@shaferllc/keel 0.59.0 → 0.68.0

package/dist/core/storage.js

@@ -9,8 +9,19 @@
  *   const bytes = await storage().get("avatars/1.png");
  *   const url = storage().url("avatars/1.png");
  *
+ * Private files get a temporary URL instead of a public one:
+ *
+ *   await storage().signedUrl("invoices/42.pdf", { expiresIn: 300 });
+ *
+ * and browsers can upload straight to the bucket — the bytes never transit the
+ * app — with a signed upload URL:
+ *
+ *   await storage().signedUploadUrl("uploads/raw.mov", { contentType: "video/quicktime" });
+ *
  * Register several disks by name and select one with `storage("s3")`.
  */
+import { getMimeType } from "hono/utils/mime";
+import { config } from "./helpers.js";
 function toBytes(contents) {
     if (typeof contents === "string")
         return new TextEncoder().encode(contents);
@@ -18,7 +29,71 @@ function toBytes(contents) {
         return contents;
     return new Uint8Array(contents);
 }
-/* ------------------------------ memory disk ------------------------------- */
+/** The MIME type for a path's extension, or `application/octet-stream`. */
+export function contentTypeFor(path) {
+    return getMimeType(path) ?? "application/octet-stream";
+}
+/* -------------------------------- signing --------------------------------- */
+/** HMAC-SHA256 hex — Web Crypto, so it works on Node and the edge. */
+async function hmac(key, data) {
+    const enc = new TextEncoder();
+    const cryptoKey = await crypto.subtle.importKey("raw", enc.encode(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const sig = await crypto.subtle.sign("HMAC", cryptoKey, enc.encode(data));
+    return [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function appKey() {
+    const key = config("app.key", "");
+    if (!key)
+        throw new Error("Signed storage URLs require config('app.key'). Set APP_KEY.");
+    return key;
+}
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+/**
+ * The string we actually sign: path + query, never the host. A disk's `url()`
+ * may be absolute (a CDN) or relative (`/storage/x`), while the request that
+ * comes back in is always absolute — signing only the path makes both sides
+ * agree. It also means the same signature is valid across your own hostnames,
+ * which is what you want behind a CDN.
+ */
+function canonical(url, params) {
+    const { pathname } = new URL(url, "http://keel.local");
+    const query = params.toString();
+    return query ? `${pathname}?${query}` : pathname;
+}
+/**
+ * Sign a URL with `config('app.key')`, adding `expires` and `signature` query
+ * params. Verify it with `verifyStorageUrl()`.
+ */
+export async function signStorageUrl(url, expiresIn = 3600) {
+    const mark = url.indexOf("?");
+    const base = mark === -1 ? url : url.slice(0, mark);
+    // Keep any query the disk's own url() already carries — a CDN token, say.
+    const params = new URLSearchParams(mark === -1 ? "" : url.slice(mark + 1));
+    params.set("expires", String(Math.floor(Date.now() / 1000) + expiresIn));
+    const signature = await hmac(appKey(), canonical(base, params));
+    params.set("signature", signature);
+    return `${base}?${params}`;
+}
+/** Whether a URL carries a valid, unexpired signature from `signStorageUrl()`. */
+export async function verifyStorageUrl(url) {
+    const parsed = new URL(url, "http://keel.local");
+    const signature = parsed.searchParams.get("signature");
+    if (!signature)
+        return false;
+    parsed.searchParams.delete("signature");
+    const expires = Number(parsed.searchParams.get("expires"));
+    if (!expires || expires < Math.floor(Date.now() / 1000))
+        return false;
+    const expected = await hmac(appKey(), canonical(parsed.pathname, parsed.searchParams));
+    return timingSafeEqual(signature, expected);
+}
 /** An in-memory `Disk` — the default; ideal for tests. Not shared across processes. */
 export class MemoryDisk {
     baseUrl;
@@ -26,11 +101,21 @@ export class MemoryDisk {
     constructor(baseUrl = "/storage") {
         this.baseUrl = baseUrl;
     }
-    async put(path, bytes) {
-        this.files.set(path, bytes);
+    async put(path, bytes, options = {}) {
+        this.files.set(path, {
+            bytes,
+            meta: {
+                size: bytes.byteLength,
+                contentType: options.contentType ?? contentTypeFor(path),
+                cacheControl: options.cacheControl,
+                visibility: options.visibility ?? "public",
+                lastModified: new Date(),
+                metadata: options.metadata,
+            },
+        });
     }
     async get(path) {
-        return this.files.get(path) ?? null;
+        return this.files.get(path)?.bytes ?? null;
     }
     async exists(path) {
         return this.files.has(path);
@@ -44,6 +129,18 @@ export class MemoryDisk {
     url(path) {
         return `${this.baseUrl}/${path}`;
     }
+    async metadata(path) {
+        return this.files.get(path)?.meta ?? null;
+    }
+    async copy(from, to) {
+        const entry = this.files.get(from);
+        if (entry)
+            this.files.set(to, { bytes: entry.bytes, meta: { ...entry.meta } });
+    }
+    async move(from, to) {
+        await this.copy(from, to);
+        this.files.delete(from);
+    }
 }
 /* -------------------------------- storage --------------------------------- */
 export class Storage {
@@ -51,9 +148,15 @@ export class Storage {
     constructor(disk) {
         this.disk = disk;
     }
-    /** Write a file (string, bytes, or ArrayBuffer — strings are UTF-8 encoded). */
-    put(path, contents) {
-        return this.disk.put(path, toBytes(contents));
+    /**
+     * Write a file (string, bytes, or ArrayBuffer — strings are UTF-8 encoded).
+     * The content type is inferred from the extension unless you pass one.
+     */
+    put(path, contents, options = {}) {
+        return this.disk.put(path, toBytes(contents), {
+            ...options,
+            contentType: options.contentType ?? contentTypeFor(path),
+        });
     }
     /** Read a file's raw bytes, or null if it doesn't exist. */
     get(path) {
@@ -73,16 +176,118 @@ export class Storage {
     list(prefix) {
         return this.disk.list(prefix);
     }
+    /** Size, content type, and friends — or null if the file doesn't exist. */
+    async metadata(path) {
+        if (this.disk.metadata)
+            return this.disk.metadata(path);
+        const bytes = await this.disk.get(path);
+        if (bytes == null)
+            return null;
+        return { size: bytes.byteLength, contentType: contentTypeFor(path) };
+    }
+    /** A file's size in bytes, or null if it doesn't exist. */
+    async size(path) {
+        return (await this.metadata(path))?.size ?? null;
+    }
+    /** Copy a file. Server-side when the disk supports it, else read-then-write. */
+    async copy(from, to) {
+        if (this.disk.copy)
+            return this.disk.copy(from, to);
+        const bytes = await this.disk.get(from);
+        if (bytes == null)
+            throw new Error(`Cannot copy "${from}": no such file.`);
+        const meta = await this.metadata(from);
+        await this.disk.put(to, bytes, {
+            contentType: meta?.contentType ?? contentTypeFor(to),
+            cacheControl: meta?.cacheControl,
+            visibility: meta?.visibility,
+            metadata: meta?.metadata,
+        });
+    }
+    /** Move a file. Server-side when the disk supports it, else copy-then-delete. */
+    async move(from, to) {
+        if (this.disk.move)
+            return this.disk.move(from, to);
+        await this.copy(from, to);
+        await this.disk.delete(from);
+    }
+    /** A public URL for the object. Use `signedUrl()` for private ones. */
     url(path) {
         return this.disk.url(path);
     }
+    /**
+     * A temporary URL for a private object. Uses the backend's own presigning when
+     * the disk implements `signedUrl` (S3, R2, GCS); otherwise signs the disk's
+     * `url()` with `config('app.key')` — serve those with `serveStorage({ signed: true })`.
+     */
+    async signedUrl(path, options = {}) {
+        if (this.disk.signedUrl)
+            return this.disk.signedUrl(path, options);
+        return signStorageUrl(this.disk.url(path), options.expiresIn ?? 3600);
+    }
+    /**
+     * A URL the browser can `PUT` the file to directly, so the bytes never transit
+     * your app — the point of this on the edge, where proxying a large upload
+     * through a Worker is exactly what you don't want.
