@lunora/server 1.0.0-alpha.21 → 1.0.0-alpha.210

package/dist/types.mjs

@@ -1,31 +0,0 @@
-const namespaceCache = /* @__PURE__ */ new Map();
-const anyApi = /* @__PURE__ */ new Proxy(
-  {},
-  {
-    get(_target, namespace) {
-      const cached = namespaceCache.get(namespace);
-      if (cached) {
-        return cached;
-      }
-      const refCache = /* @__PURE__ */ new Map();
-      const nsProxy = /* @__PURE__ */ new Proxy(
-        {},
-        {
-          get(_inner, functionName) {
-            const cachedRef = refCache.get(functionName);
-            if (cachedRef) {
-              return cachedRef;
-            }
-            const ref = { __lunoraRef: `${String(namespace)}:${String(functionName)}` };
-            refCache.set(functionName, ref);
-            return ref;
-          }
-        }
-      );
-      namespaceCache.set(namespace, nsProxy);
-      return nsProxy;
-    }
-  }
-);
-
-export { anyApi };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.21",
+  "version": "1.0.0-alpha.210",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -56,17 +56,35 @@
       "types": "./dist/rls/testing.d.ts",
       "import": "./dist/rls/testing.mjs"
     },
+    "./otel": {
+      "types": "./dist/otel.d.ts",
+      "import": "./dist/otel.mjs"
+    },
+    "./in-process": {
+      "types": "./dist/in-process.d.ts",
+      "import": "./dist/in-process.mjs"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.3",
-    "@lunora/scheduler": "1.0.0-alpha.7",
-    "@lunora/values": "1.0.0-alpha.6",
-    "drizzle-orm": "^0.45.2",
-    "hono": "^4.12.28"
+    "@lunora/errors": ">=1.0.0-alpha.51 <2.0.0-0",
+    "@lunora/scheduler": "1.0.0-alpha.131",
+    "@lunora/shard-engine": "1.0.0-alpha.133",
+    "@lunora/values": "1.0.0-alpha.67",
+    "@lunora/wire": "1.0.0-alpha.1",
+    "drizzle-orm": "^0.45.3",
+    "hono": "^4.13.13"
+  },
+  "peerDependencies": {
+    "@opentelemetry/api": "^1.9.0"
+  },
+  "peerDependenciesMeta": {
+    "@opentelemetry/api": {
+      "optional": true
+    }
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"

package/dist/packem_shared/LunoraEnvError-BGmd1Qs0.mjs

@@ -1,187 +0,0 @@
-import { LunoraError as LunoraError$1 } from '@lunora/errors';
-import { optionalInner } from '@lunora/values';
-
-const SECRET_VALUE_PREFIXES = [
-  /^sk_/u,
-  /^pk_/u,
-  /^rk_/u,
-  /^ghp_/u,
-  /^gho_/u,
-  /^ghs_/u,
-  /^ghr_/u,
-  /^github_pat_/u,
-  /^xox[baprs]-/u,
-  /^AKIA/u,
-  /^AIza/u,
-  /^Bearer\s/u
-];
-const HIGH_ENTROPY_TOKEN = /[\w./+-]{24,}/gu;
-const STANDALONE_TOKEN = /^[\w./+-]+$/u;
-const EMBEDDED_PREFIXED_TOKEN_SHORT = /\b(?:(?:sk|pk|rk|ghp|gho|ghs|ghr)_[\w./+-]*|github_pat_[\w./+-]*|xox[baprs]-[\w./+-]*)/gu;
-const EMBEDDED_PREFIXED_TOKEN_LONG = /\b(?:AKIA|AIza)[\w./+-]+|Bearer\s+[\w./+-]+/gu;
-const URL_CREDENTIAL = /\b([a-z][\w.+-]*:\/\/[\w.%+-]+):[\w.%+-]+@/gu;
-const REDACTED = "[redacted]";
-const SECRET_KEY = /(?:KEY|PASSWORD|SECRET|TOKEN)$/u;
-const looksLikeSecretValue = (value) => {
-  if (SECRET_VALUE_PREFIXES.some((prefix) => prefix.test(value))) {
-    return true;
-  }
-  const trimmed = value.trim();
-  return trimmed.length >= 24 && STANDALONE_TOKEN.test(trimmed);
-};
-const QUOTED_VALUE = /(["'])(?<inner>(?:\\.|(?!\1).)*)\1/gu;
-const KEYED_VALUE = /\b(?<key>[A-Za-z_]\w*)\s*[=:]\s*\S+/gu;
-const redactSecrets = (message) => {
-  let out = message;
-  out = out.replaceAll(QUOTED_VALUE, (match, ...groups) => {
-    const named = groups.at(-1);
-    return named?.inner !== void 0 && looksLikeSecretValue(named.inner) ? REDACTED : match;
-  });
-  out = out.replaceAll(URL_CREDENTIAL, (_match, prefix) => `${prefix}:${REDACTED}@`);
-  out = out.replaceAll(EMBEDDED_PREFIXED_TOKEN_SHORT, REDACTED);
-  out = out.replaceAll(EMBEDDED_PREFIXED_TOKEN_LONG, REDACTED);
-  out = out.replaceAll(KEYED_VALUE, (match, ...groups) => {
-    const named = groups.at(-1);
-    return named?.key !== void 0 && SECRET_KEY.test(named.key) ? `${named.key}=${REDACTED}` : match;
-  });
-  out = out.replaceAll(HIGH_ENTROPY_TOKEN, REDACTED);
-  return out;
-};
-const redactValueForKey = (message, key, raw) => {
-  const masked = redactSecrets(message);
-  if (typeof raw === "string" && raw !== "" && SECRET_KEY.test(key)) {
-    return masked.replaceAll(raw, REDACTED);
-  }
-  return masked;
-};
-class LunoraEnvError extends LunoraError$1 {
-  failures;
-  constructor(failures) {
-    const summary = failures.map((failure) => `  - ${failure.key}: ${failure.message}`).join("\n");
-    super("ENV_INVALID", `Invalid environment (${String(failures.length)} key(s)):
-${summary}`, { name: "LunoraEnvError" });
-    this.failures = failures;
-  }
-}
-const TRUE_VALUES = /* @__PURE__ */ new Set(["1", "on", "true", "yes"]);
-const FALSE_VALUES = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
-const INTEGER_LITERAL = /^-?\d+$/u;
-const unwrapKind = (validator) => {
-  if (validator.kind !== "optional") {
-    return validator.kind;
-  }
-  const inner = optionalInner(validator);
-  return inner ? unwrapKind(inner) : validator.kind;
-};
-const coerce = (validator, raw) => {
-  if (typeof raw !== "string") {
-    return raw;
-  }
-  switch (unwrapKind(validator)) {
-    case "bigint": {
-      return INTEGER_LITERAL.test(raw.trim()) ? BigInt(raw.trim()) : raw;
-    }
-    case "boolean": {
-      const lowered = raw.trim().toLowerCase();
-      if (TRUE_VALUES.has(lowered)) {
-        return true;
-      }
-      if (FALSE_VALUES.has(lowered)) {
-        return false;
-      }
-      return raw;
-    }
-    case "number": {
-      const trimmed = raw.trim();
-      if (trimmed === "") {
-        return raw;
-      }
-      const parsed = Number(trimmed);
-      return Number.isNaN(parsed) ? raw : parsed;
-    }
-    default: {
-      return raw;
-    }
-  }
-};
-const validateKey = (key, validator, env, failures) => {
-  const raw = env[key];
-  if (raw === void 0 && validator.kind === "optional") {
-    return { ok: true, value: void 0 };
-  }
-  const result = validator.safeParse(coerce(validator, raw));
-  if (result.ok) {
-    return { ok: true, value: result.value };
-  }
-  failures.push({ key, message: redactValueForKey(result.error.message, key, raw) });
-  return { ok: false };
-};
-const requireEnvObject = (env) => {
-  if (typeof env !== "object" || env === null) {
-    throw new LunoraEnvError([{ key: "<env>", message: `expected an object, received ${env === null ? "null" : typeof env}` }]);
-  }
-  return env;
-};
-const defineEnv = (shape) => {
-  const keys = Object.keys(shape);
-  const cache = /* @__PURE__ */ new WeakMap();
-  const accessor = ((env) => {
-    const source = requireEnvObject(env);
-    let resolved = cache.get(source);
-    if (resolved === void 0) {
-      resolved = /* @__PURE__ */ new Map();
-      cache.set(source, resolved);
-    }
-    const cached = resolved;
-    const read = (property) => {
-      if (cached.has(property)) {
-        return cached.get(property);
-      }
-      const failures = [];
-      const outcome = validateKey(property, shape[property], source, failures);
-      if (!outcome.ok) {
-        throw new LunoraEnvError(failures);
-      }
-      cached.set(property, outcome.value);
-      return outcome.value;
-    };
-    return /* @__PURE__ */ new Proxy({}, {
-      get(_target, property) {
-        if (typeof property !== "string" || !(property in shape)) {
-          return void 0;
-        }
-        return read(property);
-      },
-      getOwnPropertyDescriptor(_target, property) {
-        if (typeof property === "string" && property in shape) {
-          return { configurable: true, enumerable: true, value: read(property), writable: false };
-        }
-        return void 0;
-      },
-      has(_target, property) {
-        return typeof property === "string" && property in shape;
-      },
-      ownKeys() {
-        return keys;
-      }
-    });
-  });
-  accessor.parse = (env) => {
-    const source = requireEnvObject(env);
-    const failures = [];
-    const out = {};
-    for (const key of keys) {
-      const outcome = validateKey(key, shape[key], source, failures);
-      if (outcome.ok && outcome.value !== void 0) {
-        out[key] = outcome.value;
-      }
-    }
-    if (failures.length > 0) {
-      throw new LunoraEnvError(failures);
-    }
-    return out;
-  };
-  return accessor;
-};
-
-export { LunoraEnvError, defineEnv, redactSecrets };

