@alienplatform/bindings 3.2.0 → 3.3.0

package/LICENSE.md

@@ -0,0 +1,105 @@
+# Functional Source License, Version 1.1, Apache 2.0 Future License
+
+## Abbreviation
+
+FSL-1.1-Apache-2.0
+
+## Notice
+
+Copyright 2026 Alien Software, Inc.
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

package/README.md

@@ -1,6 +1,7 @@
 # `@alienplatform/bindings`
 
-Direct TypeScript bindings for Alien storage, kv, queue, vault, and linked-container discovery over an
+Direct TypeScript bindings for Alien storage, kv, queue, vault, linked-container
+discovery, and Postgres over an
 in-process [napi-rs](https://napi.rs) addon. The addon itself lives in the Rust
 crate `crates/alien-bindings-node`; this package is the published JavaScript
 wrapper that loads it.
@@ -20,6 +21,43 @@ const publicUrl = await database.getPublicUrl() // string | null
 Use the internal URL for calls between resources in the same deployment. Use
 the public URL only when the caller is outside that private network.
 
+## Postgres
+
+Postgres is connection-only: every backend speaks the same wire protocol, so the
+binding hands back connection details and your app connects with its own driver.
+Resolving a managed cloud backend (Aurora, Cloud SQL, Flexible Server) reads the
+password from that cloud's secret store using the workload's own identity — the
+binding itself only ever carries a locator for it.
+
+```ts
+import { Client } from "pg"
+import { postgres } from "@alienplatform/bindings"
+
+const conn = await postgres("my-db").connection()
+
+// Field style: node-postgres parses a URL's sslmode and would override `ssl`, so
+// pass the fields when you need `conn.ssl` to take effect.
+const client = new Client({
+  host: conn.host,
+  port: conn.port,
+  database: conn.database,
+  user: conn.username,
+  password: conn.password,
+  ssl: conn.ssl,
+})
+await client.connect()
+```
+
+`conn.connectionString` is the same details as a `postgres://` URL, with the
+credentials percent-encoded, for drivers that take one.
+
+External (BYO) Postgres bindings use verified TLS by default. Their `sslMode`
+policy is deliberately limited to `"verify-full"` and `"disable"` because
+node-postgres cannot represent libpq's opportunistic `prefer` fallback without
+owning the connection attempt. Use `"disable"` only as an explicit compatibility
+opt-out for a plaintext-only server; missing legacy configuration defaults to
+`"verify-full"`.
+
 ## Native addon resolution
 
 The addon is loaded lazily on the first binding operation (never at import — the

package/dist/errors.d.ts

@@ -40,6 +40,55 @@ export declare const BindingNotConfiguredError: {
         envVar: z.ZodString;
     }, z.core.$strip>>;
 };
+/**
+ * Thrown when the native addon reports a Postgres `sslmode` this package does not
+ * recognize, which means the addon and this wrapper disagree about the Rust `SslMode`
+ * enum — a version skew between the two halves of the package.
+ *
+ * `sslmode` is the value the addon sent; `expected` is the set this wrapper accepts.
+ * Not retryable: a skew is fixed by aligning versions, not by trying again.
+ */
+export declare const UnknownPostgresSslModeError: {
+    metadata: import("@alienplatform/core").AlienErrorMetadata<z.ZodObject<{
+        sslmode: z.ZodString;
+        expected: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    contextSchema: z.ZodObject<{
+        sslmode: z.ZodString;
+        expected: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    create: (context: {
+        sslmode: string;
+        expected: string[];
+    }) => import("@alienplatform/core").AlienErrorDefinition<z.ZodObject<{
+        sslmode: z.ZodString;
+        expected: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+};
+/**
+ * Thrown when the native addon reports a Postgres TLS policy that cannot be
+ * applied safely, such as a verified mode without any CA roots.
+ *
+ * This indicates wrapper/addon version skew or a malformed resolved binding.
+ * It is not retryable because retrying cannot repair the contract.
+ */
+export declare const InvalidPostgresTlsConfigError: {
+    metadata: import("@alienplatform/core").AlienErrorMetadata<z.ZodObject<{
+        sslmode: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>>;
+    contextSchema: z.ZodObject<{
+        sslmode: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>;
+    create: (context: {
+        sslmode: string;
+        reason: string;
+    }) => import("@alienplatform/core").AlienErrorDefinition<z.ZodObject<{
+        sslmode: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>>;
+};
 /**
  * Recover a typed {@link AlienError} from an error thrown by the native addon.
  *
@@ -53,4 +102,5 @@ export declare const BindingNotConfiguredError: {
  *   `BINDINGS_ERROR`, preserving the original message.
  */
 export declare function unwrapNapiError(err: unknown): AlienError;
+export { BindingNotFoundError } from "@alienplatform/core";
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAA;AAI3B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;AAElC;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;CAWpC,CAAA;AAwCF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAsCxD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAA;AAI3B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;AAElC;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;CAWpC,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;CAUtC,CAAA;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;CAUxC,CAAA;AAwCF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAsCxD;AAGD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/factories.d.ts

