@wtfalch/authz-store 0.4.0 → 0.6.0

package/README.md

@@ -15,10 +15,24 @@ package rather than a subpath on the engine.
 
 ## Status
 
-**Published.** `@wtfalch/authz-store` is on npm at 0.2.1. "Depend" here means a
-pin in that host's `package.json`, not a verified deployment: Boule (`manage`)
-pins 0.2.1, `people` pins 0.2.1, and otf's `web/` pins 0.2.0. archon still carries its own copy of
-this layer, unmoved.
+**Published at 0.4.0; host adoption is incomplete.** Checked on 2026-09-30
+against the npm registry (latest 0.4.0, shasum
+`9305f37cc20d79a469cbaacde80990e295ebc2df`) and the repository manifest.
+The registry exports both the main entry and the client-safe `./policy` entry.
+Extraction waves 1–11 are implemented in this package; publishing issues
+[#123](https://github.com/wtfalch/authz/issues/123) and
+[#128](https://github.com/wtfalch/authz/issues/128) are closed.
+
+Current host pins and remaining adoption work are recorded in the
+[shared persistence map](../../docs/shared-persistence-map.md#current-status-2026-09-30).
+A manifest pin establishes a source dependency, not a deployment or full
+adoption. Archon pins 0.4.0 and has merged wave 1, with a local access-loader
+exception pending [#130](https://github.com/wtfalch/authz/issues/130). Boule
+pins 0.2.1, OTF `web/` pins 0.2.0, and the people package pins 0.2.1.
+
+The following wave notes describe the extraction steps in order. References
+to modules being host-side at a particular wave describe that step, not the
+current adoption status of every host.
 
 Moved so far: credential secrets, the `ScopedDb` seam, every table definition,
 `ownerCoverage`, wave 1 (authz#83): `StoreBinding` (the `applicationId`,
@@ -114,7 +128,8 @@ same helper otf already used, in place of the `(error as {code?}).code ===
 '23505'` duck-typing Boule's and archon's copies both wrote — declared as a
 peer dependency, matching `drizzle-orm`'s role (a host-supplied instance),
 pinned exact at `0.4.0` (the estate's `@wtfalch/*` pin rule), plus a matching
-exact `devDependency` for this package's own build and test.
+exact `devDependency` for this package's own build and test. From 0.6.0 the
+peer is the range `>=0.5.2 <0.6.0` and the `devDependency` is exact `0.5.2`.
 
 Wave 7 (authz#83, authz#95 decision 2, authz#98) moves `credentials.ts`
 (`mintCredential`, `revokeCredential`, `credentialsFor`) and `bootstrap.ts`
@@ -361,14 +376,15 @@ are: each genuinely needs the secret/keys column it names (an export row's
 0.4.0 also renames the SQL function `migrations/0006_erase_person.sql`
 creates, from `erase_person` to `authz_erase_person`. The old name collided
 with each host's own erasure function of the same name and signature, which
-also scrubs a host's `profiles`; `migrateStore`'s `CREATE OR REPLACE FUNCTION`
+also scrubs a host's `profiles`; the migration's `CREATE OR REPLACE FUNCTION`
 replaced a host's function outright, silently dropping that scrub. 0.3.0
 published an hour before this fix and no persistent database had applied
 0006 yet, so this is a same-file rename, not a new numbered migration.
 `src/erase.ts` calls `authz_erase_person`.
 
-The rest of the host layer has not moved — tracked in
-https://github.com/wtfalch/authz/issues/83.
+Extraction is complete through wave 11. Remaining host adoption and the
+resource-resolution extension are tracked in
+https://github.com/wtfalch/authz/issues/83 and the current-status map above.
 
 New here, not moved: `authz_grants`, grants stored per person rather than
 compiled from a role, and `guestGrants`, which reads a tenant's guest grants
@@ -377,10 +393,13 @@ have `expires_at`. Chat reads this to act on expiry; see
 https://github.com/wtfalch/authz/issues/42.
 
 Tests run against a real Postgres — PGlite, compiled to wasm and started in the
-test process — so no container, service or network is needed. Most tests build
-the tables from the drizzle definitions. `src/migrate.test.ts` applies the
-shipped SQL instead and fails when the two disagree on a column, a type,
-nullability or an index name.
+test process — so no container, service or network is needed. Every test applies
+the shipped SQL through `@wtfalch/db`'s `runMigrationSources`, and
+`src/migrate.test.ts` fails when that SQL and the drizzle definitions disagree on
+a column, a type, nullability or an index name. Set `TEST_DATABASE_URL` to run the
+same suite on a real Postgres, each test file in its own uniquely named schema,
+dropped afterwards; roles, grants and the nested-transaction savepoint path are
+tested only there.
 
 ## 0.4.0
 
@@ -407,8 +426,8 @@ constraint as-is).
 `StoreBinding`, `PolicyData` and `PolicyRoleTemplate`, and nothing else, for a
 client component that only needs the policy catalogue for permission labels.
 The main entry (`.`) still exports everything it does today — this is
-additive — but it also drags in `migrateStore`, which imports
-`node:fs/promises` and breaks a production client build; `./policy`'s import
+additive — but it also drags in `node:crypto` and `drizzle-orm`, which break
+a production client build; `./policy`'s import
 graph is proved free of any `node:` module, `drizzle-orm` or a database handle
 by `scripts/tests/package-contract.test.mjs`. 0.4.0 also exports the five
 membership row helpers from `src/membership-rows.ts` off the main entry —
@@ -421,11 +440,87 @@ passed, exactly as before.
 
 ## Migrations
 
-The package ships its own SQL in `migrations/`, and `migrateStore(db)` applies
-it. Run it before the app's own migrations, so every table the package owns
-exists before an app migration references it. Each file runs once, in one
-transaction, and is recorded in `authz_store_migrations`. Never edit a shipped
-file; a change is a new numbered one.
+The package ships its own SQL in `migrations/` and applies none of it: the host
+does, with `runMigrationSources` from `@wtfalch/db/migrate` (0.5.2 or later), before its
+own migrations, so every table the package owns exists before a host migration
+references it. The directory comes from the subpath
+`@wtfalch/authz-store/migrations-dir`, which imports only `node:url`, so a
+migration image or a bundler never loads the main entry for it:
+
+```ts
+import { runMigrationSources } from '@wtfalch/db/migrate';
+import { migrationsDir } from '@wtfalch/authz-store/migrations-dir';
+
+const ownerUrl = process.env.DATABASE_URL_OWNER;
+if (!ownerUrl) throw new Error('DATABASE_URL_OWNER is required');
+
+await runMigrationSources({
+  url: ownerUrl,
+  schema: 'myservice',
+  sources: [
+    { name: 'authz-store', dir: migrationsDir },
+    { name: 'app', dir: 'drizzle' },
+  ],
+});
+```
+
+Each file runs once, in one transaction, and is recorded with its checksum in
+`_migrations_sources` in the host's schema. Never edit a shipped file; a change
+is a new numbered one. The SQL names no schema: the host's `schema` decides
+where the tables land. The runtime connection puts that schema on its
+`search_path`, and `ensureRuntimeRole({ schemas: ['myservice'] })` covers it.
+`authz_erase_person` is a `SECURITY DEFINER` function that pins the
+`search_path` of the migration run; the runtime role needs EXECUTE on it, which
+the host grants (see below). Migrate with `@wtfalch/db` 0.5.2 or later: 0.5.0
+and 0.5.1 let a temp table shadow the store's tables inside that function.
+
+### Moving from 0.5
+
+Before, `migrateStore(db)` applied the SQL on the host's one database and
+recorded it in `authz_store_migrations`, and the host ran a grant for
+`authz_erase_person` (or named its runtime role `<database>_rt`):
+
+```ts
+import { migrateStore } from '@wtfalch/authz-store';
+
+await migrateStore(db);
+```
+
+After, with the owner credential, a schema, the store's source first, and the
+grant on `ensureRuntimeRole`:
+
+```ts
+import { runMigrationSources } from '@wtfalch/db/migrate';
+import { ensureRuntimeRole } from '@wtfalch/db/runtime-role';
+import { migrationsDir } from '@wtfalch/authz-store/migrations-dir';
+
+const ownerUrl = process.env.DATABASE_URL_OWNER;
+const runtimeUrl = process.env.DATABASE_URL;
+if (!ownerUrl || !runtimeUrl) throw new Error('DATABASE_URL_OWNER and DATABASE_URL are required');
+
+await runMigrationSources({
+  url: ownerUrl,
+  schema: 'myservice',
+  sources: [
+    { name: 'authz-store', dir: migrationsDir },
+    { name: 'app', dir: 'drizzle' },
+  ],
+});
+await ensureRuntimeRole({
+  ownerUrl,
+  runtimeUrl,
+  schemas: ['myservice'],
+  grants: ['myservice.authz_erase_person(text,text,text)'],
+});
+// Runtime connection: createDatabase({ url, searchPath: ['myservice', 'public'] })
+```
+
+`migrateStore` and its `authz_store_migrations` table are gone; a database that
+used them keeps a stale table that nothing reads and nothing adopts. 0.6.0
+assumes databases are recreated empty. Pass the native Drizzle handle,
+`withDrizzle(...).orm` or `tx.orm`, to every function, with no cast. Install
+`@wtfalch/db` `>=0.5.2 <0.6.0` yourself: it is a peer dependency (the runtime
+code imports `sqlState` from it).
 
 `0001_baseline.sql` is every store table as manage's live schema had it on
 2026-09-22. Three things stay with each app, because each lists something the
@@ -435,18 +530,28 @@ app owns:
   list that app's offered permissions.
 - The foreign key from `break_glass_sessions.operator_id` to `profiles`.
 
-The baseline is for a new database. manage and otf `web/` already have these
-tables, so each needs a one-off reconciliation: bring the schema to the
-baseline, then insert `0001_baseline.sql` into `authz_store_migrations` by
-hand. otf also lacks `authz_roles.updated_by` and the `'activation'`
-assignment source.
-
-What a host must supply is growing, and it is all explicit: a module that needs
-the host's `APPLICATION_ID` and `PLATFORM_ID` takes them as a `PolicyBinding`
-argument rather than importing them, because the two applications differ there.
-
-The remaining ~12,800 lines, and the one-off migration each application needs to
-adopt them, are not started.
+The baseline is for a new database. An existing host must verify its schema
+and migration history before adopting it. Its reconciliation brings the
+schema to the baseline before recording `0001_baseline.sql` in
+`_migrations_sources`; it must preserve runtime-role privileges and the
+host-specific constraints above. The historical map records OTF's missing
+`authz_roles.updated_by` and `'activation'` assignment source; verify these
+against the host being migrated rather than assuming that snapshot is current.
+
+Version 0.4.0 creates `authz_erase_person`, keeping host erasure separate.
+A host whose database already recorded an older `0006_erase_person.sql` must
+check which function was installed: changing a dependency pin does not replay
+an applied migration. Reconcile with a new additive host migration and retain
+host-owned profile/reporting scrubs. Boule's upgrade prerequisite is tracked
+in [boule#163](https://github.com/wtfalch/boule/issues/163). No deployed migration
+history was inspected for this status update.
+
+Hosts pass their application id, platform id and catalogue through
+`StoreBinding`/`StorePolicy`; the store does not import host constants.
+
+The remaining work is adoption of the extracted modules, host resource-resolution
+support and each host's verified reconciliation. Follow the current-status map
+and host issues; the historical line count is not a current migration estimate.
 
 ## Why it is not part of `@wtfalch/authz`
 
@@ -465,3 +570,43 @@ framework-neutral package cannot import it, so that import is dropped here. A
 host that wants the guard re-exports these functions through its own
 `server-only` module. `generateCredentialSecret` reaching a client bundle is the
 thing worth preventing.
+
+
+## Host resource lookups
+
+`StoreBinding.resolveResource` extends `policyResource`, `loadAccess` and `refreshAccess`
+with authoritative metadata for host-owned resource types (authz#130). The callback receives
+the caller's database transaction and an immutable target containing `applicationId`,
+`platformId`, `organisationId`, `type` and `id`. It returns an `AccessResource` or `undefined`:
+
+```ts
+const policy = definePolicy(catalogueData, {
+  applicationId: APPLICATION_ID,
+  platformId: PLATFORM_ID,
+  resolveResource: async (tx, target) => {
+    if (target.type !== 'files.file') return undefined;
+    // This host function queries its own table using BOTH organisationId and id.
+    const row = await findFile(tx, target.organisationId, target.id);
+    if (!row) return undefined;
+    return {
+      ...target,
+      teamId: row.teamId,
+      owner: { id: row.ownerId, class: row.ownerClass },
+    };
+  },
+});
+```
+
+This callback is trusted server configuration. The host must query authoritative rows
+in the supplied transaction, constrain them to the requested organisation and resource,
+and return `undefined` for missing resources or optional modules. The store rejects a
+result with a different application, platform, organisation, type or id. Lookup errors
+propagate. An unresolved resource cannot establish the team containment needed to
+delegate a team-scoped grant to one resource. Core `team` and `audit`
+lookups keep their store checks and never fall through to the callback.
+
+`definePolicy` retains the callback on the binding, so `refreshAccess` uses it when
+re-reading credential lineage before a mutation. Keep callbacks and their database
+imports in server modules; the `./policy` export remains safe to import for client
+catalogue labels. This API requires the next store release; published 0.4.0 does not
+include it. Host adoption and release remain separate steps under authz#83.

