@takosjp/yurucommu-core 3.4.5 → 4.1.0

package/src/backend/runtime/s3-fetch.ts

@@ -0,0 +1,380 @@
+import type {
+  ObjectStore,
+  ObjectStoreBody,
+  ObjectStoreObject,
+  ObjectStorePutOptions,
+} from "./types.ts";
+
+/**
+ * The host supplies a Fetch-compatible capability that is already scoped to
+ * one object bucket. The adapter never receives (or needs) an endpoint,
+ * bucket name, region, or credential.
+ */
+export interface S3ObjectFetcher {
+  fetch(request: Request): Promise<Response>;
+}
+
+export interface S3FetchObjectStoreOptions {
+  /** Maximum number of bytes a GET may expose to the application. */
+  readonly maxObjectBytes?: number;
+}
+
+export type S3FetchObjectOperation = "put" | "get" | "delete";
+
+/** An S3 protocol failure without response-body or endpoint details. */
+export class S3FetchObjectStoreError extends Error {
+  constructor(
+    readonly operation: S3FetchObjectOperation,
+    readonly code: string,
+    readonly status?: number,
+  ) {
+    super(code);
+    this.name = "S3FetchObjectStoreError";
+  }
+}
+
+const SYNTHETIC_ORIGIN = "https://s3.invalid";
+const DEFAULT_MAX_OBJECT_BYTES = 64 * 1024 * 1024;
+const MAX_HEADER_VALUE_LENGTH = 8 * 1024;
+const FETCH_REJECTION_CODES: Record<S3FetchObjectOperation, string> = {
+  put: "s3_fetcher_put_rejected",
+  get: "s3_fetcher_get_rejected",
+  delete: "s3_fetcher_delete_rejected",
+};
+
+/**
+ * Adapt a bucket-scoped S3 HTTP Fetcher to the core's provider-neutral object
+ * store contract.
+ *
+ * The URL is intentionally synthetic. A host-owned Fetcher receives the
+ * request and supplies the actual endpoint and credentials internally; no
+ * provider materialization can escape through this public adapter.
+ */
+export function createS3FetchObjectStore(
+  fetcher: S3ObjectFetcher,
+  options: S3FetchObjectStoreOptions = {},
+): ObjectStore {
+  if (!fetcher || typeof fetcher.fetch !== "function") {
+    throw new TypeError("s3_fetcher_invalid");
+  }
+  const maxObjectBytes = options.maxObjectBytes ?? DEFAULT_MAX_OBJECT_BYTES;
+  assertMaxObjectBytes(maxObjectBytes);
+
+  return new S3FetchObjectStore(fetcher, maxObjectBytes);
+}
+
+class S3FetchObjectStore implements ObjectStore {
+  constructor(
+    private readonly fetcher: S3ObjectFetcher,
+    private readonly maxObjectBytes: number,
+  ) {}
+
+  async put(
+    key: string,
+    value: ObjectStoreBody,
+    options?: ObjectStorePutOptions,
+  ): Promise<void> {
+    const headers = new Headers();
+    if (options?.contentType !== undefined) {
+      setBoundedHeader(headers, "content-type", options.contentType, "put");
+    }
+    const byteLength = knownBodyLength(value);
+    if (byteLength !== undefined) {
+      headers.set("content-length", String(byteLength));
+    }
+
+    const response = await fetchFromS3(
+      this.fetcher,
+      new Request(objectUrl(key), {
+        method: "PUT",
+        headers,
+        body: value as BodyInit,
+      }),
+      "put",
+    );
+    await expectSuccess(response, "put");
+  }
+
+  async get(key: string): Promise<ObjectStoreObject | null> {
+    const response = await fetchFromS3(
+      this.fetcher,
+      new Request(objectUrl(key), { method: "GET" }),
+      "get",
+    );
+    if (response.status === 404) {
+      await cancelBody(response);
+      return null;
+    }
+    await expectSuccess(response, "get", false);
+
+    let byteLength: number | undefined;
+    let contentType: string | undefined;
+    let etag: string | undefined;
+    try {
+      byteLength = parseContentLength(
+        response.headers.get("content-length"),
+        this.maxObjectBytes,
+        "get",
+        response.status,
+      );
+      contentType = boundedHeader(
+        response.headers,
+        "content-type",
+        "get",
+        response.status,
+      );
+      etag = boundedHeader(response.headers, "etag", "get", response.status);
+    } catch (error) {
+      await cancelBody(response);
+      throw error;
+    }
+    return {
+      key,
+      body:
+        response.body === null
+          ? null
+          : boundedBody(response.body, this.maxObjectBytes, "get"),
+      ...(contentType === undefined ? {} : { contentType }),
+      ...(etag === undefined ? {} : { etag }),
+      ...(byteLength === undefined ? {} : { byteLength }),
+    };
+  }
+
+  async delete(key: string | readonly string[]): Promise<void> {
+    const isBatch = typeof key !== "string";
+    const keys = [...new Set(isBatch ? key : [key])];
+    const failures: S3FetchObjectStoreError[] = [];
+    for (const entry of keys) {
+      try {
+        const response = await fetchFromS3(
+          this.fetcher,
+          new Request(objectUrl(entry), { method: "DELETE" }),
