cursedbelt-server 4.27.0 → 4.29.0

package/dist/server/sharing/schema.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The sharing tables' names and DDL, with no driver attached — the ONE copy both the
+ * `bun:sqlite` migration (`./migrations.ts`) and a D1 app's `db/schema.sql` are built from.
+ *
+ * It is import-free on purpose: `./d1.ts` runs on `workerd`, and a Worker app generates its
+ * schema file from these statements rather than running DDL at request time. The migration
+ * runs exactly this list, so the two can never describe different tables. Why each table and
+ * each index exists is `./migrations.ts`'s header.
+ */
+export declare const SHARE_GRANTS_TABLE = "share_grants";
+export declare const SHARE_GROUPS_TABLE = "share_groups";
+export declare const SHARE_GROUP_MEMBERS_TABLE = "share_group_members";
+export declare const SHARE_EVENTS_TABLE = "share_events";
+/**
+ * Every statement of the `0001_share_grants` migration, in order. Idempotent (`IF NOT
+ * EXISTS` throughout), so a schema file built from it can be applied to a database that
+ * already has the tables.
+ */
+export declare const SHARE_DDL: readonly string[];

package/dist/server/sharing/schema.js

@@ -0,0 +1,88 @@
+/**
+ * The sharing tables' names and DDL, with no driver attached — the ONE copy both the
+ * `bun:sqlite` migration (`./migrations.ts`) and a D1 app's `db/schema.sql` are built from.
+ *
+ * It is import-free on purpose: `./d1.ts` runs on `workerd`, and a Worker app generates its
+ * schema file from these statements rather than running DDL at request time. The migration
+ * runs exactly this list, so the two can never describe different tables. Why each table and
+ * each index exists is `./migrations.ts`'s header.
+ */
+export const SHARE_GRANTS_TABLE = "share_grants";
+export const SHARE_GROUPS_TABLE = "share_groups";
+export const SHARE_GROUP_MEMBERS_TABLE = "share_group_members";
+export const SHARE_EVENTS_TABLE = "share_events";
+/**
+ * Every statement of the `0001_share_grants` migration, in order. Idempotent (`IF NOT
+ * EXISTS` throughout), so a schema file built from it can be applied to a database that
+ * already has the tables.
+ */
+export const SHARE_DDL = [
+    `
+				CREATE TABLE IF NOT EXISTS ${SHARE_GRANTS_TABLE} (
+					grant_id    INTEGER PRIMARY KEY AUTOINCREMENT,
+					app         TEXT NOT NULL,
+					kind        TEXT NOT NULL,
+					resource_id TEXT NOT NULL,
+					subject_type TEXT NOT NULL CHECK (subject_type IN ('user', 'group')),
+					subject_id  TEXT NOT NULL,
+					level       TEXT NOT NULL CHECK (level IN ('read', 'write')),
+					granted_by  TEXT NOT NULL,
+					granted_at  TEXT NOT NULL,
+					note        TEXT NOT NULL DEFAULT '',
+					-- One grant per subject per resource. This is what makes raising
+					-- read to write an UPDATE the audit trail can describe, instead of
+					-- two rows where revoking one leaves access in place.
+					UNIQUE (app, kind, resource_id, subject_type, subject_id)
+				)
+			`,
+    // The hot read is the resolver's: "does this subject hold a grant on this
+    // row" — correlated per row of a list query, so it must be an index hit.
+    `CREATE INDEX IF NOT EXISTS idx_share_grants_subject
+				 ON ${SHARE_GRANTS_TABLE} (subject_type, subject_id, app, kind, resource_id)`,
+    // …and the panel's: "who can see this record".
