@lunora/server 1.0.0-alpha.22 → 1.0.0-alpha.23

package/dist/index.d.mts

@@ -863,12 +863,14 @@ interface QueryArgs$1 {
   baseWhere?: unknown;
   cursor?: null | string;
   limit?: number;
+  orderBy?: ReadonlyArray<Record<string, unknown>>;
   where?: unknown;
   with?: Record<string, unknown>;
 }
 interface AggregateArgs$1 {
   field?: string;
   op: string;
+  where?: unknown;
 }
 interface GroupByArgs$1 {
   agg?: {
@@ -876,6 +878,7 @@ interface GroupByArgs$1 {
     op: string;
   };
   by: ReadonlyArray<string>;
+  where?: unknown;
 }
 interface TableReaderLike$1 {
   collect: () => Promise<Record<string, unknown>[]>;

package/dist/index.d.ts

@@ -863,12 +863,14 @@ interface QueryArgs$1 {
   baseWhere?: unknown;
   cursor?: null | string;
   limit?: number;
+  orderBy?: ReadonlyArray<Record<string, unknown>>;
   where?: unknown;
   with?: Record<string, unknown>;
 }
 interface AggregateArgs$1 {
   field?: string;
   op: string;
+  where?: unknown;
 }
 interface GroupByArgs$1 {
   agg?: {
@@ -876,6 +878,7 @@ interface GroupByArgs$1 {
     op: string;
   };
   by: ReadonlyArray<string>;
+  where?: unknown;
 }
 interface TableReaderLike$1 {
   collect: () => Promise<Record<string, unknown>[]>;

package/dist/index.mjs

@@ -10,7 +10,7 @@ export { onConnect, onDisconnect } from './packem_shared/onConnect-CIPXKPyw.mjs'
 export { defineMigration } from './packem_shared/defineMigration-Hx01yIht.mjs';
 export { defineMutator } from './packem_shared/defineMutator-EIXAWhs9.mjs';
 export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-CcTj1_v2.mjs';
-export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-pc2cfrnm.mjs';
+export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-BAD0QPAg.mjs';
 export { protectPublic } from './packem_shared/protectPublic-BlcGpiRc.mjs';
 export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-znq4ygKQ.mjs';
 export { defineShape } from './packem_shared/defineShape-C5scNOrf.mjs';
@@ -20,7 +20,7 @@ export { ValidationError, v } from '@lunora/values';
 export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-D54vUQe4.mjs';
 export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-By3QB4he.mjs';
 export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-B5nL4Z1P.mjs';
-export { mask } from './packem_shared/mask-BT1YgRbF.mjs';
+export { mask } from './packem_shared/mask-DSBtA3qp.mjs';
 export { rls } from './packem_shared/rls-B_ZWgslr.mjs';
 export { storageRules } from './packem_shared/storageRules-6QxzDOcx.mjs';
 

package/dist/packem_shared/{PRESENCE_DEFAULT_TTL_MS-pc2cfrnm.mjs → PRESENCE_DEFAULT_TTL_MS-BAD0QPAg.mjs}

@@ -32,7 +32,7 @@ const definePresence = (options = {}) => {
   }).mutation(async ({ args, ctx: context }) => {
     const lastSeen = Date.now();
     const userId = context.auth.userId ?? void 0;
-    if (args.data !== void 0 && JSON.stringify(args.data).length > MAX_DATA_BYTES) {
+    if (args.data !== void 0 && new TextEncoder().encode(JSON.stringify(args.data)).length > MAX_DATA_BYTES) {
       throw new LunoraError("BAD_REQUEST", `presence data exceeds the ${String(MAX_DATA_BYTES)}-byte limit`);
     }
     const existing = await context.db.query(PRESENCE_TABLE).withIndex("byRoomSession", (q) => q.eq("roomId", args.roomId).eq("sessionId", args.sessionId)).first();

package/dist/packem_shared/{mask-BT1YgRbF.mjs → mask-DSBtA3qp.mjs}

@@ -191,32 +191,54 @@ const wrapDatabase = (base, perTable, context) => {
       }
     }
   };
+  const assertOrderByAllowed = (tableName, orderBy, method) => {
+    const columns = perTable.get(tableName);
+    if (!columns || !Array.isArray(orderBy)) {
+      return;
+    }
+    for (const entry of orderBy) {
+      if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+        for (const field of Object.keys(entry)) {
+          if (field in columns) {
+            throw new LunoraError("MASK_UNSUPPORTED", `${method}() ordering "${tableName}" by masked column "${field}" is not supported`);
+          }
+        }
+      }
+    }
+  };
   const wrapped = {
     ...base,
     aggregate(tableName, options) {
       assertReductionAllowed(tableName, [options.field], "aggregate");
+      assertWhereAllowed(tableName, options.where, "aggregate");
       return base.aggregate(tableName, options);
     },
     count(tableName, whereOrArgs) {
       const wrapper = whereOrArgs && typeof whereOrArgs === "object" && !Array.isArray(whereOrArgs) ? whereOrArgs : void 0;
       const where = wrapper && ("where" in wrapper || "baseWhere" in wrapper || "restrictsCounts" in wrapper) ? wrapper.where : whereOrArgs;
       assertWhereAllowed(tableName, where, "count");
+      if (wrapper) {
+        assertWhereAllowed(tableName, wrapper.baseWhere, "count");
+      }
       return base.count(tableName, whereOrArgs);
     },
     async findFirst(tableName, args) {
       assertWhereAllowed(tableName, args?.where, "findFirst");
+      assertOrderByAllowed(tableName, args?.orderBy, "findFirst");
       const row = await base.findFirst(tableName, args);
       const columns = perTable.get(tableName);
       return row && columns ? maskRow(row, columns, context) : row;
     },
     async findFirstOrThrow(tableName, args) {
       assertWhereAllowed(tableName, args?.where, "findFirstOrThrow");
+      assertOrderByAllowed(tableName, args?.orderBy, "findFirstOrThrow");
       const row = await base.findFirstOrThrow(tableName, args);
       const columns = perTable.get(tableName);
       return columns ? maskRow(row, columns, context) : row;
     },
     async findMany(tableName, args) {
       assertWhereAllowed(tableName, args?.where, "findMany");
+      assertOrderByAllowed(tableName, args?.orderBy, "findMany");
       const page = await base.findMany(tableName, args);
       const columns = perTable.get(tableName);
       return columns ? maskPage(page, columns, context) : page;
@@ -231,6 +253,7 @@ const wrapDatabase = (base, perTable, context) => {
     },
     groupBy(tableName, options) {
       assertReductionAllowed(tableName, [...options.by, options.agg?.field], "groupBy");
+      assertWhereAllowed(tableName, options.where, "groupBy");
       return base.groupBy(tableName, options);
     },
     query(tableName) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.22",
+  "version": "1.0.0-alpha.23",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -62,9 +62,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.3",
-    "@lunora/scheduler": "1.0.0-alpha.7",
-    "@lunora/values": "1.0.0-alpha.6",
+    "@lunora/errors": "1.0.0-alpha.4",
+    "@lunora/scheduler": "1.0.0-alpha.8",
+    "@lunora/values": "1.0.0-alpha.7",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.28"
   },