@lunora/server 1.0.0-alpha.1 → 1.0.0-alpha.10

package/dist/packem_shared/buildRlsReadRegistry-1jexWrb3.mjs

@@ -0,0 +1,107 @@
+import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-2Jhd0uev.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
+
+const FALSE_PREDICATE = { OR: [] };
+const readEntryTags = (entry) => {
+  const hoisted = entry?.rls?.tags;
+  if (hoisted) {
+    return hoisted;
+  }
+  const tag = readRlsTag(entry);
+  return tag ? [tag] : [];
+};
+const addTagToRegistry = (byTable, tag) => {
+  const rolePermissions = indexRolePermissions(tag.roles);
+  const seenWhenByTable = /* @__PURE__ */ new Map();
+  const policiesByTable = /* @__PURE__ */ new Map();
+  for (const policy of tag.policies) {
+    if (policy.on !== "read") {
+      continue;
+    }
+    const seen = seenWhenByTable.get(policy.table) ?? /* @__PURE__ */ new Set();
+    if (seen.has(policy.when)) {
+      continue;
+    }
+    seen.add(policy.when);
+    seenWhenByTable.set(policy.table, seen);
+    const list = policiesByTable.get(policy.table) ?? [];
+    list.push(policy);
+    policiesByTable.set(policy.table, list);
+  }
+  for (const [table, policies] of policiesByTable) {
+    const groups = byTable.get(table) ?? [];
+    groups.push({ policies, rolePermissions });
+    byTable.set(table, groups);
+  }
+};
+const isFalsePredicate = (where) => {
+  const or = where.OR;
+  return Array.isArray(or) && or.length === 0 && Object.keys(where).length === 1;
+};
+const andMerge = (injected, caller) => {
+  if (!injected || Object.keys(injected).length === 0) {
+    return caller;
+  }
+  if (isFalsePredicate(injected)) {
+    return injected;
+  }
+  if (Object.keys(caller).length === 0) {
+    return injected;
+  }
+  return { AND: [injected, caller] };
+};
+const evaluateGroupBaseWhere = (group, request) => {
+  const granted = /* @__PURE__ */ new Set();
+  for (const roleName of request.roles) {
+    for (const name of group.rolePermissions.get(roleName) ?? []) {
+      granted.add(name);
+    }
+  }
+  return computeReadBaseWhere(group.policies, {
+    auth: {
+      can: (permission) => granted.has(permissionName(permission)),
+      identity: request.identity,
+      roles: request.roles,
+      userId: request.userId
+    },
+    ctx: request.ctx
+  });
+};
+const resolveReadBaseWhere = (registry, request) => {
+  const groups = registry.byTable.get(request.table);
+  if (!groups || groups.length === 0) {
+    return request.rlsRequired && !request.tablePublic ? FALSE_PREDICATE : void 0;
+  }
+  const predicates = [];
+  for (const group of groups) {
+    const base = evaluateGroupBaseWhere(group, request);
+    if (base === void 0) {
+      return void 0;
+    }
+    if (isFalsePredicate(base)) {
+      continue;
+    }
+    predicates.push(base);
+  }
+  if (predicates.length === 0) {
+    return FALSE_PREDICATE;
+  }
+  return predicates.length === 1 ? predicates[0] : { OR: predicates };
+};
+const buildRlsReadRegistry = (functions) => {
+  const byTable = /* @__PURE__ */ new Map();
+  const seenTags = /* @__PURE__ */ new Set();
+  for (const entry of functions) {
+    for (const tag of readEntryTags(entry)) {
+      if (seenTags.has(tag)) {
+        continue;
+      }
+      seenTags.add(tag);
+      addTagToRegistry(byTable, tag);
+    }
+  }
+  return { byTable };
+};
+const composeShapeReadWhere = (registry, request) => andMerge(resolveReadBaseWhere(registry, request), request.shapeWhere);
+
+export { buildRlsReadRegistry, composeShapeReadWhere };