+          "delete",
+        );
+        await expectSuccess(response, "delete");
+      } catch (error) {
+        failures.push(
+          error instanceof S3FetchObjectStoreError
+            ? error
+            : new S3FetchObjectStoreError(
+                "delete",
+                "s3_delete_operation_failed",
+              ),
+        );
+      }
+    }
+    if (failures.length === 0) return;
+    if (!isBatch) {
+      throw failures[0];
+    }
+    throw new AggregateError(failures, "s3_batch_delete_failed");
+  }
+}
+
+async function fetchFromS3(
+  fetcher: S3ObjectFetcher,
+  request: Request,
+  operation: S3FetchObjectOperation,
+): Promise<Response> {
+  try {
+    return await fetcher.fetch(request);
+  } catch {
+    // Never retain the supplied rejection as `cause` or copy any of its text:
+    // the host Fetcher may contain endpoint and credential diagnostics.
+    throw new S3FetchObjectStoreError(
+      operation,
+      FETCH_REJECTION_CODES[operation],
+    );
+  }
+}
+
+function objectUrl(key: string): string {
+  return `${SYNTHETIC_ORIGIN}/${key
+    .split("/")
+    .map(encodePathSegment)
+    .join("/")}`;
+}
+
+/** Encode every path segment, including dot segments, so URL normalization
+ * cannot reinterpret a user key as traversal. */
+function encodePathSegment(value: string): string {
+  const encoded = encodeURIComponent(value).replace(
+    /[.!'()*]/gu,
+    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+  // URL parsers normalize `%2E`/`%2E%2E` path segments as traversal before a
+  // Fetcher sees the request. Double-escape only those complete segments so
+  // the host can decode the wire path without losing the key boundary.
+  return value === "." || value === ".."
+    ? encoded.replace(/%2E/gu, "%252E")
+    : encoded;
+}
+
+function knownBodyLength(value: ObjectStoreBody): number | undefined {
+  if (value instanceof Blob) return value.size;
+  if (value instanceof ArrayBuffer) return value.byteLength;
+  if (typeof value === "string") {
+    return new TextEncoder().encode(value).byteLength;
+  }
+  return undefined;
+}
+
+async function expectSuccess(
+  response: Response,
+  operation: S3FetchObjectOperation,
+  cancelSuccessfulBody = true,
+): Promise<void> {
+  if (response.status >= 200 && response.status < 300) {
+    if (cancelSuccessfulBody) await cancelBody(response);
+    return;
+  }
+  await cancelBody(response);
+  throw new S3FetchObjectStoreError(
+    operation,
+    "s3_response_unexpected_status",
+    response.status,
+  );
+}
+
+async function cancelBody(response: Response): Promise<void> {
+  await response.body?.cancel().catch(() => undefined);
+}
+
+function boundedHeader(
+  headers: Headers,
+  name: string,
+  operation: S3FetchObjectOperation,
+  status: number,
+): string | undefined {
+  const value = headers.get(name);
+  if (value === null || value.length === 0) return undefined;
+  if (value.length > MAX_HEADER_VALUE_LENGTH) {
+    throw new S3FetchObjectStoreError(
+      operation,
+      "s3_response_header_too_large",
+      status,
+    );
+  }
+  return value;
+}
+
+function setBoundedHeader(
+  headers: Headers,
+  name: string,
+  value: string,
+  operation: S3FetchObjectOperation,
+): void {
+  if (value.length > MAX_HEADER_VALUE_LENGTH) {
+    throw new S3FetchObjectStoreError(operation, "s3_request_header_too_large");
+  }
+  headers.set(name, value);
+}
+
+function parseContentLength(
+  value: string | null,
+  maxObjectBytes: number,
+  operation: S3FetchObjectOperation,
+  status: number,
+): number | undefined {
+  if (value === null) return undefined;
+  if (
+    value.length > MAX_HEADER_VALUE_LENGTH ||
+    !/^\d+$/u.test(value) ||
+    !Number.isSafeInteger(Number(value))
+  ) {
+    throw new S3FetchObjectStoreError(
+      operation,
+      "s3_response_content_length_invalid",
+      status,
+    );
+  }
+  const parsed = Number(value);
+  if (parsed > maxObjectBytes) {
+    throw new S3FetchObjectStoreError(
+      operation,
+      "s3_response_object_too_large",
+      status,
+    );
+  }
+  return parsed;
+}
+
+function boundedBody(
+  stream: ReadableStream<Uint8Array>,
+  maxObjectBytes: number,
+  operation: S3FetchObjectOperation,
+): ReadableStream<Uint8Array> {
+  const reader = stream.getReader();
+  let size = 0;
+  let finished = false;
+  const release = (): void => {
+    if (finished) return;
+    finished = true;
+    try {
+      reader.releaseLock();
+    } catch {
+      // The bounded adapter owns no useful diagnostic at this boundary. A
+      // lock-release failure after read/cancel completion must not surface a
+      // provider error or retain its cause.