package/dist/activations.js

@@ -108,7 +108,8 @@ function entryBoundary(catalogue, permission, tenantId) {
  * calling `compileRoleGrants`: eligibility only needs to know a permission is
  * *named*, not perform a full grant compile, and a standing custom role can
  * never contain a non-assignable permission in the first place (creating one
- * would already have failed `roleAssignmentRefusal`), so nothing here can
+ * would already have failed `roleAssignmentRefusal`: a custom role has no
+ * guards and is not keyed `owner`), so nothing here can
  * throw the way minting a fresh role below can.
  */
 async function eligibleElevatedPermissions(tx, binding, tenantId, elevated, principal) {
@@ -231,10 +232,10 @@ export async function requestActivation(access, db, scopeColumn, policy, options
         }
         if (refusal !== null) {
             // compileRoleGrants throws for any entry whose permission is
-            // `assignable: false` on a non-built-in role -- see Boule's own
-            // comment (activations.ts): every coApproval permission was one of
-            // these on the package version this file was ported from, so none of
-            // them could be minted into an activation's role either.
+            // `assignable: false` on a role that is neither keyed `owner` nor
+            // guarded by an owner-only permission for an `ownerGuarded` entry. An
+            // activation's minted role is neither, so a permission like that
+            // cannot be minted into one.
             return refused('invalid_role', 'One or more of these permissions cannot yet be granted through a time-boxed activation.');
         }
         await tx.insert(policyRoles).values({

package/dist/binding.d.ts

@@ -1,5 +1,12 @@
-import type { ResourceCatalogue, ResourcePermission } from '@wtfalch/authz';
+import type { AccessResource, ResourceCatalogue, ResourcePermission } from '@wtfalch/authz';
 import type { PolicyBinding } from './owners.js';
+import type { DbOrTx } from './scoped.js';
+/** Exact tenant resource identity requested by the shared access loader. */
+export type ResourceTarget = Pick<AccessResource, 'applicationId' | 'platformId' | 'type' | 'id'> & {
+    readonly organisationId: string;
+};
+/** A trusted host lookup, using the caller's transaction and tenant predicate. */
+export type HostResourceResolver = (tx: DbOrTx, target: ResourceTarget) => Promise<AccessResource | undefined>;
 /**
  * `PolicyBinding` (`applicationId`, `platformId`) plus the host's own resource catalogue. The
  * store has no catalogue of its own — each host defines its own permissions — so every moved
@@ -8,6 +15,14 @@ import type { PolicyBinding } from './owners.js';
  */
 export interface StoreBinding extends PolicyBinding {
     readonly catalogue: ResourceCatalogue;
+    /**
+     * Resolve host-owned resource types for delegation and credential lineage. Return undefined
+     * for an absent module or resource. Query authoritative rows in `tx`, constrained to the
+     * requested organisation and id. Team and audit resources remain store-owned. A result
+     * whose application, platform, organisation, type or id differs from the target is rejected.
+     * Lookup errors propagate; they never confer access.
+     */
+    readonly resolveResource?: HostResourceResolver;
     /**
      * The host's own audit event names, beyond `@wtfalch/authz`'s core events (0.4.0). A host
      * records its own events (archon: `flag.changed`, `cms.published`, `key.rotated`; files/ai/

package/dist/boot.d.ts

@@ -1,4 +1,4 @@
-import type { TenantKind } from '@wtfalch/authz';
+import { type TenantKind } from '@wtfalch/authz';
 import type { StoreBinding } from './binding.js';
 import type { StorePolicy } from './policy.js';
 import type { DbOrTx } from './scoped.js';
@@ -35,9 +35,11 @@ export declare function ensureBuiltInRoles(tx: DbOrTx, policy: StorePolicy, tena
  * exist from before this change shipped) without duplicating or throwing.
  *
  * Stored `built_in: true`, not the `false` `starterRoles()` itself declares,
- * for the reasons the host's own boot.ts documents (`@wtfalch/authz`'s
- * `compileRoleGrants` refuses a non-`assignable` entry unless the role is
- * `built_in`, and today's owner/admin templates carry several).
+ * for the reasons the host's own boot.ts documents. `built_in` does not let a
+ * role hold a locked power: `@wtfalch/authz`'s `compileRoleGrants` lets a
+ * non-`assignable` entry onto the role keyed `owner`, or, for an
+ * `ownerGuarded` permission, onto a role guarded by an owner-only permission,
+ * whatever the row's `built_in` flag says.
  */
 export declare function seedStarterRoles(tx: DbOrTx, policy: StorePolicy, tenant: {
     id: string;

package/dist/boot.js

@@ -1,5 +1,7 @@
 import { randomUUID } from 'node:crypto';
+import { compileRoleGrants, resourceRoleSchema, } from '@wtfalch/authz';
 import { and, eq } from 'drizzle-orm';
+import { primaryAssignment } from './assignments.js';
 import { writeServiceEvent } from './audit.js';
 import { policyRole, requirePolicySchema } from './policy-access.js';
 import { policyRoles } from './policy-schema.js';
@@ -27,14 +29,49 @@ export const content = (role) => canonical({
     label: role.label,
     description: role.description,
 });
+/**
+ * A stored role that does not compile makes `loadPolicyState` throw for every access check in the
+ * tenant, and an unchanged revision is never rewritten, so refuse such a template before anything
+ * is written. The schema is checked first, then each entry alone so the error can name the
+ * permission.
+ */
+function assertTemplateCompiles(policy, template) {
+    const parsed = resourceRoleSchema.safeParse({ id: 'template', ...template });
+    if (!parsed.success)
+        throw new Error(`Role template ${template.key} is invalid: ${parsed.error.issues
+            .map((i) => `${i.path.join('.') || '(role)'}: ${i.message}`)
+            .join('; ')}`);
+    const role = parsed.data;
+    const assignment = primaryAssignment(role, { id: 'template', class: 'human' });
+    for (const entry of role.entries) {
+        try {
+            compileRoleGrants({ ...role, entries: [entry] }, assignment, policy.catalogue);
+        }
+        catch {
+            const p = Object.hasOwn(policy.catalogue, entry.permission)
+                ? policy.catalogue[entry.permission]
+                : undefined;
+            const shapeOk = p?.scopes.includes(entry.scope.kind) &&
+                p.boundaries.includes(entry.boundary.kind) &&
+                p.relations.includes(entry.relation);
+            throw new Error(p && shapeOk && !p.assignable
+                ? `Role template ${template.key} cannot hold ${entry.permission}: it is a locked (non-assignable) permission this role may not hold. Mark it ownerGuarded in the catalogue and guard the role with an owner-only permission (non-assignable, not ownerGuarded).`
+                : `Role template ${template.key} has an entry for ${entry.permission} that does not fit the catalogue: unknown permission, or a scope, boundary or relation it does not allow.`);
+        }
+    }
+}
 /** Called in the tenant creation/deploy transaction while its tenant row is locked. */
 export async function ensureBuiltInRoles(tx, policy, tenant) {
+    // Validate every template before the first write, so a bad one never leaves a partial write.
+    const templates = policy.builtInRoles(tenant.id, tenant.kind);
+    for (const template of templates)
+        assertTemplateCompiles(policy, template);
     const rows = await tx
         .select()
         .from(policyRoles)
         .where(and(eq(policyRoles.tenantId, tenant.id), eq(policyRoles.applicationId, policy.applicationId), eq(policyRoles.platformId, policy.platformId)));
     const result = [];
-    for (const template of policy.builtInRoles(tenant.id, tenant.kind)) {
+    for (const template of templates) {
         const existing = rows.find((r) => r.key === template.key);
         let status = 'unchanged';
         if (existing) {
@@ -99,12 +136,17 @@ export async function ensureBuiltInRoles(tx, policy, tenant) {
  * exist from before this change shipped) without duplicating or throwing.
  *
  * Stored `built_in: true`, not the `false` `starterRoles()` itself declares,
- * for the reasons the host's own boot.ts documents (`@wtfalch/authz`'s
- * `compileRoleGrants` refuses a non-`assignable` entry unless the role is
- * `built_in`, and today's owner/admin templates carry several).
+ * for the reasons the host's own boot.ts documents. `built_in` does not let a
+ * role hold a locked power: `@wtfalch/authz`'s `compileRoleGrants` lets a
+ * non-`assignable` entry onto the role keyed `owner`, or, for an
+ * `ownerGuarded` permission, onto a role guarded by an owner-only permission,
+ * whatever the row's `built_in` flag says.
  */
 export async function seedStarterRoles(tx, policy, tenant) {
-    const rows = policy.starterRoles(tenant.id, tenant.kind).map((template) => ({
+    const templates = policy.starterRoles(tenant.id, tenant.kind);
+    for (const template of templates)
+        assertTemplateCompiles(policy, template);
+    const rows = templates.map((template) => ({
         id: randomUUID(),
         tenantId: tenant.id,
         applicationId: policy.applicationId,

