@lunora/server 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/packem_shared/{defineMigration-CAJLr6fx.mjs → defineMigration-Hx01yIht.mjs}

@@ -1,6 +1,8 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const defineMigration = (definition) => {
   if (definition.id.trim() === "") {
-    throw new Error("defineMigration: `id` must be a non-empty string");
+    throw new LunoraError$1("INTERNAL", "defineMigration: `id` must be a non-empty string");
   }
   return { __lunoraMigration: true, ...definition };
 };

package/dist/packem_shared/defineMutator-EIXAWhs9.mjs

@@ -0,0 +1,11 @@
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+
+const defineMutator = (definition) => {
+  const handler = async (context, rawArgs) => {
+    const parsed = validateArgs(definition.args ?? {}, rawArgs);
+    return definition.server(context, parsed);
+  };
+  return { __lunoraMutator: true, ...definition, handler, kind: "mutation" };
+};
+
+export { defineMutator };

package/dist/packem_shared/defineShape-C5scNOrf.mjs

@@ -0,0 +1,18 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+
+const defineShape = (definition) => {
+  if (definition.table.trim() === "") {
+    throw new LunoraError$1("INTERNAL", "defineShape: `table` must be a non-empty string");
+  }
+  if (definition.columns?.length === 0) {
+    throw new LunoraError$1("INTERNAL", "defineShape: `columns` must list at least one column when provided");
+  }
+  const compileWhere = (context, rawArgs) => {
+    const parsed = validateArgs(definition.args ?? {}, rawArgs);
+    return definition.where(context, parsed);
+  };
+  return { __lunoraShape: true, ...definition, compileWhere };
+};
+
+export { defineShape };

package/dist/packem_shared/{defineStorageRule-qu0mpilX.mjs → defineStorageRule-B5nL4Z1P.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const defineStorageRule = (input) => {
   return { bucket: input.bucket, on: input.on, prefix: input.prefix, when: input.when };
 };
@@ -7,7 +9,8 @@ const defineStorageRules = (rules) => {
     const key = JSON.stringify([rule.bucket, rule.on, rule.prefix]);
     const whens = seenWhenByKey.get(key) ?? /* @__PURE__ */ new Set();
     if (whens.has(rule.when)) {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `defineStorageRules: duplicate rule for (bucket "${rule.bucket}", on "${rule.on}"${rule.prefix === void 0 ? "" : `, prefix "${rule.prefix}"`}) — the same decision function is registered more than once. Multiple distinct rules per (bucket, on) are allowed (they OR); remove the duplicate.`
       );
     }

package/dist/packem_shared/functions-Di9FUNkf.mjs

@@ -0,0 +1,5 @@
+import { parseValidatorMap } from '@lunora/values';
+
+const validateArgs = (validators, args) => parseValidatorMap(validators, args, "args");
+
+export { validateArgs as v };

package/dist/packem_shared/{httpAction-B7FYUEgr.mjs → httpAction-DCXoYPIk.mjs}

@@ -1,6 +1,7 @@
+import { toErrorBody } from '@lunora/errors';
 import { parseValidatorMap, ValidationError } from '@lunora/values';
 import { Hono } from 'hono';
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
 