package/dist/packem_shared/createSecrets-TsIP9lOa.mjs

@@ -0,0 +1,55 @@
+const NON_SECRET_BINDING_METHODS = [
+  "put",
+  // KV / R2
+  "list",
+  // KV / R2
+  "delete",
+  // KV / R2
+  "getWithMetadata",
+  // KV
+  "head",
+  // R2
+  "createMultipartUpload",
+  // R2
+  "idFromName",
+  // Durable Object namespace
+  "newUniqueId",
+  // Durable Object namespace
+  "getByName",
+  // Durable Object namespace
+  "send",
+  // Queue producer
+  "sendBatch",
+  // Queue producer
+  "writeDataPoint",
+  // Analytics Engine dataset
+  "create",
+  // Workflows binding (get(id) + create/createBatch)
+  "createBatch"
+  // Workflows binding
+];
+const isSecretBinding = (value) => {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value;
+  if (typeof record.get !== "function") {
+    return false;
+  }
+  return !NON_SECRET_BINDING_METHODS.some((method) => typeof record[method] === "function");
+};
+const createSecrets = (env) => {
+  return {
+    get: async (name) => {
+      const binding = env[name];
+      if (!isSecretBinding(binding)) {
+        throw new Error(
+          `ctx.secrets: no Secrets Store binding named "${name}". Add a \`secrets_store_secrets[]\` entry (binding "${name}", pointing at your store + secret) to wrangler.jsonc — \`ctx.secrets\` reads a Secrets Store binding, not a plain \`.dev.vars\` value.`
+        );
+      }
+      return binding.get();
+    }
+  };
+};
+
+export { createSecrets };

package/dist/packem_shared/{defineAggregateIndex-DzqxtAyV.mjs → defineAggregateIndex-ZdyU78gh.mjs}

@@ -1,5 +1,5 @@
-import { isOrWrapsFromValidator } from '@lunora/values';
-import { mergeSchemaExtension } from './defineSchemaExtension-Ck5_TUO8.mjs';
+import { isOrWrapsFromValidator, v } from '@lunora/values';
+import { mergeSchemaExtension } from './composePluginMiddleware-Ck5_TUO8.mjs';
 
 const relationBuilder = {
   many: (table, options) => {
@@ -22,7 +22,8 @@ const createTriggerBuilder = () => {
     beforeUpdate: (handler) => makeTrigger("before", "update", handler)
   };
 };
-const defineTable = (shape) => {
+const defineTable = (inputShape) => {
+  const shape = { ...inputShape };
   for (const [columnName, validator] of Object.entries(shape)) {
     if (isOrWrapsFromValidator(validator)) {
       throw new Error(`defineTable: column "${columnName}" uses v.from() which is args-only — table columns need a concrete v.* type`);
@@ -39,6 +40,8 @@ const defineTable = (shape) => {
   let shardMode = { kind: "root" };
   let isExternallyManaged = false;
   let isPublic = false;
+  let softDelete;
+  let externalSource;
   const builder = {
     aggregateIndex(name, options) {
       const op = options?.op ?? "count";
@@ -61,6 +64,9 @@ const defineTable = (shape) => {
     get aggregateIndexes() {
       return aggregateIndexes;
     },
+    get externalSource() {
+      return externalSource;
+    },
     externallyManaged() {
       isExternallyManaged = true;
       return builder;
@@ -132,6 +138,28 @@ const defineTable = (shape) => {
     get shardMode() {
       return shardMode;
     },
+    get softDeleteMode() {
+      return softDelete;
+    },
+    source(definition) {
+      if (!definition.binding) {
+        throw new Error("source: `binding` is required (the wrangler Hyperdrive binding name)");
+      }
+      if (!definition.query) {
+        throw new Error("source: `query` is required (the tenant-membership SQL)");
+      }
+      externalSource = definition;
+      isExternallyManaged = true;
+      return builder;
+    },
+    softDelete(options) {
+      const field = options?.field ?? "deletedAt";
+      softDelete = { field };
+      if (!(field in shape)) {
+        shape[field] = v.optional(v.number().nullable());
+      }
+      return builder;
+    },
     get triggerMap() {
       return triggers;
     },
@@ -192,6 +220,9 @@ const withExtend = (schema) => {
     extend(extension) {
       return withExtend(mergeSchemaExtension(schema, extension));
     },
+    jurisdiction(_jurisdiction) {
+      return withExtend(schema);
+    },
     rls(mode) {
       return withExtend({ ...schema, rlsMode: mode });
     }
@@ -227,9 +258,33 @@ const attachStandaloneIndexes = (tables, aggregateIndexes, rankIndexes) => {
     table.rankIndexes.push(index);
   }
 };
+const validateExternalSources = (tables) => {
+  for (const [name, table] of Object.entries(tables)) {
+    const source = table.externalSource;
+    if (!source) {
+      continue;
+    }
+    if (table.shardMode.kind === "global") {
+      throw new Error(
+        `defineSchema: table "${name}" cannot be both .source() and .global() — a sourced table materializes into a shard DO's SQLite, a global table lives in the external tier`
+      );
+    }
+    if (table.shardMode.kind === "shardBy" && !source.tenantBy) {
+      throw new Error(
+        `defineSchema: sourced + .shardBy() table "${name}" needs a \`tenantBy\` mapper — without it every tenant's DO would run the same unscoped query and replicate the whole multitenant table (a cross-tenant leak). Add \`tenantBy: (shardKey) => [shardKey]\` binding the shard key into the query's parameters.`
+      );
+    }
+    if (source.mode === "incremental") {
+      throw new Error(
+        `defineSchema: table "${name}" uses \`mode: "incremental"\`, which is not yet implemented — only "full-pull" (the default) is supported. Remove \`mode\` or set it to "full-pull".`
+      );
+    }
+  }
+};
 const defineSchema = (tables, vectorIndexes = {}, aggregateIndexes = {}, rankIndexes = {}) => {
   fillIndexTableNames(tables);
   attachStandaloneIndexes(tables, aggregateIndexes, rankIndexes);
+  validateExternalSources(tables);
   return withExtend({ tables, vectorIndexes });
 };
 

