@progressive-development/pd-provider-firebase-functions 1.3.0 → 1.4.0

package/bin/prepare-functions-deploy.mjs

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+/**
+ * Makes a Firebase Functions package.json cloud-ready.
+ *
+ * The cloud build installs with npm, and npm does not know the `workspace:`
+ * protocol — a single `workspace:*` ends the deploy with EUNSUPPORTEDPROTOCOL
+ * before anything is uploaded. So every workspace dependency is replaced by
+ * something npm can resolve. Two cases, and the difference is whether the
+ * package is visible to the registry:
+ *
+ *   PUBLISHED → `^<local version>`. The cloud fetches it from the registry.
+ *               So that this never silently deploys an old build: publish
+ *               first, then deploy.
+ *   PRIVATE   → `file:vendor/<name>.tgz`. A private package exists in no
+ *               registry; it is packed here and lands in the functions folder,
+ *               which is uploaded anyway. Packed is what `files` names — i.e.
+ *               `dist`, which must be built BEFORE (see the predeploy chain in
+ *               firebase.json).
+ *
+ * No configuration: pnpm links every workspace dependency into the functions
+ * package's node_modules as a symlink, and its real path is the source folder.
+ *
+ * Usage (firebase.json → functions.predeploy, run inside the functions package):
+ *   pnpm --filter <functions-package> exec pd-prepare-functions-deploy [--dry-run] [dir]
+ *
+ * CAUTION: the script rewrites package.json for good. To continue working:
+ *   git checkout -- packages/functions/package.json && pnpm install
+ */
+import { execFileSync } from "node:child_process";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/** Fixed tarball name per package — otherwise vendor/ collects one corpse per version. */
+export function vendorFileName(name) {
+  return `${name.replace(/[@/]/g, "-").replace(/^-/, "")}.tgz`;
+}
+
+/**
+ * Where a workspace dependency really lives: follow pnpm's symlink.
+ * @returns {{ dir: string, version: string, private: boolean, main: string }}
+ */
+export function findWorkspacePackage(functionsDir, name) {
+  const link = join(functionsDir, "node_modules", ...name.split("/"));
+  if (!existsSync(link)) {
+    throw new Error(`${name}: nicht in node_modules — erst pnpm install.`);
+  }
+  const dir = realpathSync(link);
+  const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+  return {
+    dir,
+    version: pkg.version,
+    private: pkg.private === true,
+    main: pkg.main ?? "dist/index.js",
+  };
+}
+
+/**
+ * Pure part: the rewritten dependency map plus what changed.
+ * `lookup(name)` answers like findWorkspacePackage.
+ */
+export function rewriteDependencies(dependencies, lookup) {
+  const out = { ...(dependencies ?? {}) };
+  const changes = [];
+  for (const [name, spec] of Object.entries(out)) {
+    if (!String(spec).startsWith("workspace:")) continue;
+    const source = lookup(name);
+    const to = source.private
+      ? `file:vendor/${vendorFileName(name)}`
+      : `^${source.version}`;
+    out[name] = to;
+    changes.push({ name, from: spec, to, private: source.private, source });
+  }
+  return { dependencies: out, changes };
+}
+
+/** Packs a private package into vendor/ and returns the tarball name. */
+export function packPrivate(functionsDir, name, source) {
+  const entry = join(source.dir, source.main);
+  if (!existsSync(entry)) {
+    // Without dist the tarball would be empty and the failure would surface in the cloud.
+    throw new Error(`${name}: ${entry} fehlt — erst bauen, dann deployen.`);
+  }
+  const vendor = join(functionsDir, "vendor");
+  mkdirSync(vendor, { recursive: true });
+  const produced = execFileSync("npm", ["pack", "--pack-destination", vendor], {
+    cwd: source.dir,
+    encoding: "utf8",
+  })
+    .trim()
+    .split("\n")
+    .pop();
+  const target = vendorFileName(name);
+  renameSync(join(vendor, produced), join(vendor, target));
+  return target;
+}
+
+/**
+ * Runs the whole thing for one functions directory.
