@gettersethya/mira 0.1.0-alpha.10

package/dist/src/collection-service/input-schema.js

@@ -0,0 +1,123 @@
+import { ParseResult, Schema } from "effect";
+import { ValidationError } from "./errors.js";
+// Fields auto-generated by the system — excluded from all input schemas.
+const GENERATED_FIELDS = new Set(["id", "seqId", "created", "updated"]);
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function filterAnnotations(kind, errorFn) {
+    if (errorFn === undefined)
+        return undefined;
+    const msg = errorFn(kind);
+    if (msg === undefined)
+        return undefined;
+    return { message: () => msg };
+}
+function propertyToSchema(prop, fieldDef) {
+    const errorFn = fieldDef?.error;
+    if (prop["x-kind"] === "literalText") {
+        const typeMsg = errorFn?.("type");
+        const base = typeMsg !== undefined
+            ? Schema.String.annotations({ message: () => typeMsg })
+            : Schema.String;
+        const literalValues = prop["x-literal"];
+        if (literalValues && literalValues.length > 0) {
+            const literalSet = new Set(literalValues);
+            return base.pipe(Schema.filter((a) => literalSet.has(a), filterAnnotations("literal", errorFn)));
+        }
+        return base;
+    }
+    if (prop["x-kind"] === "json")
+        return Schema.Unknown;
+    if (prop["x-kind"] === "date" ||
+        prop["x-kind"] === "relation" ||
+        prop["x-kind"] === "file")
+        return Schema.String;
+    if (prop.type === "string") {
+        const typeMsg = errorFn?.("type");
+        const base = typeMsg !== undefined
+            ? Schema.String.annotations({ message: () => typeMsg })
+            : Schema.String;
+        let s = base;
+        if (prop.format === "email") {
+            s = s.pipe(Schema.pattern(EMAIL_RE, filterAnnotations("email", errorFn)));
+        }
+        if (prop.minLength !== undefined) {
+            s = s.pipe(Schema.minLength(prop.minLength, filterAnnotations("minLength", errorFn)));
+        }
+        if (prop.maxLength !== undefined) {
+            s = s.pipe(Schema.maxLength(prop.maxLength, filterAnnotations("maxLength", errorFn)));
+        }
+        return s;
+    }
+    if (prop.type === "integer") {
+        const typeMsg = errorFn?.("type");
+        const base = typeMsg !== undefined
+            ? Schema.Number.annotations({ message: () => typeMsg })
+            : Schema.Number;
+        let s = base.pipe(Schema.int(filterAnnotations("int", errorFn)));
+        if (prop.minimum !== undefined) {
+            s = s.pipe(Schema.greaterThanOrEqualTo(prop.minimum, filterAnnotations("minimum", errorFn)));
+        }
+        if (prop.maximum !== undefined) {
+            s = s.pipe(Schema.lessThanOrEqualTo(prop.maximum, filterAnnotations("maximum", errorFn)));
+        }
+        return s;
+    }
+    if (prop.type === "number") {
+        const typeMsg = errorFn?.("type");
+        const base = typeMsg !== undefined
+            ? Schema.Number.annotations({ message: () => typeMsg })
+            : Schema.Number;
+        let s = base;
+        if (prop.minimum !== undefined) {
+            s = s.pipe(Schema.greaterThanOrEqualTo(prop.minimum, filterAnnotations("minimum", errorFn)));
+        }
+        if (prop.maximum !== undefined) {
+            s = s.pipe(Schema.lessThanOrEqualTo(prop.maximum, filterAnnotations("maximum", errorFn)));
+        }
+        return s;
+    }
+    if (prop.type === "boolean") {
+        const typeMsg = errorFn?.("type");
+        return typeMsg !== undefined
+            ? Schema.Boolean.annotations({ message: () => typeMsg })
+            : Schema.Boolean;
+    }
+    return Schema.Unknown;
+}
+export function buildInputSchemas(colDef) {
+    const schema = colDef.schema;
+    const required = new Set(schema.required ?? []);
+    const createFields = {};
+    const updateFields = {};
+    for (const [key, prop] of Object.entries(schema.properties)) {
+        if (GENERATED_FIELDS.has(key))
+            continue;
+        const fieldDef = colDef.fields[key];
+        const errorFn = fieldDef?.error;
+        const base = propertyToSchema(prop, fieldDef);
+        if (required.has(key)) {
+            const requiredMsg = errorFn?.("required");
+            createFields[key] = requiredMsg !== undefined
+                ? Schema.propertySignature(base).annotations({ missingMessage: () => requiredMsg })
+                : base;
+        }
+        else {
+            createFields[key] = Schema.optional(base);
+        }
+        updateFields[key] = Schema.optional(base);
+    }
+    return {
+        create: Schema.Struct(createFields),
+        update: Schema.Struct(updateFields)
+    };
+}
+export function parseErrToValidationError(collection) {
+    return (err) => {
+        const issues = ParseResult.ArrayFormatter.formatIssueSync(err.issue).map((i) => {
+            const prefix = i.path.length > 0 ? `${i.path.join(".")}: ` : "";
+            return `${prefix}${i.message}`;
+        });
+        return new ValidationError({ collection, issues });
+    };
+}
+//# sourceMappingURL=input-schema.js.map

