cvx-kit 0.0.2 → 0.0.3

package/docs/tenancy.md

@@ -0,0 +1,179 @@
+# `cvx-kit/tenancy` — row-level security, with tenancy as an opt-in layer
+
+Row-level security and tenancy are **separate, composable features** of the
+same `security` config on `createAuthFunctions`:
+
+- **`security.rules` alone** — role-level / module-level RLS with no tenancy
+  at all: gate writes by role, freeze evidence tables, ownership-gate reads.
+  `defaultPolicy` stays `'allow'`; unlisted tables behave normally.
+- **`security.tenancy` alone** — pure tenant isolation from a table registry.
+- **Both** — rules are AND-composed with tenant isolation.
+
+A single-org app that only wants role-gated writes configures `rules` and
+never touches tenancy. Nothing below is required unless you opt into it.
+
+Multi-tenancy itself is a structural machine, not a per-handler
+convention. The model: **tenant = the identity provider's organization id**,
+stamped as a server-owned `tenant` string field on every tenant-scoped row,
+always derived from the verified identity — never accepted as an argument.
+Isolation is defense-in-depth; each layer covers a hole in the previous one:
+
+1. **Schema** — `tenantTable` injects the field and strips it from every
+   write boundary.
+2. **Row-level security** — deny-default rules generated mechanically from
+   one table registry, wrapped into the auth constructors.
+3. **Triggers** — a post-image invariant forbids tenant reassignment (RLS
+   authorizes against the pre-image only).
+4. **Reference guards** — client-supplied ids re-verify ownership without
+   disclosing existence.
+
+Single-org apps skip all of this: every piece is opt-in, and
+`createAuthFunctions` without a `security` config behaves exactly as before.
+
+## The registry is the design
+
+One list of table names drives everything. Adding a table to the registry is
+the entire onboarding — there is no second per-table step to forget:
+
+```ts
+// convex/tenancy.ts (or alongside triggers.ts)
+export const TENANT_TABLES = ['<entities>', '<others>'] as const
+```
+
+- `security.tenancy.tables: TENANT_TABLES` → RLS rules generated per table
+- `tenantOwnership(triggers, ...TENANT_TABLES)` → reassignment guard per table
+- each listed table is declared with `tenantTable(...)` in its module
+
+Recommended architecture test: assert every `tenantTable` in the codebase
+appears in `TENANT_TABLES`, and vice versa.
+
+## Wiring
+
+```ts
+// domain/<module>/schema.ts — tenant injected at the schema boundary
+export const <entities> = tenantTable('<entities>', (id) => ({
+  name: z.string(), ownerId: id('users'),
+}), { publicFields: ['name'] })
+// tenant: excluded from insertSchema/updateSchema/commandInput,
+// in publicDto only if explicitly allowlisted
+
+// domain/<module>/table.ts — every index tenant-prefixed
+<entities>: <entities>.table.index('by_tenant', ['tenant'])
+                            .index('by_tenant_owner', ['tenant', 'ownerId'])
+
+// convex/triggers.ts
+tenantOwnership(triggers, ...TENANT_TABLES)
+
+// convex/functions.ts
+createAuthFunctions<DataModel>({
+  ...,
+  security: {
+    tenancy: {
+      tables: TENANT_TABLES,
+      // optional; defaults to bundle.org.organizationId
+      resolve: (bundle) => bundle.org.organizationId,
+    },
+    // role-level security, AND-composed with tenant isolation
+    rules: (bundle) => ({
+      '<entities>': { modify: async () => bundle.role === '<privileged>' },
+    }),
+    // defaults to 'deny' when tenancy is configured
+    defaultPolicy: 'deny',
+  },
+})
+```
+
+## What the constructors do with it
+
+- Every authenticated ctx gains **`ctx.tenant`** (also on the frozen bundle) —