+ * @returns the list of changes (empty when nothing was a workspace dependency)
+ */
+export function prepare(functionsDir, { dryRun = false, log = console.log } = {}) {
+  const pkgPath = join(functionsDir, "package.json");
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+  const { dependencies, changes } = rewriteDependencies(pkg.dependencies, (name) =>
+    findWorkspacePackage(functionsDir, name)
+  );
+
+  for (const change of changes) {
+    const kind = change.private ? `privat, ${change.source.version}` : "veröffentlicht";
+    log(`  ${change.name}: ${change.from} -> ${change.to} (${kind})`);
+    if (change.private && !dryRun) packPrivate(functionsDir, change.name, change.source);
+  }
+
+  if (changes.length === 0) {
+    log("Keine Workspace-Abhängigkeiten offen.");
+  } else if (dryRun) {
+    log(`Dry-Run: ${pkgPath} bleibt unverändert.`);
+  } else {
+    writeFileSync(pkgPath, JSON.stringify({ ...pkg, dependencies }, null, 2) + "\n");
+    log(`${pkgPath} für den Deploy umgeschrieben.`);
+  }
+  return changes;
+}
+
+// CLI — argv[1] may be the symlinked path of a pnpm bin shim while
+// import.meta.url is the real one; compare real paths.
+const invokedAs = process.argv[1] && pathToFileURL(realpathSync(process.argv[1])).href;
+if (invokedAs === import.meta.url) {
+  const args = process.argv.slice(2);
+  const dryRun = args.includes("--dry-run");
+  const dir = resolve(args.find((a) => !a.startsWith("--")) ?? process.cwd());
+  prepare(dir, { dryRun });
+}

package/bin/prepare-functions-deploy.spec.mjs

@@ -0,0 +1,108 @@
+/**
+ * prepare-functions-deploy: veröffentlicht → ^version, privat → vendor-Tarball,
+ * Auffinden über pnpm-Symlinks, Dry-Run schreibt nichts.
+ */
+import { describe, expect, it } from "vitest";
+import { mkdtempSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  findWorkspacePackage,
+  prepare,
+  rewriteDependencies,
+  vendorFileName,
+} from "./prepare-functions-deploy.mjs";
+
+describe("vendorFileName", () => {
+  it("macht aus einem Scope-Namen einen Dateinamen", () => {
+    expect(vendorFileName("@scope/pkg")).toBe("scope-pkg.tgz");
+    expect(vendorFileName("plain")).toBe("plain.tgz");
+  });
+});
+
+describe("rewriteDependencies", () => {
+  const lookup = (name) =>
+    name === "private-model"
+      ? { dir: "/x", version: "0.1.0", private: true, main: "dist/index.js" }
+      : { dir: "/y", version: "1.3.1", private: false, main: "dist/index.js" };
+
+  it("ersetzt nur workspace:-Abhängigkeiten", () => {
+    const { dependencies, changes } = rewriteDependencies(
+      { "@pd/functions": "workspace:*", "private-model": "workspace:^", express: "^4.0.0" },
+      lookup
+    );
+    expect(dependencies).toEqual({
+      "@pd/functions": "^1.3.1",
+      "private-model": "file:vendor/private-model.tgz",
+      express: "^4.0.0",
+    });
+    expect(changes.map((c) => c.name)).toEqual(["@pd/functions", "private-model"]);
+  });
+
+  it("ohne dependencies passiert nichts", () => {
+    expect(rewriteDependencies(undefined, lookup)).toEqual({ dependencies: {}, changes: [] });
+  });
+});
+
+/** Ein Mini-Workspace: functions/ mit pnpm-artigen Symlinks auf zwei Pakete. */
+function fakeWorkspace() {
+  const root = mkdtempSync(join(tmpdir(), "pd-prepare-"));
+  const functions = join(root, "functions");
+  const model = join(root, "model");
+  const published = join(root, "published");
+  mkdirSync(join(functions, "node_modules", "@pd"), { recursive: true });
+  mkdirSync(model);
+  mkdirSync(published);
+  writeFileSync(
+    join(model, "package.json"),
+    JSON.stringify({ name: "app-model", version: "0.2.0", private: true, main: "dist/index.js" })
+  );
+  writeFileSync(
+    join(published, "package.json"),
+    JSON.stringify({ name: "@pd/functions", version: "1.3.1" })
+  );
+  symlinkSync(model, join(functions, "node_modules", "app-model"), "dir");
+  symlinkSync(published, join(functions, "node_modules", "@pd", "functions"), "dir");
+  writeFileSync(
+    join(functions, "package.json"),
+    JSON.stringify({
+      name: "functions",
+      dependencies: { "app-model": "workspace:*", "@pd/functions": "workspace:*", "firebase-admin": "^13.0.0" },
+    })
+  );
+  return { functions, model };
+}
+
+describe("findWorkspacePackage", () => {
+  it("folgt dem Symlink und liest die package.json der Quelle", () => {
+    const { functions } = fakeWorkspace();
+    const src = findWorkspacePackage(functions, "@pd/functions");
+    expect(src).toMatchObject({ version: "1.3.1", private: false });
+    expect(findWorkspacePackage(functions, "app-model").private).toBe(true);
+  });
+
+  it("meldet ein fehlendes Paket verständlich", () => {
+    const { functions } = fakeWorkspace();
+    expect(() => findWorkspacePackage(functions, "nope")).toThrow(/pnpm install/);
+  });
+});
+
+describe("prepare", () => {
+  it("dry-run: meldet die Änderungen, schreibt nichts, packt nichts", () => {
+    const { functions } = fakeWorkspace();
+    const before = readFileSync(join(functions, "package.json"), "utf8");
+    const lines = [];
+    const changes = prepare(functions, { dryRun: true, log: (l) => lines.push(l) });
+    expect(changes.map((c) => c.to)).toEqual(["file:vendor/app-model.tgz", "^1.3.1"]);
+    expect(readFileSync(join(functions, "package.json"), "utf8")).toBe(before);
+    expect(lines.at(-1)).toMatch(/Dry-Run/);
+  });
+
+  it("scharf: privates Paket ohne dist bricht ab, bevor geschrieben wird", () => {
+    const { functions } = fakeWorkspace();
+    const before = readFileSync(join(functions, "package.json"), "utf8");
+    expect(() => prepare(functions, { log: () => {} })).toThrow(/erst bauen/);
+    expect(readFileSync(join(functions, "package.json"), "utf8")).toBe(before);
+  });
+});

package/dist/auth-trash.js

@@ -1,116 +1,127 @@
-import { getAuth } from 'firebase-admin/auth';
-import { moveToTrash, getTrashItem, permanentDelete, restoreFromTrash } from './trash.js';
-import { NotFoundError } from './errors.js';
-import { logger } from './logger.js';
-
+import { NotFoundError } from "./errors.js";
+import { logger } from "./logger.js";
+import { getTrashItem, moveToTrash, permanentDelete, restoreFromTrash } from "./trash.js";
+import { getAuth } from "firebase-admin/auth";
+//#region src/auth-trash.ts
+/**
+* Auth-aware Trash Functions
+*
+* Extends the generic trash service with Firebase Auth user handling.
+* Use these when the trashed document is linked to an Auth user.
+*/
+/**
+* Extract Auth UID from trash item based on options.
+*/
 function getAuthUidFromTrashItem(trashItem, options) {
-  const source = options?.authUidSource ?? "documentId";
-  if (source === "documentId") {
-    return trashItem.originalId;
-  }
-  const data = trashItem.data;
-  const uid = data[source];
-  if (typeof uid !== "string" || !uid) {
-    throw new Error(
-      `Auth UID field '${source}' not found or empty in trash item data`
-    );
-  }
-  return uid;
+	const source = options?.authUidSource ?? "documentId";
+	if (source === "documentId") return trashItem.originalId;
+	const uid = trashItem.data[source];
+	if (typeof uid !== "string" || !uid) throw new Error(`Auth UID field '${source}' not found or empty in trash item data`);
+	return uid;
 }
+/**
+* Move document to trash AND disable the associated Auth user.
+*
+* Order of operations:
+* 1. Disable Auth user (if user doesn't exist, continue anyway)
+* 2. Move document to trash
+*
+* @param collection - The collection path
+* @param documentId - The document ID to trash
+* @param deletedBy - UID of the user performing the deletion
+* @param objectType - Type identifier for filtering
+* @param options - Auth and database options
+* @returns The created trash item
+*/
 async function moveToTrashWithAuth(collection, documentId, deletedBy, objectType, options) {
-  const authUid = options?.authUidSource === "documentId" || !options?.authUidSource ? documentId : documentId;
-  logger.info("Disabling Auth user before trash", {
-    authUid,
-    collection,
-    documentId
-  });
-  try {
-    await getAuth().updateUser(authUid, { disabled: true });
-    logger.info("Auth user disabled", { authUid });
-  } catch (error) {
-    const authError = error;
-    if (authError.code === "auth/user-not-found") {
-      logger.info("Auth user not found, continuing with trash operation", {
-        authUid
-      });
-    } else {
-      throw error;
-    }
-  }
-  const trashItem = await moveToTrash(
-    collection,
-    documentId,
-    deletedBy,
-    objectType,
-    options?.databaseId
-  );
-  logger.info("Document moved to trash with Auth disabled", {
-    trashItemId: trashItem.id,
-    authUid
-  });
-  return trashItem;
+	const authUid = options?.authUidSource === "documentId" || !options?.authUidSource ? documentId : documentId;
+	logger.info("Disabling Auth user before trash", {
+		authUid,
+		collection,
+		documentId
+	});
+	try {
+		await getAuth().updateUser(authUid, { disabled: true });
+		logger.info("Auth user disabled", { authUid });
+	} catch (error) {
+		if (error.code === "auth/user-not-found") logger.info("Auth user not found, continuing with trash operation", { authUid });
+		else throw error;
+	}
+	const trashItem = await moveToTrash(collection, documentId, deletedBy, objectType, options?.databaseId);
+	logger.info("Document moved to trash with Auth disabled", {
+		trashItemId: trashItem.id,
+		authUid
+	});
+	return trashItem;
 }
+/**
+* Restore document from trash AND re-enable the Auth user.
+*
+* Order of operations:
+* 1. Get trash item to find Auth UID
+* 2. Restore document from trash
+* 3. Re-enable Auth user (if user doesn't exist, log warning)
+*
+* @param trashItemId - The trash document ID
+* @param options - Auth and database options
+*/
 async function restoreFromTrashWithAuth(trashItemId, options) {
-  const trashItem = await getTrashItem(trashItemId, options?.databaseId);
-  if (!trashItem) {
-    throw new NotFoundError(`Trash item ${trashItemId} not found`);
-  }
-  const authUid = getAuthUidFromTrashItem(trashItem, options);
-  logger.info("Restoring from trash with Auth re-enable", {
-    trashItemId,
-    authUid,
-    originalCollection: trashItem.originalCollection
-  });
-  await restoreFromTrash(trashItemId, options?.databaseId);
-  try {
-    await getAuth().updateUser(authUid, { disabled: false });
-    logger.info("Document restored and Auth user re-enabled", {
-      trashItemId,
-      authUid
-    });
-  } catch (error) {
-    const authError = error;
-    if (authError.code === "auth/user-not-found") {
-      logger.warn(
-        "Document restored but Auth user not found - manual Auth user creation required",
-        {
-          trashItemId,
-          authUid
-        }
-      );
-    } else {
-      throw error;
-    }
-  }
+	const trashItem = await getTrashItem(trashItemId, options?.databaseId);
+	if (!trashItem) throw new NotFoundError(`Trash item ${trashItemId} not found`);
+	const authUid = getAuthUidFromTrashItem(trashItem, options);
+	logger.info("Restoring from trash with Auth re-enable", {
+		trashItemId,
+		authUid,
+		originalCollection: trashItem.originalCollection
+	});
+	await restoreFromTrash(trashItemId, options?.databaseId);
+	try {
+		await getAuth().updateUser(authUid, { disabled: false });
+		logger.info("Document restored and Auth user re-enabled", {
+			trashItemId,
+			authUid
+		});
+	} catch (error) {
+		if (error.code === "auth/user-not-found") logger.warn("Document restored but Auth user not found - manual Auth user creation required", {
+			trashItemId,
+			authUid
+		});
+		else throw error;
+	}
 }
+/**
+* Permanently delete from trash AND delete the Auth user.
+*
+* Order of operations:
+* 1. Get trash item to find Auth UID
+* 2. Delete from trash
+* 3. Delete Auth user (ignore if user doesn't exist)
+*
+* @param trashItemId - The trash document ID
+* @param options - Auth and database options
+*/
 async function permanentDeleteWithAuth(trashItemId, options) {
-  const trashItem = await getTrashItem(trashItemId, options?.databaseId);
-  if (!trashItem) {
-    throw new NotFoundError(`Trash item ${trashItemId} not found`);
-  }
-  const authUid = getAuthUidFromTrashItem(trashItem, options);
-  logger.info("Permanently deleting with Auth user deletion", {
-    trashItemId,
-    authUid
-  });
-  await permanentDelete(trashItemId, options?.databaseId);
-  try {
-    await getAuth().deleteUser(authUid);
-    logger.info("Trash item and Auth user permanently deleted", {
-      trashItemId,
-      authUid
-    });
-  } catch (error) {
-    const authError = error;
-    if (authError.code === "auth/user-not-found") {
-      logger.info("Auth user not found, trash item deleted", {
-        trashItemId,
-        authUid
-      });
-    } else {
-      throw error;
-    }
-  }
+	const trashItem = await getTrashItem(trashItemId, options?.databaseId);
+	if (!trashItem) throw new NotFoundError(`Trash item ${trashItemId} not found`);
+	const authUid = getAuthUidFromTrashItem(trashItem, options);
+	logger.info("Permanently deleting with Auth user deletion", {
+		trashItemId,
+		authUid
+	});
+	await permanentDelete(trashItemId, options?.databaseId);
+	try {
+		await getAuth().deleteUser(authUid);
+		logger.info("Trash item and Auth user permanently deleted", {
+			trashItemId,
+			authUid
+		});
+	} catch (error) {
+		if (error.code === "auth/user-not-found") logger.info("Auth user not found, trash item deleted", {
+			trashItemId,
+			authUid
+		});
+		else throw error;
+	}
 }
-
+//#endregion
 export { moveToTrashWithAuth, permanentDeleteWithAuth, restoreFromTrashWithAuth };

package/dist/auth.js

@@ -1,30 +1,37 @@
-import { UnauthorizedError, ForbiddenError } from './errors.js';
-import { logger } from './logger.js';
-
+import { ForbiddenError, UnauthorizedError } from "./errors.js";
+import { logger } from "./logger.js";
+//#region src/auth.ts
+/**
+* Require authenticated user
+*/
 function requireAuth(request) {
-  if (!request.auth) {
-    throw new UnauthorizedError();
-  }
-  return {
-    uid: request.auth.uid,
-    email: request.auth.token.email ?? null,
-    claims: request.auth.token
-  };
+	if (!request.auth) throw new UnauthorizedError();
+	return {
+		uid: request.auth.uid,
+		email: request.auth.token.email ?? null,
+		claims: request.auth.token
+	};
 }
+/**
+* Require specific role claims.
+* Supports Firebase standard format: { admin: true, developer: true }
+*/
 function requireClaims(request, allowedRoles) {
-  const auth = requireAuth(request);
-  const hasRole = allowedRoles.some((role) => auth.claims[role] === true);
-  if (!hasRole) {
-    throw new ForbiddenError();
-  }
-  return auth;
+	const auth = requireAuth(request);
+	if (!allowedRoles.some((role) => auth.claims[role] === true)) throw new ForbiddenError();
+	return auth;
 }
+/**
+* Ensure user can only access own resources
+*/
 function requireOwnership(auth, resourceOwnerId) {
-  const isAdmin = auth.claims.admin === true;
-  if (!isAdmin && auth.uid !== resourceOwnerId) {
-    logger.warn("Ownership violation", { uid: auth.uid, resourceOwnerId });
-    throw new ForbiddenError("Cannot access other user's resources");
-  }
+	if (!(auth.claims.admin === true) && auth.uid !== resourceOwnerId) {
+		logger.warn("Ownership violation", {
+			uid: auth.uid,
+			resourceOwnerId
+		});
+		throw new ForbiddenError("Cannot access other user's resources");
+	}
 }
-
+//#endregion
 export { requireAuth, requireClaims, requireOwnership };

package/dist/changes.js

@@ -1,69 +1,62 @@
+//#region src/changes.ts
 function hasIsEqual(value) {
-  return typeof value === "object" && value !== null && typeof value.isEqual === "function";
+	return typeof value === "object" && value !== null && typeof value.isEqual === "function";
 }
+/** undefined, null and missing keys all count as "not set" and equal. */
 function isUnset(value) {
-  return value === void 0 || value === null;
+	return value === void 0 || value === null;
 }
 function isEqualValue(a, b) {
-  if (isUnset(a) && isUnset(b)) {
-    return true;
-  }
-  if (isUnset(a) || isUnset(b)) {
-    return false;
-  }
-  if (a === b) {
-    return true;
-  }
-  if (typeof a === "number" && typeof b === "number" && Number.isNaN(a) && Number.isNaN(b)) {
-    return true;
-  }
-  if (hasIsEqual(a) && hasIsEqual(b)) {
-    try {
-      return a.isEqual(b);
-    } catch {
-      return false;
-    }
-  }
-  if (hasIsEqual(a) || hasIsEqual(b)) {
-    return false;
-  }
-  if (a instanceof Date && b instanceof Date) {
-    return a.getTime() === b.getTime();
-  }
-  if (Array.isArray(a) && Array.isArray(b)) {
-    return a.length === b.length && a.every((item, i) => isEqualValue(item, b[i]));
-  }
-  if (Array.isArray(a) || Array.isArray(b)) {
-    return false;
-  }
-  if (typeof a === "object" && typeof b === "object") {
-    const aObj = a;
-    const bObj = b;
-    const keys = /* @__PURE__ */ new Set([...Object.keys(aObj), ...Object.keys(bObj)]);
-    for (const key of keys) {
-      if (!isEqualValue(aObj[key], bObj[key])) {
-        return false;
-      }
-    }
-    return true;
-  }
-  return false;
+	if (isUnset(a) && isUnset(b)) return true;
+	if (isUnset(a) || isUnset(b)) return false;
+	if (a === b) return true;
+	if (typeof a === "number" && typeof b === "number" && Number.isNaN(a) && Number.isNaN(b)) return true;
+	if (hasIsEqual(a) && hasIsEqual(b)) try {
+		return a.isEqual(b);
+	} catch {
+		return false;
+	}
+	if (hasIsEqual(a) || hasIsEqual(b)) return false;
+	if (a instanceof Date && b instanceof Date) return a.getTime() === b.getTime();
+	if (Array.isArray(a) && Array.isArray(b)) return a.length === b.length && a.every((item, i) => isEqualValue(item, b[i]));
+	if (Array.isArray(a) || Array.isArray(b)) return false;
+	if (typeof a === "object" && typeof b === "object") {
+		const aObj = a;
+		const bObj = b;
+		const keys = /* @__PURE__ */ new Set([...Object.keys(aObj), ...Object.keys(bObj)]);
+		for (const key of keys) if (!isEqualValue(aObj[key], bObj[key])) return false;
+		return true;
+	}
+	return false;
 }
+/**
+* Compute which top-level fields changed between two object states.
+*
+* Values are compared deeply (nested objects, arrays), but changes are
+* reported per top-level field with the full old/new value. Firestore value
+* types are compared via their own isEqual(). undefined, null and missing
+* keys are treated as the same "not set" state.
+*
+* @param before - Previous state; undefined means "object did not exist yet"
+* @param after - New state
+* @param options - Optional ignore list for noisy fields (e.g. "lastEdit")
+* @returns The changed fields — or undefined if nothing changed, so
+*          "did anything change?" is a truthiness check on the result
+*/
 function computeChanges(before, after, options) {
-  const ignore = new Set(options?.ignoreFields ?? []);
-  const keys = /* @__PURE__ */ new Set([...Object.keys(before ?? {}), ...Object.keys(after)]);
-  const changes = {};
-  for (const key of keys) {
-    if (ignore.has(key)) {
-      continue;
-    }
-    const oldValue = before?.[key];
-    const newValue = after[key];
-    if (!isEqualValue(oldValue, newValue)) {
-      changes[key] = { old: oldValue ?? null, new: newValue ?? null };
-    }
-  }
-  return Object.keys(changes).length > 0 ? changes : void 0;
+	const ignore = new Set(options?.ignoreFields ?? []);
+	const keys = /* @__PURE__ */ new Set([...Object.keys(before ?? {}), ...Object.keys(after)]);
+	const changes = {};
+	for (const key of keys) {
+		if (ignore.has(key)) continue;
+		const oldValue = before?.[key];
+		const newValue = after[key];
+		if (!isEqualValue(oldValue, newValue)) changes[key] = {
+			old: oldValue ?? null,
+			new: newValue ?? null
+		};
+	}
+	return Object.keys(changes).length > 0 ? changes : void 0;
 }
-
+//#endregion
 export { computeChanges };