@stratum-hq/db-adapters 1.3.0 → 1.5.0

package/README.md

@@ -2,6 +2,8 @@
 
 PostgreSQL adapters for [Stratum](https://github.com/stratum-hq/Stratum) that automatically scope queries to the current tenant using Row-Level Security. Supports raw `pg`, Prisma, Drizzle, and Sequelize, plus helpers for enabling RLS on your tables.
 
+Read the documentation at [docs.stratum-hq.org/packages/db-adapters](https://docs.stratum-hq.org/packages/db-adapters/).
+
 ## Installation
 
 ```bash
@@ -35,11 +37,13 @@ import { prismaWithTenant } from "@stratum-hq/db-adapters";        // Prisma
 import { drizzleWithTenant } from "@stratum-hq/db-adapters";  // Drizzle
 import { SequelizeAdapter, sequelizeWithTenantScope } from "@stratum-hq/db-adapters"; // Sequelize
 
-// Prisma — all queries scoped to the current tenant
+// Prisma: all queries scoped to the current tenant
 const tenantPrisma = prismaWithTenant(prisma, () => getTenantContext().tenant_id, pool);
 const orders = await tenantPrisma.order.findMany();
 ```
 
+The Sequelize wrapper scopes its `query()` method only. Model methods such as `Order.findAll()` do not go through it and run without a tenant.
+
 ## RLS & Migration Helpers
 
 ```typescript
@@ -62,7 +66,9 @@ try {
 - Restrictive policies can only narrow access, so they may check anything.
 - An existing `tenant_isolation` policy must be permissive, apply to all commands, and apply to `PUBLIC` (no `TO` clause), like the one `createPolicy` generates and every policy Stratum ships.
 
-The check recognizes the form Stratum generates, with the operands in either order, with casts, ANDed with other conditions, or ORed with Stratum's `app.bypass_rls` bypass. A policy that isolates correctly but is written in another form is also refused; replace it with the generated form. This is a breaking change for callers that relied on the old skip, shipped in a minor release.
+The check recognizes the form Stratum generates, with the operands in either order, with casts, ANDed with other conditions, or ORed with Stratum's `app.bypass_rls` bypass, directly or through `stratum_legacy_bypass()` (migration 032). A policy that isolates correctly but is written in another form is also refused; replace it with the generated form. This is a breaking change for callers that relied on the old skip, shipped in a minor release.
+
+A permissive policy named `stratum_control_plane` is accepted only when it applies to exactly the control role of migration 032 (`stratum_control` by default; pass `{ controlRole }` to `createPolicy` for another name). A policy that checks `app.bypass_rls` directly still passes in 1.x, but `createPolicy` emits a `STRATUM_GUC_BYPASS_POLICY` process warning for it: the control role, which PostgreSQL role membership decides, replaces it. 2.0 refuses such policies.
 
 `isRLSEnabled` reports on the table that the name resolves to through the `search_path`, not on a table with the same name in another schema.
 
@@ -103,10 +109,60 @@ When the pool count reaches `maxPools`, the manager ends the least recently used
 
 Concurrent first requests for one tenant share one pool.
 
+## PGlite
+
+`@stratum-hq/db-adapters/pglite` runs `@stratum-hq/lib` on [PGlite](https://pglite.dev), which is PostgreSQL compiled to WebAssembly. It works in Node and in the browser, and it needs no database server. Use it for fast local tests and for demos.
+
+Install PGlite. It is an optional peer dependency, so npm does not install it for you.
+
+```bash
+npm install @electric-sql/pglite
+```
+
+```typescript
+import { Stratum, bootstrapRolesSql } from "@stratum-hq/lib";
+import { withTenantContext } from "@stratum-hq/db-adapters";
+import { createPglitePool, createRestrictedPool } from "@stratum-hq/db-adapters/pglite";
+
+// In-memory database. Pass PGlite options, such as { dataDir: "idb://my-db" }, to keep data.
+// The library runs on adminPool (the PGlite superuser). Row-level security applies
+// only to a role that is not a superuser, so the application uses a restricted pool.
+const adminPool = await createPglitePool();
+const appPool = await createRestrictedPool(adminPool);
+const stratum = new Stratum({ adminPool, pool: appPool, autoMigrate: true });
+await stratum.initialize();
+
+// Limit the application role to reading the Stratum tables, as in production,
+// and close the legacy app.bypass_rls path (migration 032).
+await adminPool.query(bootstrapRolesSql({ appRole: "stratum_app" }));
+await adminPool.query("UPDATE stratum_security SET legacy_guc_bypass = false");
+
+const acme = await stratum.createTenant({ name: "Acme", slug: "acme" });
+await withTenantContext(appPool, acme.id, (client) => client.query("SELECT * FROM config_entries"));
+```
+
+`createPglitePool(source?)` returns a `pg.Pool`-compatible object:
+
+- `source` is a PGlite instance or PGlite options. When you pass options, the pool creates the instance and loads the `ltree` and `uuid_ossp` extensions. `pool.end()` then closes the instance.
+- When you pass your own instance, load `ltree` and `uuid_ossp` yourself. `pool.end()` does not close your instance.
+- `pool.pglite` is the PGlite instance.
+
+`createRestrictedPool(pool, { role? })` creates the role `stratum_app` (or the name you give) with `NOSUPERUSER NOBYPASSRLS`. It grants the role read and write access to every table and sequence in the `public` schema. Default privileges extend the grants to tables that the superuser creates later. The returned pool runs every query as that role. `bootstrapRolesSql({ appRole })` from `@stratum-hq/lib` narrows those grants on the Stratum tables to the recommended read-only set; `Stratum.initialize()` warns about the wider grants until you run it.
+
+The restricted role is a test and demo convenience, not a security boundary: any query can leave it with `RESET ROLE`.
+
+Limits:
+
+- **One connection.** A client from `connect()` holds the only connection until `release()`. Other callers wait in order. If you hold a client and call `pool.query()`, the call waits forever. `release()` rolls back a transaction the client left open and resets the session settings and the role, so the next client starts clean.
+- **No concurrency.** Queries run one at a time. Do not use this adapter to test race conditions or lock contention.
+- **Superuser by default.** PGlite connects as the superuser `postgres`, and a superuser bypasses row-level security. Use `createRestrictedPool` when a test must prove isolation.
