@syncular/server 0.1.3 → 0.2.1

package/dist/auth-leases.js

@@ -1,368 +0,0 @@
-import { collectScopeVars, SYNC_AUTH_LEASE_ALG_ES256, SYNC_AUTH_LEASE_CODE_EXPIRED, SYNC_AUTH_LEASE_CODE_INVALID, SYNC_AUTH_LEASE_CODE_SCHEMA_MISMATCH, SYNC_AUTH_LEASE_CODE_SCOPE_MISMATCH, SYNC_AUTH_LEASE_CODE_SCOPE_REVOKED, SYNC_AUTH_LEASE_PROTOCOL_VERSION, SYNC_AUTH_LEASE_TYP, SYNC_AUTH_LEASE_VERSION, SyncAuthLeasePayloadSchema, } from '@syncular/core';
-import { sql } from 'kysely';
-import { resolveEffectiveScopesForSubscriptions } from './subscriptions/index.js';
-const textEncoder = new TextEncoder();
-const textDecoder = new TextDecoder();
-export async function issueAuthLease(options) {
-    const nowMs = options.nowMs?.() ?? Date.now();
-    const defaultTtlMs = positiveIntegerOrDefault(options.defaultTtlMs, 15 * 60 * 1000);
-    const maxTtlMs = positiveIntegerOrDefault(options.maxTtlMs, defaultTtlMs);
-    const requestedTtlMs = positiveIntegerOrDefault(options.request.ttlMs, defaultTtlMs);
-    const ttlMs = Math.min(requestedTtlMs, maxTtlMs);
-    const requestedSubscriptions = options.request.scopes.map((scope) => ({
-        id: scope.subscriptionId,
-        table: scope.table,
-        scopes: scope.values,
-        params: {},
-        cursor: -1,
-        crdtStateVectors: [],
-    }));
-    const resolved = await resolveEffectiveScopesForSubscriptions({
-        db: options.db,
-        auth: options.auth,
-        handlers: options.handlers,
-        scopeCache: options.scopeCache,
-        subscriptions: requestedSubscriptions,
-    });
-    const scopes = resolved
-        .filter((subscription) => subscription.status === 'active')
-        .map((subscription) => {
-        const requested = options.request.scopes.find((scope) => scope.subscriptionId === subscription.id);
-        return {
-            subscriptionId: subscription.id,
-            table: subscription.table,
-            values: subscription.scopes,
-            operations: requested?.operations ?? [],
-        };
-    })
-        .filter((scope) => scope.operations.length > 0);
-    if (scopes.length === 0) {
-        return null;
-    }
-    const payload = {
-        version: SYNC_AUTH_LEASE_VERSION,
-        leaseId: options.leaseId?.() ?? randomLeaseId(),
-        issuer: options.issuer,
-        audience: options.audience,
-        actorId: options.auth.actorId,
-        subject: (await options.subject?.(options.auth)) ?? {},
-        schemaVersion: options.request.schemaVersion,
-        protocolVersion: SYNC_AUTH_LEASE_PROTOCOL_VERSION,
-        issuedAtMs: nowMs,
-        notBeforeMs: nowMs,
-        expiresAtMs: nowMs + ttlMs,
-        maxClockSkewMs: Math.max(0, options.maxClockSkewMs ?? 30_000),
-        scopes,
-        capabilities: options.capabilities ?? {
-            allowBlobs: false,
-            allowCrdt: false,
-            allowEncryptedFields: false,
-        },
-    };
-    return signAuthLeaseToken({
-        kid: options.kid,
-        payload,
-        signer: options.signer,
-    });
-}
-export async function signAuthLeaseToken(args) {
-    const protectedHeader = {
-        alg: SYNC_AUTH_LEASE_ALG_ES256,
-        kid: args.kid,
-        typ: SYNC_AUTH_LEASE_TYP,
-    };
-    const payload = SyncAuthLeasePayloadSchema.parse(args.payload);
-    const signingInput = `${encodeJsonSegment(protectedHeader)}.${encodeJsonSegment(payload)}`;
-    const signature = await args.signer({
-        protectedHeader,
-        payload,
-        signingInput,
-    });
-    return {
-        ok: true,
-        token: `${signingInput}.${base64UrlEncode(signature)}`,
-        protectedHeader,
-        payload,
-    };
-}
-export function createWebCryptoEs256AuthLeaseSigner(args) {
-    return async ({ signingInput }) => new Uint8Array(await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, args.privateKey, textEncoder.encode(signingInput)));
-}
-export async function verifyAuthLeaseToken(options) {
-    const parts = options.token.split('.');
-    if (parts.length !== 3) {
-        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease token must have three JWS segments');
-    }
-    const protectedHeader = decodeJsonSegment(parts[0]);
-    if (!protectedHeader ||
-        protectedHeader.alg !== SYNC_AUTH_LEASE_ALG_ES256 ||
-        protectedHeader.typ !== SYNC_AUTH_LEASE_TYP) {
-        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease token has unsupported protected header');
-    }
-    const signature = base64UrlDecode(parts[2]);
-    if (!signature) {
-        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease signature segment is invalid');
-    }
-    const signingInput = `${parts[0]}.${parts[1]}`;
