@lunora/server 1.0.0-alpha.56 → 1.0.0-alpha.57

package/dist/index.mjs

@@ -1 +1 @@
-import{initLunora as t}from"./packem_shared/initLunora-QNqOuG0A.mjs";import{createSecrets as i}from"./packem_shared/createSecrets-CgVPiW2C.mjs";import{LunoraEnvError as p,defineEnv as m,redactSecrets as a}from"./packem_shared/LunoraEnvError-CgpI2Mm_.mjs";import{LunoraError as x}from"./packem_shared/LunoraError-LVhdU0Lo.mjs";import{bindOrm as c,bindTableFacade as l}from"./packem_shared/bindOrm-Bp9hsM2q.mjs";import{httpAction as u,httpRoute as S,httpRouter as g,isSafeHeaderValue as R,serveStorageObject as L}from"./packem_shared/httpAction-C14NuF3V.mjs";import{defineIdentity as h}from"./packem_shared/defineIdentity-B7gfAgxx.mjs";import{onConnect as I,onDisconnect as T}from"./packem_shared/onConnect-CEtRmUpJ.mjs";import{DEFAULT_LIMIT as y,DEFAULT_MAX_LIMIT as M,clampLimit as _,defineListArgs as D}from"./packem_shared/DEFAULT_LIMIT-yHJ5O96W.mjs";import{defineMigration as C}from"./packem_shared/defineMigration-Bfpwxv2f.mjs";import{defineMutator as V}from"./packem_shared/defineMutator-BgpQ-xUo.mjs";import{composePluginMiddleware as N,defineComponent as O,definePlugin as U,defineSchemaExtension as w,installPlugins as B,mergeSchemaExtension as W}from"./packem_shared/composePluginMiddleware-COr09CXA.mjs";import{PRESENCE_DEFAULT_TTL_MS as H,PRESENCE_TABLE as J,definePresence as X,presenceExtension as q}from"./packem_shared/PRESENCE_DEFAULT_TTL_MS-C9RX3Cl6.mjs";import{protectPublic as G}from"./packem_shared/protectPublic-BhKewPqm.mjs";import{defineAggregateIndex as Q,defineRankIndex as Y,defineSchema as Z,defineTable as $,defineVectorIndex as ee}from"./packem_shared/defineAggregateIndex-_gWNmkQZ.mjs";import{defineShape as re}from"./packem_shared/defineShape-Ds8uNqzX.mjs";import{anyApi as ne}from"./types.mjs";import{cronJobs as fe}from"@lunora/scheduler";import{ValidationError as me,v as ae}from"@lunora/values";import{allowAll as xe,deny as se,isDeny as ce,toWhereInput as le}from"./packem_shared/allowAll-BnyNbJZT.mjs";import{asBucketStorage as ue}from"./packem_shared/asBucketStorage-BthCnWop.mjs";import{buildRlsReadRegistry as ge,composeShapeReadWhere as Re}from"./packem_shared/buildRlsReadRegistry-WdiqSj87.mjs";import{createPolicyDsl as Pe,definePermission as he,definePolicies as Ae,definePolicy as Ie,defineRole as Te}from"./packem_shared/createPolicyDsl-sV1swpkD.mjs";import{defineStorageRule as ye,defineStorageRules as Me}from"./packem_shared/defineStorageRule-BDu01PUn.mjs";import{mask as De}from"./packem_shared/mask-C6Bi78qj.mjs";import{rls as Ce}from"./packem_shared/rls-_iVsPvhX.mjs";import{storageRules as Ve}from"./packem_shared/storageRules-BptPZbi8.mjs";const e="0.0.0";export{y as DEFAULT_LIMIT,M as DEFAULT_MAX_LIMIT,p as LunoraEnvError,x as LunoraError,H as PRESENCE_DEFAULT_TTL_MS,J as PRESENCE_TABLE,e as VERSION,me as ValidationError,xe as allowAll,ne as anyApi,ue as asBucketStorage,c as bindOrm,l as bindTableFacade,ge as buildRlsReadRegistry,_ as clampLimit,N as composePluginMiddleware,Re as composeShapeReadWhere,Pe as createPolicyDsl,i as createSecrets,fe as cronJobs,Q as defineAggregateIndex,O as defineComponent,m as defineEnv,h as defineIdentity,D as defineListArgs,C as defineMigration,V as defineMutator,he as definePermission,U as definePlugin,Ae as definePolicies,Ie as definePolicy,X as definePresence,Y as defineRankIndex,Te as defineRole,Z as defineSchema,w as defineSchemaExtension,re as defineShape,ye as defineStorageRule,Me as defineStorageRules,$ as defineTable,ee as defineVectorIndex,se as deny,u as httpAction,S as httpRoute,g as httpRouter,t as initLunora,B as installPlugins,ce as isDeny,R as isSafeHeaderValue,De as mask,W as mergeSchemaExtension,I as onConnect,T as onDisconnect,q as presenceExtension,G as protectPublic,a as redactSecrets,Ce as rls,L as serveStorageObject,Ve as storageRules,le as toWhereInput,ae as v};
+import{initLunora as t}from"./packem_shared/initLunora-DXCOVntr.mjs";import{createSecrets as i}from"./packem_shared/createSecrets-CgVPiW2C.mjs";import{LunoraEnvError as f,defineEnv as s,redactSecrets as m}from"./packem_shared/LunoraEnvError-CgpI2Mm_.mjs";import{LunoraError as p}from"./packem_shared/LunoraError-LVhdU0Lo.mjs";import{bindOrm as c,bindTableFacade as l}from"./packem_shared/bindOrm-Bp9hsM2q.mjs";import{httpAction as u,httpRoute as S,httpRouter as g,isSafeHeaderValue as R,serveStorageObject as L}from"./packem_shared/httpAction-C14NuF3V.mjs";import{defineIdentity as P}from"./packem_shared/defineIdentity-B7gfAgxx.mjs";import{onConnect as A,onDisconnect as I}from"./packem_shared/onConnect-CEtRmUpJ.mjs";import{DEFAULT_LIMIT as y,DEFAULT_MAX_LIMIT as M,clampLimit as _,defineListArgs as D}from"./packem_shared/DEFAULT_LIMIT-yHJ5O96W.mjs";import{defineMigration as k}from"./packem_shared/defineMigration-Bfpwxv2f.mjs";import{defineMutator as C}from"./packem_shared/defineMutator-BgpQ-xUo.mjs";import{c as N,H as O,d as U,a as W,X as w,Z as B,b as H,q as X,K as j,W as q,i as J,m as K}from"./packem_shared/plugin-B5pDeN17.mjs";import{PRESENCE_DEFAULT_TTL_MS as z,PRESENCE_TABLE as G,definePresence as Q,presenceExtension as Y}from"./packem_shared/PRESENCE_DEFAULT_TTL_MS-DO2-TdzC.mjs";import{protectPublic as ee}from"./packem_shared/protectPublic-BhKewPqm.mjs";import{defineShape as oe}from"./packem_shared/defineShape-Ds8uNqzX.mjs";import{anyApi as ne}from"./types.mjs";import{cronJobs as ae}from"@lunora/scheduler";import{ValidationError as se,v as me}from"@lunora/values";import{allowAll as pe,deny as xe,isDeny as ce,toWhereInput as le}from"./packem_shared/allowAll-BnyNbJZT.mjs";import{asBucketStorage as ue}from"./packem_shared/asBucketStorage-BthCnWop.mjs";import{buildMaskRegistry as ge}from"./packem_shared/buildMaskRegistry-BCIzKxdK.mjs";import{buildRlsReadRegistry as Le,composeShapeReadWhere as he}from"./packem_shared/buildRlsReadRegistry-CA-aUi7I.mjs";import{createPolicyDsl as be,definePermission as Ae,definePolicies as Ie,definePolicy as Te,defineRole as ye}from"./packem_shared/createPolicyDsl-sV1swpkD.mjs";import{defineStorageRule as _e,defineStorageRules as De}from"./packem_shared/defineStorageRule-BDu01PUn.mjs";import{mask as ke}from"./packem_shared/mask-DF7mtxQe.mjs";import{rls as Ce}from"./packem_shared/rls-tRDkICWZ.mjs";import{storageRules as Ne}from"./packem_shared/storageRules-BptPZbi8.mjs";const e="0.0.0";export{y as DEFAULT_LIMIT,M as DEFAULT_MAX_LIMIT,f as LunoraEnvError,p as LunoraError,z as PRESENCE_DEFAULT_TTL_MS,G as PRESENCE_TABLE,e as VERSION,se as ValidationError,pe as allowAll,ne as anyApi,ue as asBucketStorage,c as bindOrm,l as bindTableFacade,ge as buildMaskRegistry,Le as buildRlsReadRegistry,_ as clampLimit,N as composePluginMiddleware,he as composeShapeReadWhere,be as createPolicyDsl,i as createSecrets,ae as cronJobs,O as defineAggregateIndex,U as defineComponent,s as defineEnv,P as defineIdentity,D as defineListArgs,k as defineMigration,C as defineMutator,Ae as definePermission,W as definePlugin,Ie as definePolicies,Te as definePolicy,Q as definePresence,w as defineRankIndex,ye as defineRole,B as defineSchema,H as defineSchemaExtension,oe as defineShape,_e as defineStorageRule,De as defineStorageRules,X as defineTable,j as defineVectorIndex,xe as deny,u as httpAction,S as httpRoute,g as httpRouter,q as indexFieldsFromSchema,t as initLunora,J as installPlugins,ce as isDeny,R as isSafeHeaderValue,ke as mask,K as mergeSchemaExtension,A as onConnect,I as onDisconnect,Y as presenceExtension,ee as protectPublic,m as redactSecrets,Ce as rls,L as serveStorageObject,Ne as storageRules,le as toWhereInput,me as v};

package/dist/packem_shared/PRESENCE_DEFAULT_TTL_MS-DO2-TdzC.mjs

@@ -0,0 +1 @@
+import{v as t}from"@lunora/values";import{initLunora as E}from"./initLunora-DXCOVntr.mjs";import{LunoraError as p}from"./LunoraError-LVhdU0Lo.mjs";import{onDisconnect as q}from"./onConnect-CEtRmUpJ.mjs";import{b as v,q as R,d as _}from"./plugin-B5pDeN17.mjs";const D=3e4,y=4096,u="presence",h="present",c=`${u}_${h}`,M=v(u,{tables:{[h]:R({data:t.optional(t.record(t.string(),t.any())),lastSeen:t.number(),roomId:t.string(),sessionId:t.string(),userId:t.optional(t.string())}).index("byRoomSession",["roomId","sessionId"]).index("byRoom",["roomId"])}}),{mutation:b,query:L}=E.dataModel().create(),B=(l={})=>{const m=l.ttlMs??D,f=Math.max(0,Math.min(l.disconnectGraceMs??0,m)),w=b.input({data:t.optional(t.record(t.string(),t.any())),roomId:t.string(),sessionId:t.string()}).mutation(async({args:o,ctx:s})=>{const r=Date.now(),i=s.auth.userId??void 0;if(o.data!==void 0&&new TextEncoder().encode(JSON.stringify(o.data)).length>y)throw new p("BAD_REQUEST",`presence data exceeds the ${String(y)}-byte limit`);const e=await s.db.query(c).withIndex("byRoomSession",n=>n.eq("roomId",o.roomId).eq("sessionId",o.sessionId)).first();if(e&&(e.userId??void 0)!==i)throw new p("FORBIDDEN","presence heartbeat denied: this (roomId, sessionId) is held by another identity");const a={lastSeen:r,roomId:o.roomId,sessionId:o.sessionId,...o.data===void 0?{}:{data:o.data},...i===void 0?{}:{userId:i}};return await(e?s.db.patch(e._id,a):s.db.insert(c,a)),{lastSeen:r}}),S=L.input({roomId:t.string()}).query(async({args:o,ctx:s})=>{const r=Date.now()-m,i=(await s.db.query(c).withIndex("byRoom",n=>n.eq("roomId",o.roomId)).collect()).filter(n=>n.lastSeen>r).toSorted((n,d)=>d.lastSeen-n.lastSeen),e=new Set,a=[];for(const n of i){const d=n.userId;if(d!==void 0){if(e.has(d))continue;e.add(d)}const I={lastSeen:n.lastSeen,roomId:n.roomId};d!==void 0&&(I.userId=d),n.data!==void 0&&(I.data=n.data),a.push(I)}return a}),g={...b.input({roomId:t.string()}).mutation(async({args:o,ctx:s})=>{const r=Date.now()-m,i=await s.db.query(c).withIndex("byRoom",e=>e.eq("roomId",o.roomId)).filter(e=>e.lastSeen<=r).collect();return await Promise.all(i.map(e=>s.db.delete(e._id))),{deleted:i.length}}),visibility:"internal"},x=q(async(o,s)=>{const r=s.context?.roomId,i=s.context?.sessionId;if(typeof r!="string"||typeof i!="string")return;const e=await o.db.query(c).withIndex("byRoomSession",d=>d.eq("roomId",r).eq("sessionId",i)).first();if(!e)return;const a=s.userId??void 0;if((e.userId??void 0)!==a)return;if(f===0){await o.db.delete(e._id);return}const n=Math.min(e.lastSeen,Date.now()+f-m);await o.db.patch(e._id,{lastSeen:n})});return _(u,{extension:M,functions:{disconnect:x,heartbeat:w,listPresent:S,sweep:g}})};export{D as PRESENCE_DEFAULT_TTL_MS,c as PRESENCE_TABLE,B as definePresence,M as presenceExtension};

package/dist/packem_shared/buildMaskRegistry-BCIzKxdK.mjs

@@ -0,0 +1 @@
+const n=Symbol.for("lunora.mask.middleware-columns"),c=(e,o)=>(Object.defineProperty(e,n,{configurable:!0,enumerable:!1,value:o}),e),u=e=>{if(!(e===null||typeof e!="function"&&typeof e!="object"))return e[n]},d=e=>{const o=new Map;for(const r of e){const t=r?.maskedTables;if(t)for(const[a,f]of t){const s=o.get(a)??new Set;for(const l of f)s.add(l);o.set(a,s)}}return o};export{d as buildMaskRegistry,u as readMaskTag,c as tagMaskMiddleware};

package/dist/packem_shared/{buildRlsReadRegistry-WdiqSj87.mjs → buildRlsReadRegistry-CA-aUi7I.mjs}

