{"_id":"@aiquants/authz-drizzle","_rev":"17-8d7426e1e594d9927dd4e39905901049","name":"@aiquants/authz-drizzle","dist-tags":{"latest":"1.3.1"},"versions":{"0.1.0":{"name":"@aiquants/authz-drizzle","version":"0.1.0","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.1.0","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"faee7ba791413e045fb0d096ed0073d883651db3","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.1.0.tgz","fileCount":9,"integrity":"sha512-It4GOoF+BWnEYX+y0/4OwBgrrnzO/te2w+jE33CSG4z+uOwvoWcTImpnraDipeH/FZOWng2xOvldQQn7Y4MgRQ==","signatures":[{"sig":"MEYCIQDlm3Kh4GbbB+uK4KuOnpdgHGpwS5Fu6I285XLxl/OauQIhAIxCSK9t5cXxorCoYV+I/EeXlR6LR/Wvb2QLRy+Zo5uX","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":149350},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"npm version major && pnpm publish --no-git-checks","publish:minor":"npm version minor && pnpm publish --no-git-checks","publish:patch":"npm version patch && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","dependencies":{"@aiquants/authz-core":"0.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-beta.10-42c284e","@vitest/coverage-v8":"^4.1.8"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.1.0_1782370740871_0.9233613661722819","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@aiquants/authz-drizzle","version":"0.1.1","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.1.1","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"70b365153744ebd0e10412a56300f068c05c90c6","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.1.1.tgz","fileCount":9,"integrity":"sha512-OQm33DtgDP/gB+ANBL5HT+JnM1pwTegwCFI7rcNAswqcFUe3BvSnOfBckO5zbuw5dRvRyKN3jkFnIYm2X/VY5Q==","signatures":[{"sig":"MEQCIEFp7IJEJE74Vfz9qQN80MbAvd8HmitM1cDFHOl+rbJJAiA6bB+VV7XaL0g3IN1KuC6+9soKCxLVPsAmukLZisgBPQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":201500},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"gitHead":"6f6b127785a33a1497be65e090566897f3408a98","scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"npm version major && pnpm publish --no-git-checks","publish:minor":"npm version minor && pnpm publish --no-git-checks","publish:patch":"npm version patch && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage","prepublishOnly":"pnpm run clean && pnpm run typecheck && pnpm run --if-present test && pnpm run build"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"_npmVersion":"11.16.0","description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"24.16.0","dependencies":{"@aiquants/authz-core":"workspace:*"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-beta.10-42c284e","@vitest/coverage-v8":"^4.1.8"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.1.1_1782779499994_0.9462867055336928","host":"s3://npm-registry-packages-npm-production"}},"0.1.3":{"name":"@aiquants/authz-drizzle","version":"0.1.3","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.1.3","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"34cbdfc79fc6eeb8d88ba0edd5fd8ccc538b38eb","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.1.3.tgz","fileCount":9,"integrity":"sha512-6bKjx1BGJRaxolE0trsMtI8pwvPIMcJ4ZoSX60uW1DBwafX+y/GivuuEXB8Y19Z3YE1LrGilkUHd5eCZXkadRA==","signatures":[{"sig":"MEYCIQDWMRkui7tMkWeBeX2VnUG0MzY7w467FBQpltA8nvXqYgIhAPCfV7g671y9D5wO8NEyVdl6GIywk9QJXqDqgzWbrOKo","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":201383},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"npm version major && pnpm publish --no-git-checks","publish:minor":"npm version minor && pnpm publish --no-git-checks","publish:patch":"npm version patch && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","dependencies":{"@aiquants/authz-core":"0.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-beta.10-42c284e","@vitest/coverage-v8":"^4.1.8"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.1.3_1782781239633_0.5505059974887407","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@aiquants/authz-drizzle","version":"0.2.0","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.2.0","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"0ae545d79b9244ff449de6dd88c15f0cb2d5f0bb","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.2.0.tgz","fileCount":9,"integrity":"sha512-37kPOmbnQ+rqQ3rLu3n9uIrD7yho+K4rGcURM6md633jCwGYFj94e3P1nTGDgZTRYBiHVFN6z9UoMUgMOMsrTw==","signatures":[{"sig":"MEYCIQCCAoYh075PmR8wF3euG3+4w+r4J5dy7ixXy2pA4jG2WgIhALXj70d6Wx6jj3n+gEWkNCvYU7KyG+MIJXxLkNI9AcAI","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":214384},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"npm version major && pnpm publish --no-git-checks","publish:minor":"npm version minor && pnpm publish --no-git-checks","publish:patch":"npm version patch && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","dependencies":{"@aiquants/authz-core":"0.2.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-beta.10-42c284e","@vitest/coverage-v8":"^4.1.8"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.2.0_1782877085068_0.7946569385586144","host":"s3://npm-registry-packages-npm-production"}},"0.2.1":{"name":"@aiquants/authz-drizzle","version":"0.2.1","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.2.1","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"cf01dde03e4b765621c1a061fb6bb4375e7d7ea5","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.2.1.tgz","fileCount":9,"integrity":"sha512-dVgSPt4cdAEIX8GyKO7EXU4kozEYRWcQJsuAsLJz4+u1IMWlZrkSVLzBtAKkfOzb9DbJZ7k360keMBIkEzyNaA==","signatures":[{"sig":"MEUCIBn+kwvP2rJsYHgw0zHhGGOIGqMLA9LffxEFVkuUI4LEAiEAyewEBedTgC/HuuDlXLim2YNXjxGPAUN3qr/GVlEbmVg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":214373},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"npm version major && pnpm publish --no-git-checks","publish:minor":"npm version minor && pnpm publish --no-git-checks","publish:patch":"npm version patch && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","dependencies":{"@aiquants/authz-core":"0.2.