package/dist/packem_shared/LunoraError-WbxmrpxR.mjs

@@ -1,9 +0,0 @@
-import { LunoraError as LunoraError$1 } from '@lunora/errors';
-
-class LunoraError extends LunoraError$1 {
-  constructor(code, message, data) {
-    super(code, message, { data });
-  }
-}
-
-export { LunoraError };

package/dist/packem_shared/PRESENCE_DEFAULT_TTL_MS-BtPCiNLW.mjs

@@ -1,114 +0,0 @@
-import { v } from '@lunora/values';
-import { initLunora } from './initLunora-sQUqaejx.mjs';
-import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
-import { onDisconnect } from './onConnect-CIPXKPyw.mjs';
-import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-CcTj1_v2.mjs';
-import { defineTable } from './defineAggregateIndex-znq4ygKQ.mjs';
-
-const DEFAULT_TTL_MS = 3e4;
-const MAX_DATA_BYTES = 4096;
-const PRESENCE_KEY = "presence";
-const PRESENCE_BARE_TABLE = "present";
-const PRESENCE_TABLE = `${PRESENCE_KEY}_${PRESENCE_BARE_TABLE}`;
-const presenceExtension = defineSchemaExtension(PRESENCE_KEY, {
-  tables: {
-    [PRESENCE_BARE_TABLE]: defineTable({
-      data: v.optional(v.record(v.string(), v.any())),
-      lastSeen: v.number(),
-      roomId: v.string(),
-      sessionId: v.string(),
-      userId: v.optional(v.string())
-    }).index("byRoomSession", ["roomId", "sessionId"]).index("byRoom", ["roomId"])
-  }
-});
-const { mutation, query } = initLunora.dataModel().create();
-const definePresence = (options = {}) => {
-  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-  const disconnectGraceMs = Math.max(0, Math.min(options.disconnectGraceMs ?? 0, ttlMs));
-  const heartbeat = mutation.input({
-    data: v.optional(v.record(v.string(), v.any())),
-    roomId: v.string(),
-    sessionId: v.string()
-  }).mutation(async ({ args, ctx: context }) => {
-    const lastSeen = Date.now();
-    const userId = context.auth.userId ?? void 0;
-    if (args.data !== void 0 && JSON.stringify(args.data).length > MAX_DATA_BYTES) {
-      throw new LunoraError("BAD_REQUEST", `presence data exceeds the ${String(MAX_DATA_BYTES)}-byte limit`);
-    }
-    const existing = await context.db.query(PRESENCE_TABLE).withIndex("byRoomSession", (q) => q.eq("roomId", args.roomId).eq("sessionId", args.sessionId)).first();
-    if (existing && (existing["userId"] ?? void 0) !== userId) {
-      throw new LunoraError("FORBIDDEN", "presence heartbeat denied: this (roomId, sessionId) is held by another identity");
-    }
-    const row = {
-      lastSeen,
-      roomId: args.roomId,
-      sessionId: args.sessionId,
-      ...args.data === void 0 ? {} : { data: args.data },
-      ...userId === void 0 ? {} : { userId }
-    };
-    await (existing ? context.db.patch(existing["_id"], row) : context.db.insert(PRESENCE_TABLE, row));
-    return { lastSeen };
-  });
-  const listPresent = query.input({ roomId: v.string() }).query(async ({ args, ctx: context }) => {
-    const cutoff = Date.now() - ttlMs;
-    const rows = await context.db.query(PRESENCE_TABLE).withIndex("byRoom", (q) => q.eq("roomId", args.roomId)).collect();
-    const live = rows.filter((row) => row["lastSeen"] > cutoff).toSorted((a, b) => b["lastSeen"] - a["lastSeen"]);
-    const seenUsers = /* @__PURE__ */ new Set();
-    const members = [];
-    for (const row of live) {
-      const userId = row["userId"];
-      if (userId !== void 0) {
-        if (seenUsers.has(userId)) {
-          continue;
-        }
-        seenUsers.add(userId);
-      }
-      const member = {
-        lastSeen: row["lastSeen"],
-        roomId: row["roomId"]
-      };
-      if (userId !== void 0) {
-        member.userId = userId;
-      }
-      if (row["data"] !== void 0) {
-        member.data = row["data"];
-      }
-      members.push(member);
-    }
-    return members;
-  });
-  const sweep = mutation.input({ roomId: v.string() }).mutation(async ({ args, ctx: context }) => {
-    const cutoff = Date.now() - ttlMs;
-    const stale = await context.db.query(PRESENCE_TABLE).withIndex("byRoom", (q) => q.eq("roomId", args.roomId)).filter((row) => row["lastSeen"] <= cutoff).collect();
-    await Promise.all(stale.map((row) => context.db.delete(row["_id"])));
-    return { deleted: stale.length };
-  });
-  const internalSweep = { ...sweep, visibility: "internal" };
-  const disconnect = onDisconnect(async (context, event) => {
-    const roomId = event.context?.["roomId"];
-    const sessionId = event.context?.["sessionId"];
-    if (typeof roomId !== "string" || typeof sessionId !== "string") {
-      return;
-    }
-    const existing = await context.db.query(PRESENCE_TABLE).withIndex("byRoomSession", (q) => q.eq("roomId", roomId).eq("sessionId", sessionId)).first();
-    if (!existing) {
-      return;
-    }
-    const verifiedUserId = event.userId ?? void 0;
-    if ((existing["userId"] ?? void 0) !== verifiedUserId) {
-      return;
-    }
-    if (disconnectGraceMs === 0) {
-      await context.db.delete(existing["_id"]);
-      return;
-    }
-    const agedLastSeen = Math.min(existing["lastSeen"], Date.now() + disconnectGraceMs - ttlMs);
-    await context.db.patch(existing["_id"], { lastSeen: agedLastSeen });
-  });
-  return defineComponent(PRESENCE_KEY, {
-    extension: presenceExtension,
-    functions: { disconnect, heartbeat, listPresent, sweep: internalSweep }
-  });
-};
-
-export { DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension };

package/dist/packem_shared/asBucketStorage-Cnxd9y2q.mjs

@@ -1,11 +0,0 @@
-const asBucketStorage = (raw) => {
-  const candidate = raw ?? {};
-  if (typeof candidate.bucket === "function") {
-    return candidate;
-  }
-  const self = { ...candidate, bucketName: "default" };
-  self.bucket = () => self;
-  return self;
-};
-
-export { asBucketStorage as default };

