@lunora/bindings 1.0.0-alpha.16 → 1.0.0-alpha.18

package/dist/packem_shared/createContextVectors-D-ae1wWO.mjs

@@ -0,0 +1,6 @@
+import{c as w,U as b}from"./concurrent-DMFQCILU.mjs";const x=(n,c)=>{if(!c.includes("."))return n[c];let s=n;for(const l of c.split(".")){if(s===null||typeof s!="object"||Array.isArray(s))return;s=s[l]}return s},B=(n,c)=>{const s=c?.namespace,l=new Set(c?.shardedIndexNames),m=(t,a)=>{if(a!==void 0)return a;if(l.has(t)){if(s!==void 0)return s;throw new Error(`@lunora/bindings/vectors: index "${t}" belongs to a sharded table, but this DO instance has no shard key (it is the root/default DO) and no explicit namespace was given. A namespace-less operation here would reach every tenant's vectors — Vectorize indexes are account-global. Pass an explicit namespace, or issue this call from the sharded DO instance that owns the tenant.`)}},i=async(t,a)=>{await n.upsert(t,{embed:a.embed,id:a.id,input:a.input,metadata:a.metadata,namespace:m(t,a.namespace)})},u=async(t,a,r)=>{const o=await n.getByIds(t,a);return r===void 0?o:o.filter(d=>d.namespace===r)};return{deleteByIds:async(t,a,r)=>{const o=m(t,r);if(o===void 0){await n.deleteByIds(t,a);return}const d=await u(t,a,o);d.length!==0&&await n.deleteByIds(t,d.map(h=>h.id))},getByIds:async(t,a,r)=>{const o=m(t,r);return(await u(t,a,o)).map(d=>({id:d.id,metadata:d.metadata,namespace:d.namespace,values:d.values}))},query:async(t,a)=>{const r=await n.query(t,{embed:a.embed,filter:a.filter,input:a.input,namespace:m(t,a.namespace),returnMetadata:a.returnMetadata??"indexed",topK:a.topK,vector:a.vector});return{count:r.count,matches:r.matches.map(o=>({id:o.id,metadata:o.metadata,score:o.score}))}},upsert:i,upsertNow:i}},y=new Set,v=n=>{y.has(n)||(y.add(n),console.warn(`[@lunora/bindings/vectors] index "${n}" syncs vectors without a namespace — in a
+multi-tenant/sharded app this exposes one tenant's vectors (and any captured
+metadata) to every other tenant, since Vectorize indexes are account-global.
+Pass \`namespace\` (the shard/tenant key) on both write and query — query-side
+namespace filtering is mandatory for multi-tenant apps. Single-tenant apps that
+legitimately have no tenant key suppress this via { allowSharedNamespace: true }.`))},g=(n,c)=>{const s={};for(const l of c)l in n&&(s[l]=n[l]);return s},S=n=>{const{allowSharedNamespace:c,namespace:s,schema:l,vectors:m}=n;return async i=>{const u=l.tables[i.table]?.vectorIndexes??[],t=Object.entries(l.vectorIndexes).filter(([,e])=>e.table===i.table);if(u.length===0&&t.length===0)return;const a=[...u.map(e=>e.name),...t.map(([e])=>e)];if(i.op==="delete"){await Promise.all(a.map(e=>m.deleteByIds(e,[i.id])));return}const r=i.doc;if(!r)return;const o=u.map(e=>({index:e,value:x(r,e.field)})),d=o.filter(e=>e.value!==void 0&&e.value!==null),h=o.filter(e=>e.value===void 0||e.value===null);for(const{index:e,value:p}of d)if(typeof p!="string")throw new TypeError(`@lunora/bindings/vectors: inline index "${e.name}" expects a string source at "${e.field}" on table "${i.table}" (got ${typeof p}); use a standalone defineVectorIndex with a select() to derive text from non-string columns`);const f=[...h.map(e=>async()=>{await m.deleteByIds(e.index.name,[i.id])}),...d.map(e=>async()=>{!c&&s===void 0&&v(e.index.name),await m.upsert(e.index.name,{embed:e.index.embed,id:i.id,input:e.value,metadata:e.index.metadata?g(r,e.index.metadata):void 0,namespace:s})}),...t.map(([e,p])=>async()=>{!c&&s===void 0&&v(e),await m.upsert(e,{embed:p.embed,id:i.id,input:p.select(r),metadata:p.metadata?.(r),namespace:s})})];try{await w(f,b,async e=>e())}catch(e){throw await Promise.allSettled(a.map(p=>m.deleteByIds(p,[i.id]))),e}}};export{B as createContextVectors,S as createVectorSyncHook};