@@ -13,7 +13,7 @@
  * correctly even when destructured off the handle (`const { get } = storage(x)`).
  */
 import type { NativeAddon } from "./loader.js";
-import type { Container, Kv, Queue, Storage, Vault } from "./types.js";
+import type { Container, Kv, Postgres, Queue, Storage, Vault } from "./types.js";
 /** The public factory surface. */
 export interface Factories {
     storage(name: string): Storage;
@@ -21,6 +21,7 @@ export interface Factories {
     queue(name: string): Queue;
     vault(name: string): Vault;
     container(name: string): Container;
+    postgres(name: string): Postgres;
 }
 /** Build the factories bound to a given addon provider. */
 export declare function createFactories(getAddon: () => NativeAddon): Factories;

package/dist/factories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factories.d.ts","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EACV,WAAW,EAOZ,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EACV,SAAS,EACT,EAAE,EAIF,KAAK,EAGL,OAAO,EACP,KAAK,EACN,MAAM,YAAY,CAAA;AAsInB,kCAAkC;AAClC,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC9B,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAA;IACpB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAA;IAC1B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,WAAW,GAAG,SAAS,CAQtE"}
+{"version":3,"file":"factories.d.ts","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,OAAO,KAAK,EACV,WAAW,EASZ,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EACV,SAAS,EACT,EAAE,EAGF,QAAQ,EAIR,KAAK,EAGL,OAAO,EACP,KAAK,EACN,MAAM,YAAY,CAAA;AA8PnB,kCAAkC;AAClC,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC9B,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAA;IACpB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAA;IAC1B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAA;CACjC;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,WAAW,GAAG,SAAS,CAStE"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * `@alienplatform/bindings` — direct TypeScript bindings for Alien storage, kv,
- * queue, vault, and linked containers, backed by an in-process napi-rs addon over the Rust
- * `alien-bindings` crate.
+ * queue, vault, linked containers, and Postgres, backed by an in-process napi-rs addon
+ * over the Rust `alien-bindings` crate.
  *
  * Constructing a factory (`storage("x")`, `kv("y")`, …) does no I/O and needs no
  * addon; the native module loads on the first operation. The first operation
@@ -18,6 +18,8 @@ export declare const queue: (name: string) => import("./types.js").Queue;
 export declare const vault: (name: string) => import("./types.js").Vault;
 /** Resolve the linked-container binding named `name`. */
 export declare const container: (name: string) => import("./types.js").Container;
-export { AlienError, BindingNotConfiguredError, defineError } from "./errors.js";
-export type { Container, Kv, KvScanItem, KvScanResult, KvSetOptions, ObjectMeta, PresignedRequest, Queue, QueueMessage, SignedUrlMethod, SignedUrlOptions, Storage, Vault, } from "./types.js";
+/** Resolve the Postgres binding named `name`. */
+export declare const postgres: (name: string) => import("./types.js").Postgres;
+export { AlienError, BindingNotConfiguredError, BindingNotFoundError, defineError, InvalidPostgresTlsConfigError, UnknownPostgresSslModeError, } from "./errors.js";
+export type { Container, Kv, KvScanItem, KvScanResult, KvSetOptions, ObjectMeta, Postgres, PostgresConnection, PostgresSslMode, PostgresTlsOptions, PresignedRequest, Queue, QueueMessage, SignedUrlMethod, SignedUrlOptions, Storage, Vault, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,gDAAgD;AAChD,eAAO,MAAM,OAAO,gDAAoB,CAAA;AACxC,kDAAkD;AAClD,eAAO,MAAM,EAAE,2CAAe,CAAA;AAC9B,8CAA8C;AAC9C,eAAO,MAAM,KAAK,8CAAkB,CAAA;AACpC,8CAA8C;AAC9C,eAAO,MAAM,KAAK,8CAAkB,CAAA;AACpC,yDAAyD;AACzD,eAAO,MAAM,SAAS,kDAAsB,CAAA;AAE5C,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEhF,YAAY,EACV,SAAS,EACT,EAAE,EACF,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,KAAK,GACN,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,gDAAgD;AAChD,eAAO,MAAM,OAAO,gDAAoB,CAAA;AACxC,kDAAkD;AAClD,eAAO,MAAM,EAAE,2CAAe,CAAA;AAC9B,8CAA8C;AAC9C,eAAO,MAAM,KAAK,8CAAkB,CAAA;AACpC,8CAA8C;AAC9C,eAAO,MAAM,KAAK,8CAAkB,CAAA;AACpC,yDAAyD;AACzD,eAAO,MAAM,SAAS,kDAAsB,CAAA;AAC5C,iDAAiD;AACjD,eAAO,MAAM,QAAQ,iDAAqB,CAAA;AAE1C,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,oBAAoB,EACpB,WAAW,EACX,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,aAAa,CAAA;AAEpB,YAAY,EACV,SAAS,EACT,EAAE,EACF,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,KAAK,GACN,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -1,9 +1,9 @@
-import { a as BindingNotConfiguredError, i as AlienError, o as defineError, r as createFactories, t as loadAddon } from "./loader.js";
+import { a as BindingNotConfiguredError, c as UnknownPostgresSslModeError, i as AlienError, l as defineError, o as BindingNotFoundError, r as createFactories, s as InvalidPostgresTlsConfigError, t as loadAddon } from "./loader.js";
 //#region src/index.ts
 /**
 * `@alienplatform/bindings` — direct TypeScript bindings for Alien storage, kv,
-* queue, vault, and linked containers, backed by an in-process napi-rs addon over the Rust
-* `alien-bindings` crate.
+* queue, vault, linked containers, and Postgres, backed by an in-process napi-rs addon
+* over the Rust `alien-bindings` crate.
 *
 * Constructing a factory (`storage("x")`, `kv("y")`, …) does no I/O and needs no
 * addon; the native module loads on the first operation. The first operation
@@ -21,5 +21,7 @@ const queue = factories.queue;
 const vault = factories.vault;
 /** Resolve the linked-container binding named `name`. */
 const container = factories.container;
+/** Resolve the Postgres binding named `name`. */
+const postgres = factories.postgres;
 //#endregion
-export { AlienError, BindingNotConfiguredError, container, defineError, kv, queue, storage, vault };
+export { AlienError, BindingNotConfiguredError, BindingNotFoundError, InvalidPostgresTlsConfigError, UnknownPostgresSslModeError, container, defineError, kv, postgres, queue, storage, vault };

