@lunora/do 0.0.0 → 1.0.0-alpha.10

package/dist/packem_shared/RANK_TIEBREAK-CXhdcA1o.mjs

@@ -0,0 +1,91 @@
+import { s as serializeSqlValue } from './serialize-sql-BlRUoiQe.mjs';
+
+const compareStrings = (a, b) => {
+  if (a < b) {
+    return -1;
+  }
+  return a > b ? 1 : 0;
+};
+const NOT_RESOLVABLE = /* @__PURE__ */ Symbol("not-resolvable");
+const resolvePartitionValue = (value) => {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    const operatorKeys = Object.keys(value);
+    if (operatorKeys.length === 1 && operatorKeys[0] === "eq") {
+      return value.eq;
+    }
+    return NOT_RESOLVABLE;
+  }
+  return value;
+};
+const encodePartitionKey = (partitionBy, source) => {
+  if (partitionBy.length === 0) {
+    return "";
+  }
+  const ordered = {};
+  for (const field of [...partitionBy].toSorted(compareStrings)) {
+    ordered[field] = source[field] ?? null;
+  }
+  return JSON.stringify(ordered);
+};
+const RANK_TIEBREAK = "__id__";
+const sortColumnName = (i) => `__sort_k${String(i)}__`;
+const matchesRankStaticWhere = (document, predicate) => {
+  for (const [field, expected] of Object.entries(predicate)) {
+    const actual = document[field];
+    if (expected !== null && typeof expected === "object" && !Array.isArray(expected)) {
+      const operatorKeys = Object.keys(expected);
+      if (operatorKeys.length === 1 && operatorKeys[0] === "eq") {
+        if (actual !== expected.eq) {
+          return false;
+        }
+        continue;
+      }
+      return false;
+    }
+    if (actual !== expected) {
+      return false;
+    }
+  }
+  return true;
+};
+const resolveRankPartition = (index, where) => {
+  const partitionBy = index.partitionBy ?? [];
+  const requested = where ?? {};
+  for (const key of Object.keys(requested)) {
+    if (key === "AND" || key === "OR" || key === "NOT") {
+      return void 0;
+    }
+  }
+  const resolved = {};
+  for (const field of partitionBy) {
+    if (field in requested) {
+      const value = resolvePartitionValue(requested[field]);
+      if (value === NOT_RESOLVABLE) {
+        return void 0;
+      }
+      resolved[field] = value;
+    } else if (index.where && field in index.where) {
+      resolved[field] = index.where[field];
+    } else {
+      return void 0;
+    }
+  }
+  return resolved;
+};
+const rankTableName = (table, indexName) => `${table}__rank_${indexName}`;
+const rankKeyFromDocument = (index, document_) => {
+  return {
+    partitionKey: encodePartitionKey(index.partitionBy ?? [], document_),
+    rowId: document_["_id"],
+    // Serialize each sort value the same way `syncRankIndexEntry` writes the
+    // stored `__sort_k<i>__` column, so a peer shard's comparison matches
+    // byte-for-byte. This also makes the values JSON-safe for the
+    // cross-shard RPC wire — `serializeSqlValue` turns bigint/Date/object
+    // into a string|number|null, where raw bigint would crash JSON.stringify
+    // and a raw Date would serialize to a different shape than the store.
+    // eslint-disable-next-line unicorn/no-null -- mirrors syncRankIndexEntry: a missing field serializes via `?? null` so the stored and wire bytes agree
+    sortValues: index.sortBy.map((key) => serializeSqlValue(document_[key.field] ?? null))
+  };
+};
+
+export { RANK_TIEBREAK, encodePartitionKey, matchesRankStaticWhere, rankKeyFromDocument as rankKeyFromDoc, rankTableName, resolveRankPartition, sortColumnName };

