
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@prisma-next/sql-runtime
Advanced tools
SQL runtime implementation for Prisma Next.
The SQL runtime package implements the SQL family runtime by extending the abstract RuntimeCore base class from @prisma-next/framework-components/runtime with SQL-specific adapters, drivers, codecs, marker verification, telemetry fingerprinting, and a beforeCompile middleware chain. It provides the public runtime API for SQL-based databases, including descriptor-based static context derivation via SqlStaticContributions and execution-plane composition via ExecutionStack.
Execute SQL query Plans with deterministic verification, guardrails, and feedback. Provide a unified execution surface that works across all SQL query lanes (DSL, ORM, Raw SQL).
ExecutionStackExecutionContext from SqlStaticContributions on descriptors without instantiationRuntimeFamilyAdapter for SQL contracts (defined in runtime-spi.ts)marker.ts) on first execute and compare storage/profile hashes against the contract. On the first execute() call, any drift — hash mismatch, absent row, or missing marker table — is reported via a single warn-level structured log line through the runtime's Log interface (payload includes code, scope, expected, actual, message) and the query proceeds normally. The check runs once per runtime lifetime; subsequent queries skip the marker read. Pass verifyMarker: false to skip the marker read entirely.fingerprint.ts)guardrails/raw.ts)beforeCompile Chain: AST-rewrite middleware chain run pre-lowering (middleware/before-compile-chain.ts)SqlRuntime extends RuntimeCore<SqlQueryPlan, SqlExecutionPlan, SqlMiddleware> and overrides lower, runDriver, runBeforeCompile, and close with SQL-specific behaviour@prisma-next/framework-components - Runtime component descriptor types (./execution) and the abstract RuntimeCore base class plus runWithMiddleware helper (./runtime)@prisma-next/sql-contract - SQL contract types (via @prisma-next/sql-contract/types)@prisma-next/operations - Operation registrySqlRuntime is an abstract base class. Construct a runtime via the target factory — postgres() from @prisma-next/postgres or sqlite() from @prisma-next/sqlite. You do not call new SqlRuntime() directly.
import postgres from '@prisma-next/postgres';
import { budgets } from '@prisma-next/sql-runtime';
import type { Contract } from './src/contract';
import contractJson from './src/contract.json' with { type: 'json' };
const db = postgres<Contract>({
contractJson,
url: process.env.DATABASE_URL,
middleware: [budgets()],
});
for await (const row of db.runtime().execute(plan)) {
console.log(row);
}
Pass verifyMarker: false to skip the marker read entirely — e.g. during a known-skewed deploy window where contract drift is expected and tolerated.
const db = postgres<Contract>({
contractJson,
url: process.env.DATABASE_URL,
verifyMarker: false,
middleware: [budgets()],
});
SqlRuntime - Abstract family-layer base class; subclass to build a target runtime (construction happens via target factories — postgres() from @prisma-next/postgres, sqlite() from @prisma-next/sqlite)Runtime - Runtime instance interfacewithTransaction - Helper to run a callback inside a transaction against any RuntimeVerifyMarkerOption - Marker-verification option ('onFirstUse' default; false to skip)RuntimeTelemetryEvent, TelemetryOutcome - Telemetry event typescreateExecutionContext - Create an execution context from contract + descriptors-only stackcreateSqlExecutionStack - SQL-specific stack factory that preserves descriptor typesExecutionContext - Context type for SQL operationsTypeHelperRegistry - Registry for type helper lookupSqlStaticContributions - Interface for descriptor-level static contributions (codecs, operations, parameterized codecs, mutation default generators)RuntimeMutationDefaultGenerator - Descriptor for generator id + implementationSqlRuntimeTargetDescriptor, SqlRuntimeAdapterDescriptor, SqlRuntimeExtensionDescriptor - Structural descriptor types requiring SqlStaticContributionsSqlRuntimeAdapterInstance, SqlRuntimeDriverInstance, SqlRuntimeExtensionInstance - Instance typesSqlExecutionStack - Descriptors-only stack type for static context creationSqlExecutionStackWithDriver - Descriptor stack including driver for runtime instantiationRuntimeParameterizedCodecDescriptor - Parameterized codec descriptor typevalidateCodecRegistryCompleteness - Codec validationextractCodecIds - Extract codec IDs from a contractvalidateContractCodecMappings - Validate contract codec mappings against registrycreateAstCodecRegistry - Contract-free codec registry that resolves codecs from AST-supplied CodecRefsderiveParamMetadata - Walk a control DML AST and collect per-value codec metadata for encodingencodeParamsWithMetadata - Encode lowered control DML parameters through their codecs./test/utils bootstrap marker tables via contract-free DDL loweringMarker reads and writes go through the control adapter SPI (adapter.readMarker, adapter.initMarker, adapter.updateMarker, adapter.writeLedgerEntry).
lowerSqlPlan - SQL plan lowering via adapterbudgets - AST-first budget middleware (canonical in SQL domain), inspects plan.ast when present for row estimationlints - AST-first lint middleware (canonical in SQL domain), inspects plan.ast when presentSqlMiddleware, SqlMiddlewareContext - SQL-family middleware interface and per-execution contextBudgetsOptions, LintsOptions - Middleware option typesAfterExecuteResult - Middleware afterExecute hook result type (re-exported from @prisma-next/framework-components/runtime)Log - Log entry type (re-exported from @prisma-next/framework-components/runtime)The lints middleware operates on plan.ast when it is a SQL QueryAst:
limit is missingselectAllIntent is presentWhen plan.ast is missing, the middleware falls back to raw heuristic guardrails (fallbackWhenAstMissing: 'raw') or skips linting (fallbackWhenAstMissing: 'skip'). Default is 'raw'.
import postgres from '@prisma-next/postgres';
import { lints } from '@prisma-next/sql-runtime';
const db = postgres<Contract>({
contractJson,
url: process.env.DATABASE_URL,
middleware: [lints({ severities: { noLimit: 'error' } })],
});
The SQL runtime extends the abstract RuntimeCore base class from @prisma-next/framework-components/runtime with SQL-specific implementations. Descriptors implement SqlStaticContributions so ExecutionContext can be derived from the descriptors-only stack without instantiation.
@prisma-next/framework-components/execution)class SqlRuntime extends RuntimeCore<SqlQueryPlan, SqlExecutionPlan, SqlMiddleware> — overrides lower (with codec param-encoding), runDriver, runBeforeCompile (delegates to the SQL beforeCompile chain), and close. The execution path also wraps the runWithMiddleware helper from framework-components/runtime with codec row-decoding, marker verification (via the RuntimeFamilyAdapter defined in runtime-spi.ts), and telemetry fingerprinting (via computeSqlFingerprint from fingerprint.ts).flowchart LR
Stack[ExecutionStack] --> Context[ExecutionContext]
Stack --> StackI[ExecutionStackInstance]
Stack --> DriverDesc[Driver Descriptor]
Stack --> AdapterDesc[Adapter Descriptor]
Stack --> Packs[Extension Packs]
Context --> Runtime[SqlRuntime]
Runtime -.extends.-> Core[RuntimeCore]
DriverDesc --> DriverInst[Driver Instance]
AdapterDesc --> AdapterInst[Adapter Instance]
Runtime --> DriverInst
The SQL runtime uses stable error codes for programmatic error handling:
RUNTIME.CONTRACT_FAMILY_MISMATCH — Contract target family differs from runtime familyRUNTIME.CONTRACT_TARGET_MISMATCH — Contract target differs from stack target descriptorRUNTIME.MISSING_EXTENSION_PACK — Contract requires an extension pack not provided in stackRUNTIME.DUPLICATE_PARAMETERIZED_CODEC — Multiple extensions registered same parameterized codecRUNTIME.DUPLICATE_MUTATION_DEFAULT_GENERATOR — Multiple components registered the same mutation default generator id (details include existingOwner and incomingOwner)RUNTIME.MISSING_MUTATION_DEFAULT_GENERATOR — Contract references mutation default generator id(s) the assembled stack does not provide; surfaced at createExecutionContext time (details include ids)RUNTIME.MUTATION_DEFAULT_GENERATOR_MISSING — Defense-in-depth lazy fallback raised by applyMutationDefaults when a generator becomes unavailable after context creationRUNTIME.TYPE_PARAMS_INVALID — Type parameters fail codec schema validationRUNTIME.CODEC_MISSING — Required codec not found in registryRUNTIME.DECODE_FAILED — Row decoding failedAll errors follow the repo's error envelope convention with code, category, severity, and optional details.
Unit tests verify:
FAQs
SQL runtime implementation for Prisma Next
The npm package @prisma-next/sql-runtime receives a total of 14,627 weekly downloads. As such, @prisma-next/sql-runtime popularity was classified as popular.
We found that @prisma-next/sql-runtime demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.