@amerged/ohmyhost-runtime 0.1.29 → 0.1.30

package/README.md

@@ -1,6 +1,6 @@
 # @amerged/ohmyhost-runtime
 
-ohmyho.st runtime client, version 0.1.29.
+ohmyho.st runtime client, version 0.1.30.
 
 ```sh
 npm install @amerged/ohmyhost-runtime

package/dist/database-kysely.d.ts

@@ -1,5 +1,7 @@
 import { type Dialect } from "kysely";
-import { type CustomerDatabaseBinding } from "./database.js";
+import { type CustomerDatabaseBinding, type CustomerDatabaseRlsTransaction } from "./database.js";
+/** Compile Kysely queries inside an already-open withRls callback. The callback owns completion. */
+export declare function createRlsTransactionDialect(transaction: CustomerDatabaseRlsTransaction): Dialect;
 /** Kysely 0.29.5's PostgreSQL compiler and transactions over the private RPC binding. */
 export declare function createPrivateDatabaseDialect(binding: CustomerDatabaseBinding): Dialect;
 //# sourceMappingURL=database-kysely.d.ts.map

package/dist/database-kysely.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database-kysely.d.ts","sourceRoot":"","sources":["../src/database-kysely.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,OAAO,EAKb,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAEL,KAAK,uBAAuB,EAG7B,MAAM,eAAe,CAAC;AAOvB,yFAAyF;AACzF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAQtF"}
+{"version":3,"file":"database-kysely.d.ts","sourceRoot":"","sources":["../src/database-kysely.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,OAAO,EAKb,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAEL,KAAK,uBAAuB,EAG5B,KAAK,8BAA8B,EACpC,MAAM,eAAe,CAAC;AAOvB,oGAAoG;AACpG,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,8BAA8B,GAAG,OAAO,CAOhG;AA0DD,yFAAyF;AACzF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAQtF"}

package/dist/database-kysely.js

@@ -1,5 +1,65 @@
 import { PostgresAdapter, PostgresIntrospector, PostgresQueryCompiler, CompiledQuery, } from "kysely";
 import { createPrivateDatabaseClient, } from "./database.js";
+/** Compile Kysely queries inside an already-open withRls callback. The callback owns completion. */
+export function createRlsTransactionDialect(transaction) {
+    return Object.freeze({
+        createAdapter: () => new PostgresAdapter(),
+        createQueryCompiler: () => new PostgresQueryCompiler(),
+        createIntrospector: (kysely) => new PostgresIntrospector(kysely),
+        createDriver: () => new RlsTransactionDriver(transaction),
+    });
+}
+class RlsTransactionDriver {
+    transaction;
+    #connections = new Set();
+    #destroyed = false;
+    async init() { }
+    async acquireConnection() {
+        if (this.#destroyed)
+            throw new TypeError("The RLS database dialect is destroyed");
+        const connection = Object.freeze({
+            executeQuery: async (query) => {
+                if (!this.#connections.has(connection))
+                    throw new TypeError("The RLS database connection is released");
+                const result = await this.transaction.query({
+                    text: query.sql,
+                    values: query.parameters,
+                });
+                return {
+                    rows: [...result.rows],
+                    ...(["INSERT", "UPDATE", "DELETE", "MERGE"].includes(result.command) &&
+                        result.rowCount !== null
+                        ? { numAffectedRows: BigInt(result.rowCount) }
+                        : {}),
+                };
+            },
+            streamQuery() {
+                throw new TypeError("RLS database streaming is not supported");
+            },
+        });
+        this.#connections.add(connection);
+        return connection;
+    }
+    async beginTransaction() {
+        throw new TypeError("RLS transaction lifecycle belongs to withRls");
+    }
+    async commitTransaction() {
+        throw new TypeError("RLS transaction lifecycle belongs to withRls");
+    }
+    async rollbackTransaction() {
+        throw new TypeError("RLS transaction lifecycle belongs to withRls");
+    }
+    async releaseConnection(connection) {
+        this.#connections.delete(connection);
+    }
+    async destroy() {
+        this.#destroyed = true;
+        this.#connections.clear();
+    }
+    constructor(transaction) {
+        this.transaction = transaction;
+    }
+}
 /** Kysely 0.29.5's PostgreSQL compiler and transactions over the private RPC binding. */
 export function createPrivateDatabaseDialect(binding) {
     const database = createPrivateDatabaseClient(binding);

package/dist/database-kysely.js.map

@@ -1 +1 @@
-{"version":3,"file":"database-kysely.js","sourceRoot":"","sources":["../src/database-kysely.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,GAOd,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,2BAA2B,GAI5B,MAAM,eAAe,CAAC;AAOvB,yFAAyF;AACzF,MAAM,UAAU,4BAA4B,CAAC,OAAgC;IAC3E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,EAAE;QAC1C,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE;QACtD,kBAAkB,EAAE,CAAC,MAAuB,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC;QACjF,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,qBAAqB;IAyFW;IAxF3B,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC/C,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC7C,UAAU,GAAG,KAAK,CAAC;IAEZ,KAAK,CAAC,IAAI,KAAmB,CAAC;IAE9B,KAAK,CAAC,iBAAiB;QAC5B,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAsB,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAa,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACzD,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;YACtF,MAAM,UAAU,GAAuB,MAAM,CAAC,MAAM,CAAC;gBACnD,YAAY,EAAE,KAAK,EAAO,KAAoB,EAA6B,EAAE;oBAC3E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBAClC,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;oBACrE,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;wBAC9B,IAAI,EAAE,KAAK,CAAC,GAAG;wBACf,MAAM,EAAE,KAAK,CAAC,UAAkD;qBACjE,CAAC,CAAC;oBACH,OAAO;wBACL,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAU;wBAC/B,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;4BACpE,MAAM,CAAC,QAAQ,KAAK,IAAI;4BACtB,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;4BAC9C,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC;gBACJ,CAAC;gBACD,WAAW;oBACT,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;gBACrE,CAAC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACrF,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,QAAQ,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,CACd,GAAG,EAAE;YACH,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CACF,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,UAA8B,EAC9B,QAA6B;QAE7B,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/E,IAAI,GAAG,mBAAmB,CAAC;YAC3B,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS;gBACvC,IAAI,IAAI,oBAAoB,QAAQ,CAAC,cAAc,EAAE,CAAC;YACxD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;gBAAE,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,UAA8B;QAC3D,MAAM,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,UAA8B;QAC7D,MAAM,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/D,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,UAA8B;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChC,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC,MAAM,CAAC;IACrB,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CACjF,CAAC;QACF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,YAAoC,QAAgC;QAAhC,aAAQ,GAAR,QAAQ,CAAwB;IAAG,CAAC;CACzE"}
+{"version":3,"file":"database-kysely.js","sourceRoot":"","sources":["../src/database-kysely.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,GAOd,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,2BAA2B,GAK5B,MAAM,eAAe,CAAC;AAOvB,oGAAoG;AACpG,MAAM,UAAU,2BAA2B,CAAC,WAA2C;IACrF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,EAAE;QAC1C,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE;QACtD,kBAAkB,EAAE,CAAC,MAAuB,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC;QACjF,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,oBAAoB,CAAC,WAAW,CAAC;KAC1D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,oBAAoB;IAqDY;IApD3B,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtD,UAAU,GAAG,KAAK,CAAC;IAEZ,KAAK,CAAC,IAAI,KAAmB,CAAC;IAE9B,KAAK,CAAC,iBAAiB;QAC5B,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAClF,MAAM,UAAU,GAAuB,MAAM,CAAC,MAAM,CAAC;YACnD,YAAY,EAAE,KAAK,EAAO,KAAoB,EAA6B,EAAE;gBAC3E,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;oBACpC,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;gBACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAC1C,IAAI,EAAE,KAAK,CAAC,GAAG;oBACf,MAAM,EAAE,KAAK,CAAC,UAAkD;iBACjE,CAAC,CAAC;gBACH,OAAO;oBACL,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAU;oBAC/B,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;wBACpE,MAAM,CAAC,QAAQ,KAAK,IAAI;wBACtB,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;wBAC9C,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;YACJ,CAAC;YACD,WAAW;gBACT,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACjE,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,UAAU,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,gBAAgB;QAC3B,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,iBAAiB;QAC5B,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,mBAAmB;QAC9B,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,UAA8B;QAC3D,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,YAAoC,WAA2C;QAA3C,gBAAW,GAAX,WAAW,CAAgC;IAAG,CAAC;CACpF;AAED,yFAAyF;AACzF,MAAM,UAAU,4BAA4B,CAAC,OAAgC;IAC3E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,EAAE;QAC1C,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE;QACtD,kBAAkB,EAAE,CAAC,MAAuB,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC;QACjF,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,qBAAqB;IAyFW;IAxF3B,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC/C,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC7C,UAAU,GAAG,KAAK,CAAC;IAEZ,KAAK,CAAC,IAAI,KAAmB,CAAC;IAE9B,KAAK,CAAC,iBAAiB;QAC5B,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAsB,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAa,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACzD,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;YACtF,MAAM,UAAU,GAAuB,MAAM,CAAC,MAAM,CAAC;gBACnD,YAAY,EAAE,KAAK,EAAO,KAAoB,EAA6B,EAAE;oBAC3E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBAClC,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;oBACrE,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;wBAC9B,IAAI,EAAE,KAAK,CAAC,GAAG;wBACf,MAAM,EAAE,KAAK,CAAC,UAAkD;qBACjE,CAAC,CAAC;oBACH,OAAO;wBACL,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAU;wBAC/B,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;4BACpE,MAAM,CAAC,QAAQ,KAAK,IAAI;4BACtB,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;4BAC9C,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC;gBACJ,CAAC;gBACD,WAAW;oBACT,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;gBACrE,CAAC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACrF,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,QAAQ,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,CACd,GAAG,EAAE;YACH,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CACF,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,UAA8B,EAC9B,QAA6B;QAE7B,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/E,IAAI,GAAG,mBAAmB,CAAC;YAC3B,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS;gBACvC,IAAI,IAAI,oBAAoB,QAAQ,CAAC,cAAc,EAAE,CAAC;YACxD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;gBAAE,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,UAA8B;QAC3D,MAAM,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,UAA8B;QAC7D,MAAM,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/D,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,UAA8B;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChC,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC,MAAM,CAAC;IACrB,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CACjF,CAAC;QACF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,YAAoC,QAAgC;QAAhC,aAAQ,GAAR,QAAQ,CAAwB;IAAG,CAAC;CACzE"}

package/dist/database-rls.d.ts

@@ -0,0 +1,12 @@
+import type { CustomerDatabaseJson } from "./database.js";
+export interface CustomerDatabaseRlsIdentity {
+    readonly subject: string;
+    readonly claims?: Readonly<Record<string, CustomerDatabaseJson>>;
+}
+export type CustomerDatabaseRlsClaims = Readonly<Record<string, CustomerDatabaseJson>> & {
+    readonly sub: string | null;
+    readonly role: "authenticated" | "anon";
+};
+/** Shared SDK/service validation. Identity is asserted by the trusted application backend. */
+export declare function normalizeRlsIdentity(input: unknown): CustomerDatabaseRlsClaims;
+//# sourceMappingURL=database-rls.d.ts.map

package/dist/database-rls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-rls.d.ts","sourceRoot":"","sources":["../src/database-rls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;CAClE;AAED,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG;IACvF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAAC;CACzC,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CA+B9E"}

package/dist/database-rls.js

@@ -0,0 +1,109 @@
+/** Shared SDK/service validation. Identity is asserted by the trusted application backend. */
+export function normalizeRlsIdentity(input) {
+    let subject = null;
+    const document = {};
+    if (input !== null) {
+        const identity = plainProperties(input);
+        if (Object.keys(identity).sort().join(",") !== "subject" &&
+            Object.keys(identity).sort().join(",") !== "claims,subject")
+            invalidIdentity();
+        const value = identity["subject"]?.value;
+        if (typeof value !== "string" ||
+            value.length === 0 ||
+            new TextEncoder().encode(value).byteLength > 512 ||
+            /\p{Cc}/u.test(value))
+            invalidIdentity();
+        subject = value;
+        if (Object.hasOwn(identity, "claims")) {
+            const claims = plainProperties(identity["claims"]?.value);
+            for (const [key, descriptor] of Object.entries(claims)) {
+                if (key === "sub" || key === "role")
+                    invalidIdentity();
+                validateKey(key);
+                document[key] = descriptor.value;
+            }
+        }
+    }
+    document["sub"] = subject;
+    document["role"] = subject === null ? "anon" : "authenticated";
+    return cloneJson(document, { nodes: 0, bytes: 0 }, 0);
+}
+function cloneJson(value, budget, depth) {
+    budget.nodes += 1;
+    if (budget.nodes > 1_000 || depth > 8)
+        invalidIdentity();
+    if (value === null ||
+        typeof value === "boolean" ||
+        typeof value === "string" ||
+        typeof value === "number") {
+        if (typeof value === "number" && !Number.isFinite(value))
+            invalidIdentity();
+        if (typeof value === "string")
+            validateJsonString(value);
+        consume(budget, JSON.stringify(value));
+        return value;
+    }
+    if (Array.isArray(value)) {
+        if (Object.getPrototypeOf(value) !== Array.prototype ||
+            Object.getOwnPropertySymbols(value).length !== 0 ||
+            Object.getOwnPropertyNames(value).length !== value.length + 1)
+            invalidIdentity();
+        consume(budget, "[]");
+        const output = [];
+        for (let index = 0; index < value.length; index += 1) {
+            const property = Object.getOwnPropertyDescriptor(value, String(index));
+            if (property === undefined || !Object.hasOwn(property, "value") || !property.enumerable)
+                invalidIdentity();
+            if (index > 0)
+                consume(budget, ",");
+            output.push(cloneJson(property.value, budget, depth + 1));
+        }
+        return Object.freeze(output);
+    }
+    const properties = plainProperties(value);
+    consume(budget, "{}");
+    const output = {};
+    for (const [index, [key, property]] of Object.entries(properties).entries()) {
+        validateKey(key);
+        consume(budget, `${index > 0 ? "," : ""}${JSON.stringify(key)}:`);
+        output[key] = cloneJson(property.value, budget, depth + 1);
+    }
+    return Object.freeze(output);
+}
+function plainProperties(value) {
+    if (typeof value !== "object" ||
+        value === null ||
+        Object.getPrototypeOf(value) !== Object.prototype ||
+        Object.getOwnPropertySymbols(value).length !== 0)
+        invalidIdentity();
+    const properties = Object.getOwnPropertyDescriptors(value);
+    for (const property of Object.values(properties)) {
+        if (!Object.hasOwn(property, "value") || !property.enumerable)
+            invalidIdentity();
+    }
+    return properties;
+}
+function validateKey(key) {
+    validateJsonString(key);
+    if (key.length === 0 ||
+        new TextEncoder().encode(key).byteLength > 128 ||
+        /\p{Cc}/u.test(key) ||
+        key === "__proto__" ||
+        key === "constructor" ||
+        key === "prototype")
+        invalidIdentity();
+}
+function validateJsonString(value) {
+    // PostgreSQL jsonb rejects NUL and lone UTF-16 surrogates even when JSON.stringify escapes them.
