@lunora/do 1.0.0-alpha.17 → 1.0.0-alpha.19

package/dist/index.d.mts

@@ -2800,8 +2800,14 @@ interface StorageRulesResult {
 * package's tests and the studio's fails the build if the two key sets diverge.
 */
 interface StudioFeaturesResult {
+  /** `@lunora/bindings/analytics` / `ctx.analytics` is used, or it is a declared dependency. */
+  analytics: boolean;
+  /** `@lunora/auth` is a declared dependency (backs the Users / Sessions / Organizations / Configuration pages). */
+  auth: boolean;
   /** `@lunora/flags` / `ctx.flags` is used, or it is a declared dependency. */
   flags: boolean;
+  /** `@lunora/bindings/kv` / `ctx.kv` is used, or it is a declared dependency. */
+  kv: boolean;
   /** `@lunora/mail` is imported by a `lunora/` source or a declared dependency. */
   mail: boolean;
   /** `@lunora/payment` is used (import or `ctx.payments`) or a declared dependency. */
@@ -6597,8 +6603,11 @@ interface WhereSqlStrategy {
   fieldRef: FieldRefSql;
   /**
   * Dialect `contains` rendering given the field reference and the (already
-  * bound) search term. Absent ⇒ the portable `… LIKE '%' || term || '%'`
-  * concat form (SQLite/Postgres); MySQL supplies a `CONCAT(...)` variant.
+  * bound, already wildcard-escaped) search term. Absent ⇒ the portable
+  * `… LIKE '%' || term || '%' ESCAPE '\'` concat form (SQLite/Postgres); MySQL
+  * supplies a `CONCAT(...)` variant. The term is escaped by
+  * {@link compileContains}, so an implementation MUST pair it with
+  * `ESCAPE '\'` for the literal-match to hold.
   */
   likeContains?: (reference: SQL, term: SQL) => SQL;
   /**

package/dist/index.d.ts

@@ -2800,8 +2800,14 @@ interface StorageRulesResult {
 * package's tests and the studio's fails the build if the two key sets diverge.
 */
 interface StudioFeaturesResult {
+  /** `@lunora/bindings/analytics` / `ctx.analytics` is used, or it is a declared dependency. */
+  analytics: boolean;
+  /** `@lunora/auth` is a declared dependency (backs the Users / Sessions / Organizations / Configuration pages). */
+  auth: boolean;
   /** `@lunora/flags` / `ctx.flags` is used, or it is a declared dependency. */
   flags: boolean;
+  /** `@lunora/bindings/kv` / `ctx.kv` is used, or it is a declared dependency. */
+  kv: boolean;
   /** `@lunora/mail` is imported by a `lunora/` source or a declared dependency. */
   mail: boolean;
   /** `@lunora/payment` is used (import or `ctx.payments`) or a declared dependency. */
@@ -6597,8 +6603,11 @@ interface WhereSqlStrategy {
   fieldRef: FieldRefSql;
   /**
   * Dialect `contains` rendering given the field reference and the (already
-  * bound) search term. Absent ⇒ the portable `… LIKE '%' || term || '%'`
-  * concat form (SQLite/Postgres); MySQL supplies a `CONCAT(...)` variant.
+  * bound, already wildcard-escaped) search term. Absent ⇒ the portable
+  * `… LIKE '%' || term || '%' ESCAPE '\'` concat form (SQLite/Postgres); MySQL
+  * supplies a `CONCAT(...)` variant. The term is escaped by
+  * {@link compileContains}, so an implementation MUST pair it with
+  * `ESCAPE '\'` for the literal-match to hold.
   */
   likeContains?: (reference: SQL, term: SQL) => SQL;
   /**