+     *
+     * Only the backend can accept such a write, so this requires a disk that
+     * implements `signedUploadUrl` (see the S3/R2 recipe in the storage guide).
+     */
+    async signedUploadUrl(path, options = {}) {
+        if (!this.disk.signedUploadUrl) {
+            throw new Error("This disk does not support signed upload URLs. Implement `signedUploadUrl` on it " +
+                "(the storage guide has an S3/R2 recipe) — only the storage backend can accept a direct upload.");
+        }
+        return this.disk.signedUploadUrl(path, {
+            ...options,
+            contentType: options.contentType ?? contentTypeFor(path),
+        });
+    }
     /** The underlying driver, for backend-specific operations. */
     get driver() {
         return this.disk;
     }
 }
+/* --------------------------------- faking --------------------------------- */
+/**
+ * A `Storage` backed by a `MemoryDisk`, with assertions — what `fakeDisk()`
+ * installs so tests never touch a real bucket.
+ */
+export class FakeStorage extends Storage {
+    constructor() {
+        super(new MemoryDisk());
+    }
+    async assertExists(path) {
+        if (!(await this.exists(path))) {
+            throw new Error(`Expected "${path}" to exist on the fake disk, but it does not.`);
+        }
+    }
+    async assertMissing(path) {
+        if (await this.exists(path)) {
+            throw new Error(`Expected "${path}" to be missing from the fake disk, but it exists.`);
+        }
+    }
+    /** Assert a file's contents, as UTF-8 text. */
+    async assertContents(path, expected) {
+        await this.assertExists(path);
+        const actual = await this.getText(path);
+        if (actual !== expected) {
+            throw new Error(`Expected "${path}" to contain ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}.`);
+        }
+    }
+    /** Assert how many files are stored, optionally under a prefix. */
+    async assertCount(expected, prefix) {
+        const actual = (await this.list(prefix)).length;
+        if (actual !== expected) {
+            const where = prefix ? ` under "${prefix}"` : "";
+            throw new Error(`Expected ${expected} file(s)${where} on the fake disk, found ${actual}.`);
+        }
+    }
+}
 /* -------------------------------- global ---------------------------------- */
 const disks = new Map([["default", new Storage(new MemoryDisk())]]);
+/** Disks displaced by `fakeDisk()`, so `restoreDisk()` can put them back. */
+const realDisks = new Map();
 /** Register a disk, optionally under a name (default: `"default"`). */
 export function setDisk(disk, name = "default") {
     const store = new Storage(disk);
@@ -96,3 +301,78 @@ export function storage(name = "default") {
         throw new Error(`No storage disk named "${name}". Register it with setDisk().`);
     return store;
 }
+/**
+ * Swap a disk for an in-memory `FakeStorage` so tests never touch a real bucket,
+ * and assert against what was written. Undo with `restoreDisk()`.
+ *
+ *   const disk = fakeDisk();
+ *   await request.post("/avatars", form);
+ *   await disk.assertExists("avatars/1.png");
+ */
+export function fakeDisk(name = "default") {
+    const existing = disks.get(name);
+    // Only remember the *real* disk — faking twice must not stash a fake.
+    if (existing && !realDisks.has(name))
+        realDisks.set(name, existing);
+    const fake = new FakeStorage();
+    disks.set(name, fake);
+    return fake;
+}
+/** Restore the real disk after `fakeDisk()`. With no name, restores them all. */
+export function restoreDisk(name) {
+    const names = name ? [name] : [...realDisks.keys()];
+    for (const key of names) {
+        const real = realDisks.get(key);
+        if (real)
+            disks.set(key, real);
+        realDisks.delete(key);
+    }
+}
+/**
+ * Serve files from a disk over HTTP — what makes the fallback `signedUrl()` real
+ * for disks without backend presigning (the memory disk, a local-filesystem
+ * disk). Requests that don't match `basePath`, or that name a file the disk
+ * doesn't have, fall through to your routes.
