@blixis-io/tenancy 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael Voeten
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,26 @@
+# `@blixis-io/tenancy`
+
+Request-scoped multi-tenant access control (`TenantScopedGuard`, a fail-closed `tenantScope()` query helper). Mechanism only — no Organization/Space/Membership data model — reusable by any multi-tenant app.
+
+```bash
+npm install @blixis-io/tenancy @blixis-io/http @blixis-io/core @blixis-io/di
+```
+
+```ts
+import { defineTenancyModule } from "@blixis-io/tenancy";
+
+export const { TenancyModule, TenantScopedGuard, getTenant, requireTenant } = defineTenancyModule({
+  getActor: (ctx) => getCurrentUser(ctx),
+  resolveMembership: (actor, spaceId) => membershipService.find(actor.id, spaceId),
+});
+```
+
+```ts
+@UseGuards(AuthGuard, TenantScopedGuard)
+@Controller("spaces/:spaceId/entries")
+class EntriesController {}
+```
+
+Fail-closed by design: an unknown or inaccessible space returns `404`, never `403` — a non-member can't tell a space exists at all.
+
+Part of [Blixis Framework](https://github.com/blixis-io/framework) — full docs: [Tenancy](https://blixis-io.github.io/framework/concepts/tenancy/) · [API reference](https://blixis-io.github.io/framework/reference/blixis-tenancy/).

package/dist/index.d.ts

@@ -0,0 +1,76 @@
+import { DynamicModule } from "@blixis-io/core";
+import { Class } from "@blixis-io/di";
+import { CanActivate, RequestContext } from "@blixis-io/http";
+import { SQL } from "drizzle-orm";
+import { PgColumn } from "drizzle-orm/pg-core";
+//#region src/errors.d.ts
+/**
+ * Thrown by `requireTenant()` and `tenantScope()` when there's no tenant in
+ * the current request context — the fail-closed guarantee: neither ever
+ * falls back to returning unscoped data.
+ */
+export declare class MissingTenantError extends Error {
+  constructor();
+}
+//#endregion
+//#region src/module.d.ts
+interface TenantContext {
+  organizationId: string;
+  spaceId: string;
+  /** Defaults to `"main"` when the route has no `:environment` param. */
+  environmentId: string;
+  role: string;
+}
+interface Membership {
+  organizationId: string;
+  role: string;
+}
+interface TenancyModuleOptions<Actor> {
+  /** Reads the current actor out of RequestContext — app-provided, since this package doesn't know which auth mechanism populated it. */
+  getActor: (ctx: RequestContext) => Actor | undefined;
+  /**
+   * Given the actor and a `spaceId` (from the route), returns their
+   * membership, or `null`/`undefined` if they have none. Called on every
+   * tenant-scoped request — a `null` result becomes a `404`, never a
+   * `403`, so a non-member can't tell a space exists at all.
+   */
+  resolveMembership: (actor: Actor, spaceId: string) => Membership | null | undefined | Promise<Membership | null | undefined>;
+}
+interface TenancyForRootOptions {
+  /** Makes `TenantScopedGuard` visible to every module without each one importing this one directly. Defaults to `false`. */
+  global?: boolean;
+}
+/** For a resource loaded another way (e.g. by id, via another module's service) — confirms it actually belongs to the current tenant. Mismatch is a 404, not a 403, same fail-closed reasoning as everywhere else here. Doesn't need any per-`defineTenancyModule()` state, so it's a plain module-level export, not part of the closure. */
+export declare function assertSameTenant(resourceSpaceId: string, tenant: TenantContext): void;
+/**
+ * Builds a `TenantScopedGuard` bound to one membership-resolution strategy.
+ * Owns the request-scoping *mechanism* only — no Organization/Space/
+ * Membership data model or CRUD lives here; that's app-specific CMS domain
+ * data, supplied via `resolveMembership`.
+ */
+export declare function defineTenancyModule<Actor>(options: TenancyModuleOptions<Actor>): {
+  TenancyModule: {
+    forRoot(forRootOptions?: TenancyForRootOptions): DynamicModule;
+  };
+  TenantScopedGuard: Class<CanActivate>;
+  getTenant: (ctx: RequestContext) => TenantContext | undefined;
+  requireTenant: (ctx: RequestContext) => TenantContext;
+  assertSameTenant: (resourceSpaceId: string, tenant: TenantContext) => void;
+};
+//#endregion
+//#region src/scope.d.ts
+/**
+ * A `where` predicate scoping a query to `tenant`'s space — throws
+ * `MissingTenantError` instead of silently returning an unscoped query
+ * when `tenant` is `undefined`. Compose with other conditions via
+ * Drizzle's own `and(tenantScope(posts.spaceId, tenant), ...)`.
+ */
+export declare function tenantScope(spaceIdColumn: PgColumn, tenant: TenantContext | undefined): SQL;
+/** Spread into an app's own `pgTable()` definition — `organizationId`/`spaceId` columns, present on every tenant-scoped table, including child tables (no join needed to scope a query). */
+export declare function tenantColumns(): {
+  organizationId: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgUUIDBuilderInitial<"organization_id">>;
+  spaceId: import("drizzle-orm").NotNull<import("drizzle-orm/pg-core").PgUUIDBuilderInitial<"space_id">>;
+};
+//#endregion
+export type { Membership, TenancyForRootOptions, TenancyModuleOptions, TenantContext };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/errors.ts","../src/module.ts","../src/scope.ts"],"mappings":";;;;;;;;;;;qBAKa,2BAA2B;EACtC;;;;UCKe;EACf;EACA;;EAEA;EACA;;UAGe;EACf;EACA;;UAGe,qBAAqB;;EAEpC,WAAW,KAAK,mBAAmB;;;;;;;EAOnC,oBACE,OAAO,OACP,oBACG,gCAAgC,QAAQ;;UAG9B;;EAEf;;;wBAUc,iBAAiB,yBAAyB,QAAQ;;;;;;;wBAYlD,oBAAoB,OAClC,SAAS,qBAAqB;EAE9B;IAAiB,QAAQ,iBAAiB,wBAAwB;;EAClE,mBAAmB,MAAM;EACzB,YAAY,KAAK,mBAAmB;EACpC,gBAAgB,KAAK,mBAAmB;EACxC,mBAAmB,yBAAyB,QAAQ;;;;;;;;;;wBC3DtC,YAAY,eAAe,UAAU,QAAQ,4BAA4B;;wBAQzE;EAEZ,sCAAc,sCAAA;EACd,+BAAO,sCAAA"}

package/dist/index.js

@@ -0,0 +1,118 @@
+import { Module } from "@blixis-io/core";
+import { Injectable } from "@blixis-io/di";
+import { NotFoundException, RequestContext, UnauthorizedException } from "@blixis-io/http";
+import { eq } from "drizzle-orm";
+import { uuid } from "drizzle-orm/pg-core";
+//#region src/errors.ts
+/**
+* Thrown by `requireTenant()` and `tenantScope()` when there's no tenant in
+* the current request context — the fail-closed guarantee: neither ever
+* falls back to returning unscoped data.
+*/
+var MissingTenantError = class extends Error {
+	constructor() {
+		super("No tenant in request context — apply TenantScopedGuard to this route first, or this was called outside a tenant-scoped request.");
+		this.name = "MissingTenantError";
+	}
+};
+//#endregion
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/decorateMetadata.js
+function __decorateMetadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region src/module.ts
+let tenancyInstanceCounter = 0;
+/** For a resource loaded another way (e.g. by id, via another module's service) — confirms it actually belongs to the current tenant. Mismatch is a 404, not a 403, same fail-closed reasoning as everywhere else here. Doesn't need any per-`defineTenancyModule()` state, so it's a plain module-level export, not part of the closure. */
+function assertSameTenant(resourceSpaceId, tenant) {
+	if (resourceSpaceId !== tenant.spaceId) throw new NotFoundException();
+}
+/**
+* Builds a `TenantScopedGuard` bound to one membership-resolution strategy.
+* Owns the request-scoping *mechanism* only — no Organization/Space/
+* Membership data model or CRUD lives here; that's app-specific CMS domain
+* data, supplied via `resolveMembership`.
+*/
+function defineTenancyModule(options) {
+	var _TenancyModule;
+	const TENANT_KEY = `blixis.tenancy.tenant.${tenancyInstanceCounter++}`;
+	function getTenant(ctx) {
+		return ctx.get(TENANT_KEY);
+	}
+	function requireTenant(ctx) {
+		const tenant = getTenant(ctx);
+		if (!tenant) throw new MissingTenantError();
+		return tenant;
+	}
+	let TenantScopedGuard = class TenantScopedGuard {
+		constructor(ctx) {
+			this.ctx = ctx;
+		}
+		async canActivate({ params }) {
+			const spaceId = params["spaceId"];
+			if (!spaceId) throw new Error("TenantScopedGuard requires a :spaceId route param");
+			const actor = options.getActor(this.ctx);
+			if (!actor) throw new UnauthorizedException();
+			const membership = await options.resolveMembership(actor, spaceId);
+			if (!membership) throw new NotFoundException();
+			const tenant = {
+				organizationId: membership.organizationId,
+				spaceId,
+				environmentId: params["environment"] ?? "main",
+				role: membership.role
+			};
+			this.ctx.set(TENANT_KEY, tenant);
+			return true;
+		}
+	};
+	TenantScopedGuard = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [typeof RequestContext === "undefined" ? Object : RequestContext])], TenantScopedGuard);
+	let TenancyModule = _TenancyModule = class TenancyModule {
+		static forRoot(forRootOptions = {}) {
+			return {
+				module: _TenancyModule,
+				providers: [TenantScopedGuard],
+				exports: [TenantScopedGuard],
+				global: forRootOptions.global ?? false
+			};
+		}
+	};
+	TenancyModule = _TenancyModule = __decorate([Module()], TenancyModule);
+	return {
+		TenancyModule,
+		TenantScopedGuard,
+		getTenant,
+		requireTenant,
+		assertSameTenant
+	};
+}
+//#endregion
+//#region src/scope.ts
+/**
+* A `where` predicate scoping a query to `tenant`'s space — throws
+* `MissingTenantError` instead of silently returning an unscoped query
+* when `tenant` is `undefined`. Compose with other conditions via
+* Drizzle's own `and(tenantScope(posts.spaceId, tenant), ...)`.
+*/
+function tenantScope(spaceIdColumn, tenant) {
+	if (!tenant) throw new MissingTenantError();
+	return eq(spaceIdColumn, tenant.spaceId);
+}
+/** Spread into an app's own `pgTable()` definition — `organizationId`/`spaceId` columns, present on every tenant-scoped table, including child tables (no join needed to scope a query). */
+function tenantColumns() {
+	return {
+		organizationId: uuid("organization_id").notNull(),
+		spaceId: uuid("space_id").notNull()
+	};
+}
+//#endregion
+export { MissingTenantError, assertSameTenant, defineTenancyModule, tenantColumns, tenantScope };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/errors.ts","../src/module.ts","../src/scope.ts"],"sourcesContent":["/**\n * Thrown by `requireTenant()` and `tenantScope()` when there's no tenant in\n * the current request context — the fail-closed guarantee: neither ever\n * falls back to returning unscoped data.\n */\nexport class MissingTenantError extends Error {\n  constructor() {\n    super(\n      \"No tenant in request context — apply TenantScopedGuard to this route first, or this was called outside a tenant-scoped request.\",\n    );\n    this.name = \"MissingTenantError\";\n  }\n}\n","import { Module, type DynamicModule } from \"@blixis-io/core\";\nimport { Injectable, type Class } from \"@blixis-io/di\";\nimport {\n  NotFoundException,\n  RequestContext,\n  UnauthorizedException,\n  type CanActivate,\n  type ExecutionContext,\n} from \"@blixis-io/http\";\nimport { MissingTenantError } from \"./errors.js\";\n\nexport interface TenantContext {\n  organizationId: string;\n  spaceId: string;\n  /** Defaults to `\"main\"` when the route has no `:environment` param. */\n  environmentId: string;\n  role: string;\n}\n\nexport interface Membership {\n  organizationId: string;\n  role: string;\n}\n\nexport interface TenancyModuleOptions<Actor> {\n  /** Reads the current actor out of RequestContext — app-provided, since this package doesn't know which auth mechanism populated it. */\n  getActor: (ctx: RequestContext) => Actor | undefined;\n  /**\n   * Given the actor and a `spaceId` (from the route), returns their\n   * membership, or `null`/`undefined` if they have none. Called on every\n   * tenant-scoped request — a `null` result becomes a `404`, never a\n   * `403`, so a non-member can't tell a space exists at all.\n   */\n  resolveMembership: (\n    actor: Actor,\n    spaceId: string,\n  ) => Membership | null | undefined | Promise<Membership | null | undefined>;\n}\n\nexport interface TenancyForRootOptions {\n  /** Makes `TenantScopedGuard` visible to every module without each one importing this one directly. Defaults to `false`. */\n  global?: boolean;\n}\n\n// One RequestContext key per defineTenancyModule() call, not a fixed\n// literal — otherwise two calls in the same app would read/write the same\n// slot and clobber each other. (Real bug found this exact way in\n// @blixis-io/auth; fixed proactively here.)\nlet tenancyInstanceCounter = 0;\n\n/** For a resource loaded another way (e.g. by id, via another module's service) — confirms it actually belongs to the current tenant. Mismatch is a 404, not a 403, same fail-closed reasoning as everywhere else here. Doesn't need any per-`defineTenancyModule()` state, so it's a plain module-level export, not part of the closure. */\nexport function assertSameTenant(resourceSpaceId: string, tenant: TenantContext): void {\n  if (resourceSpaceId !== tenant.spaceId) {\n    throw new NotFoundException();\n  }\n}\n\n/**\n * Builds a `TenantScopedGuard` bound to one membership-resolution strategy.\n * Owns the request-scoping *mechanism* only — no Organization/Space/\n * Membership data model or CRUD lives here; that's app-specific CMS domain\n * data, supplied via `resolveMembership`.\n */\nexport function defineTenancyModule<Actor>(\n  options: TenancyModuleOptions<Actor>,\n): {\n  TenancyModule: { forRoot(forRootOptions?: TenancyForRootOptions): DynamicModule };\n  TenantScopedGuard: Class<CanActivate>;\n  getTenant: (ctx: RequestContext) => TenantContext | undefined;\n  requireTenant: (ctx: RequestContext) => TenantContext;\n  assertSameTenant: (resourceSpaceId: string, tenant: TenantContext) => void;\n} {\n  const TENANT_KEY = `blixis.tenancy.tenant.${tenancyInstanceCounter++}`;\n\n  function getTenant(ctx: RequestContext): TenantContext | undefined {\n    return ctx.get<TenantContext>(TENANT_KEY);\n  }\n\n  function requireTenant(ctx: RequestContext): TenantContext {\n    const tenant = getTenant(ctx);\n    if (!tenant) {\n      throw new MissingTenantError();\n    }\n    return tenant;\n  }\n\n  @Injectable()\n  class TenantScopedGuard implements CanActivate {\n    constructor(private readonly ctx: RequestContext) {}\n\n    async canActivate({ params }: ExecutionContext): Promise<boolean> {\n      const spaceId = params[\"spaceId\"];\n      if (!spaceId) {\n        throw new Error(\"TenantScopedGuard requires a :spaceId route param\");\n      }\n\n      const actor = options.getActor(this.ctx);\n      if (!actor) {\n        throw new UnauthorizedException();\n      }\n\n      const membership = await options.resolveMembership(actor, spaceId);\n      if (!membership) {\n        throw new NotFoundException();\n      }\n\n      const tenant: TenantContext = {\n        organizationId: membership.organizationId,\n        spaceId,\n        environmentId: params[\"environment\"] ?? \"main\",\n        role: membership.role,\n      };\n      this.ctx.set(TENANT_KEY, tenant);\n      return true;\n    }\n  }\n\n  @Module()\n  class TenancyModule {\n    static forRoot(forRootOptions: TenancyForRootOptions = {}): DynamicModule {\n      return {\n        module: TenancyModule,\n        providers: [TenantScopedGuard],\n        exports: [TenantScopedGuard],\n        global: forRootOptions.global ?? false,\n      };\n    }\n  }\n\n  return { TenancyModule, TenantScopedGuard, getTenant, requireTenant, assertSameTenant };\n}\n","import { eq, type SQL } from \"drizzle-orm\";\nimport { uuid, type PgColumn } from \"drizzle-orm/pg-core\";\nimport { MissingTenantError } from \"./errors.js\";\nimport type { TenantContext } from \"./module.js\";\n\n/**\n * A `where` predicate scoping a query to `tenant`'s space — throws\n * `MissingTenantError` instead of silently returning an unscoped query\n * when `tenant` is `undefined`. Compose with other conditions via\n * Drizzle's own `and(tenantScope(posts.spaceId, tenant), ...)`.\n */\nexport function tenantScope(spaceIdColumn: PgColumn, tenant: TenantContext | undefined): SQL {\n  if (!tenant) {\n    throw new MissingTenantError();\n  }\n  return eq(spaceIdColumn, tenant.spaceId);\n}\n\n/** Spread into an app's own `pgTable()` definition — `organizationId`/`spaceId` columns, present on every tenant-scoped table, including child tables (no join needed to scope a query). */\nexport function tenantColumns() {\n  return {\n    organizationId: uuid(\"organization_id\").notNull(),\n    spaceId: uuid(\"space_id\").notNull(),\n  };\n}\n"],"mappings":";;;;;;;;;;;AAKA,IAAa,qBAAb,cAAwC,MAAM;CAC5C,cAAc;EACZ,MACE,iIACF;EACA,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;;;ACoCA,IAAI,yBAAyB;;AAG7B,SAAgB,iBAAiB,iBAAyB,QAA6B;CACrF,IAAI,oBAAoB,OAAO,SAC7B,MAAM,IAAI,kBAAkB;AAEhC;;;;;;;AAQA,SAAgB,oBACd,SAOA;;CACA,MAAM,aAAa,yBAAyB;CAE5C,SAAS,UAAU,KAAgD;EACjE,OAAO,IAAI,IAAmB,UAAU;CAC1C;CAEA,SAAS,cAAc,KAAoC;EACzD,MAAM,SAAS,UAAU,GAAG;EAC5B,IAAI,CAAC,QACH,MAAM,IAAI,mBAAmB;EAE/B,OAAO;CACT;CAEA,IACM,oBADN,MACM,kBAAyC;EAC7C,YAAY,KAAsC;GAArB,KAAA,MAAA;EAAsB;EAEnD,MAAM,YAAY,EAAE,UAA8C;GAChE,MAAM,UAAU,OAAO;GACvB,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,mDAAmD;GAGrE,MAAM,QAAQ,QAAQ,SAAS,KAAK,GAAG;GACvC,IAAI,CAAC,OACH,MAAM,IAAI,sBAAsB;GAGlC,MAAM,aAAa,MAAM,QAAQ,kBAAkB,OAAO,OAAO;GACjE,IAAI,CAAC,YACH,MAAM,IAAI,kBAAkB;GAG9B,MAAM,SAAwB;IAC5B,gBAAgB,WAAW;IAC3B;IACA,eAAe,OAAO,kBAAkB;IACxC,MAAM,WAAW;GACnB;GACA,KAAK,IAAI,IAAI,YAAY,MAAM;GAC/B,OAAO;EACT;CACF;CA7BC,oBAAA,WAAA,CAAA,WAAW,GAAA,mBAAA,qBAAA,CAAA,OAAA,mBAAA,cAAA,SAAA,cAAA,CAAA,CAAA,GAAA,iBAAA;CA+BZ,IACM,gBAAA,iBADN,MACM,cAAc;EAClB,OAAO,QAAQ,iBAAwC,CAAC,GAAkB;GACxE,OAAO;IACL,QAAA;IACA,WAAW,CAAC,iBAAiB;IAC7B,SAAS,CAAC,iBAAiB;IAC3B,QAAQ,eAAe,UAAU;GACnC;EACF;CACF;CAVC,gBAAA,iBAAA,WAAA,CAAA,OAAO,CAAA,GAAA,aAAA;CAYR,OAAO;EAAE;EAAe;EAAmB;EAAW;EAAe;CAAiB;AACxF;;;;;;;;;ACvHA,SAAgB,YAAY,eAAyB,QAAwC;CAC3F,IAAI,CAAC,QACH,MAAM,IAAI,mBAAmB;CAE/B,OAAO,GAAG,eAAe,OAAO,OAAO;AACzC;;AAGA,SAAgB,gBAAgB;CAC9B,OAAO;EACL,gBAAgB,KAAK,iBAAiB,CAAC,CAAC,QAAQ;EAChD,SAAS,KAAK,UAAU,CAAC,CAAC,QAAQ;CACpC;AACF"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@blixis-io/tenancy",
+  "version": "0.1.0",
+  "description": "Request-scoped multi-tenant access control (TenantScopedGuard, a fail-closed tenantScope() query helper). Mechanism only — no Organization/Space/Membership data model — reusable by any multi-tenant app.",
+  "license": "MIT",
+  "author": "Michael Voeten <michael@voeten.online>",
+  "homepage": "https://blixis-io.github.io/framework/",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/blixis-io/framework.git",
+    "directory": "packages/tenancy"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "keywords": [
+    "multi-tenancy",
+    "authorization",
+    "typescript"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "@blixis-io/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@blixis-io/core": "0.1.0",
+    "@blixis-io/di": "0.1.0",
+    "@blixis-io/http": "0.1.0",
+    "drizzle-orm": "^0.45.3"
+  },
+  "devDependencies": {
+    "@types/pg": "^8.15.6",
+    "pg": "^8.23.0"
+  },
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.json",
+    "build": "rolldown -c"
+  }
+}