bunderstack 0.18.0 → 0.19.0

package/dist/realtime/filter.js

@@ -1,9 +1,50 @@
 import { getEventMeta, withEventMeta } from '@orpc/server';
 import { checkAccess, rowMatchesScope, tableEntryForName } from '../access.js';
-export async function* filterRealtimeChanges(source, options) {
-    const subscriptions = new Set(options.subscriptions);
+/**
+ * Whether one change may reach this subscriber: the given right plus the read
+ * scope of the row, evaluated against the caller's session. The session
+ * resolves at most once per stream.
+ */
+export function createChangeGuard(entry, options) {
     let sessionPromise;
     const getSession = () => (sessionPromise ??= options.getSession());
+    return async (change) => {
+        if (!entry.enabled || options.rule === 'deny')
+            return false;
+        const needsSession = options.rule !== 'public' || entry.readScope !== undefined;
+        const session = needsSession
+            ? await getSession()
+            : { user: null, activeOrganizationId: null };
+        const context = {
+            request: options.request,
+            user: session.user,
+            row: change.record,
+            session: { activeOrganizationId: session.activeOrganizationId },
+        };
+        if (!(await checkAccess(options.rule, context, entry.ownerColumn)).allowed) {
+            return false;
+        }
+        if (entry.readScope &&
+            !rowMatchesScope(change.record, entry.readScope(context))) {
+            return false;
+        }
+        return true;
+    };
+}
+/** Preserve publisher event metadata (ids) across the projection. */
+function project(change) {
+    const projected = {
+        table: change.table,
+        action: change.action,
+        record: change.record,
+    };
+    const meta = getEventMeta(change);
+    return meta ? withEventMeta(projected, meta) : projected;
+}
+export async function* filterRealtimeChanges(source, options) {
+    const subscriptions = new Set(options.subscriptions);
+    // One guard — and therefore one cached session — per table entry.
+    const guards = new Map();
     for await (const change of source) {
         // Events name tables by schema key; the SQL-name lookup stays as a fallback
         // for publishers outside the CRUD path that only know the physical name.
@@ -17,32 +58,28 @@ export async function* filterRealtimeChanges(source, options) {
                 !subscriptions.has(`${change.table}/${String(recordId)}`))) {
             continue;
         }
-        if (entry.get === 'deny')
+        let guard = guards.get(entry);
+        if (!guard) {
+            guard = createChangeGuard(entry, { ...options, rule: entry.get });
+            guards.set(entry, guard);
+        }
+        if (!(await guard(change)))
             continue;
-        const needsSession = entry.get !== 'public' || entry.readScope !== undefined;
-        const session = needsSession
-            ? await getSession()
-            : { user: null, activeOrganizationId: null };
-        const context = {
-            request: options.request,
-            user: session.user,
-            row: change.record,
-            session: { activeOrganizationId: session.activeOrganizationId },
-        };
-        if (!(await checkAccess(entry.get, context, entry.ownerColumn)).allowed) {
+        yield project(change);
+    }
+}
+/**
+ * The same stream narrowed to one table with its access entry known up front —
+ * what a live view (`GET /{table}:live`) consumes.
+ */
+export async function* filterTableChanges(source, options) {
+    const guard = createChangeGuard(options.entry, options);
+    for await (const change of source) {
+        if (change.table !== options.tableName)
             continue;
-        }
-        if (entry.readScope &&
-            !rowMatchesScope(change.record, entry.readScope(context))) {
+        if (!(await guard(change)))
             continue;
-        }
-        const projected = {
-            table: change.table,
-            action: change.action,
-            record: change.record,
-        };
-        const meta = getEventMeta(change);
-        yield meta ? withEventMeta(projected, meta) : projected;
+        yield project(change);
     }
 }
 //# sourceMappingURL=filter.js.map

package/dist/realtime/filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"filter.js","sourceRoot":"","sources":["../../src/realtime/filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAK1D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAY3E,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,qBAAqB,CAC1C,MAAqC,EACrC,OAAqC;IAErC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACpD,IAAI,cAES,CAAA;IACb,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAElE,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAClC,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAChC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK,EAAE,OAAO;YAAE,SAAQ;QAE7B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;QACjC,IACE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAChC,CAAC,QAAQ,IAAI,IAAI;gBACf,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAC5D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM;YAAE,SAAQ;QAElC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAA;QAC5E,MAAM,OAAO,GAAG,YAAY;YAC1B,CAAC,CAAC,MAAM,UAAU,EAAE;YACpB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAA;QAC9C,MAAM,OAAO,GAAG;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,MAAM,CAAC,MAAM;YAClB,OAAO,EAAE,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;SAChE,CAAA;QACD,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACxE,SAAQ;QACV,CAAC;QACD,IACE,KAAK,CAAC,SAAS;YACf,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EACzD,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,SAAS,GAAmB;YAChC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAA;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzD,CAAC;AACH,CAAC"}
+{"version":3,"file":"filter.js","sourceRoot":"","sources":["../../src/realtime/filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAU1D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AA2B3E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAA0B,EAC1B,OAA0E;IAE1E,IAAI,cAAkD,CAAA;IACtD,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAElE,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,KAAK,CAAA;QAE3D,MAAM,YAAY,GAChB,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAA;QAC5D,MAAM,OAAO,GAAG,YAAY;YAC1B,CAAC,CAAC,MAAM,UAAU,EAAE;YACpB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAA;QAC9C,MAAM,OAAO,GAAG;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,MAAM,CAAC,MAAM;YAClB,OAAO,EAAE,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;SAChE,CAAA;QACD,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IACE,KAAK,CAAC,SAAS;YACf,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EACzD,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,OAAO,CAAC,MAAsB;IACrC,MAAM,SAAS,GAAmB;QAChC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAA;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,qBAAqB,CAC1C,MAAqC,EACrC,OAAqC;IAErC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACpD,kEAAkE;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAA;IAEH,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAClC,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAChC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK,EAAE,OAAO;YAAE,SAAQ;QAE7B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;QACjC,IACE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAChC,CAAC,QAAQ,IAAI,IAAI;gBACf,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAC5D,CAAC;YACD,SAAQ;QACV,CAAC;QAED,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;YACjE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC1B,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YAAE,SAAQ;QACpC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,kBAAkB,CACvC,MAAqC,EACrC,OAAkC;IAElC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACvD,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS;YAAE,SAAQ;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YAAE,SAAQ;QACpC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;AACH,CAAC"}

package/llms.txt

@@ -1,7 +1,7 @@
 BUNDERSTACK
 
 A batteries-included backend framework for Bun. Version 0.17 (beta).
-Docs: https://bunderstack.dev/docs
+Docs: https://bunderstack.kcrz.dev/docs
 This file is written for coding agents. It is dense on purpose.
 
 WHAT IT IS
@@ -13,7 +13,7 @@ subscriptions, and a health check live in the same oRPC graph, reachable both
 as typed RPC and as ordinary HTTP.
 
 Stack: Bun, Drizzle (+ drizzle-kit), Better Auth, oRPC v2, libSQL or Postgres,
-sharp. Validation accepts any Standard Schema library; generated schemas use
+Bun.Image. Validation accepts any Standard Schema library; generated schemas use
 Valibot. There is no Hono, no tRPC, and no Zod requirement.
 
 Packages: bunderstack (server), bunderstack-query (client + TanStack Query),
@@ -303,7 +303,7 @@ STORAGE
   }
 
 Canonical URL: /api/files/{bucket}/{+path}. transforms: true enables on-the-fly
-image derivatives through sharp. app.storage exposes delete, bucket, sweep,
+image derivatives through Bun.Image. app.storage exposes delete, bucket, sweep,
 getUrl, and upload for server-generated files.
 
 REALTIME

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunderstack",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Batteries-included backend framework for Bun: type-safe oRPC APIs, auth, storage, realtime, jobs, email, and validated env from one config.",
   "keywords": [
     "backend",
@@ -60,6 +60,10 @@
       "types": "./dist/database/postgres-js.d.ts",
       "default": "./dist/database/postgres-js.js"
     },
+    "./live": {
+      "types": "./dist/live/index.d.ts",
+      "default": "./dist/live/index.js"
+    },
     "./provision": {
       "types": "./dist/provision.d.ts",
       "default": "./dist/provision.js"
@@ -107,7 +111,7 @@
     "db:push": "drizzle-kit push",
     "dev": "bun --hot ../../examples/standalone/server.ts",
     "prepack": "bun run build",
-    "test": "bun test",
+    "test": "bun test --parallel --timeout=30000",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {