secret_hash`, `secret_prefix` and `keys_issued_id` on purpose, and a
+plain `select()` there named them anyway, failing every service-credential
+request with "column does not exist". `export.ts`, `person-records.ts` and
+`credentials.ts` already select explicit column lists and were left as they
+are: each genuinely needs the secret/keys column it names (an export row's
+`secretPrefix`, a revoke's `keysIssuedId`, `credentialsFor`'s display
+`secretPrefix`), so narrowing further would break them, not fix them.
+
+0.4.0 also renames the SQL function `migrations/0006_erase_person.sql`
+creates, from `erase_person` to `authz_erase_person`. The old name collided
+with each host's own erasure function of the same name and signature, which
+also scrubs a host's `profiles`; `migrateStore`'s `CREATE OR REPLACE FUNCTION`
+replaced a host's function outright, silently dropping that scrub. 0.3.0
+published an hour before this fix and no persistent database had applied
+0006 yet, so this is a same-file rename, not a new numbered migration.
+`src/erase.ts` calls `authz_erase_person`.
+
 The rest of the host layer has not moved — tracked in
 https://github.com/wtfalch/authz/issues/83.
 
@@ -361,6 +382,43 @@ the tables from the drizzle definitions. `src/migrate.test.ts` applies the
 shipped SQL instead and fails when the two disagree on a column, a type,
 nullability or an index name.
 
+## 0.4.0
+
+`StoreBinding` (`src/binding.ts`) gains `hostEvents?: readonly string[]`: a host's own audit
+event names (archon: `flag.changed`, `cms.published`, `key.rotated`; files/ai/integrations:
+`mail.*`, `storage.*`, `integrations.*`), beyond `@wtfalch/authz`'s core events, so a host writes
+its own events through the same `record`/`recordAs`/`writeServiceEvent` path core events use,
+never a second one of its own (authz#83, archon#72). `definePolicy(data, binding)` accepts
+`hostEvents` in `binding` and carries it onto the returned `StorePolicy`; a `hostEvents` name that
+repeats a core event name is a configuration error and `definePolicy` throws. `recordAs` and
+`writeServiceEvent` each gain an optional trailing `binding` parameter, since neither had one to
+read `hostEvents` off before.
+
+`EventInput.action` (on `record`, `recordAs` and `writeServiceEvent`) is now `EventName |
+(string & {})`: core names still autocomplete, and any other string is accepted only when it is
+listed in the binding's `hostEvents`; anything else throws before the row is built any further,
+naming the action. **The store's own baseline `authz_events_action_check` constraint still lists
+core events only** — this package's migrations are unchanged. A host that adopts `hostEvents` must
+widen that CHECK in its own migration first (hosts that don't adopt keep their existing
+constraint as-is).
+
+0.4.0 (authz#83 round 2) adds a `./policy` subpath export
+(https://github.com/wtfalch/boule/pull/162): `definePolicy` plus `StorePolicy`,
+`StoreBinding`, `PolicyData` and `PolicyRoleTemplate`, and nothing else, for a
+client component that only needs the policy catalogue for permission labels.
+The main entry (`.`) still exports everything it does today — this is
+additive — but it also drags in `migrateStore`, which imports
+`node:fs/promises` and breaks a production client build; `./policy`'s import
+graph is proved free of any `node:` module, `drizzle-orm` or a database handle
+by `scripts/tests/package-contract.test.mjs`. 0.4.0 also exports the five
+membership row helpers from `src/membership-rows.ts` off the main entry —
+`insertMembershipRow`, `deleteMembershipRow`, `changeRoleRow`,
+`guardStaysHeldRow`, `membersOfRow` — so `@wtfalch/people` can call this
+package's copy instead of carrying its own
+(https://github.com/wtfalch/people/issues/16). No behaviour change: each
+helper writes an audit row only when a `MembershipRowAuditOptions` writer is
+passed, exactly as before.
+
 ## Migrations
 
