okengine 0.13.0 → 0.15.2

package/src/elements/store/cache.test.ts

@@ -92,6 +92,7 @@ describe("autoCacheEligible", () => {
       false,
     );
     expect(autoCacheEligible({ effects: { reads: ["runs"] } })).toBe(false);
+    expect(autoCacheEligible({ effects: { reads: ["signal:notify"] } })).toBe(false);
     expect(autoCacheEligible({ effects: {} })).toBe(false);
   });
 
@@ -112,6 +113,7 @@ describe("autoCacheEligible", () => {
         { kind: "read", resource: "sql:views" },
         { kind: "read", resource: "sql:views" },
         { kind: "read", resource: "runs" },
+        { kind: "read", resource: "signal:notify" },
         { kind: "write", resource: "sql:views" },
         { kind: "ask", resource: "summarize" },
         { kind: "emit", resource: "view-changed" },

package/src/elements/store/cache.ts

@@ -53,7 +53,7 @@ export function tier1KeysForReads(
   effects: Effects,
   dimsByResource?: Readonly<Record<string, readonly string[]>>,
 ): string[] {
-  const reads = (effects.reads ?? []).filter((r): r is ResourceRef => r !== "runs");
+  const reads = (effects.reads ?? []).filter((r): r is ResourceRef => isStoreResourceRef(r));
   return reads.map((resource) => computedCacheKey(resource, dimsByResource?.[resource]));
 }
 
@@ -223,7 +223,7 @@ export function resolveCacheEffects(
   declared: Effects | undefined,
   learnedReads: readonly ResourceRef[] | undefined,
 ): Effects {
-  const declaredReads = (declared?.reads ?? []).filter((r) => r !== "runs");
+  const declaredReads = (declared?.reads ?? []).filter((r) => isStoreResourceRef(r));
   if (declaredReads.length > 0 || (declared?.writes?.length ?? 0) > 0) {
     return declared ?? {};
   }
@@ -275,7 +275,7 @@ export function autoCacheEligible(options: {
   const effects = options.effects ?? {};
   if ((effects.asks?.length ?? 0) > 0) return false;
   if ((effects.writes?.length ?? 0) > 0) return false;
-  const reads = (effects.reads ?? []).filter((r) => r !== "runs");
+  const reads = (effects.reads ?? []).filter((r) => isStoreResourceRef(r));
   return reads.length > 0;
 }
 

package/src/elements/store/declare.ts

@@ -122,13 +122,12 @@ export interface IndexStoreDecl extends StoreDeclBase {
 export type StoreDecl = SqlStoreDecl | KvStoreDecl | FilesStoreDecl | IndexStoreDecl;
 
 /**
- * `store.sql` / `store.files` push into the shared {@link storeRegistry}
+ * Every `store.*` facet pushes into the shared {@link storeRegistry}
  * (`src/kernel/element-registries.ts`) so {@link oke} can auto-populate
  * `stores` with zero explicit array — mirrors the {@link on} trigger-drain
- * registry (`src/kernel/on.ts`). `store.kv` / `store.index` are
- * intentionally not auto-registered (out of scope).
+ * registry (`src/kernel/on.ts`).
  *
- * Snapshot of every `store.sql` / `store.files` declared since the last reset.
+ * Snapshot of every store declared since the last reset.
  */
 export function listStores(): readonly StoreDecl[] {
   return storeRegistry.slice();
@@ -180,13 +179,15 @@ export function sql(name: string, options: SqlStoreOptions = {}): SqlStoreDecl {
  * @param options - Options
  */
 export function kv(name: string, options: KvStoreOptions = {}): KvStoreDecl {
-  return {
+  const decl: KvStoreDecl = {
     facet: "kv",
     name,
     ref: `kv:${name}`,
     ...(options.description !== undefined ? { description: options.description } : {}),
     ...(options.durable === true ? { durable: true } : {}),
   };
+  storeRegistry.push(decl);
+  return decl;
 }
 
