@btravstack/prisma 0.15.0 → 0.16.0

package/dist/result.d.cts

@@ -0,0 +1,71 @@
+import { AsyncResult } from "unthrown";
+//#region src/result.d.ts
+declare const UniqueConstraintViolation_base: import("unthrown").TaggedErrorConstructor<"UniqueConstraintViolation">;
+/**
+ * A write refused by a unique index or constraint — SQLSTATE `23505`.
+ *
+ * `constraint` is the index the database named, which is what makes this
+ * translatable: a table with two unique constraints produces one error type and
+ * the caller still knows which one fired.
+ */
+export declare class UniqueConstraintViolation extends UniqueConstraintViolation_base<{
+  readonly constraint: string | undefined;
+  readonly table: string | undefined;
+}> {}
+declare const ForeignKeyViolation_base: import("unthrown").TaggedErrorConstructor<"ForeignKeyViolation">;
+/** A write refused by a foreign key — SQLSTATE `23503`. */
+export declare class ForeignKeyViolation extends ForeignKeyViolation_base<{
+  readonly constraint: string | undefined;
+  readonly table: string | undefined;
+}> {}
+declare const NotAuthorized_base: import("unthrown").TaggedErrorConstructor<"NotAuthorized">;
+/**
+ * The database refused the statement outright — SQLSTATE `42501`.
+ *
+ * On a table with row-level security this is what a `WITH CHECK` violation
+ * looks like — an `INSERT` or an `UPDATE` whose resulting row falls outside the
+ * policy. It is **not** what every cross-tenant statement produces: `USING`
+ * FILTERS, so a `SELECT`, `UPDATE` or `DELETE` that matches another tenant's
+ * rows answers nothing at all rather than failing. Only a write that lands
+ * outside the policy raises this.
+ *
+ * It is modeled rather than left as a defect because only the caller knows
+ * whether reaching it is a bug (an adapter bound to one tenant) or a request
+ * (a caller asking for something it may not have).
+ */
+export declare class NotAuthorized extends NotAuthorized_base<{
+  readonly table: string | undefined;
+}> {}
+/** What {@link qualify} models. Anything else is a defect. */
+export type SqlError = UniqueConstraintViolation | ForeignKeyViolation | NotAuthorized;
+/**
+ * SQLSTATE → a tagged error, or the caller's defect for anything unmodeled.
+ *
+ * The three arms are the ones an application triages. Everything else — a
+ * syntax error, a dead connection, a deadlock — is infrastructure a caller
+ * cannot act on differently, and belongs on the defect channel where an
+ * unexpected failure already goes.
+ */
+export declare const qualify: <D>(cause: unknown, defect: (cause: unknown) => D) => SqlError | D;
+/**
+ * Runs a query and answers a `Result` instead of rejecting.
+ *
+ * It takes a **thunk**, not a promise: an `AsyncResult` is eager, and a promise
+ * built at the call site has already started before the Result exists. Passing
+ * the work in unstarted is what keeps a sequence of these a sequence rather
+ * than a race.
+ *
+ * @example
+ * ```ts
+ * const save = (order: Order) =>
+ *   tryQuery(() => db.orm.orders.Order.create({ orderId: order.id })).mapErrCases(
+ *     (matcher, defect) =>
+ *       matcher
+ *         .with(P.tag("UniqueConstraintViolation"), () => new DuplicateOrder({ id: order.id }))
+ *         .with(P.tag("ForeignKeyViolation"), (violation) => defect(violation))
+ *         .with(P.tag("NotAuthorized"), (refused) => defect(refused)),
+ *   );
+ * ```
+ */
+export declare const tryQuery: <T>(run: () => PromiseLike<T>) => AsyncResult<T, SqlError>;
+//#endregion

package/dist/result.d.mts

@@ -0,0 +1,71 @@
+import { AsyncResult } from "unthrown";
+//#region src/result.d.ts
+declare const UniqueConstraintViolation_base: import("unthrown").TaggedErrorConstructor<"UniqueConstraintViolation">;
+/**
+ * A write refused by a unique index or constraint — SQLSTATE `23505`.
+ *
+ * `constraint` is the index the database named, which is what makes this
+ * translatable: a table with two unique constraints produces one error type and
+ * the caller still knows which one fired.
+ */
+export declare class UniqueConstraintViolation extends UniqueConstraintViolation_base<{
+  readonly constraint: string | undefined;
+  readonly table: string | undefined;
+}> {}
+declare const ForeignKeyViolation_base: import("unthrown").TaggedErrorConstructor<"ForeignKeyViolation">;
+/** A write refused by a foreign key — SQLSTATE `23503`. */
+export declare class ForeignKeyViolation extends ForeignKeyViolation_base<{
+  readonly constraint: string | undefined;
+  readonly table: string | undefined;
+}> {}
+declare const NotAuthorized_base: import("unthrown").TaggedErrorConstructor<"NotAuthorized">;
+/**
+ * The database refused the statement outright — SQLSTATE `42501`.
+ *
+ * On a table with row-level security this is what a `WITH CHECK` violation
+ * looks like — an `INSERT` or an `UPDATE` whose resulting row falls outside the
+ * policy. It is **not** what every cross-tenant statement produces: `USING`
+ * FILTERS, so a `SELECT`, `UPDATE` or `DELETE` that matches another tenant's
+ * rows answers nothing at all rather than failing. Only a write that lands
+ * outside the policy raises this.
+ *
+ * It is modeled rather than left as a defect because only the caller knows
+ * whether reaching it is a bug (an adapter bound to one tenant) or a request
+ * (a caller asking for something it may not have).
+ */
+export declare class NotAuthorized extends NotAuthorized_base<{
+  readonly table: string | undefined;
+}> {}
+/** What {@link qualify} models. Anything else is a defect. */
+export type SqlError = UniqueConstraintViolation | ForeignKeyViolation | NotAuthorized;
+/**
+ * SQLSTATE → a tagged error, or the caller's defect for anything unmodeled.
+ *
+ * The three arms are the ones an application triages. Everything else — a
+ * syntax error, a dead connection, a deadlock — is infrastructure a caller
+ * cannot act on differently, and belongs on the defect channel where an
+ * unexpected failure already goes.
+ */
+export declare const qualify: <D>(cause: unknown, defect: (cause: unknown) => D) => SqlError | D;
+/**
+ * Runs a query and answers a `Result` instead of rejecting.
+ *
+ * It takes a **thunk**, not a promise: an `AsyncResult` is eager, and a promise
+ * built at the call site has already started before the Result exists. Passing
+ * the work in unstarted is what keeps a sequence of these a sequence rather
+ * than a race.
+ *
+ * @example
+ * ```ts
+ * const save = (order: Order) =>
+ *   tryQuery(() => db.orm.orders.Order.create({ orderId: order.id })).mapErrCases(
+ *     (matcher, defect) =>
+ *       matcher
+ *         .with(P.tag("UniqueConstraintViolation"), () => new DuplicateOrder({ id: order.id }))
+ *         .with(P.tag("ForeignKeyViolation"), (violation) => defect(violation))
+ *         .with(P.tag("NotAuthorized"), (refused) => defect(refused)),
+ *   );
+ * ```
+ */
+export declare const tryQuery: <T>(run: () => PromiseLike<T>) => AsyncResult<T, SqlError>;
+//#endregion

package/dist/result.mjs

@@ -0,0 +1,73 @@
+import { TaggedError, fromPromise } from "unthrown";
+//#region src/result.ts
+/**
+* A write refused by a unique index or constraint — SQLSTATE `23505`.
+*
+* `constraint` is the index the database named, which is what makes this
+* translatable: a table with two unique constraints produces one error type and
+* the caller still knows which one fired.
+*/
+var UniqueConstraintViolation = class extends TaggedError("UniqueConstraintViolation") {};
+/** A write refused by a foreign key — SQLSTATE `23503`. */
+var ForeignKeyViolation = class extends TaggedError("ForeignKeyViolation") {};
+/**
+* The database refused the statement outright — SQLSTATE `42501`.
+*
+* On a table with row-level security this is what a `WITH CHECK` violation
+* looks like — an `INSERT` or an `UPDATE` whose resulting row falls outside the
+* policy. It is **not** what every cross-tenant statement produces: `USING`
+* FILTERS, so a `SELECT`, `UPDATE` or `DELETE` that matches another tenant's
+* rows answers nothing at all rather than failing. Only a write that lands
+* outside the policy raises this.
+*
+* It is modeled rather than left as a defect because only the caller knows
+* whether reaching it is a bug (an adapter bound to one tenant) or a request
+* (a caller asking for something it may not have).
+*/
+var NotAuthorized = class extends TaggedError("NotAuthorized") {};
+/**
+* SQLSTATE → a tagged error, or the caller's defect for anything unmodeled.
+*
+* The three arms are the ones an application triages. Everything else — a
+* syntax error, a dead connection, a deadlock — is infrastructure a caller
+* cannot act on differently, and belongs on the defect channel where an
+* unexpected failure already goes.
+*/
+const qualify = (cause, defect) => {
+	const error = cause;
+	switch (error?.sqlState) {
+		case "23505": return new UniqueConstraintViolation({
+			constraint: error.constraint,
+			table: error.table
+		});
+		case "23503": return new ForeignKeyViolation({
+			constraint: error.constraint,
+			table: error.table
+		});
+		case "42501": return new NotAuthorized({ table: error.table });
+		default: return defect(cause);
+	}
+};
+/**
+* Runs a query and answers a `Result` instead of rejecting.
+*
+* It takes a **thunk**, not a promise: an `AsyncResult` is eager, and a promise
+* built at the call site has already started before the Result exists. Passing
+* the work in unstarted is what keeps a sequence of these a sequence rather
+* than a race.
+*
+* @example
+* ```ts
+* const save = (order: Order) =>
+*   tryQuery(() => db.orm.orders.Order.create({ orderId: order.id })).mapErrCases(
+*     (matcher, defect) =>
+*       matcher
+*         .with(P.tag("UniqueConstraintViolation"), () => new DuplicateOrder({ id: order.id }))
+*         .with(P.tag("ForeignKeyViolation"), (violation) => defect(violation))
+*         .with(P.tag("NotAuthorized"), (refused) => defect(refused)),
+*   );
+* ```
+*/
+const tryQuery = (run) => fromPromise(Promise.resolve().then(run), qualify);
+//#endregion
+export { ForeignKeyViolation, NotAuthorized, UniqueConstraintViolation, qualify, tryQuery };

package/dist/rls.cjs

@@ -1,40 +1,40 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-let _prisma_client_extension = require("@prisma/client/extension");
+const require_result = require("./result.cjs");
 //#region src/rls.ts
 /**
-* A Prisma client extension pinning every statement to `tenant` through a
-* transaction-local `set_config`, so a row-level-security policy reading
-* `current_setting('app.tenant_id', true)` sees it.
+* Runs `work` in a transaction whose connection is pinned to `tenant`, so a
+* row-level-security policy reading `current_setting('app.tenant_id', true)`
+* admits that tenant's rows and no others.
 *
-* @remarks
-* Apply it **last**: the transaction callback's `tx` comes from the client as
-* it stood when this extension was applied, so an extension added after this
-* one is invisible inside a transaction.
+* The pin is `set_config(setting, tenant, true)` — **transaction-local**, which
+* is the whole reason this opens a transaction rather than issuing the pin and
+* handing back a client. A session-scoped pin followed by a separate query
+* works only while the pool happens to hand back the same connection, and fails
+* the first time it does not; it is the shape a middleware would take, and it
+* is why there is no middleware here.
+*
+* It answers an `AsyncResult`, qualified by {@link tryQuery}: the pin and the
+* work run on one connection and fail on one channel, so a caller never wraps
+* this in a second combinator. `work` still hands back a `PromiseLike`, because
+* that is what Prisma's own transaction callback is.
 *
-* `$transaction([...])` is refused — the reasoning is in
-* `packages/prisma/CLAUDE.md`. Use the callback form.
+* @remarks
+* The policy must read the **same** setting name. A `tenantPinned(db, tenant,
+* work, { setting })` whose policy names a different one denies every row and
+* every write, which looks exactly like row security working.
 *
 * @example
 * ```ts
-* const db = new PrismaClient({ adapter }).$extends(unthrownPrisma).$extends(tenantScoped(tenant));
+* const orders = await tenantPinned(db, tenant, (tx) => tx.orm.orders.Order.all());
 * ```
 */
-const tenantScoped = (tenant, options) => _prisma_client_extension.Prisma.defineExtension((client) => {
+const tenantPinned = (db, tenant, work, options) => {
 	const setting = options?.setting ?? "app.tenant_id";
-	const bare = client;
-	const pinOn = (on) => on.$executeRaw`SELECT set_config(${setting}, ${tenant}, true)`;
-	return client.$extends({
-		name: "tenantScoped",
-		client: { $transaction: ((arg, txOptions) => {
-			if (Array.isArray(arg)) return Promise.reject(/* @__PURE__ */ new Error("tenantScoped: $transaction([...]) is unsupported — use the callback form."));
-			const fn = arg;
-			return bare.$transaction(async (tx) => {
-				await pinOn(tx);
-				return fn(tx);
-			}, txOptions);
-		}) },
-		query: { $allOperations: ({ args, query }) => bare.$transaction([pinOn(bare), query(args)]).then((results) => results[1]) }
-	});
-});
+	const plan = db.raw.sql`SELECT set_config(${setting}, ${tenant}, ${true}) AS pinned`.returnsRow({ pinned: "pg/text@1" }).build();
+	return require_result.tryQuery(() => db.transaction(async (tx) => {
+		await tx.query(plan);
+		return work(tx);
+	}));
+};
 //#endregion
-exports.tenantScoped = tenantScoped;
+exports.tenantPinned = tenantPinned;

package/dist/rls.d.cts

@@ -1,6 +1,8 @@
+import { SqlError } from "./result.cjs";
+import { AsyncResult } from "unthrown";
 //#region src/rls.d.ts
-/** Options of {@link tenantScoped}. */
-export type TenantScopedOptions = {
+/** Options of {@link tenantPinned}. */
+export type TenantPinnedOptions = {
   /**
    * The PostgreSQL run-time setting the policy reads. Defaults to
    * `app.tenant_id`, matching `current_setting('app.tenant_id', true)`.
@@ -8,47 +10,53 @@ export type TenantScopedOptions = {
   readonly setting?: string;
 };
 /**
- * The client a pinned `$transaction` callback receives — the extended client
- * minus what a transaction cannot do, exactly as Prisma's own deny list has it.
- *
- * @remarks
- * Not `@unthrown/prisma`'s `TransactionClient`, which denies a longer list; an
- * application applying both extensions imports both names.
+ * The little of a Prisma 8 client this needs: the raw lane to build the pin
+ * with, and `transaction` to run it in. Structural, so the starter never has to
+ * name a contract it cannot see.
  */
-export type ScopedTransactionClient<C> = Omit<C, "$connect" | "$disconnect" | "$extends" | "$on" | "$use">;
+type Pinnable<Tx> = {
+  /**
+   * Required to EXIST and deliberately not described further. Spelling the
+   * tag's signature out would refuse every real client: a parameter is
+   * contravariant, and the genuine `raw.sql` takes the target's own
+   * interpolation union and its own row-spec type — both narrower than
+   * anything this package, which cannot see a contract, could name.
+   */
+  readonly raw: {
+    readonly sql: unknown;
+  };
+  readonly transaction: <R>(fn: (tx: Tx) => PromiseLike<R>) => Promise<R>;
+};
+/** What the pin needs of a transaction context: somewhere to run a plan. */
+type Queryable = {
+  readonly query: (plan: never) => PromiseLike<unknown>;
+};
 /**
- * The `$transaction` a {@link tenantScoped} client exposes: the callback form
- * only, with `this` carrying the extended client through to `tx`.
+ * Runs `work` in a transaction whose connection is pinned to `tenant`, so a
+ * row-level-security policy reading `current_setting('app.tenant_id', true)`
+ * admits that tenant's rows and no others.
  *
- * @remarks
- * The generic `this` is what keeps `tx` typed. The starter cannot name a
- * generated client, so the receiver is the only place that type can come from.
- * The array form is absent because it cannot be pinned atomically.
- */
-export type ScopedTransaction = <C, R>(this: C, fn: (tx: ScopedTransactionClient<C>) => Promise<R>, options?: {
-  maxWait?: number;
-  timeout?: number;
-  isolationLevel?: string;
-}) => Promise<R>;
-/**
- * A Prisma client extension pinning every statement to `tenant` through a
- * transaction-local `set_config`, so a row-level-security policy reading
- * `current_setting('app.tenant_id', true)` sees it.
+ * The pin is `set_config(setting, tenant, true)` — **transaction-local**, which
+ * is the whole reason this opens a transaction rather than issuing the pin and
+ * handing back a client. A session-scoped pin followed by a separate query
+ * works only while the pool happens to hand back the same connection, and fails
+ * the first time it does not; it is the shape a middleware would take, and it
+ * is why there is no middleware here.
  *
- * @remarks
- * Apply it **last**: the transaction callback's `tx` comes from the client as
- * it stood when this extension was applied, so an extension added after this
- * one is invisible inside a transaction.
+ * It answers an `AsyncResult`, qualified by {@link tryQuery}: the pin and the
+ * work run on one connection and fail on one channel, so a caller never wraps
+ * this in a second combinator. `work` still hands back a `PromiseLike`, because
+ * that is what Prisma's own transaction callback is.
  *
- * `$transaction([...])` is refused — the reasoning is in
- * `packages/prisma/CLAUDE.md`. Use the callback form.
+ * @remarks
+ * The policy must read the **same** setting name. A `tenantPinned(db, tenant,
+ * work, { setting })` whose policy names a different one denies every row and
+ * every write, which looks exactly like row security working.
  *
  * @example
  * ```ts
- * const db = new PrismaClient({ adapter }).$extends(unthrownPrisma).$extends(tenantScoped(tenant));
+ * const orders = await tenantPinned(db, tenant, (tx) => tx.orm.orders.Order.all());
  * ```
  */
-export declare const tenantScoped: (tenant: string, options?: TenantScopedOptions) => (client: any) => import("@prisma/client/extension").PrismaClientExtends<import("@prisma/client/runtime/client").InternalArgs<{}, {}, {}, {
-  $transaction: ScopedTransaction;
-}> & import("@prisma/client/runtime/client").DefaultArgs>;
+export declare const tenantPinned: <Tx extends Queryable, R>(db: Pinnable<Tx>, tenant: string, work: (tx: Tx) => PromiseLike<R>, options?: TenantPinnedOptions) => AsyncResult<R, SqlError>;
 //#endregion

package/dist/rls.d.mts

@@ -1,6 +1,8 @@
+import { SqlError } from "./result.mjs";
+import { AsyncResult } from "unthrown";
 //#region src/rls.d.ts
-/** Options of {@link tenantScoped}. */
-export type TenantScopedOptions = {
+/** Options of {@link tenantPinned}. */
+export type TenantPinnedOptions = {
   /**
    * The PostgreSQL run-time setting the policy reads. Defaults to
    * `app.tenant_id`, matching `current_setting('app.tenant_id', true)`.
@@ -8,47 +10,53 @@ export type TenantScopedOptions = {
   readonly setting?: string;
 };
 /**
- * The client a pinned `$transaction` callback receives — the extended client
- * minus what a transaction cannot do, exactly as Prisma's own deny list has it.
- *
- * @remarks
- * Not `@unthrown/prisma`'s `TransactionClient`, which denies a longer list; an
- * application applying both extensions imports both names.
+ * The little of a Prisma 8 client this needs: the raw lane to build the pin
+ * with, and `transaction` to run it in. Structural, so the starter never has to
+ * name a contract it cannot see.
  */
-export type ScopedTransactionClient<C> = Omit<C, "$connect" | "$disconnect" | "$extends" | "$on" | "$use">;
+type Pinnable<Tx> = {
+  /**
+   * Required to EXIST and deliberately not described further. Spelling the
+   * tag's signature out would refuse every real client: a parameter is
+   * contravariant, and the genuine `raw.sql` takes the target's own
+   * interpolation union and its own row-spec type — both narrower than
+   * anything this package, which cannot see a contract, could name.
+   */
+  readonly raw: {
+    readonly sql: unknown;
+  };
+  readonly transaction: <R>(fn: (tx: Tx) => PromiseLike<R>) => Promise<R>;
+};
+/** What the pin needs of a transaction context: somewhere to run a plan. */
+type Queryable = {
+  readonly query: (plan: never) => PromiseLike<unknown>;
+};
 /**
- * The `$transaction` a {@link tenantScoped} client exposes: the callback form
- * only, with `this` carrying the extended client through to `tx`.
+ * Runs `work` in a transaction whose connection is pinned to `tenant`, so a
+ * row-level-security policy reading `current_setting('app.tenant_id', true)`
+ * admits that tenant's rows and no others.
  *
- * @remarks
- * The generic `this` is what keeps `tx` typed. The starter cannot name a
- * generated client, so the receiver is the only place that type can come from.
- * The array form is absent because it cannot be pinned atomically.
- */
-export type ScopedTransaction = <C, R>(this: C, fn: (tx: ScopedTransactionClient<C>) => Promise<R>, options?: {
-  maxWait?: number;
-  timeout?: number;
-  isolationLevel?: string;
-}) => Promise<R>;
-/**
- * A Prisma client extension pinning every statement to `tenant` through a
- * transaction-local `set_config`, so a row-level-security policy reading
- * `current_setting('app.tenant_id', true)` sees it.
+ * The pin is `set_config(setting, tenant, true)` — **transaction-local**, which
+ * is the whole reason this opens a transaction rather than issuing the pin and
+ * handing back a client. A session-scoped pin followed by a separate query
+ * works only while the pool happens to hand back the same connection, and fails
+ * the first time it does not; it is the shape a middleware would take, and it
+ * is why there is no middleware here.
  *
- * @remarks
- * Apply it **last**: the transaction callback's `tx` comes from the client as
- * it stood when this extension was applied, so an extension added after this
- * one is invisible inside a transaction.
+ * It answers an `AsyncResult`, qualified by {@link tryQuery}: the pin and the
+ * work run on one connection and fail on one channel, so a caller never wraps
+ * this in a second combinator. `work` still hands back a `PromiseLike`, because
+ * that is what Prisma's own transaction callback is.
  *
- * `$transaction([...])` is refused — the reasoning is in
- * `packages/prisma/CLAUDE.md`. Use the callback form.
+ * @remarks
+ * The policy must read the **same** setting name. A `tenantPinned(db, tenant,
+ * work, { setting })` whose policy names a different one denies every row and
+ * every write, which looks exactly like row security working.
  *
  * @example
  * ```ts
- * const db = new PrismaClient({ adapter }).$extends(unthrownPrisma).$extends(tenantScoped(tenant));
+ * const orders = await tenantPinned(db, tenant, (tx) => tx.orm.orders.Order.all());
  * ```
  */
-export declare const tenantScoped: (tenant: string, options?: TenantScopedOptions) => (client: any) => import("@prisma/client/extension").PrismaClientExtends<import("@prisma/client/runtime/client").InternalArgs<{}, {}, {}, {
-  $transaction: ScopedTransaction;
-}> & import("@prisma/client/runtime/client").DefaultArgs>;
+export declare const tenantPinned: <Tx extends Queryable, R>(db: Pinnable<Tx>, tenant: string, work: (tx: Tx) => PromiseLike<R>, options?: TenantPinnedOptions) => AsyncResult<R, SqlError>;
 //#endregion