 The package ships its own SQL in `migrations/`, and `migrateStore(db)` applies

package/dist/audit.d.ts

@@ -1,4 +1,5 @@
 import { type ActorClass, type Context, type EventName, type Outcome } from '@wtfalch/authz';
+import type { StoreBinding } from './binding.js';
 import type { DbOrTx } from './scoped.js';
 import type { Access, Principal } from './types.js';
 /**
@@ -6,6 +7,10 @@ import type { Access, Principal } from './types.js';
  * context, the session, the timestamp, the schema version) is filled in by
  * `record`, `recordAs` or `writeServiceEvent` below, never by the caller, so
  * a feature module cannot sign a row as someone it is not (D9).
+ *
+ * `action` accepts a core `EventName` (still autocompletes) or any other
+ * string (0.4.0): a host's own event, checked at write time against the
+ * `hostEvents` on the binding reachable from the call — see `insertEvent`.
  */
 export interface EventInput {
     readonly teamId?: string;
@@ -13,7 +18,7 @@ export interface EventInput {
         readonly id: string;
         readonly class: ActorClass;
     };
-    readonly action: EventName;
+    readonly action: EventName | (string & {});
     readonly tenantId: string | null;
     readonly targetType: string;
     readonly targetId: string;
@@ -50,20 +55,28 @@ export declare function record(tx: DbOrTx, access: Access, input: EventInput): P
  * resolves nothing before the tenant row exists, so there is no membership
  * to build one from. Never carries a break-glass session, because there is
  * no session without an `Access` to hold it.
+ *
+ * `binding` (0.4.0) is optional because every call inside this package
+ * writes a core event; it exists so a caller recording its own host event
+ * through `recordAs` (there is no `Access` here to read one from, unlike
+ * `record`) can pass whatever `StoreBinding` it has in scope.
  */
-export declare function recordAs(tx: DbOrTx, actor: Principal, context: Context, input: EventInput): Promise<void>;
+export declare function recordAs(tx: DbOrTx, actor: Principal, context: Context, input: EventInput, binding?: StoreBinding): Promise<void>;
 /**
  * The bootstrap, migration, deploy and job rows: written as `service`, never
  * as a person or a credential, because nothing signed in to cause them.
  * `context` defaults to `standard`; pass `'operator'` for a row about the
  * operator tenant specifically (an operator-only system role changing, say).
+ *
+ * `binding` (0.4.0): this function had no binding parameter before, so one
+ * is added here, optional, for a caller recording its own host event.
  */
 export declare function writeServiceEvent(tx: DbOrTx, actor: {
     readonly id: string;
     readonly display: string;
 }, input: EventInput & {
     readonly context?: 'standard' | 'operator';
-}): Promise<void>;
+}, binding?: StoreBinding): Promise<void>;
 /** One row of the tenant's own security log, already narrowed to what the tenant may see. */
 export interface SecurityLogEntry {
     readonly id: number;