package/dist/vectors/index.d.mts

@@ -57,6 +57,7 @@ interface VectorMatchesLike {
 interface VectorRecordLike {
   id: string;
   metadata?: Record<string, unknown>;
+  namespace?: string;
   values: ReadonlyArray<number>;
 }
 interface VectorQueryInputLike {
@@ -84,22 +85,105 @@ interface VectorUpsertInputLike {
 /**
  * Structural mirror of `@lunora/server`'s `VectorSearch`. Declared here so the
  * adapter never imports `@lunora/server` (keeps the dependency edge one-way:
- * the generated DO depends on both, neither depends on the other).
+ * the generated DO depends on both, neither depends on the other). `getByIds`/
+ * `deleteByIds` carry an optional trailing `namespace` — a pure addition (more
+ * general, not narrower) that stays assignable to `@lunora/server`'s
+ * `VectorSearchReader`/`VectorSearch`, whose own two-argument signatures are
+ * unchanged: a function accepting an extra OPTIONAL parameter is assignable
+ * wherever a function taking fewer parameters is expected.
  */
 interface VectorSearchLike {
-  deleteByIds: (indexName: string, ids: ReadonlyArray<string>) => Promise<void>;
-  getByIds: (indexName: string, ids: ReadonlyArray<string>) => Promise<ReadonlyArray<VectorRecordLike>>;
+  deleteByIds: (indexName: string, ids: ReadonlyArray<string>, namespace?: string) => Promise<void>;
+  getByIds: (indexName: string, ids: ReadonlyArray<string>, namespace?: string) => Promise<ReadonlyArray<VectorRecordLike>>;
   query: (indexName: string, input: VectorQueryInputLike) => Promise<VectorMatchesLike>;
   upsert: (indexName: string, input: VectorUpsertInputLike) => Promise<void>;
   upsertNow: (indexName: string, input: VectorUpsertInputLike) => Promise<void>;
 }
+/** Options for {@link createContextVectors}. */
+interface CreateContextVectorsOptions {
+  /**
+   * The DO's own shard/tenant key, applied as the default `namespace` for
+   * an operation against an index in `shardedIndexNames` that doesn't pass
+   * one explicitly. `undefined` means this instance HAS no shard key —
+   * always true for the root/default DO instance, since only a per-tenant
+   * instance owns one. See `shardedIndexNames` for what that implies per
+   * index, and {@link createContextVectors}'s docblock for the full
+   * root-instance rule.
+   */
+  namespace?: string;
+  /**
+   * Vector index names sourced from a `.shardBy()`'d table — the ones
+   * `namespace` is a meaningful tenant scope for. `ctx.vectors` is a single
+   * flat facade over EVERY declared index (root-scoped and sharded tables
+   * alike — Vectorize indexes are account-global and `config.vectors(env)`
+   * registers them all in one flat map), reachable from ANY DO instance —
+   * so `namespace` can only be a safe default for the indexes actually
+   * listed here.
