@lunora/server 1.0.0-alpha.3 → 1.0.0-alpha.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.3",
+  "version": "1.0.0-alpha.30",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -25,7 +25,7 @@
     "directory": "packages/server"
   },
   "files": [
-    "dist",
+    "./dist",
     "README.md",
     "LICENSE.md",
     "__assets__"
@@ -62,10 +62,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/scheduler": "1.0.0-alpha.1",
-    "@lunora/values": "1.0.0-alpha.2",
+    "@lunora/errors": "1.0.0-alpha.7",
+    "@lunora/scheduler": "1.0.0-alpha.11",
+    "@lunora/values": "1.0.0-alpha.10",
     "drizzle-orm": "^0.45.2",
-    "hono": "^4.12.26"
+    "hono": "^4.12.30"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"

package/dist/packem_shared/LunoraError-DhggBJZF.mjs

@@ -1,51 +0,0 @@
-const CODE_STATUS = {
-  BAD_REQUEST: 400,
-  CONFLICT: 409,
-  /**
-   * `count()` invoked against a table whose context carries an active RLS
-   * policy. The operation itself is unsupported in an RLS-restricted reader
-   * (kitcn's documented constraint) — the request is well-formed and the
-   * caller is authorized, so this is a 422 (semantic conflict) rather than a
-   * 403 (policy denial).
-   */
-  COUNT_RLS_UNSUPPORTED: 422,
-  FORBIDDEN: 403,
-  INTERNAL_SERVER_ERROR: 500,
-  /**
-   * An analytical reduction (`aggregate` / `groupBy`) was invoked over a
-   * column that the procedure's `mask()` middleware redacts. A masked column
-   * can't be summed, averaged, or grouped without leaking the very values the
-   * mask hides (a group key *is* the raw value; an aggregate is computed from
-   * it), so the operation fails closed. The request is well-formed and the
-   * caller is authorized — this is a 422 (semantic conflict), mirroring
-   * `COUNT_RLS_UNSUPPORTED`.
-   */
-  MASK_UNSUPPORTED: 422,
-  NOT_FOUND: 404,
-  NOT_IMPLEMENTED: 501,
-  /**
-   * A write policy's `when` returned a relation-crossing predicate
-   * (`some`/`none`/`every`/`is`/`isNot`). The in-memory write-policy evaluator
-   * has no child fetcher and cannot resolve a relation node, so the policy is
-   * unsupported as written. Relation predicates are valid in *read* policies
-   * and query `where` clauses (the pre-resolver handles them there). The
-   * request is well-formed; this is a 422 (semantic conflict), mirroring the
-   * sibling `*_UNSUPPORTED` codes.
-   */
-  RELATION_PREDICATE_UNSUPPORTED: 422,
-  TOO_MANY_REQUESTS: 429,
-  UNAUTHORIZED: 401,
-  UNPROCESSABLE: 422
-};
-class LunoraError extends Error {
-  name = "LunoraError";
-  code;
-  status;
-  constructor(code, message) {
-    super(message ?? code);
-    this.code = code;
-    this.status = CODE_STATUS[code];
-  }
-}
-
-export { LunoraError };

package/dist/packem_shared/types.d-BDY0FYHK.d.ts

@@ -1,135 +0,0 @@
-import { WhereOf } from "../data-model.js";
-/** Structural mirror of `@lunora/do`'s `WhereInput`. */
-interface WhereInput {
-  [field: string]: unknown;
-  AND?: WhereInput[];
-  NOT?: WhereInput;
-  OR?: WhereInput[];
-}
-/** Operations a policy can gate. `read` covers `get`/`findMany`/`query`/`count`. */
-type PolicyOperation = "delete" | "insert" | "read" | "update";
-/**
-* A policy's `when` decision:
-*
-* - `WhereInput`: a row-shape predicate. On reads it is AND-merged into every
-* query against the table — the row is invisible unless it matches. On writes
-* it is evaluated against the candidate document (`insert`) or the pre-write
-* row (`update`/`delete`); a mismatch denies the write with
-* `LunoraError("FORBIDDEN")`. Same operator set as the SQL compiler
-* (`eq`/`ne`/`in`/`notIn`/`lt`/`lte`/`gt`/`gte`/`isNull`/`contains` +
-* `AND`/`OR`/`NOT`).