package/dist/audit.js

@@ -2,6 +2,14 @@ import { authzEventSchema, core, tenantVisibleByDefault, } from '@wtfalch/authz'
 import { and, desc, eq, lt, or } from 'drizzle-orm';
 import { permitsRead } from './policy-access.js';
 import { authzEvents } from './schema.js';
+/** The core event list as a plain set, for a fast membership check against a caller's action. */
+const CORE_EVENTS = new Set(core.events);
+/**
+ * Any one core event name, used only to stand in for a validated host action
+ * when `insertEvent` asks `authzEventSchema` to check every other field
+ * (see the comment there) — never written to a row.
+ */
+const FIRST_CORE_EVENT = core.events[0];
 /**
  * The one place a row actually gets built and inserted. Every field the
  * schema requires is filled in here, the candidate row is validated with
@@ -13,8 +21,25 @@ import { authzEvents } from './schema.js';
  * inside a transaction; callers that need this row atomic with another
  * write (which is every authority write except a service log) pass their
  * own transaction through.
+ *
+ * `hostEvents` (0.4.0) is the calling binding's own event names, beyond the
+ * core list. `action` is accepted when it is a core event or listed in
+ * `hostEvents`; anything else throws here, before `row` is built any
+ * further and before anything reaches `tx.insert`, naming the action in the
+ * message. `authzEventSchema`'s own `action` field only knows the core
+ * list (it lives in `@wtfalch/authz`, which has no notion of a host's
+ * vocabulary), so once a host action has passed the membership check above,
+ * the schema is asked to validate a copy of `row` with `action` swapped for
+ * an arbitrary core event — every other field is still validated exactly as
+ * `authzEventSchema` does today, and the swapped value is never the one
+ * written; `row.action` (the real value) is what actually reaches the insert
+ * below.
  */
-async function insertEvent(tx, actor, context, sessionId, input) {
+async function insertEvent(tx, actor, context, sessionId, input, hostEvents) {
+    const isCoreAction = CORE_EVENTS.has(input.action);
+    if (!isCoreAction && !hostEvents?.includes(input.action)) {
+        throw new Error(`unknown audit action "${input.action}": not a core event and not listed in this binding's hostEvents`);
+    }
     const occurredAt = new Date();
     const row = {
         occurred_at: occurredAt.toISOString(),
@@ -33,13 +58,17 @@ async function insertEvent(tx, actor, context, sessionId, input) {
         request_id: input.request?.id ?? null,
         ip: input.request?.ip ?? null,
         user_agent: input.request?.userAgent ?? null,
+        // A host event is outside the core `tenantVisible` list by construction
+        // (`tenantVisibleByDefault` only knows core `EventName`s), so it defaults
+        // to false unless the caller says otherwise; the cast is safe because the
+        // function only ever does a `Set.has` lookup against a plain string.
         tenant_visible: input.tenantVisible ?? tenantVisibleByDefault(input.action),
         before: input.before ?? null,
         after: input.after ?? null,
         erased_at: null,
         schema_version: core.version,
     };
-    authzEventSchema.parse(row);
+    authzEventSchema.parse(isCoreAction ? row : { ...row, action: FIRST_CORE_EVENT });
     await tx.insert(authzEvents).values({
         occurredAt,
         tenantId: row.tenant_id,
@@ -93,26 +122,34 @@ export async function record(tx, access, input) {
             reference: input.reference ?? grant.reference,
         }
         : input;
-    await insertEvent(tx, { class: access.actor.class, id: access.actor.id, display: access.actor.display }, access.context, access.breakGlass?.id ?? null, withSession);
+    await insertEvent(tx, { class: access.actor.class, id: access.actor.id, display: access.actor.display }, access.context, access.breakGlass?.id ?? null, withSession, access.binding.hostEvents);
 }
 /**
  * The same insert for a write with no `Access` yet: self-serve `createTenant`
  * resolves nothing before the tenant row exists, so there is no membership
  * to build one from. Never carries a break-glass session, because there is
  * no session without an `Access` to hold it.
+ *
+ * `binding` (0.4.0) is optional because every call inside this package
+ * writes a core event; it exists so a caller recording its own host event
+ * through `recordAs` (there is no `Access` here to read one from, unlike
+ * `record`) can pass whatever `StoreBinding` it has in scope.
  */
-export async function recordAs(tx, actor, context, input) {
-    await insertEvent(tx, { class: actor.class, id: actor.id, display: actor.display }, context, null, input);
+export async function recordAs(tx, actor, context, input, binding) {
+    await insertEvent(tx, { class: actor.class, id: actor.id, display: actor.display }, context, null, input, binding?.hostEvents);
 }
 /**
  * The bootstrap, migration, deploy and job rows: written as `service`, never
  * as a person or a credential, because nothing signed in to cause them.
  * `context` defaults to `standard`; pass `'operator'` for a row about the
  * operator tenant specifically (an operator-only system role changing, say).
+ *
+ * `binding` (0.4.0): this function had no binding parameter before, so one
+ * is added here, optional, for a caller recording its own host event.
  */
-export async function writeServiceEvent(tx, actor, input) {
+export async function writeServiceEvent(tx, actor, input, binding) {
     const { context = 'standard', ...rest } = input;
-    await insertEvent(tx, { class: 'service', id: actor.id, display: actor.display }, context, null, rest);
+    await insertEvent(tx, { class: 'service', id: actor.id, display: actor.display }, context, null, rest, binding?.hostEvents);
 }
 /**
  * The tenant's own security log: what happened to this organisation's

package/dist/binding.d.ts

@@ -8,6 +8,15 @@ import type { PolicyBinding } from './owners.js';
  */
 export interface StoreBinding extends PolicyBinding {
     readonly catalogue: ResourceCatalogue;
+    /**
+     * The host's own audit event names, beyond `@wtfalch/authz`'s core events (0.4.0). A host
+     * records its own events (archon: `flag.changed`, `cms.published`, `key.rotated`; files/ai/
+     * integrations: `mail.*`, `storage.*`, `integrations.*`) through the same `record`/`recordAs`/
+     * `writeServiceEvent` write path core events use, rather than a second one of its own. The
+     * store's own baseline `authz_events_action_check` constraint lists core events only; a host
+     * that lists names here must widen that check in its own migration.
+     */
+    readonly hostEvents?: readonly string[];
 }
 /**
  * The one lookup every moved module did as `catalogue[permission]`. A tiny helper rather than

