@protobase/server 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/aggregate-service.js

@@ -0,0 +1,135 @@
+import { badRequest } from "./problem.js";
+import { checkedFilter } from "./filter-input.js";
+import { readScope, requestAccess, requireOperation } from "./request-access.js";
+import { readTransaction } from "./transactions.js";
+import { columnId, filterCondition, scopeConditions, tableId, whereClause } from "./sql-parts.js";
+import { parseParams } from "./params.js";
+import { facetCounts, histogram, series } from "@protobase/query";
+import { z } from "zod";
+import { sql } from "kysely";
+//#region src/aggregate-service.ts
+const field = z.string().min(1);
+const filter = z.string().optional();
+const facetParams = z.object({
+	field,
+	filter,
+	limit: z.coerce.number().int().optional()
+});
+const seriesParams = z.object({
+	field,
+	filter,
+	range: z.enum([
+		"7d",
+		"30d",
+		"90d",
+		"1y",
+		"all"
+	]).optional(),
+	from: z.string().optional(),
+	to: z.string().optional(),
+	granularity: z.enum([
+		"hour",
+		"day",
+		"week",
+		"month"
+	]).default("day"),
+	time_zone: z.string().optional()
+});
+const histogramParams = z.object({
+	field,
+	filter,
+	buckets: z.coerce.number().int().default(20)
+});
+const rangeDays = {
+	"7d": 7,
+	"30d": 30,
+	"90d": 90,
+	"1y": 365
+};
+const scoped = async (deps, entry, session, source) => {
+	const access = await requestAccess(deps, entry, session);
+	requireOperation(access, "list");
+	return {
+		access,
+		model: access.model,
+		filter: checkedFilter(access.model, source),
+		scope: readScope(access)
+	};
+};
+/** Counts per value of a field, ignoring the filter's own terms on that field (AIP-160 filters, UI facet panels). */
+const facets = async (deps, entry, session, input) => {
+	const params = parseParams(facetParams, input);
+	const { model, filter: checked, scope } = await scoped(deps, entry, session, params.filter);
+	const counts = await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => facetCounts(trx, model, params.field, checked, {
+		statementTimeoutMs: deps.statementTimeoutMs,
+		...params.limit !== void 0 && { limit: params.limit },
+		scope
+	}));
+	return {
+		field: params.field,
+		facets: counts
+	};
+};
+const earliest = async (deps, access, fieldName, scope) => {
+	const target = access.model.fields[fieldName];
+	const conditions = [...scopeConditions(access.full, scope.tenantValue), ...filterCondition(access.full, scope.rowFilter)];
+	return (await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => sql`select min(${columnId(target)})::text as lowest from ${tableId(access.full)} as t${whereClause(conditions)}`.execute(trx))).rows[0]?.lowest ?? void 0;
+};
+const bound = (model, fieldName, value) => model.fields[fieldName]?.type === "date" ? value.slice(0, 10) : value;
+const seriesRange = async (deps, access, params, scope) => {
+	const to = params.to ?? (/* @__PURE__ */ new Date()).toISOString();
+	const { model } = access;
+	if (params.from) return {
+		from: bound(model, params.field, params.from),
+		to: bound(model, params.field, to)
+	};
+	const range = params.range ?? "30d";
+	if (range !== "all") {
+		const from = (/* @__PURE__ */ new Date(Date.now() - rangeDays[range] * 864e5)).toISOString();
+		return {
+			from: bound(model, params.field, from),
+			to: bound(model, params.field, to)
+		};
+	}
+	const lowest = await earliest(deps, access, params.field, scope);
+	return lowest ? {
+		from: bound(model, params.field, lowest),
+		to: bound(model, params.field, to)
+	} : void 0;
+};
+/** Row counts per calendar bucket of a date or timestamp field, empty buckets included. */
+const timeSeries = async (deps, entry, session, input) => {
+	const params = parseParams(seriesParams, input);
+	const { access, model, filter: checked, scope } = await scoped(deps, entry, session, params.filter);
+	if (!model.fields[params.field]) throw badRequest("invalid-parameter", `Unknown field "${params.field}"`, { errors: [{
+		parameter: "field",
+		message: "Unknown field"
+	}] });
+	const range = await seriesRange(deps, access, params, scope);
+	const timeZone = params.time_zone ?? "UTC";
+	const points = range ? await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => series(trx, model, params.field, {
+		range,
+		granularity: params.granularity,
+		timeZone,
+		...checked && { filter: checked },
+		scope
+	})) : [];
+	return {
+		field: params.field,
+		granularity: params.granularity,
+		time_zone: timeZone,
+		points
+	};
+};
+/** Equal-width buckets between the filtered minimum and maximum of a numeric field. */
+const numericHistogram = async (deps, entry, session, input) => {
+	const params = parseParams(histogramParams, input);
+	const { model, filter: checked, scope } = await scoped(deps, entry, session, params.filter);
+	const result = await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => histogram(trx, model, params.field, checked, params.buckets, scope));
+	return {
+		field: params.field,
+		...result
+	};
+};
+//#endregion
+export { facets, numericHistogram, timeSeries };

