@di-framework/pglite-component 6.0.14 → 6.0.16

package/README.md

@@ -1,6 +1,6 @@
 # di-framework:pglite — embedded PostgreSQL over WIT
 
-The provider bundles the PGlite PostgreSQL 17.5 engine into a WebAssembly
+The provider bundles a PostgreSQL 17.11 engine, built for WASI, into a WebAssembly
 component. SQL calls cross WIT and WebAssembly memory. There is no TCP listener,
 network client, native sidecar, or separate database service.
 
@@ -59,12 +59,56 @@ is cached under `target/engine`. Containers are build tools only; deployment
 runs the resulting `.wasm` directly. For a remote Podman daemon, set the task's
 `DOCKER_CONTEXT=podman`.
 
+### Engine source
+
+The engine is upstream PostgreSQL `REL_17_11` with ElectricSQL's PGlite WASI
+changes replayed onto it. Electric maintains no WASI branch past 17.5 (its newer
+branches are Emscripten-only), so the 17.5 WASI changes are carried as
+[`engine/patches/postgresql-17.11-wasi.patch`](engine/patches/README.md)
+(PostgreSQL License). `scripts/build-engine.ts` fetches the tag pinned in
+`scripts/tool-versions.env` (`POSTGRES_SOURCE_TAG`), refuses it unless it
+resolves to `POSTGRES_SOURCE_COMMIT`, and applies that patch and then the
+[wasipg](https://github.com/moznion/wasipg) recipe's sjlj patches, checking each
+before applying it. `scripts/patch-engine-source.ts` adds the di-framework
+changes described in `engine/NOTICE`.
+
+`make check-engine-patch` runs all of those steps without the container build,
+in about 30 seconds. Run it first after bumping the PostgreSQL release: a patch
+that no longer applies fails with its name, the base, and git's output. Then
+follow [engine/patches/README.md](engine/patches/README.md).
+
 The build embeds the support filesystem, adapts the engine's WASI Preview 1
 imports to Preview 2, and composes the engine with the Rust database provider.
 It fails if the final artifact imports sockets or leaves the engine unresolved.
 Ship `dist/di-framework-pglite.wasm` together with `THIRD-PARTY-NOTICES.txt`.
 Build provenance and checksums are in `dist/BUILD-INFO.txt` and `SHA256SUMS`.
 
+On one host architecture and one builder image, two clean engine builds are
+byte-identical. `scripts/build-engine.ts` sets `SOURCE_DATE_EPOCH` to the commit
+time of the pinned engine recipe (`PGLITE_SOURCE_REF`) and passes it into the
+build container. OpenSSL then writes that date into `crypto/buildinf.h`
+instead of the wall clock, so `libcrypto.a` is deterministic, and clang's
+`__DATE__`/`__TIME__` are fixed. `engine/build-pgcrypto.sh` fails if
+`buildinf.h` does not carry the pinned date. The engine does not link
+OpenSSL's build info today, so this guards against it being linked in later.
+`make reproducible` builds the engine twice from clean copies of the package
+and fails unless `pglite.wasi`, `engine.core.wasm`, `engine.wasm` and every
+embedded support file have the same sha256. The builds go in a new
+`df-pglite-repro.*` directory under the system temp dir, or under
+`REPRO_ARGS="--work-dir DIR"`, an existing directory outside the repository checkout.
+Only that new directory is deleted, and it is kept if a build fails or the
+digests differ. `--sdk-cache DIR` reuses SDK tarballs you have already
+downloaded, and `--keep` keeps both builds. The
+[reproducibility workflow](../../.github/workflows/pglite-engine-reproducible.yml)
+runs the check on x86_64 when an engine input changes.
+
+The results are not portable across these limits:
+- An aarch64 host and an x86_64 host produce different engines and support
+  files, so an Apple Silicon build does not reproduce the released x86_64
+  engine.
+- The builder image's `FROM debian:12` tag and its `apt-get` packages are not
+  pinned, so builds made months apart can differ.
+
 `make smoke` composes a real WIT consumer, runs it without network access, and
 checks typed parameters/results, SQL errors and recovery, transactions,
 rollback on close/drop, exclusive connection ownership, durability settings,
@@ -72,6 +116,14 @@ and persistence across separate runtime processes. It also exits a runtime
 with an open transaction and verifies that committed rows survive and the
 uncommitted row is absent after restart. No scripted database server is used.
 
+`make smoke` also checks upgrades from the previous release. It downloads the
+published `@di-framework/pglite-component` tarball pinned as
+`PGLITE_UPGRADE_FROM_*` in `scripts/tool-versions.env` (6.0.15, PostgreSQL
+17.5) and checks its sha256. Its provider writes a data directory with a table,
+pgcrypto and PGP ciphertext. The new build must then open that directory,
+report 17.11, read the rows, decrypt the old ciphertext, run pgcrypto on new
+values, and write to it.
+
 ## Publishing to GHCR
 
 The pglite component is published to GitHub Container Registry (GHCR) as an OCI wasm component. [The workflow](https://github.com/di-framework/platform/actions/workflows/pglite-component-publish.yml) runs by itself on each push to `main` that changes one of its input paths (`on.push.paths`). `workflow_dispatch` stays available for reruns and always builds.
@@ -79,7 +131,7 @@ The pglite component is published to GitHub Container Registry (GHCR) as an OCI
 The workflow has four jobs:
 - `check-source` (`packages: read`) hashes the committed input files (`scripts/source-check.ts`). On a push it skips the build when `ghcr.io/di-framework/pglite-component:src-<hash>` already exists, so commits that do not change the component publish nothing.
 - `build` (no write token) runs the same targets as `ci.yml`: `make tools-rust`, `make unit smoke` (which runs `make build`, composing the provider with the engine via `wac plug`), then the publisher crates' clippy and tests.
-- `publish` (`packages: write`) downloads the tested `dist/` and runs `pglite-component-publisher`. It never rebuilds or modifies `dist/`. It checks `SHA256SUMS`, requires the export `di-framework:pglite/database@0.2.0` and rejects any import that is not `wasi:*`, then pushes `ghcr.io/di-framework/pglite-component:<commit sha>` once, pulls it back by the manifest digest to compare bytes, then points the version tag (`0.2.0`, the WIT package version) at that same manifest with `oras tag` and asserts both tags resolve to one digest. The `build` job passes the tested wasm sha256 to `publish`, which verifies it before pushing. It also tags the manifest `src-<hash>`.
+- `publish` (`packages: write`) downloads the tested `dist/` and runs `pglite-component-publisher`. It never rebuilds or modifies `dist/`. It checks `SHA256SUMS`, requires the export `di-framework:pglite/database@0.2.0` and rejects any import that is not `wasi:*`, then pushes the layer, config and manifest with `oras` under `ghcr.io/di-framework/pglite-component:<commit sha>` only, pulls it back with `wash` by the manifest digest to compare bytes, and only then points the version tag (`0.2.0`, the WIT package version) at that same manifest with `oras tag` and asserts both tags resolve to one digest. A failed check leaves the version tag where it was. The manifest and config carry a fixed `created` time (the publish step clears `SOURCE_DATE_EPOCH`, so `1970-01-01T00:00:00Z`), so publishing an unchanged `di-framework-pglite.wasm` gives the same digest and the pin job has nothing to pin. The `build` job passes the tested wasm sha256 to `publish`, which verifies it before pushing. It also tags the manifest `src-<hash>`.
 - `pin` (`contents: write`, `pull-requests: write`) opens or updates the PR `bot/pin-pglite-component`, "chore: pin pglite-component to <digest>", which rewrites the digests in this README with `scripts/pin-artifact.ts`. GitHub does not run workflows on a PR that `GITHUB_TOKEN` opened, so a maintainer has to start its checks (close and reopen it) before merging. It also runs when a push's source is already published (a revert to an older source, or a pin PR closed unmerged), so `main`'s pin follows the current source; it opens no PR when `main` already has the digest. On that path the `realign` job (`packages: write`) points the moving version tag back at that source's digest with `scripts/retag.sh`, which leaves a tag that is already there alone. Every tag move is behind the same source guard, so a stale run never retags.
 
 Tags are movable. `0.2.0` always points to the latest `main` publish for WIT package 0.2.0, and re-running a commit also moves its SHA tag. Only the `@sha256:...` digest is immutable, so consumers pin by digest.
@@ -87,7 +139,7 @@ Tags are movable. `0.2.0` always points to the latest `main` publish for WIT pac
 ### Artifact location
 
 The digest is in **Details** > **Record component digest** > **Step summary**, and in the `pglite-publish-report` artifact (`publish-report.json`).
-Published digest: `ghcr.io/di-framework/pglite-component@sha256:4c6243bed7c30df93ef5a6c11c3070e3e777786fe4e34b3a63f4b89b8f75a523`
+Published digest: `ghcr.io/di-framework/pglite-component@sha256:9be0cc2f59efea9ade293173ca28bd289a5505eb31b08fb954e718c03316355e`
 
 **Note:** The GHCR package must be made public by an org admin after the first publish. Until then, only members with access to di-framework/platform can pull it.
 
@@ -125,7 +177,7 @@ wasmtime run --dir ./data::/data path/to/app.composed.wasm
 To use the published OCI component from GHCR instead (pin by digest for reproducibility):
 
 ```sh
-export PGLITE_REF='ghcr.io/di-framework/pglite-component@sha256:4c6243bed7c30df93ef5a6c11c3070e3e777786fe4e34b3a63f4b89b8f75a523'
+export PGLITE_REF='ghcr.io/di-framework/pglite-component@sha256:9be0cc2f59efea9ade293173ca28bd289a5505eb31b08fb954e718c03316355e'
 wash oci pull "${PGLITE_REF}" pglite.wasm
 wac plug --plug pglite.wasm path/to/app.wasm -o path/to/app.composed.wasm
 mkdir -p ./data
@@ -210,13 +262,25 @@ PostgreSQL type:
 | `float4`, `float8` | `real` | |
 | `bytea` | `blob` | |
 | `json`, `jsonb` | `json` | JSON text; `jsonb` is re-rendered by PostgreSQL (`{"a": 1}`) |
-| `timestamptz` | `timestamp` | RFC 3339 in UTC, e.g. `2024-01-15T10:30:00Z`, fractional seconds kept (`...:00.123Z`). `infinity` and `-infinity` are returned as those literals; BC dates are returned unmodified (`0044-03-15 00:00:00+00 BC`) |
+| `timestamptz` | `timestamp` | RFC 3339 in UTC, e.g. `2024-01-15T10:30:00Z`, fractional seconds kept (`...:00.123Z`). `infinity` and `-infinity` are returned as those literals. A value RFC 3339 cannot hold (BC dates, years after 9999) is `text`, as PostgreSQL printed it (`0044-03-15 00:00:00+00 BC`) |
 | `timestamp` (no zone) | `text` | `2024-01-15 10:30:00` (ISO, space separator, no offset). Deliberately not `timestamp`, which always denotes an instant |
 | `date` | `text` | `2024-01-15` |
 | `uuid`, `numeric` | `text` | canonical PostgreSQL text (`12.50` keeps its scale) |
 | arrays | `text` | PostgreSQL array literal, e.g. `{a,b}` |
 | everything else | `text` | |
 
+A caller can still change either setting with `SET` for the rest of the connection. `timestamptz`
+cells are parsed rather than trusted, so the `timestamp` variant always holds RFC 3339 in UTC (or
+an infinity):
+
+- After `SET TimeZone`, with `DateStyle` still ISO, PostgreSQL prints a local offset
+  (`2024-01-15 05:30:00.5-05`). The provider converts it back to UTC (`2024-01-15T10:30:00.5Z`).
+- After `SET DateStyle` to `SQL`, `Postgres` or `German`, the output cannot be converted reliably
+  (`15/01/2024 05:30:00.5 EST`), so it is returned as `text`, exactly as printed. `infinity` and
+  `-infinity` print the same under every DateStyle, so they stay `timestamp`.
+
+Closing and reopening the connection pins `DateStyle=ISO` and `TimeZone=UTC` again.
+
 Parameters are typed as follows. `integer`, `real`, `boolean` and `blob` are
 sent as `int8`, `float8`, `bool` and `bytea`. `text`, `json` and `timestamp`
 are all sent with OID 0 (unknown), so PostgreSQL infers the type from context:
@@ -269,6 +333,33 @@ engine routes to the host's WASI `random` interface. `gen_random_uuid()` is
 built into PostgreSQL and works without the extension. Other contrib modules
 are not included. The WIT interface does not change.
 
+Public-key PGP (`pgp_pub_encrypt`/`pgp_pub_decrypt`) works with ElGamal and RSA
+keys; pgcrypto cannot generate keys, so import them with `dearmor()`. For
+ElGamal, the ephemeral `k` comes from OpenSSL's DRBG (`BN_rand`), not from
+`pg_strong_random`. On WASI, OpenSSL seeds that DRBG from `getentropy`, which
+is the same WASI `random_get` import. It fails closed: if the host cannot
+supply entropy, the DRBG does not start and `pgp_pub_encrypt` raises an error
+instead of using a weak `k`.
+
+Blowfish (`bf`), CAST5 (`cast5`) and single DES (`des`) are unavailable in
+this build, because the OpenSSL legacy provider is not built or loaded.
+pgcrypto refuses them with `Cipher cannot be initialized`: in `encrypt()` and
+`decrypt()`, in the PGP functions, and when decrypting PGP messages that use
+them. For PGP this is upstream PostgreSQL's own check (17.11, CVE-2026-14663);
+pgcrypto is otherwise unmodified. Provider releases before the #355 fix wrote
+Blowfish and CAST5 PGP messages that are not actually encrypted. To recover such
+a message, decrypt it once with upstream's `ignore-cipher-failure=1` option
+(`pgp_sym_decrypt`, `pgp_pub_decrypt`; decryption only), then re-encrypt it with
+AES. Plaintext recovered that way is not authenticated by the key. `3des` (DES-EDE3) is in OpenSSL's default provider and still works, for
+legacy data only. Use `aes` (`aes128`, `aes192`, `aes256` for PGP). Password hashing with
+`crypt()` and `gen_salt('bf')`, `'md5'`, `'xdes'` or `'des'` is unaffected,
+because pgcrypto implements those itself.
+
+The engine has no `dlopen`. Its emulation keeps a fixed table of 64 loaded
+libraries per engine instance. pgcrypto resolves before that table and never
+uses a slot. A `LOAD` of a new library after the table is full fails with
+`dlopen table is full` and leaves the session usable.
+
 ## Persistence and ownership
 
 For an `open("/data/orders", ...)` call:
@@ -279,7 +370,8 @@ For an `open("/data/orders", ...)` call:
 
 Mount the entire root on persistent storage and reuse it after restarts.
 Initialization creates the cluster once; later starts reuse it. Incomplete
-clusters or an incompatible PostgreSQL major version are rejected.
+clusters are rejected, and so is a data directory from another PostgreSQL major
+version (see [below](#upgrading-across-postgresql-major-versions)).
 `fsync`, `synchronous_commit`, and `full_page_writes` are enabled before the
 backend starts. The host filesystem must honor WASI sync operations; a local
 restart test is not a power-loss durability certification.
@@ -310,6 +402,38 @@ its components the matching WASI preopen. Use a stable workload identity on
 redeploy and configure exclusive execution for this database. These
 annotations provide storage; they do not enforce database ownership.
 
+## Upgrading across PostgreSQL major versions
+
+A data directory belongs to one PostgreSQL major version, recorded in
+`<root>/data/PG_VERSION`. Minor releases share the on-disk format: a directory
+written by the 17.5 engine (provider 6.0.15 and earlier) opens in place under
+17.11, and `make smoke` checks this.
+
+The engine opens only major version 17. For any other `PG_VERSION`, `open`
+fails with `open-failed` and a message such as:
+
+```text
+incompatible PostgreSQL data directory: PG_VERSION is 16, but this provider bundles
+PostgreSQL 17.11 and opens only major version 17 data directories; see
+platform/pglite-component/README.md#upgrading-across-postgresql-major-versions
+```
+
+The provider does not convert directories between major versions; it bundles
+neither a second engine nor `pg_upgrade`. To move a database across a major
+version:
+
+1. Stop every writer. Keep the provider version that wrote the directory,
+   pinned by its digest or npm version, and back up the whole root.
+2. With that provider, export the data through the application, for example
+   with a migration step that reads each table through the `database`
+   interface into a portable format.
+3. Deploy the new provider on a new, empty root, and recreate the schema with
+   the application's migrations.
+4. Import the exported data, check it, then retire the old root.
+
+If the root is encrypted with `pglite-encfs`, compose encfs with the same key
+for both the export and the import. PostgreSQL 18 is tracked in #401.
+
 ## Implementation
 
 - `js/adapter.ts`: the `SqlDatabase` adapter published on npm (`bun run build:adapter`).
@@ -318,7 +442,10 @@ annotations provide storage; they do not enforce database ownership.
 - `src/pgwire.rs`: PostgreSQL message encoding and typed rows, over memory.
 - `src/engine.rs`: persistent filesystem setup and exclusive engine access.
 - `engine/bridge.wat`: private canonical ABI bridge to the core engine.
-- `engine/build-pgcrypto.sh`: builds OpenSSL libcrypto and pgcrypto in the engine container and generates pgcrypto's static `dlsym` table; `scripts/patch-engine-source.ts` links both into the engine.
+- `engine/build-pgcrypto.sh`: builds OpenSSL libcrypto and pgcrypto in the engine container and generates pgcrypto's static `dlsym` table; `scripts/patch-engine-source.ts` links both into the engine. The libcrypto build is cached under a key of the OpenSSL source tarball's sha256, the Configure options and `SOURCE_DATE_EPOCH`, so an OpenSSL version bump always rebuilds it.
+- `scripts/patch-engine-source.ts`: also replaces the upstream `dlopen` emulation's unbounded table (`dltab`) with the bounded one described under [Extensions](#extensions), and keeps pgcrypto's hook ahead of it.
+- `engine/patches/postgresql-17.11-wasi.patch`: Electric's 17.5 WASI changes replayed onto upstream `REL_17_11`; see [engine/patches/README.md](engine/patches/README.md).
+- `scripts/build-engine.ts`: builds the engine source tree (pinned tag, checked commit, checked patches) and runs the wasipg container build; `scripts/check-engine-patch.ts` (`make check-engine-patch`) runs the same source steps without the build.
 - `scripts/prepare-engine.ts`: pinned engine preparation and componentization (all build scripts are Bun TypeScript; see `scripts/`).
 - `wit/deps/pglite-engine/engine.wit`: internal interface, composed away at build.
 

package/dist/BUILD-INFO.txt

@@ -1,14 +1,16 @@
 component:       di-framework:pglite@0.2.0
 profile:         release
-built:           2026-10-13T22:17:05Z
+built:           2026-10-16T17:04:13Z
 rustc:           rustc 1.97.1 (8bab26f4f 2026-07-14)
 target:          wasm32-wasip2
 wasm-tools:      wasm-tools 1.258.0 (5c6d31c78 2026-08-24)
 wit-bindgen:     0.61.1
 md5:             0.7.0
-engine:          PostgreSQL 17.5, persistent WASI filesystem
+engine:          PostgreSQL 17.11, persistent WASI filesystem
 extensions:      plpgsql, pgcrypto (OpenSSL 3.5.9 libcrypto)
-engine-source:   https://github.com/moznion/wasipg/tree/fa290be67946c0d3c4540bd1400b11e193d874e1
+engine-source:   https://github.com/postgres/postgres/tree/083ac033419f690758508e08c1736089384bbee8 (REL_17_11)
+engine-patch:    engine/patches/postgresql-17.11-wasi.patch (sha256 6beb64a561caa80e3669733f9e24e344edb0445d2623c17eee79d48ec28fac65)
+engine-recipe:   https://github.com/moznion/wasipg/tree/fa290be67946c0d3c4540bd1400b11e193d874e1
 adapter-sha256:  e51dd61669a20daca34befe7fdadf1ac84e4795a2c84a8400818ee1de5373ccc
-engine-sha256:   e0afe7bc67537c40ae37655df4722987e968784c45a3684ed35df2f19d86bdbf
-size:            20112680 bytes
+engine-sha256:   eb374344cff24c4cedacdad05a636a3b75b5eb1c4e55aa1a3ff9930be2ebc328
+size:            20168533 bytes

package/dist/SHA256SUMS

@@ -1,4 +1,4 @@
-269169e596bc15f4cb5539bc9af85e58f6ac9bb090dd1ba05254878768c6b823  di-framework-pglite.wasm
+a98a0476f61d539c72458be572d5705c8a237a49d51329784b65d564fab1b657  di-framework-pglite.wasm
 6053154ec1bc94de63ce4f4f4cce5922ef57dce794c2dde326f5845b8982d35f  di-framework-pglite.wit
-11f6ed49c8b63158770f1a4dea98780424ed9759ffa80a883f9efa5993bb7d29  BUILD-INFO.txt
-f57bcfb7d092565405081e910da9816b6b6a23d916c28542bf5d469e4bd31ff7  THIRD-PARTY-NOTICES.txt
+f76f82266b1f741e10c5c89e6c30f620571adba6bb228a33324681d2dc1822b3  BUILD-INFO.txt
+443fd294671eb64972556656d3ee871e48448ad1169c012d18aa868568f628c1  THIRD-PARTY-NOTICES.txt

package/dist/THIRD-PARTY-NOTICES.txt

@@ -1,14 +1,22 @@
 di-framework embedded PGlite component
 
-The provider bundles PostgreSQL 17.5 (PGlite WASI), originally maintained by
-ElectricSQL. PostgreSQL's license is reproduced in POSTGRESQL-COPYRIGHT.
-The upstream bindings license and WASI adapter license are reproduced in
-PGLITE-BINDINGS-LICENSE and WASMTIME-LICENSE. The engine statically links
-the pgcrypto extension and OpenSSL libcrypto; their notices are in
-PGCRYPTO-NOTICES and the OpenSSL license (Apache-2.0) in OPENSSL-LICENSE.
+The provider bundles PostgreSQL 17.11 built for WASI. The engine source is
+upstream PostgreSQL REL_17_11 (commit 083ac033419f690758508e08c1736089384bbee8)
+with ElectricSQL's PGlite WASI changes from postgres-pglite branch
+REL_17_5_WASM-pglite (commit 2194acf356e9b7bf7cff29c4ed4bd6b82b93895d) replayed
+onto it; that replay is engine/patches/postgresql-17.11-wasi.patch in the
+di-framework source. PostgreSQL, postgres-pglite and the replay patch are
+distributed under the PostgreSQL License, reproduced in POSTGRESQL-COPYRIGHT.
+The engine is built with the wasipg recipe and its sjlj patches (Apache-2.0;
+notice below). The upstream bindings license and WASI adapter license are
+reproduced in PGLITE-BINDINGS-LICENSE and WASMTIME-LICENSE. The engine
+statically links the pgcrypto extension and OpenSSL libcrypto; their notices
+are in PGCRYPTO-NOTICES and the OpenSSL license (Apache-2.0) in
+OPENSSL-LICENSE.
 
 Sources:
-https://github.com/electric-sql/postgres-pglite
+https://github.com/postgres/postgres/tree/REL_17_11
+https://github.com/electric-sql/postgres-pglite/tree/REL_17_5_WASM-pglite
 https://github.com/electric-sql/pglite-bindings
 https://github.com/moznion/wasipg
 https://github.com/bytecodealliance/wasmtime/tree/v29.0.1
@@ -20,7 +28,18 @@ ABI bridge, uses WASI randomness instead of a /dev/urandom preopen, and keeps
 bootstrap files within the database's persistent filesystem mount. A growable,
 bounded memory buffer replaces socket-file spillover for query replies. Backend
 startup restores application session defaults after bootstrap and enables
-durable writes.
+durable writes. The emulated dlopen keeps loaded libraries in a bounded table
+instead of writing past the end of an unsized array. Two small changes to the
+WASI glue let it compile against 17.11: initdb's frontend SplitGUCList
+declaration is renamed where initdb is compiled into the backend, and the
+frontend allocator stubs gain the overflow-checked pg_malloc_mul and
+pg_realloc_mul. pgcrypto is unmodified: PostgreSQL 17.11 itself refuses
+ciphers OpenSSL cannot run (CVE-2026-14663), which in this build includes
+Blowfish and CAST5.
+
+The wasipg notice below describes wasipg's own release artifacts, which were
+built from REL_17_5_WASM-pglite; this provider uses wasipg's build recipe and
+patches with the 17.11 source tree above.
 
 The engine's core module, support files, adapter, and the provider are
 composed into one deployable artifact. Engine code executes in the Wasm
@@ -83,9 +102,9 @@ wasi-libc from wasi-sdk 33, distributed under
 "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT". The shadow headers
 under build/hotfix/ are derived from wasi-libc headers.
