@nebutra/tenant 0.1.3 → 3.0.0

package/README.md

@@ -372,6 +372,22 @@ interface TenantConfig {
 
 - `withRls(prisma, tenantId)` — Apply RLS extension to Prisma
 - `generateRlsPolicySql(options)` — Generate deterministic PostgreSQL RLS policy SQL
+- `applyTenantSession(tx, tenantId, options?)` / `tenantSessionOperations(prisma, tenantId, options?)` —
+  The tenant session core: the transaction-local `SET LOCAL ROLE` (from `APP_DB_ROLE`) and
+  `set_config('app.current_tenant_id', …, true)` statements. `withRls` runs it as a batch
+  transaction; `withTenantContext` in `@nebutra/db/rls` runs it inside an interactive
+  transaction. One implementation, two shapes — new wrappers run the core rather than
+  restating the statements. (`getTenantDb` in `@nebutra/db` still carries its own copy
+  until the P1.2 follow-up routes it through `tenantSessionOperations`.)
+- `resolveRlsRole(env?)` / `isValidDbRole(role)` — `APP_DB_ROLE` resolved as a bare SQL identifier
+  (permissive: `null` on invalid)
+- `resolveRlsRoleOrThrow(env?)` — the same resolution, but throws `TenantIsolationError` when
+  `APP_DB_ROLE` is set to something that is not a bare SQL identifier, instead of returning
+  `null`. `applyTenantSession`/`tenantSessionOperations` resolve the role through this when no
+  explicit `role` option is given, and so does `withRls` (closure P1.3 — an unusable
+  `APP_DB_ROLE` refuses to run rather than silently dropping the role switch)
+- `TENANT_SESSION_SETTING` / `TENANT_SESSION_EXPRESSION` — the setting key the policies read and
+  the wrappers write
 - `getTenantSchema(tenantId)` — Get schema name for schema-per-tenant
 - `getTenantDatabaseUrl(tenantId, baseUrl?)` — Get DB URL for database-per-tenant
 - `TenantAwarePrismaClient` — Wrapper class for tenant isolation

package/dist/context.d.ts

@@ -1,4 +1,4 @@
-import type { TenantContext } from "./types";
+import type { TenantContext } from "./types.js";
 /**
  * Execute a function with a tenant context set.
  *

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAW7C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAS7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAWhD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,IAAI,aAAa,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,EACxC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,IAAI,aAAa,CASjC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAWhD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAS7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAWhD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,IAAI,aAAa,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,EACxC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,IAAI,aAAa,CASjC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD"}

package/dist/context.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { logger } from "@nebutra/logger";
-import { TenantRequiredError } from "./types";
+import { TenantRequiredError } from "./types.js";
 /**
  * AsyncLocalStorage-based tenant context — request-scoped, zero-copy across async boundaries.
  *

