@hachej/boring-core 0.1.63 → 0.1.64

package/dist/app/server/index.d.ts

@@ -4,8 +4,8 @@ import { WorkspaceServerPlugin, WorkspaceBridgeOperationDefinition, WorkspaceBri
 import { FastifyInstance } from 'fastify';
 import { C as CoreConfig } from '../../types-Bb7I-83I.js';
 import { T as TelemetrySink } from '../../telemetry-DR18MeI0.js';
-import { B as BetterAuthInstance, L as LoadConfigOptions } from '../../authHook-BbgCBHjP.js';
-import { D as Database, U as UserStore, W as WorkspaceStore } from '../../connection-B1iC6B-w.js';
+import { B as BetterAuthInstance, L as LoadConfigOptions } from '../../authHook-CcUgmE_N.js';
+import { D as Database, U as UserStore, W as WorkspaceStore } from '../../connection-B5wXGP69.js';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import 'better-auth';
 import 'drizzle-orm/postgres-js';

package/dist/app/server/index.js

@@ -9,13 +9,13 @@ import {
   registerRoutes,
   registerSettingsRoutes,
   registerWorkspaceRoutes
-} from "../../chunk-ZMS6O4CY.js";
+} from "../../chunk-BU6GSLJL.js";
 import {
   PostgresUserStore,
   PostgresWorkspaceStore,
   createDatabase,
   telemetryEvents
-} from "../../chunk-BVZ2YT3M.js";
+} from "../../chunk-6ZY63QYN.js";
 import {
   noopTelemetry,
   safeCapture

package/dist/{authHook-BbgCBHjP.d.ts → authHook-CcUgmE_N.d.ts}

@@ -1,7 +1,7 @@
 import { C as CoreConfig, R as RuntimeConfig } from './types-Bb7I-83I.js';
 import { FastifyPluginAsync } from 'fastify';
 import { Auth } from 'better-auth';
-import { W as WorkspaceStore, D as Database } from './connection-B1iC6B-w.js';
+import { W as WorkspaceStore, D as Database } from './connection-B5wXGP69.js';
 import { T as TelemetrySink } from './telemetry-DR18MeI0.js';
 
 interface LoadConfigOptions {

package/dist/{chunk-BVZ2YT3M.js → chunk-6ZY63QYN.js}

@@ -1711,6 +1711,22 @@ import { eq as eq2, sql as sql5 } from "drizzle-orm";
 function normalizeEmail2(email) {
   return email.trim().toLowerCase();
 }
+function jsonbPath(path) {
+  return sql5`ARRAY[${sql5.join(path.map((part) => sql5`${part}`), sql5`, `)}]::text[]`;
+}
+function jsonbSetPathExpression(path, value) {
+  let expression = sql5`${userSettings.settings}`;
+  for (let i = 1; i < path.length; i += 1) {
+    const prefixPath = jsonbPath(path.slice(0, i));
+    const existingObject = sql5`CASE
+      WHEN jsonb_typeof(${userSettings.settings} #> ${prefixPath}) = 'object'
+      THEN ${userSettings.settings} #> ${prefixPath}
+      ELSE '{}'::jsonb
+    END`;
+    expression = sql5`jsonb_set(${expression}, ${prefixPath}, ${existingObject}, true)`;
+  }
+  return sql5`jsonb_set(${expression}, ${jsonbPath(path)}, ${JSON.stringify(value)}::jsonb, true)`;
+}
 function rowToUser(row) {
   return {
     id: row.id,
@@ -1797,6 +1813,60 @@ var PostgresUserStore = class {
       settings: rows[0].settings ?? {}
     };
   }
+  async putClientUserSettings(userId, appId, updates) {
+    if (!updates.settings) return await this.putUserSettings(userId, appId, { displayName: updates.displayName });
+    const current = await this.getUserSettings(userId, appId);
+    const clientSettings = Object.fromEntries(
+      Object.entries(updates.settings).filter(([key]) => !key.startsWith("__server"))
+    );
+    const nextDisplayName = updates.displayName ?? current.displayName;
+    const nextEmail = current.email;
+    const rows = await this.db.insert(userSettings).values({
+      userId,
+      appId,
+      displayName: nextDisplayName,
+      email: nextEmail,
+      settings: clientSettings
+    }).onConflictDoUpdate({
+      target: [userSettings.userId, userSettings.appId],
+      set: {
+        displayName: nextDisplayName,
+        settings: sql5`(
+            SELECT COALESCE(jsonb_object_agg(key, value), '{}'::jsonb)
+            FROM jsonb_each(${userSettings.settings})
+            WHERE left(key, 8) = '__server'
+          ) || ${JSON.stringify(clientSettings)}::jsonb`,
+        updatedAt: /* @__PURE__ */ new Date()
+      }
+    }).returning();
+    return {
+      displayName: rows[0].displayName,
+      email: rows[0].email,
+      settings: rows[0].settings ?? {}
+    };
+  }
+  async patchUserSettingsJsonPath(userId, appId, path, value) {
+    if (path.length === 0) throw new Error("settings JSON path must not be empty");
+    const user = await this.getById(userId);
+    const rows = await this.db.transaction(async (tx) => {
+      await tx.insert(userSettings).values({
+        userId,
+        appId,
+        displayName: user?.name ?? "",
+        email: user?.email ?? "",
+        settings: {}
+      }).onConflictDoNothing({ target: [userSettings.userId, userSettings.appId] });
+      return await tx.update(userSettings).set({
+        settings: jsonbSetPathExpression(path, value),
+        updatedAt: /* @__PURE__ */ new Date()
+      }).where(sql5`${userSettings.userId} = ${userId} AND ${userSettings.appId} = ${appId}`).returning();
+    });
+    return {
+      displayName: rows[0].displayName,
+      email: rows[0].email,
+      settings: rows[0].settings ?? {}
+    };
+  }
 };
 