package/dist/audit/console-queue.d.ts

@@ -0,0 +1,5 @@
+import { AuditQueue } from "../types.js";
+//#region src/audit/console-queue.d.ts
+/** The stand-in queue: prints each event as one JSON line, so nothing is kept. */
+export declare const consoleAuditQueue: (print?: (line: string) => void) => AuditQueue;
+//#endregion

package/dist/audit/console-queue.js

@@ -0,0 +1,5 @@
+//#region src/audit/console-queue.ts
+/** The stand-in queue: prints each event as one JSON line, so nothing is kept. */
+const consoleAuditQueue = (print = console.info) => ({ publish: async (event) => print(`[audit] ${JSON.stringify(event)}`) });
+//#endregion
+export { consoleAuditQueue };

package/dist/auth/jwt.d.ts

@@ -0,0 +1,21 @@
+import { Authenticator, TenantValue } from "../types.js";
+import { JWTVerifyGetKey } from "jose";
+//#region src/auth/jwt.d.ts
+export type JwtOptions = {
+  /** JWKS endpoint of the identity provider; or pass `keys`, for example `createLocalJWKSet`. */
+  jwksUrl?: string | URL;
+  keys?: JWTVerifyGetKey;
+  issuer?: string;
+  audience?: string;
+  /** Claim holding the roles, an array, or a string separated by spaces or commas. Default `roles`. */
+  rolesClaim?: string;
+  /** Claim holding the tenant. Default `tenant`. */
+  tenantClaim?: string;
+  /** Accepted signature algorithms. Default: asymmetric ones only, so a token can never be "verified" with a public key used as an HMAC secret. */
+  algorithms?: string[];
+  /** A fixed tenant (or resolver) used instead of any claim, for single-tenant deployments. */
+  tenant?: TenantValue | (() => Promise<TenantValue | undefined>);
+};
+/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. */
+export declare const jwtAuthenticator: (options: JwtOptions) => Authenticator;
+//#endregion