package/dist/src/collection-service/input-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-schema.js","sourceRoot":"","sources":["../../../src/collection-service/input-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvE,MAAM,QAAQ,GAAG,4BAA4B,CAAA;AAO7C,SAAS,iBAAiB,CACxB,IAAoB,EACpB,OAAmE;IAEnE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAA;AAC/B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAwB,EAAE,QAA8B;IAChF,MAAM,OAAO,GAAG,QAAQ,EAAE,KAAK,CAAA;IAE/B,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,aAAa,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,IAAI,GAAmC,OAAO,KAAK,SAAS;YAChE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YACvD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;QACjB,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,CAAA;QACvC,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAA;YACzC,OAAO,IAAI,CAAC,IAAI,CACd,MAAM,CAAC,MAAM,CACX,CAAC,CAAC,EAAe,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EACrC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CACtC,CACF,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,CAAA;IACpD,IACE,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM;QACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM;QACzB,OAAO,MAAM,CAAC,MAAM,CAAA;IAEtB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,IAAI,GAAmC,OAAO,KAAK,SAAS;YAChE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YACvD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;QACjB,IAAI,CAAC,GAAmC,IAAI,CAAA;QAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC5B,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAC3E,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QACvF,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QACvF,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,IAAI,GAAmC,OAAO,KAAK,SAAS;YAChE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YACvD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;QACjB,IAAI,CAAC,GAAmC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAChG,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,IAAI,GAAmC,OAAO,KAAK,SAAS;YAChE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YACvD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;QACjB,IAAI,CAAC,GAAmC,IAAI,CAAA;QAC5C,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,CAAA;QACjC,OAAO,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YACxD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAA;IACpB,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAwB;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IAK/C,MAAM,YAAY,GAAgC,EAAE,CAAA;IACpD,MAAM,YAAY,GAAgC,EAAE,CAAA;IAEpD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAEvC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,QAAQ,EAAE,KAAK,CAAA;QAE/B,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAE7C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,OAAO,EAAE,CAAC,UAAU,CAAC,CAAA;YACzC,YAAY,CAAC,GAAG,CAAC,GAAG,WAAW,KAAK,SAAS;gBAC3C,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;gBACnF,CAAC,CAAC,IAAI,CAAA;QACV,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3C,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3C,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;KACpC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,CAAC,GAA2B,EAAmB,EAAE;QACtD,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7E,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YAC/D,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,CAAA;QAChC,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IACpD,CAAC,CAAA;AACH,CAAC"}

package/dist/src/collection-service/where.d.ts

@@ -0,0 +1,35 @@
+import { Effect } from "effect";
+import type { CollectionSchema } from "@gettersethya/mira-client";
+import type { EnforceResult } from "../rule/enforcer.js";
+import type { RepoRecord, SortOrder, WhereClause } from "../repository/types.js";
+import type { RequestCtx } from "./context.js";
+import { ForbiddenError } from "./errors.js";
+/** Combines two WHERE clauses with AND. Both inputs are trusted internal code. */
+export declare function andWhere(a: WhereClause, b: WhereClause): WhereClause;
+/** Produces a WHERE clause that matches a single record by id. */
+export declare function idClause(id: string): WhereClause;
+/** Produces a WHERE clause for cursor pagination: seqId strictly after the given cursor. */
+export declare function cursorClause(after: number): WhereClause;
+/**
+ * Resolves `@auth_<field>` and `@request_<source>_<key>` placeholders produced by the
+ * rule compiler into positional `?` params bound from `RequestCtx`.
+ *
+ * The replacement is done in a single left-to-right pass so that the param array stays
+ * in the same order as the `?` placeholders in the resulting SQL.
+ *
+ * Returns `ForbiddenError` if the rule references auth but `ctx.auth` is absent.
+ */
+export declare function resolveCtxPlaceholders(result: EnforceResult, ctx: RequestCtx, collection: string, action: string): Effect.Effect<{
+    sql: string;
+    params: unknown[];
+}, ForbiddenError, never>;
+/**
+ * Replaces `t.<fieldName>` column references in a WHERE clause with `?` params
+ * bound to the corresponding values in `record`.
+ *
+ * Used for the `create` permission pre-check: `SELECT 1 WHERE <rule>` without a FROM.
+ * The replacement is done left-to-right to preserve param ordering with existing `?`.
+ */
+export declare function resolveFieldRefs(clause: WhereClause, record: RepoRecord): WhereClause;
+export declare function buildUserSort(query: RequestCtx["query"], schema: CollectionSchema): SortOrder | null;
+//# sourceMappingURL=where.d.ts.map

package/dist/src/collection-service/where.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"where.d.ts","sourceRoot":"","sources":["../../../src/collection-service/where.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,GAAG,WAAW,CAKpE;AAED,kEAAkE;AAClE,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,CAEhD;AAED,4FAA4F;AAC5F,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAEvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;0BAiChH;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,GAAG,WAAW,CAgBrF;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAC1B,MAAM,EAAE,gBAAgB,GACvB,SAAS,GAAG,IAAI,CAMlB"}

package/dist/src/collection-service/where.js

@@ -0,0 +1,91 @@
+import { Effect } from "effect";
+import { ForbiddenError } from "./errors.js";
+/** Combines two WHERE clauses with AND. Both inputs are trusted internal code. */
+export function andWhere(a, b) {
+    return {
+        sql: `(${a.sql}) AND (${b.sql})`,
+        params: [...a.params, ...b.params]
+    };
+}
+/** Produces a WHERE clause that matches a single record by id. */
+export function idClause(id) {
+    return { sql: "t.id = ?", params: [id] };
+}
+/** Produces a WHERE clause for cursor pagination: seqId strictly after the given cursor. */
+export function cursorClause(after) {
+    return { sql: "t.seqId > ?", params: [after] };
+}
+/**
+ * Resolves `@auth_<field>` and `@request_<source>_<key>` placeholders produced by the
+ * rule compiler into positional `?` params bound from `RequestCtx`.
+ *
+ * The replacement is done in a single left-to-right pass so that the param array stays
+ * in the same order as the `?` placeholders in the resulting SQL.
+ *
+ * Returns `ForbiddenError` if the rule references auth but `ctx.auth` is absent.
+ */
+export function resolveCtxPlaceholders(result, ctx, collection, action) {
+    return Effect.gen(function* () {
+        const needsAuth = /@auth_\w+/.test(result.sql);
+        if (needsAuth && ctx.auth === undefined) {
+            return yield* new ForbiddenError({ collection, action });
+        }
+        const resolved = [];
+        let pIdx = 0;
+        const { params } = result;
+        // Single-pass left-to-right replacement preserves param ordering.
+        // Groups: (1) @auth field, (2) @request source, (3) @request key
+        const newSql = result.sql.replace(/\?|@auth_(\w+)|@request_(\w+)_(\w+)/g, (match, g1, g2, g3) => {
+            const authField = typeof g1 === "string" ? g1 : undefined;
+            const reqSource = typeof g2 === "string" ? g2 : undefined;
+            const reqKey = typeof g3 === "string" ? g3 : undefined;
+            if (match === "?") {
+                resolved.push(params[pIdx++]);
+            }
+            else if (authField === "collection") {
+                resolved.push(ctx.auth?.collection ?? null);
+            }
+            else if (authField !== undefined) {
+                resolved.push(ctx.auth?.record[authField] ?? null);
+            }
+            else if (reqSource !== undefined && reqKey !== undefined) {
+                const val = reqSource === "query" ? ctx.query[reqKey] : ctx.headers[reqKey];
+                resolved.push(Array.isArray(val) ? val[0] : (val ?? null));
+            }
+            return "?";
+        });
+        return yield* Effect.succeed({ sql: newSql, params: resolved });
+    });
+}
+/**
+ * Replaces `t.<fieldName>` column references in a WHERE clause with `?` params
+ * bound to the corresponding values in `record`.
+ *
+ * Used for the `create` permission pre-check: `SELECT 1 WHERE <rule>` without a FROM.
+ * The replacement is done left-to-right to preserve param ordering with existing `?`.
+ */
+export function resolveFieldRefs(clause, record) {
+    const resolved = [];
+    let pIdx = 0;
+    const { params } = clause;
+    const newSql = clause.sql.replace(/\?|\bt\.(\w+)\b/g, (_, g1) => {
+        const field = typeof g1 === "string" ? g1 : undefined;
+        if (field !== undefined) {
+            resolved.push(record[field] ?? null);
+        }
+        else {
+            resolved.push(params[pIdx++]);
+        }
+        return "?";
+    });
+    return { sql: newSql, params: resolved };
+}
+export function buildUserSort(query, schema) {
+    const sortField = typeof query["sort"] === "string" ? query["sort"] : null;
+    if (sortField === null || !schema.properties[sortField])
+        return null;
+    const rawOrder = typeof query["order"] === "string" ? query["order"] : null;
+    const direction = rawOrder === "desc" ? "desc" : "asc";
+    return { field: sortField, direction };
+}
+//# sourceMappingURL=where.js.map

package/dist/src/collection-service/where.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"where.js","sourceRoot":"","sources":["../../../src/collection-service/where.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAK/B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,kFAAkF;AAClF,MAAM,UAAU,QAAQ,CAAC,CAAc,EAAE,CAAc;IACrD,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,GAAG;QAChC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;KACnC,CAAA;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,QAAQ,CAAC,EAAU;IACjC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;AAC1C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,GAAe,EAAE,UAAkB,EAAE,MAAc;IAC/G,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAmB,EAAE,CAAA;QACnC,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;QAEzB,kEAAkE;QAClE,iEAAiE;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,sCAAsC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAU,EAAE;YACtG,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YACzD,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YACzD,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YAEtD,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBAClB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YAC/B,CAAC;iBAAM,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,CAAA;YAC7C,CAAC;iBAAM,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAA;YACpD,CAAC;iBAAM,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBAC3E,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAA;YAC5D,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC,CAAC,CAAA;QAEF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,MAAkB;IACtE,MAAM,QAAQ,GAAmB,EAAE,CAAA;IACnC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAU,EAAE;QACtE,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAA;QACtC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAC,CAAA;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAA0B,EAC1B,MAAwB;IAExB,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,MAAM,SAAS,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAA;IACtD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AACxC,CAAC"}