+    }
+  };
+
+  return new ReadableStream<Uint8Array>(
+    {
+      async pull(controller) {
+        try {
+          const result = await reader.read();
+          if (result.done) {
+            controller.close();
+            release();
+            return;
+          }
+          size += result.value.byteLength;
+          if (size > maxObjectBytes) {
+            await reader
+              .cancel("s3_response_object_too_large")
+              .catch(() => undefined);
+            controller.error(
+              new S3FetchObjectStoreError(
+                operation,
+                "s3_response_object_too_large",
+              ),
+            );
+            release();
+            return;
+          }
+          controller.enqueue(result.value);
+        } catch {
+          controller.error(
+            new S3FetchObjectStoreError(
+              operation,
+              "s3_response_body_read_failed",
+            ),
+          );
+          release();
+        }
+      },
+      async cancel() {
+        try {
+          // Do not forward an arbitrary caller reason into a provider-owned
+          // stream, and never retain a provider rejection as cause/text.
+          await reader.cancel("s3_response_body_cancelled");
+        } catch {
+          throw new S3FetchObjectStoreError(
+            operation,
+            "s3_response_body_cancel_failed",
+          );
+        } finally {
+          release();
+        }
+      },
+    },
+    { highWaterMark: 0 },
+  );
+}
+
+function assertMaxObjectBytes(value: number): void {
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new TypeError("s3_object_response_limit_invalid");
+  }
+}

package/src/backend/runtime/sqlite-proxy-rows.ts

@@ -0,0 +1,309 @@
+/**
+ * Row shape for every `drizzle-orm/sqlite-proxy` lane.
+ *
+ * `sqlite-proxy` maps `rows[i][j]` POSITIONALLY onto the fields Drizzle
+ * compiled, so a lane is only correct while the j-th cell it hands back is the
+ * j-th item of the projection list that went out. Two things break that, and
+ * both break it SILENTLY:
+ *
+ * 1. Duplicate result-column names. Drizzle's join SQL is
+ *
+ *        select "inbox"."actor_ap_id", ..., "activities"."actor_ap_id", ...
+ *          from "inbox" inner join "activities" on ...
+ *
+ *    and SQLite names both result columns `actor_ap_id`. Any driver, facade, or
+ *    Host hop that materializes a row as a RECORD keeps one of them and every
+ *    later field shifts by one. (`created_at` collides in the same query, and
+ *    JavaScript's key ordering adds a second trap: an integer-like name such as
+ *    the `1` of `select 1` sorts ahead of every other key.) So this module
+ *    rewrites the projection list before it is sent, giving every unaliased
+ *    item a unique, non-numeric name (`__c0`, `__c1`, ...). Drizzle never looks
+ *    at result-column names, so the rename is invisible to it. The rewrite is
+ *    then BACKED BY A GUARD: a row that comes back with a different number of
+ *    columns than the statement projected throws instead of being mapped.
+ *
+ * 2. Rows with no names at all. Drizzle reads a row positionally, but
+ *    `db.get(sql`... AS matched`)` — a raw statement with no compiled fields —
+ *    is handed the driver's row untouched, and on D1 that is a record: call
+ *    sites read `row.matched`. A bare array answers `undefined` to those reads,
+ *    and several of them gate block/mute enforcement, where `undefined` reads
+ *    as "not blocked". So the row this module builds answers to BOTH access
+ *    styles: an array Drizzle can index, carrying its column names as
+ *    non-enumerable properties.
+ *
+ * Lanes differ only in how they obtain the (names, values) pair — `edge.sql`
+ * from a record per row, the managed relational runtime from a `columns` list
+ * beside positional rows — so both share everything below.
+ */
+
+/** A row came back with a different column count than the statement projected. */
+export class ProxyColumnMismatchError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ProxyColumnMismatchError";
+  }
+}
+
+const PROJECTION_ALIAS_PREFIX = "__c";
+
+const SELECT_LIST_TERMINATORS = new Set([
+  "from",
+  "where",
+  "group",
+  "having",
+  "window",
+  "order",
+  "limit",
+  "offset",
+  "union",
+  "except",
+  "intersect",
+]);
+
+interface ScannedWord {
+  readonly word: string;
+  readonly start: number;
+  readonly end: number;
+}
+
+interface Scan {
+  readonly words: readonly ScannedWord[];
+  readonly commas: readonly number[];
+}
+
+function isWordChar(ch: string): boolean {
+  return /[A-Za-z0-9_$]/.test(ch);
+}
+
+/**
+ * Walk the statement recording the bare words and commas that sit at
+ * parenthesis depth zero. Quoted identifiers, string literals, and comments are
+ * skipped whole, so a `,` inside `'a,b'` or a `from` inside a subquery is never
+ * mistaken for structure.
+ */
+function scanTopLevel(sql: string): Scan {
+  const words: ScannedWord[] = [];
+  const commas: number[] = [];
+  let depth = 0;
+  let index = 0;
+  while (index < sql.length) {
+    const ch = sql[index]!;
+    if (ch === "'" || ch === '"' || ch === "`") {
+      index += 1;
+      while (index < sql.length) {
+        if (sql[index] === ch) {
+          if (sql[index + 1] === ch) index += 2;
+          else {
+            index += 1;
+            break;
+          }
+        } else index += 1;
+      }
+      continue;
+    }
+    if (ch === "[") {
+      const close = sql.indexOf("]", index + 1);
+      index = close === -1 ? sql.length : close + 1;
+      continue;
+    }
+    if (ch === "-" && sql[index + 1] === "-") {
+      const newline = sql.indexOf("\n", index);
+      index = newline === -1 ? sql.length : newline + 1;
+      continue;
+    }
+    if (ch === "/" && sql[index + 1] === "*") {
+      const close = sql.indexOf("*/", index + 2);
+      index = close === -1 ? sql.length : close + 2;
+      continue;
+    }
+    if (ch === "(") {
+      depth += 1;
+      index += 1;
+      continue;
+    }
+    if (ch === ")") {
+      depth -= 1;
+      index += 1;
+      continue;
+    }
+    if (ch === ",") {
+      if (depth === 0) commas.push(index);
+      index += 1;
+      continue;
+    }
+    if (isWordChar(ch) && !/[0-9]/.test(ch)) {
+      const start = index;
+      while (index < sql.length && isWordChar(sql[index]!)) index += 1;
+      if (depth === 0) {
+        words.push({
+          word: sql.slice(start, index).toLowerCase(),
+          start,
+          end: index,
+        });
+      }
+      continue;
+    }
+    if (/[0-9]/.test(ch)) {
+      while (index < sql.length && isWordChar(sql[index]!)) index += 1;
+      continue;
+    }
+    index += 1;
+  }
+  return { words, commas };
+}
+
+/** Does this projection item already carry its own `as "name"` alias? */
+function hasOwnAlias(item: string): boolean {
+  return scanTopLevel(item).words.some((word) => word.word === "as");
+}
+
+export interface RewrittenStatement {
+  readonly sql: string;
+  /**
+   * How many result columns the statement projects, when that could be
+   * determined. `undefined` means the guard cannot check this statement — a
+   * `select *`, or a shape with no projection list at all.
+   */
+  readonly columns: number | undefined;
+}
+
+/**
+ * Give every projected column a distinct, non-numeric name.
+ *
+ * Handles the two shapes Drizzle emits: a `select` list (including one that
+ * follows a `with` clause, whose CTE bodies are parenthesized and therefore
+ * invisible to a depth-zero scan) and a `returning` list on a write. For a
+ * compound `select ... union select ...` only the first arm is rewritten, which
+ * is sufficient: SQLite takes a compound select's result-column names from its
+ * first arm.
+ *
+ * Anything else — a `pragma`, a `create table`, a `select *` — is returned
+ * untouched with no column count, because there is nothing safe to rename.
+ */
+export function rewriteProjection(sql: string): RewrittenStatement {
+  const scan = scanTopLevel(sql);
+  const first = scan.words[0];
+  if (!first) return { sql, columns: undefined };
+
+  let listStart: number;
+  let listEnd: number;
+
+  if (first.word === "select" || first.word === "with") {
+    const selectAt = scan.words.findIndex((word) => word.word === "select");
+    if (selectAt === -1) return { sql, columns: undefined };
+    const select = scan.words[selectAt]!;
+    // The list begins right after the keyword, NOT at the next bare word: an
+    // item usually opens with a quoted identifier, which the scanner skips.
+    listStart = select.end;
+    let cursor = selectAt + 1;
+    const next = scan.words[cursor];
+    if (
+      next &&
+      (next.word === "distinct" || next.word === "all") &&
+      sql.slice(select.end, next.start).trim() === ""
+    ) {
+      listStart = next.end;
+      cursor += 1;
+    }
+    const terminator = scan.words
+      .slice(cursor)
+      .find((word) => SELECT_LIST_TERMINATORS.has(word.word));
+    listEnd = terminator ? terminator.start : sql.length;
+  } else {
+    // insert / update / delete: only a `returning` list is projected.
+    const returning = [...scan.words]
+      .reverse()
+      .find((word) => word.word === "returning");
+    if (!returning) return { sql, columns: undefined };
+    listStart = returning.end;
+    listEnd = sql.length;
+  }
+
+  if (listEnd <= listStart) return { sql, columns: undefined };
+
+  const boundaries = [
+    listStart,
+    ...scan.commas.filter((at) => at > listStart && at < listEnd),
+    listEnd,
+  ];
+  const items: { text: string; start: number; end: number }[] = [];
+  for (let index = 0; index + 1 < boundaries.length; index += 1) {
+    const start = index === 0 ? boundaries[0]! : boundaries[index]! + 1;
+    const end = boundaries[index + 1]!;
+    items.push({ text: sql.slice(start, end), start, end });
+  }
+  if (items.length === 0) return { sql, columns: undefined };
+
+  // `select *` and `"t".*` cannot take an alias, and their column count is not
+  // knowable from the text. Leave the whole statement alone.
+  if (items.some((item) => /(^|\.)\s*\*\s*$/.test(item.text.trim()))) {
+    return { sql, columns: undefined };
+  }
+
+  let out = "";
+  let cursor = 0;
+  items.forEach((item, position) => {
+    out += sql.slice(cursor, item.end);
+    if (!hasOwnAlias(item.text)) {
+      const trailing = item.text.length - item.text.trimEnd().length;
+      // Insert before the item's own trailing whitespace so the statement keeps
+      // its shape.
+      out =
+        out.slice(0, out.length - trailing) +
+        ` as "${PROJECTION_ALIAS_PREFIX}${position}"` +
+        out.slice(out.length - trailing);
+    }
+    cursor = item.end;
+  });
+  out += sql.slice(cursor);
+  return { sql: out, columns: items.length };
+}
+
+/** What a lane must remember about a statement to shape its rows back. */
+export interface ProjectedStatement {
+  /** Which lane is speaking, so a refusal names the surface that refused. */
+  readonly lane: string;
+  /** The statement as the caller wrote it, for the refusal message. */
+  readonly sql: string;
+  /** `rewriteProjection`'s column count, or `undefined` when unknowable. */
+  readonly columns: number | undefined;
+}
+
+/** Array indices and `length` are the only names an array cannot also carry. */
+function canCarryName(key: string): boolean {
+  return key !== "length" && String(Number(key)) !== key;
+}
+
+/**
+ * Build the row `sqlite-proxy` indexes positionally, carrying its column names.
+ *
+ * Fails closed first: if the lane came back with a different number of columns
+ * than the statement projected, the cells no longer line up with the fields
+ * Drizzle compiled, and returning them would be a silent mis-read.
+ */
+export function positionalRow(
+  statement: ProjectedStatement,
+  columns: readonly string[],
+  values: readonly unknown[],
+): unknown[] {
+  if (statement.columns !== undefined && columns.length !== statement.columns) {
+    throw new ProxyColumnMismatchError(
+      `${statement.lane} returned ${columns.length} columns for a statement ` +
+        `projecting ${statement.columns}; the row cannot be mapped ` +
+        `positionally. Statement: ${statement.sql}`,
+    );
+  }
+  const row = [...values];
+  for (let index = 0; index < columns.length; index += 1) {
+    const key = columns[index]!;
+    if (canCarryName(key)) {
+      Object.defineProperty(row, key, {
+        value: values[index],
+        enumerable: false,
+        configurable: true,
+        writable: true,
+      });
+    }
+  }
+  return row;
+}