package/dist/loader.d.ts

@@ -89,6 +89,28 @@ export interface RawContainerHandle {
     getInternalUrl(): Promise<string>;
     getPublicUrl(): Promise<string | null>;
 }
+/**
+ * Raw napi Postgres connection. `sslmode` is the exact query-parameter value the
+ * Rust `SslMode` emits.
+ */
+export interface RawPostgresConnection {
+    connectionString: string;
+    host: string;
+    port: number;
+    database: string;
+    username: string;
+    password: string;
+    sslmode: unknown;
+    caCertificates: unknown;
+}
+/**
+ * Raw napi Postgres handle. `connection()` is synchronous: the Rust provider has
+ * already resolved everything (including reading a cloud backend's password from
+ * its secret store) by the time the handle exists.
+ */
+export interface RawPostgresHandle {
+    connection(): RawPostgresConnection;
+}
 /** Raw napi vault handle. */
 export interface RawVaultHandle {
     getSecret(name: string): Promise<string>;
@@ -103,6 +125,7 @@ export interface RawBindingsHandle {
     queue(name: string): Promise<RawQueueHandle>;
     vault(name: string): Promise<RawVaultHandle>;
     container(name: string): Promise<RawContainerHandle>;
+    postgres(name: string): Promise<RawPostgresHandle>;
 }
 /** The complete napi addon module surface consumed by the wrapper. */
 export interface NativeAddon {

package/dist/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AASH,0BAA0B;AAC1B,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,4BAA4B;AAC5B,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,gCAAgC;AAChC,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1C,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;CAC7F;AAED,iCAAiC;AACjC,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,EACvB,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,GAC3B,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;CAC5F;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAChD,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACjC,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACvC;AAED,6BAA6B;AAC7B,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;CACjC;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAChD,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACtC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IAC5C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IAC5C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACrD;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,UAAU,iBAAiB,CAAA;IAC3C,OAAO,IAAI,MAAM,CAAA;CAClB;AAED,0DAA0D;AAC1D,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,CAAA;AAEtC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,SAAS,CAW3C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,MAAM,CAAC,YAA2B,EACxC,IAAI,GAAE,SAA4D,GACjE,MAAM,CAaR;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,MAAgD,GACzD,MAAM,GAAG,SAAS,CAWpB;AASD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAO7F;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAE9D;AAED;;;GAGG;AACH,wBAAgB,SAAS,IAAI,WAAW,CA0DvC"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AASH,0BAA0B;AAC1B,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,4BAA4B;AAC5B,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,gCAAgC;AAChC,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1C,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;CAC7F;AAED,iCAAiC;AACjC,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,EACvB,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,GAC3B,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;CAC5F;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAChD,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACjC,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,MAAM,CAAA;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,IAAI,qBAAqB,CAAA;CACpC;AAED,6BAA6B;AAC7B,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;CACjC;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAChD,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACtC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IAC5C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IAC5C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACnD;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,UAAU,iBAAiB,CAAA;IAC3C,OAAO,IAAI,MAAM,CAAA;CAClB;AAED,0DAA0D;AAC1D,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,CAAA;AAEtC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,SAAS,CAW3C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,MAAM,CAAC,YAA2B,EACxC,IAAI,GAAE,SAA4D,GACjE,MAAM,CAaR;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,MAAgD,GACzD,MAAM,GAAG,SAAS,CAWpB;AASD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAO7F;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAE9D;AAED;;;GAGG;AACH,wBAAgB,SAAS,IAAI,WAAW,CA0DvC"}

package/dist/loader.js

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import { AlienError, defineError } from "@alienplatform/core";
+import { AlienError, BindingNotFoundError, defineError } from "@alienplatform/core";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -3380,6 +3380,41 @@ const BindingNotConfiguredError = defineError({
 	internal: false,
 	httpStatusCode: 400
 });
+/**
+* Thrown when the native addon reports a Postgres `sslmode` this package does not
+* recognize, which means the addon and this wrapper disagree about the Rust `SslMode`
+* enum — a version skew between the two halves of the package.
+*
+* `sslmode` is the value the addon sent; `expected` is the set this wrapper accepts.
+* Not retryable: a skew is fixed by aligning versions, not by trying again.
+*/
+const UnknownPostgresSslModeError = defineError({
+	code: "UNKNOWN_POSTGRES_SSLMODE",
+	context: object({
+		sslmode: string(),
+		expected: array(string())
+	}),
+	message: ({ sslmode, expected }) => `@alienplatform/bindings received an unknown Postgres sslmode '${sslmode}' from the native addon; expected one of ${expected.join(", ")}.`,
+	retryable: false,
+	internal: false
+});
+/**
+* Thrown when the native addon reports a Postgres TLS policy that cannot be
+* applied safely, such as a verified mode without any CA roots.
+*
+* This indicates wrapper/addon version skew or a malformed resolved binding.
+* It is not retryable because retrying cannot repair the contract.
+*/
+const InvalidPostgresTlsConfigError = defineError({
+	code: "INVALID_POSTGRES_TLS_CONFIG",
+	context: object({
+		sslmode: string(),
+		reason: string()
+	}),
+	message: ({ sslmode, reason }) => `@alienplatform/bindings received an invalid Postgres TLS configuration for sslmode '${sslmode}' from the native addon: ${reason}.`,
+	retryable: false,
+	internal: false
+});
 /** Fallback code for napi-internal errors whose message is not an envelope. */
 const GENERIC_BINDINGS_CODE = "BINDINGS_ERROR";
 /** Envelope codes the wrapper maps to a dedicated typed error. */
@@ -3540,6 +3575,90 @@ function makeVault(handle) {
 		list: () => guard(handle, (raw) => raw.listSecrets())
 	};
 }
+const POSTGRES_SSL_MODES = {
+	disable: true,
+	"verify-ca": true,
+	"verify-full": true
+};
+function postgresSslModeLabel(sslmode) {
+	return typeof sslmode === "string" ? sslmode : String(sslmode);
+}
+function invalidPostgresTlsConfig(sslmode, reason) {
+	return new AlienError(InvalidPostgresTlsConfigError.create({
+		sslmode: postgresSslModeLabel(sslmode),
+		reason
+	}).toOptions());
+}
+function isPostgresSslMode(value) {
+	return typeof value === "string" && Object.hasOwn(POSTGRES_SSL_MODES, value);
+}
+function hasAtLeastOne(values) {
+	return values.length > 0;
+}
+/**
+* Decode the raw addon connection into the public discriminated union, deriving
+* node-postgres TLS options from the Rust-resolved mode and provider roots.
+*
+* An unrecognized `sslmode` means the addon and this wrapper disagree about the
+* `SslMode` enum — a version skew that must fail loudly rather than produce a
+* connection with a silently wrong TLS posture. It throws
+* {@link UnknownPostgresSslModeError} so a caller can discriminate it by `code`;
+* `guard` passes an `AlienError` through untouched.
+*/
+function toPostgresConnection(raw) {
+	if (!isPostgresSslMode(raw.sslmode)) throw new AlienError(UnknownPostgresSslModeError.create({
+		sslmode: postgresSslModeLabel(raw.sslmode),
+		expected: Object.keys(POSTGRES_SSL_MODES)
+	}).toOptions());
+	if (!Array.isArray(raw.caCertificates)) throw invalidPostgresTlsConfig(raw.sslmode, "caCertificates must be an array");
+	const caCertificates = [];
+	const rawCaCertificates = raw.caCertificates;
+	for (const [index, certificate] of rawCaCertificates.entries()) {
+		if (typeof certificate !== "string") throw invalidPostgresTlsConfig(raw.sslmode, `caCertificates[${index}] must be a string`);
+		if (certificate.trim().length === 0) throw invalidPostgresTlsConfig(raw.sslmode, `caCertificates[${index}] cannot be empty`);
+		caCertificates.push(certificate);
+	}
+	const fields = {
+		connectionString: raw.connectionString,
+		host: raw.host,
+		port: raw.port,
+		database: raw.database,
+		username: raw.username,
+		password: raw.password
+	};
+	switch (raw.sslmode) {
+		case "disable":
+			if (caCertificates.length > 0) throw invalidPostgresTlsConfig(raw.sslmode, "disable cannot carry CA certificates");
+			return {
+				...fields,
+				sslmode: raw.sslmode,
+				ssl: false
+			};
+		case "verify-ca":
+			if (!hasAtLeastOne(caCertificates)) throw invalidPostgresTlsConfig(raw.sslmode, "verify-ca requires at least one CA certificate");
+			return {
+				...fields,
+				sslmode: raw.sslmode,
+				ssl: {
+					ca: caCertificates,
+					rejectUnauthorized: true,
+					checkServerIdentity: () => void 0
+				}
+			};
+		case "verify-full": return {
+			...fields,
+			sslmode: raw.sslmode,
+			ssl: {
+				...caCertificates.length > 0 ? { ca: caCertificates } : {},
+				rejectUnauthorized: true
+			}
+		};
+		default: return raw.sslmode;
+	}
+}
+function makePostgres(handle) {
+	return { connection: () => guard(handle, async (raw) => toPostgresConnection(raw.connection())) };
+}
 /** Build the factories bound to a given addon provider. */
 function createFactories(getAddon) {
 	return {
@@ -3547,7 +3666,8 @@ function createFactories(getAddon) {
 		kv: (name) => makeKv(lazyHandle(getAddon, name, (b, n) => b.kv(n))),
 		queue: (name) => makeQueue(lazyHandle(getAddon, name, (b, n) => b.queue(n))),
 		vault: (name) => makeVault(lazyHandle(getAddon, name, (b, n) => b.vault(n))),
-		container: (name) => makeContainer(lazyHandle(getAddon, name, (b, n) => b.container(n)))
+		container: (name) => makeContainer(lazyHandle(getAddon, name, (b, n) => b.container(n))),
+		postgres: (name) => makePostgres(lazyHandle(getAddon, name, (b, n) => b.postgres(n)))
 	};
 }
 //#endregion
@@ -3716,4 +3836,4 @@ function loadAddon() {
 	throw new Error(`Cannot load the @alienplatform/bindings native addon for '${triple}'. Install the '${pkg}' prebuild, or build it locally with \`napi build --platform\` in crates/alien-bindings-node, or set ALIEN_BINDINGS_ADDON_PATH to a built .node file.`);
 }
 //#endregion
-export { BindingNotConfiguredError as a, AlienError as i, registerEmbeddedAddon as n, defineError as o, createFactories as r, loadAddon as t };
+export { BindingNotConfiguredError as a, UnknownPostgresSslModeError as c, AlienError as i, defineError as l, registerEmbeddedAddon as n, BindingNotFoundError as o, createFactories as r, InvalidPostgresTlsConfigError as s, loadAddon as t };