-* - `true`: unrestricted. On reads no predicate is merged; on writes the row is
-* allowed.
-* - `false`: deny. On reads the table is forced to match zero rows (a sentinel
-* predicate); on writes the operation throws `LunoraError("FORBIDDEN")`.
-*
-* Returning `undefined` opts this specific policy out (rare; useful when
-* branching on `ctx.auth.roles`).
-*/
-type PolicyDecision = WhereInput | boolean | undefined;
-/**
-* Relation-aware twin of {@link PolicyDecision}, parameterized over the
-* generated `DataModel` (`DM`) + `Relations` (`REL`) maps and a table `T`. A
-* read policy may now return a Prisma-style relation predicate (the
-* `@lunora/do` pre-resolver resolves it via a semijoin), so the typed
-* authoring surface accepts `WhereOf<DM, REL, T>` — column predicates **and**
-* `is`/`isNot`/`some`/`none`/`every` over `T`'s declared relations — in
-* addition to the `boolean`/`undefined` decisions. Used by the project-bound
-* `definePolicy` from `createPolicyDsl`.
-*/
-type PolicyDecisionOf<DM, REL extends Record<keyof DM, object>, T extends keyof DM> = WhereOf<DM, REL, T> | boolean | undefined;
-/**
-* Relation-aware input for a project-bound `definePolicy` (see
-* `createPolicyDsl`). `table` is constrained to a real table name and
-* `when`'s return type is the table-specific {@link PolicyDecisionOf} — so an
-* unknown table, a stray column, or a relation predicate naming a relation the
-* table does not declare is a compile error rather than a silent runtime deny.
-*/
-interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T extends keyof DM, Context = unknown> {
-  on: PolicyOperation;
-  table: T;
-  when: (context: PolicyContext<Context>) => PolicyDecisionOf<DM, REL, T>;
-}
-/**
-* Context handed to a policy. `auth.roles` is the per-request role list,
-* sourced from the identity resolver (better-auth claims today). `auth.can`
-* answers whether any of those roles grants a permission (see
-* {@link Permission} / {@link RlsOptions}). `row` is present only on write
-* policies (`insert`/`update`/`delete`) — for `update` and `delete` it is the
-* pre-write row; for `insert` it is the candidate document. `ctx` is the full
-* procedure context the middleware closed over.
-*/
-interface PolicyContext<Context = unknown> {
-  readonly auth: {
-    /**
-    * `true` when any of the request's `roles` grants `permission` (passed
-    * by {@link Permission} object or its `name`). Always `false` when no
-    * roles were handed to the middleware (`rls(policies, { roles })`), or
-    * when none of the request's roles lists the permission.
-    */
-    readonly can: (permission: Permission | string) => boolean;
-    readonly identity?: Record<string, unknown> | null;
-    readonly roles: ReadonlyArray<string>;
-    readonly userId: null | string;
-  };
-  readonly ctx: Context;
-  readonly row?: Record<string, unknown>;
-}
-/** A registered policy as stored in the policy table. */
-interface Policy<Context = unknown> {
-  readonly on: PolicyOperation;
-  readonly table: string;
-  readonly when: (context: PolicyContext<Context>) => PolicyDecision;
-}
-/**
-* Input accepted by `definePolicy`. The branded result is the same
-* shape; we keep the input/output split so callers can read JSDoc on the
-* constructor without the type re-exposing `Policy` internals.
-*/
-interface DefinePolicyInput<Context = unknown> {
-  on: PolicyOperation;
-  /** Logical table name the policy applies to. */
-  table: string;
-  /**
-  * Decision function. Returning a `WhereInput` (read only) AND-merges the
-  * predicate; `true` allows; `false` denies; `undefined` skips this policy.
-  *
-  * NOTE: `count()` is **unsupported** on a policy-restricted table — the
-  * reader throws `LunoraError("COUNT_RLS_UNSUPPORTED")` (422). This mirrors
-  * kitcn's documented behavior.