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.2.1_1782991433370_0.06038235483514298","host":"s3://npm-registry-packages-npm-production"}},"0.2.2":{"name":"@aiquants/authz-drizzle","version":"0.2.2","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.2.2","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"961aa340c9549b2db79a8f4c018cbd9bb8092ce9","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.2.2.tgz","fileCount":9,"integrity":"sha512-wE1i63saP0pehluKCwRs8W6iraDYzdouLzxHC4K84gMRQCGiX7VOxoexKRn7PrB+rp+V82CAokUxka7dXZs1fw==","signatures":[{"sig":"MEQCIFr39hYIRlG6wyeh/aEVonO9C/pj/NkdHDgCENrGn6QGAiAuOSNFercy4W0wLFFN8IRb1gw5H4pUb2c5QnNuLaDrwA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":219484},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm version major --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm version minor --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm version patch --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","dependencies":{"@aiquants/authz-core":"0.2.1"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.2.2_1784162313292_0.06137542868627044","host":"s3://npm-registry-packages-npm-production"}},"0.2.3":{"name":"@aiquants/authz-drizzle","version":"0.2.3","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.2.3","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"1d3e0af7eeac7a36955d7d534f4be6fd70656fee","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.2.3.tgz","fileCount":9,"integrity":"sha512-oWYCM0DcKvp4FK/xZEAOnEBTL0/SvBffcVjOrualQxKaZhyu0DxBSkNSF8RKDVCOa/laR7EFPYTeJwGNXBf3tg==","signatures":[{"sig":"MEYCIQC+P7J/SJ7cbYd9roSM/r2kMwcOc/0MfMeEVRhoxMA7ngIhANI3bKILEiPMsefUp9+9Gzdm2Qvyfg1ahVQ/TaT8L9vE","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":220796},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm version major --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm version minor --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm version patch --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.2.2"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.2.2"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.2.3_1784168332212_0.7328468174239535","host":"s3://npm-registry-packages-npm-production"}},"0.2.4":{"name":"@aiquants/authz-drizzle","version":"0.2.4","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.2.4","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"f587aa5c0e5efeb96758f2a560da2a8787f87949","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.2.4.tgz","fileCount":9,"integrity":"sha512-PyfPo7NTyGbITLW85m+R+ckG/9GhqY0RkoJofPp6gFlflAfDlaeRtMk0cfud+2zaVClHsK64WjjWvGsbyPmWDQ==","signatures":[{"sig":"MEUCIQCVUeDwLBEV47KxxY83g8O3K3yw5EEpLny6q7DI96bbrgIgNyJCYHUjPEPKN0nzCOCcdfgfZCqh/sHhT59uDEUoNmo=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":221015},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm run typecheck && pnpm run --if-present test && pnpm version major --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm run typecheck && pnpm run --if-present test && pnpm version minor --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm run typecheck && pnpm run --if-present test && pnpm version patch --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.2.5"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.2.5"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.2.4_1784773422387_0.5664173092251266","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@aiquants/authz-drizzle","version":"0.3.0","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.3.0","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"d95f023515ebf2270750d2bcf9b2f946721933c6","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.3.0.tgz","fileCount":9,"integrity":"sha512-w6+lKFd0sadsoe8Qd/AaocpbxCzFlYoOuNMNVqm2r6+uFXrhLhIUKeneygcz5WTeBBDi18PQ9gIqpNR2aedDBQ==","signatures":[{"sig":"MEYCIQDxrdawNapmErG4x1obuPZ69SOl3eeL6XUnBeWIQe727QIhAMG4LM4bHDF6AU/Fpv2l3AtmxBviRT3Bbuf5N+KAhEfa","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":361209},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm run typecheck && pnpm run --if-present test && pnpm version major --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm run typecheck && pnpm run --if-present test && pnpm version minor --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm run typecheck && pnpm run --if-present test && pnpm version patch --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.3.0"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.3.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.3.0_1785927845167_0.13644330117566805","host":"s3://npm-registry-packages-npm-production"}},"0.4.0":{"name":"@aiquants/authz-drizzle","version":"0.4.0","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.4.0","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"27918e611f75ffcdc306d4a72955fd061ee23ec4","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.4.0.tgz","fileCount":9,"integrity":"sha512-h81EwWGJahZHyPq4ZYP7qvqnzV6Y4AyRfPuCcPinZMKpbCZ8lroRCimTlJjQm9uyri3HEXoeMvEusAVTAOyksA==","signatures":[{"sig":"MEUCIQDZpUrPjcloeAYxuJ16q/SHP42OE+Sk/VjbwGQApmupPAIgSPE3n7gp348/Iq/0/2fUzTZKnEhymlqUpl8oBf6E6CI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":406050},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm run typecheck && pnpm run --if-present test && pnpm version major --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm run typecheck && pnpm run --if-present test && pnpm version minor --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm run typecheck && pnpm run --if-present test && pnpm version patch --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.4.0"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.4.