package/dist/src/config/config.d.ts

@@ -0,0 +1,44 @@
+import { SqlClient } from "@effect/sql";
+import { CryptoService } from "../crypto/index.js";
+import { Context, Layer } from "effect";
+import type { AppConfigShape } from "./types.js";
+declare const AppConfig_base: Context.TagClass<AppConfig, "AppConfig", AppConfigShape>;
+/**
+ * Application configuration tag, backed by the `_config` table in the database.
+ *
+ * On first boot, seeds default values (including an auto-generated `jwt_secret`)
+ * into the `_config` table. Runtime reads go through the database — no env vars
+ * or config files are needed for basic operation.
+ *
+ * Provides access to:
+ * - `appName`, `port`, `applicationUrl` — basic server configuration
+ * - `jwtSecret` — Redacted JWT signing secret (auto-generated)
+ * - `useS3`, `s3Config` — optional S3 storage configuration
+ *
+ * @example
+ * import { AppConfig } from "@gettersethya/mira"
+ *
+ * Effect.gen(function* () {
+ *   const cfg = yield* AppConfig
+ *   console.log(cfg.appName, cfg.port)
+ *   const secret = cfg.jwtSecret  // Redacted<string>
+ * })
+ *
+ * @see AppConfigLive — the live layer implementation
+ * @see AppConfigShape — the full config shape
+ */
+export declare class AppConfig extends AppConfig_base {
+}
+/**
+ * Live layer for `AppConfig`.
+ * Seeds the `_config` table on first boot with sensible defaults
+ * (including auto-generating `jwt_secret` via CryptoService).
+ *
+ * @example
+ * Layer.provideMerge(AppConfigLive)
+ *
+ * @see AppConfig — the service tag
+ */
+export declare const AppConfigLive: Layer.Layer<AppConfig, import("effect/ParseResult").ParseError | import("@effect/sql/SqlError").SqlError, CryptoService | SqlClient.SqlClient>;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/src/config/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAa,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,OAAO,EAAU,KAAK,EAA4B,MAAM,QAAQ,CAAA;AACzE,OAAO,KAAK,EAAE,cAAc,EAAY,MAAM,YAAY,CAAA;;AAO1D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,SAAU,SAAQ,cAAqD;CAAG;AAEvF;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,gJA8DzB,CAAA"}