 const httpAction = (handler) => async (c) => handler(c.get("lunora"), c.req.raw);
 const httpRouter = () => {
@@ -109,7 +110,11 @@ const errorResponse = (error) => {
     return Response.json({ code: "BAD_REQUEST", error: error.message }, { status: 400 });
   }
   if (error instanceof LunoraError) {
-    return Response.json({ code: error.code, error: error.message }, { status: error.status });
+    const { body, redacted, status } = toErrorBody(error, { fallbackCode: "INTERNAL_SERVER_ERROR", redactedMessage: "Internal error" });
+    if (redacted) {
+      console.error("[lunora] http action error (redacted on the wire):", error);
+    }
+    return Response.json({ code: body.code, error: body.message }, { status });
   }
   throw error;
 };
@@ -121,18 +126,25 @@ const buildRouteHandler = (state, userHandler) => async (c) => {
     const body = Object.keys(state.body).length > 0 ? await parseBody(state.body, c) : {};
     const result = await userHandler({ body, ctx: context, params, searchParams });
     const payload = state.output ? applyOutput(state.output, result) : result;
-    return payload === void 0 ? new Response(null, { status: 204 }) : Response.json(payload);
+    const headers = {};
+    if (state.cacheControl) {
+      headers["cache-control"] = state.cacheControl;
+    }
+    if (state.cacheTag) {
+      headers["cache-tag"] = state.cacheTag;
+    }
+    if (state.vary) {
+      headers.vary = state.vary;
+    }
+    const hasCacheHeaders = Object.keys(headers).length > 0;
+    if (payload === void 0) {
+      return new Response(null, { headers: hasCacheHeaders ? headers : void 0, status: 204 });
+    }
+    return Response.json(payload, { headers: hasCacheHeaders ? headers : void 0 });
   } catch (error) {
     return errorResponse(error);
   }
 };
-const isLunoraErrorLike = (error) => {
-  if (!error || typeof error !== "object") {
-    return false;
-  }
-  const candidate = error;
-  return candidate.name === "LunoraError" && typeof candidate.code === "string" && typeof candidate.message === "string";
-};
 const sseFrame = (chunk, event) => {
   const data = JSON.stringify(chunk);
   const prefix = event ? `event: ${event}
@@ -193,39 +205,42 @@ const buildStreamHandler = (state, userHandler) => (
           }
           controller.enqueue(encoder.encode(sseFrame({}, "complete")));
         } catch (error) {
-          let payload;
-          if (isLunoraErrorLike(error)) {
-            payload = { code: error.code, message: error.message };
-          } else {
+          const { body, redacted } = toErrorBody(error, { fallbackCode: "INTERNAL_SERVER_ERROR", redactedMessage: "Internal error" });
+          if (redacted) {
             console.error("[lunora] unhandled stream handler error:", error);
-            payload = { code: "INTERNAL_SERVER_ERROR", message: "Internal error" };
           }
-          controller.enqueue(encoder.encode(sseFrame(payload, "error")));
+          controller.enqueue(encoder.encode(sseFrame({ code: body.code, message: body.message }, "error")));
         } finally {
           request.signal.removeEventListener("abort", onAbort);
           controller.close();
         }
       }
     });
-    return new Response(stream, {
-      headers: {
-        "cache-control": "no-cache, no-transform",
-        "content-type": "text/event-stream; charset=utf-8",
-        // Hint to proxies (including Cloudflare's own buffering layer)
-        // that this response must not be coalesced.
-        "x-accel-buffering": "no"
-      }
-    });
+    const headers = {
+      // SSE responses must stay uncacheable so proxies don't buffer or
+      // coalesce live frames. `cacheControl()` is intentionally ignored
+      // for stream() routes; `cacheTag`/`vary` are also omitted because
+      // they only make sense alongside a cacheable response.
+      "cache-control": "no-cache, no-transform",
+      "content-type": "text/event-stream; charset=utf-8",
+      // Hint to proxies (including Cloudflare's own buffering layer)
+      // that this response must not be coalesced.
+      "x-accel-buffering": "no"
+    };
+    return new Response(stream, { headers });
   }
 );
 const makeRouteBuilder = (state) => {
   return {
     body: (validators) => makeRouteBuilder({ ...state, body: { ...state.body, ...validators } }),
+    cacheControl: (value) => makeRouteBuilder({ ...state, cacheControl: value }),
+    cacheTag: (value) => makeRouteBuilder({ ...state, cacheTag: value }),
     handler: (userHandler) => buildRouteHandler(state, userHandler),
     output: (validator) => makeRouteBuilder({ ...state, output: validator }),
     params: (validators) => makeRouteBuilder({ ...state, params: { ...state.params, ...validators } }),
     searchParams: (validators) => makeRouteBuilder({ ...state, searchParams: { ...state.searchParams, ...validators } }),
-    stream: (userHandler) => buildStreamHandler(state, userHandler)
+    stream: (userHandler) => buildStreamHandler(state, userHandler),
+    vary: (value) => makeRouteBuilder({ ...state, vary: value })
   };
 };
 const makeRouteFactory = (method) => (path) => makeRouteBuilder({ body: {}, method, params: {}, path, searchParams: {} });
@@ -337,4 +352,4 @@ const serveStorageObject = async (context, key, request) => {
   });
 };
 
-export { httpAction, httpRoute, httpRouter, serveStorageObject };
+export { httpAction, httpRoute, httpRouter, isSafeHeaderValue, serveStorageObject };

package/dist/packem_shared/{initLunora-CATvPsVt.mjs → initLunora-sQUqaejx.mjs}

@@ -1,7 +1,6 @@
-import { parseValidatorMap } from '@lunora/values';
-import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
-
-const validateArgs = (validators, args) => parseValidatorMap(validators, args, "args");
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
+import { r as runMiddlewareChain } from './run-middleware-I6EiQfxL.mjs';
 
 const runMiddleware = (middlewares, baseContext) => runMiddlewareChain(middlewares, baseContext, (context) => context);
 const makeHandler = (args, middlewares, userHandler, output) => async (context, rawArgs) => {
@@ -35,16 +34,29 @@ const makeStreamHandler = (args, middlewares, userHandler) => (context, rawArgs,
     }
   })();
 };
+const collectRls = (middlewares) => {
+  const tags = [];
+  for (const middleware of middlewares) {
+    const tag = readRlsTag(middleware);
+    if (!tag) {
+      continue;
+    }
+    tags.push(tag);
+  }
+  return tags.length > 0 ? { tags } : void 0;
+};
 const makeBuilder = (kind, state, visibility) => {
   return {
     __lunoraProcedure: kind,
     ...visibility ? { __lunoraVisibility: visibility } : {},
     input: (validators) => makeBuilder(kind, { ...state, args: { ...state.args, ...validators } }, visibility),
     [kind]: (userHandler) => {
+      const rls = collectRls(state.middlewares);
       return {
         args: state.args,
         handler: makeHandler(state.args, state.middlewares, userHandler, state.output),
         kind,
+        ...rls ? { rls } : {},
         ...visibility ? { visibility } : {}
       };
     },
@@ -55,10 +67,12 @@ const makeBuilder = (kind, state, visibility) => {
     // unconditionally keeps the runtime free of per-kind branching.
     ...kind === "query" ? {
       stream: (userHandler) => {
+        const rls = collectRls(state.middlewares);
         return {
           args: state.args,
           handler: makeStreamHandler(state.args, state.middlewares, userHandler),
           kind: "stream",
+          ...rls ? { rls } : {},
           ...visibility ? { visibility } : {}
         };
       }

package/dist/packem_shared/{mask-Jc84C_hK.mjs → mask-BT1YgRbF.mjs}

@@ -1,5 +1,5 @@
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
-import { bindTableFacade, bindOrm } from './bindOrm-DCuyr46L.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-Bfgl7f-Q.mjs';
 