package/dist/packem_shared/defineMutator-EIXAWhs9.mjs

@@ -0,0 +1,11 @@
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+
+const defineMutator = (definition) => {
+  const handler = async (context, rawArgs) => {
+    const parsed = validateArgs(definition.args ?? {}, rawArgs);
+    return definition.server(context, parsed);
+  };
+  return { __lunoraMutator: true, ...definition, handler, kind: "mutation" };
+};
+
+export { defineMutator };

package/dist/packem_shared/defineShape-CJ27Wx7o.mjs

@@ -0,0 +1,17 @@
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+
+const defineShape = (definition) => {
+  if (definition.table.trim() === "") {
+    throw new Error("defineShape: `table` must be a non-empty string");
+  }
+  if (definition.columns?.length === 0) {
+    throw new Error("defineShape: `columns` must list at least one column when provided");
+  }
+  const compileWhere = (context, rawArgs) => {
+    const parsed = validateArgs(definition.args ?? {}, rawArgs);
+    return definition.where(context, parsed);
+  };
+  return { __lunoraShape: true, ...definition, compileWhere };
+};
+
+export { defineShape };

package/dist/packem_shared/functions-Di9FUNkf.mjs

@@ -0,0 +1,5 @@
+import { parseValidatorMap } from '@lunora/values';
+
+const validateArgs = (validators, args) => parseValidatorMap(validators, args, "args");
+
+export { validateArgs as v };

package/dist/packem_shared/{httpAction-B7FYUEgr.mjs → httpAction-FLwfsePg.mjs}

@@ -1,6 +1,6 @@
 import { parseValidatorMap, ValidationError } from '@lunora/values';
 import { Hono } from 'hono';
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
 
 const httpAction = (handler) => async (c) => handler(c.get("lunora"), c.req.raw);
 const httpRouter = () => {

package/dist/packem_shared/{initLunora-CATvPsVt.mjs → initLunora-lxwHTEV3.mjs}

@@ -1,8 +1,7 @@
-import { parseValidatorMap } from '@lunora/values';
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
 import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
 
-const validateArgs = (validators, args) => parseValidatorMap(validators, args, "args");
-
 const runMiddleware = (middlewares, baseContext) => runMiddlewareChain(middlewares, baseContext, (context) => context);
 const makeHandler = (args, middlewares, userHandler, output) => async (context, rawArgs) => {
   const parsed = validateArgs(args, rawArgs);
@@ -35,16 +34,29 @@ const makeStreamHandler = (args, middlewares, userHandler) => (context, rawArgs,
     }
   })();
 };
+const collectRls = (middlewares) => {
+  const tags = [];
+  for (const middleware of middlewares) {
+    const tag = readRlsTag(middleware);
+    if (!tag) {
+      continue;
+    }
+    tags.push(tag);
+  }
+  return tags.length > 0 ? { tags } : void 0;
+};
 const makeBuilder = (kind, state, visibility) => {
   return {
     __lunoraProcedure: kind,
     ...visibility ? { __lunoraVisibility: visibility } : {},
     input: (validators) => makeBuilder(kind, { ...state, args: { ...state.args, ...validators } }, visibility),
     [kind]: (userHandler) => {
+      const rls = collectRls(state.middlewares);
       return {
         args: state.args,
         handler: makeHandler(state.args, state.middlewares, userHandler, state.output),
         kind,
+        ...rls ? { rls } : {},
         ...visibility ? { visibility } : {}
       };
     },
@@ -55,10 +67,12 @@ const makeBuilder = (kind, state, visibility) => {
     // unconditionally keeps the runtime free of per-kind branching.
     ...kind === "query" ? {
       stream: (userHandler) => {
+        const rls = collectRls(state.middlewares);
         return {
           args: state.args,
           handler: makeStreamHandler(state.args, state.middlewares, userHandler),
           kind: "stream",
+          ...rls ? { rls } : {},
           ...visibility ? { visibility } : {}
         };
       }