 PostgreSQL Database Management System
-(formerly known as Postgres, then as Postgres95)
+(also known as Postgres, formerly known as Postgres95)
 
-Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group
+Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
 
 Portions Copyright (c) 1994, The Regents of the University of California
 
@@ -107,7 +126,7 @@ ON AN "AS IS" BASIS, AND THE UNIVERSITY OF CALIFORNIA HAS NO OBLIGATIONS TO
 PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
 
 --------------------------------------------------------------------------
-pgcrypto (PostgreSQL 17.5 contrib/pgcrypto)
+pgcrypto (PostgreSQL 17.11 contrib/pgcrypto)
 --------------------------------------------------------------------------
 
 pgcrypto is part of PostgreSQL and is distributed under the PostgreSQL
@@ -118,6 +137,7 @@ distribution.
 px.c, px-hmac.c, px-crypt.c, mbuf.c, openssl.c, pgcrypto.c, pgp*.c and
 their headers:
 
+    Copyright (c) 2000 Marko Kreen
     Copyright (c) 2001 Marko Kreen
     Copyright (c) 2005 Marko Kreen
     All rights reserved.

package/dist/js/adapter.d.ts

@@ -100,7 +100,8 @@ export declare function toWasmPgValue(value: unknown): WasmPgValue;
 /**
  * Formats a `timestamp` variant the way the `wasmcloud:postgres` codec does:
  * `YYYY-MM-DDTHH:MM:SS.mmmZ`. Microseconds are truncated to milliseconds.
- * `infinity`, `-infinity`, and BC dates are returned unchanged.
+ * `infinity` and `-infinity` are returned unchanged. (The provider returns BC dates and other
+ * values it cannot express in RFC 3339 as `text`, so they never reach this function.)
  */
 export declare function pgliteTimestampIso(value: string): string;
 /** Converts a `value` variant into what the `wasmcloud:postgres` codec in `@di-framework/repo` returns. */

package/dist/js/adapter.js

@@ -141,7 +141,8 @@ const RFC3339_UTC = /^(\d{4,}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/;
 /**
  * Formats a `timestamp` variant the way the `wasmcloud:postgres` codec does:
  * `YYYY-MM-DDTHH:MM:SS.mmmZ`. Microseconds are truncated to milliseconds.
- * `infinity`, `-infinity`, and BC dates are returned unchanged.
+ * `infinity` and `-infinity` are returned unchanged. (The provider returns BC dates and other
+ * values it cannot express in RFC 3339 as `text`, so they never reach this function.)
  */
 export function pgliteTimestampIso(value) {
     const match = RFC3339_UTC.exec(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@di-framework/pglite-component",
-  "version": "6.0.14",
+  "version": "6.0.16",
   "type": "module",
   "description": "Embedded PostgreSQL component with persistent WASI storage and no TCP, plus its SqlDatabase adapter for @di-framework/repo.",
   "license": "(MIT OR Apache-2.0)",

package/wit/world.wit

@@ -60,7 +60,12 @@ interface types {
   /// - `json` and `jsonb` -> `json` (JSON text).
   /// - `timestamptz` -> `timestamp`, RFC 3339 in UTC (`2024-01-15T10:30:00Z`,
   ///   fractional seconds kept). `infinity` and `-infinity` are returned as
-  ///   those literals.
+  ///   those literals. This holds after a caller's own `SET TimeZone`: any
+  ///   ISO output is converted back to UTC. A value that cannot be converted
+  ///   (BC dates, years after 9999, or any output after `SET DateStyle` to
+  ///   `SQL`, `Postgres` or `German`) is returned as `text`, as PostgreSQL
+  ///   printed it. `infinity` and `-infinity` stay `timestamp` under every
+  ///   DateStyle. Reopening the connection pins both settings again.
   /// - `timestamp` (no zone) and `date` -> `text` (`2024-01-15 10:30:00`,
   ///   `2024-01-15`).
   /// - `uuid` and `numeric` -> `text`; arrays -> `text` as PostgreSQL array
@@ -109,7 +114,7 @@ interface database {
   /// are supported. Close/drop releases the connection for reuse at that root.
   open: func(path: string, options: option<open-options>) -> result<connection, error>;
 
-  /// The bundled engine version string, `17.5`; does not open a database.
+  /// The bundled engine version string, `17.11`; does not open a database.
   server-version: func() -> result<string, error>;
 
   /// An exclusive handle to the embedded session. Closing or dropping it