@lunora/server 1.0.0-alpha.2 → 1.0.0-alpha.200

package/dist/packem_shared/wire-codec-CZ4obM6q.mjs

@@ -0,0 +1 @@
+const m=e=>{let t="";for(let o=0;o<e.length;o+=32768)t+=String.fromCharCode(...e.subarray(o,o+32768));return btoa(t)},A=e=>{const t=atob(e),c=new Uint8Array(t.length);for(let o=0;o<t.length;o+=1)c[o]=t.codePointAt(o)??0;return c},i="$lunora.wire$";const w="__proto__",g={BigInt64Array,BigUint64Array,Float32Array,Float64Array,Int8Array,Int16Array,Int32Array,Uint8Array,Uint8ClampedArray,Uint16Array,Uint32Array},p={Error,EvalError,RangeError,ReferenceError,SyntaxError,TypeError,URIError},l=e=>{if(e===null||typeof e!="object")return!1;const t=Object.getPrototypeOf(e);return t===null||t===Object.prototype},u=(e,t=0)=>{if(t>64)throw new RangeError("wire-codec: value nesting exceeds the 64-level limit");if(e===void 0)return[i,"undefined"];if(e===null)return null;const c=typeof e;if(c==="bigint"){const r=e.toString();if(r.length>1024)throw new RangeError("wire-codec: over-long bigint (max 1024 digits)");return[i,"bigint",r]}if(c==="number"){const r=e;return Number.isNaN(r)?[i,"nan"]:r===1/0?[i,"inf"]:r===-1/0?[i,"-inf"]:r}if(c!=="object")return e;if(e instanceof Date)return[i,"date",u(e.getTime(),t+1)];if(e instanceof Error){const r=e,n=u(Object.fromEntries(Object.keys(r).map(a=>[a,r[a]])),t+1),s=[i,"error",String(r.name),String(r.message),n];return r.cause!==void 0&&s.push(u(r.cause,t+1)),s}if(e instanceof URL)return[i,"url",e.href];if(e instanceof Map)return[i,"map",[...e.entries()].map(([r,n])=>[u(r,t+1),u(n,t+1)])];if(e instanceof Set)return[i,"set",[...e].map(r=>u(r,t+1))];if(e instanceof ArrayBuffer)return[i,"bytes",m(new Uint8Array(e)),"ArrayBuffer"];if(ArrayBuffer.isView(e)){const r=e,n=r.constructor.name,s=new Uint8Array(r.buffer,r.byteOffset,r.byteLength);return n==="Uint8Array"?[i,"bytes",m(s)]:[i,"bytes",m(s),n]}if(Array.isArray(e)){const r=e.map(n=>u(n,t+1));return r.length>0&&r[0]===i?[i,"arr",r]:r}if(!l(e)){const r=e.constructor?.name??"value";throw new TypeError(`wire-codec: cannot encode a ${r} over the Lunora wire — only plain objects, arrays, and the supported built-ins (Date, Error, URL, Map, Set, ArrayBuffer/typed arrays, bigint) round-trip`)}const o=e,f={};for(const r of Object.keys(o)){const n=o[r];if(n===void 0)continue;const s=u(n,t+1);r===w?Object.defineProperty(f,r,{configurable:!0,enumerable:!0,value:s,writable:!0}):f[r]=s}return f},y=(e,t=0)=>{if(t>64)throw new RangeError("wire-codec: value nesting exceeds the 64-level limit");if(e===null||typeof e!="object")return e;if(Array.isArray(e)){if(e[0]===i)switch(e[1]){case"-inf":return-1/0;case"arr":return e[2].map(r=>y(r,t+1));case"bigint":{const r=e[2];if(typeof r!="string"||r.length>1024||!/^-?\d+$/.test(r))throw new RangeError("wire-codec: invalid or over-long bigint (max 1024 digits)");return BigInt(r)}case"date":{const r=y(e[2],t+1);if(typeof r!="number")throw new TypeError("wire-codec: malformed date — epoch must be a number");return new Date(r)}case"map":{const r=e[2];return new Map(r.map(n=>{if(!Array.isArray(n)||n.length!==2)throw new TypeError("wire-codec: malformed map entry — expected a [key, value] pair");return[y(n[0],t+1),y(n[1],t+1)]}))}case"set":return new Set(e[2].map(r=>y(r,t+1)));case"url":{const r=e[2];if(typeof r!="string")throw new TypeError("wire-codec: malformed url — href must be a string");return new URL(r)}case"error":{const r=e[2],n=e[3];if(typeof r!="string"||typeof n!="string")throw new TypeError("wire-codec: malformed error — name and message must be strings");const s=(Object.hasOwn(p,r)?p[r]:void 0)??Error,a=new s(n);a.name!==r&&Object.defineProperty(a,"name",{configurable:!0,value:r,writable:!0});const b=y(e[4],t+1);if(b===null||typeof b!="object"||Array.isArray(b))throw new TypeError("wire-codec: malformed error — props must be an object");for(const d of Object.keys(b))d===w?Object.defineProperty(a,d,{configurable:!0,enumerable:!0,value:b[d],writable:!0}):a[d]=b[d];return e.length>5&&Object.defineProperty(a,"cause",{configurable:!0,value:y(e[5],t+1),writable:!0}),a}case"bytes":{const r=e[2];if(typeof r!="string")throw new TypeError("wire-codec: malformed bytes — payload must be a base64 string");const n=A(r);if(m(n)!==r)throw new TypeError("wire-codec: malformed bytes — payload must be canonical padded base64");const s=e[3]??"Uint8Array";if(s==="ArrayBuffer")return n.buffer.byteLength===n.byteLength?n.buffer:n.slice().buffer;const a=Object.hasOwn(g,s)?g[s]:void 0;return a?new a(n.slice().buffer):n}case"inf":return 1/0;case"nan":return Number.NaN;case"undefined":return;default:return e.map(r=>y(r,t+1))}return e.map(f=>y(f,t+1))}const c=e,o={};for(const f of Object.keys(c)){const r=y(c[f],t+1);f===w?Object.defineProperty(o,f,{configurable:!0,enumerable:!0,value:r,writable:!0}):o[f]=r}return o},E=(e,t,c)=>{try{return u(c)}catch(o){throw new TypeError(`${e}: cannot encode args for '${t}' — ${o instanceof Error?o.message:String(o)}`,o instanceof Error?{cause:o}:void 0)}};export{E as a,y as d,u as e,l as i};

package/dist/rls/testing.d.mts

@@ -1,48 +1,56 @@
-import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-DmvyEMD6.mjs";
+import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-B7FLdYUD.mjs";
 import "../data-model.mjs";
 /**
-* The slice of a request identity a policy reads. Mirrors the
-* `PolicyContext.auth` shape the middleware builds at request time — every
-* field is optional and defaults the same way the middleware defaults it
-* (`userId`/`identity` → `null`, `roles` → `[]`).
-*/
+ * The slice of a request identity a policy reads. Mirrors the
+ * `PolicyContext.auth` shape the middleware builds at request time — every
+ * field is optional and defaults the same way the middleware defaults it
+ * (`userId`/`identity` → `null`, `roles` → the `roles` claim on `identity`).
+ *
+ * There is deliberately NO separate `roles` field: `auth.roles` is derived from
+ * the identity claims by the same `readIdentityRoles` the middleware uses, so
+ * the harness cannot set up a world the runtime is unable to produce. Give a
+ * role-branched policy its roles the way production does —
+ * `.as({ identity: { roles: ["admin"] }, userId: "u1" })`.
+ */
 interface TestIdentity {
-  /** Raw identity claims a policy may branch on (`auth.identity.email`, …). */
+  /**
+   * Raw identity claims a policy may branch on (`auth.identity.email`, …).
+   * The `roles` claim (a `string[]` or a comma-separated string) is what
+   * populates `auth.roles` and backs `auth.can(...)`.
+   */
   identity?: Record<string, unknown> | null;
-  /** Role labels the request carries; resolved to permissions via the harness `roles` registry. */
-  roles?: ReadonlyArray<string>;
   /** The caller id (`auth.userId`); `null`/omitted is the anonymous caller. */
   userId?: null | string;
 }
 /** Options for {@link expectPolicy}. */
 interface ExpectPolicyOptions<Context = unknown> {
   /**
-  * The procedure context a policy reads via `ctx` (e.g. `ctx.orgId`). Held
-  * for the whole harness; pass a fresh `expectPolicy(..., { ctx })` for a
-  * different context. Defaults to an empty object.
