@lunora/server 1.0.0-alpha.3 → 1.0.0-alpha.31

package/dist/index.mjs

@@ -1,23 +1,28 @@
 export { default as asBucketStorage } from './packem_shared/asBucketStorage-Cnxd9y2q.mjs';
-export { initLunora } from './packem_shared/initLunora-CATvPsVt.mjs';
-export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/LunoraEnvError-DjFkpkSP.mjs';
-export { LunoraError } from './packem_shared/LunoraError-DhggBJZF.mjs';
-export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-Ce57S3N9.mjs';
-export { httpAction, httpRoute, httpRouter, serveStorageObject } from './packem_shared/httpAction-B7FYUEgr.mjs';
+export { initLunora } from './packem_shared/initLunora-D0Wuki7S.mjs';
+export { createSecrets } from './packem_shared/createSecrets-DwaR2rNG.mjs';
+export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/LunoraEnvError-BGmd1Qs0.mjs';
+export { LunoraError } from './packem_shared/LunoraError-WbxmrpxR.mjs';
+export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-CaY7Wq9Z.mjs';
+export { httpAction, httpRoute, httpRouter, isSafeHeaderValue, serveStorageObject } from './packem_shared/httpAction-DCXoYPIk.mjs';
+export { defineIdentity } from './packem_shared/defineIdentity-DiX4zM9x.mjs';
 export { onConnect, onDisconnect } from './packem_shared/onConnect-CIPXKPyw.mjs';
-export { defineMigration } from './packem_shared/defineMigration-CAJLr6fx.mjs';
-export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-Ck5_TUO8.mjs';
-export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-UQuUI5sV.mjs';
-export { protectPublic } from './packem_shared/protectPublic-BjFkQ_Or.mjs';
-export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-B20MIOmj.mjs';
+export { defineMigration } from './packem_shared/defineMigration-Hx01yIht.mjs';
+export { defineMutator } from './packem_shared/defineMutator-EIXAWhs9.mjs';
+export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-z62dttBo.mjs';
+export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-Cr0i4mTv.mjs';
+export { protectPublic } from './packem_shared/protectPublic-BlcGpiRc.mjs';
+export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-cdo0g-un.mjs';
+export { defineShape } from './packem_shared/defineShape-C5scNOrf.mjs';
 export { anyApi } from './types.mjs';
 export { cronJobs } from '@lunora/scheduler';
 export { ValidationError, v } from '@lunora/values';
-export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-De67zPDS.mjs';
-export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-qu0mpilX.mjs';
-export { mask } from './packem_shared/mask-eCUYOwhd.mjs';
-export { rls } from './packem_shared/rls-Bi9HiyDC.mjs';
-export { storageRules } from './packem_shared/storageRules-4a30FSpI.mjs';
+export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-2uk_GfiH.mjs';
+export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-By3QB4he.mjs';
+export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-B5nL4Z1P.mjs';
+export { mask } from './packem_shared/mask-BepaW7YN.mjs';
+export { rls } from './packem_shared/rls-BaDQf7MG.mjs';
+export { storageRules } from './packem_shared/storageRules-6QxzDOcx.mjs';
 
 const VERSION = "0.0.0";
 

package/dist/packem_shared/{LunoraEnvError-DjFkpkSP.mjs → LunoraEnvError-BGmd1Qs0.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
 import { optionalInner } from '@lunora/values';
 
 const SECRET_VALUE_PREFIXES = [
@@ -53,13 +54,12 @@ const redactValueForKey = (message, key, raw) => {
   }
   return masked;
 };
-class LunoraEnvError extends Error {
-  name = "LunoraEnvError";
+class LunoraEnvError extends LunoraError$1 {
   failures;
   constructor(failures) {
     const summary = failures.map((failure) => `  - ${failure.key}: ${failure.message}`).join("\n");
-    super(`Invalid environment (${String(failures.length)} key(s)):
-${summary}`);
+    super("ENV_INVALID", `Invalid environment (${String(failures.length)} key(s)):
+${summary}`, { name: "LunoraEnvError" });
     this.failures = failures;
   }
 }

package/dist/packem_shared/LunoraError-WbxmrpxR.mjs

@@ -0,0 +1,9 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
+class LunoraError extends LunoraError$1 {
+  constructor(code, message, data) {
+    super(code, message, { data });
+  }
+}
+
+export { LunoraError };

package/dist/packem_shared/{PRESENCE_DEFAULT_TTL_MS-UQuUI5sV.mjs → PRESENCE_DEFAULT_TTL_MS-Cr0i4mTv.mjs}

