@sixb/pg 0.1.7 → 0.1.9

package/src/pg-execution-storage.ts

@@ -2,10 +2,14 @@ import {
   type ExecutionStorageRow,
   executionRecordFromStorageRow,
   executionRecordToStorageRow,
-  normalizeExecutionRecord,
-  validateExecutionRecordReferences,
+  prepareExecutionRecord,
 } from "@sixb/core/internal/execution-storage"
-import type { CreateExecutionInput, ExecutionRecord, ExecutionStorage } from "@sixb/core/storage"
+import type {
+  CreateExecutionInput,
+  ExecutionRecord,
+  ExecutionStorage,
+  ShareSessionStorage,
+} from "@sixb/core/storage"
 import { ExecutionStorageError } from "@sixb/core/storage"
 import type { PgAuthStorage } from "./auth-storage"
 import { isUniqueViolation } from "./storage-errors"
@@ -14,14 +18,15 @@ import type { PgStoreClient } from "./transactions"
 export class PgExecutionStorage implements ExecutionStorage {
   constructor(
     private readonly sql: PgStoreClient,
-    private readonly auth: PgAuthStorage
+    private readonly auth: PgAuthStorage,
+    private readonly shareSessions: Pick<ShareSessionStorage, "getById">
   ) {}
 
   async create(input: CreateExecutionInput): Promise<ExecutionRecord> {
-    const record = normalizeExecutionRecord(input)
-    await validateExecutionRecordReferences(record, {
+    const record = await prepareExecutionRecord(input, {
       auth: this.auth,
       getExecution: (params) => this.getById(params),
+      getShareSession: (params) => this.shareSessions.getById(params),
     })
     const row = executionRecordToStorageRow(record)
 
@@ -36,6 +41,7 @@ export class PgExecutionStorage implements ExecutionStorage {
           source_id,
           requested_by_user_id,
           requested_by_service_account_id,
+          requester_group_ids,
           correlation_id,
           parent_execution_id,
           authority_kind,
@@ -46,6 +52,9 @@ export class PgExecutionStorage implements ExecutionStorage {
           authority_primitive_kind,
           authority_primitive_id,
           authority_kernel_operation,
+          authority_delegation_kind,
+          authority_delegation_id,
+          authority_delegation_session_id,
           created_at
         ) VALUES (
           ${row.projectId},
@@ -56,6 +65,7 @@ export class PgExecutionStorage implements ExecutionStorage {
           ${row.sourceId},
           ${row.requestedByUserId},
           ${row.requestedByServiceAccountId},
+          ${JSON.stringify(row.requesterGroupIds)}::text::jsonb,
           ${row.correlationId},
           ${row.parentExecutionId},
           ${row.authorityKind},
@@ -66,6 +76,9 @@ export class PgExecutionStorage implements ExecutionStorage {
           ${row.authorityPrimitiveKind},
           ${row.authorityPrimitiveId},
           ${row.authorityKernelOperation},
+          ${row.authorityDelegationKind},
+          ${row.authorityDelegationId},
+          ${row.authorityDelegationSessionId},
           ${row.createdAt}
         )
         RETURNING *
@@ -110,6 +123,7 @@ function toStorageRow(row: PgExecutionRow): ExecutionStorageRow {
     sourceId: row.source_id,
     requestedByUserId: row.requested_by_user_id,
     requestedByServiceAccountId: row.requested_by_service_account_id,
+    requesterGroupIds: row.requester_group_ids,
     correlationId: row.correlation_id,
     parentExecutionId: row.parent_execution_id,
     authorityKind: row.authority_kind,
@@ -120,6 +134,9 @@ function toStorageRow(row: PgExecutionRow): ExecutionStorageRow {
     authorityPrimitiveKind: row.authority_primitive_kind,
     authorityPrimitiveId: row.authority_primitive_id,
     authorityKernelOperation: row.authority_kernel_operation,
+    authorityDelegationKind: row.authority_delegation_kind,
+    authorityDelegationId: row.authority_delegation_id,
+    authorityDelegationSessionId: row.authority_delegation_session_id,
     createdAt: new Date(row.created_at),
   }
 }
@@ -133,6 +150,7 @@ interface PgExecutionRow {
   readonly source_id: string
   readonly requested_by_user_id: string | null
   readonly requested_by_service_account_id: string | null
+  readonly requester_group_ids: string[]
   readonly correlation_id: string
   readonly parent_execution_id: string | null
   readonly authority_kind: ExecutionStorageRow["authorityKind"]
@@ -143,5 +161,8 @@ interface PgExecutionRow {
   readonly authority_primitive_kind: ExecutionStorageRow["authorityPrimitiveKind"]
   readonly authority_primitive_id: string | null
   readonly authority_kernel_operation: ExecutionStorageRow["authorityKernelOperation"]
+  readonly authority_delegation_kind: ExecutionStorageRow["authorityDelegationKind"]
+  readonly authority_delegation_id: string | null
+  readonly authority_delegation_session_id: string | null
   readonly created_at: Date | string
 }

package/src/pg-pipeline-run-storage.ts

@@ -1,6 +1,7 @@
 import type { JsonValue } from "@sixb/core"
 import { parseSixbFailure, serializeSixbFailure } from "@sixb/core/internal/errors"
 import { assertPipelineRunExecution } from "@sixb/core/internal/pipeline-run-storage-provider"
+import { canRequeuePipelineRunAfterEnqueueFailure } from "@sixb/core/internal/storage"
 import type { DatasetVersionRef } from "@sixb/core/lake-storage"
 import type {
   ExecutionStorage,
@@ -19,11 +20,7 @@ import type {
   StartPipelineRunInput,
   StartPipelineStepRunInput,
 } from "@sixb/core/storage"
-import {
-  canRequeuePipelineRunAfterEnqueueFailure,
-  PIPELINE_RUN_FAILURE_CODES,
-  PipelineRunError,
-} from "@sixb/core/storage"
+import { PIPELINE_RUN_FAILURE_CODES, PipelineRunError } from "@sixb/core/storage"
 import { queryLatestRunsByOwnerId } from "./latest-run-query"
 import type { SqlParameter } from "./pg-client"
 import { appendRunListFilters, hasEmptyStatuses, queryRunList } from "./run-list-query"

package/src/pg-sync-run-storage.ts

@@ -1,5 +1,6 @@
 import type { JsonValue } from "@sixb/core"
 import { parseSixbFailure, serializeSixbFailure } from "@sixb/core/internal/errors"
+import { canRequeueSyncRunAfterEnqueueFailure } from "@sixb/core/internal/storage"
 import { assertSyncRunExecution } from "@sixb/core/internal/sync-run-storage-provider"
 import type {
   ExecutionStorage,
@@ -13,11 +14,7 @@ import type {
   SyncRunRecord,
   SyncRunStorage,
 } from "@sixb/core/storage"
-import {
-  canRequeueSyncRunAfterEnqueueFailure,
-  SYNC_RUN_FAILURE_CODES,
-  SyncRunError,
-} from "@sixb/core/storage"
+import { SYNC_RUN_FAILURE_CODES, SyncRunError } from "@sixb/core/storage"
 import { queryLatestRunsByOwnerId } from "./latest-run-query"
 import type { SqlParameter } from "./pg-client"
 import { appendRunListFilters, hasEmptyStatuses, queryRunList } from "./run-list-query"

package/src/pg-workflow-run-storage.ts

@@ -1,5 +1,4 @@
 import type { JsonValue } from "@sixb/core"
-import { normalizeRequesterGroupIds } from "@sixb/core/internal/auth"
 import { parseSixbFailure, serializeSixbFailure } from "@sixb/core/internal/errors"
 import {
   assertWorkflowAgentNodeRunExecution,
@@ -83,7 +82,6 @@ export class PgWorkflowRunStorage implements WorkflowRunStorage {
           input,
           queued_at,
           started_at,
-          requester_group_ids,
           attempt
         ) VALUES (
           ${input.projectId},
@@ -94,7 +92,6 @@ export class PgWorkflowRunStorage implements WorkflowRunStorage {
           ${serializeRecord(input.input)}::text::jsonb,
           ${queuedAt},
           ${queuedAt},
-          ${JSON.stringify(normalizeRequesterGroupIds(input.requesterGroupIds))}::text::jsonb,
           ${0}
         )
         RETURNING *
@@ -822,7 +819,6 @@ function rowToWorkflowRunRecord(row: WorkflowRunDatabaseRow): WorkflowRunRecord
     startedAt: new Date(row.started_at),
     finishedAt: row.finished_at ? new Date(row.finished_at) : undefined,
     error: row.error === null ? undefined : parseSixbFailure(row.error, WORKFLOW_RUN_FAILURE_CODES),
-    requesterGroupIds: parseJson(row.requester_group_ids),
     attempt: Number(row.attempt),
     ...(row.execution_token && row.execution_queue_lease_expires_at
       ? {
@@ -883,7 +879,6 @@ interface WorkflowRunDatabaseRow {
   started_at: Date | string
   finished_at: Date | string | null
   error: JsonValue | null
-  requester_group_ids: string[] | string
   attempt: number | string
   execution_token: string | null
   execution_queue_lease_expires_at: Date | string | null

package/src/share-grant-storage.ts

@@ -0,0 +1,236 @@
+import {
+  normalizeGetShareGrantByIdInput,
+  normalizeListShareGrantsInput,
+  normalizeRevokeShareGrantInput,
+  normalizeShareGrantCreate,
+  parseShareGrantRecord,
+} from "@sixb/core/internal/share-grant-storage-provider"
+import type {
+  CreateShareGrantInput,
+  GetShareGrantByIdInput,
+  ListShareGrantsInput,
+  ListShareGrantsResult,
+  RevokeShareGrantInput,
+  ShareGrantRecord,
+  ShareGrantStorage,
+} from "@sixb/core/storage"
+import { ShareGrantStorageError } from "@sixb/core/storage"
+import type { SqlParameter } from "./pg-client"
+import { isUniqueViolation } from "./storage-errors"
+import type { PgStoreClient } from "./transactions"
+
+export class PgShareGrantStorage implements ShareGrantStorage {
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async create(input: CreateShareGrantInput): Promise<ShareGrantRecord> {
+    const record = normalizeShareGrantCreate(input)
+    try {
+      const [row] = await this.sql<PgShareGrantRow[]>`
+        INSERT INTO share_grants (
+          project_id,
+          id,
+          definition_id,
+          target_object_type_id,
+          target_primary_id,
+          issued_by_type,
+          issued_by_id,
+          authority_version,
+          authority_snapshot,
+          authority_digest,
+          token_hash,
+          destination_path,
+          created_at,
+          expires_at
+        ) VALUES (
+          ${record.projectId},
+          ${record.id},
+          ${record.definitionId},
+          ${record.target.objectTypeId},
+          ${record.target.primaryId},
+          ${record.issuedBy.type},
+          ${record.issuedBy.id},
+          ${record.authoritySnapshot.version},
+          ${JSON.stringify(record.authoritySnapshot)}::text::jsonb,
+          ${record.authorityDigest},
+          ${record.tokenHash},
+          ${record.destinationPath},
+          ${record.createdAt},
+          ${record.expiresAt}
+        )
+        RETURNING *
+      `
+      if (!row) {
+        throw invalidRecord(`Share grant '${record.id}' disappeared after create.`)
+      }
+      return recordFromRow(row)
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw new ShareGrantStorageError(
+          "duplicate",
+          `[SixbPg] Share grant '${record.id}' conflicts with an existing record.`,
+          { cause: error }
+        )
+      }
+      throw error
+    }
+  }
+
+  async getById(input: GetShareGrantByIdInput): Promise<ShareGrantRecord | null> {
+    const normalized = normalizeGetShareGrantByIdInput(input)
+    const [row] = await this.sql<PgShareGrantRow[]>`
+      SELECT *
+      FROM share_grants
+      WHERE project_id = ${normalized.projectId} AND id = ${normalized.id}
+    `
+    return row ? recordFromRow(row) : null
+  }
+
+  async list(input: ListShareGrantsInput): Promise<ListShareGrantsResult> {
+    const normalized = normalizeListShareGrantsInput(input)
+    const where = ["project_id = $1"]
+    const params: SqlParameter[] = [normalized.projectId]
+    let parameter = 2
+
+    if (normalized.definitionId !== undefined) {
+      where.push(`definition_id = $${parameter++}`)
+      params.push(normalized.definitionId)
+    }
+    if (normalized.target !== undefined) {
+      where.push(`target_object_type_id = $${parameter++}`, `target_primary_id = $${parameter++}`)
+      params.push(normalized.target.objectTypeId, normalized.target.primaryId)
+    }
+    if (!normalized.includeRevoked) where.push("revoked_at IS NULL")
+    if (!normalized.includeExpired) {
+      where.push(`expires_at > $${parameter++}`)
+      params.push(normalized.now)
+    }
+
+    const predicate = where.join(" AND ")
+    const [totalRow] = await this.sql.unsafe<PgShareGrantCountRow[]>(
+      `SELECT COUNT(*)::bigint AS total FROM share_grants WHERE ${predicate}`,
+      params
+    )
+    const total = parseCount(totalRow?.total)
+
+    const listParams = [...params, normalized.limit, normalized.offset]
+    const rows = await this.sql.unsafe<PgShareGrantRow[]>(
+      `
+        SELECT *
+        FROM share_grants
+        WHERE ${predicate}
+        ORDER BY created_at DESC, id DESC
+        LIMIT $${parameter++} OFFSET $${parameter}
+      `,
+      listParams
+    )
+    const grants = rows.map(recordFromRow)
+    return {
+      grants,
+      total,
+      hasMore: normalized.offset + grants.length < total,
+    }
+  }
+
+  async revoke(input: RevokeShareGrantInput): Promise<ShareGrantRecord | null> {
+    const normalized = normalizeRevokeShareGrantInput(input)
+    const current = await this.getById({ projectId: normalized.projectId, id: normalized.id })
+    if (!current) return null
+    if (current.revokedAt) return current
+
+    const revocation = normalizeRevokeShareGrantInput(normalized, current.createdAt)
+    const [updated] = await this.sql<PgShareGrantRow[]>`
+      UPDATE share_grants
+      SET revoked_at = ${revocation.revokedAt},
+          revoked_by_type = ${revocation.revokedBy.type},
+          revoked_by_id = ${revocation.revokedBy.id}
+      WHERE project_id = ${revocation.projectId}
+        AND id = ${revocation.id}
+        AND revoked_at IS NULL
+      RETURNING *
+    `
+    if (updated) return recordFromRow(updated)
+
+    return this.getById({ projectId: revocation.projectId, id: revocation.id })
+  }
+}
+
+interface PgShareGrantRow {
+  readonly project_id: unknown
+  readonly id: unknown
+  readonly definition_id: unknown
+  readonly target_object_type_id: unknown
+  readonly target_primary_id: unknown
+  readonly issued_by_type: unknown
+  readonly issued_by_id: unknown
+  readonly authority_version: unknown
+  readonly authority_snapshot: unknown
+  readonly authority_digest: unknown
+  readonly token_hash: unknown
+  readonly destination_path: unknown
+  readonly created_at: unknown
+  readonly expires_at: unknown
+  readonly revoked_at: unknown
+  readonly revoked_by_type: unknown
+  readonly revoked_by_id: unknown
+}
+
+interface PgShareGrantCountRow {
+  readonly total: unknown
+}
+
+function recordFromRow(row: PgShareGrantRow): ShareGrantRecord {
+  const authoritySnapshot = parseJsonColumn(row.authority_snapshot)
+  if (
+    !isRecord(authoritySnapshot) ||
+    !Number.isSafeInteger(row.authority_version) ||
+    authoritySnapshot.version !== row.authority_version
+  ) {
+    throw invalidRecord("Share authority version does not match its snapshot.")
+  }
+
+  return parseShareGrantRecord({
+    id: row.id,
+    projectId: row.project_id,
+    definitionId: row.definition_id,
+    target: {
+      objectTypeId: row.target_object_type_id,
+      primaryId: row.target_primary_id,
+    },
+    issuedBy: { type: row.issued_by_type, id: row.issued_by_id },
+    authoritySnapshot,
+    authorityDigest: row.authority_digest,
+    tokenHash: row.token_hash,
+    destinationPath: row.destination_path,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    ...(row.revoked_at === null ? {} : { revokedAt: row.revoked_at }),
+    ...(row.revoked_by_type === null && row.revoked_by_id === null
+      ? {}
+      : { revokedBy: { type: row.revoked_by_type, id: row.revoked_by_id } }),
+  })
+}
+
+function parseJsonColumn(value: unknown): unknown {
+  if (typeof value !== "string") return value
+  try {
+    return JSON.parse(value)
+  } catch (error) {
+    throw invalidRecord("Share authority snapshot is not valid JSON.", error)
+  }
+}
+
+function parseCount(value: unknown): number {
+  const count = Number(value)
+  if (!Number.isSafeInteger(count) || count < 0) {
+    throw invalidRecord("Share grant count is not a non-negative safe integer.")
+  }
+  return count
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function invalidRecord(message: string, cause?: unknown): ShareGrantStorageError {
+  return new ShareGrantStorageError("invalid_record", `[SixbPg] ${message}`, { cause })
+}