 const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
 const indexRolePermissions = (roles) => {
@@ -46,6 +46,29 @@ const maskRow = (row, columns, base) => {
 const maskPage = (page, columns, base) => {
   return { ...page, page: page.page.map((row) => maskRow(row, columns, base)) };
 };
+const assertIndexFieldsAllowed = (builderCallback, columns, tableName, method) => {
+  if (typeof builderCallback !== "function") {
+    return;
+  }
+  const referenced = /* @__PURE__ */ new Set();
+  const makeRecorder = () => /* @__PURE__ */ new Proxy(
+    {},
+    {
+      get: () => (field) => {
+        if (typeof field === "string") {
+          referenced.add(field);
+        }
+        return makeRecorder();
+      }
+    }
+  );
+  builderCallback(makeRecorder());
+  for (const field of referenced) {
+    if (field in columns) {
+      throw new LunoraError("MASK_UNSUPPORTED", `${method}() filtering "${tableName}" by masked column "${field}" is not supported`);
+    }
+  }
+};
 const isFacadeEntry = (value) => {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return false;
@@ -54,21 +77,27 @@ const isFacadeEntry = (value) => {
   return typeof candidate["findMany"] === "function" && typeof candidate["withSearchIndex"] === "function";
 };
 const wrapDatabase = (base, perTable, context) => {
-  const wrapReader = (reader, columns) => {
+  const wrapReader = (reader, columns, tableName) => {
     return {
       collect: async () => {
         const rows = await reader.collect();
         return rows.map((row) => maskRow(row, columns, context));
       },
+      // SECURITY (value oracle): the predicate must see the MASKED row, not
+      // the raw stored row — otherwise a caller can `.filter(d => d.ssn ===
+      // guess)` to read the value the mask hides. Masking before the
+      // predicate keeps filtering on non-masked columns working while
+      // redacting masked cells the predicate can observe.
       filter: (predicate) => wrapReader(
-        reader.filter((document) => predicate(document)),
-        columns
+        reader.filter((document) => predicate(maskRow(document, columns, context))),
+        columns,
+        tableName
       ),
       first: async () => {
         const row = await reader.first();
         return row ? maskRow(row, columns, context) : null;
       },
-      order: (direction) => wrapReader(reader.order(direction), columns),
+      order: (direction) => wrapReader(reader.order(direction), columns, tableName),
       paginate: async (options) => maskPage(await reader.paginate(options), columns, context),
       take: async (limit) => {
         const rows = await reader.take(limit);
@@ -78,8 +107,19 @@ const wrapDatabase = (base, perTable, context) => {
         const row = await reader.unique();
         return row ? maskRow(row, columns, context) : null;
       },
-      withIndex: (indexName, range) => wrapReader(reader.withIndex(indexName, range), columns),
-      withSearchIndex: (indexName, search) => wrapReader(reader.withSearchIndex(indexName, search), columns)
+      // SECURITY (value oracle): reject before delegating when the range /
+      // search references a masked column — an index range or search term
+      // over a masked column is the same value oracle as a masked-column
+      // `where`, so it must fail closed (see `assertIndexFieldsAllowed`).
+      // Reads over NON-masked columns pass through and still mask output.
+      withIndex: (indexName, range) => {
+        assertIndexFieldsAllowed(range, columns, tableName, "withIndex");
+        return wrapReader(reader.withIndex(indexName, range), columns, tableName);
+      },
+      withSearchIndex: (indexName, search) => {
+        assertIndexFieldsAllowed(search, columns, tableName, "withSearchIndex");
+        return wrapReader(reader.withSearchIndex(indexName, search), columns, tableName);
+      }
     };
   };
   const locate = async (id, expectedTable) => {
@@ -120,23 +160,63 @@ const wrapDatabase = (base, perTable, context) => {
       throw new LunoraError("MASK_UNSUPPORTED", `${method}() over masked column "${offending}" on "${tableName}" is not supported`);
     }
   };
+  const collectWhereFields = (where, into) => {
+    if (!where || typeof where !== "object" || Array.isArray(where)) {
+      return;
+    }
+    for (const [key, value] of Object.entries(where)) {
+      if (key === "AND" || key === "OR") {
+        if (Array.isArray(value)) {
+          for (const clause of value) {
+            collectWhereFields(clause, into);
+          }
+        }
+      } else if (key === "NOT") {
+        collectWhereFields(value, into);
+      } else if (!key.startsWith("__")) {
+        into.add(key);
+      }
+    }
+  };
+  const assertWhereAllowed = (tableName, where, method) => {
+    const columns = perTable.get(tableName);
+    if (!columns || where === void 0) {
+      return;
+    }
+    const referenced = /* @__PURE__ */ new Set();
+    collectWhereFields(where, referenced);
+    for (const field of referenced) {
+      if (field in columns) {
+        throw new LunoraError("MASK_UNSUPPORTED", `${method}() filtering "${tableName}" by masked column "${field}" is not supported`);
+      }
+    }
+  };
   const wrapped = {
     ...base,
     aggregate(tableName, options) {
       assertReductionAllowed(tableName, [options.field], "aggregate");
       return base.aggregate(tableName, options);
     },
+    count(tableName, whereOrArgs) {
+      const wrapper = whereOrArgs && typeof whereOrArgs === "object" && !Array.isArray(whereOrArgs) ? whereOrArgs : void 0;
+      const where = wrapper && ("where" in wrapper || "baseWhere" in wrapper || "restrictsCounts" in wrapper) ? wrapper.where : whereOrArgs;
+      assertWhereAllowed(tableName, where, "count");
+      return base.count(tableName, whereOrArgs);
+    },
     async findFirst(tableName, args) {
+      assertWhereAllowed(tableName, args?.where, "findFirst");
       const row = await base.findFirst(tableName, args);
       const columns = perTable.get(tableName);
       return row && columns ? maskRow(row, columns, context) : row;
     },
     async findFirstOrThrow(tableName, args) {
+      assertWhereAllowed(tableName, args?.where, "findFirstOrThrow");
       const row = await base.findFirstOrThrow(tableName, args);
       const columns = perTable.get(tableName);
       return columns ? maskRow(row, columns, context) : row;
     },
     async findMany(tableName, args) {
+      assertWhereAllowed(tableName, args?.where, "findMany");
       const page = await base.findMany(tableName, args);
       const columns = perTable.get(tableName);
       return columns ? maskPage(page, columns, context) : page;
@@ -156,7 +236,7 @@ const wrapDatabase = (base, perTable, context) => {
     query(tableName) {
       const reader = base.query(tableName);
       const columns = perTable.get(tableName);
-      return columns ? wrapReader(reader, columns) : reader;
+      return columns ? wrapReader(reader, columns, tableName) : reader;
     },
     async rankPage(tableName, indexName, options) {
       const page = await base.rankPage(tableName, indexName, options);

