@prisma-next/extension-supabase 0.13.0 → 0.14.0-dev.10

package/src/contract/contract.json

@@ -37,7 +37,7 @@
               "id": {
                 "nullable": false,
                 "type": {
-                  "codecId": "pg/text@1",
+                  "codecId": "pg/uuid@1",
                   "kind": "scalar"
                 }
               },
@@ -58,7 +58,7 @@
               "user_id": {
                 "nullable": false,
                 "type": {
-                  "codecId": "pg/text@1",
+                  "codecId": "pg/uuid@1",
                   "kind": "scalar"
                 }
               }
@@ -105,7 +105,7 @@
               "id": {
                 "nullable": false,
                 "type": {
-                  "codecId": "pg/text@1",
+                  "codecId": "pg/uuid@1",
                   "kind": "scalar"
                 }
               },
@@ -211,7 +211,7 @@
               "id": {
                 "nullable": false,
                 "type": {
-                  "codecId": "pg/text@1",
+                  "codecId": "pg/uuid@1",
                   "kind": "scalar"
                 }
               },
@@ -259,13 +259,6 @@
   },
   "storage": {
     "namespaces": {
-      "__unbound__": {
-        "entries": {
-          "table": {}
-        },
-        "id": "__unbound__",
-        "kind": "postgres-unbound-schema"
-      },
       "auth": {
         "entries": {
           "table": {
@@ -278,7 +271,7 @@
                   "typeRef": "Timestamptz"
                 },
                 "id": {
-                  "codecId": "pg/text@1",
+                  "codecId": "pg/uuid@1",
                   "nativeType": "uuid",
                   "nullable": false,
                   "typeRef": "Uuid"
@@ -295,7 +288,7 @@
                   "typeRef": "Timestamptz"
                 },
                 "user_id": {
-                  "codecId": "pg/text@1",
+                  "codecId": "pg/uuid@1",
                   "nativeType": "uuid",
                   "nullable": false,
                   "typeRef": "Uuid"
@@ -324,7 +317,7 @@
                   "nullable": false
                 },
                 "id": {
-                  "codecId": "pg/text@1",
+                  "codecId": "pg/uuid@1",
                   "nativeType": "uuid",
                   "nullable": false,
                   "typeRef": "Uuid"
@@ -408,7 +401,7 @@
                   "typeRef": "Timestamptz"
                 },
                 "id": {
-                  "codecId": "pg/text@1",
+                  "codecId": "pg/uuid@1",
                   "nativeType": "uuid",
                   "nullable": false,
                   "typeRef": "Uuid"
@@ -440,7 +433,7 @@
         "kind": "postgres-schema"
       }
     },
-    "storageHash": "sha256:a92ac18f82eb73f747fa9512351caec3e42df1a1a897bce787966af84371638c",
+    "storageHash": "sha256:61dac13aa56bcb5b7f1c5441c2bd8fc07d88f6c870c80b4c1640fd0d180fb423",
     "types": {
       "Timestamptz": {
         "codecId": "pg/timestamptz@1",
@@ -448,7 +441,7 @@
         "nativeType": "timestamptz"
       },
       "Uuid": {
-        "codecId": "pg/text@1",
+        "codecId": "pg/uuid@1",
         "kind": "codec-instance",
         "nativeType": "uuid"
       }

package/src/exports/runtime.ts

@@ -1,31 +1,19 @@
-/**
- * Minimal M1 runtime descriptor for the Supabase extension.
- *
- * The Supabase pack contributes no runtime codec types or query operations in
- * M1 — `auth.*`/`storage.*` are external tables accessed via the stock
- * postgres runtime, not through a custom codec or operation surface. This
- * descriptor exists so the postgres runtime's contract-requirements check
- * (which verifies every `extensionPacks` entry in the emitted `contract.json`
- * has a matching runtime component) passes.
- *
- * TODO(M2): Replace with the real SupabaseRuntime that adds
- *   `asUser()`/`asAnon()` role-binding and the Supabase auth surface.
- */
-import type { SqlRuntimeExtensionDescriptor } from '@prisma-next/sql-runtime';
-
-const supabaseRuntimeDescriptor: SqlRuntimeExtensionDescriptor<'postgres'> = {
-  kind: 'extension' as const,
-  id: 'supabase',
-  version: '0.12.0',
-  familyId: 'sql' as const,
-  targetId: 'postgres' as const,
-  codecs: () => [],
-  create() {
-    return {
-      familyId: 'sql' as const,
-      targetId: 'postgres' as const,
-    };
-  },
-};
+import { supabaseRuntimeDescriptor } from '../runtime/descriptor';
 
