@nylorun/runtime 0.10.0-beta → 0.11.0-beta

package/dist/store/postgres/connect.d.ts

@@ -0,0 +1,25 @@
+import { type Sql } from "postgres";
+export type PostgresClient = Sql;
+export interface PostgresClientOptions {
+    /** Pool size. Default 10. */
+    max?: number;
+    /** Seconds before an idle connection closes. Default 30. */
+    idleTimeoutSeconds?: number;
+    /** Seconds to wait for a connection. Default 10. */
+    connectTimeoutSeconds?: number;
+    /** `application_name` on every connection. Default `nylorun-runtime`. */
+    applicationName?: string;
+}
+/**
+ * Opens a connection pool for Session Stores and the Tenant catalog. One pool
+ * serves every Tenant schema of a Host; stores never end it, so the caller
+ * calls `client.end()` at shutdown. This module and its siblings are the only
+ * code that imports the Postgres driver (seam rule 3).
+ *
+ * Statements are not prepared (`prepare: false`). Every statement names its
+ * Tenant's schema, so the same query is a different statement per Tenant, and
+ * named prepared statements would pile up on every pooled connection with the
+ * number of Tenants a Host serves. Unnamed statements still go in one round
+ * trip; the queries are simple enough that re-planning them costs little.
+ */
+export declare function createPostgresClient(url: string, options?: PostgresClientOptions): PostgresClient;

package/dist/store/postgres/connect.js

@@ -0,0 +1,25 @@
+import postgres, {} from "postgres";
+/**
+ * Opens a connection pool for Session Stores and the Tenant catalog. One pool
+ * serves every Tenant schema of a Host; stores never end it, so the caller
+ * calls `client.end()` at shutdown. This module and its siblings are the only
+ * code that imports the Postgres driver (seam rule 3).
+ *
+ * Statements are not prepared (`prepare: false`). Every statement names its
+ * Tenant's schema, so the same query is a different statement per Tenant, and
+ * named prepared statements would pile up on every pooled connection with the
+ * number of Tenants a Host serves. Unnamed statements still go in one round
+ * trip; the queries are simple enough that re-planning them costs little.
+ */
+export function createPostgresClient(url, options = {}) {
+    return postgres(url, {
+        max: options.max ?? 10,
+        idle_timeout: options.idleTimeoutSeconds ?? 30,
+        connect_timeout: options.connectTimeoutSeconds ?? 10,
+        prepare: false,
+        onnotice: () => { },
+        connection: {
+            application_name: options.applicationName ?? "nylorun-runtime",
+        },
+    });
+}

package/dist/store/postgres/locking.d.ts

@@ -0,0 +1,16 @@
+import type { SessionDoc, StoredSession, Tx } from "../types.js";
+/**
+ * Locks several sessions in one transaction without risking a deadlock.
+ *
+ * Postgres row locks are taken in the order statements run. Two transactions
+ * that lock sessions `a` then `b` and `b` then `a` can deadlock, and Postgres
+ * aborts one with `40P01`. Every transaction that touches more than one
+ * session therefore locks all of them first, in ascending id order (UTF-16
+ * code unit order, the same order `lockSessions` uses everywhere), and only
+ * then writes. Duplicate ids are locked once.
+ *
+ * Returns each id's session, or undefined when it does not exist.
+ */
+export declare function lockSessions<T extends SessionDoc = SessionDoc>(t: Tx, ids: Iterable<string>): Promise<Map<string, StoredSession<T> | undefined>>;
+/** The order `lockSessions` locks in: unique ids, ascending. */
+export declare function lockOrder(ids: Iterable<string>): string[];

package/dist/store/postgres/locking.js

@@ -0,0 +1,22 @@
+/**
+ * Locks several sessions in one transaction without risking a deadlock.
+ *
+ * Postgres row locks are taken in the order statements run. Two transactions
+ * that lock sessions `a` then `b` and `b` then `a` can deadlock, and Postgres
+ * aborts one with `40P01`. Every transaction that touches more than one
+ * session therefore locks all of them first, in ascending id order (UTF-16
+ * code unit order, the same order `lockSessions` uses everywhere), and only
+ * then writes. Duplicate ids are locked once.
+ *
+ * Returns each id's session, or undefined when it does not exist.
+ */
+export async function lockSessions(t, ids) {
+    const locked = new Map();
+    for (const id of lockOrder(ids))
+        locked.set(id, await t.lockSession(id));
+    return locked;
+}
+/** The order `lockSessions` locks in: unique ids, ascending. */
+export function lockOrder(ids) {
+    return [...new Set(ids)].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+}

