@lunora/do 0.0.0 → 1.0.0-alpha.1

package/dist/index.mjs

@@ -0,0 +1,35 @@
+export { exportShardRows, exportShardTable, importShardRows, parseExportShardArgs, parseImportShardArgs, selectExportTables, validateImportRow } from './packem_shared/exportShardRows-DZEhUeyI.mjs';
+export { AGGREGATE_SQL_FUNCTION, aggregateSqlFunction, matchesStaticWhere, normalizeCountArgument, throwingScheduler } from './packem_shared/matchesStaticWhere-CFk6adSu.mjs';
+export { aggregateTableName, coerceAggregateNumber, encodeAggregateKey, foldAggregateTally, readAggregateValue } from './packem_shared/aggregateTableName-CxNqY1Sl.mjs';
+export { CountRlsUnsupportedError, mergeWhere, planAggregateLookup, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy } from './packem_shared/CountRlsUnsupportedError-28ZvvwKS.mjs';
+export { AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, ensureAuthMetricsTables, readAuthMetrics, recordAuthEvent } from './packem_shared/AUTH_METRICS_BUCKET_MS-CiHHYeJi.mjs';
+export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/assertValidClientId-CBZ1zC96.mjs';
+export { DATA_MIGRATION_STATE_TABLE, readMigrationStatus, runDataMigration } from './packem_shared/DATA_MIGRATION_STATE_TABLE-PTtTiQ7U.mjs';
+export { SCAN_DEP, createDependencyTracker, depKey } from './packem_shared/SCAN_DEP-DLJF8dsj.mjs';
+export { renderSql } from './packem_shared/renderSql-D6eUcn2N.mjs';
+export { FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, ensureFunctionMetricsTables, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, recordFunctionMetric } from './packem_shared/ensureFunctionMetricsTables-UDNVD7FS.mjs';
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTION_PREFIX-Dzdqq5J2.mjs';
+export { LogBuffer } from './packem_shared/LogBuffer-B_Ezju_N.mjs';
+export { MAIL_RETENTION, MAIL_TABLE, clearCapturedMail, ensureMailTable, readCapturedMail, recordCapturedMail } from './packem_shared/clearCapturedMail-CPpgl-dX.mjs';
+export { default as NotFoundError } from './packem_shared/NotFoundError-CMuMZt81.mjs';
+export { armRestore, readBookmark } from './packem_shared/armRestore-BJk53Ro8.mjs';
+export { buildSeekWhere, decodeCursor, encodeCursor, normalizeOrderKeys } from './packem_shared/buildSeekWhere-lVsNXSLy.mjs';
+export { R as RANK_TIEBREAK, e as encodePartitionKey, m as matchesRankStaticWhere, r as rankTableName, a as resolveRankPartition, s as sortColumnName } from './packem_shared/rank-CrkEIpF4.mjs';
+export { ReactiveCache, reactiveCacheKey, stableStringify } from './packem_shared/ReactiveCache-ByVzgH3d.mjs';
+export { serveRelationFanout } from './packem_shared/serveRelationFanout-Clr1a05L.mjs';
+export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/assertFlatPredicate-DyVYReuT.mjs';
+export { applyOnDelete, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-CMif2RKw.mjs';
+export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/guardWriter-u3UlnCH5.mjs';
+export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/ftsTableName-BLEMawrp.mjs';
+export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
+export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-ilPZsVwu.mjs';
+export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO, subscriptionListDeltas } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-DQkmGiCS.mjs';
+export { SHARD_REGISTRY_DO_NAME, ShardRegistryDO } from './packem_shared/SHARD_REGISTRY_DO_NAME-BsAbi5Mn.mjs';
+export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/assertReadonly-dDcFE1YZ.mjs';
+export { createSystemReader } from './packem_shared/createSystemReader-8CzSZP9V.mjs';
+export { ConflictError } from './packem_shared/ConflictError-C0STs6bU.mjs';
+export { hasTrigger, runTriggers } from './packem_shared/runTriggers-5N6_Fx0A.mjs';
+export { compileWhereSql } from './packem_shared/compileWhereSql-CXrhFA3G.mjs';
+export { CDC_LOG_TABLE, applyCdcChanges, readCdcChanges, trimCdcChanges } from './packem_shared/applyCdcChanges-Ctdmxmrv.mjs';
+export { backfillAggregateIndexes, backfillRankIndexes } from './packem_shared/backfillAggregateIndexes-BF5eL7kW.mjs';
+export { runShardMigrations } from './packem_shared/runShardMigrations-C3bn5r93.mjs';

package/dist/packem_shared/ADMIN_FUNCTION_PREFIX-Dzdqq5J2.mjs

@@ -0,0 +1,313 @@
+const ADMIN_FUNCTION_PREFIX = "__lunora_admin__:";
+const RELATION_FUNCTION_PREFIX = "__lunora_relation__:";
+const ADMIN_FUNCTIONS = {
+  applyCdc: "__lunora_admin__:applyCdc",
+  cdcSync: "__lunora_admin__:cdcSync",
+  clearCapturedMail: "__lunora_admin__:clearCapturedMail",
+  clearTable: "__lunora_admin__:clearTable",
+  createWorkflowInstance: "__lunora_admin__:createWorkflowInstance",
+  deleteRows: "__lunora_admin__:deleteRows",
+  describeTable: "__lunora_admin__:describeTable",
+  describeTables: "__lunora_admin__:describeTables",
+  exportShard: "__lunora_admin__:exportShard",
+  facetColumn: "__lunora_admin__:facetColumn",
+  getAdvisories: "__lunora_admin__:getAdvisories",
+  getAuditLog: "__lunora_admin__:getAuditLog",
+  getAuthMetrics: "__lunora_admin__:getAuthMetrics",
+  getCapturedMail: "__lunora_admin__:getCapturedMail",
+  getFunctionStats: "__lunora_admin__:getFunctionStats",
+  listSubscriptions: "__lunora_admin__:listSubscriptions",
+  listTableIndexes: "__lunora_admin__:listTableIndexes",
+  getLogs: "__lunora_admin__:getLogs",
+  getMetrics: "__lunora_admin__:getMetrics",
+  getPitrBookmark: "__lunora_admin__:getPitrBookmark",
+  getRequestLog: "__lunora_admin__:getRequestLog",
+  getSecurityAudit: "__lunora_admin__:getSecurityAudit",
+  getSettings: "__lunora_admin__:getSettings",
+  // eslint-disable-next-line no-secrets/no-secrets -- reserved admin RPC path constant, not a credential
+  getWorkflowInstanceStatus: "__lunora_admin__:getWorkflowInstanceStatus",
+  importShard: "__lunora_admin__:importShard",
+  listTables: "__lunora_admin__:listTables",
+  listWorkflows: "__lunora_admin__:listWorkflows",
+  maskPolicies: "__lunora_admin__:maskPolicies",
+  migrationStatus: "__lunora_admin__:migrationStatus",
+  pitrRestore: "__lunora_admin__:pitrRestore",
+  rankBefore: "__lunora_admin__:rankBefore",
+  rankPage: "__lunora_admin__:rankPage",
+  readTablePage: "__lunora_admin__:readTablePage",
+  recordAuthEvent: "__lunora_admin__:recordAuthEvent",
+  recordContainerEvent: "__lunora_admin__:recordContainerEvent",
+  recordMail: "__lunora_admin__:recordMail",
+  rlsPolicies: "__lunora_admin__:rlsPolicies",
+  runAs: "__lunora_admin__:runAs",
+  runMigration: "__lunora_admin__:runMigration",
+  runSql: "__lunora_admin__:runSql",
+  sendTestMail: "__lunora_admin__:sendTestMail",
+  storageOrphans: "__lunora_admin__:storageOrphans",
+  storageReferences: "__lunora_admin__:storageReferences",