+ *
+ *   this.use(serveStorage());                                  // public files
+ *   this.use(serveStorage({ basePath: "/private", signed: true }));
+ */
+export function serveStorage(options = {}) {
+    const basePath = (options.basePath ?? "/storage").replace(/\/+$/, "");
+    return async (c, next) => {
+        if (c.req.method !== "GET" && c.req.method !== "HEAD")
+            return next();
+        const url = new URL(c.req.url);
+        if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`))
+            return next();
+        const path = decodeURIComponent(url.pathname.slice(basePath.length + 1));
+        if (!path || path.includes(".."))
+            return next(); // path traversal guard
+        if (options.signed && !(await verifyStorageUrl(c.req.url))) {
+            return c.text("Forbidden", 403);
+        }
+        const store = storage(options.disk);
+        const bytes = await store.get(path);
+        if (bytes == null)
+            return next();
+        const meta = await store.metadata(path);
+        const etag = `W/"${meta?.size ?? bytes.byteLength}-${meta?.lastModified?.getTime() ?? 0}"`;
+        c.header("Content-Type", meta?.contentType ?? contentTypeFor(path));
+        c.header("ETag", etag);
+        if (meta?.lastModified)
+            c.header("Last-Modified", meta.lastModified.toUTCString());
+        const cacheControl = meta?.cacheControl ??
+            (options.maxAge != null
+                ? `${options.signed ? "private" : "public"}, max-age=${options.maxAge}`
+                : undefined);
+        if (cacheControl)
+            c.header("Cache-Control", cacheControl);
+        if (c.req.header("If-None-Match") === etag)
+            return c.body(null, 304);
+        if (c.req.method === "HEAD")
+            return c.body(null, 200);
+        // Copy out of the view's backing buffer — `bytes.buffer` alone may be larger.
+        const body = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+        return c.body(body, 200);
+    };
+}

package/dist/core/tokens.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Personal access tokens — opaque, database-backed bearer tokens for API and
+ * mobile clients, an alternative to the stateless [`jwt`](./crypto.ts). Unlike a
+ * JWT, an opaque token can be *revoked* instantly (it's a row you delete), carries
+ * *abilities* (scopes), and tracks *last used* — at the cost of a lookup per
+ * request. Built on the `db()` layer, so it runs anywhere a `Connection` does.
+ *
+ *   const { token } = await createToken(user.id, { abilities: ["posts:write"] });
+ *   // → "keel_<selector>.<verifier>"  — show once, never recoverable
+ *
+ *   const record = await verifyToken(token);  // { tokenableId, abilities, … } | null
+ *   tokenAllows(record, "posts:write");        // true
+ *
+ * Pair it with `tokenAuth()` in ./auth.ts to protect routes. The token splits
+ * into a public *selector* (indexed, for lookup) and a secret *verifier* (stored
+ * only as a SHA-256 hash) — so a leaked database can't mint working tokens, and
+ * verification needs no `RETURNING`/auto-increment (portable across every driver).