@@ -1 +1 @@
-import{indexRolePermissions as f,computeReadBaseWhere as h,permissionName as d}from"./rls-_iVsPvhX.mjs";import{l as u}from"./policy-tag-Dprt9JWo.mjs";import{deny as p}from"./allowAll-BnyNbJZT.mjs";const c=p(),b=t=>{const e=t?.rls?.tags;if(e)return e;const o=u(t);return o?[o]:[]},g=(t,e)=>{const o=f(e.roles),r=new Map,n=new Map;for(const s of e.policies){if(s.on!=="read")continue;const a=r.get(s.table)??new Set;if(a.has(s.when))continue;a.add(s.when),r.set(s.table,a);const i=n.get(s.table)??[];i.push(s),n.set(s.table,i)}for(const[s,a]of n){const i=t.get(s)??[];i.push({policies:a,rolePermissions:o}),t.set(s,i)}},l=t=>{const e=t.OR;return Array.isArray(e)&&e.length===0&&Object.keys(t).length===1},m=(t,e)=>!t||Object.keys(t).length===0?e:l(t)||Object.keys(e).length===0?t:{AND:[t,e]},y=(t,e)=>{const o=new Set;for(const r of e.roles)for(const n of t.rolePermissions.get(r)??[])o.add(n);return h(t.policies,{auth:{can:r=>o.has(d(r)),identity:e.identity,roles:e.roles,userId:e.userId},ctx:e.ctx})},R=(t,e)=>{const o=t.byTable.get(e.table);if(!o||o.length===0)return e.rlsRequired&&!e.tablePublic?c:void 0;const r=[];for(const n of o){const s=y(n,e);if(s===void 0)return;l(s)||r.push(s)}return r.length===0?c:r.length===1?r[0]:{OR:r}},x=t=>{const e=new Map,o=new Set;for(const r of t)for(const n of b(r))o.has(n)||(o.add(n),g(e,n));return{byTable:e}},S=(t,e)=>m(R(t,e),e.shapeWhere);export{x as buildRlsReadRegistry,S as composeShapeReadWhere};
+import{indexRolePermissions as f,computeReadBaseWhere as h,permissionName as d}from"./rls-tRDkICWZ.mjs";import{l as u}from"./policy-tag-Dprt9JWo.mjs";import{deny as p}from"./allowAll-BnyNbJZT.mjs";const c=p(),b=t=>{const e=t?.rls?.tags;if(e)return e;const o=u(t);return o?[o]:[]},g=(t,e)=>{const o=f(e.roles),r=new Map,n=new Map;for(const s of e.policies){if(s.on!=="read")continue;const a=r.get(s.table)??new Set;if(a.has(s.when))continue;a.add(s.when),r.set(s.table,a);const i=n.get(s.table)??[];i.push(s),n.set(s.table,i)}for(const[s,a]of n){const i=t.get(s)??[];i.push({policies:a,rolePermissions:o}),t.set(s,i)}},l=t=>{const e=t.OR;return Array.isArray(e)&&e.length===0&&Object.keys(t).length===1},m=(t,e)=>!t||Object.keys(t).length===0?e:l(t)||Object.keys(e).length===0?t:{AND:[t,e]},y=(t,e)=>{const o=new Set;for(const r of e.roles)for(const n of t.rolePermissions.get(r)??[])o.add(n);return h(t.policies,{auth:{can:r=>o.has(d(r)),identity:e.identity,roles:e.roles,userId:e.userId},ctx:e.ctx})},R=(t,e)=>{const o=t.byTable.get(e.table);if(!o||o.length===0)return e.rlsRequired&&!e.tablePublic?c:void 0;const r=[];for(const n of o){const s=y(n,e);if(s===void 0)return;l(s)||r.push(s)}return r.length===0?c:r.length===1?r[0]:{OR:r}},S=t=>{const e=new Map,o=new Set;for(const r of t)for(const n of b(r))o.has(n)||(o.add(n),g(e,n));return{byTable:e}},x=(t,e)=>m(R(t,e),e.shapeWhere);export{S as buildRlsReadRegistry,x as composeShapeReadWhere};

package/dist/packem_shared/composePluginMiddleware-B67TQ409.mjs

@@ -0,0 +1 @@
+import"@lunora/errors";import"./run-middleware-BeEEqmdE.mjs";import{c as s,d as o,a as m,b as t,i as d,m as l}from"./plugin-B5pDeN17.mjs";export{s as composePluginMiddleware,o as defineComponent,m as definePlugin,t as defineSchemaExtension,d as installPlugins,l as mergeSchemaExtension};

package/dist/packem_shared/defineAggregateIndex-DMhN3nby.mjs

@@ -0,0 +1 @@
+import"@lunora/errors";import{H as n,X as s,Z as r,q as f,K as m,W as o,N as t}from"./plugin-B5pDeN17.mjs";import"@lunora/values";export{n as defineAggregateIndex,s as defineRankIndex,r as defineSchema,f as defineTable,m as defineVectorIndex,o as indexFieldsFromSchema,t as validateIndexFields};

package/dist/packem_shared/initLunora-DXCOVntr.mjs

@@ -0,0 +1 @@
+import{s as g}from"./functions-CDC08CWY.mjs";import{readMaskTag as w}from"./buildMaskRegistry-BCIzKxdK.mjs";import{l as f}from"./policy-tag-Dprt9JWo.mjs";import{l as x}from"./run-middleware-BeEEqmdE.mjs";const y=(t,e)=>e===void 0||typeof t!="object"||t===null?t:Object.assign(Object.create(Object.getPrototypeOf(t)),t,{meta:e}),p=(t,e)=>x(t,e,s=>s),b=(t,e,s,a,i)=>async(r,d)=>{const l=g(t,d),n=await p(e,y(r,i)),m=await s({args:l,ctx:n});return a?a.parse(m):m},k=(t,e,s)=>(a,i,r)=>{const d=g(t,i);return(async function*(){const l=await p(e,a),n=s({args:d,ctx:l,signal:r})[Symbol.asyncIterator]();try{for(;;){if(r.aborted)return;const m=await n.next();if(m.done||r.aborted)return;yield m.value}}finally{await n.return?.()}})()},u=t=>{const e=[];for(const s of t){const a=f(s);a&&e.push(a)}return e.length>0?{tags:e}:void 0},c=t=>{const e=new Map;for(const s of t){const a=w(s);if(a)for(const[i,r]of a.columns){const d=e.get(i)??new Set;for(const l of r)d.add(l);e.set(i,d)}}return e.size>0?e:void 0},o=(t,e,s)=>({__lunoraProcedure:t,...s?{__lunoraVisibility:s}:{},input:a=>o(t,{...e,args:{...e.args,...a}},s),[t]:a=>{const i=u(e.middlewares),r=c(e.middlewares);return{args:e.args,...e.expose?{expose:e.expose}:{},handler:b(e.args,e.middlewares,a,e.output,e.meta),kind:t,...r?{maskedTables:r}:{},...e.meta?{meta:e.meta}:{},...i?{rls:i}:{},...s?{visibility:s}:{},...e.x402?{x402:e.x402}:{}}},meta:a=>o(t,{...e,meta:{...e.meta,...a}},s),output:a=>o(t,{...e,output:a},s),...t==="query"?{stream:a=>{const i=u(e.middlewares),r=c(e.middlewares);return{args:e.args,...e.expose?{expose:e.expose}:{},handler:k(e.args,e.middlewares,a),kind:"stream",...r?{maskedTables:r}:{},...i?{rls:i}:{},...s?{visibility:s}:{},...e.x402?{x402:e.x402}:{}}}}:{},use:a=>o(t,{...e,middlewares:[...e.middlewares,a]},s),...s?{}:{expose:a=>o(t,{...e,expose:a},s)},...s?{}:{x402:a=>o(t,{...e,x402:a},s)}}),q={dataModel:()=>({create:t=>({action:o("action",{args:{},middlewares:[]}),internalAction:o("action",{args:{},middlewares:[]},"internal"),internalMutation:o("mutation",{args:{},middlewares:[]},"internal"),internalQuery:o("query",{args:{},middlewares:[]},"internal"),mutation:o("mutation",{args:{},middlewares:[]}),query:o("query",{args:{},middlewares:[]})})})};export{q as initLunora};

package/dist/packem_shared/mask-DF7mtxQe.mjs

@@ -0,0 +1 @@
+import{LunoraError as p}from"./LunoraError-LVhdU0Lo.mjs";import{bindOrm as T,bindTableFacade as W}from"./bindOrm-Bp9hsM2q.mjs";import{o as P}from"./optional-writer-override-CXXO30sZ.mjs";import{tagMaskMiddleware as R}from"./buildMaskRegistry-BCIzKxdK.mjs";const O=n=>typeof n=="string"?n:n.name,F=n=>{const o=new Map;for(const s of n??[])o.set(s.name,new Set((s.permissions??[]).map(l=>O(l))));return o},j=n=>{let o=2166136261;for(let s=0;s<n.length;s+=1)o^=n.codePointAt(s)??0,o=Math.imul(o,16777619);return(o>>>0).toString(16).padStart(8,"0")},U=(n,o,s)=>{try{return n==="redact"?null:n==="hash"?o==null?o:j(typeof o=="string"?o:JSON.stringify(o)):n(o,s)}catch{return null}},u=(n,o,s)=>{const l={...n};for(const[w,h]of Object.entries(o))w in l&&(l[w]=U(h,n[w],{...s,column:w,row:n}));return l},N=(n,o,s)=>({...n,page:n.page.map(l=>u(l,o,s))}),v=(n,o,s,l)=>{if(typeof n!="function")return;const w=new Set,h=()=>new Proxy({},{get:()=>d=>(typeof d=="string"&&w.add(d),h())});n(h());for(const d of w)if(d in o)throw new p("MASK_UNSUPPORTED",`${l}() filtering "${s}" by masked column "${d}" is not supported`)},_=n=>{if(typeof n!="object"||n===null||Array.isArray(n))return!1;const o=n;return typeof o.findMany=="function"&&typeof o.withSearchIndex=="function"},E=(n,o,s,l)=>{const w=n.rankBefore,h=n.rankPageRows,d=(t,e,a,r)=>{const i=o.get(t);if(!i)return;const c=l?.[t]?.[r]?.[e];if(!c)return;const A=c.find(B=>B in i);if(A!==void 0)throw new p("MASK_UNSUPPORTED",`${a}() reading "${t}" via index "${e}" would order rows by masked column "${A}" — use an index whose declared fields are all unmasked, or unmask the column`)},y=(t,e,a)=>({async*[Symbol.asyncIterator](){for await(const r of{[Symbol.asyncIterator]:()=>t[Symbol.asyncIterator]()})yield u(r,e,s)},collect:async()=>(await t.collect()).map(r=>u(r,e,s)),collectWithScores:async()=>(await t.collectWithScores()).map(r=>{const i=u(r.document,e,s);return"distanceMeters"in r?{distanceMeters:null,document:i}:{document:i,score:r.score}}),filter:r=>y(t.filter(i=>r(u(i,e,s))),e,a),first:async()=>{const r=await t.first();return r?u(r,e,s):null},order:r=>y(t.order(r),e,a),paginate:async r=>N(await t.paginate(r),e,s),take:async r=>(await t.take(r)).map(i=>u(i,e,s)),unique:async()=>{const r=await t.unique();return r?u(r,e,s):null},withIndex:(r,i)=>(d(a,r,"withIndex","index"),v(i,e,a,"withIndex"),y(t.withIndex(r,i),e,a)),withSearchIndex:(r,i)=>(v(i,e,a,"withSearchIndex"),y(t.withSearchIndex(r,i),e,a)),withGeoIndex:(r,i)=>(d(a,r,"withGeoIndex","geo"),y(t.withGeoIndex(r,i),e,a))}),S=async(t,e)=>{if(n.lookupById){const c=await n.lookupById(t,e);return c?{row:c.row,tableName:o.has(c.tableName)?c.tableName:void 0}:{row:null,tableName:void 0}}const a=await n.get(t,e);if(!a)return{row:null,tableName:void 0};let r;e===void 0?r=[...o.keys()]:o.has(e)?r=[e]:r=[];const i=await Promise.all(r.map(async c=>(await n.findFirst(c,{limit:1,where:{_id:t}}))?._id===t?c:void 0));return{row:a,tableName:i.find(c=>c!==void 0)}},M=(t,e,a)=>{const r=o.get(t);if(!r)return;const i=e.find(c=>typeof c=="string"&&c in r);if(i!==void 0)throw new p("MASK_UNSUPPORTED",`${a}() over masked column "${i}" on "${t}" is not supported`)},m=(t,e)=>{if(!(!t||typeof t!="object"||Array.isArray(t)))for(const[a,r]of Object.entries(t))if(a==="AND"||a==="OR"){if(Array.isArray(r))for(const i of r)m(i,e)}else a==="NOT"?m(r,e):a.startsWith("__")||e.add(a)},f=(t,e,a)=>{const r=o.get(t);if(!r||e===void 0)return;const i=new Set;m(e,i);for(const c of i)if(c in r)throw new p("MASK_UNSUPPORTED",`${a}() filtering "${t}" by masked column "${c}" is not supported`)},b=(t,e,a)=>{const r=o.get(t);if(!(!r||!Array.isArray(e))){for(const i of e)if(i&&typeof i=="object"&&!Array.isArray(i)){for(const c of Object.keys(i))if(c in r)throw new p("MASK_UNSUPPORTED",`${a}() ordering "${t}" by masked column "${c}" is not supported`)}}},I=t=>t&&typeof t=="object"&&!Array.isArray(t)?t:void 0,g=(t,e,a)=>{const r=I(e);f(t,r?.where,a),f(t,r?.baseWhere,a)},k={...n,async deleteWhere(t,e,a){if(f(t,e,"deleteMany({ where })"),n.deleteWhere===void 0)throw new p("INTERNAL",`ctx.db.${t}.deleteMany({ where }) is unavailable: this writer has no where-based delete`);return n.deleteWhere(t,e,a)},async patchWhere(t,e,a){if(f(t,e.where,"patchMany({ where })"),n.patchWhere===void 0)throw new p("INTERNAL",`ctx.db.${t}.patchMany({ where }) is unavailable: this writer has no where-based patch`);return n.patchWhere(t,e,a)},aggregate(t,e){return M(t,[e.field],"aggregate"),f(t,e.where,"aggregate"),n.aggregate(t,e)},count(t,e){const a=e&&typeof e=="object"&&!Array.isArray(e)?e:void 0,r=a&&("where"in a||"baseWhere"in a||"restrictsCounts"in a)?a.where:e;return f(t,r,"count"),a&&f(t,a.baseWhere,"count"),n.count(t,e)},async findFirst(t,e){f(t,e?.where,"findFirst"),f(t,e?.baseWhere,"findFirst"),b(t,e?.orderBy,"findFirst");const a=await n.findFirst(t,e),r=o.get(t);return a&&r?u(a,r,s):a},async findFirstOrThrow(t,e){f(t,e?.where,"findFirstOrThrow"),f(t,e?.baseWhere,"findFirstOrThrow"),b(t,e?.orderBy,"findFirstOrThrow");const a=await n.findFirstOrThrow(t,e),r=o.get(t);return r?u(a,r,s):a},async findMany(t,e){f(t,e?.where,"findMany"),f(t,e?.baseWhere,"findMany"),b(t,e?.orderBy,"findMany");const a=await n.findMany(t,e),r=o.get(t);return r?N(a,r,s):a},async get(t,e){const{row:a,tableName:r}=await S(t,e),i=r===void 0?void 0:o.get(r);return!a||!i?a:u(a,i,s)},async lookupById(t,e){const a=await n.lookupById?.(t,e);if(!a)return null;const r=o.get(a.tableName);return{row:r?u(a.row,r,s):a.row,tableName:a.tableName}},groupBy(t,e){return M(t,[...e.by,e.agg?.field],"groupBy"),f(t,e.where,"groupBy"),n.groupBy(t,e)},query(t){const e=n.query(t),a=o.get(t);return a?y(e,a,t):e},async rank(t,e,a){return g(t,a,"rank"),d(t,e,"rank","rank"),n.rank(t,e,a)},async rankPage(t,e,a){g(t,a,"rankPage"),d(t,e,"rankPage","rank");const r=await n.rankPage(t,e,a),i=o.get(t);return i?N(r,i,s):r},...P("rankBefore",w,t=>(e,a,r)=>(g(e,r,"rankBefore"),d(e,a,"rankBefore","rank"),t(e,a,r))),...P("rankPageRows",h,t=>async(e,a,r)=>{g(e,r,"rankPageRows"),d(e,a,"rankPageRows","rank");const i=await t(e,a,r),c=o.get(e);return c?{...i,rows:i.rows.map(A=>({...A,doc:u(A.doc,c,s)}))}:i})},x=k;for(const t of o.keys())_(n[t])&&(x[t]=W(k,t));return k},G=(n,o={})=>{const s=new Map(Object.entries(n)),l=F(o.roles),w=async({ctx:d,next:y})=>{const S=d.auth??{},M=await S.getIdentity?.()??null,m=S.roles??[],f=new Set;for(const x of m)for(const t of l.get(x)??[])f.add(t);const b={auth:{can:x=>f.has(O(x)),identity:M,roles:m,userId:S.userId??null},ctx:d};if(o.bypass?.(b))return y();const I=E(d.db,s,b,o.indexFields),g={db:I},{orm:k}=d;return k!==null&&typeof k=="object"&&(g.orm=T(I)),y({ctx:g})},h=new Map;for(const[d,y]of s)h.set(d,new Set(Object.keys(y)));return R(w,{columns:h})};export{G as mask};

package/dist/packem_shared/optional-writer-override-CXXO30sZ.mjs

@@ -0,0 +1 @@
+const e=(t,o,c)=>o?{[t]:c(o)}:{};export{e as o};

