@geonosis/db 0.2.0

package/dist/index.cjs

@@ -0,0 +1,674 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEFAULT_OPS_VALUE: () => DEFAULT_OPS_VALUE,
+  DbRefusal: () => DbRefusal,
+  appConnectionString: () => appConnectionString,
+  appRoleStatements: () => appRoleStatements,
+  concurrentTenantsConformance: () => concurrentTenantsConformance,
+  createConnections: () => createConnections,
+  createSessionSeam: () => createSessionSeam,
+  forcedRowLevelSecurityConformance: () => forcedRowLevelSecurityConformance,
+  nodePostgresDriver: () => nodePostgresDriver,
+  perStepConnection: () => perStepConnection,
+  sessionConformance: () => sessionConformance,
+  statementCensusConformance: () => statementCensusConformance,
+  tenantIsolationConformance: () => tenantIsolationConformance,
+  tenantPolicies: () => tenantPolicies
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/app-role.ts
+var import_node_buffer = require("buffer");
+var import_node_crypto = require("crypto");
+
+// src/errors.ts
+var DbRefusal = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "DbRefusal";
+  }
+};
+
+// src/identifiers.ts
+var quoted = (name) => `"${name.replaceAll('"', '""')}"`;
+var literal = (value) => `'${value.replaceAll("'", "''")}'`;
+var qualified = (table, schema) => schema === void 0 ? quoted(table) : `${quoted(schema)}.${quoted(table)}`;
+
+// src/app-role.ts
+var SCRAM_ITERATIONS = 4096;
+var SCRAM_SALT_BYTES = 16;
+var scramVerifier = (password) => {
+  const salt = (0, import_node_crypto.randomBytes)(SCRAM_SALT_BYTES);
+  const salted = (0, import_node_crypto.pbkdf2Sync)(password, salt, SCRAM_ITERATIONS, 32, "sha256");
+  const storedKey = (0, import_node_crypto.createHash)("sha256").update((0, import_node_crypto.createHmac)("sha256", salted).update("Client Key").digest()).digest();
+  const serverKey = (0, import_node_crypto.createHmac)("sha256", salted).update("Server Key").digest();
+  return `SCRAM-SHA-256$${SCRAM_ITERATIONS}:${salt.toString("base64")}$${storedKey.toString("base64")}:${import_node_buffer.Buffer.from(serverKey).toString("base64")}`;
+};
+var DOLLAR_TAG = "$geonosis_app_role$";
+var appRoleStatements = (options) => {
+  if (typeof options.role !== "string" || options.role === "") {
+    throw new DbRefusal(
+      "appRoleStatements needs a `role`, and has no default: the name an application logs in as belongs to whoever runs the database, and one baked in here would be another repo's"
+    );
+  }
+  const role = quoted(options.role);
+  const schema = quoted(options.schema ?? "public");
+  return [
+    `do ${DOLLAR_TAG} begin if not exists (select from pg_roles where rolname = ${literal(options.role)}) then create role ${role} login nosuperuser nobypassrls; end if; end ${DOLLAR_TAG}`,
+    `alter role ${role} with password ${literal(scramVerifier(options.password))}`,
+    `grant usage on schema ${schema} to ${role}`,
+    `grant select, insert, update, delete on all tables in schema ${schema} to ${role}`,
+    `grant usage, select on all sequences in schema ${schema} to ${role}`,
+    `alter default privileges in schema ${schema} grant select, insert, update, delete on tables to ${role}`,
+    `alter default privileges in schema ${schema} grant usage, select on sequences to ${role}`,
+    ...options.statementTimeout === void 0 ? [] : [`alter role ${role} set statement_timeout = ${literal(options.statementTimeout)}`],
+    ...options.idleInTransactionTimeout === void 0 ? [] : [
+      `alter role ${role} set idle_in_transaction_session_timeout = ${literal(options.idleInTransactionTimeout)}`
+    ]
+  ];
+};
+var appConnectionString = (ownerConnectionString, credentials) => {
+  const url = new URL(ownerConnectionString);
+  url.username = credentials.role;
+  url.password = credentials.password;
+  return url.toString();
+};
+
+// src/conformance.ts
+var import_conformance = require("@geonosis/conformance");
+var A = "tenant_conformance_a";
+var B = "tenant_conformance_b";
+var CONCURRENT = [
+  "tenant_conformance_1",
+  "tenant_conformance_2",
+  "tenant_conformance_3",
+  "tenant_conformance_4",
+  "tenant_conformance_5",
+  "tenant_conformance_6",
+  "tenant_conformance_7",
+  "tenant_conformance_8"
+];
+var probeSql = (probe) => {
+  const on = qualified(probe.name, probe.schema);
+  const tenant = quoted(probe.tenantColumn);
+  return {
+    insert: (tenantId, id) => ({
+      params: [tenantId, id],
+      text: `insert into ${on} (${tenant}, ${quoted(probe.idColumn)}) values ($1, $2)`
+    }),
+    selectAll: { text: `select ${tenant} as tenant from ${on}` },
+    tenantsOf: (answer) => (0, import_conformance.rowsOf)(answer).map((row) => row.tenant).toSorted()