+    if (!value.isWellFormed() || value.includes("\u0000"))
+        invalidIdentity();
+}
+function consume(budget, text) {
+    budget.bytes += new TextEncoder().encode(text).byteLength;
+    if (budget.bytes > 16 * 1024)
+        invalidIdentity();
+}
+function invalidIdentity() {
+    throw new TypeError("Invalid database RLS identity");
+}
+//# sourceMappingURL=database-rls.js.map

package/dist/database-rls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-rls.js","sourceRoot":"","sources":["../src/database-rls.ts"],"names":[],"mappings":"AAYA,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACxC,IACE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS;YACpD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,gBAAgB;YAE3D,eAAe,EAAE,CAAC;QACpB,MAAM,KAAK,GAAY,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;QAClD,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,GAAG;YAChD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAErB,eAAe,EAAE,CAAC;QACpB,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;YAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvD,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM;oBAAE,eAAe,EAAE,CAAC;gBACvD,WAAW,CAAC,GAAG,CAAC,CAAC;gBACjB,QAAQ,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;IAC/D,OAAO,SAAS,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAA8B,CAAC;AACrF,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,MAAwC,EACxC,KAAa;IAEb,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,IAAI,MAAM,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC;QAAE,eAAe,EAAE,CAAC;IACzD,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,SAAS;QAC1B,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,eAAe,EAAE,CAAC;QAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IACE,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,SAAS;YAChD,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;YAChD,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAE7D,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtB,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACvE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU;gBACrF,eAAe,EAAE,CAAC;YACpB,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtB,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5E,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;QACjD,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAEhD,eAAe,EAAE,CAAC;IACpB,MAAM,UAAU,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC3D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU;YAAE,eAAe,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxB,IACE,GAAG,CAAC,MAAM,KAAK,CAAC;QAChB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,GAAG;QAC9C,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QACnB,GAAG,KAAK,WAAW;QACnB,GAAG,KAAK,aAAa;QACrB,GAAG,KAAK,WAAW;QAEnB,eAAe,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,iGAAiG;IACjG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,eAAe,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,OAAO,CAAC,MAAyB,EAAE,IAAY;IACtD,MAAM,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;IAC1D,IAAI,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI;QAAE,eAAe,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;AACvD,CAAC"}

package/dist/database.d.ts

@@ -1,3 +1,5 @@
+import { type CustomerDatabaseRlsIdentity } from "./database-rls.js";
+export type { CustomerDatabaseRlsIdentity } from "./database-rls.js";
 export type CustomerDatabaseJson = string | number | boolean | null | readonly CustomerDatabaseJson[] | Readonly<{
     [key: string]: CustomerDatabaseJson;
 }>;
@@ -15,6 +17,15 @@ export interface CustomerDatabaseBinding {
     query(input: unknown): Promise<unknown>;
     transaction(input: unknown): Promise<unknown>;
     open?(): Promise<CustomerDatabaseConnectionStub>;
+    openRls?(identity: CustomerDatabaseRlsIdentity | null): Promise<CustomerDatabaseRlsConnectionStub>;
+}
+/** Private lifecycle RPC. Only query is exposed to the application callback. */
+export interface CustomerDatabaseRlsConnectionStub extends CustomerDatabaseConnectionStub {
+    commit(): Promise<unknown>;
+}
+/** An existing identity-scoped transaction owned by withRls. */
+export interface CustomerDatabaseRlsTransaction {
+    query(input: CustomerDatabaseQuery): Promise<CustomerDatabaseQueryResult>;
 }
 /** The server-side held connection, reached through a stub. Never handed to customer code raw. */
 export interface CustomerDatabaseConnectionStub {
@@ -26,6 +37,8 @@ export interface CustomerDatabaseConnection {
     query(input: CustomerDatabaseQuery): Promise<CustomerDatabaseQueryResult>;
 }
 export interface CustomerDatabaseClient {
+    /** Authenticate in application code first; null explicitly selects anonymous policies. */
+    withRls<Result>(identity: CustomerDatabaseRlsIdentity | null, run: (transaction: CustomerDatabaseRlsTransaction) => Promise<Result>): Promise<Result>;
     /**
      * Run a read, a decision and a write on one connection. The callback shape is deliberate: the
      * connection is always released, including when the callback throws, so a customer cannot leak

package/dist/database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../src/database.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,oBAAoB,GAC5B,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,oBAAoB,EAAE,GAC/B,QAAQ,CAAC;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAAE,CAAC,CAAC;AAEtD,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,GAAG,IAAI,GAAG,UAAU,CAAC;AAEjF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,OAAO,CAAC,8BAA8B,CAAC,CAAC;CAClD;AAED,kGAAkG;AAClG,MAAM,WAAW,8BAA8B;IAC7C,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,0BAA0B;IACzC,KAAK,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,cAAc,CAAC,MAAM,EACnB,GAAG,EAAE,CAAC,UAAU,EAAE,0BAA0B,KAAK,OAAO,CAAC,MAAM,CAAC,GAC/D,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,KAAK,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1E,WAAW,CACT,OAAO,EAAE,SAAS,qBAAqB,EAAE,GACxC,OAAO,CAAC,SAAS,2BAA2B,EAAE,CAAC,CAAC;CACpD;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,uBAAuB,GAC/B,sBAAsB,CAqExB"}
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../src/database.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAE3F,YAAY,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAarE,MAAM,MAAM,oBAAoB,GAC5B,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,oBAAoB,EAAE,GAC/B,QAAQ,CAAC;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAAE,CAAC,CAAC;AAEtD,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,GAAG,IAAI,GAAG,UAAU,CAAC;AAEjF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACjD,OAAO,CAAC,CACN,QAAQ,EAAE,2BAA2B,GAAG,IAAI,GAC3C,OAAO,CAAC,iCAAiC,CAAC,CAAC;CAC/C;AAED,gFAAgF;AAChF,MAAM,WAAW,iCAAkC,SAAQ,8BAA8B;IACvF,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5B;AAED,gEAAgE;AAChE,MAAM,WAAW,8BAA8B;IAC7C,KAAK,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC3E;AAED,kGAAkG;AAClG,MAAM,WAAW,8BAA8B;IAC7C,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,0BAA0B;IACzC,KAAK,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAsB;IACrC,0FAA0F;IAC1F,OAAO,CAAC,MAAM,EACZ,QAAQ,EAAE,2BAA2B,GAAG,IAAI,EAC5C,GAAG,EAAE,CAAC,WAAW,EAAE,8BAA8B,KAAK,OAAO,CAAC,MAAM,CAAC,GACpE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,MAAM,EACnB,GAAG,EAAE,CAAC,UAAU,EAAE,0BAA0B,KAAK,OAAO,CAAC,MAAM,CAAC,GAC/D,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,KAAK,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1E,WAAW,CACT,OAAO,EAAE,SAAS,qBAAqB,EAAE,GACxC,OAAO,CAAC,SAAS,2BAA2B,EAAE,CAAC,CAAC;CACpD;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,uBAAuB,GAC/B,sBAAsB,CA2ExB"}

package/dist/database.js

@@ -1,4 +1,5 @@
 import { CustomerDatabaseError, CustomerRuntimeError } from "./errors.js";
+import { normalizeRlsIdentity } from "./database-rls.js";
 const MAX_QUERY_BYTES = 64 * 1024;
 const MAX_PARAMETERS = 100;
 const MAX_PARAMETER_BYTES = 1024 * 1024;
@@ -17,6 +18,9 @@ export function createPrivateDatabaseClient(binding) {
         throw new CustomerRuntimeError("database_binding_missing", false, "pass the OHMYHOST_DATABASE binding from the Worker env (Next.js: getCloudflareContext({ async: true }).env), not process.env. It exists only in server code of a deployment whose ohmyhost.yaml sets database.enabled: true.");
     }
     return Object.freeze({
+        withRls(identity, run) {
+            return runRlsTransaction(binding, identity, run);
+        },
         async withConnection(run) {
             if (typeof binding.open !== "function")
                 throw unavailable();
@@ -76,6 +80,111 @@ export function createPrivateDatabaseClient(binding) {
         },
     });
 }
+async function runRlsTransaction(binding, identity, run) {
+    let wireIdentity;
+    try {
+        const normalized = normalizeRlsIdentity(identity);
+        const sub = normalized.sub;
+        const claims = { ...normalized };
+        delete claims["sub"];
+        delete claims["role"];
+        wireIdentity = sub === null ? null : { subject: sub, claims };
+    }
+    catch {
+        throw new CustomerRuntimeError("database_rls_identity_invalid", false);
+    }
+    if (typeof binding.openRls !== "function")
+        throw unavailable();
+    let stub;
+    try {
+        stub = await binding.openRls(wireIdentity);
+    }
+    catch {
+        throw unavailable();
+    }
+    let state = "active";
+    let poisoned = false;
+    let pending = Promise.resolve();
+    const transaction = Object.freeze({
+        query(input) {
+            // Validate and snapshot immediately, before the caller can change a queued query.
+            let parsed;
+            try {
+                if (state !== "active" || poisoned)
+                    throw rlsTransactionFailed();
+                parsed = validateQuery(input, undefined, false, true);
+            }
+            catch (error) {
+                if (state === "active")
+                    poisoned = true;
+                const failed = Promise.reject(error);
+                // A fire-and-forget query must still roll the scope back without an unhandled rejection.