+ *
+ * Expected table (`personal_access_tokens` by default), all timestamps epoch-ms:
+ *   selector TEXT UNIQUE, hash TEXT, tokenable_id TEXT, name TEXT,
+ *   abilities TEXT (JSON), last_used_at INTEGER, expires_at INTEGER, created_at INTEGER
+ */
+/** A verified token, as returned by `verifyToken`. */
+export interface AccessToken {
+    /** Public lookup key (the part before the `.`). Pass to `revokeToken`. */
+    selector: string;
+    /** The id of the entity the token belongs to (usually a user id). */
+    tokenableId: string;
+    /** Optional human label, for a "your tokens" management screen. */
+    name: string | null;
+    /** Granted abilities/scopes; `["*"]` means all. */
+    abilities: string[];
+    /** Epoch-ms of last successful use, or null if never (updated on verify). */
+    lastUsedAt: number | null;
+    /** Epoch-ms expiry, or null for a token that never expires. */
+    expiresAt: number | null;
+}
+export interface CreateTokenOptions {
+    /** Abilities/scopes to grant. Defaults to `["*"]` (everything). */
+    abilities?: string[];
+    /** Lifetime — seconds (number) or a duration string (`"30d"`, `"12h"`). No expiry if omitted. */
+    expiresIn?: number | string;
+    /** A human label for the token. */
+    name?: string;
+    /** Which registered connection to store the token on. */
+    connection?: string;
+}
+export interface IssuedToken {
+    /** The plaintext token — `keel_<selector>.<verifier>`. Shown once; store the hash only. */
+    token: string;
+    selector: string;
+    abilities: string[];
+    expiresAt: number | null;
+}
+/** Change the table personal access tokens are stored in (default `personal_access_tokens`). */
+export declare function setTokensTable(name: string): void;
+/** Mint a new access token for an entity. Returns the plaintext once — persist nothing but the hash. */
+export declare function createToken(tokenableId: string | number, options?: CreateTokenOptions): Promise<IssuedToken>;
+/**
+ * Verify a plaintext token and return its record, or `null` if it's malformed,
+ * unknown, tampered, or expired. On success it stamps `last_used_at`. An expired
+ * token is deleted in passing, so the table self-prunes as stale tokens are tried.
+ */
+export declare function verifyToken(token: string, connection?: string): Promise<AccessToken | null>;
+/** Whether a verified token grants an ability (`["*"]` grants everything). */
+export declare function tokenAllows(token: AccessToken | null | undefined, ability: string): boolean;
+/** The negation of `tokenAllows`. */
+export declare function tokenDenies(token: AccessToken | null | undefined, ability: string): boolean;
+/** Revoke a single token by its selector (the part before the `.`). */
+export declare function revokeToken(selector: string, connection?: string): Promise<void>;
+/** Revoke every token belonging to an entity — a "log out everywhere" switch. */
+export declare function revokeTokens(tokenableId: string | number, connection?: string): Promise<void>;
+/** List an entity's tokens (metadata only — the secret is never stored). */
+export declare function listTokens(tokenableId: string | number, connection?: string): Promise<AccessToken[]>;

package/dist/core/tokens.js

@@ -0,0 +1,155 @@
+/**
+ * Personal access tokens — opaque, database-backed bearer tokens for API and
+ * mobile clients, an alternative to the stateless [`jwt`](./crypto.ts). Unlike a
+ * JWT, an opaque token can be *revoked* instantly (it's a row you delete), carries
+ * *abilities* (scopes), and tracks *last used* — at the cost of a lookup per
+ * request. Built on the `db()` layer, so it runs anywhere a `Connection` does.
+ *
+ *   const { token } = await createToken(user.id, { abilities: ["posts:write"] });
+ *   // → "keel_<selector>.<verifier>"  — show once, never recoverable
+ *
+ *   const record = await verifyToken(token);  // { tokenableId, abilities, … } | null
+ *   tokenAllows(record, "posts:write");        // true
+ *
+ * Pair it with `tokenAuth()` in ./auth.ts to protect routes. The token splits
+ * into a public *selector* (indexed, for lookup) and a secret *verifier* (stored
+ * only as a SHA-256 hash) — so a leaked database can't mint working tokens, and
+ * verification needs no `RETURNING`/auto-increment (portable across every driver).
+ *
+ * Expected table (`personal_access_tokens` by default), all timestamps epoch-ms:
+ *   selector TEXT UNIQUE, hash TEXT, tokenable_id TEXT, name TEXT,
+ *   abilities TEXT (JSON), last_used_at INTEGER, expires_at INTEGER, created_at INTEGER
+ */
+import { db } from "./database.js";
+/** The table tokens are stored in; override with `setTokensTable`. */
+let table = "personal_access_tokens";
+/** Change the table personal access tokens are stored in (default `personal_access_tokens`). */
+export function setTokensTable(name) {
+    table = name;
+}
+/* -------------------------------- crypto -------------------------------- */
+const DURATION = /^(\d+)\s*(s|m|h|d)$/;
+const UNIT = { s: 1, m: 60, h: 3600, d: 86400 };
+function seconds(value) {
+    if (typeof value === "number")
+        return value;
+    const match = DURATION.exec(value.trim());
+    if (!match)
+        throw new Error(`Invalid duration "${value}" (use e.g. 3600, "30m", "12h", "30d").`);
+    return Number(match[1]) * UNIT[match[2]];
+}
+function base64url(bytes) {
+    let s = "";
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken(size) {
+    return base64url(crypto.getRandomValues(new Uint8Array(size)));
+}
+/** SHA-256 of the verifier, base64url — what we actually persist. */
+async function sha256(value) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return base64url(new Uint8Array(digest));
+}
+/** Constant-time string compare, so a bad hash can't be timed byte-by-byte. */
+function safeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < a.length; i++)
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return result === 0;
+}
+/* ------------------------------- lifecycle ------------------------------ */
+/** Mint a new access token for an entity. Returns the plaintext once — persist nothing but the hash. */
+export async function createToken(tokenableId, options = {}) {
+    const selector = randomToken(12);
+    const verifier = randomToken(24);
+    const abilities = options.abilities ?? ["*"];
+    const expiresAt = options.expiresIn != null ? Date.now() + seconds(options.expiresIn) * 1000 : null;
+    await db(table, options.connection).insert({
+        selector,
+        hash: await sha256(verifier),
+        tokenable_id: String(tokenableId),
+        name: options.name ?? null,
+        abilities: JSON.stringify(abilities),
+        last_used_at: null,
+        expires_at: expiresAt,
+        created_at: Date.now(),
+    });
+    return { token: `keel_${selector}.${verifier}`, selector, abilities, expiresAt };
+}
+/**
+ * Verify a plaintext token and return its record, or `null` if it's malformed,
+ * unknown, tampered, or expired. On success it stamps `last_used_at`. An expired
+ * token is deleted in passing, so the table self-prunes as stale tokens are tried.
+ */
+export async function verifyToken(token, connection) {
+    const match = /^keel_([^.]+)\.(.+)$/.exec(token);
+    if (!match)
+        return null;
+    const selector = match[1];
+    const verifier = match[2];
+    const row = await db(table, connection).where("selector", selector).first();
+    if (!row)
+        return null;
+    if (!safeEqual(await sha256(verifier), String(row.hash)))
+        return null;
+    const expiresAt = row.expires_at != null ? Number(row.expires_at) : null;
+    if (expiresAt != null && Date.now() >= expiresAt) {
+        await db(table, connection).where("selector", selector).delete();
+        return null;
+    }
+    const now = Date.now();
+    await db(table, connection).where("selector", selector).update({ last_used_at: now });
+    return {
+        selector,
+        tokenableId: String(row.tokenable_id),
+        name: row.name ?? null,
+        abilities: parseAbilities(row.abilities),
+        lastUsedAt: now,
+        expiresAt,
+    };
+}
+/** Whether a verified token grants an ability (`["*"]` grants everything). */
+export function tokenAllows(token, ability) {
+    if (!token)
+        return false;
+    return token.abilities.includes("*") || token.abilities.includes(ability);
+}
+/** The negation of `tokenAllows`. */
+export function tokenDenies(token, ability) {
+    return !tokenAllows(token, ability);
+}
+/** Revoke a single token by its selector (the part before the `.`). */
+export async function revokeToken(selector, connection) {
+    await db(table, connection).where("selector", selector).delete();
+}
+/** Revoke every token belonging to an entity — a "log out everywhere" switch. */
+export async function revokeTokens(tokenableId, connection) {
+    await db(table, connection).where("tokenable_id", String(tokenableId)).delete();
+}
+/** List an entity's tokens (metadata only — the secret is never stored). */
+export async function listTokens(tokenableId, connection) {
+    const rows = await db(table, connection).where("tokenable_id", String(tokenableId)).get();
+    return rows.map((row) => ({
+        selector: String(row.selector),
+        tokenableId: String(row.tokenable_id),
+        name: row.name ?? null,
+        abilities: parseAbilities(row.abilities),
+        lastUsedAt: row.last_used_at != null ? Number(row.last_used_at) : null,
+        expiresAt: row.expires_at != null ? Number(row.expires_at) : null,
+    }));
+}
+function parseAbilities(value) {
+    if (typeof value !== "string")
+        return Array.isArray(value) ? value : ["*"];
+    try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) ? parsed : ["*"];
+    }
+    catch {
+        return ["*"];
+    }
+}

package/dist/db/d1.d.ts

@@ -0,0 +1,32 @@
+/**
+ * A Keel `Connection` for Cloudflare D1. Pass your D1 binding (from `env.DB`)
+ * and register it — dialect `"sqlite"`:
+ *
+ *   import { d1Connection } from "@shaferllc/keel/db/d1";
+ *   import { setConnection } from "@shaferllc/keel/core";
+ *
+ *   setConnection(d1Connection(env.DB), "sqlite");
+ *
+ * The binding is duck-typed — this module imports no driver and no
+ * `@cloudflare/workers-types`, so it stays edge-native and dependency-free. Any
+ * object shaped like a D1 database works.