package/dist/packem_shared/policy-tag-DvpVH2tv.mjs

@@ -0,0 +1,13 @@
+const RLS_TAG = /* @__PURE__ */ Symbol.for("lunora.rls.middleware-policies");
+const tagRlsMiddleware = (middleware, tag) => {
+  Object.defineProperty(middleware, RLS_TAG, { configurable: true, enumerable: false, value: tag });
+  return middleware;
+};
+const readRlsTag = (middleware) => {
+  if (middleware === null || typeof middleware !== "function" && typeof middleware !== "object") {
+    return void 0;
+  }
+  return middleware[RLS_TAG];
+};
+
+export { readRlsTag as r, tagRlsMiddleware as t };

package/dist/packem_shared/{protectPublic-BjFkQ_Or.mjs → protectPublic-BlcGpiRc.mjs}

@@ -1,4 +1,4 @@
-import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
+import { r as runMiddlewareChain } from './run-middleware-I6EiQfxL.mjs';
 
 const protectPublic = (options) => {
   const chain = [options.rateLimit, options.captcha, ...options.use ?? []].filter(

package/dist/packem_shared/{rls-BDKRbMCA.mjs → rls-B_ZWgslr.mjs}

@@ -1,5 +1,6 @@
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
-import { bindTableFacade, bindOrm } from './bindOrm-DCuyr46L.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-Bfgl7f-Q.mjs';
+import { t as tagRlsMiddleware } from './policy-tag-DvpVH2tv.mjs';
 
 const DEFAULT_BATCH_LIMIT = 500;
 const assertBatchLimit = (count, limit, op) => {
@@ -244,7 +245,6 @@ const isFacadeEntry = (value) => {
   return typeof candidate["findMany"] === "function" && typeof candidate["withSearchIndex"] === "function";
 };
 const wrapDatabase = (base, raw, perTable, context) => {
-  const route = (tableName) => perTable.has(tableName) ? raw : base;
   const readBaseCache = /* @__PURE__ */ new Map();
   const readBase = (tableName) => {
     const cached = readBaseCache.get(tableName);
@@ -262,6 +262,7 @@ const wrapDatabase = (base, raw, perTable, context) => {
     readBaseCache.set(tableName, result);
     return result;
   };
+  const route = (tableName) => readBase(tableName).restricts ? raw : base;
   const relationReadFilter = (table) => readBase(table).baseWhere;
   const locateRow = async (id, expectedTable) => {
     if (raw.lookupById) {
@@ -299,7 +300,7 @@ const wrapDatabase = (base, raw, perTable, context) => {
       const nextRow = computeNextRow ? computeNextRow(located.row) : void 0;
       const writeOk = evaluateWrite(policies, op, { ...context, row: located.row }, nextRow);
       if (!writeOk) {
-        throw new LunoraError("FORBIDDEN", `${op} on "${located.tableName}" denied by policy`);
+        throw new LunoraError("FORBIDDEN", `${op} denied by policy`);
       }
     }
     return perform(raw);
@@ -324,7 +325,7 @@ const wrapDatabase = (base, raw, perTable, context) => {
         restrictsCounts: (args.restrictsCounts ?? false) || restricts
       });
     },
-    delete: (id, expectedTable) => gateById(id, "delete", (writer) => writer.delete(id, expectedTable), void 0, expectedTable),
+    delete: (id, expectedTable, options) => gateById(id, "delete", (writer) => writer.delete(id, expectedTable, options), void 0, expectedTable),
     async deleteMany(ids, options, expectedTable) {
       assertBatchLimit(ids.length, options?.limit, "deleteMany");
       for (const id of ids) {
@@ -332,6 +333,16 @@ const wrapDatabase = (base, raw, perTable, context) => {
       }
       return { deleted: ids.length };
     },
+    async deleteWhere(tableName, where, options) {
+      const { baseWhere } = readBase(tableName);
+      const resolved = await route(tableName).findMany(tableName, {
+        baseWhere: mergeBaseWhere(where, baseWhere),
+        relationBaseWhere: relationReadFilter
+      });
+      const ids = resolved.page.map((row) => String(row["_id"]));
+      assertBatchLimit(ids.length, options?.limit, "deleteWhere");
+      return wrapped.deleteMany(ids, options);
+    },
     async findFirst(tableName, args) {
       const { baseWhere } = readBase(tableName);
       return route(tableName).findFirst(tableName, {
@@ -365,7 +376,10 @@ const wrapDatabase = (base, raw, perTable, context) => {
         return base.get(id, expectedTable);
       }
       const { baseWhere, restricts } = readBase(located.tableName);
-      if (!restricts || !baseWhere) {
+      if (!restricts) {
+        return base.get(id, expectedTable);
+      }
+      if (!baseWhere) {
         return located.row;
       }
       const allowed = await raw.findFirst(located.tableName, { baseWhere, limit: 1, where: { _id: id } });
@@ -432,6 +446,19 @@ const wrapDatabase = (base, raw, perTable, context) => {
           expectedTable
         );
       }
+      return { patched: patches.length };
+    },
+    async patchWhere(tableName, args, options) {
+      const { baseWhere } = readBase(tableName);
+      const resolved = await route(tableName).findMany(tableName, {
+        baseWhere: mergeBaseWhere(args.where, baseWhere),
+        relationBaseWhere: relationReadFilter
+      });
+      const patches = resolved.page.map((row) => {
+        return { id: String(row["_id"]), patch: args.patch };
+      });
+      assertBatchLimit(patches.length, options?.limit, "patchWhere");
+      return wrapped.patchMany(patches, options);
     },
     query(tableName) {
       const { baseWhere } = readBase(tableName);
@@ -441,6 +468,22 @@ const wrapDatabase = (base, raw, perTable, context) => {
       }
       return reader.filter((document) => matchesWhere(document, baseWhere));
     },
+    // Restore clears the soft-delete marker — a by-id un-delete, gated as an
+    // "update" (the policy that governs patch). No post-image check: the
+    // writer owns the marker field, so we only enforce the pre-image USING.
+    restore: (id, expectedTable) => gateById(
+      id,
+      "update",
+      async (writer) => {
+        const perform = writer.restore ?? raw.restore;
+        if (!perform) {
+          throw new LunoraError("BAD_REQUEST", "restore is not supported by this writer");
+        }
+        await perform(id, expectedTable);
+      },
+      void 0,
+      expectedTable
+    ),
     replace: (id, document, expectedTable) => gateById(
       id,
       "update",
@@ -516,7 +559,7 @@ const indexRolePermissions = (roles) => {
 const rls = (policies, options = {}) => {
   const perTable = indexByTable(policies);
   const rolePermissions = indexRolePermissions(options.roles);
-  return async ({ ctx, next }) => {
+  const middleware = async ({ ctx, next }) => {
     const auth = ctx.auth ?? {};
     const identity = await auth.getIdentity?.() ?? null;
     const roles = auth.roles ?? [];
@@ -546,6 +589,7 @@ const rls = (policies, options = {}) => {
     }
     return next({ ctx: extension });
   };
+  return tagRlsMiddleware(middleware, { policies, roles: options.roles ?? [] });
 };
 
 export { computeReadBaseWhere, evaluateWrite, indexRolePermissions, matchesWhere, permissionName, rls };

package/dist/packem_shared/{run-middleware-CYQOuoV6.mjs → run-middleware-I6EiQfxL.mjs}

@@ -1,8 +1,10 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const runMiddlewareChain = async (middlewares, baseContext, terminal) => {
   let lastIndex = -1;
   const dispatch = async (index, context) => {
     if (index <= lastIndex) {
-      throw new Error("middleware next() called multiple times");
+      throw new LunoraError$1("INTERNAL", "middleware next() called multiple times");
     }
     lastIndex = index;
     const middleware = middlewares[index];

package/dist/packem_shared/{storageRules-4a30FSpI.mjs → storageRules-6QxzDOcx.mjs}

@@ -1,4 +1,4 @@
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
 
 const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
 const indexRolePermissions = (roles = []) => {

package/dist/packem_shared/{types.d-DmvyEMD6.d.mts → types.d-BB3pjV0m.d.mts}

@@ -45,10 +45,10 @@ type PolicyDecisionOf<DM, REL extends Record<keyof DM, object>, T extends keyof
 * unknown table, a stray column, or a relation predicate naming a relation the
 * table does not declare is a compile error rather than a silent runtime deny.
 */
-interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T extends keyof DM, Context = unknown> {
+interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T extends keyof DM, Context = unknown, Identity = Record<string, unknown>> {
   on: PolicyOperation;
   table: T;
-  when: (context: PolicyContext<Context>) => PolicyDecisionOf<DM, REL, T>;
+  when: (context: PolicyContext<Context, Identity>) => PolicyDecisionOf<DM, REL, T>;
 }
 /**
 * Context handed to a policy. `auth.roles` is the per-request role list,
@@ -59,7 +59,7 @@ interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T ext
 * pre-write row; for `insert` it is the candidate document. `ctx` is the full
 * procedure context the middleware closed over.
 */
-interface PolicyContext<Context = unknown> {
+interface PolicyContext<Context = unknown, Identity = Record<string, unknown>> {
   readonly auth: {
     /**
     * `true` when any of the request's `roles` grants `permission` (passed
@@ -68,7 +68,13 @@ interface PolicyContext<Context = unknown> {
     * when none of the request's roles lists the permission.
     */
     readonly can: (permission: Permission | string) => boolean;
-    readonly identity?: Record<string, unknown> | null;
+    /**
+    * The resolved identity, typed to the `Identity` type parameter bound on
+    * `createPolicyDsl` — e.g. the app's `defineIdentity(...)` claim type via
+    * the `InferIdentity` helper; otherwise the untyped claim bag.
+    * `undefined`/`null` when the request is anonymous.
+    */
+    readonly identity?: Identity | null;
     readonly roles: ReadonlyArray<string>;
     readonly userId: null | string;
   };

package/dist/packem_shared/{types.d-BDY0FYHK.d.ts → types.d-Cxl6ndhm.d.ts}

@@ -45,10 +45,10 @@ type PolicyDecisionOf<DM, REL extends Record<keyof DM, object>, T extends keyof
 * unknown table, a stray column, or a relation predicate naming a relation the
 * table does not declare is a compile error rather than a silent runtime deny.
 */
-interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T extends keyof DM, Context = unknown> {
+interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T extends keyof DM, Context = unknown, Identity = Record<string, unknown>> {
   on: PolicyOperation;
   table: T;
-  when: (context: PolicyContext<Context>) => PolicyDecisionOf<DM, REL, T>;
+  when: (context: PolicyContext<Context, Identity>) => PolicyDecisionOf<DM, REL, T>;
 }
 /**
 * Context handed to a policy. `auth.roles` is the per-request role list,
@@ -59,7 +59,7 @@ interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T ext
 * pre-write row; for `insert` it is the candidate document. `ctx` is the full
 * procedure context the middleware closed over.
 */
-interface PolicyContext<Context = unknown> {
+interface PolicyContext<Context = unknown, Identity = Record<string, unknown>> {
   readonly auth: {
     /**
     * `true` when any of the request's `roles` grants `permission` (passed
@@ -68,7 +68,13 @@ interface PolicyContext<Context = unknown> {
     * when none of the request's roles lists the permission.
     */
     readonly can: (permission: Permission | string) => boolean;
-    readonly identity?: Record<string, unknown> | null;
+    /**
+    * The resolved identity, typed to the `Identity` type parameter bound on
+    * `createPolicyDsl` — e.g. the app's `defineIdentity(...)` claim type via
+    * the `InferIdentity` helper; otherwise the untyped claim bag.
+    * `undefined`/`null` when the request is anonymous.
+    */
+    readonly identity?: Identity | null;
     readonly roles: ReadonlyArray<string>;
     readonly userId: null | string;
   };

package/dist/rls/testing.d.mts

@@ -1,4 +1,4 @@
-import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-DmvyEMD6.mjs";
+import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-BB3pjV0m.mjs";
 import "../data-model.mjs";
 /**
 * The slice of a request identity a policy reads. Mirrors the