package/dist/auth/jwt.js

@@ -0,0 +1,49 @@
+import { unauthorized } from "../problem.js";
+import { createRemoteJWKSet, errors, jwtVerify } from "jose";
+//#region src/auth/jwt.ts
+const asymmetric = [
+	"EdDSA",
+	"ES256",
+	"ES384",
+	"ES512",
+	"RS256",
+	"RS384",
+	"RS512",
+	"PS256",
+	"PS384",
+	"PS512"
+];
+const rolesOf = (claim) => {
+	if (typeof claim === "string") return claim.split(/[\s,]+/).filter(Boolean);
+	return Array.isArray(claim) ? claim.filter((role) => typeof role === "string") : [];
+};
+/** Verifies `Authorization: Bearer <jwt>` against a JWKS; `sub` is the user id. */
+const jwtAuthenticator = (options) => {
+	const { rolesClaim = "roles", tenantClaim = "tenant" } = options;
+	const keys = options.keys ?? (options.jwksUrl ? createRemoteJWKSet(new URL(options.jwksUrl)) : void 0);
+	if (!keys) throw new Error("jwtAuthenticator needs jwksUrl or keys");
+	return async (request) => {
+		const [scheme, token] = (request.headers.get("authorization") ?? "").split(" ");
+		if (scheme?.toLowerCase() !== "bearer" || !token) throw unauthorized("Send a bearer token in the Authorization header");
+		const { sub, [tenantClaim]: tenant, [rolesClaim]: roles } = (await jwtVerify(token, keys, {
+			algorithms: options.algorithms ?? asymmetric,
+			...options.issuer && { issuer: options.issuer },
+			...options.audience && { audience: options.audience }
+		}).catch((error) => {
+			if (error instanceof errors.JOSEError) throw unauthorized("The bearer token is invalid or expired");
+			throw error;
+		})).payload;
+		if (!sub) throw unauthorized("The bearer token has no subject");
+		const claimed = typeof tenant === "string" || typeof tenant === "number" ? tenant : void 0;
+		const tenantValue = options.tenant === void 0 ? claimed : typeof options.tenant === "function" ? await options.tenant() : options.tenant;
+		return {
+			user: {
+				id: sub,
+				roles: rolesOf(roles)
+			},
+			...tenantValue !== void 0 && { tenant: tenantValue }
+		};
+	};
+};
+//#endregion
+export { jwtAuthenticator };

package/dist/batch/refs.js

@@ -0,0 +1,31 @@
+import { badRequest } from "../problem.js";
+import { decodeKeyText } from "../key.js";
+import { encodeKey } from "@protobase/schema";
+//#region src/batch/refs.ts
+const isRef = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && "$ref" in value;
+const valueOf = (created, ref) => {
+	const target = created.get(ref.$ref);
+	if (!target) throw badRequest("unknown-ref", `"${ref.$ref}" is not the ref of an earlier create in this batch`);
+	if (ref.field) {
+		const value = target.record[ref.field];
+		if (typeof value !== "string" && typeof value !== "number") throw badRequest("unknown-ref", `"${ref.$ref}" has no readable field "${ref.field}" to point at`);
+		return value;
+	}
+	if (target.key.length !== 1) throw badRequest("unknown-ref", `"${ref.$ref}" has a composite key; name the field to point at with { $ref, field }`);
+	return target.key[0];
+};
+/** Replaces every `{ $ref }` in a record's values with the key (or `field`) of the record it names. */
+const resolveData = (created, data) => Object.fromEntries(Object.entries(data).map(([name, value]) => [name, isRef(value) ? valueOf(created, value) : value]));
+/** A batch key as typed key parts, for `entry`. */
+const resolveKey = (created, entry, input) => {
+	if (isRef(input)) {
+		const target = created.get(input.$ref);
+		if (!target) throw badRequest("unknown-ref", `"${input.$ref}" is not the ref of an earlier create in this batch`);
+		return input.field ? [valueOf(created, input)] : [...target.key];
+	}
+	if (typeof input === "number") return decodeKeyText(entry, String(input));
+	if (typeof input === "string") return decodeKeyText(entry, input);
+	return decodeKeyText(entry, encodeKey(input.map((part) => isRef(part) ? valueOf(created, part) : part)));
+};
+//#endregion
+export { resolveData, resolveKey };

package/dist/batch/reorder.js

@@ -0,0 +1,79 @@
+import { badRequest } from "../problem.js";
+import { tenantScope } from "../tenant.js";
+import { requireOperation, targetFilter, writableFields } from "../request-access.js";
+import { columnId, keyConditions, scopeConditions, tableId, whereClause } from "../sql-parts.js";
+import { fetchRecord } from "../records.js";
+import { missing, shown } from "../write-shared.js";
+import { validateBody } from "../validate-body.js";
+import { applyUpdate, planUpdate } from "../write-update.js";
+import { encodeKey } from "@protobase/schema";
+import { sql } from "kysely";
+//#region src/batch/reorder.ts
+const checkViolation = "23514";
+const isDatabaseCode = (error, code) => error instanceof Error && error.code === code;
+/**
+* Moves the affected rows out of the range in use, in one statement per row and without touching their ETags, so the
+* final positions can be written without any two rows colliding on a non-deferrable unique index.
+* First above the highest value in the column; when a check constraint refuses that, below the lowest (negative).
+* The first attempt runs in a savepoint, so a refusal costs nothing.
+*/
+const moveAside = async (trx, access, field, keys) => {
+	const { full } = access;
+	const column = columnId(full.fields[field]);
+	const tenant = tenantScope(access.entry, access.session)?.tenantValue;
+	const bounds = (await sql`select max(${column}) as high, min(${column}) as low from ${tableId(full)} as t`.execute(trx)).rows[0];
+	const assign = async (temporary) => {
+		for (const [rank, key] of keys.entries()) {
+			const conditions = [...scopeConditions(full, tenant), ...keyConditions(full, key)];
+			await sql`update ${tableId(full)} as t set ${column} = ${temporary(rank)}${whereClause(conditions)}`.execute(trx);
+		}
+	};
+	await sql`savepoint reorder_aside`.execute(trx);
+	try {
+		await assign((rank) => Number(bounds.high ?? 0) + 1 + rank);
+		await sql`release savepoint reorder_aside`.execute(trx);
+	} catch (error) {
+		if (!isDatabaseCode(error, checkViolation)) throw error;
+		await sql`rollback to savepoint reorder_aside`.execute(trx);
+		await assign((rank) => Math.min(Number(bounds.low ?? 0), 0) - 1 - rank);
+	}
+};
+/**
+* `reorder`: the listed records end up with `field` = 1, 2, 3, ... in the given order. Only records whose value changes
+* are written, each as an ordinary update (validation, access, ETag, hooks); they are first moved aside (see `moveAside`)
+* so that a unique index such as (invoice_id, position) is never violated half way. Everything checks out before any row moves.
+*/
+const reorderIn = async (trx, deps, access, input) => {
+	const { entry, full } = access;
+	requireOperation(access, "update");
+	const field = full.fields[input.field];
+	validateBody(access, "update", { [input.field]: 1 });
+	if (field?.type !== "integer" && field?.type !== "bigint") throw badRequest("invalid-parameter", `"${input.field}" must be an integer field to order by`);
+	if (!writableFields(access, "update").includes(input.field)) throw badRequest("invalid-parameter", `"${input.field}" is read-only`);
+	const names = input.keys.map((key) => encodeKey(key));
+	if (new Set(names).size !== names.length) throw badRequest("invalid-parameter", "A record appears twice in keys");
+	const tenant = tenantScope(entry, access.session)?.tenantValue;
+	const target = targetFilter(access, "update");
+	const current = await Promise.all(input.keys.map(async (key) => {
+		const found = await fetchRecord(trx, entry, key, tenant, {
+			deleted: "hide",
+			lock: true,
+			...target && { filter: target },
+			etagFields: Object.keys(access.model.fields)
+		});
+		if (!found) throw missing(entry);
+		return found;
+	}));
+	const changing = input.keys.flatMap((key, i) => Number(current[i].record[input.field]) === i + 1 ? [] : [i]);
+	const plans = /* @__PURE__ */ new Map();
+	for (const i of changing) plans.set(i, await planUpdate(trx, access, input.keys[i], { [input.field]: i + 1 }, input.etags[names[i]] ?? null));
+	if (changing.length > 0) await moveAside(trx, access, input.field, changing.map((i) => input.keys[i]));
+	const results = [];
+	for (const [i, key] of input.keys.entries()) {
+		const plan = plans.get(i);
+		results.push(shown(access, plan ? await applyUpdate(trx, deps, access, key, plan) : current[i]));
+	}
+	return results;
+};
+//#endregion
+export { reorderIn };