+ */
+import type { Connection, Row } from "../core/database.js";
+/** The slice of the D1 `Database` API this adapter uses. */
+export interface D1Like {
+    prepare(sql: string): {
+        bind(...values: unknown[]): {
+            all<T = Row>(): Promise<{
+                results?: T[];
+            }>;
+            run(): Promise<{
+                meta: {
+                    changes?: number;
+                    last_row_id?: number;
+                };
+            }>;
+        };
+    };
+}
+/** Build a `Connection` backed by a Cloudflare D1 binding. */
+export declare function d1Connection(database: D1Like): Connection;

package/dist/db/d1.js

@@ -0,0 +1,26 @@
+/**
+ * A Keel `Connection` for Cloudflare D1. Pass your D1 binding (from `env.DB`)
+ * and register it — dialect `"sqlite"`:
+ *
+ *   import { d1Connection } from "@shaferllc/keel/db/d1";
+ *   import { setConnection } from "@shaferllc/keel/core";
+ *
+ *   setConnection(d1Connection(env.DB), "sqlite");
+ *
+ * The binding is duck-typed — this module imports no driver and no
+ * `@cloudflare/workers-types`, so it stays edge-native and dependency-free. Any
+ * object shaped like a D1 database works.
+ */
+/** Build a `Connection` backed by a Cloudflare D1 binding. */
+export function d1Connection(database) {
+    return {
+        async select(sql, bindings) {
+            const { results } = await database.prepare(sql).bind(...bindings).all();
+            return results ?? [];
+        },
+        async write(sql, bindings) {
+            const { meta } = await database.prepare(sql).bind(...bindings).run();
+            return { rowsAffected: meta.changes ?? 0, insertId: meta.last_row_id };
+        },
+    };
+}

package/dist/db/libsql.d.ts

@@ -0,0 +1,29 @@
+/**
+ * A Keel `Connection` for libSQL / Turso. Pass an `@libsql/client` client (it
+ * runs on Node and the edge — Turso speaks HTTP) and register it with dialect
+ * `"sqlite"`:
+ *
+ *   import { libsqlConnection } from "@shaferllc/keel/db/libsql";
+ *   import { setConnection } from "@shaferllc/keel/core";
+ *   import { createClient } from "@libsql/client";
+ *
+ *   const client = createClient({ url: env.TURSO_URL, authToken: env.TURSO_TOKEN });
+ *   setConnection(libsqlConnection(client), "sqlite");
+ *
+ * The client is duck-typed — this module imports no driver, so it never bundles
+ * `@libsql/client`.
+ */
+import type { Connection, Row } from "../core/database.js";
+/** The slice of the `@libsql/client` API this adapter uses. */
+export interface LibSqlLike {
+    execute(stmt: {
+        sql: string;
+        args: unknown[];
+    }): Promise<{
+        rows: Row[];
+        rowsAffected: number;
+        lastInsertRowid?: bigint | number;
+    }>;
+}
+/** Build a `Connection` backed by an `@libsql/client` client. */
+export declare function libsqlConnection(client: LibSqlLike): Connection;