@@ -1,9 +1,9 @@
 import { v } from '@lunora/values';
-import { initLunora } from './initLunora-CATvPsVt.mjs';
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { initLunora } from './initLunora-D0Wuki7S.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
 import { onDisconnect } from './onConnect-CIPXKPyw.mjs';
-import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-Ck5_TUO8.mjs';
-import { defineTable } from './defineAggregateIndex-B20MIOmj.mjs';
+import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-z62dttBo.mjs';
+import { defineTable } from './defineAggregateIndex-cdo0g-un.mjs';
 
 const DEFAULT_TTL_MS = 3e4;
 const MAX_DATA_BYTES = 4096;
@@ -32,7 +32,7 @@ const definePresence = (options = {}) => {
   }).mutation(async ({ args, ctx: context }) => {
     const lastSeen = Date.now();
     const userId = context.auth.userId ?? void 0;
-    if (args.data !== void 0 && JSON.stringify(args.data).length > MAX_DATA_BYTES) {
+    if (args.data !== void 0 && new TextEncoder().encode(JSON.stringify(args.data)).length > MAX_DATA_BYTES) {
       throw new LunoraError("BAD_REQUEST", `presence data exceeds the ${String(MAX_DATA_BYTES)}-byte limit`);
     }
     const existing = await context.db.query(PRESENCE_TABLE).withIndex("byRoomSession", (q) => q.eq("roomId", args.roomId).eq("sessionId", args.sessionId)).first();