-    const verified = await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, options.publicKey, toBufferSource(signature), textEncoder.encode(signingInput));
-    if (!verified) {
-        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease signature verification failed', { kid: protectedHeader.kid });
-    }
-    const rawPayload = decodeJsonSegment(parts[1]);
-    const parsedPayload = SyncAuthLeasePayloadSchema.safeParse(rawPayload);
-    if (!parsedPayload.success) {
-        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease payload is invalid', {
-            kid: protectedHeader.kid,
-        });
-    }
-    const payload = parsedPayload.data;
-    if (options.expectedIssuer !== undefined &&
-        payload.issuer !== options.expectedIssuer) {
-        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease issuer mismatch', {
-            leaseId: payload.leaseId,
-            kid: protectedHeader.kid,
-        });
-    }
-    if (options.expectedAudience !== undefined &&
-        payload.audience !== options.expectedAudience) {
-        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease audience mismatch', {
-            leaseId: payload.leaseId,
-            kid: protectedHeader.kid,
-        });
-    }
-    if (options.expectedSchemaVersion !== undefined &&
-        payload.schemaVersion !== options.expectedSchemaVersion) {
-        return rejected(SYNC_AUTH_LEASE_CODE_SCHEMA_MISMATCH, 'auth lease schema version mismatch', { leaseId: payload.leaseId, kid: protectedHeader.kid });
-    }
-    const nowMs = options.nowMs ?? Date.now();
-    const skewMs = Math.max(0, payload.maxClockSkewMs);
-    if (nowMs + skewMs < payload.notBeforeMs) {
-        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease is not valid yet', {
-            leaseId: payload.leaseId,
-            kid: protectedHeader.kid,
-        });
-    }
-    if (nowMs - skewMs > payload.expiresAtMs) {
-        return rejected(SYNC_AUTH_LEASE_CODE_EXPIRED, 'auth lease is expired', {
-            leaseId: payload.leaseId,
-            kid: protectedHeader.kid,
-            expiresAtMs: payload.expiresAtMs,
-        });
-    }
-    return { ok: true, protectedHeader, payload };
-}
-export function authLeaseCoversOperation(args) {
-    const leaseScope = args.payload.scopes.find((scope) => scope.table === args.table &&
-        scope.operations.some((operation) => operation === args.op));
-    if (!leaseScope) {
-        return rejected(SYNC_AUTH_LEASE_CODE_SCOPE_MISMATCH, 'auth lease does not cover operation table or type', { leaseId: args.payload.leaseId });
-    }
-    for (const [key, value] of Object.entries(args.scopes)) {
-        if (!scopeValueCovers(leaseScope.values[key], value)) {
-            return rejected(SYNC_AUTH_LEASE_CODE_SCOPE_MISMATCH, 'auth lease does not cover scope', {
-                leaseId: args.payload.leaseId,
-            });
-        }
-    }
-    return null;
-}
-export async function validateAuthLeaseOperation(options) {
-    const requiredScopeKeys = Array.from(collectScopeVars(options.handler.scopePatterns));
-    const extracted = await extractOperationScopes({
-        db: options.db,
-        handler: options.handler,
-        operation: options.operation,
-    });
-    const requiresScopeValues = requiredScopeKeys.length > 0 && extracted.rowExistsOrWillBeWritten;
-    if (requiresScopeValues &&
-        requiredScopeKeys.some((key) => typeof extracted.scopes[key] !== 'string' ||
-            extracted.scopes[key].length === 0)) {
-        return authLeaseOperationError({
-            opIndex: options.opIndex,
-            code: SYNC_AUTH_LEASE_CODE_SCOPE_MISMATCH,
-            error: 'Auth lease operation scopes could not be extracted',
-        });
-    }
-    const leaseCoverage = authLeaseCoversOperation({
-        payload: options.payload,
-        table: options.operation.table,
-        op: options.operation.op,
-        scopes: extracted.scopes,
-    });
-    if (leaseCoverage) {
-        return authLeaseOperationError({
-            opIndex: options.opIndex,
-            code: leaseCoverage.code,
-            error: leaseCoverage.message,
-        });
-    }
-    if (requiresScopeValues) {
-        let currentScopes;
-        try {
-            currentScopes = await options.handler.resolveScopes({
-                db: options.db,
-                actorId: options.auth.actorId,
-                auth: options.auth,
-            });
-        }
-        catch {
-            return authLeaseOperationError({
-                opIndex: options.opIndex,
-                code: SYNC_AUTH_LEASE_CODE_SCOPE_REVOKED,
-                error: 'Auth lease scopes could not be resolved for replay',
-            });
-        }
-        if (!storedScopesCoveredByScopeValues({
-            storedScopes: extracted.scopes,