+  storageRules: "__lunora_admin__:storageRules",
+  studioFeatures: "__lunora_admin__:studioFeatures",
+  writeRow: "__lunora_admin__:writeRow"
+};
+const DEFAULT_PAGE_SIZE = 50;
+const MAX_PAGE_SIZE = 500;
+const DEFAULT_FACET_LIMIT = 30;
+const MAX_FACET_LIMIT = 200;
+const DOC_COLUMN = "__doc__";
+const safeParseObject = (text) => {
+  try {
+    const value = JSON.parse(text);
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+  } catch {
+    return void 0;
+  }
+};
+const expandDocumentRows = (columns, rows) => {
+  if (!columns.includes(DOC_COLUMN)) {
+    return { columns, rows };
+  }
+  const parsed = [];
+  for (const row of rows) {
+    const raw = row[DOC_COLUMN];
+    const documentData = typeof raw === "string" ? safeParseObject(raw) : void 0;
+    if (documentData === void 0) {
+      return { columns, rows };
+    }
+    const meta = Object.fromEntries(Object.entries(row).filter(([column]) => column !== DOC_COLUMN));
+    parsed.push({ ...meta, ...documentData });
+  }
+  const metaColumns = columns.filter((name) => name !== DOC_COLUMN);
+  const documentKeys = [];
+  const seen = new Set(metaColumns);
+  for (const documentData of parsed) {
+    for (const key of Object.keys(documentData)) {
+      if (!seen.has(key)) {
+        seen.add(key);
+        documentKeys.push(key);
+      }
+    }
+  }
+  return { columns: [...metaColumns, ...documentKeys], rows: parsed };
+};
+const escapeLike = (value) => value.replaceAll(/[\\%_]/g, (character) => `\\${character}`);
+const isInternalTable = (name) => name.startsWith("sqlite_") || name.startsWith("_cf_") || name.startsWith("__miniflare") || name.startsWith("__lunora") || name.includes("__fts_");
+const quoteIdentifier = (name) => `"${name.replaceAll('"', '""')}"`;
+const clamp = (value, min, max) => Math.min(Math.max(value, min), max);
+const countRows = (sql, quotedTable) => {
+  const row = sql.exec(`SELECT COUNT(*) AS c FROM ${quotedTable}`).one();
+  return Number(row.c);
+};
+const listTables = (sql) => {
+  const names = sql.exec("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").toArray();
+  const tables = [];
+  for (const { name } of names) {
+    if (isInternalTable(name)) {
+      continue;
+    }
+    tables.push({ name, rowCount: countRows(sql, quoteIdentifier(name)) });
+  }
+  return tables;
+};
+const tableExists = (sql, table) => sql.exec("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ? LIMIT 1", table).toArray().length > 0;
+const FILTER_SQL_OPERATOR = { eq: "=", gt: ">", gte: ">=", lt: "<", lte: "<=", ne: "<>" };
+const filterValueText = (value) => {
+  if (typeof value === "string") {
+    return value;
+  }
+  return typeof value === "number" || typeof value === "boolean" ? String(value) : "";
+};
+const resolveColumnExpression = (column, physicalColumns) => {
+  const isPhysical = physicalColumns.includes(column);
+  const isDocumentStored = physicalColumns.includes(DOC_COLUMN);
+  if (!isPhysical && !isDocumentStored) {
+    return void 0;
+  }
+  return isPhysical ? { expression: quoteIdentifier(column), params: [] } : { expression: `json_extract(${quoteIdentifier(DOC_COLUMN)}, ?)`, params: [`$."${column.replaceAll('"', '""')}"`] };
+};
+const buildFilterClause = (clause, physicalColumns) => {
+  const resolved = resolveColumnExpression(clause.column, physicalColumns);
+  if (resolved === void 0) {