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.4.0_1786372612401_0.859850211197839","host":"s3://npm-registry-packages-npm-production"}},"0.5.0":{"name":"@aiquants/authz-drizzle","version":"0.5.0","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@0.5.0","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"26d605b1535726cb3f132e706239cde7b67e5c18","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-0.5.0.tgz","fileCount":9,"integrity":"sha512-5xIftn+zRIlqkuTGB+aCzZj9wxtnMpceeo3ivIZerGm6q+41y4SbiajHJcEHr48qPx8sxNsNO02MeqXnjm1Kow==","signatures":[{"sig":"MEQCIETxX70zqQGmF2p6Bra7F4yBTQyJCEHDb87TeTHCDCHZAiApLptAMgtV96LN4QXotuSpGXFXrIUmj6Xd42p2fxZQbw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":625029},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm run typecheck && pnpm run --if-present test && pnpm version major --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm run typecheck && pnpm run --if-present test && pnpm version minor --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm run typecheck && pnpm run --if-present test && pnpm version patch --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.5.0"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.5.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_0.5.0_1788170350550_0.6829044364459358","host":"s3://npm-registry-packages-npm-production"}},"1.0.0":{"name":"@aiquants/authz-drizzle","version":"1.0.0","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@1.0.0","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"c0273e818432287393ad4655c4818c115a68eabf","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-1.0.0.tgz","fileCount":9,"integrity":"sha512-2xlBBDt0JkVRgGNVgphgrnEEgSc0vJcmXBX1omHTBELLDXp/rI8O8pKHAb3gvypU/JRtKLUuMXxXTJvcHpjx4A==","signatures":[{"sig":"MEYCIQCr9/fxjOp0sGftn2XZt/UNX1mCyC1SfINZaVRh6k3rSQIhAJ1a7GeZeQfIKeJLEz7pdMYF03cT+fnV+TIYvug/GYFa","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":614425},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm run typecheck && pnpm run --if-present test && pnpm version major --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm run typecheck && pnpm run --if-present test && pnpm version minor --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm run typecheck && pnpm run --if-present test && pnpm version patch --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.5.0"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.5.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_1.0.0_1788957849988_0.26867868996516875","host":"s3://npm-registry-packages-npm-production"}},"1.1.0":{"name":"@aiquants/authz-drizzle","version":"1.1.0","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@1.1.0","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"3a981cbae399e084c7c27343fd3653625366a7ad","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-1.1.0.tgz","fileCount":9,"integrity":"sha512-a0hq9bCYPJhokg2AajbVBNp39ZE+/MQEq9WTZCnp4notmJrx2uLQwDDP1/JMFfVaqaY6gypT/zLG3FBoX+cemg==","signatures":[{"sig":"MEUCIQCS1etQSjjnVVIQh6JN/nQji3dJDjil9jlkEXzWe7oP0wIgaZ0rPU2lO9a9/KDgcHq945y2W+soDjNTlh+CVaOkNwE=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":616212},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm run typecheck && pnpm run --if-present test && pnpm version major --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm run typecheck && pnpm run --if-present test && pnpm version minor --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm run typecheck && pnpm run --if-present test && pnpm version patch --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.5.0"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.5.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_1.1.0_1788959637431_0.940339519933223","host":"s3://npm-registry-packages-npm-production"}},"1.2.0":{"name":"@aiquants/authz-drizzle","version":"1.2.0","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@1.2.0","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"6af80386a2854a645fe1a3d7d947f13246f075c3","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-1.2.0.tgz","fileCount":9,"integrity":"sha512-5rUuolgJeMr/zejpbKvwMdq/Oo4P6l0mVtwJJ0nVHQtx4TBDxsJEaOueT3YTE7QKCh5dOa6niWgncRxD0Wbjlw==","signatures":[{"sig":"MEQCIExP9NBF3r8G2REEILP2Cmp6AenVPEiYr57J2PHV5eVjAiAQTqLxNAaIW1AFIwy9m5RwVcgTiDREn9zDeOujCuLNTA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":624123},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm run typecheck && pnpm run --if-present test && pnpm version major --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm run typecheck && pnpm run --if-present test && pnpm version minor --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm run typecheck && pnpm run --if-present test && pnpm version patch --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.6.0"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.6.