+  };
+};
+var written = async (subject, rows) => {
+  const probe = probeSql(subject.probe);
+  for (const [tenantId, id] of rows) {
+    await subject.seam.inTenant(
+      subject.connection,
+      tenantId,
+      (tx) => tx.execute(probe.insert(tenantId, id))
+    );
+  }
+};
+var tenantIsolationConformance = (subject) => {
+  const probe = probeSql(subject.probe);
+  return [
+    {
+      name: "the role the session connects as is no superuser",
+      run: async () => {
+        const [row] = (0, import_conformance.rowsOf)(
+          await subject.connection.execute({
+            text: `select current_setting('is_superuser') as super`
+          })
+        );
+        (0, import_conformance.assertIs)(
+          row?.super,
+          "off",
+          "the session connects as a superuser, and a superuser is exempt from every policy on every table \u2014 the wall is not being tested, and in production it would not be there"
+        );
+      }
+    },
+    {
+      name: "a tenant sees only its own rows",
+      run: async () => {
+        await subject.reset();
+        await written(subject, [
+          [A, "row_a"],
+          [B, "row_b"]
+        ]);
+        const seen = await subject.seam.inTenant(
+          subject.connection,
+          A,
+          (tx) => tx.execute(probe.selectAll)
+        );
+        (0, import_conformance.assertSame)(
+          probe.tenantsOf(seen),
+          [A],
+          "a read with no predicate, inside a session naming one tenant, answered with rows belonging to another"
+        );
+      }
+    },
+    {
+      name: "no tenant named means no rows",
+      run: async () => {
+        await subject.reset();
+        await written(subject, [
+          [A, "row_a"],
+          [B, "row_b"]
+        ]);
+        (0, import_conformance.assertSame)(
+          probe.tenantsOf(await subject.connection.execute(probe.selectAll)),
+          [],
+          "a read outside every session answered with rows: the policy defaults to visible, so a query that forgets its session sees the whole table"
+        );
+      }
+    },
+    {
+      name: "a tenant cannot write into another tenant's rows",
+      run: async () => {
+        await subject.reset();
+        await (0, import_conformance.assertRefuses)(
+          () => subject.seam.inTenant(
+            subject.connection,
+            B,
+            (tx) => tx.execute(probe.insert(A, "row_forged"))
+          ),
+          "a session naming one tenant wrote a row belonging to another \u2014 the isolation policy has a `using` clause and no `with check`, so it reads one way and writes any way"
+        );
+        (0, import_conformance.assertSame)(
+          probe.tenantsOf(
+            await subject.seam.inOps(subject.connection, (tx) => tx.execute(probe.selectAll))
+          ),
+          [],
+          "the forged write was reported as refused and the row is there anyway"
+        );
+      }
+    },
+    {
+      name: "the ops lever sees every tenant",
+      run: async () => {
+        await subject.reset();
+        await written(subject, [
+          [A, "row_a"],
+          [B, "row_b"]
+        ]);
+        (0, import_conformance.assertSame)(
+          probe.tenantsOf(
+            await subject.seam.inOps(subject.connection, (tx) => tx.execute(probe.selectAll))
+          ),
+          [A, B].toSorted(),
+          "maintenance could not see across tenants, so every sweep, backfill and repair has to be run once per tenant or not at all"
+        );
+      }
+    }
+  ];
+};
+var recorderOf = async (subject) => {
+  if (typeof subject.recording !== "function") {
+    throw new import_conformance.ConformanceFailure(
+      "this subject has no `recording`, and the census is a count of what reached the server: supply a handle that reports the statements it sends \u2014 a driver log hook is usually one line \u2014 or this claim is untested rather than passing"
+    );
+  }
+  return subject.recording();
+};
+var counted = (statements, pattern) => statements.filter((one) => pattern.test(one)).length;
+var statementCensusConformance = (subject) => {
+  const probe = probeSql(subject.probe);
+  return [
+    {
+      name: "a read in a session is four statements, one of them the tenant",
+      run: async () => {
+        await subject.reset();
+        const recorded = await recorderOf(subject);
+        try {
+          await subject.seam.inTenant(recorded.connection, A, (tx) => tx.execute(probe.selectAll));
+        } finally {
+          await recorded.close();
+        }
+        const { statements } = recorded;
+        (0, import_conformance.assertIs)(
+          counted(statements, /savepoint/i),
+          0,
+          `the read opened a savepoint, which means a nested transaction per query: ${statements.join(" | ")}`
+        );
+        (0, import_conformance.assertIs)(
+          counted(statements, /set_config/i),
+          1,
+          `the tenant was named ${counted(statements, /set_config/i)} times for one read: ${statements.join(" | ")}`
+        );
+        (0, import_conformance.assertThat)(
+          statements.findIndex((one) => /set_config/i.test(one)) < statements.findIndex((one) => one.includes(subject.probe.name)),
+          `the read ran before the tenant was named, so it ran under whatever the connection carried: ${statements.join(" | ")}`
+        );
+        (0, import_conformance.assertIs)(
+          statements.length,
+          4,
+          `a read in a session is the transaction, the tenant, the read and the commit: ${statements.join(" | ")}`
+        );
+      }
+    },
+    {
+      name: "a second read in that session opens no savepoint and names the tenant once",
+      run: async () => {
+        await subject.reset();
+        const recorded = await recorderOf(subject);
+        try {
+          await subject.seam.inTenant(recorded.connection, A, async (tx) => {
+            await tx.execute(probe.selectAll);
+            await subject.seam.inTenant(tx, A, (inner) => inner.execute(probe.selectAll));
+          });
+        } finally {
+          await recorded.close();
+        }
+        const { statements } = recorded;
+        (0, import_conformance.assertIs)(
+          counted(statements, /savepoint/i),
+          0,
+          `the second read opened a savepoint: a query already inside its session re-enters it rather than nesting \u2014 ${statements.join(" | ")}`
+        );
+        (0, import_conformance.assertIs)(
+          counted(statements, /set_config/i),
+          1,
+          `the tenant was named again inside a session already open for it: ${statements.join(" | ")}`
+        );
+        (0, import_conformance.assertIs)(
+          statements.length,
+          5,
+          `two reads in one session are the transaction, the tenant, both reads and the commit: ${statements.join(" | ")}`
+        );
+      }
+    }
+  ];
+};
+var concurrentTenantsConformance = (subject) => {
+  const probe = probeSql(subject.probe);
+  return [
+    {
+      name: "concurrent writes each land under their own tenant",
+      run: async () => {
+        await subject.reset();
+        await Promise.all(
+          CONCURRENT.map(
+            (tenantId, index) => subject.seam.inTenant(
+              subject.connection,
+              tenantId,
+              (tx) => tx.execute(probe.insert(tenantId, `row_${index}`))
+            )
+          )
+        );
+        (0, import_conformance.assertSame)(
+          probe.tenantsOf(
+            await subject.seam.inOps(subject.connection, (tx) => tx.execute(probe.selectAll))
+          ),
+          CONCURRENT.toSorted(),
+          "writes made at the same moment did not each land under the tenant they named: the setting is not local to its transaction, so one connection carried another request's tenant"
+        );
+      }
+    },
+    {
+      name: "concurrent reads each see one tenant only",
+      run: async () => {
+        await subject.reset();
+        await Promise.all(
+          CONCURRENT.map(
+            (tenantId, index) => subject.seam.inTenant(
+              subject.connection,
+              tenantId,
+              (tx) => tx.execute(probe.insert(tenantId, `row_${index}`))
+            )
+          )
+        );
+        const seen = await Promise.all(
+          CONCURRENT.map(
+            (tenantId) => subject.seam.inTenant(subject.connection, tenantId, (tx) => tx.execute(probe.selectAll)).then(probe.tenantsOf)
+          )
+        );
+        (0, import_conformance.assertSame)(
+          seen,
+          CONCURRENT.map((tenantId) => [tenantId]),
+          "a read saw rows of a tenant other than the one its own session named, while other tenants were reading"
+        );
+      }
+    },
+    {
+      name: "a session refuses a second tenant",
+      run: async () => {
+        await (0, import_conformance.assertRefuses)(
+          () => subject.seam.inTenant(
+            subject.connection,
+            A,
+            (tx) => subject.seam.inTenant(tx, B, (inner) => inner.execute(probe.selectAll))
+          ),
+          "a session open for one tenant accepted a query for another: whichever setting wins, one of the two queries runs behind the wrong policy",
+          // #211/#213: the SEAM's own refusal, by class — a driver that crashed throws too.