package/dist/erase.d.ts

@@ -48,7 +48,7 @@ export interface ErasureHost {
  * record of what happened, and rewriting it is exactly that.
  *
  * One transaction, in this order and never the other way round: the sweep
- * through `erase_person` and `host.eraseHostRecords` first, then the
+ * through `authz_erase_person` and `host.eraseHostRecords` first, then the
  * `person.erased` audit row. Writing the event first would make it a
  * candidate for its own sweep the moment the erased subject is the
  * operator's own id (self-erasure), since the sweep matches on `actor_id`,

package/dist/erase.js

@@ -6,7 +6,7 @@ import { done, refused } from './types.js';
 /**
  * The single sanctioned write to `authz_events` (D9, X6 M3, Tests 29).
  *
- * `migrations/0006_erase_person.sql`'s `erase_person` is a `SECURITY
+ * `migrations/0006_erase_person.sql`'s `authz_erase_person` is a `SECURITY
  * DEFINER` function owned by the migration role: the runtime role has no
  * UPDATE on `authz_events` at all (0001's grants), and a trigger refuses any
  * UPDATE on that table touching a column outside `actor_display`, `before`,
@@ -62,7 +62,7 @@ function rowsOf(result) {
  * record of what happened, and rewriting it is exactly that.
  *
  * One transaction, in this order and never the other way round: the sweep
- * through `erase_person` and `host.eraseHostRecords` first, then the
+ * through `authz_erase_person` and `host.eraseHostRecords` first, then the
  * `person.erased` audit row. Writing the event first would make it a
  * candidate for its own sweep the moment the erased subject is the
  * operator's own id (self-erasure), since the sweep matches on `actor_id`,
@@ -90,7 +90,7 @@ export async function erasePerson(operatorAccess, db, scopeColumn, principalId,
         // this needs the address rather than only the actor id.
         const rawEmail = await host.emailOf(tx, principalId);
         const subjectEmail = rawEmail?.trim().toLowerCase() ?? null;
-        const result = await tx.execute(sql `select erase_person(${principalId}, ${pseudonym}, ${subjectEmail}) as touched`);
+        const result = await tx.execute(sql `select authz_erase_person(${principalId}, ${pseudonym}, ${subjectEmail}) as touched`);
         const [row] = rowsOf(result);
         const rowsErased = Number(row?.touched ?? 0);
         // The host's own personal-data tables: `profiles` and whatever an

package/dist/index.d.ts

@@ -38,3 +38,4 @@ export { archiveTeam, assignAppRole, changeTeamParticipant, deleteAppRole, remov
 export { exportTenant, type ExportActor, type ExportedAttachProposal, type ExportedAuditRow, type ExportedCredential, type ExportedInvitation, type ExportedMembership, type ExportedRole, type ExportedTenant, } from './export.js';
 export { eventsFor, type EventPage, type EventsForOptions, type EventSummary, } from './events.js';
 export { platformFrozen, setPlatformFrozen } from './platform.js';
+export { changeRoleRow, deleteMembershipRow, guardStaysHeldRow, insertMembershipRow, membersOfRow, type ChangeRoleRowInput, type ChangeRoleRowResult, type DeleteMembershipRowInput, type DeleteMembershipRowResult, type InsertMembershipRowInput, type InsertMembershipRowResult, type MembershipRosterRow, type MembershipRowAuditActor, type MembershipRowAuditEvent, type MembershipRowAuditOptions, } from './membership-rows.js';

package/dist/index.js

@@ -38,3 +38,4 @@ export { archiveTeam, assignAppRole, changeTeamParticipant, deleteAppRole, remov
 export { exportTenant, } from './export.js';
 export { eventsFor, } from './events.js';
 export { platformFrozen, setPlatformFrozen } from './platform.js';
+export { changeRoleRow, deleteMembershipRow, guardStaysHeldRow, insertMembershipRow, membersOfRow, } from './membership-rows.js';