package/dist/packem_shared/plugin-B5pDeN17.mjs

@@ -0,0 +1 @@
+import{LunoraError as i}from"@lunora/errors";import{l as z}from"./run-middleware-BeEEqmdE.mjs";import{isOrWrapsFromValidator as F,v as S}from"@lunora/values";const B=["de","en","es","fr","it","nl","none","pt"],O=["native","portable"],C=e=>O.includes(e),P=e=>B.includes(e),_="a an and are as at be but by for if in into is it no not of on or such that the their then there these they this to was will with",H="aber als am an auch auf aus bei bin bis bist da dass der den des dem die das denn dir du ein eine für hat ich im in ist mit nicht noch nur oder sich sie sind über und von vor war wie wir zu zum zur",K="a al como con de del el en es la las lo los mas no o para pero por que se su sus un una uno y ya",Q="au aux avec ce ces dans de des du elle en et eux il je la le les leur lui ma mais me même mes moi mon ne nos notre nous on ou par pas pour qu que qui sa se ses son sur ta te tes toi ton tu un une vos votre vous y",U="a ai al alla anche che chi ci coi col come con da dal degli dei del della di do e ed gli ha hai hanno i il in la le lo ma mi ne nei nel non o per più quale quanto se si sono su sul tra un una uno vi",W="aan al als bij dan dat de der deze die dit door een en er het hij ij in is je kan me men met mij na naar niet nog nu of om ons ook op over te tot uit van voor was wat we wij zij zijn zo",J="a ao aos as até com como da das de do dos e em entre era essa esse esta este eu foi há isso já mais mas me mesmo meu na nas no nos num numa o os ou para pela pelo por qual que quem se sem seu só sua também te tem um uma você",G=/[\u0300-\u036F]/gu,V=e=>e.normalize("NFD").replaceAll(G,"").normalize("NFC").toLowerCase(),g=e=>new Set(V(e).split(" "));g(H),g(_),g(K),g(Q),g(U),g(W),g(J);const q=16,X={many:(e,n)=>({field:n.field,kind:"many",references:n.references??"_id",table:e}),one:(e,n)=>({field:n.field,kind:"one",onDelete:n.onDelete,references:n.references??"_id",table:e})},w=(e,n,t)=>({handler:t,op:n,timing:e}),Y=()=>({afterDelete:e=>w("after","delete",e),afterInsert:e=>w("after","insert",e),afterUpdate:e=>w("after","update",e),beforeDelete:e=>w("before","delete",e),beforeInsert:e=>w("before","insert",e),beforeUpdate:e=>w("before","update",e)}),me=e=>{const n={...e};for(const[a,o]of Object.entries(n))if(F(o))throw new i("INTERNAL",`defineTable: column "${a}" uses v.from() which is args-only — table columns need a concrete v.* type`);const t=[],r=[],s=[],l=[],c={},d=[],m={},f=Y(),p=[];let $={kind:"root"},N=!1,j=!1,A,L,T,R;const u={aggregateIndex(a,o){const h=o?.op??"count";if(h!=="count"&&!o?.field)throw new i("INTERNAL",`aggregateIndex "${a}": op "${h}" requires a "field"`);return t.push({by:o?.by,field:o?.field,name:a,on:"",op:h,where:o?.where}),u},get aggregateIndexes(){return t},get externalSource(){return R},externallyManaged(){return N=!0,u},geoIndex(a,o){return r.push({field:o.field,name:a,precision:o.precision}),u},get geoIndexes(){return r},global(a){return $={backend:a?.backend??"d1",kind:"global"},u},get isExternallyManaged(){return N},get isPublic(){return j},index(a,o,h){return s.push({fields:o,name:a,unique:h?.unique??!1}),u},get indexes(){return s},ownedBy(a){return A=a,u},get ownerField(){return A},public(){return j=!0,u},rankIndex(a,o){if(!o.sortBy||o.sortBy.length===0)throw new i("INTERNAL",`rankIndex "${a}": "sortBy" is required and must list at least one key`);const h=o.sortBy.map(b=>({direction:b.direction??"asc",field:b.field}));return l.push({name:a,on:"",partitionBy:o.partitionBy,sortBy:h,where:o.where}),u},get rankIndexes(){return l},get relationMap(){return c},relations(a){return Object.assign(c,a(X)),u},searchIndex(a,o){if(o.filterFields&&o.filterFields.length>q)throw new i("INTERNAL",`searchIndex "${a}": at most ${String(q)} filterFields are supported (got ${String(o.filterFields.length)})`);const{language:h}=o;if(h!==void 0&&!P(h))throw new i("INTERNAL",`searchIndex "${a}": unknown language "${h}" (supported: ${B.join(", ")})`);const{strategy:b}=o;if(b!==void 0&&!C(b))throw new i("INTERNAL",`searchIndex "${a}": unknown strategy "${b}" (supported: ${O.join(", ")})`);return d.push({field:o.field,filterFields:o.filterFields,language:o.language,name:a,staged:o.staged,strategy:o.strategy}),u},get searchIndexes(){return d},shape:n,shardBy(a){return $={field:a,kind:"shardBy"},u},get shardMode(){return $},get softDeleteMode(){return L},source(a){if(!a.binding)throw new i("INTERNAL","source: `binding` is required (the wrangler Hyperdrive binding name)");if(!a.query)throw new i("INTERNAL","source: `query` is required (the tenant-membership SQL)");return R=a,N=!0,u},softDelete(a){const o=a?.field??"deletedAt";return L={field:o},o in n||(n[o]=S.optional(S.number().nullable())),u},get triggerMap(){return m},triggers(a){return Object.assign(m,a(f)),u},ttl(a,o){return T={after:o?.after,field:a},u},get ttlPolicy(){return T},get vectorIndexes(){return p},vectorize(a,o){return p.push({dimensions:o.dimensions,embed:o.embed,field:a,metadata:o.metadata,metric:o.metric,name:o.index}),u}};return u},fe=e=>({dimensions:e.dimensions,embed:e.embed,kind:"vectorIndex",metadata:e.metadata,metric:e.metric,select:e.source.select,table:e.source.table}),he=(e,n)=>{const t=n.op??"count";if(t!=="count"&&!n.field)throw new i("INTERNAL",`aggregateIndex "${e}": op "${t}" requires a "field"`);return{by:n.by,field:n.field,name:e,on:n.on,op:t,where:n.where}},ge=(e,n)=>{if(!n.sortBy||n.sortBy.length===0)throw new i("INTERNAL",`rankIndex "${e}": "sortBy" is required and must list at least one key`);const t=n.sortBy.map(r=>({direction:r.direction??"asc",field:r.field}));return{name:e,on:n.table,partitionBy:n.partitionBy,sortBy:t,where:n.where}},y=e=>({...e,extend(n){return y(D(e,n))},jurisdiction(n){return y(e)},rls(n){return y({...e,rlsMode:n})}}),Z=e=>{for(const[n,t]of Object.entries(e)){for(const r of t.aggregateIndexes)r.on===""&&(r.on=n);for(const r of t.rankIndexes)r.on===""&&(r.on=n)}},ee=(e,n,t)=>{for(const r of Object.values(n)){const s=e[r.on];if(!s)throw new i("INTERNAL",`defineAggregateIndex "${r.name}": unknown table "${r.on}"`);s.aggregateIndexes.push(r)}for(const r of Object.values(t)){const s=e[r.on];if(!s)throw new i("INTERNAL",`defineRankIndex "${r.name}": unknown table "${r.on}"`);s.rankIndexes.push(r)}},ne=e=>{if(e.cursor)return"cursor";if(e.reconcileEveryMs!==void 0)return"reconcileEveryMs";if(e.softDeleteColumn!==void 0)return"softDeleteColumn"},te=(e,n)=>{const t=n.mode==="incremental";if(n.mode!==void 0&&n.mode!=="full-pull"&&!t)throw new i("INTERNAL",`defineSchema: table "${e}" uses \`mode: ${JSON.stringify(n.mode)}\` — supported modes are "full-pull" (default) and "incremental".`);if(!t){const r=ne(n);if(r)throw new i("INTERNAL",`defineSchema: table "${e}" sets \`${r}\` but is not \`mode: "incremental"\` — that knob only applies to incremental ingest. Set \`mode: "incremental"\` or remove \`${r}\`.`);return}if(!n.cursor?.column||!n.cursor.query)throw new i("INTERNAL",`defineSchema: table "${e}" is \`mode: "incremental"\` but has no \`cursor\` — add \`cursor: { column: "updated_at", query: "… WHERE … > $N" }\` binding the watermark as the trailing parameter.`);if(n.reconcileEveryMs===void 0&&n.softDeleteColumn===void 0)throw new i("INTERNAL",`defineSchema: table "${e}" is \`mode: "incremental"\` with no delete-visibility path — an incremental pull never sees upstream deletes, so it would accumulate phantom rows. Add \`reconcileEveryMs\` (a periodic full-pull sweep) or \`softDeleteColumn\` (an upstream tombstone column).`)},re=e=>{for(const[n,t]of Object.entries(e)){const r=t.externalSource;if(r){if(t.shardMode.kind==="global")throw new i("INTERNAL",`defineSchema: table "${n}" cannot be both .source() and .global() — a sourced table materializes into a shard DO's SQLite, a global table lives in the external tier`);if(t.shardMode.kind==="shardBy"&&!r.tenantBy)throw new i("INTERNAL",`defineSchema: sourced + .shardBy() table "${n}" needs a \`tenantBy\` mapper — without it every tenant's DO would run the same unscoped query and replicate the whole multitenant table (a cross-tenant leak). Add \`tenantBy: (shardKey) => [shardKey]\` binding the shard key into the query's parameters.`);te(n,r)}}},oe=["_creationTime","_id"],ae=new Set(oe),x=(e,n,t,r)=>{if(!(ae.has(t)||t in r.shape))throw new i("INTERNAL",`defineSchema: table "${e}" index "${n}" names column "${t}" which is not in the table's shape`)},v=(e,n,t,r)=>{const s=new Set;for(const l of t){if(s.has(l.name))throw new i("INTERNAL",`defineSchema: table "${e}" declares ${n} "${l.name}" more than once`);s.add(l.name),r(l)}},M=e=>{for(const[n,t]of Object.entries(e))v(n,"index",t.indexes,r=>{for(const s of r.fields)x(n,r.name,s,t)}),v(n,"rank index",t.rankIndexes,r=>{for(const s of r.sortBy)x(n,r.name,s.field,t);for(const s of r.partitionBy??[])x(n,r.name,s,t)}),v(n,"geo index",t.geoIndexes,r=>{x(n,r.name,r.field,t)})},k=(e,n,t)=>{if(e.length===0)return;const r={};for(const s of e)r[n(s)]=t(s);return r},se=e=>{const n=new Set(e.sortBy.map(t=>t.field));for(const t of e.partitionBy??[])n.add(t);return[...n]},be=e=>{const n={};for(const[t,r]of Object.entries(e.tables)){const s=k(r.geoIndexes,d=>d.name,d=>[d.field]),l=k(r.indexes,d=>d.name,d=>d.fields),c=k(r.rankIndexes,d=>d.name,se);(s||l||c)&&(n[t]={...s?{geo:s}:{},...l?{index:l}:{},...c?{rank:c}:{}})}return n},we=(e,n={},t={},r={})=>(Z(e),ee(e,t,r),re(e),M(e),y({tables:e,vectorIndexes:n})),I=(e,n)=>`${e}_${n}`,E=(e,n,t)=>t.has(e)?I(n,e):e,ie=(e,n,t,r)=>{const s=I(n,r),l=f=>f===""?s:E(f,n,t),c={};for(const[f,p]of Object.entries(e.relationMap))c[f]={...p,table:E(p.table,n,t)};const d=e.aggregateIndexes.map(f=>({...f,on:l(f.on)})),m=e.rankIndexes.map(f=>({...f,on:l(f.on)}));return{...e,aggregateIndexes:d,rankIndexes:m,relationMap:c}},pe=(e,n)=>{if(!e)throw new i("INTERNAL","defineSchemaExtension: `key` is required and must be a non-empty string");return{key:e,tables:n.tables,...n.vectorIndexes?{vectorIndexes:n.vectorIndexes}:{}}},de=((e,n)=>{if(!e)throw new i("INTERNAL","definePlugin: `key` is required and must be a non-empty string");if(n.extension&&n.extension.key!==e)throw new i("INTERNAL",`definePlugin("${e}"): extension key "${n.extension.key}" does not match plugin key`);return{key:e,...n.extension?{extension:n.extension}:{},...n.middleware?{middleware:n.middleware}:{}}}),xe=(e,n)=>({...de(e,{...n.extension?{extension:n.extension}:{},...n.middleware?{middleware:n.middleware}:{}}),functions:n.functions??{}}),D=(e,n)=>{const{key:t}=n,r=new Set(Object.keys(n.tables)),s={...e.tables};for(const[c,d]of Object.entries(n.tables)){const m=I(t,c);if(Object.hasOwn(s,m))throw new i("INTERNAL",`defineSchema(...).extend("${t}"): table "${m}" already exists in the base schema — another extension with the same key already contributed it`);s[m]=ie(d,t,r,c)}const l={...e.vectorIndexes};if(n.vectorIndexes)for(const[c,d]of Object.entries(n.vectorIndexes)){const m=I(t,c);if(Object.hasOwn(l,m))throw new i("INTERNAL",`defineSchema(...).extend("${t}"): vector index "${m}" already exists in the base schema — another extension with the same key already contributed it`);l[m]={...d,table:E(d.table,t,r)}}return M(s),{rlsMode:e.rlsMode,tables:s,vectorIndexes:l}},ye=(e,n)=>{let t=e;for(const r of n)r.extension&&(t=D(t,r.extension));return t},Ie=e=>{const n=e.map(t=>t.middleware).filter(t=>t!==void 0);return(async({ctx:t,next:r})=>z(n,t,s=>r({ctx:s})))};export{he as H,fe as K,M as N,be as W,ge as X,we as Z,de as a,pe as b,Ie as c,xe as d,ye as i,D as m,me as q};

package/dist/packem_shared/rls-tRDkICWZ.mjs

@@ -0,0 +1 @@
+import{LunoraError as w}from"./LunoraError-LVhdU0Lo.mjs";import{bindOrm as F,bindTableFacade as U}from"./bindOrm-Bp9hsM2q.mjs";import{o as E}from"./optional-writer-override-CXXO30sZ.mjs";import{r as j}from"./policy-tag-Dprt9JWo.mjs";import{deny as $}from"./allowAll-BnyNbJZT.mjs";const T=500,k=(r,t,s)=>{const i=t??T;if(r>i)throw new w("BAD_REQUEST",`${s}: batch of ${String(r)} exceeds the limit of ${String(i)} (raise options.limit or chunk the call)`)},C=$(),L=Symbol.for("lunora.ctxdb.rls-unwrap"),q=r=>{const t=new Map;for(const s of r){const i=t.get(s.table)??[];i.push(s),t.set(s.table,i)}return t},z=(r,t)=>{const s=[];let i=!1;for(const u of r){if(u.on!=="read")continue;const c=u.when(t);if(c!==void 0){if(c===!0){i=!0;break}c!==!1&&s.push(c)}}if(!i)return s.length===0?C:s.length===1?s[0]:{OR:s}},I=r=>typeof r=="object"&&r!==null&&!Array.isArray(r),Q=["contains","eq","gt","gte","in","isNull","lt","lte","ne","notIn"],W=r=>{const t=typeof r;return t==="number"||t==="string"||t==="bigint"},G=(r,t)=>!("lt"in t&&(!W(r)||!W(t.lt)||r>=t.lt)||"lte"in t&&(!W(r)||!W(t.lte)||r>t.lte)||"gt"in t&&(!W(r)||!W(t.gt)||r<=t.gt)||"gte"in t&&(!W(r)||!W(t.gte)||r<t.gte)),H=(r,t)=>{if("in"in t){const s=t.in;if(!Array.isArray(s)||!s.includes(r))return!1}if("notIn"in t){const s=t.notIn;if(Array.isArray(s)&&s.includes(r))return!1}if("contains"in t){const s=t.contains;if(typeof r!="string"||typeof s!="string"||!r.includes(s))return!1}return!("isNull"in t&&t.isNull===!0!=(r==null))},J=(r,t)=>"eq"in t&&r!==t.eq||"ne"in t&&r===t.ne?!1:H(r,t)&&G(r,t),K=(r,t,s,i)=>t==="AND"?Array.isArray(s)&&s.every(u=>i(r,u)):t==="OR"?Array.isArray(s)&&s.some(u=>i(r,u)):!i(r,s??{}),P=r=>r==="AND"||r==="OR"||r==="NOT",V=r=>I(r)&&Object.keys(r).every(t=>Q.includes(t)),X=["every","is","isNot","none","some"],Y=r=>I(r)&&Object.keys(r).length>0&&Object.keys(r).every(t=>X.includes(t)),R=r=>Object.keys(r).some(t=>{const s=r[t];return P(t)?t==="NOT"?R(s??{}):Array.isArray(s)&&s.some(i=>R(i??{})):Y(s)}),v=(r,t)=>{for(const s of Object.keys(t)){const i=t[s];if(P(s)){if(!K(r,s,i,v))return!1;continue}const u=r[s];if(V(i)){if(!J(u,i))return!1;continue}if(u!==i)return!1}return!0},Z=(r,t,s)=>{const i=r.when({...t,row:s});if(i===void 0||i===!0)return!0;if(i===!1)return!1;if(R(i))throw new w("RELATION_PREDICATE_UNSUPPORTED","relation predicates are not supported in write policies; use a read policy or a flat column check");return v(s,i)},ee=(r,t,s)=>{const i=r.when(t);if(i===void 0||i===!0)return s===void 0||Z(r,t,s);if(i===!1)return!1;if(R(i))throw new w("RELATION_PREDICATE_UNSUPPORTED","relation predicates are not supported in write policies; use a read policy or a flat column check");return!t.row||!v(t.row,i)?!1:s===void 0||v(s,i)},M=(r,t,s,i)=>{let u=!1;for(const c of r)if(c.on===t&&(u=!0,!ee(c,s,i)))return!1;return u},S=r=>r??{},re=new Set(["baseWhere","relationBaseWhere","restrictsCounts","where"]),te=(r,t)=>t===void 0?!0:r==="restrictsCounts"?typeof t=="boolean":r==="relationBaseWhere"?typeof t=="function":I(t),ae=r=>{const t=Object.keys(r);return t.length===0?!1:t.every(s=>re.has(s)&&te(s,r[s]))},ne=r=>r===void 0?{}:I(r)&&ae(r)?r:{where:r},b=(r,t)=>!t||Object.keys(t).length===0?r:!r||Object.keys(r).length===0?t:{AND:[t,r]},se=r=>{if(typeof r!="object"||r===null||Array.isArray(r))return!1;const t=r;return typeof t.findMany=="function"&&typeof t.withSearchIndex=="function"},oe=(r,t,s,i)=>{const u=new Map,c=e=>{const a=u.get(e);if(a)return a;const n=s.get(e);if(!n||n.length===0||!n.some(l=>l.on==="read")){const l={baseWhere:void 0,restricts:!1};return u.set(e,l),l}const o={baseWhere:z(n,i),restricts:!0};return u.set(e,o),o},f=e=>c(e).restricts?t:r,y=e=>c(e).baseWhere,N=async(e,a)=>{if(t.lookupById){const h=await t.lookupById(e,a);return h?{row:h.row,tableName:s.has(h.tableName)?h.tableName:void 0}:{row:null,tableName:void 0}}const n=await t.get(e,a);if(!n)return{row:null,tableName:void 0};const o=a!==void 0&&s.has(a)?[a]:[],l=a===void 0?[...s.keys()]:o,d=await Promise.all(l.map(async h=>(await t.findFirst(h,{limit:1,where:{_id:e}}))?._id===e?h:void 0));return{row:n,tableName:d.find(h=>h!==void 0)}},B=async(e,a)=>{const n=await N(e,a);return n.row&&n.tableName!==void 0?{row:n.row,tableName:n.tableName}:void 0},p=async(e,a,n,o,l)=>{const d=await B(e,l);if(!d)return n(r);const h=s.get(d.tableName);if(h){const D=o?o(d.row):void 0;if(!M(h,a,{...i,row:d.row},D))throw new w("FORBIDDEN",`${a} denied by policy`)}return n(t)},m=(e,a)=>{const{baseWhere:n,restricts:o}=c(e);if(o)throw new w("COUNT_RLS_UNSUPPORTED",`${a}() is not supported on "${e}" inside an RLS-restricted context`);return n},_=r.rankBefore,O=r.rankPageRows,g={...r,async count(e,a){const{baseWhere:n,restricts:o}=c(e),l=ne(a);return f(e).count(e,{...l,baseWhere:b(l.baseWhere,n),relationBaseWhere:y,restrictsCounts:(l.restrictsCounts??!1)||o})},delete:(e,a,n)=>p(e,"delete",o=>o.delete(e,a,n),void 0,a),async deleteAll(e,a){const n=Math.max(1,a?.chunkSize??T),{baseWhere:o}=c(e);let l=0;for(;;){const d=(await f(e).findMany(e,{baseWhere:o,limit:n,relationBaseWhere:y})).page.map(h=>String(h._id));if(d.length===0)break;for(const h of d)await p(h,"delete",D=>D.delete(h,void 0,a?.hard===void 0?void 0:{hard:a.hard})),l+=1;if(d.length<n)break}return{deleted:l}},async deleteMany(e,a,n){k(e.length,a?.limit,"deleteMany");for(const o of e)await p(o,"delete",l=>l.delete(o,n),void 0,n);return{deleted:e.length}},async deleteWhere(e,a,n){const{baseWhere:o}=c(e),l=(await f(e).findMany(e,{baseWhere:b(a,o),relationBaseWhere:y})).page.map(d=>String(d._id));return k(l.length,n?.limit,"deleteWhere"),g.deleteMany(l,n)},async findFirst(e,a){const{baseWhere:n}=c(e);return f(e).findFirst(e,{...S(a),baseWhere:b(a?.baseWhere,n),relationBaseWhere:y})},async findFirstOrThrow(e,a){const{baseWhere:n}=c(e);return f(e).findFirstOrThrow(e,{...S(a),baseWhere:b(a?.baseWhere,n),relationBaseWhere:y})},async findMany(e,a){const{baseWhere:n}=c(e);return f(e).findMany(e,{...S(a),baseWhere:b(a?.baseWhere,n),relationBaseWhere:y})},async get(e,a){const n=await N(e,a);if(!n.row)return null;if(n.tableName===void 0)return r.get(e,a);const{baseWhere:o,restricts:l}=c(n.tableName);if(!l)return r.get(e,a);if(!o)return n.row;const d=await t.findFirst(n.tableName,{baseWhere:o,limit:1,where:{_id:e}});return d?._id===e?d:null},async lookupById(e,a){const n=await N(e,a);if(!n.row)return null;if(n.tableName===void 0||!c(n.tableName).restricts)return await r.lookupById?.(e,a)??null;const{baseWhere:o}=c(n.tableName);if(!o)return{row:n.row,tableName:n.tableName};const l=await t.findFirst(n.tableName,{baseWhere:o,limit:1,where:{_id:e}});return l?._id===e?{row:l,tableName:n.tableName}:null},async insert(e,a){const n=s.get(e);if(n){if(!M(n,"insert",{...i,row:a}))throw new w("FORBIDDEN",`insert on "${e}" denied by policy`);return t.insert(e,a)}return r.insert(e,a)},async insertMany(e,a,n){k(a.length,n?.limit,"insertMany");const o=s.get(e);if(o){for(const l of a)if(!M(o,"insert",{...i,row:l}))throw new w("FORBIDDEN",`insert on "${e}" denied by policy`);return t.insertMany(e,a,n)}return r.insertMany(e,a,n)},async insertManyUnsafe(e,a,n){k(a.length,n?.limit,"insertManyUnsafe");const o=s.get(e);if(o){for(const l of a)if(!M(o,"insert",{...i,row:l}))throw new w("FORBIDDEN",`insert on "${e}" denied by policy`);return t.insertManyUnsafe(e,a,n)}return r.insertManyUnsafe(e,a,n)},patch:(e,a,n)=>p(e,"update",o=>o.patch(e,a,n),o=>({...o,...a}),n),async patchMany(e,a,n){k(e.length,a?.limit,"patchMany");for(const o of e)await p(o.id,"update",l=>l.patch(o.id,o.patch,n),l=>({...l,...o.patch}),n);return{patched:e.length}},async patchWhere(e,a,n){const{baseWhere:o}=c(e),l=(await f(e).findMany(e,{baseWhere:b(a.where,o),relationBaseWhere:y})).page.map(d=>({id:String(d._id),patch:a.patch}));return k(l.length,n?.limit,"patchWhere"),g.patchMany(l,n)},query(e){const{baseWhere:a}=c(e),n=f(e).query(e);return a?n.filter(o=>v(o,a)):n},restore:(e,a)=>p(e,"update",async n=>{const o=n.restore??t.restore;if(!o)throw new w("BAD_REQUEST","restore is not supported by this writer");await o(e,a)},void 0,a),replace:(e,a,n)=>p(e,"update",o=>o.replace(e,a,n),o=>({...a,_creationTime:a._creationTime??o._creationTime,_id:o._id}),n),aggregate(e,a){const{baseWhere:n}=c(e);return f(e).aggregate(e,{...a,baseWhere:b(a.baseWhere,n),relationBaseWhere:y})},groupBy(e,a){const{baseWhere:n}=c(e);return f(e).groupBy(e,{...a,baseWhere:b(a.baseWhere,n),relationBaseWhere:y})},rank(e,a,n){const o=m(e,"rank");return f(e).rank(e,a,{...n,baseWhere:b(n.baseWhere,o)})},rankPage(e,a,n){const o=m(e,"rankPage");return f(e).rankPage(e,a,{...n,baseWhere:b(n?.baseWhere,o)})},wipeShard(){throw new w("FORBIDDEN","ctx.db.wipeShard() is unavailable under rls(): a whole-shard erase can't be policy-gated per row, and erasing only policy-visible rows would silently leave data behind. Run it from an internalMutation, or use ctx.db.deleteAll(table) per table.",{status:403})},...E("rankBefore",_,e=>(a,n,o)=>(m(a,"rankBefore"),(f(a).rankBefore??e)(a,n,o))),...E("rankPageRows",O,e=>(a,n,o)=>{const l=m(a,"rankPageRows");return(f(a).rankPageRows??e)(a,n,{...o,baseWhere:b(o?.baseWhere,l)})})},A=g;for(const e of s.keys())se(r[e])&&(A[e]=U(g,e));return g},x=r=>typeof r=="string"?r:r.name,ie=r=>{const t=new Map;for(const s of r??[])t.set(s.name,new Set((s.permissions??[]).map(i=>x(i))));return t},he=(r,t={})=>{const s=q(r),i=ie(t.roles);return j(async({ctx:u,next:c})=>{const f=u.auth??{},y=await f.getIdentity?.()??null,N=f.roles??[],B=new Set;for(const e of N)for(const a of i.get(e)??[])B.add(a);const p={auth:{can:e=>B.has(x(e)),identity:y,roles:N,userId:f.userId??null},ctx:u},m=u.db,_=m[L]??m,O=oe(m,_,s,p),g={db:O},{orm:A}=u;return A!==null&&typeof A=="object"&&(g.orm=F(O)),c({ctx:g})},{policies:r,roles:t.roles??[]})};export{z as computeReadBaseWhere,M as evaluateWrite,ie as indexRolePermissions,v as matchesWhere,x as permissionName,he as rls};

package/dist/rls/testing.mjs

@@ -1 +1 @@
-import{indexRolePermissions as y,computeReadBaseWhere as I,matchesWhere as P,evaluateWrite as W,permissionName as g}from"../packem_shared/rls-_iVsPvhX.mjs";const w=(f,i={})=>{const m=y(i.roles),h=i.ctx??{};return{as:p=>{const s=p??{},c=s.roles??[],u=new Set;for(const e of c)for(const t of m.get(e)??[])u.add(t);const l={auth:{can:e=>u.has(g(e)),identity:s.identity??null,roles:c,userId:s.userId??null},ctx:h},d=(e,t,r,a)=>{const n=f.filter(o=>o.table===t);if(n.length===0)return!0;if(e==="read"){if(!n.some(x=>x.on==="read"))return!0;const o=I(n,l);return o===void 0||P(r??{},o)}return W(n,e,{...l,row:r},a)};return{can:d,cannot:(e,t,r,a)=>!d(e,t,r,a)}}}};export{w as expectPolicy};
+import{indexRolePermissions as y,computeReadBaseWhere as P,matchesWhere as W,evaluateWrite as g,permissionName as v}from"../packem_shared/rls-tRDkICWZ.mjs";const I=(f,i={})=>{const m=y(i.roles),h=i.ctx??{};return{as:p=>{const s=p??{},c=s.roles??[],u=new Set;for(const e of c)for(const t of m.get(e)??[])u.add(t);const l={auth:{can:e=>u.has(v(e)),identity:s.identity??null,roles:c,userId:s.userId??null},ctx:h},d=(e,t,r,a)=>{const n=f.filter(o=>o.table===t);if(n.length===0)return!0;if(e==="read"){if(!n.some(x=>x.on==="read"))return!0;const o=P(n,l);return o===void 0||W(r??{},o)}return g(n,e,{...l,row:r},a)};return{can:d,cannot:(e,t,r,a)=>!d(e,t,r,a)}}}};export{I as expectPolicy};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.56",
+  "version": "1.0.0-alpha.57",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -66,9 +66,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.10",
-    "@lunora/scheduler": "1.0.0-alpha.16",
-    "@lunora/values": "1.0.0-alpha.13",
+    "@lunora/errors": "1.0.0-alpha.12",
+    "@lunora/scheduler": "1.0.0-alpha.18",
+    "@lunora/values": "1.0.0-alpha.15",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.32"
   },