+    return void 0;
+  }
+  const { expression, params: pathParameters } = resolved;
+  if (clause.operator === "contains") {
+    return {
+      params: [...pathParameters, `%${escapeLike(filterValueText(clause.value))}%`],
+      sql: String.raw`CAST(${expression} AS TEXT) LIKE ? ESCAPE '\'`
+    };
+  }
+  return { params: [...pathParameters, clause.value], sql: `${expression} ${FILTER_SQL_OPERATOR[clause.operator]} ?` };
+};
+const buildTablePredicate = (columns, needle, filters) => {
+  const conjuncts = [];
+  const parameters = [];
+  if (needle !== "" && columns.length > 0) {
+    const pattern = `%${escapeLike(needle)}%`;
+    conjuncts.push(`(${columns.map((name) => String.raw`CAST(${quoteIdentifier(name)} AS TEXT) LIKE ? ESCAPE '\'`).join(" OR ")})`);
+    parameters.push(...columns.map(() => pattern));
+  }
+  for (const clause of filters ?? []) {
+    const built = buildFilterClause(clause, columns);
+    if (built !== void 0) {
+      conjuncts.push(`(${built.sql})`);
+      parameters.push(...built.params);
+    }
+  }
+  return conjuncts.length === 0 ? void 0 : { parameters, where: conjuncts.join(" AND ") };
+};
+const buildOrderBy = (orderBy, physicalColumns) => {
+  if (orderBy === void 0) {
+    return void 0;
+  }
+  const resolved = resolveColumnExpression(orderBy.column, physicalColumns);
+  if (resolved === void 0) {
+    return void 0;
+  }
+  const keyword = orderBy.direction === "desc" ? "DESC" : "ASC";
+  return { params: resolved.params, sql: `${resolved.expression} ${keyword}` };
+};
+const readTablePage = (sql, options) => {
+  const { table } = options;
+  if (isInternalTable(table) || !tableExists(sql, table)) {
+    throw Object.assign(new Error(`unknown table: ${table}`), { code: "UNKNOWN_TABLE", name: "LunoraError", status: 404 });
+  }
+  const limit = clamp(Math.trunc(options.limit ?? DEFAULT_PAGE_SIZE), 1, MAX_PAGE_SIZE);
+  const offset = Math.max(0, Math.trunc(options.offset ?? 0));
+  const quoted = quoteIdentifier(table);
+  const columns = sql.exec(`PRAGMA table_info(${quoted})`).toArray().map((column) => column.name);
+  const needle = options.search?.trim() ?? "";
+  const withReferences = (page) => {
+    if (options.refs === void 0) {
+      return page;
+    }
+    const references = {};
+    for (const column of page.columns) {
+      const target = options.refs[column];
+      if (target !== void 0) {
+        references[column] = target;
+      }
+    }
+    return Object.keys(references).length > 0 ? { ...page, refs: references } : page;
+  };
+  const predicate = buildTablePredicate(columns, needle, options.filters);
+  const order = buildOrderBy(options.orderBy, columns);
+  const whereSql = predicate === void 0 ? "" : ` WHERE ${predicate.where}`;
+  const orderSql = order === void 0 ? "" : ` ORDER BY ${order.sql}`;
+  const whereParams = predicate?.parameters ?? [];
+  const orderParams = order?.params ?? [];
+  const total = predicate === void 0 ? countRows(sql, quoted) : Number(sql.exec(`SELECT COUNT(*) AS c FROM ${quoted}${whereSql}`, ...whereParams).one().c);
+  const rawRows = sql.exec(`SELECT * FROM ${quoted}${whereSql}${orderSql} LIMIT ? OFFSET ?`, ...whereParams, ...orderParams, limit, offset).toArray();
+  return withReferences({ ...expandDocumentRows(columns, rawRows), total });
+};
+const selectMatchingIds = (sql, options) => {
+  const { table } = options;
+  if (isInternalTable(table) || !tableExists(sql, table)) {
+    throw Object.assign(new Error(`unknown table: ${table}`), { code: "UNKNOWN_TABLE", name: "LunoraError", status: 404 });
+  }
+  const limit = clamp(Math.trunc(options.limit ?? MAX_PAGE_SIZE), 1, MAX_PAGE_SIZE);
+  const quoted = quoteIdentifier(table);
+  const columns = sql.exec(`PRAGMA table_info(${quoted})`).toArray().map((column) => column.name);
+  const needle = options.search?.trim() ?? "";
+  const predicate = buildTablePredicate(columns, needle, options.filters);
+  const fetched = predicate === void 0 ? sql.exec(`SELECT id FROM ${quoted} LIMIT ?`, limit + 1).toArray() : sql.exec(`SELECT id FROM ${quoted} WHERE ${predicate.where} LIMIT ?`, ...predicate.parameters, limit + 1).toArray();
+  const hasMore = fetched.length > limit;
+  const ids = (hasMore ? fetched.slice(0, limit) : fetched).map((row) => row.id);
+  return { hasMore, ids };
+};
+const knownDisplayColumns = (sql, quotedTable, physicalColumns) => {
+  const known = new Set(physicalColumns.filter((name) => name !== DOC_COLUMN));
+  if (!physicalColumns.includes(DOC_COLUMN)) {
+    return known;
+  }
+  const sample = sql.exec(`SELECT ${quoteIdentifier(DOC_COLUMN)} AS doc FROM ${quotedTable} LIMIT ?`, MAX_PAGE_SIZE).toArray();
+  for (const { doc } of sample) {
+    const documentData = typeof doc === "string" ? safeParseObject(doc) : void 0;
+    if (documentData !== void 0) {
+      for (const key of Object.keys(documentData)) {
+        known.add(key);
+      }
+    }
+  }
+  return known;
+};
+const facetColumn = (sql, options) => {
+  const { column, table } = options;
+  if (isInternalTable(table) || !tableExists(sql, table)) {
+    throw Object.assign(new Error(`unknown table: ${table}`), { code: "UNKNOWN_TABLE", name: "LunoraError", status: 404 });
+  }
+  const quoted = quoteIdentifier(table);
+  const physicalColumns = sql.exec(`PRAGMA table_info(${quoted})`).toArray().map((info) => info.name);
+  if (!knownDisplayColumns(sql, quoted, physicalColumns).has(column)) {
+    throw Object.assign(new Error(`unknown column: ${column}`), { code: "UNKNOWN_COLUMN", name: "LunoraError", status: 404 });
+  }
+  const resolved = resolveColumnExpression(column, physicalColumns);
+  if (resolved === void 0) {
+    throw Object.assign(new Error(`unknown column: ${column}`), { code: "UNKNOWN_COLUMN", name: "LunoraError", status: 404 });
+  }
+  const limit = clamp(Math.trunc(options.limit ?? DEFAULT_FACET_LIMIT), 1, MAX_FACET_LIMIT);
+  const needle = options.search?.trim() ?? "";
+  const predicate = buildTablePredicate(physicalColumns, needle, options.filters);
+  const whereSql = predicate === void 0 ? "" : ` WHERE ${predicate.where}`;
+  const whereParams = predicate?.parameters ?? [];
+  const rows = sql.exec(
+    `SELECT ${resolved.expression} AS value, COUNT(*) AS count FROM ${quoted}${whereSql} GROUP BY ${resolved.expression} ORDER BY count DESC LIMIT ?`,
+    ...resolved.params,
+    ...whereParams,
+    ...resolved.params,
+    limit + 1
+  ).toArray();
+  const truncated = rows.length > limit;
+  const kept = truncated ? rows.slice(0, limit) : rows;
+  return {
+    truncated,
+    values: kept.map((row) => {
+      return { count: Number(row.count), value: row.value };
+    })
+  };
+};