+    `CREATE INDEX IF NOT EXISTS idx_share_grants_resource
+				 ON ${SHARE_GRANTS_TABLE} (app, kind, resource_id)`,
+    `
+				CREATE TABLE IF NOT EXISTS ${SHARE_GROUPS_TABLE} (
+					group_id   TEXT PRIMARY KEY,
+					name       TEXT NOT NULL,
+					created_by TEXT NOT NULL,
+					created_at TEXT NOT NULL,
+					note       TEXT NOT NULL DEFAULT ''
+				)
+			`,
+    `
+				CREATE TABLE IF NOT EXISTS ${SHARE_GROUP_MEMBERS_TABLE} (
+					group_id   TEXT NOT NULL REFERENCES ${SHARE_GROUPS_TABLE} (group_id) ON DELETE CASCADE,
+					subject_id TEXT NOT NULL,
+					added_by   TEXT NOT NULL,
+					added_at   TEXT NOT NULL,
+					PRIMARY KEY (group_id, subject_id)
+				)
+			`,
+    // "Which groups is this person in" — read by every shared-row query.
+    `CREATE INDEX IF NOT EXISTS idx_share_group_members_subject
+				 ON ${SHARE_GROUP_MEMBERS_TABLE} (subject_id)`,
+    `
+				CREATE TABLE IF NOT EXISTS ${SHARE_EVENTS_TABLE} (
+					event_id      INTEGER PRIMARY KEY AUTOINCREMENT,
+					at            TEXT NOT NULL,
+					action        TEXT NOT NULL,
+					app           TEXT,
+					kind          TEXT,
+					resource_id   TEXT,
+					subject_type  TEXT NOT NULL CHECK (subject_type IN ('user', 'group')),
+					subject_id    TEXT NOT NULL,
+					level         TEXT,
+					previous_level TEXT,
+					actor         TEXT NOT NULL,
+					note          TEXT NOT NULL DEFAULT ''
+				)
+			`,
+    // "Everything that ever happened to this record", newest first.
+    `CREATE INDEX IF NOT EXISTS idx_share_events_resource
+				 ON ${SHARE_EVENTS_TABLE} (app, kind, resource_id, event_id DESC)`,
+    // "Everything this person was ever given" — the offboarding question.
+    `CREATE INDEX IF NOT EXISTS idx_share_events_subject
+				 ON ${SHARE_EVENTS_TABLE} (subject_id, event_id DESC)`,
+];

package/dist/server/sharing/sql.js

@@ -26,7 +26,7 @@
  * tested with hostile input; a consumer never quotes anything itself.
  */
 import { levelsMeeting, normalizeSubjectId } from "cursedbelt-core/sharing/model";
-import { SHARE_GRANTS_TABLE, SHARE_GROUP_MEMBERS_TABLE } from "./migrations.js";
+import { SHARE_GRANTS_TABLE, SHARE_GROUP_MEMBERS_TABLE } from "./schema.js";
 /**
  * Quote a string as a SQL literal.
  *

package/dist/server/sharing/statements.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Every SQL statement the share stores run, and the row → shape mappers — ONE copy for both
+ * the `bun:sqlite` store (`./store.ts`) and the D1 store (`./d1.ts`).
+ *
+ * Two stores with two copies of "strongest first, then oldest" is two answers the day
+ * somebody edits one of them. So the stores differ only in HOW they execute (a synchronous
+ * transaction vs one atomic `batch()`), never in WHAT they ask. Driver-free on purpose: the
+ * D1 store runs on `workerd`.