package/dist/packem_shared/PRESENCE_DEFAULT_TTL_MS-C9RX3Cl6.mjs

@@ -1 +0,0 @@
-import{v as o}from"@lunora/values";import{initLunora as E}from"./initLunora-QNqOuG0A.mjs";import{LunoraError as p}from"./LunoraError-LVhdU0Lo.mjs";import{onDisconnect as q}from"./onConnect-CEtRmUpJ.mjs";import{defineSchemaExtension as v,defineComponent as R}from"./composePluginMiddleware-COr09CXA.mjs";import{defineTable as _}from"./defineAggregateIndex-_gWNmkQZ.mjs";const D=3e4,y=4096,l="presence",h="present",c=`${l}_${h}`,M=v(l,{tables:{[h]:_({data:o.optional(o.record(o.string(),o.any())),lastSeen:o.number(),roomId:o.string(),sessionId:o.string(),userId:o.optional(o.string())}).index("byRoomSession",["roomId","sessionId"]).index("byRoom",["roomId"])}}),{mutation:b,query:T}=E.dataModel().create(),F=(u={})=>{const m=u.ttlMs??D,f=Math.max(0,Math.min(u.disconnectGraceMs??0,m)),w=b.input({data:o.optional(o.record(o.string(),o.any())),roomId:o.string(),sessionId:o.string()}).mutation(async({args:t,ctx:s})=>{const r=Date.now(),i=s.auth.userId??void 0;if(t.data!==void 0&&new TextEncoder().encode(JSON.stringify(t.data)).length>y)throw new p("BAD_REQUEST",`presence data exceeds the ${String(y)}-byte limit`);const e=await s.db.query(c).withIndex("byRoomSession",n=>n.eq("roomId",t.roomId).eq("sessionId",t.sessionId)).first();if(e&&(e.userId??void 0)!==i)throw new p("FORBIDDEN","presence heartbeat denied: this (roomId, sessionId) is held by another identity");const a={lastSeen:r,roomId:t.roomId,sessionId:t.sessionId,...t.data===void 0?{}:{data:t.data},...i===void 0?{}:{userId:i}};return await(e?s.db.patch(e._id,a):s.db.insert(c,a)),{lastSeen:r}}),S=T.input({roomId:o.string()}).query(async({args:t,ctx:s})=>{const r=Date.now()-m,i=(await s.db.query(c).withIndex("byRoom",n=>n.eq("roomId",t.roomId)).collect()).filter(n=>n.lastSeen>r).toSorted((n,d)=>d.lastSeen-n.lastSeen),e=new Set,a=[];for(const n of i){const d=n.userId;if(d!==void 0){if(e.has(d))continue;e.add(d)}const I={lastSeen:n.lastSeen,roomId:n.roomId};d!==void 0&&(I.userId=d),n.data!==void 0&&(I.data=n.data),a.push(I)}return a}),g={...b.input({roomId:o.string()}).mutation(async({args:t,ctx:s})=>{const r=Date.now()-m,i=await s.db.query(c).withIndex("byRoom",e=>e.eq("roomId",t.roomId)).filter(e=>e.lastSeen<=r).collect();return await Promise.all(i.map(e=>s.db.delete(e._id))),{deleted:i.length}}),visibility:"internal"},x=q(async(t,s)=>{const r=s.context?.roomId,i=s.context?.sessionId;if(typeof r!="string"||typeof i!="string")return;const e=await t.db.query(c).withIndex("byRoomSession",d=>d.eq("roomId",r).eq("sessionId",i)).first();if(!e)return;const a=s.userId??void 0;if((e.userId??void 0)!==a)return;if(f===0){await t.db.delete(e._id);return}const n=Math.min(e.lastSeen,Date.now()+f-m);await t.db.patch(e._id,{lastSeen:n})});return R(l,{extension:M,functions:{disconnect:x,heartbeat:w,listPresent:S,sweep:g}})};export{D as PRESENCE_DEFAULT_TTL_MS,c as PRESENCE_TABLE,F as definePresence,M as presenceExtension};

package/dist/packem_shared/composePluginMiddleware-COr09CXA.mjs

@@ -1 +0,0 @@
-import{LunoraError as x}from"@lunora/errors";import{l as h}from"./run-middleware-BeEEqmdE.mjs";const l=(n,e)=>`${n}_${e}`,m=(n,e,t)=>t.has(n)?l(e,n):n,b=(n,e,t,s)=>{const i=l(e,s),d=o=>o===""?i:m(o,e,t),a={};for(const[o,f]of Object.entries(n.relationMap))a[o]={...f,table:m(f.table,e,t)};const c=n.aggregateIndexes.map(o=>({...o,on:d(o.on)})),r=n.rankIndexes.map(o=>({...o,on:d(o.on)}));return{...n,aggregateIndexes:c,rankIndexes:r,relationMap:a}},g=(n,e)=>{if(!n)throw new x("INTERNAL","defineSchemaExtension: `key` is required and must be a non-empty string");return{key:n,tables:e.tables,...e.vectorIndexes?{vectorIndexes:e.vectorIndexes}:{}}},u=((n,e)=>{if(!n)throw new x("INTERNAL","definePlugin: `key` is required and must be a non-empty string");if(e.extension&&e.extension.key!==n)throw new x("INTERNAL",`definePlugin("${n}"): extension key "${e.extension.key}" does not match plugin key`);return{key:n,...e.extension?{extension:e.extension}:{},...e.middleware?{middleware:e.middleware}:{}}}),k=(n,e)=>({...u(n,{...e.extension?{extension:e.extension}:{},...e.middleware?{middleware:e.middleware}:{}}),functions:e.functions??{}}),w=(n,e)=>{const{key:t}=e,s=new Set(Object.keys(e.tables)),i={...n.tables};for(const[a,c]of Object.entries(e.tables)){const r=l(t,a);if(Object.hasOwn(i,r))throw new x("INTERNAL",`defineSchema(...).extend("${t}"): table "${r}" already exists in the base schema — another extension with the same key already contributed it`);i[r]=b(c,t,s,a)}const d={...n.vectorIndexes};if(e.vectorIndexes)for(const[a,c]of Object.entries(e.vectorIndexes)){const r=l(t,a);if(Object.hasOwn(d,r))throw new x("INTERNAL",`defineSchema(...).extend("${t}"): vector index "${r}" already exists in the base schema — another extension with the same key already contributed it`);d[r]={...c,table:m(c.table,t,s)}}return{rlsMode:n.rlsMode,tables:i,vectorIndexes:d}},p=(n,e)=>{let t=n;for(const s of e)s.extension&&(t=w(t,s.extension));return t},E=n=>{const e=n.map(t=>t.middleware).filter(t=>t!==void 0);return(async({ctx:t,next:s})=>h(e,t,i=>s({ctx:i})))};export{E as composePluginMiddleware,k as defineComponent,u as definePlugin,g as defineSchemaExtension,p as installPlugins,w as mergeSchemaExtension};

package/dist/packem_shared/defineAggregateIndex-_gWNmkQZ.mjs

@@ -1 +0,0 @@
-import{LunoraError as i}from"@lunora/errors";import{isOrWrapsFromValidator as B,v as E}from"@lunora/values";import{mergeSchemaExtension as R}from"./composePluginMiddleware-COr09CXA.mjs";const A=["de","en","es","fr","it","nl","none","pt"],L=["native","portable"],T=e=>L.includes(e),S=e=>A.includes(e),D="a an and are as at be but by for if in into is it no not of on or such that the their then there these they this to was will with",M="aber als am an auch auf aus bei bin bis bist da dass der den des dem die das denn dir du ein eine für hat ich im in ist mit nicht noch nur oder sich sie sind über und von vor war wie wir zu zum zur",z="a al como con de del el en es la las lo los mas no o para pero por que se su sus un una uno y ya",F="au aux avec ce ces dans de des du elle en et eux il je la le les leur lui ma mais me même mes moi mon ne nos notre nous on ou par pas pour qu que qui sa se ses son sur ta te tes toi ton tu un une vos votre vous y",O="a ai al alla anche che chi ci coi col come con da dal degli dei del della di do e ed gli ha hai hanno i il in la le lo ma mi ne nei nel non o per più quale quanto se si sono su sul tra un una uno vi",C="aan al als bij dan dat de der deze die dit door een en er het hij ij in is je kan me men met mij na naar niet nog nu of om ons ook op over te tot uit van voor was wat we wij zij zijn zo",_="a ao aos as até com como da das de do dos e em entre era essa esse esta este eu foi há isso já mais mas me mesmo meu na nas no nos num numa o os ou para pela pelo por qual que quem se sem seu só sua também te tem um uma você",H=/[\u0300-\u036F]/gu,K=e=>e.normalize("NFD").replaceAll(H,"").normalize("NFC").toLowerCase(),u=e=>new Set(K(e).split(" "));u(M),u(D),u(z),u(F),u(O),u(C),u(_);const q=16,P={many:(e,n)=>({field:n.field,kind:"many",references:n.references??"_id",table:e}),one:(e,n)=>({field:n.field,kind:"one",onDelete:n.onDelete,references:n.references??"_id",table:e})},m=(e,n,o)=>({handler:o,op:n,timing:e}),Q=()=>({afterDelete:e=>m("after","delete",e),afterInsert:e=>m("after","insert",e),afterUpdate:e=>m("after","update",e),beforeDelete:e=>m("before","delete",e),beforeInsert:e=>m("before","insert",e),beforeUpdate:e=>m("before","update",e)}),ee=e=>{const n={...e};for(const[r,t]of Object.entries(n))if(B(t))throw new i("INTERNAL",`defineTable: column "${r}" uses v.from() which is args-only — table columns need a concrete v.* type`);const o=[],a=[],l=[],p=[],b={},w=[],y={},j=Q(),I=[];let h={kind:"root"},g=!1,x=!1,v,N,$,k;const s={aggregateIndex(r,t){const d=t?.op??"count";if(d!=="count"&&!t?.field)throw new i("INTERNAL",`aggregateIndex "${r}": op "${d}" requires a "field"`);return o.push({by:t?.by,field:t?.field,name:r,on:"",op:d,where:t?.where}),s},get aggregateIndexes(){return o},get externalSource(){return k},externallyManaged(){return g=!0,s},geoIndex(r,t){return a.push({field:t.field,name:r,precision:t.precision}),s},get geoIndexes(){return a},global(r){return h={backend:r?.backend??"d1",kind:"global"},s},get isExternallyManaged(){return g},get isPublic(){return x},index(r,t,d){return l.push({fields:t,name:r,unique:d?.unique??!1}),s},get indexes(){return l},ownedBy(r){return v=r,s},get ownerField(){return v},public(){return x=!0,s},rankIndex(r,t){if(!t.sortBy||t.sortBy.length===0)throw new i("INTERNAL",`rankIndex "${r}": "sortBy" is required and must list at least one key`);const d=t.sortBy.map(c=>({direction:c.direction??"asc",field:c.field}));return p.push({name:r,on:"",partitionBy:t.partitionBy,sortBy:d,where:t.where}),s},get rankIndexes(){return p},get relationMap(){return b},relations(r){return Object.assign(b,r(P)),s},searchIndex(r,t){if(t.filterFields&&t.filterFields.length>q)throw new i("INTERNAL",`searchIndex "${r}": at most ${String(q)} filterFields are supported (got ${String(t.filterFields.length)})`);const{language:d}=t;if(d!==void 0&&!S(d))throw new i("INTERNAL",`searchIndex "${r}": unknown language "${d}" (supported: ${A.join(", ")})`);const{strategy:c}=t;if(c!==void 0&&!T(c))throw new i("INTERNAL",`searchIndex "${r}": unknown strategy "${c}" (supported: ${L.join(", ")})`);return w.push({field:t.field,filterFields:t.filterFields,language:t.language,name:r,staged:t.staged,strategy:t.strategy}),s},get searchIndexes(){return w},shape:n,shardBy(r){return h={field:r,kind:"shardBy"},s},get shardMode(){return h},get softDeleteMode(){return N},source(r){if(!r.binding)throw new i("INTERNAL","source: `binding` is required (the wrangler Hyperdrive binding name)");if(!r.query)throw new i("INTERNAL","source: `query` is required (the tenant-membership SQL)");return k=r,g=!0,s},softDelete(r){const t=r?.field??"deletedAt";return N={field:t},t in n||(n[t]=E.optional(E.number().nullable())),s},get triggerMap(){return y},triggers(r){return Object.assign(y,r(j)),s},ttl(r,t){return $={after:t?.after,field:r},s},get ttlPolicy(){return $},get vectorIndexes(){return I},vectorize(r,t){return I.push({dimensions:t.dimensions,embed:t.embed,field:r,metadata:t.metadata,metric:t.metric,name:t.index}),s}};return s},ne=e=>({dimensions:e.dimensions,embed:e.embed,kind:"vectorIndex",metadata:e.metadata,metric:e.metric,select:e.source.select,table:e.source.table}),te=(e,n)=>{const o=n.op??"count";if(o!=="count"&&!n.field)throw new i("INTERNAL",`aggregateIndex "${e}": op "${o}" requires a "field"`);return{by:n.by,field:n.field,name:e,on:n.on,op:o,where:n.where}},re=(e,n)=>{if(!n.sortBy||n.sortBy.length===0)throw new i("INTERNAL",`rankIndex "${e}": "sortBy" is required and must list at least one key`);const o=n.sortBy.map(a=>({direction:a.direction??"asc",field:a.field}));return{name:e,on:n.table,partitionBy:n.partitionBy,sortBy:o,where:n.where}},f=e=>({...e,extend(n){return f(R(e,n))},jurisdiction(n){return f(e)},rls(n){return f({...e,rlsMode:n})}}),U=e=>{for(const[n,o]of Object.entries(e)){for(const a of o.aggregateIndexes)a.on===""&&(a.on=n);for(const a of o.rankIndexes)a.on===""&&(a.on=n)}},V=(e,n,o)=>{for(const a of Object.values(n)){const l=e[a.on];if(!l)throw new i("INTERNAL",`defineAggregateIndex "${a.name}": unknown table "${a.on}"`);l.aggregateIndexes.push(a)}for(const a of Object.values(o)){const l=e[a.on];if(!l)throw new i("INTERNAL",`defineRankIndex "${a.name}": unknown table "${a.on}"`);l.rankIndexes.push(a)}},W=e=>{if(e.cursor)return"cursor";if(e.reconcileEveryMs!==void 0)return"reconcileEveryMs";if(e.softDeleteColumn!==void 0)return"softDeleteColumn"},G=(e,n)=>{const o=n.mode==="incremental";if(n.mode!==void 0&&n.mode!=="full-pull"&&!o)throw new i("INTERNAL",`defineSchema: table "${e}" uses \`mode: ${JSON.stringify(n.mode)}\` — supported modes are "full-pull" (default) and "incremental".`);if(!o){const a=W(n);if(a)throw new i("INTERNAL",`defineSchema: table "${e}" sets \`${a}\` but is not \`mode: "incremental"\` — that knob only applies to incremental ingest. Set \`mode: "incremental"\` or remove \`${a}\`.`);return}if(!n.cursor?.column||!n.cursor.query)throw new i("INTERNAL",`defineSchema: table "${e}" is \`mode: "incremental"\` but has no \`cursor\` — add \`cursor: { column: "updated_at", query: "… WHERE … > $N" }\` binding the watermark as the trailing parameter.`);if(n.reconcileEveryMs===void 0&&n.softDeleteColumn===void 0)throw new i("INTERNAL",`defineSchema: table "${e}" is \`mode: "incremental"\` with no delete-visibility path — an incremental pull never sees upstream deletes, so it would accumulate phantom rows. Add \`reconcileEveryMs\` (a periodic full-pull sweep) or \`softDeleteColumn\` (an upstream tombstone column).`)},J=e=>{for(const[n,o]of Object.entries(e)){const a=o.externalSource;if(a){if(o.shardMode.kind==="global")throw new i("INTERNAL",`defineSchema: table "${n}" cannot be both .source() and .global() — a sourced table materializes into a shard DO's SQLite, a global table lives in the external tier`);if(o.shardMode.kind==="shardBy"&&!a.tenantBy)throw new i("INTERNAL",`defineSchema: sourced + .shardBy() table "${n}" needs a \`tenantBy\` mapper — without it every tenant's DO would run the same unscoped query and replicate the whole multitenant table (a cross-tenant leak). Add \`tenantBy: (shardKey) => [shardKey]\` binding the shard key into the query's parameters.`);G(n,a)}}},ae=(e,n={},o={},a={})=>(U(e),V(e,o,a),J(e),f({tables:e,vectorIndexes:n}));export{te as defineAggregateIndex,re as defineRankIndex,ae as defineSchema,ee as defineTable,ne as defineVectorIndex};

