@geekmidas/db 9.0.2 → 10.0.0-alpha.0

package/dist/errors-CfFCan-X.mjs

@@ -0,0 +1,69 @@
+//#region src/errors.ts
+/**
+* Database URL errors and redaction — engine-neutral.
+*
+* Nothing here is Postgres-specific: every engine addresses itself as a URL
+* carrying a password, and "must name a host" holds for all of them. The parts
+* that differ — libpq's `options=-c search_path=…`, which no other engine
+* accepts — live under the driver they belong to.
+*
+* Messages state the rule, which is constant; the offending value is a field.
+* An interpolated message cannot be matched on and carries user input into
+* every log line that touches it.
+*/
+/**
+* Replace the password in a connection string with `***`.
+*
+* A connection string is a secret, and the places it is most likely to be
+* written down — a log line, an error, a crash report shipped to a third party
+* — are the places nobody is reading carefully. This exists so that redacting
+* is the easy thing to do at each of them.
+*
+* Safe on input that is not a URL: it returns a constant rather than throwing,
+* because this runs on paths that must not fail. Anything unparseable is
+* treated as potentially secret and withheld entirely rather than echoed.
+*/
+function redactDatabaseUrl(url) {
+	try {
+		const parsed = new URL(url);
+		if (!parsed.password) return url;
+		parsed.password = "***";
+		return parsed.toString();
+	} catch {
+		return "<unparseable url>";
+	}
+}
+/**
+* Base for an address that cannot become a connection string.
+*
+* Deliberately carries no URL field: these are thrown while *composing* one, so
+* there is no URL yet — only the parts, which include the password.
+*/
+var DatabaseAddressError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = new.target.name;
+	}
+};
+/** An address with no host to connect to. */
+var MissingDatabaseHost = class extends DatabaseAddressError {
+	constructor() {
+		super("A database address must name a host");
+	}
+};
+/**
+* An address with no database name.
+*
+* Postgres silently falls back to the connecting role's name, so the app
+* connects successfully to the wrong database and fails later with confusing
+* "relation does not exist" errors. Rejecting it here is much cheaper.
+*/
+var MissingDatabaseName = class extends DatabaseAddressError {
+	constructor() {
+		super("A database address must name a database");
+	}
+};
+
+//#endregion
+export { DatabaseAddressError, MissingDatabaseHost, MissingDatabaseName, redactDatabaseUrl };
+//# sourceMappingURL=errors-CfFCan-X.mjs.map

package/dist/errors-CfFCan-X.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-CfFCan-X.mjs","names":["url: string","message: string"],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Database URL errors and redaction — engine-neutral.\n *\n * Nothing here is Postgres-specific: every engine addresses itself as a URL\n * carrying a password, and \"must name a host\" holds for all of them. The parts\n * that differ — libpq's `options=-c search_path=…`, which no other engine\n * accepts — live under the driver they belong to.\n *\n * Messages state the rule, which is constant; the offending value is a field.\n * An interpolated message cannot be matched on and carries user input into\n * every log line that touches it.\n */\n\n/**\n * Replace the password in a connection string with `***`.\n *\n * A connection string is a secret, and the places it is most likely to be\n * written down — a log line, an error, a crash report shipped to a third party\n * — are the places nobody is reading carefully. This exists so that redacting\n * is the easy thing to do at each of them.\n *\n * Safe on input that is not a URL: it returns a constant rather than throwing,\n * because this runs on paths that must not fail. Anything unparseable is\n * treated as potentially secret and withheld entirely rather than echoed.\n */\nexport function redactDatabaseUrl(url: string): string {\n\ttry {\n\t\tconst parsed = new URL(url);\n\t\tif (!parsed.password) return url;\n\t\tparsed.password = '***';\n\t\treturn parsed.toString();\n\t} catch {\n\t\treturn '<unparseable url>';\n\t}\n}\n\n/**\n * Base for an address that cannot become a connection string.\n *\n * Deliberately carries no URL field: these are thrown while *composing* one, so\n * there is no URL yet — only the parts, which include the password.\n */\nexport abstract class DatabaseAddressError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = new.target.name;\n\t}\n}\n\n/** An address with no host to connect to. */\nexport class MissingDatabaseHost extends DatabaseAddressError {\n\tconstructor() {\n\t\tsuper('A database address must name a host');\n\t}\n}\n\n/**\n * An address with no database name.\n *\n * Postgres silently falls back to the connecting role's name, so the app\n * connects successfully to the wrong database and fails later with confusing\n * \"relation does not exist\" errors. Rejecting it here is much cheaper.\n */\nexport class MissingDatabaseName extends DatabaseAddressError {\n\tconstructor() {\n\t\tsuper('A database address must name a database');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,kBAAkBA,KAAqB;AACtD,KAAI;EACH,MAAM,SAAS,IAAI,IAAI;AACvB,OAAK,OAAO,SAAU,QAAO;AAC7B,SAAO,WAAW;AAClB,SAAO,OAAO,UAAU;CACxB,QAAO;AACP,SAAO;CACP;AACD;;;;;;;AAQD,IAAsB,uBAAtB,cAAmD,MAAM;CACxD,YAAYC,SAAiB;AAC5B,QAAM,QAAQ;AACd,OAAK,OAAO,IAAI,OAAO;CACvB;AACD;;AAGD,IAAa,sBAAb,cAAyC,qBAAqB;CAC7D,cAAc;AACb,QAAM,sCAAsC;CAC5C;AACD;;;;;;;;AASD,IAAa,sBAAb,cAAyC,qBAAqB;CAC7D,cAAc;AACb,QAAM,0CAA0C;CAChD;AACD"}

package/dist/errors-Cs5jlAv-.cjs

@@ -0,0 +1,93 @@
+
+//#region src/errors.ts
+/**
+* Database URL errors and redaction — engine-neutral.
+*
+* Nothing here is Postgres-specific: every engine addresses itself as a URL
+* carrying a password, and "must name a host" holds for all of them. The parts
+* that differ — libpq's `options=-c search_path=…`, which no other engine
+* accepts — live under the driver they belong to.
+*
+* Messages state the rule, which is constant; the offending value is a field.
+* An interpolated message cannot be matched on and carries user input into
+* every log line that touches it.
+*/
+/**
+* Replace the password in a connection string with `***`.
+*
+* A connection string is a secret, and the places it is most likely to be
+* written down — a log line, an error, a crash report shipped to a third party
+* — are the places nobody is reading carefully. This exists so that redacting
+* is the easy thing to do at each of them.
+*
+* Safe on input that is not a URL: it returns a constant rather than throwing,
+* because this runs on paths that must not fail. Anything unparseable is
+* treated as potentially secret and withheld entirely rather than echoed.
+*/
+function redactDatabaseUrl(url) {
+	try {
+		const parsed = new URL(url);
+		if (!parsed.password) return url;
+		parsed.password = "***";
+		return parsed.toString();
+	} catch {
+		return "<unparseable url>";
+	}
+}
+/**
+* Base for an address that cannot become a connection string.
+*
+* Deliberately carries no URL field: these are thrown while *composing* one, so
+* there is no URL yet — only the parts, which include the password.
+*/
+var DatabaseAddressError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = new.target.name;
+	}
+};
+/** An address with no host to connect to. */
+var MissingDatabaseHost = class extends DatabaseAddressError {
+	constructor() {
+		super("A database address must name a host");
+	}
+};
+/**
+* An address with no database name.
+*
+* Postgres silently falls back to the connecting role's name, so the app
+* connects successfully to the wrong database and fails later with confusing
+* "relation does not exist" errors. Rejecting it here is much cheaper.
+*/
+var MissingDatabaseName = class extends DatabaseAddressError {
+	constructor() {
+		super("A database address must name a database");
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'DatabaseAddressError', {
+  enumerable: true,
+  get: function () {
+    return DatabaseAddressError;
+  }
+});
+Object.defineProperty(exports, 'MissingDatabaseHost', {
+  enumerable: true,
+  get: function () {
+    return MissingDatabaseHost;
+  }
+});
+Object.defineProperty(exports, 'MissingDatabaseName', {
+  enumerable: true,
+  get: function () {
+    return MissingDatabaseName;
+  }
+});
+Object.defineProperty(exports, 'redactDatabaseUrl', {
+  enumerable: true,
+  get: function () {
+    return redactDatabaseUrl;
+  }
+});
+//# sourceMappingURL=errors-Cs5jlAv-.cjs.map

package/dist/errors-Cs5jlAv-.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-Cs5jlAv-.cjs","names":["url: string","message: string"],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Database URL errors and redaction — engine-neutral.\n *\n * Nothing here is Postgres-specific: every engine addresses itself as a URL\n * carrying a password, and \"must name a host\" holds for all of them. The parts\n * that differ — libpq's `options=-c search_path=…`, which no other engine\n * accepts — live under the driver they belong to.\n *\n * Messages state the rule, which is constant; the offending value is a field.\n * An interpolated message cannot be matched on and carries user input into\n * every log line that touches it.\n */\n\n/**\n * Replace the password in a connection string with `***`.\n *\n * A connection string is a secret, and the places it is most likely to be\n * written down — a log line, an error, a crash report shipped to a third party\n * — are the places nobody is reading carefully. This exists so that redacting\n * is the easy thing to do at each of them.\n *\n * Safe on input that is not a URL: it returns a constant rather than throwing,\n * because this runs on paths that must not fail. Anything unparseable is\n * treated as potentially secret and withheld entirely rather than echoed.\n */\nexport function redactDatabaseUrl(url: string): string {\n\ttry {\n\t\tconst parsed = new URL(url);\n\t\tif (!parsed.password) return url;\n\t\tparsed.password = '***';\n\t\treturn parsed.toString();\n\t} catch {\n\t\treturn '<unparseable url>';\n\t}\n}\n\n/**\n * Base for an address that cannot become a connection string.\n *\n * Deliberately carries no URL field: these are thrown while *composing* one, so\n * there is no URL yet — only the parts, which include the password.\n */\nexport abstract class DatabaseAddressError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = new.target.name;\n\t}\n}\n\n/** An address with no host to connect to. */\nexport class MissingDatabaseHost extends DatabaseAddressError {\n\tconstructor() {\n\t\tsuper('A database address must name a host');\n\t}\n}\n\n/**\n * An address with no database name.\n *\n * Postgres silently falls back to the connecting role's name, so the app\n * connects successfully to the wrong database and fails later with confusing\n * \"relation does not exist\" errors. Rejecting it here is much cheaper.\n */\nexport class MissingDatabaseName extends DatabaseAddressError {\n\tconstructor() {\n\t\tsuper('A database address must name a database');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,kBAAkBA,KAAqB;AACtD,KAAI;EACH,MAAM,SAAS,IAAI,IAAI;AACvB,OAAK,OAAO,SAAU,QAAO;AAC7B,SAAO,WAAW;AAClB,SAAO,OAAO,UAAU;CACxB,QAAO;AACP,SAAO;CACP;AACD;;;;;;;AAQD,IAAsB,uBAAtB,cAAmD,MAAM;CACxD,YAAYC,SAAiB;AAC5B,QAAM,QAAQ;AACd,OAAK,OAAO,IAAI,OAAO;CACvB;AACD;;AAGD,IAAa,sBAAb,cAAyC,qBAAqB;CAC7D,cAAc;AACb,QAAM,sCAAsC;CAC5C;AACD;;;;;;;;AASD,IAAa,sBAAb,cAAyC,qBAAqB;CAC7D,cAAc;AACb,QAAM,0CAA0C;CAChD;AACD"}

package/dist/errors.cjs

@@ -0,0 +1,6 @@
+const require_errors = require('./errors-Cs5jlAv-.cjs');
+
+exports.DatabaseAddressError = require_errors.DatabaseAddressError;
+exports.MissingDatabaseHost = require_errors.MissingDatabaseHost;
+exports.MissingDatabaseName = require_errors.MissingDatabaseName;
+exports.redactDatabaseUrl = require_errors.redactDatabaseUrl;