package/dist/packem_shared/{bindOrm-Ce57S3N9.mjs → bindOrm-CaY7Wq9Z.mjs}

@@ -1,13 +1,15 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const isUniqueConflict = (error) => typeof error === "object" && error !== null && error.code === "CONFLICT" && error.kind === "unique";
 const buildUpsertWhere = (tableName, target, create) => {
   const fields = typeof target === "string" ? [target] : target;
   if (fields.length === 0) {
-    throw new Error(`ctx.db.${tableName}.upsert: "target" must name at least one field`);
+    throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.upsert: "target" must name at least one field`);
   }
   const where = {};
   for (const field of fields) {
     if (!(field in create)) {
-      throw new Error(`ctx.db.${tableName}.upsert: target field "${field}" is missing from the create document`);
+      throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.upsert: target field "${field}" is missing from the create document`);
     }
     where[field] = create[field];
   }
@@ -42,15 +44,24 @@ const bindTableFacade = (writer, tableName) => {
     count: (where) => writer.count(tableName, where),
     delete: (id) => writer.delete(id, tableName),
     // `deleteMany`/`patchMany` forward the bound `tableName` as `expectedTable`
-    // (threaded through the writer + the RLS middleware's per-id gate) so every
-    // batched id is scoped to this table — the same IDOR guard the single-row
-    // `delete`/`patch` apply. `patchMany` maps the facade's `values` payload to
-    // the writer's `{ id, patch }` shape.
-    deleteMany: (ids, options) => {
-      if (writer.deleteMany === void 0) {
-        throw new Error(`ctx.db.${tableName}.deleteMany is unavailable: this writer has no batch delete`);
+    // for id-based calls (threaded through the writer + the RLS middleware's
+    // per-id gate) so every batched id is scoped to this table — the same IDOR
+    // guard the single-row `delete`/`patch` apply. The where-based form routes
+    // through the structural writer's `deleteMany(tableName, { where })`.
+    // `patchMany` maps the facade's `values` payload to the writer's
+    // `{ id, patch }` shape.
+    deleteMany: (first, options) => {
+      if (Array.isArray(first)) {
+        if (writer.deleteMany === void 0) {
+          throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.deleteMany is unavailable: this writer has no batch delete`);
+        }
+        return writer.deleteMany(first, options, tableName);
+      }
+      if (writer.deleteWhere === void 0) {
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.deleteMany({ where }) is unavailable: this writer has no where-based delete`);
       }
-      return writer.deleteMany(ids, options, tableName);
+      const whereArgs = first;
+      return writer.deleteWhere(tableName, whereArgs.where, { limit: whereArgs.limit });
     },
     // `exists` reuses `findFirst` (RLS-filtered, indexed when a `.withIndex`-able
     // `where` is supplied) and only asks whether a row came back — no count scan.
@@ -65,29 +76,36 @@ const bindTableFacade = (writer, tableName) => {
     insert,
     insertMany: (documents, options) => {
       if (writer.insertMany === void 0) {
-        throw new Error(`ctx.db.${tableName}.insertMany is unavailable: this writer has no batch insert`);
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.insertMany is unavailable: this writer has no batch insert`);
       }
       return writer.insertMany(tableName, documents, options);
     },
     patch: (id, patch) => writer.patch(id, patch, tableName),
-    patchMany: (patches, options) => {
-      if (writer.patchMany === void 0) {
-        throw new Error(`ctx.db.${tableName}.patchMany is unavailable: this writer has no batch patch`);
+    patchMany: (first, options) => {
+      if (Array.isArray(first)) {
+        if (writer.patchMany === void 0) {
+          throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.patchMany is unavailable: this writer has no batch patch`);
+        }
+        return writer.patchMany(
+          first.map((entry) => {
+            return { id: entry.id, patch: entry.values };
+          }),
+          options,
+          tableName
+        );
+      }
+      if (writer.patchWhere === void 0) {
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.patchMany({ where, values }) is unavailable: this writer has no where-based patch`);
       }
-      return writer.patchMany(
-        patches.map((entry) => {
-          return { id: entry.id, patch: entry.values };
-        }),
-        options,
-        tableName
-      );
+      const whereArgs = first;
+      return writer.patchWhere(tableName, { patch: whereArgs.values, where: whereArgs.where }, { limit: whereArgs.limit });
     },
     rank: (indexName, options) => writer.rank(tableName, indexName, options),
     rankPage: (indexName, options) => writer.rankPage(tableName, indexName, options),
     replace: (id, document) => writer.replace(id, document, tableName),
     restore: async (id) => {
       if (!writer.restore) {
-        throw new Error(`ctx.db.${tableName}.restore is unavailable: this writer has no restore (is the table .softDelete()?)`);
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.restore is unavailable: this writer has no restore (is the table .softDelete()?)`);
       }
       await writer.restore(id, tableName);
     },
@@ -99,6 +117,7 @@ const bindTableFacade = (writer, tableName) => {
       }
       return results;
     },
+    withGeoIndex: (indexName, build) => writer.query(tableName).withGeoIndex(indexName, build),
     withSearchIndex: (indexName, search) => writer.query(tableName).withSearchIndex(indexName, search)
   };
 };
@@ -106,7 +125,7 @@ const bindOrm = (facade) => {
   const resolve = (table) => {
     const bound = facade[table];
     if (!bound) {
-      throw new Error(`unknown table: ${table}`);
+      throw new LunoraError$1("INTERNAL", `unknown table: ${table}`);
     }
     return bound;
   };