package/dist/packem_shared/initLunora-QNqOuG0A.mjs

@@ -1 +0,0 @@
-import{s as c}from"./functions-CDC08CWY.mjs";import{l as p}from"./policy-tag-Dprt9JWo.mjs";import{l as x}from"./run-middleware-BeEEqmdE.mjs";const w=(t,e)=>e===void 0||typeof t!="object"||t===null?t:Object.assign(Object.create(Object.getPrototypeOf(t)),t,{meta:e}),g=(t,e)=>x(t,e,r=>r),y=(t,e,r,a,i)=>async(o,m)=>{const n=c(t,m),d=await g(e,w(o,i)),l=await r({args:n,ctx:d});return a?a.parse(l):l},f=(t,e,r)=>(a,i,o)=>{const m=c(t,i);return(async function*(){const n=await g(e,a),d=r({args:m,ctx:n,signal:o})[Symbol.asyncIterator]();try{for(;;){if(o.aborted)return;const l=await d.next();if(l.done||o.aborted)return;yield l.value}}finally{await d.return?.()}})()},u=t=>{const e=[];for(const r of t){const a=p(r);a&&e.push(a)}return e.length>0?{tags:e}:void 0},s=(t,e,r)=>({__lunoraProcedure:t,...r?{__lunoraVisibility:r}:{},input:a=>s(t,{...e,args:{...e.args,...a}},r),[t]:a=>{const i=u(e.middlewares);return{args:e.args,...e.expose?{expose:e.expose}:{},handler:y(e.args,e.middlewares,a,e.output,e.meta),kind:t,...e.meta?{meta:e.meta}:{},...i?{rls:i}:{},...r?{visibility:r}:{},...e.x402?{x402:e.x402}:{}}},meta:a=>s(t,{...e,meta:{...e.meta,...a}},r),output:a=>s(t,{...e,output:a},r),...t==="query"?{stream:a=>{const i=u(e.middlewares);return{args:e.args,...e.expose?{expose:e.expose}:{},handler:f(e.args,e.middlewares,a),kind:"stream",...i?{rls:i}:{},...r?{visibility:r}:{},...e.x402?{x402:e.x402}:{}}}}:{},use:a=>s(t,{...e,middlewares:[...e.middlewares,a]},r),...r?{}:{expose:a=>s(t,{...e,expose:a},r)},...r?{}:{x402:a=>s(t,{...e,x402:a},r)}}),j={dataModel:()=>({create:t=>({action:s("action",{args:{},middlewares:[]}),internalAction:s("action",{args:{},middlewares:[]},"internal"),internalMutation:s("mutation",{args:{},middlewares:[]},"internal"),internalQuery:s("query",{args:{},middlewares:[]},"internal"),mutation:s("mutation",{args:{},middlewares:[]}),query:s("query",{args:{},middlewares:[]})})})};export{j as initLunora};

package/dist/packem_shared/mask-C6Bi78qj.mjs

@@ -1 +0,0 @@
-import{LunoraError as g}from"./LunoraError-LVhdU0Lo.mjs";import{bindOrm as N,bindTableFacade as x}from"./bindOrm-Bp9hsM2q.mjs";const S=a=>typeof a=="string"?a:a.name,I=a=>{const i=new Map;for(const s of a??[])i.set(s.name,new Set((s.permissions??[]).map(c=>S(c))));return i},M=a=>{let i=2166136261;for(let s=0;s<a.length;s+=1)i^=a.codePointAt(s)??0,i=Math.imul(i,16777619);return(i>>>0).toString(16).padStart(8,"0")},O=(a,i,s)=>{try{return a==="redact"?null:a==="hash"?i==null?i:M(typeof i=="string"?i:JSON.stringify(i)):a(i,s)}catch{return null}},h=(a,i,s)=>{const c={...a};for(const[f,w]of Object.entries(i))f in c&&(c[f]=O(w,a[f],{...s,column:f,row:a}));return c},m=(a,i,s)=>({...a,page:a.page.map(c=>h(c,i,s))}),A=(a,i,s,c)=>{if(typeof a!="function")return;const f=new Set,w=()=>new Proxy({},{get:()=>y=>(typeof y=="string"&&f.add(y),w())});a(w());for(const y of f)if(y in i)throw new g("MASK_UNSUPPORTED",`${c}() filtering "${s}" by masked column "${y}" is not supported`)},k=a=>{if(typeof a!="object"||a===null||Array.isArray(a))return!1;const i=a;return typeof i.findMany=="function"&&typeof i.withSearchIndex=="function"},v=(a,i,s)=>{const c=(t,r,n)=>({collect:async()=>(await t.collect()).map(e=>h(e,r,s)),filter:e=>c(t.filter(o=>e(h(o,r,s))),r,n),first:async()=>{const e=await t.first();return e?h(e,r,s):null},order:e=>c(t.order(e),r,n),paginate:async e=>m(await t.paginate(e),r,s),take:async e=>(await t.take(e)).map(o=>h(o,r,s)),unique:async()=>{const e=await t.unique();return e?h(e,r,s):null},withIndex:(e,o)=>(A(o,r,n,"withIndex"),c(t.withIndex(e,o),r,n)),withSearchIndex:(e,o)=>(A(o,r,n,"withSearchIndex"),c(t.withSearchIndex(e,o),r,n)),withGeoIndex:(e,o)=>c(t.withGeoIndex(e,o),r,n)}),f=async(t,r)=>{if(a.lookupById){const d=await a.lookupById(t,r);return d?{row:d.row,tableName:i.has(d.tableName)?d.tableName:void 0}:{row:null,tableName:void 0}}const n=await a.get(t,r);if(!n)return{row:null,tableName:void 0};let e;r===void 0?e=[...i.keys()]:i.has(r)?e=[r]:e=[];const o=await Promise.all(e.map(async d=>(await a.findFirst(d,{limit:1,where:{_id:t}}))?._id===t?d:void 0));return{row:n,tableName:o.find(d=>d!==void 0)}},w=(t,r,n)=>{const e=i.get(t);if(!e)return;const o=r.find(d=>typeof d=="string"&&d in e);if(o!==void 0)throw new g("MASK_UNSUPPORTED",`${n}() over masked column "${o}" on "${t}" is not supported`)},y=(t,r)=>{if(!(!t||typeof t!="object"||Array.isArray(t)))for(const[n,e]of Object.entries(t))if(n==="AND"||n==="OR"){if(Array.isArray(e))for(const o of e)y(o,r)}else n==="NOT"?y(e,r):n.startsWith("__")||r.add(n)},u=(t,r,n)=>{const e=i.get(t);if(!e||r===void 0)return;const o=new Set;y(r,o);for(const d of o)if(d in e)throw new g("MASK_UNSUPPORTED",`${n}() filtering "${t}" by masked column "${d}" is not supported`)},l=(t,r,n)=>{const e=i.get(t);if(!(!e||!Array.isArray(r))){for(const o of r)if(o&&typeof o=="object"&&!Array.isArray(o)){for(const d of Object.keys(o))if(d in e)throw new g("MASK_UNSUPPORTED",`${n}() ordering "${t}" by masked column "${d}" is not supported`)}}},p={...a,async deleteWhere(t,r,n){if(u(t,r,"deleteMany({ where })"),a.deleteWhere===void 0)throw new g("INTERNAL",`ctx.db.${t}.deleteMany({ where }) is unavailable: this writer has no where-based delete`);return a.deleteWhere(t,r,n)},async patchWhere(t,r,n){if(u(t,r.where,"patchMany({ where })"),a.patchWhere===void 0)throw new g("INTERNAL",`ctx.db.${t}.patchMany({ where }) is unavailable: this writer has no where-based patch`);return a.patchWhere(t,r,n)},aggregate(t,r){return w(t,[r.field],"aggregate"),u(t,r.where,"aggregate"),a.aggregate(t,r)},count(t,r){const n=r&&typeof r=="object"&&!Array.isArray(r)?r:void 0,e=n&&("where"in n||"baseWhere"in n||"restrictsCounts"in n)?n.where:r;return u(t,e,"count"),n&&u(t,n.baseWhere,"count"),a.count(t,r)},async findFirst(t,r){u(t,r?.where,"findFirst"),u(t,r?.baseWhere,"findFirst"),l(t,r?.orderBy,"findFirst");const n=await a.findFirst(t,r),e=i.get(t);return n&&e?h(n,e,s):n},async findFirstOrThrow(t,r){u(t,r?.where,"findFirstOrThrow"),u(t,r?.baseWhere,"findFirstOrThrow"),l(t,r?.orderBy,"findFirstOrThrow");const n=await a.findFirstOrThrow(t,r),e=i.get(t);return e?h(n,e,s):n},async findMany(t,r){u(t,r?.where,"findMany"),u(t,r?.baseWhere,"findMany"),l(t,r?.orderBy,"findMany");const n=await a.findMany(t,r),e=i.get(t);return e?m(n,e,s):n},async get(t,r){const{row:n,tableName:e}=await f(t,r),o=e===void 0?void 0:i.get(e);return!n||!o?n:h(n,o,s)},groupBy(t,r){return w(t,[...r.by,r.agg?.field],"groupBy"),u(t,r.where,"groupBy"),a.groupBy(t,r)},query(t){const r=a.query(t),n=i.get(t);return n?c(r,n,t):r},async rankPage(t,r,n){const e=await a.rankPage(t,r,n),o=i.get(t);return o?m(e,o,s):e}},b=p;for(const t of i.keys())k(a[t])&&(b[t]=x(p,t));return p},F=(a,i={})=>{const s=new Map(Object.entries(a)),c=I(i.roles);return async({ctx:f,next:w})=>{const y=f.auth??{},u=await y.getIdentity?.()??null,l=y.roles??[],p=new Set;for(const e of l)for(const o of c.get(e)??[])p.add(o);const b={auth:{can:e=>p.has(S(e)),identity:u,roles:l,userId:y.userId??null},ctx:f};if(i.bypass?.(b))return w();const t=v(f.db,s,b),r={db:t},{orm:n}=f;return n!==null&&typeof n=="object"&&(r.orm=N(t)),w({ctx:r})}};export{F as mask};