 export default supabaseRuntimeDescriptor;
+
+export type {
+  RoleBoundDb,
+  SupabaseDb,
+  SupabaseOptions,
+  SupabaseOptionsWithContract,
+  SupabaseOptionsWithContractJson,
+  SupabaseTargetId,
+} from '../runtime/supabase';
+export { default as supabase, InvalidJwtError, SupabaseConfigError } from '../runtime/supabase';
+export type {
+  RoleSession,
+  SupabaseRoleBinding,
+  SupabaseRuntime,
+} from '../runtime/supabase-runtime';
+export { SupabaseRuntimeImpl } from '../runtime/supabase-runtime';

package/src/runtime/descriptor.ts

@@ -0,0 +1,26 @@
+import type { SqlRuntimeExtensionDescriptor } from '@prisma-next/sql-runtime';
+import packageJson from '../../package.json' with { type: 'json' };
+
+/**
+ * Tells the runtime that the Supabase pack's runtime component is available.
+ *
+ * When a contract declares the Supabase pack, the runtime checks that a
+ * matching descriptor has been registered. Without this, loading a Supabase
+ * contract errors with "pack runtime component missing". The `supabase()`
+ * factory registers this descriptor automatically — app code never needs to
+ * reference it directly.
+ */
+export const supabaseRuntimeDescriptor: SqlRuntimeExtensionDescriptor<'postgres'> = {
+  kind: 'extension' as const,
+  id: 'supabase',
+  version: packageJson.version,
+  familyId: 'sql' as const,
+  targetId: 'postgres' as const,
+  codecs: () => [],
+  create() {
+    return {
+      familyId: 'sql' as const,
+      targetId: 'postgres' as const,
+    };
+  },
+};