+                void failed.catch(() => undefined);
+                return failed;
+            }
+            const operation = pending.then(async () => {
+                if (poisoned)
+                    throw rlsTransactionFailed();
+                let raw;
+                try {
+                    raw = await stub.query(parsed);
+                }
+                catch {
+                    throw unavailable();
+                }
+                throwRlsFailure(raw);
+                throwStatementFailure(raw);
+                return validateResult(raw);
+            });
+            pending = operation.then(() => undefined, () => {
+                poisoned = true;
+            });
+            return operation;
+        },
+    });
+    try {
+        const result = await run(transaction);
+        state = "closing";
+        await pending;
+        if (poisoned)
+            throw rlsTransactionFailed();
+        let committed;
+        try {
+            committed = await stub.commit();
+        }
+        catch {
+            throw new CustomerRuntimeError("database_transaction_outcome_unknown", false);
+        }
+        throwRlsFailure(committed, true);
+        if (!isRecord(committed) ||
+            Object.keys(committed).join(",") !== "type" ||
+            committed["type"] !== "ohmyhost.database-rls-commit/v1") {
+            throw new CustomerRuntimeError("database_transaction_outcome_unknown", false);
+        }
+        return result;
+    }
+    finally {
+        state = "closing";
+        await pending;
+        state = "closed";
+        await stub.close().catch(() => undefined);
+    }
+}
+function rlsTransactionFailed() {
+    return new CustomerRuntimeError("database_rls_transaction_failed", false);
+}
+function throwRlsFailure(value, duringCommit = false) {
+    if (!isRecord(value) || value["type"] !== "ohmyhost.database-rls-error/v1")
+        return;
+    const code = value["code"];
+    if (Object.keys(value).sort().join(",") !== "code,type" ||
+        (code !== "database_rls_transaction_failed" && code !== "database_transaction_outcome_unknown")) {
+        if (duringCommit)
+            throw new CustomerRuntimeError("database_transaction_outcome_unknown", false);
+        invalidResponse();
+    }
+    throw new CustomerRuntimeError(code, false);
+}
 function throwStatementFailure(value) {
     if (!isRecord(value) || value["type"] !== "ohmyhost.database-error/v1")
         return;
@@ -86,7 +195,7 @@ function throwStatementFailure(value) {
         invalidResponse();
     throw new CustomerDatabaseError(sqlstate);
 }
-function validateQuery(value, aggregateBudget, inConnection = false) {
+function validateQuery(value, aggregateBudget, inConnection = false, inRls = false) {
     if (!isRecord(value) || Object.keys(value).sort().join(",") !== "text,values")
         invalidQuery();
     const text = value["text"];
@@ -98,7 +207,7 @@ function validateQuery(value, aggregateBudget, inConnection = false) {
         values.length > MAX_PARAMETERS) {
         invalidQuery();
     }
-    validateSql(text, inConnection);
+    validateSql(text, inConnection, inRls);
     const budget = aggregateBudget ?? { nodes: 1, bytes: 2 };
     const parsedValues = values.map((parameter, index) => {
         if (index > 0)
@@ -131,7 +240,7 @@ function validateTransaction(value) {
     });
     return Object.freeze(queries);
 }
-function validateSql(text, inConnection = false) {
+function validateSql(text, inConnection = false, inRls = false) {
     let visible = "";
     let index = 0;
     while (index < text.length) {
@@ -201,6 +310,7 @@ function validateSql(text, inConnection = false) {
     const statement = statements[0];
     if (statements.length !== 1 ||
         semicolonCount > 1 ||
+        (inRls && /^call\b/iu.test(statement)) ||
         (inConnection
             ? // Transaction control is the whole point of holding a connection; session-wide state and a
                 // chained transaction, which the database Worker refuses among the first six words, are not.

package/dist/database.js.map

@@ -1 +1 @@
-{"version":3,"file":"database.js","sourceRoot":"","sources":["../src/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE1E,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AACrC,MAAM,eAAe,GAAG,CAAC,CAAC;AAuD1B,MAAM,UAAU,2BAA2B,CACzC,OAAgC;IAEhC,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU;QACnC,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EACzC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,KAAK,EACL,8NAA8N,CAC/N,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,cAAc,CAClB,GAAgE;YAEhE,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,WAAW,EAAE,CAAC;YAC5D,IAAI,IAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,WAAW,EAAE,CAAC;YACtB,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CACd,MAAM,CAAC,MAAM,CAAC;oBACZ,KAAK,CAAC,KAAK,CAAC,KAA4B;wBACtC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;wBACrD,IAAI,GAAY,CAAC;wBACjB,IAAI,CAAC;4BACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACjC,CAAC;wBAAC,MAAM,CAAC;4BACP,MAAM,WAAW,EAAE,CAAC;wBACtB,CAAC;wBACD,qBAAqB,CAAC,GAAG,CAAC,CAAC;wBAC3B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;oBAC7B,CAAC;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,sFAAsF;gBACtF,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAA4B;YACtC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,WAAW,EAAE,CAAC;YACtB,CAAC;YACD,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAyC;YACzD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,WAAW,EAAE,CAAC;YACtB,CAAC;YACD,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;gBAAE,eAAe,EAAE,CAAC;YAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,4BAA4B;QAAE,OAAO;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,eAAe;QACvD,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAEhC,eAAe,EAAE,CAAC;IACpB,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,eAAkD,EAClD,YAAY,GAAG,KAAK;IAEpB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,aAAa;QAAE,YAAY,EAAE,CAAC;IAC9F,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QACxB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,eAAe;QAC3D,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,MAAM,CAAC,MAAM,GAAG,cAAc,EAC9B,CAAC;QACD,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,eAAe,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACzD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QACnD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC;QAC3F,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACpB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,YAAY,UAAU,CAAC,CAAC,CAAC;YACrF,wBAAwB,CAAC,MAAM,CAAC,GAAG,wBAAwB;YAE3D,YAAY,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAA2C,CAAC;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1F,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAClB,IAAI,MAAM,CAAC,KAAK,GAAG,gBAAgB;YAAE,YAAY,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC;QACtD,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,YAAY,GAAG,KAAK;IACrD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAW,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;YACxC,KAAK,GAAG,QAAQ,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;YACxC,KAAK,GAAG,QAAQ,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;YAChD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;YACxC,KAAK,GAAG,QAAQ,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtC,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC;YACvB,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC5C,KAAK,IAAI,CAAC,CAAC;oBACX,MAAM,IAAI,CAAC,CAAC;gBACd,CAAC;qBAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnD,KAAK,IAAI,CAAC,CAAC;oBACX,MAAM,IAAI,CAAC,CAAC;gBACd,CAAC;;oBAAM,MAAM,IAAI,CAAC,CAAC;YACrB,CAAC;YACD,IAAI,KAAK,KAAK,CAAC;gBAAE,YAAY,EAAE,CAAC;YAChC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;YACtC,KAAK,GAAG,MAAM,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClD,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,YAAY,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;gBAClC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;gBACxC,KAAK,GAAG,QAAQ,CAAC;gBACjB,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,IAAI,SAAS,CAAC;QACrB,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAG,OAAO;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAW,CAAC;IAC1C,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,cAAc,GAAG,CAAC;QAClB,CAAC,YAAY;YACX,CAAC,CAAC,2FAA2F;gBAC3F,6FAA6F;gBAC7F,kDAAkD,CAAC,IAAI,CAAC,SAAS,CAAC;oBAClE,CAAC,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC;wBACnD,CAAC,mCAAmC,CAAC,IAAI,CAAC,SAAS,CAAC;wBACpD,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpD,CAAC,CAAC,+GAA+G,CAAC,IAAI,CAClH,SAAS,CACV,CAAC,EACN,CAAC;QACD,YAAY,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa,EAAE,KAAgB;IAC9D,MAAM,aAAa,GACjB,KAAK,KAAK,GAAG;QACb,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QACpD,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAW,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;IACtB,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,uBAAuB,EAAE,CAAC;QACxF,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QACrC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,eAAe;QAC7B,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAElC,OAAO,eAAe,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtC,yFAAyF;IACzF,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClG,MAAM,UAAU,GAAwC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,eAAe,EAAE,CAAC;QAChD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAC/B,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAc,EACd,MAAwC,EACxC,KAAa,EACb,YAAoB,EACpB,OAAoB;IAEpB,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,IAAI,MAAM,CAAC,KAAK,GAAG,gBAAgB,IAAI,KAAK,GAAG,eAAe;QAAE,OAAO,EAAE,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,CAAC,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;QACjD,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACxB,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACzD,OAAO,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC5E,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC1C,yFAAyF;IACzF,2FAA2F;IAC3F,kFAAkF;IAClF,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;QAC1D,IACE,QAAQ,GAAG,CAAC;YACZ,QAAQ,GAAG,aAAa;YACxB,4CAA4C;YAC5C,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;YAClC,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,aAAa;YACrB,GAAG,KAAK,WAAW,EACnB,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC,MAAM,CAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CACjC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CACrB,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,EACnF,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,IAAI,oBAAoB,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,OAAO,CACd,MAAyB,EACzB,KAAa,EACb,OAAe,EACf,OAAoB;IAEpB,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACtB,IAAI,MAAM,CAAC,KAAK,GAAG,OAAO;QAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AACpE,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../src/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAoC,MAAM,mBAAmB,CAAC;AAI3F,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AACrC,MAAM,eAAe,GAAG,CAAC,CAAC;AAyE1B,MAAM,UAAU,2BAA2B,CACzC,OAAgC;IAEhC,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU;QACnC,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EACzC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,KAAK,EACL,8NAA8N,CAC/N,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,CACL,QAA4C,EAC5C,GAAqE;YAErE,OAAO,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,GAAgE;YAEhE,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,WAAW,EAAE,CAAC;YAC5D,IAAI,IAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,WAAW,EAAE,CAAC;YACtB,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CACd,MAAM,CAAC,MAAM,CAAC;oBACZ,KAAK,CAAC,KAAK,CAAC,KAA4B;wBACtC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;wBACrD,IAAI,GAAY,CAAC;wBACjB,IAAI,CAAC;4BACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACjC,CAAC;wBAAC,MAAM,CAAC;4BACP,MAAM,WAAW,EAAE,CAAC;wBACtB,CAAC;wBACD,qBAAqB,CAAC,GAAG,CAAC,CAAC;wBAC3B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;oBAC7B,CAAC;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,sFAAsF;gBACtF,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAA4B;YACtC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,WAAW,EAAE,CAAC;YACtB,CAAC;YACD,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAyC;YACzD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,WAAW,EAAE,CAAC;YACtB,CAAC;YACD,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;gBAAE,eAAe,EAAE,CAAC;YAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAgC,EAChC,QAA4C,EAC5C,GAAqE;IAErE,IAAI,YAAgD,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC3B,MAAM,MAAM,GAAyC,EAAE,GAAG,UAAU,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,YAAY,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU;QAAE,MAAM,WAAW,EAAE,CAAC;IAC/D,IAAI,IAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,WAAW,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,GAAoC,QAAQ,CAAC;IACtD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAmC,MAAM,CAAC,MAAM,CAAC;QAChE,KAAK,CAAC,KAA4B;YAChC,kFAAkF;YAClF,IAAI,MAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,KAAK,KAAK,QAAQ,IAAI,QAAQ;oBAAE,MAAM,oBAAoB,EAAE,CAAC;gBACjE,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,KAAK,QAAQ;oBAAE,QAAQ,GAAG,IAAI,CAAC;gBACxC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAA8B,KAAK,CAAC,CAAC;gBAClE,yFAAyF;gBACzF,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACnC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACxC,IAAI,QAAQ;oBAAE,MAAM,oBAAoB,EAAE,CAAC;gBAC3C,IAAI,GAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,WAAW,EAAE,CAAC;gBACtB,CAAC;gBACD,eAAe,CAAC,GAAG,CAAC,CAAC;gBACrB,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBAC3B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,SAAS,CAAC,IAAI,CACtB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE;gBACH,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC,CACF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,KAAK,GAAG,SAAS,CAAC;QAClB,MAAM,OAAO,CAAC;QACd,IAAI,QAAQ;YAAE,MAAM,oBAAoB,EAAE,CAAC;QAC3C,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjC,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM;YAC3C,SAAS,CAAC,MAAM,CAAC,KAAK,iCAAiC,EACvD,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,KAAK,GAAG,SAAS,CAAC;QAClB,MAAM,OAAO,CAAC;QACd,KAAK,GAAG,QAAQ,CAAC;QACjB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,IAAI,oBAAoB,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,YAAY,GAAG,KAAK;IAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,gCAAgC;QAAE,OAAO;IACnF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,WAAW;QACnD,CAAC,IAAI,KAAK,iCAAiC,IAAI,IAAI,KAAK,sCAAsC,CAAC,EAC/F,CAAC;QACD,IAAI,YAAY;YAAE,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QAChG,eAAe,EAAE,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,4BAA4B;QAAE,OAAO;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,eAAe;QACvD,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAEhC,eAAe,EAAE,CAAC;IACpB,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,eAAkD,EAClD,YAAY,GAAG,KAAK,EACpB,KAAK,GAAG,KAAK;IAEb,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,aAAa;QAAE,YAAY,EAAE,CAAC;IAC9F,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QACxB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,eAAe;QAC3D,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,MAAM,CAAC,MAAM,GAAG,cAAc,EAC9B,CAAC;QACD,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,eAAe,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACzD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QACnD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC;QAC3F,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACpB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,YAAY,UAAU,CAAC,CAAC,CAAC;YACrF,wBAAwB,CAAC,MAAM,CAAC,GAAG,wBAAwB;YAE3D,YAAY,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAA2C,CAAC;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1F,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAClB,IAAI,MAAM,CAAC,KAAK,GAAG,gBAAgB;YAAE,YAAY,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC;QACtD,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,YAAY,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK;IACpE,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAW,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;YACxC,KAAK,GAAG,QAAQ,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;YACxC,KAAK,GAAG,QAAQ,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;YAChD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;YACxC,KAAK,GAAG,QAAQ,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtC,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC;YACvB,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC5C,KAAK,IAAI,CAAC,CAAC;oBACX,MAAM,IAAI,CAAC,CAAC;gBACd,CAAC;qBAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnD,KAAK,IAAI,CAAC,CAAC;oBACX,MAAM,IAAI,CAAC,CAAC;gBACd,CAAC;;oBAAM,MAAM,IAAI,CAAC,CAAC;YACrB,CAAC;YACD,IAAI,KAAK,KAAK,CAAC;gBAAE,YAAY,EAAE,CAAC;YAChC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;YACtC,KAAK,GAAG,MAAM,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClD,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,YAAY,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;gBAClC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;gBACxC,KAAK,GAAG,QAAQ,CAAC;gBACjB,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,IAAI,SAAS,CAAC;QACrB,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAG,OAAO;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IACpF,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAW,CAAC;IAC1C,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,cAAc,GAAG,CAAC;QAClB,CAAC,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC,YAAY;YACX,CAAC,CAAC,2FAA2F;gBAC3F,6FAA6F;gBAC7F,kDAAkD,CAAC,IAAI,CAAC,SAAS,CAAC;oBAClE,CAAC,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC;wBACnD,CAAC,mCAAmC,CAAC,IAAI,CAAC,SAAS,CAAC;wBACpD,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpD,CAAC,CAAC,+GAA+G,CAAC,IAAI,CAClH,SAAS,CACV,CAAC,EACN,CAAC;QACD,YAAY,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa,EAAE,KAAgB;IAC9D,MAAM,aAAa,GACjB,KAAK,KAAK,GAAG;QACb,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QACpD,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAW,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;IACtB,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,uBAAuB,EAAE,CAAC;QACxF,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QACrC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,eAAe;QAC7B,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAElC,OAAO,eAAe,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtC,yFAAyF;IACzF,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClG,MAAM,UAAU,GAAwC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,eAAe,EAAE,CAAC;QAChD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAC/B,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAc,EACd,MAAwC,EACxC,KAAa,EACb,YAAoB,EACpB,OAAoB;IAEpB,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,IAAI,MAAM,CAAC,KAAK,GAAG,gBAAgB,IAAI,KAAK,GAAG,eAAe;QAAE,OAAO,EAAE,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,CAAC,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;QACjD,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACxB,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACzD,OAAO,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAC5E,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC1C,yFAAyF;IACzF,2FAA2F;IAC3F,kFAAkF;IAClF,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;QAC1D,IACE,QAAQ,GAAG,CAAC;YACZ,QAAQ,GAAG,aAAa;YACxB,4CAA4C;YAC5C,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;YAClC,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,aAAa;YACrB,GAAG,KAAK,WAAW,EACnB,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC,MAAM,CAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CACjC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CACrB,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,EACnF,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,IAAI,oBAAoB,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,OAAO,CACd,MAAyB,EACzB,KAAa,EACb,OAAe,EACf,OAAoB;IAEpB,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACtB,IAAI,MAAM,CAAC,KAAK,GAAG,OAAO;QAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AACpE,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/errors.d.ts

@@ -1,5 +1,5 @@
 export type CustomerRuntimeGatewayErrorCode = "gateway_configuration_invalid" | "gateway_request_invalid" | "gateway_response_invalid" | "gateway_timeout" | "gateway_unavailable" | "mail_content_expired" | "mail_attachment_too_large" | "mail_message_not_found" | "mail_rejected" | "mail_reputation_suspended" | "mail_send_conflict" | "mail_send_limit_exceeded" | "insufficient_organization_credits" | "paid_plan_required" | "project_budget_exceeded" | "storage_conflict" | "data_change_in_progress" | "storage_binding_data_changed" | "storage_delete_pending" | "storage_object_not_found" | "storage_quota_exceeded" | "storage_upload_expired" | "storage_upload_rejected" | "unauthorized";
-export type CustomerRuntimeErrorCode = CustomerRuntimeGatewayErrorCode | "database_binding_missing" | "database_query_invalid" | "database_response_invalid" | "database_unavailable" | "scheduled_context_invalid";
+export type CustomerRuntimeErrorCode = CustomerRuntimeGatewayErrorCode | "database_binding_missing" | "database_query_invalid" | "database_response_invalid" | "database_rls_identity_invalid" | "database_rls_transaction_failed" | "database_transaction_outcome_unknown" | "database_unavailable" | "scheduled_context_invalid";
 export declare class CustomerRuntimeError extends Error {
     readonly code: CustomerRuntimeErrorCode;
     readonly retryable: boolean;

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,+BAA+B,GACvC,+BAA+B,GAC/B,yBAAyB,GACzB,0BAA0B,GAC1B,iBAAiB,GACjB,qBAAqB,GACrB,sBAAsB,GACtB,2BAA2B,GAC3B,wBAAwB,GACxB,eAAe,GACf,2BAA2B,GAC3B,oBAAoB,GACpB,0BAA0B,GAC1B,mCAAmC,GACnC,oBAAoB,GACpB,yBAAyB,GACzB,kBAAkB,GAClB,yBAAyB,GACzB,8BAA8B,GAC9B,wBAAwB,GACxB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,cAAc,CAAC;AAEnB,MAAM,MAAM,wBAAwB,GAChC,+BAA+B,GAC/B,0BAA0B,GAC1B,wBAAwB,GACxB,2BAA2B,GAC3B,sBAAsB,GACtB,2BAA2B,CAAC;AAEhC,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,IAAI,EAAE,wBAAwB;aAC9B,SAAS,EAAE,OAAO;IAHpC,gGAAgG;gBAE9E,IAAI,EAAE,wBAAwB,EAC9B,SAAS,EAAE,OAAO,EAClC,MAAM,CAAC,EAAE,MAAM;CAKlB;AAED,gGAAgG;AAChG,qBAAa,qBAAsB,SAAQ,KAAK;aAGX,IAAI,EAAE,MAAM;IAF/C,SAAgB,SAAS,EAAE,OAAO,CAAC;gBAEA,IAAI,EAAE,MAAM;CAMhD;AAED,qBAAa,2BAA4B,SAAQ,oBAAoB;aAGjD,MAAM,EAAE,MAAM,GAAG,IAAI;gBADrC,IAAI,EAAE,+BAA+B,EACrB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrC,SAAS,EAAE,OAAO,EAClB,MAAM,CAAC,EAAE,MAAM;CAKlB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,+BAA+B,GACvC,+BAA+B,GAC/B,yBAAyB,GACzB,0BAA0B,GAC1B,iBAAiB,GACjB,qBAAqB,GACrB,sBAAsB,GACtB,2BAA2B,GAC3B,wBAAwB,GACxB,eAAe,GACf,2BAA2B,GAC3B,oBAAoB,GACpB,0BAA0B,GAC1B,mCAAmC,GACnC,oBAAoB,GACpB,yBAAyB,GACzB,kBAAkB,GAClB,yBAAyB,GACzB,8BAA8B,GAC9B,wBAAwB,GACxB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,cAAc,CAAC;AAEnB,MAAM,MAAM,wBAAwB,GAChC,+BAA+B,GAC/B,0BAA0B,GAC1B,wBAAwB,GACxB,2BAA2B,GAC3B,+BAA+B,GAC/B,iCAAiC,GACjC,sCAAsC,GACtC,sBAAsB,GACtB,2BAA2B,CAAC;AAEhC,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,IAAI,EAAE,wBAAwB;aAC9B,SAAS,EAAE,OAAO;IAHpC,gGAAgG;gBAE9E,IAAI,EAAE,wBAAwB,EAC9B,SAAS,EAAE,OAAO,EAClC,MAAM,CAAC,EAAE,MAAM;CAKlB;AAED,gGAAgG;AAChG,qBAAa,qBAAsB,SAAQ,KAAK;aAGX,IAAI,EAAE,MAAM;IAF/C,SAAgB,SAAS,EAAE,OAAO,CAAC;gBAEA,IAAI,EAAE,MAAM;CAMhD;AAED,qBAAa,2BAA4B,SAAQ,oBAAoB;aAGjD,MAAM,EAAE,MAAM,GAAG,IAAI;gBADrC,IAAI,EAAE,+BAA+B,EACrB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrC,SAAS,EAAE,OAAO,EAClB,MAAM,CAAC,EAAE,MAAM;CAKlB"}

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAkCA,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAG3B;IACA;IAHlB,gGAAgG;IAChG,YACkB,IAA8B,EAC9B,SAAkB,EAClC,MAAe;QAEf,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAJ1C,SAAI,GAAJ,IAAI,CAA0B;QAC9B,cAAS,GAAT,SAAS,CAAS;QAIlC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAGX;IAFnB,SAAS,CAAU;IAEnC,YAAmC,IAAY;QAC7C,KAAK,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;QADpB,SAAI,GAAJ,IAAI,CAAQ;QAE7C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;IACxD,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,oBAAoB;IAGjD;IAFlB,YACE,IAAqC,EACrB,MAAqB,EACrC,SAAkB,EAClB,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAJf,WAAM,GAAN,MAAM,CAAe;QAKrC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAqCA,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAG3B;IACA;IAHlB,gGAAgG;IAChG,YACkB,IAA8B,EAC9B,SAAkB,EAClC,MAAe;QAEf,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAJ1C,SAAI,GAAJ,IAAI,CAA0B;QAC9B,cAAS,GAAT,SAAS,CAAS;QAIlC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAGX;IAFnB,SAAS,CAAU;IAEnC,YAAmC,IAAY;QAC7C,KAAK,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;QADpB,SAAI,GAAJ,IAAI,CAAQ;QAE7C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;IACxD,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,oBAAoB;IAGjD;IAFlB,YACE,IAAqC,EACrB,MAAqB,EACrC,SAAkB,EAClB,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAJf,WAAM,GAAN,MAAM,CAAe;QAKrC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-runtime",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "type": "module",
   "engines": {
     "node": ">=22"