-            allowedScopes: currentScopes,
-            requiredScopeKeys,
-        })) {
-            return authLeaseOperationError({
-                opIndex: options.opIndex,
-                code: SYNC_AUTH_LEASE_CODE_SCOPE_REVOKED,
-                error: 'Auth lease scope is no longer authorized',
-            });
-        }
-    }
-    return null;
-}
-async function extractOperationScopes(args) {
-    const existingRow = await readExistingRow({
-        db: args.db,
-        table: args.operation.table,
-        primaryKeyColumn: args.handler.primaryKeyColumn ?? 'id',
-        rowId: args.operation.row_id,
-    });
-    if (existingRow) {
-        return {
-            scopes: args.handler.extractScopes(existingRow),
-            rowExistsOrWillBeWritten: true,
-        };
-    }
-    if (args.operation.op === 'delete') {
-        return { scopes: {}, rowExistsOrWillBeWritten: false };
-    }
-    const payloadRecord = args.operation.payload &&
-        typeof args.operation.payload === 'object' &&
-        !Array.isArray(args.operation.payload)
-        ? args.operation.payload
-        : {};
-    return {
-        scopes: args.handler.extractScopes({
-            ...payloadRecord,
-            [args.handler.primaryKeyColumn ?? 'id']: args.operation.row_id,
-        }),
-        rowExistsOrWillBeWritten: true,
-    };
-}
-async function readExistingRow(args) {
-    const result = await sql `
-    SELECT *
-    FROM ${sql.table(args.table)}
-    WHERE ${sql.ref(args.primaryKeyColumn)} = ${args.rowId}
-    LIMIT 1
-  `.execute(args.db);
-    return result.rows[0] ?? null;
-}
-function storedScopesCoveredByScopeValues(args) {
-    for (const key of args.requiredScopeKeys) {
-        const storedValue = args.storedScopes[key];
-        if (typeof storedValue !== 'string' || storedValue.length === 0) {
-            return false;
-        }
-        if (!scopeValueCovers(args.allowedScopes[key], storedValue)) {
-            return false;
-        }
-    }
-    return true;
-}
-function authLeaseOperationError(args) {
-    return {
-        opIndex: args.opIndex,
-        status: 'error',
-        error: args.error,
-        code: args.code,
-        retriable: false,
-    };
-}
-function scopeValueCovers(leaseValue, requestedValue) {
-    if (leaseValue === undefined)
-        return false;
-    const leaseValues = Array.isArray(leaseValue) ? leaseValue : [leaseValue];
-    const requestedValues = Array.isArray(requestedValue)
-        ? requestedValue
-        : [requestedValue];
-    if (leaseValues.includes('*'))
-        return true;
-    return requestedValues.every((value) => leaseValues.includes(value));
-}
-function positiveIntegerOrDefault(value, defaultValue) {
-    return typeof value === 'number' && Number.isInteger(value) && value > 0
-        ? value
-        : defaultValue;
-}
-function randomLeaseId() {
-    if (typeof crypto !== 'undefined' &&
-        typeof crypto.randomUUID === 'function') {
-        return `lease_${crypto.randomUUID()}`;
-    }
-    return `lease_${Date.now().toString(36)}_${Math.random()
-        .toString(36)
-        .slice(2)}`;
-}
-function encodeJsonSegment(value) {
-    return base64UrlEncode(textEncoder.encode(JSON.stringify(value)));
-}
-function decodeJsonSegment(segment) {
-    const bytes = base64UrlDecode(segment);
-    if (!bytes)
-        return null;
-    try {
-        return JSON.parse(textDecoder.decode(bytes));
-    }
-    catch {
-        return null;
-    }
-}
-function base64UrlEncode(bytes) {
-    let binary = '';
-    for (const byte of bytes) {
-        binary += String.fromCharCode(byte);
-    }
-    return btoa(binary)
-        .replaceAll('+', '-')
-        .replaceAll('/', '_')
-        .replaceAll('=', '');
-}
-function base64UrlDecode(value) {
-    const normalized = value.replaceAll('-', '+').replaceAll('_', '/');
-    const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=');
-    try {
-        const binary = atob(padded);
-        const bytes = new Uint8Array(binary.length);
-        for (let index = 0; index < binary.length; index += 1) {
-            bytes[index] = binary.charCodeAt(index);
-        }
-        return bytes;
-    }
-    catch {
-        return null;
-    }
-}
-function toBufferSource(bytes) {
-    if (bytes.buffer instanceof ArrayBuffer) {
-        return new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-    }
-    const owned = new Uint8Array(bytes.byteLength);
-    owned.set(bytes);
-    return owned;
-}
-function rejected(code, message, details = {}) {
-    return {
-        ok: false,
-        code,
-        message,
-        ...details,
-    };
-}
-//# sourceMappingURL=auth-leases.js.map