+          DbRefusal
+        );
+      }
+    },
+    {
+      name: "the ops lever refuses a tenant query",
+      run: async () => {
+        await (0, import_conformance.assertRefuses)(
+          () => subject.seam.inOps(
+            subject.connection,
+            (tx) => subject.seam.inTenant(tx, A, (inner) => inner.execute(probe.selectAll))
+          ),
+          "a tenant query reached from an ops sweep ran anyway \u2014 with no tenant named, behind the ops policy, which is every tenant",
+          DbRefusal
+        );
+      }
+    }
+  ];
+};
+var forcedRowLevelSecurityConformance = (subject) => [
+  {
+    name: "every guarded table forces row level security",
+    run: async () => {
+      const tables = subject.guardedTables ?? [subject.probe.name];
+      const rows = (0, import_conformance.rowsOf)(
+        await subject.connection.execute({
+          params: [tables],
+          text: "select relname as name, relforcerowsecurity as forced from pg_class where relname = any($1)"
+        })
+      );
+      (0, import_conformance.assertSame)(
+        rows.map((row) => row.name).toSorted(),
+        [...tables].toSorted(),
+        "a table named as guarded is not in pg_class under that name"
+      );
+      (0, import_conformance.assertSame)(
+        rows.filter((row) => row.forced !== true).map((row) => row.name),
+        [],
+        "these tables have row level security enabled but not forced, so their owner \u2014 the migrator, and every ops connection \u2014 reads and writes every tenant"
+      );
+    }
+  }
+];
+var sessionConformance = (subject) => [
+  ...tenantIsolationConformance(subject),
+  ...statementCensusConformance(subject),
+  ...concurrentTenantsConformance(subject),
+  ...forcedRowLevelSecurityConformance(subject)
+];
+
+// src/connections.ts
+var import_node_async_hooks = require("async_hooks");
+var invocation = new import_node_async_hooks.AsyncLocalStorage();
+var createConnections = (config) => {
+  const opened = () => config.open === void 0 ? config.driver.open(config.connectionString) : config.driver.open(config.connectionString, config.open);
+  return {
+    inInvocation: () => invocation.getStore() !== void 0,
+    open: opened,
+    sessionDb: () => {
+      const frame = invocation.getStore();
+      if (frame === void 0) {
+        throw new DbRefusal(
+          "sessionDb() was called outside withConnection(), where a handle opened for it would be closed by nobody. Wrap the invocation \u2014 withConnection(() => \u2026, (closing) => ctx.waitUntil(closing)) \u2014 or call open() and close what you were given."