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-export { getCurrentTenant, getCurrentTenantId, getTenantIdOrNull, getTenantOrNull, requireTenant, runWithTenant, } from "./context";
-export { compose, fromApiKey, fromHeader, fromJwtClaim, fromPath, fromSubdomain, } from "./resolvers";
-export type { AuthSessionLike, SessionGetter } from "./resolvers/from-auth-session";
-export { fromAuthSession } from "./resolvers/from-auth-session";
-export type { IsolationStrategy, PlanTier, TenantConfig, TenantContext, TenantInfo, TenantResolver, } from "./types";
-export { TenantConfigSchema, TenantContextSchema, TenantInfoSchema, TenantIsolationError, TenantRequiredError, } from "./types";
-export type { RlsPolicyCommand, RlsPolicySqlOptions } from "./isolation";
-export { createTenantPrismaProxy, generateRlsPolicySql, getTenantDatabaseUrl, getTenantSchema, TenantAwarePrismaClient, withRls, } from "./isolation";
+export { getCurrentTenant, getCurrentTenantId, getTenantIdOrNull, getTenantOrNull, requireTenant, runWithTenant, } from "./context.js";
+export type { AuthSessionLike, SessionGetter } from "./resolvers/from-auth-session.js";
+export { fromAuthSession } from "./resolvers/from-auth-session.js";
+export { compose, fromApiKey, fromHeader, fromJwtClaim, fromPath, fromSubdomain, } from "./resolvers.js";
+export type { IsolationStrategy, PlanTier, TenantConfig, TenantContext, TenantInfo, TenantResolver, } from "./types.js";
+export { TenantConfigSchema, TenantContextSchema, TenantInfoSchema, TenantIsolationError, TenantRequiredError, } from "./types.js";
+export type { RlsPolicyCommand, RlsPolicySqlOptions, TenantSessionExecutor, TenantSessionOptions, } from "./isolation.js";
+export { applyTenantSession, createTenantPrismaProxy, generateRlsPolicySql, getTenantDatabaseUrl, getTenantSchema, isValidDbRole, resolveRlsRole, TENANT_SESSION_EXPRESSION, TENANT_SESSION_SETTING, TenantAwarePrismaClient, tenantSessionOperations, withRls, } from "./isolation.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,OAAO,EACP,UAAU,EACV,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,cAAc,GACf,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAKjB,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,uBAAuB,EACvB,OAAO,GACR,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,OAAO,EACL,OAAO,EACP,UAAU,EACV,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAKpB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,OAAO,GACR,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -2,12 +2,13 @@
 // @nebutra/tenant — Multi-tenancy context and isolation
 // =============================================================================
 // Re-export context functions
-export { getCurrentTenant, getCurrentTenantId, getTenantIdOrNull, getTenantOrNull, requireTenant, runWithTenant, } from "./context";
+export { getCurrentTenant, getCurrentTenantId, getTenantIdOrNull, getTenantOrNull, requireTenant, runWithTenant, } from "./context.js";
+export { fromAuthSession } from "./resolvers/from-auth-session.js";
 // Re-export resolvers
-export { compose, fromApiKey, fromHeader, fromJwtClaim, fromPath, fromSubdomain, } from "./resolvers";
-export { fromAuthSession } from "./resolvers/from-auth-session";
-export { TenantConfigSchema, TenantContextSchema, TenantInfoSchema, TenantIsolationError, TenantRequiredError, } from "./types";
-// Re-export isolation helpers
-export { createTenantPrismaProxy, generateRlsPolicySql, getTenantDatabaseUrl, getTenantSchema, TenantAwarePrismaClient, withRls, } from "./isolation";
+export { compose, fromApiKey, fromHeader, fromJwtClaim, fromPath, fromSubdomain, } from "./resolvers.js";
+export { TenantConfigSchema, TenantContextSchema, TenantInfoSchema, TenantIsolationError, TenantRequiredError, } from "./types.js";
+// Re-export isolation helpers — including the tenant session core shared with
+// `@nebutra/db/rls` (closure P1.2: one implementation behind both wrappers).
+export { applyTenantSession, createTenantPrismaProxy, generateRlsPolicySql, getTenantDatabaseUrl, getTenantSchema, isValidDbRole, resolveRlsRole, TENANT_SESSION_EXPRESSION, TENANT_SESSION_SETTING, TenantAwarePrismaClient, tenantSessionOperations, withRls, } from "./isolation.js";
 // Re-export React hooks (as subpath export ./react)
 // These are exported via package.json "exports" for tree-shaking