package/dist/store/postgres/migrations/001_initial.d.ts

@@ -0,0 +1,27 @@
+import type { Migration } from "./index.js";
+/**
+ * The first Postgres Tenant schema.
+ *
+ * - `tenant` holds the Tenant envelope (one row).
+ * - Document tables keep `id text primary key, body json`. The fields typed
+ *   queries filter on are stored generated columns with indexes. Ids and
+ *   timestamps compared as text use `COLLATE "C"`, so ordering is by code
+ *   point, like the in-memory fake, whatever the database collation.
+ * - Bodies are `json`, not `jsonb`, so every string round-trips exactly as
+ *   `JSON.stringify` wrote it. `jsonb` rejects the escapes `\u0000` (`22P05`)
+ *   and unpaired surrogates (`\ud800`), which tool output can contain and
+ *   which the in-memory store accepts. `json` stores the text
+ *   verbatim and checks only its syntax. The generated columns read the body
+ *   through `doc(body)`, which casts to `jsonb` after replacing those two
+ *   escapes with `\ufffd`: the stored body is untouched, and only an indexed
+ *   field that itself contained one (never an id, status or timestamp) would
+ *   see U+FFFD. Bodies with no `\u` escape at all take the plain cast. Queries
+ *   never apply `->`/`->>` to a `json` body (Postgres de-escapes the whole text
+ *   and fails on the same escapes); they read generated columns.
+ * - `sessions` carries the store-managed `next_event_seq` and ownership
+ *   columns (`owner`, `epoch`, `owner_expires_at`), which are never in `body`.
+ * - `outbox(session_id, seq, body)` holds committed, unrelayed events.
+ * - Executors, principals, vault and settings keep typed columns. Vault
+ *   ciphertext is `bytea` columns, never inside a JSON body.
+ */
+export declare const initial: Migration;

package/dist/store/postgres/migrations/001_initial.js

@@ -0,0 +1,196 @@
+/**
+ * The first Postgres Tenant schema.
+ *
+ * - `tenant` holds the Tenant envelope (one row).
+ * - Document tables keep `id text primary key, body json`. The fields typed
+ *   queries filter on are stored generated columns with indexes. Ids and
+ *   timestamps compared as text use `COLLATE "C"`, so ordering is by code
+ *   point, like the in-memory fake, whatever the database collation.
+ * - Bodies are `json`, not `jsonb`, so every string round-trips exactly as
+ *   `JSON.stringify` wrote it. `jsonb` rejects the escapes `\u0000` (`22P05`)
+ *   and unpaired surrogates (`\ud800`), which tool output can contain and
+ *   which the in-memory store accepts. `json` stores the text
+ *   verbatim and checks only its syntax. The generated columns read the body
+ *   through `doc(body)`, which casts to `jsonb` after replacing those two
+ *   escapes with `\ufffd`: the stored body is untouched, and only an indexed
+ *   field that itself contained one (never an id, status or timestamp) would
+ *   see U+FFFD. Bodies with no `\u` escape at all take the plain cast. Queries
+ *   never apply `->`/`->>` to a `json` body (Postgres de-escapes the whole text
+ *   and fails on the same escapes); they read generated columns.
+ * - `sessions` carries the store-managed `next_event_seq` and ownership
+ *   columns (`owner`, `epoch`, `owner_expires_at`), which are never in `body`.
+ * - `outbox(session_id, seq, body)` holds committed, unrelayed events.
+ * - Executors, principals, vault and settings keep typed columns. Vault
+ *   ciphertext is `bytea` columns, never inside a JSON body.
+ */
+export const initial = {
+    version: 1,
+    name: "initial",
+    up: (s) => `
+    CREATE FUNCTION ${s}.doc(body json) RETURNS jsonb
+    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS $$
+      SELECT CASE WHEN strpos(body::text, '\\u') = 0 THEN body::jsonb
+        ELSE regexp_replace(
+          body::text,
+          '(?<!\\\\)((?:\\\\\\\\)*)\\\\u(0000|[dD][89a-fA-F][0-9a-fA-F]{2})',
+          '\\1\\\\ufffd',
+          'g'
+        )::jsonb
+      END
+    $$;
+
+    CREATE TABLE ${s}.tenant (
+      id text COLLATE "C" PRIMARY KEY,
+      name text NOT NULL,
+      created_at text NOT NULL,
+      updated_at text NOT NULL,
+      schema_version integer NOT NULL,
+      singleton boolean NOT NULL DEFAULT true UNIQUE CHECK (singleton)
+    );
+
+    CREATE TABLE ${s}.definitions (
+      id text COLLATE "C" PRIMARY KEY,
+      body json NOT NULL
+    );
+
+    CREATE TABLE ${s}.sessions (
+      id text COLLATE "C" PRIMARY KEY,
+      body json NOT NULL,
+      status text GENERATED ALWAYS AS (${s}.doc(body)->>'status') STORED,
+      agent_id text GENERATED ALWAYS AS (${s}.doc(body)->>'agentId') STORED,
+      stream_incarnation text GENERATED ALWAYS AS (${s}.doc(body)->>'streamIncarnation') STORED,
+      next_event_seq bigint NOT NULL DEFAULT 0,
+      owner text,
+      epoch bigint NOT NULL DEFAULT 0,
+      owner_expires_at timestamptz
+    );
+    CREATE INDEX sessions_status ON ${s}.sessions (status, owner_expires_at);
+    CREATE INDEX sessions_agent ON ${s}.sessions (agent_id);
+
+    CREATE TABLE ${s}.commands (
+      id text COLLATE "C" PRIMARY KEY,
+      body json NOT NULL
+    );
+
+    CREATE TABLE ${s}.checkpoints (
+      id text COLLATE "C" PRIMARY KEY,
+      body json NOT NULL
+    );
+
+    CREATE TABLE ${s}.effects (
+      id text COLLATE "C" PRIMARY KEY,
+      body json NOT NULL,
+      session_id text GENERATED ALWAYS AS (${s}.doc(body)->'request'->>'sessionId') STORED,
+      turn_id text GENERATED ALWAYS AS (${s}.doc(body)->'request'->>'turnId') STORED,
+      kind text GENERATED ALWAYS AS (${s}.doc(body)->'request'->>'kind') STORED,
+      status text GENERATED ALWAYS AS (${s}.doc(body)->>'status') STORED
+    );
+    CREATE INDEX effects_session ON ${s}.effects (session_id, turn_id, status);
+    CREATE INDEX effects_status ON ${s}.effects (status, kind);
+
+    CREATE TABLE ${s}.actions (
+      id text COLLATE "C" PRIMARY KEY,
+      body json NOT NULL,
+      session_id text GENERATED ALWAYS AS (${s}.doc(body)->>'sessionId') STORED,
+      turn_id text GENERATED ALWAYS AS (${s}.doc(body)->>'turnId') STORED,
+      agent_id text GENERATED ALWAYS AS (${s}.doc(body)->>'agentId') STORED,
+      status text GENERATED ALWAYS AS (${s}.doc(body)->>'status') STORED,
+      kind text GENERATED ALWAYS AS (${s}.doc(body)->>'kind') STORED,
+      lease_expires_at text GENERATED ALWAYS AS (${s}.doc(body)->>'leaseExpiresAt') STORED
+    );
+    CREATE INDEX actions_session ON ${s}.actions (session_id, turn_id, status);
+    CREATE INDEX actions_agent ON ${s}.actions (agent_id, status);
+    CREATE INDEX actions_status ON ${s}.actions (status, kind);
+    CREATE INDEX actions_lease ON ${s}.actions (status, lease_expires_at);
+
+    CREATE TABLE ${s}.sandboxes (
+      id text COLLATE "C" PRIMARY KEY,
+      body json NOT NULL
+    );
+
+    CREATE TABLE ${s}.links (
+      id text COLLATE "C" PRIMARY KEY,
+      body json NOT NULL,
+      workflow_session_id text GENERATED ALWAYS AS (${s}.doc(body)->>'workflowSessionId') STORED
+    );
+    CREATE INDEX links_workflow ON ${s}.links (workflow_session_id);
+
+    CREATE TABLE ${s}.outbox (
+      session_id text COLLATE "C" NOT NULL,
+      seq bigint NOT NULL,
+      body json NOT NULL,
+      created_at text COLLATE "C" GENERATED ALWAYS AS (${s}.doc(body)->>'createdAt') STORED,
+      PRIMARY KEY (session_id, seq)
+    );
+
+    CREATE TABLE ${s}.executors (
+      agent_id text COLLATE "C" PRIMARY KEY,
+      token_hash text NOT NULL UNIQUE,
+      implementation_version text NOT NULL,
+      manifest_hash text,
+      principal_id text,
+      created_at text NOT NULL,
+      updated_at text NOT NULL
+    );
+
+    CREATE TABLE ${s}.principals (
+      id text COLLATE "C" PRIMARY KEY,
+      role text NOT NULL,
+      token_hash text NOT NULL UNIQUE,
+      idempotency_key text,
+      created_at text NOT NULL
+    );
+
+    CREATE TABLE ${s}.vaults (
+      id text COLLATE "C" PRIMARY KEY,
+      name text NOT NULL,
+      owner_user_id text NOT NULL,
+      metadata_json text,
+      created_at text COLLATE "C" NOT NULL,
+      scope text NOT NULL DEFAULT 'user' CHECK (scope IN ('user', 'host'))
+    );
+    CREATE INDEX vaults_owner ON ${s}.vaults (owner_user_id, created_at, id);
+    CREATE UNIQUE INDEX vaults_one_host ON ${s}.vaults (scope) WHERE scope = 'host';
+
+    CREATE TABLE ${s}.vault_credentials (
+      id text COLLATE "C" PRIMARY KEY,
+      vault_id text NOT NULL REFERENCES ${s}.vaults (id) ON DELETE CASCADE,
+      name text NOT NULL,
+      type text NOT NULL,
+      binding_json text NOT NULL,
+      expires_at text,
+      created_at text COLLATE "C" NOT NULL,
+      rotated_at text,
+      kek_id text NOT NULL,
+      nonce bytea NOT NULL,
+      ciphertext bytea NOT NULL,
+      wrapped_dek bytea NOT NULL
+    );
+    CREATE INDEX vault_credentials_vault ON ${s}.vault_credentials (vault_id, created_at, id);
+
+    CREATE TABLE ${s}.vault_audit (
+      ord bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+      id text NOT NULL UNIQUE,
+      at text NOT NULL,
+      actor text NOT NULL,
+      action text NOT NULL,
+      vault_id text,
+      credential_id text,
+      session_id text,
+      target text,
+      outcome text NOT NULL
+    );
+    CREATE INDEX vault_audit_vault ON ${s}.vault_audit (vault_id, ord);
+
+    CREATE TABLE ${s}.vault_idempotency (
+      id text PRIMARY KEY,
+      body_hash text NOT NULL,
+      response text NOT NULL
+    );
+
+    CREATE TABLE ${s}.tenant_settings (
+      key text PRIMARY KEY,
+      value text NOT NULL
+    );
+  `,
+};

package/dist/store/postgres/migrations/index.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Forward-only, numbered migrations of one Tenant schema (architecture §14.6).
+ *
+ * Each schema records what it has applied in `<schema>.schema_version`, one
+ * row per migration; its version is the highest row. Migrating runs every
+ * missing step in order, in the caller's transaction, under a transaction-level
+ * advisory lock on the schema so two processes never migrate the same schema
+ * at once. A schema newer than the Runtime is never touched: migrating it
+ * throws a `schema-too-new` quarantine and the Tenant is quarantined.
+ *
+ * Adding a migration: append `NNN_name.ts` with the next version to
+ * `MIGRATIONS`. Never edit or reorder an applied migration.
+ */
+import type { Sql, TransactionSql } from "postgres";
+export interface Migration {
+    /** 1, 2, 3, … without gaps. */
+    version: number;
+    name: string;
+    /** DDL for the quoted schema name `s` (for example `"tenant_tn_…"`). */
+    up(s: string): string;
+}
+export declare const MIGRATIONS: readonly Migration[];
+/** The schema version this Runtime writes and expects. */
+export declare const POSTGRES_SCHEMA_VERSION: number;
+/** Checks that versions run 1, 2, 3, … Throws otherwise. */
+export declare function assertMigrations(migrations: readonly Migration[]): void;
+/** Takes the schema's migration lock until the transaction ends. */
+export declare function lockSchema(tx: TransactionSql, schema: string): Promise<void>;
+export declare function schemaExists(sql: Sql | TransactionSql, schema: string): Promise<boolean>;
+/**
+ * The schema's version: 0 when it exists without a `schema_version` table,
+ * undefined when the schema does not exist.
+ */
+export declare function readSchemaVersion(sql: Sql | TransactionSql, schema: string): Promise<number | undefined>;
+/**
+ * Creates the schema when missing and applies every missing migration, inside
+ * `tx`. Call `lockSchema` first when other processes may migrate concurrently
+ * (`migrateSchema` does). Throws a `schema-too-new` `QuarantineError` when the
+ * schema is ahead of `migrations`.
+ */
+export declare function migrateSchemaInTx(tx: TransactionSql, schema: string, migrations?: readonly Migration[]): Promise<{
+    from: number;
+    to: number;
+}>;
+/** `migrateSchemaInTx` in its own transaction, under the schema's migration lock. */
+export declare function migrateSchema(sql: Sql, schema: string, migrations?: readonly Migration[]): Promise<{
+    from: number;
+    to: number;
+}>;

package/dist/store/postgres/migrations/index.js

@@ -0,0 +1,75 @@
+import { quarantine } from "../../../tenant/quarantine.js";
+import { quoteIdentifier, tenantIdFromSchema } from "../names.js";
+import { initial } from "./001_initial.js";
+export const MIGRATIONS = [initial];
+/** The schema version this Runtime writes and expects. */
+export const POSTGRES_SCHEMA_VERSION = MIGRATIONS.at(-1).version;
+/** Checks that versions run 1, 2, 3, … Throws otherwise. */
+export function assertMigrations(migrations) {
+    migrations.forEach((migration, index) => {
+        if (migration.version !== index + 1)
+            throw new Error(`Migration ${migration.name} has version ${migration.version}, expected ${index + 1}`);
+    });
+}
+/** Takes the schema's migration lock until the transaction ends. */
+export async function lockSchema(tx, schema) {
+    await tx `SELECT pg_advisory_xact_lock(hashtextextended(${`nylorun.schema:${schema}`}, 0))`;
+}
+export async function schemaExists(sql, schema) {
+    const rows = await sql `SELECT 1 FROM pg_namespace WHERE nspname = ${schema}`;
+    return rows.length > 0;
+}
+/**
+ * The schema's version: 0 when it exists without a `schema_version` table,
+ * undefined when the schema does not exist.
+ */
+export async function readSchemaVersion(sql, schema) {
+    const [row] = await sql `
+    SELECT
+      EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${schema}) AS has_schema,
+      to_regclass(${`${quoteIdentifier(schema)}.schema_version`}) IS NOT NULL AS has_table`;
+    if (!row.has_schema)
+        return undefined;
+    if (!row.has_table)
+        return 0;
+    const [version] = await sql `
+    SELECT max(version)::int AS version FROM ${sql(`${schema}.schema_version`)}`;
+    return version?.version ?? 0;
+}
+/**
+ * Creates the schema when missing and applies every missing migration, inside
+ * `tx`. Call `lockSchema` first when other processes may migrate concurrently
+ * (`migrateSchema` does). Throws a `schema-too-new` `QuarantineError` when the
+ * schema is ahead of `migrations`.
+ */
+export async function migrateSchemaInTx(tx, schema, migrations = MIGRATIONS) {
+    assertMigrations(migrations);
+    const s = quoteIdentifier(schema);
+    const latest = migrations.length;
+    await tx.unsafe(`
+    CREATE SCHEMA IF NOT EXISTS ${s};
+    CREATE TABLE IF NOT EXISTS ${s}.schema_version (
+      version integer PRIMARY KEY,
+      name text NOT NULL,
+      applied_at timestamptz NOT NULL DEFAULT now()
+    );`);
+    const from = (await readSchemaVersion(tx, schema)) ?? 0;
+    if (from > latest)
+        throw quarantine("schema-too-new", `Tenant schema version ${from} is newer than this Runtime's ${latest}`, { tenantId: tenantIdFromSchema(schema) ?? schema });
+    for (const migration of migrations.slice(from)) {
+        await tx.unsafe(migration.up(s));
+        await tx `INSERT INTO ${tx(`${schema}.schema_version`)} (version, name)
+             VALUES (${migration.version}, ${migration.name})`;
+    }
+    if (from < latest)
+        await tx `UPDATE ${tx(`${schema}.tenant`)} SET schema_version = ${latest}`;
+    return { from, to: latest };
+}
+/** `migrateSchemaInTx` in its own transaction, under the schema's migration lock. */
+export async function migrateSchema(sql, schema, migrations = MIGRATIONS) {
+    const result = await sql.begin(async (tx) => {
+        await lockSchema(tx, schema);
+        return { result: await migrateSchemaInTx(tx, schema, migrations) };
+    });
+    return result.result;
+}

package/dist/store/postgres/names.d.ts

@@ -0,0 +1,11 @@
+export declare const TENANT_SCHEMA_PREFIX = "tenant_";
+/** Postgres truncates identifiers longer than NAMEDATALEN - 1 bytes. */
+export declare const MAX_IDENTIFIER_BYTES = 63;
+/** The schema holding `tenantId`'s Session Store. Throws on an invalid id. */
+export declare function tenantSchemaName(tenantId: string): string;
+/** The Tenant id a schema name encodes, or undefined when it is not a Tenant schema. */
+export declare function tenantIdFromSchema(schema: string): string | undefined;
+/** Rejects names Postgres would truncate or that could not be quoted safely. */
+export declare function assertIdentifier(name: string): void;
+/** `"name"`, for SQL text built outside a tagged template (migrations). */
+export declare function quoteIdentifier(name: string): string;

package/dist/store/postgres/names.js

@@ -0,0 +1,42 @@
+/**
+ * Tenant id ↔ Postgres schema name (architecture §8.1, §12.2).
+ *
+ * A Tenant's Session Store is the schema `"tenant_<id>"`, for example
+ * `tn_01k8z3…` ↦ `"tenant_tn_01k8z3…"`. Tenant ids match
+ * `^tn_[0-9a-hjkmnp-tv-z]{26}$` (lowercase ASCII), so the name is 36 bytes,
+ * under Postgres' 63-byte identifier limit, and needs no case folding. It is
+ * always written quoted. The mapping is total and reversible: a schema that
+ * starts with `tenant_` but does not decode to a valid Tenant id is not a
+ * Tenant.
+ */
+import { isTenantId } from "@nylorun/core/compatibility";
+export const TENANT_SCHEMA_PREFIX = "tenant_";
+/** Postgres truncates identifiers longer than NAMEDATALEN - 1 bytes. */
+export const MAX_IDENTIFIER_BYTES = 63;
+/** The schema holding `tenantId`'s Session Store. Throws on an invalid id. */
+export function tenantSchemaName(tenantId) {
+    if (!isTenantId(tenantId))
+        throw new Error(`Invalid tenant id: ${tenantId}`);
+    const schema = `${TENANT_SCHEMA_PREFIX}${tenantId}`;
+    assertIdentifier(schema);
+    return schema;
+}
+/** The Tenant id a schema name encodes, or undefined when it is not a Tenant schema. */
+export function tenantIdFromSchema(schema) {
+    if (!schema.startsWith(TENANT_SCHEMA_PREFIX))
+        return undefined;
+    const id = schema.slice(TENANT_SCHEMA_PREFIX.length);
+    return isTenantId(id) ? id : undefined;
+}
+/** Rejects names Postgres would truncate or that could not be quoted safely. */
+export function assertIdentifier(name) {
+    if (name.length === 0 ||
+        Buffer.byteLength(name, "utf8") > MAX_IDENTIFIER_BYTES ||
+        !/^[a-z_][a-z0-9_]*$/.test(name))
+        throw new Error(`Invalid Postgres identifier: ${name}`);
+}
+/** `"name"`, for SQL text built outside a tagged template (migrations). */
+export function quoteIdentifier(name) {
+    assertIdentifier(name);
+    return `"${name}"`;
+}

package/dist/store/postgres/store.d.ts

@@ -0,0 +1,11 @@
+import type { Sql } from "postgres";
+import type { SessionStore, SessionStoreOptions } from "../types.js";
+export interface PostgresSessionStoreOptions extends SessionStoreOptions {
+    /** The shared pool. The store never ends it. */
+    sql: Sql;
+    /** The Tenant schema. Defaults to `tenantSchemaName(tenantId)`. */
+    schema?: string;
+    /** The version `health()` expects. Defaults to `POSTGRES_SCHEMA_VERSION`. */
+    schemaVersion?: number;
+}
+export declare function createPostgresSessionStore(options: PostgresSessionStoreOptions): SessionStore;