+  resolved via `security.tenancy.resolve`, defaulting to the organization id.
+  Actions re-derive it from the live-verified membership.
+- **Queries** get a wrapped reader: rows failing `read` are invisible —
+  filtered from every `get`/`query`, even a full table scan.
+- **Mutations** wrap triggers first, then the RLS writer — `insert`/`modify`
+  failing a rule throws. Order matters and is handled for you.
+- **`system*` constructors stay unwrapped** — trusted internal paths reach
+  every table. This is deliberate: schedulers and callbacks receive the
+  server-derived tenant as data, never as authority.
+- With tenancy configured, `defaultPolicy` defaults to **deny**: tables
+  outside the registry are unreachable from `auth*`/`role*`/`admin*`
+  functions. Global/platform tables are reached from `system*` paths, or by
+  explicitly granting rules for them.
+
+Handlers stamp inserts from the ctx — the schema forbids clients supplying
+it, RLS rejects a wrong value, and the trigger forbids changing it later:
+
+```ts
+await ctx.db.insert('<entities>', { ...args, tenant: ctx.tenant })
+```
+
+## Role-level security — with or without tenancy
+
+`security.rules` receives the full auth bundle and returns convex-helpers
+`Rules`. It works standalone (no tenancy configured) or AND-composed with
+tenant isolation (`composeRules`) — a row must pass **every** rule set that
+defines the operation. Use it for role-gated writes, ownership-gated reads,
+or state-machine write locks:
+
+```ts
+// rules-only, single-org app: no tenancy anywhere
+security: {
+  rules: (bundle) => ({
+    '<entities>': { modify: async () => bundle.role !== '<readonly-role>' },
+  }),
+}
+```
+
+```ts
+rules: (bundle) => ({
+  '<entities>': {
+    modify: async (_ctx, doc) =>
+      bundle.role === 'admin' || doc.ownerId === bundle.actor.userId,
+  },
+  '<evidence>': { modify: async () => false },   // frozen via RLS as well as trigger
+})
+```
+
+## Client-supplied ids
+
+RLS makes foreign rows invisible to reads, but any id a client sends should
+still be re-verified — and without disclosing existence:
+
+```ts
+import { requireTenantReference } from 'cvx-kit/tenancy'
+
+const row = await requireTenantReference(ctx.tenant, () => ctx.db.get(args.id))
+// missing row and foreign row fail identically: REFERENCE_NOT_FOUND
+```
+
+`assertTenantOwned(tenant, doc)` is the internal-path variant
+(CROSS_TENANT_REFERENCE, for rows you already loaded on trusted paths).
+
+## Footguns
+
+1. **Actions have no db** — an action passing work to internal functions must
+   pass `ctx.tenant` (server-derived) as data; internal functions must never
+   accept a caller-chosen tenant on a public path.
+2. **Provider ids are global** (memberships, invitations in WorkOS-style
+   providers): org-scoped mutations against the provider must re-check the
+   id belongs to the active org, or you ship a cross-tenant IDOR.
+3. **Tables outside the registry get none of this.** Keep the global-table
+   list short and named; every one is a per-handler-discipline zone.
+4. **`t.run(...)` in convex-test bypasses RLS and triggers** — same rule as
+   always: seeding only.
+5. **Return "not found", never "forbidden"** for cross-tenant references —
+   existence is also tenant data.
+
+## Module maps
+
+`createModule` (from `cvx-kit/zod-table`) merges per-module table maps into
+the schema and rejects a table declared by two modules:
+
+```ts
+// convex/domain/table.ts
+export const domainTables = createModule(
+  <moduleA>Tables, <moduleB>Tables, <moduleC>Tables,
+)
+// convex/schema.ts
+export default defineSchema(domainTables)
+```