package/dist/batch/run-batch.js

@@ -0,0 +1,105 @@
+import { HttpProblem, badRequest, notFound } from "../problem.js";
+import { problemOf } from "../error-handler.js";
+import { requestAccess } from "../request-access.js";
+import { writeTransaction } from "../transactions.js";
+import { keyOf } from "../write-shared.js";
+import { writeIn } from "../write-pipeline.js";
+import { resolveData, resolveKey } from "./refs.js";
+import { reorderIn } from "./reorder.js";
+//#region src/batch/run-batch.ts
+const entryOf = (deps, name) => {
+	const entry = deps.registry.find(name);
+	if (!entry) throw notFound(`There is no resource "${name}"`);
+	return entry;
+};
+const atOperation = (error, index, operation) => {
+	const known = problemOf(error);
+	if (!known) throw error;
+	return new HttpProblem(known.status, known.slug, known.title, known.detail, {
+		...known.extras,
+		operation: index,
+		op: operation.op,
+		resource: operation.resource
+	}, known.headers);
+};
+/**
+* Runs the operations in order inside ONE transaction, each through the normal write pipeline (validation, access with row
+* filters and record-level rules, tenant, ETags, hooks). Any failure rolls the whole batch back and names the failing operation.
+*/
+const runBatch = async (deps, session, operations) => {
+	const refs = operations.flatMap((operation) => operation.op === "create" && operation.ref ? [operation.ref] : []);
+	if (new Set(refs).size !== refs.length) throw badRequest("invalid-parameter", "Each create may use a ref name once");
+	const accesses = /* @__PURE__ */ new Map();
+	const accessFor = async (entry) => {
+		const known = accesses.get(entry.name);
+		if (known) return known;
+		const access = await requestAccess(deps, entry, session);
+		accesses.set(entry.name, access);
+		return access;
+	};
+	return writeTransaction(deps.db, deps.statementTimeoutMs, async (trx) => {
+		const created = /* @__PURE__ */ new Map();
+		const results = [];
+		for (const [index, operation] of operations.entries()) try {
+			const entry = entryOf(deps, operation.resource);
+			const access = await accessFor(entry);
+			if (operation.op === "create") {
+				const written = await writeIn(trx, deps, access, {
+					operation: "create",
+					body: resolveData(created, operation.data)
+				});
+				if (operation.ref) created.set(operation.ref, {
+					entry,
+					key: keyOf(access, written.record),
+					record: written.record
+				});
+				results.push({
+					op: "create",
+					resource: entry.name,
+					...operation.ref && { ref: operation.ref },
+					...written
+				});
+			} else if (operation.op === "update") {
+				const written = await writeIn(trx, deps, access, {
+					operation: "update",
+					key: resolveKey(created, entry, operation.key),
+					body: resolveData(created, operation.data),
+					ifMatch: operation.etag ?? null
+				});
+				results.push({
+					op: "update",
+					resource: entry.name,
+					...written
+				});
+			} else if (operation.op === "delete") {
+				await writeIn(trx, deps, access, {
+					operation: "delete",
+					key: resolveKey(created, entry, operation.key),
+					ifMatch: operation.etag ?? null
+				});
+				results.push({
+					op: "delete",
+					resource: entry.name,
+					deleted: true
+				});
+			} else {
+				const keys = operation.keys.map((key) => resolveKey(created, entry, key));
+				const records = await reorderIn(trx, deps, access, {
+					field: operation.field,
+					keys,
+					etags: operation.etags ?? {}
+				});
+				results.push({
+					op: "reorder",
+					resource: entry.name,
+					records
+				});
+			}
+		} catch (error) {
+			throw atOperation(error, index, operation);
+		}
+		return results;
+	});
+};
+//#endregion
+export { runBatch };