package/dist/erase.d.ts

@@ -39,7 +39,7 @@ export interface ErasureHost {
  *
  * Gated on the operator tenant's own `people:erase`: operator scope,
  * sensitive and unassignable, the same shape `owners:install` has, so only
- * the operator tenant's owner holds it. A caller reaches this through its
+ * the role keyed `owner` in the operator tenant can hold it. A caller reaches this through its
  * own permission check first, which is what a host wires up to write the
  * denied `person.erased` row on a refusal; this function's own checks are
  * the second net, the same as `installOwner`'s.

package/dist/erase.js

@@ -53,7 +53,7 @@ function rowsOf(result) {
  *
  * Gated on the operator tenant's own `people:erase`: operator scope,
  * sensitive and unassignable, the same shape `owners:install` has, so only
- * the operator tenant's owner holds it. A caller reaches this through its
+ * the role keyed `owner` in the operator tenant can hold it. A caller reaches this through its
  * own permission check first, which is what a host wires up to write the
  * denied `person.erased` row on a refusal; this function's own checks are
  * the second net, the same as `installOwner`'s.

package/dist/index.d.ts

@@ -4,9 +4,8 @@ export { policyActivationApprovals, policyActivations, policyAssignments, policy
 export { accessTeamMembers, accessTeams, type AppRolePermission, } from './resource-schema.js';
 export { attachProposals, authzEvents, breakGlassSessions, credentials, invitations, memberships, tenants, type AttachProposal, type AuthzEvent, type BreakGlassSession, type Credential, type Invitation, type Membership, type NewAttachProposal, type NewAuthzEvent, type NewBreakGlassSession, type NewCredential, type NewInvitation, type NewMembership, type NewTenant, type Tenant, } from './schema.js';
 export { ownerCoverage, ownerSeatCovered, principalIsReachable, type OwnerCoverage, type OwnerCoverageOptions, type PolicyBinding, } from './owners.js';
-export { migrateStore } from './migrate.js';
 export { guestGrants, policyGrants, type GrantStatus, type GuestGrant } from './grants.js';
-export { permissionOf, type StoreBinding } from './binding.js';
+export { permissionOf, type StoreBinding, type HostResourceResolver, type ResourceTarget, } from './binding.js';
 export { isCustomRoleKey } from './role-keys.js';
 export { type Access, type BreakGlassGrant, type Context, type Principal, type Result, type TenantRow, done, isUuid, refused, tenantTag, } from './types.js';
 export { policyResource } from './policy-resources.js';

package/dist/index.js

@@ -4,9 +4,8 @@ export { policyActivationApprovals, policyActivations, policyAssignments, policy
 export { accessTeamMembers, accessTeams, } from './resource-schema.js';
 export { attachProposals, authzEvents, breakGlassSessions, credentials, invitations, memberships, tenants, } from './schema.js';
 export { ownerCoverage, ownerSeatCovered, principalIsReachable, } from './owners.js';
-export { migrateStore } from './migrate.js';
 export { guestGrants, policyGrants } from './grants.js';
-export { permissionOf } from './binding.js';
+export { permissionOf, } from './binding.js';
 export { isCustomRoleKey } from './role-keys.js';
 export { done, isUuid, refused, tenantTag, } from './types.js';
 export { policyResource } from './policy-resources.js';

package/dist/memberships.js

@@ -176,6 +176,10 @@ export async function changeRole(access, db, scopeColumn, options) {
         const reason = roleAssignmentRefusal(fresh, role, primaryAssignment(role, principal, previous?.expiresAt?.getTime()), self ? null : 'members:grant');
         if (reason)
             return refused(self ? 'self_promotion' : reason, 'You cannot delegate that role.');
+        // A self-change skips the `members:grant` operation (and with it the guard check) above, but a
+        // guarded role must still only reach someone who holds every guard.
+        if (self && role.guards.some((guard) => !permits(fresh, guard)))
+            return refused('self_promotion', 'You cannot delegate that role.');
         if (before &&
             before.id !== role.id &&
             !(await guardStaysHeld(tx, fresh.binding, fresh.tenant.id, [policyRole(before)], principal)))

package/dist/migrations-dir.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Absolute path of the directory holding this package's numbered `.sql`
+ * migrations. The host passes it to `runMigrationSources` as
+ * `{ name: 'authz-store', dir: migrationsDir }`.
+ *
+ * Its own subpath (`@wtfalch/authz-store/migrations-dir`) and no other
+ * imports: a migration image imports this without Drizzle and authz, and a
+ * bundler never meets this file's `import.meta.url` through the main entry.
+ * `migrations/` sits next to `dist/` in the package and next to `src/` in
+ * this repository, so one relative path is right in both.
+ */
+export declare const migrationsDir: string;

package/dist/migrations-dir.js

@@ -0,0 +1,13 @@
+import { fileURLToPath } from 'node:url';
+/**
+ * Absolute path of the directory holding this package's numbered `.sql`
+ * migrations. The host passes it to `runMigrationSources` as
+ * `{ name: 'authz-store', dir: migrationsDir }`.
+ *
+ * Its own subpath (`@wtfalch/authz-store/migrations-dir`) and no other
+ * imports: a migration image imports this without Drizzle and authz, and a
+ * bundler never meets this file's `import.meta.url` through the main entry.
+ * `migrations/` sits next to `dist/` in the package and next to `src/` in
+ * this repository, so one relative path is right in both.
+ */
+export const migrationsDir = fileURLToPath(new URL('../migrations/', import.meta.url));

package/dist/policy-entry.d.ts

@@ -1,11 +1,11 @@
 /**
  * `@wtfalch/authz-store/policy` — a client-safe subpath for `definePolicy` and the types its
- * signature needs. The main entry (`.`) re-exports `migrateStore`, which imports
- * `node:fs/promises`, so a client component that only reads the policy catalogue for permission
+ * signature needs. The main entry (`.`) imports `node:crypto` and
+ * `drizzle-orm`, so a client component that only reads the policy catalogue for permission
  * labels cannot import from `.` without pulling Node into a production browser build
  * (https://github.com/wtfalch/boule/pull/162). Nothing this module imports, directly or
  * transitively, may import a `node:` module, `drizzle-orm`, or a database handle — proved by
  * `scripts/tests/package-contract.test.mjs`.
  */
 export { definePolicy, type PolicyData, type PolicyRoleTemplate, type StorePolicy, } from './policy.js';
-export type { StoreBinding } from './binding.js';
+export type { StoreBinding, HostResourceResolver, ResourceTarget } from './binding.js';

package/dist/policy-entry.js

@@ -1,7 +1,7 @@
 /**
  * `@wtfalch/authz-store/policy` — a client-safe subpath for `definePolicy` and the types its
- * signature needs. The main entry (`.`) re-exports `migrateStore`, which imports
- * `node:fs/promises`, so a client component that only reads the policy catalogue for permission
+ * signature needs. The main entry (`.`) imports `node:crypto` and
+ * `drizzle-orm`, so a client component that only reads the policy catalogue for permission
  * labels cannot import from `.` without pulling Node into a production browser build
  * (https://github.com/wtfalch/boule/pull/162). Nothing this module imports, directly or
  * transitively, may import a `node:` module, `drizzle-orm`, or a database handle — proved by

package/dist/policy-resources.js

@@ -4,14 +4,16 @@ import { authzEvents } from './schema.js';
 import { isUuid } from './types.js';
 /** Authoritative resource metadata, shared by delegation and credential lineage evaluation. */
 export async function policyResource(tx, binding, organisationId, type, id) {
-    const base = {
+    const base = Object.freeze({
         applicationId: binding.applicationId,
         platformId: binding.platformId,
         organisationId,
         type,
         id,
-    };
-    if (type === 'team' && isUuid(id)) {
+    });
+    if (type === 'team') {
+        if (!isUuid(id))
+            return undefined;
         const [row] = await tx
             .select({ id: accessTeams.id })
             .from(accessTeams)
@@ -19,7 +21,9 @@ export async function policyResource(tx, binding, organisationId, type, id) {
             .limit(1);
         return row ? { ...base, teamId: id } : undefined;
     }
-    if (type === 'audit' && /^\d{1,15}$/.test(id)) {
+    if (type === 'audit') {
+        if (!/^\d{1,15}$/.test(id))
+            return undefined;
         const [row] = await tx
             .select({
             teamId: authzEvents.teamId,
@@ -42,5 +46,13 @@ export async function policyResource(tx, binding, organisationId, type, id) {
                 : {}),
         };
     }
-    return undefined;
+    const resource = await binding.resolveResource?.(tx, base);
+    if (!resource ||
+        resource.applicationId !== base.applicationId ||
+        resource.platformId !== base.platformId ||
+        resource.organisationId !== base.organisationId ||
+        resource.type !== base.type ||
+        resource.id !== base.id)
+        return undefined;
+    return resource;
 }

package/dist/policy.d.ts

@@ -68,4 +68,5 @@ export declare function definePolicy(data: PolicyData, binding: {
     readonly applicationId: string;
     readonly platformId: string;
     readonly hostEvents?: readonly string[];
+    readonly resolveResource?: StoreBinding['resolveResource'];
 }): StorePolicy;

package/dist/policy.js

@@ -59,6 +59,7 @@ export function definePolicy(data, binding) {
         platformId: binding.platformId,
         catalogue,
         hostEvents: binding.hostEvents,
+        resolveResource: binding.resolveResource,
         defaultCeiling: data.defaultCeiling,
         maxDepth: data.maxDepth,
         elevated: new Set(data.elevated),

package/dist/role-keys.d.ts

@@ -1,7 +1,8 @@
 /**
  * Custom role keys always start with `c_` (enforced at creation, the host's `createRole`); every
  * other key — including a starter role's, whether or not its row is still `built_in` — names an
- * app-defined role. Several modules need "is this key one this app controls" rather than "is this
+ * app-defined role. `built_in` says nothing about which permissions a role may hold: that is
+ * the role key `owner` or an owner-only guard (`compileRoleGrants`). Several modules need "is this key one this app controls" rather than "is this
  * row currently marked built-in", because a starter role's `built_in` flag can differ between an
  * old tenant (`true`) and a new one (`false`) while the key means the same thing in both (ADR
  * 0016). No imports, so any module can depend on it without risking a cycle.

package/dist/role-keys.js

@@ -1,7 +1,8 @@
 /**
  * Custom role keys always start with `c_` (enforced at creation, the host's `createRole`); every
  * other key — including a starter role's, whether or not its row is still `built_in` — names an
- * app-defined role. Several modules need "is this key one this app controls" rather than "is this
+ * app-defined role. `built_in` says nothing about which permissions a role may hold: that is
+ * the role key `owner` or an owner-only guard (`compileRoleGrants`). Several modules need "is this key one this app controls" rather than "is this
  * row currently marked built-in", because a starter role's `built_in` flag can differ between an
  * old tenant (`true`) and a new one (`false`) while the key means the same thing in both (ADR
  * 0016). No imports, so any module can depend on it without risking a cycle.

package/dist/roles.d.ts

@@ -11,13 +11,19 @@ export interface EditableRole extends ResourceRole {
     readonly editable: boolean;
 }
 export declare function rolesForEditor(access: Access): Promise<EditableRole[]>;
-/** Definition edits must cover both its full scope and every existing recipient/scope. */
+/**
+ * Definition edits must cover both its full scope and every existing recipient/scope, and the
+ * editor must hold every guard of the role (an owner-guarded role can only be edited by someone
+ * the guards admit, i.e. an owner). Callers check the role both before and after an edit.
+ */
 export declare function canEditDefinition(access: Access, role: ResourceRole): boolean;
 export interface CreateRoleOptions {
     readonly key: string;
     readonly name: string;
     readonly description?: string;
     readonly entries: ResourceRole['entries'];
+    /** Catalogue permissions the editor must hold to assign or edit the role; default none. */
+    readonly guards?: readonly string[];
 }
 export interface UpdateRoleOptions {
     readonly key: string;
@@ -25,6 +31,8 @@ export interface UpdateRoleOptions {
     readonly name?: string;
     readonly description?: string;
     readonly entries?: ResourceRole['entries'];
+    /** Replaces the guards; the editor must hold every old and every new guard. */
+    readonly guards?: readonly string[];
 }
 export interface DeleteRoleOptions {
     readonly key: string;

package/dist/roles.js

@@ -31,14 +31,21 @@ export async function rolesForEditor(access) {
         editable: !role.builtIn && permits(access, 'roles:update') && canEditDefinition(access, role),
     }));
 }
-/** Definition edits must cover both its full scope and every existing recipient/scope. */
+/**
+ * Definition edits must cover both its full scope and every existing recipient/scope, and the
+ * editor must hold every guard of the role (an owner-guarded role can only be edited by someone
+ * the guards admit, i.e. an owner). Callers check the role both before and after an edit.
+ */
 export function canEditDefinition(access, role) {
+    if (role.guards.some((guard) => !permits(access, guard)))
+        return false;
     if (roleAssignmentRefusal(access, role, primaryAssignment(role, { id: 'prospective-person', class: 'human' }), null))
         return false;
     return access.policyState.assignmentRows
         .filter((a) => a.roleId === role.id && (!a.expiresAt || a.expiresAt.getTime() > Date.now()))
         .every((a) => !roleAssignmentRefusal(access, role, policyAssignment(a), null));
 }
+const knownGuards = (access, guards) => guards.every((g) => Object.hasOwn(access.binding.catalogue, g));
 const invalid = () => refused('invalid_role', 'Choose valid operations, boundaries and scopes within your authority.');
 export async function createRole(access, db, scopeColumn, options) {
     if (access.context === 'break_glass')
@@ -49,6 +56,9 @@ export async function createRole(access, db, scopeColumn, options) {
             return refused('no_permission', 'You cannot create roles here.');
         if (!/^c_[a-z0-9_-]{1,61}$/.test(options.key))
             return refused('invalid_key', 'Choose a custom role key starting with c_.');
+        const guards = [...new Set(options.guards ?? [])];
+        if (!knownGuards(fresh, guards))
+            return invalid();
         const candidate = resourceRoleSchema.safeParse({
             id: randomUUID(),
             key: options.key,
@@ -60,7 +70,7 @@ export async function createRole(access, db, scopeColumn, options) {
             revision: 1,
             builtIn: false,
             entries: options.entries,
-            guards: [],
+            guards,
         });
         if (!candidate.success || !canEditDefinition(fresh, candidate.data))
             return invalid();
@@ -84,7 +94,7 @@ export async function createRole(access, db, scopeColumn, options) {
             revision: role.revision,
             builtIn: false,
             entries: role.entries,
-            guards: [],
+            guards: role.guards,
             createdBy: fresh.actor.id,
         });
         await record(tx, fresh, {
@@ -116,9 +126,11 @@ export async function updateRole(access, db, scopeColumn, options) {
             label: options.name ?? before.label,
             description: options.description ?? before.description,
             entries: options.entries ?? before.entries,
+            guards: options.guards ? [...new Set(options.guards)] : before.guards,
             revision: before.revision + 1,
         });
         if (!parsed.success ||
+            !knownGuards(fresh, parsed.data.guards) ||
             !canEditDefinition(fresh, before) ||
             !canEditDefinition(fresh, parsed.data))
             return invalid();
@@ -129,6 +141,7 @@ export async function updateRole(access, db, scopeColumn, options) {
             name: after.label,
             description: after.description,
             entries: after.entries,
+            guards: after.guards,
             revision: after.revision,
             updatedAt: new Date(),
             // ADR 0016's Aged-and-Independent approver rule reads this to exclude

package/dist/schema.d.ts

@@ -1457,6 +1457,23 @@ export declare const authzEvents: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        tenantDisplay: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_display";
+            tableName: "authz_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         teamId: import("drizzle-orm/pg-core").PgColumn<{
             name: "team_id";
             tableName: "authz_events";
@@ -1610,6 +1627,23 @@ export declare const authzEvents: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        targetDisplay: import("drizzle-orm/pg-core").PgColumn<{
+            name: "target_display";
+            tableName: "authz_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         outcome: import("drizzle-orm/pg-core").PgColumn<{
             name: "outcome";
             tableName: "authz_events";

package/dist/schema.js

@@ -169,6 +169,10 @@ export const authzEvents = pgTable('authz_events', {
     id: bigint('id', { mode: 'number' }).generatedAlwaysAsIdentity().primaryKey(),
     occurredAt: timestamp('occurred_at', { withTimezone: true }).notNull().default(sql `now()`),
     tenantId: uuid('tenant_id'),
+    // What the tenant was CALLED when this happened, beside its id so the row still reads once
+    // the organisation is closed. Null on a row written before this column existed, or when
+    // tenantId itself is null. Never rewritten once set (authz_events_guard enforces it).
+    tenantDisplay: text('tenant_display'),
     teamId: uuid('team_id'),
     subjectId: text('subject_id'),
     subjectClass: text('subject_class'),
@@ -178,6 +182,9 @@ export const authzEvents = pgTable('authz_events', {
     action: text('action').notNull(),
     targetType: text('target_type').notNull(),
     targetId: text('target_id').notNull(),
+    // Same as tenantDisplay, for the target: what it was CALLED when this happened. Null on a row
+    // written before this column existed.
+    targetDisplay: text('target_display'),
     outcome: text('outcome').notNull(),
     context: text('context').notNull(),
     sessionId: text('session_id'),

package/dist/tenants.d.ts

@@ -204,8 +204,8 @@ export declare function createTenantAsOperator(operatorAccess: Access, db: DbOrT
 export declare function deleteJustCreatedTenant(operatorAccess: Access, db: DbOrTx, scopeColumn: Scope['column'], tenantId: string): Promise<Result<void>>;
 /**
  * Archives a tenant from inside it, by whoever holds `tenant:delete` there
- * (the owner: the permission is not assignable, so no other system role
- * carries it). Refused while the tenant holds children (D19's fifth rule):
+ * (the owner: the permission is not assignable and not owner-guarded, so no
+ * role other than the one keyed `owner` can carry it). Refused while the tenant holds children (D19's fifth rule):
  * an archived parent's own state says nothing about the organisations
  * hanging off it, so those must be detached or archived on purpose first,
  * not silently along for the ride.

package/dist/tenants.js

@@ -111,7 +111,9 @@ export async function createTenant(principal, db, policy, config, profiles, opti
             return refused('slug_taken', 'That address is already taken.');
         let tenantRow;
         try {
-            [tenantRow] = await tx
+            // A savepoint: a unique violation aborts a Postgres transaction, and the rest of this
+            // function runs in it. Rolling back to the savepoint lets the catch below return normally.
+            [tenantRow] = await tx.transaction((sp) => sp
                 .insert(tenants)
                 .values({
                 kind: 'customer',
@@ -121,7 +123,7 @@ export async function createTenant(principal, db, policy, config, profiles, opti
                 selfDenied: [],
                 createdBy: principal.id,
             })
-                .returning({ id: tenants.id });
+                .returning({ id: tenants.id }));
         }
         catch (error) {
             if (isUniqueViolation(error))
@@ -197,10 +199,11 @@ export async function renameTenant(access, db, scopeColumn, options) {
                 return refused('slug_taken', 'That address is already taken.');
         }
         try {
-            await tx
+            // A savepoint, for the same reason as in `createTenant`.
+            await tx.transaction((sp) => sp
                 .update(tenants)
                 .set({ name: nextName, slug: nextSlug, updatedAt: new Date() })
-                .where(eq(tenants.id, tenantRow.id));
+                .where(eq(tenants.id, tenantRow.id)));
         }
         catch (error) {
             if (isUniqueViolation(error))
@@ -611,7 +614,8 @@ export async function createTenantAsOperator(operatorAccess, db, scopeColumn, po
             }
             let tenantRow;
             try {
-                [tenantRow] = await tx
+                // A savepoint, for the same reason as in `createTenant`.
+                [tenantRow] = await tx.transaction((sp) => sp
                     .insert(tenants)
                     .values({
                     kind: 'customer',
@@ -621,7 +625,7 @@ export async function createTenantAsOperator(operatorAccess, db, scopeColumn, po
                     selfDenied: [],
                     createdBy: currentAccess.actor.id,
                 })
-                    .returning({ id: tenants.id });
+                    .returning({ id: tenants.id }));
             }
             catch (error) {
                 if (isUniqueViolation(error))
@@ -761,8 +765,8 @@ export async function deleteJustCreatedTenant(operatorAccess, db, scopeColumn, t
 }
 /**
  * Archives a tenant from inside it, by whoever holds `tenant:delete` there
- * (the owner: the permission is not assignable, so no other system role
- * carries it). Refused while the tenant holds children (D19's fifth rule):
+ * (the owner: the permission is not assignable and not owner-guarded, so no
+ * role other than the one keyed `owner` can carry it). Refused while the tenant holds children (D19's fifth rule):
  * an archived parent's own state says nothing about the organisations
  * hanging off it, so those must be detached or archived on purpose first,
  * not silently along for the ride.

package/migrations/0006_erase_person.sql

@@ -12,12 +12,17 @@
 --
 -- 0.4.0 note: this function was originally named `erase_person`, the same
 -- name and signature as each host's own erasure function (the one that also
--- scrubs `profiles`). `migrateStore` replaces a same-named function outright,
+-- scrubs `profiles`). `CREATE OR REPLACE FUNCTION` replaces a same-named function outright,
 -- so applying this migration silently dropped a host's own `profiles` scrub.
 -- Renamed here to `authz_erase_person` before any persistent database ever
 -- applied it: 0.3.0 published an hour before this fix, and no host had run
 -- this migration against a real database yet, so this is a same-file rename,
 -- not a new numbered migration.
+--
+-- 0.6.0 note: edited in place, again before any persistent database applied
+-- it (databases were recreated empty when migrations moved to the host's
+-- runner, in the host's own schema). The function now pins the `search_path`
+-- of the session that creates it, and the runtime-role grant moved to the host.
 
 -- ----------------------------------------------- authz_erase_person(...)
 -- The single sanctioned write to `authz_events` (D9, M3).
@@ -45,15 +50,17 @@
 -- a list to keep in step forever; what a row meant is in `action`,
 -- `target_*` and `reason`, none of which this touches.
 --
--- `search_path` is pinned. A SECURITY DEFINER function that resolves an
--- unqualified name through the caller's `search_path` runs whatever they put
--- in front of it, with the owner's privileges, which is the standard way
--- this feature becomes a privilege escalation.
+-- `search_path` is pinned to the one the host's migration run set, which is
+-- the host's schema first, so the unqualified names below resolve there. A
+-- SECURITY DEFINER function that resolves an unqualified name through the
+-- caller's `search_path` runs whatever they put in front of it, with the
+-- owner's privileges, which is the standard way this feature becomes a
+-- privilege escalation.
 CREATE OR REPLACE FUNCTION "authz_erase_person"("subject" text, "pseudonym" text, "subject_email" text)
 RETURNS integer
 LANGUAGE plpgsql
 SECURITY DEFINER
-SET search_path = pg_catalog, public
+SET search_path FROM CURRENT
 AS $$
 DECLARE
   touched integer;
@@ -126,18 +133,3 @@ $$;
 -- new function to PUBLIC by default.
 REVOKE ALL ON FUNCTION "authz_erase_person"(text, text, text) FROM PUBLIC;
 --> statement-breakpoint
-
--- The store has no runtime-role convention of its own, unlike Boule's fixed
--- `<database>_rt`, granted unconditionally. A host whose runtime role
--- happens to be named that way gets EXECUTE for free; a host with no such
--- role gets nothing granted here and grants EXECUTE itself, rather than
--- this migration failing outright for naming a role that does not exist.
-DO $$
-DECLARE
-  rt text := current_database() || '_rt';
-BEGIN
-  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = rt) THEN
-    EXECUTE format('GRANT EXECUTE ON FUNCTION "authz_erase_person"(text, text, text) TO %I', rt);
-  END IF;
-END
-$$;

package/migrations/0007_event_display_columns.sql

@@ -0,0 +1,52 @@
+-- authz_events gains target_display and tenant_display, matching how
+-- actor_display already works: written once by whoever signs the row, never
+-- rewritten afterward. See https://github.com/wtfalch/authz/issues/69.
+ALTER TABLE "authz_events" ADD COLUMN "tenant_display" text;
+--> statement-breakpoint
+ALTER TABLE "authz_events" ADD COLUMN "target_display" text;
+--> statement-breakpoint
+ALTER TABLE "authz_events" ADD CONSTRAINT "authz_events_tenant_display_check"
+  CHECK (((tenant_display IS NULL) OR ((length(tenant_display) >= 1) AND (length(tenant_display) <= 256))));
+--> statement-breakpoint
+ALTER TABLE "authz_events" ADD CONSTRAINT "authz_events_target_display_check"
+  CHECK (((target_display IS NULL) OR ((length(target_display) >= 1) AND (length(target_display) <= 256))));
+--> statement-breakpoint
+-- Extend the append-only guard: target_display and tenant_display join the immutable set (they are
+-- never rewritten, unlike actor_display/before/after/erased_at, which an erasure may still touch).
+CREATE OR REPLACE FUNCTION authz_events_guard()
+ RETURNS trigger
+ LANGUAGE plpgsql
+AS $function$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'authz_events is append-only: delete refused';
+  ELSIF TG_OP = 'TRUNCATE' THEN
+    RAISE EXCEPTION 'authz_events is append-only: truncate refused';
+  ELSIF TG_OP = 'UPDATE' THEN
+    IF NEW."id" IS DISTINCT FROM OLD."id"
+      OR NEW."occurred_at" IS DISTINCT FROM OLD."occurred_at"
+      OR NEW."tenant_id" IS DISTINCT FROM OLD."tenant_id"
+      OR NEW."tenant_display" IS DISTINCT FROM OLD."tenant_display"
+      OR NEW."actor_class" IS DISTINCT FROM OLD."actor_class"
+      OR NEW."actor_id" IS DISTINCT FROM OLD."actor_id"
+      OR NEW."action" IS DISTINCT FROM OLD."action"
+      OR NEW."target_type" IS DISTINCT FROM OLD."target_type"
+      OR NEW."target_id" IS DISTINCT FROM OLD."target_id"
+      OR NEW."target_display" IS DISTINCT FROM OLD."target_display"
+      OR NEW."outcome" IS DISTINCT FROM OLD."outcome"
+      OR NEW."context" IS DISTINCT FROM OLD."context"
+      OR NEW."session_id" IS DISTINCT FROM OLD."session_id"
+      OR NEW."reason" IS DISTINCT FROM OLD."reason"
+      OR NEW."reference" IS DISTINCT FROM OLD."reference"
+      OR NEW."request_id" IS DISTINCT FROM OLD."request_id"
+      OR NEW."ip" IS DISTINCT FROM OLD."ip"
+      OR NEW."user_agent" IS DISTINCT FROM OLD."user_agent"
+      OR NEW."tenant_visible" IS DISTINCT FROM OLD."tenant_visible"
+      OR NEW."schema_version" IS DISTINCT FROM OLD."schema_version"
+    THEN
+      RAISE EXCEPTION 'authz_events is append-only: only actor_display, before, after and erased_at may change';
+    END IF;
+  END IF;
+  RETURN NEW;
+END
+$function$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/authz-store",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Persistence and lifecycle for @wtfalch/authz: the storage a host would otherwise write itself.",
   "type": "module",
   "files": [
@@ -17,11 +17,15 @@
       "types": "./dist/policy-entry.d.ts",
       "default": "./dist/policy-entry.js"
     },
+    "./migrations-dir": {
+      "types": "./dist/migrations-dir.d.ts",
+      "default": "./dist/migrations-dir.js"
+    },
     "./package.json": "./package.json"
   },
   "peerDependencies": {
-    "@wtfalch/authz": "^0.16.0",
-    "@wtfalch/db": "0.4.0",
+    "@wtfalch/authz": "^0.17.0",
+    "@wtfalch/db": ">=0.5.2 <0.6.0",
     "drizzle-orm": ">=0.39.3 <1.0.0",
     "zod": "^4.1.13"
   },
@@ -35,12 +39,10 @@
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.8",
     "@types/node": "^22",
-    "@wtfalch/db": "0.4.0",
+    "@wtfalch/db": "0.5.2",
     "@wtfalch/keys": "0.4.2",
-    "drizzle-kit": "^0.31.10",
-    "drizzle-orm": "^0.39.0",
+    "drizzle-orm": "0.39.3",
     "fast-check": "^4.9.0",
-    "postgres": "^3.4.5",
     "typescript": "^5.9.0",
     "vitest": "^4.1.6",
     "zod": "^4.5.4"

package/dist/migrate.d.ts

@@ -1,9 +0,0 @@
-import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
-type HostDb = PgDatabase<PgQueryResultHKT, any, any>;
-/**
- * Applies the package's migrations that `authz_store_migrations` has no row for, in file-name
- * order, one transaction per file. Returns the names it applied. The host runs this before its own
- * migrations, so everything the package owns exists before a host migration references it.
- */
-export declare function migrateStore(db: HostDb): Promise<string[]>;
-export {};

package/dist/migrate.js

@@ -1,52 +0,0 @@
-import { readFile, readdir } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { sql } from 'drizzle-orm';
-/**
- * The shipped SQL, next to `dist/` in the package and next to `src/` in this repository. Computed
- * lazily inside `migrateStore` rather than as a module-level `new URL('../migrations/',
- * import.meta.url)`: Turbopack resolves that literal statically when an app imports the package
- * barrel, and fails with "Can't resolve '../migrations/'" because the directory holds no importable
- * module.
- */
-function migrationsDir() {
-    return join(dirname(fileURLToPath(import.meta.url)), '..', 'migrations');
-}
-/** Files split on this line, the marker drizzle-kit writes, so any driver can run them one statement at a time. */
-const BREAKPOINT = '--> statement-breakpoint';
-/** One key for every host, so two containers starting at once apply each file once between them. */
-const LOCK = 7_310_422_001;
-/**
- * Applies the package's migrations that `authz_store_migrations` has no row for, in file-name
- * order, one transaction per file. Returns the names it applied. The host runs this before its own
- * migrations, so everything the package owns exists before a host migration references it.
- */
-export async function migrateStore(db) {
-    const dir = migrationsDir();
-    const names = (await readdir(dir)).filter((n) => n.endsWith('.sql')).sort();
-    const applied = [];
-    for (const name of names) {
-        const text = await readFile(join(dir, name), 'utf8');
-        const ran = await db.transaction(async (tx) => {
-            await tx.execute(sql `select pg_advisory_xact_lock(${LOCK})`);
-            // Created under the lock: two runners creating it at once collide in pg_type.
-            await tx.execute(sql `create table if not exists authz_store_migrations (name text primary key, applied_at timestamptz not null default now())`);
-            const done = await tx.execute(sql `select 1 from authz_store_migrations where name = ${name}`);
-            if (rowsOf(done).length > 0)
-                return false;
-            for (const statement of text.split(BREAKPOINT)) {
-                if (statement.trim())
-                    await tx.execute(sql.raw(statement));
-            }
-            await tx.execute(sql `insert into authz_store_migrations (name) values (${name})`);
-            return true;
-        });
-        if (ran)
-            applied.push(name);
-    }
-    return applied;
-}
-/** postgres-js returns the rows as the result; node-postgres and PGlite wrap them in `rows`. */
-function rowsOf(result) {
-    return Array.isArray(result) ? result : (result.rows ?? []);
-}