package/dist/packem_shared/bindOrm-Bfgl7f-Q.mjs

@@ -1,146 +0,0 @@
-import { LunoraError as LunoraError$1 } from '@lunora/errors';
-
-const isUniqueConflict = (error) => typeof error === "object" && error !== null && error.code === "CONFLICT" && error.kind === "unique";
-const buildUpsertWhere = (tableName, target, create) => {
-  const fields = typeof target === "string" ? [target] : target;
-  if (fields.length === 0) {
-    throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.upsert: "target" must name at least one field`);
-  }
-  const where = {};
-  for (const field of fields) {
-    if (!(field in create)) {
-      throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.upsert: target field "${field}" is missing from the create document`);
-    }
-    where[field] = create[field];
-  }
-  return where;
-};
-const bindTableFacade = (writer, tableName) => {
-  const insert = async (document, options) => {
-    if (options?.skipDuplicates !== true) {
-      return writer.insert(tableName, document);
-    }
-    try {
-      return await writer.insert(tableName, document);
-    } catch (error) {
-      if (isUniqueConflict(error)) {
-        return null;
-      }
-      throw error;
-    }
-  };
-  const upsert = async ({ create, target, update }) => {
-    const where = buildUpsertWhere(tableName, target, create);
-    const existing = await writer.findFirst(tableName, { where });
-    if (existing && typeof existing["_id"] === "string") {
-      await writer.patch(existing["_id"], update ?? create, tableName);
-      return { created: false, id: existing["_id"] };
-    }
-    const id = await writer.insert(tableName, create);
-    return { created: true, id };
-  };
-  return {
-    aggregate: (options) => writer.aggregate(tableName, options),
-    count: (where) => writer.count(tableName, where),
-    delete: (id) => writer.delete(id, tableName),
-    // `deleteMany`/`patchMany` forward the bound `tableName` as `expectedTable`
-    // for id-based calls (threaded through the writer + the RLS middleware's
-    // per-id gate) so every batched id is scoped to this table — the same IDOR
-    // guard the single-row `delete`/`patch` apply. The where-based form routes
-    // through the structural writer's `deleteMany(tableName, { where })`.
-    // `patchMany` maps the facade's `values` payload to the writer's
-    // `{ id, patch }` shape.
-    deleteMany: (first, options) => {
-      if (Array.isArray(first)) {
-        if (writer.deleteMany === void 0) {
-          throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.deleteMany is unavailable: this writer has no batch delete`);
-        }
-        return writer.deleteMany(first, options, tableName);
-      }
-      if (writer.deleteWhere === void 0) {
-        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.deleteMany({ where }) is unavailable: this writer has no where-based delete`);
-      }
-      const whereArgs = first;
-      return writer.deleteWhere(tableName, whereArgs.where, { limit: whereArgs.limit });
-    },
-    // `exists` reuses `findFirst` (RLS-filtered, indexed when a `.withIndex`-able
-    // `where` is supplied) and only asks whether a row came back — no count scan.
-    exists: async (where) => await writer.findFirst(tableName, where === void 0 ? void 0 : { where }) !== null,
-    findFirst: (args) => writer.findFirst(tableName, args),
-    findFirstOrThrow: (args) => writer.findFirstOrThrow(tableName, args),
-    findMany: (args) => writer.findMany(tableName, args),
-    get: (id) => writer.get(id, tableName),
-    groupBy: (options) => writer.groupBy(tableName, options),
-    // Physical removal — bypasses `.softDelete()`. RLS gates it as a delete.
-    hardDelete: (id) => writer.delete(id, tableName, { hard: true }),
-    insert,
-    insertMany: (documents, options) => {
-      if (writer.insertMany === void 0) {
-        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.insertMany is unavailable: this writer has no batch insert`);
-      }
-      return writer.insertMany(tableName, documents, options);
-    },
-    patch: (id, patch) => writer.patch(id, patch, tableName),
-    patchMany: (first, options) => {
-      if (Array.isArray(first)) {
-        if (writer.patchMany === void 0) {
-          throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.patchMany is unavailable: this writer has no batch patch`);
-        }
-        return writer.patchMany(
-          first.map((entry) => {
-            return { id: entry.id, patch: entry.values };
-          }),
-          options,
-          tableName
-        );
-      }
-      if (writer.patchWhere === void 0) {
-        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.patchMany({ where, values }) is unavailable: this writer has no where-based patch`);
-      }
-      const whereArgs = first;
-      return writer.patchWhere(tableName, { patch: whereArgs.values, where: whereArgs.where }, { limit: whereArgs.limit });
-    },
-    rank: (indexName, options) => writer.rank(tableName, indexName, options),
-    rankPage: (indexName, options) => writer.rankPage(tableName, indexName, options),
-    replace: (id, document) => writer.replace(id, document, tableName),
-    restore: async (id) => {
-      if (!writer.restore) {
-        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.restore is unavailable: this writer has no restore (is the table .softDelete()?)`);
-      }
-      await writer.restore(id, tableName);
-    },
-    upsert,
-    upsertMany: async ({ rows, target }) => {
-      const results = [];
-      for (const row of rows) {
-        results.push(await upsert({ create: row.create, target, update: row.update }));
-      }
-      return results;
-    },
-    withSearchIndex: (indexName, search) => writer.query(tableName).withSearchIndex(indexName, search)
-  };
-};
-const bindOrm = (facade) => {
-  const resolve = (table) => {
-    const bound = facade[table];
-    if (!bound) {
-      throw new LunoraError$1("INTERNAL", `unknown table: ${table}`);
-    }
-    return bound;
-  };
-  return {
-    delete: (table, id) => resolve(table).delete(id),
-    insert: (table) => {
-      return { values: (document) => resolve(table).insert(document) };
-    },
-    query: facade,
-    replace: (table, id) => {
-      return { with: (document) => resolve(table).replace(id, document) };
-    },
-    update: (table, id) => {
-      return { set: (values) => resolve(table).patch(id, values) };
-    }
-  };
-};
-
-export { bindOrm, bindTableFacade };