+        );
+      }
+      const known = frame.get(config.connectionString);
+      if (known !== void 0) return known.connection;
+      const held = opened();
+      frame.set(config.connectionString, held);
+      return held.connection;
+    },
+    withConnection: async (run, release = (closing) => void closing) => {
+      if (invocation.getStore() !== void 0) return run();
+      const held = /* @__PURE__ */ new Map();
+      try {
+        return await invocation.run(held, run);
+      } finally {
+        release(Promise.all([...held.values()].map((one) => one.close())).then(() => void 0));
+      }
+    }
+  };
+};
+var perStepConnection = (connections) => ({
+  perStep: () => (body) => connections.withConnection(body)
+});
+
+// src/node-postgres.ts
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
+var loadPg = async () => {
+  let loaded;
+  try {
+    loaded = await import("pg");
+  } catch (error) {
+    throw new DbRefusal(
+      "pg is an optional peer dependency of @geonosis/db and is not installed \u2014 `npm install pg`, or pass your own copy as `nodePostgresDriver({ pg })`",
+      { cause: error }
+    );
+  }
+  return loaded.default ?? loaded;
+};
+var drivingPg = (module2) => {
+  if (typeof module2?.Pool !== "function") {
+    throw new DbRefusal(
+      "what was given as `pg` has no `Pool` \u2014 @geonosis/db opens every connection through one, so whatever answered to that name is not the driver this expects"
+    );
+  }
+  return module2;
+};
+var values = (statement) => statement.params === void 0 ? void 0 : [...statement.params];
+var DEFAULT_MIGRATIONS_TABLE = "geonosis_db_migrations";
+var nodePostgresDriver = async (options = {}) => {
+  const pg = drivingPg(options.pg ?? await loadPg());
+  const ledger = quoted(options.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE);
+  const open = (connectionString, opened = {}) => {
+    const say = opened.onStatement ?? (() => {
+    });
+    const pool = new pg.Pool({
+      connectionString,
+      ...opened.poolSize === void 0 ? {} : { max: opened.poolSize }
+    });
+    pool.on("error", opened.onIdleError ?? (() => {
+    }));
+    const sent = async (run, statement) => {
+      say(statement.text);
+      return run(statement.text, values(statement));
+    };
+    return {
+      close: () => pool.end(),
+      connection: {
+        execute: (statement) => sent((text, params) => pool.query(text, params), statement),
+        transaction: async (run) => {
+          const client = await pool.connect();
+          try {
+            say("begin");
+            await client.query("begin");
+            const result = await run({
+              execute: (statement) => sent((text, params) => client.query(text, params), statement)
+            });
+            say("commit");
+            await client.query("commit");
+            return result;
+          } catch (error) {
+            say("rollback");
+            await client.query("rollback").catch(() => void 0);
+            throw error;
+          } finally {
+            client.release();
+          }
+        }
+      }
+    };
+  };
+  return {
+    /**
+     * The `.sql` files of a folder, in name order, each in its own transaction, each recorded so
+     * the next run skips it. The smallest thing that can apply a folder: a consumer with a migrator
+     * of their own passes their own `Driver` and this is never called.
+     */
+    migrate: async (connectionString, migrationsFolder) => {
+      const held = open(connectionString, { poolSize: 1 });
+      try {
+        await held.connection.execute({
+          text: `create table if not exists ${ledger} (name text primary key, applied_at timestamptz not null default now())`
+        });
+        const files = (await (0, import_promises.readdir)(migrationsFolder)).filter((name) => name.endsWith(".sql")).toSorted();
+        for (const name of files) {
+          const sql = await (0, import_promises.readFile)((0, import_node_path.join)(migrationsFolder, name), "utf8");
+          await held.connection.transaction(async (tx) => {
+            const applied = await tx.execute({
+              params: [name],
+              text: `select name from ${ledger} where name = $1`
+            });
+            if (applied.rows.length > 0) return;
+            await tx.execute({ text: sql });
+            await tx.execute({ params: [name], text: `insert into ${ledger} (name) values ($1)` });
+          });
+        }
+      } finally {
+        await held.close();
+      }
+    },
+    open
+  };
+};
+
+// src/settings.ts
+var DEFAULT_OPS_VALUE = "on";
+var CUSTOM_SETTING = /^[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]*$/;
+var readSettings = (settings) => {
+  for (const named of ["opsSetting", "tenantSetting"]) {
+    const name = settings[named];
+    if (typeof name !== "string" || name === "") {
+      throw new DbRefusal(
+        `${named} is required and has no default: the name of a session setting is the one thing this package cannot pick for you, because the policies and the seam have to agree on it exactly`
+      );
+    }
+    if (!CUSTOM_SETTING.test(name)) {
+      throw new DbRefusal(
+        `${named} is "${name}", and Postgres reads a setting an application defines as \`prefix.name\` \u2014 anything else is rejected as unrecognised the first time a session sets it`
+      );
+    }
+  }
+  return { ...settings, opsValue: settings.opsValue ?? DEFAULT_OPS_VALUE };
+};
+
+// src/policies.ts
+var settingRead = (name) => `(select current_setting(${literal(name)}, true))`;
+var both = (predicate) => `using (${predicate}) with check (${predicate})`;
+var DEFAULT_NAMES = {
+  freeze: "not_frozen",
+  isolation: "tenant_isolation",
+  opsMaintenance: "ops_maintenance"
+};
+var tenantPolicies = (table, options) => {
+  const settings = readSettings(options.settings);
+  const names = { ...DEFAULT_NAMES, ...options.names };
+  const on = qualified(table, options.schema);
+  const tenant = settingRead(settings.tenantSetting);
+  const opsIsOn = `${settingRead(settings.opsSetting)} = ${literal(settings.opsValue)}`;
+  const policy = (name, as, predicate) => [
+    `drop policy if exists ${quoted(name)} on ${on}`,
+    `create policy ${quoted(name)} on ${on} as ${as} for all ${both(predicate)}`
+  ];
+  const frozen = options.freeze;
+  const notFrozen = frozen === void 0 ? [] : policy(
+    names.freeze,
+    "restrictive",
+    `${opsIsOn} or not exists (select 1 from ${quoted(frozen.table)} where ${quoted(frozen.tenantColumn)} = ${tenant})`
+  );
+  return [
+    `alter table ${on} enable row level security`,
+    `alter table ${on} force row level security`,
+    ...policy(names.isolation, "permissive", `${quoted(options.tenantColumn)} = ${tenant}`),
+    ...policy(names.opsMaintenance, "permissive", opsIsOn),
+    ...notFrozen
+  ];
+};
+
+// src/session.ts
+var OPS = /* @__PURE__ */ Symbol("the ops lever");
+var scopeOf = /* @__PURE__ */ new WeakMap();
+var describe = (scope) => scope === OPS ? "the ops lever" : `tenant ${JSON.stringify(scope)}`;
+var canOpen = (executor) => typeof executor.transaction === "function";
+var createSessionSeam = (config) => {
+  const settings = readSettings(config.settings);
+  const contextOf = (scope) => {
+    if (scope !== OPS) {
+      return { params: [settings.tenantSetting, scope], text: "select set_config($1, $2, true)" };
+    }
+    return config.opsStatementTimeout === void 0 ? {
+      params: [settings.opsSetting, settings.opsValue],
+      text: "select set_config($1, $2, true)"
+    } : {
+      params: [settings.opsSetting, settings.opsValue, config.opsStatementTimeout],
+      text: "select set_config($1, $2, true), set_config('statement_timeout', $3, true)"
+    };
+  };
+  const opened = async (executor, scope, run) => {
+    const current = scopeOf.get(executor);
+    if (current === scope) return run(executor);
+    if (current !== void 0) {
+      throw new DbRefusal(
+        `this transaction is open for ${describe(current)} and was asked for ${describe(scope)}: a transaction names one scope, and the second query would run behind the first one's policy`
+      );
+    }
+    if (!canOpen(executor)) {
+      throw new DbRefusal(
+        `this executor is in no session and cannot open a transaction, so ${describe(scope)} has nothing to name \u2014 pass the connection, or run it inside a session already open for that scope`
+      );
+    }
+    return executor.transaction(async (tx) => {
+      await tx.execute(contextOf(scope));
+      scopeOf.set(tx, scope);
+      return run(tx);
+    });
+  };
+  return {
+    inOps: (executor, run) => opened(executor, OPS, run),
+    inTenant: (executor, tenantId, run) => opened(executor, tenantId, run),
+    scoped: (query) => (executor, params) => opened(executor, params.tenantId, (tx) => query(tx, params)),
+    scopedAsOps: (query) => (executor, params) => opened(executor, OPS, (tx) => query(tx, params))
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_OPS_VALUE,
+  DbRefusal,
+  appConnectionString,
+  appRoleStatements,
+  concurrentTenantsConformance,
+  createConnections,
+  createSessionSeam,
+  forcedRowLevelSecurityConformance,
+  nodePostgresDriver,
+  perStepConnection,
+  sessionConformance,
+  statementCensusConformance,
+  tenantIsolationConformance,
+  tenantPolicies
+});