package/dist/policy-access.js

@@ -277,8 +277,17 @@ export async function loadAccess(tx, binding, db, scopeColumn, principal, tenant
             if (visited.has(`${cursor.class}:${cursor.id}`) || visited.size >= 32)
                 return null;
             visited.add(`${cursor.class}:${cursor.id}`);
+            // Narrow to the columns this walk reads: a service-credential chain
+            // never needs `secretHash`/`secretPrefix`/`keysIssuedId`, and a host
+            // that dropped those columns (files, ai) would otherwise fail every
+            // request through this path with "column does not exist".
             const [credential] = await tx
-                .select()
+                .select({
+                issuerId: credentials.issuerId,
+                issuerClass: credentials.issuerClass,
+                expiresAt: credentials.expiresAt,
+                revokedAt: credentials.revokedAt,
+            })
                 .from(credentials)
                 .where(and(eq(credentials.id, cursor.id), eq(credentials.kind, cursor.class)))
                 .limit(1);

package/dist/policy-entry.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `@wtfalch/authz-store/policy` — a client-safe subpath for `definePolicy` and the types its
+ * signature needs. The main entry (`.`) re-exports `migrateStore`, which imports
+ * `node:fs/promises`, so a client component that only reads the policy catalogue for permission
+ * labels cannot import from `.` without pulling Node into a production browser build
+ * (https://github.com/wtfalch/boule/pull/162). Nothing this module imports, directly or
+ * transitively, may import a `node:` module, `drizzle-orm`, or a database handle — proved by
+ * `scripts/tests/package-contract.test.mjs`.
+ */
+export { definePolicy, type PolicyData, type PolicyRoleTemplate, type StorePolicy, } from './policy.js';
+export type { StoreBinding } from './binding.js';

package/dist/policy-entry.js

@@ -0,0 +1,10 @@
+/**
+ * `@wtfalch/authz-store/policy` — a client-safe subpath for `definePolicy` and the types its
+ * signature needs. The main entry (`.`) re-exports `migrateStore`, which imports
+ * `node:fs/promises`, so a client component that only reads the policy catalogue for permission
+ * labels cannot import from `.` without pulling Node into a production browser build
+ * (https://github.com/wtfalch/boule/pull/162). Nothing this module imports, directly or
+ * transitively, may import a `node:` module, `drizzle-orm`, or a database handle — proved by
+ * `scripts/tests/package-contract.test.mjs`.
+ */
+export { definePolicy, } from './policy.js';

package/dist/policy.d.ts

@@ -57,8 +57,15 @@ export interface StorePolicy extends StoreBinding {
  * Builds a `StorePolicy` from a host's own `policy-catalogue.json` data and its
  * `{ applicationId, platformId }`. Generic over the host's data because every host's catalogue
  * differs; this function is the one piece of that shape both applications wrote identically.
+ *
+ * `binding.hostEvents` (0.4.0), when given, is carried onto the returned `StorePolicy` unchanged
+ * so `record`/`recordAs`/`writeServiceEvent` can validate a host's own audit actions against it.
+ * A name in `hostEvents` that repeats a core event name is a configuration error — it would make
+ * an audit row ambiguous about which vocabulary it came from — so this throws rather than let it
+ * pass silently.
  */
 export declare function definePolicy(data: PolicyData, binding: {
     readonly applicationId: string;
     readonly platformId: string;
+    readonly hostEvents?: readonly string[];
 }): StorePolicy;

package/dist/policy.js

@@ -1,10 +1,22 @@
-import { defineResourceCatalogue, } from '@wtfalch/authz';
+import { core, defineResourceCatalogue, } from '@wtfalch/authz';
 /**
  * Builds a `StorePolicy` from a host's own `policy-catalogue.json` data and its
  * `{ applicationId, platformId }`. Generic over the host's data because every host's catalogue
  * differs; this function is the one piece of that shape both applications wrote identically.
+ *
+ * `binding.hostEvents` (0.4.0), when given, is carried onto the returned `StorePolicy` unchanged
+ * so `record`/`recordAs`/`writeServiceEvent` can validate a host's own audit actions against it.
+ * A name in `hostEvents` that repeats a core event name is a configuration error — it would make
+ * an audit row ambiguous about which vocabulary it came from — so this throws rather than let it
+ * pass silently.
  */
 export function definePolicy(data, binding) {
+    const coreEvents = new Set(core.events);
+    for (const name of binding.hostEvents ?? []) {
+        if (coreEvents.has(name)) {
+            throw new Error(`definePolicy: hostEvents "${name}" collides with a core event name; a host event must not reuse one`);
+        }
+    }
     const namespaces = [
         ...new Set(Object.keys(data.permissions).map((key) => key.split(/[.:]/)[0])),
     ];
@@ -46,6 +58,7 @@ export function definePolicy(data, binding) {
         applicationId: binding.applicationId,
         platformId: binding.platformId,
         catalogue,
+        hostEvents: binding.hostEvents,
         defaultCeiling: data.defaultCeiling,
         maxDepth: data.maxDepth,
         elevated: new Set(data.elevated),