package/dist/rls.mjs

@@ -1,39 +1,39 @@
-import { Prisma } from "@prisma/client/extension";
+import { tryQuery } from "./result.mjs";
 //#region src/rls.ts
 /**
-* A Prisma client extension pinning every statement to `tenant` through a
-* transaction-local `set_config`, so a row-level-security policy reading
-* `current_setting('app.tenant_id', true)` sees it.
+* Runs `work` in a transaction whose connection is pinned to `tenant`, so a
+* row-level-security policy reading `current_setting('app.tenant_id', true)`
+* admits that tenant's rows and no others.
 *
-* @remarks
-* Apply it **last**: the transaction callback's `tx` comes from the client as
-* it stood when this extension was applied, so an extension added after this
-* one is invisible inside a transaction.
+* The pin is `set_config(setting, tenant, true)` — **transaction-local**, which
+* is the whole reason this opens a transaction rather than issuing the pin and
+* handing back a client. A session-scoped pin followed by a separate query
+* works only while the pool happens to hand back the same connection, and fails
+* the first time it does not; it is the shape a middleware would take, and it
+* is why there is no middleware here.
+*
+* It answers an `AsyncResult`, qualified by {@link tryQuery}: the pin and the
+* work run on one connection and fail on one channel, so a caller never wraps
+* this in a second combinator. `work` still hands back a `PromiseLike`, because
+* that is what Prisma's own transaction callback is.
 *
-* `$transaction([...])` is refused — the reasoning is in
-* `packages/prisma/CLAUDE.md`. Use the callback form.
+* @remarks
+* The policy must read the **same** setting name. A `tenantPinned(db, tenant,
+* work, { setting })` whose policy names a different one denies every row and
+* every write, which looks exactly like row security working.
 *
 * @example
 * ```ts
-* const db = new PrismaClient({ adapter }).$extends(unthrownPrisma).$extends(tenantScoped(tenant));
+* const orders = await tenantPinned(db, tenant, (tx) => tx.orm.orders.Order.all());
 * ```
 */
-const tenantScoped = (tenant, options) => Prisma.defineExtension((client) => {
+const tenantPinned = (db, tenant, work, options) => {
 	const setting = options?.setting ?? "app.tenant_id";
-	const bare = client;
-	const pinOn = (on) => on.$executeRaw`SELECT set_config(${setting}, ${tenant}, true)`;
-	return client.$extends({
-		name: "tenantScoped",
-		client: { $transaction: ((arg, txOptions) => {
-			if (Array.isArray(arg)) return Promise.reject(/* @__PURE__ */ new Error("tenantScoped: $transaction([...]) is unsupported — use the callback form."));
-			const fn = arg;
-			return bare.$transaction(async (tx) => {
-				await pinOn(tx);
-				return fn(tx);
-			}, txOptions);
-		}) },
-		query: { $allOperations: ({ args, query }) => bare.$transaction([pinOn(bare), query(args)]).then((results) => results[1]) }
-	});
-});
+	const plan = db.raw.sql`SELECT set_config(${setting}, ${tenant}, ${true}) AS pinned`.returnsRow({ pinned: "pg/text@1" }).build();
+	return tryQuery(() => db.transaction(async (tx) => {
+		await tx.query(plan);
+		return work(tx);
+	}));
+};
 //#endregion
-export { tenantScoped };
+export { tenantPinned };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@btravstack/prisma",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "The Prisma starter for @btravstack/core: DATABASE_URL through Config, the Postgres driver adapter, and a client whose pool is the application scope's",
   "keywords": [
     "database",
@@ -50,16 +50,24 @@
         "default": "./dist/rls.cjs"
       }
     },
+    "./result": {
+      "import": {
+        "types": "./dist/result.d.mts",
+        "default": "./dist/result.mjs"
+      },
+      "require": {
+        "types": "./dist/result.d.cts",
+        "default": "./dist/result.cjs"
+      }
+    },
     "./package.json": "./package.json"
   },
   "devDependencies": {
-    "@btravstack/config": "0.15.0",
-    "@btravstack/core": "0.15.0",
-    "@btravstack/di": "0.15.0",
+    "@btravstack/config": "0.16.0",
+    "@btravstack/core": "0.16.0",
+    "@btravstack/di": "0.16.0",
     "@btravstack/tsconfig": "0.4.0",
-    "@prisma/adapter-pg": "7.10.0",
-    "@prisma/client": "7.10.0",
-    "@prisma/instrumentation": "7.10.0",
+    "@prisma/orm-postgres": "8.0.0-rc.11",
     "@types/node": "26.4.1",
     "@unthrown/vitest": "5.8.0",
     "@vitest/coverage-v8": "4.1.11",
@@ -69,28 +77,18 @@
     "vitest": "4.1.11"
   },
   "peerDependencies": {
-    "@btravstack/config": "^0.15.0",
-    "@btravstack/core": "^0.15.0",
-    "@btravstack/di": "^0.15.0",
-    "@prisma/adapter-pg": "^7.0.0",
-    "@prisma/client": "^7.10.0",
-    "@prisma/instrumentation": "^7.0.0",
+    "@btravstack/config": "^0.16.0",
+    "@btravstack/core": "^0.16.0",
+    "@btravstack/di": "^0.16.0",
+    "@prisma/orm-postgres": "^8.0.0-rc.11",
     "unthrown": "^5.0.0"
   },
-  "peerDependenciesMeta": {
-    "@prisma/client": {
-      "optional": true
-    },
-    "@prisma/instrumentation": {
-      "optional": true
-    }
-  },
   "engines": {
     "node": ">=22"
   },
   "scripts": {
-    "build": "tsdown src/index.ts src/rls.ts --format cjs,esm --dts --clean",
-    "dev": "tsdown src/index.ts src/rls.ts --format cjs,esm --dts --watch",
+    "build": "tsdown src/index.ts src/rls.ts src/result.ts --format cjs,esm --dts --clean",
+    "dev": "tsdown src/index.ts src/rls.ts src/result.ts --format cjs,esm --dts --watch",
     "test": "vitest run --coverage",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test-d.json"
   }