package/docs/triggers.md

@@ -48,6 +48,11 @@ createAuthFunctions<DataModel>({ ..., triggers })
   votes/history/audit-style evidence tables.
 - **`noDelete(triggers, ...tables)`** — forbids hard deletes only; updates
   pass. Pair with `archivedAt` for soft deletion.
+- **`tenantOwnership(triggers, ...tables)`** — the tenancy post-image
+  invariant: inserts must carry a non-empty `tenant`, updates may never
+  reassign it. Register for every table in the tenancy registry (row-level
+  security checks the pre-image only — this closes that hole). See
+  `tenancy.md`.
 
 `Triggers`, `Change`, and `Trigger` are re-exported for custom registrations.
 

package/docs/zod-table.md

@@ -93,6 +93,29 @@ Think of the options as three independent allowlists over the same shape:
 All derived objects are `.strict()` — unknown keys are rejected, in both
 directions.
 
+## `tenantTable` — tenant-owned rows
+
+`tenantTable` is `zodTable` plus a server-owned `tenant` string field —
+injected exactly like timestamps: present in storage, excluded from
+`insertSchema`/`updateSchema`/`commandInput`, in `publicDto` only by explicit
+allowlist. Handlers stamp it from `ctx.tenant`; row-level security matches on
+it; the `tenantOwnership` trigger forbids reassigning it. See `tenancy.md`.
+
+```ts
+export const <entities> = tenantTable('<entities>', (id) => ({ ... }), {
+  commandFields: [...], publicFields: [...],
+})
+```
+
+## `createModule` — module table maps
+
+Merges per-module table maps into the application schema, throwing when two
+modules declare the same table — the combinator for `domain/table.ts`:
+
+```ts
+export default defineSchema(createModule(<moduleA>Tables, <moduleB>Tables))
+```
+
 ## `zodVariantTable` — discriminated unions
 
 For tables whose rows are a discriminated union (events, polymorphic

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cvx-kit",
-	"version": "0.0.2",
+	"version": "0.0.3",
 	"description": "Reusable Convex application kit: foundation kernels, approvals component, zod table boundaries, WorkOS-backed auth function constructors, and audited command protocol.",
 	"type": "module",
 	"license": "MIT",
@@ -25,6 +25,10 @@
 			"types": "./dist/auth.d.mts",
 			"import": "./dist/auth.mjs"
 		},
+		"./tenancy": {
+			"types": "./dist/tenancy.d.mts",
+			"import": "./dist/tenancy.mjs"
+		},
 		"./triggers": {
 			"types": "./dist/triggers.d.mts",
 			"import": "./dist/triggers.mjs"

package/src/auth.ts

@@ -22,7 +22,16 @@ import type {
 	UserIdentity,
 } from 'convex/server'
 import type { Triggers } from 'convex-helpers/server/triggers'
+import type { TableNamesInDataModel } from 'convex/server'
 import { defaultErrors, type ErrorFactory } from './errors'
+import {
+	composeRules,
+	createTenantRules,
+	wrapDatabaseReader,
+	wrapDatabaseWriter,
+	type RLSConfig,
+	type Rules,
+} from './tenancy'
 
 /** The default vocabulary; every app can supply its own via the Role generic. */
 export type DefaultRole = 'reader' | 'writer' | 'admin'
@@ -39,8 +48,43 @@ export type AuthBundle<Role extends string> = Readonly<{
 	org: Readonly<{ organizationId: string; role: Role }>
 	role: Role
 	actor: Actor<Role>
+	/** The resolved tenant — security.tenancy.resolve, or the organization id. */
+	tenant: string
 }>
 
+/**
+ * Row-level security configuration. Tenant isolation and role-level rules
+ * compose (AND) onto the same wrapped database: queries get a wrapped
+ * reader, mutations get triggers first, then a wrapped writer.
+ */
+export type SecurityConfig<
+	DataModel extends GenericDataModel,
+	Role extends string,
+> = {
+	/**
+	 * Tenant isolation. `tables` is THE registry: every listed table gets
+	 * read/insert/modify gated on row.tenant === ctx.tenant. Pair with
+	 * tenantTable (schema) and tenantOwnership (triggers) on the same list.
+	 */
+	tenancy?: {
+		tables: readonly TableNamesInDataModel<DataModel>[]
+		/** Maps the auth bundle to the tenant; defaults to org.organizationId. */
+		resolve?: (bundle: Omit<AuthBundle<Role>, 'tenant'>) => string
+	}
+	/**
+	 * Role-level (or any policy) rules derived from the authenticated bundle,
+	 * composed AND-wise with tenant isolation. E.g. gate `modify` on a table
+	 * to admin roles.
+	 */
+	rules?: (bundle: AuthBundle<Role>) => Rules<unknown, DataModel>
+	/**
+	 * Policy for tables with no rule. Defaults to 'deny' when tenancy is
+	 * configured (unlisted tables are unreachable — fail closed), 'allow'
+	 * otherwise.
+	 */
+	defaultPolicy?: RLSConfig['defaultPolicy']
+}
+
 type AnyAuthContext<DataModel extends GenericDataModel> =
 	| GenericQueryCtx<DataModel>
 	| GenericMutationCtx<DataModel>
@@ -90,6 +134,12 @@ export type AuthFunctionsConfig<
 	) => GenericMutationCtx<DataModel>
 	/** Upper bound for include() reads. */
 	maxIncludedQueryRows?: number
+	/**
+	 * Row-level security: tenant isolation (from a table registry) and
+	 * role-level rules, applied structurally inside every auth*, role*, and
+	 * admin* constructor. system* constructors stay unwrapped (trusted).
+	 */
+	security?: SecurityConfig<DataModel, Role>
 }
 
 /** WorkOS-style default: `member` writes; reader/writer/admin pass through. */
@@ -223,15 +273,68 @@ export function createAuthFunctions<
 					: undefined
 		const role = config.mapRole(organizationRole)
 		if (!role) return errors.throw({ code: 'FORBIDDEN' })
-		return Object.freeze({
+		const base = {
 			identity,
 			user: Object.freeze({ id: user.id }),
 			org: Object.freeze({ organizationId, role }),
 			role,
 			actor: Object.freeze({ userId: user.id, organizationId, role }),
+		}
+		return Object.freeze({
+			...base,
+			tenant: config.security?.tenancy?.resolve?.(base) ?? organizationId,
 		})
 	}
 
+	const securityConfig: RLSConfig | undefined = config.security
+		? {
+				defaultPolicy:
+					config.security.defaultPolicy ??
+					(config.security.tenancy ? 'deny' : 'allow'),
+			}
+		: undefined
+
+	function securityRules(
+		bundle: AuthBundle<Role>,
+	): Rules<unknown, DataModel> | undefined {
+		const security = config.security
+		if (!security) return undefined
+		const sets: Rules<unknown, DataModel>[] = []
+		if (security.tenancy) {
+			sets.push(
+				createTenantRules<DataModel>(bundle.tenant, security.tenancy.tables),
+			)
+		}
+		if (security.rules) sets.push(security.rules(bundle))
+		return sets.length === 1 ? sets[0] : composeRules(...sets)
+	}
+
+	function secureReader(
+		ctx: GenericQueryCtx<DataModel>,
+		bundle: AuthBundle<Role>,
+	): GenericQueryCtx<DataModel> {
+		const rules = securityRules(bundle)
+		if (!rules) return ctx
+		return {
+			...ctx,
+			db: wrapDatabaseReader({}, ctx.db, rules as never, securityConfig),
+		}
+	}
+
+	function secureWriter(
+		ctx: GenericMutationCtx<DataModel>,
+		bundle: AuthBundle<Role>,
+	): GenericMutationCtx<DataModel> {
+		const rules = securityRules(bundle)
+		if (!rules) return ctx
+		// Triggers wrap first (ctx already trigger-wrapped by the caller),
+		// then row-level security wraps the triggered db — order matters.
+		return {
+			...ctx,
+			db: wrapDatabaseWriter({}, ctx.db, rules as never, securityConfig),
+		}
+	}
+
 	async function verifiedMembership(userId: string, organizationId: string) {
 		if (!config.verifyMembership) return null
 		try {
@@ -253,15 +356,17 @@ export function createAuthFunctions<
 	}
 
 	async function queryInput(ctx: GenericQueryCtx<DataModel>) {
+		const bundle = await authenticatedUser(ctx)
 		return {
-			ctx: { ...ctx, include, ...(await authenticatedUser(ctx)) },
+			ctx: { ...secureReader(ctx, bundle), include, ...bundle },
 			args: {},
 		}
 	}
 
 	async function mutationInput(ctx: GenericMutationCtx<DataModel>) {
+		const bundle = await authenticatedUser(ctx)
 		return {
-			ctx: { ...wrapDB(ctx), include, ...(await authenticatedUser(ctx)) },
+			ctx: { ...secureWriter(wrapDB(ctx), bundle), include, ...bundle },
 			args: {},
 		}
 	}
@@ -275,20 +380,28 @@ export function createAuthFunctions<
 		if (!membership) return { ctx: { ...ctx, ...authenticated }, args: {} }
 		const role = config.mapRole(membership.roleSlug)
 		if (!role) return errors.throw({ code: 'FORBIDDEN' })
+		const verified = {
+			identity: authenticated.identity,
+			user: authenticated.user,
+			org: Object.freeze({
+				organizationId: membership.organizationId,
+				role,
+			}),
+			role,
+			actor: Object.freeze({
+				userId: authenticated.user.id,
+				organizationId: membership.organizationId,
+				role,
+			}),
+		}
 		return {
 			ctx: {
 				...ctx,
-				...authenticated,
-				org: Object.freeze({
-					organizationId: membership.organizationId,
-					role,
-				}),
-				role,
-				actor: Object.freeze({
-					userId: authenticated.user.id,
-					organizationId: membership.organizationId,
-					role,
-				}),
+				...verified,
+				// Tenant re-derives from the live-verified organization.
+				tenant:
+					config.security?.tenancy?.resolve?.(verified) ??
+					membership.organizationId,
 			},
 			args: {},
 		}

package/src/components/foundation/client.ts

@@ -35,12 +35,41 @@ export type AuditedOperation = Readonly<{
 	command: Readonly<{ parse: (value: unknown) => unknown }>
 	result: Readonly<{ parse: (value: unknown) => unknown }>
 	classification: string
+	/**
+	 * Permission slug required to execute this operation. Checked through the
+	 * Foundation's injected checkPermission BEFORE guards and the handler;
+	 * declaring a permission without injecting a checker fails closed.
+	 */
+	permission?: string
+	/**
+	 * Per-operation precondition, after the permission check and the registry
+	 * default guard, before the handler. Throw to deny — nothing has run yet.
+	 */
+	guard?: (context: never, command: never) => MaybePromise<void>
+	/**
+	 * Allowlist of aggregate types this operation's audit may reference. When
+	 * declared, an audit entry whose aggregate.type is not listed throws —
+	 * the audit vocabulary is enforced, not advisory.
+	 */
+	aggregates?: readonly string[]
 	audit: (
 		resolution: Readonly<{ command: never; result: never }>,
 		context: never,
 	) => MaybePromise<Omit<AuditEntryInput, 'classification'> | null>
 }>
 
+/** Registry-wide defaults applied to every operation of one Command. */
+export type CommandDefaults = Readonly<{
+	/** Runs before every operation's own guard. Throw to deny. */
+	guard?: (context: never) => MaybePromise<void>
+}>
+
+/** Injected permission policy: throw to deny. Host semantics, kit ordering. */
+export type PermissionChecker = (
+	context: never,
+	input: Readonly<{ permission: string; operation: string }>,
+) => MaybePromise<void>
+
 export type AuditedRegistry = Readonly<Record<string, AuditedOperation>>
 
 export type FoundationOptions = Readonly<{
@@ -52,6 +81,12 @@ export type FoundationOptions = Readonly<{
 			 */
 			writeAudit?: AuditWriter
 		}>
+	/**
+	 * Permission policy for operations that declare a `permission`. Runs
+	 * before guards and the handler; throw to deny. An operation with a
+	 * permission but no injected checker fails closed.
+	 */
+	checkPermission?: PermissionChecker
 }>
 
 type FoundationComponentApi = Readonly<{
@@ -68,6 +103,13 @@ class BoundCommand<Context, const Operations extends AuditedRegistry> {
 	readonly #kernel: CommandKernelClass<Context, Operations>
 	readonly #observability: Observability
 	readonly #writeAudit: AuditWriter
+	readonly #checkPermission: PermissionChecker | undefined
+	readonly #defaults: CommandDefaults
+
+	/** Declared aggregate types per operation — introspectable for tests. */
+	readonly aggregates: Readonly<{
+		[Key in OperationKey<Operations>]: Operations[Key]['aggregates']
+	}>
 
 	static operation<const Definition extends AuditedOperation>(
 		definition: Definition,
@@ -77,10 +119,25 @@ class BoundCommand<Context, const Operations extends AuditedRegistry> {
 
 	constructor(
 		operations: Operations,
-		deps: { observability: Observability; writeAudit: AuditWriter },
+		deps: {
+			observability: Observability
+			writeAudit: AuditWriter
+			checkPermission?: PermissionChecker
+			defaults?: CommandDefaults
+		},
 	) {
 		this.#observability = deps.observability
 		this.#writeAudit = deps.writeAudit
+		this.#checkPermission = deps.checkPermission
+		this.#defaults = deps.defaults ?? {}
+		this.aggregates = Object.freeze(
+			Object.fromEntries(
+				Object.entries(operations).map(([operation, definition]) => [
+					operation,
+					definition.aggregates,
+				]),
+			),
+		) as this['aggregates']
 		this.#kernel = new CommandKernelClass<Context, Operations>({
 			operations,
 			execute: (execution) => this.#execute(execution),
@@ -106,12 +163,35 @@ class BoundCommand<Context, const Operations extends AuditedRegistry> {
 				classification: execution.definition.classification,
 			},
 			async () => {
+				// Guards run before the handler: permission → default → operation.
+				const permission = execution.definition.permission
+				if (permission !== undefined) {
+					if (!this.#checkPermission) {
+						throw new CommandPermissionError(execution.operation)
+					}
+					await this.#checkPermission(execution.context as never, {
+						permission,
+						operation: execution.operation,
+					})
+				}
+				await this.#defaults.guard?.(execution.context as never)
+				await execution.definition.guard?.(
+					execution.context as never,
+					execution.command as never,
+				)
 				const result = await execution.run()
 				const audit = await execution.definition.audit(
 					{ command: execution.command, result } as never,
 					execution.context as never,
 				)
 				if (audit) {
+					const allowed = execution.definition.aggregates
+					if (allowed && !allowed.includes(audit.aggregate.type)) {
+						throw new CommandAggregateError(
+							execution.operation,
+							audit.aggregate.type,
+						)
+					}
 					await this.#writeAudit(execution.context as never, {
 						...audit,
 						classification: execution.definition.classification,
@@ -123,6 +203,30 @@ class BoundCommand<Context, const Operations extends AuditedRegistry> {
 	}
 }
 
+/** The audit referenced an aggregate type outside the operation's allowlist. */
+class CommandAggregateError extends Error {
+	readonly code = 'COMMAND_AGGREGATE_NOT_DECLARED'
+	readonly name = 'CommandAggregateError'
+
+	constructor(operation: string, aggregateType: string) {
+		super(
+			`Operation "${operation}" audited aggregate type "${aggregateType}" outside its declared aggregates`,
+		)
+	}
+}
+
+/** Fails closed: an operation declared a permission but no checker exists. */
+class CommandPermissionError extends Error {
+	readonly code = 'COMMAND_PERMISSION_NOT_CONFIGURED'
+	readonly name = 'CommandPermissionError'
+
+	constructor(operation: string) {
+		super(
+			`Operation "${operation}" declares a permission but the Foundation has no checkPermission`,
+		)
+	}
+}
+
 export type ApplicationCommand<
 	Context,
 	Operations extends AuditedRegistry,
@@ -131,6 +235,7 @@ export type ApplicationCommand<
 type CommandConstructor = {
 	new <Context, const Operations extends AuditedRegistry>(
 		operations: Operations,
+		defaults?: CommandDefaults,
 	): BoundCommand<Context, Operations>
 	operation: (typeof BoundCommand)['operation']
 }
@@ -153,12 +258,18 @@ export class Foundation<
 		const observability = new Observability(options.observability)
 		this.observability = observability
 		const writeAudit = options.observability.writeAudit ?? (() => undefined)
+		const checkPermission = options.checkPermission
 		this.Command = class <
 			Context,
 			const Operations extends AuditedRegistry,
 		> extends BoundCommand<Context, Operations> {
-			constructor(operations: Operations) {
-				super(operations, { observability, writeAudit })
+			constructor(operations: Operations, defaults?: CommandDefaults) {
+				super(operations, {
+					observability,
+					writeAudit,
+					checkPermission,
+					defaults,
+				})
 			}
 		}
 	}

package/src/index.ts

@@ -4,12 +4,23 @@ export {
 	type ErrorFactory,
 } from './errors'
 export {
+	createModule,
 	jsonSafeZid,
+	tenantTable,
 	TIMESTAMP_FIELDS,
 	zodTable,
 	zodVariantTable,
 	type TableBoundaryOptions,
 } from './zod-table'
+export {
+	assertTenantOwned,
+	composeRules,
+	createTenantRules,
+	requireTenantReference,
+	TENANT_FIELD,
+	type RLSConfig,
+	type Rules,
+} from './tenancy'
 export {
 	createAuthFunctions,
 	createInclude,
@@ -20,9 +31,11 @@ export {
 	type DefaultRole,
 	type Include,
 	type IncludedQuery,
+	type SecurityConfig,
 } from './auth'
 export {
 	appendOnly,
+	tenantOwnership,
 	createTriggers,
 	noDelete,
 	timestamps,
@@ -37,5 +50,7 @@ export {
 	type AuditedRegistry,
 	type AuditEntryInput,
 	type AuditWriter,
+	type CommandDefaults,
 	type FoundationOptions,
+	type PermissionChecker,
 } from './components/foundation/client'