package/dist/packem_shared/RLS_UNWRAP_SYMBOL-EtGQdC9d.mjs

@@ -0,0 +1,132 @@
+const RLS_UNWRAP_SYMBOL = /* @__PURE__ */ Symbol.for("lunora.ctxdb.rls-unwrap");
+class RlsRequiredError extends Error {
+  code = "RLS_REQUIRED";
+  status = 403;
+  table;
+  constructor(table) {
+    super(
+      `ctx.db access to "${table}" is denied: the schema is marked .rls("required"), so this table is protected. Apply RLS with .use(rls(policies)) in the procedure, or mark the table .public() to opt it out.`
+    );
+    this.name = "RlsRequiredError";
+    this.table = table;
+  }
+}
+const guardWriter = (raw, schema, tableOfId) => {
+  if (schema.rlsMode !== "required") {
+    return raw;
+  }
+  const base = raw;
+  const isProtected = (tableName) => {
+    const definition = schema.tables[tableName];
+    return definition !== void 0 && definition.isPublic !== true;
+  };
+  const guardTable = (tableName) => {
+    if (isProtected(tableName)) {
+      throw new RlsRequiredError(tableName);
+    }
+  };
+  const guardById = async (id, expectedTable) => {
+    if (expectedTable !== void 0) {
+      guardTable(expectedTable);
+      return;
+    }
+    const tableName = await tableOfId(id);
+    if (tableName !== void 0) {
+      guardTable(tableName);
+    }
+  };
+  const baseRankBefore = base.rankBefore;
+  const guarded = {
+    ...raw,
+    [RLS_UNWRAP_SYMBOL]: raw,
+    aggregate: (tableName, options) => {
+      guardTable(tableName);
+      return base.aggregate(tableName, options);
+    },
+    count: (tableName, whereOrArgs) => {
+      guardTable(tableName);
+      return base.count(tableName, whereOrArgs);
+    },
+    delete: async (id, expectedTable, options) => {
+      await guardById(id, expectedTable);
+      return base.delete(id, expectedTable, options);
+    },
+    deleteMany: async (ids, options, expectedTable) => {
+      for (const id of ids) {
+        await guardById(id, expectedTable);
+      }
+      return base.deleteMany(ids, options, expectedTable);
+    },
+    findFirst: (tableName, args) => {
+      guardTable(tableName);
+      return base.findFirst(tableName, args);
+    },
+    findFirstOrThrow: (tableName, args) => {
+      guardTable(tableName);
+      return base.findFirstOrThrow(tableName, args);
+    },
+    findMany: (tableName, args) => {
+      guardTable(tableName);
+      return base.findMany(tableName, args);
+    },
+    get: async (id, expectedTable) => {
+      await guardById(id, expectedTable);
+      return base.get(id, expectedTable);
+    },
+    groupBy: (tableName, options) => {
+      guardTable(tableName);
+      return base.groupBy(tableName, options);
+    },
+    insert: (tableName, document, options) => {
+      guardTable(tableName);
+      return base.insert(tableName, document, options);
+    },
+    insertMany: (tableName, documents, options) => {
+      guardTable(tableName);
+      return base.insertMany(tableName, documents, options);
+    },
+    insertManyUnsafe: (tableName, documents, options) => {
+      guardTable(tableName);
+      return base.insertManyUnsafe(tableName, documents, options);
+    },
+    patch: async (id, patch, expectedTable) => {
+      await guardById(id, expectedTable);
+      return base.patch(id, patch, expectedTable);
+    },
+    patchMany: async (patches, options, expectedTable) => {
+      for (const entry of patches) {
+        await guardById(entry.id, expectedTable);
+      }
+      return base.patchMany(patches, options, expectedTable);
+    },
+    query: (tableName) => {
+      guardTable(tableName);
+      return base.query(tableName);
+    },
+    rank: (tableName, indexName, options) => {
+      guardTable(tableName);
+      return base.rank(tableName, indexName, options);
+    },
+    rankPage: (tableName, indexName, options) => {
+      guardTable(tableName);
+      return base.rankPage(tableName, indexName, options);
+    },
+    replace: async (id, document, expectedTable) => {
+      await guardById(id, expectedTable);
+      return base.replace(id, document, expectedTable);
+    },
+    restore: async (id, expectedTable) => {
+      await guardById(id, expectedTable);
+      return base.restore?.(id, expectedTable);
+    }
+  };
+  if (baseRankBefore) {
+    guarded["rankBefore"] = (tableName, indexName, options) => {
+      guardTable(tableName);
+      return baseRankBefore(tableName, indexName, options);
+    };
+  }
+  return guarded;
+};
+
+export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter };