@trypattern/sdk 0.1.7 → 0.1.9

package/dist/server/database.js

@@ -0,0 +1,93 @@
+import { asc, count } from 'drizzle-orm';
+import { drizzle } from 'drizzle-orm/d1';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { PAGE_PROBLEM, afterCursor, pageOf, pageReply } from "./keyset.js";
+import { sqlTable } from "./tables.js";
+import { users } from "./users.js";
+const userRow = z.object({
+    id: z.string(),
+    email: z.string(),
+    name: z.string(),
+    avatarUrl: z.string().nullable(),
+    createdAt: z.string()
+});
+const USERS_ACCESS = {
+    read: 'admin',
+    create: 'server',
+    update: 'server',
+    delete: 'server'
+};
+function adminRefusal(c) {
+    const viewer = c.get('viewer');
+    if (viewer === null)
+        return c.json({ error: 'Signed out' }, 401);
+    return viewer.isAdmin ? undefined : c.json({ error: 'forbidden' }, 403);
+}
+function jsonSchemaOf(schema) {
+    return z.toJSONSchema(schema, { unrepresentable: 'any' });
+}
+async function rowCount(c, table) {
+    const counted = await drizzle(c.env.DB)
+        .select({ count: count() })
+        .from(sqlTable(table))
+        .get();
+    return counted?.count ?? 0;
+}
+async function userCount(c) {
+    const counted = await drizzle(c.env.DB)
+        .select({ count: count() })
+        .from(users)
+        .get();
+    return counted?.count ?? 0;
+}
+export function serveDatabase(tables) {
+    const listed = Object.values(tables).filter((table) => table.access.read !== 'server');
+    return new Hono()
+        .get('/schema', async (c) => {
+        const refusal = adminRefusal(c);
+        if (refusal !== undefined)
+            return refusal;
+        const own = await Promise.all(listed.map(async (table) => ({
+            name: table.name,
+            schema: jsonSchemaOf(table.row),
+            access: table.access,
+            public: [...table.public],
+            rowCount: await rowCount(c, table),
+            isBuiltIn: false
+        })));
+        const builtIn = {
+            name: 'users',
+            schema: jsonSchemaOf(userRow),
+            access: USERS_ACCESS,
+            public: [],
+            rowCount: await userCount(c),
+            isBuiltIn: true
+        };
+        return c.json({ tables: [...own, builtIn] });
+    })
+        .get('/tables/users', async (c) => {
+        const refusal = adminRefusal(c);
+        if (refusal !== undefined)
+            return refusal;
+        const page = pageOf(c);
+        if (page === 'invalid') {
+            return c.json({ error: PAGE_PROBLEM }, 400);
+        }
+        const query = drizzle(c.env.DB)
+            .select({
+            id: users.id,
+            email: users.email,
+            name: users.name,
+            avatarUrl: users.avatarUrl,
+            createdAt: users.createdAt
+        })
+            .from(users)
+            .where(afterCursor(users.createdAt, users.id, page))
+            .orderBy(asc(users.createdAt), asc(users.id));
+        const rows = await (page === undefined
+            ? query
+            : query.limit(page.limit + 1));
+        return pageReply(c, rows, page);
+    });
+}

package/dist/server/keyset.d.ts

@@ -0,0 +1,13 @@
+import type { SQLiteColumn } from 'drizzle-orm/sqlite-core';
+import type { Context } from 'hono';
+import type { ServerEnv } from './env.ts';
+export declare const PAGE_PROBLEM = "limit must be 1 to 1000, after a cursor";
+export type Page = {
+    readonly limit: number;
+    readonly after: readonly [string, string] | undefined;
+};
+export declare function pageOf(c: Context<ServerEnv>): Page | undefined | 'invalid';
+export declare function afterCursor(createdAt: SQLiteColumn, id: SQLiteColumn, page: Page | undefined): import("drizzle-orm").SQL<unknown> | undefined;
+export declare function pageReply(c: Context<ServerEnv>, rows: readonly Readonly<Record<string, unknown>>[], page: Page | undefined): Response & import("hono").TypedResponse<readonly {
+    readonly [x: string]: import("hono/utils/types").JSONValue;
+}[], import("hono/utils/http-status").ContentfulStatusCode, "json">;

package/dist/server/keyset.js

@@ -0,0 +1,52 @@
+import { and, eq, gt, or } from 'drizzle-orm';
+import { z } from 'zod';
+import { NEXT_PAGE_HEADER } from "../patternAccess.js";
+const PAGE_LIMIT = 1000;
+export const PAGE_PROBLEM = 'limit must be 1 to 1000, after a cursor';
+const pageQuery = z.object({
+    limit: z.coerce.number().int().min(1).max(PAGE_LIMIT).optional(),
+    after: z.string().min(1).optional()
+});
+const cursor = z.tuple([z.string(), z.string()]);
+function cursorOf(row) {
+    return btoa(JSON.stringify([row['createdAt'], row['id']]))
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replaceAll('=', '');
+}
+function cursorParts(text) {
+    try {
+        const parsed = cursor.safeParse(JSON.parse(atob(text.replaceAll('-', '+').replaceAll('_', '/'))));
+        return parsed.success ? parsed.data : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function pageOf(c) {
+    const parsed = pageQuery.safeParse(c.req.query());
+    if (!parsed.success)
+        return 'invalid';
+    const { limit, after } = parsed.data;
+    if (limit === undefined)
+        return after === undefined ? undefined : 'invalid';
+    if (after === undefined)
+        return { limit, after: undefined };
+    const parts = cursorParts(after);
+    return parts === undefined ? 'invalid' : { limit, after: parts };
+}
+export function afterCursor(createdAt, id, page) {
+    if (page?.after === undefined)
+        return undefined;
+    const [at, lastId] = page.after;
+    return or(gt(createdAt, at), and(eq(createdAt, at), gt(id, lastId)));
+}
+export function pageReply(c, rows, page) {
+    if (page === undefined || rows.length <= page.limit)
+        return c.json(rows);
+    const shown = rows.slice(0, page.limit);
+    const last = shown.at(-1);
+    if (last !== undefined)
+        c.header(NEXT_PAGE_HEADER, cursorOf(last));
+    return c.json(shown);
+}

package/dist/server/patternKeys.d.ts

@@ -0,0 +1 @@
+export declare const PATTERN_KEYS: Readonly<Record<string, string>>;

package/dist/server/patternKeys.js

@@ -0,0 +1,3 @@
+export const PATTERN_KEYS = {
+    'pattern-2026-10': 'R0VOZWJtSyBR2jwbN1U3nci1WImH9ZTy27KIw4igaXs'
+};

package/dist/server/patternViewer.d.ts

@@ -0,0 +1,6 @@
+import type { Context, Next } from 'hono';
+import type { ServerEnv } from './env.ts';
+export declare function bearerOf(c: Context<ServerEnv>): string | undefined;
+export declare function attachPatternViewer(c: Context<ServerEnv>, next: Next, token: string): Promise<void | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 401, "json">)>;

package/dist/server/patternViewer.js

@@ -0,0 +1,27 @@
+import { verifiedTablesAssertion } from "../patternAccess.js";
+import { PATTERN_KEYS } from "./patternKeys.js";
+const BEARER = /^bearer\s+/i;
+const SCHEMA_PATH = '/api/schema';
+const TABLES_PATH = '/api/tables/';
+export function bearerOf(c) {
+    const header = c.req.header('authorization') ?? '';
+    return BEARER.test(header) ? header.replace(BEARER, '').trim() : undefined;
+}
+function isReadByPattern(c) {
+    const { path } = c.req;
+    return (c.req.method === 'GET' &&
+        (path === SCHEMA_PATH || path.startsWith(TABLES_PATH)));
+}
+export async function attachPatternViewer(c, next, token) {
+    const email = isReadByPattern(c)
+        ? await verifiedTablesAssertion(token, {
+            hostname: new URL(c.req.url).hostname,
+            keys: PATTERN_KEYS,
+            now: Math.floor(Date.now() / 1000)
+        })
+        : undefined;
+    if (email === undefined)
+        return c.json({ error: 'Signed out' }, 401);
+    c.set('viewer', { userId: `pattern:${email}`, isAdmin: true });
+    return next();
+}

package/dist/server/services.js

@@ -5,7 +5,7 @@ async function inputOf(c, call) {
     const raw = call.method === 'get' ? c.req.query() : await c.req.json().catch(() => ({}));
     return call.input.safeParse(raw);
 }
-const BUILT_IN_PATHS = ['/auth', '/health', '/tables', '/app', '/me'];
+const BUILT_IN_PATHS = ['/auth', '/health', '/tables', '/app', '/me', '/schema'];
 function builtInPathOf(path) {
     return BUILT_IN_PATHS.find((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }

package/dist/server/session.js

@@ -1,9 +1,8 @@
 import { deleteCookie, getSignedCookie, setCookie, setSignedCookie } from 'hono/cookie';
 import { serializeSigned } from 'hono/utils/cookie';
 import { z } from 'zod';
-import { USER_COOKIE } from "../auth/user.js";
+import { SESSION_COOKIE, USER_COOKIE } from "../auth/user.js";
 import { createSession } from "./sessions.js";
-const SESSION_COOKIE = 'pattern_session';
 const RECHECK_SECONDS = 15 * 60;
 const SESSION_SECONDS = 30 * 86_400;
 const cookieOptions = {
@@ -61,6 +60,6 @@ export async function readPass(c) {
 }
 export const needsRecheck = (pass) => pass.recheckAt <= nowInSeconds();
 export function forgetSession(c) {
-    deleteCookie(c, SESSION_COOKIE, { path: '/' });
-    deleteCookie(c, USER_COOKIE, { path: '/' });
+    deleteCookie(c, SESSION_COOKIE, { path: '/', secure: true });
+    deleteCookie(c, USER_COOKIE, { path: '/', secure: true });
 }

package/dist/server/tables.d.ts

@@ -13,6 +13,17 @@ export declare function seedSql<Group extends Tables>(tables: Group, seed: Seed<
 export declare function serveTables<Group extends Tables>(tables: Group): import("hono/hono-base").HonoBase<ServerEnv, {
     "/:table": {
         $get: {
+            input: {
+                param: {
+                    table: string;
+                };
+            };
+            output: readonly {
+                readonly [x: string]: import("hono/utils/types").JSONValue;
+            }[];
+            outputFormat: "json";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+        } | {
             input: {
                 param: {
                     table: string;
@@ -29,9 +40,11 @@ export declare function serveTables<Group extends Tables>(tables: Group): import
                     table: string;
                 };
             };
-            output: {}[];
+            output: {
+                error: string;
+            };
             outputFormat: "json";
-            status: import("hono/utils/http-status").ContentfulStatusCode;
+            status: 404;
         } | {
             input: {
                 param: {
@@ -42,7 +55,7 @@ export declare function serveTables<Group extends Tables>(tables: Group): import
                 error: string;
             };
             outputFormat: "json";
-            status: 404;
+            status: 400;
         };
     };
 } & {

package/dist/server/tables.js

@@ -1,9 +1,10 @@
-import { asc, eq, sql } from 'drizzle-orm';
+import { and, asc, eq, sql } from 'drizzle-orm';
 import { drizzle } from 'drizzle-orm/d1';
 import { integer, real, sqliteTable, text, uniqueIndex } from 'drizzle-orm/sqlite-core';
 import { Hono } from 'hono';
 import { z } from 'zod';
 import { changeRefusal, createRefusal, listRefusal, readScope } from "../access.js";
+import { PAGE_PROBLEM, afterCursor, pageOf, pageReply } from "./keyset.js";
 import { ownerIdOf, seededRows, snakeCase } from "../table.js";
 function typesOf(schema) {
     const { type } = z.toJSONSchema(schema);
@@ -161,13 +162,21 @@ export function serveTables(tables) {
         if (refusal !== undefined)
             return refuse(c, refusal);
         const scope = readScope(table, viewer);
+        const page = pageOf(c);
+        if (page === 'invalid') {
+            return c.json({ error: PAGE_PROBLEM }, 400);
+        }
         const query = drizzle(c.env.DB)
             .select(selection(table, target))
-            .from(target);
-        const rows = await (typeof scope === 'object'
-            ? query.where(eq(column(target, 'ownerId'), scope.ownerId))
-            : query).orderBy(asc(column(target, 'createdAt')), asc(column(target, 'id')));
-        return c.json(rows);
+            .from(target)
+            .where(and(typeof scope === 'object'
+            ? eq(column(target, 'ownerId'), scope.ownerId)
+            : undefined, afterCursor(column(target, 'createdAt'), column(target, 'id'), page)))
+            .orderBy(asc(column(target, 'createdAt')), asc(column(target, 'id')));
+        const rows = await (page === undefined
+            ? query
+            : query.limit(page.limit + 1));
+        return pageReply(c, rows, page);
     })
         .get('/:table/public', async (c) => {
         const entry = known.get(c.req.param('table'));

package/dist/serviceClients.js

@@ -25,11 +25,9 @@ export function httpServices(services, gate, onSignedOut) {
     return buildClient(services, (group, name, call) => (input = {}) => gate.pass(`${group}.${name}`, async () => {
         const { path, rest } = splitInput(call, input);
         const sent = call.input.parse(rest);
-        const query = call.method === 'get' && Object.keys(sent).length > 0
-            ? `?${new URLSearchParams(Object.entries(sent).map(([key, value]) => [
-                key,
-                String(value)
-            ])).toString()}`
+        const fields = Object.entries(sent).filter(([, value]) => value !== undefined);
+        const query = call.method === 'get' && fields.length > 0
+            ? `?${new URLSearchParams(fields.map(([key, value]) => [key, String(value)])).toString()}`
             : '';
         const response = await fetch(`/api${path}${query}`, {
             method: call.method.toUpperCase(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trypattern/sdk",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "type": "module",
   "files": [
     "dist",