package/dist/packem_shared/rls-_iVsPvhX.mjs

@@ -1 +0,0 @@
-import{LunoraError as p}from"./LunoraError-LVhdU0Lo.mjs";import{bindOrm as x,bindTableFacade as P}from"./bindOrm-Bp9hsM2q.mjs";import{r as U}from"./policy-tag-Dprt9JWo.mjs";import{deny as j}from"./allowAll-BnyNbJZT.mjs";const S=500,N=(t,r,s)=>{const i=r??S;if(t>i)throw new p("BAD_REQUEST",`${s}: batch of ${String(t)} exceeds the limit of ${String(i)} (raise options.limit or chunk the call)`)},F=j(),C=Symbol.for("lunora.ctxdb.rls-unwrap"),$=t=>{const r=new Map;for(const s of t){const i=r.get(s.table)??[];i.push(s),r.set(s.table,i)}return r},q=(t,r)=>{const s=[];let i=!1;for(const u of t){if(u.on!=="read")continue;const c=u.when(r);if(c!==void 0){if(c===!0){i=!0;break}c!==!1&&s.push(c)}}if(!i)return s.length===0?F:s.length===1?s[0]:{OR:s}},D=t=>typeof t=="object"&&t!==null&&!Array.isArray(t),L=["contains","eq","gt","gte","in","isNull","lt","lte","ne","notIn"],m=t=>{const r=typeof t;return r==="number"||r==="string"||r==="bigint"},z=(t,r)=>!("lt"in r&&(!m(t)||!m(r.lt)||t>=r.lt)||"lte"in r&&(!m(t)||!m(r.lte)||t>r.lte)||"gt"in r&&(!m(t)||!m(r.gt)||t<=r.gt)||"gte"in r&&(!m(t)||!m(r.gte)||t<r.gte)),Q=(t,r)=>{if("in"in r){const s=r.in;if(!Array.isArray(s)||!s.includes(t))return!1}if("notIn"in r){const s=r.notIn;if(Array.isArray(s)&&s.includes(t))return!1}if("contains"in r){const s=r.contains;if(typeof t!="string"||typeof s!="string"||!t.includes(s))return!1}return!("isNull"in r&&r.isNull===!0!=(t==null))},G=(t,r)=>"eq"in r&&t!==r.eq||"ne"in r&&t===r.ne?!1:Q(t,r)&&z(t,r),H=(t,r,s,i)=>r==="AND"?Array.isArray(s)&&s.every(u=>i(t,u)):r==="OR"?Array.isArray(s)&&s.some(u=>i(t,u)):!i(t,s??{}),I=t=>t==="AND"||t==="OR"||t==="NOT",J=t=>D(t)&&Object.keys(t).every(r=>L.includes(r)),K=["every","is","isNot","none","some"],V=t=>D(t)&&Object.keys(t).length>0&&Object.keys(t).every(r=>K.includes(r)),R=t=>Object.keys(t).some(r=>{const s=t[r];return I(r)?r==="NOT"?R(s??{}):Array.isArray(s)&&s.some(i=>R(i??{})):V(s)}),k=(t,r)=>{for(const s of Object.keys(r)){const i=r[s];if(I(s)){if(!H(t,s,i,k))return!1;continue}const u=t[s];if(J(i)){if(!G(u,i))return!1;continue}if(u!==i)return!1}return!0},X=(t,r,s)=>{const i=t.when({...r,row:s});if(i===void 0||i===!0)return!0;if(i===!1)return!1;if(R(i))throw new p("RELATION_PREDICATE_UNSUPPORTED","relation predicates are not supported in write policies; use a read policy or a flat column check");return k(s,i)},Y=(t,r,s)=>{const i=t.when(r);if(i===void 0||i===!0)return s===void 0||X(t,r,s);if(i===!1)return!1;if(R(i))throw new p("RELATION_PREDICATE_UNSUPPORTED","relation predicates are not supported in write policies; use a read policy or a flat column check");return!r.row||!k(r.row,i)?!1:s===void 0||k(s,i)},M=(t,r,s,i)=>{let u=!1;for(const c of t)if(c.on===r&&(u=!0,!Y(c,s,i)))return!1;return u},E=t=>t??{},Z=new Set(["baseWhere","relationBaseWhere","restrictsCounts","where"]),ee=(t,r)=>r===void 0?!0:t==="restrictsCounts"?typeof r=="boolean":t==="relationBaseWhere"?typeof r=="function":D(r),te=t=>{const r=Object.keys(t);return r.length===0?!1:r.every(s=>Z.has(s)&&ee(s,t[s]))},re=t=>t===void 0?{}:D(t)&&te(t)?t:{where:t},b=(t,r)=>!r||Object.keys(r).length===0?t:!t||Object.keys(t).length===0?r:{AND:[r,t]},ne=t=>{if(typeof t!="object"||t===null||Array.isArray(t))return!1;const r=t;return typeof r.findMany=="function"&&typeof r.withSearchIndex=="function"},ae=(t,r,s,i)=>{const u=new Map,c=e=>{const n=u.get(e);if(n)return n;const a=s.get(e);if(!a||a.length===0||!a.some(l=>l.on==="read")){const l={baseWhere:void 0,restricts:!1};return u.set(e,l),l}const o={baseWhere:q(a,i),restricts:!0};return u.set(e,o),o},f=e=>c(e).restricts?r:t,y=e=>c(e).baseWhere,v=async(e,n)=>{if(r.lookupById){const h=await r.lookupById(e,n);return h?{row:h.row,tableName:s.has(h.tableName)?h.tableName:void 0}:{row:null,tableName:void 0}}const a=await r.get(e,n);if(!a)return{row:null,tableName:void 0};const o=n!==void 0&&s.has(n)?[n]:[],l=n===void 0?[...s.keys()]:o,d=await Promise.all(l.map(async h=>(await r.findFirst(h,{limit:1,where:{_id:e}}))?._id===e?h:void 0));return{row:a,tableName:d.find(h=>h!==void 0)}},B=async(e,n)=>{const a=await v(e,n);return a.row&&a.tableName!==void 0?{row:a.row,tableName:a.tableName}:void 0},w=async(e,n,a,o,l)=>{const d=await B(e,l);if(!d)return a(t);const h=s.get(d.tableName);if(h){const _=o?o(d.row):void 0;if(!M(h,n,{...i,row:d.row},_))throw new p("FORBIDDEN",`${n} denied by policy`)}return a(r)},W=(e,n)=>{const{baseWhere:a,restricts:o}=c(e);if(o)throw new p("COUNT_RLS_UNSUPPORTED",`${n}() is not supported on "${e}" inside an RLS-restricted context`);return a},O=t.rankBefore,g={...t,async count(e,n){const{baseWhere:a,restricts:o}=c(e),l=re(n);return f(e).count(e,{...l,baseWhere:b(l.baseWhere,a),relationBaseWhere:y,restrictsCounts:(l.restrictsCounts??!1)||o})},delete:(e,n,a)=>w(e,"delete",o=>o.delete(e,n,a),void 0,n),async deleteAll(e,n){const a=Math.max(1,n?.chunkSize??S),{baseWhere:o}=c(e);let l=0;for(;;){const d=(await f(e).findMany(e,{baseWhere:o,limit:a,relationBaseWhere:y})).page.map(h=>String(h._id));if(d.length===0)break;for(const h of d)await w(h,"delete",_=>_.delete(h,void 0,n?.hard===void 0?void 0:{hard:n.hard})),l+=1;if(d.length<a)break}return{deleted:l}},async deleteMany(e,n,a){N(e.length,n?.limit,"deleteMany");for(const o of e)await w(o,"delete",l=>l.delete(o,a),void 0,a);return{deleted:e.length}},async deleteWhere(e,n,a){const{baseWhere:o}=c(e),l=(await f(e).findMany(e,{baseWhere:b(n,o),relationBaseWhere:y})).page.map(d=>String(d._id));return N(l.length,a?.limit,"deleteWhere"),g.deleteMany(l,a)},async findFirst(e,n){const{baseWhere:a}=c(e);return f(e).findFirst(e,{...E(n),baseWhere:b(n?.baseWhere,a),relationBaseWhere:y})},async findFirstOrThrow(e,n){const{baseWhere:a}=c(e);return f(e).findFirstOrThrow(e,{...E(n),baseWhere:b(n?.baseWhere,a),relationBaseWhere:y})},async findMany(e,n){const{baseWhere:a}=c(e);return f(e).findMany(e,{...E(n),baseWhere:b(n?.baseWhere,a),relationBaseWhere:y})},async get(e,n){const a=await v(e,n);if(!a.row)return null;if(a.tableName===void 0)return t.get(e,n);const{baseWhere:o,restricts:l}=c(a.tableName);if(!l)return t.get(e,n);if(!o)return a.row;const d=await r.findFirst(a.tableName,{baseWhere:o,limit:1,where:{_id:e}});return d?._id===e?d:null},async insert(e,n){const a=s.get(e);if(a){if(!M(a,"insert",{...i,row:n}))throw new p("FORBIDDEN",`insert on "${e}" denied by policy`);return r.insert(e,n)}return t.insert(e,n)},async insertMany(e,n,a){N(n.length,a?.limit,"insertMany");const o=s.get(e);if(o){for(const l of n)if(!M(o,"insert",{...i,row:l}))throw new p("FORBIDDEN",`insert on "${e}" denied by policy`);return r.insertMany(e,n,a)}return t.insertMany(e,n,a)},async insertManyUnsafe(e,n,a){N(n.length,a?.limit,"insertManyUnsafe");const o=s.get(e);if(o){for(const l of n)if(!M(o,"insert",{...i,row:l}))throw new p("FORBIDDEN",`insert on "${e}" denied by policy`);return r.insertManyUnsafe(e,n,a)}return t.insertManyUnsafe(e,n,a)},patch:(e,n,a)=>w(e,"update",o=>o.patch(e,n,a),o=>({...o,...n}),a),async patchMany(e,n,a){N(e.length,n?.limit,"patchMany");for(const o of e)await w(o.id,"update",l=>l.patch(o.id,o.patch,a),l=>({...l,...o.patch}),a);return{patched:e.length}},async patchWhere(e,n,a){const{baseWhere:o}=c(e),l=(await f(e).findMany(e,{baseWhere:b(n.where,o),relationBaseWhere:y})).page.map(d=>({id:String(d._id),patch:n.patch}));return N(l.length,a?.limit,"patchWhere"),g.patchMany(l,a)},query(e){const{baseWhere:n}=c(e),a=f(e).query(e);return n?a.filter(o=>k(o,n)):a},restore:(e,n)=>w(e,"update",async a=>{const o=a.restore??r.restore;if(!o)throw new p("BAD_REQUEST","restore is not supported by this writer");await o(e,n)},void 0,n),replace:(e,n,a)=>w(e,"update",o=>o.replace(e,n,a),o=>({...n,_creationTime:n._creationTime??o._creationTime,_id:o._id}),a),aggregate(e,n){const{baseWhere:a}=c(e);return f(e).aggregate(e,{...n,baseWhere:b(n.baseWhere,a),relationBaseWhere:y})},groupBy(e,n){const{baseWhere:a}=c(e);return f(e).groupBy(e,{...n,baseWhere:b(n.baseWhere,a),relationBaseWhere:y})},rank(e,n,a){const o=W(e,"rank");return f(e).rank(e,n,{...a,baseWhere:b(a.baseWhere,o)})},rankPage(e,n,a){const o=W(e,"rankPage");return f(e).rankPage(e,n,{...a,baseWhere:b(a?.baseWhere,o)})},wipeShard(){throw new p("FORBIDDEN","ctx.db.wipeShard() is unavailable under rls(): a whole-shard erase can't be policy-gated per row, and erasing only policy-visible rows would silently leave data behind. Run it from an internalMutation, or use ctx.db.deleteAll(table) per table.",{status:403})},...O?{rankBefore:(e,n,a)=>(W(e,"rankBefore"),(f(e).rankBefore??O)(e,n,a))}:{}},A=g;for(const e of s.keys())ne(t[e])&&(A[e]=P(g,e));return g},T=t=>typeof t=="string"?t:t.name,se=t=>{const r=new Map;for(const s of t??[])r.set(s.name,new Set((s.permissions??[]).map(i=>T(i))));return r},ue=(t,r={})=>{const s=$(t),i=se(r.roles);return U(async({ctx:u,next:c})=>{const f=u.auth??{},y=await f.getIdentity?.()??null,v=f.roles??[],B=new Set;for(const n of v)for(const a of i.get(n)??[])B.add(a);const w={auth:{can:n=>B.has(T(n)),identity:y,roles:v,userId:f.userId??null},ctx:u},W=u.db,O=W[C]??W,g=ae(W,O,s,w),A={db:g},{orm:e}=u;return e!==null&&typeof e=="object"&&(A.orm=x(g)),c({ctx:A})},{policies:t,roles:r.roles??[]})};export{q as computeReadBaseWhere,M as evaluateWrite,se as indexRolePermissions,k as matchesWhere,T as permissionName,ue as rls};