 // src/server/db/stores/PostgresMeteringStore.ts

package/dist/{chunk-ZMS6O4CY.js → chunk-BU6GSLJL.js}

@@ -12,7 +12,7 @@ import {
   workspaceRuntimes,
   workspaceSettings,
   workspaces
-} from "./chunk-BVZ2YT3M.js";
+} from "./chunk-6ZY63QYN.js";
 import {
   noopTelemetry,
   safeCapture
@@ -767,6 +767,24 @@ async function createCoreApp(config, options) {
   return app;
 }
 
+// src/server/app/userSettingsLocks.ts
+var userSettingsWriteQueues = /* @__PURE__ */ new Map();
+function userSettingsWriteKey(userId, appId) {
+  return `${appId}\0${userId}`;
+}
+async function withUserSettingsWriteLock(userId, appId, fn) {
+  const key = userSettingsWriteKey(userId, appId);
+  const previous = userSettingsWriteQueues.get(key) ?? Promise.resolve();
+  const run = previous.catch(() => void 0).then(fn);
+  const settled = run.then(() => void 0, () => void 0);
+  userSettingsWriteQueues.set(key, settled);
+  try {
+    return await run;
+  } finally {
+    if (userSettingsWriteQueues.get(key) === settled) userSettingsWriteQueues.delete(key);
+  }
+}
+
 // src/server/app/routes.ts
 import fp from "fastify-plugin";
 import { z as z2 } from "zod";
@@ -904,6 +922,24 @@ async function deleteUserCompletely(userId, deps) {
 
 // src/server/app/routes.ts
 var HEALTH_DB_TIMEOUT_MS = 2e3;
+var SERVER_OWNED_USER_SETTINGS_PREFIX = "__server";
+function stripServerOwnedUserSettings(next) {
+  const sanitized = { ...next };
+  for (const key of Object.keys(sanitized)) {
+    if (key.startsWith(SERVER_OWNED_USER_SETTINGS_PREFIX)) delete sanitized[key];
+  }
+  return sanitized;
+}
+function sanitizeUserSettingsResult(result) {
+  return { ...result, settings: stripServerOwnedUserSettings(result.settings) };
+}
+function preserveServerOwnedUserSettings(next, current) {
+  const sanitized = stripServerOwnedUserSettings(next);
+  for (const [key, value] of Object.entries(current)) {
+    if (key.startsWith(SERVER_OWNED_USER_SETTINGS_PREFIX)) sanitized[key] = value;
+  }
+  return sanitized;
+}
 async function pingDatabase(sqlClient, timeoutMs) {
   const timeoutMessage = `Database ping timed out after ${timeoutMs}ms`;
   let timeoutId;
@@ -964,7 +1000,7 @@ var routesPlugin = async (app, opts) => {
   app.get("/api/v1/me", async (request) => {
     const user = request.user;
     const settings = await userStore.getUserSettings(user.id, app.config.appId);
-    return { user, settings };
+    return { user, settings: sanitizeUserSettingsResult(settings) };
   });
   app.put("/api/v1/me/settings", async (request, reply) => {
     const parsed = updateSettingsBody.safeParse(request.body);
@@ -976,13 +1012,19 @@ var routesPlugin = async (app, opts) => {
         requestId: request.id
       });
     }
-    const result = await userStore.putUserSettings(
-      request.user.id,
-      app.config.appId,
-      parsed.data
-    );
+    const userId = request.user.id;
+    const clientSettings = parsed.data.settings ? stripServerOwnedUserSettings(parsed.data.settings) : void 0;
+    const result = userStore.putClientUserSettings ? await userStore.putClientUserSettings(userId, app.config.appId, { ...parsed.data, ...clientSettings ? { settings: clientSettings } : {} }) : await withUserSettingsWriteLock(userId, app.config.appId, async () => {
+      const current = parsed.data.settings ? await userStore.getUserSettings(userId, app.config.appId) : void 0;
+      const updates = parsed.data.settings ? { ...parsed.data, settings: preserveServerOwnedUserSettings(parsed.data.settings, current?.settings ?? {}) } : parsed.data;
+      return await userStore.putUserSettings(
+        userId,
+        app.config.appId,
+        updates
+      );
+    });
     reply.status(200);
-    return result;
+    return sanitizeUserSettingsResult(result);
   });
   app.delete("/api/v1/me", async (request, reply) => {
     const parsed = deleteMeBody.safeParse(request.body);
@@ -2919,6 +2961,7 @@ export {
   validateConfig,
   buildRuntimeConfigPayload,
   createCoreApp,
+  withUserSettingsWriteLock,
   registerRoutes,
   MailDeliveryError,
   createMailTransport,

package/dist/{connection-B1iC6B-w.d.ts → connection-B5wXGP69.d.ts}

@@ -37,6 +37,19 @@ interface UserStore {
         email: string;
         settings: Record<string, unknown>;
     }>;
+    putClientUserSettings?(userId: string, appId: string, updates: {
+        displayName?: string;
+        settings?: Record<string, unknown>;
+    }): Promise<{
+        displayName: string;
+        email: string;
+        settings: Record<string, unknown>;
+    }>;
+    patchUserSettingsJsonPath?(userId: string, appId: string, path: string[], value: unknown): Promise<{
+        displayName: string;
+        email: string;
+        settings: Record<string, unknown>;
+    }>;
 }
 interface WorkspaceStore {
     create(userId: string, name: string, appId: string, opts?: {

package/dist/server/db/index.d.ts

@@ -1,5 +1,5 @@
-import { U as UserStore, W as WorkspaceStore } from '../../connection-B1iC6B-w.js';
-export { D as Database, d as createDatabase } from '../../connection-B1iC6B-w.js';
+import { U as UserStore, W as WorkspaceStore } from '../../connection-B5wXGP69.js';
+export { D as Database, d as createDatabase } from '../../connection-B5wXGP69.js';
 export { F as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, P as PostgresMeteringStore, R as RecordUsageInput, a as RecordUsageResult, b as ReservationFinalStatus, c as ReserveInput, d as ReserveResult, e as RunMigrationsOptions, r as runMigrations } from '../../PostgresMeteringStore-qjKGmVFr.js';
 import { U as User, c as Workspace, E as ERROR_CODES, M as MemberRole, d as WorkspaceMember, e as WorkspaceInvite, f as WorkspaceRuntime, W as WorkspaceRuntimeResourceSelector, a as WorkspaceRuntimeResource, b as WorkspaceRuntimeResourceInput } from '../../types-Bb7I-83I.js';
 import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
@@ -204,6 +204,19 @@ declare class PostgresUserStore implements UserStore {
         email: string;
         settings: Record<string, unknown>;
     }>;
+    putClientUserSettings(userId: string, appId: string, updates: {
+        displayName?: string;
+        settings?: Record<string, unknown>;
+    }): Promise<{
+        displayName: string;
+        email: string;
+        settings: Record<string, unknown>;
+    }>;
+    patchUserSettingsJsonPath(userId: string, appId: string, path: string[], value: unknown): Promise<{
+        displayName: string;
+        email: string;
+        settings: Record<string, unknown>;
+    }>;
 }
 
 export { LocalUserStore, LocalWorkspaceStore, PostgresUserStore, PostgresWorkspaceStore };

package/dist/server/db/index.js

@@ -7,7 +7,7 @@ import {
   PostgresWorkspaceStore,
   createDatabase,
   runMigrations
-} from "../../chunk-BVZ2YT3M.js";
+} from "../../chunk-6ZY63QYN.js";
 import "../../chunk-QZGYKLXB.js";
 import "../../chunk-MLKGABMK.js";
 export {

