@lunora/server 0.0.0 → 1.0.0-alpha.10

package/dist/index.mjs

@@ -0,0 +1,28 @@
+export { default as asBucketStorage } from './packem_shared/asBucketStorage-Cnxd9y2q.mjs';
+export { initLunora } from './packem_shared/initLunora-lxwHTEV3.mjs';
+export { createSecrets } from './packem_shared/createSecrets-TsIP9lOa.mjs';
+export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/LunoraEnvError-DjFkpkSP.mjs';
+export { LunoraError } from './packem_shared/LunoraError-DN7Zhhvu.mjs';
+export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-Ce57S3N9.mjs';
+export { httpAction, httpRoute, httpRouter, serveStorageObject } from './packem_shared/httpAction-FLwfsePg.mjs';
+export { onConnect, onDisconnect } from './packem_shared/onConnect-CIPXKPyw.mjs';
+export { defineMigration } from './packem_shared/defineMigration-CAJLr6fx.mjs';
+export { defineMutator } from './packem_shared/defineMutator-EIXAWhs9.mjs';
+export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-Ck5_TUO8.mjs';
+export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-D8viLY1S.mjs';
+export { protectPublic } from './packem_shared/protectPublic-BjFkQ_Or.mjs';
+export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-ZdyU78gh.mjs';
+export { defineShape } from './packem_shared/defineShape-CJ27Wx7o.mjs';
+export { anyApi } from './types.mjs';
+export { cronJobs } from '@lunora/scheduler';
+export { ValidationError, v } from '@lunora/values';
+export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-1jexWrb3.mjs';
+export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-De67zPDS.mjs';
+export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-qu0mpilX.mjs';
+export { mask } from './packem_shared/mask-BV_jNzsN.mjs';
+export { rls } from './packem_shared/rls-2Jhd0uev.mjs';
+export { storageRules } from './packem_shared/storageRules-Cje6Woea.mjs';
+
+const VERSION = "0.0.0";
+
+export { VERSION };

package/dist/packem_shared/LunoraEnvError-DjFkpkSP.mjs

@@ -0,0 +1,187 @@
+import { optionalInner } from '@lunora/values';
+
+const SECRET_VALUE_PREFIXES = [
+  /^sk_/u,
+  /^pk_/u,
+  /^rk_/u,
+  /^ghp_/u,
+  /^gho_/u,
+  /^ghs_/u,
+  /^ghr_/u,
+  /^github_pat_/u,
+  /^xox[baprs]-/u,
+  /^AKIA/u,
+  /^AIza/u,
+  /^Bearer\s/u
+];
+const HIGH_ENTROPY_TOKEN = /[\w./+-]{24,}/gu;
+const STANDALONE_TOKEN = /^[\w./+-]+$/u;
+const EMBEDDED_PREFIXED_TOKEN_SHORT = /\b(?:(?:sk|pk|rk|ghp|gho|ghs|ghr)_[\w./+-]*|github_pat_[\w./+-]*|xox[baprs]-[\w./+-]*)/gu;
+const EMBEDDED_PREFIXED_TOKEN_LONG = /\b(?:AKIA|AIza)[\w./+-]+|Bearer\s+[\w./+-]+/gu;
+const URL_CREDENTIAL = /\b([a-z][\w.+-]*:\/\/[\w.%+-]+):[\w.%+-]+@/gu;
+const REDACTED = "[redacted]";
+const SECRET_KEY = /(?:KEY|PASSWORD|SECRET|TOKEN)$/u;
+const looksLikeSecretValue = (value) => {
+  if (SECRET_VALUE_PREFIXES.some((prefix) => prefix.test(value))) {
+    return true;
+  }
+  const trimmed = value.trim();
+  return trimmed.length >= 24 && STANDALONE_TOKEN.test(trimmed);
+};
+const QUOTED_VALUE = /(["'])(?<inner>(?:\\.|(?!\1).)*)\1/gu;
+const KEYED_VALUE = /\b(?<key>[A-Za-z_]\w*)\s*[=:]\s*\S+/gu;
+const redactSecrets = (message) => {
+  let out = message;
+  out = out.replaceAll(QUOTED_VALUE, (match, ...groups) => {
+    const named = groups.at(-1);
+    return named?.inner !== void 0 && looksLikeSecretValue(named.inner) ? REDACTED : match;
+  });
+  out = out.replaceAll(URL_CREDENTIAL, (_match, prefix) => `${prefix}:${REDACTED}@`);
+  out = out.replaceAll(EMBEDDED_PREFIXED_TOKEN_SHORT, REDACTED);
+  out = out.replaceAll(EMBEDDED_PREFIXED_TOKEN_LONG, REDACTED);
+  out = out.replaceAll(KEYED_VALUE, (match, ...groups) => {
+    const named = groups.at(-1);
+    return named?.key !== void 0 && SECRET_KEY.test(named.key) ? `${named.key}=${REDACTED}` : match;
+  });
+  out = out.replaceAll(HIGH_ENTROPY_TOKEN, REDACTED);
+  return out;
+};
+const redactValueForKey = (message, key, raw) => {
+  const masked = redactSecrets(message);
+  if (typeof raw === "string" && raw !== "" && SECRET_KEY.test(key)) {
+    return masked.replaceAll(raw, REDACTED);
+  }
+  return masked;
+};
+class LunoraEnvError extends Error {
+  name = "LunoraEnvError";
+  failures;
+  constructor(failures) {
+    const summary = failures.map((failure) => `  - ${failure.key}: ${failure.message}`).join("\n");
+    super(`Invalid environment (${String(failures.length)} key(s)):
+${summary}`);
+    this.failures = failures;
+  }
+}
+const TRUE_VALUES = /* @__PURE__ */ new Set(["1", "on", "true", "yes"]);
+const FALSE_VALUES = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
+const INTEGER_LITERAL = /^-?\d+$/u;
+const unwrapKind = (validator) => {
+  if (validator.kind !== "optional") {
+    return validator.kind;
+  }
+  const inner = optionalInner(validator);
+  return inner ? unwrapKind(inner) : validator.kind;
+};
+const coerce = (validator, raw) => {
+  if (typeof raw !== "string") {
+    return raw;
+  }
+  switch (unwrapKind(validator)) {
+    case "bigint": {
+      return INTEGER_LITERAL.test(raw.trim()) ? BigInt(raw.trim()) : raw;
+    }
+    case "boolean": {
+      const lowered = raw.trim().toLowerCase();
+      if (TRUE_VALUES.has(lowered)) {
+        return true;
+      }
+      if (FALSE_VALUES.has(lowered)) {
+        return false;
+      }
+      return raw;
+    }
+    case "number": {
+      const trimmed = raw.trim();
+      if (trimmed === "") {
+        return raw;
+      }
+      const parsed = Number(trimmed);
+      return Number.isNaN(parsed) ? raw : parsed;
+    }
+    default: {
+      return raw;
+    }
+  }
+};
+const validateKey = (key, validator, env, failures) => {
+  const raw = env[key];
+  if (raw === void 0 && validator.kind === "optional") {
+    return { ok: true, value: void 0 };
+  }
+  const result = validator.safeParse(coerce(validator, raw));
+  if (result.ok) {
+    return { ok: true, value: result.value };
+  }
+  failures.push({ key, message: redactValueForKey(result.error.message, key, raw) });
+  return { ok: false };
+};
+const requireEnvObject = (env) => {
+  if (typeof env !== "object" || env === null) {
+    throw new LunoraEnvError([{ key: "<env>", message: `expected an object, received ${env === null ? "null" : typeof env}` }]);
+  }
+  return env;
+};
+const defineEnv = (shape) => {
+  const keys = Object.keys(shape);
+  const cache = /* @__PURE__ */ new WeakMap();
+  const accessor = ((env) => {
+    const source = requireEnvObject(env);
+    let resolved = cache.get(source);
+    if (resolved === void 0) {
+      resolved = /* @__PURE__ */ new Map();
+      cache.set(source, resolved);
+    }
+    const cached = resolved;
+    const read = (property) => {
+      if (cached.has(property)) {
+        return cached.get(property);
+      }
+      const failures = [];
+      const outcome = validateKey(property, shape[property], source, failures);
+      if (!outcome.ok) {
+        throw new LunoraEnvError(failures);
+      }
+      cached.set(property, outcome.value);
+      return outcome.value;
+    };
+    return /* @__PURE__ */ new Proxy({}, {
+      get(_target, property) {
+        if (typeof property !== "string" || !(property in shape)) {
+          return void 0;
+        }
+        return read(property);
+      },
+      getOwnPropertyDescriptor(_target, property) {
+        if (typeof property === "string" && property in shape) {
+          return { configurable: true, enumerable: true, value: read(property), writable: false };
+        }
+        return void 0;
+      },
+      has(_target, property) {
+        return typeof property === "string" && property in shape;
+      },
+      ownKeys() {
+        return keys;
+      }
+    });
+  });
+  accessor.parse = (env) => {
+    const source = requireEnvObject(env);
+    const failures = [];
+    const out = {};
+    for (const key of keys) {
+      const outcome = validateKey(key, shape[key], source, failures);
+      if (outcome.ok && outcome.value !== void 0) {
+        out[key] = outcome.value;
+      }
+    }
+    if (failures.length > 0) {
+      throw new LunoraEnvError(failures);
+    }
+    return out;
+  };
+  return accessor;
+};
+
+export { LunoraEnvError, defineEnv, redactSecrets };

package/dist/packem_shared/LunoraError-DN7Zhhvu.mjs

@@ -0,0 +1,54 @@
+const CODE_STATUS = {
+  BAD_REQUEST: 400,
+  CONFLICT: 409,
+  /**
+   * `count()` invoked against a table whose context carries an active RLS
+   * policy. The operation itself is unsupported in an RLS-restricted reader
+   * (kitcn's documented constraint) — the request is well-formed and the
+   * caller is authorized, so this is a 422 (semantic conflict) rather than a
+   * 403 (policy denial).
+   */
+  COUNT_RLS_UNSUPPORTED: 422,
+  FORBIDDEN: 403,
+  INTERNAL_SERVER_ERROR: 500,
+  /**
+   * An analytical reduction (`aggregate` / `groupBy`) was invoked over a
+   * column that the procedure's `mask()` middleware redacts. A masked column
+   * can't be summed, averaged, or grouped without leaking the very values the
+   * mask hides (a group key *is* the raw value; an aggregate is computed from
+   * it), so the operation fails closed. The request is well-formed and the
+   * caller is authorized — this is a 422 (semantic conflict), mirroring
+   * `COUNT_RLS_UNSUPPORTED`.
+   */
+  MASK_UNSUPPORTED: 422,
+  NOT_FOUND: 404,
+  NOT_IMPLEMENTED: 501,
+  /**
+   * A write policy's `when` returned a relation-crossing predicate
+   * (`some`/`none`/`every`/`is`/`isNot`). The in-memory write-policy evaluator
+   * has no child fetcher and cannot resolve a relation node, so the policy is
+   * unsupported as written. Relation predicates are valid in *read* policies
+   * and query `where` clauses (the pre-resolver handles them there). The
+   * request is well-formed; this is a 422 (semantic conflict), mirroring the
+   * sibling `*_UNSUPPORTED` codes.
+   */
+  RELATION_PREDICATE_UNSUPPORTED: 422,
+  TOO_MANY_REQUESTS: 429,
+  UNAUTHORIZED: 401,
+  UNPROCESSABLE: 422
+};
+class LunoraError extends Error {
+  name = "LunoraError";
+  code;
+  status;
+  /** Structured, JSON+wire-encodable payload surfaced to the client alongside `code`. */
+  data;
+  constructor(code, message, data) {
+    super(message ?? code);
+    this.code = code;
+    this.status = CODE_STATUS[code];
+    this.data = data;
+  }
+}
+
+export { LunoraError };

package/dist/packem_shared/PRESENCE_DEFAULT_TTL_MS-D8viLY1S.mjs

@@ -0,0 +1,114 @@
+import { v } from '@lunora/values';
+import { initLunora } from './initLunora-lxwHTEV3.mjs';
+import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
+import { onDisconnect } from './onConnect-CIPXKPyw.mjs';
+import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-Ck5_TUO8.mjs';
+import { defineTable } from './defineAggregateIndex-ZdyU78gh.mjs';
+
+const DEFAULT_TTL_MS = 3e4;
+const MAX_DATA_BYTES = 4096;
+const PRESENCE_KEY = "presence";
+const PRESENCE_BARE_TABLE = "present";
+const PRESENCE_TABLE = `${PRESENCE_KEY}_${PRESENCE_BARE_TABLE}`;
+const presenceExtension = defineSchemaExtension(PRESENCE_KEY, {
+  tables: {
+    [PRESENCE_BARE_TABLE]: defineTable({
+      data: v.optional(v.record(v.string(), v.any())),
+      lastSeen: v.number(),
+      roomId: v.string(),
+      sessionId: v.string(),
+      userId: v.optional(v.string())
+    }).index("byRoomSession", ["roomId", "sessionId"]).index("byRoom", ["roomId"])
+  }
+});
+const { mutation, query } = initLunora.dataModel().create();
+const definePresence = (options = {}) => {
+  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+  const disconnectGraceMs = Math.max(0, Math.min(options.disconnectGraceMs ?? 0, ttlMs));
+  const heartbeat = mutation.input({
+    data: v.optional(v.record(v.string(), v.any())),
+    roomId: v.string(),
+    sessionId: v.string()
+  }).mutation(async ({ args, ctx: context }) => {
+    const lastSeen = Date.now();
+    const userId = context.auth.userId ?? void 0;
+    if (args.data !== void 0 && JSON.stringify(args.data).length > MAX_DATA_BYTES) {
+      throw new LunoraError("BAD_REQUEST", `presence data exceeds the ${String(MAX_DATA_BYTES)}-byte limit`);
+    }
+    const existing = await context.db.query(PRESENCE_TABLE).withIndex("byRoomSession", (q) => q.eq("roomId", args.roomId).eq("sessionId", args.sessionId)).first();
+    if (existing && (existing["userId"] ?? void 0) !== userId) {
+      throw new LunoraError("FORBIDDEN", "presence heartbeat denied: this (roomId, sessionId) is held by another identity");
+    }
+    const row = {
+      lastSeen,
+      roomId: args.roomId,
+      sessionId: args.sessionId,
+      ...args.data === void 0 ? {} : { data: args.data },
+      ...userId === void 0 ? {} : { userId }
+    };
+    await (existing ? context.db.patch(existing["_id"], row) : context.db.insert(PRESENCE_TABLE, row));
+    return { lastSeen };
+  });
+  const listPresent = query.input({ roomId: v.string() }).query(async ({ args, ctx: context }) => {
+    const cutoff = Date.now() - ttlMs;
+    const rows = await context.db.query(PRESENCE_TABLE).withIndex("byRoom", (q) => q.eq("roomId", args.roomId)).collect();
+    const live = rows.filter((row) => row["lastSeen"] > cutoff).toSorted((a, b) => b["lastSeen"] - a["lastSeen"]);
+    const seenUsers = /* @__PURE__ */ new Set();
+    const members = [];
+    for (const row of live) {
+      const userId = row["userId"];
+      if (userId !== void 0) {
+        if (seenUsers.has(userId)) {
+          continue;
+        }
+        seenUsers.add(userId);
+      }
+      const member = {
+        lastSeen: row["lastSeen"],
+        roomId: row["roomId"]
+      };
+      if (userId !== void 0) {
+        member.userId = userId;
+      }
+      if (row["data"] !== void 0) {
+        member.data = row["data"];
+      }
+      members.push(member);
+    }
+    return members;
+  });
+  const sweep = mutation.input({ roomId: v.string() }).mutation(async ({ args, ctx: context }) => {
+    const cutoff = Date.now() - ttlMs;
+    const stale = await context.db.query(PRESENCE_TABLE).withIndex("byRoom", (q) => q.eq("roomId", args.roomId)).filter((row) => row["lastSeen"] <= cutoff).collect();
+    await Promise.all(stale.map((row) => context.db.delete(row["_id"])));
+    return { deleted: stale.length };
+  });
+  const internalSweep = { ...sweep, visibility: "internal" };
+  const disconnect = onDisconnect(async (context, event) => {
+    const roomId = event.context?.["roomId"];
+    const sessionId = event.context?.["sessionId"];
+    if (typeof roomId !== "string" || typeof sessionId !== "string") {
+      return;
+    }
+    const existing = await context.db.query(PRESENCE_TABLE).withIndex("byRoomSession", (q) => q.eq("roomId", roomId).eq("sessionId", sessionId)).first();
+    if (!existing) {
+      return;
+    }
+    const verifiedUserId = event.userId ?? void 0;
+    if ((existing["userId"] ?? void 0) !== verifiedUserId) {
+      return;
+    }
+    if (disconnectGraceMs === 0) {
+      await context.db.delete(existing["_id"]);
+      return;
+    }
+    const agedLastSeen = Math.min(existing["lastSeen"], Date.now() + disconnectGraceMs - ttlMs);
+    await context.db.patch(existing["_id"], { lastSeen: agedLastSeen });
+  });
+  return defineComponent(PRESENCE_KEY, {
+    extension: presenceExtension,
+    functions: { disconnect, heartbeat, listPresent, sweep: internalSweep }
+  });
+};
+
+export { DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension };

package/dist/packem_shared/asBucketStorage-Cnxd9y2q.mjs

@@ -0,0 +1,11 @@
+const asBucketStorage = (raw) => {
+  const candidate = raw ?? {};
+  if (typeof candidate.bucket === "function") {
+    return candidate;
+  }
+  const self = { ...candidate, bucketName: "default" };
+  self.bucket = () => self;
+  return self;
+};
+
+export { asBucketStorage as default };

package/dist/packem_shared/bindOrm-Ce57S3N9.mjs

@@ -0,0 +1,128 @@
+const isUniqueConflict = (error) => typeof error === "object" && error !== null && error.code === "CONFLICT" && error.kind === "unique";
+const buildUpsertWhere = (tableName, target, create) => {
+  const fields = typeof target === "string" ? [target] : target;
+  if (fields.length === 0) {
+    throw new Error(`ctx.db.${tableName}.upsert: "target" must name at least one field`);
+  }
+  const where = {};
+  for (const field of fields) {
+    if (!(field in create)) {
+      throw new Error(`ctx.db.${tableName}.upsert: target field "${field}" is missing from the create document`);
+    }
+    where[field] = create[field];
+  }
+  return where;
+};
+const bindTableFacade = (writer, tableName) => {
+  const insert = async (document, options) => {
+    if (options?.skipDuplicates !== true) {
+      return writer.insert(tableName, document);
+    }
+    try {
+      return await writer.insert(tableName, document);
+    } catch (error) {
+      if (isUniqueConflict(error)) {
+        return null;
+      }
+      throw error;
+    }
+  };
+  const upsert = async ({ create, target, update }) => {
+    const where = buildUpsertWhere(tableName, target, create);
+    const existing = await writer.findFirst(tableName, { where });
+    if (existing && typeof existing["_id"] === "string") {
+      await writer.patch(existing["_id"], update ?? create, tableName);
+      return { created: false, id: existing["_id"] };
+    }
+    const id = await writer.insert(tableName, create);
+    return { created: true, id };
+  };
+  return {
+    aggregate: (options) => writer.aggregate(tableName, options),
+    count: (where) => writer.count(tableName, where),
+    delete: (id) => writer.delete(id, tableName),
+    // `deleteMany`/`patchMany` forward the bound `tableName` as `expectedTable`
+    // (threaded through the writer + the RLS middleware's per-id gate) so every
+    // batched id is scoped to this table — the same IDOR guard the single-row
+    // `delete`/`patch` apply. `patchMany` maps the facade's `values` payload to
+    // the writer's `{ id, patch }` shape.
+    deleteMany: (ids, options) => {
+      if (writer.deleteMany === void 0) {
+        throw new Error(`ctx.db.${tableName}.deleteMany is unavailable: this writer has no batch delete`);
+      }
+      return writer.deleteMany(ids, options, tableName);
+    },
+    // `exists` reuses `findFirst` (RLS-filtered, indexed when a `.withIndex`-able
+    // `where` is supplied) and only asks whether a row came back — no count scan.
+    exists: async (where) => await writer.findFirst(tableName, where === void 0 ? void 0 : { where }) !== null,
+    findFirst: (args) => writer.findFirst(tableName, args),
+    findFirstOrThrow: (args) => writer.findFirstOrThrow(tableName, args),
+    findMany: (args) => writer.findMany(tableName, args),
+    get: (id) => writer.get(id, tableName),
+    groupBy: (options) => writer.groupBy(tableName, options),
+    // Physical removal — bypasses `.softDelete()`. RLS gates it as a delete.
+    hardDelete: (id) => writer.delete(id, tableName, { hard: true }),
+    insert,
+    insertMany: (documents, options) => {
+      if (writer.insertMany === void 0) {
+        throw new Error(`ctx.db.${tableName}.insertMany is unavailable: this writer has no batch insert`);
+      }
+      return writer.insertMany(tableName, documents, options);
+    },
+    patch: (id, patch) => writer.patch(id, patch, tableName),
+    patchMany: (patches, options) => {
+      if (writer.patchMany === void 0) {
+        throw new Error(`ctx.db.${tableName}.patchMany is unavailable: this writer has no batch patch`);
+      }
+      return writer.patchMany(
+        patches.map((entry) => {
+          return { id: entry.id, patch: entry.values };
+        }),
+        options,
+        tableName
+      );
+    },
+    rank: (indexName, options) => writer.rank(tableName, indexName, options),
+    rankPage: (indexName, options) => writer.rankPage(tableName, indexName, options),
+    replace: (id, document) => writer.replace(id, document, tableName),
+    restore: async (id) => {
+      if (!writer.restore) {
+        throw new Error(`ctx.db.${tableName}.restore is unavailable: this writer has no restore (is the table .softDelete()?)`);
+      }
+      await writer.restore(id, tableName);
+    },
+    upsert,
+    upsertMany: async ({ rows, target }) => {
+      const results = [];
+      for (const row of rows) {
+        results.push(await upsert({ create: row.create, target, update: row.update }));
+      }
+      return results;
+    },
+    withSearchIndex: (indexName, search) => writer.query(tableName).withSearchIndex(indexName, search)
+  };
+};
+const bindOrm = (facade) => {
+  const resolve = (table) => {
+    const bound = facade[table];
+    if (!bound) {
+      throw new Error(`unknown table: ${table}`);
+    }
+    return bound;
+  };
+  return {
+    delete: (table, id) => resolve(table).delete(id),
+    insert: (table) => {
+      return { values: (document) => resolve(table).insert(document) };
+    },
+    query: facade,
+    replace: (table, id) => {
+      return { with: (document) => resolve(table).replace(id, document) };
+    },
+    update: (table, id) => {
+      return { set: (values) => resolve(table).patch(id, values) };
+    }
+  };
+};
+
+export { bindOrm, bindTableFacade };

package/dist/packem_shared/buildRlsReadRegistry-1jexWrb3.mjs

@@ -0,0 +1,107 @@
+import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-2Jhd0uev.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
+
+const FALSE_PREDICATE = { OR: [] };
+const readEntryTags = (entry) => {
+  const hoisted = entry?.rls?.tags;
+  if (hoisted) {
+    return hoisted;
+  }
+  const tag = readRlsTag(entry);
+  return tag ? [tag] : [];
+};
+const addTagToRegistry = (byTable, tag) => {
+  const rolePermissions = indexRolePermissions(tag.roles);
+  const seenWhenByTable = /* @__PURE__ */ new Map();
+  const policiesByTable = /* @__PURE__ */ new Map();
+  for (const policy of tag.policies) {
+    if (policy.on !== "read") {
+      continue;
+    }
+    const seen = seenWhenByTable.get(policy.table) ?? /* @__PURE__ */ new Set();
+    if (seen.has(policy.when)) {
+      continue;
+    }
+    seen.add(policy.when);
+    seenWhenByTable.set(policy.table, seen);
+    const list = policiesByTable.get(policy.table) ?? [];
+    list.push(policy);
+    policiesByTable.set(policy.table, list);
+  }
+  for (const [table, policies] of policiesByTable) {
+    const groups = byTable.get(table) ?? [];
+    groups.push({ policies, rolePermissions });
+    byTable.set(table, groups);
+  }
+};
+const isFalsePredicate = (where) => {
+  const or = where.OR;
+  return Array.isArray(or) && or.length === 0 && Object.keys(where).length === 1;
+};
+const andMerge = (injected, caller) => {
+  if (!injected || Object.keys(injected).length === 0) {
+    return caller;
+  }
+  if (isFalsePredicate(injected)) {
+    return injected;
+  }
+  if (Object.keys(caller).length === 0) {
+    return injected;
+  }
+  return { AND: [injected, caller] };
+};
+const evaluateGroupBaseWhere = (group, request) => {
+  const granted = /* @__PURE__ */ new Set();
+  for (const roleName of request.roles) {
+    for (const name of group.rolePermissions.get(roleName) ?? []) {
+      granted.add(name);
+    }
+  }
+  return computeReadBaseWhere(group.policies, {
+    auth: {
+      can: (permission) => granted.has(permissionName(permission)),
+      identity: request.identity,
+      roles: request.roles,
+      userId: request.userId
+    },
+    ctx: request.ctx
+  });
+};
+const resolveReadBaseWhere = (registry, request) => {
+  const groups = registry.byTable.get(request.table);
+  if (!groups || groups.length === 0) {
+    return request.rlsRequired && !request.tablePublic ? FALSE_PREDICATE : void 0;
+  }
+  const predicates = [];
+  for (const group of groups) {
+    const base = evaluateGroupBaseWhere(group, request);
+    if (base === void 0) {
+      return void 0;
+    }
+    if (isFalsePredicate(base)) {
+      continue;
+    }
+    predicates.push(base);
+  }
+  if (predicates.length === 0) {
+    return FALSE_PREDICATE;
+  }
+  return predicates.length === 1 ? predicates[0] : { OR: predicates };
+};
+const buildRlsReadRegistry = (functions) => {
+  const byTable = /* @__PURE__ */ new Map();
+  const seenTags = /* @__PURE__ */ new Set();
+  for (const entry of functions) {
+    for (const tag of readEntryTags(entry)) {
+      if (seenTags.has(tag)) {
+        continue;
+      }
+      seenTags.add(tag);
+      addTagToRegistry(byTable, tag);
+    }
+  }
+  return { byTable };
+};
+const composeShapeReadWhere = (registry, request) => andMerge(resolveReadBaseWhere(registry, request), request.shapeWhere);
+
+export { buildRlsReadRegistry, composeShapeReadWhere };