package/dist/auth-leases.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-leases.js","sourceRoot":"","sources":["../src/auth-leases.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAGhB,yBAAyB,EACzB,4BAA4B,EAC5B,4BAA4B,EAC5B,oCAAoC,EACpC,mCAAmC,EACnC,kCAAkC,EAClC,gCAAgC,EAChC,mBAAmB,EACnB,uBAAuB,EAKvB,0BAA0B,GAI3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAe,GAAG,EAAE,MAAM,QAAQ,CAAC;AAK1C,OAAO,EAAE,sCAAsC,EAAE,MAAM,iBAAiB,CAAC;AAGzE,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AACtC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAmFtC,MAAM,CAAC,KAAK,UAAU,cAAc,CAIlC,OAAwC;IAExC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,wBAAwB,CAC3C,OAAO,CAAC,YAAY,EACpB,EAAE,GAAG,EAAE,GAAG,IAAI,CACf,CAAC;IACF,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,wBAAwB,CAC7C,OAAO,CAAC,OAAO,CAAC,KAAK,EACrB,YAAY,CACb,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,KAAK,CAAC,cAAc;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,CAAC,CAAC;QACV,gBAAgB,EAAE,EAAE;KACrB,CAAC,CAAC,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa,EAAE,sBAAsB;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,QAAQ;SACpB,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC;SAC1D,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;QACpB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,EAAE,CACpD,CAAC;QACF,OAAO;YACL,cAAc,EAAE,YAAY,CAAC,EAAE;YAC/B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,UAAU,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE;SACxC,CAAC;IACJ,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAElD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAyB;QACpC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,aAAa,EAAE;QAC/C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;QAC7B,OAAO,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;QACtD,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;QAC5C,eAAe,EAAE,gCAAgC;QACjD,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,KAAK,GAAG,KAAK;QAC1B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC;QAC7D,MAAM;QACN,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI;YACpC,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,KAAK;YAChB,oBAAoB,EAAE,KAAK;SAC5B;KACF,CAAC;IAEF,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,eAAe,GAAiC;QACpD,GAAG,EAAE,yBAAyB;QAC9B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,mBAAmB;KACzB,CAAC;IACF,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,GAAG,iBAAiB,CAAC,eAAe,CAAC,IAAI,iBAAiB,CAC7E,OAAO,CACR,EAAE,CAAC;IACJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;QAClC,eAAe;QACf,OAAO;QACP,YAAY;KACb,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,GAAG,YAAY,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE;QACtD,eAAe;QACf,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,IAEnD;IACC,OAAO,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAChC,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACtB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,IAAI,CAAC,UAAU,EACf,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CACjC,CACF,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,QAAQ,CACb,4BAA4B,EAC5B,+CAA+C,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CACvC,KAAK,CAAC,CAAC,CAAE,CACV,CAAC;IACF,IACE,CAAC,eAAe;QAChB,eAAe,CAAC,GAAG,KAAK,yBAAyB;QACjD,eAAe,CAAC,GAAG,KAAK,mBAAmB,EAC3C,CAAC;QACD,OAAO,QAAQ,CACb,4BAA4B,EAC5B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,QAAQ,CACb,4BAA4B,EAC5B,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACzC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,OAAO,CAAC,SAAS,EACjB,cAAc,CAAC,SAAS,CAAC,EACzB,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CACjC,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CACb,4BAA4B,EAC5B,0CAA0C,EAC1C,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,CAC7B,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAU,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,0BAA0B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,QAAQ,CACb,4BAA4B,EAC5B,+BAA+B,EAC/B;YACE,GAAG,EAAE,eAAe,CAAC,GAAG;SACzB,CACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC;IACnC,IACE,OAAO,CAAC,cAAc,KAAK,SAAS;QACpC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,EACzC,CAAC;QACD,OAAO,QAAQ,CACb,4BAA4B,EAC5B,4BAA4B,EAC5B;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,eAAe,CAAC,GAAG;SACzB,CACF,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACtC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,gBAAgB,EAC7C,CAAC;QACD,OAAO,QAAQ,CACb,4BAA4B,EAC5B,8BAA8B,EAC9B;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,eAAe,CAAC,GAAG;SACzB,CACF,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,qBAAqB,EACvD,CAAC;QACD,OAAO,QAAQ,CACb,oCAAoC,EACpC,oCAAoC,EACpC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,QAAQ,CACb,4BAA4B,EAC5B,6BAA6B,EAC7B;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,eAAe,CAAC,GAAG;SACzB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,QAAQ,CAAC,4BAA4B,EAAE,uBAAuB,EAAE;YACrE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,eAAe,CAAC,GAAG;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAKxC;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CACzC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QAC1B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC,CAC9D,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,QAAQ,CACb,mCAAmC,EACnC,mDAAmD,EACnD,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAClC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,QAAQ,CACb,mCAAmC,EACnC,iCAAiC,EACjC;gBACE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;aAC9B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAI9C,OAAoD;IAEpD,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAClC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAChD,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC;QAC7C,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,wBAAwB,CAAC;IACrE,IACE,mBAAmB;QACnB,iBAAiB,CAAC,IAAI,CACpB,CAAC,GAAG,EAAE,EAAE,CACN,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YACzC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CACrC,EACD,CAAC;QACD,OAAO,uBAAuB,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,mCAAmC;YACzC,KAAK,EAAE,oDAAoD;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK;QAC9B,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QACxB,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAC,CAAC;IACH,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,uBAAuB,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,KAAK,EAAE,aAAa,CAAC,OAAO;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,aAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;gBAClD,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;gBAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,uBAAuB,CAAC;gBAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,kCAAkC;gBACxC,KAAK,EAAE,oDAAoD;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IACE,CAAC,gCAAgC,CAAC;YAChC,YAAY,EAAE,SAAS,CAAC,MAAM;YAC9B,aAAa,EAAE,aAAa;YAC5B,iBAAiB;SAClB,CAAC,EACF,CAAC;YACD,OAAO,uBAAuB,CAAC;gBAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,kCAAkC;gBACxC,KAAK,EAAE,0CAA0C;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,sBAAsB,CAGnC,IAID;IACC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC;QACxC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;QAC3B,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI;QACvD,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;KAC7B,CAAC,CAAC;IAEH,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC;YAC/C,wBAAwB,EAAE,IAAI;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,aAAa,GACjB,IAAI,CAAC,SAAS,CAAC,OAAO;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;QAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO;QACxB,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YACjC,GAAG,aAAa;YAChB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;SAC/D,CAAC;QACF,wBAAwB,EAAE,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAwB,IAKrD;IACC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAyB;;WAExC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,KAAK;;GAEvD,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,gCAAgC,CAAC,IAIzC;IACC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,IAIhC;IACC,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAA2C,EAC3C,cAAmC;IAEnC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QACnD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACrB,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,YAAoB;IAEpB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACtE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,YAAY,CAAC;AACnB,CAAC;AAED,SAAS,aAAa;IACpB,IACE,OAAO,MAAM,KAAK,WAAW;QAC7B,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EACvC,CAAC;QACD,OAAO,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE;SACrD,QAAQ,CAAC,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,iBAAiB,CAAI,OAAe;IAC3C,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAM,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAC9B,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EACvD,GAAG,CACJ,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,IAAI,KAAK,CAAC,MAAM,YAAY,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/C,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CACf,IAAY,EACZ,OAAe,EACf,OAAO,GAAkE,EAAE;IAE3E,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,OAAO;QACP,GAAG,OAAO;KACX,CAAC;AACJ,CAAC"}

package/dist/better-sqlite3.d.ts

@@ -1,22 +0,0 @@
-/**
- * @syncular/server/better-sqlite3 - better-sqlite3 dialect for sync
- *
- * Provides a Kysely dialect for better-sqlite3 (Node.js).
- * SQLite-compatible — use with @syncular/server/sqlite.
- */
-import type { Database as BetterSqlite3Database } from 'better-sqlite3';
-import { SqliteDialect } from 'kysely';
-export interface BetterSqlite3PathOptions {
-    /** Path to SQLite database file, or ':memory:' for in-memory */
-    path: string;
-}
-export interface BetterSqlite3InstanceOptions {
-    /** An existing better-sqlite3 Database instance */
-    database: BetterSqlite3Database;
-}
-export type BetterSqlite3Options = BetterSqlite3PathOptions | BetterSqlite3InstanceOptions;
-/**
- * Create the better-sqlite3 dialect directly.
- */
-export declare function createBetterSqlite3Dialect(options: BetterSqlite3Options): SqliteDialect;
-//# sourceMappingURL=better-sqlite3.d.ts.map

package/dist/better-sqlite3.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"better-sqlite3.d.ts","sourceRoot":"","sources":["../src/better-sqlite3.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,IAAI,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEvC,MAAM,WAAW,wBAAwB;IACvC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,mDAAmD;IACnD,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,MAAM,oBAAoB,GAC5B,wBAAwB,GACxB,4BAA4B,CAAC;AAEjC;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,oBAAoB,GAC5B,aAAa,CAIf"}

package/dist/better-sqlite3.js

@@ -1,16 +0,0 @@
-/**
- * @syncular/server/better-sqlite3 - better-sqlite3 dialect for sync
- *
- * Provides a Kysely dialect for better-sqlite3 (Node.js).
- * SQLite-compatible — use with @syncular/server/sqlite.
- */
-import Database from 'better-sqlite3';
-import { SqliteDialect } from 'kysely';
-/**
- * Create the better-sqlite3 dialect directly.
- */
-export function createBetterSqlite3Dialect(options) {
-    const database = 'database' in options ? options.database : new Database(options.path);
-    return new SqliteDialect({ database });
-}
-//# sourceMappingURL=better-sqlite3.js.map

package/dist/better-sqlite3.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"better-sqlite3.js","sourceRoot":"","sources":["../src/better-sqlite3.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAgBvC;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA6B;IAE7B,MAAM,QAAQ,GACZ,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/blobs/access.d.ts

@@ -1,35 +0,0 @@
-import { type Kysely } from 'kysely';
-import type { ServerTableHandler, SyncServerAuth } from '../handlers/types';
-import type { SyncCoreDb } from '../schema';
-export type ScopedBlobAccessDecisionReason = 'allowed' | 'handler_missing' | 'missing_reference' | 'resolve_scopes_failed' | 'scope_denied';
-export interface ScopedBlobAccessDecision {
-    actorId: string;
-    partitionId: string;
-    hash: string;
-    allowed: boolean;
-    reason: ScopedBlobAccessDecisionReason;
-    table?: string;
-    column?: string;
-    rowId?: string;
-}
-export interface ScopedBlobReferenceTable {
-    table: string;
-    blobColumns: readonly string[];
-    primaryKeyColumn?: string;
-    candidateLimit?: number;
-}
-export interface CreateScopedBlobAccessCheckerOptions<DB extends SyncCoreDb = SyncCoreDb, Auth extends SyncServerAuth = SyncServerAuth> {
-    db: Kysely<DB>;
-    handlers: readonly ServerTableHandler<DB, Auth>[];
-    references: readonly ScopedBlobReferenceTable[];
-    candidateLimit?: number;
-    onDecision?: (decision: ScopedBlobAccessDecision) => void;
-}
-export interface ScopedBlobAccessRequest<Auth extends SyncServerAuth> {
-    actorId: string;
-    partitionId: string;
-    hash: string;
-    auth?: Auth;
-}
-export declare function createScopedBlobAccessChecker<DB extends SyncCoreDb, Auth extends SyncServerAuth = SyncServerAuth>(options: CreateScopedBlobAccessCheckerOptions<DB, Auth>): (request: ScopedBlobAccessRequest<Auth>) => Promise<boolean>;
-//# sourceMappingURL=access.d.ts.map

package/dist/blobs/access.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/blobs/access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,MAAM,8BAA8B,GACtC,SAAS,GACT,iBAAiB,GACjB,mBAAmB,GACnB,uBAAuB,GACvB,cAAc,CAAC;AAEnB,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,8BAA8B,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oCAAoC,CACnD,EAAE,SAAS,UAAU,GAAG,UAAU,EAClC,IAAI,SAAS,cAAc,GAAG,cAAc;IAE5C,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACf,QAAQ,EAAE,SAAS,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;IAClD,UAAU,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,wBAAwB,KAAK,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,uBAAuB,CAAC,IAAI,SAAS,cAAc;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED,wBAAgB,6BAA6B,CAC3C,EAAE,SAAS,UAAU,EACrB,IAAI,SAAS,cAAc,GAAG,cAAc,EAE5C,OAAO,EAAE,oCAAoC,CAAC,EAAE,EAAE,IAAI,CAAC,GACtD,CAAC,OAAO,EAAE,uBAAuB,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CA8G9D"}

package/dist/blobs/access.js

@@ -1,149 +0,0 @@
-import { collectScopeVars } from '@syncular/core';
-import { sql } from 'kysely';
-import { rowScopesAllowed } from '../helpers/scope-authorization.js';
-export function createScopedBlobAccessChecker(options) {
-    const handlersByTable = new Map(options.handlers.map((handler) => [handler.table, handler]));
-    const candidateLimit = options.candidateLimit ?? 100;
-    const emit = (decision) => {
-        options.onDecision?.(decision);
-    };
-    return async (request) => {
-        let deniedDecision = null;
-        let configurationDecision = null;
-        for (const reference of options.references) {
-            if (reference.blobColumns.length === 0)
-                continue;
-            const rows = await readBlobReferenceCandidateRows({
-                db: options.db,
-                table: reference.table,
-                columns: reference.blobColumns,
-                hash: request.hash,
-                limit: reference.candidateLimit ?? candidateLimit,
-            });
-            if (rows.length === 0) {
-                continue;
-            }
-            const handler = handlersByTable.get(reference.table);
-            if (!handler) {
-                configurationDecision ??= {
-                    ...request,
-                    allowed: false,
-                    reason: 'handler_missing',
-                    table: reference.table,
-                };
-                continue;
-            }
-            const allowedScopes = await resolveBlobAccessScopes({
-                db: options.db,
-                handler,
-                request,
-            });
-            if (!allowedScopes.ok) {
-                configurationDecision ??= {
-                    ...request,
-                    allowed: false,
-                    reason: 'resolve_scopes_failed',
-                    table: reference.table,
-                };
-                continue;
-            }
-            const requiredScopeKeys = Array.from(collectScopeVars(handler.scopePatterns));
-            for (const row of rows) {
-                const matchedColumn = reference.blobColumns.find((column) => blobColumnMatchesHash(row[column], request.hash));
-                if (!matchedColumn)
-                    continue;
-                const rowScopes = handler.extractScopes(row);
-                if (!rowScopesAllowed({
-                    rowScopes,
-                    allowedScopes: allowedScopes.scopes,
-                    requiredScopeKeys,
-                })) {
-                    deniedDecision ??= {
-                        ...request,
-                        allowed: false,
-                        reason: 'scope_denied',
-                        table: reference.table,
-                        column: matchedColumn,
-                        rowId: readRowId(row, reference.primaryKeyColumn ?? handler.primaryKeyColumn),
-                    };
-                    continue;
-                }
-                emit({
-                    ...request,
-                    allowed: true,
-                    reason: 'allowed',
-                    table: reference.table,
-                    column: matchedColumn,
-                    rowId: readRowId(row, reference.primaryKeyColumn ?? handler.primaryKeyColumn),
-                });
-                return true;
-            }
-        }
-        emit(deniedDecision ??
-            configurationDecision ?? {
-            ...request,
-            allowed: false,
-            reason: 'missing_reference',
-        });
-        return false;
-    };
-}
-async function resolveBlobAccessScopes(args) {
-    try {
-        const scopes = await args.handler.resolveScopes({
-            db: args.db,
-            actorId: args.request.actorId,
-            auth: args.request.auth ??
-                {
-                    actorId: args.request.actorId,
-                    partitionId: args.request.partitionId,
-                },
-        });
-        return { ok: true, scopes };
-    }
-    catch {
-        return { ok: false };
-    }
-}
-async function readBlobReferenceCandidateRows(args) {
-    const pattern = `%${args.hash}%`;
-    const predicates = args.columns.map((column) => sql `${sql.ref(column)} like ${pattern}`);
-    const result = await sql `
-    select *
-    from ${sql.table(args.table)}
-    where ${sql.join(predicates, sql ` or `)}
-    limit ${args.limit}
-  `.execute(args.db);
-    return result.rows;
-}
-function readRowId(row, primaryKeyColumn) {
-    const column = primaryKeyColumn ?? 'id';
-    const value = row[column];
-    return value === null || value === undefined ? undefined : String(value);
-}
-function blobColumnMatchesHash(value, hash) {
-    const parsed = parseMaybeJson(value);
-    if (isBlobRefHash(parsed, hash))
-        return true;
-    if (Array.isArray(parsed)) {
-        return parsed.some((entry) => isBlobRefHash(parseMaybeJson(entry), hash));
-    }
-    return false;
-}
-function parseMaybeJson(value) {
-    if (typeof value !== 'string')
-        return value;
-    try {
-        return JSON.parse(value);
-    }
-    catch {
-        return value;
-    }
-}
-function isBlobRefHash(value, hash) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        return false;
-    }
-    return value.hash === hash;
-}
-//# sourceMappingURL=access.js.map

package/dist/blobs/access.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/blobs/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAoB,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAe,GAAG,EAAE,MAAM,QAAQ,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AA8ClE,MAAM,UAAU,6BAA6B,CAI3C,OAAuD;IAEvD,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,GAAG,CAAC;IAErD,MAAM,IAAI,GAAG,CAAC,QAAkC,EAAQ,EAAE;QACxD,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,cAAc,GAAoC,IAAI,CAAC;QAC3D,IAAI,qBAAqB,GAAoC,IAAI,CAAC;QAElE,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAEjD,MAAM,IAAI,GAAG,MAAM,8BAA8B,CAAC;gBAChD,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,OAAO,EAAE,SAAS,CAAC,WAAW;gBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,SAAS,CAAC,cAAc,IAAI,cAAc;aAClD,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,qBAAqB,KAAK;oBACxB,GAAG,OAAO;oBACV,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,iBAAiB;oBACzB,KAAK,EAAE,SAAS,CAAC,KAAK;iBACvB,CAAC;gBACF,SAAS;YACX,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC;gBAClD,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO;gBACP,OAAO;aACR,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,qBAAqB,KAAK;oBACxB,GAAG,OAAO;oBACV,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uBAAuB;oBAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;iBACvB,CAAC;gBACF,SAAS;YACX,CAAC;YAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAClC,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CACxC,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,aAAa,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1D,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CACjD,CAAC;gBACF,IAAI,CAAC,aAAa;oBAAE,SAAS;gBAE7B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBAC7C,IACE,CAAC,gBAAgB,CAAC;oBAChB,SAAS;oBACT,aAAa,EAAE,aAAa,CAAC,MAAM;oBACnC,iBAAiB;iBAClB,CAAC,EACF,CAAC;oBACD,cAAc,KAAK;wBACjB,GAAG,OAAO;wBACV,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,cAAc;wBACtB,KAAK,EAAE,SAAS,CAAC,KAAK;wBACtB,MAAM,EAAE,aAAa;wBACrB,KAAK,EAAE,SAAS,CACd,GAAG,EACH,SAAS,CAAC,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CACvD;qBACF,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC;oBACH,GAAG,OAAO;oBACV,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,SAAS;oBACjB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,MAAM,EAAE,aAAa;oBACrB,KAAK,EAAE,SAAS,CACd,GAAG,EACH,SAAS,CAAC,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CACvD;iBACF,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CACF,cAAc;YACZ,qBAAqB,IAAI;YACvB,GAAG,OAAO;YACV,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mBAAmB;SAC5B,CACJ,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAGpC,IAID;IACC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC9C,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,IAAI,EACF,IAAI,CAAC,OAAO,CAAC,IAAI;gBAChB;oBACC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;oBAC7B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;iBAC7B;SACb,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAwB,IAMpE;IACC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CACjC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,OAAO,EAAE,CACpD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAyB;;WAExC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAA,MAAM,CAAC;YAC/B,IAAI,CAAC,KAAK;GACnB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAChB,GAA4B,EAC5B,gBAAoC;IAEpC,MAAM,MAAM,GAAG,gBAAgB,IAAI,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,IAAY;IACzD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAQ,KAA4B,CAAC,IAAI,KAAK,IAAI,CAAC;AACrD,CAAC"}