package/dist/isolation.d.ts

@@ -1,4 +1,5 @@
-import type { IsolationStrategy } from "./types";
+import type { IsolationStrategy } from "./types.js";
+export { applyTenantSession, isValidDbRole, resolveRlsRole, resolveRlsRoleOrThrow, TENANT_SESSION_EXPRESSION, TENANT_SESSION_SETTING, type TenantSessionExecutor, type TenantSessionOptions, tenantSessionOperations, } from "./rls-session.js";
 /** Minimal Prisma-like client interface for RLS extension support. */
 interface PrismaLikeClient {
     $extends?: (extension: unknown) => unknown;
@@ -37,8 +38,10 @@ export declare function generateRlsPolicySql(options: RlsPolicySqlOptions): stri
  * Works with PostgreSQL RLS policies that check `app.current_tenant_id`.
  * This is the standard pattern for shared-schema multi-tenancy.
  *
- * The Prisma client middleware intercepts all queries and sets the
- * application-level variable before executing.
+ * The Prisma client extension intercepts all queries and sets the
+ * application-level variable before executing. Missing `$extends`,
+ * `$transaction`, or `$executeRaw` throws `TenantIsolationError` instead
+ * of running an unisolated query. Production also requires `APP_DB_ROLE`.
  *
  * @param prisma The Prisma client to extend
  * @param tenantId The tenant ID to set in RLS context
@@ -162,5 +165,4 @@ export declare class TenantAwarePrismaClient {
  * ```
  */
 export declare function createTenantPrismaProxy(prisma: PrismaLikeClient, tenantId: string, strategy?: IsolationStrategy): PrismaLikeClient;
-export {};
 //# sourceMappingURL=isolation.d.ts.map

package/dist/isolation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isolation.d.ts","sourceRoot":"","sources":["../src/isolation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAOjD,sEAAsE;AACtE,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,OAAO,CAAC;IAC3C,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD;AAWD,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,4FAA4F;IAC5F,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oDAAoD;IACpD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAyCD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CA2DzE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,CAyDlF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmBxD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CA6B/E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,QAAQ;gBADR,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM;IAK1B;;OAEG;IACH,IAAI,MAAM,qBAET;IAED;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM;IAIxC;;;;;;OAMG;IACG,UAAU,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBpF;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAmBtF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,iBAAmC,GAC5C,gBAAgB,CAmBlB"}
+{"version":3,"file":"isolation.d.ts","sourceRoot":"","sources":["../src/isolation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAM1B,sEAAsE;AACtE,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,OAAO,CAAC;IAC3C,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD;AAED,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,4FAA4F;IAC5F,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oDAAoD;IACpD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA2CD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CA2DzE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,CAwElF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmBxD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CA6B/E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,QAAQ;gBADR,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM;IAK1B;;OAEG;IACH,IAAI,MAAM,qBAET;IAED;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM;IAIxC;;;;;;OAMG;IACG,UAAU,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBpF;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAmBtF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,iBAAmC,GAC5C,gBAAgB,CAmBlB"}

package/dist/isolation.js

@@ -1,16 +1,15 @@
 import { logger } from "@nebutra/logger";
-import { TenantIsolationError } from "./types";
-// Optional non-bypassrls role to assume for tenant-scoped queries — e.g. "app_user"
-// on Supabase, whose `postgres` connection role bypasses RLS entirely. Env-driven so
-// other backends opt in (or leave unset); validated as a bare SQL identifier before
-// interpolation since role names cannot be bound as parameters.
-const RLS_ROLE = (() => {
-    const r = process.env.APP_DB_ROLE;
-    return r && /^[a-z_][a-z0-9_]*$/.test(r) ? r : null;
-})();
+import { resolveRlsRoleOrThrow, TENANT_SESSION_EXPRESSION, tenantSessionOperations, } from "./rls-session.js";
+import { TenantIsolationError } from "./types.js";
+// The tenant session core is the single implementation behind `withRls` here
+// and `withTenantContext` in `@nebutra/db/rls`. Re-exported so consumers of
+// `@nebutra/tenant/isolation` reach it without a second entry point.
+export { applyTenantSession, isValidDbRole, resolveRlsRole, resolveRlsRoleOrThrow, TENANT_SESSION_EXPRESSION, TENANT_SESSION_SETTING, tenantSessionOperations, } from "./rls-session.js";
 const DEFAULT_TENANT_COLUMN = "tenant_id";
 const DEFAULT_POLICY_PREFIX = "tenant_isolation";
-const DEFAULT_TENANT_EXPRESSION = "current_setting('app.current_tenant_id', true)";
+// Same key the session core writes with set_config — policies and wrappers
+// cannot disagree about which setting carries the tenant.
+const DEFAULT_TENANT_EXPRESSION = TENANT_SESSION_EXPRESSION;
 function assertNonEmptyIdentifier(value, label) {
     if (typeof value !== "string" || value.trim().length === 0 || value.includes("\0")) {