package/dist/index.mjs

@@ -3,15 +3,15 @@ export { AGGREGATE_SQL_FUNCTION, aggregateSqlFunction, matchesStaticWhere, norma
 export { aggregateTableName, coerceAggregateNumber, encodeAggregateKey, foldAggregateTally, readAggregateValue } from './packem_shared/aggregateTableName-CxNqY1Sl.mjs';
 export { CountRlsUnsupportedError, mergeWhere, planAggregateLookup, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy } from './packem_shared/CountRlsUnsupportedError-28ZvvwKS.mjs';
 export { AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, ensureAuthMetricsTables, readAuthMetrics, recordAuthEvent } from './packem_shared/AUTH_METRICS_BUCKETS_TABLE-CiHHYeJi.mjs';
-export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/NotUniqueError-BXn2j5vu.mjs';
+export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/NotUniqueError-Do5h_jiW.mjs';
 export { DATA_MIGRATION_STATE_TABLE, readMigrationStatus, runDataMigration } from './packem_shared/DATA_MIGRATION_STATE_TABLE-DfPxn8I0.mjs';
 export { SCAN_DEP, createDependencyTracker, depKey } from './packem_shared/SCAN_DEP-DLJF8dsj.mjs';
 export { renderSql } from './packem_shared/renderSql-D6eUcn2N.mjs';
 export { diffExternalSource } from './packem_shared/diffExternalSource-Cx9HUPJj.mjs';
-export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-uKBx9H0s.mjs';
-export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-BMTJv65e.mjs';
+export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-Bj6EXy50.mjs';
+export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-9mJRJ9Ld.mjs';
 export { FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, ensureFunctionMetricsTables, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, recordFunctionMetric } from './packem_shared/FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
-export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-fMl1vyt1.mjs';
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-BvGiv2u6.mjs';
 export { LogBuffer } from './packem_shared/LogBuffer-B_Ezju_N.mjs';
 export { MAIL_RETENTION, MAIL_TABLE, clearCapturedMail, ensureMailTable, readCapturedMail, recordCapturedMail } from './packem_shared/MAIL_RETENTION-CPpgl-dX.mjs';
 export { default as NotFoundError } from './packem_shared/NotFoundError-CMuMZt81.mjs';
@@ -19,20 +19,20 @@ export { armRestore, readBookmark } from './packem_shared/armRestore-BJk53Ro8.mj
 export { applySelect, buildSeekWhere, decodeCursor, encodeCursor, normalizeOrderKeys, softDeleteScope } from './packem_shared/applySelect-BvZdFUBT.mjs';
 export { RANK_TIEBREAK, encodePartitionKey, matchesRankStaticWhere, rankTableName, resolveRankPartition, sortColumnName } from './packem_shared/RANK_TIEBREAK-CXhdcA1o.mjs';
 export { ReactiveCache, reactiveCacheKey } from './packem_shared/ReactiveCache-BYlSGY0N.mjs';
-export { serveRelationFanout } from './packem_shared/serveRelationFanout-EZLD9-O3.mjs';
+export { serveRelationFanout } from './packem_shared/serveRelationFanout-BuSmWawx.mjs';
 export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, assertShapeShardable, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-DU-Y4-LJ.mjs';
 export { applyOnDelete, fanOutScalarCounts, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-BQ-8ZlZ1.mjs';
 export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/RLS_UNWRAP_SYMBOL-EtGQdC9d.mjs';
 export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/buildFtsMatch-BLEMawrp.mjs';
 export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
 export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-ilPZsVwu.mjs';
-export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-DDp_NomS.mjs';
+export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-DlFX7CLL.mjs';
 export { SHARD_REGISTRY_DO_NAME, ShardRegistryDO } from './packem_shared/SHARD_REGISTRY_DO_NAME-BsAbi5Mn.mjs';
 export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-dDcFE1YZ.mjs';
 export { createSystemReader } from './packem_shared/createSystemReader-8CzSZP9V.mjs';
 export { ConflictError } from './packem_shared/ConflictError-C0STs6bU.mjs';
 export { hasTrigger, runTriggers } from './packem_shared/hasTrigger-5N6_Fx0A.mjs';
-export { compileWhereSql } from './packem_shared/compileWhereSql-CXrhFA3G.mjs';
+export { compileWhereSql } from './packem_shared/compileWhereSql-MW_Lk8nJ.mjs';
 export { CDC_LOG_TABLE, applyCdcChanges, readCdcChanges, trimCdcChanges } from './packem_shared/CDC_LOG_TABLE-DSycmnDf.mjs';
 export { backfillAggregateIndexes, backfillRankIndexes } from './packem_shared/backfillAggregateIndexes-BZsOqDXP.mjs';
 export { runShardMigrations } from './packem_shared/runShardMigrations-nIwoQeOK.mjs';

package/dist/packem_shared/{ADMIN_FUNCTIONS-fMl1vyt1.mjs → ADMIN_FUNCTIONS-BvGiv2u6.mjs}

@@ -1,3 +1,5 @@
+const quoteIdentifier = (name) => `"${name.replaceAll('"', '""')}"`;
+
 const ADMIN_FUNCTION_PREFIX = "__lunora_admin__:";
 const RELATION_FUNCTION_PREFIX = "__lunora_relation__:";
 const FLAGS_FUNCTION_PREFIX = "__lunora_flags__:";
@@ -95,7 +97,6 @@ const expandDocumentRows = (columns, rows) => {
 };
 const escapeLike = (value) => value.replaceAll(/[\\%_]/g, (character) => `\\${character}`);
 const isInternalTable = (name) => name.startsWith("sqlite_") || name.startsWith("_cf_") || name.startsWith("__miniflare") || name.startsWith("__lunora") || name.includes("__fts_");
-const quoteIdentifier = (name) => `"${name.replaceAll('"', '""')}"`;
 const clamp = (value, min, max) => Math.min(Math.max(value, min), max);
 const countRows = (sql, quotedTable) => {
   const row = sql.exec(`SELECT COUNT(*) AS c FROM ${quotedTable}`).one();

package/dist/packem_shared/{NotUniqueError-BXn2j5vu.mjs → NotUniqueError-Do5h_jiW.mjs}

@@ -19,11 +19,11 @@ import { guardWriter } from './RLS_UNWRAP_SYMBOL-EtGQdC9d.mjs';
 import { createSystemReader } from './createSystemReader-8CzSZP9V.mjs';
 import { ConflictError } from './ConflictError-C0STs6bU.mjs';
 import { runTriggers } from './hasTrigger-5N6_Fx0A.mjs';
-import { compileWhereSql } from './compileWhereSql-CXrhFA3G.mjs';
+import { compileWhereSql } from './compileWhereSql-MW_Lk8nJ.mjs';
 export { backfillAggregateIndexes, backfillRankIndexes } from './backfillAggregateIndexes-BZsOqDXP.mjs';
 export { C as CLIENT_WATERMARK_TABLE, G as GLOBAL_SHAPE_SNAPSHOT_TABLE, I as IDEMPOTENCY_TABLE, c as advanceClientWatermark, d as deleteGlobalShapeSnapshot, e as deleteGlobalShapeSnapshotsForConnection, m as migrateClientWatermark, b as migrateGlobalShapeSnapshot, r as readClientWatermark, f as readGlobalShapeSnapshot, g as readIdempotent, t as trimIdempotent, w as writeGlobalShapeSnapshot, h as writeIdempotent } from './ctx-db-idempotency-BdcNpvY4.mjs';
 export { runShardMigrations } from './runShardMigrations-nIwoQeOK.mjs';
-export { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-BQapRFjB.mjs';
+export { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-0RaIOy7J.mjs';
 
 const rankIndexFieldsUnchanged = (index, previous, next) => {
   const fields = [...index.partitionBy ?? [], ...index.sortBy.map((key) => key.field), ...index.where ? Object.keys(index.where) : []];

package/dist/packem_shared/{ROOT_DO_SIZE_WARN_BYTES-DDp_NomS.mjs → ROOT_DO_SIZE_WARN_BYTES-DlFX7CLL.mjs}