+ */
+import type { ShareAction, ShareEvent, ShareGrant, ShareLevel } from "cursedbelt-core/sharing/model";
+export interface GrantRow {
+    app: string;
+    kind: string;
+    resource_id: string;
+    subject_type: "user" | "group";
+    subject_id: string;
+    level: ShareLevel;
+    granted_by: string;
+    granted_at: string;
+    note: string;
+}
+export interface EventRow {
+    event_id: number;
+    at: string;
+    action: ShareAction;
+    app: string | null;
+    kind: string | null;
+    resource_id: string | null;
+    subject_type: "user" | "group";
+    subject_id: string;
+    level: ShareLevel | null;
+    previous_level: ShareLevel | null;
+    actor: string;
+    note: string;
+}
+export interface GroupRow {
+    group_id: string;
+    name: string;
+    created_by: string;
+    created_at: string;
+    note: string;
+}
+export interface GroupMemberRow {
+    group_id: string;
+    subject_id: string;
+    added_by: string;
+    added_at: string;
+}
+export declare const toGrant: (row: GrantRow) => ShareGrant;
+export declare const toEvent: (row: EventRow) => ShareEvent;
+export declare const SHARE_SQL: {
+    /** Binds the eleven {@link EVENT_COLUMNS}. */
+    readonly insertEvent: "INSERT INTO share_events\n\t\t\t   (at, action, app, kind, resource_id, subject_type, subject_id, level, previous_level, actor, note)\n\t\t\t VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
+    readonly selectGrant: "SELECT * FROM share_grants WHERE app = ? AND kind = ? AND resource_id = ? AND subject_type = ? AND subject_id = ?";
+    /** Binds app, kind, resource_id, subject_type, subject_id, level, granted_by, granted_at, note. */
+    readonly upsertGrant: "INSERT INTO share_grants\n\t\t\t\t   (app, kind, resource_id, subject_type, subject_id, level, granted_by, granted_at, note)\n\t\t\t\t VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)\n\t\t\t\t ON CONFLICT (app, kind, resource_id, subject_type, subject_id)\n\t\t\t\t DO UPDATE SET level = excluded.level, granted_by = excluded.granted_by,\n\t\t\t\t               granted_at = excluded.granted_at, note = excluded.note";
+    readonly deleteGrant: "DELETE FROM share_grants WHERE app = ? AND kind = ? AND resource_id = ? AND subject_type = ? AND subject_id = ?";
+    readonly selectResourceGrants: "SELECT * FROM share_grants WHERE app = ? AND kind = ? AND resource_id = ?";
+    readonly deleteResourceGrants: "DELETE FROM share_grants WHERE app = ? AND kind = ? AND resource_id = ?";
+    readonly selectSubjectGrants: "SELECT * FROM share_grants WHERE app = ? AND subject_type = ? AND subject_id = ?";
+    readonly deleteSubjectGrants: "DELETE FROM share_grants WHERE app = ? AND subject_type = ? AND subject_id = ?";
+    readonly selectGroupGrants: "SELECT * FROM share_grants WHERE app = ? AND subject_type = 'group' AND subject_id = ?";
+    readonly deleteGroupGrants: "DELETE FROM share_grants WHERE app = ? AND subject_type = 'group' AND subject_id = ?";
+    readonly listForResource: "SELECT * FROM share_grants\n\t\t\t\t\t WHERE app = ? AND kind = ? AND resource_id = ?\n\t\t\t\t\t -- Strongest first, then oldest. Spelled as a CASE rather than an\n\t\t\t\t\t -- ORDER BY on level, which happens to work only because 'write'\n\t\t\t\t\t -- sorts after 'read' and would silently mis-order a third level.\n\t\t\t\t\t ORDER BY CASE level WHEN 'write' THEN 0 ELSE 1 END, granted_at ASC";
+    readonly listForSubject: "SELECT * FROM share_grants\n\t\t\t\t\t WHERE app = ? AND subject_type = ? AND subject_id = ?\n\t\t\t\t\t ORDER BY granted_at DESC";
+    /** Binds app, kind, resource_id, then the viewer twice. */
+    readonly accessFor: "SELECT level FROM share_grants\n\t\t\t\t\t WHERE app = ? AND kind = ? AND resource_id = ?\n\t\t\t\t\t   AND ( (subject_type = 'user' AND subject_id = ?)\n\t\t      OR (subject_type = 'group' AND subject_id IN\n\t\t          (SELECT group_id FROM share_group_members WHERE subject_id = ?)) )";
+    /** Binds app, kind, each of `levelCount` levels, then the viewer twice. */
+    readonly resourceIdsFor: (levelCount: number) => string;
+    readonly upsertGroup: "INSERT INTO share_groups (group_id, name, created_by, created_at, note)\n\t\t\t\t\t VALUES (?, ?, ?, ?, ?)\n\t\t\t\t\t ON CONFLICT (group_id) DO UPDATE SET name = excluded.name, note = excluded.note";
+    readonly renameGroup: "UPDATE share_groups SET name = ? WHERE group_id = ?";
+    readonly deleteGroup: "DELETE FROM share_groups WHERE group_id = ?";
+    readonly listGroups: "SELECT * FROM share_groups ORDER BY name";
+    readonly insertMember: "INSERT INTO share_group_members (group_id, subject_id, added_by, added_at)\n\t\t\t\t\t VALUES (?, ?, ?, ?) ON CONFLICT (group_id, subject_id) DO NOTHING";
+    readonly deleteMember: "DELETE FROM share_group_members WHERE group_id = ? AND subject_id = ?";
+    readonly listMembers: "SELECT * FROM share_group_members WHERE group_id = ? ORDER BY subject_id";
+    readonly groupIdsFor: "SELECT group_id FROM share_group_members WHERE subject_id = ? ORDER BY group_id";
+    /** The trail, newest first, under a WHERE built by {@link eventsWhere}; binds its params then the limit. */
+    readonly events: (where: string) => string;
+    /**
+     * The grant's event, read from the grant as it stands BEFORE the upsert that follows it in
+     * the same batch: `regrade` (with the old level) when the level changes, `grant` otherwise.
+     * Binds at, level, app, kind, resource_id, subject_type, subject_id, level, level, actor,
+     * note, then the five {@link ONE_GRANT} keys.
+     */
+    readonly insertGrantEvent: `INSERT INTO share_events (at, action, app, kind, resource_id, subject_type, subject_id, level, previous_level, actor, note)
+\t\t\t SELECT ?, CASE WHEN g.level IS NOT NULL AND g.level <> ? THEN 'regrade' ELSE 'grant' END,
+\t\t\t        ?, ?, ?, ?, ?, ?,
+\t\t\t        CASE WHEN g.level <> ? THEN g.level ELSE NULL END, ?, ?
+\t\t\t   FROM (SELECT 1) AS one
+\t\t\t   LEFT JOIN share_grants AS g ON g.${string}
+\t\t\t RETURNING *`;
+    /**
+     * One `revoke` event per grant matching `where`, oldest grant first — written BEFORE the
+     * delete that follows it in the same batch. Binds at, actor, note, then `where`'s params.
+     */
+    readonly insertRevokeEvents: (where: string) => string;
+    readonly oneGrant: "app = ? AND kind = ? AND resource_id = ? AND subject_type = ? AND subject_id = ?";
+    readonly resourceGrants: "app = ? AND kind = ? AND resource_id = ?";
+    readonly subjectGrants: "app = ? AND subject_type = ? AND subject_id = ?";
+    readonly groupGrants: "app = ? AND subject_type = 'group' AND subject_id = ?";
+};
+/** The trail's WHERE and its params, bound to one app — the filter both stores apply. */
+export declare function eventsWhere(app: string, query: {
+    kind?: string;
+    id?: string;
+    subject?: {
+        type: string;
+        id: string;
+    };
+}): {
+    where: string;
+    params: (string | number)[];
+};
+/** Newest first, capped: default 200, never more than 1000, never less than 1. */
+export declare const eventLimit: (limit: number | undefined) => number;

