
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@prisma-next/sql-runtime
Advanced tools
SQL runtime implementation for Prisma Next.
The SQL runtime package implements the SQL family runtime by extending the abstract RuntimeCore base class from @prisma-next/framework-components/runtime with SQL-specific adapters, drivers, codecs, marker verification, telemetry fingerprinting, and a beforeCompile middleware chain. It provides the public runtime API for SQL-based databases, including descriptor-based static context derivation via SqlStaticContributions and execution-plane composition via ExecutionStack.
Execute SQL query Plans with deterministic verification, guardrails, and feedback. Provide a unified execution surface that works across all SQL query lanes (DSL, ORM, Raw SQL).
ExecutionStackExecutionContext from SqlStaticContributions on descriptors without instantiationRuntimeFamilyAdapter for SQL contracts (defined in runtime-spi.ts)marker.ts) on first execute and compare storage/profile hashes against the contract. On the first execute() call, any drift — hash mismatch, absent row, or missing marker table — is reported via a single warn-level structured log line through the runtime's Log interface (payload includes code, scope, expected, actual, message) and the query proceeds normally. The check runs once per runtime lifetime; subsequent queries skip the marker read. Pass verifyMarker: false to skip the marker read entirely.fingerprint.ts)guardrails/raw.ts)beforeCompile Chain: AST-rewrite middleware chain run pre-lowering (middleware/before-compile-chain.ts)SqlRuntime extends RuntimeCore<SqlQueryPlan, SqlExecutionPlan, SqlMiddleware> and overrides lower, runDriver, runBeforeCompile, and close with SQL-specific behaviour@prisma-next/framework-components - Runtime component descriptor types (./execution) and the abstract RuntimeCore base class plus runWithMiddleware helper (./runtime)@prisma-next/sql-contract - SQL contract types (via @prisma-next/sql-contract/types)@prisma-next/operations - Operation registrySqlRuntime is an abstract base class. Construct a runtime via the target factory — postgres() from @prisma-next/postgres or sqlite() from @prisma-next/sqlite. You do not call new SqlRuntime() directly.
import postgres from '@prisma-next/postgres';
import { budgets } from '@prisma-next/sql-runtime';
import type { Contract } from './src/contract';
import contractJson from './src/contract.json' with { type: 'json' };
const db = postgres<Contract>({
contractJson,
url: process.env.DATABASE_URL,
middleware: [budgets()],
});
for await (const row of db.runtime().execute(plan)) {
console.log(row);
}
Pass verifyMarker: false to skip the marker read entirely — e.g. during a known-skewed deploy window where contract drift is expected and tolerated.
const db = postgres<Contract>({
contractJson,
url: process.env.DATABASE_URL,
verifyMarker: false,
middleware: [budgets()],
});
SqlRuntime - Abstract family-layer base class; subclass to build a target runtime (construction happens via target factories — postgres() from @prisma-next/postgres, sqlite() from @prisma-next/sqlite)Runtime - Runtime instance interfacewithTransaction - Helper to run a callback inside a transaction against any RuntimeVerifyMarkerOption - Marker-verification option ('onFirstUse' default; false to skip)RuntimeTelemetryEvent, TelemetryOutcome - Telemetry event typescreateExecutionContext - Create an execution context from contract + descriptors-only stackcreateSqlExecutionStack - SQL-specific stack factory that preserves descriptor typesExecutionContext - Context type for SQL operationsTypeHelperRegistry - Registry for type helper lookupSqlStaticContributions - Interface for descriptor-level static contributions (codecs, operations, parameterized codecs, mutation default generators)RuntimeMutationDefaultGenerator - Descriptor for generator id + implementationSqlRuntimeTargetDescriptor, SqlRuntimeAdapterDescriptor, SqlRuntimeExtensionDescriptor - Structural descriptor types requiring SqlStaticContributionsSqlRuntimeAdapterInstance, SqlRuntimeDriverInstance, SqlRuntimeExtensionInstance - Instance typesSqlExecutionStack - Descriptors-only stack type for static context creationSqlExecutionStackWithDriver - Descriptor stack including driver for runtime instantiationRuntimeParameterizedCodecDescriptor - Parameterized codec descriptor typevalidateCodecRegistryCompleteness - Codec validationextractCodecIds - Extract codec IDs from a contractvalidateContractCodecMappings - Validate contract codec mappings against registrycreateAstCodecRegistry - Contract-free codec registry that resolves codecs from AST-supplied CodecRefsderiveParamMetadata - Walk a control DML AST and collect per-value codec metadata for encodingencodeParamsWithMetadata - Encode lowered control DML parameters through their codecs./test/utils bootstrap marker tables via contract-free DDL loweringMarker reads and writes go through the control adapter SPI (adapter.readMarker, adapter.initMarker, adapter.updateMarker, adapter.writeLedgerEntry).
lowerSqlPlan - SQL plan lowering via adapterbudgets - AST-first budget middleware (canonical in SQL domain), inspects plan.ast when present for row estimationlints - AST-first lint middleware (canonical in SQL domain), inspects plan.ast when presentSqlMiddleware, SqlMiddlewareContext - SQL-family middleware interface and per-execution contextBudgetsOptions, LintsOptions - Middleware option typesAfterExecuteResult - Middleware afterExecute hook result type (re-exported from @prisma-next/framework-components/runtime)Log - Log entry type (re-exported from @prisma-next/framework-components/runtime)The lints middleware operates on plan.ast when it is a SQL QueryAst:
limit is missingselectAllIntent is presentWhen plan.ast is missing, the middleware falls back to raw heuristic guardrails (fallbackWhenAstMissing: 'raw') or skips linting (fallbackWhenAstMissing: 'skip'). Default is 'raw'.
import postgres from '@prisma-next/postgres';
import { lints } from '@prisma-next/sql-runtime';
const db = postgres<Contract>({
contractJson,
url: process.env.DATABASE_URL,
middleware: [lints({ severities: { noLimit: 'error' } })],
});
The SQL runtime extends the abstract RuntimeCore base class from @prisma-next/framework-components/runtime with SQL-specific implementations. Descriptors implement SqlStaticContributions so ExecutionContext can be derived from the descriptors-only stack without instantiation.
@prisma-next/framework-components/execution)class SqlRuntime extends RuntimeCore<SqlQueryPlan, SqlExecutionPlan, SqlMiddleware> — overrides lower (with codec param-encoding), runDriver, runBeforeCompile (delegates to the SQL beforeCompile chain), and close. The execution path also wraps the runWithMiddleware helper from framework-components/runtime with codec row-decoding, marker verification (via the RuntimeFamilyAdapter defined in runtime-spi.ts), and telemetry fingerprinting (via computeSqlFingerprint from fingerprint.ts).flowchart LR
Stack[ExecutionStack] --> Context[ExecutionContext]
Stack --> StackI[ExecutionStackInstance]
Stack --> DriverDesc[Driver Descriptor]
Stack --> AdapterDesc[Adapter Descriptor]
Stack --> Packs[Extension Packs]
Context --> Runtime[SqlRuntime]
Runtime -.extends.-> Core[RuntimeCore]
DriverDesc --> DriverInst[Driver Instance]
AdapterDesc --> AdapterInst[Adapter Instance]
Runtime --> DriverInst
The SQL runtime uses stable error codes for programmatic error handling:
RUNTIME.CONTRACT_FAMILY_MISMATCH — Contract target family differs from runtime familyRUNTIME.CONTRACT_TARGET_MISMATCH — Contract target differs from stack target descriptorRUNTIME.MISSING_EXTENSION_PACK — Contract requires an extension pack not provided in stackRUNTIME.DUPLICATE_PARAMETERIZED_CODEC — Multiple extensions registered same parameterized codecRUNTIME.DUPLICATE_MUTATION_DEFAULT_GENERATOR — Multiple components registered the same mutation default generator id (details include existingOwner and incomingOwner)RUNTIME.MISSING_MUTATION_DEFAULT_GENERATOR — Contract references mutation default generator id(s) the assembled stack does not provide; surfaced at createExecutionContext time (details include ids)RUNTIME.MUTATION_DEFAULT_GENERATOR_MISSING — Defense-in-depth lazy fallback raised by applyMutationDefaults when a generator becomes unavailable after context creationRUNTIME.TYPE_PARAMS_INVALID — Type parameters fail codec schema validationRUNTIME.CODEC_MISSING — Required codec not found in registryRUNTIME.DECODE_FAILED — Row decoding failedAll errors follow the repo's error envelope convention with code, category, severity, and optional details.
Unit tests verify:
FAQs
SQL runtime implementation for Prisma Next
The npm package @prisma-next/sql-runtime receives a total of 11,175 weekly downloads. As such, @prisma-next/sql-runtime popularity was classified as popular.
We found that @prisma-next/sql-runtime demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.