         throw new TenantIsolationError(`Invalid ${label} for RLS policy generation`, "shared_schema");
@@ -87,8 +86,10 @@ export function generateRlsPolicySql(options) {
  * Works with PostgreSQL RLS policies that check `app.current_tenant_id`.
  * This is the standard pattern for shared-schema multi-tenancy.
  *
- * The Prisma client middleware intercepts all queries and sets the
- * application-level variable before executing.
+ * The Prisma client extension intercepts all queries and sets the
+ * application-level variable before executing. Missing `$extends`,
+ * `$transaction`, or `$executeRaw` throws `TenantIsolationError` instead
+ * of running an unisolated query. Production also requires `APP_DB_ROLE`.
  *
  * @param prisma The Prisma client to extend
  * @param tenantId The tenant ID to set in RLS context
@@ -112,45 +113,51 @@ export function generateRlsPolicySql(options) {
  * ```
  */
 export function withRls(prisma, tenantId) {
+    const extendClient = prisma.$extends;
+    const runTransaction = prisma.$transaction;
+    const executeRaw = prisma.$executeRaw;
+    if (typeof extendClient !== "function") {
+        throw new TenantIsolationError("Prisma client does not support $extends; refusing unisolated queries", "shared_schema");
+    }
+    if (typeof runTransaction !== "function" || typeof executeRaw !== "function") {
+        throw new TenantIsolationError("Prisma client cannot apply transaction-local RLS; refusing unisolated queries", "shared_schema");
+    }
+    // Closure P1.3: an unusable APP_DB_ROLE (not a bare SQL identifier) throws
+    // here instead of resolving to null and silently running without RLS.
+    const rlsRole = resolveRlsRoleOrThrow();
+    if (process.env.NODE_ENV === "production" && !rlsRole) {
+        throw new TenantIsolationError("APP_DB_ROLE is required in production so withRls cannot run as a BYPASSRLS owner", "shared_schema");
+    }
+    // Prisma's `$executeRaw*` and `$transaction` are prototype methods that read
+    // `this`, so the session core is handed bound adapters rather than the
+    // detached functions captured above for the capability checks.
+    const executeRawUnsafe = prisma.$executeRawUnsafe;
+    const executor = {
+        $executeRaw: (query, ...values) => executeRaw.call(prisma, query, ...values),
+        $executeRawUnsafe: typeof executeRawUnsafe === "function"
+            ? (query) => executeRawUnsafe.call(prisma, query)
+            : undefined,
+    };
     try {
-        // Check if Prisma client supports $extends (v5+)
-        if (typeof prisma.$extends === "function") {
-            // Create a Prisma client extension that scopes every query to the tenant.
-            const extended = prisma.$extends({
-                query: {
-                    async $allOperations({ args, query, }) {
-                        // Run the RLS setting and the operation in ONE transaction so they
-                        // share a connection, and set it transaction-local (third arg
-                        // `true`) so it is cleared at transaction end. A session-level SET
-                        // would leak across pooled/reused connections; running the SET
-                        // outside a transaction does not guarantee the query lands on the
-                        // same connection at all.
-                        if (typeof prisma.$transaction === "function" &&
-                            typeof prisma.$executeRaw === "function") {
-                            const ops = [];
-                            // Switch to the non-bypassrls role first (when configured) so RLS
-                            // policies apply; role names can't be bound, hence validated raw.
-                            if (RLS_ROLE && typeof prisma.$executeRawUnsafe === "function") {
-                                ops.push(prisma.$executeRawUnsafe(`SET LOCAL ROLE "${RLS_ROLE}"`));
-                            }
-                            ops.push(prisma.$executeRaw `SELECT set_config('app.current_tenant_id', ${tenantId}, true)`);
-                            ops.push(query(args));
-                            const results = (await prisma.$transaction(ops));
-                            logger.debug("RLS context set", { tenantId });
-                            return results[results.length - 1];
-                        }
-                        return query(args);
-                    },
+        const extended = extendClient.call(prisma, {
+            query: {
+                async $allOperations({ args, query, }) {
+                    // One batch transaction: role switch (if configured) → tenant
+                    // setting → the model query, all on the same connection.
+                    const ops = tenantSessionOperations(executor, tenantId, { role: rlsRole });
+                    ops.push(query(args));
+                    const results = (await runTransaction.call(prisma, ops));
+                    logger.debug("RLS context set", { tenantId });
+                    return results[results.length - 1];
                 },
-            });
-            return extended;
-        }
-        logger.debug("withRls: Prisma client does not support $extends, returning original client", {
-            tenantId,
+            },
         });
-        return prisma;
+        return extended;
     }
     catch (err) {
+        if (err instanceof TenantIsolationError) {
+            throw err;
+        }
         logger.error("Failed to apply RLS extension", err, { tenantId });
         throw new TenantIsolationError(`Failed to apply RLS isolation for tenant ${tenantId}`, "shared_schema");
     }

package/dist/middleware.d.ts

@@ -1,4 +1,4 @@
-import type { TenantConfig } from "./types";
+import type { TenantConfig } from "./types.js";
 /** Minimal Hono-like context — matches Hono's `Context` without importing it. */
 interface HonoLikeContext {
     req: {

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,SAAS,CAAC;AAO5D,iFAAiF;AACjF,UAAU,eAAe;IACvB,GAAG,EAAE;QACH,GAAG,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC;QAC1B,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAC9C,CAAC;IACF,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC;CACnD;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,GAAE,OAAO,CAAC,YAAY,CAAM,IAuBnD,GAAG,eAAe,EAAE,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,uBAyDhE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC,EAC3C,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACvC,MAAM,GAAE,OAAO,CAAC,YAAY,CAAM,IAQpB,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC,CAsDtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC,EACjD,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,IAE3C,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC,CAiBtC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,YAAY,CAAC;AAO/D,iFAAiF;AACjF,UAAU,eAAe;IACvB,GAAG,EAAE;QACH,GAAG,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC;QAC1B,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAC9C,CAAC;IACF,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC;CACnD;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,GAAE,OAAO,CAAC,YAAY,CAAM,IAuBnD,GAAG,eAAe,EAAE,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,uBAyDhE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC,EAC3C,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACvC,MAAM,GAAE,OAAO,CAAC,YAAY,CAAM,IAQpB,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC,CAsDtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC,EACjD,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,IAE3C,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC,CAiBtC"}

package/dist/middleware.js

@@ -1,7 +1,7 @@
 import { logger } from "@nebutra/logger";
-import { runWithTenant } from "./context";
-import { fromHeader, fromJwtClaim, fromPath, fromSubdomain } from "./resolvers";
-import { TenantRequiredError } from "./types";
+import { runWithTenant } from "./context.js";
+import { fromHeader, fromJwtClaim, fromPath, fromSubdomain } from "./resolvers.js";
+import { TenantRequiredError } from "./types.js";
 // =============================================================================
 // Hono Middleware for Multi-Tenant Context
 // =============================================================================

package/dist/react.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import type { TenantContext } from "./types";
+import type { TenantContext } from "./types.js";
 /**
  * Provider component that wraps your app with tenant context.
  *

package/dist/react.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAEA,OAAO,KAAoC,MAAM,OAAO,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAe7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,aAAa,CAAC;CACtB;;;;;;;WAMA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,IAAI,aAAa,CAUzC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,IAAI,aAAa,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAGpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,8CAG5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAC9C,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EACjC,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;YAEpB,CAAC;eAFW,KAAK;;;EAqBnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,GACT,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,uDAYA"}
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAEA,OAAO,KAAoC,MAAM,OAAO,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAehD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,aAAa,CAAC;CACtB;;;;;;;WAMA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,IAAI,aAAa,CAUzC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,IAAI,aAAa,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAGpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,8CAG5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAC9C,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EACjC,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;YAEpB,CAAC;eAFW,KAAK;;;EAqBnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,QAAQ,GACT,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,uDAYA"}

package/dist/react.js

@@ -1,6 +1,6 @@
 "use client";
 import React, { createContext, useContext } from "react";
-import { TenantRequiredError } from "./types";
+import { TenantRequiredError } from "./types.js";
 // =============================================================================
 // React Context for Tenant — Client-side multi-tenancy
 // =============================================================================

package/dist/resolvers/from-auth-session.d.ts

@@ -1,4 +1,4 @@
-import type { TenantResolver } from "../types";
+import type { TenantResolver } from "../types.js";
 /**
  * Minimal shape this resolver needs from a session object.
  *

package/dist/resolvers/from-auth-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"from-auth-session.d.ts","sourceRoot":"","sources":["../../src/resolvers/from-auth-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAM/C;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAC/B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,aAAa,GAAG,cAAc,CAgBzE"}
+{"version":3,"file":"from-auth-session.d.ts","sourceRoot":"","sources":["../../src/resolvers/from-auth-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAMlD;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAC/B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,aAAa,GAAG,cAAc,CAgBzE"}

package/dist/resolvers.d.ts

@@ -1,4 +1,4 @@
-import type { TenantResolver } from "./types";
+import type { TenantResolver } from "./types.js";
 /**
  * Extract tenant ID from an HTTP header.
  *

package/dist/resolvers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../src/resolvers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAsD9C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,MAAsB,GAAG,cAAc,CAW7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAsB7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAwBvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAsB9D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,cAAc,CAiB/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,OAAO,CAAC,GAAG,SAAS,EAAE,cAAc,EAAE,GAAG,cAAc,CAiBtE"}
+{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../src/resolvers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAsDjD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,UAAU,GAAE,MAAsB,GAAG,cAAc,CAW7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAsB7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAwBvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAsB9D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,cAAc,CAiB/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,OAAO,CAAC,GAAG,SAAS,EAAE,cAAc,EAAE,GAAG,cAAc,CAiBtE"}

package/dist/rls-session.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Tenant session core — how a PostgreSQL transaction is scoped to a tenant for
+ * row-level security, shared by both public wrappers:
+ *
+ *   - `withRls(prisma, tenantId)`              (`@nebutra/tenant/isolation`)
+ *   - `withTenantContext(prisma, tenantId, cb)` (`@nebutra/db/rls`)
+ *
+ * Both issue exactly the statements this module produces. The RLS policies
+ * (`generateRlsPolicySql`, migration `20260313000000_enable_rls`) read
+ * `current_setting('app.current_tenant_id', true)`; the wrappers write the same
+ * key through `set_config(..., true)`, so the value is transaction-local and
+ * cannot leak across pooled connections. Keeping the key and the statements
+ * here — rather than once per wrapper — is closure item P1.2: two copies of a
+ * security invariant drift, one copy cannot.
+ *
+ * Closure P1.3: an `APP_DB_ROLE` that is configured but unusable must refuse
+ * to run rather than quietly drop the role switch and execute as the
+ * connection's own (possibly BYPASSRLS) role. Two shapes of "unusable" are
+ * handled here — `resolveSessionRole` refuses a value that fails
+ * `isValidDbRole`, and `planTenantSession` refuses when the executor cannot
+ * run `$executeRawUnsafe` at all, so the role switch has nowhere to go.
+ * Neither case matters to `getTenantDb` in `@nebutra/db` (`src/client.ts`):
+ * it still carries its own copy of the RLS statements, closes the same gap
+ * with its own verification (`rls-role.ts`), and is unaffected either way.
+ *
+ * Not yet routed through here: `getTenantDb` in `@nebutra/db` (`src/client.ts`)
+ * still carries its own copy of these statements, with a
+ * `SET LOCAL statement_timeout` between the role switch and `set_config`. The
+ * P1.2 follow-up moves it onto `tenantSessionOperations`; until then that copy
+ * is the one other place these statements exist, and it must not gain siblings.
+ *
+ * This module imports nothing outside `@nebutra/tenant` (only `./types`, whose
+ * sole dependency is zod): `@nebutra/db` consumes it, and it must stay usable
+ * from any Prisma-like executor (interactive transaction, batch transaction, or
+ * a client extension).
+ */
+/** PostgreSQL session setting the RLS policies compare `tenant_id` against. */
+export declare const TENANT_SESSION_SETTING = "app.current_tenant_id";
+/**
+ * SQL expression the generated RLS policies use to read the tenant. The second
+ * argument (`missing_ok = true`) makes an unset session yield NULL — which the
+ * policy predicate then rejects — instead of raising.
+ */
+export declare const TENANT_SESSION_EXPRESSION = "current_setting('app.current_tenant_id', true)";
+/** True when `role` is a bare SQL identifier safe to interpolate into `SET LOCAL ROLE`. */
+export declare function isValidDbRole(role: unknown): role is string;
+/**
+ * Resolve the optional non-BYPASSRLS role tenant-scoped transactions assume —
+ * e.g. `app_user` on Supabase, whose `postgres` connection role bypasses RLS.
+ *
+ * Resolved at call time (not module load) so every wrapper sees the same
+ * environment and tests can exercise both shapes.
+ *
+ * @returns the validated role, or `null` when unset or not a bare identifier
+ */
+export declare function resolveRlsRole(env?: {
+    APP_DB_ROLE?: string | undefined;
+}): string | null;
+/**
+ * Resolve `APP_DB_ROLE` the way `resolveRlsRole` does, but fail closed:
+ * when it is set to something that is not a bare SQL identifier, throw
+ * `TenantIsolationError` instead of silently returning `null`.
+ *
+ * Closure P1.3 — `resolveRlsRole`'s null-on-invalid contract is what let an
+ * unusable `APP_DB_ROLE` disable RLS silently: every caller that treated
+ * `null` as "no role configured" ran the query as the connection's own
+ * (possibly BYPASSRLS) role instead of refusing. `resolveRlsRole` keeps that
+ * permissive contract for callers that genuinely want it (diagnostics,
+ * tooling); every tenant-scoped code path resolves the role through this
+ * function instead.
+ *
+ * @throws TenantIsolationError when `APP_DB_ROLE` is set but not a bare SQL
+ *   identifier.
+ */
+export declare function resolveRlsRoleOrThrow(env?: {
+    APP_DB_ROLE?: string | undefined;
+}): string | null;
+/**
+ * The subset of a Prisma client (or interactive-transaction client) the tenant
+ * session needs. `$executeRaw` is tagged-template only so `tenantId` is always
+ * bound as a parameter; `$executeRawUnsafe` carries the role switch, whose
+ * identifier is validated by `isValidDbRole` before it is interpolated.
+ */
+export interface TenantSessionExecutor {
+    $executeRaw: (query: TemplateStringsArray, ...values: unknown[]) => PromiseLike<number>;
+    $executeRawUnsafe?: ((query: string) => PromiseLike<number>) | undefined;
+}
+export interface TenantSessionOptions {
+    /**
+     * Role to assume before scoping the transaction.
+     *
+     * - `undefined` (default): resolve from `APP_DB_ROLE` via `resolveRlsRoleOrThrow()`
+     * - `null`: never switch role (admin / migration paths that must run as owner)
+     * - a string: use this validated identifier
+     */
+    role?: string | null | undefined;
+}
+/**
+ * Issue the tenant-session statements through `executor` and return them in
+ * order, without awaiting. Prisma promises are lazy, so the returned array can
+ * be spread into a batch `$transaction([...ops, query])` and will run inside
+ * that transaction, in order, ahead of the query.
+ */
+export declare function tenantSessionOperations(executor: TenantSessionExecutor, tenantId: string, options?: TenantSessionOptions): PromiseLike<number>[];
+/**
+ * Run the tenant-session statements sequentially on `executor` — an interactive
+ * transaction client — and resolve once the transaction is scoped to `tenantId`.
+ */
+export declare function applyTenantSession(executor: TenantSessionExecutor, tenantId: string, options?: TenantSessionOptions): Promise<void>;
+//# sourceMappingURL=rls-session.d.ts.map

package/dist/rls-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-session.d.ts","sourceRoot":"","sources":["../src/rls-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,mDAAuD,CAAC;AAQ9F,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,GAAG,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAgB,GACtD,MAAM,GAAG,IAAI,CAGf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAgB,GACtD,MAAM,GAAG,IAAI,CAaf;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC;IACxF,iBAAiB,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CAC1E;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAClC;AAoED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,GACjC,WAAW,CAAC,MAAM,CAAC,EAAE,CAGvB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/rls-session.js

@@ -0,0 +1,162 @@
+/**
+ * Tenant session core — how a PostgreSQL transaction is scoped to a tenant for
+ * row-level security, shared by both public wrappers:
+ *
+ *   - `withRls(prisma, tenantId)`              (`@nebutra/tenant/isolation`)
+ *   - `withTenantContext(prisma, tenantId, cb)` (`@nebutra/db/rls`)
+ *
+ * Both issue exactly the statements this module produces. The RLS policies
+ * (`generateRlsPolicySql`, migration `20260313000000_enable_rls`) read
+ * `current_setting('app.current_tenant_id', true)`; the wrappers write the same
+ * key through `set_config(..., true)`, so the value is transaction-local and
+ * cannot leak across pooled connections. Keeping the key and the statements
+ * here — rather than once per wrapper — is closure item P1.2: two copies of a
+ * security invariant drift, one copy cannot.
+ *
+ * Closure P1.3: an `APP_DB_ROLE` that is configured but unusable must refuse
+ * to run rather than quietly drop the role switch and execute as the
+ * connection's own (possibly BYPASSRLS) role. Two shapes of "unusable" are
+ * handled here — `resolveSessionRole` refuses a value that fails
+ * `isValidDbRole`, and `planTenantSession` refuses when the executor cannot
+ * run `$executeRawUnsafe` at all, so the role switch has nowhere to go.
+ * Neither case matters to `getTenantDb` in `@nebutra/db` (`src/client.ts`):
+ * it still carries its own copy of the RLS statements, closes the same gap
+ * with its own verification (`rls-role.ts`), and is unaffected either way.
+ *
+ * Not yet routed through here: `getTenantDb` in `@nebutra/db` (`src/client.ts`)
+ * still carries its own copy of these statements, with a
+ * `SET LOCAL statement_timeout` between the role switch and `set_config`. The
+ * P1.2 follow-up moves it onto `tenantSessionOperations`; until then that copy
+ * is the one other place these statements exist, and it must not gain siblings.
+ *
+ * This module imports nothing outside `@nebutra/tenant` (only `./types`, whose
+ * sole dependency is zod): `@nebutra/db` consumes it, and it must stay usable
+ * from any Prisma-like executor (interactive transaction, batch transaction, or
+ * a client extension).
+ */
+import { TenantIsolationError } from "./types.js";
+/** PostgreSQL session setting the RLS policies compare `tenant_id` against. */
+export const TENANT_SESSION_SETTING = "app.current_tenant_id";
+/**
+ * SQL expression the generated RLS policies use to read the tenant. The second
+ * argument (`missing_ok = true`) makes an unset session yield NULL — which the
+ * policy predicate then rejects — instead of raising.
+ */
+export const TENANT_SESSION_EXPRESSION = `current_setting('${TENANT_SESSION_SETTING}', true)`;
+/**
+ * A bare SQL identifier: the only shape `APP_DB_ROLE` may take, because
+ * `SET LOCAL ROLE` cannot be bind-parameterized and the role is interpolated.
+ */
+const DB_ROLE_PATTERN = /^[a-z_][a-z0-9_]*$/;
+/** True when `role` is a bare SQL identifier safe to interpolate into `SET LOCAL ROLE`. */
+export function isValidDbRole(role) {
+    return typeof role === "string" && DB_ROLE_PATTERN.test(role);
+}
+/**
+ * Resolve the optional non-BYPASSRLS role tenant-scoped transactions assume —
+ * e.g. `app_user` on Supabase, whose `postgres` connection role bypasses RLS.
+ *
+ * Resolved at call time (not module load) so every wrapper sees the same
+ * environment and tests can exercise both shapes.
+ *
+ * @returns the validated role, or `null` when unset or not a bare identifier
+ */
+export function resolveRlsRole(env = process.env) {
+    const role = env.APP_DB_ROLE;
+    return isValidDbRole(role) ? role : null;
+}
+/**
+ * Resolve `APP_DB_ROLE` the way `resolveRlsRole` does, but fail closed:
+ * when it is set to something that is not a bare SQL identifier, throw
+ * `TenantIsolationError` instead of silently returning `null`.
+ *
+ * Closure P1.3 — `resolveRlsRole`'s null-on-invalid contract is what let an
+ * unusable `APP_DB_ROLE` disable RLS silently: every caller that treated
+ * `null` as "no role configured" ran the query as the connection's own
+ * (possibly BYPASSRLS) role instead of refusing. `resolveRlsRole` keeps that
+ * permissive contract for callers that genuinely want it (diagnostics,
+ * tooling); every tenant-scoped code path resolves the role through this
+ * function instead.
+ *
+ * @throws TenantIsolationError when `APP_DB_ROLE` is set but not a bare SQL
+ *   identifier.
+ */
+export function resolveRlsRoleOrThrow(env = process.env) {
+    const role = env.APP_DB_ROLE;
+    if (role === undefined || role === "")
+        return null;
+    if (!isValidDbRole(role)) {
+        throw new TenantIsolationError(`APP_DB_ROLE is set to ${JSON.stringify(role)}, which is not a bare SQL identifier ` +
+            "(expected /^[a-z_][a-z0-9_]*$/). Refusing to run tenant-scoped queries: an invalid " +
+            "role would otherwise be skipped silently, running the query as the connection's own " +
+            "(possibly BYPASSRLS) role instead of under row-level security.", "shared_schema");
+    }
+    return role;
+}
+function resolveSessionRole(options) {
+    if (options.role === undefined) {
+        // Closure P1.3: fail closed on an unusable APP_DB_ROLE instead of the
+        // permissive `resolveRlsRole()` silently treating it as unset.
+        return resolveRlsRoleOrThrow();
+    }
+    if (options.role === null) {
+        return null;
+    }
+    if (!isValidDbRole(options.role)) {
+        throw new TenantIsolationError(`Tenant session role must be a bare SQL identifier (got ${JSON.stringify(options.role)})`, "shared_schema");
+    }
+    return options.role;
+}
+/**
+ * The ordered statement plan for scoping one transaction to `tenantId`:
+ *
+ *   1. `SET LOCAL ROLE "<role>"` — only when a role is configured, so the
+ *      tenant setting below (and every query after it) runs as the
+ *      non-BYPASSRLS role rather than the connection owner.
+ *   2. `SELECT set_config('app.current_tenant_id', $1, true)` — transaction-local
+ *      (`true`), so it is cleared when the transaction commits or rolls back.
+ *
+ * A role is refused, not skipped, when the executor cannot run
+ * `$executeRawUnsafe`: closure P1.3 turned the pre-merge `withRls` behaviour
+ * (silently skip the role switch) into a refusal, since skipping it here
+ * means the query after it runs as the connection's own role instead of the
+ * one `APP_DB_ROLE` configured.
+ */
+function planTenantSession(executor, tenantId, role) {
+    const plan = [];
+    if (role) {
+        const switchRole = executor.$executeRawUnsafe;
+        if (typeof switchRole !== "function") {
+            throw new TenantIsolationError(`APP_DB_ROLE is set to ${JSON.stringify(role)}, but this executor cannot run ` +
+                "$executeRawUnsafe to SET LOCAL ROLE. Refusing to run tenant-scoped queries: " +
+                "skipping the role switch would run them as the connection's own (possibly " +
+                "BYPASSRLS) role instead of under row-level security.", "shared_schema");
+        }
+        // `role` matched DB_ROLE_PATTERN, so it is safe to interpolate — SET LOCAL
+        // ROLE cannot take a bind parameter.
+        plan.push(() => switchRole.call(executor, `SET LOCAL ROLE "${role}"`));
+    }
+    // transaction-local: cleared automatically when the transaction ends.
+    plan.push(() => executor.$executeRaw `SELECT set_config('app.current_tenant_id', ${tenantId}, true)`);
+    return plan;
+}
+/**
+ * Issue the tenant-session statements through `executor` and return them in
+ * order, without awaiting. Prisma promises are lazy, so the returned array can
+ * be spread into a batch `$transaction([...ops, query])` and will run inside
+ * that transaction, in order, ahead of the query.
+ */
+export function tenantSessionOperations(executor, tenantId, options = {}) {
+    const role = resolveSessionRole(options);
+    return planTenantSession(executor, tenantId, role).map((statement) => statement());
+}
+/**
+ * Run the tenant-session statements sequentially on `executor` — an interactive
+ * transaction client — and resolve once the transaction is scoped to `tenantId`.
+ */
+export async function applyTenantSession(executor, tenantId, options = {}) {
+    const role = resolveSessionRole(options);
+    for (const statement of planTenantSession(executor, tenantId, role)) {
+        await statement();
+    }
+}

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@nebutra/tenant",
-  "version": "0.1.3",
+  "version": "3.0.0",
   "private": false,
   "license": "MIT",
   "type": "module",
   "nebutra": {
+    "graph": "core",
     "status": "foundation",
     "productionReady": false,
     "requires": [
@@ -44,9 +45,19 @@
   ],
   "dependencies": {
     "zod": "^4.3.6",
-    "@nebutra/logger": "0.1.2"
+    "@nebutra/logger": "3.0.0"
+  },
+  "peerDependencies": {
+    "react": "^18.0.0 || ^19.0.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
   },
   "devDependencies": {
+    "@types/react": "^19.0.0",
+    "react": "^19.0.0",
     "vitest": "^4.1.4",
     "typescript": "^5.9.3"
   },