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_1.2.0_1788967914322_0.6015247659062042","host":"s3://npm-registry-packages-npm-production"}},"1.2.1":{"name":"@aiquants/authz-drizzle","version":"1.2.1","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@1.2.1","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"fd0f187178f85447f705247a5a4b4817547c3b22","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-1.2.1.tgz","fileCount":9,"integrity":"sha512-7kas3Q4khuyVw4y3aJ/fM4y03fhs7RIHIgGXhwd0rA0QxedrvgafvuDm/BS9csB5sctVAbkY0A95xhkbiWy9BA==","signatures":[{"sig":"MEYCIQCTSE8zIocymUVk5JK5HCf5JpDtj3VsG4fjFBqDWaEAfQIhAJGLtbL5z6WYAFJxqc/WtK9O5RnuvGgbmV6Z7ArEULWH","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":625206},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm run typecheck && pnpm run --if-present test && pnpm version major --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm run typecheck && pnpm run --if-present test && pnpm version minor --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm run typecheck && pnpm run --if-present test && pnpm version patch --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"_nodeVersion":"26.0.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.6.0"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.6.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_1.2.1_1788970213033_0.8300315774871836","host":"s3://npm-registry-packages-npm-production"}},"1.3.0":{"name":"@aiquants/authz-drizzle","version":"1.3.0","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","_id":"@aiquants/authz-drizzle@1.3.0","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"dist":{"shasum":"74c7c6f5cf4de9bb5a29c4c15daca0bfb526d99c","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-1.3.0.tgz","fileCount":9,"integrity":"sha512-AjofNUCwUvELc3ZMQNXglsES/KYv4c+KB7m6n1vWET1B1dAAj+0IRaZ7/Cog66dmxTIH8f/exyC6woaQ0dGQHg==","signatures":[{"sig":"MEQCIACfhGHD8vuQH7cyuU5NBB1/88A8as95cgYn7Q1tBK0ZAiAaYLG/7nnbR164edHcBHI73FezNW62SPi+dHJWXjRd6g==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQCNuErTGwyOY6usaWc5fPTerDtZFTxCzlET351vHOmbQgIhAKZTQQezTaDi3RCJxnz2ybpwuP5dopnY5nJWYj+Q+wwH","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":630839},"main":"dist/index.js","types":"dist/index.d.ts","module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm run typecheck && pnpm run --if-present test && pnpm version major --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm run typecheck && pnpm run --if-present test && pnpm version minor --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm run typecheck && pnpm run --if-present test && pnpm version patch --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"sideEffects":false,"dependencies":{"@aiquants/mssql":"^0.1.1"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.6.0"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.6.0"},"_npmOperationalInternal":{"tmp":"tmp/authz-drizzle_1.3.0_1789648985557_0.6125590831898289","host":"s3://npm-registry-packages-npm-production"}},"1.3.1":{"_id":"@aiquants/authz-drizzle@1.3.1","dist":{"shasum":"6e18657e285d995a694275dba9af026954f7a02e","tarball":"https://registry.npmjs.org/@aiquants/authz-drizzle/-/authz-drizzle-1.3.1.tgz","fileCount":7,"integrity":"sha512-koAmr83Zh/NswYtXKuhGnelJVEJpzvaz+8GOQLlYj1bW94jZRLUoqGS0UHXonuHYIZZmlIvwwu8SYtKepmQQ9g==","signatures":[{"sig":"MEUCIGqtkdi75Qc3ncM5SQpTk5LXiJVT0F0ALUwRZzHjA/ejAiEAkEaPIPrWtjpRSyqS0z5B9eHpLUWhU/IXbNp2p0dbxuQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIFkh4PfIWfLWl+JGEVAhwarG3Az0aDlz7/LUvc4nIoFNAiEAmN9pXxDZiE6nC1iCh8w/oLRwdRmZaK7J4rr1s9ycFnA="}],"unpackedSize":175630},"main":"dist/index.js","name":"@aiquants/authz-drizzle","types":"dist/index.d.ts","author":{"url":"https://x.com/fehdek","name":"fehde-k"},"module":"dist/index.mjs","engines":{"node":">=18.0.0","pnpm":">=8.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"license":"MIT","scripts":{"dev":"tsup --watch","lint":"biome lint src/","test":"vitest run","build":"tsup && node ../../.config/scripts/strip-dts-comments.mjs dist","check":"biome check src/","clean":"rimraf dist","check:fix":"biome check --write src/","typecheck":"tsc --noEmit","build:watch":"tsup --watch","license-check":"pnpm dlx license-checker --production --onlyAllow \"MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;Unlicense\"","publish:major":"pnpm run typecheck && pnpm run --if-present test && pnpm version major --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:minor":"pnpm run typecheck && pnpm run --if-present test && pnpm version minor --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","publish:patch":"pnpm run typecheck && pnpm run --if-present test && pnpm version patch --no-git-tag-version --no-git-checks && pnpm publish --no-git-checks","test:coverage":"vitest run --coverage"},"version":"1.3.1","_npmUser":{"name":"fehde","email":"genbu0498@gmail.com"},"keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","directories":{},"maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"sideEffects":false,"dependencies":{"@aiquants/mssql":"^0.1.2"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","rimraf":"^6.1.2","vitest":"^4.1.8","typescript":"^5.9.3","drizzle-orm":"1.0.0-rc.4","@vitest/coverage-v8":"^4.1.8","@aiquants/authz-core":"0.6.1"},"peerDependencies":{"drizzle-orm":">=1.0.0-beta.4 <2.0.0","@aiquants/authz-core":"^0.6.1"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/authz-drizzle_1.3.1_1789699492746_0.9295948361238799"}}},"time":{"created":"2026-06-25T06:59:00.776Z","modified":"2026-09-18T02:44:53.027Z","0.1.0":"2026-06-25T06:59:01.005Z","0.1.1":"2026-06-30T00:31:40.136Z","0.1.3":"2026-06-30T01:00:39.770Z","0.2.0":"2026-07-01T03:38:05.239Z","0.2.1":"2026-07-02T11:23:53.552Z","0.2.2":"2026-07-16T00:38:33.432Z","0.2.3":"2026-07-16T02:18:52.392Z","0.2.4":"2026-07-23T02:23:42.526Z","0.3.0":"2026-08-05T11:04:05.293Z","0.4.0":"2026-08-10T14:36:52.550Z","0.5.0":"2026-08-31T09:59:10.709Z","1.0.0":"2026-09-09T12:44:10.149Z","1.1.0":"2026-09-09T13:13:57.612Z","1.2.0":"2026-09-09T15:31:54.472Z","1.2.1":"2026-09-09T16:10:13.183Z","1.3.0":"2026-09-17T12:43:05.685Z","1.3.1":"2026-09-18T02:44:52.843Z"},"author":{"url":"https://x.com/fehdek","name":"fehde-k"},"license":"MIT","keywords":["rbac","authorization","drizzle","mssql","row-level-security","typescript"],"description":"Drizzle (mssql) adapter for @aiquants/authz-core: defineAuthzSchema factory, getEffectivePermissions, and row/column scope application helpers.","maintainers":[{"name":"fehde-k","email":"owner@aiquants.co.jp"},{"name":"fehde","email":"genbu0498@gmail.com"}],"readme":"# @aiquants/authz-drizzle\n\nDrizzle (**mssql**) adapter for [`@aiquants/authz-core`](https://www.npmjs.com/package/@aiquants/authz-core). Generic schema factory + effective-permission query + row/column scope application. mssql-only (`drizzle-orm/mssql-core`: `nvarchar/bigint/bit/datetime2`).\n\n## Install\n\nMonorepo (already a pnpm workspace package):\n\n```jsonc\n// consumer package.json\n\"dependencies\": {\n  \"@aiquants/authz-core\": \"workspace:*\",\n  \"@aiquants/authz-drizzle\": \"workspace:*\"\n}\n```\n\nExternal projects:\n\n```bash\npnpm add @aiquants/authz-drizzle drizzle-orm   # peer: drizzle-orm >=1.0.0-beta.4 <2\n```\n\n`drizzle-orm` is a **peer dependency**; `@aiquants/authz-core` is pulled in transitively. Build / test: `pnpm run build` (tsup → dist) / `pnpm run test` (vitest).\n\n## Required database schema (DDL)\n\n`defineAuthzSchema()` maps the tables below but does **not** create them — run this DDL once (MSSQL). Adjust the schema name (`dbo_authz`) and the cross-schema FK at the end to point at **your** user table.\n\n```sql\nIF SCHEMA_ID('dbo_authz') IS NULL EXEC('CREATE SCHEMA dbo_authz');\n\nCREATE TABLE dbo_authz.TMRole (\n  id BIGINT IDENTITY(1,1) NOT NULL,\n  tenant_id NVARCHAR(64) NOT NULL CONSTRAINT DF_authz_TMRole_tenant_id DEFAULT (N'default'),\n  role_key NVARCHAR(100) NOT NULL,\n  name NVARCHAR(200) NOT NULL,\n  description NVARCHAR(1000) NULL,\n  is_active BIT NOT NULL CONSTRAINT DF_authz_TMRole_is_active DEFAULT (1),\n  created_at DATETIME2 NULL, created_by NVARCHAR(50) NULL,\n  updated_at DATETIME2 NULL, updated_by NVARCHAR(50) NULL,\n  CONSTRAINT PK_authz_TMRole PRIMARY KEY CLUSTERED (id)\n);\nCREATE TABLE dbo_authz.TMResource (\n  id BIGINT IDENTITY(1,1) NOT NULL,\n  tenant_id NVARCHAR(64) NOT NULL CONSTRAINT DF_authz_TMResource_tenant_id DEFAULT (N'default'),\n  app_key NVARCHAR(100) NOT NULL,\n  resource_key NVARCHAR(200) NOT NULL,\n  name NVARCHAR(200) NOT NULL,\n  description NVARCHAR(1000) NULL,\n  created_at DATETIME2 NULL, created_by NVARCHAR(50) NULL,\n  updated_at DATETIME2 NULL, updated_by NVARCHAR(50) NULL,\n  CONSTRAINT PK_authz_TMResource PRIMARY KEY CLUSTERED (id)\n);\nCREATE TABLE dbo_authz.TDRolePermission (\n  id BIGINT IDENTITY(1,1) NOT NULL,\n  role_id BIGINT NOT NULL,\n  resource_id BIGINT NOT NULL,\n  action NVARCHAR(20) NOT NULL\n    CONSTRAINT CK_authz_TDRolePermission_action CHECK (action IN ('read','create','update','delete')),\n  row_scope    JSON NULL,   -- SQL Server 2025+ native json. Older servers: NVARCHAR(MAX) (+ optional ISJSON CHECK).\n  column_scope JSON NULL,\n  created_at DATETIME2 NULL, created_by NVARCHAR(50) NULL,\n  updated_at DATETIME2 NULL, updated_by NVARCHAR(50) NULL,\n  CONSTRAINT PK_authz_TDRolePermission PRIMARY KEY CLUSTERED (id)\n);\nCREATE TABLE dbo_authz.TDUserRole (\n  user_id BIGINT NOT NULL,\n  role_id BIGINT NOT NULL,\n  created_at DATETIME2 NULL, created_by NVARCHAR(50) NULL,\n  updated_at DATETIME2 NULL, updated_by NVARCHAR(50) NULL,\n  CONSTRAINT PK_authz_TDUserRole PRIMARY KEY CLUSTERED (user_id, role_id)\n);\n\n-- uniqueness (the adapter relies on the DDL owning these).\n-- ⚠️ tenant_id LEADS every unique index on a tenant-scoped table: without it two tenants cannot use the\n-- same role_key / resource_key, which is the same thing as having one shared tenant.\nCREATE UNIQUE INDEX UQ_authz_TMRole_role_key ON dbo_authz.TMRole (tenant_id, role_key);\nCREATE UNIQUE INDEX UQ_authz_TMResource_app_key_resource_key ON dbo_authz.TMResource (tenant_id, app_key, resource_key);\nCREATE UNIQUE INDEX UQ_authz_TDRolePermission_role_resource_action ON dbo_authz.TDRolePermission (role_id, resource_id, action);\n\n-- referential integrity\nALTER TABLE dbo_authz.TDRolePermission ADD CONSTRAINT FK_authz_TDRolePermission_role_id     FOREIGN KEY (role_id)     REFERENCES dbo_authz.TMRole (id);\nALTER TABLE dbo_authz.TDRolePermission ADD CONSTRAINT FK_authz_TDRolePermission_resource_id FOREIGN KEY (resource_id) REFERENCES dbo_authz.TMResource (id);\nALTER TABLE dbo_authz.TDUserRole       ADD CONSTRAINT FK_authz_TDUserRole_role_id           FOREIGN KEY (role_id)     REFERENCES dbo_authz.TMRole (id);\n-- cross-schema FK → YOUR user table (placeholder: dbo_identity.Users). Adjust to your app:\nALTER TABLE dbo_authz.TDUserRole       ADD CONSTRAINT FK_authz_TDUserRole_user_id           FOREIGN KEY (user_id)     REFERENCES dbo_identity.Users (id);\n```\n\n> `defineAuthzSchema(schemaName, { userTable })` must be given the **same schema name** and a drizzle handle to the same user table the FK points at. `row_scope` / `column_scope` are stored as JSON text either way — the adapter reads them as strings and parses via `@aiquants/authz-core`.\n>\n> Optional (recommended for larger datasets): non-unique secondary indexes on the FK columns — `TDUserRole(user_id)`, `TDRolePermission(role_id)`, `TDRolePermission(resource_id)`. They affect performance only, not correctness.\n\n## Bootstrap (seed an initial admin and reserved roles)\n\nSo the first person can manage authorization, grant one role full access to a self-management resource and assign it to a real user (`user_id` = a row in your user table). We also seed the reserved roles `@authenticated` and `@anonymous`.