+   *
+   * An index NOT in this set (sourced from a root-scoped table) always
+   * stays namespace-less, regardless of `namespace` or which DO instance
+   * calls it — it has no tenant identity to begin with, so scoping it would
+   * silently return nothing for legitimate, intentionally shared data (and,
+   * called from a per-tenant instance, would wrongly search under that
+   * tenant's namespace even though nothing was ever written there under
+   * it). An index IN this set, called from a per-tenant DO instance
+   * (`namespace` is set), defaults to `namespace`, scoping correctly. An
+   * index IN this set, called from the root/default DO instance
+   * (`namespace` is `undefined`) with no explicit override, is unsafe to
+   * default at all — see {@link createContextVectors}'s docblock.
+   *
+   * Omitted (or empty) → no index is ever treated as sharded, i.e.
+   * `namespace` never applies as a default on any call — the unsharded-app,
+   * byte-identical-to-today case.
+   */
+  shardedIndexNames?: ReadonlyArray<string>;
+}
 /**
  * Bridge `LunoraVectors` (returns Vectorize mutation receipts) to the server's
  * `VectorSearch` contract (void mutations, server match/record shapes). Both
  * `upsert` and `upsertNow` write inline — this design has no post-commit queue,
  * so "now" and "deferred" collapse to the same synchronous call.
+ *
+ * Tenant isolation (read side) — IMPORTANT: an explicit `namespace` argument
+ * on any call (`input.namespace` for `query`/`upsert`/`upsertNow`, the
+ * trailing `namespace` parameter for `getByIds`/`deleteByIds`) ALWAYS wins —
+ * this is a deliberate soft default, not a hard boundary: `ctx.vectors` is
+ * trusted server-side app code (the same trust level that lets `ctx.db` read
+ * any table), so a caller that explicitly names a namespace is trusted to
+ * mean it, including a legitimate cross-tenant admin read/write. Absent an
+ * explicit namespace, `options.namespace` (this DO instance's own shard key)
+ * is the DEFAULT for any index in `options.shardedIndexNames` — see that
+ * option's docblock for why the default is index-scoped rather than global.
+ *
+ * Root-instance rule — IMPORTANT: when an operation targets a sharded index
+ * (one in `shardedIndexNames`) and BOTH the explicit argument and
+ * `options.namespace` are absent (this is the root/default DO instance, which
+ * owns no shard key), there is no safe default and no override — this THROWS
+ * rather than silently resolving to "no namespace". A namespace-less
+ * query/getByIds/deleteByIds/upsert against a sharded index would reach or
+ * mutate EVERY tenant's vectors (Vectorize indexes are account-global), which
+ * is the exact cross-tenant leak this file exists to close; returning an
+ * empty result set instead would masquerade that same configuration problem
+ * as "no data", which is worse — a caller debugging it sees nothing rather
+ * than a directed error. This case is reachable in a MIXED schema (some
+ * vectorized tables `.shardBy()`'d, others root-scoped) whenever application
+ * code queries a sharded index's name from the root DO instance without an
+ * explicit namespace; it is not reachable from `createVectorSyncHook`'s own
+ * internal calls, which only ever process a table this DO instance owns (so
+ * a sharded table's write never reaches a root instance in the first place).
+ *
+ * Id path, unrelated axis — IMPORTANT: independent of the override/root rules
+ * above, `getByIds`/`deleteByIds` can't ask Vectorize to filter by namespace
+ * remotely at all (its id-based operations take no `namespace` option), so
+ * once a namespace IS resolved (explicit or defaulted) for these two methods,
+ * isolation is enforced client-side: `getByIds` drops any returned record
+ * whose `namespace` doesn't match (fail closed: a record with no `namespace`
+ * field is treated as a mismatch, never as "belongs to everyone"), and
+ * `deleteByIds` resolves ids via `getByIds` first and only deletes the subset
+ * that belongs to the resolved namespace — silently, by design (see the
+ * `deleteByIds` implementation for the no-signal tradeoff this makes).
