@lunora/server 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/packem_shared/{bindTableFacade-DCuyr46L.mjs → bindOrm-Ce57S3N9.mjs}

@@ -1,4 +1,42 @@
+const isUniqueConflict = (error) => typeof error === "object" && error !== null && error.code === "CONFLICT" && error.kind === "unique";
+const buildUpsertWhere = (tableName, target, create) => {
+  const fields = typeof target === "string" ? [target] : target;
+  if (fields.length === 0) {
+    throw new Error(`ctx.db.${tableName}.upsert: "target" must name at least one field`);
+  }
+  const where = {};
+  for (const field of fields) {
+    if (!(field in create)) {
+      throw new Error(`ctx.db.${tableName}.upsert: target field "${field}" is missing from the create document`);
+    }
+    where[field] = create[field];
+  }
+  return where;
+};
 const bindTableFacade = (writer, tableName) => {
+  const insert = async (document, options) => {
+    if (options?.skipDuplicates !== true) {
+      return writer.insert(tableName, document);
+    }
+    try {
+      return await writer.insert(tableName, document);
+    } catch (error) {
+      if (isUniqueConflict(error)) {
+        return null;
+      }
+      throw error;
+    }
+  };
+  const upsert = async ({ create, target, update }) => {
+    const where = buildUpsertWhere(tableName, target, create);
+    const existing = await writer.findFirst(tableName, { where });
+    if (existing && typeof existing["_id"] === "string") {
+      await writer.patch(existing["_id"], update ?? create, tableName);
+      return { created: false, id: existing["_id"] };
+    }
+    const id = await writer.insert(tableName, create);
+    return { created: true, id };
+  };
   return {
     aggregate: (options) => writer.aggregate(tableName, options),
     count: (where) => writer.count(tableName, where),
@@ -14,12 +52,17 @@ const bindTableFacade = (writer, tableName) => {
       }
       return writer.deleteMany(ids, options, tableName);
     },
+    // `exists` reuses `findFirst` (RLS-filtered, indexed when a `.withIndex`-able
+    // `where` is supplied) and only asks whether a row came back — no count scan.
+    exists: async (where) => await writer.findFirst(tableName, where === void 0 ? void 0 : { where }) !== null,
     findFirst: (args) => writer.findFirst(tableName, args),
     findFirstOrThrow: (args) => writer.findFirstOrThrow(tableName, args),
     findMany: (args) => writer.findMany(tableName, args),
     get: (id) => writer.get(id, tableName),
     groupBy: (options) => writer.groupBy(tableName, options),
-    insert: (document) => writer.insert(tableName, document),
+    // Physical removal — bypasses `.softDelete()`. RLS gates it as a delete.
+    hardDelete: (id) => writer.delete(id, tableName, { hard: true }),
+    insert,
     insertMany: (documents, options) => {
       if (writer.insertMany === void 0) {
         throw new Error(`ctx.db.${tableName}.insertMany is unavailable: this writer has no batch insert`);
@@ -42,6 +85,20 @@ const bindTableFacade = (writer, tableName) => {
     rank: (indexName, options) => writer.rank(tableName, indexName, options),
     rankPage: (indexName, options) => writer.rankPage(tableName, indexName, options),
     replace: (id, document) => writer.replace(id, document, tableName),
+    restore: async (id) => {
+      if (!writer.restore) {
+        throw new Error(`ctx.db.${tableName}.restore is unavailable: this writer has no restore (is the table .softDelete()?)`);
+      }
+      await writer.restore(id, tableName);
+    },
+    upsert,
+    upsertMany: async ({ rows, target }) => {
+      const results = [];
+      for (const row of rows) {
+        results.push(await upsert({ create: row.create, target, update: row.update }));
+      }
+      return results;
+    },
     withSearchIndex: (indexName, search) => writer.query(tableName).withSearchIndex(indexName, search)
   };
 };