-  */
-  when: (context: PolicyContext<Context>) => PolicyDecision;
-}
-/**
-* A named, abstract capability a policy can check with `ctx.auth.can(...)`,
-* instead of branching on raw role strings. Declare one with
-* `definePermission`; grant it to a role via {@link Role.permissions};
-* register the roles with the middleware via {@link RlsOptions.roles}.
-*/
-interface Permission {
-  readonly description?: string;
-  readonly name: string;
-}
-/**
-* A role declaration. Roles are string labels attached to the request's
-* identity (via better-auth claims today). `permissions` lists the
-* capabilities the role grants — at request time the middleware unions the
-* permissions of every role in `ctx.auth.roles` so a policy can ask
-* `ctx.auth.can(permission)` rather than enumerate roles.
-*/
-interface Role {
-  readonly description?: string;
-  readonly name: string;
-  /** Permissions this role grants — by {@link Permission} object or bare name. */
-  readonly permissions?: ReadonlyArray<Permission | string>;
-}
-/**
-* Options for the `rls(policies, options)` middleware. `roles` registers the
-* role→permission grants that back `ctx.auth.can(...)`; a role not listed here
-* grants no permissions (so `can` is conservative — it fails closed for
-* unknown roles).
-*/
-interface RlsOptions {
-  readonly roles?: ReadonlyArray<Role>;
-}
-export { DefinePolicyInput as D, PolicyOperation as P, Role as R, TypedDefinePolicyInput as T, WhereInput as W, Policy as a, Permission as b, RlsOptions as c, PolicyContext as d, PolicyDecision as e, PolicyDecisionOf as f };

package/dist/packem_shared/types.d-DmvyEMD6.d.mts

@@ -1,135 +0,0 @@
-import { WhereOf } from "../data-model.mjs";
-/** Structural mirror of `@lunora/do`'s `WhereInput`. */
-interface WhereInput {
-  [field: string]: unknown;
-  AND?: WhereInput[];
-  NOT?: WhereInput;
-  OR?: WhereInput[];
-}
-/** Operations a policy can gate. `read` covers `get`/`findMany`/`query`/`count`. */
-type PolicyOperation = "delete" | "insert" | "read" | "update";
-/**
-* A policy's `when` decision:
-*
-* - `WhereInput`: a row-shape predicate. On reads it is AND-merged into every
-* query against the table — the row is invisible unless it matches. On writes
-* it is evaluated against the candidate document (`insert`) or the pre-write
-* row (`update`/`delete`); a mismatch denies the write with
-* `LunoraError("FORBIDDEN")`. Same operator set as the SQL compiler
-* (`eq`/`ne`/`in`/`notIn`/`lt`/`lte`/`gt`/`gte`/`isNull`/`contains` +
-* `AND`/`OR`/`NOT`).
-* - `true`: unrestricted. On reads no predicate is merged; on writes the row is
-* allowed.
-* - `false`: deny. On reads the table is forced to match zero rows (a sentinel
-* predicate); on writes the operation throws `LunoraError("FORBIDDEN")`.
-*
-* Returning `undefined` opts this specific policy out (rare; useful when
-* branching on `ctx.auth.roles`).
-*/
-type PolicyDecision = WhereInput | boolean | undefined;
-/**
-* Relation-aware twin of {@link PolicyDecision}, parameterized over the
-* generated `DataModel` (`DM`) + `Relations` (`REL`) maps and a table `T`. A
-* read policy may now return a Prisma-style relation predicate (the
-* `@lunora/do` pre-resolver resolves it via a semijoin), so the typed
-* authoring surface accepts `WhereOf<DM, REL, T>` — column predicates **and**
-* `is`/`isNot`/`some`/`none`/`every` over `T`'s declared relations — in
-* addition to the `boolean`/`undefined` decisions. Used by the project-bound
-* `definePolicy` from `createPolicyDsl`.
-*/
-type PolicyDecisionOf<DM, REL extends Record<keyof DM, object>, T extends keyof DM> = WhereOf<DM, REL, T> | boolean | undefined;
-/**
-* Relation-aware input for a project-bound `definePolicy` (see
-* `createPolicyDsl`). `table` is constrained to a real table name and
-* `when`'s return type is the table-specific {@link PolicyDecisionOf} — so an
-* unknown table, a stray column, or a relation predicate naming a relation the
-* table does not declare is a compile error rather than a silent runtime deny.