package/dist/native.d.ts

@@ -38,6 +38,8 @@ export declare const queue: (name: string) => import("./types.js").Queue;
 export declare const vault: (name: string) => import("./types.js").Vault;
 /** Resolve the linked-container binding named `name`. */
 export declare const container: (name: string) => import("./types.js").Container;
-export { AlienError, BindingNotConfiguredError, defineError } from "./errors.js";
-export type { Container, Kv, KvScanItem, KvScanResult, KvSetOptions, ObjectMeta, PresignedRequest, Queue, QueueMessage, SignedUrlMethod, SignedUrlOptions, Storage, Vault, } from "./types.js";
+/** Resolve the Postgres binding named `name`. */
+export declare const postgres: (name: string) => import("./types.js").Postgres;
+export { AlienError, BindingNotConfiguredError, defineError, InvalidPostgresTlsConfigError, UnknownPostgresSslModeError, } from "./errors.js";
+export type { Container, Kv, KvScanItem, KvScanResult, KvSetOptions, ObjectMeta, Postgres, PostgresConnection, PostgresSslMode, PostgresTlsOptions, PresignedRequest, Queue, QueueMessage, SignedUrlMethod, SignedUrlOptions, Storage, Vault, } from "./types.js";
 //# sourceMappingURL=native.d.ts.map