package/dist/packem_shared/buildRlsReadRegistry-1jexWrb3.mjs

@@ -0,0 +1,107 @@
+import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-2Jhd0uev.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
+
+const FALSE_PREDICATE = { OR: [] };
+const readEntryTags = (entry) => {
+  const hoisted = entry?.rls?.tags;
+  if (hoisted) {
+    return hoisted;
+  }
+  const tag = readRlsTag(entry);
+  return tag ? [tag] : [];
+};
+const addTagToRegistry = (byTable, tag) => {
+  const rolePermissions = indexRolePermissions(tag.roles);
+  const seenWhenByTable = /* @__PURE__ */ new Map();
+  const policiesByTable = /* @__PURE__ */ new Map();
+  for (const policy of tag.policies) {
+    if (policy.on !== "read") {
+      continue;
+    }
+    const seen = seenWhenByTable.get(policy.table) ?? /* @__PURE__ */ new Set();
+    if (seen.has(policy.when)) {
+      continue;
+    }
+    seen.add(policy.when);
+    seenWhenByTable.set(policy.table, seen);
+    const list = policiesByTable.get(policy.table) ?? [];
+    list.push(policy);
+    policiesByTable.set(policy.table, list);
+  }
+  for (const [table, policies] of policiesByTable) {
+    const groups = byTable.get(table) ?? [];
+    groups.push({ policies, rolePermissions });
+    byTable.set(table, groups);
+  }
+};
+const isFalsePredicate = (where) => {
+  const or = where.OR;
+  return Array.isArray(or) && or.length === 0 && Object.keys(where).length === 1;
+};
+const andMerge = (injected, caller) => {
+  if (!injected || Object.keys(injected).length === 0) {
+    return caller;
+  }
+  if (isFalsePredicate(injected)) {
+    return injected;
+  }
+  if (Object.keys(caller).length === 0) {
+    return injected;
+  }
+  return { AND: [injected, caller] };
+};
+const evaluateGroupBaseWhere = (group, request) => {
+  const granted = /* @__PURE__ */ new Set();
+  for (const roleName of request.roles) {
+    for (const name of group.rolePermissions.get(roleName) ?? []) {
+      granted.add(name);
+    }
+  }
+  return computeReadBaseWhere(group.policies, {
+    auth: {
+      can: (permission) => granted.has(permissionName(permission)),
+      identity: request.identity,
+      roles: request.roles,
+      userId: request.userId
+    },
+    ctx: request.ctx
+  });
+};
+const resolveReadBaseWhere = (registry, request) => {
+  const groups = registry.byTable.get(request.table);
+  if (!groups || groups.length === 0) {
+    return request.rlsRequired && !request.tablePublic ? FALSE_PREDICATE : void 0;
+  }
+  const predicates = [];
+  for (const group of groups) {
+    const base = evaluateGroupBaseWhere(group, request);
+    if (base === void 0) {
+      return void 0;
+    }
+    if (isFalsePredicate(base)) {
+      continue;
+    }
+    predicates.push(base);
+  }
+  if (predicates.length === 0) {
+    return FALSE_PREDICATE;
+  }
+  return predicates.length === 1 ? predicates[0] : { OR: predicates };
+};
+const buildRlsReadRegistry = (functions) => {
+  const byTable = /* @__PURE__ */ new Map();
+  const seenTags = /* @__PURE__ */ new Set();
+  for (const entry of functions) {
+    for (const tag of readEntryTags(entry)) {
+      if (seenTags.has(tag)) {
+        continue;
+      }
+      seenTags.add(tag);
+      addTagToRegistry(byTable, tag);
+    }
+  }
+  return { byTable };
+};
+const composeShapeReadWhere = (registry, request) => andMerge(resolveReadBaseWhere(registry, request), request.shapeWhere);
+
+export { buildRlsReadRegistry, composeShapeReadWhere };

package/dist/packem_shared/createSecrets-TsIP9lOa.mjs

@@ -0,0 +1,55 @@
+const NON_SECRET_BINDING_METHODS = [
+  "put",
+  // KV / R2
+  "list",
+  // KV / R2
+  "delete",
+  // KV / R2
+  "getWithMetadata",
+  // KV
+  "head",
+  // R2
+  "createMultipartUpload",
+  // R2
+  "idFromName",
+  // Durable Object namespace
+  "newUniqueId",
+  // Durable Object namespace
+  "getByName",
+  // Durable Object namespace
+  "send",
+  // Queue producer
+  "sendBatch",
+  // Queue producer
+  "writeDataPoint",
+  // Analytics Engine dataset
+  "create",
+  // Workflows binding (get(id) + create/createBatch)
+  "createBatch"
+  // Workflows binding
+];
+const isSecretBinding = (value) => {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value;
+  if (typeof record.get !== "function") {
+    return false;
+  }
+  return !NON_SECRET_BINDING_METHODS.some((method) => typeof record[method] === "function");
+};
+const createSecrets = (env) => {
+  return {
+    get: async (name) => {
+      const binding = env[name];
+      if (!isSecretBinding(binding)) {
+        throw new Error(
+          `ctx.secrets: no Secrets Store binding named "${name}". Add a \`secrets_store_secrets[]\` entry (binding "${name}", pointing at your store + secret) to wrangler.jsonc — \`ctx.secrets\` reads a Secrets Store binding, not a plain \`.dev.vars\` value.`
+        );
+      }
+      return binding.get();
+    }
+  };
+};
+
+export { createSecrets };

package/dist/packem_shared/{defineAggregateIndex-DzqxtAyV.mjs → defineAggregateIndex-ZdyU78gh.mjs}

@@ -1,5 +1,5 @@
-import { isOrWrapsFromValidator } from '@lunora/values';
-import { mergeSchemaExtension } from './defineSchemaExtension-Ck5_TUO8.mjs';
+import { isOrWrapsFromValidator, v } from '@lunora/values';
+import { mergeSchemaExtension } from './composePluginMiddleware-Ck5_TUO8.mjs';
 
 const relationBuilder = {
   many: (table, options) => {
@@ -22,7 +22,8 @@ const createTriggerBuilder = () => {
     beforeUpdate: (handler) => makeTrigger("before", "update", handler)
   };
 };
-const defineTable = (shape) => {
+const defineTable = (inputShape) => {
+  const shape = { ...inputShape };
   for (const [columnName, validator] of Object.entries(shape)) {
     if (isOrWrapsFromValidator(validator)) {
       throw new Error(`defineTable: column "${columnName}" uses v.from() which is args-only — table columns need a concrete v.* type`);
@@ -39,6 +40,8 @@ const defineTable = (shape) => {
   let shardMode = { kind: "root" };
   let isExternallyManaged = false;
   let isPublic = false;
+  let softDelete;
+  let externalSource;
   const builder = {
     aggregateIndex(name, options) {
       const op = options?.op ?? "count";
@@ -61,6 +64,9 @@ const defineTable = (shape) => {
     get aggregateIndexes() {
       return aggregateIndexes;
     },
+    get externalSource() {
+      return externalSource;
+    },
     externallyManaged() {
       isExternallyManaged = true;
       return builder;
@@ -132,6 +138,28 @@ const defineTable = (shape) => {
     get shardMode() {
       return shardMode;
     },
+    get softDeleteMode() {
+      return softDelete;
+    },
+    source(definition) {
+      if (!definition.binding) {
+        throw new Error("source: `binding` is required (the wrangler Hyperdrive binding name)");
+      }
+      if (!definition.query) {
+        throw new Error("source: `query` is required (the tenant-membership SQL)");
+      }
+      externalSource = definition;
+      isExternallyManaged = true;
+      return builder;
+    },
+    softDelete(options) {
+      const field = options?.field ?? "deletedAt";
+      softDelete = { field };
+      if (!(field in shape)) {
+        shape[field] = v.optional(v.number().nullable());
+      }
+      return builder;
+    },
     get triggerMap() {
       return triggers;
     },
@@ -192,6 +220,9 @@ const withExtend = (schema) => {
     extend(extension) {
       return withExtend(mergeSchemaExtension(schema, extension));
     },
+    jurisdiction(_jurisdiction) {
+      return withExtend(schema);
+    },
     rls(mode) {
       return withExtend({ ...schema, rlsMode: mode });
     }
@@ -227,9 +258,33 @@ const attachStandaloneIndexes = (tables, aggregateIndexes, rankIndexes) => {
     table.rankIndexes.push(index);
   }
 };
+const validateExternalSources = (tables) => {
+  for (const [name, table] of Object.entries(tables)) {
+    const source = table.externalSource;
+    if (!source) {
+      continue;
+    }
+    if (table.shardMode.kind === "global") {
+      throw new Error(
+        `defineSchema: table "${name}" cannot be both .source() and .global() — a sourced table materializes into a shard DO's SQLite, a global table lives in the external tier`
+      );
+    }
+    if (table.shardMode.kind === "shardBy" && !source.tenantBy) {
+      throw new Error(
+        `defineSchema: sourced + .shardBy() table "${name}" needs a \`tenantBy\` mapper — without it every tenant's DO would run the same unscoped query and replicate the whole multitenant table (a cross-tenant leak). Add \`tenantBy: (shardKey) => [shardKey]\` binding the shard key into the query's parameters.`
+      );
+    }
+    if (source.mode === "incremental") {
+      throw new Error(
+        `defineSchema: table "${name}" uses \`mode: "incremental"\`, which is not yet implemented — only "full-pull" (the default) is supported. Remove \`mode\` or set it to "full-pull".`
+      );
+    }
+  }
+};
 const defineSchema = (tables, vectorIndexes = {}, aggregateIndexes = {}, rankIndexes = {}) => {
   fillIndexTableNames(tables);
   attachStandaloneIndexes(tables, aggregateIndexes, rankIndexes);
+  validateExternalSources(tables);
   return withExtend({ tables, vectorIndexes });
 };
 

package/dist/packem_shared/defineIdentity-B_9YD46A.mjs

@@ -0,0 +1,34 @@
+import { parseValidatorMap, ValidationError } from '@lunora/values';
+
+const NON_STRING_USER_ID_KINDS = /* @__PURE__ */ new Set([
+  "array",
+  "bigint",
+  "boolean",
+  "bytes",
+  "date",
+  "null",
+  "number",
+  "object",
+  "optional",
+  "record",
+  "timestamp"
+]);
+const defineIdentity = (claims, options = {}) => {
+  const map = claims;
+  const userIdValidator = map["userId"];
+  if (userIdValidator === void 0 || NON_STRING_USER_ID_KINDS.has(userIdValidator.kind)) {
+    throw new Error("defineIdentity: the claim map must declare a required string `userId` validator (e.g. `v.string()` or `v.id(...)`)");
+  }
+  const onInvalid = options.onInvalid ?? "anonymous";
+  const validate = (identity) => {
+    try {
+      parseValidatorMap(map, identity, "identity");
+      return { ok: true };
+    } catch (error) {
+      return { error: error instanceof ValidationError ? error.message : String(error), ok: false };
+    }
+  };
+  return { __lunoraIdentity: true, claims: map, onInvalid, validate };
+};
+
+export { defineIdentity };

package/dist/packem_shared/defineMutator-EIXAWhs9.mjs

@@ -0,0 +1,11 @@
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+
+const defineMutator = (definition) => {
+  const handler = async (context, rawArgs) => {
+    const parsed = validateArgs(definition.args ?? {}, rawArgs);
+    return definition.server(context, parsed);
+  };
+  return { __lunoraMutator: true, ...definition, handler, kind: "mutation" };
+};
+
+export { defineMutator };

package/dist/packem_shared/defineShape-CJ27Wx7o.mjs

@@ -0,0 +1,17 @@
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+
+const defineShape = (definition) => {
+  if (definition.table.trim() === "") {
+    throw new Error("defineShape: `table` must be a non-empty string");
+  }
+  if (definition.columns?.length === 0) {
+    throw new Error("defineShape: `columns` must list at least one column when provided");
+  }
+  const compileWhere = (context, rawArgs) => {
+    const parsed = validateArgs(definition.args ?? {}, rawArgs);
+    return definition.where(context, parsed);
+  };
+  return { __lunoraShape: true, ...definition, compileWhere };
+};
+
+export { defineShape };

package/dist/packem_shared/functions-Di9FUNkf.mjs

@@ -0,0 +1,5 @@
+import { parseValidatorMap } from '@lunora/values';
+
+const validateArgs = (validators, args) => parseValidatorMap(validators, args, "args");
+
+export { validateArgs as v };

package/dist/packem_shared/{httpAction-B7FYUEgr.mjs → httpAction-FLwfsePg.mjs}

@@ -1,6 +1,6 @@
 import { parseValidatorMap, ValidationError } from '@lunora/values';
 import { Hono } from 'hono';
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
 
 const httpAction = (handler) => async (c) => handler(c.get("lunora"), c.req.raw);
 const httpRouter = () => {

package/dist/packem_shared/{initLunora-CATvPsVt.mjs → initLunora-lxwHTEV3.mjs}

@@ -1,8 +1,7 @@
-import { parseValidatorMap } from '@lunora/values';
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
 import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
 
-const validateArgs = (validators, args) => parseValidatorMap(validators, args, "args");
-
 const runMiddleware = (middlewares, baseContext) => runMiddlewareChain(middlewares, baseContext, (context) => context);
 const makeHandler = (args, middlewares, userHandler, output) => async (context, rawArgs) => {
   const parsed = validateArgs(args, rawArgs);
@@ -35,16 +34,29 @@ const makeStreamHandler = (args, middlewares, userHandler) => (context, rawArgs,
     }
   })();
 };
+const collectRls = (middlewares) => {
+  const tags = [];
+  for (const middleware of middlewares) {
+    const tag = readRlsTag(middleware);
+    if (!tag) {
+      continue;
+    }
+    tags.push(tag);
+  }
+  return tags.length > 0 ? { tags } : void 0;
+};
 const makeBuilder = (kind, state, visibility) => {
   return {
     __lunoraProcedure: kind,
     ...visibility ? { __lunoraVisibility: visibility } : {},
     input: (validators) => makeBuilder(kind, { ...state, args: { ...state.args, ...validators } }, visibility),
     [kind]: (userHandler) => {
+      const rls = collectRls(state.middlewares);
       return {
         args: state.args,
         handler: makeHandler(state.args, state.middlewares, userHandler, state.output),
         kind,
+        ...rls ? { rls } : {},
         ...visibility ? { visibility } : {}
       };
     },
@@ -55,10 +67,12 @@ const makeBuilder = (kind, state, visibility) => {
     // unconditionally keeps the runtime free of per-kind branching.
     ...kind === "query" ? {
       stream: (userHandler) => {
+        const rls = collectRls(state.middlewares);
         return {
           args: state.args,
           handler: makeStreamHandler(state.args, state.middlewares, userHandler),
           kind: "stream",
+          ...rls ? { rls } : {},
           ...visibility ? { visibility } : {}
         };
       }

package/dist/packem_shared/{mask-CkZJHHMM.mjs → mask-BV_jNzsN.mjs}

@@ -1,5 +1,5 @@
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
-import { bindTableFacade, bindOrm } from './bindTableFacade-DCuyr46L.mjs';
+import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-Ce57S3N9.mjs';
 
 const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
 const indexRolePermissions = (roles) => {

package/dist/packem_shared/policy-tag-DvpVH2tv.mjs

@@ -0,0 +1,13 @@
+const RLS_TAG = /* @__PURE__ */ Symbol.for("lunora.rls.middleware-policies");
+const tagRlsMiddleware = (middleware, tag) => {
+  Object.defineProperty(middleware, RLS_TAG, { configurable: true, enumerable: false, value: tag });
+  return middleware;
+};
+const readRlsTag = (middleware) => {
+  if (middleware === null || typeof middleware !== "function" && typeof middleware !== "object") {
+    return void 0;
+  }
+  return middleware[RLS_TAG];
+};
+
+export { readRlsTag as r, tagRlsMiddleware as t };