\n\n```sql\nINSERT INTO dbo_authz.TMRole (role_key, name, description) VALUES ('admin', 'Administrator', 'Full system administrator (including authorization management)');\nINSERT INTO dbo_authz.TMRole (tenant_id, role_key, name, description) VALUES (N'default', '@authenticated', 'Authenticated Users', 'All logged-in authenticated users (implicit assignment)');\nINSERT INTO dbo_authz.TMRole (tenant_id, role_key, name, description) VALUES (N'default', '@anonymous', 'Anonymous Users / Guests', 'All users including unauthenticated guests (implicit assignment)');\n\nINSERT INTO dbo_authz.TMResource (tenant_id, app_key, resource_key, name) VALUES (N'default', 'myapp', 'authz_admin', 'Authorization admin');\n\nINSERT INTO dbo_authz.TDRolePermission (role_id, resource_id, action, row_scope, column_scope)\nSELECT r.id, res.id, a.action, NULL, NULL                       -- NULL/NULL = all rows / all columns\nFROM dbo_authz.TMRole r\nCROSS JOIN dbo_authz.TMResource res\nCROSS JOIN (VALUES ('read'),('create'),('update'),('delete')) AS a(action)\nWHERE r.role_key = 'admin' AND res.app_key = 'myapp' AND res.resource_key = 'authz_admin';\n\nINSERT INTO dbo_authz.TDUserRole (user_id, role_id)\nSELECT 123, id FROM dbo_authz.TMRole WHERE role_key = 'admin';  -- 123 = your user id\n```\n\n## Usage\n\n```ts\n// 1. Define the schema (schema name + the host app's user table)\nconst tables = defineAuthzSchema(\"dbo_authz\", { userTable: Users })\n\n// 2. Resolve a user's effective permission for one (tenant, app, resource).\n//    `tenantId` is REQUIRED and non-empty; `userId` can be null for anonymous guests.\nconst perm = await getEffectivePermissions(db, tables, { userId, tenantId, appKey: \"quants\", resourceKey: \"daily_report\" })\n\n// 2b. …or for many resources at once — ONE round-trip instead of N (this is what a framework adapter wires up).\nconst perms = await getEffectivePermissionsMany(db, tables, { userId, tenantId, appKey: \"quants\", resourceKeys: [\"daily_report\", \"sales\"] })\nperms.sales.actions   // every requested key is present; a resource with no grants has zero actions\n\n// 3. Apply the merged scope to a query + result (per-endpoint columnMap + the tenant of YOUR table)\nconst columnMap = { dept: Report.dept, amount: Report.amount }\nconst scope = perm.scopeByAction.read           // MergedScope | undefined\n// ⚠️ no scope = no grant. Never write `scope?.rowScope ?? null` — `null` means ALL rows, so the fallback would open it up.\nconst rows = await applyRowScope(db.select().from(Report), scope ? scope.rowScope : { anyOf: [] }, columnMap, { column: Report.tenantId, id: tenantId })\nreturn maskColumns(rows, scope ? scope.columnScope : { mode: \"allow\", columns: [] })   // drop columns the user may not see\n```\n\n## Tenant contract\n\n`tenantId` is a **required, non-empty string** on every entry point of this package. A missing or blank\ntenant is an error — it never means \"no filter\" or \"every tenant\", which is the inversion that turns a\nscoping bug into a cross-tenant data leak.\n\n- `TMRole`, `TMResource` and `TMGroup` each carry a `NOT NULL` `tenant_id`, and each of their unique\n  indexes leads with it: `TMRole(tenant_id, role_key)`, `TMResource(tenant_id, app_key, resource_key)`,\n  `TMGroup(tenant_id, group_key)`. The link tables carry no tenant — they inherit it from the row they point at.\n- The permission query filters **all three** of those tables and projects the roles' and resources' real\n  `tenant_id` into each grant row, so `buildEffectivePermission` verifies ownership against the database\n  value rather than against an echo of the argument.\n- Every `AuthzAdminStore` method takes `tenantId` as its first argument. Reads are filtered by it, by-id\n  writes match on it (an id from another tenant addresses nothing), and a write that references another\n  row (role / resource / group) proves that row lives in the same tenant first. When a payload names a\n  tenant too, the two are reconciled with `assertTenantMatch` — a mismatch is rejected, never resolved\n  in favour of one side.\n- The last-administrator lockout guard is evaluated **per tenant**: another tenant's administrators can\n  no longer make this tenant's last administrator removable.\n- `applyRowScope` / `buildRowScopeWhere` take a required `{ column, id }` tenant and AND it into the\n  predicate, so a host cannot forget to scope its own business query. `maskColumns` takes no tenant: it\n  only removes columns from rows a tenant-scoped query already returned, and cannot widen a result set.\n- The physical `DEFAULT (N'default')` on `tenant_id` exists for hand-written SQL only. Every code path\n  here supplies the tenant explicitly, so the default is never exercised.\n\n## Breaking changes in this release\n\n| Before | Now |\n| --- | --- |\n| `applyRowScope(qb, scope, columnMap, existingWhere?)` | `applyRowScope(qb, scope, columnMap, tenant, existingWhere?)` — `tenant: { column, id }` is **required**, and the builder is always narrowed (return type is `ReturnType<QB[\"where\"]>`, never the untouched builder), because the tenant predicate always applies. |\n| `buildRowScopeWhere(scope, columnMap)` → `SQL \\| undefined` | `buildRowScopeWhere(scope, columnMap, tenant)` → `SQL`. An \"all rows\" scope now yields the tenant predicate alone instead of `undefined`. |\n| `getEffectivePermissions*({ …, tenantId? })` | `tenantId` is required and non-empty; a blank value throws `AuthzTenantError` before any SQL is issued. The predicate is applied to `TMRole`, `TMResource` **and** `TMGroup`. |\n| `listResourceKeys(db, tables, appKey)` | `listResourceKeys(db, tables, appKey, tenantId)`. |\n| `AuthzAdminStore` methods took no tenant | every method takes `tenantId` first (`listRoles(tenantId)`, `createGrant(tenantId, input, actor)`, `getSelfAdminContext(tenantId, actorUserId)`, …), and `guardedWrite(tenantId, removal, op, write)` is part of the port. |\n| `createAdminLockoutGuard(...).guardedWrite(removal, op, write)` | `guardedWrite(tenantId, removal, op, write)`. |\n| `defineAuthzSchema(schemaName, { userTable, enableTenant })` | the `enableTenant` option is **deleted** — it was accepted and never read. `tenant_id` is unconditional. |\n| `tenantId` omitted from an insert | the drizzle column declares **no** `.default()`, so this is now a type error. The physical `DEFAULT (N'default')` still exists (it is what lets the column be added to a populated table) but is generated by `buildAuthzDdlStatements` alone and is unreachable from library code. |\n| `createAuthzAdminStore({ userTenantColumn })` | replaced by the required `userScope` discriminated option. An omitted column used to mean \"no tenant filter\", so `listUsers` — the admin UI's only ownership proof for `TDUserRole` writes — returned every tenant's users. |\n| `seedAuthzTables(db, schemaName, { appKey, … })` | `seedAuthzTables(db, schemaName, { tenantId, appKey, … })` — seeded rows name their tenant instead of relying on the physical default. |\n| `LockoutOp` was declared here | re-exported from `@aiquants/authz-core` (single declaration). |\n| `getEffectivePermissions` was the only loader | still here (a thin wrapper), but a framework adapter should wire `getEffectivePermissionsMany` — one round-trip for N resources. |\n| `userId` was coerced with `Number()` | a `userId` that is not an integer (or a digit-only string) throws a `TypeError`. `\"0x10\"` no longer becomes user 16. |\n\n## Programmatic Setup and Seeding (Optional/Testing)\n\nFor testing or automated database setup scripts, the package exports helper utilities to programmatically build the schema and seed initial data:\n\n```ts\nimport { ensureAuthzTablesExist, seedAuthzTables } from \"@aiquants/authz-drizzle\"\n\n// 1. Create the schema, tables, indices, and foreign keys if they do not exist (DDL)\nawait ensureAuthzTablesExist(db, \"dbo_authz\", \"dbo_identity.Users\")\n\n// 2. Bootstrap initial admin roles, resources, and assignments (DML, idempotent) into ONE named tenant\nawait seedAuthzTables(db, \"dbo_authz\", {\n  tenantId: \"default\",\n  appKey: \"myapp\",\n  adminEmails: [\"admin@example.com\"],\n  userTable: Users,\n})\n```\n\n## API\n\n- `defineAuthzSchema(schemaName, { userTable })` → `{ TMRole, TMResource, TDRolePermission, TDUserRole, TMGroup, TDGroupRole, TDGroupMember }`. There is no option to disable the tenant column. Schema name is an argument (no business names baked in); the cross-schema FKs `TDUserRole.user_id → userTable.id` and `TDGroupMember.user_id → userTable.id` are wired via drizzle's `foreignKey()`. UNIQUE constraints are owned by the DDL side.\n- `getEffectivePermissionsMany(db, tables, { userId, tenantId, groupIds, appKey, resourceKeys })` → effective permission per key.\n  Joins active roles once for the whole set and routes each grant row back to its own resource, so **N resources cost\n  one round-trip** (chunked against the MSSQL 2100-parameter budget). Duplicate keys collapse; every requested key is\n  present in the result (no grants → an empty permission, never a missing key); the result never carries a key you did\n  not ask for. How a row is matched back to your key depends on collation (see the note below).\n- `getEffectivePermissions(db, tables, { userId, tenantId, groupIds, appKey, resourceKey })` → `EffectivePermission` (joins active roles, handles reserved `@authenticated` and `@anonymous` roles, and delegates scope merge to core. `userId` can be `string | number | null`). Thin single-resource wrapper over `getEffectivePermissionsMany`, so both share one query path.\n  Misuse fails loudly: a non-array `resourceKeys` (a bare string would iterate per character) or a non-string member throws a `TypeError` naming the package and the offending index, before any SQL is issued.\n- `listResourceKeys(db, tables, appKey, tenantId)` → `string[]` of every resource key registered in that tenant, ascending. Feeds the framework adapter's \"show me all my permissions\" port.\n\n> **Resource keys and collation.** SQL compares `resource_key` under the column's collation (the MSSQL default\n> ignores case and trailing spaces), so the key a row comes back with need not be spelled the way you asked for it.\n> A **single-key** request trusts SQL outright — whatever the collation, the answer is identical to the old\n> one-query-per-resource behaviour. A multi-key request routes each row by exact match first, then by comparison\n> form (trimmed + lower-cased); when two requested keys share that form the row is dropped rather than guessed\n> (fail-close). Property order of the returned record is not part of the contract — iterate the keys you asked for.\n\n- `buildRowScopeWhere(mergedRowScope, columnMap, tenant)` → `SQL` — the tenant predicate AND the row scope (three-valued: `null`→tenant only / `{anyOf:[]}`→`1=0` / non-empty→OR-of-AND). Unknown `field` → `1=0` (fail-close). `null` in `values` → `IS NULL`/`IS NOT NULL`. A blank `tenant.id` throws `AuthzTenantError`.\n- `applyRowScope(qb, mergedRowScope, columnMap, tenant, existingWhere?)` → `qb.where(...)` convenience. `.where()` is always called, so the tenant predicate cannot be omitted by accident.\n- `maskColumns(rows, mergedColumnScope)` → field mask applied after fetch (allow & deny forms).\n- `ensureAuthzTablesExist(db, schemaName, userTableFkTarget, objectNamePrefix?)` → `Promise<void>`.