@@ -5,7 +5,7 @@ import { recordAuthEvent, readAuthMetrics } from './AUTH_METRICS_BUCKETS_TABLE-C
 import { DATA_MIGRATION_STATE_TABLE, readMigrationStatus } from './DATA_MIGRATION_STATE_TABLE-DfPxn8I0.mjs';
 import { SCAN_DEP, createDependencyTracker, tableFromDepKey } from './SCAN_DEP-DLJF8dsj.mjs';
 import { readFunctionMetricsTotals, readFunctionMetricIndexHits, recordFunctionMetric, mergeScanAttribution, readFunctionMetrics, readFunctionMetricBuckets } from './FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
-import { createFanoutCounters, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, selectMatchingIds, ADMIN_FUNCTIONS, findStorageReferences, listTables, summarizeSubscriptions, summarizeFanoutTopics, readTablePage, facetColumn, FLAGS_FUNCTION_PREFIX, recordFanoutPass, MAX_PAGE_SIZE } from './ADMIN_FUNCTIONS-fMl1vyt1.mjs';
+import { createFanoutCounters, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, selectMatchingIds, ADMIN_FUNCTIONS, findStorageReferences, listTables, summarizeSubscriptions, summarizeFanoutTopics, readTablePage, facetColumn, FLAGS_FUNCTION_PREFIX, recordFanoutPass, MAX_PAGE_SIZE } from './ADMIN_FUNCTIONS-BvGiv2u6.mjs';
 import { LogBuffer } from './LogBuffer-B_Ezju_N.mjs';
 import { recordCapturedMail, clearCapturedMail, readCapturedMail, MAIL_TABLE } from './MAIL_RETENTION-CPpgl-dX.mjs';
 import { readBookmark, armRestore } from './armRestore-BJk53Ro8.mjs';
@@ -17,7 +17,7 @@ import { runReadonlySql } from './MAX_SQL_ROWS-dDcFE1YZ.mjs';
 import { ConflictError } from './ConflictError-C0STs6bU.mjs';
 import { e as deleteGlobalShapeSnapshotsForConnection, g as readIdempotent, h as writeIdempotent, t as trimIdempotent, r as readClientWatermark, m as migrateClientWatermark, c as advanceClientWatermark, d as deleteGlobalShapeSnapshot, f as readGlobalShapeSnapshot, w as writeGlobalShapeSnapshot } from './ctx-db-idempotency-BdcNpvY4.mjs';
 import { CDC_LOG_TABLE, readCdcChanges, readCdcCursor, readCdcEpoch, minCdcSeq, bumpCdcEpoch } from './CDC_LOG_TABLE-DSycmnDf.mjs';
-import { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-BQapRFjB.mjs';
+import { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-0RaIOy7J.mjs';
 
 const MAX_BATCH_ENTRIES = 500;
 
@@ -269,6 +269,30 @@ const buildPokeFrames = (parts, meta, options = {}) => {
 
 const DEFAULT_RELAY_FAN = 2;
 const DEFAULT_MAX_RELAYS = 8;
+const RELAY_SECRET_KEY = "LUNORA_RELAY_SECRET";
+const RELAY_SIGNATURE_HEADER = "x-lunora-relay-sig";
+const relaySecretOf = (env) => {
+  const value = env?.[RELAY_SECRET_KEY];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+};
+const constantTimeEqual$1 = (a, b) => {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let mismatch = 0;
+  for (let index = 0; index < a.length; index += 1) {
+    const charA = a.charCodeAt(index);
+    const charB = b.charCodeAt(index);
+    mismatch |= charA ^ charB;
+  }
+  return mismatch === 0;
+};
+const signRelayBody = async (secret, body) => {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
+  return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+};
 const envPositiveInt = (env, key, fallback) => {
   const raw = env?.[key];
   let parsed = Number.NaN;
@@ -305,9 +329,23 @@ class RelayLink {
    * to `relay.ts` without a case here is a COMPILE error, not a runtime mis-route.
    */
   async handleControl(request) {
+    let raw;
+    try {
+      raw = await request.text();
+    } catch {
+      return new Response("bad request", { status: 400 });
+    }
+    const secret = relaySecretOf(this.host.env());
+    if (secret !== void 0) {
+      const supplied = request.headers.get(RELAY_SIGNATURE_HEADER);
+      const expected = await signRelayBody(secret, raw);
+      if (supplied === null || !constantTimeEqual$1(supplied, expected)) {
+        return new Response("forbidden", { status: 403 });
+      }
+    }
     let message;
     try {
-      message = await request.json();
+      message = JSON.parse(raw);
     } catch {
       return new Response("bad request", { status: 400 });
     }
@@ -372,10 +410,16 @@ class RelayLink {
       return void 0;
     }
     const stub = typeof namespace.getByName === "function" ? namespace.getByName(targetName) : namespace.get(namespace.idFromName(targetName));
+    const body = JSON.stringify(message);
+    const headers = { "content-type": "application/json", "x-lunora-shard-binding": this.host.shardBinding() ?? "" };
+    const secret = relaySecretOf(this.host.env());
+    if (secret !== void 0) {
+      headers[RELAY_SIGNATURE_HEADER] = await signRelayBody(secret, body);
+    }
     try {
       return await stub.fetch("https://relay.internal/_lunora/relay", {
-        body: JSON.stringify(message),
-        headers: { "content-type": "application/json", "x-lunora-shard-binding": this.host.shardBinding() ?? "" },
+        body,
+        headers,
         method: "POST"
       });
     } catch {
@@ -679,8 +723,9 @@ class OwnerRelay extends RelayLink {
    * sound against the cross-identity row-leak (review). Resolves under the anonymous
    * multicast identity (the base) plus two `Proxy`-backed identities that return a
    * distinct value for ANY accessed claim, requires all to agree on table + where +
-   * columns, rejects any table with an RLS read policy or a masked projected column,
-   * and fails closed if the claims are enumerated (a wholesale copy the proxy can't
+   * columns, rejects any table with an RLS read policy or ANY masked column
+   * defined (even if unprojected — see {@link OwnerRelay.tableHasAnyMask}), and
+   * fails closed if the claims are enumerated (a wholesale copy the proxy can't
    * differentiate).
    */
   probeShapeRelayUniform(name, args) {
@@ -696,7 +741,7 @@ class OwnerRelay extends RelayLink {
     if (this.host.rlsMetadata().policies.some((policy) => policy.on === "read" && policy.table === base.table)) {
       return false;
     }
-    if (this.shapeColumnsMasked(base.table, base.columns)) {
+    if (this.tableHasAnyMask(base.table)) {
       return false;
     }
     const baseWhere = stableStringify(base.effectiveWhere);
@@ -734,17 +779,18 @@ class OwnerRelay extends RelayLink {
     });
     return matches && !enumerated;
   }
-  /** Whether any column the shape projects from `table` is masked — a masked value is identity-dependent, so the shape can't be relay-uniform. */
-  shapeColumnsMasked(table, columns) {
-    const masked = this.host.maskMetadata().columns.filter((entry) => entry.table === table);
-    if (masked.length === 0) {
-      return false;
-    }
-    if (columns === void 0) {
-      return true;
-    }
-    const projected = new Set(columns);
-    return masked.some((entry) => projected.has(entry.column));
+  /**
+   * Whether `table` has ANY masked column defined (L7). Deliberately conservative:
+   * we disqualify a shape from relay-multicast if its table declares any mask at
+   * all, even when the current query doesn't project the masked column. A masked
+   * value is identity-dependent, and keying uniformity off the *projected* set
+   * meant a later column addition (or a `select` change) could silently widen a
+   * cohort to include an identity-dependent value. Refusing on any table-level
+   * mask removes that footgun; the cost is a few extra shapes falling back to the
+   * per-identity path, which is always correct.
+   */
+  tableHasAnyMask(table) {
+    return this.host.maskMetadata().columns.some((entry) => entry.table === table);
   }
 }
 class RelayMember extends RelayLink {
@@ -2785,7 +2831,19 @@ class ShardDO {
    */
   // eslint-disable-next-line class-methods-use-this -- base-class override hook: the codegen subclass overrides this with the statically-discovered feature flags
   studioFeatures() {
-    return { flags: false, mail: false, payments: false, queues: false, scheduler: false, storage: false, vectors: false, workflows: false };
+    return {
+      analytics: false,
+      auth: false,
+      flags: false,
+      kv: false,
+      mail: false,
+      payments: false,
+      queues: false,
+      scheduler: false,
+      storage: false,
+      vectors: false,
+      workflows: false
+    };
   }
   /**
    * Evaluate every statically-discovered feature flag under `context` for the

package/dist/packem_shared/{compileWhereSql-CXrhFA3G.mjs → compileWhereSql-MW_Lk8nJ.mjs}

@@ -11,9 +11,10 @@ const isOperatorObject = (value) => {
   const keys = Object.keys(value);
   return keys.length > 0 && keys.every((key) => OPERATOR_KEY_SET.has(key));
 };
+const escapeLikeTerm = (value) => typeof value === "string" ? value.replaceAll(/[\\%_]/g, (character) => `\\${character}`) : value;
 const compileContains = (reference, value, strategy) => {
-  const term = sql`${strategy.serialize(value)}`;
-  return strategy.likeContains ? strategy.likeContains(reference, term) : sql`${reference} LIKE '%' || ${term} || '%'`;
+  const term = sql`${strategy.serialize(escapeLikeTerm(value))}`;
+  return strategy.likeContains ? strategy.likeContains(reference, term) : sql`${reference} LIKE '%' || ${term} || '%' ESCAPE '\\'`;
 };
 const compileComparator = (reference, operator, comparator, value, strategy) => {
   if (value === null) {

package/dist/packem_shared/{ctx-db-shapes-BQapRFjB.mjs → ctx-db-shapes-0RaIOy7J.mjs}

@@ -1,7 +1,7 @@
 import { sql } from 'drizzle-orm';
 import { r as runDrizzle } from './do-exec-5eQy5cEi.mjs';
 import { D as DOC_COLUMN, r as rowToDocument, j as jsonPathSql } from './do-sql-BCHCWtrD.mjs';
-import { compileWhereSql } from './compileWhereSql-CXrhFA3G.mjs';
+import { compileWhereSql } from './compileWhereSql-MW_Lk8nJ.mjs';
 import { s as serializeSqlValue } from './serialize-sql-BlRUoiQe.mjs';
 
 const shapeWhereStrategy = { fieldRef: jsonPathSql, serialize: serializeSqlValue };

package/dist/packem_shared/{isSourceDue-BMTJv65e.mjs → isSourceDue-9mJRJ9Ld.mjs}

@@ -1,4 +1,4 @@
-import { runExternalSourceTick } from './materializeExternalRows-uKBx9H0s.mjs';
+import { runExternalSourceTick } from './materializeExternalRows-Bj6EXy50.mjs';
 
 const liftSourceId = (row, options = {}) => {
   const { idColumn = "id", map } = options;

package/dist/packem_shared/{materializeExternalRows-uKBx9H0s.mjs → materializeExternalRows-Bj6EXy50.mjs}

@@ -1,5 +1,5 @@
 import { applyCdcChanges } from './CDC_LOG_TABLE-DSycmnDf.mjs';
-import { s as selectShapeRows } from './ctx-db-shapes-BQapRFjB.mjs';
+import { s as selectShapeRows } from './ctx-db-shapes-0RaIOy7J.mjs';
 import { diffExternalSource, projectExternalSourceRow } from './diffExternalSource-Cx9HUPJj.mjs';
 import { stableStringify } from './stableStringify-MydiuScU.mjs';
 

package/dist/packem_shared/{serveRelationFanout-EZLD9-O3.mjs → serveRelationFanout-BuSmWawx.mjs}

@@ -1,4 +1,4 @@
-import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTIONS-fMl1vyt1.mjs';
+import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTIONS-BvGiv2u6.mjs';
 
 const serveRelationFanout = async (schema, database, functionPath, args) => {
   const table = typeof args["table"] === "string" ? args["table"] : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/do",
-  "version": "1.0.0-alpha.17",
+  "version": "1.0.0-alpha.19",
   "description": "Lunora Durable Objects: ShardDO (SQLite, OCC, hibernated WebSocket subscriptions) and SessionDO",
   "keywords": [
     "cloudflare",