+const findStorageReferences = (sql, storageColumns, keys) => {
+  const references = {};
+  const scanned = keys.slice(0, MAX_PAGE_SIZE);
+  for (const key of scanned) {
+    references[key] = [];
+  }
+  if (scanned.length === 0) {
+    return { references, storageColumns };
+  }
+  const placeholders = scanned.map(() => "?").join(", ");
+  for (const [table, columns] of Object.entries(storageColumns)) {
+    if (isInternalTable(table) || !tableExists(sql, table)) {
+      continue;
+    }
+    const quoted = quoteIdentifier(table);
+    const physicalColumns = sql.exec(`PRAGMA table_info(${quoted})`).toArray().map((column) => column.name);
+    for (const column of columns) {
+      const resolved = resolveColumnExpression(column, physicalColumns);
+      if (resolved === void 0) {
+        continue;
+      }
+      const rows = sql.exec(
+        `SELECT id, ${resolved.expression} AS ref FROM ${quoted} WHERE ${resolved.expression} IN (${placeholders})`,
+        ...resolved.params,
+        ...resolved.params,
+        ...scanned
+      ).toArray();
+      for (const row of rows) {
+        references[row.ref]?.push({ column, id: row.id, table });
+      }
+    }
+  }
+  return { references, storageColumns };
+};
+const summarizeSubscriptions = (attachments) => {
+  const connections = attachments.map((attachment, id) => {
+    const subscriptions = Object.values(attachment.subs ?? {}).map((sub) => {
+      return { args: sub.args, functionPath: sub.functionPath, table: sub.table };
+    });
+    return { admin: attachment.admin === true, id, subscriptions };
+  });
+  const totalSubscriptions = connections.reduce((sum, connection) => sum + connection.subscriptions.length, 0);
+  return { connections, totalConnections: connections.length, totalSubscriptions };
+};
+
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, MAX_PAGE_SIZE, RELATION_FUNCTION_PREFIX, facetColumn, findStorageReferences, listTables, readTablePage, selectMatchingIds, summarizeSubscriptions };

package/dist/packem_shared/AUTH_METRICS_BUCKET_MS-CiHHYeJi.mjs

@@ -0,0 +1,84 @@
+const AUTH_METRICS_TABLE = "__lunora_auth_metrics";
+const AUTH_METRICS_BUCKETS_TABLE = "__lunora_auth_metrics_buckets";
+const AUTH_METRICS_ROW_KEY = "app";
+const AUTH_METRICS_BUCKET_MS = 6e4;
+const AUTH_METRICS_BUCKET_RETENTION = 1440;
+const runSql = (sql, query, ...params) => {
+  const runner = sql.exec;
+  return runner.call(sql, query, ...params);
+};
+const bucketFloor = (ts) => Math.floor(ts / AUTH_METRICS_BUCKET_MS) * AUTH_METRICS_BUCKET_MS;
+const ensureAuthMetricsTables = (sql) => {
+  runSql(
+    sql,
+    `CREATE TABLE IF NOT EXISTS "${AUTH_METRICS_TABLE}" (
+            key TEXT PRIMARY KEY,
+            attempts INTEGER NOT NULL DEFAULT 0,
+            failures INTEGER NOT NULL DEFAULT 0,
+            since_ms INTEGER NOT NULL DEFAULT 0
+        )`
+  );
+  runSql(
+    sql,
+    `CREATE TABLE IF NOT EXISTS "${AUTH_METRICS_BUCKETS_TABLE}" (
+            bucket_ms INTEGER PRIMARY KEY,
+            attempts INTEGER NOT NULL DEFAULT 0,
+            failures INTEGER NOT NULL DEFAULT 0
+        )`
+  );
+};
+const recordAuthEvent = (sql, input) => {
+  ensureAuthMetricsTables(sql);
+  const failureCount = input.outcome === "fail" ? 1 : 0;
+  runSql(
+    sql,
+    `INSERT INTO "${AUTH_METRICS_TABLE}" (key, attempts, failures, since_ms)
+         VALUES (?, 1, ?, ?)