package/migrations/0006_erase_person.sql

@@ -9,8 +9,17 @@
 --
 -- Additive, per every other file in this directory: never edit this file
 -- once shipped, a change is a new numbered one.
+--
+-- 0.4.0 note: this function was originally named `erase_person`, the same
+-- name and signature as each host's own erasure function (the one that also
+-- scrubs `profiles`). `migrateStore` replaces a same-named function outright,
+-- so applying this migration silently dropped a host's own `profiles` scrub.
+-- Renamed here to `authz_erase_person` before any persistent database ever
+-- applied it: 0.3.0 published an hour before this fix, and no host had run
+-- this migration against a real database yet, so this is a same-file rename,
+-- not a new numbered migration.
 
--- ------------------------------------------------------- erase_person(...)
+-- ----------------------------------------------- authz_erase_person(...)
 -- The single sanctioned write to `authz_events` (D9, M3).
 --
 -- Two walls stand between the running app and its own audit log, and this
@@ -40,7 +49,7 @@
 -- unqualified name through the caller's `search_path` runs whatever they put
 -- in front of it, with the owner's privileges, which is the standard way
 -- this feature becomes a privilege escalation.
-CREATE OR REPLACE FUNCTION "erase_person"("subject" text, "pseudonym" text, "subject_email" text)
+CREATE OR REPLACE FUNCTION "authz_erase_person"("subject" text, "pseudonym" text, "subject_email" text)
 RETURNS integer
 LANGUAGE plpgsql
 SECURITY DEFINER
@@ -50,10 +59,10 @@ DECLARE
   touched integer;
 BEGIN
   IF "subject" IS NULL OR length("subject") = 0 THEN
-    RAISE EXCEPTION 'erase_person: a subject id is required';
+    RAISE EXCEPTION 'authz_erase_person: a subject id is required';
   END IF;
   IF "pseudonym" IS NULL OR length("pseudonym") = 0 OR length("pseudonym") > 256 THEN
-    RAISE EXCEPTION 'erase_person: a pseudonym of 1 to 256 characters is required';
+    RAISE EXCEPTION 'authz_erase_person: a pseudonym of 1 to 256 characters is required';
   END IF;
 
   -- Rows this person WROTE, and rows written ABOUT them.
@@ -115,7 +124,7 @@ $$;
 -- runtime role may be handed this one without gaining any other access to
 -- the table. Revoked from PUBLIC first, since Postgres grants EXECUTE on a
 -- new function to PUBLIC by default.
-REVOKE ALL ON FUNCTION "erase_person"(text, text, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION "authz_erase_person"(text, text, text) FROM PUBLIC;
 --> statement-breakpoint
 
 -- The store has no runtime-role convention of its own, unlike Boule's fixed
@@ -128,7 +137,7 @@ DECLARE
   rt text := current_database() || '_rt';
 BEGIN
   IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = rt) THEN
-    EXECUTE format('GRANT EXECUTE ON FUNCTION "erase_person"(text, text, text) TO %I', rt);
+    EXECUTE format('GRANT EXECUTE ON FUNCTION "authz_erase_person"(text, text, text) TO %I', rt);
   END IF;
 END
 $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/authz-store",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Persistence and lifecycle for @wtfalch/authz: the storage a host would otherwise write itself.",
   "type": "module",
   "files": [
@@ -13,6 +13,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./policy": {
+      "types": "./dist/policy-entry.d.ts",
+      "default": "./dist/policy-entry.js"
+    },
     "./package.json": "./package.json"
   },
   "peerDependencies": {