package/dist/native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAID,gDAAgD;AAChD,eAAO,MAAM,OAAO,gDAAoB,CAAA;AACxC,kDAAkD;AAClD,eAAO,MAAM,EAAE,2CAAe,CAAA;AAC9B,8CAA8C;AAC9C,eAAO,MAAM,KAAK,8CAAkB,CAAA;AACpC,8CAA8C;AAC9C,eAAO,MAAM,KAAK,8CAAkB,CAAA;AACpC,yDAAyD;AACzD,eAAO,MAAM,SAAS,kDAAsB,CAAA;AAE5C,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEhF,YAAY,EACV,SAAS,EACT,EAAE,EACF,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,KAAK,GACN,MAAM,YAAY,CAAA"}
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAID,gDAAgD;AAChD,eAAO,MAAM,OAAO,gDAAoB,CAAA;AACxC,kDAAkD;AAClD,eAAO,MAAM,EAAE,2CAAe,CAAA;AAC9B,8CAA8C;AAC9C,eAAO,MAAM,KAAK,8CAAkB,CAAA;AACpC,8CAA8C;AAC9C,eAAO,MAAM,KAAK,8CAAkB,CAAA;AACpC,yDAAyD;AACzD,eAAO,MAAM,SAAS,kDAAsB,CAAA;AAC5C,iDAAiD;AACjD,eAAO,MAAM,QAAQ,iDAAqB,CAAA;AAE1C,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,WAAW,EACX,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,aAAa,CAAA;AAEpB,YAAY,EACV,SAAS,EACT,EAAE,EACF,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,KAAK,GACN,MAAM,YAAY,CAAA"}

package/dist/native.js

@@ -1,4 +1,4 @@
-import { a as BindingNotConfiguredError, i as AlienError, n as registerEmbeddedAddon, o as defineError, r as createFactories } from "./loader.js";
+import { a as BindingNotConfiguredError, c as UnknownPostgresSslModeError, i as AlienError, l as defineError, n as registerEmbeddedAddon, r as createFactories, s as InvalidPostgresTlsConfigError } from "./loader.js";
 import addon from "./alien-bindings.node";
 //#region src/native.ts
 /**
@@ -44,5 +44,7 @@ const queue = factories.queue;
 const vault = factories.vault;
 /** Resolve the linked-container binding named `name`. */
 const container = factories.container;
+/** Resolve the Postgres binding named `name`. */
+const postgres = factories.postgres;
 //#endregion
-export { AlienError, BindingNotConfiguredError, container, defineError, installEmbeddedAddon, kv, queue, storage, vault };
+export { AlienError, BindingNotConfiguredError, InvalidPostgresTlsConfigError, UnknownPostgresSslModeError, container, defineError, installEmbeddedAddon, kv, postgres, queue, storage, vault };

package/dist/types.d.ts

@@ -139,6 +139,105 @@ export interface Container {
     /** Get the public URL when the container is publicly exposed. */
     getPublicUrl(): Promise<string | null>;
 }
+/**
+ * TLS mode for a Postgres connection: `disable` for the local developer backend
+ * or an explicit BYO plaintext opt-out, `verify-full` for a BYO database with
+ * certificate and hostname verification, `verify-ca` for Cloud SQL over its
+ * Private Service Connect IP, and `verify-full` for Aurora and Flexible Server.
+ */
+export type PostgresSslMode = "disable" | "verify-ca" | "verify-full";
+/** TLS options for `verify-ca`, where the provider CA authenticates the server. */
+interface PostgresVerifyCaTlsOptions {
+    /**
+     * One or more PEM-encoded provider CA certificates. `verify-ca` cannot use the
+     * operating system trust store because the certificate is specific to the instance.
+     */
+    ca: [string, ...string[]];
+    /** Always true: an untrusted certificate fails the connection. */
+    rejectUnauthorized: true;
+    /**
+     * Skip hostname matching after the CA chain succeeds because Cloud SQL's
+     * certificate does not contain the Private Service Connect IP being dialed.
+     */
+    checkServerIdentity: () => undefined;
+}
+/** TLS options for full certificate and hostname verification. */
+interface PostgresVerifyFullTlsOptions {
+    /**
+     * PEM-encoded provider root CA certificates. Managed backends supply these;
+     * an external database can omit them to use the operating system trust store.
+     */
+    ca?: string[];
+    /** Always true: an untrusted certificate fails the connection. */
+    rejectUnauthorized: true;
+    /** `verify-full` must never override Node's hostname verification. */
+    checkServerIdentity?: never;
+}
+/** Verified TLS options ready to pass to node-postgres. */
+export type PostgresTlsOptions = PostgresVerifyCaTlsOptions | PostgresVerifyFullTlsOptions;
+/** Connection fields shared by every Postgres TLS mode. */
+interface PostgresConnectionFields {
+    /**
+     * `postgres://user:password@host:port/database?sslmode=<mode>`. The username,
+     * password, and database are percent-encoded to the RFC 3986 unreserved set, so a
+     * generated password containing URL-special characters can never corrupt the URL.
+     */
+    connectionString: string;
+    /** Address to dial — the cluster writer endpoint for Aurora, the host elsewhere. */
+    host: string;
+    /** TCP port. */
+    port: number;
+    /** Database name. */
+    database: string;
+    /** Role to connect as. */
+    username: string;
+    /**
+     * Connection password. For the managed cloud backends this was read from the
+     * cloud secret store when the binding resolved; the binding itself only ever
+     * carries a locator for it.
+     */
+    password: string;
+}
+interface PostgresDisableConnection extends PostgresConnectionFields {
+    sslmode: "disable";
+    ssl: false;
+}
+interface PostgresVerifyCaConnection extends PostgresConnectionFields {
+    sslmode: "verify-ca";
+    ssl: PostgresVerifyCaTlsOptions;
+}
+interface PostgresVerifyFullConnection extends PostgresConnectionFields {
+    sslmode: "verify-full";
+    ssl: PostgresVerifyFullTlsOptions;
+}
+/**
+ * Everything a Postgres driver needs to connect, discriminated by {@link sslmode}.
+ *
+ * For node-postgres, pass the individual fields with `ssl` rather than combining
+ * `connectionString` and `ssl`. node-postgres parses URL TLS parameters and can
+ * overwrite an explicit `ssl` object, including provider roots.
+ *
+ * External (BYO) bindings default to `verify-full`. A plaintext-only legacy server
+ * must be configured explicitly with `sslMode: "disable"` in its external binding.
+ */
+export type PostgresConnection = PostgresDisableConnection | PostgresVerifyCaConnection | PostgresVerifyFullConnection;
+/**
+ * A resolved Postgres binding.
+ *
+ * Unlike the other kinds this exposes no operations: every Postgres backend speaks
+ * the same wire protocol, so the binding hands back connection details and the
+ * application connects with its own driver.
+ */
+export interface Postgres {
+    /**
+     * Resolve the connection details.
+     *
+     * For a managed cloud backend the first call reads the password from that cloud's
+     * secret store with the workload's own identity; the resolved value is then reused,
+     * so call the factory again to pick up a rotated password.
+     */
+    connection(): Promise<PostgresConnection>;
+}
 /** A resolved vault (secrets) binding. */
 export interface Vault {
     /** Get the secret named `name` as a string. */
@@ -154,4 +253,5 @@ export interface Vault {
     /** List the names of all secrets in this vault. */
     list(): Promise<string[]>;
 }
+export {};
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAA;AAEtD,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,MAAM,EAAE,eAAe,CAAA;IACvB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED,yCAAyC;AACzC,MAAM,WAAW,OAAO;IACtB,kCAAkC;IAClC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC,8BAA8B;IAC9B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,mCAAmC;IACnC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,qDAAqD;IACrD,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAC5C,+CAA+C;IAC/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACvC,yCAAyC;IACzC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,6CAA6C;IAC7C,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAChE;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IACzB,eAAe;IACf,GAAG,EAAE,MAAM,CAAA;IACX,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAA;CACd;AAED,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,oCAAoC;AACpC,MAAM,WAAW,EAAE;IACjB,sEAAsE;IACtE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,0EAA0E;IAC1E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC5C,2EAA2E;IAC3E,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACpD;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzE;;;;OAIG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9E,yCAAyC;IACzC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,kCAAkC;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,0DAA0D;IAC1D,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC7E;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,WAAW,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAA;IACf,0CAA0C;IAC1C,aAAa,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,gCAAgC;AAChC,MAAM,WAAW,KAAK;IACpB,4EAA4E;IAC5E,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,oCAAoC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC7C,mDAAmD;IACnD,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,2EAA2E;IAC3E,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACjC,iEAAiE;IACjE,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACvC;AAED,0CAA0C;AAC1C,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC,mDAAmD;IACnD,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC9C,oEAAoE;IACpE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,oEAAoE;IACpE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,sCAAsC;IACtC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,mDAAmD;IACnD,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAA;AAEtD,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,MAAM,EAAE,eAAe,CAAA;IACvB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED,yCAAyC;AACzC,MAAM,WAAW,OAAO;IACtB,kCAAkC;IAClC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC,8BAA8B;IAC9B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,mCAAmC;IACnC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,qDAAqD;IACrD,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAC5C,+CAA+C;IAC/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACvC,yCAAyC;IACzC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,6CAA6C;IAC7C,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAChE;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IACzB,eAAe;IACf,GAAG,EAAE,MAAM,CAAA;IACX,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAA;CACd;AAED,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,KAAK,EAAE,UAAU,EAAE,CAAA;IACnB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,oCAAoC;AACpC,MAAM,WAAW,EAAE;IACjB,sEAAsE;IACtE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,0EAA0E;IAC1E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC5C,2EAA2E;IAC3E,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACpD;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzE;;;;OAIG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9E,yCAAyC;IACzC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,kCAAkC;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,0DAA0D;IAC1D,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC7E;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,WAAW,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAA;IACf,0CAA0C;IAC1C,aAAa,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,gCAAgC;AAChC,MAAM,WAAW,KAAK;IACpB,4EAA4E;IAC5E,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,oCAAoC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC7C,mDAAmD;IACnD,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,2EAA2E;IAC3E,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACjC,iEAAiE;IACjE,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACvC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAA;AAErE,mFAAmF;AACnF,UAAU,0BAA0B;IAClC;;;OAGG;IACH,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IACzB,kEAAkE;IAClE,kBAAkB,EAAE,IAAI,CAAA;IACxB;;;OAGG;IACH,mBAAmB,EAAE,MAAM,SAAS,CAAA;CACrC;AAED,kEAAkE;AAClE,UAAU,4BAA4B;IACpC;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;IACb,kEAAkE;IAClE,kBAAkB,EAAE,IAAI,CAAA;IACxB,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,KAAK,CAAA;CAC5B;AAED,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,GAAG,4BAA4B,CAAA;AAE1F,2DAA2D;AAC3D,UAAU,wBAAwB;IAChC;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,qBAAqB;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,UAAU,yBAA0B,SAAQ,wBAAwB;IAClE,OAAO,EAAE,SAAS,CAAA;IAClB,GAAG,EAAE,KAAK,CAAA;CACX;AAED,UAAU,0BAA2B,SAAQ,wBAAwB;IACnE,OAAO,EAAE,WAAW,CAAA;IACpB,GAAG,EAAE,0BAA0B,CAAA;CAChC;AAED,UAAU,4BAA6B,SAAQ,wBAAwB;IACrE,OAAO,EAAE,aAAa,CAAA;IACtB,GAAG,EAAE,4BAA4B,CAAA;CAClC;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAC1B,yBAAyB,GACzB,0BAA0B,GAC1B,4BAA4B,CAAA;AAEhC;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;;;OAMG;IACH,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAC1C;AAED,0CAA0C;AAC1C,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC,mDAAmD;IACnD,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC9C,oEAAoE;IACpE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,oEAAoE;IACpE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,sCAAsC;IACtC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,mDAAmD;IACnD,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;CAC1B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alienplatform/bindings",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "type": "module",
   "sideEffects": false,
   "types": "./dist/index.d.ts",
@@ -21,17 +21,6 @@
     "node": ">=18",
     "bun": ">=1.0.23"
   },
-  "scripts": {
-    "build": "tsdown && tsc -p tsconfig.build.json --emitDeclarationOnly",
-    "build:addon": "napi build --platform --release --cwd ../../crates/alien-bindings-node",
-    "prepare": "npm run build",
-    "test": "vitest run",
-    "test:bun": "bun scripts/run-bun-tests.mjs",
-    "test:ts": "tsc --noEmit",
-    "smoke": "node scripts/smoke-envelope.mjs",
-    "format-and-lint": "biome check .",
-    "format-and-lint:fix": "biome check . --write"
-  },
   "keywords": [
     "alien",
     "bindings",
@@ -39,11 +28,12 @@
     "kv",
     "queue",
     "vault",
+    "postgres",
     "napi"
   ],
   "author": "Alien Software, Inc. <hi@alien.dev>",
   "license": "FSL-1.1-Apache-2.0",
-  "description": "Direct TypeScript bindings for Alien storage, kv, queue, and vault over an in-process napi-rs addon",
+  "description": "Direct TypeScript bindings for Alien storage, kv, queue, vault, and postgres over an in-process napi-rs addon",
   "homepage": "https://alien.dev",
   "repository": {
     "type": "git",
@@ -54,22 +44,32 @@
     "access": "public"
   },
   "devDependencies": {
-    "@alienplatform/typescript-config": "workspace:^",
     "@biomejs/biome": "^1.9.4",
     "@napi-rs/cli": "^3.0.0",
     "@types/node": "^24.0.15",
     "tsdown": "^0.13.0",
     "typescript": "^5.8.3",
     "vitest": "^3.1.4",
-    "zod": "4.3.2"
+    "zod": "4.3.2",
+    "@alienplatform/typescript-config": "^1.0.0"
   },
   "dependencies": {
-    "@alienplatform/core": "workspace:^"
+    "@alienplatform/core": "^3.3.0"
   },
   "optionalDependencies": {
-    "@alienplatform/bindings-darwin-arm64": "3.2.0",
-    "@alienplatform/bindings-darwin-x64": "3.2.0",
-    "@alienplatform/bindings-linux-x64-gnu": "3.2.0",
-    "@alienplatform/bindings-linux-arm64-gnu": "3.2.0"
+    "@alienplatform/bindings-darwin-arm64": "3.3.0",
+    "@alienplatform/bindings-darwin-x64": "3.3.0",
+    "@alienplatform/bindings-linux-x64-gnu": "3.3.0",
+    "@alienplatform/bindings-linux-arm64-gnu": "3.3.0"
+  },
+  "scripts": {
+    "build": "tsdown && tsc -p tsconfig.build.json --emitDeclarationOnly",
+    "build:addon": "napi build --platform --release --cwd ../../crates/alien-bindings-node",
+    "test": "vitest run",
+    "test:bun": "bun scripts/run-bun-tests.mjs",
+    "test:ts": "tsc --noEmit",
+    "smoke": "node scripts/smoke-envelope.mjs",
+    "format-and-lint": "biome check .",
+    "format-and-lint:fix": "biome check . --write"
   }
-}
+}