package/dist/src/config/config.js

@@ -0,0 +1,89 @@
+import { SqlClient, SqlSchema } from "@effect/sql";
+import { CryptoService } from "../crypto/index.js";
+import { Context, Effect, Layer, Option, Redacted, Schema } from "effect";
+const ConfigRowSchema = Schema.Struct({
+    key: Schema.String,
+    value: Schema.String
+});
+/**
+ * Application configuration tag, backed by the `_config` table in the database.
+ *
+ * On first boot, seeds default values (including an auto-generated `jwt_secret`)
+ * into the `_config` table. Runtime reads go through the database — no env vars
+ * or config files are needed for basic operation.
+ *
+ * Provides access to:
+ * - `appName`, `port`, `applicationUrl` — basic server configuration
+ * - `jwtSecret` — Redacted JWT signing secret (auto-generated)
+ * - `useS3`, `s3Config` — optional S3 storage configuration
+ *
+ * @example
+ * import { AppConfig } from "@gettersethya/mira"
+ *
+ * Effect.gen(function* () {
+ *   const cfg = yield* AppConfig
+ *   console.log(cfg.appName, cfg.port)
+ *   const secret = cfg.jwtSecret  // Redacted<string>
+ * })
+ *
+ * @see AppConfigLive — the live layer implementation
+ * @see AppConfigShape — the full config shape
+ */
+export class AppConfig extends Context.Tag("AppConfig")() {
+}
+/**
+ * Live layer for `AppConfig`.
+ * Seeds the `_config` table on first boot with sensible defaults
+ * (including auto-generating `jwt_secret` via CryptoService).
+ *
+ * @example
+ * Layer.provideMerge(AppConfigLive)
+ *
+ * @see AppConfig — the service tag
+ */
+export const AppConfigLive = Layer.effect(AppConfig, Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    // DDL — sql.unsafe is fine for CREATE TABLE
+    yield* sql.unsafe(`CREATE TABLE IF NOT EXISTS _config (key TEXT PRIMARY KEY, value TEXT NOT NULL)`);
+    const rows = yield* SqlSchema.findAll({
+        Request: Schema.Void,
+        Result: ConfigRowSchema,
+        execute: () => sql `SELECT key, value FROM ${sql("_config")}`
+    })(undefined);
+    const stored = new Map(rows.map((r) => [r.key, r.value]));
+    const seed = (key, defaultValue) => Effect.gen(function* () {
+        const existing = stored.get(key);
+        if (existing !== undefined)
+            return existing;
+        yield* sql `INSERT INTO ${sql("_config")} ${sql.insert({ key, value: defaultValue })}`;
+        return defaultValue;
+    });
+    const require = (key) => Effect.fromNullable(stored.get(key)).pipe(Effect.mapError(() => new Error(`_config key "${key}" is required when use_s3=true`)), Effect.orDie);
+    const appName = yield* seed("app_name", "mira");
+    const port = Number(yield* seed("port", "8080"));
+    const applicationUrl = yield* seed("application_url", `http://localhost:${port}`);
+    // Generated once on first boot, persisted so tokens survive restarts
+    const existingSecret = stored.get("jwt_secret");
+    const jwtSecretStr = existingSecret !== undefined
+        ? existingSecret
+        : yield* Effect.gen(function* () {
+            const cryptoSvc = yield* CryptoService;
+            const generated = Buffer.from(yield* cryptoSvc.randomBytes(48)).toString("hex");
+            yield* sql `INSERT INTO ${sql("_config")} ${sql.insert({ key: "jwt_secret", value: generated })}`;
+            yield* Effect.logInfo("jwt_secret generated and persisted to _config table.");
+            return generated;
+        });
+    const jwtSecret = Redacted.make(jwtSecretStr);
+    const useS3 = (yield* seed("use_s3", "false")) === "true";
+    const s3Config = useS3
+        ? Option.some({
+            endpoint: Redacted.make(yield* require("s3_endpoint")),
+            bucketName: yield* require("s3_bucket_name"),
+            regionName: yield* require("s3_region_name"),
+            accessKey: Redacted.make(yield* require("s3_access_key")),
+            secret: Redacted.make(yield* require("s3_secret"))
+        })
+        : Option.none();
+    return { appName, port, applicationUrl, jwtSecret, useS3, s3Config };
+}));
+//# sourceMappingURL=config.js.map

package/dist/src/config/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGzE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC,MAAM;IAClB,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,SAAU,SAAQ,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAA6B;CAAG;AAEvF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CACvC,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAA;IAEtC,4CAA4C;IAC5C,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gFAAgF,CAAC,CAAA;IAEnG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAA,0BAA0B,GAAG,CAAC,SAAS,CAAC,EAAE;KAC7D,CAAC,CAAC,SAAS,CAAC,CAAA;IAEb,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEzD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,YAAoB,EAAE,EAAE,CACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAA;QAC3C,KAAK,CAAC,CAAC,GAAG,CAAA,eAAe,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;QACrF,OAAO,YAAY,CAAA;IACrB,CAAC,CAAC,CAAA;IAEJ,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAC9B,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CACvC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,gBAAgB,GAAG,gCAAgC,CAAC,CAAC,EACrF,MAAM,CAAC,KAAK,CACb,CAAA;IAEH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAChD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAA;IAEjF,qEAAqE;IACrE,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC/C,MAAM,YAAY,GAChB,cAAc,KAAK,SAAS;QAC1B,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,aAAa,CAAA;YACtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC/E,KAAK,CAAC,CAAC,GAAG,CAAA,eAAe,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAA;YAChG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAA;YAC7E,OAAO,SAAS,CAAA;QAClB,CAAC,CAAC,CAAA;IACR,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAE7C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,MAAM,CAAA;IAEzD,MAAM,QAAQ,GAA4B,KAAK;QAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACtD,UAAU,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC5C,UAAU,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC5C,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACzD,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SACnD,CAAC;QACJ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IAEjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AACtE,CAAC,CAAC,CACH,CAAA"}

package/dist/src/config/index.d.ts

@@ -0,0 +1,3 @@
+export { AppConfig, AppConfigLive } from "./config.js";
+export type { AppConfigShape, S3Config } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtD,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA"}

package/dist/src/config/index.js

@@ -0,0 +1,2 @@
+export { AppConfig, AppConfigLive } from "./config.js";
+//# sourceMappingURL=index.js.map

package/dist/src/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA"}

package/dist/src/config/types.d.ts

@@ -0,0 +1,29 @@
+import type { Option, Redacted } from "effect";
+/**
+ * Optional S3 storage configuration.
+ * Only loaded when `useS3` is true in AppConfig.
+ *
+ * @see AppConfig.useS3 — whether S3 is enabled
+ * @see AppConfig.s3Config — the Option<S3Config>
+ */
+export interface S3Config {
+    readonly endpoint: Redacted.Redacted<string>;
+    readonly bucketName: string;
+    readonly regionName: string;
+    readonly accessKey: Redacted.Redacted<string>;
+    readonly secret: Redacted.Redacted<string>;
+}
+/**
+ * Shape of the application configuration stored in the `_config` DB table.
+ *
+ * @see AppConfig — the Context.Tag that provides this
+ */
+export interface AppConfigShape {
+    readonly appName: string;
+    readonly port: number;
+    readonly applicationUrl: string;
+    readonly jwtSecret: Redacted.Redacted<string>;
+    readonly useS3: boolean;
+    readonly s3Config: Option.Option<S3Config>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;CAC3C"}

package/dist/src/config/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/config/types.ts"],"names":[],"mappings":""}

package/dist/src/crypto/crypto.d.ts

@@ -0,0 +1,11 @@
+import { Context, Effect } from "effect";
+declare const CryptoService_base: Context.TagClass<CryptoService, "CryptoService", {
+    /** Synchronous variant — for use in callbacks that cannot yield an Effect. */
+    randomBytesSync(size: number): Uint8Array;
+    randomBytes(size: number): Effect.Effect<Uint8Array>;
+    randomUUID(): Effect.Effect<string>;
+}>;
+export declare class CryptoService extends CryptoService_base {
+}
+export {};
+//# sourceMappingURL=crypto.d.ts.map

package/dist/src/crypto/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/crypto/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;;IAKpC,8EAA8E;0BACxD,MAAM,GAAG,UAAU;sBACvB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;kBACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;;AANvC,qBAAa,aAAc,SAAQ,kBAQhC;CAAG"}

package/dist/src/crypto/crypto.js

@@ -0,0 +1,4 @@
+import { Context } from "effect";
+export class CryptoService extends Context.Tag("CryptoService")() {
+}
+//# sourceMappingURL=crypto.js.map

package/dist/src/crypto/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/crypto/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAU,MAAM,QAAQ,CAAA;AAExC,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAQ5D;CAAG"}

package/dist/src/crypto/index.d.ts

@@ -0,0 +1,3 @@
+export { CryptoService } from "./crypto.js";
+export { NodeCryptoLayer } from "./node.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA"}

package/dist/src/crypto/index.js

@@ -0,0 +1,3 @@
+export { CryptoService } from "./crypto.js";
+export { NodeCryptoLayer } from "./node.js";
+//# sourceMappingURL=index.js.map

package/dist/src/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA"}

package/dist/src/crypto/node.d.ts

@@ -0,0 +1,4 @@
+import { Layer } from "effect";
+import { CryptoService } from "./crypto.js";
+export declare const NodeCryptoLayer: Layer.Layer<CryptoService, never, never>;
+//# sourceMappingURL=node.d.ts.map

package/dist/src/crypto/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../../src/crypto/node.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,eAAO,MAAM,eAAe,0CAO3B,CAAA"}