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
-import { L as LoadConfigOptions } from '../authHook-BbgCBHjP.js';
-export { A as AuthHookOptions, B as BetterAuthInstance, C as CreateAuthOptions, a as authHook, b as buildRuntimeConfigPayload, c as createAuth, l as loadConfig, v as validateConfig, d as validatePasswordStrength } from '../authHook-BbgCBHjP.js';
+import { L as LoadConfigOptions } from '../authHook-CcUgmE_N.js';
+export { A as AuthHookOptions, B as BetterAuthInstance, C as CreateAuthOptions, a as authHook, b as buildRuntimeConfigPayload, c as createAuth, l as loadConfig, v as validateConfig, d as validatePasswordStrength } from '../authHook-CcUgmE_N.js';
 import { z } from 'zod';
 import { C as CoreConfig, M as MemberRole, W as WorkspaceRuntimeResourceSelector, a as WorkspaceRuntimeResource, b as WorkspaceRuntimeResourceInput } from '../types-Bb7I-83I.js';
 import * as fastify from 'fastify';
 import { FastifyInstance, FastifyPluginAsync, preHandlerHookHandler, FastifyRequest, FastifyReply } from 'fastify';
 import * as http from 'http';
 import { IncomingMessage } from 'node:http';
-import { C as CreateCoreAppOptions, D as Database, U as UserStore, W as WorkspaceStore, a as WorkspaceProvisioner } from '../connection-B1iC6B-w.js';
-export { A as AuthProvider, b as CapabilitiesContributor, P as ProvisionContext, c as ProvisionResult, d as createDatabase } from '../connection-B1iC6B-w.js';
+import { C as CreateCoreAppOptions, D as Database, U as UserStore, W as WorkspaceStore, a as WorkspaceProvisioner } from '../connection-B5wXGP69.js';
+export { A as AuthProvider, b as CapabilitiesContributor, P as ProvisionContext, c as ProvisionResult, d as createDatabase } from '../connection-B5wXGP69.js';
 import postgres from 'postgres';
 import { P as PostgresMeteringStore, C as CreditLedgerEntry } from '../PostgresMeteringStore-qjKGmVFr.js';
 export { F as FinishReservationInput, G as GrantOnceInput, I as InsufficientCreditError, M as MeteringBalance, R as RecordUsageInput, a as RecordUsageResult, b as ReservationFinalStatus, c as ReserveInput, d as ReserveResult, r as runMigrations } from '../PostgresMeteringStore-qjKGmVFr.js';
@@ -285,6 +285,8 @@ interface RoutesOptions {
 }
 declare const registerRoutes: FastifyPluginAsync<RoutesOptions>;
 
+declare function withUserSettingsWriteLock<T>(userId: string, appId: string, fn: () => Promise<T>): Promise<T>;
+
 interface RenderedEmail {
     to: string;
     subject: string;
@@ -1019,4 +1021,4 @@ interface CreditsRoutesOptions {
  */
 declare function registerCreditsRoutes(app: FastifyInstance, options: CreditsRoutesOptions): void;
 
-export { CONSERVATIVE_DEFAULT_RATE, type CreateCheckoutInput, CreateCoreAppOptions, type CreditBalance, type CreditCost, CreditExhaustedError, type CreditPricingConfig, type CreditUsageInput, type CreditUsageRecord, type CreditsConfig, type CreditsMeteringStore, type CreditsRoutesOptions, CreditsService, DEFAULT_CREDITS_CONFIG, DEFAULT_MODEL_RATES, Database, type FsProvisionerOptions, type IdempotencyEntry, type IdempotencyKeyStore, type LemonSqueezyCheckoutConfig, type LemonSqueezyOrder, type LemonSqueezyRouteOptions, type LemonSqueezyWebhookOptions, type LemonSqueezyWebhookResult, LoadConfigOptions, MailDeliveryError, type MailTransport, type ModelTokenRate, type PostSignupHookDeps, PostgresMeteringStore, type RenderedEmail, type RoutesOptions, type RunCoreMigrationsFromEnvOptions, SIGNUP_GRANT_REASON, UserStore, WorkspaceProvisioner, WorkspaceRuntimeSandboxHandleStore, type WorkspaceRuntimeStoreLike, type WorkspaceSandboxHandleRecord, WorkspaceStore, buildCheckoutRequestBody, coreConfigSchema, createCoreApp, createCreditsMeteringSink, createDrizzleIdempotencyStore, createFsProvisioner, createIdempotencyMiddleware, createLemonSqueezyCheckout, createMailTransport, createPostSignupHook, estimateProviderCost, handleLemonSqueezyWebhook, maxEffectiveRate, maxServedRate, parseLemonSqueezyOrder, registerCreditsRoutes, registerInviteRoutes, registerMemberRoutes, registerRoutes, registerSettingsRoutes, registerWorkspaceRoutes, renderMagicLink, renderResetPassword, renderVerifyEmail, renderWelcome, renderWorkspaceInvite, requireWorkspaceMember, runCoreMigrationsFromEnv, safeRedirect, signUserAttribution, usageToCredits, verifyLemonSqueezySignature, verifyUserAttribution };
+export { CONSERVATIVE_DEFAULT_RATE, type CreateCheckoutInput, CreateCoreAppOptions, type CreditBalance, type CreditCost, CreditExhaustedError, type CreditPricingConfig, type CreditUsageInput, type CreditUsageRecord, type CreditsConfig, type CreditsMeteringStore, type CreditsRoutesOptions, CreditsService, DEFAULT_CREDITS_CONFIG, DEFAULT_MODEL_RATES, Database, type FsProvisionerOptions, type IdempotencyEntry, type IdempotencyKeyStore, type LemonSqueezyCheckoutConfig, type LemonSqueezyOrder, type LemonSqueezyRouteOptions, type LemonSqueezyWebhookOptions, type LemonSqueezyWebhookResult, LoadConfigOptions, MailDeliveryError, type MailTransport, type ModelTokenRate, type PostSignupHookDeps, PostgresMeteringStore, type RenderedEmail, type RoutesOptions, type RunCoreMigrationsFromEnvOptions, SIGNUP_GRANT_REASON, UserStore, WorkspaceProvisioner, WorkspaceRuntimeSandboxHandleStore, type WorkspaceRuntimeStoreLike, type WorkspaceSandboxHandleRecord, WorkspaceStore, buildCheckoutRequestBody, coreConfigSchema, createCoreApp, createCreditsMeteringSink, createDrizzleIdempotencyStore, createFsProvisioner, createIdempotencyMiddleware, createLemonSqueezyCheckout, createMailTransport, createPostSignupHook, estimateProviderCost, handleLemonSqueezyWebhook, maxEffectiveRate, maxServedRate, parseLemonSqueezyOrder, registerCreditsRoutes, registerInviteRoutes, registerMemberRoutes, registerRoutes, registerSettingsRoutes, registerWorkspaceRoutes, renderMagicLink, renderResetPassword, renderVerifyEmail, renderWelcome, renderWorkspaceInvite, requireWorkspaceMember, runCoreMigrationsFromEnv, safeRedirect, signUserAttribution, usageToCredits, verifyLemonSqueezySignature, verifyUserAttribution, withUserSettingsWriteLock };

package/dist/server/index.js

@@ -23,14 +23,15 @@ import {
   renderWorkspaceInvite,
   requireWorkspaceMember,
   validateConfig,
-  validatePasswordStrength
-} from "../chunk-ZMS6O4CY.js";
+  validatePasswordStrength,
+  withUserSettingsWriteLock
+} from "../chunk-BU6GSLJL.js";
 import {
   InsufficientCreditError,
   PostgresMeteringStore,
   createDatabase,
   runMigrations
-} from "../chunk-BVZ2YT3M.js";
+} from "../chunk-6ZY63QYN.js";
 import {
   noopTelemetry,
   safeCapture
@@ -1635,5 +1636,6 @@ export {
   validateConfig,
   validatePasswordStrength,
   verifyLemonSqueezySignature,
-  verifyUserAttribution
+  verifyUserAttribution,
+  withUserSettingsWriteLock
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-core",
-  "version": "0.1.63",
+  "version": "0.1.64",
   "type": "module",
   "license": "MIT",
   "description": "Foundation package for boring-ui-v2 apps: DB, auth, config, HTTP app factory, and frontend app shell.",
@@ -79,9 +79,9 @@
     "react-router-dom": "^7.14.2",
     "smol-toml": "^1.6.1",
     "zod": "^3.25.76",
-    "@hachej/boring-agent": "0.1.63",
-    "@hachej/boring-ui-kit": "0.1.63",
-    "@hachej/boring-workspace": "0.1.63"
+    "@hachej/boring-ui-kit": "0.1.64",
+    "@hachej/boring-workspace": "0.1.64",
+    "@hachej/boring-agent": "0.1.64"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",