+- **Only part of `pg.Pool`.** The pool supports `query`, `connect`, `end` and `on`. Callbacks, cursors, `totalCount` and the other pool counters do not exist.
+- PGlite `^0.4.2` is the supported version.
+
 ## Security
 
 - All DDL validates table names against `/^[a-zA-Z_][a-zA-Z0-9_]*$/`.
-- Tenant ID is always set via `set_config($1, true)` — fully parameterized.
+- Tenant ID is always set via `set_config($1, true)`, fully parameterized.
 - `enableRLS()` always applies `FORCE ROW LEVEL SECURITY`, preventing bypass by table owners.
 - Always reset the tenant context when returning connections to the pool; `createTenantPool` handles this for you.
 

package/dist/adapters/drizzle.d.ts

@@ -14,8 +14,9 @@ export declare class DrizzleAdapter extends BaseAdapter {
      * on the same connection.
      *
      * contextFn should return the current tenant ID (e.g. from AsyncLocalStorage).
-     * When contextFn returns an empty string the original methods are forwarded
-     * without wrapping.
+     * When contextFn returns an empty string, `transaction()` and `execute()`
+     * throw instead of running. Use the unwrapped Drizzle instance for system or
+     * admin queries that run without a tenant.
      */
     withTenant<D extends DrizzleLike>(db: D, contextFn: () => string): Pick<D, "execute" | "transaction">;
 }

package/dist/adapters/drizzle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drizzle.d.ts","sourceRoot":"","sources":["../../src/adapters/drizzle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACjE;AAQD,qBAAa,cAAe,SAAQ,WAAW;gBACjC,IAAI,EAAE,EAAE,CAAC,IAAI;IAIzB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,CAAC,SAAS,WAAW,EAC9B,EAAE,EAAE,CAAC,EACL,SAAS,EAAE,MAAM,MAAM,GACtB,IAAI,CAAC,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC;CAsCtC;AAGD,wBAAgB,UAAU,CAAC,CAAC,SAAS,WAAW,EAC9C,EAAE,EAAE,CAAC,EACL,SAAS,EAAE,MAAM,MAAM,EACvB,IAAI,EAAE,EAAE,CAAC,IAAI,GACZ,IAAI,CAAC,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC,CAGpC;AAED,4CAA4C;AAC5C,eAAO,MAAM,eAAe,mBAAa,CAAC"}
+{"version":3,"file":"drizzle.d.ts","sourceRoot":"","sources":["../../src/adapters/drizzle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACjE;AAQD,qBAAa,cAAe,SAAQ,WAAW;gBACjC,IAAI,EAAE,EAAE,CAAC,IAAI;IAIzB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,SAAS,WAAW,EAC9B,EAAE,EAAE,CAAC,EACL,SAAS,EAAE,MAAM,MAAM,GACtB,IAAI,CAAC,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC;CAsCtC;AAGD,wBAAgB,UAAU,CAAC,CAAC,SAAS,WAAW,EAC9C,EAAE,EAAE,CAAC,EACL,SAAS,EAAE,MAAM,MAAM,EACvB,IAAI,EAAE,EAAE,CAAC,IAAI,GACZ,IAAI,CAAC,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC,CAGpC;AAED,4CAA4C;AAC5C,eAAO,MAAM,eAAe,mBAAa,CAAC"}

package/dist/adapters/drizzle.js

@@ -20,8 +20,9 @@ class DrizzleAdapter extends base_adapter_js_1.BaseAdapter {
      * on the same connection.
      *
      * contextFn should return the current tenant ID (e.g. from AsyncLocalStorage).
-     * When contextFn returns an empty string the original methods are forwarded
-     * without wrapping.
+     * When contextFn returns an empty string, `transaction()` and `execute()`
+     * throw instead of running. Use the unwrapped Drizzle instance for system or
+     * admin queries that run without a tenant.
      */
     withTenant(db, contextFn) {
         const original = db;

package/dist/adapters/drizzle.js.map

@@ -1 +1 @@
-{"version":3,"file":"drizzle.js","sourceRoot":"","sources":["../../src/adapters/drizzle.ts"],"names":[],"mappings":";;;AA4EA,gCAOC;AAnFD,wDAAiD;AAUjD,gFAAgF;AAChF,KAAK,UAAU,eAAe,CAAC,EAAe,EAAE,QAAgB;IAC9D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,8CAA8C,QAAQ,SAAS,CAAC,CAAC;AACvF,CAAC;AAED,MAAa,cAAe,SAAQ,6BAAW;IAC7C,YAAY,IAAa;QACvB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED;;;;;;;;;;OAUG;IACH,UAAU,CACR,EAAK,EACL,SAAuB;QAEvB,MAAM,QAAQ,GAAG,EAAE,CAAC;QAEpB,MAAM,kBAAkB,GAAG,KAAK,EAAK,EAAmC,EAAc,EAAE;YACtF,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sDAAsD;oBACtD,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,EAAe,EAAE,EAAE;gBACpD,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACpC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,cAAc,GAAG,KAAK,EAAE,KAAc,EAAoB,EAAE;YAChE,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sDAAsD;oBACtD,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,EAAe,EAAE,EAAE;gBACpD,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACpC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,qEAAqE;QACrE,mDAAmD;QACnD,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,WAAW,EAAE,kBAAkB;SACiB,CAAC;IACrD,CAAC;CACF;AAzDD,wCAyDC;AAED,+DAA+D;AAC/D,SAAgB,UAAU,CACxB,EAAK,EACL,SAAuB,EACvB,IAAa;IAEb,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,4CAA4C;AAC/B,QAAA,eAAe,GAAG,UAAU,CAAC"}
+{"version":3,"file":"drizzle.js","sourceRoot":"","sources":["../../src/adapters/drizzle.ts"],"names":[],"mappings":";;;AA6EA,gCAOC;AApFD,wDAAiD;AAUjD,gFAAgF;AAChF,KAAK,UAAU,eAAe,CAAC,EAAe,EAAE,QAAgB;IAC9D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,8CAA8C,QAAQ,SAAS,CAAC,CAAC;AACvF,CAAC;AAED,MAAa,cAAe,SAAQ,6BAAW;IAC7C,YAAY,IAAa;QACvB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED;;;;;;;;;;;OAWG;IACH,UAAU,CACR,EAAK,EACL,SAAuB;QAEvB,MAAM,QAAQ,GAAG,EAAE,CAAC;QAEpB,MAAM,kBAAkB,GAAG,KAAK,EAAK,EAAmC,EAAc,EAAE;YACtF,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sDAAsD;oBACtD,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,EAAe,EAAE,EAAE;gBACpD,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACpC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,cAAc,GAAG,KAAK,EAAE,KAAc,EAAoB,EAAE;YAChE,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sDAAsD;oBACtD,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,EAAe,EAAE,EAAE;gBACpD,MAAM,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACpC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,qEAAqE;QACrE,mDAAmD;QACnD,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,WAAW,EAAE,kBAAkB;SACiB,CAAC;IACrD,CAAC;CACF;AA1DD,wCA0DC;AAED,+DAA+D;AAC/D,SAAgB,UAAU,CACxB,EAAK,EACL,SAAuB,EACvB,IAAa;IAEb,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,4CAA4C;AAC/B,QAAA,eAAe,GAAG,UAAU,CAAC"}

package/dist/adapters/sequelize.d.ts

@@ -15,8 +15,9 @@ export declare class SequelizeAdapter extends BaseAdapter {
      * connection-pool hops.
      *
      * contextFn should return the current tenant ID (e.g. from AsyncLocalStorage).
-     * When contextFn returns an empty string the original query is forwarded
-     * without wrapping.
+     * When contextFn returns an empty string, `query()` throws instead of
+     * running the query. Use the unwrapped Sequelize instance for system or
+     * admin queries that run without a tenant.
      */
     withTenantScope(sequelize: SequelizeLike, contextFn: () => string): SequelizeLike;
 }

package/dist/adapters/sequelize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sequelize.d.ts","sourceRoot":"","sources":["../../src/adapters/sequelize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,UAAU,aAAa;IACrB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACnF;AAED,qBAAa,gBAAiB,SAAQ,WAAW;gBACnC,IAAI,EAAE,EAAE,CAAC,IAAI;IAIzB;;;;;;;;;;OAUG;IACH,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,MAAM,GAAG,aAAa;CA0BlF;AAGD,wBAAgB,eAAe,CAC7B,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,MAAM,MAAM,EACvB,IAAI,EAAE,EAAE,CAAC,IAAI,GACZ,aAAa,CAGf"}
+{"version":3,"file":"sequelize.d.ts","sourceRoot":"","sources":["../../src/adapters/sequelize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,UAAU,aAAa;IACrB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACnF;AAED,qBAAa,gBAAiB,SAAQ,WAAW;gBACnC,IAAI,EAAE,EAAE,CAAC,IAAI;IAIzB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,MAAM,GAAG,aAAa;CA0BlF;AAGD,wBAAgB,eAAe,CAC7B,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,MAAM,MAAM,EACvB,IAAI,EAAE,EAAE,CAAC,IAAI,GACZ,aAAa,CAGf"}

package/dist/adapters/sequelize.js

@@ -15,8 +15,9 @@ class SequelizeAdapter extends base_adapter_js_1.BaseAdapter {
      * connection-pool hops.
      *
      * contextFn should return the current tenant ID (e.g. from AsyncLocalStorage).
-     * When contextFn returns an empty string the original query is forwarded
-     * without wrapping.
+     * When contextFn returns an empty string, `query()` throws instead of
+     * running the query. Use the unwrapped Sequelize instance for system or
+     * admin queries that run without a tenant.
      */
     withTenantScope(sequelize, contextFn) {
         const original = sequelize;

package/dist/adapters/sequelize.js.map

@@ -1 +1 @@
-{"version":3,"file":"sequelize.js","sourceRoot":"","sources":["../../src/adapters/sequelize.ts"],"names":[],"mappings":";;;AAwDA,0CAOC;AA/DD,wDAAiD;AAWjD,MAAa,gBAAiB,SAAQ,6BAAW;IAC/C,YAAY,IAAa;QACvB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED;;;;;;;;;;OAUG;IACH,eAAe,CAAC,SAAwB,EAAE,SAAuB;QAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC;QAE3B,MAAM,YAAY,GAAG,KAAK,EAAE,GAAW,EAAE,OAAiC,EAAE,EAAE;YAC5E,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sDAAsD;oBACtD,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,CAAU,EAAE,EAAE;gBAC/C,MAAM,QAAQ,CAAC,KAAK,CAClB,sDAAsD,EACtD,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,EAA6B,CAChE,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC,EAA6B,CAAC,CAAC;YACxF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YAChD,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzC,CAAC;IACJ,CAAC;CACF;AA1CD,4CA0CC;AAED,sEAAsE;AACtE,SAAgB,eAAe,CAC7B,SAAwB,EACxB,SAAuB,EACvB,IAAa;IAEb,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"sequelize.js","sourceRoot":"","sources":["../../src/adapters/sequelize.ts"],"names":[],"mappings":";;;AAyDA,0CAOC;AAhED,wDAAiD;AAWjD,MAAa,gBAAiB,SAAQ,6BAAW;IAC/C,YAAY,IAAa;QACvB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,SAAwB,EAAE,SAAuB;QAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC;QAE3B,MAAM,YAAY,GAAG,KAAK,EAAE,GAAW,EAAE,OAAiC,EAAE,EAAE;YAC5E,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sDAAsD;oBACtD,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,CAAU,EAAE,EAAE;gBAC/C,MAAM,QAAQ,CAAC,KAAK,CAClB,sDAAsD,EACtD,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,EAA6B,CAChE,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC,EAA6B,CAAC,CAAC;YACxF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YAChD,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzC,CAAC;IACJ,CAAC;CACF;AA3CD,4CA2CC;AAED,sEAAsE;AACtE,SAAgB,eAAe,CAC7B,SAAwB,EACxB,SAAuB,EACvB,IAAa;IAEb,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC"}

package/dist/database/manager.d.ts

@@ -21,7 +21,7 @@ export declare function createDatabase(client: pg.PoolClient | pg.Client, tenant
  * Drops the per-tenant database if it exists.
  *
  * IMPORTANT: DROP DATABASE cannot run inside a transaction block.
- * Same constraint as createDatabase — use a standalone client.
+ * Same constraint as createDatabase: use a standalone client.
  */
 export declare function dropDatabase(client: pg.PoolClient | pg.Client, tenantSlug: string): Promise<void>;
 //# sourceMappingURL=manager.d.ts.map

package/dist/database/manager.js

@@ -38,7 +38,7 @@ async function databaseExists(client, tenantSlug) {
  */
 async function createDatabase(client, tenantSlug, templateDb) {
     const dbName = getDatabaseName(tenantSlug);
-    // Identifiers validated by regex — no user-supplied interpolation outside of validated values.
+    // Identifiers validated by regex: no user-supplied interpolation outside of validated values.
     // pg does not support parameterized DDL identifiers, so we construct the SQL string directly.
     let sql = `CREATE DATABASE "${dbName}"`;
     if (templateDb) {
@@ -54,7 +54,7 @@ async function createDatabase(client, tenantSlug, templateDb) {
  * Drops the per-tenant database if it exists.
  *
  * IMPORTANT: DROP DATABASE cannot run inside a transaction block.
- * Same constraint as createDatabase — use a standalone client.
+ * Same constraint as createDatabase: use a standalone client.
  */
 async function dropDatabase(client, tenantSlug) {
     const dbName = getDatabaseName(tenantSlug);

package/dist/database/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/database/manager.ts"],"names":[],"mappings":";;AAWA,0CASC;AAMD,wCAUC;AASD,wCAiBC;AAQD,oCAMC;AA3ED,2CAAgD;AAEhD,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;GAGG;AACH,SAAgB,eAAe,CAAC,UAAkB;IAChD,IAAA,mBAAY,EAAC,UAAU,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,UAAU,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,kCAAkC,UAAU,aAAa,oBAAoB,QAAQ,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,cAAc,CAClC,MAAiC,EACjC,UAAkB;IAElB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uEAAuE,EACvE,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,cAAc,CAClC,MAAiC,EACjC,UAAkB,EAClB,UAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,+FAA+F;IAC/F,8FAA8F;IAC9F,IAAI,GAAG,GAAG,oBAAoB,MAAM,GAAG,CAAC;IACxC,IAAI,UAAU,EAAE,CAAC;QACf,iEAAiE;QACjE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,IAAI,cAAc,UAAU,GAAG,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAChC,MAAiC,EACjC,UAAkB;IAElB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,GAAG,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/database/manager.ts"],"names":[],"mappings":";;AAWA,0CASC;AAMD,wCAUC;AASD,wCAiBC;AAQD,oCAMC;AA3ED,2CAAgD;AAEhD,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;GAGG;AACH,SAAgB,eAAe,CAAC,UAAkB;IAChD,IAAA,mBAAY,EAAC,UAAU,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,UAAU,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,kCAAkC,UAAU,aAAa,oBAAoB,QAAQ,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,cAAc,CAClC,MAAiC,EACjC,UAAkB;IAElB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uEAAuE,EACvE,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,cAAc,CAClC,MAAiC,EACjC,UAAkB,EAClB,UAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,8FAA8F;IAC9F,8FAA8F;IAC9F,IAAI,GAAG,GAAG,oBAAoB,MAAM,GAAG,CAAC;IACxC,IAAI,UAAU,EAAE,CAAC;QACf,iEAAiE;QACjE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,IAAI,cAAc,UAAU,GAAG,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAChC,MAAiC,EACjC,UAAkB;IAElB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,GAAG,CAAC,CAAC;AAC5D,CAAC"}

package/dist/database/pool-manager.d.ts

@@ -1,6 +1,6 @@
 import pg from "pg";
 export interface DatabasePoolManagerOptions {
-    /** Template connection config (host, port, user, password, ssl, etc.) — database name is overridden per tenant. */
+    /** Template connection config (host, port, user, password, ssl, etc.). The database name is overridden per tenant. */
     baseConnectionConfig: pg.PoolConfig;
     /** Maximum number of tenant pools to keep open simultaneously. Default: 50. */
     maxPools?: number;

package/dist/database/pool-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool-manager.d.ts","sourceRoot":"","sources":["../../src/database/pool-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,0BAA0B;IACzC,mHAAmH;IACnH,oBAAoB,EAAE,EAAE,CAAC,UAAU,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AASD;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,OAAO,EAAE,0BAA0B;IAM/C;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC;IAgCtE;;;;;;;;OAQG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAqBxD;gFAC4E;IACtE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBrE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAO/B,uGAAuG;IACvG,OAAO,CAAC,iBAAiB;IAKzB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAWtB,qDAAqD;IACrD,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IAW5D;;;OAGG;IACH,OAAO,CAAC,OAAO;CAgBhB"}
+{"version":3,"file":"pool-manager.d.ts","sourceRoot":"","sources":["../../src/database/pool-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,MAAM,WAAW,0BAA0B;IACzC,sHAAsH;IACtH,oBAAoB,EAAE,EAAE,CAAC,UAAU,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AASD;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,OAAO,EAAE,0BAA0B;IAM/C;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC;IAgCtE;;;;;;;;OAQG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAqBxD;gFAC4E;IACtE,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBrE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAO/B,uGAAuG;IACvG,OAAO,CAAC,iBAAiB;IAKzB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAWtB,qDAAqD;IACrD,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IAW5D;;;OAGG;IACH,OAAO,CAAC,OAAO;CAgBhB"}

package/dist/index.d.ts

@@ -5,7 +5,11 @@ export { SchemaRawAdapter, createSchemaTenantPool, } from "./adapters/schema-raw
 export type { SchemaAdapterOptions } from "./adapters/schema-raw.js";
 export { SchemaPrismaAdapter, withSchemaTenant, } from "./adapters/schema-prisma.js";