  */
-declare const createContextVectors: (lunora: LunoraVectors) => VectorSearchLike;
+declare const createContextVectors: (lunora: LunoraVectors, options?: CreateContextVectorsOptions) => VectorSearchLike;
 /** A single row mutation observed by the ctx-db, fed to {@link createVectorSyncHook}. */
 interface WriteEvent {
   doc?: Record<string, unknown>;
@@ -152,6 +236,23 @@ interface SchemaLike {
  * (regardless of whether metadata is present); a genuinely single-tenant app
  * suppresses it with `allowSharedNamespace: true`.
  *
+ * Since plan 255, codegen satisfies the query-side requirement automatically
+ * for a `.shardBy()`'d vectorized table: the `vectors` instance passed in
+ * `options` here is the SAME `createContextVectors(...)` instance exposed as
+ * `ctx.vectors`, constructed with the identical shard-key `namespace` default
+ * AND the identical `shardedIndexNames` — so `ctx.vectors.query`/`getByIds`/
+ * `deleteByIds` are scoped without any app code changes. One consequence of
+ * sharing that instance: this hook's own internal `deleteByIds` calls (on row
+ * delete, on a cleared inline field, and on compensation after a failed
+ * upsert) now also go through the namespace-verifying path described on
+ * {@link createContextVectors} — an extra `getByIds` subrequest per
+ * delete-shaped write, not a behavior change (the row being deleted was
+ * written under this same shard's namespace, so the verification passes).
+ * This never hits {@link createContextVectors}'s root-instance throw: a write
+ * event only ever fires for a table THIS DO instance owns, so if this hook
+ * processes a write for a sharded index, this instance IS a real per-tenant
+ * shard (not root) — `namespace` here is never `undefined` for that index.
+ *
  * Consistency — IMPORTANT: this hook runs inline within the mutation but talks
  * to Vectorize, which is external and non-transactional. The per-index calls
  * fan out; if one fails after others have already applied, the SQLite write may

package/dist/vectors/index.d.ts

@@ -57,6 +57,7 @@ interface VectorMatchesLike {
 interface VectorRecordLike {
   id: string;
   metadata?: Record<string, unknown>;
+  namespace?: string;
   values: ReadonlyArray<number>;
 }
 interface VectorQueryInputLike {
@@ -84,22 +85,105 @@ interface VectorUpsertInputLike {
 /**
  * Structural mirror of `@lunora/server`'s `VectorSearch`. Declared here so the
  * adapter never imports `@lunora/server` (keeps the dependency edge one-way:
- * the generated DO depends on both, neither depends on the other).
+ * the generated DO depends on both, neither depends on the other). `getByIds`/
+ * `deleteByIds` carry an optional trailing `namespace` — a pure addition (more
+ * general, not narrower) that stays assignable to `@lunora/server`'s
+ * `VectorSearchReader`/`VectorSearch`, whose own two-argument signatures are
+ * unchanged: a function accepting an extra OPTIONAL parameter is assignable
+ * wherever a function taking fewer parameters is expected.
  */
 interface VectorSearchLike {
-  deleteByIds: (indexName: string, ids: ReadonlyArray<string>) => Promise<void>;
-  getByIds: (indexName: string, ids: ReadonlyArray<string>) => Promise<ReadonlyArray<VectorRecordLike>>;
+  deleteByIds: (indexName: string, ids: ReadonlyArray<string>, namespace?: string) => Promise<void>;
+  getByIds: (indexName: string, ids: ReadonlyArray<string>, namespace?: string) => Promise<ReadonlyArray<VectorRecordLike>>;
   query: (indexName: string, input: VectorQueryInputLike) => Promise<VectorMatchesLike>;
   upsert: (indexName: string, input: VectorUpsertInputLike) => Promise<void>;
   upsertNow: (indexName: string, input: VectorUpsertInputLike) => Promise<void>;
 }
+/** Options for {@link createContextVectors}. */
+interface CreateContextVectorsOptions {
+  /**
+   * The DO's own shard/tenant key, applied as the default `namespace` for
+   * an operation against an index in `shardedIndexNames` that doesn't pass
+   * one explicitly. `undefined` means this instance HAS no shard key —
+   * always true for the root/default DO instance, since only a per-tenant
+   * instance owns one. See `shardedIndexNames` for what that implies per
+   * index, and {@link createContextVectors}'s docblock for the full
+   * root-instance rule.
+   */
+  namespace?: string;
+  /**
+   * Vector index names sourced from a `.shardBy()`'d table — the ones
+   * `namespace` is a meaningful tenant scope for. `ctx.vectors` is a single
+   * flat facade over EVERY declared index (root-scoped and sharded tables
+   * alike — Vectorize indexes are account-global and `config.vectors(env)`
+   * registers them all in one flat map), reachable from ANY DO instance —
+   * so `namespace` can only be a safe default for the indexes actually
+   * listed here.
+   *
+   * An index NOT in this set (sourced from a root-scoped table) always
+   * stays namespace-less, regardless of `namespace` or which DO instance
+   * calls it — it has no tenant identity to begin with, so scoping it would
+   * silently return nothing for legitimate, intentionally shared data (and,
+   * called from a per-tenant instance, would wrongly search under that
+   * tenant's namespace even though nothing was ever written there under
+   * it). An index IN this set, called from a per-tenant DO instance
+   * (`namespace` is set), defaults to `namespace`, scoping correctly. An
+   * index IN this set, called from the root/default DO instance
+   * (`namespace` is `undefined`) with no explicit override, is unsafe to
+   * default at all — see {@link createContextVectors}'s docblock.
+   *
+   * Omitted (or empty) → no index is ever treated as sharded, i.e.
+   * `namespace` never applies as a default on any call — the unsharded-app,
+   * byte-identical-to-today case.
+   */
+  shardedIndexNames?: ReadonlyArray<string>;
+}
 /**
  * Bridge `LunoraVectors` (returns Vectorize mutation receipts) to the server's
  * `VectorSearch` contract (void mutations, server match/record shapes). Both
  * `upsert` and `upsertNow` write inline — this design has no post-commit queue,
  * so "now" and "deferred" collapse to the same synchronous call.
+ *
+ * Tenant isolation (read side) — IMPORTANT: an explicit `namespace` argument
+ * on any call (`input.namespace` for `query`/`upsert`/`upsertNow`, the
+ * trailing `namespace` parameter for `getByIds`/`deleteByIds`) ALWAYS wins —
+ * this is a deliberate soft default, not a hard boundary: `ctx.vectors` is
+ * trusted server-side app code (the same trust level that lets `ctx.db` read
+ * any table), so a caller that explicitly names a namespace is trusted to
+ * mean it, including a legitimate cross-tenant admin read/write. Absent an
+ * explicit namespace, `options.namespace` (this DO instance's own shard key)
+ * is the DEFAULT for any index in `options.shardedIndexNames` — see that
+ * option's docblock for why the default is index-scoped rather than global.
+ *
+ * Root-instance rule — IMPORTANT: when an operation targets a sharded index
+ * (one in `shardedIndexNames`) and BOTH the explicit argument and
+ * `options.namespace` are absent (this is the root/default DO instance, which
+ * owns no shard key), there is no safe default and no override — this THROWS
+ * rather than silently resolving to "no namespace". A namespace-less
+ * query/getByIds/deleteByIds/upsert against a sharded index would reach or
+ * mutate EVERY tenant's vectors (Vectorize indexes are account-global), which
+ * is the exact cross-tenant leak this file exists to close; returning an
+ * empty result set instead would masquerade that same configuration problem
+ * as "no data", which is worse — a caller debugging it sees nothing rather
+ * than a directed error. This case is reachable in a MIXED schema (some
+ * vectorized tables `.shardBy()`'d, others root-scoped) whenever application
+ * code queries a sharded index's name from the root DO instance without an
+ * explicit namespace; it is not reachable from `createVectorSyncHook`'s own
+ * internal calls, which only ever process a table this DO instance owns (so
+ * a sharded table's write never reaches a root instance in the first place).
+ *
+ * Id path, unrelated axis — IMPORTANT: independent of the override/root rules
+ * above, `getByIds`/`deleteByIds` can't ask Vectorize to filter by namespace
+ * remotely at all (its id-based operations take no `namespace` option), so
+ * once a namespace IS resolved (explicit or defaulted) for these two methods,
+ * isolation is enforced client-side: `getByIds` drops any returned record
+ * whose `namespace` doesn't match (fail closed: a record with no `namespace`
+ * field is treated as a mismatch, never as "belongs to everyone"), and
+ * `deleteByIds` resolves ids via `getByIds` first and only deletes the subset
+ * that belongs to the resolved namespace — silently, by design (see the
+ * `deleteByIds` implementation for the no-signal tradeoff this makes).
  */
-declare const createContextVectors: (lunora: LunoraVectors) => VectorSearchLike;
+declare const createContextVectors: (lunora: LunoraVectors, options?: CreateContextVectorsOptions) => VectorSearchLike;
 /** A single row mutation observed by the ctx-db, fed to {@link createVectorSyncHook}. */
 interface WriteEvent {
   doc?: Record<string, unknown>;
@@ -152,6 +236,23 @@ interface SchemaLike {
  * (regardless of whether metadata is present); a genuinely single-tenant app
  * suppresses it with `allowSharedNamespace: true`.
  *
+ * Since plan 255, codegen satisfies the query-side requirement automatically
+ * for a `.shardBy()`'d vectorized table: the `vectors` instance passed in
+ * `options` here is the SAME `createContextVectors(...)` instance exposed as
+ * `ctx.vectors`, constructed with the identical shard-key `namespace` default
+ * AND the identical `shardedIndexNames` — so `ctx.vectors.query`/`getByIds`/
+ * `deleteByIds` are scoped without any app code changes. One consequence of
+ * sharing that instance: this hook's own internal `deleteByIds` calls (on row
+ * delete, on a cleared inline field, and on compensation after a failed
+ * upsert) now also go through the namespace-verifying path described on
+ * {@link createContextVectors} — an extra `getByIds` subrequest per
+ * delete-shaped write, not a behavior change (the row being deleted was
+ * written under this same shard's namespace, so the verification passes).
+ * This never hits {@link createContextVectors}'s root-instance throw: a write
+ * event only ever fires for a table THIS DO instance owns, so if this hook
+ * processes a write for a sharded index, this instance IS a real per-tenant
+ * shard (not root) — `namespace` here is never `undefined` for that index.
+ *
  * Consistency — IMPORTANT: this hook runs inline within the mutation but talks
  * to Vectorize, which is external and non-transactional. The per-index calls
  * fan out; if one fails after others have already applied, the SQLite write may

package/dist/vectors/index.mjs

@@ -1 +1 @@
-import{createContextVectors as t,createVectorSyncHook as o}from"../packem_shared/createContextVectors-HVMMJ-88.mjs";import{createVectorAdminIntrospector as a}from"../packem_shared/createVectorAdminIntrospector-B9Yt09yj.mjs";import{default as m}from"../packem_shared/createVectors-jb8fAY6R.mjs";export{t as createContextVectors,a as createVectorAdminIntrospector,o as createVectorSyncHook,m as createVectors};
+import{createContextVectors as t,createVectorSyncHook as o}from"../packem_shared/createContextVectors-D-ae1wWO.mjs";import{createVectorAdminIntrospector as a}from"../packem_shared/createVectorAdminIntrospector-B9Yt09yj.mjs";import{default as m}from"../packem_shared/createVectors-jb8fAY6R.mjs";export{t as createContextVectors,a as createVectorAdminIntrospector,o as createVectorSyncHook,m as createVectors};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/bindings",
-  "version": "1.0.0-alpha.16",
+  "version": "1.0.0-alpha.18",
   "description": "Lightweight Cloudflare binding helpers for Lunora — ctx.kv, ctx.images, ctx.analytics, ctx.pipelines, ctx.vectors, ctx.r2sql — one install, per-binding subpaths",
   "keywords": [
     "analytics",
@@ -64,8 +64,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.11",
-    "@lunora/platform": "1.0.0-alpha.2"
+    "@lunora/errors": "1.0.0-alpha.12",
+    "@lunora/platform": "1.0.0-alpha.4"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"

package/dist/packem_shared/createContextVectors-HVMMJ-88.mjs

@@ -1,6 +0,0 @@
-import{c as w,U as b}from"./concurrent-DMFQCILU.mjs";const x=(n,d)=>{if(!d.includes("."))return n[d];let t=n;for(const a of d.split(".")){if(t===null||typeof t!="object"||Array.isArray(t))return;t=t[a]}return t},B=n=>{const d=async(t,a)=>{await n.upsert(t,{embed:a.embed,id:a.id,input:a.input,metadata:a.metadata,namespace:a.namespace})};return{deleteByIds:async(t,a)=>{await n.deleteByIds(t,a)},getByIds:async(t,a)=>(await n.getByIds(t,a)).map(i=>({id:i.id,metadata:i.metadata,values:i.values})),query:async(t,a)=>{const i=await n.query(t,{embed:a.embed,filter:a.filter,input:a.input,namespace:a.namespace,returnMetadata:a.returnMetadata??"indexed",topK:a.topK,vector:a.vector});return{count:i.count,matches:i.matches.map(s=>({id:s.id,metadata:s.metadata,score:s.score}))}},upsert:d,upsertNow:d}},y=new Set,v=n=>{y.has(n)||(y.add(n),console.warn(`[@lunora/bindings/vectors] index "${n}" syncs vectors without a namespace — in a
-multi-tenant/sharded app this exposes one tenant's vectors (and any captured
-metadata) to every other tenant, since Vectorize indexes are account-global.
-Pass \`namespace\` (the shard/tenant key) on both write and query — query-side
-namespace filtering is mandatory for multi-tenant apps. Single-tenant apps that
-legitimately have no tenant key suppress this via { allowSharedNamespace: true }.`))},g=(n,d)=>{const t={};for(const a of d)a in n&&(t[a]=n[a]);return t},S=n=>{const{allowSharedNamespace:d,namespace:t,schema:a,vectors:i}=n;return async s=>{const c=a.tables[s.table]?.vectorIndexes??[],l=Object.entries(a.vectorIndexes).filter(([,e])=>e.table===s.table);if(c.length===0&&l.length===0)return;const m=[...c.map(e=>e.name),...l.map(([e])=>e)];if(s.op==="delete"){await Promise.all(m.map(e=>i.deleteByIds(e,[s.id])));return}const r=s.doc;if(!r)return;const u=c.map(e=>({index:e,value:x(r,e.field)})),p=u.filter(e=>e.value!==void 0&&e.value!==null),f=u.filter(e=>e.value===void 0||e.value===null);for(const{index:e,value:o}of p)if(typeof o!="string")throw new TypeError(`@lunora/bindings/vectors: inline index "${e.name}" expects a string source at "${e.field}" on table "${s.table}" (got ${typeof o}); use a standalone defineVectorIndex with a select() to derive text from non-string columns`);const h=[...f.map(e=>async()=>{await i.deleteByIds(e.index.name,[s.id])}),...p.map(e=>async()=>{!d&&t===void 0&&v(e.index.name),await i.upsert(e.index.name,{embed:e.index.embed,id:s.id,input:e.value,metadata:e.index.metadata?g(r,e.index.metadata):void 0,namespace:t})}),...l.map(([e,o])=>async()=>{!d&&t===void 0&&v(e),await i.upsert(e,{embed:o.embed,id:s.id,input:o.select(r),metadata:o.metadata?.(r),namespace:t})})];try{await w(h,b,async e=>e())}catch(e){throw await Promise.allSettled(m.map(o=>i.deleteByIds(o,[s.id]))),e}}};export{B as createContextVectors,S as createVectorSyncHook};