-  */
+   * The procedure context a policy reads via `ctx` (e.g. `ctx.orgId`). Held
+   * for the whole harness; pass a fresh `expectPolicy(..., { ctx })` for a
+   * different context. Defaults to an empty object.
+   */
   ctx?: Context;
   /**
-  * Role→permission grants backing `auth.can(...)` — the same registry passed
-  * to `rls(policies, { roles })`. A role not listed here grants nothing, so
-  * `can(...)` fails closed exactly as it does in production.
-  */
+   * Role→permission grants backing `auth.can(...)` — the same registry passed
+   * to `rls(policies, { roles })`. A role not listed here grants nothing, so
+   * `can(...)` fails closed exactly as it does in production.
+   */
   roles?: ReadonlyArray<Role>;
 }
 /** A harness bound to one identity; answers can/cannot for an `(op, table, row)`. */
 interface BoundPolicyAssertion {
   /**
-  * Would this identity be **allowed** the operation on `row`?
-  *
-  * - `read` — is `row` visible? `true` when the table has no read policy (unrestricted), or when the effective read `baseWhere` matches `row`.
-  * - `insert` — is the candidate `row` allowed by the insert policies?
-  * - `update` / `delete` — is the pre-write `row` allowed? For `update` pass `nextRow` to also assert the post-image (WITH CHECK) — a policy can't be satisfied by the old row while the patch reassigns it to another tenant.
-  *
-  * A table with **no** policy in the list is unguarded → always `true`
-  * (mirrors the middleware passing such tables through unwrapped). A table
-  * that participates but declares no policy for the write `op` denies
-  * (default-DENY), exactly as the middleware does.
-  */
+   * Would this identity be **allowed** the operation on `row`?
+   *
+   * - `read` — is `row` visible? `true` when the table has no read policy (unrestricted), or when the effective read `baseWhere` matches `row`.
+   * - `insert` — is the candidate `row` allowed by the insert policies?
+   * - `update` / `delete` — is the pre-write `row` allowed? For `update` pass `nextRow` to also assert the post-image (WITH CHECK) — a policy can't be satisfied by the old row while the patch reassigns it to another tenant.
+   *
+   * A table with **no** policy in the list is unguarded → always `true`
+   * (mirrors the middleware passing such tables through unwrapped). A table
+   * that participates but declares no policy for the write `op` denies
+   * (default-DENY), exactly as the middleware does.
+   */
   can: (op: PolicyOperation, table: string, row?: Record<string, unknown>, nextRow?: Record<string, unknown>) => boolean;
   /** Negation of {@link BoundPolicyAssertion.can} — reads more naturally in a denial test. */
   cannot: (op: PolicyOperation, table: string, row?: Record<string, unknown>, nextRow?: Record<string, unknown>) => boolean;
@@ -53,11 +61,11 @@ interface PolicyAssertion {
   as: (identity?: TestIdentity | null) => BoundPolicyAssertion;
 }
 /**
-* Build an in-process assertion harness over a policy set. Reuses the `rls()`
-* middleware's own evaluation primitives, so an assertion is faithful to
-* request-time behaviour by construction.
-* @param policies the policy list, typically from `definePolicies([...])`.
-* @param options role registry + procedure `ctx` (see {@link ExpectPolicyOptions}).
-*/
+ * Build an in-process assertion harness over a policy set. Reuses the `rls()`
+ * middleware's own evaluation primitives, so an assertion is faithful to
+ * request-time behaviour by construction.
+ * @param policies the policy list, typically from `definePolicies([...])`.
+ * @param options role registry + procedure `ctx` (see {@link ExpectPolicyOptions}).
+ */
 declare const expectPolicy: <Context = unknown>(policies: ReadonlyArray<Policy<Context>>, options?: ExpectPolicyOptions<Context>) => PolicyAssertion;
 export { BoundPolicyAssertion, ExpectPolicyOptions, PolicyAssertion, TestIdentity, expectPolicy };

package/dist/rls/testing.d.ts

@@ -1,48 +1,56 @@
-import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-BDY0FYHK.js";
+import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-BCtjbIzl.js";
 import "../data-model.js";
 /**
-* The slice of a request identity a policy reads. Mirrors the
-* `PolicyContext.auth` shape the middleware builds at request time — every
-* field is optional and defaults the same way the middleware defaults it
-* (`userId`/`identity` → `null`, `roles` → `[]`).
-*/
+ * The slice of a request identity a policy reads. Mirrors the
+ * `PolicyContext.auth` shape the middleware builds at request time — every
+ * field is optional and defaults the same way the middleware defaults it
+ * (`userId`/`identity` → `null`, `roles` → the `roles` claim on `identity`).
+ *
+ * There is deliberately NO separate `roles` field: `auth.roles` is derived from
+ * the identity claims by the same `readIdentityRoles` the middleware uses, so
+ * the harness cannot set up a world the runtime is unable to produce. Give a
+ * role-branched policy its roles the way production does —
+ * `.as({ identity: { roles: ["admin"] }, userId: "u1" })`.
+ */
 interface TestIdentity {
-  /** Raw identity claims a policy may branch on (`auth.identity.email`, …). */
+  /**
+   * Raw identity claims a policy may branch on (`auth.identity.email`, …).
+   * The `roles` claim (a `string[]` or a comma-separated string) is what
+   * populates `auth.roles` and backs `auth.can(...)`.
+   */
   identity?: Record<string, unknown> | null;
-  /** Role labels the request carries; resolved to permissions via the harness `roles` registry. */
-  roles?: ReadonlyArray<string>;
   /** The caller id (`auth.userId`); `null`/omitted is the anonymous caller. */
   userId?: null | string;
 }
 /** Options for {@link expectPolicy}. */
 interface ExpectPolicyOptions<Context = unknown> {
   /**
-  * The procedure context a policy reads via `ctx` (e.g. `ctx.orgId`). Held
-  * for the whole harness; pass a fresh `expectPolicy(..., { ctx })` for a
-  * different context. Defaults to an empty object.
-  */
+   * The procedure context a policy reads via `ctx` (e.g. `ctx.orgId`). Held
+   * for the whole harness; pass a fresh `expectPolicy(..., { ctx })` for a
+   * different context. Defaults to an empty object.
+   */
   ctx?: Context;
   /**
-  * Role→permission grants backing `auth.can(...)` — the same registry passed
-  * to `rls(policies, { roles })`. A role not listed here grants nothing, so
-  * `can(...)` fails closed exactly as it does in production.
-  */
+   * Role→permission grants backing `auth.can(...)` — the same registry passed
+   * to `rls(policies, { roles })`. A role not listed here grants nothing, so
+   * `can(...)` fails closed exactly as it does in production.
+   */
   roles?: ReadonlyArray<Role>;
 }
 /** A harness bound to one identity; answers can/cannot for an `(op, table, row)`. */
 interface BoundPolicyAssertion {
   /**
-  * Would this identity be **allowed** the operation on `row`?
-  *
-  * - `read` — is `row` visible? `true` when the table has no read policy (unrestricted), or when the effective read `baseWhere` matches `row`.
-  * - `insert` — is the candidate `row` allowed by the insert policies?
-  * - `update` / `delete` — is the pre-write `row` allowed? For `update` pass `nextRow` to also assert the post-image (WITH CHECK) — a policy can't be satisfied by the old row while the patch reassigns it to another tenant.
-  *
-  * A table with **no** policy in the list is unguarded → always `true`
-  * (mirrors the middleware passing such tables through unwrapped). A table
-  * that participates but declares no policy for the write `op` denies
-  * (default-DENY), exactly as the middleware does.
-  */
+   * Would this identity be **allowed** the operation on `row`?
+   *
+   * - `read` — is `row` visible? `true` when the table has no read policy (unrestricted), or when the effective read `baseWhere` matches `row`.
+   * - `insert` — is the candidate `row` allowed by the insert policies?
+   * - `update` / `delete` — is the pre-write `row` allowed? For `update` pass `nextRow` to also assert the post-image (WITH CHECK) — a policy can't be satisfied by the old row while the patch reassigns it to another tenant.
+   *
+   * A table with **no** policy in the list is unguarded → always `true`
+   * (mirrors the middleware passing such tables through unwrapped). A table
+   * that participates but declares no policy for the write `op` denies
+   * (default-DENY), exactly as the middleware does.
+   */
   can: (op: PolicyOperation, table: string, row?: Record<string, unknown>, nextRow?: Record<string, unknown>) => boolean;
   /** Negation of {@link BoundPolicyAssertion.can} — reads more naturally in a denial test. */
   cannot: (op: PolicyOperation, table: string, row?: Record<string, unknown>, nextRow?: Record<string, unknown>) => boolean;
@@ -53,11 +61,11 @@ interface PolicyAssertion {
   as: (identity?: TestIdentity | null) => BoundPolicyAssertion;
 }
 /**
-* Build an in-process assertion harness over a policy set. Reuses the `rls()`
-* middleware's own evaluation primitives, so an assertion is faithful to
-* request-time behaviour by construction.
-* @param policies the policy list, typically from `definePolicies([...])`.
-* @param options role registry + procedure `ctx` (see {@link ExpectPolicyOptions}).
-*/
+ * Build an in-process assertion harness over a policy set. Reuses the `rls()`
+ * middleware's own evaluation primitives, so an assertion is faithful to
+ * request-time behaviour by construction.
+ * @param policies the policy list, typically from `definePolicies([...])`.
+ * @param options role registry + procedure `ctx` (see {@link ExpectPolicyOptions}).
+ */
 declare const expectPolicy: <Context = unknown>(policies: ReadonlyArray<Policy<Context>>, options?: ExpectPolicyOptions<Context>) => PolicyAssertion;
 export { BoundPolicyAssertion, ExpectPolicyOptions, PolicyAssertion, TestIdentity, expectPolicy };

package/dist/rls/testing.mjs

@@ -1,49 +1 @@
-import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-BDKRbMCA.mjs';
-
-const expectPolicy = (policies, options = {}) => {
-  const rolePermissions = indexRolePermissions(options.roles);
-  const context = options.ctx ?? {};
-  return {
-    as: (identity) => {
-      const auth = identity ?? {};
-      const roles = auth.roles ?? [];
-      const granted = /* @__PURE__ */ new Set();
-      for (const roleName of roles) {
-        for (const name of rolePermissions.get(roleName) ?? []) {
-          granted.add(name);
-        }
-      }
-      const baseContext = {
-        auth: {
-          can: (permission) => granted.has(permissionName(permission)),
-          // eslint-disable-next-line unicorn/no-null -- PolicyContext.auth.identity is a public `… | null` type, mirroring the middleware
-          identity: auth.identity ?? null,
-          roles,
-          // eslint-disable-next-line unicorn/no-null -- PolicyContext.auth.userId is a public `null | string` type, mirroring the middleware
-          userId: auth.userId ?? null
-        },
-        ctx: context
-      };
-      const can = (op, table, row, nextRow) => {
-        const tablePolicies = policies.filter((policy) => policy.table === table);
-        if (tablePolicies.length === 0) {
-          return true;
-        }
-        if (op === "read") {
-          if (!tablePolicies.some((policy) => policy.on === "read")) {
-            return true;
-          }
-          const baseWhere = computeReadBaseWhere(tablePolicies, baseContext);
-          return baseWhere === void 0 || matchesWhere(row ?? {}, baseWhere);
-        }
-        return evaluateWrite(tablePolicies, op, { ...baseContext, row }, nextRow);
-      };
-      return {
-        can,
-        cannot: (op, table, row, nextRow) => !can(op, table, row, nextRow)
-      };
-    }
-  };
-};
-
-export { expectPolicy };
+import{i as y,e as P,g as W,f as v,m as I,h as R}from"../packem_shared/middleware-DbhB1jRk.mjs";const p=(m,o={})=>{const h=y(o.roles),x=o.ctx??{};return{as:f=>{const c=f??{},i=c.identity??null,l=P(i),u={auth:{can:W(l,h),identity:i,roles:l,userId:c.userId??null},ctx:x},d=(e,r,t,a)=>{const s=m.filter(n=>n.table===r);if(s.length===0)return!0;if(e==="read"){if(!s.some(b=>b.on==="read"))return!0;const n=v(s,u);return n===void 0||I(t??{},n)}return R(s,e,{...u,row:t},a)};return{can:d,cannot:(e,r,t,a)=>!d(e,r,t,a)}}}};export{p as expectPolicy};