package/dist/packem_shared/{mask-CkZJHHMM.mjs → mask-BV_jNzsN.mjs}

@@ -1,5 +1,5 @@
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
-import { bindTableFacade, bindOrm } from './bindTableFacade-DCuyr46L.mjs';
+import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-Ce57S3N9.mjs';
 
 const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
 const indexRolePermissions = (roles) => {

package/dist/packem_shared/policy-tag-DvpVH2tv.mjs

@@ -0,0 +1,13 @@
+const RLS_TAG = /* @__PURE__ */ Symbol.for("lunora.rls.middleware-policies");
+const tagRlsMiddleware = (middleware, tag) => {
+  Object.defineProperty(middleware, RLS_TAG, { configurable: true, enumerable: false, value: tag });
+  return middleware;
+};
+const readRlsTag = (middleware) => {
+  if (middleware === null || typeof middleware !== "function" && typeof middleware !== "object") {
+    return void 0;
+  }
+  return middleware[RLS_TAG];
+};
+
+export { readRlsTag as r, tagRlsMiddleware as t };

package/dist/packem_shared/{rls-Zhf5wEeJ.mjs → rls-2Jhd0uev.mjs}

@@ -1,5 +1,6 @@
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
-import { bindTableFacade, bindOrm } from './bindTableFacade-DCuyr46L.mjs';
+import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-Ce57S3N9.mjs';
+import { t as tagRlsMiddleware } from './policy-tag-DvpVH2tv.mjs';
 
 const DEFAULT_BATCH_LIMIT = 500;
 const assertBatchLimit = (count, limit, op) => {
@@ -324,7 +325,7 @@ const wrapDatabase = (base, raw, perTable, context) => {
         restrictsCounts: (args.restrictsCounts ?? false) || restricts
       });
     },
-    delete: (id, expectedTable) => gateById(id, "delete", (writer) => writer.delete(id, expectedTable), void 0, expectedTable),
+    delete: (id, expectedTable, options) => gateById(id, "delete", (writer) => writer.delete(id, expectedTable, options), void 0, expectedTable),
     async deleteMany(ids, options, expectedTable) {
       assertBatchLimit(ids.length, options?.limit, "deleteMany");
       for (const id of ids) {
@@ -441,6 +442,22 @@ const wrapDatabase = (base, raw, perTable, context) => {
       }
       return reader.filter((document) => matchesWhere(document, baseWhere));
     },
+    // Restore clears the soft-delete marker — a by-id un-delete, gated as an
+    // "update" (the policy that governs patch). No post-image check: the
+    // writer owns the marker field, so we only enforce the pre-image USING.
+    restore: (id, expectedTable) => gateById(
+      id,
+      "update",
+      async (writer) => {
+        const perform = writer.restore ?? raw.restore;
+        if (!perform) {
+          throw new LunoraError("BAD_REQUEST", "restore is not supported by this writer");
+        }
+        await perform(id, expectedTable);
+      },
+      void 0,
+      expectedTable
+    ),
     replace: (id, document, expectedTable) => gateById(
       id,
       "update",
@@ -516,7 +533,7 @@ const indexRolePermissions = (roles) => {
 const rls = (policies, options = {}) => {
   const perTable = indexByTable(policies);
   const rolePermissions = indexRolePermissions(options.roles);
-  return async ({ ctx, next }) => {
+  const middleware = async ({ ctx, next }) => {
     const auth = ctx.auth ?? {};
     const identity = await auth.getIdentity?.() ?? null;
     const roles = auth.roles ?? [];
@@ -546,6 +563,7 @@ const rls = (policies, options = {}) => {
     }
     return next({ ctx: extension });
   };
+  return tagRlsMiddleware(middleware, { policies, roles: options.roles ?? [] });
 };
 
 export { computeReadBaseWhere, evaluateWrite, indexRolePermissions, matchesWhere, permissionName, rls };

package/dist/packem_shared/{storageRules-4a30FSpI.mjs → storageRules-Cje6Woea.mjs}

@@ -1,4 +1,4 @@
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
 
 const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
 const indexRolePermissions = (roles = []) => {

package/dist/rls/testing.mjs

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-Zhf5wEeJ.mjs';
+import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-2Jhd0uev.mjs';
 
 const expectPolicy = (policies, options = {}) => {
   const rolePermissions = indexRolePermissions(options.roles);