\n  Checks schema, tables, indexes and constraints, and creates them if missing.\n  **Every statement is generated from `defineAuthzSchema`** — columns, types, identity, defaults, primary\n  keys, unique index columns and foreign keys all come from the model, so there is no second, hand-written\n  copy to drift. It also adds `tenant_id` to a table that predates the tenant migration, and drops a\n  superseded tenant-less unique index once the composite one exists.\n  Existence is detected **by the exact intended column SET — never by object name, and never by a column\n  count**, so running it against an already-migrated database can neither duplicate a constraint nor\n  re-create the single-column unique index that would destroy tenant isolation.\n  `objectNamePrefix` (default: the schema name) only affects the names of objects this function creates —\n  set it to match your DDL scripts' naming.\n- `buildAuthzDdlStatements(schemaName, userTableFkTarget, objectNamePrefix?)` → `string[]`. The same\n  statements `ensureAuthzTablesExist` executes, returned for review or for running them yourself.\n- `createAuthzAdminStore(db, tables, { userTable, userScope, adminAppKey, adminResourceKey?, userActiveColumn?, ensureConnection?, lockoutMessage? })` → an `AuthzAdminStore`.\n  **`userScope` is required** and must be either `{ kind: \"global\" }` (one shared user table) or `{ kind: \"per-tenant\", tenantColumn }` (users partitioned by that column); omitting it throws `TypeError`.\n  There is no default, because assuming one silently decides whether a foreign tenant's users are listed, and whether they can be given this tenant's roles.\n  Every write that references a user (`assignUserRole` / `removeUserRole`) proves the user first, exactly as the role, resource and group references are already proven.\n- **Deadlocked transactions are run again.** SERIALIZABLE buys \"the proof a write depends on does not change between the\n  read and the write\" at the price of contention: overlapping key ranges can deadlock, and SQL Server resolves a deadlock\n  by rolling one side back. Nothing was committed there and the retry gets through once the other side is gone, so\n  re-reading, re-deciding and re-writing is correct.\n  - Which failures qualify — **only the deadlock victim (`1205`)**, never a mere `EABORT` — lives in\n    [`@aiquants/mssql`](../mssql/README.md), and each boundary wraps its closure in\n    `capture` so the ORM cannot destroy the cause the decision needs.\n  - Applied at every transaction boundary (`serialized`, `withTransaction`, `createAdminLockoutGuard.guardedWrite`), never\n    when already inside an ambient transaction. Configure with `transactionRetry` (default 3 attempts, doubling with\n    jitter; `{ attempts: 1 }` disables). **Pass `onRetry`** — a silent retry hides that contention is rising.\n- `createAdminLockoutGuard(db, tables, opts)` → `{ guardedWrite(tenantId, removal, op, write) }`. Applies the same last-administrator check to destructive writes made **outside** this store (e.g. group membership edited by a separate user-admin surface). Check and write run inside one serializable transaction — there is deliberately no \"check only\" API, since splitting them lets two concurrent operations both pass. Like the store's own guard, it refuses when **any** tenant would lose its last administrator.\n- `seedAuthzTables(db, schemaName, { tenantId, appKey, adminEmails, userTable })` → `Promise<void>`. Idempotently inserts the default `admin` role, reserved roles (`@authenticated`, `@anonymous`), `authz_admin` resource, permissions, and assigns the admin role to users matched by the provided emails.\n\n`columnMap: Record<field, Column>` is supplied per endpoint (the core layer does not know a table's columns).\n\n## Group-aware authorization\n\n- `getEffectivePermissions` unions direct grants (`TDUserRole`) with group-derived grants (`TDGroupRole`). The `TDGroupRole` join is added **only** when `groupIds` is non-empty — joining unconditionally multiplies rows by the group table.\n- `@anonymous` is always a candidate role, but **`@authenticated` is included only when a user id resolved**. Admitting it for an unauthenticated caller that merely carries group ids would be a fail-open.\n- The lockout guard counts administrators from **both** paths, and (when `userActiveColumn` is supplied) excludes deactivated users — otherwise disabling the last administrator would go undetected. It evaluates **every tenant the removal touches**, not only the acting one: `deactivateUserId` names a host-side user id and the user table carries no tenant, so the write removes admin paths in every tenant at once. The refusal message names the tenants that would be left with none.\n- The group path also joins `TMGroup`, filters its `tenant_id`, **and projects it** so the returned tenant is re-checked byte-exactly in memory — SQL compares under the column collation (case-insensitive by default), which is a weaker rule than the tenant contract. `TMRole` and `TMResource` tenants are projected and re-checked the same way.\n\n## Two rules that will bite you (drizzle/MSSQL)\n\n1. **Always mark identity columns.** drizzle lists *every* schema column in an INSERT, so an `id` without `.identity()` emits `insert into … ([id], …) values (default, …)` and the database rejects it.\n2. **Declare only columns that exist.** For the same reason, a column present in the schema but absent from the table fails every insert with `Invalid column name`. Tables that are only ever inserted into and deleted from therefore use a `created_*`-only audit set rather than the full `created_*`/`updated_*` one.\n\nMIT\n","readmeFilename":""}