package/dist/packem_shared/{rls-Zhf5wEeJ.mjs → rls-2Jhd0uev.mjs}

@@ -1,5 +1,6 @@
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
-import { bindTableFacade, bindOrm } from './bindTableFacade-DCuyr46L.mjs';
+import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-Ce57S3N9.mjs';
+import { t as tagRlsMiddleware } from './policy-tag-DvpVH2tv.mjs';
 
 const DEFAULT_BATCH_LIMIT = 500;
 const assertBatchLimit = (count, limit, op) => {
@@ -324,7 +325,7 @@ const wrapDatabase = (base, raw, perTable, context) => {
         restrictsCounts: (args.restrictsCounts ?? false) || restricts
       });
     },
-    delete: (id, expectedTable) => gateById(id, "delete", (writer) => writer.delete(id, expectedTable), void 0, expectedTable),
+    delete: (id, expectedTable, options) => gateById(id, "delete", (writer) => writer.delete(id, expectedTable, options), void 0, expectedTable),
     async deleteMany(ids, options, expectedTable) {
       assertBatchLimit(ids.length, options?.limit, "deleteMany");
       for (const id of ids) {
@@ -441,6 +442,22 @@ const wrapDatabase = (base, raw, perTable, context) => {
       }
       return reader.filter((document) => matchesWhere(document, baseWhere));
     },
+    // Restore clears the soft-delete marker — a by-id un-delete, gated as an
+    // "update" (the policy that governs patch). No post-image check: the
+    // writer owns the marker field, so we only enforce the pre-image USING.
+    restore: (id, expectedTable) => gateById(
+      id,
+      "update",
+      async (writer) => {
+        const perform = writer.restore ?? raw.restore;
+        if (!perform) {
+          throw new LunoraError("BAD_REQUEST", "restore is not supported by this writer");
+        }
+        await perform(id, expectedTable);
+      },
+      void 0,
+      expectedTable
+    ),
     replace: (id, document, expectedTable) => gateById(
       id,
       "update",
@@ -516,7 +533,7 @@ const indexRolePermissions = (roles) => {
 const rls = (policies, options = {}) => {
   const perTable = indexByTable(policies);
   const rolePermissions = indexRolePermissions(options.roles);
-  return async ({ ctx, next }) => {
+  const middleware = async ({ ctx, next }) => {
     const auth = ctx.auth ?? {};
     const identity = await auth.getIdentity?.() ?? null;
     const roles = auth.roles ?? [];
@@ -546,6 +563,7 @@ const rls = (policies, options = {}) => {
     }
     return next({ ctx: extension });
   };
+  return tagRlsMiddleware(middleware, { policies, roles: options.roles ?? [] });
 };
 
 export { computeReadBaseWhere, evaluateWrite, indexRolePermissions, matchesWhere, permissionName, rls };

package/dist/packem_shared/{storageRules-4a30FSpI.mjs → storageRules-Cje6Woea.mjs}

@@ -1,4 +1,4 @@
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
 
 const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
 const indexRolePermissions = (roles = []) => {

package/dist/packem_shared/{types.d-DmvyEMD6.d.mts → types.d-BB3pjV0m.d.mts}

@@ -45,10 +45,10 @@ type PolicyDecisionOf<DM, REL extends Record<keyof DM, object>, T extends keyof
 * unknown table, a stray column, or a relation predicate naming a relation the
 * table does not declare is a compile error rather than a silent runtime deny.
 */
-interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T extends keyof DM, Context = unknown> {
+interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T extends keyof DM, Context = unknown, Identity = Record<string, unknown>> {
   on: PolicyOperation;
   table: T;
-  when: (context: PolicyContext<Context>) => PolicyDecisionOf<DM, REL, T>;
+  when: (context: PolicyContext<Context, Identity>) => PolicyDecisionOf<DM, REL, T>;
 }
 /**
 * Context handed to a policy. `auth.roles` is the per-request role list,
@@ -59,7 +59,7 @@ interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T ext
 * pre-write row; for `insert` it is the candidate document. `ctx` is the full
 * procedure context the middleware closed over.
 */
-interface PolicyContext<Context = unknown> {
+interface PolicyContext<Context = unknown, Identity = Record<string, unknown>> {
   readonly auth: {
     /**
     * `true` when any of the request's `roles` grants `permission` (passed
@@ -68,7 +68,13 @@ interface PolicyContext<Context = unknown> {
     * when none of the request's roles lists the permission.
     */
     readonly can: (permission: Permission | string) => boolean;
-    readonly identity?: Record<string, unknown> | null;
+    /**
+    * The resolved identity, typed to the `Identity` type parameter bound on
+    * `createPolicyDsl` — e.g. the app's `defineIdentity(...)` claim type via
+    * the `InferIdentity` helper; otherwise the untyped claim bag.
+    * `undefined`/`null` when the request is anonymous.
+    */
+    readonly identity?: Identity | null;
     readonly roles: ReadonlyArray<string>;
     readonly userId: null | string;
   };

package/dist/packem_shared/{types.d-BDY0FYHK.d.ts → types.d-Cxl6ndhm.d.ts}

@@ -45,10 +45,10 @@ type PolicyDecisionOf<DM, REL extends Record<keyof DM, object>, T extends keyof
 * unknown table, a stray column, or a relation predicate naming a relation the
 * table does not declare is a compile error rather than a silent runtime deny.
 */
-interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T extends keyof DM, Context = unknown> {
+interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T extends keyof DM, Context = unknown, Identity = Record<string, unknown>> {
   on: PolicyOperation;
   table: T;
-  when: (context: PolicyContext<Context>) => PolicyDecisionOf<DM, REL, T>;
+  when: (context: PolicyContext<Context, Identity>) => PolicyDecisionOf<DM, REL, T>;
 }
 /**
 * Context handed to a policy. `auth.roles` is the per-request role list,
@@ -59,7 +59,7 @@ interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T ext
 * pre-write row; for `insert` it is the candidate document. `ctx` is the full
 * procedure context the middleware closed over.
 */
-interface PolicyContext<Context = unknown> {
+interface PolicyContext<Context = unknown, Identity = Record<string, unknown>> {
   readonly auth: {
     /**
     * `true` when any of the request's `roles` grants `permission` (passed
@@ -68,7 +68,13 @@ interface PolicyContext<Context = unknown> {
     * when none of the request's roles lists the permission.
     */
     readonly can: (permission: Permission | string) => boolean;
-    readonly identity?: Record<string, unknown> | null;
+    /**
+    * The resolved identity, typed to the `Identity` type parameter bound on
+    * `createPolicyDsl` — e.g. the app's `defineIdentity(...)` claim type via
+    * the `InferIdentity` helper; otherwise the untyped claim bag.
+    * `undefined`/`null` when the request is anonymous.
+    */
+    readonly identity?: Identity | null;
     readonly roles: ReadonlyArray<string>;
     readonly userId: null | string;
   };

package/dist/rls/testing.d.mts

@@ -1,4 +1,4 @@
-import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-DmvyEMD6.mjs";
+import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-BB3pjV0m.mjs";
 import "../data-model.mjs";
 /**
 * The slice of a request identity a policy reads. Mirrors the

package/dist/rls/testing.d.ts

@@ -1,4 +1,4 @@
-import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-BDY0FYHK.js";
+import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-Cxl6ndhm.js";
 import "../data-model.js";
 /**
 * The slice of a request identity a policy reads. Mirrors the

package/dist/rls/testing.mjs

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-Zhf5wEeJ.mjs';
+import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-2Jhd0uev.mjs';
 
 const expectPolicy = (policies, options = {}) => {
   const rolePermissions = indexRolePermissions(options.roles);