package/dist/server/sharing/statements.js

@@ -0,0 +1,139 @@
+import { SHARE_EVENTS_TABLE, SHARE_GRANTS_TABLE, SHARE_GROUPS_TABLE, SHARE_GROUP_MEMBERS_TABLE } from "./schema.js";
+export const toGrant = (row) => ({
+    resource: { app: row.app, kind: row.kind, id: row.resource_id },
+    subject: { type: row.subject_type, id: row.subject_id },
+    level: row.level,
+    grantedBy: row.granted_by,
+    grantedAt: row.granted_at,
+    note: row.note,
+});
+export const toEvent = (row) => ({
+    id: row.event_id,
+    at: row.at,
+    action: row.action,
+    resource: row.app === null || row.kind === null || row.resource_id === null
+        ? null
+        : { app: row.app, kind: row.kind, id: row.resource_id },
+    subject: { type: row.subject_type, id: row.subject_id },
+    level: row.level,
+    previousLevel: row.previous_level,
+    actor: row.actor,
+    note: row.note,
+});
+/** The audit trail's columns, in the order every event insert binds them. */
+const EVENT_COLUMNS = "(at, action, app, kind, resource_id, subject_type, subject_id, level, previous_level, actor, note)";
+/** One grant row's WHERE — the five columns of its UNIQUE key. */
+const ONE_GRANT = "app = ? AND kind = ? AND resource_id = ? AND subject_type = ? AND subject_id = ?";
+const RESOURCE_GRANTS = "app = ? AND kind = ? AND resource_id = ?";
+const SUBJECT_GRANTS = "app = ? AND subject_type = ? AND subject_id = ?";
+const GROUP_GRANTS = "app = ? AND subject_type = 'group' AND subject_id = ?";
+/** "This viewer, directly or through any group they are in" — binds `subjectId` twice. */
+const VIEWER_MATCH = `( (subject_type = 'user' AND subject_id = ?)
+		      OR (subject_type = 'group' AND subject_id IN
+		          (SELECT group_id FROM ${SHARE_GROUP_MEMBERS_TABLE} WHERE subject_id = ?)) )`;
+export const SHARE_SQL = {
+    /** Binds the eleven {@link EVENT_COLUMNS}. */
+    insertEvent: `INSERT INTO ${SHARE_EVENTS_TABLE}
+			   ${EVENT_COLUMNS}
+			 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    selectGrant: `SELECT * FROM ${SHARE_GRANTS_TABLE} WHERE ${ONE_GRANT}`,
+    /** Binds app, kind, resource_id, subject_type, subject_id, level, granted_by, granted_at, note. */
+    upsertGrant: `INSERT INTO ${SHARE_GRANTS_TABLE}
+				   (app, kind, resource_id, subject_type, subject_id, level, granted_by, granted_at, note)
+				 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+				 ON CONFLICT (app, kind, resource_id, subject_type, subject_id)
+				 DO UPDATE SET level = excluded.level, granted_by = excluded.granted_by,
+				               granted_at = excluded.granted_at, note = excluded.note`,
+    deleteGrant: `DELETE FROM ${SHARE_GRANTS_TABLE} WHERE ${ONE_GRANT}`,
+    selectResourceGrants: `SELECT * FROM ${SHARE_GRANTS_TABLE} WHERE ${RESOURCE_GRANTS}`,
+    deleteResourceGrants: `DELETE FROM ${SHARE_GRANTS_TABLE} WHERE ${RESOURCE_GRANTS}`,
+    selectSubjectGrants: `SELECT * FROM ${SHARE_GRANTS_TABLE} WHERE ${SUBJECT_GRANTS}`,
+    deleteSubjectGrants: `DELETE FROM ${SHARE_GRANTS_TABLE} WHERE ${SUBJECT_GRANTS}`,
+    selectGroupGrants: `SELECT * FROM ${SHARE_GRANTS_TABLE} WHERE ${GROUP_GRANTS}`,
+    deleteGroupGrants: `DELETE FROM ${SHARE_GRANTS_TABLE} WHERE ${GROUP_GRANTS}`,
+    listForResource: `SELECT * FROM ${SHARE_GRANTS_TABLE}
+					 WHERE ${RESOURCE_GRANTS}
+					 -- Strongest first, then oldest. Spelled as a CASE rather than an
+					 -- ORDER BY on level, which happens to work only because 'write'
+					 -- sorts after 'read' and would silently mis-order a third level.
+					 ORDER BY CASE level WHEN 'write' THEN 0 ELSE 1 END, granted_at ASC`,
+    listForSubject: `SELECT * FROM ${SHARE_GRANTS_TABLE}
+					 WHERE ${SUBJECT_GRANTS}
+					 ORDER BY granted_at DESC`,
+    /** Binds app, kind, resource_id, then the viewer twice. */
+    accessFor: `SELECT level FROM ${SHARE_GRANTS_TABLE}
+					 WHERE ${RESOURCE_GRANTS}
+					   AND ${VIEWER_MATCH}`,
+    /** Binds app, kind, each of `levelCount` levels, then the viewer twice. */
+    resourceIdsFor: (levelCount) => `SELECT DISTINCT resource_id FROM ${SHARE_GRANTS_TABLE}
+					 WHERE app = ? AND kind = ? AND level IN (${Array.from({ length: levelCount }, () => "?").join(", ")})
+					   AND ${VIEWER_MATCH}
+					 ORDER BY resource_id`,
+    upsertGroup: `INSERT INTO ${SHARE_GROUPS_TABLE} (group_id, name, created_by, created_at, note)
+					 VALUES (?, ?, ?, ?, ?)
+					 ON CONFLICT (group_id) DO UPDATE SET name = excluded.name, note = excluded.note`,
+    renameGroup: `UPDATE ${SHARE_GROUPS_TABLE} SET name = ? WHERE group_id = ?`,
+    deleteGroup: `DELETE FROM ${SHARE_GROUPS_TABLE} WHERE group_id = ?`,
+    listGroups: `SELECT * FROM ${SHARE_GROUPS_TABLE} ORDER BY name`,
+    insertMember: `INSERT INTO ${SHARE_GROUP_MEMBERS_TABLE} (group_id, subject_id, added_by, added_at)
+					 VALUES (?, ?, ?, ?) ON CONFLICT (group_id, subject_id) DO NOTHING`,
+    deleteMember: `DELETE FROM ${SHARE_GROUP_MEMBERS_TABLE} WHERE group_id = ? AND subject_id = ?`,
+    listMembers: `SELECT * FROM ${SHARE_GROUP_MEMBERS_TABLE} WHERE group_id = ? ORDER BY subject_id`,
+    groupIdsFor: `SELECT group_id FROM ${SHARE_GROUP_MEMBERS_TABLE} WHERE subject_id = ? ORDER BY group_id`,
+    /** The trail, newest first, under a WHERE built by {@link eventsWhere}; binds its params then the limit. */
+    events: (where) => `SELECT * FROM ${SHARE_EVENTS_TABLE} WHERE ${where} ORDER BY event_id DESC LIMIT ?`,
+    // ── The D1 store's atomic forms ────────────────────────────────────────────────────────
+    // D1 has no interactive transaction, so "read the grant, then decide what to log" cannot
+    // be two round trips without a window between them. These write the audit row FROM the
+    // grant row inside one `batch()`, so the decision and the write are one atomic step. They
+    // are listed here beside the sync forms they must agree with — `d1.spec.ts` runs both
+    // stores through one scenario and compares every table.
+    /**
+     * The grant's event, read from the grant as it stands BEFORE the upsert that follows it in
+     * the same batch: `regrade` (with the old level) when the level changes, `grant` otherwise.
+     * Binds at, level, app, kind, resource_id, subject_type, subject_id, level, level, actor,
+     * note, then the five {@link ONE_GRANT} keys.
+     */
+    insertGrantEvent: `INSERT INTO ${SHARE_EVENTS_TABLE} ${EVENT_COLUMNS}
+			 SELECT ?, CASE WHEN g.level IS NOT NULL AND g.level <> ? THEN 'regrade' ELSE 'grant' END,
+			        ?, ?, ?, ?, ?, ?,
+			        CASE WHEN g.level <> ? THEN g.level ELSE NULL END, ?, ?
+			   FROM (SELECT 1) AS one
+			   LEFT JOIN ${SHARE_GRANTS_TABLE} AS g ON g.${ONE_GRANT.replaceAll(" AND ", " AND g.")}
+			 RETURNING *`,
+    /**
+     * One `revoke` event per grant matching `where`, oldest grant first — written BEFORE the
+     * delete that follows it in the same batch. Binds at, actor, note, then `where`'s params.
+     */
+    insertRevokeEvents: (where) => `INSERT INTO ${SHARE_EVENTS_TABLE} ${EVENT_COLUMNS}
+			 SELECT ?, 'revoke', app, kind, resource_id, subject_type, subject_id, level, NULL, ?, ?
+			   FROM ${SHARE_GRANTS_TABLE} WHERE ${where} ORDER BY grant_id
+			 RETURNING *`,
+    oneGrant: ONE_GRANT,
+    resourceGrants: RESOURCE_GRANTS,
+    subjectGrants: SUBJECT_GRANTS,
+    groupGrants: GROUP_GRANTS,
+};
+/** The trail's WHERE and its params, bound to one app — the filter both stores apply. */
+export function eventsWhere(app, query) {
+    const clauses = ["app IS NULL OR app = ?"];
+    const params = [app];
+    if (query.kind !== undefined) {
+        clauses.push("kind = ?");
+        params.push(query.kind);
+    }
+    if (query.id !== undefined) {
+        clauses.push("resource_id = ?");
+        params.push(query.id);
+    }
+    if (query.subject) {
+        clauses.push("subject_type = ? AND subject_id = ?");
+        params.push(query.subject.type, query.subject.id);
+    }
+    return {
+        where: clauses.map((clause) => `(${clause})`).join(" AND "),
+        params,
+    };
+}
+/** Newest first, capped: default 200, never more than 1000, never less than 1. */
+export const eventLimit = (limit) => Math.max(1, Math.min(limit ?? 200, 1000));

package/dist/server/sharing/store.d.ts

@@ -34,15 +34,9 @@
  */
 import type { Database } from "bun:sqlite";
 import { type ShareAccess, type ShareEvent, type ShareGrant, type ShareGroup, type ShareGroupMember, type ShareLevel, type ShareSubject, type ShareViewer } from "cursedbelt-core/sharing/model";
-/** Shorthand for the common subject. `group(id)` is its sibling. */
-export declare const user: (id: string) => ShareSubject;
-export declare const group: (id: string) => ShareSubject;
-/** A resource within the store's own app — the `app` half is supplied by the
- *  store, so a caller cannot mistakenly write a grant into another app's rows. */
-export interface ShareTarget {
-    kind: string;
-    id: string;
-}
+import type { GrantInput, RevokeInput, ShareEventQuery, ShareTarget } from "./contract.js";
+export { group, user } from "./contract.js";
+export type { GrantInput, RevokeInput, ShareEventQuery, ShareTarget } from "./contract.js";
 export interface ShareStoreOptions {
     db: Database;
     /** The satellite this store speaks for. Fixed at construction so `app` cannot
@@ -66,25 +60,6 @@ export interface ShareStoreOptions {
     /** Injectable clock, for tests that assert ordering. ISO-8601 strings. */
     now?: () => string;
 }
-export interface GrantInput extends ShareTarget {
-    subject: ShareSubject;
-    level: ShareLevel;
-    grantedBy: string;
-    note?: string;
-}
-export interface RevokeInput extends ShareTarget {
-    subject: ShareSubject;
-    revokedBy: string;
-    note?: string;
-}
-export interface ShareEventQuery {
-    kind?: string;
-    id?: string;
-    subject?: ShareSubject;
-    /** Newest first, capped. Default 200 — a panel shows a page, and an unbounded
-     *  audit read on a busy resource is the query that times out in production. */
-    limit?: number;
-}
 export type ShareStore = ReturnType<typeof createShareStore>;
 /**
  * Open (and migrate) the sharing tables in this database, returning the store.