 export { createPolicy, dropPolicy, enableRLS, disableRLS, isRLSEnabled, } from "./rls/manager.js";
+export type { CreatePolicyOptions } from "./rls/manager.js";
+export { tablePolicyIssues, tablePolicyWarnings, permissivePolicyIssue, isControlPlanePolicy, DEFAULT_CONTROL_ROLE, } from "./rls/policy-check.js";
+export type { PolicyRow } from "./rls/policy-check.js";
 export { setTenantContext, resetTenantContext, withTenantContext, withRlsBypass, getCurrentTenantId, } from "./rls/session.js";
+export type { TenantScope, TenantContextOptions } from "./rls/session.js";
 export { createSchema, dropSchema, schemaExists, listTenantSchemas, replicateTableToSchema, tenantSchemaName, } from "./schema/manager.js";
 export { setSchemaSearchPath, resetSearchPath, getCurrentSearchPath, } from "./schema/session.js";
 export { addTenantColumn, enableRLS as enableRLSForMigration, createIsolationPolicy, migrateTable, } from "./migration-helpers.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,SAAS,IAAI,qBAAqB,EAClC,qBAAqB,EACrB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxG,OAAO,EACL,cAAc,EACd,UAAU,IAAI,iBAAiB,EAC/B,eAAe,IAAI,sBAAsB,GAC1C,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,SAAS,IAAI,qBAAqB,EAClC,qBAAqB,EACrB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,eAAe,IAAI,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxG,OAAO,EACL,cAAc,EACd,UAAU,IAAI,iBAAiB,EAC/B,eAAe,IAAI,sBAAsB,GAC1C,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.drizzleWithTenantScope = exports.drizzleWithTenant = exports.DrizzleAdapter = exports.sequelizeWithTenantScope = exports.SequelizeAdapter = exports.DatabasePrismaAdapter = exports.DatabaseRawAdapter = exports.DatabasePoolManager = exports.dropDatabase = exports.createDatabase = exports.databaseExists = exports.getDatabaseName = exports.migrateTable = exports.createIsolationPolicy = exports.enableRLSForMigration = exports.addTenantColumn = exports.getCurrentSearchPath = exports.resetSearchPath = exports.setSchemaSearchPath = exports.tenantSchemaName = exports.replicateTableToSchema = exports.listTenantSchemas = exports.schemaExists = exports.dropSchema = exports.createSchema = exports.getCurrentTenantId = exports.withRlsBypass = exports.withTenantContext = exports.resetTenantContext = exports.setTenantContext = exports.isRLSEnabled = exports.disableRLS = exports.enableRLS = exports.dropPolicy = exports.createPolicy = exports.withSchemaTenant = exports.SchemaPrismaAdapter = exports.createSchemaTenantPool = exports.SchemaRawAdapter = exports.prismaWithTenant = exports.PrismaAdapter = exports.createTenantPool = exports.RawAdapter = exports.BaseAdapter = void 0;
+exports.drizzleWithTenantScope = exports.drizzleWithTenant = exports.DrizzleAdapter = exports.sequelizeWithTenantScope = exports.SequelizeAdapter = exports.DatabasePrismaAdapter = exports.DatabaseRawAdapter = exports.DatabasePoolManager = exports.dropDatabase = exports.createDatabase = exports.databaseExists = exports.getDatabaseName = exports.migrateTable = exports.createIsolationPolicy = exports.enableRLSForMigration = exports.addTenantColumn = exports.getCurrentSearchPath = exports.resetSearchPath = exports.setSchemaSearchPath = exports.tenantSchemaName = exports.replicateTableToSchema = exports.listTenantSchemas = exports.schemaExists = exports.dropSchema = exports.createSchema = exports.getCurrentTenantId = exports.withRlsBypass = exports.withTenantContext = exports.resetTenantContext = exports.setTenantContext = exports.DEFAULT_CONTROL_ROLE = exports.isControlPlanePolicy = exports.permissivePolicyIssue = exports.tablePolicyWarnings = exports.tablePolicyIssues = exports.isRLSEnabled = exports.disableRLS = exports.enableRLS = exports.dropPolicy = exports.createPolicy = exports.withSchemaTenant = exports.SchemaPrismaAdapter = exports.createSchemaTenantPool = exports.SchemaRawAdapter = exports.prismaWithTenant = exports.PrismaAdapter = exports.createTenantPool = exports.RawAdapter = exports.BaseAdapter = void 0;
 var base_adapter_js_1 = require("./base-adapter.js");
 Object.defineProperty(exports, "BaseAdapter", { enumerable: true, get: function () { return base_adapter_js_1.BaseAdapter; } });
 var raw_js_1 = require("./adapters/raw.js");
@@ -21,6 +21,12 @@ Object.defineProperty(exports, "dropPolicy", { enumerable: true, get: function (
 Object.defineProperty(exports, "enableRLS", { enumerable: true, get: function () { return manager_js_1.enableRLS; } });
 Object.defineProperty(exports, "disableRLS", { enumerable: true, get: function () { return manager_js_1.disableRLS; } });
 Object.defineProperty(exports, "isRLSEnabled", { enumerable: true, get: function () { return manager_js_1.isRLSEnabled; } });
+var policy_check_js_1 = require("./rls/policy-check.js");
+Object.defineProperty(exports, "tablePolicyIssues", { enumerable: true, get: function () { return policy_check_js_1.tablePolicyIssues; } });
+Object.defineProperty(exports, "tablePolicyWarnings", { enumerable: true, get: function () { return policy_check_js_1.tablePolicyWarnings; } });
+Object.defineProperty(exports, "permissivePolicyIssue", { enumerable: true, get: function () { return policy_check_js_1.permissivePolicyIssue; } });
+Object.defineProperty(exports, "isControlPlanePolicy", { enumerable: true, get: function () { return policy_check_js_1.isControlPlanePolicy; } });
+Object.defineProperty(exports, "DEFAULT_CONTROL_ROLE", { enumerable: true, get: function () { return policy_check_js_1.DEFAULT_CONTROL_ROLE; } });
 var session_js_1 = require("./rls/session.js");
 Object.defineProperty(exports, "setTenantContext", { enumerable: true, get: function () { return session_js_1.setTenantContext; } });
 Object.defineProperty(exports, "resetTenantContext", { enumerable: true, get: function () { return session_js_1.resetTenantContext; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,qDAAgD;AAAvC,8GAAA,WAAW,OAAA;AAEpB,4CAAiE;AAAxD,oGAAA,UAAU,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AACrC,kDAAqF;AAA5E,0GAAA,aAAa,OAAA;AAAE,6GAAA,UAAU,OAAoB;AACtD,0DAGkC;AAFhC,iHAAA,gBAAgB,OAAA;AAChB,uHAAA,sBAAsB,OAAA;AAGxB,gEAGqC;AAFnC,uHAAA,mBAAmB,OAAA;AACnB,oHAAA,gBAAgB,OAAA;AAGlB,+CAM0B;AALxB,0GAAA,YAAY,OAAA;AACZ,wGAAA,UAAU,OAAA;AACV,uGAAA,SAAS,OAAA;AACT,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AAGd,+CAM0B;AALxB,8GAAA,gBAAgB,OAAA;AAChB,gHAAA,kBAAkB,OAAA;AAClB,+GAAA,iBAAiB,OAAA;AACjB,2GAAA,aAAa,OAAA;AACb,gHAAA,kBAAkB,OAAA;AAGpB,kDAO6B;AAN3B,0GAAA,YAAY,OAAA;AACZ,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AACZ,+GAAA,iBAAiB,OAAA;AACjB,oHAAA,sBAAsB,OAAA;AACtB,8GAAA,gBAAgB,OAAA;AAGlB,kDAI6B;AAH3B,iHAAA,mBAAmB,OAAA;AACnB,6GAAA,eAAe,OAAA;AACf,kHAAA,oBAAoB,OAAA;AAGtB,+DAKgC;AAJ9B,uHAAA,eAAe,OAAA;AACf,6HAAA,SAAS,OAAyB;AAClC,6HAAA,qBAAqB,OAAA;AACrB,oHAAA,YAAY,OAAA;AAGd,0BAA0B;AAC1B,oDAK+B;AAJ7B,6GAAA,eAAe,OAAA;AACf,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,0GAAA,YAAY,OAAA;AAGd,8DAAiE;AAAxD,sHAAA,mBAAmB,OAAA;AAG5B,8DAAgE;AAAvD,qHAAA,kBAAkB,OAAA;AAC3B,oEAAsE;AAA7D,2HAAA,qBAAqB,OAAA;AAC9B,wDAAwG;AAA/F,gHAAA,gBAAgB,OAAA;AAAE,wHAAA,eAAe,OAA4B;AACtE,oDAI+B;AAH7B,4GAAA,cAAc,OAAA;AACd,+GAAA,UAAU,OAAqB;AAC/B,oHAAA,eAAe,OAA0B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,qDAAgD;AAAvC,8GAAA,WAAW,OAAA;AAEpB,4CAAiE;AAAxD,oGAAA,UAAU,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AACrC,kDAAqF;AAA5E,0GAAA,aAAa,OAAA;AAAE,6GAAA,UAAU,OAAoB;AACtD,0DAGkC;AAFhC,iHAAA,gBAAgB,OAAA;AAChB,uHAAA,sBAAsB,OAAA;AAGxB,gEAGqC;AAFnC,uHAAA,mBAAmB,OAAA;AACnB,oHAAA,gBAAgB,OAAA;AAGlB,+CAM0B;AALxB,0GAAA,YAAY,OAAA;AACZ,wGAAA,UAAU,OAAA;AACV,uGAAA,SAAS,OAAA;AACT,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AAGd,yDAM+B;AAL7B,oHAAA,iBAAiB,OAAA;AACjB,sHAAA,mBAAmB,OAAA;AACnB,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AACpB,uHAAA,oBAAoB,OAAA;AAItB,+CAM0B;AALxB,8GAAA,gBAAgB,OAAA;AAChB,gHAAA,kBAAkB,OAAA;AAClB,+GAAA,iBAAiB,OAAA;AACjB,2GAAA,aAAa,OAAA;AACb,gHAAA,kBAAkB,OAAA;AAIpB,kDAO6B;AAN3B,0GAAA,YAAY,OAAA;AACZ,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AACZ,+GAAA,iBAAiB,OAAA;AACjB,oHAAA,sBAAsB,OAAA;AACtB,8GAAA,gBAAgB,OAAA;AAGlB,kDAI6B;AAH3B,iHAAA,mBAAmB,OAAA;AACnB,6GAAA,eAAe,OAAA;AACf,kHAAA,oBAAoB,OAAA;AAGtB,+DAKgC;AAJ9B,uHAAA,eAAe,OAAA;AACf,6HAAA,SAAS,OAAyB;AAClC,6HAAA,qBAAqB,OAAA;AACrB,oHAAA,YAAY,OAAA;AAGd,0BAA0B;AAC1B,oDAK+B;AAJ7B,6GAAA,eAAe,OAAA;AACf,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,0GAAA,YAAY,OAAA;AAGd,8DAAiE;AAAxD,sHAAA,mBAAmB,OAAA;AAG5B,8DAAgE;AAAvD,qHAAA,kBAAkB,OAAA;AAC3B,oEAAsE;AAA7D,2HAAA,qBAAqB,OAAA;AAC9B,wDAAwG;AAA/F,gHAAA,gBAAgB,OAAA;AAAE,wHAAA,eAAe,OAA4B;AACtE,oDAI+B;AAH7B,4GAAA,cAAc,OAAA;AACd,+GAAA,UAAU,OAAqB;AAC/B,oHAAA,eAAe,OAA0B"}

package/dist/migration-helpers.d.ts

@@ -1,6 +1,7 @@
 import pg from "pg";
+import { type CreatePolicyOptions } from "./rls/manager.js";
 export declare function addTenantColumn(client: pg.PoolClient, tableName: string): Promise<void>;
 export declare function enableRLS(client: pg.PoolClient, tableName: string): Promise<void>;
-export declare function createIsolationPolicy(client: pg.PoolClient, tableName: string): Promise<void>;
+export declare function createIsolationPolicy(client: pg.PoolClient, tableName: string, options?: CreatePolicyOptions): Promise<void>;
 export declare function migrateTable(client: pg.PoolClient, tableName: string): Promise<void>;
 //# sourceMappingURL=migration-helpers.d.ts.map

package/dist/migration-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration-helpers.d.ts","sourceRoot":"","sources":["../src/migration-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAUpB,wBAAsB,eAAe,CACnC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"migration-helpers.d.ts","sourceRoot":"","sources":["../src/migration-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAA8C,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAUxG,wBAAsB,eAAe,CACnC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/migration-helpers.js

@@ -4,6 +4,7 @@ exports.addTenantColumn = addTenantColumn;
 exports.enableRLS = enableRLS;
 exports.createIsolationPolicy = createIsolationPolicy;
 exports.migrateTable = migrateTable;
+const manager_js_1 = require("./rls/manager.js");
 // Validate table name to prevent SQL injection (only allows alphanumeric + underscores)
 function validateTableName(name) {
     if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
@@ -20,10 +21,16 @@ async function enableRLS(client, tableName) {
     await client.query(`ALTER TABLE ${safe} ENABLE ROW LEVEL SECURITY`);
     await client.query(`ALTER TABLE ${safe} FORCE ROW LEVEL SECURITY`);
 }
-async function createIsolationPolicy(client, tableName) {
+async function createIsolationPolicy(client, tableName, options = {}) {
     const safe = validateTableName(tableName);
+    if (options.subtreeRead) {
+        await (0, manager_js_1.assertSubtreeFunction)(client);
+    }
     await client.query(`CREATE POLICY tenant_isolation ON ${safe}
      USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid)`);
+    if (options.subtreeRead) {
+        await client.query(`CREATE POLICY tenant_subtree_read ON ${safe} FOR SELECT USING (${manager_js_1.SUBTREE_READ_FILTER})`);
+    }
 }
 async function migrateTable(client, tableName) {
     await addTenantColumn(client, tableName);

package/dist/migration-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"migration-helpers.js","sourceRoot":"","sources":["../src/migration-helpers.ts"],"names":[],"mappings":";;AAUA,0CAQC;AAED,8BAOC;AAED,sDASC;AAED,oCAOC;AA7CD,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAChB,eAAe,IAAI,qCAAqC,CACzD,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,4BAA4B,CAAC,CAAC;IACpE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC;AACrE,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAChB,qCAAqC,IAAI;0FAC6C,CACvF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,MAAM,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"migration-helpers.js","sourceRoot":"","sources":["../src/migration-helpers.ts"],"names":[],"mappings":";;AAWA,0CAQC;AAED,8BAOC;AAED,sDAkBC;AAED,oCAOC;AAxDD,iDAAwG;AAExG,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAChB,eAAe,IAAI,qCAAqC,CACzD,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,4BAA4B,CAAC,CAAC;IACpE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC;AACrE,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,MAAqB,EACrB,SAAiB,EACjB,UAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAA,kCAAqB,EAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,CAChB,qCAAqC,IAAI;0FAC6C,CACvF,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,KAAK,CAChB,wCAAwC,IAAI,sBAAsB,gCAAmB,GAAG,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,MAAM,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC"}

package/dist/pglite/index.d.ts

@@ -0,0 +1,60 @@
+import type pg from "pg";
+import type { PGliteInterface, PGliteOptions } from "@electric-sql/pglite" with { "resolution-mode": "import" };
+/**
+ * A `pg.Pool`-compatible object over one PGlite instance.
+ *
+ * Only these members work: `query`, `connect` (a client with `query` and
+ * `release`), `end` and `on`. Other `pg.Pool` members are undefined.
+ */
+export type PglitePool = pg.Pool & {
+    /** The PGlite instance that runs every query of this pool. */
+    readonly pglite: PGliteInterface;
+};
+export interface RestrictedPoolOptions {
+    /**
+     * The name of the role. It must match `^[a-z_][a-z0-9_]{0,62}$`.
+     * Defaults to `stratum_app`.
+     */
+    role?: string;
+}
+/**
+ * Return a `pg.Pool`-compatible pool that runs every query on one PGlite instance.
+ *
+ * The pool has one connection. A client from `connect()` holds it until
+ * `release()`, and other callers wait in order. `release()` rolls back a
+ * transaction the client left open and resets the session settings, so the
+ * next client does not inherit them. Queries run as the PGlite
+ * superuser, so row-level security does not apply; use
+ * {@link createRestrictedPool} for that.
+ *
+ * @param source - A PGlite instance, or options to create one. When the
+ *   pool creates the instance, it loads the `ltree` and `uuid_ossp`
+ *   extensions, and `end()` closes the instance. When you pass an instance,
+ *   you load the extensions and you close it.
+ * @returns The pool, after PGlite is ready.
+ */
+export declare function createPglitePool(source?: PGliteInterface | PGliteOptions): Promise<PglitePool>;
+/**
+ * Return a pool that runs every query as a role that is not a superuser, so
+ * that row-level security applies.
+ *
+ * The function creates the role when it does not exist, with NOSUPERUSER and
+ * NOBYPASSRLS. It grants the role SELECT, INSERT, UPDATE and DELETE on every
+ * table in the `public` schema, and usage of every sequence. Default
+ * privileges extend these grants to tables that the current user creates
+ * later.
+ *
+ * The returned pool shares the connection and the lock of `pool`. Each client
+ * runs `SET ROLE` when it gets the connection and `RESET ROLE` at release.
+ * Its `end()` closes nothing; end the source pool instead.
+ *
+ * The restricted role is a convenience for tests and demos, not a security
+ * boundary: any query can leave it with `RESET ROLE`, because the session
+ * belongs to the superuser.
+ *
+ * @param pool - A pool from {@link createPglitePool} that runs as the superuser.
+ * @param options - The role name.
+ * @throws Error - The role name is not a plain lowercase identifier.
+ */
+export declare function createRestrictedPool(pool: PglitePool, options?: RestrictedPoolOptions): Promise<PglitePool>;
+//# sourceMappingURL=index.d.ts.map

package/dist/pglite/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pglite/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAW,MAAM,sBAAsB,CAAC,OAAO,iBAAiB,EAAE,QAAQ,EAAE,CAAC;AAMzH;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,GAAG;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAuID;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBpG;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,UAAU,CAAC,CAoBrB"}

package/dist/pglite/index.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPglitePool = createPglitePool;
+exports.createRestrictedPool = createRestrictedPool;
+// pg returns int8 and numeric values as strings, because a JavaScript number
+// loses precision above 2^53. PGlite returns numbers, so these parsers
+// restore the pg behavior.
+const PG_PARSERS = { 20: (value) => value, 1700: (value) => value };
+const ROLE_NAME = /^[a-z_][a-z0-9_]{0,62}$/;
+// A restricted pool must share the lock of its source pool, because both
+// use the same connection.
+const locks = new WeakMap();
+/**
+ * Return a lock that gives one holder at a time the connection, in request order.
+ */
+function createLock() {
+    let tail = Promise.resolve();
+    return () => {
+        let unlock;
+        const held = new Promise((resolve) => (unlock = resolve));
+        const acquired = tail.then(() => unlock);
+        tail = tail.then(() => held);
+        return acquired;
+    };
+}
+// pg sends a plain object as JSON text for every parameter type. PGlite
+// serializes by the inferred parameter type and rejects an object for a text
+// parameter, so the conversion happens here.
+function prepareValue(value) {
+    if (value === undefined)
+        return null;
+    if (value !== null &&
+        typeof value === "object" &&
+        !(value instanceof Date) &&
+        !(value instanceof Uint8Array) &&
+        !Array.isArray(value)) {
+        return JSON.stringify(value);
+    }
+    return value;
+}
+function toQueryResult(result) {
+    // PGlite reports affectedRows 0 for a SELECT. pg reports the number of rows
+    // for any statement that returns rows.
+    const rowCount = result.fields.length > 0 ? result.rows.length : (result.affectedRows ?? 0);
+    return { rows: result.rows, rowCount, fields: result.fields };
+}
+async function run(db, textOrConfig, values) {
+    const text = typeof textOrConfig === "string" ? textOrConfig : textOrConfig.text;
+    const params = values ?? (typeof textOrConfig === "string" ? undefined : textOrConfig.values);
+    if (!params || params.length === 0) {
+        // pg uses the simple query protocol when there are no parameters, and
+        // that protocol accepts several statements, as migration files hold.
+        // PGlite exec() is the same protocol. It returns one result per statement,
+        // and pg returns the last one.
+        const results = await db.exec(text, { parsers: PG_PARSERS });
+        return toQueryResult(results[results.length - 1] ?? { rows: [], fields: [] });
+    }
+    return toQueryResult(await db.query(text, params.map(prepareValue), { parsers: PG_PARSERS }));
+}
+function makePool(db, acquire, ownsInstance, role) {
+    const connect = async () => {
+        const unlock = await acquire();
+        try {
+            if (role)
+                await db.exec(`SET ROLE "${role}"`);
+        }
+        catch (err) {
+            unlock();
+            throw err;
+        }
+        let released = false;
+        return {
+            query: (textOrConfig, values) => run(db, textOrConfig, values),
+            // pg gives each client its own session and destroys the connection when
+            // release() receives an error. This pool has one session for every
+            // client, so release cleans it instead: it rolls back a transaction the
+            // client left open, and resets the settings and the role the client
+            // set. The lock stays held until the cleanup ends, so the next client
+            // gets a clean session.
+            release: () => {
+                if (released)
+                    return;
+                released = true;
+                // RESET ALL leaves the role alone, so RESET ROLE follows it.
+                db.exec("ROLLBACK; RESET ALL; RESET ROLE").then(unlock, unlock);
+            },
+        };
+    };
+    const pool = {
+        pglite: db,
+        connect,
+        async query(textOrConfig, values) {
+            const client = await connect();
+            try {
+                return await client.query(textOrConfig, values);
+            }
+            finally {
+                client.release();
+            }
+        },
+        async end() {
+            if (ownsInstance && !db.closed)
+                await db.close();
+        },
+        on() {
+            return pool;
+        },
+    };
+    const result = pool;
+    locks.set(result, acquire);
+    return result;
+}
+function isPglite(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        typeof value.exec === "function" &&
+        typeof value.query === "function");
+}
+/**
+ * Return a `pg.Pool`-compatible pool that runs every query on one PGlite instance.
+ *
+ * The pool has one connection. A client from `connect()` holds it until
+ * `release()`, and other callers wait in order. `release()` rolls back a
+ * transaction the client left open and resets the session settings, so the
+ * next client does not inherit them. Queries run as the PGlite
+ * superuser, so row-level security does not apply; use
+ * {@link createRestrictedPool} for that.
+ *
+ * @param source - A PGlite instance, or options to create one. When the
+ *   pool creates the instance, it loads the `ltree` and `uuid_ossp`
+ *   extensions, and `end()` closes the instance. When you pass an instance,
+ *   you load the extensions and you close it.
+ * @returns The pool, after PGlite is ready.
+ */
+async function createPglitePool(source) {
+    if (isPglite(source)) {
+        await source.waitReady;
+        return makePool(source, createLock(), false, null);
+    }
+    const [{ PGlite }, { ltree }, { uuid_ossp }] = await Promise.all([
+        import("@electric-sql/pglite"),
+        import("@electric-sql/pglite/contrib/ltree"),
+        import("@electric-sql/pglite/contrib/uuid_ossp"),
+    ]);
+    const options = source ?? {};
+    const db = await PGlite.create({
+        ...options,
+        extensions: { ltree, uuid_ossp, ...options.extensions },
+    });
+    return makePool(db, createLock(), true, null);
+}
+/**
+ * Return a pool that runs every query as a role that is not a superuser, so
+ * that row-level security applies.
+ *
+ * The function creates the role when it does not exist, with NOSUPERUSER and
+ * NOBYPASSRLS. It grants the role SELECT, INSERT, UPDATE and DELETE on every
+ * table in the `public` schema, and usage of every sequence. Default
+ * privileges extend these grants to tables that the current user creates
+ * later.
+ *
+ * The returned pool shares the connection and the lock of `pool`. Each client
+ * runs `SET ROLE` when it gets the connection and `RESET ROLE` at release.
+ * Its `end()` closes nothing; end the source pool instead.
+ *
+ * The restricted role is a convenience for tests and demos, not a security
+ * boundary: any query can leave it with `RESET ROLE`, because the session
+ * belongs to the superuser.
+ *
+ * @param pool - A pool from {@link createPglitePool} that runs as the superuser.
+ * @param options - The role name.
+ * @throws Error - The role name is not a plain lowercase identifier.
+ */
+async function createRestrictedPool(pool, options = {}) {
+    const role = options.role ?? "stratum_app";
+    if (!ROLE_NAME.test(role)) {
+        throw new Error(`Invalid role name '${role}': use lowercase letters, digits and underscores`);
+    }
+    await pool.query(`
+    DO $$ BEGIN
+      IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}') THEN
+        CREATE ROLE "${role}" NOLOGIN NOSUPERUSER NOBYPASSRLS;
+      END IF;
+    END $$;
+    GRANT USAGE ON SCHEMA public TO "${role}";
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO "${role}";
+    GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO "${role}";
+    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO "${role}";
+    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO "${role}";
+  `);
+    const acquire = locks.get(pool);
+    if (!acquire)
+        throw new Error("createRestrictedPool needs a pool from createPglitePool");
+    return makePool(pool.pglite, acquire, false, role);
+}
+//# sourceMappingURL=index.js.map