package/dist/src/crypto/node.js

@@ -0,0 +1,9 @@
+import * as nodeCrypto from "node:crypto";
+import { Effect, Layer } from "effect";
+import { CryptoService } from "./crypto.js";
+export const NodeCryptoLayer = Layer.succeed(CryptoService, CryptoService.of({
+    randomBytesSync: (size) => nodeCrypto.randomBytes(size),
+    randomBytes: (size) => Effect.sync(() => nodeCrypto.randomBytes(size)),
+    randomUUID: () => Effect.sync(() => nodeCrypto.randomUUID())
+}));
+//# sourceMappingURL=node.js.map

package/dist/src/crypto/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../../src/crypto/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAC1C,aAAa,EACb,aAAa,CAAC,EAAE,CAAC;IACf,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;IACvD,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACtE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;CAC7D,CAAC,CACH,CAAA"}

package/dist/src/databases/index.d.ts

@@ -0,0 +1,2 @@
+export { SqliteDatabase } from "./sqlite.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/databases/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/databases/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/src/databases/index.js

@@ -0,0 +1,2 @@
+export { SqliteDatabase } from "./sqlite.js";
+//# sourceMappingURL=index.js.map

package/dist/src/databases/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/databases/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/src/databases/sqlite.d.ts

@@ -0,0 +1,24 @@
+import type { MiraDatabase } from "../app/types.js";
+/**
+ * SQLite database preset using `@effect/sql-sqlite-node`.
+ *
+ * Creates a `MiraDatabase` that provides both the SQLite `SqlClient`
+ * and the `Dialect` (for schema generation). The layer uses `Layer.orDie`
+ * to convert `ConfigError` into a runtime panic — if the config is wrong,
+ * the server should not start.
+ *
+ * @param config.filename - Path to the SQLite database file (use `":memory:"` for testing)
+ * @returns A MiraDatabase preset
+ *
+ * @example
+ * Mira.builder()
+ *   .database(SqliteDatabase({ filename: "data.db" }))
+ *   // or for testing:
+ *   .database(SqliteDatabase({ filename: ":memory:" }))
+ *
+ * @see MiraDatabase — the interface SqliteDatabase implements
+ */
+export declare const SqliteDatabase: (config: {
+    filename: string;
+}) => MiraDatabase;
+//# sourceMappingURL=sqlite.d.ts.map

package/dist/src/databases/sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../../src/databases/sqlite.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,KAAG,YAK5D,CAAA"}

package/dist/src/databases/sqlite.js

@@ -0,0 +1,27 @@
+import { SqliteClient } from "@effect/sql-sqlite-node";
+import { Layer } from "effect";
+import { Dialect } from "../migrator/dialect.js";
+import { sqliteDialect } from "../migrator/dialect-sqlite.js";
+/**
+ * SQLite database preset using `@effect/sql-sqlite-node`.
+ *
+ * Creates a `MiraDatabase` that provides both the SQLite `SqlClient`
+ * and the `Dialect` (for schema generation). The layer uses `Layer.orDie`
+ * to convert `ConfigError` into a runtime panic — if the config is wrong,
+ * the server should not start.
+ *
+ * @param config.filename - Path to the SQLite database file (use `":memory:"` for testing)
+ * @returns A MiraDatabase preset
+ *
+ * @example
+ * Mira.builder()
+ *   .database(SqliteDatabase({ filename: "data.db" }))
+ *   // or for testing:
+ *   .database(SqliteDatabase({ filename: ":memory:" }))
+ *
+ * @see MiraDatabase — the interface SqliteDatabase implements
+ */
+export const SqliteDatabase = (config) => ({
+    layer: Layer.mergeAll(SqliteClient.layer({ filename: config.filename }).pipe(Layer.orDie), Layer.succeed(Dialect, sqliteDialect)),
+});
+//# sourceMappingURL=sqlite.js.map

package/dist/src/databases/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../../../src/databases/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAG5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAA4B,EAAgB,EAAE,CAAC,CAAC;IAC7E,KAAK,EAAE,KAAK,CAAC,QAAQ,CACnB,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACnE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CACtC;CACF,CAAC,CAAA"}