package/dist/errors.d.cts

@@ -0,0 +1,53 @@
+//#region src/errors.d.ts
+/**
+ * Database URL errors and redaction — engine-neutral.
+ *
+ * Nothing here is Postgres-specific: every engine addresses itself as a URL
+ * carrying a password, and "must name a host" holds for all of them. The parts
+ * that differ — libpq's `options=-c search_path=…`, which no other engine
+ * accepts — live under the driver they belong to.
+ *
+ * Messages state the rule, which is constant; the offending value is a field.
+ * An interpolated message cannot be matched on and carries user input into
+ * every log line that touches it.
+ */
+/**
+ * Replace the password in a connection string with `***`.
+ *
+ * A connection string is a secret, and the places it is most likely to be
+ * written down — a log line, an error, a crash report shipped to a third party
+ * — are the places nobody is reading carefully. This exists so that redacting
+ * is the easy thing to do at each of them.
+ *
+ * Safe on input that is not a URL: it returns a constant rather than throwing,
+ * because this runs on paths that must not fail. Anything unparseable is
+ * treated as potentially secret and withheld entirely rather than echoed.
+ */
+declare function redactDatabaseUrl(url: string): string;
+/**
+ * Base for an address that cannot become a connection string.
+ *
+ * Deliberately carries no URL field: these are thrown while *composing* one, so
+ * there is no URL yet — only the parts, which include the password.
+ */
+declare abstract class DatabaseAddressError extends Error {
+  constructor(message: string);
+}
+/** An address with no host to connect to. */
+declare class MissingDatabaseHost extends DatabaseAddressError {
+  constructor();
+}
+/**
+ * An address with no database name.
+ *
+ * Postgres silently falls back to the connecting role's name, so the app
+ * connects successfully to the wrong database and fails later with confusing
+ * "relation does not exist" errors. Rejecting it here is much cheaper.
+ */
+declare class MissingDatabaseName extends DatabaseAddressError {
+  constructor();
+}
+//# sourceMappingURL=errors.d.ts.map
+//#endregion
+export { DatabaseAddressError, MissingDatabaseHost, MissingDatabaseName, redactDatabaseUrl };
+//# sourceMappingURL=errors.d.cts.map

package/dist/errors.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.cts","names":[],"sources":["../src/errors.ts"],"sourcesContent":[],"mappings":";;AAyBA;AAiBA;AAQA;AAaA;;;;;;;;;;;;;;;;;;;;iBAtCgB,iBAAA;;;;;;;uBAiBM,oBAAA,SAA6B,KAAK;;;;cAQ3C,mBAAA,SAA4B,oBAAoB;;;;;;;;;;cAahD,mBAAA,SAA4B,oBAAoB"}

package/dist/errors.d.mts

@@ -0,0 +1,53 @@
+//#region src/errors.d.ts
+/**
+ * Database URL errors and redaction — engine-neutral.
+ *
+ * Nothing here is Postgres-specific: every engine addresses itself as a URL
+ * carrying a password, and "must name a host" holds for all of them. The parts
+ * that differ — libpq's `options=-c search_path=…`, which no other engine
+ * accepts — live under the driver they belong to.
+ *
+ * Messages state the rule, which is constant; the offending value is a field.
+ * An interpolated message cannot be matched on and carries user input into
+ * every log line that touches it.
+ */
+/**
+ * Replace the password in a connection string with `***`.
+ *
+ * A connection string is a secret, and the places it is most likely to be
+ * written down — a log line, an error, a crash report shipped to a third party
+ * — are the places nobody is reading carefully. This exists so that redacting
+ * is the easy thing to do at each of them.
+ *
+ * Safe on input that is not a URL: it returns a constant rather than throwing,
+ * because this runs on paths that must not fail. Anything unparseable is
+ * treated as potentially secret and withheld entirely rather than echoed.
+ */
+declare function redactDatabaseUrl(url: string): string;
+/**
+ * Base for an address that cannot become a connection string.
+ *
+ * Deliberately carries no URL field: these are thrown while *composing* one, so
+ * there is no URL yet — only the parts, which include the password.
+ */
+declare abstract class DatabaseAddressError extends Error {
+  constructor(message: string);
+}
+/** An address with no host to connect to. */
+declare class MissingDatabaseHost extends DatabaseAddressError {
+  constructor();
+}
+/**
+ * An address with no database name.
+ *
+ * Postgres silently falls back to the connecting role's name, so the app
+ * connects successfully to the wrong database and fails later with confusing
+ * "relation does not exist" errors. Rejecting it here is much cheaper.
+ */
+declare class MissingDatabaseName extends DatabaseAddressError {
+  constructor();
+}
+//# sourceMappingURL=errors.d.ts.map
+//#endregion
+export { DatabaseAddressError, MissingDatabaseHost, MissingDatabaseName, redactDatabaseUrl };
+//# sourceMappingURL=errors.d.mts.map

package/dist/errors.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.mts","names":[],"sources":["../src/errors.ts"],"sourcesContent":[],"mappings":";;AAyBA;AAiBA;AAQA;AAaA;;;;;;;;;;;;;;;;;;;;iBAtCgB,iBAAA;;;;;;;uBAiBM,oBAAA,SAA6B,KAAK;;;;cAQ3C,mBAAA,SAA4B,oBAAoB;;;;;;;;;;cAahD,mBAAA,SAA4B,oBAAoB"}

package/dist/errors.mjs

@@ -0,0 +1,3 @@
+import { DatabaseAddressError, MissingDatabaseHost, MissingDatabaseName, redactDatabaseUrl } from "./errors-CfFCan-X.mjs";
+
+export { DatabaseAddressError, MissingDatabaseHost, MissingDatabaseName, redactDatabaseUrl };

package/dist/kysely/pagination.cjs

@@ -1,4 +1,4 @@
-const require_pagination = require('../pagination-Bdoa4PVj.cjs');
+const require_pagination = require('../pagination-Bu1dqOy0.cjs');
 
 //#region src/kysely/pagination.ts
 /**

package/dist/kysely/pagination.d.mts

@@ -1,4 +1,4 @@
-import { Direction, PaginationResult, decodeCursor, encodeCursor } from "../pagination-BziGl-B8.mjs";
+import { Direction, PaginationResult, decodeCursor, encodeCursor } from "../pagination-kv-KWS-7.mjs";
 import { SelectQueryBuilder } from "kysely";
 
 //#region src/kysely/pagination.d.ts

package/dist/kysely/pagination.mjs

@@ -1,4 +1,4 @@
-import { Direction, decodeCursor, encodeCursor } from "../pagination-BDLa7Yb_.mjs";
+import { Direction, decodeCursor, encodeCursor } from "../pagination-CQ8QHXaL.mjs";
 
 //#region src/kysely/pagination.ts
 /**

package/dist/{kysely-Dm1w5gAY.d.mts → kysely-BAedYsvn.d.mts}

@@ -10,4 +10,4 @@ type DatabaseConnection<T> = ControlledTransaction<T> | Kysely<T> | Transaction<
 
 //#endregion
 export { DatabaseConnection, TransactionSettings, withTransaction };
-//# sourceMappingURL=kysely-Dm1w5gAY.d.mts.map
+//# sourceMappingURL=kysely-BAedYsvn.d.mts.map

package/dist/{kysely-Dm1w5gAY.d.mts.map → kysely-BAedYsvn.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"kysely-Dm1w5gAY.d.mts","names":[],"sources":["../src/kysely.ts"],"sourcesContent":[],"mappings":";;;UAOiB,mBAAA;mBACC;AADlB;AAIgB,iBAAA,eAAe,CAAA,EAAA,EAAA,CAAA,CAAA,CAAA,EAAA,EAC1B,kBAD0B,CACP,EADO,CAAA,EAAA,EAAA,EAAA,CAAA,GAAA,EAEpB,WAFoB,CAER,EAFQ,CAAA,EAAA,GAEA,OAFA,CAEQ,CAFR,CAAA,EAAA,QAAA,CAAA,EAGnB,mBAHmB,CAAA,EAI5B,OAJ4B,CAIpB,CAJoB,CAAA;AAAA,KAkBnB,kBAlBmB,CAAA,CAAA,CAAA,GAmB5B,qBAnB4B,CAmBN,CAnBM,CAAA,GAoB5B,MApB4B,CAoBrB,CApBqB,CAAA,GAqB5B,WArB4B,CAqBhB,CArBgB,CAAA"}
+{"version":3,"file":"kysely-BAedYsvn.d.mts","names":[],"sources":["../src/kysely.ts"],"sourcesContent":[],"mappings":";;;UAOiB,mBAAA;mBACC;AADlB;AAIgB,iBAAA,eAAe,CAAA,EAAA,EAAA,CAAA,CAAA,CAAA,EAAA,EAC1B,kBAD0B,CACP,EADO,CAAA,EAAA,EAAA,EAAA,CAAA,GAAA,EAEpB,WAFoB,CAER,EAFQ,CAAA,EAAA,GAEA,OAFA,CAEQ,CAFR,CAAA,EAAA,QAAA,CAAA,EAGnB,mBAHmB,CAAA,EAI5B,OAJ4B,CAIpB,CAJoB,CAAA;AAAA,KAkBnB,kBAlBmB,CAAA,CAAA,CAAA,GAmB5B,qBAnB4B,CAmBN,CAnBM,CAAA,GAoB5B,MApB4B,CAoBrB,CApBqB,CAAA,GAqB5B,WArB4B,CAqBhB,CArBgB,CAAA"}

package/dist/{kysely-DmfA94RY.mjs → kysely-Bo_Zg-D3.mjs}

@@ -8,4 +8,4 @@ function withTransaction(db, cb, settings) {
 
 //#endregion
 export { withTransaction };
-//# sourceMappingURL=kysely-DmfA94RY.mjs.map
+//# sourceMappingURL=kysely-Bo_Zg-D3.mjs.map

package/dist/{kysely-DmfA94RY.mjs.map → kysely-Bo_Zg-D3.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"kysely-DmfA94RY.mjs","names":["db: DatabaseConnection<DB>","cb: (trx: Transaction<DB>) => Promise<T>","settings?: TransactionSettings"],"sources":["../src/kysely.ts"],"sourcesContent":["import type {\n\tControlledTransaction,\n\tIsolationLevel,\n\tKysely,\n\tTransaction,\n} from 'kysely';\n\nexport interface TransactionSettings {\n\tisolationLevel?: IsolationLevel;\n}\n\nexport function withTransaction<DB, T>(\n\tdb: DatabaseConnection<DB>,\n\tcb: (trx: Transaction<DB>) => Promise<T>,\n\tsettings?: TransactionSettings,\n): Promise<T> {\n\tif (db.isTransaction) {\n\t\treturn cb(db as Transaction<DB>);\n\t}\n\n\tconst builder = db.transaction();\n\n\tif (settings?.isolationLevel) {\n\t\treturn builder.setIsolationLevel(settings.isolationLevel).execute(cb);\n\t}\n\n\treturn builder.execute(cb);\n}\n\nexport type DatabaseConnection<T> =\n\t| ControlledTransaction<T>\n\t| Kysely<T>\n\t| Transaction<T>;\n"],"mappings":";AAWA,SAAgB,gBACfA,IACAC,IACAC,UACa;AACb,KAAI,GAAG,cACN,QAAO,GAAG,GAAsB;CAGjC,MAAM,UAAU,GAAG,aAAa;AAEhC,KAAI,UAAU,eACb,QAAO,QAAQ,kBAAkB,SAAS,eAAe,CAAC,QAAQ,GAAG;AAGtE,QAAO,QAAQ,QAAQ,GAAG;AAC1B"}
+{"version":3,"file":"kysely-Bo_Zg-D3.mjs","names":["db: DatabaseConnection<DB>","cb: (trx: Transaction<DB>) => Promise<T>","settings?: TransactionSettings"],"sources":["../src/kysely.ts"],"sourcesContent":["import type {\n\tControlledTransaction,\n\tIsolationLevel,\n\tKysely,\n\tTransaction,\n} from 'kysely';\n\nexport interface TransactionSettings {\n\tisolationLevel?: IsolationLevel;\n}\n\nexport function withTransaction<DB, T>(\n\tdb: DatabaseConnection<DB>,\n\tcb: (trx: Transaction<DB>) => Promise<T>,\n\tsettings?: TransactionSettings,\n): Promise<T> {\n\tif (db.isTransaction) {\n\t\treturn cb(db as Transaction<DB>);\n\t}\n\n\tconst builder = db.transaction();\n\n\tif (settings?.isolationLevel) {\n\t\treturn builder.setIsolationLevel(settings.isolationLevel).execute(cb);\n\t}\n\n\treturn builder.execute(cb);\n}\n\nexport type DatabaseConnection<T> =\n\t| ControlledTransaction<T>\n\t| Kysely<T>\n\t| Transaction<T>;\n"],"mappings":";AAWA,SAAgB,gBACfA,IACAC,IACAC,UACa;AACb,KAAI,GAAG,cACN,QAAO,GAAG,GAAsB;CAGjC,MAAM,UAAU,GAAG,aAAa;AAEhC,KAAI,UAAU,eACb,QAAO,QAAQ,kBAAkB,SAAS,eAAe,CAAC,QAAQ,GAAG;AAGtE,QAAO,QAAQ,QAAQ,GAAG;AAC1B"}

package/dist/{kysely-8WPSKCZG.cjs → kysely-LWvS2ekY.cjs}

@@ -14,4 +14,4 @@ Object.defineProperty(exports, 'withTransaction', {
     return withTransaction;
   }
 });
-//# sourceMappingURL=kysely-8WPSKCZG.cjs.map
+//# sourceMappingURL=kysely-LWvS2ekY.cjs.map

package/dist/{kysely-8WPSKCZG.cjs.map → kysely-LWvS2ekY.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"kysely-8WPSKCZG.cjs","names":["db: DatabaseConnection<DB>","cb: (trx: Transaction<DB>) => Promise<T>","settings?: TransactionSettings"],"sources":["../src/kysely.ts"],"sourcesContent":["import type {\n\tControlledTransaction,\n\tIsolationLevel,\n\tKysely,\n\tTransaction,\n} from 'kysely';\n\nexport interface TransactionSettings {\n\tisolationLevel?: IsolationLevel;\n}\n\nexport function withTransaction<DB, T>(\n\tdb: DatabaseConnection<DB>,\n\tcb: (trx: Transaction<DB>) => Promise<T>,\n\tsettings?: TransactionSettings,\n): Promise<T> {\n\tif (db.isTransaction) {\n\t\treturn cb(db as Transaction<DB>);\n\t}\n\n\tconst builder = db.transaction();\n\n\tif (settings?.isolationLevel) {\n\t\treturn builder.setIsolationLevel(settings.isolationLevel).execute(cb);\n\t}\n\n\treturn builder.execute(cb);\n}\n\nexport type DatabaseConnection<T> =\n\t| ControlledTransaction<T>\n\t| Kysely<T>\n\t| Transaction<T>;\n"],"mappings":";;AAWA,SAAgB,gBACfA,IACAC,IACAC,UACa;AACb,KAAI,GAAG,cACN,QAAO,GAAG,GAAsB;CAGjC,MAAM,UAAU,GAAG,aAAa;AAEhC,KAAI,UAAU,eACb,QAAO,QAAQ,kBAAkB,SAAS,eAAe,CAAC,QAAQ,GAAG;AAGtE,QAAO,QAAQ,QAAQ,GAAG;AAC1B"}
+{"version":3,"file":"kysely-LWvS2ekY.cjs","names":["db: DatabaseConnection<DB>","cb: (trx: Transaction<DB>) => Promise<T>","settings?: TransactionSettings"],"sources":["../src/kysely.ts"],"sourcesContent":["import type {\n\tControlledTransaction,\n\tIsolationLevel,\n\tKysely,\n\tTransaction,\n} from 'kysely';\n\nexport interface TransactionSettings {\n\tisolationLevel?: IsolationLevel;\n}\n\nexport function withTransaction<DB, T>(\n\tdb: DatabaseConnection<DB>,\n\tcb: (trx: Transaction<DB>) => Promise<T>,\n\tsettings?: TransactionSettings,\n): Promise<T> {\n\tif (db.isTransaction) {\n\t\treturn cb(db as Transaction<DB>);\n\t}\n\n\tconst builder = db.transaction();\n\n\tif (settings?.isolationLevel) {\n\t\treturn builder.setIsolationLevel(settings.isolationLevel).execute(cb);\n\t}\n\n\treturn builder.execute(cb);\n}\n\nexport type DatabaseConnection<T> =\n\t| ControlledTransaction<T>\n\t| Kysely<T>\n\t| Transaction<T>;\n"],"mappings":";;AAWA,SAAgB,gBACfA,IACAC,IACAC,UACa;AACb,KAAI,GAAG,cACN,QAAO,GAAG,GAAsB;CAGjC,MAAM,UAAU,GAAG,aAAa;AAEhC,KAAI,UAAU,eACb,QAAO,QAAQ,kBAAkB,SAAS,eAAe,CAAC,QAAQ,GAAG;AAGtE,QAAO,QAAQ,QAAQ,GAAG;AAC1B"}

package/dist/kysely.cjs

@@ -1,3 +1,3 @@
-const require_kysely = require('./kysely-8WPSKCZG.cjs');
+const require_kysely = require('./kysely-LWvS2ekY.cjs');
 
 exports.withTransaction = require_kysely.withTransaction;

package/dist/kysely.d.mts

@@ -1,2 +1,2 @@
-import { DatabaseConnection, TransactionSettings, withTransaction } from "./kysely-Dm1w5gAY.mjs";
+import { DatabaseConnection, TransactionSettings, withTransaction } from "./kysely-BAedYsvn.mjs";
 export { DatabaseConnection, TransactionSettings, withTransaction };

package/dist/kysely.mjs

@@ -1,3 +1,3 @@
-import { withTransaction } from "./kysely-DmfA94RY.mjs";
+import { withTransaction } from "./kysely-Bo_Zg-D3.mjs";
 
 export { withTransaction };

package/dist/objection/pagination.cjs

@@ -1,4 +1,4 @@
-const require_pagination = require('../pagination-Bdoa4PVj.cjs');
+const require_pagination = require('../pagination-Bu1dqOy0.cjs');
 
 //#region src/objection/pagination.ts
 /**

package/dist/objection/pagination.d.mts

@@ -1,4 +1,4 @@
-import { Direction, PaginationResult, decodeCursor, encodeCursor } from "../pagination-BziGl-B8.mjs";
+import { Direction, PaginationResult, decodeCursor, encodeCursor } from "../pagination-kv-KWS-7.mjs";
 import { Model, QueryBuilder } from "objection";
 
 //#region src/objection/pagination.d.ts

package/dist/objection/pagination.mjs

@@ -1,4 +1,4 @@
-import { Direction, decodeCursor, encodeCursor } from "../pagination-BDLa7Yb_.mjs";
+import { Direction, decodeCursor, encodeCursor } from "../pagination-CQ8QHXaL.mjs";
 
 //#region src/objection/pagination.ts
 /**

package/dist/{pagination-Bdoa4PVj.cjs → pagination-Bu1dqOy0.cjs}

@@ -52,4 +52,4 @@ Object.defineProperty(exports, 'encodeCursor', {
     return encodeCursor;
   }
 });
-//# sourceMappingURL=pagination-Bdoa4PVj.cjs.map
+//# sourceMappingURL=pagination-Bu1dqOy0.cjs.map

package/dist/{pagination-Bdoa4PVj.cjs.map → pagination-Bu1dqOy0.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"pagination-Bdoa4PVj.cjs","names":["value: unknown","cursor: string"],"sources":["../src/pagination.ts"],"sourcesContent":["/**\n * Sort direction for cursor-based pagination.\n */\nexport enum Direction {\n\tAsc = 'asc',\n\tDesc = 'desc',\n}\n\n/**\n * Result of a paginated query.\n */\nexport interface PaginationResult<TItem> {\n\titems: TItem[];\n\tpagination: {\n\t\ttotal: number;\n\t\thasMore: boolean;\n\t\tcursor?: string;\n\t};\n}\n\n/**\n * Encode a cursor value for safe URL transmission.\n * Supports various types: string, number, Date, etc.\n */\nexport function encodeCursor(value: unknown): string {\n\tconst payload = {\n\t\tv: value instanceof Date ? value.toISOString() : value,\n\t\tt: value instanceof Date ? 'date' : typeof value,\n\t};\n\treturn Buffer.from(JSON.stringify(payload)).toString('base64url');\n}\n\n/**\n * Decode a cursor string back to its original value.\n */\nexport function decodeCursor(cursor: string): unknown {\n\ttry {\n\t\tconst json = Buffer.from(cursor, 'base64url').toString('utf-8');\n\t\tconst payload = JSON.parse(json);\n\n\t\tif (payload.t === 'date') {\n\t\t\treturn new Date(payload.v);\n\t\t}\n\n\t\treturn payload.v;\n\t} catch {\n\t\tthrow new Error('Invalid cursor format');\n\t}\n}\n"],"mappings":";;;;;AAGA,IAAY,kDAAL;AACN;AACA;;AACA;;;;;AAkBD,SAAgB,aAAaA,OAAwB;CACpD,MAAM,UAAU;EACf,GAAG,iBAAiB,OAAO,MAAM,aAAa,GAAG;EACjD,GAAG,iBAAiB,OAAO,gBAAgB;CAC3C;AACD,QAAO,OAAO,KAAK,KAAK,UAAU,QAAQ,CAAC,CAAC,SAAS,YAAY;AACjE;;;;AAKD,SAAgB,aAAaC,QAAyB;AACrD,KAAI;EACH,MAAM,OAAO,OAAO,KAAK,QAAQ,YAAY,CAAC,SAAS,QAAQ;EAC/D,MAAM,UAAU,KAAK,MAAM,KAAK;AAEhC,MAAI,QAAQ,MAAM,OACjB,QAAO,IAAI,KAAK,QAAQ;AAGzB,SAAO,QAAQ;CACf,QAAO;AACP,QAAM,IAAI,MAAM;CAChB;AACD"}
+{"version":3,"file":"pagination-Bu1dqOy0.cjs","names":["value: unknown","cursor: string"],"sources":["../src/pagination.ts"],"sourcesContent":["/**\n * Sort direction for cursor-based pagination.\n */\nexport enum Direction {\n\tAsc = 'asc',\n\tDesc = 'desc',\n}\n\n/**\n * Result of a paginated query.\n */\nexport interface PaginationResult<TItem> {\n\titems: TItem[];\n\tpagination: {\n\t\ttotal: number;\n\t\thasMore: boolean;\n\t\tcursor?: string;\n\t};\n}\n\n/**\n * Encode a cursor value for safe URL transmission.\n * Supports various types: string, number, Date, etc.\n */\nexport function encodeCursor(value: unknown): string {\n\tconst payload = {\n\t\tv: value instanceof Date ? value.toISOString() : value,\n\t\tt: value instanceof Date ? 'date' : typeof value,\n\t};\n\treturn Buffer.from(JSON.stringify(payload)).toString('base64url');\n}\n\n/**\n * Decode a cursor string back to its original value.\n */\nexport function decodeCursor(cursor: string): unknown {\n\ttry {\n\t\tconst json = Buffer.from(cursor, 'base64url').toString('utf-8');\n\t\tconst payload = JSON.parse(json);\n\n\t\tif (payload.t === 'date') {\n\t\t\treturn new Date(payload.v);\n\t\t}\n\n\t\treturn payload.v;\n\t} catch {\n\t\tthrow new Error('Invalid cursor format');\n\t}\n}\n"],"mappings":";;;;;AAGA,IAAY,kDAAL;AACN;AACA;;AACA;;;;;AAkBD,SAAgB,aAAaA,OAAwB;CACpD,MAAM,UAAU;EACf,GAAG,iBAAiB,OAAO,MAAM,aAAa,GAAG;EACjD,GAAG,iBAAiB,OAAO,gBAAgB;CAC3C;AACD,QAAO,OAAO,KAAK,KAAK,UAAU,QAAQ,CAAC,CAAC,SAAS,YAAY;AACjE;;;;AAKD,SAAgB,aAAaC,QAAyB;AACrD,KAAI;EACH,MAAM,OAAO,OAAO,KAAK,QAAQ,YAAY,CAAC,SAAS,QAAQ;EAC/D,MAAM,UAAU,KAAK,MAAM,KAAK;AAEhC,MAAI,QAAQ,MAAM,OACjB,QAAO,IAAI,KAAK,QAAQ;AAGzB,SAAO,QAAQ;CACf,QAAO;AACP,QAAM,IAAI,MAAM;CAChB;AACD"}

package/dist/{pagination-BDLa7Yb_.mjs → pagination-CQ8QHXaL.mjs}

@@ -34,4 +34,4 @@ function decodeCursor(cursor) {
 
 //#endregion
 export { Direction, decodeCursor, encodeCursor };
-//# sourceMappingURL=pagination-BDLa7Yb_.mjs.map
+//# sourceMappingURL=pagination-CQ8QHXaL.mjs.map

package/dist/{pagination-BDLa7Yb_.mjs.map → pagination-CQ8QHXaL.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"pagination-BDLa7Yb_.mjs","names":["value: unknown","cursor: string"],"sources":["../src/pagination.ts"],"sourcesContent":["/**\n * Sort direction for cursor-based pagination.\n */\nexport enum Direction {\n\tAsc = 'asc',\n\tDesc = 'desc',\n}\n\n/**\n * Result of a paginated query.\n */\nexport interface PaginationResult<TItem> {\n\titems: TItem[];\n\tpagination: {\n\t\ttotal: number;\n\t\thasMore: boolean;\n\t\tcursor?: string;\n\t};\n}\n\n/**\n * Encode a cursor value for safe URL transmission.\n * Supports various types: string, number, Date, etc.\n */\nexport function encodeCursor(value: unknown): string {\n\tconst payload = {\n\t\tv: value instanceof Date ? value.toISOString() : value,\n\t\tt: value instanceof Date ? 'date' : typeof value,\n\t};\n\treturn Buffer.from(JSON.stringify(payload)).toString('base64url');\n}\n\n/**\n * Decode a cursor string back to its original value.\n */\nexport function decodeCursor(cursor: string): unknown {\n\ttry {\n\t\tconst json = Buffer.from(cursor, 'base64url').toString('utf-8');\n\t\tconst payload = JSON.parse(json);\n\n\t\tif (payload.t === 'date') {\n\t\t\treturn new Date(payload.v);\n\t\t}\n\n\t\treturn payload.v;\n\t} catch {\n\t\tthrow new Error('Invalid cursor format');\n\t}\n}\n"],"mappings":";;;;AAGA,IAAY,kDAAL;AACN;AACA;;AACA;;;;;AAkBD,SAAgB,aAAaA,OAAwB;CACpD,MAAM,UAAU;EACf,GAAG,iBAAiB,OAAO,MAAM,aAAa,GAAG;EACjD,GAAG,iBAAiB,OAAO,gBAAgB;CAC3C;AACD,QAAO,OAAO,KAAK,KAAK,UAAU,QAAQ,CAAC,CAAC,SAAS,YAAY;AACjE;;;;AAKD,SAAgB,aAAaC,QAAyB;AACrD,KAAI;EACH,MAAM,OAAO,OAAO,KAAK,QAAQ,YAAY,CAAC,SAAS,QAAQ;EAC/D,MAAM,UAAU,KAAK,MAAM,KAAK;AAEhC,MAAI,QAAQ,MAAM,OACjB,QAAO,IAAI,KAAK,QAAQ;AAGzB,SAAO,QAAQ;CACf,QAAO;AACP,QAAM,IAAI,MAAM;CAChB;AACD"}
+{"version":3,"file":"pagination-CQ8QHXaL.mjs","names":["value: unknown","cursor: string"],"sources":["../src/pagination.ts"],"sourcesContent":["/**\n * Sort direction for cursor-based pagination.\n */\nexport enum Direction {\n\tAsc = 'asc',\n\tDesc = 'desc',\n}\n\n/**\n * Result of a paginated query.\n */\nexport interface PaginationResult<TItem> {\n\titems: TItem[];\n\tpagination: {\n\t\ttotal: number;\n\t\thasMore: boolean;\n\t\tcursor?: string;\n\t};\n}\n\n/**\n * Encode a cursor value for safe URL transmission.\n * Supports various types: string, number, Date, etc.\n */\nexport function encodeCursor(value: unknown): string {\n\tconst payload = {\n\t\tv: value instanceof Date ? value.toISOString() : value,\n\t\tt: value instanceof Date ? 'date' : typeof value,\n\t};\n\treturn Buffer.from(JSON.stringify(payload)).toString('base64url');\n}\n\n/**\n * Decode a cursor string back to its original value.\n */\nexport function decodeCursor(cursor: string): unknown {\n\ttry {\n\t\tconst json = Buffer.from(cursor, 'base64url').toString('utf-8');\n\t\tconst payload = JSON.parse(json);\n\n\t\tif (payload.t === 'date') {\n\t\t\treturn new Date(payload.v);\n\t\t}\n\n\t\treturn payload.v;\n\t} catch {\n\t\tthrow new Error('Invalid cursor format');\n\t}\n}\n"],"mappings":";;;;AAGA,IAAY,kDAAL;AACN;AACA;;AACA;;;;;AAkBD,SAAgB,aAAaA,OAAwB;CACpD,MAAM,UAAU;EACf,GAAG,iBAAiB,OAAO,MAAM,aAAa,GAAG;EACjD,GAAG,iBAAiB,OAAO,gBAAgB;CAC3C;AACD,QAAO,OAAO,KAAK,KAAK,UAAU,QAAQ,CAAC,CAAC,SAAS,YAAY;AACjE;;;;AAKD,SAAgB,aAAaC,QAAyB;AACrD,KAAI;EACH,MAAM,OAAO,OAAO,KAAK,QAAQ,YAAY,CAAC,SAAS,QAAQ;EAC/D,MAAM,UAAU,KAAK,MAAM,KAAK;AAEhC,MAAI,QAAQ,MAAM,OACjB,QAAO,IAAI,KAAK,QAAQ;AAGzB,SAAO,QAAQ;CACf,QAAO;AACP,QAAM,IAAI,MAAM;CAChB;AACD"}

package/dist/{pagination-BziGl-B8.d.mts → pagination-kv-KWS-7.d.mts}

@@ -29,4 +29,4 @@ declare function decodeCursor(cursor: string): unknown;
 //# sourceMappingURL=pagination.d.ts.map
 //#endregion
 export { Direction, PaginationResult, decodeCursor, encodeCursor };
-//# sourceMappingURL=pagination-BziGl-B8.d.mts.map
+//# sourceMappingURL=pagination-kv-KWS-7.d.mts.map

package/dist/{pagination-BziGl-B8.d.mts.map → pagination-kv-KWS-7.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"pagination-BziGl-B8.d.mts","names":[],"sources":["../src/pagination.ts"],"sourcesContent":[],"mappings":";;AAGA;AAQA;AAagB,aArBJ,SAAA;EAgCI,GAAA,GAAA,KAAA;;;;;;UAxBC;SACT;;;;;;;;;;;iBAYQ,YAAA;;;;iBAWA,YAAA"}
+{"version":3,"file":"pagination-kv-KWS-7.d.mts","names":[],"sources":["../src/pagination.ts"],"sourcesContent":[],"mappings":";;AAGA;AAQA;AAagB,aArBJ,SAAA;EAgCI,GAAA,GAAA,KAAA;;;;;;UAxBC;SACT;;;;;;;;;;;iBAYQ,YAAA;;;;iBAWA,YAAA"}

package/dist/pagination.cjs

@@ -1,4 +1,4 @@
-const require_pagination = require('./pagination-Bdoa4PVj.cjs');
+const require_pagination = require('./pagination-Bu1dqOy0.cjs');
 
 exports.Direction = require_pagination.Direction;
 exports.decodeCursor = require_pagination.decodeCursor;

package/dist/pagination.d.mts

@@ -1,2 +1,2 @@
-import { Direction, PaginationResult, decodeCursor, encodeCursor } from "./pagination-BziGl-B8.mjs";
+import { Direction, PaginationResult, decodeCursor, encodeCursor } from "./pagination-kv-KWS-7.mjs";
 export { Direction, PaginationResult, decodeCursor, encodeCursor };

package/dist/pagination.mjs

@@ -1,3 +1,3 @@
-import { Direction, decodeCursor, encodeCursor } from "./pagination-BDLa7Yb_.mjs";
+import { Direction, decodeCursor, encodeCursor } from "./pagination-CQ8QHXaL.mjs";
 
 export { Direction, decodeCursor, encodeCursor };

package/dist/pg/roles.cjs

@@ -0,0 +1,154 @@
+
+//#region src/pg/roles.ts
+/**
+* Everything one tenant's roles need, in dependency order.
+*
+* The owner before the schema it owns, the schema before the grants on it. A
+* caller applies them in sequence and may stop at the first failure without
+* leaving a half-granted role that looks complete.
+*/
+function roleStatements(spec) {
+	const { runtime, owner, schema, passwords } = spec;
+	return [
+		{
+			describe: `role ${owner}`,
+			exists: roleExists(owner),
+			sql: `CREATE ROLE ${ident(owner)} LOGIN PASSWORD ${literal(passwords.owner)}`
+		},
+		{
+			describe: `role ${runtime}`,
+			exists: roleExists(runtime),
+			sql: `CREATE ROLE ${ident(runtime)} LOGIN PASSWORD ${literal(passwords.runtime)}`
+		},
+		{
+			describe: `${owner} granted to the connecting role`,
+			sql: `GRANT ${ident(owner)} TO CURRENT_USER`
+		},
+		{
+			describe: `schema ${schema}`,
+			exists: {
+				sql: "SELECT 1 FROM information_schema.schemata WHERE schema_name = $1",
+				values: [schema]
+			},
+			sql: `CREATE SCHEMA ${ident(schema)} AUTHORIZATION ${ident(owner)}`
+		},
+		{
+			describe: `${schema} is owned by ${owner}`,
+			sql: `ALTER SCHEMA ${ident(schema)} OWNER TO ${ident(owner)}`
+		},
+		{
+			describe: `${runtime} may use ${schema}`,
+			sql: `GRANT USAGE ON SCHEMA ${ident(schema)} TO ${ident(runtime)}`
+		},
+		{
+			describe: `${runtime} may read and write future tables in ${schema}`,
+			sql: `ALTER DEFAULT PRIVILEGES FOR ROLE ${ident(owner)} IN SCHEMA ${ident(schema)} GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${ident(runtime)}`
+		},
+		{
+			describe: `${runtime} may use future sequences in ${schema}`,
+			sql: `ALTER DEFAULT PRIVILEGES FOR ROLE ${ident(owner)} IN SCHEMA ${ident(schema)} GRANT USAGE, SELECT ON SEQUENCES TO ${ident(runtime)}`
+		},
+		{
+			describe: `${runtime} may read and write existing tables in ${schema}`,
+			sql: `GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA ${ident(schema)} TO ${ident(runtime)}`
+		},
+		{
+			describe: `${runtime} may use existing sequences in ${schema}`,
+			sql: `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${ident(schema)} TO ${ident(runtime)}`
+		},
+		{
+			describe: `${runtime} resolves names in ${schema}`,
+			sql: `ALTER ROLE ${ident(runtime)} SET search_path TO ${ident(schema)}`
+		},
+		{
+			describe: `${owner} resolves names in ${schema}`,
+			sql: `ALTER ROLE ${ident(owner)} SET search_path TO ${ident(schema)}`
+		},
+		...spec.reader ? readerStatements(spec, spec.reader) : []
+	];
+}
+/**
+* A role that may read and nothing else.
+*
+* `SELECT` and no more, on what exists and on what the owner creates later. No
+* `INSERT`, no `UPDATE`, no `DELETE`, and no sequence `USAGE` — a reader that
+* could take a sequence value could not write the row it was for, so granting
+* it would be surface with no use.
+*/
+function readerStatements(spec, reader) {
+	const { owner, schema, passwords } = spec;
+	const password = passwords.reader;
+	if (!password) throw new ReaderNeedsPassword(reader);
+	return [
+		{
+			describe: `role ${reader}`,
+			exists: roleExists(reader),
+			sql: `CREATE ROLE ${ident(reader)} LOGIN PASSWORD ${literal(password)}`
+		},
+		{
+			describe: `${reader} may use ${schema}`,
+			sql: `GRANT USAGE ON SCHEMA ${ident(schema)} TO ${ident(reader)}`
+		},
+		{
+			describe: `${reader} may read future tables in ${schema}`,
+			sql: `ALTER DEFAULT PRIVILEGES FOR ROLE ${ident(owner)} IN SCHEMA ${ident(schema)} GRANT SELECT ON TABLES TO ${ident(reader)}`
+		},
+		{
+			describe: `${reader} may read existing tables in ${schema}`,
+			sql: `GRANT SELECT ON ALL TABLES IN SCHEMA ${ident(schema)} TO ${ident(reader)}`
+		},
+		{
+			describe: `${reader} resolves names in ${schema}`,
+			sql: `ALTER ROLE ${ident(reader)} SET search_path TO ${ident(schema)}`
+		}
+	];
+}
+/** A reader role was named and no password was supplied for it. */
+var ReaderNeedsPassword = class extends Error {
+	constructor(role) {
+		super(`'${role}' is a reader role and no password was supplied for it. This module composes DDL and invents no secrets: pass passwords.reader alongside the role name.`);
+		this.role = role;
+		this.name = "ReaderNeedsPassword";
+	}
+};
+/** The read-only role's name for a given runtime role. */
+function readerRole(runtime) {
+	return `${runtime}_reader`;
+}
+/** The owner role's name for a given runtime role. */
+function ownerRole(runtime) {
+	return `${runtime}_owner`;
+}
+function roleExists(role) {
+	return {
+		sql: "SELECT 1 FROM pg_roles WHERE rolname = $1",
+		values: [role]
+	};
+}
+/**
+* Quote an identifier for use in DDL.
+*
+* Names reaching here are already canonical, so this is defence rather than
+* sanitisation — but DDL cannot be parameterised, and an unquoted identifier is
+* the one place a name could ever be more than a name.
+*/
+function ident(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
+}
+/**
+* Quote a string literal.
+*
+* A password cannot be a bind parameter in `CREATE ROLE`, which is the one
+* place in this module where a value rather than a name is interpolated — so it
+* is escaped rather than trusted, whatever the caller believes it derived.
+*/
+function literal(value) {
+	return `'${value.replace(/'/g, "''")}'`;
+}
+
+//#endregion
+exports.ReaderNeedsPassword = ReaderNeedsPassword;
+exports.ownerRole = ownerRole;
+exports.readerRole = readerRole;
+exports.roleStatements = roleStatements;
+//# sourceMappingURL=roles.cjs.map