@nebutra/tenant 0.1.2 → 2.0.0

package/README.md

@@ -372,6 +372,22 @@ interface TenantConfig {
 
 - `withRls(prisma, tenantId)` — Apply RLS extension to Prisma
 - `generateRlsPolicySql(options)` — Generate deterministic PostgreSQL RLS policy SQL
+- `applyTenantSession(tx, tenantId, options?)` / `tenantSessionOperations(prisma, tenantId, options?)` —
+  The tenant session core: the transaction-local `SET LOCAL ROLE` (from `APP_DB_ROLE`) and
+  `set_config('app.current_tenant_id', …, true)` statements. `withRls` runs it as a batch
+  transaction; `withTenantContext` in `@nebutra/db/rls` runs it inside an interactive
+  transaction. One implementation, two shapes — new wrappers run the core rather than
+  restating the statements. (`getTenantDb` in `@nebutra/db` still carries its own copy
+  until the P1.2 follow-up routes it through `tenantSessionOperations`.)
+- `resolveRlsRole(env?)` / `isValidDbRole(role)` — `APP_DB_ROLE` resolved as a bare SQL identifier
+  (permissive: `null` on invalid)
+- `resolveRlsRoleOrThrow(env?)` — the same resolution, but throws `TenantIsolationError` when
+  `APP_DB_ROLE` is set to something that is not a bare SQL identifier, instead of returning
+  `null`. `applyTenantSession`/`tenantSessionOperations` resolve the role through this when no
+  explicit `role` option is given, and so does `withRls` (closure P1.3 — an unusable
+  `APP_DB_ROLE` refuses to run rather than silently dropping the role switch)
+- `TENANT_SESSION_SETTING` / `TENANT_SESSION_EXPRESSION` — the setting key the policies read and
+  the wrappers write
 - `getTenantSchema(tenantId)` — Get schema name for schema-per-tenant
 - `getTenantDatabaseUrl(tenantId, baseUrl?)` — Get DB URL for database-per-tenant
 - `TenantAwarePrismaClient` — Wrapper class for tenant isolation
@@ -485,6 +501,6 @@ function AdvancedAnalytics() {
 
 ## See Also
 
-- [@nebutra/logger](../logger) — Structured logging
-- [@nebutra/queue](../queue) — Message queue with tenant support
+- [@nebutra/logger](../../platform/logger/) — Structured logging
+- [@nebutra/queue](../../integrations/queue/) — Message queue with tenant support
 - Prisma RLS [Documentation](https://www.prisma.io/docs/orm/prisma-client/queries/raw-database-access)

package/dist/context.d.ts

@@ -1,4 +1,4 @@
-import type { TenantContext } from "./types";
+import type { TenantContext } from "./types.js";
 /**
  * Execute a function with a tenant context set.
  *

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAW7C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAS7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAWhD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,IAAI,aAAa,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,EACxC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,IAAI,aAAa,CASjC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAWhD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAS7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAWhD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,IAAI,aAAa,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,EACxC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,IAAI,aAAa,CASjC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD"}

package/dist/context.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { logger } from "@nebutra/logger";
-import { TenantRequiredError } from "./types";
+import { TenantRequiredError } from "./types.js";
 /**
  * AsyncLocalStorage-based tenant context — request-scoped, zero-copy across async boundaries.
  *

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-export { getCurrentTenant, getCurrentTenantId, getTenantIdOrNull, getTenantOrNull, requireTenant, runWithTenant, } from "./context";
-export { compose, fromApiKey, fromHeader, fromJwtClaim, fromPath, fromSubdomain, } from "./resolvers";
-export type { AuthSessionLike, SessionGetter } from "./resolvers/from-auth-session";
-export { fromAuthSession } from "./resolvers/from-auth-session";
-export type { IsolationStrategy, PlanTier, TenantConfig, TenantContext, TenantInfo, TenantResolver, } from "./types";
-export { TenantConfigSchema, TenantContextSchema, TenantInfoSchema, TenantIsolationError, TenantRequiredError, } from "./types";
-export type { RlsPolicyCommand, RlsPolicySqlOptions } from "./isolation";
-export { createTenantPrismaProxy, generateRlsPolicySql, getTenantDatabaseUrl, getTenantSchema, TenantAwarePrismaClient, withRls, } from "./isolation";
+export { getCurrentTenant, getCurrentTenantId, getTenantIdOrNull, getTenantOrNull, requireTenant, runWithTenant, } from "./context.js";
+export type { AuthSessionLike, SessionGetter } from "./resolvers/from-auth-session.js";
+export { fromAuthSession } from "./resolvers/from-auth-session.js";
+export { compose, fromApiKey, fromHeader, fromJwtClaim, fromPath, fromSubdomain, } from "./resolvers.js";
+export type { IsolationStrategy, PlanTier, TenantConfig, TenantContext, TenantInfo, TenantResolver, } from "./types.js";
+export { TenantConfigSchema, TenantContextSchema, TenantInfoSchema, TenantIsolationError, TenantRequiredError, } from "./types.js";
+export type { RlsPolicyCommand, RlsPolicySqlOptions, TenantSessionExecutor, TenantSessionOptions, } from "./isolation.js";
+export { applyTenantSession, createTenantPrismaProxy, generateRlsPolicySql, getTenantDatabaseUrl, getTenantSchema, isValidDbRole, resolveRlsRole, TENANT_SESSION_EXPRESSION, TENANT_SESSION_SETTING, TenantAwarePrismaClient, tenantSessionOperations, withRls, } from "./isolation.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,OAAO,EACP,UAAU,EACV,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,cAAc,GACf,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAKjB,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,uBAAuB,EACvB,OAAO,GACR,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,OAAO,EACL,OAAO,EACP,UAAU,EACV,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAKpB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,OAAO,GACR,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -2,12 +2,13 @@
 // @nebutra/tenant — Multi-tenancy context and isolation
 // =============================================================================
 // Re-export context functions
-export { getCurrentTenant, getCurrentTenantId, getTenantIdOrNull, getTenantOrNull, requireTenant, runWithTenant, } from "./context";
+export { getCurrentTenant, getCurrentTenantId, getTenantIdOrNull, getTenantOrNull, requireTenant, runWithTenant, } from "./context.js";
+export { fromAuthSession } from "./resolvers/from-auth-session.js";
 // Re-export resolvers
-export { compose, fromApiKey, fromHeader, fromJwtClaim, fromPath, fromSubdomain, } from "./resolvers";
-export { fromAuthSession } from "./resolvers/from-auth-session";
-export { TenantConfigSchema, TenantContextSchema, TenantInfoSchema, TenantIsolationError, TenantRequiredError, } from "./types";
-// Re-export isolation helpers
-export { createTenantPrismaProxy, generateRlsPolicySql, getTenantDatabaseUrl, getTenantSchema, TenantAwarePrismaClient, withRls, } from "./isolation";
+export { compose, fromApiKey, fromHeader, fromJwtClaim, fromPath, fromSubdomain, } from "./resolvers.js";
+export { TenantConfigSchema, TenantContextSchema, TenantInfoSchema, TenantIsolationError, TenantRequiredError, } from "./types.js";
+// Re-export isolation helpers — including the tenant session core shared with
+// `@nebutra/db/rls` (closure P1.2: one implementation behind both wrappers).
+export { applyTenantSession, createTenantPrismaProxy, generateRlsPolicySql, getTenantDatabaseUrl, getTenantSchema, isValidDbRole, resolveRlsRole, TENANT_SESSION_EXPRESSION, TENANT_SESSION_SETTING, TenantAwarePrismaClient, tenantSessionOperations, withRls, } from "./isolation.js";
 // Re-export React hooks (as subpath export ./react)
 // These are exported via package.json "exports" for tree-shaking

package/dist/isolation.d.ts

@@ -1,9 +1,12 @@
-import type { IsolationStrategy } from "./types";
+import type { IsolationStrategy } from "./types.js";
+export { applyTenantSession, isValidDbRole, resolveRlsRole, resolveRlsRoleOrThrow, TENANT_SESSION_EXPRESSION, TENANT_SESSION_SETTING, type TenantSessionExecutor, type TenantSessionOptions, tenantSessionOperations, } from "./rls-session.js";
 /** Minimal Prisma-like client interface for RLS extension support. */
 interface PrismaLikeClient {
     $extends?: (extension: unknown) => unknown;
     $executeRaw?: (query: TemplateStringsArray, ...values: unknown[]) => Promise<number>;
     $queryRaw?: (query: TemplateStringsArray, ...values: unknown[]) => Promise<unknown[]>;
+    $transaction?: (operations: unknown[]) => Promise<unknown[]>;
+    $executeRawUnsafe?: (query: string) => Promise<number>;
 }
 export type RlsPolicyCommand = "ALL" | "SELECT" | "INSERT" | "UPDATE" | "DELETE";
 export interface RlsPolicySqlOptions {
@@ -35,8 +38,10 @@ export declare function generateRlsPolicySql(options: RlsPolicySqlOptions): stri
  * Works with PostgreSQL RLS policies that check `app.current_tenant_id`.
  * This is the standard pattern for shared-schema multi-tenancy.
  *
- * The Prisma client middleware intercepts all queries and sets the
- * application-level variable before executing.
+ * The Prisma client extension intercepts all queries and sets the
+ * application-level variable before executing. Missing `$extends`,
+ * `$transaction`, or `$executeRaw` throws `TenantIsolationError` instead
+ * of running an unisolated query. Production also requires `APP_DB_ROLE`.
  *
  * @param prisma The Prisma client to extend
  * @param tenantId The tenant ID to set in RLS context
@@ -130,13 +135,20 @@ export declare class TenantAwarePrismaClient {
      */
     getDatabaseUrl(baseUrl?: string): string;
     /**
-     * Execute a raw SQL query with tenant context.
+     * Execute a raw SQL statement with tenant context.
+     *
+     * Tagged-template only — interpolated values are bound as parameters by
+     * Prisma, never concatenated into the SQL string:
+     *   client.executeRaw`UPDATE users SET active = ${flag} WHERE id = ${id}`
      */
-    executeRaw(query: string): Promise<number>;
+    executeRaw(query: TemplateStringsArray, ...values: unknown[]): Promise<number>;
     /**
-     * Execute a raw query and return results.
+     * Execute a raw SQL query with tenant context and return rows.
+     *
+     * Tagged-template only — interpolated values are bound as parameters:
+     *   client.queryRaw`SELECT * FROM users WHERE id = ${id}`
      */
-    queryRaw(query: string): Promise<unknown[]>;
+    queryRaw(query: TemplateStringsArray, ...values: unknown[]): Promise<unknown[]>;
 }
 /**
  * Create a tenant-aware Prisma proxy that applies isolation based on strategy.
@@ -153,5 +165,4 @@ export declare class TenantAwarePrismaClient {
  * ```
  */
 export declare function createTenantPrismaProxy(prisma: PrismaLikeClient, tenantId: string, strategy?: IsolationStrategy): PrismaLikeClient;
-export {};
 //# sourceMappingURL=isolation.d.ts.map

package/dist/isolation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isolation.d.ts","sourceRoot":"","sources":["../src/isolation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAOjD,sEAAsE;AACtE,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,OAAO,CAAC;IAC3C,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CACvF;AAED,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,4FAA4F;IAC5F,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oDAAoD;IACpD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAyCD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CA2DzE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,CAiClF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmBxD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CA6B/E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,QAAQ;gBADR,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM;IAK1B;;OAEG;IACH,IAAI,MAAM,qBAET;IAED;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM;IAIxC;;OAEG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwBhD;;OAEG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAoBlD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,iBAAmC,GAC5C,gBAAgB,CAmBlB"}
+{"version":3,"file":"isolation.d.ts","sourceRoot":"","sources":["../src/isolation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAM1B,sEAAsE;AACtE,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,OAAO,CAAC;IAC3C,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD;AAED,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,4FAA4F;IAC5F,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oDAAoD;IACpD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA2CD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CA2DzE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,CAwElF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmBxD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CA6B/E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,QAAQ;gBADR,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM;IAK1B;;OAEG;IACH,IAAI,MAAM,qBAET;IAED;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM;IAIxC;;;;;;OAMG;IACG,UAAU,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBpF;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAmBtF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,iBAAmC,GAC5C,gBAAgB,CAmBlB"}

package/dist/isolation.js

@@ -1,8 +1,15 @@
 import { logger } from "@nebutra/logger";
-import { TenantIsolationError } from "./types";
+import { resolveRlsRoleOrThrow, TENANT_SESSION_EXPRESSION, tenantSessionOperations, } from "./rls-session.js";
+import { TenantIsolationError } from "./types.js";
+// The tenant session core is the single implementation behind `withRls` here
+// and `withTenantContext` in `@nebutra/db/rls`. Re-exported so consumers of
+// `@nebutra/tenant/isolation` reach it without a second entry point.
+export { applyTenantSession, isValidDbRole, resolveRlsRole, resolveRlsRoleOrThrow, TENANT_SESSION_EXPRESSION, TENANT_SESSION_SETTING, tenantSessionOperations, } from "./rls-session.js";
 const DEFAULT_TENANT_COLUMN = "tenant_id";
 const DEFAULT_POLICY_PREFIX = "tenant_isolation";
-const DEFAULT_TENANT_EXPRESSION = "current_setting('app.current_tenant_id', true)";
+// Same key the session core writes with set_config — policies and wrappers
+// cannot disagree about which setting carries the tenant.
+const DEFAULT_TENANT_EXPRESSION = TENANT_SESSION_EXPRESSION;
 function assertNonEmptyIdentifier(value, label) {
     if (typeof value !== "string" || value.trim().length === 0 || value.includes("\0")) {
         throw new TenantIsolationError(`Invalid ${label} for RLS policy generation`, "shared_schema");
@@ -79,8 +86,10 @@ export function generateRlsPolicySql(options) {
  * Works with PostgreSQL RLS policies that check `app.current_tenant_id`.
  * This is the standard pattern for shared-schema multi-tenancy.
  *
- * The Prisma client middleware intercepts all queries and sets the
- * application-level variable before executing.
+ * The Prisma client extension intercepts all queries and sets the
+ * application-level variable before executing. Missing `$extends`,
+ * `$transaction`, or `$executeRaw` throws `TenantIsolationError` instead
+ * of running an unisolated query. Production also requires `APP_DB_ROLE`.
  *
  * @param prisma The Prisma client to extend
  * @param tenantId The tenant ID to set in RLS context
@@ -104,31 +113,51 @@ export function generateRlsPolicySql(options) {
  * ```
  */
 export function withRls(prisma, tenantId) {
+    const extendClient = prisma.$extends;
+    const runTransaction = prisma.$transaction;
+    const executeRaw = prisma.$executeRaw;
+    if (typeof extendClient !== "function") {
+        throw new TenantIsolationError("Prisma client does not support $extends; refusing unisolated queries", "shared_schema");
+    }
+    if (typeof runTransaction !== "function" || typeof executeRaw !== "function") {
+        throw new TenantIsolationError("Prisma client cannot apply transaction-local RLS; refusing unisolated queries", "shared_schema");
+    }
+    // Closure P1.3: an unusable APP_DB_ROLE (not a bare SQL identifier) throws
+    // here instead of resolving to null and silently running without RLS.
+    const rlsRole = resolveRlsRoleOrThrow();
+    if (process.env.NODE_ENV === "production" && !rlsRole) {
+        throw new TenantIsolationError("APP_DB_ROLE is required in production so withRls cannot run as a BYPASSRLS owner", "shared_schema");
+    }
+    // Prisma's `$executeRaw*` and `$transaction` are prototype methods that read
+    // `this`, so the session core is handed bound adapters rather than the
+    // detached functions captured above for the capability checks.
+    const executeRawUnsafe = prisma.$executeRawUnsafe;
+    const executor = {
+        $executeRaw: (query, ...values) => executeRaw.call(prisma, query, ...values),
+        $executeRawUnsafe: typeof executeRawUnsafe === "function"
+            ? (query) => executeRawUnsafe.call(prisma, query)
+            : undefined,
+    };
     try {
-        // Check if Prisma client supports $extends (v5+)
-        if (typeof prisma.$extends === "function") {
-            // Create a Prisma client extension that sets RLS context on each query
-            const extended = prisma.$extends({
-                query: {
-                    $allOperations: {
-                        async $before() {
-                            // Execute SET command to set application variable
-                            if (typeof prisma.$executeRaw === "function") {
-                                await prisma.$executeRaw `SELECT set_config('app.current_tenant_id', ${tenantId}, false)`;
-                            }
-                            logger.debug("RLS context set", { tenantId });
-                        },
-                    },
+        const extended = extendClient.call(prisma, {
+            query: {
+                async $allOperations({ args, query, }) {
+                    // One batch transaction: role switch (if configured) → tenant
+                    // setting → the model query, all on the same connection.
+                    const ops = tenantSessionOperations(executor, tenantId, { role: rlsRole });
+                    ops.push(query(args));
+                    const results = (await runTransaction.call(prisma, ops));
+                    logger.debug("RLS context set", { tenantId });
+                    return results[results.length - 1];
                 },
-            });
-            return extended;
-        }
-        logger.debug("withRls: Prisma client does not support $extends, returning original client", {
-            tenantId,
+            },
         });
-        return prisma;
+        return extended;
     }
     catch (err) {
+        if (err instanceof TenantIsolationError) {
+            throw err;
+        }
         logger.error("Failed to apply RLS extension", err, { tenantId });
         throw new TenantIsolationError(`Failed to apply RLS isolation for tenant ${tenantId}`, "shared_schema");
     }
@@ -247,19 +276,22 @@ export class TenantAwarePrismaClient {
         return getTenantDatabaseUrl(this.tenantId, baseUrl);
     }
     /**
-     * Execute a raw SQL query with tenant context.
+     * Execute a raw SQL statement with tenant context.
+     *
+     * Tagged-template only — interpolated values are bound as parameters by
+     * Prisma, never concatenated into the SQL string:
+     *   client.executeRaw`UPDATE users SET active = ${flag} WHERE id = ${id}`
      */
-    async executeRaw(query) {
+    async executeRaw(query, ...values) {
         try {
-            logger.debug("Executing raw query with tenant context", {
+            logger.debug("Executing raw statement with tenant context", {
                 tenantId: this.tenantId,
-                queryLength: query.length,
             });
             const client = this.client;
             if (!client.$executeRaw) {
                 throw new TenantIsolationError("Prisma client does not support $executeRaw", "shared_schema");
             }
-            return await client.$executeRaw `${query}`;
+            return await client.$executeRaw(query, ...values);
         }
         catch (err) {
             logger.error("Failed to execute raw query", err, { tenantId: this.tenantId });
@@ -267,19 +299,21 @@ export class TenantAwarePrismaClient {
         }
     }
     /**
-     * Execute a raw query and return results.
+     * Execute a raw SQL query with tenant context and return rows.
+     *
+     * Tagged-template only — interpolated values are bound as parameters:
+     *   client.queryRaw`SELECT * FROM users WHERE id = ${id}`
      */
-    async queryRaw(query) {
+    async queryRaw(query, ...values) {
         try {
-            logger.debug("Executing query with tenant context", {
+            logger.debug("Executing raw query with tenant context", {
                 tenantId: this.tenantId,
-                queryLength: query.length,
             });
             const client = this.client;
             if (!client.$queryRaw) {
                 throw new TenantIsolationError("Prisma client does not support $queryRaw", "shared_schema");
             }
-            return await client.$queryRaw `${query}`;
+            return await client.$queryRaw(query, ...values);
         }
         catch (err) {
             logger.error("Failed to execute query", err, { tenantId: this.tenantId });

package/dist/middleware.d.ts

@@ -1,4 +1,4 @@
-import type { TenantConfig } from "./types";
+import type { TenantConfig } from "./types.js";
 /** Minimal Hono-like context — matches Hono's `Context` without importing it. */
 interface HonoLikeContext {
     req: {

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,SAAS,CAAC;AAO5D,iFAAiF;AACjF,UAAU,eAAe;IACvB,GAAG,EAAE;QACH,GAAG,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC;QAC1B,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAC9C,CAAC;IACF,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC;CACnD;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,GAAE,OAAO,CAAC,YAAY,CAAM,IAuBnD,GAAG,eAAe,EAAE,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,uBAyDhE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC,EAC3C,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACvC,MAAM,GAAE,OAAO,CAAC,YAAY,CAAM,IAQpB,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC,CAsDtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC,EACjD,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,IAE3C,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC,CAiBtC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,YAAY,CAAC;AAO/D,iFAAiF;AACjF,UAAU,eAAe;IACvB,GAAG,EAAE;QACH,GAAG,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC;QAC1B,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAC9C,CAAC;IACF,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC;CACnD;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,GAAE,OAAO,CAAC,YAAY,CAAM,IAuBnD,GAAG,eAAe,EAAE,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,uBAyDhE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC,EAC3C,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACvC,MAAM,GAAE,OAAO,CAAC,YAAY,CAAM,IAQpB,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC,CAsDtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC,EACjD,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,IAE3C,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC,CAiBtC"}

package/dist/middleware.js

@@ -1,7 +1,7 @@
 import { logger } from "@nebutra/logger";
-import { runWithTenant } from "./context";
-import { fromHeader, fromJwtClaim, fromPath, fromSubdomain } from "./resolvers";
-import { TenantRequiredError } from "./types";
+import { runWithTenant } from "./context.js";
+import { fromHeader, fromJwtClaim, fromPath, fromSubdomain } from "./resolvers.js";
+import { TenantRequiredError } from "./types.js";
 // =============================================================================
 // Hono Middleware for Multi-Tenant Context
 // =============================================================================

package/dist/react.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import type { TenantContext } from "./types";
+import type { TenantContext } from "./types.js";
 /**
  * Provider component that wraps your app with tenant context.
  *

package/dist/react.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAEA,OAAO,KAAoC,MAAM,OAAO,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAe7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,aAAa,CAAC;CACtB;;;;;;;WAMA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,IAAI,aAAa,CAUzC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,IAAI,aAAa,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAGpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,8CAG5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAC9C,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EACjC,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;YAEpB,CAAC;eAFW,KAAK;;;EAqBnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,GACT,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,uDAYA"}
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAEA,OAAO,KAAoC,MAAM,OAAO,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAehD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,aAAa,CAAC;CACtB;;;;;;;WAMA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,IAAI,aAAa,CAUzC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,IAAI,aAAa,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAGpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,8CAG5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAC9C,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EACjC,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;YAEpB,CAAC;eAFW,KAAK;;;EAqBnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,GACT,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,uDAYA"}

package/dist/react.js

@@ -1,6 +1,6 @@
 "use client";
 import React, { createContext, useContext } from "react";
-import { TenantRequiredError } from "./types";
+import { TenantRequiredError } from "./types.js";
 // =============================================================================
 // React Context for Tenant — Client-side multi-tenancy
 // =============================================================================

package/dist/resolvers/from-auth-session.d.ts

@@ -1,4 +1,4 @@
-import type { TenantResolver } from "../types";
+import type { TenantResolver } from "../types.js";
 /**
  * Minimal shape this resolver needs from a session object.
  *

package/dist/resolvers/from-auth-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"from-auth-session.d.ts","sourceRoot":"","sources":["../../src/resolvers/from-auth-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAM/C;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAC/B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,aAAa,GAAG,cAAc,CAgBzE"}
+{"version":3,"file":"from-auth-session.d.ts","sourceRoot":"","sources":["../../src/resolvers/from-auth-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAMlD;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAC/B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,aAAa,GAAG,cAAc,CAgBzE"}

package/dist/resolvers.d.ts

@@ -1,4 +1,4 @@
-import type { TenantResolver } from "./types";
+import type { TenantResolver } from "./types.js";
 /**
  * Extract tenant ID from an HTTP header.
  *

package/dist/resolvers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../src/resolvers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAsD9C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,MAAsB,GAAG,cAAc,CAW7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAsB7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAwBvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAsB9D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,cAAc,CAiB/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,OAAO,CAAC,GAAG,SAAS,EAAE,cAAc,EAAE,GAAG,cAAc,CAiBtE"}
+{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../src/resolvers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAsDjD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,MAAsB,GAAG,cAAc,CAW7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAsB7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAwBvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAsB9D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,cAAc,CAiB/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,OAAO,CAAC,GAAG,SAAS,EAAE,cAAc,EAAE,GAAG,cAAc,CAiBtE"}

package/dist/rls-session.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Tenant session core — how a PostgreSQL transaction is scoped to a tenant for
+ * row-level security, shared by both public wrappers:
+ *
+ *   - `withRls(prisma, tenantId)`              (`@nebutra/tenant/isolation`)
+ *   - `withTenantContext(prisma, tenantId, cb)` (`@nebutra/db/rls`)
+ *
+ * Both issue exactly the statements this module produces. The RLS policies
+ * (`generateRlsPolicySql`, migration `20260313000000_enable_rls`) read
+ * `current_setting('app.current_tenant_id', true)`; the wrappers write the same
+ * key through `set_config(..., true)`, so the value is transaction-local and
+ * cannot leak across pooled connections. Keeping the key and the statements
+ * here — rather than once per wrapper — is closure item P1.2: two copies of a
+ * security invariant drift, one copy cannot.
+ *
+ * Closure P1.3: an `APP_DB_ROLE` that is configured but unusable must refuse
+ * to run rather than quietly drop the role switch and execute as the
+ * connection's own (possibly BYPASSRLS) role. Two shapes of "unusable" are
+ * handled here — `resolveSessionRole` refuses a value that fails
+ * `isValidDbRole`, and `planTenantSession` refuses when the executor cannot
+ * run `$executeRawUnsafe` at all, so the role switch has nowhere to go.
+ * Neither case matters to `getTenantDb` in `@nebutra/db` (`src/client.ts`):
+ * it still carries its own copy of the RLS statements, closes the same gap
+ * with its own verification (`rls-role.ts`), and is unaffected either way.
+ *
+ * Not yet routed through here: `getTenantDb` in `@nebutra/db` (`src/client.ts`)
+ * still carries its own copy of these statements, with a
+ * `SET LOCAL statement_timeout` between the role switch and `set_config`. The
+ * P1.2 follow-up moves it onto `tenantSessionOperations`; until then that copy
+ * is the one other place these statements exist, and it must not gain siblings.
+ *
+ * This module imports nothing outside `@nebutra/tenant` (only `./types`, whose
+ * sole dependency is zod): `@nebutra/db` consumes it, and it must stay usable
+ * from any Prisma-like executor (interactive transaction, batch transaction, or
+ * a client extension).
+ */
+/** PostgreSQL session setting the RLS policies compare `tenant_id` against. */
+export declare const TENANT_SESSION_SETTING = "app.current_tenant_id";
+/**
+ * SQL expression the generated RLS policies use to read the tenant. The second
+ * argument (`missing_ok = true`) makes an unset session yield NULL — which the
+ * policy predicate then rejects — instead of raising.
+ */
+export declare const TENANT_SESSION_EXPRESSION = "current_setting('app.current_tenant_id', true)";
+/** True when `role` is a bare SQL identifier safe to interpolate into `SET LOCAL ROLE`. */
+export declare function isValidDbRole(role: unknown): role is string;
+/**
+ * Resolve the optional non-BYPASSRLS role tenant-scoped transactions assume —
+ * e.g. `app_user` on Supabase, whose `postgres` connection role bypasses RLS.
+ *
+ * Resolved at call time (not module load) so every wrapper sees the same
+ * environment and tests can exercise both shapes.
+ *
+ * @returns the validated role, or `null` when unset or not a bare identifier
+ */
+export declare function resolveRlsRole(env?: {
+    APP_DB_ROLE?: string | undefined;
+}): string | null;
+/**
+ * Resolve `APP_DB_ROLE` the way `resolveRlsRole` does, but fail closed:
+ * when it is set to something that is not a bare SQL identifier, throw
+ * `TenantIsolationError` instead of silently returning `null`.
+ *
+ * Closure P1.3 — `resolveRlsRole`'s null-on-invalid contract is what let an
+ * unusable `APP_DB_ROLE` disable RLS silently: every caller that treated
+ * `null` as "no role configured" ran the query as the connection's own
+ * (possibly BYPASSRLS) role instead of refusing. `resolveRlsRole` keeps that
+ * permissive contract for callers that genuinely want it (diagnostics,
+ * tooling); every tenant-scoped code path resolves the role through this
+ * function instead.
+ *
+ * @throws TenantIsolationError when `APP_DB_ROLE` is set but not a bare SQL
+ *   identifier.
+ */
+export declare function resolveRlsRoleOrThrow(env?: {
+    APP_DB_ROLE?: string | undefined;
+}): string | null;
+/**
+ * The subset of a Prisma client (or interactive-transaction client) the tenant
+ * session needs. `$executeRaw` is tagged-template only so `tenantId` is always
+ * bound as a parameter; `$executeRawUnsafe` carries the role switch, whose
+ * identifier is validated by `isValidDbRole` before it is interpolated.
+ */
+export interface TenantSessionExecutor {
+    $executeRaw: (query: TemplateStringsArray, ...values: unknown[]) => PromiseLike<number>;
+    $executeRawUnsafe?: ((query: string) => PromiseLike<number>) | undefined;
+}
+export interface TenantSessionOptions {
+    /**
+     * Role to assume before scoping the transaction.
+     *
+     * - `undefined` (default): resolve from `APP_DB_ROLE` via `resolveRlsRoleOrThrow()`
+     * - `null`: never switch role (admin / migration paths that must run as owner)
+     * - a string: use this validated identifier
+     */
+    role?: string | null | undefined;
+}
+/**
+ * Issue the tenant-session statements through `executor` and return them in
+ * order, without awaiting. Prisma promises are lazy, so the returned array can
+ * be spread into a batch `$transaction([...ops, query])` and will run inside
+ * that transaction, in order, ahead of the query.
+ */
+export declare function tenantSessionOperations(executor: TenantSessionExecutor, tenantId: string, options?: TenantSessionOptions): PromiseLike<number>[];
+/**
+ * Run the tenant-session statements sequentially on `executor` — an interactive
+ * transaction client — and resolve once the transaction is scoped to `tenantId`.
+ */
+export declare function applyTenantSession(executor: TenantSessionExecutor, tenantId: string, options?: TenantSessionOptions): Promise<void>;
+//# sourceMappingURL=rls-session.d.ts.map

package/dist/rls-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-session.d.ts","sourceRoot":"","sources":["../src/rls-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,mDAAuD,CAAC;AAQ9F,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,GAAG,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAgB,GACtD,MAAM,GAAG,IAAI,CAGf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAgB,GACtD,MAAM,GAAG,IAAI,CAaf;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC;IACxF,iBAAiB,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CAC1E;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAClC;AAoED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,GACjC,WAAW,CAAC,MAAM,CAAC,EAAE,CAGvB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAKf"}