package/src/share-session-storage.ts

@@ -0,0 +1,127 @@
+import {
+  normalizeGetShareSessionByIdInput,
+  normalizeRenewShareSessionIfValidInput,
+  normalizeRevokeShareSessionInput,
+  normalizeShareSessionCreate,
+  parseShareSessionRecord,
+} from "@sixb/core/internal/share-session-storage-provider"
+import type {
+  CreateShareSessionInput,
+  GetShareSessionByIdInput,
+  RenewShareSessionIfValidInput,
+  RevokeShareSessionInput,
+  ShareSessionRecord,
+  ShareSessionStorage,
+} from "@sixb/core/storage"
+import { ShareSessionStorageError } from "@sixb/core/storage"
+import { isForeignKeyViolation, isUniqueViolation } from "./storage-errors"
+import type { PgStoreClient } from "./transactions"
+
+export class PgShareSessionStorage implements ShareSessionStorage {
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async create(input: CreateShareSessionInput): Promise<ShareSessionRecord> {
+    const record = normalizeShareSessionCreate(input)
+    try {
+      const [row] = await this.sql<PgShareSessionRow[]>`
+        INSERT INTO share_sessions (
+          project_id, id, grant_id, token_hash, created_at, expires_at, absolute_expires_at
+        ) VALUES (
+          ${record.projectId}, ${record.id}, ${record.grantId}, ${record.tokenHash},
+          ${record.createdAt}, ${record.expiresAt}, ${record.absoluteExpiresAt}
+        )
+        RETURNING *
+      `
+      if (!row) throw invalidRecord(`Share session '${record.id}' disappeared after create.`)
+      return recordFromRow(row)
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw new ShareSessionStorageError(
+          "duplicate",
+          `[SixbPg] Share session '${record.id}' conflicts with an existing record.`,
+          { cause: error }
+        )
+      }
+      if (isForeignKeyViolation(error)) {
+        throw new ShareSessionStorageError(
+          "invalid_input",
+          `[SixbPg] Share grant '${record.grantId}' does not exist in project '${record.projectId}'.`,
+          { cause: error }
+        )
+      }
+      throw error
+    }
+  }
+
+  async getById(input: GetShareSessionByIdInput): Promise<ShareSessionRecord | null> {
+    const normalized = normalizeGetShareSessionByIdInput(input)
+    const [row] = await this.sql<PgShareSessionRow[]>`
+      SELECT * FROM share_sessions
+      WHERE project_id = ${normalized.projectId} AND id = ${normalized.id}
+    `
+    return row ? recordFromRow(row) : null
+  }
+
+  async renewIfValid(input: RenewShareSessionIfValidInput): Promise<ShareSessionRecord | null> {
+    const normalized = normalizeRenewShareSessionIfValidInput(input)
+    const [row] = await this.sql<PgShareSessionRow[]>`
+      UPDATE share_sessions
+      SET expires_at = LEAST(absolute_expires_at, GREATEST(expires_at, ${normalized.expiresAt}))
+      WHERE project_id = ${normalized.projectId}
+        AND id = ${normalized.id}
+        AND grant_id = ${normalized.grantId}
+        AND token_hash = ${normalized.tokenHash}
+        AND revoked_at IS NULL
+        AND created_at <= ${normalized.now}
+        AND expires_at > ${normalized.now}
+        AND absolute_expires_at > ${normalized.now}
+      RETURNING *
+    `
+    return row ? recordFromRow(row) : null
+  }
+
+  async revoke(input: RevokeShareSessionInput): Promise<ShareSessionRecord | null> {
+    const normalized = normalizeRevokeShareSessionInput(input)
+    const current = await this.getById(normalized)
+    if (!current || current.revokedAt) return current
+    const revocation = normalizeRevokeShareSessionInput(normalized, current.createdAt)
+    const [updated] = await this.sql<PgShareSessionRow[]>`
+      UPDATE share_sessions
+      SET revoked_at = ${revocation.revokedAt}
+      WHERE project_id = ${revocation.projectId}
+        AND id = ${revocation.id}
+        AND revoked_at IS NULL
+      RETURNING *
+    `
+    if (updated) return recordFromRow(updated)
+    return this.getById({ projectId: revocation.projectId, id: revocation.id })
+  }
+}
+
+interface PgShareSessionRow {
+  readonly project_id: unknown
+  readonly id: unknown
+  readonly grant_id: unknown
+  readonly token_hash: unknown
+  readonly created_at: unknown
+  readonly expires_at: unknown
+  readonly absolute_expires_at: unknown
+  readonly revoked_at: unknown
+}
+
+function recordFromRow(row: PgShareSessionRow): ShareSessionRecord {
+  return parseShareSessionRecord({
+    projectId: row.project_id,
+    id: row.id,
+    grantId: row.grant_id,
+    tokenHash: row.token_hash,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    absoluteExpiresAt: row.absolute_expires_at,
+    ...(row.revoked_at === null ? {} : { revokedAt: row.revoked_at }),
+  })
+}
+
+function invalidRecord(message: string, cause?: unknown): ShareSessionStorageError {
+  return new ShareSessionStorageError("invalid_record", `[SixbPg] ${message}`, { cause })
+}

package/src/storage-errors.ts

@@ -5,6 +5,7 @@
 
 /** PostgreSQL SQLSTATE for a unique-constraint violation. */
 const UNIQUE_VIOLATION = "23505"
+const FOREIGN_KEY_VIOLATION = "23503"
 
 /**
  * PostgreSQL SQLSTATEs in class 40 (transaction rollback) that are transient and safe to retry by
@@ -46,6 +47,11 @@ export function isUniqueViolation(error: unknown): boolean {
   return pgErrorCode(error) === UNIQUE_VIOLATION
 }
 
+/** True when the error is a PostgreSQL foreign-key violation (SQLSTATE 23503). */
+export function isForeignKeyViolation(error: unknown): boolean {
+  return pgErrorCode(error) === FOREIGN_KEY_VIOLATION
+}
+
 /**
  * True when the error is a transient transaction-rollback conflict that is safe to retry by
  * replaying the transaction — a serialization failure (SQLSTATE 40001) or a deadlock (40P01).

package/src/transactions.ts

@@ -4,10 +4,14 @@ import type { SQL, SQLClient } from "./pg-client"
 export type PgStoreClient = SQL | SQLClient
 
 export interface RunPgTransactionOptions {
-  /** Open the transaction at `SERIALIZABLE`; omit for the server default (`READ COMMITTED`). */
-  readonly isolation?: "serializable"
+  /** Open the transaction at an explicit isolation; omit for the server default. */
+  readonly isolation?: "repeatableRead" | "serializable"
 }
 
+type PgTransactionIsolation = "unverifiedDefault" | "repeatableRead" | "serializable"
+
+const activePgTransactions = new WeakMap<PgStoreClient, PgTransactionIsolation>()
+
 export async function runPgTransaction<T>(
   sql: PgStoreClient,
   run: (tx: SQLClient) => Promise<T>,
@@ -24,10 +28,47 @@ export async function runPgTransaction<T>(
   // The isolation level is folded into `BEGIN` (`BEGIN ISOLATION LEVEL SERIALIZABLE`) rather than
   // a separate `SET TRANSACTION` statement: one round-trip instead of two, and the level is
   // guaranteed to take effect before any data statement of the transaction runs.
-  if (options.isolation === "serializable") {
-    return sql.begin("isolation level serializable", run) as Promise<T>
+  const isolation = options.isolation ?? "unverifiedDefault"
+  const trackedRun = async (tx: SQLClient): Promise<T> => {
+    activePgTransactions.set(tx, isolation)
+    try {
+      return await run(tx)
+    } finally {
+      activePgTransactions.delete(tx)
+    }
+  }
+
+  if (isolation === "serializable") {
+    return sql.begin("isolation level serializable", trackedRun) as Promise<T>
+  }
+  if (isolation === "repeatableRead") {
+    return sql.begin("isolation level repeatable read", trackedRun) as Promise<T>
+  }
+  return sql.begin(trackedRun) as Promise<T>
+}
+
+/**
+ * Run a multi-statement read against one proven PostgreSQL snapshot.
+ *
+ * A provider-owned repeatable-read or serializable transaction may be reused. An external
+ * transaction client is rejected because postgres.js does not expose its current isolation.
+ */
+export async function runPgRepeatableReadTransaction<T>(
+  sql: PgStoreClient,
+  run: (tx: SQLClient) => Promise<T>
+): Promise<T> {
+  if (canStartPgTransaction(sql)) {
+    return runPgTransaction(sql, run, { isolation: "repeatableRead" })
   }
-  return sql.begin(run) as Promise<T>
+
+  const isolation = activePgTransactions.get(sql)
+  if (isolation === "repeatableRead" || isolation === "serializable") {
+    return run(sql)
+  }
+
+  throw new Error(
+    '[SixbPg] Selected object reads cannot join an unverified PostgreSQL transaction. Use storage.transaction(..., { isolation: "serializable" }) when reading through tx.objects.'
+  )
 }
 
 export function authLockKey(kind: string, ...parts: readonly string[]): string {

package/dist/pg-object-query-compiler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pg-object-query-compiler.d.ts","sourceRoot":"","sources":["../src/pg-object-query-compiler.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,WAAW,EAKhB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAA;AAEnB,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,OAAO,CAAA;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,OAAO,EAAE,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,OAAO,EAAE,CAAA;IACpB,KAAK,EAAE,aAAa,CAAA;IACpB,YAAY,CAAC,EAAE,oBAAoB,CAAA;IACnC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAClD,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,SAAS,CAAC,EAAE,CAAA;IAC7C,aAAa,CAAC,IAAI,EAAE,SAAS,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAC3F;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,OAAO,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,OAAO,EAAE,CAAA;CAChB;AAED,UAAU,oBAAoB;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,OAAO,EAAE,CAAA;IACf,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAA;CACnC;AAgBD,UAAU,aAAa;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,OAAO,EAAE,CAAA;IACf,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACrC,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,KAAK,kBAAkB,GACnB;IACE,IAAI,EAAE,UAAU,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;IACzB,UAAU,CAAC,EAAE,eAAe,CAAA;CAC7B,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,MAAM,EAAE,gBAAgB,GAAG,YAAY,CAAA;IACvC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;CAC1B,CAAA;AAmBL,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,qBAAqB,CAevB;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,WAAW,GACjB,qBAAqB,CASvB;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,WAAW,GACjB,qBAAqB,CAUvB;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,oBAAoB,CAkBtB"}

package/dist/pg-object-storage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pg-object-storage.d.ts","sourceRoot":"","sources":["../src/pg-object-storage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EAGnB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,SAAS,EAET,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,oBAAoB,CAAA;AAU3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AA4GnD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,eAAgB,YAAW,aAAa;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,aAAa;IAE/C,iBAAiB,IAAI,uBAAuB;IAItC,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA8BpE,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IASpE,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAMvE,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmBpE,cAAc,CAAC,MAAM,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,EAAE,MAAM,CAAA;KAClB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAWvB,SAAS,CAAC,MAAM,EAAE;QACtB,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,SAAS,CAAC,EAAE,aAAa,CAAA;KAC1B,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC;IAmB/B,mBAAmB,CAAC,MAAM,EAAE;QAChC,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,SAAS;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAC9D,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAkBrC,cAAc,CAAC,MAAM,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,SAAS;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAC7E,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;IAqBzC,UAAU,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA6E1E,sBAAsB,CAAC,MAAM,EAAE;QACnC,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,SAAS;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAC7D,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC;IAkC/B,mBAAmB,CAAC,MAAM,EAAE;QAChC,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,KAAK,EAAE,MAAM,CAAA;KACd,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBhE,IAAI,CAAC,MAAM,EAAE;QACjB,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;QACzC,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,YAAY,CAAC,EAAE,IAAI,CAAA;QACnB,aAAa,CAAC,EAAE,IAAI,CAAA;QACpB,YAAY,CAAC,EAAE,IAAI,CAAA;QACnB,aAAa,CAAC,EAAE,IAAI,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,CAAA;QACjD,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;KACvB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CA6EhF"}