@lunora/server 1.0.0-alpha.203 → 1.0.0-alpha.204

package/dist/index.d.mts

@@ -2473,6 +2473,13 @@ interface PatchWriteOptions {
 interface QueryArgs$1 {
   baseWhere?: WhereInput;
   cursor?: null | string;
+  /**
+   * Opt a list read back into a `.softDelete()` table's tombstoned rows. Set by
+   * the chunked erase's re-location for a `{ hard: true }` delete, which must find
+   * a row an earlier delete of the page soft-deleted and physically remove it; the
+   * read `baseWhere` still applies (see `@lunora/do`'s `QueryArgs`).
+   */
+  includeDeleted?: boolean;
   limit?: number;
   orderBy?: ReadonlyArray<unknown>;
   /**
@@ -2670,6 +2677,13 @@ interface DatabaseWriterLike {
     allowExplicitId?: boolean;
     limit?: number;
   }) => Promise<string[]>;
+  /**
+   * Does the store currently hold an atomic write boundary open? Published by the writer (see
+   * `@lunora/shard-engine`'s `DatabaseWriterLike`). A chunked erase trusts the page image only while a
+   * mutation's serialized transaction is open; an action runs outside one, so every row is re-located.
+   * Absent ⇒ treated as "not in a transaction" (the conservative default).
+   */
+  inTransaction?: () => boolean;
   /**
    * Optional table-aware lookup. The underlying writer (e.g. `@lunora/do`)
    * already knows the owning table of an id internally, so it can return
@@ -2759,6 +2773,13 @@ interface DatabaseWriterLike {
   relationEdges?: ReadonlyArray<RelationEdgeLike>;
   replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
   restore?: (id: string, expectedTable?: string) => Promise<void>;
+  /**
+   * Soft-delete marker column per table, for tables declared `.softDelete()`. Published by the writer
+   * (see `@lunora/shard-engine`'s `DatabaseWriterLike`). A re-located row whose marker is already set is
+   * gone — the writer's delete is a no-op for it — so the chunked erase skips it instead of deleting and
+   * counting it.
+   */
+  softDeleteFields?: ReadonlyMap<string, string>;
   /**
    * Whole-shard erase. The RLS wrapper deliberately **fails this closed** rather
    * than wrapping it — see the wrapper's `wipeShard`.

package/dist/index.d.ts

@@ -2473,6 +2473,13 @@ interface PatchWriteOptions {
 interface QueryArgs$1 {
   baseWhere?: WhereInput;
   cursor?: null | string;
+  /**
+   * Opt a list read back into a `.softDelete()` table's tombstoned rows. Set by
+   * the chunked erase's re-location for a `{ hard: true }` delete, which must find
+   * a row an earlier delete of the page soft-deleted and physically remove it; the
+   * read `baseWhere` still applies (see `@lunora/do`'s `QueryArgs`).
+   */
+  includeDeleted?: boolean;
   limit?: number;
   orderBy?: ReadonlyArray<unknown>;
   /**
@@ -2670,6 +2677,13 @@ interface DatabaseWriterLike {
     allowExplicitId?: boolean;
     limit?: number;
   }) => Promise<string[]>;
+  /**
+   * Does the store currently hold an atomic write boundary open? Published by the writer (see
+   * `@lunora/shard-engine`'s `DatabaseWriterLike`). A chunked erase trusts the page image only while a
+   * mutation's serialized transaction is open; an action runs outside one, so every row is re-located.
+   * Absent ⇒ treated as "not in a transaction" (the conservative default).
+   */
+  inTransaction?: () => boolean;
   /**
    * Optional table-aware lookup. The underlying writer (e.g. `@lunora/do`)
    * already knows the owning table of an id internally, so it can return
@@ -2759,6 +2773,13 @@ interface DatabaseWriterLike {
   relationEdges?: ReadonlyArray<RelationEdgeLike>;
   replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
   restore?: (id: string, expectedTable?: string) => Promise<void>;
+  /**
+   * Soft-delete marker column per table, for tables declared `.softDelete()`. Published by the writer
+   * (see `@lunora/shard-engine`'s `DatabaseWriterLike`). A re-located row whose marker is already set is
+   * gone — the writer's delete is a no-op for it — so the chunked erase skips it instead of deleting and
+   * counting it.
+   */
+  softDeleteFields?: ReadonlyMap<string, string>;
   /**
    * Whole-shard erase. The RLS wrapper deliberately **fails this closed** rather
    * than wrapping it — see the wrapper's `wipeShard`.

package/dist/index.mjs

@@ -1 +1 @@
-import{ACTION_CACHE_DEFAULT_TTL_MS as t,ACTION_CACHE_TABLE as i,actionCacheExtension as n,cacheKeyFor as a,defineActionCache as f}from"./packem_shared/ACTION_CACHE_DEFAULT_TTL_MS-mmP-6BcT.mjs";import{initLunora as d}from"./packem_shared/initLunora-B-7Xs3Qq.mjs";import{isPerDispatchMiddleware as p,tagPerDispatchMiddleware as x}from"./packem_shared/isPerDispatchMiddleware-DDQPatSm.mjs";import{createSecrets as l}from"./packem_shared/createSecrets-D6rLB42U.mjs";import{beginDeferredDeletes as u,flushDeferredDeletes as h,withDeferredDeletes as S}from"./packem_shared/beginDeferredDeletes-DhwFBbvs.mjs";import{beginDeferredSchedules as T,withDeferredSchedules as g}from"./packem_shared/beginDeferredSchedules-C7QLYr6C.mjs";import{DOCUMENT_HISTORY_REDACTED_FIELDS as R,DOCUMENT_HISTORY_TABLE as _,defineDocumentHistory as I,documentHistoryExtension as L}from"./packem_shared/DOCUMENT_HISTORY_REDACTED_FIELDS-BBf5JG4Z.mjs";import{LunoraEnvError as M,defineEnv as P,redactSecrets as b}from"./packem_shared/LunoraEnvError-bkdMu_-N.mjs";import{bindOrm as F,bindTableFacade as O}from"./packem_shared/bindOrm-Kf5dmpGw.mjs";import{httpAction as N,httpRoute as w,httpRouter as U,isSafeHeaderValue as k}from"./packem_shared/httpAction-8vJ8HTqX.mjs";import{serveStorageObject as B}from"./packem_shared/serveStorageObject-uoExuirp.mjs";import{defineIdentity as W}from"./packem_shared/defineIdentity-DwkNKwYa.mjs";import{default as Y}from"./packem_shared/defineIdentityGuard-Bt8N65Zs.mjs";import{onConnect as J,onDisconnect as K,onShardInit as Q}from"./packem_shared/onConnect-BLRoOpv2.mjs";import{DEFAULT_LIMIT as q,DEFAULT_MAX_LIMIT as z,clampLimit as Z,defineListArgs as $}from"./packem_shared/DEFAULT_LIMIT-pT_tV8R0.mjs";import{defineMigration as re}from"./packem_shared/defineMigration-CXOS0Bvq.mjs";import{defineModule as te}from"./packem_shared/defineModule-OecXWM3U.mjs";import{defineMutator as ne}from"./packem_shared/defineMutator-B4ipDtDR.mjs";import{platformAdmin as fe}from"./packem_shared/platformAdmin-kczXQme8.mjs";import{c as de,d as me,a as pe,b as xe,e as ce,f as le,g as Ee,h as ue,i as he,j as Se,k as De,m as Te}from"./packem_shared/plugin-Bm9wIpiI.mjs";import{PRESENCE_DEFAULT_TTL_MS as Ae,PRESENCE_TABLE as Re,definePresence as _e,presenceExtension as Ie}from"./packem_shared/PRESENCE_DEFAULT_TTL_MS-DFpy5J8G.mjs";import{protectPublic as Ce}from"./packem_shared/protectPublic-Bi5_95aP.mjs";import{onQueryChange as Pe}from"./packem_shared/onQueryChange-iuLzmyPs.mjs";import{createServices as ye}from"./packem_shared/createServices-IJvoqi0e.mjs";import{defineShape as Oe}from"./packem_shared/defineShape-Bg8YEWXZ.mjs";import{onWhisper as Ne}from"./packem_shared/onWhisper-CfDbFLQh.mjs";import{LunoraError as Ue}from"@lunora/errors";import{cronJobs as ve}from"@lunora/scheduler";import{ValidationError as Ve,v as We}from"@lunora/values";import{allowAll as Ye,deny as Ge,isDeny as Je,toWhereInput as Ke}from"./packem_shared/allowAll-DkRAgItV.mjs";import{asBucketStorage as Xe}from"./packem_shared/asBucketStorage-DoGYOjq3.mjs";import{assertShapesDeclareReadPolicies as ze,buildRlsReadRegistry as Ze,composeShapeReadWhere as $e}from"./packem_shared/assertShapesDeclareReadPolicies-CcMBusSy.mjs";import{buildMaskRegistry as rr}from"./packem_shared/buildMaskRegistry-DpWMtalG.mjs";import{createPolicyDsl as tr,definePermission as ir,definePolicies as nr,definePolicy as ar,defineRole as fr}from"./packem_shared/createPolicyDsl-BZa6SqLJ.mjs";import{defineStorageRule as dr,defineStorageRules as mr}from"./packem_shared/defineStorageRule-Dv4nJE0H.mjs";import{mask as xr}from"./packem_shared/mask-BWCKBOVv.mjs";import{r as lr}from"./packem_shared/middleware-Dqm5Tc-j.mjs";import{storageRules as ur}from"./packem_shared/storageRules-Ce004Pqj.mjs";const e="0.0.0";export{t as ACTION_CACHE_DEFAULT_TTL_MS,i as ACTION_CACHE_TABLE,q as DEFAULT_LIMIT,z as DEFAULT_MAX_LIMIT,R as DOCUMENT_HISTORY_REDACTED_FIELDS,_ as DOCUMENT_HISTORY_TABLE,M as LunoraEnvError,Ue as LunoraError,Ae as PRESENCE_DEFAULT_TTL_MS,Re as PRESENCE_TABLE,e as VERSION,Ve as ValidationError,n as actionCacheExtension,Ye as allowAll,Xe as asBucketStorage,ze as assertShapesDeclareReadPolicies,u as beginDeferredDeletes,T as beginDeferredSchedules,F as bindOrm,O as bindTableFacade,rr as buildMaskRegistry,Ze as buildRlsReadRegistry,a as cacheKeyFor,Z as clampLimit,de as composePluginMiddleware,$e as composeShapeReadWhere,tr as createPolicyDsl,l as createSecrets,ye as createServices,ve as cronJobs,f as defineActionCache,me as defineAggregateIndex,pe as defineComponent,I as defineDocumentHistory,P as defineEnv,W as defineIdentity,Y as defineIdentityGuard,$ as defineListArgs,re as defineMigration,te as defineModule,ne as defineMutator,ir as definePermission,xe as definePlugin,nr as definePolicies,ar as definePolicy,_e as definePresence,ce as defineRankIndex,fr as defineRole,le as defineSchema,Ee as defineSchemaExtension,Oe as defineShape,dr as defineStorageRule,mr as defineStorageRules,ue as defineTable,he as defineVectorIndex,Ge as deny,L as documentHistoryExtension,h as flushDeferredDeletes,N as httpAction,w as httpRoute,U as httpRouter,Se as indexFieldsFromSchema,d as initLunora,De as installPlugins,Je as isDeny,p as isPerDispatchMiddleware,k as isSafeHeaderValue,xr as mask,Te as mergeSchemaExtension,J as onConnect,K as onDisconnect,Pe as onQueryChange,Q as onShardInit,Ne as onWhisper,fe as platformAdmin,Ie as presenceExtension,Ce as protectPublic,b as redactSecrets,lr as rls,B as serveStorageObject,ur as storageRules,x as tagPerDispatchMiddleware,Ke as toWhereInput,We as v,S as withDeferredDeletes,g as withDeferredSchedules};
+import{ACTION_CACHE_DEFAULT_TTL_MS as t,ACTION_CACHE_TABLE as i,actionCacheExtension as n,cacheKeyFor as a,defineActionCache as f}from"./packem_shared/ACTION_CACHE_DEFAULT_TTL_MS-mmP-6BcT.mjs";import{initLunora as d}from"./packem_shared/initLunora-B-7Xs3Qq.mjs";import{isPerDispatchMiddleware as p,tagPerDispatchMiddleware as x}from"./packem_shared/isPerDispatchMiddleware-DDQPatSm.mjs";import{createSecrets as l}from"./packem_shared/createSecrets-D6rLB42U.mjs";import{beginDeferredDeletes as u,flushDeferredDeletes as h,withDeferredDeletes as S}from"./packem_shared/beginDeferredDeletes-DhwFBbvs.mjs";import{beginDeferredSchedules as T,withDeferredSchedules as g}from"./packem_shared/beginDeferredSchedules-C7QLYr6C.mjs";import{DOCUMENT_HISTORY_REDACTED_FIELDS as R,DOCUMENT_HISTORY_TABLE as _,defineDocumentHistory as I,documentHistoryExtension as L}from"./packem_shared/DOCUMENT_HISTORY_REDACTED_FIELDS-BBf5JG4Z.mjs";import{LunoraEnvError as M,defineEnv as P,redactSecrets as b}from"./packem_shared/LunoraEnvError-bkdMu_-N.mjs";import{bindOrm as F,bindTableFacade as O}from"./packem_shared/bindOrm-Kf5dmpGw.mjs";import{httpAction as N,httpRoute as w,httpRouter as U,isSafeHeaderValue as k}from"./packem_shared/httpAction-8vJ8HTqX.mjs";import{serveStorageObject as B}from"./packem_shared/serveStorageObject-uoExuirp.mjs";import{defineIdentity as W}from"./packem_shared/defineIdentity-DwkNKwYa.mjs";import{default as Y}from"./packem_shared/defineIdentityGuard-Bt8N65Zs.mjs";import{onConnect as J,onDisconnect as K,onShardInit as Q}from"./packem_shared/onConnect-BLRoOpv2.mjs";import{DEFAULT_LIMIT as q,DEFAULT_MAX_LIMIT as z,clampLimit as Z,defineListArgs as $}from"./packem_shared/DEFAULT_LIMIT-pT_tV8R0.mjs";import{defineMigration as re}from"./packem_shared/defineMigration-CXOS0Bvq.mjs";import{defineModule as te}from"./packem_shared/defineModule-OecXWM3U.mjs";import{defineMutator as ne}from"./packem_shared/defineMutator-B4ipDtDR.mjs";import{platformAdmin as fe}from"./packem_shared/platformAdmin-kczXQme8.mjs";import{c as de,d as me,a as pe,b as xe,e as ce,f as le,g as Ee,h as ue,i as he,j as Se,k as De,m as Te}from"./packem_shared/plugin-Bm9wIpiI.mjs";import{PRESENCE_DEFAULT_TTL_MS as Ae,PRESENCE_TABLE as Re,definePresence as _e,presenceExtension as Ie}from"./packem_shared/PRESENCE_DEFAULT_TTL_MS-DFpy5J8G.mjs";import{protectPublic as Ce}from"./packem_shared/protectPublic-Bi5_95aP.mjs";import{onQueryChange as Pe}from"./packem_shared/onQueryChange-iuLzmyPs.mjs";import{createServices as ye}from"./packem_shared/createServices-IJvoqi0e.mjs";import{defineShape as Oe}from"./packem_shared/defineShape-B6tFBTkW.mjs";import{onWhisper as Ne}from"./packem_shared/onWhisper-CfDbFLQh.mjs";import{LunoraError as Ue}from"@lunora/errors";import{cronJobs as ve}from"@lunora/scheduler";import{ValidationError as Ve,v as We}from"@lunora/values";import{allowAll as Ye,deny as Ge,isDeny as Je,toWhereInput as Ke}from"./packem_shared/allowAll-DkRAgItV.mjs";import{asBucketStorage as Xe}from"./packem_shared/asBucketStorage-DoGYOjq3.mjs";import{assertShapesDeclareReadPolicies as ze,buildRlsReadRegistry as Ze,composeShapeReadWhere as $e}from"./packem_shared/assertShapesDeclareReadPolicies-uqHVUw8L.mjs";import{buildMaskRegistry as rr}from"./packem_shared/buildMaskRegistry-DpWMtalG.mjs";import{createPolicyDsl as tr,definePermission as ir,definePolicies as nr,definePolicy as ar,defineRole as fr}from"./packem_shared/createPolicyDsl-BZa6SqLJ.mjs";import{defineStorageRule as dr,defineStorageRules as mr}from"./packem_shared/defineStorageRule-Dv4nJE0H.mjs";import{mask as xr}from"./packem_shared/mask-CYXknf5m.mjs";import{r as lr}from"./packem_shared/middleware-oEEmcgVa.mjs";import{storageRules as ur}from"./packem_shared/storageRules-Cd2r-H_T.mjs";const e="0.0.0";export{t as ACTION_CACHE_DEFAULT_TTL_MS,i as ACTION_CACHE_TABLE,q as DEFAULT_LIMIT,z as DEFAULT_MAX_LIMIT,R as DOCUMENT_HISTORY_REDACTED_FIELDS,_ as DOCUMENT_HISTORY_TABLE,M as LunoraEnvError,Ue as LunoraError,Ae as PRESENCE_DEFAULT_TTL_MS,Re as PRESENCE_TABLE,e as VERSION,Ve as ValidationError,n as actionCacheExtension,Ye as allowAll,Xe as asBucketStorage,ze as assertShapesDeclareReadPolicies,u as beginDeferredDeletes,T as beginDeferredSchedules,F as bindOrm,O as bindTableFacade,rr as buildMaskRegistry,Ze as buildRlsReadRegistry,a as cacheKeyFor,Z as clampLimit,de as composePluginMiddleware,$e as composeShapeReadWhere,tr as createPolicyDsl,l as createSecrets,ye as createServices,ve as cronJobs,f as defineActionCache,me as defineAggregateIndex,pe as defineComponent,I as defineDocumentHistory,P as defineEnv,W as defineIdentity,Y as defineIdentityGuard,$ as defineListArgs,re as defineMigration,te as defineModule,ne as defineMutator,ir as definePermission,xe as definePlugin,nr as definePolicies,ar as definePolicy,_e as definePresence,ce as defineRankIndex,fr as defineRole,le as defineSchema,Ee as defineSchemaExtension,Oe as defineShape,dr as defineStorageRule,mr as defineStorageRules,ue as defineTable,he as defineVectorIndex,Ge as deny,L as documentHistoryExtension,h as flushDeferredDeletes,N as httpAction,w as httpRoute,U as httpRouter,Se as indexFieldsFromSchema,d as initLunora,De as installPlugins,Je as isDeny,p as isPerDispatchMiddleware,k as isSafeHeaderValue,xr as mask,Te as mergeSchemaExtension,J as onConnect,K as onDisconnect,Pe as onQueryChange,Q as onShardInit,Ne as onWhisper,fe as platformAdmin,Ie as presenceExtension,Ce as protectPublic,b as redactSecrets,lr as rls,B as serveStorageObject,ur as storageRules,x as tagPerDispatchMiddleware,Ke as toWhereInput,We as v,S as withDeferredDeletes,g as withDeferredSchedules};

package/dist/packem_shared/{assertShapesDeclareReadPolicies-CcMBusSy.mjs → assertShapesDeclareReadPolicies-uqHVUw8L.mjs}

@@ -1 +1 @@
-import{LunoraError as c}from"@lunora/errors";import{i as p,e as g,f as b,g as y}from"./middleware-Dqm5Tc-j.mjs";import{r as w}from"./policy-tag-V0lqFzgS.mjs";import{deny as m}from"./allowAll-DkRAgItV.mjs";const h=m(),v=t=>{const e=t?.rls?.tags;return e||w(t)},R=(t,e)=>{const r=p(e.roles),o=new Map,n=new Map;for(const s of e.policies){if(s.on!=="read")continue;const a=o.get(s.table)??new Set;if(a.has(s.when))continue;a.add(s.when),o.set(s.table,a);const l=n.get(s.table)??[];l.push(s),n.set(s.table,l)}for(const[s,a]of n){const l=t.get(s)??[];l.push({policies:a,rolePermissions:r}),t.set(s,l)}},d=t=>{const e=t.OR;return Array.isArray(e)&&e.length===0&&Object.keys(t).length===1},T=(t,e)=>!t||Object.keys(t).length===0?e:d(t)||Object.keys(e).length===0?t:{AND:[t,e]},S=(t,e)=>{const r=g(e.identity);return b(t.policies,{auth:{can:y(r,t.rolePermissions),identity:e.identity,roles:r,userId:e.userId},ctx:e.ctx})},A=(t,e)=>{const r=t.byTable.get(e.table);if(!r||r.length===0)return e.rlsRequired&&!e.tablePublic?h:void 0;const o=[];for(const n of r){const s=S(n,e);if(s===void 0)return;d(s)||o.push(s)}return o.length===0?h:o.length===1?o[0]:{OR:o}},O=t=>{const e=new Map,r=new Set;for(const o of t)for(const n of v(o))r.has(n)||(r.add(n),R(e,n));return{byTable:e}},W=(t,e,r)=>{if(r)return;const o=new Set(e),n=Object.entries(t).filter(([,i])=>o.has(i.table)),s=i=>i.map(([u,f])=>`"${u}" (table "${f.table}")`).join(", "),a=n.filter(([,i])=>i.use===void 0);if(a.length>0)throw new c("INTERNAL",`defineShape ${s(a)} replicate${a.length===1?"s":""} a table this project's rls() read policies restrict, but declare${a.length===1?"s":""} no \`use\` — a shape runs no procedure, so those policies never reach it and every subscriber would replicate every row the shape's own \`where\` admits. Name the guards the equivalent query lists: \`defineShape({ use: [<the rls() guard>], ... })\`. If the shape really is meant to be ungoverned (its own \`where\` is the whole filter), say so with \`use: []\`.`);const l=n.filter(([,i])=>i.use!==void 0&&i.use.length>0&&!i.rlsRegistry.byTable.has(i.table));if(l.length>0)throw new c("INTERNAL",`defineShape ${s(l)} name \`use\` guards that declare no \`on: "read"\` policy for that table, so nothing governs what replicates and the shape's own \`where\` is the whole filter — the same gap a missing \`use\` leaves, on a table this project's rls() read policies restrict. A guard for a different table, or a middleware carrying no rls() policies at all, does not count: name the same rls() guard the equivalent query lists. If the shape really is meant to be ungoverned, say so with \`use: []\`.`)},$=(t,e)=>T(A(t,e),e.shapeWhere);export{W as assertShapesDeclareReadPolicies,O as buildRlsReadRegistry,$ as composeShapeReadWhere};
+import{LunoraError as c}from"@lunora/errors";import{i as p,e as g,f as b,g as y}from"./middleware-oEEmcgVa.mjs";import{r as w}from"./policy-tag-V0lqFzgS.mjs";import{deny as m}from"./allowAll-DkRAgItV.mjs";const h=m(),v=t=>{const e=t?.rls?.tags;return e||w(t)},R=(t,e)=>{const r=p(e.roles),o=new Map,n=new Map;for(const s of e.policies){if(s.on!=="read")continue;const a=o.get(s.table)??new Set;if(a.has(s.when))continue;a.add(s.when),o.set(s.table,a);const l=n.get(s.table)??[];l.push(s),n.set(s.table,l)}for(const[s,a]of n){const l=t.get(s)??[];l.push({policies:a,rolePermissions:r}),t.set(s,l)}},d=t=>{const e=t.OR;return Array.isArray(e)&&e.length===0&&Object.keys(t).length===1},T=(t,e)=>!t||Object.keys(t).length===0?e:d(t)||Object.keys(e).length===0?t:{AND:[t,e]},S=(t,e)=>{const r=g(e.identity);return b(t.policies,{auth:{can:y(r,t.rolePermissions),identity:e.identity,roles:r,userId:e.userId},ctx:e.ctx})},A=(t,e)=>{const r=t.byTable.get(e.table);if(!r||r.length===0)return e.rlsRequired&&!e.tablePublic?h:void 0;const o=[];for(const n of r){const s=S(n,e);if(s===void 0)return;d(s)||o.push(s)}return o.length===0?h:o.length===1?o[0]:{OR:o}},O=t=>{const e=new Map,r=new Set;for(const o of t)for(const n of v(o))r.has(n)||(r.add(n),R(e,n));return{byTable:e}},W=(t,e,r)=>{if(r)return;const o=new Set(e),n=Object.entries(t).filter(([,i])=>o.has(i.table)),s=i=>i.map(([u,f])=>`"${u}" (table "${f.table}")`).join(", "),a=n.filter(([,i])=>i.use===void 0);if(a.length>0)throw new c("INTERNAL",`defineShape ${s(a)} replicate${a.length===1?"s":""} a table this project's rls() read policies restrict, but declare${a.length===1?"s":""} no \`use\` — a shape runs no procedure, so those policies never reach it and every subscriber would replicate every row the shape's own \`where\` admits. Name the guards the equivalent query lists: \`defineShape({ use: [<the rls() guard>], ... })\`. If the shape really is meant to be ungoverned (its own \`where\` is the whole filter), say so with \`use: []\`.`);const l=n.filter(([,i])=>i.use!==void 0&&i.use.length>0&&!i.rlsRegistry.byTable.has(i.table));if(l.length>0)throw new c("INTERNAL",`defineShape ${s(l)} name \`use\` guards that declare no \`on: "read"\` policy for that table, so nothing governs what replicates and the shape's own \`where\` is the whole filter — the same gap a missing \`use\` leaves, on a table this project's rls() read policies restrict. A guard for a different table, or a middleware carrying no rls() policies at all, does not count: name the same rls() guard the equivalent query lists. If the shape really is meant to be ungoverned, say so with \`use: []\`.`)},$=(t,e)=>T(A(t,e),e.shapeWhere);export{W as assertShapesDeclareReadPolicies,O as buildRlsReadRegistry,$ as composeShapeReadWhere};

package/dist/packem_shared/{defineShape-Bg8YEWXZ.mjs → defineShape-B6tFBTkW.mjs}

@@ -1 +1 @@
-import{LunoraError as r}from"@lunora/errors";import{c as p}from"./context-identity-B2XYGA0B.mjs";import{v as u}from"./functions-B2-H4PQT.mjs";import{toWhereInput as m,deny as d}from"./allowAll-DkRAgItV.mjs";import{buildRlsReadRegistry as c}from"./assertShapesDeclareReadPolicies-CcMBusSy.mjs";const I=e=>{if(e.table.trim()==="")throw new r("INTERNAL","defineShape: `table` must be a non-empty string");if(e.columns?.length===0)throw new r("INTERNAL","defineShape: `columns` must list at least one column when provided");if(!e.where&&e.owner===void 0)throw new r("INTERNAL",`defineShape: shape on table "${e.table}" needs a \`where\` predicate or an \`owner\` (\`owner: true\` uses the table's .ownedBy(field), \`owner: "field"\` names the column) — a shape with neither would replicate the whole table`);return{__lunoraShape:!0,...e,compileWhere:(a,l,n)=>{const w=u(e.args??{},l),o=e.where?m(e.where(a,w)):void 0;if(e.owner===void 0)return o;const t=e.owner===!0?n?.ownerField:e.owner;if(t===void 0||t==="")throw new r("INTERNAL",`defineShape: shape on table "${e.table}" declares \`owner: true\` but the table has no \`.ownedBy(field)\` — add it to the table, or name the column directly with \`owner: "field"\``);const s=p(a);if(s===void 0)return d();const h={[t]:s};return o===void 0?h:{AND:[h,o]}},rlsRegistry:c(e.use??[])}};export{I as defineShape};
+import{LunoraError as r}from"@lunora/errors";import{c as p}from"./context-identity-B2XYGA0B.mjs";import{v as u}from"./functions-B2-H4PQT.mjs";import{toWhereInput as m,deny as d}from"./allowAll-DkRAgItV.mjs";import{buildRlsReadRegistry as c}from"./assertShapesDeclareReadPolicies-uqHVUw8L.mjs";const I=e=>{if(e.table.trim()==="")throw new r("INTERNAL","defineShape: `table` must be a non-empty string");if(e.columns?.length===0)throw new r("INTERNAL","defineShape: `columns` must list at least one column when provided");if(!e.where&&e.owner===void 0)throw new r("INTERNAL",`defineShape: shape on table "${e.table}" needs a \`where\` predicate or an \`owner\` (\`owner: true\` uses the table's .ownedBy(field), \`owner: "field"\` names the column) — a shape with neither would replicate the whole table`);return{__lunoraShape:!0,...e,compileWhere:(a,l,n)=>{const w=u(e.args??{},l),o=e.where?m(e.where(a,w)):void 0;if(e.owner===void 0)return o;const t=e.owner===!0?n?.ownerField:e.owner;if(t===void 0||t==="")throw new r("INTERNAL",`defineShape: shape on table "${e.table}" declares \`owner: true\` but the table has no \`.ownedBy(field)\` — add it to the table, or name the column directly with \`owner: "field"\``);const s=p(a);if(s===void 0)return d();const h={[t]:s};return o===void 0?h:{AND:[h,o]}},rlsRegistry:c(e.use??[])}};export{I as defineShape};

package/dist/packem_shared/{mask-BWCKBOVv.mjs → mask-CYXknf5m.mjs}

@@ -1 +1 @@
-import{LunoraError as A}from"@lunora/errors";import{f as D}from"./fnv1a-D3ueNTWB.mjs";import{i as G,a as C,o as K,b as H,c as J,d as m}from"./middleware-Dqm5Tc-j.mjs";import{bindTableFacade as Q,bindOrm as V}from"./bindOrm-Kf5dmpGw.mjs";import{tagMaskMiddleware as X}from"./buildMaskRegistry-DpWMtalG.mjs";const Y=(s,i,c)=>{try{return s==="redact"?null:s==="hash"?i==null?i:typeof i=="bigint"?D(i.toString()):D(typeof i=="string"?i:JSON.stringify(i)):s(i,c)}catch{return null}},f=(s,i,c)=>{const w={...s};for(const[y,g]of Object.entries(i))y in w&&(w[y]=Y(g,s[y],{...c,column:y,row:s}));return w},F=(s,i,c)=>({...s,page:s.page.map(w=>f(w,i,c))}),I=(s,i)=>{const c=J(i);return s instanceof Set?s.has(c):Object.hasOwn(s,c)},L=(s,i,c,w)=>{if(typeof s!="function")return;const y=new Set,g=()=>new Proxy({},{get:()=>u=>(typeof u=="string"&&y.add(u),g())});s(g());for(const u of y)if(I(i,u))throw new A("MASK_UNSUPPORTED",`${w}() filtering "${c}" by masked column "${u}" is not supported`)},Z=(s,i,c,w)=>{const y=s.rankBefore,g=s.rankPageRows,u=(r,t)=>{const n=i.get(r);return n?t.map(o=>f(o,n,c)):t},l=r=>{const t=r?.relationMask;return{...r,relationMask:t===void 0?u:(n,o)=>t(n,u(n,o))}},p=(r,t,n,o)=>{const e=i.get(r);if(!e)return;const a=w?.[r]?.[o]?.[t];if(!a)return;const d=a.find(R=>I(e,R));if(d!==void 0)throw new A("MASK_UNSUPPORTED",`${n}() reading "${r}" via index "${t}" would order rows by masked column "${d}" — use an index whose declared fields are all unmasked, or unmask the column`)},k=(r,t,n)=>({async*[Symbol.asyncIterator](){for await(const o of{[Symbol.asyncIterator]:()=>r[Symbol.asyncIterator]()})yield f(o,t,c)},collect:async()=>(await r.collect()).map(e=>f(e,t,c)),collectWithScores:async()=>(await r.collectWithScores()).map(e=>{const a=f(e.document,t,c);return"distanceMeters"in e?{distanceMeters:null,document:a}:{document:a,score:e.score}}),filter:o=>k(r.filter(e=>o(f(e,t,c))),t,n),first:async()=>{const o=await r.first();return o?f(o,t,c):null},order:o=>k(r.order(o),t,n),paginate:async o=>F(await r.paginate(o),t,c),take:async o=>(await r.take(o)).map(a=>f(a,t,c)),unique:async()=>{const o=await r.unique();return o?f(o,t,c):null},withIndex:(o,e)=>(p(n,o,"withIndex","index"),L(e,t,n,"withIndex"),k(r.withIndex(o,e),t,n)),withSearchIndex:(o,e)=>(L(e,t,n,"withSearchIndex"),k(r.withSearchIndex(o,e),t,n)),withGeoIndex:(o,e)=>(p(n,o,"withGeoIndex","geo"),k(r.withGeoIndex(o,e),t,n))}),W=async(r,t)=>{if(s.lookupById){const d=await s.lookupById(r,t);if(d)return{row:d.row,tableName:i.has(d.tableName)?d.tableName:void 0}}const n=await s.get(r,t);if(!n)return{row:null,tableName:void 0};const o=t!==void 0&&i.has(t)?[t]:[],e=t===void 0?[...i.keys()]:o,a=await Promise.all(e.map(async d=>(await s.findFirst(d,{limit:1,where:{_id:r}}))?._id===r?d:void 0));return{row:n,tableName:a.find(d=>d!==void 0)}},S=(r,t,n)=>{const o=i.get(r);if(!o)return;const e=t.find(a=>typeof a=="string"&&I(o,a));if(e!==void 0)throw new A("MASK_UNSUPPORTED",`${n}() over masked column "${e}" on "${r}" is not supported`)},O=new Set;for(const r of i.values())for(const t of Object.keys(r))O.add(t);const P=(r,t,n,o)=>{if(!(!r||typeof r!="object"||Array.isArray(r)))for(const[e,a]of Object.entries(r))q(e,a,t,n,o)},q=(r,t,n,o,e)=>{if(r==="AND"||r==="OR"){for(const a of Array.isArray(t)?t:[])P(a,n,o,e);return}if(r==="NOT"){P(t,n,o,e);return}if(!r.startsWith("__")){if(I(n,r))throw new A("MASK_UNSUPPORTED",`${e}() filtering "${o}" by masked column "${r}" is not supported`);if(m(t))for(const a of Object.values(t))P(a,O,`${o}.${r}`,e)}},E=r=>{const t=i.get(r);return t?new Set(Object.keys(t)):new Set},h=(r,t,n)=>{O.size===0||t===void 0||P(t,E(r),r,n)},U=(r,t,n,o)=>{if(Array.isArray(t)){for(const e of t)if(!(!e||typeof e!="object"||Array.isArray(e))){for(const a of Object.keys(e))if(I(n,a))throw new A("MASK_UNSUPPORTED",`${o}() ordering "${r}" by masked column "${a}" is not supported`)}}},v=(r,t,n)=>{if(!(O.size===0||!t||typeof t!="object"||Array.isArray(t)))for(const[o,e]of Object.entries(t)){if(o==="_count"||!e||typeof e!="object"||Array.isArray(e))continue;const a=e,d=`${r}.${o}`;P(a.where,O,d,n),U(d,a.orderBy,O,n),v(d,a.with,n)}},$=(r,t,n)=>{h(r,t?.where,n),h(r,t?.baseWhere,n),U(r,t?.orderBy,E(r),n),v(r,t?.with,n)},_=r=>r&&typeof r=="object"&&!Array.isArray(r)?r:void 0,M=(r,t,n)=>{const o=_(t);h(r,o?.where,n),h(r,o?.baseWhere,n),v(r,o?.with,n)},j=(r,t)=>Object.hasOwn(i.get(r)??{},t)?t:void 0,B={...s,relationWrites:(()=>{if(s.relationWrites===void 0)return;const r={};for(const[t,n]of Object.entries(s.relationWrites))r[t]=Object.fromEntries(Object.entries(n).map(([o,e])=>{const[a,d]=e.kind==="one"?[t,e.table]:[e.table,t],R=e.through?j(e.through.table,e.through.from)??j(e.through.table,e.through.to):j(a,e.field)??j(d,e.references);return[o,R===void 0?e:{...e,refusal:`"${R}" is masked for this caller, so its stored value cannot be copied`}]}));return r})(),async deleteWhere(r,t,n){if(h(r,t,"deleteMany({ where })"),s.deleteWhere===void 0)throw new A("INTERNAL",`ctx.db.${r}.deleteMany({ where }) is unavailable: this writer has no where-based delete`);return s.deleteWhere(r,t,n)},async patchIf(r,t,n){if(h(r,n.where,"patchIf"),s.patchIf===void 0)throw new A("INTERNAL",`ctx.db.patchIf on "${r}" is unsupported: this writer has no conditional write`);const o=await s.patchIf(r,t,n),e=i.get(r);return o.doc&&e?{applied:o.applied,doc:f(o.doc,e,c)}:o},async patchWhere(r,t,n){if(h(r,t.where,"patchMany({ where })"),s.patchWhere===void 0)throw new A("INTERNAL",`ctx.db.${r}.patchMany({ where }) is unavailable: this writer has no where-based patch`);return s.patchWhere(r,t,n)},aggregate(r,t){return S(r,[t.field],"aggregate"),h(r,t.where,"aggregate"),s.aggregate(r,t)},count(r,t){const n=_(t),o=n&&("where"in n||"baseWhere"in n||"restrictsCounts"in n)?n.where:t;return h(r,o,"count"),n&&h(r,n.baseWhere,"count"),s.count(r,t)},async findFirst(r,t){$(r,t,"findFirst");const n=await s.findFirst(r,l(t)),o=i.get(r);return n&&o?f(n,o,c):n},async findFirstOrThrow(r,t){$(r,t,"findFirstOrThrow");const n=await s.findFirstOrThrow(r,l(t)),o=i.get(r);return o?f(n,o,c):n},async explain(r,t){return $(r,t,"explain"),s.explain(r,t)},async findMany(r,t){$(r,t,"findMany");const n=await s.findMany(r,l(t)),o=i.get(r);return o?F(n,o,c):n},async get(r,t){const{row:n,tableName:o}=await W(r,t),e=o===void 0?void 0:i.get(o);return!n||!e?n:f(n,e,c)},related:s.related?async(r,t)=>await s.related(r,l(t)):void 0,async lookupById(r,t){const n=await s.lookupById?.(r,t);if(!n)return null;const o=i.get(n.tableName);return{row:o?f(n.row,o,c):n.row,tableName:n.tableName}},groupBy(r,t){return S(r,[...t.by,t.agg?.field],"groupBy"),h(r,t.where,"groupBy"),s.groupBy(r,t)},query(r){const t=s.query(r),n=i.get(r);return n?k(t,n,r):t},async rank(r,t,n){return M(r,n,"rank"),p(r,t,"rank","rank"),s.rank(r,t,n)},async rankPage(r,t,n){M(r,n,"rankPage"),p(r,t,"rankPage","rank");const o=await s.rankPage(r,t,n),e=i.get(r);return e?F(o,e,c):o},...K("rankBefore",y,r=>(t,n,o)=>(M(t,o,"rankBefore"),p(t,n,"rankBefore","rank"),r(t,n,o))),...K("rankPageRows",g,r=>async(t,n,o)=>{M(t,o,"rankPageRows"),p(t,n,"rankPageRows","rank");const e=await r(t,n,o),a=i.get(t);return a?{...e,rows:e.rows.map(d=>({...d,doc:f(d.doc,a,c)}))}:e})},z=B;if(O.size>0)for(const[r,t]of Object.entries(s))H(t)&&(z[r]=Q(B,r));return B},nr=(s,i={})=>{const c=new Map(Object.entries(s)),w=G(i.roles),y=async({ctx:u,next:l})=>{const p={auth:await C(u.auth??{},w),ctx:u};if(i.bypass?.(p)===!0)return l();const k=Z(u.db,c,p,i.indexFields),W={db:k},{orm:S}=u;return S!==null&&typeof S=="object"&&(W.orm=V(k)),l({ctx:W})},g=new Map;for(const[u,l]of c)g.set(u,new Set(Object.keys(l)));return X(y,{columns:g})};export{nr as mask};
+import{LunoraError as A}from"@lunora/errors";import{f as D}from"./fnv1a-D3ueNTWB.mjs";import{i as G,a as C,o as K,b as H,c as J,d as m}from"./middleware-oEEmcgVa.mjs";import{bindTableFacade as Q,bindOrm as V}from"./bindOrm-Kf5dmpGw.mjs";import{tagMaskMiddleware as X}from"./buildMaskRegistry-DpWMtalG.mjs";const Y=(s,i,c)=>{try{return s==="redact"?null:s==="hash"?i==null?i:typeof i=="bigint"?D(i.toString()):D(typeof i=="string"?i:JSON.stringify(i)):s(i,c)}catch{return null}},f=(s,i,c)=>{const w={...s};for(const[y,g]of Object.entries(i))y in w&&(w[y]=Y(g,s[y],{...c,column:y,row:s}));return w},F=(s,i,c)=>({...s,page:s.page.map(w=>f(w,i,c))}),I=(s,i)=>{const c=J(i);return s instanceof Set?s.has(c):Object.hasOwn(s,c)},L=(s,i,c,w)=>{if(typeof s!="function")return;const y=new Set,g=()=>new Proxy({},{get:()=>u=>(typeof u=="string"&&y.add(u),g())});s(g());for(const u of y)if(I(i,u))throw new A("MASK_UNSUPPORTED",`${w}() filtering "${c}" by masked column "${u}" is not supported`)},Z=(s,i,c,w)=>{const y=s.rankBefore,g=s.rankPageRows,u=(r,t)=>{const n=i.get(r);return n?t.map(o=>f(o,n,c)):t},l=r=>{const t=r?.relationMask;return{...r,relationMask:t===void 0?u:(n,o)=>t(n,u(n,o))}},p=(r,t,n,o)=>{const e=i.get(r);if(!e)return;const a=w?.[r]?.[o]?.[t];if(!a)return;const d=a.find(R=>I(e,R));if(d!==void 0)throw new A("MASK_UNSUPPORTED",`${n}() reading "${r}" via index "${t}" would order rows by masked column "${d}" — use an index whose declared fields are all unmasked, or unmask the column`)},k=(r,t,n)=>({async*[Symbol.asyncIterator](){for await(const o of{[Symbol.asyncIterator]:()=>r[Symbol.asyncIterator]()})yield f(o,t,c)},collect:async()=>(await r.collect()).map(e=>f(e,t,c)),collectWithScores:async()=>(await r.collectWithScores()).map(e=>{const a=f(e.document,t,c);return"distanceMeters"in e?{distanceMeters:null,document:a}:{document:a,score:e.score}}),filter:o=>k(r.filter(e=>o(f(e,t,c))),t,n),first:async()=>{const o=await r.first();return o?f(o,t,c):null},order:o=>k(r.order(o),t,n),paginate:async o=>F(await r.paginate(o),t,c),take:async o=>(await r.take(o)).map(a=>f(a,t,c)),unique:async()=>{const o=await r.unique();return o?f(o,t,c):null},withIndex:(o,e)=>(p(n,o,"withIndex","index"),L(e,t,n,"withIndex"),k(r.withIndex(o,e),t,n)),withSearchIndex:(o,e)=>(L(e,t,n,"withSearchIndex"),k(r.withSearchIndex(o,e),t,n)),withGeoIndex:(o,e)=>(p(n,o,"withGeoIndex","geo"),k(r.withGeoIndex(o,e),t,n))}),W=async(r,t)=>{if(s.lookupById){const d=await s.lookupById(r,t);if(d)return{row:d.row,tableName:i.has(d.tableName)?d.tableName:void 0}}const n=await s.get(r,t);if(!n)return{row:null,tableName:void 0};const o=t!==void 0&&i.has(t)?[t]:[],e=t===void 0?[...i.keys()]:o,a=await Promise.all(e.map(async d=>(await s.findFirst(d,{limit:1,where:{_id:r}}))?._id===r?d:void 0));return{row:n,tableName:a.find(d=>d!==void 0)}},S=(r,t,n)=>{const o=i.get(r);if(!o)return;const e=t.find(a=>typeof a=="string"&&I(o,a));if(e!==void 0)throw new A("MASK_UNSUPPORTED",`${n}() over masked column "${e}" on "${r}" is not supported`)},O=new Set;for(const r of i.values())for(const t of Object.keys(r))O.add(t);const P=(r,t,n,o)=>{if(!(!r||typeof r!="object"||Array.isArray(r)))for(const[e,a]of Object.entries(r))q(e,a,t,n,o)},q=(r,t,n,o,e)=>{if(r==="AND"||r==="OR"){for(const a of Array.isArray(t)?t:[])P(a,n,o,e);return}if(r==="NOT"){P(t,n,o,e);return}if(!r.startsWith("__")){if(I(n,r))throw new A("MASK_UNSUPPORTED",`${e}() filtering "${o}" by masked column "${r}" is not supported`);if(m(t))for(const a of Object.values(t))P(a,O,`${o}.${r}`,e)}},E=r=>{const t=i.get(r);return t?new Set(Object.keys(t)):new Set},h=(r,t,n)=>{O.size===0||t===void 0||P(t,E(r),r,n)},U=(r,t,n,o)=>{if(Array.isArray(t)){for(const e of t)if(!(!e||typeof e!="object"||Array.isArray(e))){for(const a of Object.keys(e))if(I(n,a))throw new A("MASK_UNSUPPORTED",`${o}() ordering "${r}" by masked column "${a}" is not supported`)}}},v=(r,t,n)=>{if(!(O.size===0||!t||typeof t!="object"||Array.isArray(t)))for(const[o,e]of Object.entries(t)){if(o==="_count"||!e||typeof e!="object"||Array.isArray(e))continue;const a=e,d=`${r}.${o}`;P(a.where,O,d,n),U(d,a.orderBy,O,n),v(d,a.with,n)}},$=(r,t,n)=>{h(r,t?.where,n),h(r,t?.baseWhere,n),U(r,t?.orderBy,E(r),n),v(r,t?.with,n)},_=r=>r&&typeof r=="object"&&!Array.isArray(r)?r:void 0,M=(r,t,n)=>{const o=_(t);h(r,o?.where,n),h(r,o?.baseWhere,n),v(r,o?.with,n)},j=(r,t)=>Object.hasOwn(i.get(r)??{},t)?t:void 0,B={...s,relationWrites:(()=>{if(s.relationWrites===void 0)return;const r={};for(const[t,n]of Object.entries(s.relationWrites))r[t]=Object.fromEntries(Object.entries(n).map(([o,e])=>{const[a,d]=e.kind==="one"?[t,e.table]:[e.table,t],R=e.through?j(e.through.table,e.through.from)??j(e.through.table,e.through.to):j(a,e.field)??j(d,e.references);return[o,R===void 0?e:{...e,refusal:`"${R}" is masked for this caller, so its stored value cannot be copied`}]}));return r})(),async deleteWhere(r,t,n){if(h(r,t,"deleteMany({ where })"),s.deleteWhere===void 0)throw new A("INTERNAL",`ctx.db.${r}.deleteMany({ where }) is unavailable: this writer has no where-based delete`);return s.deleteWhere(r,t,n)},async patchIf(r,t,n){if(h(r,n.where,"patchIf"),s.patchIf===void 0)throw new A("INTERNAL",`ctx.db.patchIf on "${r}" is unsupported: this writer has no conditional write`);const o=await s.patchIf(r,t,n),e=i.get(r);return o.doc&&e?{applied:o.applied,doc:f(o.doc,e,c)}:o},async patchWhere(r,t,n){if(h(r,t.where,"patchMany({ where })"),s.patchWhere===void 0)throw new A("INTERNAL",`ctx.db.${r}.patchMany({ where }) is unavailable: this writer has no where-based patch`);return s.patchWhere(r,t,n)},aggregate(r,t){return S(r,[t.field],"aggregate"),h(r,t.where,"aggregate"),s.aggregate(r,t)},count(r,t){const n=_(t),o=n&&("where"in n||"baseWhere"in n||"restrictsCounts"in n)?n.where:t;return h(r,o,"count"),n&&h(r,n.baseWhere,"count"),s.count(r,t)},async findFirst(r,t){$(r,t,"findFirst");const n=await s.findFirst(r,l(t)),o=i.get(r);return n&&o?f(n,o,c):n},async findFirstOrThrow(r,t){$(r,t,"findFirstOrThrow");const n=await s.findFirstOrThrow(r,l(t)),o=i.get(r);return o?f(n,o,c):n},async explain(r,t){return $(r,t,"explain"),s.explain(r,t)},async findMany(r,t){$(r,t,"findMany");const n=await s.findMany(r,l(t)),o=i.get(r);return o?F(n,o,c):n},async get(r,t){const{row:n,tableName:o}=await W(r,t),e=o===void 0?void 0:i.get(o);return!n||!e?n:f(n,e,c)},related:s.related?async(r,t)=>await s.related(r,l(t)):void 0,async lookupById(r,t){const n=await s.lookupById?.(r,t);if(!n)return null;const o=i.get(n.tableName);return{row:o?f(n.row,o,c):n.row,tableName:n.tableName}},groupBy(r,t){return S(r,[...t.by,t.agg?.field],"groupBy"),h(r,t.where,"groupBy"),s.groupBy(r,t)},query(r){const t=s.query(r),n=i.get(r);return n?k(t,n,r):t},async rank(r,t,n){return M(r,n,"rank"),p(r,t,"rank","rank"),s.rank(r,t,n)},async rankPage(r,t,n){M(r,n,"rankPage"),p(r,t,"rankPage","rank");const o=await s.rankPage(r,t,n),e=i.get(r);return e?F(o,e,c):o},...K("rankBefore",y,r=>(t,n,o)=>(M(t,o,"rankBefore"),p(t,n,"rankBefore","rank"),r(t,n,o))),...K("rankPageRows",g,r=>async(t,n,o)=>{M(t,o,"rankPageRows"),p(t,n,"rankPageRows","rank");const e=await r(t,n,o),a=i.get(t);return a?{...e,rows:e.rows.map(d=>({...d,doc:f(d.doc,a,c)}))}:e})},z=B;if(O.size>0)for(const[r,t]of Object.entries(s))H(t)&&(z[r]=Q(B,r));return B},nr=(s,i={})=>{const c=new Map(Object.entries(s)),w=G(i.roles),y=async({ctx:u,next:l})=>{const p={auth:await C(u.auth??{},w),ctx:u};if(i.bypass?.(p)===!0)return l();const k=Z(u.db,c,p,i.indexFields),W={db:k},{orm:S}=u;return S!==null&&typeof S=="object"&&(W.orm=V(k)),l({ctx:W})},g=new Map;for(const[u,l]of c)g.set(u,new Set(Object.keys(l)));return X(y,{columns:g})};export{nr as mask};

package/dist/packem_shared/middleware-oEEmcgVa.mjs

@@ -0,0 +1 @@
+import{LunoraError as g,isLunoraError as pe}from"@lunora/errors";import{findRelated as we,whereFilter as ge}from"@lunora/shard-engine";import{isPlainObject as H}from"@lunora/wire";import{bindTableFacade as Oe,bindOrm as be}from"./bindOrm-Kf5dmpGw.mjs";import{t as ve}from"./policy-tag-V0lqFzgS.mjs";import{deny as Re}from"./allowAll-DkRAgItV.mjs";const K=e=>{if(e===null||typeof e!="object")return!1;const t=Object.getPrototypeOf(e);return t===null||t===Object.prototype},J=4;class T extends Error{}const C=e=>e.includes("."),ht=e=>{const t=e.indexOf(".");return t===-1?e:e.slice(0,t)},ne=e=>{const t=e.split(".");if(t.length>J||t.includes(""))throw new T(`field path "${e}" must have 1 to ${String(J)} non-empty segments`);return t},We=(e,t)=>{if(!C(t))return e[t];let r=e;for(const s of ne(t)){if(!K(r)||!Object.hasOwn(r,s))return;r=r[s]}return r},re=(e,t,r,s)=>{const[a,...l]=t;if(a===void 0)throw new T(`field path "${s}" is empty`);if(e!=null&&!K(e))throw new T(`cannot set "${s}": "${a}" sits inside a value that is not an object`);const d=e??{};return{...d,[a]:l.length===0?r:re(d[a],l,r,s)}},Ee=(e,t)=>{const r=Object.keys(e).filter(a=>C(a));if(r.length===0)return e;for(const a of r){const l=r.find(d=>d!==a&&d.startsWith(`${a}.`));if(l!==void 0)throw new T(`patch sets both "${a}" and "${l}", which overlap; set one or the other`)}const s={};for(const[a,l]of Object.entries(e))C(a)||(s[a]=l);for(const a of r){const[l="",...d]=ne(a);if(Object.hasOwn(e,l))throw new T(`patch sets both "${l}" and "${a}"; set one or the other`);s[l]=re(Object.hasOwn(s,l)?s[l]:t[l],d,e[a],a)}return s},Ae=e=>{const t=typeof e;return t==="number"||t==="string"||t==="boolean"?t:void 0},Se=["every","is","isNot","none","some"],ke=new Set(Se),Be=e=>{if(e===null||typeof e!="object"||Array.isArray(e))return!1;const t=Object.keys(e);return t.length>0&&t.every(r=>ke.has(r))},Z=(e,t,r)=>t?{[e]:r(t)}:{},Q={decrement:{apply:(e,t)=>e-t,kind:"number"},divide:{apply:(e,t)=>e/t,kind:"number"},increment:{apply:(e,t)=>e+t,kind:"number"},multiply:{apply:(e,t)=>e*t,kind:"number"},toggle:{kind:"boolean"}};class R extends Error{}const oe=e=>{if(!K(e))return;const t=Object.keys(e),[r]=t;if(!(t.length!==1||r===void 0||!Object.hasOwn(Q,r)))return{operand:e[r],operator:r}},Pe=e=>oe(e)!==void 0,_e=(e,t,r,s)=>{const a=Q[t];if(a.apply===void 0){if(r!==!0)throw new R(`patch: use { toggle: true } on "${e}".`);if(typeof s!="boolean")throw new R(`patch: cannot toggle "${e}" — its current value is ${String(s)}; set a boolean first.`);return!s}if(typeof r!="number"||!Number.isFinite(r))throw new R(`patch: "${t}" on "${e}" needs a finite number, got ${String(r)}.`);if(typeof s!="number"||!Number.isFinite(s))throw new R(`patch: cannot ${t} "${e}" — its current value is ${String(s)}; set a number first.`);if(t==="divide"&&r===0)throw new R(`patch: cannot divide "${e}" by zero.`);const l=a.apply(s,r);if(!Number.isFinite(l))throw new R(`patch: "${t}" on "${e}" overflows to ${String(l)}.`);return l},se=(e,t)=>{const r=new Set;for(const[s,a]of Object.entries(e))t(s)!==void 0&&Pe(a)&&r.add(s);return r},Ie=(e,t,r)=>{let s;for(const a of se(e,r)){const{operand:l,operator:d}=oe(e[a]),b=r(a);if(Q[d].kind!==b)throw new R(`patch: "${d}" does not apply to the ${String(b)} column "${a}".`);s??={...e},s[a]=_e(a,d,l,t[a])}return s??e},Te=(e,t)=>{const r=a=>{const l=t[a];return typeof l=="number"||typeof l=="boolean"?typeof l:void 0},s={...e};for(const a of se(e,r))try{Object.assign(s,Ie({[a]:e[a]},t,r))}catch(l){if(!(l instanceof R))throw l}try{return Ee(s,t)}catch(a){if(a instanceof T)return s;throw a}},$e=["contains","eq","gt","gte","in","isNull","lt","lte","ne","notIn"],k=-1,B=0,W=1,$=e=>e?W:k,O=(e,t)=>e<t?e:t,me=(e,t)=>e>t?e:t,ie=e=>e===B?B:$(e===k),V=e=>{const t=typeof e;return t==="number"||t==="string"||t==="bigint"},P=e=>e==null,D=(e,t,r)=>{if(r===void 0)throw new g("BAD_REQUEST",`\`${t}\` on "${e}" received undefined; a comparison needs a value`)},De={gt:(e,t)=>e>t,gte:(e,t)=>e>=t,lt:(e,t)=>e<t,lte:(e,t)=>e<=t},Fe=(e,t,r)=>{let s=W;for(const a of["gt","gte","lt","lte"]){if(!(a in r))continue;const l=r[a];D(e,a,l);const d=C(e);if(d?Ae(l)===void 0:!V(l))s=O(s,k);else if(P(t))s=O(s,B);else{const b=De[a],p=d?typeof t==typeof l:V(t);s=O(s,$(p&&b(t,l)))}}return s},ee=(e,t,r)=>{if(!Array.isArray(r))throw new g("BAD_REQUEST",`\`${t}\` on "${e}" expects an array of values, received ${r===null?"null":typeof r}`);if(r.includes(void 0))throw new g("BAD_REQUEST",`\`${t}\` on "${e}" received undefined inside its list; a comparison needs a value`);return r},te=(e,t)=>t.length===0?k:P(e)?B:t.includes(e)?W:t.some(r=>P(r))?B:k,Me=(e,t,r)=>{let s=W;if("in"in r&&(s=O(s,te(t,ee(e,"in",r.in)))),"notIn"in r&&(s=O(s,ie(te(t,ee(e,"notIn",r.notIn))))),"contains"in r){const a=r.contains;D(e,"contains",a),s=P(t)?O(s,B):O(s,$(typeof t=="string"&&typeof a=="string"&&t.includes(a)))}return"isNull"in r&&(s=O(s,$(r.isNull===!0===P(t)))),s},Y=(e,t,r)=>t===null?$(r===P(e)):P(e)?B:$(r===(e===t)),je=(e,t,r)=>{let s=W;return"eq"in r&&(D(e,"eq",r.eq),s=O(s,Y(t,r.eq,!0))),"ne"in r&&(D(e,"ne",r.ne),s=O(s,Y(t,r.ne,!1))),s},Le=(e,t,r)=>O(je(e,t,r),O(Me(e,t,r),Fe(e,t,r))),Ce=(e,t,r,s)=>{if(t==="NOT")return ie(s(e,r??{}));if(!Array.isArray(r))return k;let a=t==="AND"?W:k;for(const l of r){const d=s(e,l);a=t==="AND"?O(a,d):me(a,d)}return a},ae=e=>e==="AND"||e==="OR"||e==="NOT",Ue=e=>H(e)&&Object.keys(e).every(t=>$e.includes(t)),U=e=>Object.keys(e).some(t=>{const r=e[t];return ae(t)?t==="NOT"?U(r??{}):Array.isArray(r)&&r.some(s=>U(s??{})):Be(r)}),ce=(e,t)=>{let r=W;for(const s of Object.keys(t)){const a=t[s];if(ae(s)){r=O(r,Ce(e,s,a,ce));continue}const l=We(e,s);if(Ue(a)){r=O(r,Le(s,l,a));continue}D(s,"eq",a),r=O(r,Y(l,a,!0))}return r},q=(e,t)=>ce(e,t)===W,le=500,I=(e,t,r)=>{const s=t??le;if(e>s)throw new g("BATCH_LIMIT_EXCEEDED",`${r}: batch of ${String(e)} exceeds the limit of ${String(s)} (raise options.limit or chunk the call)`,{status:400})},qe=Re(),Ne=Symbol.for("lunora.ctxdb.rls-unwrap"),fe=Symbol.for("lunora.rls.wrapped-chain"),Ye=e=>e[fe],xe=e=>{const t=new Map;for(const r of e){const s=t.get(r.table)??[];s.push(r),t.set(r.table,s)}return t},He=(e,t)=>{const r=[];let s=!1;for(const a of e){if(a.on!=="read")continue;const l=a.when(t);if(l!==void 0){if(l===!0){s=!0;break}l!==!1&&r.push(l)}}if(!s)return r.length===0?qe:r.length===1?r[0]:{OR:r}},Ke=(e,t,r)=>{const s=e.when({...t,row:r});if(s===void 0||s===!0)return!0;if(s===!1)return!1;if(U(s))throw new g("RELATION_PREDICATE_UNSUPPORTED","relation predicates are not supported in write policies; use a read policy or a flat column check");return q(r,s)},Qe=(e,t,r)=>{const s=e.when(t);if(s===void 0||s===!0)return r===void 0||Ke(e,t,r);if(s===!1)return!1;if(U(s))throw new g("RELATION_PREDICATE_UNSUPPORTED","relation predicates are not supported in write policies; use a read policy or a flat column check");return!t.row||!q(t.row,s)?!1:r===void 0||q(r,s)},ze=(e,t,r,s)=>{let a=!1;for(const l of e)if(l.on===t&&(a=!0,!Qe(l,r,s)))return!1;return a},Xe=new Set(["baseWhere","relationBaseWhere","restrictsCounts","where"]),Ge=(e,t)=>t===void 0?!0:e==="restrictsCounts"?typeof t=="boolean":e==="relationBaseWhere"?typeof t=="function":H(t),Je=e=>{const t=Object.keys(e);return t.length===0?!1:t.every(r=>Xe.has(r)&&Ge(r,e[r]))},Ze=e=>e===void 0?{}:H(e)&&Je(e)?e:{where:e},x=e=>e!==void 0&&Object.keys(e).length>0,Ve=e=>{if(e.length!==0)return e.length===1?e[0]:{AND:e}},v=(e,t)=>x(t)?!e||Object.keys(e).length===0?t:{AND:[t,e]}:e,et=e=>{if(typeof e!="object"||e===null||Array.isArray(e))return!1;const t=e;return typeof t.findMany=="function"&&typeof t.withSearchIndex=="function"},tt=(e,t,r)=>{const[s]=r,a=r.length===1&&s!==void 0?s.perTable:new Set(r.flatMap(n=>[...n.perTable.keys()])),l=new Map,d=n=>{const o=l.get(n);if(o)return o;const i=[];let c=!1;for(const u of r){const h=u.perTable.get(n);if(!h||h.length===0||!h.some(_=>_.on==="read"))continue;c=!0;const y=He(h,u.context);y!==void 0&&i.push(y)}const f={baseWhere:Ve(i),restricts:c};return l.set(n,f),f},b=(n,o,i,c)=>{for(const f of r){const u=f.perTable.get(n);if(u&&!ze(u,o,{...f.context,row:i},c))return!1}return!0},p=n=>d(n).restricts?t:e,w=n=>d(n).baseWhere,E=async(n,o,i)=>{if(t.lookupById){const y=await t.lookupById(n,o);if(y)return{row:y.row,tableName:a.has(y.tableName)?y.tableName:void 0}}const c=await t.get(n,o);if(!c)return{row:null,tableName:void 0};const f=o??i,u=f===void 0?[...a.keys()]:[f].filter(y=>a.has(y)),h=await Promise.all(u.map(async y=>(await t.findFirst(y,{limit:1,where:{_id:n}}))?._id===n?y:void 0));return{row:c,tableName:h.find(y=>y!==void 0)}},N=async(n,o,i)=>{const c=await E(n,o,i);return c.row&&c.tableName!==void 0?{row:c.row,tableName:c.tableName}:void 0},A=async(n,o,i,c,f,u)=>{const h=await N(n,f,u);if(!h)return i(e);const y=c?c(h.row):void 0;if(!b(h.tableName,o,h.row,y))throw new g("FORBIDDEN",`${o} denied by policy`);return i(t,h.tableName)},F=(n,o,i)=>{if(i?.hard===!0)return!1;const c=e.softDeleteFields?.get(n);return c!==void 0&&o[c]!==null&&o[c]!==void 0},M=async(n,o,i,c,f)=>{const u=i?t:e,h=await u.findFirst(o,{...i?{baseWhere:d(o).baseWhere}:{},...c?.hard===!0?{includeDeleted:!0}:{},limit:1,relationBaseWhere:w,where:f===void 0?{_id:n}:v(f,{_id:n})});if(!h||F(o,h,c))return!1;if(i&&!b(o,"delete",h))throw new g("FORBIDDEN","delete denied by policy");return await u.delete(n,o,c),!0},m=async(n,o,i,c)=>{const f=a.has(n),u=f?t:e,h=i===void 0?void 0:{hard:i},y=e.inTransaction?.()!==!0||e.deleteRereadTables?.has(n)===!0;let _=0;for(const X of o){const G=String(X._id);if(y){await M(G,n,f,h,c)&&(_+=1);continue}if(f&&!b(n,"delete",X))throw new g("FORBIDDEN","delete denied by policy");await u.delete(G,n,h),_+=1}return _},j=(n,o,i,c)=>A(n,"update",(f,u)=>i(f,{verify:u===void 0?void 0:(h,y)=>b(u,"update",h,y)}),f=>({...f,...Te(o,f)}),c),L=(n,o)=>{const{baseWhere:i}=d(n);if(x(i))throw new g("COUNT_RLS_UNSUPPORTED",`${o}() is not supported on "${n}" inside an RLS-restricted context`)},ue=e.rankBefore,he=e.rankPageRows,{relationEdges:z}=e,S={...e,async count(n,o){const{baseWhere:i}=d(n),c=Ze(o);return p(n).count(n,{...c,baseWhere:v(c.baseWhere,i),relationBaseWhere:w,restrictsCounts:(c.restrictsCounts??!1)||x(i)})},delete:(n,o,i)=>A(n,"delete",c=>c.delete(n,o,i),void 0,o),async deleteAll(n,o){const i=Math.max(1,o?.chunkSize??le),{baseWhere:c}=d(n);let f=0;for(;;){const u=await p(n).findMany(n,{baseWhere:c,limit:i,relationBaseWhere:w}),{page:h}=u;if(h.length===0||(f+=await m(n,h,o?.hard),h.length<i))break}return{deleted:f}},async deleteMany(n,o,i){I(n.length,o?.limit,"deleteMany");for(const c of n)await A(c,"delete",f=>f.delete(c,i),void 0,i);return{deleted:n.length}},async deleteWhere(n,o,i){const{baseWhere:c}=d(n),f=await p(n).findMany(n,{baseWhere:v(o,c),relationBaseWhere:w}),u=f.page.map(h=>String(h._id));return I(u.length,i?.limit,"deleteWhere"),{deleted:await m(n,f.page,void 0,o)}},async findFirst(n,o){const{baseWhere:i}=d(n);return p(n).findFirst(n,{...o,baseWhere:v(o?.baseWhere,i),relationBaseWhere:w})},async findFirstOrThrow(n,o){const{baseWhere:i}=d(n);return p(n).findFirstOrThrow(n,{...o,baseWhere:v(o?.baseWhere,i),relationBaseWhere:w})},async explain(n,o){const{baseWhere:i}=d(n);return p(n).explain(n,{...o,baseWhere:v(o?.baseWhere,i),relationBaseWhere:w})},async findMany(n,o){const{baseWhere:i}=d(n);return p(n).findMany(n,{...o,baseWhere:v(o?.baseWhere,i),relationBaseWhere:w})},async get(n,o){const i=await E(n,o);if(!i.row)return null;if(i.tableName===void 0)return e.get(n,o);const{baseWhere:c,restricts:f}=d(i.tableName);if(!f)return e.get(n,o);if(!c)return i.row;const u=await t.findFirst(i.tableName,{baseWhere:c,limit:1,where:{_id:n}});return u?._id===n?u:null},async lookupById(n,o){const i=await E(n,o);if(!i.row)return null;if(i.tableName===void 0||!d(i.tableName).restricts)return await e.lookupById?.(n,o)??null;const{baseWhere:c}=d(i.tableName);if(!c)return{row:i.row,tableName:i.tableName};const f=await t.findFirst(i.tableName,{baseWhere:c,limit:1,where:{_id:n}});return f?._id===n?{row:f,tableName:i.tableName}:null},async insert(n,o,i){if(a.has(n)){if(!b(n,"insert",o))throw new g("FORBIDDEN",`insert on "${n}" denied by policy`);return t.insert(n,o,i)}return e.insert(n,o,i)},async insertMany(n,o,i){if(I(o.length,i?.limit,"insertMany"),a.has(n)){for(const c of o)if(!b(n,"insert",c))throw new g("FORBIDDEN",`insert on "${n}" denied by policy`);return t.insertMany(n,o,i)}return e.insertMany(n,o,i)},async insertManyUnsafe(n,o,i){if(I(o.length,i?.limit,"insertManyUnsafe"),a.has(n)){for(const c of o)if(!b(n,"insert",c))throw new g("FORBIDDEN",`insert on "${n}" denied by policy`);return t.insertManyUnsafe(n,o,i)}return e.insertManyUnsafe(n,o,i)},patch:(n,o,i)=>j(n,o,(c,f)=>c.patch(n,o,i,f),i),assertPatchAllowed:(n,o)=>j(n,{},()=>Promise.resolve(),o),async patchIf(n,o,i){const c=await j(o,i.patch,async(u,h)=>{if(u.patchIf===void 0)throw new g("INTERNAL",`ctx.db.patchIf on "${n}" is unsupported: this writer has no conditional write`);return u.patchIf(n,o,{...i,verify:h.verify})},n);return c.doc===null||await S.get(o,n).then(u=>u!==null,u=>{if(pe(u)&&u.code==="RLS_REQUIRED")return!1;throw u})?c:{applied:c.applied,doc:null}},async patchMany(n,o,i){I(n.length,o?.limit,"patchMany");for(const c of n)await j(c.id,c.patch,(f,u)=>f.patch(c.id,c.patch,i,u),i);return{patched:n.length}},async patchWhere(n,o,i){const{baseWhere:c}=d(n),u=(await p(n).findMany(n,{baseWhere:v(o.where,c),relationBaseWhere:w})).page.map(h=>({id:String(h._id),patch:o.patch}));return I(u.length,i?.limit,"patchWhere"),S.patchMany(u,i)},query(n){const{baseWhere:o}=d(n),i=p(n).query(n);return o?i.filter(ge(o,c=>q(c,o))):i},related:z===void 0?void 0:async(n,o)=>we({findMany:async(i,c)=>S.findMany(i,c),lookupById:async i=>t.lookupById?.(i)},z,n,{cursor:o?.cursor,depth:o?.depth,direction:o?.direction,edges:o?.edges,limit:o?.limit,relationMask:o?.relationMask}),restore:(n,o)=>A(n,"update",async i=>{const c=i.restore??t.restore;if(!c)throw new g("BAD_REQUEST","restore is not supported by this writer");await c(n,o)},void 0,o),replace:(n,o,i)=>A(n,"update",c=>c.replace(n,o,i),c=>({...o,_creationTime:o._creationTime??c._creationTime,_id:c._id}),i),aggregate(n,o){const{baseWhere:i}=d(n);return p(n).aggregate(n,{...o,baseWhere:v(o.baseWhere,i),relationBaseWhere:w})},groupBy(n,o){const{baseWhere:i}=d(n);return p(n).groupBy(n,{...o,baseWhere:v(o.baseWhere,i),relationBaseWhere:w})},rank(n,o,i){return L(n,"rank"),p(n).rank(n,o,i)},rankPage(n,o,i){return L(n,"rankPage"),p(n).rankPage(n,o,i)},wipeShard(){throw new g("FORBIDDEN","ctx.db.wipeShard() is unavailable under rls(): a whole-shard erase can't be policy-gated per row, and erasing only policy-visible rows would silently leave data behind. Run it from an internalMutation, or use ctx.db.deleteAll(table) per table.",{status:403})},...Z("rankBefore",ue,n=>(o,i,c)=>(L(o,"rankBefore"),(p(o).rankBefore??n)(o,i,c))),...Z("rankPageRows",he,n=>(o,i,c)=>(L(o,"rankPageRows"),(p(o).rankPageRows??n)(o,i,c)))},ye=S;if(a.size>0)for(const[n,o]of Object.entries(e))et(o)&&(ye[n]=Oe(S,n));return Object.defineProperty(S,fe,{configurable:!0,enumerable:!1,value:{base:e,raw:t,steps:r},writable:!1}),S},de=e=>typeof e=="string"?e:e.name,nt=e=>{const t=new Map;for(const r of e??[])t.set(r.name,new Set((r.permissions??[]).map(s=>de(s))));return t},rt=(e,t)=>{const r=new Set;for(const s of e)for(const a of t.get(s)??[])r.add(a);return s=>r.has(de(s))},ot=["roles","role"],st=e=>{for(const t of ot){const r=e?.[t];if(typeof r=="string"){const s=r.split(",").map(a=>a.trim()).filter(a=>a.length>0);if(s.length>0)return s}if(Array.isArray(r)){const s=r.filter(a=>typeof a=="string"&&a.length>0);if(s.length>0)return s}}return[]},it=async(e,t)=>{const r=await e.getIdentity?.()??null,s=[...new Set([...st(r),...e.roles??[]])];return{can:rt(s,t),identity:r,roles:s,userId:e.userId??null}},yt=(e,t={})=>{const r=e,s=xe(r),a=nt(t.roles);return ve(async({ctx:d,next:b})=>{const p={auth:await it(d.auth??{},a),ctx:d},w=d.db,E=Ye(w),N=E?.base??w,A=E?.raw??w[Ne]??w,F=tt(N,A,[...E?.steps??[],{context:p,perTable:s}]),M={db:F},{orm:m}=d;return m!==null&&typeof m=="object"&&(M.orm=be(F)),b({ctx:M})},[{policies:r,roles:t.roles??[]}])};export{it as a,et as b,ht as c,Be as d,st as e,He as f,rt as g,ze as h,nt as i,q as m,Z as o,yt as r};

package/dist/packem_shared/{rls-DRIRHal7.mjs → rls-DRFzG7LZ.mjs}

@@ -1 +1 @@
-import{f as t,h as i,i as m,b as l,m as d,e as h,g as n,a as p,r as c}from"./middleware-Dqm5Tc-j.mjs";import"./bindOrm-Kf5dmpGw.mjs";import"./policy-tag-V0lqFzgS.mjs";import"./allowAll-DkRAgItV.mjs";export{t as computeReadBaseWhere,i as evaluateWrite,m as indexRolePermissions,l as isFacadeEntry,d as matchesWhere,h as readIdentityRoles,n as resolveCan,p as resolvePolicyAuth,c as rls};
+import{f as t,h as i,i as m,b as l,m as d,e as h,g as n,a as p,r as c}from"./middleware-oEEmcgVa.mjs";import"./bindOrm-Kf5dmpGw.mjs";import"./policy-tag-V0lqFzgS.mjs";import"./allowAll-DkRAgItV.mjs";export{t as computeReadBaseWhere,i as evaluateWrite,m as indexRolePermissions,l as isFacadeEntry,d as matchesWhere,h as readIdentityRoles,n as resolveCan,p as resolvePolicyAuth,c as rls};

package/dist/packem_shared/{storageRules-Ce004Pqj.mjs → storageRules-Cd2r-H_T.mjs}

@@ -1 +1 @@
-import{LunoraError as k}from"@lunora/errors";import{i as A,a as D}from"./middleware-Dqm5Tc-j.mjs";const E=(e,t,o)=>{const i=n=>o.isAllowed("list",n,t)&&o.isAllowed("read",n,t),{get:c,query:g}=e,f={...e},b=n=>n.filter(r=>typeof r.key=="string"&&i(r.key));return typeof c=="function"&&(f.get=async(n,r)=>(n==="_storage"&&o.assertAllowed("read",r,t),c(n,r))),typeof g=="function"&&(f.query=n=>{const r=g(n),{collect:p}=r;return n!=="_storage"||typeof p!="function"?r:{...r,collect:async()=>b(await p())}}),f},N=(e,t)=>{if(e===void 0)return!0;const o=e.endsWith("/")?e.slice(0,-1):e;return o===""||t===o||t.startsWith(`${o}/`)},S=e=>{const t=e[1],o=typeof t=="object"&&t!==null?t.method:void 0;return typeof o=="string"&&o.toUpperCase()==="PUT"?"write":"read"},M=[["createMultipartUpload","write"],["delete","delete"],["deleteAfterCommit","delete"],["download","read"],["generateUploadUrl","write"],["getMetadata","read"],["getSignedUrl",S],["getUrl","read"],["head","read"],["resumeMultipartUpload","write"],["store","write"],["upload","write"]],$=[["getPresignedUrl","ctx.storage.getPresignedUrl is not available under storageRules(...): a presigned URL reaches R2 directly, past every rule. Use getSignedUrl or generateUploadUrl, which route back through the Worker."],["list",'ctx.storage.list is not available under storageRules(...); enumerate via ctx.db.system.query("_storage"), which the rules filter.']],P=(e,t)=>{try{return e(t).bucketName===t}catch{return!1}},B=(e,t)=>{const o=e.bucketName??"default",{bucket:i}=e;for(const c of new Set(t))if(!(c===o||typeof i=="function"&&P(i,c)))throw new k("INTERNAL",`storageRules: rule for bucket "${c}" governs nothing — this request's storage cannot address that bucket (the accessor is "${o}", and selecting "${c}" does not reach a bucket of that name). A rule on an unaddressable bucket leaves the operation it was written to gate wide open. Match the rule's \`bucket\` to the name the binding is registered under in \`.storage({ bucket, buckets })\`.`)},_=(e,t={})=>{const o=A(t.roles);return async({ctx:i,next:c})=>{const g=await D(i.auth??{},o),f=(s,d,u)=>{const h=e.filter(a=>a.on===s&&a.bucket===u);if(h.length===0)return!0;const l={auth:g,ctx:i,key:d};return h.some(a=>N(a.prefix,d)&&a.when(l)===!0)},b=(s,d,u)=>{if(!f(s,d,u))throw new k("FORBIDDEN",`storage ${s} on "${d}" in bucket "${u}" denied by access rule`)},n=s=>{const d=s.bucketName??"default",u={bucketName:d};for(const[l,a]of M){const U=s[l];typeof U=="function"&&(u[l]=(...w)=>{const R=typeof w[0]=="string"?w[0]:"",v=typeof a=="function"?a(w):a;return b(v,R,d),U(...w)})}for(const[l,a]of $)typeof s[l]=="function"&&(u[l]=async()=>{throw new k("FORBIDDEN",a)});const{bucket:h}=s;return typeof h=="function"&&(u.bucket=l=>n(h(l))),u},r=i.storage;if(r===void 0)return c();B(r,e.map(s=>s.bucket));const p={storage:n(r)},y=i.db,m=y?.system;return y!==void 0&&m!==void 0&&typeof m=="object"&&(p.db={...y,system:E(m,r.bucketName??"default",{assertAllowed:b,isAllowed:f})}),c({ctx:p})}};export{_ as storageRules};
+import{LunoraError as k}from"@lunora/errors";import{i as A,a as D}from"./middleware-oEEmcgVa.mjs";const E=(e,t,o)=>{const i=n=>o.isAllowed("list",n,t)&&o.isAllowed("read",n,t),{get:c,query:g}=e,f={...e},b=n=>n.filter(r=>typeof r.key=="string"&&i(r.key));return typeof c=="function"&&(f.get=async(n,r)=>(n==="_storage"&&o.assertAllowed("read",r,t),c(n,r))),typeof g=="function"&&(f.query=n=>{const r=g(n),{collect:p}=r;return n!=="_storage"||typeof p!="function"?r:{...r,collect:async()=>b(await p())}}),f},N=(e,t)=>{if(e===void 0)return!0;const o=e.endsWith("/")?e.slice(0,-1):e;return o===""||t===o||t.startsWith(`${o}/`)},S=e=>{const t=e[1],o=typeof t=="object"&&t!==null?t.method:void 0;return typeof o=="string"&&o.toUpperCase()==="PUT"?"write":"read"},M=[["createMultipartUpload","write"],["delete","delete"],["deleteAfterCommit","delete"],["download","read"],["generateUploadUrl","write"],["getMetadata","read"],["getSignedUrl",S],["getUrl","read"],["head","read"],["resumeMultipartUpload","write"],["store","write"],["upload","write"]],$=[["getPresignedUrl","ctx.storage.getPresignedUrl is not available under storageRules(...): a presigned URL reaches R2 directly, past every rule. Use getSignedUrl or generateUploadUrl, which route back through the Worker."],["list",'ctx.storage.list is not available under storageRules(...); enumerate via ctx.db.system.query("_storage"), which the rules filter.']],P=(e,t)=>{try{return e(t).bucketName===t}catch{return!1}},B=(e,t)=>{const o=e.bucketName??"default",{bucket:i}=e;for(const c of new Set(t))if(!(c===o||typeof i=="function"&&P(i,c)))throw new k("INTERNAL",`storageRules: rule for bucket "${c}" governs nothing — this request's storage cannot address that bucket (the accessor is "${o}", and selecting "${c}" does not reach a bucket of that name). A rule on an unaddressable bucket leaves the operation it was written to gate wide open. Match the rule's \`bucket\` to the name the binding is registered under in \`.storage({ bucket, buckets })\`.`)},_=(e,t={})=>{const o=A(t.roles);return async({ctx:i,next:c})=>{const g=await D(i.auth??{},o),f=(s,d,u)=>{const h=e.filter(a=>a.on===s&&a.bucket===u);if(h.length===0)return!0;const l={auth:g,ctx:i,key:d};return h.some(a=>N(a.prefix,d)&&a.when(l)===!0)},b=(s,d,u)=>{if(!f(s,d,u))throw new k("FORBIDDEN",`storage ${s} on "${d}" in bucket "${u}" denied by access rule`)},n=s=>{const d=s.bucketName??"default",u={bucketName:d};for(const[l,a]of M){const U=s[l];typeof U=="function"&&(u[l]=(...w)=>{const R=typeof w[0]=="string"?w[0]:"",v=typeof a=="function"?a(w):a;return b(v,R,d),U(...w)})}for(const[l,a]of $)typeof s[l]=="function"&&(u[l]=async()=>{throw new k("FORBIDDEN",a)});const{bucket:h}=s;return typeof h=="function"&&(u.bucket=l=>n(h(l))),u},r=i.storage;if(r===void 0)return c();B(r,e.map(s=>s.bucket));const p={storage:n(r)},y=i.db,m=y?.system;return y!==void 0&&m!==void 0&&typeof m=="object"&&(p.db={...y,system:E(m,r.bucketName??"default",{assertAllowed:b,isAllowed:f})}),c({ctx:p})}};export{_ as storageRules};

package/dist/rls/testing.mjs

@@ -1 +1 @@
-import{i as y,e as P,g as W,f as v,m as I,h as R}from"../packem_shared/middleware-Dqm5Tc-j.mjs";const p=(m,o={})=>{const h=y(o.roles),x=o.ctx??{};return{as:f=>{const c=f??{},i=c.identity??null,l=P(i),u={auth:{can:W(l,h),identity:i,roles:l,userId:c.userId??null},ctx:x},d=(e,r,t,a)=>{const s=m.filter(n=>n.table===r);if(s.length===0)return!0;if(e==="read"){if(!s.some(b=>b.on==="read"))return!0;const n=v(s,u);return n===void 0||I(t??{},n)}return R(s,e,{...u,row:t},a)};return{can:d,cannot:(e,r,t,a)=>!d(e,r,t,a)}}}};export{p as expectPolicy};
+import{i as y,e as P,g as W,f as v,m as I,h as R}from"../packem_shared/middleware-oEEmcgVa.mjs";const p=(m,o={})=>{const h=y(o.roles),x=o.ctx??{};return{as:f=>{const c=f??{},i=c.identity??null,l=P(i),u={auth:{can:W(l,h),identity:i,roles:l,userId:c.userId??null},ctx:x},d=(e,r,t,a)=>{const s=m.filter(n=>n.table===r);if(s.length===0)return!0;if(e==="read"){if(!s.some(b=>b.on==="read"))return!0;const n=v(s,u);return n===void 0||I(t??{},n)}return R(s,e,{...u,row:t},a)};return{can:d,cannot:(e,r,t,a)=>!d(e,r,t,a)}}}};export{p as expectPolicy};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.203",
+  "version": "1.0.0-alpha.204",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -71,8 +71,8 @@
   },
   "dependencies": {
     "@lunora/errors": ">=1.0.0-alpha.51 <2.0.0-0",
-    "@lunora/scheduler": "1.0.0-alpha.127",
-    "@lunora/shard-engine": "1.0.0-alpha.130",
+    "@lunora/scheduler": "1.0.0-alpha.128",
+    "@lunora/shard-engine": "1.0.0-alpha.131",
     "@lunora/values": "1.0.0-alpha.66",
     "@lunora/wire": "1.0.0-alpha.1",
     "drizzle-orm": "^0.45.3",

package/dist/packem_shared/middleware-Dqm5Tc-j.mjs

@@ -1 +0,0 @@
-import{LunoraError as w,isLunoraError as he}from"@lunora/errors";import{findRelated as ye,whereFilter as pe}from"@lunora/shard-engine";import{isPlainObject as x}from"@lunora/wire";import{bindTableFacade as we,bindOrm as ge}from"./bindOrm-Kf5dmpGw.mjs";import{t as Oe}from"./policy-tag-V0lqFzgS.mjs";import{deny as be}from"./allowAll-DkRAgItV.mjs";const H=e=>{if(e===null||typeof e!="object")return!1;const t=Object.getPrototypeOf(e);return t===null||t===Object.prototype},X=4;class m extends Error{}const C=e=>e.includes("."),dt=e=>{const t=e.indexOf(".");return t===-1?e:e.slice(0,t)},ee=e=>{const t=e.split(".");if(t.length>X||t.includes(""))throw new m(`field path "${e}" must have 1 to ${String(X)} non-empty segments`);return t},ve=(e,t)=>{if(!C(t))return e[t];let r=e;for(const s of ee(t)){if(!H(r)||!Object.hasOwn(r,s))return;r=r[s]}return r},te=(e,t,r,s)=>{const[a,...l]=t;if(a===void 0)throw new m(`field path "${s}" is empty`);if(e!=null&&!H(e))throw new m(`cannot set "${s}": "${a}" sits inside a value that is not an object`);const f=e??{};return{...f,[a]:l.length===0?r:te(f[a],l,r,s)}},Re=(e,t)=>{const r=Object.keys(e).filter(a=>C(a));if(r.length===0)return e;for(const a of r){const l=r.find(f=>f!==a&&f.startsWith(`${a}.`));if(l!==void 0)throw new m(`patch sets both "${a}" and "${l}", which overlap; set one or the other`)}const s={};for(const[a,l]of Object.entries(e))C(a)||(s[a]=l);for(const a of r){const[l="",...f]=ee(a);if(Object.hasOwn(e,l))throw new m(`patch sets both "${l}" and "${a}"; set one or the other`);s[l]=te(Object.hasOwn(s,l)?s[l]:t[l],f,e[a],a)}return s},We=e=>{const t=typeof e;return t==="number"||t==="string"||t==="boolean"?t:void 0},Ee=["every","is","isNot","none","some"],Ae=new Set(Ee),ke=e=>{if(e===null||typeof e!="object"||Array.isArray(e))return!1;const t=Object.keys(e);return t.length>0&&t.every(r=>Ae.has(r))},G=(e,t,r)=>t?{[e]:r(t)}:{},K={decrement:{apply:(e,t)=>e-t,kind:"number"},divide:{apply:(e,t)=>e/t,kind:"number"},increment:{apply:(e,t)=>e+t,kind:"number"},multiply:{apply:(e,t)=>e*t,kind:"number"},toggle:{kind:"boolean"}};class R extends Error{}const ne=e=>{if(!H(e))return;const t=Object.keys(e),[r]=t;if(!(t.length!==1||r===void 0||!Object.hasOwn(K,r)))return{operand:e[r],operator:r}},Se=e=>ne(e)!==void 0,Be=(e,t,r,s)=>{const a=K[t];if(a.apply===void 0){if(r!==!0)throw new R(`patch: use { toggle: true } on "${e}".`);if(typeof s!="boolean")throw new R(`patch: cannot toggle "${e}" — its current value is ${String(s)}; set a boolean first.`);return!s}if(typeof r!="number"||!Number.isFinite(r))throw new R(`patch: "${t}" on "${e}" needs a finite number, got ${String(r)}.`);if(typeof s!="number"||!Number.isFinite(s))throw new R(`patch: cannot ${t} "${e}" — its current value is ${String(s)}; set a number first.`);if(t==="divide"&&r===0)throw new R(`patch: cannot divide "${e}" by zero.`);const l=a.apply(s,r);if(!Number.isFinite(l))throw new R(`patch: "${t}" on "${e}" overflows to ${String(l)}.`);return l},re=(e,t)=>{const r=new Set;for(const[s,a]of Object.entries(e))t(s)!==void 0&&Se(a)&&r.add(s);return r},Pe=(e,t,r)=>{let s;for(const a of re(e,r)){const{operand:l,operator:f}=ne(e[a]),b=r(a);if(K[f].kind!==b)throw new R(`patch: "${f}" does not apply to the ${String(b)} column "${a}".`);s??={...e},s[a]=Be(a,f,l,t[a])}return s??e},Ie=(e,t)=>{const r=a=>{const l=t[a];return typeof l=="number"||typeof l=="boolean"?typeof l:void 0},s={...e};for(const a of re(e,r))try{Object.assign(s,Pe({[a]:e[a]},t,r))}catch(l){if(!(l instanceof R))throw l}try{return Re(s,t)}catch(a){if(a instanceof m)return s;throw a}},_e=["contains","eq","gt","gte","in","isNull","lt","lte","ne","notIn"],B=-1,P=0,W=1,T=e=>e?W:B,g=(e,t)=>e<t?e:t,me=(e,t)=>e>t?e:t,oe=e=>e===P?P:T(e===B),J=e=>{const t=typeof e;return t==="number"||t==="string"||t==="bigint"},I=e=>e==null,M=(e,t,r)=>{if(r===void 0)throw new w("BAD_REQUEST",`\`${t}\` on "${e}" received undefined; a comparison needs a value`)},Te={gt:(e,t)=>e>t,gte:(e,t)=>e>=t,lt:(e,t)=>e<t,lte:(e,t)=>e<=t},$e=(e,t,r)=>{let s=W;for(const a of["gt","gte","lt","lte"]){if(!(a in r))continue;const l=r[a];M(e,a,l);const f=C(e);if(f?We(l)===void 0:!J(l))s=g(s,B);else if(I(t))s=g(s,P);else{const b=Te[a],p=f?typeof t==typeof l:J(t);s=g(s,T(p&&b(t,l)))}}return s},Z=(e,t,r)=>{if(!Array.isArray(r))throw new w("BAD_REQUEST",`\`${t}\` on "${e}" expects an array of values, received ${r===null?"null":typeof r}`);if(r.includes(void 0))throw new w("BAD_REQUEST",`\`${t}\` on "${e}" received undefined inside its list; a comparison needs a value`);return r},V=(e,t)=>t.length===0?B:I(e)?P:t.includes(e)?W:t.some(r=>I(r))?P:B,De=(e,t,r)=>{let s=W;if("in"in r&&(s=g(s,V(t,Z(e,"in",r.in)))),"notIn"in r&&(s=g(s,oe(V(t,Z(e,"notIn",r.notIn))))),"contains"in r){const a=r.contains;M(e,"contains",a),s=I(t)?g(s,P):g(s,T(typeof t=="string"&&typeof a=="string"&&t.includes(a)))}return"isNull"in r&&(s=g(s,T(r.isNull===!0===I(t)))),s},N=(e,t,r)=>t===null?T(r===I(e)):I(e)?P:T(r===(e===t)),Me=(e,t,r)=>{let s=W;return"eq"in r&&(M(e,"eq",r.eq),s=g(s,N(t,r.eq,!0))),"ne"in r&&(M(e,"ne",r.ne),s=g(s,N(t,r.ne,!1))),s},Fe=(e,t,r)=>g(Me(e,t,r),g(De(e,t,r),$e(e,t,r))),je=(e,t,r,s)=>{if(t==="NOT")return oe(s(e,r??{}));if(!Array.isArray(r))return B;let a=t==="AND"?W:B;for(const l of r){const f=s(e,l);a=t==="AND"?g(a,f):me(a,f)}return a},se=e=>e==="AND"||e==="OR"||e==="NOT",Le=e=>x(e)&&Object.keys(e).every(t=>_e.includes(t)),U=e=>Object.keys(e).some(t=>{const r=e[t];return se(t)?t==="NOT"?U(r??{}):Array.isArray(r)&&r.some(s=>U(s??{})):ke(r)}),ie=(e,t)=>{let r=W;for(const s of Object.keys(t)){const a=t[s];if(se(s)){r=g(r,je(e,s,a,ie));continue}const l=ve(e,s);if(Le(a)){r=g(r,Fe(s,l,a));continue}M(s,"eq",a),r=g(r,N(l,a,!0))}return r},q=(e,t)=>ie(e,t)===W,ae=500,_=(e,t,r)=>{const s=t??ae;if(e>s)throw new w("BATCH_LIMIT_EXCEEDED",`${r}: batch of ${String(e)} exceeds the limit of ${String(s)} (raise options.limit or chunk the call)`,{status:400})},Ce=be(),Ue=Symbol.for("lunora.ctxdb.rls-unwrap"),ce=Symbol.for("lunora.rls.wrapped-chain"),qe=e=>e[ce],Ne=e=>{const t=new Map;for(const r of e){const s=t.get(r.table)??[];s.push(r),t.set(r.table,s)}return t},Ye=(e,t)=>{const r=[];let s=!1;for(const a of e){if(a.on!=="read")continue;const l=a.when(t);if(l!==void 0){if(l===!0){s=!0;break}l!==!1&&r.push(l)}}if(!s)return r.length===0?Ce:r.length===1?r[0]:{OR:r}},xe=(e,t,r)=>{const s=e.when({...t,row:r});if(s===void 0||s===!0)return!0;if(s===!1)return!1;if(U(s))throw new w("RELATION_PREDICATE_UNSUPPORTED","relation predicates are not supported in write policies; use a read policy or a flat column check");return q(r,s)},He=(e,t,r)=>{const s=e.when(t);if(s===void 0||s===!0)return r===void 0||xe(e,t,r);if(s===!1)return!1;if(U(s))throw new w("RELATION_PREDICATE_UNSUPPORTED","relation predicates are not supported in write policies; use a read policy or a flat column check");return!t.row||!q(t.row,s)?!1:r===void 0||q(r,s)},Ke=(e,t,r,s)=>{let a=!1;for(const l of e)if(l.on===t&&(a=!0,!He(l,r,s)))return!1;return a},Qe=new Set(["baseWhere","relationBaseWhere","restrictsCounts","where"]),ze=(e,t)=>t===void 0?!0:e==="restrictsCounts"?typeof t=="boolean":e==="relationBaseWhere"?typeof t=="function":x(t),Xe=e=>{const t=Object.keys(e);return t.length===0?!1:t.every(r=>Qe.has(r)&&ze(r,e[r]))},Ge=e=>e===void 0?{}:x(e)&&Xe(e)?e:{where:e},Y=e=>e!==void 0&&Object.keys(e).length>0,Je=e=>{if(e.length!==0)return e.length===1?e[0]:{AND:e}},v=(e,t)=>Y(t)?!e||Object.keys(e).length===0?t:{AND:[t,e]}:e,Ze=e=>{if(typeof e!="object"||e===null||Array.isArray(e))return!1;const t=e;return typeof t.findMany=="function"&&typeof t.withSearchIndex=="function"},Ve=(e,t,r)=>{const[s]=r,a=r.length===1&&s!==void 0?s.perTable:new Set(r.flatMap(n=>[...n.perTable.keys()])),l=new Map,f=n=>{const o=l.get(n);if(o)return o;const i=[];let c=!1;for(const u of r){const h=u.perTable.get(n);if(!h||h.length===0||!h.some(D=>D.on==="read"))continue;c=!0;const y=Ye(h,u.context);y!==void 0&&i.push(y)}const d={baseWhere:Je(i),restricts:c};return l.set(n,d),d},b=(n,o,i,c)=>{for(const d of r){const u=d.perTable.get(n);if(u&&!Ke(u,o,{...d.context,row:i},c))return!1}return!0},p=n=>f(n).restricts?t:e,O=n=>f(n).baseWhere,E=async(n,o,i)=>{if(t.lookupById){const y=await t.lookupById(n,o);if(y)return{row:y.row,tableName:a.has(y.tableName)?y.tableName:void 0}}const c=await t.get(n,o);if(!c)return{row:null,tableName:void 0};const d=o??i,u=d===void 0?[...a.keys()]:[d].filter(y=>a.has(y)),h=await Promise.all(u.map(async y=>(await t.findFirst(y,{limit:1,where:{_id:n}}))?._id===n?y:void 0));return{row:c,tableName:h.find(y=>y!==void 0)}},F=async(n,o,i)=>{const c=await E(n,o,i);return c.row&&c.tableName!==void 0?{row:c.row,tableName:c.tableName}:void 0},A=async(n,o,i,c,d,u)=>{const h=await F(n,d,u);if(!h)return i(e);const y=c?c(h.row):void 0;if(!b(h.tableName,o,h.row,y))throw new w("FORBIDDEN",`${o} denied by policy`);return i(t,h.tableName)},j=async(n,o,i)=>{const c=await F(n,o);if(!c)return!1;if(!b(o,"delete",c.row))throw new w("FORBIDDEN","delete denied by policy");return await t.delete(n,o,i),!0},$=async(n,o,i)=>{const c=a.has(n),d=c?t:e,u=i===void 0?void 0:{hard:i},h=c&&e.deleteRereadTables?.has(n)===!0;let y=0;for(const D of o){const z=String(D._id);if(h){await j(z,n,u)&&(y+=1);continue}if(c&&!b(n,"delete",D))throw new w("FORBIDDEN","delete denied by policy");await d.delete(z,n,u),y+=1}return y},k=(n,o,i,c)=>A(n,"update",(d,u)=>i(d,{verify:u===void 0?void 0:(h,y)=>b(u,"update",h,y)}),d=>({...d,...Ie(o,d)}),c),L=(n,o)=>{const{baseWhere:i}=f(n);if(Y(i))throw new w("COUNT_RLS_UNSUPPORTED",`${o}() is not supported on "${n}" inside an RLS-restricted context`)},fe=e.rankBefore,de=e.rankPageRows,{relationEdges:Q}=e,S={...e,async count(n,o){const{baseWhere:i}=f(n),c=Ge(o);return p(n).count(n,{...c,baseWhere:v(c.baseWhere,i),relationBaseWhere:O,restrictsCounts:(c.restrictsCounts??!1)||Y(i)})},delete:(n,o,i)=>A(n,"delete",c=>c.delete(n,o,i),void 0,o),async deleteAll(n,o){const i=Math.max(1,o?.chunkSize??ae),{baseWhere:c}=f(n);let d=0;for(;;){const u=await p(n).findMany(n,{baseWhere:c,limit:i,relationBaseWhere:O}),{page:h}=u;if(h.length===0||(d+=await $(n,h,o?.hard),h.length<i))break}return{deleted:d}},async deleteMany(n,o,i){_(n.length,o?.limit,"deleteMany");for(const c of n)await A(c,"delete",d=>d.delete(c,i),void 0,i);return{deleted:n.length}},async deleteWhere(n,o,i){const{baseWhere:c}=f(n),d=await p(n).findMany(n,{baseWhere:v(o,c),relationBaseWhere:O}),u=d.page.map(h=>String(h._id));return _(u.length,i?.limit,"deleteWhere"),{deleted:await $(n,d.page)}},async findFirst(n,o){const{baseWhere:i}=f(n);return p(n).findFirst(n,{...o,baseWhere:v(o?.baseWhere,i),relationBaseWhere:O})},async findFirstOrThrow(n,o){const{baseWhere:i}=f(n);return p(n).findFirstOrThrow(n,{...o,baseWhere:v(o?.baseWhere,i),relationBaseWhere:O})},async explain(n,o){const{baseWhere:i}=f(n);return p(n).explain(n,{...o,baseWhere:v(o?.baseWhere,i),relationBaseWhere:O})},async findMany(n,o){const{baseWhere:i}=f(n);return p(n).findMany(n,{...o,baseWhere:v(o?.baseWhere,i),relationBaseWhere:O})},async get(n,o){const i=await E(n,o);if(!i.row)return null;if(i.tableName===void 0)return e.get(n,o);const{baseWhere:c,restricts:d}=f(i.tableName);if(!d)return e.get(n,o);if(!c)return i.row;const u=await t.findFirst(i.tableName,{baseWhere:c,limit:1,where:{_id:n}});return u?._id===n?u:null},async lookupById(n,o){const i=await E(n,o);if(!i.row)return null;if(i.tableName===void 0||!f(i.tableName).restricts)return await e.lookupById?.(n,o)??null;const{baseWhere:c}=f(i.tableName);if(!c)return{row:i.row,tableName:i.tableName};const d=await t.findFirst(i.tableName,{baseWhere:c,limit:1,where:{_id:n}});return d?._id===n?{row:d,tableName:i.tableName}:null},async insert(n,o,i){if(a.has(n)){if(!b(n,"insert",o))throw new w("FORBIDDEN",`insert on "${n}" denied by policy`);return t.insert(n,o,i)}return e.insert(n,o,i)},async insertMany(n,o,i){if(_(o.length,i?.limit,"insertMany"),a.has(n)){for(const c of o)if(!b(n,"insert",c))throw new w("FORBIDDEN",`insert on "${n}" denied by policy`);return t.insertMany(n,o,i)}return e.insertMany(n,o,i)},async insertManyUnsafe(n,o,i){if(_(o.length,i?.limit,"insertManyUnsafe"),a.has(n)){for(const c of o)if(!b(n,"insert",c))throw new w("FORBIDDEN",`insert on "${n}" denied by policy`);return t.insertManyUnsafe(n,o,i)}return e.insertManyUnsafe(n,o,i)},patch:(n,o,i)=>k(n,o,(c,d)=>c.patch(n,o,i,d),i),assertPatchAllowed:(n,o)=>k(n,{},()=>Promise.resolve(),o),async patchIf(n,o,i){const c=await k(o,i.patch,async(u,h)=>{if(u.patchIf===void 0)throw new w("INTERNAL",`ctx.db.patchIf on "${n}" is unsupported: this writer has no conditional write`);return u.patchIf(n,o,{...i,verify:h.verify})},n);return c.doc===null||await S.get(o,n).then(u=>u!==null,u=>{if(he(u)&&u.code==="RLS_REQUIRED")return!1;throw u})?c:{applied:c.applied,doc:null}},async patchMany(n,o,i){_(n.length,o?.limit,"patchMany");for(const c of n)await k(c.id,c.patch,(d,u)=>d.patch(c.id,c.patch,i,u),i);return{patched:n.length}},async patchWhere(n,o,i){const{baseWhere:c}=f(n),u=(await p(n).findMany(n,{baseWhere:v(o.where,c),relationBaseWhere:O})).page.map(h=>({id:String(h._id),patch:o.patch}));return _(u.length,i?.limit,"patchWhere"),S.patchMany(u,i)},query(n){const{baseWhere:o}=f(n),i=p(n).query(n);return o?i.filter(pe(o,c=>q(c,o))):i},related:Q===void 0?void 0:async(n,o)=>ye({findMany:async(i,c)=>S.findMany(i,c),lookupById:async i=>t.lookupById?.(i)},Q,n,{cursor:o?.cursor,depth:o?.depth,direction:o?.direction,edges:o?.edges,limit:o?.limit,relationMask:o?.relationMask}),restore:(n,o)=>A(n,"update",async i=>{const c=i.restore??t.restore;if(!c)throw new w("BAD_REQUEST","restore is not supported by this writer");await c(n,o)},void 0,o),replace:(n,o,i)=>A(n,"update",c=>c.replace(n,o,i),c=>({...o,_creationTime:o._creationTime??c._creationTime,_id:c._id}),i),aggregate(n,o){const{baseWhere:i}=f(n);return p(n).aggregate(n,{...o,baseWhere:v(o.baseWhere,i),relationBaseWhere:O})},groupBy(n,o){const{baseWhere:i}=f(n);return p(n).groupBy(n,{...o,baseWhere:v(o.baseWhere,i),relationBaseWhere:O})},rank(n,o,i){return L(n,"rank"),p(n).rank(n,o,i)},rankPage(n,o,i){return L(n,"rankPage"),p(n).rankPage(n,o,i)},wipeShard(){throw new w("FORBIDDEN","ctx.db.wipeShard() is unavailable under rls(): a whole-shard erase can't be policy-gated per row, and erasing only policy-visible rows would silently leave data behind. Run it from an internalMutation, or use ctx.db.deleteAll(table) per table.",{status:403})},...G("rankBefore",fe,n=>(o,i,c)=>(L(o,"rankBefore"),(p(o).rankBefore??n)(o,i,c))),...G("rankPageRows",de,n=>(o,i,c)=>(L(o,"rankPageRows"),(p(o).rankPageRows??n)(o,i,c)))},ue=S;if(a.size>0)for(const[n,o]of Object.entries(e))Ze(o)&&(ue[n]=we(S,n));return Object.defineProperty(S,ce,{configurable:!0,enumerable:!1,value:{base:e,raw:t,steps:r},writable:!1}),S},le=e=>typeof e=="string"?e:e.name,et=e=>{const t=new Map;for(const r of e??[])t.set(r.name,new Set((r.permissions??[]).map(s=>le(s))));return t},tt=(e,t)=>{const r=new Set;for(const s of e)for(const a of t.get(s)??[])r.add(a);return s=>r.has(le(s))},nt=["roles","role"],rt=e=>{for(const t of nt){const r=e?.[t];if(typeof r=="string"){const s=r.split(",").map(a=>a.trim()).filter(a=>a.length>0);if(s.length>0)return s}if(Array.isArray(r)){const s=r.filter(a=>typeof a=="string"&&a.length>0);if(s.length>0)return s}}return[]},ot=async(e,t)=>{const r=await e.getIdentity?.()??null,s=[...new Set([...rt(r),...e.roles??[]])];return{can:tt(s,t),identity:r,roles:s,userId:e.userId??null}},ut=(e,t={})=>{const r=e,s=Ne(r),a=et(t.roles);return Oe(async({ctx:f,next:b})=>{const p={auth:await ot(f.auth??{},a),ctx:f},O=f.db,E=qe(O),F=E?.base??O,A=E?.raw??O[Ue]??O,j=Ve(F,A,[...E?.steps??[],{context:p,perTable:s}]),$={db:j},{orm:k}=f;return k!==null&&typeof k=="object"&&($.orm=ge(j)),b({ctx:$})},[{policies:r,roles:t.roles??[]}])};export{ot as a,Ze as b,dt as c,ke as d,rt as e,Ye as f,tt as g,Ke as h,et as i,q as m,G as o,ut as r};