-*/
-interface TypedDefinePolicyInput<DM, REL extends Record<keyof DM, object>, T extends keyof DM, Context = unknown> {
-  on: PolicyOperation;
-  table: T;
-  when: (context: PolicyContext<Context>) => PolicyDecisionOf<DM, REL, T>;
-}
-/**
-* Context handed to a policy. `auth.roles` is the per-request role list,
-* sourced from the identity resolver (better-auth claims today). `auth.can`
-* answers whether any of those roles grants a permission (see
-* {@link Permission} / {@link RlsOptions}). `row` is present only on write
-* policies (`insert`/`update`/`delete`) — for `update` and `delete` it is the
-* pre-write row; for `insert` it is the candidate document. `ctx` is the full
-* procedure context the middleware closed over.
-*/
-interface PolicyContext<Context = unknown> {
-  readonly auth: {
-    /**
-    * `true` when any of the request's `roles` grants `permission` (passed
-    * by {@link Permission} object or its `name`). Always `false` when no
-    * roles were handed to the middleware (`rls(policies, { roles })`), or
-    * when none of the request's roles lists the permission.
-    */
-    readonly can: (permission: Permission | string) => boolean;
-    readonly identity?: Record<string, unknown> | null;
-    readonly roles: ReadonlyArray<string>;
-    readonly userId: null | string;
-  };
-  readonly ctx: Context;
-  readonly row?: Record<string, unknown>;
-}
-/** A registered policy as stored in the policy table. */
-interface Policy<Context = unknown> {
-  readonly on: PolicyOperation;
-  readonly table: string;
-  readonly when: (context: PolicyContext<Context>) => PolicyDecision;
-}
-/**
-* Input accepted by `definePolicy`. The branded result is the same
-* shape; we keep the input/output split so callers can read JSDoc on the
-* constructor without the type re-exposing `Policy` internals.
-*/
-interface DefinePolicyInput<Context = unknown> {
-  on: PolicyOperation;
-  /** Logical table name the policy applies to. */
-  table: string;
-  /**
-  * Decision function. Returning a `WhereInput` (read only) AND-merges the
-  * predicate; `true` allows; `false` denies; `undefined` skips this policy.
-  *
-  * NOTE: `count()` is **unsupported** on a policy-restricted table — the
-  * reader throws `LunoraError("COUNT_RLS_UNSUPPORTED")` (422). This mirrors
-  * kitcn's documented behavior.
-  */
-  when: (context: PolicyContext<Context>) => PolicyDecision;
-}
-/**
-* A named, abstract capability a policy can check with `ctx.auth.can(...)`,
-* instead of branching on raw role strings. Declare one with
-* `definePermission`; grant it to a role via {@link Role.permissions};
-* register the roles with the middleware via {@link RlsOptions.roles}.
-*/
-interface Permission {
-  readonly description?: string;
-  readonly name: string;
-}
-/**
-* A role declaration. Roles are string labels attached to the request's
-* identity (via better-auth claims today). `permissions` lists the
-* capabilities the role grants — at request time the middleware unions the
-* permissions of every role in `ctx.auth.roles` so a policy can ask
-* `ctx.auth.can(permission)` rather than enumerate roles.
-*/
-interface Role {
-  readonly description?: string;
-  readonly name: string;
-  /** Permissions this role grants — by {@link Permission} object or bare name. */
-  readonly permissions?: ReadonlyArray<Permission | string>;
-}
-/**
-* Options for the `rls(policies, options)` middleware. `roles` registers the
-* role→permission grants that back `ctx.auth.can(...)`; a role not listed here
-* grants no permissions (so `can` is conservative — it fails closed for
-* unknown roles).
-*/
-interface RlsOptions {
-  readonly roles?: ReadonlyArray<Role>;
-}
-export { DefinePolicyInput as D, PolicyOperation as P, Role as R, TypedDefinePolicyInput as T, WhereInput as W, Policy as a, Permission as b, RlsOptions as c, PolicyContext as d, PolicyDecision as e, PolicyDecisionOf as f };