package/src/runtime/supabase-runtime.ts

@@ -0,0 +1,171 @@
+import type { Contract } from '@prisma-next/contract/types';
+import type { RuntimeExecuteOptions } from '@prisma-next/framework-components/runtime';
+import { AsyncIterableResult } from '@prisma-next/framework-components/runtime';
+import { type PostgresRuntime, PostgresRuntimeImpl } from '@prisma-next/postgres/runtime';
+import type { SqlStorage } from '@prisma-next/sql-contract/types';
+import type { SqlExecutionPlan, SqlQueryPlan } from '@prisma-next/sql-relational-core/plan';
+import type {
+  PreparedStatement,
+  PreparedStatementImpl,
+  RuntimeConnection,
+  RuntimeTransaction,
+} from '@prisma-next/sql-runtime';
+import { blindCast } from '@prisma-next/utils/casts';
+
+export interface SupabaseRuntime extends PostgresRuntime {}
+
+export interface SupabaseRoleBinding {
+  // TODO(TML-2501): role names move to the Supabase extension contract (roles as first-class IR) when postgres-rls lands.
+  readonly role: 'anon' | 'authenticated' | 'service_role';
+  readonly claims?: Record<string, unknown>;
+}
+
+/**
+ * A connection with a Supabase role already bound via session-scoped set_config.
+ * Implements `RuntimeConnection` so it plugs into ORM scope machinery and `withTransaction`.
+ */
+export interface RoleSession extends RuntimeConnection {}
+
+export class SupabaseRuntimeImpl<
+  TContract extends Contract<SqlStorage> = Contract<SqlStorage>,
+> extends PostgresRuntimeImpl<TContract> {
+  /**
+   * Opens a raw connection and applies role + JWT claims via session-scoped set_config.
+   * On bind failure, destroys the connection before rethrowing — no leaked connections.
+   * Not on the `SupabaseRuntime` interface; consumed by the facade, not by app code.
+   */
+  async openRoleSession(binding: SupabaseRoleBinding): Promise<RoleSession> {
+    const conn = await this.acquireRawConnection();
+
+    try {
+      await conn.query('SELECT set_config($1, $2, false)', ['role', binding.role]);
+      await conn.query('SELECT set_config($1, $2, false)', [
+        'request.jwt.claims',
+        JSON.stringify(binding.claims ?? {}),
+      ]);
+    } catch (err) {
+      await conn.destroy(err).catch(() => undefined);
+      throw err;
+    }
+
+    const self = this;
+
+    const session: RoleSession = {
+      execute<Row>(
+        plan: (SqlExecutionPlan<unknown> | SqlQueryPlan<unknown>) & { readonly _row?: Row },
+        options?: RuntimeExecuteOptions,
+      ): AsyncIterableResult<Row> {
+        return self.executeAgainstQueryable<Row>(plan, conn, { ...options, scope: 'connection' });
+      },
+
+      executePrepared<Params, Row>(
+        ps: PreparedStatement<Params, Row>,
+        params: Params,
+        options?: RuntimeExecuteOptions,
+      ): AsyncIterableResult<Row> {
+        return self.executePreparedAgainstQueryable(
+          blindCast<
+            PreparedStatementImpl<Params, Row>,
+            'PreparedStatement is PreparedStatementImpl; the impl class is the only concrete form'
+          >(ps),
+          blindCast<
+            Record<string, unknown>,
+            'params are structurally Record<string, unknown> at runtime'
+          >(params),
+          conn,
+          { ...options, scope: 'connection' },
+        );
+      },
+
+      async transaction(): Promise<RuntimeTransaction> {
+        const tx = await conn.beginTransaction();
+        return {
+          async commit(): Promise<void> {
+            await tx.commit();
+          },
+          async rollback(): Promise<void> {
+            await tx.rollback();
+          },
+          execute<Row>(
+            plan: (SqlExecutionPlan<unknown> | SqlQueryPlan<unknown>) & { readonly _row?: Row },
+            options?: RuntimeExecuteOptions,
+          ): AsyncIterableResult<Row> {
+            return self.executeAgainstQueryable<Row>(plan, tx, {
+              ...options,
+              scope: 'transaction',
+            });
+          },
+          executePrepared<Params, Row>(
+            ps: PreparedStatement<Params, Row>,
+            params: Params,
+            options?: RuntimeExecuteOptions,
+          ): AsyncIterableResult<Row> {
+            return self.executePreparedAgainstQueryable(
+              blindCast<
+                PreparedStatementImpl<Params, Row>,
+                'PreparedStatement is PreparedStatementImpl; the impl class is the only concrete form'
+              >(ps),
+              blindCast<
+                Record<string, unknown>,
+                'params are structurally Record<string, unknown> at runtime'
+              >(params),
+              tx,
+              { ...options, scope: 'transaction' },
+            );
+          },
+        };
+      },
+
+      /**
+       * Resets all session-local config then releases the connection back to the pool.
+       * If RESET ALL fails, destroys the connection instead — pool-poisoning guarantee.
+       */
+      async release(): Promise<void> {
+        try {
+          await conn.query('RESET ALL');
+          await conn.release();
+        } catch (resetError) {
+          await conn.destroy(resetError).catch(() => undefined);
+        }
+      },
+
+      async destroy(reason?: unknown): Promise<void> {
+        await conn.destroy(reason);
+      },
+    };
+
+    return session;
+  }
+
+  /**
+   * Opens a role session, executes the plan, then releases after the stream drains.
+   * On mid-stream error, destroys the session instead of releasing.
+   */
+  executeWithRole<Row>(
+    plan: SqlExecutionPlan<Row> | SqlQueryPlan<Row>,
+    binding: SupabaseRoleBinding,
+    options?: RuntimeExecuteOptions,
+  ): AsyncIterableResult<Row> {
+    const self = this;
+
+    const generator = async function* (): AsyncGenerator<Row, void, unknown> {
+      const session = await self.openRoleSession(binding);
+      let errored = false;
+      try {
+        for await (const row of session.execute(plan, options)) {
+          yield row;
+        }
+      } catch (err) {
+        errored = true;
+        await session.destroy(err).catch(() => undefined);
+        throw err;
+      } finally {
+        if (!errored) {
+          await session.release();
+        }
+      }
+    };
+
+    return new AsyncIterableResult(generator());
+  }
+}

package/src/runtime/supabase.ts

@@ -0,0 +1,323 @@
+import postgresAdapter from '@prisma-next/adapter-postgres/runtime';
+import type { Contract } from '@prisma-next/contract/types';
+import postgresDriver from '@prisma-next/driver-postgres/runtime';
+import { instantiateExecutionStack } from '@prisma-next/framework-components/execution';
+import type {
+  AsyncIterableResult,
+  RuntimeExecuteOptions,
+} from '@prisma-next/framework-components/runtime';
+import { sql } from '@prisma-next/sql-builder/runtime';
+import type { Db } from '@prisma-next/sql-builder/types';
+import type { SqlStorage } from '@prisma-next/sql-contract/types';
+import { orm } from '@prisma-next/sql-orm-client';
+import type { RawSqlTag } from '@prisma-next/sql-relational-core/expression';
+import { createRawSql } from '@prisma-next/sql-relational-core/expression';
+import type { SqlExecutionPlan, SqlQueryPlan } from '@prisma-next/sql-relational-core/plan';
+import type {
+  ExecutionContext,
+  SqlExecutionStackWithDriver,
+  SqlMiddleware,
+  SqlRuntimeExtensionDescriptor,
+  TransactionContext,
+  VerifyMarkerOption,
+} from '@prisma-next/sql-runtime';
+import {
+  createExecutionContext,
+  createSqlExecutionStack,
+  withTransaction,
+} from '@prisma-next/sql-runtime';
+import postgresTarget, { PostgresContractSerializer } from '@prisma-next/target-postgres/runtime';
+import { blindCast } from '@prisma-next/utils/casts';
+import { ifDefined } from '@prisma-next/utils/defined';
+import { createRemoteJWKSet, type JWTVerifyResult, jwtVerify } from 'jose';
+import type { Client } from 'pg';
+import { Pool } from 'pg';
+import { supabaseRuntimeDescriptor } from './descriptor';
+import type { SupabaseRoleBinding, SupabaseRuntime } from './supabase-runtime';
+import { SupabaseRuntimeImpl } from './supabase-runtime';
+
+export type SupabaseTargetId = 'postgres';
+
+type OrmClient<TContract extends Contract<SqlStorage>> = ReturnType<typeof orm<TContract>>;
+
+export class SupabaseConfigError extends Error {
+  override readonly name = 'SupabaseConfigError';
+  constructor(message: string) {
+    super(message);
+  }
+}
+
+export class InvalidJwtError extends Error {
+  override readonly name = 'InvalidJwtError';
+  readonly reason: string;
+  constructor(reason: string) {
+    super(`Invalid JWT: ${reason}`);
+    this.reason = reason;
+  }
+}
+
+type KeyMaterial =
+  | { readonly kind: 'secret'; readonly key: Uint8Array }
+  | { readonly kind: 'jwks'; readonly keyset: ReturnType<typeof createRemoteJWKSet> };
+
+export interface RoleBoundDb<TContract extends Contract<SqlStorage>> {
+  readonly sql: Db<TContract>;
+  readonly orm: OrmClient<TContract>;
+  readonly raw: RawSqlTag;
+  execute<Row>(
+    plan: (SqlExecutionPlan<Row> | SqlQueryPlan<Row>) & { readonly _row?: Row },
+    options?: RuntimeExecuteOptions,
+  ): AsyncIterableResult<Row>;
+  transaction<R>(fn: (tx: TransactionContext) => PromiseLike<R>): Promise<R>;
+}
+
+export interface SupabaseDb<TContract extends Contract<SqlStorage>> {
+  readonly context: ExecutionContext<TContract>;
+  readonly stack: SqlExecutionStackWithDriver<SupabaseTargetId>;
+  asUser(jwt: string): Promise<RoleBoundDb<TContract>>;
+  asAnon(): RoleBoundDb<TContract>;
+  asServiceRole(): RoleBoundDb<TContract>;
+  close(): Promise<void>;
+  [Symbol.asyncDispose](): Promise<void>;
+}
+
+export interface SupabaseOptionsBase {
+  readonly extensions?: readonly SqlRuntimeExtensionDescriptor<SupabaseTargetId>[];
+  readonly middleware?: readonly SqlMiddleware[];
+  readonly verifyMarker?: VerifyMarkerOption;
+  readonly poolOptions?: {
+    readonly connectionTimeoutMillis?: number;
+    readonly idleTimeoutMillis?: number;
+  };
+}
+
+export interface SupabaseBindingOptions {
+  readonly url?: string;
+  readonly pg?: Pool | Client;
+}
+
+type JwtSecretOption = {
+  readonly jwtSecret: string;
+  readonly jwksUrl?: never;
+};
+
+type JwksUrlOption = {
+  readonly jwksUrl: string;
+  readonly jwtSecret?: never;
+};
+
+export type SupabaseOptionsWithContract<TContract extends Contract<SqlStorage>> =
+  SupabaseBindingOptions &
+    SupabaseOptionsBase &
+    (JwtSecretOption | JwksUrlOption) & {
+      readonly contract: TContract;
+      readonly contractJson?: never;
+    };
+
+export type SupabaseOptionsWithContractJson<TContract extends Contract<SqlStorage>> =
+  SupabaseBindingOptions &
+    SupabaseOptionsBase &
+    (JwtSecretOption | JwksUrlOption) & {
+      readonly contractJson: unknown;
+      readonly contract?: never;
+      readonly _contract?: TContract;
+    };
+
+export type SupabaseOptions<TContract extends Contract<SqlStorage>> =
+  | SupabaseOptionsWithContract<TContract>
+  | SupabaseOptionsWithContractJson<TContract>;
+
+function hasContractJson<TContract extends Contract<SqlStorage>>(
+  options: SupabaseOptions<TContract>,
+): options is SupabaseOptionsWithContractJson<TContract> {
+  return 'contractJson' in options;
+}
+
+const contractSerializer = new PostgresContractSerializer();
+
+function resolveContract<TContract extends Contract<SqlStorage>>(
+  options: SupabaseOptions<TContract>,
+): TContract {
+  const contractInput = hasContractJson(options) ? options.contractJson : options.contract;
+  return blindCast<
+    TContract,
+    'contractSerializer.deserializeContract returns a validated TContract'
+  >(contractSerializer.deserializeContract(contractInput));
+}
+
+function resolveKeyMaterial<TContract extends Contract<SqlStorage>>(
+  options: SupabaseOptions<TContract>,
+): KeyMaterial {
+  const jwtSecret = 'jwtSecret' in options ? options.jwtSecret : undefined;
+  const jwksUrl = 'jwksUrl' in options ? options.jwksUrl : undefined;
+
+  if (jwtSecret !== undefined && jwksUrl !== undefined) {
+    throw new SupabaseConfigError('Provide either jwtSecret or jwksUrl, not both');
+  }
+  if (jwtSecret === undefined && jwksUrl === undefined) {
+    throw new SupabaseConfigError('Either jwtSecret or jwksUrl is required');
+  }
+
+  if (jwtSecret !== undefined) {
+    return { kind: 'secret', key: new TextEncoder().encode(jwtSecret) };
+  }
+
+  if (jwksUrl !== undefined) {
+    return { kind: 'jwks', keyset: createRemoteJWKSet(new URL(jwksUrl)) };
+  }
+
+  throw new SupabaseConfigError('Either jwtSecret or jwksUrl is required');
+}
+
+function toPool<TContract extends Contract<SqlStorage>>(
+  options: SupabaseOptions<TContract>,
+): { pool: Pool; owned: boolean } | undefined {
+  if (options.pg instanceof Pool) {
+    return { pool: options.pg, owned: false };
+  }
+  if (typeof options.url === 'string') {
+    return {
+      pool: new Pool({
+        connectionString: options.url,
+        connectionTimeoutMillis: options.poolOptions?.connectionTimeoutMillis ?? 20_000,
+        idleTimeoutMillis: options.poolOptions?.idleTimeoutMillis ?? 30_000,
+      }),
+      owned: true,
+    };
+  }
+  return undefined;
+}
+
+function withSupabaseDescriptor(
+  extensions: readonly SqlRuntimeExtensionDescriptor<SupabaseTargetId>[] | undefined,
+): readonly SqlRuntimeExtensionDescriptor<SupabaseTargetId>[] {
+  const packs = extensions ?? [];
+  return packs.some((pack) => pack.id === supabaseRuntimeDescriptor.id)
+    ? packs
+    : [...packs, supabaseRuntimeDescriptor];
+}
+
+export default async function supabase<TContract extends Contract<SqlStorage>>(
+  options: SupabaseOptionsWithContract<TContract>,
+): Promise<SupabaseDb<TContract>>;
+export default async function supabase<TContract extends Contract<SqlStorage>>(
+  options: SupabaseOptionsWithContractJson<TContract>,
+): Promise<SupabaseDb<TContract>>;
+export default async function supabase<TContract extends Contract<SqlStorage>>(
+  options: SupabaseOptions<TContract>,
+): Promise<SupabaseDb<TContract>> {
+  const keyMaterial = resolveKeyMaterial(options);
+  const contract = resolveContract(options);
+
+  const stack = createSqlExecutionStack({
+    target: postgresTarget,
+    adapter: postgresAdapter,
+    driver: postgresDriver,
+    extensionPacks: withSupabaseDescriptor(options.extensions),
+  });
+
+  const context = createExecutionContext({ contract, stack });
+  const rawCodecInferer = stack.adapter.rawCodecInferer;
+  const rawSqlTag: RawSqlTag = createRawSql(rawCodecInferer);
+
+  const poolEntry = toPool(options);
+  let closed = false;
+
+  const stackInstance = instantiateExecutionStack(stack);
+  const driverDescriptor = stack.driver;
+  if (!driverDescriptor) {
+    throw new Error('Driver descriptor missing from execution stack');
+  }
+  const driver = driverDescriptor.create({ cursor: { disabled: true } });
+
+  if (poolEntry) {
+    await driver.connect({ kind: 'pgPool', pool: poolEntry.pool });
+  }
+
+  const runtime: SupabaseRuntime & SupabaseRuntimeImpl<TContract> = new SupabaseRuntimeImpl({
+    context,
+    adapter: stackInstance.adapter,
+    driver,
+    ...ifDefined('verifyMarker', options.verifyMarker),
+    ...ifDefined('middleware', options.middleware),
+  });
+
+  async function verifyJwt(jwt: string): Promise<JWTVerifyResult> {
+    try {
+      if (keyMaterial.kind === 'secret') {
+        return await jwtVerify(jwt, keyMaterial.key);
+      }
+      return await jwtVerify(jwt, keyMaterial.keyset);
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      throw new InvalidJwtError(reason);
+    }
+  }
+
+  function buildRoleBoundDb(binding: SupabaseRoleBinding): RoleBoundDb<TContract> {
+    const roleSql: Db<TContract> = sql<TContract>({ context, rawCodecInferer });
+    const roleOrm: OrmClient<TContract> = orm({
+      runtime: {
+        execute(plan) {
+          return runtime.executeWithRole(plan, binding);
+        },
+        // connection() returns a role session; this is the enforcement path for ORM scope
+        // operations (mutations, includes) — every statement runs role-bound.
+        connection: () => runtime.openRoleSession(binding),
+      },
+      context,
+    });
+
+    return {
+      sql: roleSql,
+      orm: roleOrm,
+      raw: rawSqlTag,
+      execute<Row>(
+        plan: (SqlExecutionPlan<Row> | SqlQueryPlan<Row>) & { readonly _row?: Row },
+        execOptions?: RuntimeExecuteOptions,
+      ): AsyncIterableResult<Row> {
+        return runtime.executeWithRole<Row>(plan, binding, execOptions);
+      },
+      transaction<R>(fn: (tx: TransactionContext) => PromiseLike<R>): Promise<R> {
+        return withTransaction({ connection: () => runtime.openRoleSession(binding) }, fn);
+      },
+    };
+  }
+
+  async function closeDb(): Promise<void> {
+    if (closed) return;
+    closed = true;
+    await runtime.close();
+    if (poolEntry?.owned) {
+      await poolEntry.pool.end().catch(() => undefined);
+    }
+  }
+
+  return {
+    context,
+    stack,
+
+    async asUser(jwt: string): Promise<RoleBoundDb<TContract>> {
+      const { payload } = await verifyJwt(jwt);
+      const rawRole = payload['role'];
+      const roleStr = typeof rawRole === 'string' ? rawRole : 'authenticated';
+      const role: SupabaseRoleBinding['role'] =
+        roleStr === 'anon' || roleStr === 'authenticated' || roleStr === 'service_role'
+          ? roleStr
+          : 'authenticated';
+      const binding: SupabaseRoleBinding = { role, claims: payload };
+      return buildRoleBoundDb(binding);
+    },
+
+    asAnon(): RoleBoundDb<TContract> {
+      return buildRoleBoundDb({ role: 'anon', claims: {} });
+    },
+
+    asServiceRole(): RoleBoundDb<TContract> {
+      return buildRoleBoundDb({ role: 'service_role', claims: {} });
+    },
+
+    close: closeDb,
+    [Symbol.asyncDispose]: closeDb,
+  };
+}