package/dist/packem_shared/buildRlsReadRegistry-D54vUQe4.mjs

@@ -1,107 +0,0 @@
-import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-B_ZWgslr.mjs';
-import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
-
-const FALSE_PREDICATE = { OR: [] };
-const readEntryTags = (entry) => {
-  const hoisted = entry?.rls?.tags;
-  if (hoisted) {
-    return hoisted;
-  }
-  const tag = readRlsTag(entry);
-  return tag ? [tag] : [];
-};
-const addTagToRegistry = (byTable, tag) => {
-  const rolePermissions = indexRolePermissions(tag.roles);
-  const seenWhenByTable = /* @__PURE__ */ new Map();
-  const policiesByTable = /* @__PURE__ */ new Map();
-  for (const policy of tag.policies) {
-    if (policy.on !== "read") {
-      continue;
-    }
-    const seen = seenWhenByTable.get(policy.table) ?? /* @__PURE__ */ new Set();
-    if (seen.has(policy.when)) {
-      continue;
-    }
-    seen.add(policy.when);
-    seenWhenByTable.set(policy.table, seen);
-    const list = policiesByTable.get(policy.table) ?? [];
-    list.push(policy);
-    policiesByTable.set(policy.table, list);
-  }
-  for (const [table, policies] of policiesByTable) {
-    const groups = byTable.get(table) ?? [];
-    groups.push({ policies, rolePermissions });
-    byTable.set(table, groups);
-  }
-};
-const isFalsePredicate = (where) => {
-  const or = where.OR;
-  return Array.isArray(or) && or.length === 0 && Object.keys(where).length === 1;
-};
-const andMerge = (injected, caller) => {
-  if (!injected || Object.keys(injected).length === 0) {
-    return caller;
-  }
-  if (isFalsePredicate(injected)) {
-    return injected;
-  }
-  if (Object.keys(caller).length === 0) {
-    return injected;
-  }
-  return { AND: [injected, caller] };
-};
-const evaluateGroupBaseWhere = (group, request) => {
-  const granted = /* @__PURE__ */ new Set();
-  for (const roleName of request.roles) {
-    for (const name of group.rolePermissions.get(roleName) ?? []) {
-      granted.add(name);
-    }
-  }
-  return computeReadBaseWhere(group.policies, {
-    auth: {
-      can: (permission) => granted.has(permissionName(permission)),
-      identity: request.identity,
-      roles: request.roles,
-      userId: request.userId
-    },
-    ctx: request.ctx
-  });
-};
-const resolveReadBaseWhere = (registry, request) => {
-  const groups = registry.byTable.get(request.table);
-  if (!groups || groups.length === 0) {
-    return request.rlsRequired && !request.tablePublic ? FALSE_PREDICATE : void 0;
-  }
-  const predicates = [];
-  for (const group of groups) {
-    const base = evaluateGroupBaseWhere(group, request);
-    if (base === void 0) {
-      return void 0;
-    }
-    if (isFalsePredicate(base)) {
-      continue;
-    }
-    predicates.push(base);
-  }
-  if (predicates.length === 0) {
-    return FALSE_PREDICATE;
-  }
-  return predicates.length === 1 ? predicates[0] : { OR: predicates };
-};
-const buildRlsReadRegistry = (functions) => {
-  const byTable = /* @__PURE__ */ new Map();
-  const seenTags = /* @__PURE__ */ new Set();
-  for (const entry of functions) {
-    for (const tag of readEntryTags(entry)) {
-      if (seenTags.has(tag)) {
-        continue;
-      }
-      seenTags.add(tag);
-      addTagToRegistry(byTable, tag);
-    }
-  }
-  return { byTable };
-};
-const composeShapeReadWhere = (registry, request) => andMerge(resolveReadBaseWhere(registry, request), request.shapeWhere);
-
-export { buildRlsReadRegistry, composeShapeReadWhere };