package/dist/packem_shared/buildRlsReadRegistry-2uk_GfiH.mjs

@@ -0,0 +1,107 @@
+import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-BaDQf7MG.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
+
+const FALSE_PREDICATE = { OR: [] };
+const readEntryTags = (entry) => {
+  const hoisted = entry?.rls?.tags;
+  if (hoisted) {
+    return hoisted;
+  }
+  const tag = readRlsTag(entry);
+  return tag ? [tag] : [];
+};
+const addTagToRegistry = (byTable, tag) => {
+  const rolePermissions = indexRolePermissions(tag.roles);
+  const seenWhenByTable = /* @__PURE__ */ new Map();
+  const policiesByTable = /* @__PURE__ */ new Map();
+  for (const policy of tag.policies) {
+    if (policy.on !== "read") {
+      continue;
+    }
+    const seen = seenWhenByTable.get(policy.table) ?? /* @__PURE__ */ new Set();
+    if (seen.has(policy.when)) {
+      continue;
+    }
+    seen.add(policy.when);
+    seenWhenByTable.set(policy.table, seen);
+    const list = policiesByTable.get(policy.table) ?? [];
+    list.push(policy);
+    policiesByTable.set(policy.table, list);
+  }
+  for (const [table, policies] of policiesByTable) {
+    const groups = byTable.get(table) ?? [];
+    groups.push({ policies, rolePermissions });
+    byTable.set(table, groups);
+  }
+};
+const isFalsePredicate = (where) => {
+  const or = where.OR;
+  return Array.isArray(or) && or.length === 0 && Object.keys(where).length === 1;
+};
+const andMerge = (injected, caller) => {
+  if (!injected || Object.keys(injected).length === 0) {
+    return caller;
+  }
+  if (isFalsePredicate(injected)) {
+    return injected;
+  }
+  if (Object.keys(caller).length === 0) {
+    return injected;
+  }
+  return { AND: [injected, caller] };
+};
+const evaluateGroupBaseWhere = (group, request) => {
+  const granted = /* @__PURE__ */ new Set();
+  for (const roleName of request.roles) {
+    for (const name of group.rolePermissions.get(roleName) ?? []) {
+      granted.add(name);
+    }
+  }
+  return computeReadBaseWhere(group.policies, {
+    auth: {
+      can: (permission) => granted.has(permissionName(permission)),
+      identity: request.identity,
+      roles: request.roles,
+      userId: request.userId
+    },
+    ctx: request.ctx
+  });
+};
+const resolveReadBaseWhere = (registry, request) => {
+  const groups = registry.byTable.get(request.table);
+  if (!groups || groups.length === 0) {
+    return request.rlsRequired && !request.tablePublic ? FALSE_PREDICATE : void 0;
+  }
+  const predicates = [];
+  for (const group of groups) {
+    const base = evaluateGroupBaseWhere(group, request);
+    if (base === void 0) {
+      return void 0;
+    }
+    if (isFalsePredicate(base)) {
+      continue;
+    }
+    predicates.push(base);
+  }
+  if (predicates.length === 0) {
+    return FALSE_PREDICATE;
+  }
+  return predicates.length === 1 ? predicates[0] : { OR: predicates };
+};
+const buildRlsReadRegistry = (functions) => {
+  const byTable = /* @__PURE__ */ new Map();
+  const seenTags = /* @__PURE__ */ new Set();
+  for (const entry of functions) {
+    for (const tag of readEntryTags(entry)) {
+      if (seenTags.has(tag)) {
+        continue;
+      }
+      seenTags.add(tag);
+      addTagToRegistry(byTable, tag);
+    }
+  }
+  return { byTable };
+};
+const composeShapeReadWhere = (registry, request) => andMerge(resolveReadBaseWhere(registry, request), request.shapeWhere);
+
+export { buildRlsReadRegistry, composeShapeReadWhere };

package/dist/packem_shared/{composePluginMiddleware-Ck5_TUO8.mjs → composePluginMiddleware-z62dttBo.mjs}

@@ -1,4 +1,5 @@
-import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+import { r as runMiddlewareChain } from './run-middleware-I6EiQfxL.mjs';
 
 const prefixTableName = (key, bareName) => `${key}_${bareName}`;
 const rewriteReference = (target, key, bareNames) => bareNames.has(target) ? prefixTableName(key, target) : target;
@@ -19,7 +20,7 @@ const rewriteTableReferences = (table, key, bareNames, ownBareName) => {
 };
 const defineSchemaExtension = (key, options) => {
   if (!key) {
-    throw new Error("defineSchemaExtension: `key` is required and must be a non-empty string");
+    throw new LunoraError$1("INTERNAL", "defineSchemaExtension: `key` is required and must be a non-empty string");
   }
   return {
     key,
@@ -27,19 +28,19 @@ const defineSchemaExtension = (key, options) => {
     ...options.vectorIndexes ? { vectorIndexes: options.vectorIndexes } : {}
   };
 };
-const definePlugin = (key, options) => {
+const definePlugin = ((key, options) => {
   if (!key) {
-    throw new Error("definePlugin: `key` is required and must be a non-empty string");
+    throw new LunoraError$1("INTERNAL", "definePlugin: `key` is required and must be a non-empty string");
   }
   if (options.extension && options.extension.key !== key) {
-    throw new Error(`definePlugin("${key}"): extension key "${options.extension.key}" does not match plugin key`);
+    throw new LunoraError$1("INTERNAL", `definePlugin("${key}"): extension key "${options.extension.key}" does not match plugin key`);
   }
   return {
     key,
     ...options.extension ? { extension: options.extension } : {},
     ...options.middleware ? { middleware: options.middleware } : {}
   };
-};
+});
 const defineComponent = (key, options) => {
   const plugin = definePlugin(key, {
     ...options.extension ? { extension: options.extension } : {},
@@ -57,7 +58,8 @@ const mergeSchemaExtension = (base, extension) => {
   for (const [bareName, table] of Object.entries(extension.tables)) {
     const prefixed = prefixTableName(key, bareName);
     if (Object.hasOwn(merged, prefixed)) {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `defineSchema(...).extend("${key}"): table "${prefixed}" already exists in the base schema — another extension with the same key already contributed it`
       );
     }
@@ -68,7 +70,8 @@ const mergeSchemaExtension = (base, extension) => {
     for (const [bareIndexName, index] of Object.entries(extension.vectorIndexes)) {
       const prefixed = prefixTableName(key, bareIndexName);
       if (Object.hasOwn(mergedVectorIndexes, prefixed)) {
-        throw new Error(
+        throw new LunoraError$1(
+          "INTERNAL",
           `defineSchema(...).extend("${key}"): vector index "${prefixed}" already exists in the base schema — another extension with the same key already contributed it`
         );
       }

package/dist/packem_shared/{createPolicyDsl-De67zPDS.mjs → createPolicyDsl-By3QB4he.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const definePolicy = (input) => {
   return { on: input.on, table: input.table, when: input.when };
 };
@@ -13,7 +15,8 @@ const definePolicies = (policies) => {
     const key = JSON.stringify([policy.table, policy.on]);
     const whens = seenWhenByKey.get(key) ?? /* @__PURE__ */ new Set();
     if (whens.has(policy.when)) {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `definePolicies: duplicate policy for (table "${policy.table}", on "${policy.on}") — the same decision function is registered more than once. Multiple distinct policies per (table, on) are allowed (reads OR, writes AND); remove the duplicate.`
       );
     }

package/dist/packem_shared/createSecrets-DwaR2rNG.mjs

@@ -0,0 +1,58 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
+const NON_SECRET_BINDING_METHODS = [
+  "put",
+  // KV / R2
+  "list",
+  // KV / R2
+  "delete",
+  // KV / R2
+  "getWithMetadata",
+  // KV
+  "head",
+  // R2
+  "createMultipartUpload",
+  // R2
+  "idFromName",
+  // Durable Object namespace
+  "newUniqueId",
+  // Durable Object namespace
+  "getByName",
+  // Durable Object namespace
+  "send",
+  // Queue producer
+  "sendBatch",
+  // Queue producer
+  "writeDataPoint",
+  // Analytics Engine dataset
+  "create",
+  // Workflows binding (get(id) + create/createBatch)
+  "createBatch"
+  // Workflows binding
+];
+const isSecretBinding = (value) => {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value;
+  if (typeof record.get !== "function") {
+    return false;
+  }
+  return !NON_SECRET_BINDING_METHODS.some((method) => typeof record[method] === "function");
+};
+const createSecrets = (env) => {
+  return {
+    get: async (name) => {
+      const binding = env[name];
+      if (!isSecretBinding(binding)) {
+        throw new LunoraError$1(
+          "INTERNAL",
+          `ctx.secrets: no Secrets Store binding named "${name}". Add a \`secrets_store_secrets[]\` entry (binding "${name}", pointing at your store + secret) to wrangler.jsonc — \`ctx.secrets\` reads a Secrets Store binding, not a plain \`.dev.vars\` value.`
+        );
+      }
+      return binding.get();
+    }
+  };
+};
+
+export { createSecrets };