 /**
@@ -213,13 +214,15 @@ export function files(name: string, options: FilesStoreOptions = {}): FilesStore
  * @param options - Dimensions
  */
 export function index(name: string, options: IndexStoreOptions = {}): IndexStoreDecl {
-  return {
+  const decl: IndexStoreDecl = {
     facet: "index",
     name,
     ref: `index:${name}`,
     ...(options.description !== undefined ? { description: options.description } : {}),
     dims: options.dims,
   };
+  storeRegistry.push(decl);
+  return decl;
 }
 
 /** Public `store` element — four facets + abstract schema declare + resource. */

package/src/elements/store/emit-drizzle.ts

@@ -21,9 +21,11 @@ import {
   type SchemaColumnDecl,
   type SchemaColumnInput,
   type SchemaRelationEntry,
+  type SchemaPolicyDecl,
   type SchemaRelationsDecl,
   type SchemaTableDecl,
 } from "./schema-decl.ts";
+import { emitPgPolicySource, parseSqlPolicySpec } from "../../drivers/pg-rls.ts";
 
 /** Supported Drizzle dialects for domain schema emit (Postgres-family only). */
 export type SqlDialect = "postgres";
@@ -186,7 +188,12 @@ export function emitDrizzleSource(
     Object.values(t.columns).some((c) => c.sqlType === "integer"),
   );
   const pgIntImport = needsInteger ? "bigint" : null;
-  const coreImport = `import { pgTable, text${pgIntImport ? `, ${pgIntImport}` : ""} } from "drizzle-orm/pg-core";`;
+  const needsPolicy = tables.some((t) => (t.policies?.length ?? 0) > 0);
+  const coreNames = ["pgTable", "text", pgIntImport, needsPolicy ? "pgPolicy" : null].filter(
+    (name): name is string => name !== null,
+  );
+  const coreImport = `import { ${coreNames.join(", ")} } from "drizzle-orm/pg-core";`;
+  const sqlImport = needsPolicy ? `import { sql } from "drizzle-orm";\n` : "";
 
   const needsId = tables.some((t) =>
     Object.values(t.columns).some((c) => c.defaultFnKind === "id"),
@@ -204,19 +211,14 @@ export function emitDrizzleSource(
   const relationsImport =
     relations.length > 0 ? `import { defineRelations } from "drizzle-orm";\n` : "";
 
-  const blocks = tables.map((table) => {
-    const lines = Object.values(table.columns).map(
-      (col) => `  ${col.key}: ${emitColumnSource(col, dialect)},`,
-    );
-    const sqlName = schemaTableSqlName(table) ?? table.name;
-    return `export const ${exportNameForTable(sqlName)} = pgTable(${JSON.stringify(sqlName)}, {\n${lines.join("\n")}\n});`;
-  });
+  const blocks = tables.map((table) => emitTableBlock(table, dialect));
 
   const relationsBlock = emitRelationsSource(relations);
 
   return [
     GENERATED_SCHEMA_HEADER,
     coreImport,
+    sqlImport.trimEnd(),
     relationsImport.trimEnd(),
     helperImport.trimEnd(),
     "",
@@ -228,6 +230,40 @@ export function emitDrizzleSource(
     .join("\n");
 }
 
+function emitTableBlock(table: SchemaTableDecl, dialect: SqlDialect): string {
+  const lines = Object.values(table.columns).map(
+    (col) => `  ${col.key}: ${emitColumnSource(col, dialect)},`,
+  );
+  const sqlName = schemaTableSqlName(table) ?? table.name;
+  const exportName = exportNameForTable(sqlName);
+  const cols = `{\n${lines.join("\n")}\n}`;
+  const policies = table.policies ?? [];
+  if (policies.length === 0) {
+    const ctor = table.rls === true ? "pgTable.withRLS" : "pgTable";
+    return `export const ${exportName} = ${ctor}(${JSON.stringify(sqlName)}, ${cols});`;
+  }
+  const extras = policies.map((policy) => `  ${emitPolicyExtra(policy, sqlName)},`).join("\n");
+  return `export const ${exportName} = pgTable(${JSON.stringify(sqlName)}, ${cols}, (_t) => [\n${extras}\n]);`;
+}
+
+function emitPolicyExtra(policy: SchemaPolicyDecl, table: string): string {
+  const roles = Array.isArray(policy.to)
+    ? policy.to.join(", ")
+    : typeof policy.to === "string"
+      ? policy.to
+      : "public";
+  const spec = parseSqlPolicySpec({
+    name: policy.name,
+    table,
+    as: policy.as,
+    to: roles,
+    for: policy.for,
+    using: policy.using,
+    withCheck: policy.withCheck,
+  });
+  return emitPgPolicySource(spec).replaceAll("\n", "\n  ");
+}
+
 function exportNameForTable(name: string): string {
   // Keep simple SQL names as-is; camelCase odd names.
   if (/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) return name;

package/src/elements/store/resource.test.ts

@@ -7,7 +7,7 @@
 
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { integer, pgTable, text } from "drizzle-orm/pg-core";
-import { createInsertSchema, createSelectSchema } from "drizzle-zod";
+import { createInsertSchema, createSelectSchema } from "drizzle-orm/zod";
 import { z } from "zod";
 import { pgliteDriver } from "../../drivers/pglite.ts";
 import type { SqlConnection } from "../../drivers/types.ts";

package/src/elements/store/rls-identity.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, test } from "bun:test";
+import type { Manifest } from "../../manifest/types.ts";
+import { firstPolicyOrPublic, resolveRlsIdentity, rlsIdentityFromAuth } from "./rls-identity.ts";
+
+const MANIFEST: Manifest = {
+  oke: "1.0",
+  app: "app",
+  gates: {
+    public: { kind: "policy" },
+    member: { kind: "policy", description: "Signed-in" },
+    "booking:create": { kind: "policy", scopes: ["booking:create"] },
+    "rate:x": { kind: "rate", max: 1, per: "1m" },
+  },
+};
+
+describe("resolveRlsIdentity", () => {
+  test("operator omit and bypass skip the stamp", () => {
+    expect(resolveRlsIdentity({})).toBeNull();
+    expect(resolveRlsIdentity({ asGate: "member", bypass: true })).toBeNull();
+  });
+
+  test("public and policy-only leave userId empty", () => {
+    expect(resolveRlsIdentity({ asGate: "public", manifest: MANIFEST })).toEqual({
+      gate: "public",
+      userId: "",
+      scopes: [],
+    });
+    expect(resolveRlsIdentity({ asGate: "member", manifest: MANIFEST })).toEqual({
+      gate: "member",
+      userId: "",
+      scopes: ["member"],
+    });
+    expect(resolveRlsIdentity({ asGate: "booking:create", manifest: MANIFEST })).toEqual({
+      gate: "booking:create",
+      userId: "",
+      scopes: ["booking:create"],
+    });
+  });
+
+  test("seeded user keeps real id and mapped gate", () => {
+    expect(
+      resolveRlsIdentity({
+        asUserId: "u1",
+        asGate: "member",
+        identities: [{ id: "u1", scopes: ["member"], status: "active" }],
+        manifest: MANIFEST,
+      }),
+    ).toEqual({ gate: "member", userId: "u1", scopes: ["member"] });
+  });
+
+  test("refuses rate gates", () => {
+    expect(resolveRlsIdentity({ asGate: "rate:x", manifest: MANIFEST })).toBeNull();
+  });
+});
+
+describe("rlsIdentityFromAuth", () => {
+  test("uses the first policy/public and live userId", () => {
+    expect(
+      rlsIdentityFromAuth({
+        userId: "u1",
+        scopes: new Set(["member", "booking:create"]),
+        gateNames: ["member", "booking:create"],
+      }),
+    ).toEqual({
+      gate: "member",
+      userId: "u1",
+      scopes: ["member", "booking:create"],
+    });
+  });
+
+  test("skips cron (no gates) and operator bypass", () => {
+    expect(
+      rlsIdentityFromAuth({
+        userId: null,
+        scopes: [],
+        gateNames: [],
+      }),
+    ).toBeNull();
+    expect(
+      rlsIdentityFromAuth({
+        userId: "op",
+        scopes: [],
+        gateNames: ["member"],
+        operator: true,
+      }),
+    ).toBeNull();
+  });
+});
+
+describe("firstPolicyOrPublic", () => {
+  test("skips rate ids", () => {
+    expect(firstPolicyOrPublic(["rate:x", "member"])).toBe("member");
+    expect(firstPolicyOrPublic(["public"])).toBe("public");
+  });
+});

package/src/elements/store/rls-identity.ts

@@ -0,0 +1,116 @@
+/**
+ * One Gate → RLS identity bag for Console, Call API, and `fx.store`.
+ */
+
+import type { Manifest } from "../../manifest/types.ts";
+import type { RlsIdentity } from "../../drivers/pg-rls.ts";
+
+export type { RlsIdentity };
+
+/** Seeded Console identity used by invoke-as / Gate picker. */
+export type RlsIdentityRow = {
+  readonly id: string;
+  readonly scopes: readonly string[];
+  readonly status?: string;
+};
+
+/** Input to {@link resolveRlsIdentity}. */
+export type ResolveRlsIdentityInput = {
+  readonly asGate?: string | null;
+  readonly asUserId?: string | null;
+  readonly bypass?: boolean;
+  readonly identities?: readonly RlsIdentityRow[];
+  readonly manifest?: Manifest | null;
+};
+
+/**
+ * Console / Call API bag. Operator and `bypass` return `null` (no stamp).
+ *
+ * @param input - Picker + Manifest
+ */
+export function resolveRlsIdentity(input: ResolveRlsIdentityInput): RlsIdentity | null {
+  if (input.bypass === true) return null;
+  const asGate = input.asGate?.trim() || null;
+  const asUserId = input.asUserId?.trim() || null;
+  if (!asGate && !asUserId) return null;
+
+  if (asUserId) {
+    const identity = (input.identities ?? []).find(
+      (row) => row.id === asUserId && row.status !== "disabled",
+    );
+    if (!identity) return null;
+    const gate = asGate ?? policyGateForScopes(identity.scopes, input.manifest);
+    if (!gate) return null;
+    return { gate, userId: identity.id, scopes: [...identity.scopes] };
+  }
+
+  if (!asGate) return null;
+  if (asGate === "public") {
+    return { gate: "public", userId: "", scopes: [] };
+  }
+
+  const declared = input.manifest?.gates?.[asGate];
+  if (!declared || declared.kind === "rate" || asGate.startsWith("rate:")) return null;
+  const scopes = declared.scopes && declared.scopes.length > 0 ? declared.scopes : [asGate];
+  return { gate: asGate, userId: "", scopes: [...scopes] };
+}
+
+/**
+ * Live HTTP / resource-mount bag after Gate passes.
+ *
+ * @param input - `fx.auth` + trigger gate names
+ */
+export function rlsIdentityFromAuth(input: {
+  readonly userId: string | null;
+  readonly scopes: ReadonlySet<string> | readonly string[];
+  readonly gateNames: readonly string[];
+  readonly bypass?: boolean;
+  readonly operator?: boolean;
+}): RlsIdentity | null {
+  if (input.bypass === true || input.operator === true) return null;
+  const gate = firstPolicyOrPublic(input.gateNames);
+  if (!gate) return null;
+  const scopes = Array.isArray(input.scopes) ? input.scopes : [...input.scopes];
+  return {
+    gate,
+    userId: input.userId ?? "",
+    scopes,
+  };
+}
+
+/**
+ * First policy/public name (rate ids skipped).
+ *
+ * @param names - Trigger gate names
+ */
+export function firstPolicyOrPublic(names: readonly string[]): string | null {
+  for (const name of names) {
+    if (name.startsWith("rate:")) continue;
+    if (name.length > 0) return name;
+  }
+  return null;
+}
+
+/**
+ * First Manifest policy implied by scopes (name, then declared roles).
+ *
+ * @param scopes - Identity scopes
+ * @param manifest - Current Manifest
+ */
+export function policyGateForScopes(
+  scopes: readonly string[],
+  manifest: Manifest | null | undefined,
+): string | null {
+  const gates = manifest?.gates ?? {};
+  for (const scope of scopes) {
+    const gate = gates[scope];
+    if (gate && gate.kind !== "rate") return scope;
+  }
+  for (const scope of scopes) {
+    for (const [name, gate] of Object.entries(gates)) {
+      if (gate.kind === "rate") continue;
+      if ((gate.roles ?? []).includes(scope)) return name;
+    }
+  }
+  return null;
+}

package/src/elements/store/runtime.ts

@@ -24,6 +24,7 @@ import type {
   VectorIndexStore,
 } from "../../drivers/types.ts";
 import { indexDriverNeedsSql } from "../../drivers/types.ts";
+import type { RlsIdentity } from "../../drivers/pg-rls.ts";
 import { buildClassificationMap, type MaskRowsOptions } from "./classify.ts";
 import {
   createStoreCache,
@@ -112,6 +113,8 @@ export interface StoreInvokeContext {
   readonly effects: Effects;
   /** Reveal PII (gated elsewhere). */
   readonly revealPii?: boolean;
+  /** Gate identity for RLS (`oke.gate` / `oke.user` / `oke.has_scope`). */
+  readonly rls?: RlsIdentity;
 }
 
 /** Unified handle returned for any facet. */
@@ -347,6 +350,7 @@ export function createStoreRuntime(options: CreateStoreRuntimeOptions): StoreRun
       revealPii: ctx.revealPii,
       routedRole: target.role,
       domainDdl: options.domainDdl ?? "ensure",
+      ...(ctx.rls ? { rls: ctx.rls } : {}),
     });
   }
 

package/src/elements/store/schema-decl.test.ts

@@ -260,3 +260,40 @@ describe("emitDrizzleSource — references + relations (Linkly-shaped)", () => {
     expect(relations.config.daily?.link?.target).toBe("links");
   });
 });
+
+describe("store.schema RLS extras", () => {
+  test("helpers stamp rls + named policies", () => {
+    const bookings = store.schema.table(
+      "bookings",
+      {
+        id: field.text().primaryKey(),
+        owner: field.text().notNull(),
+      },
+      [
+        store.schema.policy.gate("member", { for: "select" }),
+        store.schema.policy.owner("owner", { for: "all" }),
+        store.schema.policy.scope("booking:create", { for: "insert" }),
+      ],
+    );
+    expect(bookings.rls).toBe(true);
+    expect(bookings.policies?.map((p) => p.name)).toEqual([
+      "gate_member_select",
+      "owner_owner_all",
+      "scope_booking_create_insert",
+    ]);
+    const src = emitDrizzleSource([bookings], "postgres");
+    expect(src).toContain("pgPolicy");
+    expect(src).toContain("oke.gate() = ");
+    expect(src).toContain("oke.user()");
+    expect(src).toContain("oke.has_scope(");
+  });
+
+  test("rls() without policies emits pgTable.withRLS", () => {
+    const notes = store.schema.table("notes", { id: field.text().primaryKey() }, [
+      store.schema.rls(),
+    ]);
+    expect(notes.rls).toBe(true);
+    expect(notes.policies).toBeUndefined();
+    expect(emitDrizzleSource([notes], "postgres")).toContain("pgTable.withRLS");
+  });
+});

package/src/elements/store/schema-decl.ts

@@ -69,6 +69,42 @@ export interface SchemaColumnDecl extends ColumnDef {
   getSQL(): never;
 }
 
+/** Policy command on a {@link SchemaPolicyDecl}. */
+export type SchemaPolicyFor = "all" | "select" | "insert" | "update" | "delete";
+
+/** Policy behavior on a {@link SchemaPolicyDecl}. */
+export type SchemaPolicyAs = "permissive" | "restrictive";
+
+/**
+ * Drizzle-shaped policy extra (`pgPolicy` emit).
+ */
+export interface SchemaPolicyDecl {
+  readonly kind: "schema-policy";
+  readonly name: string;
+  readonly as?: SchemaPolicyAs;
+  readonly to?: string | readonly string[];
+  readonly for?: SchemaPolicyFor;
+  readonly using?: string;
+  readonly withCheck?: string;
+}
+
+/** Enable RLS with no policies (`pgTable.withRLS`). */
+export interface SchemaRlsEnableDecl {
+  readonly kind: "schema-rls";
+}
+
+/** Third-arg extra for {@link schemaTable}. */
+export type SchemaTableExtra = SchemaPolicyDecl | SchemaRlsEnableDecl;
+
+/** Options for {@link schemaPolicy} / Gate helpers. */
+export interface SchemaPolicyOptions {
+  readonly as?: SchemaPolicyAs;
+  readonly to?: string | readonly string[];
+  readonly for?: SchemaPolicyFor;
+  readonly using?: string;
+  readonly withCheck?: string;
+}
+
 /** Table from {@link store.schema.table} — extends {@link TableHandle}. */
 export interface SchemaTableDecl extends TableHandle {
   readonly kind: "schema-table";
@@ -78,6 +114,10 @@ export interface SchemaTableDecl extends TableHandle {
    * (spreading columns would otherwise shadow {@link TableHandle.name}).
    */
   readonly tableName?: string;
+  /** `true` when {@link schemaRls} was declared or any policy is present. */
+  readonly rls?: boolean;
+  /** Declared policies (emit + Manifest). */
+  readonly policies?: readonly SchemaPolicyDecl[];
 }
 
 /** Fluent field builder before key finalization. */
@@ -310,20 +350,28 @@ export type SchemaTableWithColumns<
  *
  * @param name - SQL table name
  * @param columns - Column map using {@link field} builders
+ * @param extras - RLS enable + {@link schemaPolicy} extras (Drizzle third arg)
  */
 export function schemaTable<C extends Record<string, SchemaColumnInput>>(
   name: string,
   columns: C,
+  extras: readonly SchemaTableExtra[] = [],
 ): SchemaTableWithColumns<{ [K in keyof C]: SchemaColumnDecl }> {
   const finalized = finalizeColumnMap(columns);
   const stamped: Record<string, SchemaColumnDecl> = {};
   for (const [key, col] of Object.entries(finalized)) {
     stamped[key] = { ...col, tableName: name };
   }
+  const policies = extras.filter(
+    (extra): extra is SchemaPolicyDecl => extra.kind === "schema-policy",
+  );
+  const rls = extras.some((extra) => extra.kind === "schema-rls") || policies.length > 0;
   const table = {
     name,
     columns: stamped,
     ...stamped,
+    ...(rls ? { rls: true } : {}),
+    ...(policies.length > 0 ? { policies } : {}),
   };
   // Survive columns named `name` or `kind` (they would otherwise shadow
   // the table discriminant / SQL name).
@@ -332,6 +380,117 @@ export function schemaTable<C extends Record<string, SchemaColumnInput>>(
   return table as SchemaTableWithColumns<{ [K in keyof C]: SchemaColumnDecl }>;
 }
 
+/**
+ * Enable RLS with no policies (`pgTable.withRLS`).
+ */
+export function schemaRls(): SchemaRlsEnableDecl {
+  return { kind: "schema-rls" };
+}
+
+/**
+ * Raw Drizzle-shaped policy extra.
+ *
+ * @param name - Policy name
+ * @param options - `as` / `to` / `for` / `using` / `withCheck`
+ */
+export function schemaPolicy(name: string, options: SchemaPolicyOptions = {}): SchemaPolicyDecl {
+  return {
+    kind: "schema-policy",
+    name,
+    ...(options.as !== undefined ? { as: options.as } : {}),
+    ...(options.to !== undefined ? { to: options.to } : {}),
+    ...(options.for !== undefined ? { for: options.for } : {}),
+    ...(options.using !== undefined ? { using: options.using } : {}),
+    ...(options.withCheck !== undefined ? { withCheck: options.withCheck } : {}),
+  };
+}
+
+function sqlStringLiteral(value: string): string {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+
+function helperPolicyName(prefix: string, key: string, command: SchemaPolicyFor): string {
+  const slug = key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_|_$/g, "");
+  return `${prefix}_${slug}_${command}`;
+}
+
+function policyPredicates(
+  command: SchemaPolicyFor,
+  expr: string,
+): { readonly using?: string; readonly withCheck?: string } {
+  if (command === "insert") return { withCheck: expr };
+  if (command === "update" || command === "all") return { using: expr, withCheck: expr };
+  return { using: expr };
+}
+
+/**
+ * Gate-name policy — `oke.gate() = 'member'`.
+ *
+ * @param gate - Policy / public Gate name
+ * @param options - Command (default `select`)
+ */
+export function schemaPolicyGate(
+  gate: string,
+  options: Pick<SchemaPolicyOptions, "for" | "as" | "to"> = {},
+): SchemaPolicyDecl {
+  const command = options.for ?? "select";
+  return schemaPolicy(helperPolicyName("gate", gate, command), {
+    ...options,
+    for: command,
+    ...policyPredicates(command, `oke.gate() = ${sqlStringLiteral(gate)}`),
+  });
+}
+
+/**
+ * Owner-column policy — `owner = oke.user()`.
+ *
+ * @param column - SQL / JS column name
+ * @param options - Command (default `all`)
+ */
+export function schemaPolicyOwner(
+  column: string,
+  options: Pick<SchemaPolicyOptions, "for" | "as" | "to"> = {},
+): SchemaPolicyDecl {
+  const command = options.for ?? "all";
+  return schemaPolicy(helperPolicyName("owner", column, command), {
+    ...options,
+    for: command,
+    ...policyPredicates(command, `${column} = oke.user()`),
+  });
+}
+
+/**
+ * Scope policy — `oke.has_scope('booking:create')`.
+ *
+ * @param scope - Scope string
+ * @param options - Command (default `insert`)
+ */
+export function schemaPolicyScope(
+  scope: string,
+  options: Pick<SchemaPolicyOptions, "for" | "as" | "to"> = {},
+): SchemaPolicyDecl {
+  const command = options.for ?? "insert";
+  return schemaPolicy(helperPolicyName("scope", scope, command), {
+    ...options,
+    for: command,
+    ...policyPredicates(command, `oke.has_scope(${sqlStringLiteral(scope)})`),
+  });
+}
+
+/** Callable `store.schema.policy` plus Gate helpers. */
+export type SchemaPolicyApi = typeof schemaPolicy & {
+  readonly gate: typeof schemaPolicyGate;
+  readonly owner: typeof schemaPolicyOwner;
+  readonly scope: typeof schemaPolicyScope;
+};
+
+/** `store.schema.policy` — raw + Gate helpers. */
+export const schemaPolicyApi: SchemaPolicyApi = Object.assign(schemaPolicy, {
+  gate: schemaPolicyGate,
+  owner: schemaPolicyOwner,
+  scope: schemaPolicyScope,
+});
+
 // ─── Relations (mirrors drizzle-orm `defineRelations`) ───────────────────────
 
 /** Column path recorded by relation helpers (`r.links.code`). */
@@ -527,6 +686,8 @@ export function schemaRelations<T extends Readonly<Record<string, SchemaTableDec
 export const schema = {
   table: schemaTable,
   relations: schemaRelations,
+  rls: schemaRls,
+  policy: schemaPolicyApi,
 } as const;
 
 /**

package/src/elements/store/seed.ts

@@ -61,7 +61,7 @@ export function resolveSeedIdentity(
 }
 
 /**
- * Confirm copy for `oke dev` / `oke db seed` — names this app's seed.
+ * Confirm copy for `oke db seed` — names this app's seed.
  *
  * @param identity - Resolved {@link SeedIdentity}
  */