+         ON CONFLICT(key) DO UPDATE SET
+            attempts = attempts + 1,
+            failures = failures + excluded.failures,
+            since_ms = CASE WHEN since_ms = 0 THEN excluded.since_ms ELSE since_ms END`,
+    AUTH_METRICS_ROW_KEY,
+    failureCount,
+    input.ts
+  );
+  const bucket = bucketFloor(input.ts);
+  runSql(
+    sql,
+    `INSERT INTO "${AUTH_METRICS_BUCKETS_TABLE}" (bucket_ms, attempts, failures)
+         VALUES (?, 1, ?)
+         ON CONFLICT(bucket_ms) DO UPDATE SET
+            attempts = attempts + 1,
+            failures = failures + excluded.failures`,
+    bucket,
+    failureCount
+  );
+  runSql(
+    sql,
+    `DELETE FROM "${AUTH_METRICS_BUCKETS_TABLE}"
+         WHERE bucket_ms <= (
+            SELECT MAX(bucket_ms) - ? FROM "${AUTH_METRICS_BUCKETS_TABLE}"
+         )`,
+    AUTH_METRICS_BUCKET_RETENTION * AUTH_METRICS_BUCKET_MS
+  );
+};
+const readAuthMetrics = (sql) => {
+  ensureAuthMetricsTables(sql);
+  const row = runSql(
+    sql,
+    `SELECT attempts, failures, since_ms FROM "${AUTH_METRICS_TABLE}" WHERE key = ?`,
+    AUTH_METRICS_ROW_KEY
+  ).toArray()[0];
+  const attempts = row?.attempts ?? 0;
+  const failures = row?.failures ?? 0;
+  const sinceMs = row?.since_ms ?? 0;
+  const history = runSql(
+    sql,
+    `SELECT bucket_ms, attempts, failures FROM "${AUTH_METRICS_BUCKETS_TABLE}" ORDER BY bucket_ms ASC`
+  ).toArray().map((bucket) => {
+    return { attempts: bucket.attempts, bucketMs: bucket.bucket_ms, failures: bucket.failures };
+  });
+  return { attempts, failureRate: attempts === 0 ? 0 : failures / attempts, failures, history, sinceMs };
+};
+
+export { AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_ROW_KEY, AUTH_METRICS_TABLE, ensureAuthMetricsTables, readAuthMetrics, recordAuthEvent };

package/dist/packem_shared/ConflictError-C0STs6bU.mjs

@@ -0,0 +1,13 @@
+class ConflictError extends Error {
+  code = "CONFLICT";
+  /** Why the conflict fired; `occ` is the contention signal the metrics layer counts. */
+  kind;
+  status = 409;
+  constructor(message = "Optimistic concurrency conflict", kind = "conflict") {
+    super(message);
+    this.name = "ConflictError";
+    this.kind = kind;
+  }
+}
+
+export { ConflictError };

package/dist/packem_shared/CountRlsUnsupportedError-28ZvvwKS.mjs

@@ -0,0 +1,133 @@
+class CountRlsUnsupportedError extends Error {
+  code = "COUNT_RLS_UNSUPPORTED";
+  name = "LunoraError";
+  status = 422;
+  constructor(table) {
+    super(
+      table === void 0 ? "count() is not supported in an RLS-restricted context" : `count() is not supported on table "${table}" inside an RLS-restricted context`
+    );
+  }
+}
+const mergeWhere = (left, right) => {
+  if (!left) {
+    return right;
+  }
+  if (!right) {
+    return left;
+  }
+  return { AND: [left, right] };
+};
+const BOOLEAN_COMBINATORS = /* @__PURE__ */ new Set(["AND", "NOT", "OR"]);
+const NOT_EQ = /* @__PURE__ */ Symbol("not-eq");
+const resolveEqValue = (value) => {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    const operatorKeys = Object.keys(value);
+    if (operatorKeys.length === 1 && operatorKeys[0] === "eq") {
+      return value.eq;
+    }
+    return NOT_EQ;
+  }
+  return value;
+};
+const parseRequestedEqKeys = (requested, accept) => {
+  const resolved = {};
+  for (const [key, raw] of Object.entries(requested)) {
+    if (BOOLEAN_COMBINATORS.has(key) || !accept(key)) {
+      return void 0;
+    }
+    const value = resolveEqValue(raw);
+    if (value === NOT_EQ) {
+      return void 0;
+    }
+    resolved[key] = value;
+  }
+  return resolved;
+};
+const reconcileStaticWhere = (staticWhere, resolved, requested, crossCheckRequested) => {
+  const merged = { ...resolved };
+  if (!staticWhere) {
+    return merged;
+  }
+  for (const [key, value] of Object.entries(staticWhere)) {
+    if (key in merged) {
+      if (merged[key] !== value) {
+        return void 0;
+      }
+    } else if (crossCheckRequested && key in requested) {
+      if (requested[key] !== value) {
+        return void 0;
+      }
+    } else {
+      merged[key] = value;
+    }
+  }
+  return merged;
+};
+const planAggregateLookup = (index, requestedWhere) => {
+  const by = index.by ?? [];
+  const requested = requestedWhere ?? {};
+  const resolved = parseRequestedEqKeys(requested, (key) => by.includes(key));
+  if (resolved === void 0) {
+    return void 0;
+  }
+  for (const key of by) {
+    if (!(key in resolved)) {
+      return void 0;
+    }
+  }
+  return reconcileStaticWhere(index.where, resolved, requested, true);
+};
+const collectPartialKey = (index, requestedWhere, byFields) => {
+  const partial = parseRequestedEqKeys(requestedWhere ?? {}, (key) => byFields.has(key));
+  if (partial === void 0) {
+    return void 0;
+  }
+  return reconcileStaticWhere(index.where, partial, {}, false);
+};
+const selectIndexForReducer = (indexes, op, field, requestedWhere) => {
+  let best;
+  for (const index of indexes) {
+    if (index.op !== op) {
+      continue;
+    }
+    if (op !== "count" && index.field !== field) {
+      continue;
+    }
+    const key = planAggregateLookup(index, requestedWhere);
+    if (!key) {
+      continue;
+    }
+    if (!best || (index.by?.length ?? 0) > (best.index.by?.length ?? 0)) {
+      best = { index, key };
+    }
+  }
+  return best;
+};
+const selectIndexForCount = (indexes, requestedWhere) => selectIndexForReducer(indexes, "count", void 0, requestedWhere);
+const selectIndexForAggregate = (indexes, op, field, requestedWhere) => selectIndexForReducer(indexes, op, field, requestedWhere);
+const selectIndexForGroupBy = (indexes, op, field, by, requestedWhere) => {
+  const requestedFields = new Set(by);
+  for (const index of indexes) {
+    if (index.op !== op) {
+      continue;
+    }
+    if (op !== "count" && index.field !== field) {
+      continue;
+    }
+    const indexBy = index.by ?? [];
+    if (indexBy.length !== requestedFields.size) {
+      continue;
+    }
+    if (!indexBy.every((key) => requestedFields.has(key))) {
+      continue;
+    }
+    const partial = collectPartialKey(index, requestedWhere, requestedFields);
+    if (partial === void 0) {
+      continue;
+    }
+    return { index, partial };
+  }
+  return void 0;
+};
+
+export { CountRlsUnsupportedError, mergeWhere, planAggregateLookup, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy };