@lunora/server 1.0.0-alpha.193 → 1.0.0-alpha.194

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.193",
+  "version": "1.0.0-alpha.194",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -71,8 +71,8 @@
   },
   "dependencies": {
     "@lunora/errors": ">=1.0.0-alpha.51 <2.0.0-0",
-    "@lunora/scheduler": "1.0.0-alpha.119",
-    "@lunora/shard-engine": "1.0.0-alpha.122",
+    "@lunora/scheduler": "1.0.0-alpha.120",
+    "@lunora/shard-engine": "1.0.0-alpha.123",
     "@lunora/values": "1.0.0-alpha.63",
     "drizzle-orm": "^0.45.3",
     "hono": "^4.13.13"

package/dist/packem_shared/bindOrm-D_hFUjmr.mjs

@@ -1 +0,0 @@
-import{LunoraError as d}from"@lunora/errors";const a=e=>typeof e=="object"&&e!==null&&e.code==="CONFLICT"&&e.kind==="unique",p=(e,t,r)=>{const o=typeof t=="string"?[t]:t;if(o.length===0)throw new d("INTERNAL",`ctx.db.${e}.upsert: "target" must name at least one field`);const h={};for(const n of o){if(!(n in r))throw new d("INTERNAL",`ctx.db.${e}.upsert: target field "${n}" is missing from the create document`);h[n]=r[n]}return h},l=(e,t)=>{const r=async(n,s)=>{if(s?.skipDuplicates!==!0)return e.insert(t,n);try{return await e.insert(t,n)}catch(i){if(a(i))return null;throw i}},o=async n=>{const s=n??{},i=await e.findMany(t,{...s,limit:2});if(i.page.length>1)throw new d("NOT_UNIQUE",`ctx.db.${t}.findUnique matched more than one document; expected at most one`);return i.page[0]??null},h=async({create:n,target:s,update:i})=>{const c=p(t,s,n),u=await e.findFirst(t,{where:c});return u&&typeof u._id=="string"?(await e.patch(u._id,i??n,t),{created:!1,id:u._id}):{created:!0,id:await e.insert(t,n)}};return{aggregate:n=>e.aggregate(t,n),count:n=>e.count(t,n),delete:n=>e.delete(n,t),deleteMany:(n,s)=>{if(Array.isArray(n)){if(e.deleteMany===void 0)throw new d("INTERNAL",`ctx.db.${t}.deleteMany is unavailable: this writer has no batch delete`);return e.deleteMany(n,s,t)}if(e.deleteWhere===void 0)throw new d("INTERNAL",`ctx.db.${t}.deleteMany({ where }) is unavailable: this writer has no where-based delete`);const i=n;return e.deleteWhere(t,i.where,{limit:i.limit})},exists:async n=>await e.findFirst(t,n===void 0?void 0:{where:n})!==null,findFirst:n=>e.findFirst(t,n),findFirstOrThrow:n=>e.findFirstOrThrow(t,n),findMany:n=>e.findMany(t,n),findUnique:o,get:n=>e.get(n,t),groupBy:n=>e.groupBy(t,n),hardDelete:n=>e.delete(n,t,{hard:!0}),insert:r,insertMany:(n,s)=>{if(e.insertMany===void 0)throw new d("INTERNAL",`ctx.db.${t}.insertMany is unavailable: this writer has no batch insert`);return e.insertMany(t,n,s)},patch:(n,s)=>e.patch(n,s,t),patchMany:(n,s)=>{if(Array.isArray(n)){if(e.patchMany===void 0)throw new d("INTERNAL",`ctx.db.${t}.patchMany is unavailable: this writer has no batch patch`);return e.patchMany(n.map(c=>({id:c.id,patch:c.values})),s,t)}if(e.patchWhere===void 0)throw new d("INTERNAL",`ctx.db.${t}.patchMany({ where, values }) is unavailable: this writer has no where-based patch`);const i=n;return e.patchWhere(t,{patch:i.values,where:i.where},{limit:i.limit})},rank:(n,s)=>e.rank(t,n,s),rankPage:(n,s)=>e.rankPage(t,n,s),replace:(n,s)=>e.replace(n,s,t),restore:async n=>{if(!e.restore)throw new d("INTERNAL",`ctx.db.${t}.restore is unavailable: this writer has no restore (is the table .softDelete()?)`);await e.restore(n,t)},upsert:h,upsertMany:async({rows:n,target:s})=>{const i=[];for(const c of n)i.push(await h({create:c.create,target:s,update:c.update}));return i},withGeoIndex:(n,s)=>e.query(t).withGeoIndex(n,s),withSearchIndex:(n,s)=>e.query(t).withSearchIndex(n,s)}},g=e=>{const t=r=>{const o=e[r];if(!o)throw new d("INTERNAL",`unknown table: ${r}`);return o};return{delete:(r,o)=>t(r).delete(o),insert:r=>({values:o=>t(r).insert(o)}),query:e,replace:(r,o)=>({with:h=>t(r).replace(o,h)}),update:(r,o)=>({set:h=>t(r).patch(o,h)})}};export{g as bindOrm,l as bindTableFacade};

package/dist/packem_shared/mask-0D6SL3i5.mjs

@@ -1 +0,0 @@
-import{LunoraError as A}from"@lunora/errors";import{f as U}from"./fnv1a-D3ueNTWB.mjs";import{i as q,a as z,o as _,b as G,c as C}from"./middleware-DAVx_tP1.mjs";import{bindTableFacade as H,bindOrm as J}from"./bindOrm-D_hFUjmr.mjs";import{tagMaskMiddleware as Q}from"./buildMaskRegistry-DpWMtalG.mjs";const V=(i,e,c)=>{try{return i==="redact"?null:i==="hash"?e==null?e:typeof e=="bigint"?U(e.toString()):U(typeof e=="string"?e:JSON.stringify(e)):i(e,c)}catch{return null}},w=(i,e,c)=>{const u={...i};for(const[y,g]of Object.entries(e))y in u&&(u[y]=V(g,i[y],{...c,column:y,row:i}));return u},j=(i,e,c)=>({...i,page:i.page.map(u=>w(u,e,c))}),D=(i,e,c,u)=>{if(typeof i!="function")return;const y=new Set,g=()=>new Proxy({},{get:()=>d=>(typeof d=="string"&&y.add(d),g())});i(g());for(const d of y)if(d in e)throw new A("MASK_UNSUPPORTED",`${u}() filtering "${c}" by masked column "${d}" is not supported`)},X=(i,e,c,u)=>{const y=i.rankBefore,g=i.rankPageRows,d=(r,n)=>{const t=e.get(r);return t?n.map(o=>w(o,t,c)):n},p=r=>{const n=r?.relationMask;return{...r,relationMask:n===void 0?d:(t,o)=>n(t,d(t,o))}},k=(r,n,t,o)=>{const s=e.get(r);if(!s)return;const f=u?.[r]?.[o]?.[n];if(!f)return;const a=f.find(E=>E in s);if(a!==void 0)throw new A("MASK_UNSUPPORTED",`${t}() reading "${r}" via index "${n}" would order rows by masked column "${a}" — use an index whose declared fields are all unmasked, or unmask the column`)},l=(r,n,t)=>({async*[Symbol.asyncIterator](){for await(const o of{[Symbol.asyncIterator]:()=>r[Symbol.asyncIterator]()})yield w(o,n,c)},collect:async()=>(await r.collect()).map(s=>w(s,n,c)),collectWithScores:async()=>(await r.collectWithScores()).map(s=>{const f=w(s.document,n,c);return"distanceMeters"in s?{distanceMeters:null,document:f}:{document:f,score:s.score}}),filter:o=>l(r.filter(s=>o(w(s,n,c))),n,t),first:async()=>{const o=await r.first();return o?w(o,n,c):null},order:o=>l(r.order(o),n,t),paginate:async o=>j(await r.paginate(o),n,c),take:async o=>(await r.take(o)).map(f=>w(f,n,c)),unique:async()=>{const o=await r.unique();return o?w(o,n,c):null},withIndex:(o,s)=>(k(t,o,"withIndex","index"),D(s,n,t,"withIndex"),l(r.withIndex(o,s),n,t)),withSearchIndex:(o,s)=>(D(s,n,t,"withSearchIndex"),l(r.withSearchIndex(o,s),n,t)),withGeoIndex:(o,s)=>(k(t,o,"withGeoIndex","geo"),l(r.withGeoIndex(o,s),n,t))}),I=async(r,n)=>{if(i.lookupById){const a=await i.lookupById(r,n);if(a)return{row:a.row,tableName:e.has(a.tableName)?a.tableName:void 0}}const t=await i.get(r,n);if(!t)return{row:null,tableName:void 0};const o=n!==void 0&&e.has(n)?[n]:[],s=n===void 0?[...e.keys()]:o,f=await Promise.all(s.map(async a=>(await i.findFirst(a,{limit:1,where:{_id:r}}))?._id===r?a:void 0));return{row:t,tableName:f.find(a=>a!==void 0)}},P=(r,n,t)=>{const o=e.get(r);if(!o)return;const s=n.find(f=>typeof f=="string"&&f in o);if(s!==void 0)throw new A("MASK_UNSUPPORTED",`${t}() over masked column "${s}" on "${r}" is not supported`)},S=new Set;for(const r of e.values())for(const n of Object.keys(r))S.add(n);const R=(r,n,t,o)=>{if(!(!r||typeof r!="object"||Array.isArray(r)))for(const[s,f]of Object.entries(r))K(s,f,n,t,o)},K=(r,n,t,o,s)=>{if(r==="AND"||r==="OR"){for(const f of Array.isArray(n)?n:[])R(f,t,o,s);return}if(r==="NOT"){R(n,t,o,s);return}if(!r.startsWith("__")){if(t.has(r))throw new A("MASK_UNSUPPORTED",`${s}() filtering "${o}" by masked column "${r}" is not supported`);if(C(n))for(const f of Object.values(n))R(f,S,`${o}.${r}`,s)}},B=r=>{const n=e.get(r);return n?new Set(Object.keys(n)):new Set},h=(r,n,t)=>{S.size===0||n===void 0||R(n,B(r),r,t)},v=(r,n,t,o)=>{if(Array.isArray(n)){for(const s of n)if(!(!s||typeof s!="object"||Array.isArray(s))){for(const f of Object.keys(s))if(t.has(f))throw new A("MASK_UNSUPPORTED",`${o}() ordering "${r}" by masked column "${f}" is not supported`)}}},$=(r,n,t)=>{if(!(S.size===0||!n||typeof n!="object"||Array.isArray(n)))for(const[o,s]of Object.entries(n)){if(o==="_count"||!s||typeof s!="object"||Array.isArray(s))continue;const f=s,a=`${r}.${o}`;R(f.where,S,a,t),v(a,f.orderBy,S,t),$(a,f.with,t)}},M=(r,n,t)=>{h(r,n?.where,t),h(r,n?.baseWhere,t),v(r,n?.orderBy,B(r),t),$(r,n?.with,t)},F=r=>r&&typeof r=="object"&&!Array.isArray(r)?r:void 0,O=(r,n,t)=>{const o=F(n);h(r,o?.where,t),h(r,o?.baseWhere,t),$(r,o?.with,t)},W={...i,async deleteWhere(r,n,t){if(h(r,n,"deleteMany({ where })"),i.deleteWhere===void 0)throw new A("INTERNAL",`ctx.db.${r}.deleteMany({ where }) is unavailable: this writer has no where-based delete`);return i.deleteWhere(r,n,t)},async patchIf(r,n,t){if(h(r,t.where,"patchIf"),i.patchIf===void 0)throw new A("INTERNAL",`ctx.db.patchIf on "${r}" is unsupported: this writer has no conditional write`);const o=await i.patchIf(r,n,t),s=e.get(r);return o.doc&&s?{applied:o.applied,doc:w(o.doc,s,c)}:o},async patchWhere(r,n,t){if(h(r,n.where,"patchMany({ where })"),i.patchWhere===void 0)throw new A("INTERNAL",`ctx.db.${r}.patchMany({ where }) is unavailable: this writer has no where-based patch`);return i.patchWhere(r,n,t)},aggregate(r,n){return P(r,[n.field],"aggregate"),h(r,n.where,"aggregate"),i.aggregate(r,n)},count(r,n){const t=F(n),o=t&&("where"in t||"baseWhere"in t||"restrictsCounts"in t)?t.where:n;return h(r,o,"count"),t&&h(r,t.baseWhere,"count"),i.count(r,n)},async findFirst(r,n){M(r,n,"findFirst");const t=await i.findFirst(r,p(n)),o=e.get(r);return t&&o?w(t,o,c):t},async findFirstOrThrow(r,n){M(r,n,"findFirstOrThrow");const t=await i.findFirstOrThrow(r,p(n)),o=e.get(r);return o?w(t,o,c):t},async findMany(r,n){M(r,n,"findMany");const t=await i.findMany(r,p(n)),o=e.get(r);return o?j(t,o,c):t},async get(r,n){const{row:t,tableName:o}=await I(r,n),s=o===void 0?void 0:e.get(o);return!t||!s?t:w(t,s,c)},related:i.related?async(r,n)=>await i.related(r,p(n)):void 0,async lookupById(r,n){const t=await i.lookupById?.(r,n);if(!t)return null;const o=e.get(t.tableName);return{row:o?w(t.row,o,c):t.row,tableName:t.tableName}},groupBy(r,n){return P(r,[...n.by,n.agg?.field],"groupBy"),h(r,n.where,"groupBy"),i.groupBy(r,n)},query(r){const n=i.query(r),t=e.get(r);return t?l(n,t,r):n},async rank(r,n,t){return O(r,t,"rank"),k(r,n,"rank","rank"),i.rank(r,n,t)},async rankPage(r,n,t){O(r,t,"rankPage"),k(r,n,"rankPage","rank");const o=await i.rankPage(r,n,t),s=e.get(r);return s?j(o,s,c):o},..._("rankBefore",y,r=>(n,t,o)=>(O(n,o,"rankBefore"),k(n,t,"rankBefore","rank"),r(n,t,o))),..._("rankPageRows",g,r=>async(n,t,o)=>{O(n,o,"rankPageRows"),k(n,t,"rankPageRows","rank");const s=await r(n,t,o),f=e.get(n);return f?{...s,rows:s.rows.map(a=>({...a,doc:w(a.doc,f,c)}))}:s})},L=W;if(S.size>0)for(const[r,n]of Object.entries(i))G(n)&&(L[r]=H(W,r));return W},N=(i,e={})=>{const c=new Map(Object.entries(i)),u=q(e.roles),y=async({ctx:d,next:p})=>{const k={auth:await z(d.auth??{},u),ctx:d};if(e.bypass?.(k)===!0)return p();const l=X(d.db,c,k,e.indexFields),I={db:l},{orm:P}=d;return P!==null&&typeof P=="object"&&(I.orm=J(l)),p({ctx:I})},g=new Map;for(const[d,p]of c)g.set(d,new Set(Object.keys(p)));return Q(y,{columns:g})};export{N as mask};

package/dist/packem_shared/middleware-DAVx_tP1.mjs

@@ -1 +0,0 @@
-import{LunoraError as R,isLunoraError as V}from"@lunora/errors";import{findRelated as ee,whereFilter as te}from"@lunora/shard-engine";import{i as j}from"./wire-codec-CZ4obM6q.mjs";import{bindTableFacade as ne,bindOrm as re}from"./bindOrm-D_hFUjmr.mjs";import{t as se}from"./policy-tag-V0lqFzgS.mjs";import{deny as oe}from"./allowAll-DkRAgItV.mjs";const ie=["every","is","isNot","none","some"],ae=new Set(ie),ce=e=>{if(e===null||typeof e!="object"||Array.isArray(e))return!1;const n=Object.keys(e);return n.length>0&&n.every(s=>ae.has(s))},q=(e,n,s)=>n?{[e]:s(n)}:{},le=["contains","eq","gt","gte","in","isNull","lt","lte","ne","notIn"],B=-1,I=0,b=1,T=e=>e?b:B,p=(e,n)=>e<n?e:n,fe=(e,n)=>e>n?e:n,z=e=>e===I?I:T(e===B),Y=e=>{const n=typeof e;return n==="number"||n==="string"||n==="bigint"},S=e=>e==null,M=(e,n,s)=>{if(s===void 0)throw new R("BAD_REQUEST",`\`${n}\` on "${e}" received undefined; a comparison needs a value`)},de={gt:(e,n)=>e>n,gte:(e,n)=>e>=n,lt:(e,n)=>e<n,lte:(e,n)=>e<=n},ue=(e,n,s)=>{let i=b;for(const c of["gt","gte","lt","lte"]){if(!(c in s))continue;const y=s[c];if(M(e,c,y),!Y(y))i=p(i,B);else if(S(n))i=p(i,I);else{const d=de[c];i=p(i,T(Y(n)&&d(n,y)))}}return i},K=(e,n,s)=>{if(!Array.isArray(s))throw new R("BAD_REQUEST",`\`${n}\` on "${e}" expects an array of values, received ${s===null?"null":typeof s}`);if(s.includes(void 0))throw new R("BAD_REQUEST",`\`${n}\` on "${e}" received undefined inside its list; a comparison needs a value`);return s},Q=(e,n)=>n.length===0?B:S(e)?I:n.includes(e)?b:n.some(s=>S(s))?I:B,he=(e,n,s)=>{let i=b;if("in"in s&&(i=p(i,Q(n,K(e,"in",s.in)))),"notIn"in s&&(i=p(i,z(Q(n,K(e,"notIn",s.notIn))))),"contains"in s){const c=s.contains;M(e,"contains",c),i=S(n)?p(i,I):p(i,T(typeof n=="string"&&typeof c=="string"&&n.includes(c)))}return"isNull"in s&&(i=p(i,T(s.isNull===!0===S(n)))),i},F=(e,n,s)=>n===null?T(s===S(e)):S(e)?I:T(s===(e===n)),ye=(e,n,s)=>{let i=b;return"eq"in s&&(M(e,"eq",s.eq),i=p(i,F(n,s.eq,!0))),"ne"in s&&(M(e,"ne",s.ne),i=p(i,F(n,s.ne,!1))),i},we=(e,n,s)=>p(ye(e,n,s),p(he(e,n,s),ue(e,n,s))),pe=(e,n,s,i)=>{if(n==="NOT")return z(i(e,s??{}));if(!Array.isArray(s))return B;let c=n==="AND"?b:B;for(const y of s){const d=i(e,y);c=n==="AND"?p(c,d):fe(c,d)}return c},H=e=>e==="AND"||e==="OR"||e==="NOT",ge=e=>j(e)&&Object.keys(e).every(n=>le.includes(n)),L=e=>Object.keys(e).some(n=>{const s=e[n];return H(n)?n==="NOT"?L(s??{}):Array.isArray(s)&&s.some(i=>L(i??{})):ce(s)}),G=(e,n)=>{let s=b;for(const i of Object.keys(n)){const c=n[i];if(H(i)){s=p(s,pe(e,i,c,G));continue}const y=e[i];if(ge(c)){s=p(s,we(i,y,c));continue}M(i,"eq",c),s=p(s,F(y,c,!0))}return s},C=(e,n)=>G(e,n)===b,X=500,k=(e,n,s)=>{const i=n??X;if(e>i)throw new R("BATCH_LIMIT_EXCEEDED",`${s}: batch of ${String(e)} exceeds the limit of ${String(i)} (raise options.limit or chunk the call)`,{status:400})},Re=oe(),We=Symbol.for("lunora.ctxdb.rls-unwrap"),J=Symbol.for("lunora.rls.wrapped-chain"),Oe=e=>e[J],be=e=>{const n=new Map;for(const s of e){const i=n.get(s.table)??[];i.push(s),n.set(s.table,i)}return n},Ee=(e,n)=>{const s=[];let i=!1;for(const c of e){if(c.on!=="read")continue;const y=c.when(n);if(y!==void 0){if(y===!0){i=!0;break}y!==!1&&s.push(y)}}if(!i)return s.length===0?Re:s.length===1?s[0]:{OR:s}},ve=(e,n,s)=>{const i=e.when({...n,row:s});if(i===void 0||i===!0)return!0;if(i===!1)return!1;if(L(i))throw new R("RELATION_PREDICATE_UNSUPPORTED","relation predicates are not supported in write policies; use a read policy or a flat column check");return C(s,i)},Ae=(e,n,s)=>{const i=e.when(n);if(i===void 0||i===!0)return s===void 0||ve(e,n,s);if(i===!1)return!1;if(L(i))throw new R("RELATION_PREDICATE_UNSUPPORTED","relation predicates are not supported in write policies; use a read policy or a flat column check");return!n.row||!C(n.row,i)?!1:s===void 0||C(s,i)},Be=(e,n,s,i)=>{let c=!1;for(const y of e)if(y.on===n&&(c=!0,!Ae(y,s,i)))return!1;return c},Ie=new Set(["baseWhere","relationBaseWhere","restrictsCounts","where"]),Se=(e,n)=>n===void 0?!0:e==="restrictsCounts"?typeof n=="boolean":e==="relationBaseWhere"?typeof n=="function":j(n),_e=e=>{const n=Object.keys(e);return n.length===0?!1:n.every(s=>Ie.has(s)&&Se(s,e[s]))},ke=e=>e===void 0?{}:j(e)&&_e(e)?e:{where:e},$=e=>e!==void 0&&Object.keys(e).length>0,Te=e=>{if(e.length!==0)return e.length===1?e[0]:{AND:e}},O=(e,n)=>$(n)?!e||Object.keys(e).length===0?n:{AND:[n,e]}:e,Me=e=>{if(typeof e!="object"||e===null||Array.isArray(e))return!1;const n=e;return typeof n.findMany=="function"&&typeof n.withSearchIndex=="function"},De=(e,n,s)=>{const[i]=s,c=s.length===1&&i!==void 0?i.perTable:new Set(s.flatMap(t=>[...t.perTable.keys()])),y=new Map,d=t=>{const r=y.get(t);if(r)return r;const o=[];let a=!1;for(const l of s){const h=l.perTable.get(t);if(!h||h.length===0||!h.some(m=>m.on==="read"))continue;a=!0;const u=Ee(h,l.context);u!==void 0&&o.push(u)}const f={baseWhere:Te(o),restricts:a};return y.set(t,f),f},_=(t,r,o,a)=>{for(const f of s){const l=f.perTable.get(t);if(l&&!Be(l,r,{...f.context,row:o},a))return!1}return!0},w=t=>d(t).restricts?n:e,g=t=>d(t).baseWhere,E=async(t,r,o)=>{if(n.lookupById){const u=await n.lookupById(t,r);if(u)return{row:u.row,tableName:c.has(u.tableName)?u.tableName:void 0}}const a=await n.get(t,r);if(!a)return{row:null,tableName:void 0};const f=r??o,l=f===void 0?[...c.keys()]:[f].filter(u=>c.has(u)),h=await Promise.all(l.map(async u=>(await n.findFirst(u,{limit:1,where:{_id:t}}))?._id===t?u:void 0));return{row:a,tableName:h.find(u=>u!==void 0)}},U=async(t,r,o)=>{const a=await E(t,r,o);return a.row&&a.tableName!==void 0?{row:a.row,tableName:a.tableName}:void 0},W=async(t,r,o,a,f,l)=>{const h=await U(t,f,l);if(!h)return o(e);const u=a?a(h.row):void 0;if(!_(h.tableName,r,h.row,u))throw new R("FORBIDDEN",`${r} denied by policy`);return o(n)},v=(t,r)=>{const{baseWhere:o}=d(t);if($(o))throw new R("COUNT_RLS_UNSUPPORTED",`${r}() is not supported on "${t}" inside an RLS-restricted context`)},D=e.rankBefore,P=e.rankPageRows,{relationEdges:N}=e,A={...e,async count(t,r){const{baseWhere:o}=d(t),a=ke(r);return w(t).count(t,{...a,baseWhere:O(a.baseWhere,o),relationBaseWhere:g,restrictsCounts:(a.restrictsCounts??!1)||$(o)})},delete:(t,r,o)=>W(t,"delete",a=>a.delete(t,r,o),void 0,r),async deleteAll(t,r){const o=Math.max(1,r?.chunkSize??X),{baseWhere:a}=d(t);let f=0;for(;;){const h=(await w(t).findMany(t,{baseWhere:a,limit:o,relationBaseWhere:g})).page.map(u=>String(u._id));if(h.length===0)break;for(const u of h)await W(u,"delete",m=>m.delete(u,void 0,r?.hard===void 0?void 0:{hard:r.hard}),void 0,void 0,t),f+=1;if(h.length<o)break}return{deleted:f}},async deleteMany(t,r,o){k(t.length,r?.limit,"deleteMany");for(const a of t)await W(a,"delete",f=>f.delete(a,o),void 0,o);return{deleted:t.length}},async deleteWhere(t,r,o){const{baseWhere:a}=d(t),l=(await w(t).findMany(t,{baseWhere:O(r,a),relationBaseWhere:g})).page.map(h=>String(h._id));k(l.length,o?.limit,"deleteWhere");for(const h of l)await W(h,"delete",u=>u.delete(h),void 0,void 0,t);return{deleted:l.length}},async findFirst(t,r){const{baseWhere:o}=d(t);return w(t).findFirst(t,{...r,baseWhere:O(r?.baseWhere,o),relationBaseWhere:g})},async findFirstOrThrow(t,r){const{baseWhere:o}=d(t);return w(t).findFirstOrThrow(t,{...r,baseWhere:O(r?.baseWhere,o),relationBaseWhere:g})},async findMany(t,r){const{baseWhere:o}=d(t);return w(t).findMany(t,{...r,baseWhere:O(r?.baseWhere,o),relationBaseWhere:g})},async get(t,r){const o=await E(t,r);if(!o.row)return null;if(o.tableName===void 0)return e.get(t,r);const{baseWhere:a,restricts:f}=d(o.tableName);if(!f)return e.get(t,r);if(!a)return o.row;const l=await n.findFirst(o.tableName,{baseWhere:a,limit:1,where:{_id:t}});return l?._id===t?l:null},async lookupById(t,r){const o=await E(t,r);if(!o.row)return null;if(o.tableName===void 0||!d(o.tableName).restricts)return await e.lookupById?.(t,r)??null;const{baseWhere:a}=d(o.tableName);if(!a)return{row:o.row,tableName:o.tableName};const f=await n.findFirst(o.tableName,{baseWhere:a,limit:1,where:{_id:t}});return f?._id===t?{row:f,tableName:o.tableName}:null},async insert(t,r,o){if(c.has(t)){if(!_(t,"insert",r))throw new R("FORBIDDEN",`insert on "${t}" denied by policy`);return n.insert(t,r,o)}return e.insert(t,r,o)},async insertMany(t,r,o){if(k(r.length,o?.limit,"insertMany"),c.has(t)){for(const a of r)if(!_(t,"insert",a))throw new R("FORBIDDEN",`insert on "${t}" denied by policy`);return n.insertMany(t,r,o)}return e.insertMany(t,r,o)},async insertManyUnsafe(t,r,o){if(k(r.length,o?.limit,"insertManyUnsafe"),c.has(t)){for(const a of r)if(!_(t,"insert",a))throw new R("FORBIDDEN",`insert on "${t}" denied by policy`);return n.insertManyUnsafe(t,r,o)}return e.insertManyUnsafe(t,r,o)},patch:(t,r,o)=>W(t,"update",a=>a.patch(t,r,o),a=>({...a,...r}),o),async patchIf(t,r,o){const a=await W(r,"update",async l=>{if(l.patchIf===void 0)throw new R("INTERNAL",`ctx.db.patchIf on "${t}" is unsupported: this writer has no conditional write`);return l.patchIf(t,r,o)},l=>({...l,...o.patch}),t);return a.doc===null||await A.get(r,t).then(l=>l!==null,l=>{if(V(l)&&l.code==="RLS_REQUIRED")return!1;throw l})?a:{applied:a.applied,doc:null}},async patchMany(t,r,o){k(t.length,r?.limit,"patchMany");for(const a of t)await W(a.id,"update",f=>f.patch(a.id,a.patch,o),f=>({...f,...a.patch}),o);return{patched:t.length}},async patchWhere(t,r,o){const{baseWhere:a}=d(t),l=(await w(t).findMany(t,{baseWhere:O(r.where,a),relationBaseWhere:g})).page.map(h=>({id:String(h._id),patch:r.patch}));return k(l.length,o?.limit,"patchWhere"),A.patchMany(l,o)},query(t){const{baseWhere:r}=d(t),o=w(t).query(t);return r?o.filter(te(r,a=>C(a,r))):o},related:N===void 0?void 0:async(t,r)=>ee({findMany:async(o,a)=>A.findMany(o,a),lookupById:async o=>n.lookupById?.(o)},N,t,{cursor:r?.cursor,depth:r?.depth,direction:r?.direction,edges:r?.edges,limit:r?.limit,relationMask:r?.relationMask}),restore:(t,r)=>W(t,"update",async o=>{const a=o.restore??n.restore;if(!a)throw new R("BAD_REQUEST","restore is not supported by this writer");await a(t,r)},void 0,r),replace:(t,r,o)=>W(t,"update",a=>a.replace(t,r,o),a=>({...r,_creationTime:r._creationTime??a._creationTime,_id:a._id}),o),aggregate(t,r){const{baseWhere:o}=d(t);return w(t).aggregate(t,{...r,baseWhere:O(r.baseWhere,o),relationBaseWhere:g})},groupBy(t,r){const{baseWhere:o}=d(t);return w(t).groupBy(t,{...r,baseWhere:O(r.baseWhere,o),relationBaseWhere:g})},rank(t,r,o){return v(t,"rank"),w(t).rank(t,r,o)},rankPage(t,r,o){return v(t,"rankPage"),w(t).rankPage(t,r,o)},wipeShard(){throw new R("FORBIDDEN","ctx.db.wipeShard() is unavailable under rls(): a whole-shard erase can't be policy-gated per row, and erasing only policy-visible rows would silently leave data behind. Run it from an internalMutation, or use ctx.db.deleteAll(table) per table.",{status:403})},...q("rankBefore",D,t=>(r,o,a)=>(v(r,"rankBefore"),(w(r).rankBefore??t)(r,o,a))),...q("rankPageRows",P,t=>(r,o,a)=>(v(r,"rankPageRows"),(w(r).rankPageRows??t)(r,o,a)))},x=A;if(c.size>0)for(const[t,r]of Object.entries(e))Me(r)&&(x[t]=ne(A,t));return Object.defineProperty(A,J,{configurable:!0,enumerable:!1,value:{base:e,raw:n,steps:s},writable:!1}),A},Z=e=>typeof e=="string"?e:e.name,Pe=e=>{const n=new Map;for(const s of e??[])n.set(s.name,new Set((s.permissions??[]).map(i=>Z(i))));return n},me=(e,n)=>{const s=new Set;for(const i of e)for(const c of n.get(i)??[])s.add(c);return i=>s.has(Z(i))},Le=["roles","role"],Ce=e=>{for(const n of Le){const s=e?.[n];if(typeof s=="string"){const i=s.split(",").map(c=>c.trim()).filter(c=>c.length>0);if(i.length>0)return i}if(Array.isArray(s)){const i=s.filter(c=>typeof c=="string"&&c.length>0);if(i.length>0)return i}}return[]},Ue=async(e,n)=>{const s=await e.getIdentity?.()??null,i=[...new Set([...Ce(s),...e.roles??[]])];return{can:me(i,n),identity:s,roles:i,userId:e.userId??null}},Ke=(e,n={})=>{const s=e,i=be(s),c=Pe(n.roles);return se(async({ctx:d,next:_})=>{const w={auth:await Ue(d.auth??{},c),ctx:d},g=d.db,E=Oe(g),U=E?.base??g,W=E?.raw??g[We]??g,v=De(U,W,[...E?.steps??[],{context:w,perTable:i}]),D={db:v},{orm:P}=d;return P!==null&&typeof P=="object"&&(D.orm=re(v)),_({ctx:D})},[{policies:s,roles:n.roles??[]}])};export{Ue as a,Me as b,ce as c,Ce as d,Ee as e,me as f,Be as g,Pe as i,C as m,q as o,Ke as r};

package/dist/packem_shared/plugin-xbEqjwqP.mjs

@@ -1 +0,0 @@
-import{LunoraError as i}from"@lunora/errors";import{c as V}from"./compose-middleware-BK9FlblN.mjs";import{v as B}from"@lunora/values";const q=["de","en","es","fr","it","nl","none","pt"],F=["native","portable"],X=e=>F.includes(e),G=e=>q.includes(e),U=e=>{const{value:t}=e._meta??{};if(t===null)return"null";switch(typeof t){case"bigint":case"boolean":case"number":case"string":return typeof t;default:return e.kind}},P=e=>{if(e.kind==="literal")return U(e);if(e.kind!=="optional")return e.kind;const t=e._meta?.inner;return t?P(t):e.kind},Y=e=>`table "${e}" is both .global() and .ttl(). The TTL sweep is a shard's alarm deleting from that shard's own SQLite, and a global (D1/Hyperdrive) table's rows live outside every shard — so expired rows would never be deleted. Drop .ttl() and expire the rows from a cron, or keep the table shard-local.`,J=(e,t)=>`table "${e}" is .global() and declares vector index "${t}". Vector sync runs on the shard write path, which a global (D1/Hyperdrive) table's writes never take — the index would stay empty. Drop .global(), or keep the index yourself with ctx.vectors.upsert/deleteByIds.`,j=16,W={many:(e,t)=>({field:t.field,kind:"many",references:t.references??"_id",table:e}),one:(e,t)=>({field:t.field,kind:"one",onDelete:t.onDelete,references:t.references??"_id",table:e})},g=(e,t,n)=>({handler:n,op:t,timing:e}),Z=()=>({afterDelete:e=>g("after","delete",e),afterInsert:e=>g("after","insert",e),afterUpdate:e=>g("after","update",e),beforeDelete:e=>g("before","delete",e),beforeInsert:e=>g("before","insert",e),beforeUpdate:e=>g("before","update",e)}),C=(e,t)=>{if(!t||t.length===0)throw new i("INTERNAL",`rankIndex "${e}": "sortBy" is required and must list at least one key`);return t.map(n=>({direction:n.direction??"asc",field:n.field}))},xe=e=>{const t={...e},n=[],r=[],a=[],d=[],u={},c=[],h={},f=Z(),b=[];let w={kind:"root"},E=!1,$=!1,p=!1,T=!1,M=!1,L,A,O,R;const D=s=>{if(w.kind!=="root"&&w.kind!==s.kind)throw new i("INTERNAL","shardBy/global: a table cannot be both .shardBy(key) and .global() — pick one. .shardBy(key) puts the rows in one Durable Object per key (isolation, poke-live reactivity); .global() puts them in a single replicated backend read from the edge.");w=s},l={aggregateIndex(s,o){const m=o?.op??"count";if(m!=="count"&&!o?.field)throw new i("INTERNAL",`aggregateIndex "${s}": op "${m}" requires a "field"`);return n.push({by:o?.by,field:o?.field,name:s,on:"",op:m,where:o?.where}),l},get aggregateIndexes(){return n},get externalSource(){return R},commitOrdered(){return E=!0,l},get commitOrderedMode(){return E},dropStalePatches(){return $=!0,l},get dropStalePatchesMode(){return $},externallyManaged(){return p=!0,l},geoIndex(s,o){return r.push({field:o.field,name:s,precision:o.precision}),l},get geoIndexes(){return r},global(s){return D({backend:s?.backend??"d1",kind:"global"}),l},get isExternallyManaged(){return p},get isPublic(){return M},index(s,o,m){return a.push({fields:o,name:s,unique:m?.unique??!1}),l},get indexes(){return a},memory(){return T=!0,l},get memoryMode(){return T},ownedBy(s){return L=s,l},get ownerField(){return L},public(){return M=!0,l},rankIndex(s,o){return d.push({name:s,on:"",partitionBy:o.partitionBy,sortBy:C(s,o.sortBy),where:o.where}),l},get rankIndexes(){return d},get relationMap(){return u},relations(s){return Object.assign(u,s(W)),l},searchIndex(s,o){if(o.filterFields&&o.filterFields.length>j)throw new i("INTERNAL",`searchIndex "${s}": at most ${String(j)} filterFields are supported (got ${String(o.filterFields.length)})`);const{language:m}=o;if(m!==void 0&&!G(m))throw new i("INTERNAL",`searchIndex "${s}": unknown language "${m}" (supported: ${q.join(", ")})`);const{strategy:N}=o;if(N!==void 0&&!X(N))throw new i("INTERNAL",`searchIndex "${s}": unknown strategy "${N}" (supported: ${F.join(", ")})`);return c.push({field:o.field,filterFields:o.filterFields,language:o.language,name:s,staged:o.staged,strategy:o.strategy}),l},get searchIndexes(){return c},shape:t,shardBy(s){return D({field:s,kind:"shardBy"}),l},get shardMode(){return w},get softDeleteMode(){return A},source(s){if(!s.binding)throw new i("INTERNAL","source: `binding` is required (the wrangler Hyperdrive binding name)");if(!s.query)throw new i("INTERNAL","source: `query` is required (the tenant-membership SQL)");return R=s,p=!0,l},softDelete(s){const o=s?.field??"deletedAt";return A={field:o},o in t||(t[o]=B.optional(B.number().nullable())),l},get triggerMap(){return h},triggers(s){return Object.assign(h,s(f)),l},ttl(s,o){return O={after:o?.after,field:s},l},get ttlPolicy(){return O},get vectorIndexes(){return b},vectorize(s,o){return b.push({dimensions:o.dimensions,embed:o.embed,field:s,metadata:o.metadata,metric:o.metric,model:o.model,name:o.index}),l}};return l},ye=e=>({dimensions:e.dimensions,embed:e.embed,kind:"vectorIndex",metadata:e.metadata,metric:e.metric,model:e.model,select:e.source.select,table:e.source.table}),Ie=(e,t)=>{const n=t.op??"count";if(n!=="count"&&!t.field)throw new i("INTERNAL",`aggregateIndex "${e}": op "${n}" requires a "field"`);return{by:t.by,field:t.field,name:e,on:t.on,op:n,where:t.where}},pe=(e,t)=>({name:e,on:t.table,partitionBy:t.partitionBy,sortBy:C(e,t.sortBy),where:t.where}),y=e=>({...e,extend(t){return y(z(e,t))},jurisdiction(t,n){return y(e)},rls(t){return y({...e,rlsMode:t})}}),ee=e=>{for(const[t,n]of Object.entries(e))for(const r of[...n.aggregateIndexes,...n.rankIndexes])r.on===""&&(r.on=t)},te=(e,t,n)=>{for(const r of Object.values(t)){const a=e[r.on];if(!a)throw new i("INTERNAL",`defineAggregateIndex "${r.name}": unknown table "${r.on}"`);a.aggregateIndexes.push(r)}for(const r of Object.values(n)){const a=e[r.on];if(!a)throw new i("INTERNAL",`defineRankIndex "${r.name}": unknown table "${r.on}"`);a.rankIndexes.push(r)}},ne=e=>{if(e.cursor)return"cursor";if(e.reconcileEveryMs!==void 0)return"reconcileEveryMs";if(e.softDeleteColumn!==void 0)return"softDeleteColumn"},re=(e,t)=>{const n=t.mode==="incremental";if(t.mode!==void 0&&t.mode!=="full-pull"&&!n)throw new i("INTERNAL",`defineSchema: table "${e}" uses \`mode: ${JSON.stringify(t.mode)}\` — supported modes are "full-pull" (default) and "incremental".`);if(!n){const r=ne(t);if(r)throw new i("INTERNAL",`defineSchema: table "${e}" sets \`${r}\` but is not \`mode: "incremental"\` — that knob only applies to incremental ingest. Set \`mode: "incremental"\` or remove \`${r}\`.`);return}if(!t.cursor?.column||!t.cursor.query)throw new i("INTERNAL",`defineSchema: table "${e}" is \`mode: "incremental"\` but has no \`cursor\` — add \`cursor: { column: "updated_at", query: "… WHERE … > $N" }\` binding the watermark as the trailing parameter.`);if(t.reconcileEveryMs===void 0&&t.softDeleteColumn===void 0)throw new i("INTERNAL",`defineSchema: table "${e}" is \`mode: "incremental"\` with no delete-visibility path — an incremental pull never sees upstream deletes, so it would accumulate phantom rows. Add \`reconcileEveryMs\` (a periodic full-pull sweep) or \`softDeleteColumn\` (an upstream tombstone column).`)},ae=e=>{for(const[t,n]of Object.entries(e)){const r=n.externalSource;if(r){if(n.shardMode.kind==="global")throw new i("INTERNAL",`defineSchema: table "${t}" cannot be both .source() and .global() — a sourced table materializes into a shard DO's SQLite, a global table lives in the external tier`);if(n.shardMode.kind==="shardBy"&&!r.tenantBy)throw new i("INTERNAL",`defineSchema: sourced + .shardBy() table "${t}" needs a \`tenantBy\` mapper — without it every tenant's DO would run the same unscoped query and replicate the whole multitenant table (a cross-tenant leak). Add \`tenantBy: (shardKey) => [shardKey]\` binding the shard key into the query's parameters.`);re(t,r)}}},oe=["_commitSeq","_creationTime","_id"],_="_commitSeq",se=new Set(oe),x=(e,t,n,r)=>{if(!(se.has(n)||n in r.shape))throw new i("INTERNAL",`defineSchema: table "${e}" index "${t}" names column "${n}" which is not in the table's shape`)},v=(e,t,n,r)=>{const a=new Set;for(const d of n){if(a.has(d.name))throw new i("INTERNAL",`defineSchema: table "${e}" declares ${t} "${d.name}" more than once`);a.add(d.name),r(d)}},K=e=>{for(const[t,n]of Object.entries(e))v(t,"index",n.indexes,r=>{for(const a of r.fields)x(t,r.name,a,n)}),v(t,"rank index",n.rankIndexes,r=>{for(const a of r.sortBy)x(t,r.name,a.field,n);for(const a of r.partitionBy??[])x(t,r.name,a,n)}),v(t,"geo index",n.geoIndexes,r=>{x(t,r.name,r.field,n)})},S=(e,t,n)=>{if(e.length===0)return;const r={};for(const a of e)r[t(a)]=n(a);return r},ie=e=>{const t=new Set(e.sortBy.map(n=>n.field));for(const n of e.partitionBy??[])t.add(n);return[...t]},Ne=e=>{const t={};for(const[n,r]of Object.entries(e.tables)){const a=S(r.geoIndexes,c=>c.name,c=>[c.field]),d=S(r.indexes,c=>c.name,c=>c.fields),u=S(r.rankIndexes,c=>c.name,ie);(a||d||u)&&(t[n]={...a?{geo:a}:{},...d?{index:d}:{},...u?{rank:u}:{}})}return t},de=e=>{for(const[t,n]of Object.entries(e)){if(!n.memoryMode)continue;const a=[[n.shardMode.kind==="global",".global() — those rows live in D1, which this shard does not own and cannot clear"],[n.commitOrderedMode===!0,".commitOrdered() — the counter resets with the table, so the sequence would restart and a consumer's cursor would silently skip everything after it"],[n.externalSource!==void 0,".source() — the table is materialized by the ingest loop, so wiping it on every eviction would fight the puller"],[n.searchIndexes.length>0,".searchIndex() — the FTS shadow is a separate table that clearing the rows would leave stale"],[n.geoIndexes.length>0,".geoIndex() — the geohash companion is a separate table that clearing the rows would leave stale"],[n.aggregateIndexes.length>0,".aggregateIndex() — the counter companion is a separate table that clearing the rows would leave stale"],[n.rankIndexes.length>0,".rankIndex() — the rank companion is a separate table that clearing the rows would leave stale"],[n.vectorIndexes.length>0,".vectorize() — vectors live in an external index that a shard restart cannot clear"]].find(([d])=>d)?.[1];if(a!==void 0)throw new i("INTERNAL",`defineSchema: table "${t}" is both .memory() and ${a}. Plain .index() is supported; SQLite maintains it through the DELETE.`)}},le=e=>{for(const[t,n]of Object.entries(e))if(n.shardMode.kind==="global"){for(const[r,a]of Object.entries(n.shape))if(P(a)==="bigint")throw new i("INTERNAL",`defineSchema: table "${t}" is .global() and column "${r}" is v.bigint(). A global (D1/Hyperdrive) table stores a bigint as decimal TEXT, which SQL compares lexicographically — "100" sorts before "25" — so \`orderBy\`, range filters and \`aggregate\` on this column would silently return wrong results. Use v.number() if the value fits a double, or v.string() if you only need equality.`)}},ce=e=>{for(const[t,n]of Object.entries(e))if(n.dropStalePatchesMode===!0&&n.shardMode.kind==="global")throw new i("INTERNAL",`defineSchema: table "${t}" is both .global() and .dropStalePatches(). The stale check reads the caller's baseline out of the shard's \`__cdc_log\`, which a global (D1/Hyperdrive) table has no entries in — so every patch would read as "no baseline" and apply unchanged. Drop one of the two.`)},ue=e=>{for(const[t,n]of Object.entries(e))if(n.ttlPolicy!==void 0&&n.shardMode.kind==="global")throw new i("INTERNAL",`defineSchema: ${Y(t)}`)},H=(e,t)=>{const n=[...Object.entries(e).flatMap(([r,a])=>a.vectorIndexes.map(d=>[r,d.name])),...Object.entries(t).map(([r,a])=>[a.table,r])];for(const[r,a]of n)if(e[r]?.shardMode.kind==="global")throw new i("INTERNAL",`defineSchema: ${J(r,a)}`)},he=e=>{for(const[t,n]of Object.entries(e)){if(n.commitOrderedMode){if(n.shardMode.kind==="global")throw new i("INTERNAL",`defineSchema: table "${t}" is both .global() and .commitOrdered(). \`_commitSeq\` is allocated inside the shard's write transaction, which a global (D1/Hyperdrive) table does not share — so the stamp would carry no commit-ordering guarantee. Drop one of the two.`);continue}for(const r of n.indexes)if(r.fields.includes(_))throw new i("INTERNAL",`defineSchema: table "${t}" index "${r.name}" names "${_}", but the table is not .commitOrdered() — no row carries that field, so the index would never match. Add .commitOrdered(), or drop the column from the index.`)}},Q=e=>{he(e),ce(e),le(e),ue(e),de(e)},ve=(e,t={},n={},r={})=>(ee(e),te(e,n,r),ae(e),Q(e),H(e,t),K(e),y({tables:e,vectorIndexes:t})),I=(e,t)=>`${e}_${t}`,k=(e,t,n)=>n.has(e)?I(t,e):e,fe=(e,t,n,r)=>{const a=I(t,r),d=f=>f===""?a:k(f,t,n),u={};for(const[f,b]of Object.entries(e.relationMap))u[f]={...b,table:k(b.table,t,n)};const c=e.aggregateIndexes.map(f=>({...f,on:d(f.on)})),h=e.rankIndexes.map(f=>({...f,on:d(f.on)}));return{...e,aggregateIndexes:c,rankIndexes:h,relationMap:u}},Se=(e,t)=>{if(!e)throw new i("INTERNAL","defineSchemaExtension: `key` is required and must be a non-empty string");return{key:e,tables:t.tables,...t.vectorIndexes?{vectorIndexes:t.vectorIndexes}:{}}},me=((e,t)=>{if(!e)throw new i("INTERNAL","definePlugin: `key` is required and must be a non-empty string");if(t.extension&&t.extension.key!==e)throw new i("INTERNAL",`definePlugin("${e}"): extension key "${t.extension.key}" does not match plugin key`);return{key:e,...t.extension?{extension:t.extension}:{},...t.middleware?{middleware:t.middleware}:{}}}),ke=(e,t)=>({...me(e,{...t.extension?{extension:t.extension}:{},...t.middleware?{middleware:t.middleware}:{}}),functions:t.functions??{}}),z=(e,t)=>{const{key:n}=t,r=new Set(Object.keys(t.tables)),a={...e.tables};for(const[u,c]of Object.entries(t.tables)){const h=I(n,u);if(Object.hasOwn(a,h))throw new i("INTERNAL",`defineSchema(...).extend("${n}"): table "${h}" already exists in the base schema — another extension with the same key already contributed it`);a[h]=fe(c,n,r,u)}const d={...e.vectorIndexes};if(t.vectorIndexes)for(const[u,c]of Object.entries(t.vectorIndexes)){const h=I(n,u);if(Object.hasOwn(d,h))throw new i("INTERNAL",`defineSchema(...).extend("${n}"): vector index "${h}" already exists in the base schema — another extension with the same key already contributed it`);d[h]={...c,table:k(c.table,n,r)}}return K(a),Q(a),H(a,d),{rlsMode:e.rlsMode,tables:a,vectorIndexes:d}},Ee=(e,t)=>{let n=e;for(const r of t)r.extension&&(n=z(n,r.extension));return n},$e=e=>{const t=e.map(n=>n.middleware).filter(n=>n!==void 0);return V(t)};export{ke as a,me as b,$e as c,Ie as d,pe as e,ve as f,Se as g,xe as h,ye as i,Ne as j,Ee as k,K as l,z as m,Q as n,H as v};

package/dist/packem_shared/rls-CpSeGhdp.mjs

@@ -1 +0,0 @@
-import"./wire-codec-CZ4obM6q.mjs";import"./bindOrm-D_hFUjmr.mjs";import{e as i,g as m,i as l,b as d,m as p,d as n,f as c,a as h,r as u}from"./middleware-DAVx_tP1.mjs";import"./policy-tag-V0lqFzgS.mjs";import"./allowAll-DkRAgItV.mjs";export{i as computeReadBaseWhere,m as evaluateWrite,l as indexRolePermissions,d as isFacadeEntry,p as matchesWhere,n as readIdentityRoles,c as resolveCan,h as resolvePolicyAuth,u as rls};