@lunora/server 0.0.0 → 1.0.0-alpha.2

package/dist/packem_shared/rls-BDKRbMCA.mjs

@@ -0,0 +1,551 @@
+import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-DCuyr46L.mjs';
+
+const DEFAULT_BATCH_LIMIT = 500;
+const assertBatchLimit = (count, limit, op) => {
+  const cap = limit ?? DEFAULT_BATCH_LIMIT;
+  if (count > cap) {
+    throw new LunoraError("BAD_REQUEST", `${op}: batch of ${String(count)} exceeds the limit of ${String(cap)} (raise options.limit or chunk the call)`);
+  }
+};
+const FALSE_PREDICATE = { OR: [] };
+const RLS_UNWRAP_SYMBOL = /* @__PURE__ */ Symbol.for("lunora.ctxdb.rls-unwrap");
+const indexByTable = (policies) => {
+  const map = /* @__PURE__ */ new Map();
+  for (const policy of policies) {
+    const existing = map.get(policy.table) ?? [];
+    existing.push(policy);
+    map.set(policy.table, existing);
+  }
+  return map;
+};
+const computeReadBaseWhere = (policies, context) => {
+  const predicates = [];
+  let sawTrue = false;
+  for (const policy of policies) {
+    if (policy.on !== "read") {
+      continue;
+    }
+    const decision = policy.when(context);
+    if (decision === void 0) {
+      continue;
+    }
+    if (decision === true) {
+      sawTrue = true;
+      break;
+    }
+    if (decision === false) {
+      continue;
+    }
+    predicates.push(decision);
+  }
+  if (sawTrue) {
+    return void 0;
+  }
+  if (predicates.length === 0) {
+    return FALSE_PREDICATE;
+  }
+  return predicates.length === 1 ? predicates[0] : { OR: predicates };
+};
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const OPERATOR_KEYS = ["contains", "eq", "gt", "gte", "in", "isNull", "lt", "lte", "ne", "notIn"];
+const isOrderable = (value) => {
+  const type = typeof value;
+  return type === "number" || type === "string" || type === "bigint";
+};
+const matchesOrderedOperators = (documentValue, operators) => {
+  if ("lt" in operators && (!isOrderable(documentValue) || !isOrderable(operators["lt"]) || documentValue >= operators["lt"])) {
+    return false;
+  }
+  if ("lte" in operators && (!isOrderable(documentValue) || !isOrderable(operators["lte"]) || documentValue > operators["lte"])) {
+    return false;
+  }
+  if ("gt" in operators && (!isOrderable(documentValue) || !isOrderable(operators["gt"]) || documentValue <= operators["gt"])) {
+    return false;
+  }
+  if ("gte" in operators && (!isOrderable(documentValue) || !isOrderable(operators["gte"]) || documentValue < operators["gte"])) {
+    return false;
+  }
+  return true;
+};
+const matchesMembershipOperators = (documentValue, operators) => {
+  if ("in" in operators) {
+    const list = operators["in"];
+    if (!Array.isArray(list) || !list.includes(documentValue)) {
+      return false;
+    }
+  }
+  if ("notIn" in operators) {
+    const list = operators["notIn"];
+    if (Array.isArray(list) && list.includes(documentValue)) {
+      return false;
+    }
+  }
+  if ("contains" in operators) {
+    const needle = operators["contains"];
+    if (typeof documentValue !== "string" || typeof needle !== "string" || !documentValue.includes(needle)) {
+      return false;
+    }
+  }
+  if ("isNull" in operators) {
+    const expectsNull = operators["isNull"] === true;
+    if (expectsNull !== (documentValue === null || documentValue === void 0)) {
+      return false;
+    }
+  }
+  return true;
+};
+const matchesOperators = (documentValue, operators) => {
+  if ("eq" in operators && documentValue !== operators["eq"]) {
+    return false;
+  }
+  if ("ne" in operators && documentValue === operators["ne"]) {
+    return false;
+  }
+  return matchesMembershipOperators(documentValue, operators) && matchesOrderedOperators(documentValue, operators);
+};
+const matchesCombinator = (document, key, value, recurse) => {
+  if (key === "AND") {
+    return Array.isArray(value) && value.every((branch) => recurse(document, branch));
+  }
+  if (key === "OR") {
+    return Array.isArray(value) && value.some((branch) => recurse(document, branch));
+  }
+  return !recurse(document, value ?? {});
+};
+const isCombinatorKey = (key) => key === "AND" || key === "OR" || key === "NOT";
+const isOperatorBag = (value) => isPlainObject(value) && Object.keys(value).every((k) => OPERATOR_KEYS.includes(k));
+const RELATION_OPERATOR_KEYS = ["every", "is", "isNot", "none", "some"];
+const isRelationPredicateValue = (value) => isPlainObject(value) && Object.keys(value).length > 0 && Object.keys(value).every((k) => RELATION_OPERATOR_KEYS.includes(k));
+const containsRelationPredicate = (where) => Object.keys(where).some((key) => {
+  const value = where[key];
+  if (isCombinatorKey(key)) {
+    if (key === "NOT") {
+      return containsRelationPredicate(value ?? {});
+    }
+    return Array.isArray(value) && value.some((branch) => containsRelationPredicate(branch ?? {}));
+  }
+  return isRelationPredicateValue(value);
+});
+const matchesWhere = (document, where) => {
+  for (const key of Object.keys(where)) {
+    const value = where[key];
+    if (isCombinatorKey(key)) {
+      if (!matchesCombinator(document, key, value, matchesWhere)) {
+        return false;
+      }
+      continue;
+    }
+    const documentValue = document[key];
+    if (isOperatorBag(value)) {
+      if (!matchesOperators(documentValue, value)) {
+        return false;
+      }
+      continue;
+    }
+    if (documentValue !== value) {
+      return false;
+    }
+  }
+  return true;
+};
+const satisfiesPostImage = (policy, context, nextRow) => {
+  const postDecision = policy.when({ ...context, row: nextRow });
+  if (postDecision === void 0 || postDecision === true) {
+    return true;
+  }
+  if (postDecision === false) {
+    return false;
+  }
+  if (containsRelationPredicate(postDecision)) {
+    throw new LunoraError(
+      "RELATION_PREDICATE_UNSUPPORTED",
+      "relation predicates are not supported in write policies; use a read policy or a flat column check"
+    );
+  }
+  return matchesWhere(nextRow, postDecision);
+};
+const evaluateWritePolicy = (policy, context, nextRow) => {
+  const decision = policy.when(context);
+  if (decision === void 0 || decision === true) {
+    return nextRow === void 0 || satisfiesPostImage(policy, context, nextRow);
+  }
+  if (decision === false) {
+    return false;
+  }
+  if (containsRelationPredicate(decision)) {
+    throw new LunoraError(
+      "RELATION_PREDICATE_UNSUPPORTED",
+      "relation predicates are not supported in write policies; use a read policy or a flat column check"
+    );
+  }
+  if (!context.row || !matchesWhere(context.row, decision)) {
+    return false;
+  }
+  return nextRow === void 0 || matchesWhere(nextRow, decision);
+};
+const evaluateWrite = (policies, op, context, nextRow) => {
+  let sawWritePolicy = false;
+  for (const policy of policies) {
+    if (policy.on !== op) {
+      continue;
+    }
+    sawWritePolicy = true;
+    if (!evaluateWritePolicy(policy, context, nextRow)) {
+      return false;
+    }
+  }
+  return sawWritePolicy;
+};
+const intoQueryArgs = (args) => args ?? {};
+const COUNT_ARGS_KEYS = /* @__PURE__ */ new Set(["baseWhere", "relationBaseWhere", "restrictsCounts", "where"]);
+const isCountArgsValue = (key, value) => {
+  if (value === void 0) {
+    return true;
+  }
+  if (key === "restrictsCounts") {
+    return typeof value === "boolean";
+  }
+  if (key === "relationBaseWhere") {
+    return typeof value === "function";
+  }
+  return isPlainObject(value);
+};
+const looksLikeCountArgs = (argument) => {
+  const keys = Object.keys(argument);
+  if (keys.length === 0) {
+    return false;
+  }
+  return keys.every((key) => COUNT_ARGS_KEYS.has(key) && isCountArgsValue(key, argument[key]));
+};
+const intoCountArgs = (argument) => {
+  if (argument === void 0) {
+    return {};
+  }
+  if (isPlainObject(argument) && looksLikeCountArgs(argument)) {
+    return argument;
+  }
+  return { where: argument };
+};
+const mergeBaseWhere = (caller, injected) => {
+  if (!injected || Object.keys(injected).length === 0) {
+    return caller;
+  }
+  if (!caller || Object.keys(caller).length === 0) {
+    return injected;
+  }
+  return { AND: [injected, caller] };
+};
+const isFacadeEntry = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate["findMany"] === "function" && typeof candidate["withSearchIndex"] === "function";
+};
+const wrapDatabase = (base, raw, perTable, context) => {
+  const route = (tableName) => perTable.has(tableName) ? raw : base;
+  const readBaseCache = /* @__PURE__ */ new Map();
+  const readBase = (tableName) => {
+    const cached = readBaseCache.get(tableName);
+    if (cached) {
+      return cached;
+    }
+    const policies = perTable.get(tableName);
+    if (!policies || policies.length === 0 || !policies.some((policy) => policy.on === "read")) {
+      const result2 = { baseWhere: void 0, restricts: false };
+      readBaseCache.set(tableName, result2);
+      return result2;
+    }
+    const baseWhere = computeReadBaseWhere(policies, context);
+    const result = { baseWhere, restricts: true };
+    readBaseCache.set(tableName, result);
+    return result;
+  };
+  const relationReadFilter = (table) => readBase(table).baseWhere;
+  const locateRow = async (id, expectedTable) => {
+    if (raw.lookupById) {
+      const located = await raw.lookupById(id, expectedTable);
+      if (!located) {
+        return { row: null, tableName: void 0 };
+      }
+      return { row: located.row, tableName: perTable.has(located.tableName) ? located.tableName : void 0 };
+    }
+    const row = await raw.get(id, expectedTable);
+    if (!row) {
+      return { row: null, tableName: void 0 };
+    }
+    const pinnedProbe = expectedTable !== void 0 && perTable.has(expectedTable) ? [expectedTable] : [];
+    const probeTables = expectedTable === void 0 ? [...perTable.keys()] : pinnedProbe;
+    const probes = await Promise.all(
+      probeTables.map(async (tableName) => {
+        const probe = await raw.findFirst(tableName, { limit: 1, where: { _id: id } });
+        return probe?.["_id"] === id ? tableName : void 0;
+      })
+    );
+    return { row, tableName: probes.find((entry) => entry !== void 0) };
+  };
+  const findRowTable = async (id, expectedTable) => {
+    const located = await locateRow(id, expectedTable);
+    return located.row && located.tableName !== void 0 ? { row: located.row, tableName: located.tableName } : void 0;
+  };
+  const gateById = async (id, op, perform, computeNextRow, expectedTable) => {
+    const located = await findRowTable(id, expectedTable);
+    if (!located) {
+      return perform(base);
+    }
+    const policies = perTable.get(located.tableName);
+    if (policies) {
+      const nextRow = computeNextRow ? computeNextRow(located.row) : void 0;
+      const writeOk = evaluateWrite(policies, op, { ...context, row: located.row }, nextRow);
+      if (!writeOk) {
+        throw new LunoraError("FORBIDDEN", `${op} on "${located.tableName}" denied by policy`);
+      }
+    }
+    return perform(raw);
+  };
+  const requireUnrestrictedReadBase = (tableName, method) => {
+    const { baseWhere, restricts } = readBase(tableName);
+    if (restricts) {
+      throw new LunoraError("COUNT_RLS_UNSUPPORTED", `${method}() is not supported on "${tableName}" inside an RLS-restricted context`);
+    }
+    return baseWhere;
+  };
+  const baseRankBefore = base.rankBefore;
+  const wrapped = {
+    ...base,
+    async count(tableName, whereOrArgs) {
+      const { baseWhere, restricts } = readBase(tableName);
+      const args = intoCountArgs(whereOrArgs);
+      return route(tableName).count(tableName, {
+        ...args,
+        baseWhere: mergeBaseWhere(args.baseWhere, baseWhere),
+        relationBaseWhere: relationReadFilter,
+        restrictsCounts: (args.restrictsCounts ?? false) || restricts
+      });
+    },
+    delete: (id, expectedTable) => gateById(id, "delete", (writer) => writer.delete(id, expectedTable), void 0, expectedTable),
+    async deleteMany(ids, options, expectedTable) {
+      assertBatchLimit(ids.length, options?.limit, "deleteMany");
+      for (const id of ids) {
+        await gateById(id, "delete", (writer) => writer.delete(id, expectedTable), void 0, expectedTable);
+      }
+      return { deleted: ids.length };
+    },
+    async findFirst(tableName, args) {
+      const { baseWhere } = readBase(tableName);
+      return route(tableName).findFirst(tableName, {
+        ...intoQueryArgs(args),
+        baseWhere: mergeBaseWhere(args?.baseWhere, baseWhere),
+        relationBaseWhere: relationReadFilter
+      });
+    },
+    async findFirstOrThrow(tableName, args) {
+      const { baseWhere } = readBase(tableName);
+      return route(tableName).findFirstOrThrow(tableName, {
+        ...intoQueryArgs(args),
+        baseWhere: mergeBaseWhere(args?.baseWhere, baseWhere),
+        relationBaseWhere: relationReadFilter
+      });
+    },
+    async findMany(tableName, args) {
+      const { baseWhere } = readBase(tableName);
+      return route(tableName).findMany(tableName, {
+        ...intoQueryArgs(args),
+        baseWhere: mergeBaseWhere(args?.baseWhere, baseWhere),
+        relationBaseWhere: relationReadFilter
+      });
+    },
+    async get(id, expectedTable) {
+      const located = await locateRow(id, expectedTable);
+      if (!located.row) {
+        return null;
+      }
+      if (located.tableName === void 0) {
+        return base.get(id, expectedTable);
+      }
+      const { baseWhere, restricts } = readBase(located.tableName);
+      if (!restricts || !baseWhere) {
+        return located.row;
+      }
+      const allowed = await raw.findFirst(located.tableName, { baseWhere, limit: 1, where: { _id: id } });
+      return allowed?.["_id"] === id ? allowed : null;
+    },
+    async insert(tableName, document) {
+      const policies = perTable.get(tableName);
+      if (policies) {
+        const writeOk = evaluateWrite(policies, "insert", { ...context, row: document });
+        if (!writeOk) {
+          throw new LunoraError("FORBIDDEN", `insert on "${tableName}" denied by policy`);
+        }
+        return raw.insert(tableName, document);
+      }
+      return base.insert(tableName, document);
+    },
+    async insertMany(tableName, documents, options) {
+      assertBatchLimit(documents.length, options?.limit, "insertMany");
+      const policies = perTable.get(tableName);
+      if (policies) {
+        for (const document of documents) {
+          const writeOk = evaluateWrite(policies, "insert", { ...context, row: document });
+          if (!writeOk) {
+            throw new LunoraError("FORBIDDEN", `insert on "${tableName}" denied by policy`);
+          }
+        }
+        return raw.insertMany(tableName, documents, options);
+      }
+      return base.insertMany(tableName, documents, options);
+    },
+    async insertManyUnsafe(tableName, documents, options) {
+      assertBatchLimit(documents.length, options?.limit, "insertManyUnsafe");
+      const policies = perTable.get(tableName);
+      if (policies) {
+        for (const document of documents) {
+          const writeOk = evaluateWrite(policies, "insert", { ...context, row: document });
+          if (!writeOk) {
+            throw new LunoraError("FORBIDDEN", `insert on "${tableName}" denied by policy`);
+          }
+        }
+        return raw.insertManyUnsafe(tableName, documents, options);
+      }
+      return base.insertManyUnsafe(tableName, documents, options);
+    },
+    patch: (id, patch, expectedTable) => gateById(
+      id,
+      "update",
+      (writer) => writer.patch(id, patch, expectedTable),
+      (preRow) => {
+        return { ...preRow, ...patch };
+      },
+      expectedTable
+    ),
+    async patchMany(patches, options, expectedTable) {
+      assertBatchLimit(patches.length, options?.limit, "patchMany");
+      for (const entry of patches) {
+        await gateById(
+          entry.id,
+          "update",
+          (writer) => writer.patch(entry.id, entry.patch, expectedTable),
+          (preRow) => {
+            return { ...preRow, ...entry.patch };
+          },
+          expectedTable
+        );
+      }
+    },
+    query(tableName) {
+      const { baseWhere } = readBase(tableName);
+      const reader = route(tableName).query(tableName);
+      if (!baseWhere) {
+        return reader;
+      }
+      return reader.filter((document) => matchesWhere(document, baseWhere));
+    },
+    replace: (id, document, expectedTable) => gateById(
+      id,
+      "update",
+      (writer) => writer.replace(id, document, expectedTable),
+      // Mirror the writer's post-image: `_id` always comes from the
+      // existing row; `_creationTime` honors a caller-supplied value
+      // (the writer keeps `document._creationTime` when present) and
+      // otherwise falls back to the existing row's value.
+      (preRow) => {
+        return {
+          ...document,
+          _creationTime: document["_creationTime"] ?? preRow["_creationTime"],
+          _id: preRow["_id"]
+        };
+      },
+      expectedTable
+    ),
+    // Analytical reads — plain methods (the writer always implements them;
+    // see the required signatures on `DatabaseWriterLike`). `aggregate` /
+    // `groupBy` are scoped to `where`, so the read `baseWhere` is AND-merged
+    // and the reduction only sees policy-visible rows. `rank` / `rankPage`
+    // are counts-of-partition that can't be safely narrowed, so they fail
+    // closed under a read policy (see `requireUnrestrictedReadBase`).
+    aggregate(tableName, options) {
+      const { baseWhere } = readBase(tableName);
+      return route(tableName).aggregate(tableName, {
+        ...options,
+        baseWhere: mergeBaseWhere(options.baseWhere, baseWhere),
+        relationBaseWhere: relationReadFilter
+      });
+    },
+    groupBy(tableName, options) {
+      const { baseWhere } = readBase(tableName);
+      return route(tableName).groupBy(tableName, {
+        ...options,
+        baseWhere: mergeBaseWhere(options.baseWhere, baseWhere),
+        relationBaseWhere: relationReadFilter
+      });
+    },
+    rank(tableName, indexName, options) {
+      const baseWhere = requireUnrestrictedReadBase(tableName, "rank");
+      return route(tableName).rank(tableName, indexName, { ...options, baseWhere: mergeBaseWhere(options.baseWhere, baseWhere) });
+    },
+    rankPage(tableName, indexName, options) {
+      const baseWhere = requireUnrestrictedReadBase(tableName, "rankPage");
+      return route(tableName).rankPage(tableName, indexName, { ...options, baseWhere: mergeBaseWhere(options?.baseWhere, baseWhere) });
+    },
+    // `rankBefore` is the one optional method (the D1 twin omits it).
+    ...baseRankBefore ? {
+      rankBefore: (tableName, indexName, options) => {
+        requireUnrestrictedReadBase(tableName, "rankBefore");
+        const target = route(tableName);
+        return (target.rankBefore ?? baseRankBefore)(tableName, indexName, options);
+      }
+    } : {}
+  };
+  const writableFacade = wrapped;
+  for (const tableName of perTable.keys()) {
+    if (isFacadeEntry(base[tableName])) {
+      writableFacade[tableName] = bindTableFacade(wrapped, tableName);
+    }
+  }
+  return wrapped;
+};
+const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
+const indexRolePermissions = (roles) => {
+  const map = /* @__PURE__ */ new Map();
+  for (const role of roles ?? []) {
+    map.set(role.name, new Set((role.permissions ?? []).map((permission) => permissionName(permission))));
+  }
+  return map;
+};
+const rls = (policies, options = {}) => {
+  const perTable = indexByTable(policies);
+  const rolePermissions = indexRolePermissions(options.roles);
+  return async ({ ctx, next }) => {
+    const auth = ctx.auth ?? {};
+    const identity = await auth.getIdentity?.() ?? null;
+    const roles = auth.roles ?? [];
+    const granted = /* @__PURE__ */ new Set();
+    for (const roleName of roles) {
+      for (const name of rolePermissions.get(roleName) ?? []) {
+        granted.add(name);
+      }
+    }
+    const policyContext = {
+      auth: {
+        can: (permission) => granted.has(permissionName(permission)),
+        identity,
+        roles,
+        // eslint-disable-next-line unicorn/no-null -- PolicyContext.auth.userId is a public `null | string` type
+        userId: auth.userId ?? null
+      },
+      ctx
+    };
+    const guarded = ctx.db;
+    const raw = guarded[RLS_UNWRAP_SYMBOL] ?? guarded;
+    const wrapped = wrapDatabase(guarded, raw, perTable, policyContext);
+    const extension = { db: wrapped };
+    const { orm } = ctx;
+    if (orm !== null && typeof orm === "object") {
+      extension.orm = bindOrm(wrapped);
+    }
+    return next({ ctx: extension });
+  };
+};
+
+export { computeReadBaseWhere, evaluateWrite, indexRolePermissions, matchesWhere, permissionName, rls };

package/dist/packem_shared/run-middleware-CYQOuoV6.mjs

@@ -0,0 +1,18 @@
+const runMiddlewareChain = async (middlewares, baseContext, terminal) => {
+  let lastIndex = -1;
+  const dispatch = async (index, context) => {
+    if (index <= lastIndex) {
+      throw new Error("middleware next() called multiple times");
+    }
+    lastIndex = index;
+    const middleware = middlewares[index];
+    if (!middleware) {
+      return terminal(context);
+    }
+    const next = ((options) => dispatch(index + 1, options?.ctx ? { ...context, ...options.ctx } : context));
+    return await middleware({ ctx: context, next });
+  };
+  return dispatch(0, baseContext);
+};
+
+export { runMiddlewareChain as r };

package/dist/packem_shared/storageRules-4a30FSpI.mjs

@@ -0,0 +1,88 @@
+import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+
+const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
+const indexRolePermissions = (roles = []) => {
+  const byRole = /* @__PURE__ */ new Map();
+  for (const role of roles) {
+    const granted = /* @__PURE__ */ new Set();
+    for (const permission of role.permissions ?? []) {
+      granted.add(permissionName(permission));
+    }
+    byRole.set(role.name, granted);
+  }
+  return byRole;
+};
+const prefixMatches = (prefix, key) => prefix === void 0 || key.startsWith(prefix);
+const resolveSignedUrlOperation = (args) => {
+  const options = args[1];
+  const method = typeof options === "object" && options !== null ? options.method : void 0;
+  return typeof method === "string" && method.toUpperCase() === "PUT" ? "write" : "read";
+};
+const GUARDED_METHODS = [
+  ["delete", "delete"],
+  ["download", "read"],
+  ["generateUploadUrl", "write"],
+  ["getMetadata", "read"],
+  ["getSignedUrl", resolveSignedUrlOperation],
+  ["getUrl", "read"],
+  ["store", "write"]
+];
+const storageRules = (rules, options = {}) => {
+  const rolePermissions = indexRolePermissions(options.roles);
+  return async ({ ctx, next }) => {
+    const auth = ctx.auth ?? {};
+    const identity = await auth.getIdentity?.() ?? null;
+    const roles = auth.roles ?? [];
+    const granted = /* @__PURE__ */ new Set();
+    for (const roleName of roles) {
+      for (const name of rolePermissions.get(roleName) ?? []) {
+        granted.add(name);
+      }
+    }
+    const authContext = {
+      can: (permission) => granted.has(permissionName(permission)),
+      identity,
+      roles,
+      // eslint-disable-next-line unicorn/no-null -- StorageRuleContext.auth.userId is a public `null | string` type
+      userId: auth.userId ?? null
+    };
+    const assertAllowed = (op, key, bucketName) => {
+      const applicable = rules.filter((rule) => rule.on === op && rule.bucket === bucketName);
+      if (applicable.length === 0) {
+        return;
+      }
+      const context = { auth: authContext, ctx, key };
+      const allowed = applicable.some((rule) => prefixMatches(rule.prefix, key) && rule.when(context) === true);
+      if (!allowed) {
+        throw new LunoraError("FORBIDDEN", `storage ${op} on "${key}" in bucket "${bucketName}" denied by access rule`);
+      }
+    };
+    const wrapStorage = (storage2) => {
+      const bucketName = storage2.bucketName ?? "default";
+      const wrapped = { bucketName };
+      for (const [method, op] of GUARDED_METHODS) {
+        const original = storage2[method];
+        if (typeof original === "function") {
+          wrapped[method] = (...args) => {
+            const key = typeof args[0] === "string" ? args[0] : "";
+            const operation = typeof op === "function" ? op(args) : op;
+            assertAllowed(operation, key, bucketName);
+            return original(...args);
+          };
+        }
+      }
+      const { bucket } = storage2;
+      if (typeof bucket === "function") {
+        wrapped.bucket = (name) => wrapStorage(bucket(name));
+      }
+      return wrapped;
+    };
+    const storage = ctx.storage;
+    if (storage === void 0) {
+      return next();
+    }
+    return next({ ctx: { storage: wrapStorage(storage) } });
+  };
+};
+
+export { storageRules };