@@ -30,6 +30,10 @@
       "types": "./dist/database-kysely.d.ts",
       "import": "./dist/database-kysely.js"
     },
+    "./database-rls": {
+      "types": "./dist/database-rls.d.ts",
+      "import": "./dist/database-rls.js"
+    },
     "./storage": {
       "types": "./dist/storage.d.ts",
       "import": "./dist/storage.js"

package/src/packages/customer-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/customer-runtime",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "private": true,
   "type": "module",
   "sideEffects": false,
@@ -25,6 +25,11 @@
       "types": "./dist/database-kysely.d.ts",
       "import": "./dist/database-kysely.js"
     },
+    "./database-rls": {
+      "source": "./src/database-rls.ts",
+      "types": "./dist/database-rls.d.ts",
+      "import": "./dist/database-rls.js"
+    },
     "./storage": {
       "source": "./src/storage.ts",
       "types": "./dist/storage.d.ts",

package/src/packages/customer-runtime/src/database-kysely.ts

@@ -16,6 +16,7 @@ import {
   type CustomerDatabaseBinding,
   type CustomerDatabaseClient,
   type CustomerDatabaseParameter,
+  type CustomerDatabaseRlsTransaction,
 } from "./database.js";
 
 interface Lease {
@@ -23,6 +24,72 @@ interface Lease {
   readonly closed: Promise<void>;
 }
 
+/** Compile Kysely queries inside an already-open withRls callback. The callback owns completion. */
+export function createRlsTransactionDialect(transaction: CustomerDatabaseRlsTransaction): Dialect {
+  return Object.freeze({
+    createAdapter: () => new PostgresAdapter(),
+    createQueryCompiler: () => new PostgresQueryCompiler(),
+    createIntrospector: (kysely: Kysely<unknown>) => new PostgresIntrospector(kysely),
+    createDriver: () => new RlsTransactionDriver(transaction),
+  });
+}
+
+class RlsTransactionDriver implements Driver {
+  readonly #connections = new Set<DatabaseConnection>();
+  #destroyed = false;
+
+  public async init(): Promise<void> {}
+
+  public async acquireConnection(): Promise<DatabaseConnection> {
+    if (this.#destroyed) throw new TypeError("The RLS database dialect is destroyed");
+    const connection: DatabaseConnection = Object.freeze({
+      executeQuery: async <Row>(query: CompiledQuery): Promise<QueryResult<Row>> => {
+        if (!this.#connections.has(connection))
+          throw new TypeError("The RLS database connection is released");
+        const result = await this.transaction.query({
+          text: query.sql,
+          values: query.parameters as readonly CustomerDatabaseParameter[],
+        });
+        return {
+          rows: [...result.rows] as Row[],
+          ...(["INSERT", "UPDATE", "DELETE", "MERGE"].includes(result.command) &&
+          result.rowCount !== null
+            ? { numAffectedRows: BigInt(result.rowCount) }
+            : {}),
+        };
+      },
+      streamQuery<Row>(): AsyncIterableIterator<QueryResult<Row>> {
+        throw new TypeError("RLS database streaming is not supported");
+      },
+    });
+    this.#connections.add(connection);
+    return connection;
+  }
+
+  public async beginTransaction(): Promise<void> {
+    throw new TypeError("RLS transaction lifecycle belongs to withRls");
+  }
+
+  public async commitTransaction(): Promise<void> {
+    throw new TypeError("RLS transaction lifecycle belongs to withRls");
+  }
+
+  public async rollbackTransaction(): Promise<void> {
+    throw new TypeError("RLS transaction lifecycle belongs to withRls");
+  }
+
+  public async releaseConnection(connection: DatabaseConnection): Promise<void> {
+    this.#connections.delete(connection);
+  }
+
+  public async destroy(): Promise<void> {
+    this.#destroyed = true;
+    this.#connections.clear();
+  }
+
+  public constructor(private readonly transaction: CustomerDatabaseRlsTransaction) {}
+}
+
 /** Kysely 0.29.5's PostgreSQL compiler and transactions over the private RPC binding. */
 export function createPrivateDatabaseDialect(binding: CustomerDatabaseBinding): Dialect {
   const database = createPrivateDatabaseClient(binding);

package/src/packages/customer-runtime/src/database-rls.ts

@@ -0,0 +1,134 @@
+import type { CustomerDatabaseJson } from "./database.js";
+
+export interface CustomerDatabaseRlsIdentity {
+  readonly subject: string;
+  readonly claims?: Readonly<Record<string, CustomerDatabaseJson>>;
+}
+
+export type CustomerDatabaseRlsClaims = Readonly<Record<string, CustomerDatabaseJson>> & {
+  readonly sub: string | null;
+  readonly role: "authenticated" | "anon";
+};
+
+/** Shared SDK/service validation. Identity is asserted by the trusted application backend. */
+export function normalizeRlsIdentity(input: unknown): CustomerDatabaseRlsClaims {
+  let subject: string | null = null;
+  const document: Record<string, unknown> = {};
+  if (input !== null) {
+    const identity = plainProperties(input);
+    if (
+      Object.keys(identity).sort().join(",") !== "subject" &&
+      Object.keys(identity).sort().join(",") !== "claims,subject"
+    )
+      invalidIdentity();
+    const value: unknown = identity["subject"]?.value;
+    if (
+      typeof value !== "string" ||
+      value.length === 0 ||
+      new TextEncoder().encode(value).byteLength > 512 ||
+      /\p{Cc}/u.test(value)
+    )
+      invalidIdentity();
+    subject = value;
+    if (Object.hasOwn(identity, "claims")) {
+      const claims = plainProperties(identity["claims"]?.value);
+      for (const [key, descriptor] of Object.entries(claims)) {
+        if (key === "sub" || key === "role") invalidIdentity();
+        validateKey(key);
+        document[key] = descriptor.value;
+      }
+    }
+  }
+  document["sub"] = subject;
+  document["role"] = subject === null ? "anon" : "authenticated";
+  return cloneJson(document, { nodes: 0, bytes: 0 }, 0) as CustomerDatabaseRlsClaims;
+}
+
+function cloneJson(
+  value: unknown,
+  budget: { nodes: number; bytes: number },
+  depth: number,
+): CustomerDatabaseJson {
+  budget.nodes += 1;
+  if (budget.nodes > 1_000 || depth > 8) invalidIdentity();
+  if (
+    value === null ||
+    typeof value === "boolean" ||
+    typeof value === "string" ||
+    typeof value === "number"
+  ) {
+    if (typeof value === "number" && !Number.isFinite(value)) invalidIdentity();
+    if (typeof value === "string") validateJsonString(value);
+    consume(budget, JSON.stringify(value));
+    return value;
+  }
+  if (Array.isArray(value)) {
+    if (
+      Object.getPrototypeOf(value) !== Array.prototype ||
+      Object.getOwnPropertySymbols(value).length !== 0 ||
+      Object.getOwnPropertyNames(value).length !== value.length + 1
+    )
+      invalidIdentity();
+    consume(budget, "[]");
+    const output: CustomerDatabaseJson[] = [];
+    for (let index = 0; index < value.length; index += 1) {
+      const property = Object.getOwnPropertyDescriptor(value, String(index));
+      if (property === undefined || !Object.hasOwn(property, "value") || !property.enumerable)
+        invalidIdentity();
+      if (index > 0) consume(budget, ",");
+      output.push(cloneJson(property.value, budget, depth + 1));
+    }
+    return Object.freeze(output);
+  }
+  const properties = plainProperties(value);
+  consume(budget, "{}");
+  const output: Record<string, CustomerDatabaseJson> = {};
+  for (const [index, [key, property]] of Object.entries(properties).entries()) {
+    validateKey(key);
+    consume(budget, `${index > 0 ? "," : ""}${JSON.stringify(key)}:`);
+    output[key] = cloneJson(property.value, budget, depth + 1);
+  }
+  return Object.freeze(output);
+}
+
+function plainProperties(value: unknown): Record<string, PropertyDescriptor> {
+  if (
+    typeof value !== "object" ||
+    value === null ||
+    Object.getPrototypeOf(value) !== Object.prototype ||
+    Object.getOwnPropertySymbols(value).length !== 0
+  )
+    invalidIdentity();
+  const properties = Object.getOwnPropertyDescriptors(value);
+  for (const property of Object.values(properties)) {
+    if (!Object.hasOwn(property, "value") || !property.enumerable) invalidIdentity();
+  }
+  return properties;
+}
+
+function validateKey(key: string): void {
+  validateJsonString(key);
+  if (
+    key.length === 0 ||
+    new TextEncoder().encode(key).byteLength > 128 ||
+    /\p{Cc}/u.test(key) ||
+    key === "__proto__" ||
+    key === "constructor" ||
+    key === "prototype"
+  )
+    invalidIdentity();
+}
+
+function validateJsonString(value: string): void {
+  // PostgreSQL jsonb rejects NUL and lone UTF-16 surrogates even when JSON.stringify escapes them.
+  if (!value.isWellFormed() || value.includes("\u0000")) invalidIdentity();
+}
+
+function consume(budget: { bytes: number }, text: string): void {
+  budget.bytes += new TextEncoder().encode(text).byteLength;
+  if (budget.bytes > 16 * 1024) invalidIdentity();
+}
+
+function invalidIdentity(): never {
+  throw new TypeError("Invalid database RLS identity");
+}

package/src/packages/customer-runtime/src/database.ts

@@ -1,4 +1,7 @@
 import { CustomerDatabaseError, CustomerRuntimeError } from "./errors.js";
+import { normalizeRlsIdentity, type CustomerDatabaseRlsIdentity } from "./database-rls.js";
+
+export type { CustomerDatabaseRlsIdentity } from "./database-rls.js";
 
 const MAX_QUERY_BYTES = 64 * 1024;
 const MAX_PARAMETERS = 100;
@@ -36,6 +39,19 @@ export interface CustomerDatabaseBinding {
   query(input: unknown): Promise<unknown>;
   transaction(input: unknown): Promise<unknown>;
   open?(): Promise<CustomerDatabaseConnectionStub>;
+  openRls?(
+    identity: CustomerDatabaseRlsIdentity | null,
+  ): Promise<CustomerDatabaseRlsConnectionStub>;
+}
+
+/** Private lifecycle RPC. Only query is exposed to the application callback. */
+export interface CustomerDatabaseRlsConnectionStub extends CustomerDatabaseConnectionStub {
+  commit(): Promise<unknown>;
+}
+
+/** An existing identity-scoped transaction owned by withRls. */
+export interface CustomerDatabaseRlsTransaction {
+  query(input: CustomerDatabaseQuery): Promise<CustomerDatabaseQueryResult>;
 }
 
 /** The server-side held connection, reached through a stub. Never handed to customer code raw. */
@@ -50,6 +66,11 @@ export interface CustomerDatabaseConnection {
 }
 
 export interface CustomerDatabaseClient {
+  /** Authenticate in application code first; null explicitly selects anonymous policies. */
+  withRls<Result>(
+    identity: CustomerDatabaseRlsIdentity | null,
+    run: (transaction: CustomerDatabaseRlsTransaction) => Promise<Result>,
+  ): Promise<Result>;
   /**
    * Run a read, a decision and a write on one connection. The callback shape is deliberate: the
    * connection is always released, including when the callback throws, so a customer cannot leak
@@ -80,6 +101,12 @@ export function createPrivateDatabaseClient(
     );
   }
   return Object.freeze({
+    withRls<Result>(
+      identity: CustomerDatabaseRlsIdentity | null,
+      run: (transaction: CustomerDatabaseRlsTransaction) => Promise<Result>,
+    ): Promise<Result> {
+      return runRlsTransaction(binding, identity, run);
+    },
     async withConnection<Result>(
       run: (connection: CustomerDatabaseConnection) => Promise<Result>,
     ): Promise<Result> {
@@ -137,6 +164,112 @@ export function createPrivateDatabaseClient(
   });
 }
 
+async function runRlsTransaction<Result>(
+  binding: CustomerDatabaseBinding,
+  identity: CustomerDatabaseRlsIdentity | null,
+  run: (transaction: CustomerDatabaseRlsTransaction) => Promise<Result>,
+): Promise<Result> {
+  let wireIdentity: CustomerDatabaseRlsIdentity | null;
+  try {
+    const normalized = normalizeRlsIdentity(identity);
+    const sub = normalized.sub;
+    const claims: Record<string, CustomerDatabaseJson> = { ...normalized };
+    delete claims["sub"];
+    delete claims["role"];
+    wireIdentity = sub === null ? null : { subject: sub, claims };
+  } catch {
+    throw new CustomerRuntimeError("database_rls_identity_invalid", false);
+  }
+  if (typeof binding.openRls !== "function") throw unavailable();
+  let stub: CustomerDatabaseRlsConnectionStub;
+  try {
+    stub = await binding.openRls(wireIdentity);
+  } catch {
+    throw unavailable();
+  }
+  let state: "active" | "closing" | "closed" = "active";
+  let poisoned = false;
+  let pending: Promise<void> = Promise.resolve();
+  const transaction: CustomerDatabaseRlsTransaction = Object.freeze({
+    query(input: CustomerDatabaseQuery): Promise<CustomerDatabaseQueryResult> {
+      // Validate and snapshot immediately, before the caller can change a queued query.
+      let parsed: CustomerDatabaseQuery;
+      try {
+        if (state !== "active" || poisoned) throw rlsTransactionFailed();
+        parsed = validateQuery(input, undefined, false, true);
+      } catch (error) {
+        if (state === "active") poisoned = true;
+        const failed = Promise.reject<CustomerDatabaseQueryResult>(error);
+        // A fire-and-forget query must still roll the scope back without an unhandled rejection.
+        void failed.catch(() => undefined);
+        return failed;
+      }
+      const operation = pending.then(async () => {
+        if (poisoned) throw rlsTransactionFailed();
+        let raw: unknown;
+        try {
+          raw = await stub.query(parsed);
+        } catch {
+          throw unavailable();
+        }
+        throwRlsFailure(raw);
+        throwStatementFailure(raw);
+        return validateResult(raw);
+      });
+      pending = operation.then(
+        () => undefined,
+        () => {
+          poisoned = true;
+        },
+      );
+      return operation;
+    },
+  });
+  try {
+    const result = await run(transaction);
+    state = "closing";
+    await pending;
+    if (poisoned) throw rlsTransactionFailed();
+    let committed: unknown;
+    try {
+      committed = await stub.commit();
+    } catch {
+      throw new CustomerRuntimeError("database_transaction_outcome_unknown", false);
+    }
+    throwRlsFailure(committed, true);
+    if (
+      !isRecord(committed) ||
+      Object.keys(committed).join(",") !== "type" ||
+      committed["type"] !== "ohmyhost.database-rls-commit/v1"
+    ) {
+      throw new CustomerRuntimeError("database_transaction_outcome_unknown", false);
+    }
+    return result;
+  } finally {
+    state = "closing";
+    await pending;
+    state = "closed";
+    await stub.close().catch(() => undefined);
+  }
+}
+
+function rlsTransactionFailed(): CustomerRuntimeError {
+  return new CustomerRuntimeError("database_rls_transaction_failed", false);
+}
+
+function throwRlsFailure(value: unknown, duringCommit = false): void {
+  if (!isRecord(value) || value["type"] !== "ohmyhost.database-rls-error/v1") return;
+  const code = value["code"];
+  if (
+    Object.keys(value).sort().join(",") !== "code,type" ||
+    (code !== "database_rls_transaction_failed" && code !== "database_transaction_outcome_unknown")
+  ) {
+    if (duringCommit) throw new CustomerRuntimeError("database_transaction_outcome_unknown", false);
+    invalidResponse();
+  }
+  throw new CustomerRuntimeError(code, false);
+}
+
 function throwStatementFailure(value: unknown): void {
   if (!isRecord(value) || value["type"] !== "ohmyhost.database-error/v1") return;
   const sqlstate = value["sqlstate"];
@@ -153,6 +286,7 @@ function validateQuery(
   value: unknown,
   aggregateBudget?: { nodes: number; bytes: number },
   inConnection = false,
+  inRls = false,
 ): CustomerDatabaseQuery {
   if (!isRecord(value) || Object.keys(value).sort().join(",") !== "text,values") invalidQuery();
   const text = value["text"];
@@ -166,7 +300,7 @@ function validateQuery(
   ) {
     invalidQuery();
   }
-  validateSql(text, inConnection);
+  validateSql(text, inConnection, inRls);
   const budget = aggregateBudget ?? { nodes: 1, bytes: 2 };
   const parsedValues = values.map((parameter, index) => {
     if (index > 0) consume(budget, 1, MAX_PARAMETER_BYTES, invalidQuery);
@@ -200,7 +334,7 @@ function validateTransaction(value: unknown): readonly CustomerDatabaseQuery[] {
   return Object.freeze(queries);
 }
 
-function validateSql(text: string, inConnection = false): void {
+function validateSql(text: string, inConnection = false, inRls = false): void {
   let visible = "";
   let index = 0;
   while (index < text.length) {
@@ -266,6 +400,7 @@ function validateSql(text: string, inConnection = false): void {
   if (
     statements.length !== 1 ||
     semicolonCount > 1 ||
+    (inRls && /^call\b/iu.test(statement)) ||
     (inConnection
       ? // Transaction control is the whole point of holding a connection; session-wide state and a
         // chained transaction, which the database Worker refuses among the first six words, are not.

package/src/packages/customer-runtime/src/errors.ts

@@ -29,6 +29,9 @@ export type CustomerRuntimeErrorCode =
   | "database_binding_missing"
   | "database_query_invalid"
   | "database_response_invalid"
+  | "database_rls_identity_invalid"
+  | "database_rls_transaction_failed"
+  | "database_transaction_outcome_unknown"
   | "database_unavailable"
   | "scheduled_context_invalid";